@k2b/cloud 0.24.0 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -39,6 +39,7 @@
     "./browser/search": "./src/browser/search.ts",
     "./browser/testing": "./src/browser/testing.ts",
     "./browser/resource-picker": "./src/browser/resource-picker.tsx",
+    "./browser/files": "./src/browser/files.tsx",
     "./capabilities": "./src/capabilities/client.ts",
     "./capabilities/server": "./src/capabilities/server.ts",
     "./capabilities/store": "./src/capabilities/executions.ts",
@@ -99,7 +100,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.1",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.14.0",
+    "@k2b/ui": "0.15.0",
     "@k2b/stdlib": "0.27.0",
     "@k2b/sync": "7.0.0",
     "@nats-io/jetstream": "3.4.0",

package/src/access/PermissionEditor.tsx

@@ -4,6 +4,7 @@ import { createSignal, For, Show } from "solid-js";
 import { CloudAvatar } from "../account/Avatar";
 import type { AccessEntry, PermissionLevel, Principal, ServiceAccountKind } from "../contracts/shared";
 import { groupDisplayName } from "../shared/account-display";
+import { isManagerEntry } from "./managers";
 import { accessMessages } from "./messages";
 import PrincipalPicker from "./PrincipalPicker";
 import { serviceAccountKindDisplay } from "./service-account-kind";
@@ -43,8 +44,10 @@ type PermissionEditorProps = {
   /** Update an existing entry's permission level. */
   updateAccess: (accessId: string, permission: GrantableLevel) => Promise<void>;
 
-  /** Revoke an existing entry. The last entry IS deletable — for
-   *  hierarchical resources the parent ACL still applies. */
+  /** Revoke an existing entry. Any entry can be revoked except the last
+   *  manager: once exactly one entry manages the resource (`admin` for a
+   *  person, group, all signed-in users, or a standalone or agent service
+   *  account), its row can neither be lowered nor removed. */
   revokeAccess: (accessId: string) => Promise<void>;
 
   /** Allow granting `public` access from this editor. */
@@ -120,9 +123,10 @@ const resolveEntryDisplay = (
 };
 
 const getEntryDisplayName = (entry: AccessEntry, t: ReturnType<typeof accessMessages.resolve>["t"], locale: string): string => {
-  if (entry.displayName) return entry.principal.type === "group" ? groupDisplayName(entry.displayName, locale) : entry.displayName;
+  // Audiences always use the localized label; a server-supplied name is not translated.
   if (entry.principal.type === "authenticated") return t.allUsers;
   if (entry.principal.type === "public") return t.public;
+  if (entry.displayName) return entry.principal.type === "group" ? groupDisplayName(entry.displayName, locale) : entry.displayName;
   if (entry.principal.type === "user") return entry.principal.userId;
   if (entry.principal.type === "service_account") return entry.principal.serviceAccountId;
   return entry.principal.groupId;
@@ -209,6 +213,11 @@ export default function PermissionEditor(props: PermissionEditorProps) {
     onError: (err) => prompts.error(err.message),
   });
   const busy = () => grantMut.loading() || updateMut.loading() || revokeMut.loading();
+  // The service refuses to remove the last manager; the row says so up front.
+  const lastManagerId = () => {
+    const managers = entries().filter(isManagerEntry);
+    return managers.length === 1 ? managers[0]!.id : null;
+  };
 
   return (
     <div class="flex flex-col gap-3">
@@ -220,6 +229,7 @@ export default function PermissionEditor(props: PermissionEditorProps) {
               entry={entry}
               canEdit={canEdit()}
               disabled={busy()}
+              lastManager={entry.id === lastManagerId()}
               allowed={allowed(entry.principal)}
               singlePicker={allowed(entry.principal).length === 1}
               onUpdatePermission={(permission) => {
@@ -264,6 +274,8 @@ function AccessEntryRow(props: {
   entry: AccessEntry;
   canEdit: boolean;
   disabled: boolean;
+  /** The only entry that manages the resource: it keeps its level and cannot be removed. */
+  lastManager: boolean;
   allowed: ResolvedLevel[];
   /** When true the per-row picker collapses to a non-interactive badge
    *  (single-level mode — there's nothing to switch to). */
@@ -275,6 +287,8 @@ function AccessEntryRow(props: {
   const t = () => accessMessages.resolve([locale()]).t;
   const displayName = () => getEntryDisplayName(props.entry, t(), locale());
   const display = () => resolveEntryDisplay(props.entry.permission, props.allowed, t());
+  const manageLabel = () => resolveEntryDisplay("admin", props.allowed, t()).label;
+  const removeLabel = () => (props.lastManager ? t().lastManager({ level: manageLabel() }) : t().remove({ name: displayName() }));
   const isInteractive = () =>
     props.canEdit && !props.disabled && !props.singlePicker && props.allowed.some((option) => option.level === props.entry.permission);
 
@@ -334,11 +348,16 @@ function AccessEntryRow(props: {
         <SelectChip
           aria-label={t().permissionFor({ name: displayName() })}
           value={() => props.entry.permission as GrantableLevel}
-          options={props.allowed.map((option) => ({
-            value: option.level,
-            label: option.label,
-            icon: `ti ${option.icon}`,
-          }))}
+          options={props.allowed.map((option) => {
+            const locked = props.lastManager && option.level !== "admin";
+            return {
+              value: option.level,
+              label: option.label,
+              icon: `ti ${option.icon}`,
+              disabled: locked,
+              description: locked ? t().lastManagerOption({ level: manageLabel() }) : undefined,
+            };
+          })}
           icon={`ti ${display().icon}`}
           position="bottom-left"
           onValueChange={(permission) => {
@@ -351,7 +370,7 @@ function AccessEntryRow(props: {
           remain keyboard reachable and stay visible on touch-sized layouts. */}
       <Show when={props.canEdit}>
         <Tooltip.Anchor
-          content={t().remove({ name: displayName() })}
+          content={removeLabel()}
           class="shrink-0 opacity-100 transition-opacity sm:opacity-0 sm:group-hover/access-row:opacity-100 sm:group-focus-within/access-row:opacity-100"
         >
           <IconButton
@@ -360,9 +379,11 @@ function AccessEntryRow(props: {
             variant="ghost"
             size="xs"
             onClick={props.onRevoke}
-            disabled={props.disabled}
+            disabled={props.disabled || props.lastManager}
             aria-label={t().remove({ name: displayName() })}
-            class="focus-ui flex h-7 w-7 items-center justify-center rounded text-zinc-400 transition-colors hover:bg-red-500/[0.08] hover:text-red-600 focus:opacity-100 dark:hover:text-red-400"
+            // A disabled button takes no focus and touch has no hover, so the reason also reaches assistive technology.
+            aria-description={props.lastManager ? removeLabel() : undefined}
+            class="focus-ui flex h-7 w-7 items-center justify-center rounded text-zinc-400 transition-colors focus:opacity-100 enabled:hover:bg-red-500/[0.08] enabled:hover:text-red-600 dark:enabled:hover:text-red-400"
           >
             <i class="ti ti-x text-sm" />
           </IconButton>

package/src/access/managers.ts

@@ -0,0 +1,32 @@
+import type { PermissionLevel, Principal, ServiceAccountKind } from "../contracts/shared";
+
+/** The fields of an access entry that decide whether it manages its resource. */
+export type ManagerCandidate = {
+  principal: Principal;
+  permission: PermissionLevel;
+  serviceAccountKind?: ServiceAccountKind | null;
+};
+
+/**
+ * Whether an entry keeps its resource manageable: `admin` for a user, a group,
+ * all signed-in users, or a standalone or agent service account. Public access
+ * never counts, and neither do resource-bound or user-delegated keys: they
+ * disappear with their key or their user without passing the resource's rules.
+ */
+export const isManagerEntry = (entry: ManagerCandidate): boolean => {
+  if (entry.permission !== "admin") return false;
+  switch (entry.principal.type) {
+    case "user":
+    case "group":
+    case "authenticated":
+      return true;
+    case "service_account":
+      return entry.serviceAccountKind === "standalone" || entry.serviceAccountKind === "agent";
+    case "public":
+      return false;
+  }
+};
+
+/** Whether a change from `before` to `after` takes a resource from at least one manager to none. */
+export const removesLastManager = (before: readonly ManagerCandidate[], after: readonly ManagerCandidate[]): boolean =>
+  before.some(isManagerEntry) && !after.some(isManagerEntry);

package/src/access/messages.ts

@@ -26,6 +26,9 @@ export const accessMessages = i18n.define({
       anyoneWithLink: "Anyone with the link",
       permissionFor: ({ name }: { name: string }) => `Permission for ${name}`,
       remove: ({ name }: { name: string }) => `Remove ${name}`,
+      lastManager: ({ level }: { level: string }) =>
+        `The last entry with “${level}” access can't be lowered or removed. Give another person or group “${level}” access first.`,
+      lastManagerOption: ({ level }: { level: string }) => `Available once another person or group has “${level}” access`,
       read: "Read",
       readDescription: "Read this resource through the app API.",
       write: "Write",
@@ -86,6 +89,9 @@ export const accessMessages = i18n.define({
       anyoneWithLink: "Alle mit dem Link",
       permissionFor: ({ name }) => `Berechtigung für ${name}`,
       remove: ({ name }) => `${name} entfernen`,
+      lastManager: ({ level }) =>
+        `Der letzte Eintrag mit Zugriff „${level}“ kann nicht herabgestuft oder entfernt werden. Gib zuerst einer anderen Person oder Gruppe Zugriff „${level}“.`,
+      lastManagerOption: ({ level }) => `Möglich, sobald eine weitere Person oder Gruppe Zugriff „${level}“ hat`,
       read: "Lesen",
       readDescription: "Diese Ressource über die App-API lesen.",
       write: "Schreiben",

package/src/ai/memory-learning.ts

@@ -16,6 +16,7 @@ import {
   listAiTurnWorkflowEvidence,
   markAiWorkflowPatternReviewed,
 } from "./memory-workflow-evidence";
+import { AI_MEMORY_LEARNING_DEFAULT_ENABLED, aiUserPrefs } from "./prefs";
 import { aiConversations } from "./store";
 import type { RunAiStructuredInput, RunAiStructuredResult } from "./structured";
 import { resolveAiBackgroundModel, runAiStructured } from "./structured";
@@ -148,11 +149,11 @@ export const listAiMemoryLearningCandidates = async (limit: number, monthlyToken
         ) AS user_rank
       FROM ai.turns turn
       JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
-      JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
+      LEFT JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
       LEFT JOIN monthly_usage usage ON usage.user_id = conversation.created_by_user_id
       WHERE conversation.created_by_user_id IS NOT NULL
         AND conversation.archived_at IS NULL
-        AND prefs.memory_learning_enabled = TRUE
+        AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
         AND turn.status = 'completed'
         AND COALESCE(turn.run_config->>'kind', 'chat') = 'chat'
         AND turn.memory_learned_at IS NULL
@@ -196,14 +197,7 @@ const markFailed = async (candidate: Candidate): Promise<void> => {
   `;
 };
 
-const learningEnabled = async (userId: string): Promise<boolean> => {
-  const [row] = await sql<{ enabled: boolean }[]>`
-    SELECT COALESCE(memory_learning_enabled, FALSE) AS enabled
-    FROM ai.user_prefs
-    WHERE user_id = ${userId}::uuid
-  `;
-  return Boolean(row?.enabled);
-};
+const learningEnabled = async (userId: string): Promise<boolean> => (await aiUserPrefs.get(userId)).memoryLearningEnabled;
 
 const monthlyAccountedTokens = async (userId: string): Promise<number> => {
   const [row] = await sql<{ tokens: number }[]>`
@@ -447,7 +441,6 @@ export const learnAiMemoriesFromPrivateChats = async (
     let runId: string | null = null;
     let changes: AiMemoryLearningChange[] = [];
     try {
-      if (!(await learningEnabled(candidate.userId))) continue;
       const evidence = await loadTurnEvidence(candidate);
       if (!evidence.userText) {
         await markLearned(candidate);
@@ -465,6 +458,8 @@ export const learnAiMemoriesFromPrivateChats = async (
       });
       const reservedTokens = estimatedTokens(systemPrompt, taskInput);
       if ((await readMonthlyUsage(candidate.userId)) + reservedTokens > monthlyTokenBudget) continue;
+      // Read the choice again right before the turn can reach the model.
+      if (!(await learningEnabled(candidate.userId))) continue;
       runId = await aiMemoryLearningRuns.start({
         userId: candidate.userId,
         conversationId: candidate.conversationId,
@@ -550,7 +545,6 @@ export const learnAiMemoriesFromPrivateChats = async (
     let runId: string | null = null;
     const startedAt = Date.now();
     try {
-      if (!(await learningEnabled(pattern.userId))) continue;
       const context = await workflowPatternInput(pattern);
       if (!context.source) {
         await markAiWorkflowPatternReviewed(pattern);
@@ -564,6 +558,7 @@ export const learnAiMemoriesFromPrivateChats = async (
       });
       const reservedTokens = estimatedTokens(workflowPrompt, context.input);
       if ((await readMonthlyUsage(pattern.userId)) + reservedTokens > monthlyTokenBudget) continue;
+      if (!(await learningEnabled(pattern.userId))) continue;
       runId = await aiMemoryLearningRuns.start({
         userId: pattern.userId,
         conversationId: context.source.candidate.conversationId,

package/src/ai/memory-workflow-evidence.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import { type CloudResourceRef, CloudResourceRefSchema } from "../contracts/capabilities";
+import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 
 const MAX_RECEIPT_RESOURCES = 20;
 const MAX_CAPABILITY_ID_CHARS = 180;
@@ -22,7 +23,11 @@ export type AiMemoryWorkflowPattern = {
   turnIds: string[];
 };
 
-/** Persist only successful, schema-valid capability/resource receipts. */
+/**
+ * Persist only successful, schema-valid capability/resource receipts, and only
+ * while learning is on for the user: receipts from a time it was off never
+ * count toward a workflow pattern.
+ */
 export const recordAiMemoryWorkflowEvidence = async (input: {
   userId: string;
   conversationId: string;
@@ -61,9 +66,11 @@ export const recordAiMemoryWorkflowEvidence = async (input: {
           ${resource.ref.type}, ${resource.ref.id}, ${resource.title ?? null}
         FROM ai.turns turn
         JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
+        LEFT JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
         WHERE turn.id = ${input.turnId}::uuid
           AND conversation.id = ${input.conversationId}::uuid
           AND conversation.created_by_user_id = ${input.userId}::uuid
+          AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
         ON CONFLICT (turn_id, capability_id, resource_type, resource_id)
         DO UPDATE SET resource_title = COALESCE(EXCLUDED.resource_title, ai.memory_workflow_evidence.resource_title)
       `;
@@ -116,10 +123,11 @@ export const listAiPendingWorkflowPatterns = async (limit = 5): Promise<AiMemory
              FILTER (WHERE evidence.resource_title IS NOT NULL))[1] AS resource_title,
            count(*)::int AS observation_count
     FROM ai.memory_workflow_evidence evidence
-    JOIN ai.user_prefs prefs ON prefs.user_id = evidence.user_id AND prefs.memory_learning_enabled = TRUE
+    LEFT JOIN ai.user_prefs prefs ON prefs.user_id = evidence.user_id
     JOIN ai.conversations conversation
       ON conversation.id = evidence.conversation_id AND conversation.created_by_user_id = evidence.user_id
     WHERE evidence.reviewed_at IS NULL
+      AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
     GROUP BY evidence.user_id, evidence.capability_id, evidence.resource_type, evidence.resource_id
     HAVING count(*) >= 3
     ORDER BY min(evidence.observed_at), evidence.user_id, evidence.capability_id, evidence.resource_type, evidence.resource_id

package/src/ai/migrate.ts

@@ -951,7 +951,7 @@ export const migrateCloudAi = async (): Promise<void> => {
     CREATE TABLE IF NOT EXISTS ai.user_prefs (
       user_id UUID PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
       memory_enabled BOOLEAN NOT NULL DEFAULT TRUE,
-      memory_learning_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+      memory_learning_enabled BOOLEAN,
       updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
     )
   `.simple();
@@ -960,7 +960,16 @@ export const migrateCloudAi = async (): Promise<void> => {
   // memory blob. Deliberately discard it instead of migrating ambiguous lines.
   await sql`ALTER TABLE ai.user_prefs DROP COLUMN IF EXISTS memory`.simple();
   await sql`ALTER TABLE ai.user_prefs DROP COLUMN IF EXISTS instructions`.simple();
-  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS memory_learning_enabled BOOLEAN NOT NULL DEFAULT FALSE`.simple();
+  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS memory_learning_enabled BOOLEAN`.simple();
+  // NULL means the user never chose, so the default (on) applies. Earlier
+  // releases stored FALSE for every new row, and an explicit "off" looks the
+  // same, so existing FALSE rows stay as they are rather than being switched on.
+  // memory_learning_chosen_at, added below, tells later explicit choices apart.
+  await sql`
+    ALTER TABLE ai.user_prefs
+      ALTER COLUMN memory_learning_enabled DROP NOT NULL,
+      ALTER COLUMN memory_learning_enabled DROP DEFAULT
+  `.simple();
 
   // Last model the user actually ran a turn with — preselected for new chats.
   await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS last_model_id TEXT NOT NULL DEFAULT ''`.simple();
@@ -1125,6 +1134,40 @@ export const migrateCloudAi = async (): Promise<void> => {
     WHERE reviewed_at IS NULL
   `.simple();
 
+  // Learning considers only turns that finish while it is on: completeTurn marks
+  // the others, and receipts are recorded only while it is on. When learning
+  // became the default, every earlier turn and receipt of a person without an
+  // explicit "on" came from a time it was off, so they are marked as considered
+  // exactly once, when the column that records explicit choices is introduced.
+  await sql`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'ai' AND table_name = 'user_prefs' AND column_name = 'memory_learning_chosen_at'
+      ) THEN
+        ALTER TABLE ai.user_prefs ADD COLUMN memory_learning_chosen_at TIMESTAMPTZ;
+        UPDATE ai.turns turn
+        SET memory_learned_at = COALESCE(turn.completed_at, turn.created_at)
+        FROM ai.conversations conversation
+        WHERE conversation.id = turn.conversation_id
+          AND turn.status = 'completed'
+          AND turn.memory_learned_at IS NULL
+          AND NOT EXISTS (
+            SELECT 1 FROM ai.user_prefs prefs
+            WHERE prefs.user_id = conversation.created_by_user_id AND prefs.memory_learning_enabled
+          );
+        UPDATE ai.memory_workflow_evidence evidence
+        SET reviewed_at = now()
+        WHERE evidence.reviewed_at IS NULL
+          AND NOT EXISTS (
+            SELECT 1 FROM ai.user_prefs prefs
+            WHERE prefs.user_id = evidence.user_id AND prefs.memory_learning_enabled
+          );
+      END IF;
+    END $$
+  `.simple();
+
   await sql`
     CREATE TABLE IF NOT EXISTS ai.memory_learning_runs (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),

package/src/ai/model-access.ts

@@ -114,13 +114,14 @@ export const aiModelAccess = {
         service_account_id: string | null;
         authenticated_only: boolean | null;
         display_name: string | null;
+        avatar_hash: string | null;
         service_account_kind: ServiceAccountKind | null;
       }[]
     >`
       SELECT resource.profile_id, resource.revision, access.id, access.created_at,
         access.user_id, access.group_id, access.service_account_id, access.authenticated_only,
-        COALESCE(users.display_name, groups.name, service_accounts.name) AS display_name,
-        service_accounts.kind AS service_account_kind
+        COALESCE(NULLIF(users.display_name, ''), users.uid, groups.name, service_accounts.name) AS display_name,
+        users.avatar_hash, service_accounts.kind AS service_account_kind
       FROM ai.model_access_resources resource LEFT JOIN ai.model_access model ON model.profile_id = resource.profile_id
       LEFT JOIN auth.access access ON access.id = model.access_id
       LEFT JOIN auth.users users ON users.id = access.user_id
@@ -148,6 +149,7 @@ export const aiModelAccess = {
         permission: "read",
         createdAt: row.created_at.toISOString(),
         ...(row.display_name ? { displayName: row.display_name } : {}),
+        ...(row.user_id ? { avatarHash: row.avatar_hash } : {}),
         ...(row.service_account_kind ? { serviceAccountKind: row.service_account_kind } : {}),
       });
     }

package/src/ai/prefs.ts

@@ -1,9 +1,16 @@
 import { sql } from "bun";
 import type { RequestActor } from "../server";
 
+/**
+ * Learning from private chats applies to everyone who has not chosen.
+ * A stored `NULL` means "never chose"; only an explicit save stores a boolean.
+ */
+export const AI_MEMORY_LEARNING_DEFAULT_ENABLED = true;
+
 export type AiUserPrefs = {
   userId: string;
   memoryEnabled: boolean;
+  /** Effective setting: the user's explicit choice, otherwise the default. */
   memoryLearningEnabled: boolean;
   /** Model profile id of the user's most recent chat turn — preselected for new chats. */
   lastModelId: string;
@@ -13,7 +20,7 @@ export type AiUserPrefs = {
 type PrefsRow = {
   user_id: string;
   memory_enabled: boolean;
-  memory_learning_enabled: boolean;
+  memory_learning_enabled: boolean | null;
   last_model_id: string | null;
   updated_at: string | Date;
 };
@@ -21,7 +28,7 @@ type PrefsRow = {
 const toPrefs = (row: PrefsRow): AiUserPrefs => ({
   userId: row.user_id,
   memoryEnabled: row.memory_enabled,
-  memoryLearningEnabled: row.memory_learning_enabled,
+  memoryLearningEnabled: row.memory_learning_enabled ?? AI_MEMORY_LEARNING_DEFAULT_ENABLED,
   lastModelId: row.last_model_id ?? "",
   updatedAt: new Date(row.updated_at).toISOString(),
 });
@@ -29,7 +36,7 @@ const toPrefs = (row: PrefsRow): AiUserPrefs => ({
 const emptyPrefs = (userId: string): AiUserPrefs => ({
   userId,
   memoryEnabled: true,
-  memoryLearningEnabled: false,
+  memoryLearningEnabled: AI_MEMORY_LEARNING_DEFAULT_ENABLED,
   lastModelId: "",
   updatedAt: new Date(0).toISOString(),
 });
@@ -56,13 +63,20 @@ export const aiUserPrefs = {
   ): Promise<AiUserPrefs> {
     const memoryEnabled = patch.memoryEnabled ?? null;
     const memoryLearningEnabled = patch.memoryLearningEnabled ?? null;
+    // Records when the person last saved the learning switch, so a stored "off"
+    // from an earlier release stays distinguishable from a choice made since.
+    const learningChosen = memoryLearningEnabled !== null;
     const lastModelId = patch.lastModelId?.trim().slice(0, 200) ?? null;
     const rows = (await sql`
-      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, last_model_id, updated_at)
-      VALUES (${userId}, ${memoryEnabled ?? true}, ${memoryLearningEnabled ?? false}, ${lastModelId ?? ""}, now())
+      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, memory_learning_chosen_at, last_model_id, updated_at)
+      VALUES (
+        ${userId}, ${memoryEnabled ?? true}, ${memoryLearningEnabled},
+        CASE WHEN ${learningChosen}::boolean THEN now() END, ${lastModelId ?? ""}, now()
+      )
       ON CONFLICT (user_id) DO UPDATE SET
         memory_enabled = COALESCE(${memoryEnabled}, ai.user_prefs.memory_enabled),
         memory_learning_enabled = COALESCE(${memoryLearningEnabled}, ai.user_prefs.memory_learning_enabled),
+        memory_learning_chosen_at = CASE WHEN ${learningChosen}::boolean THEN now() ELSE ai.user_prefs.memory_learning_chosen_at END,
         last_model_id = COALESCE(${lastModelId}, ai.user_prefs.last_model_id),
         updated_at = now()
       RETURNING *

package/src/ai/projects.ts

@@ -82,6 +82,7 @@ export type AiProjectAccess = {
   principal: Principal;
   permission: AiProjectPermission;
   displayName?: string;
+  avatarHash?: string | null;
   /** Kind of a `service_account` principal; presentation only. */
   serviceAccountKind?: ServiceAccountKind;
   createdAt: string;
@@ -157,6 +158,7 @@ type ProjectAccessRow = {
   permission: AiProjectPermission;
   created_at: Date | string;
   display_name: string | null;
+  avatar_hash: string | null;
   service_account_kind: ServiceAccountKind | null;
 };
 
@@ -260,6 +262,7 @@ const toProjectAccess = (row: ProjectAccessRow): AiProjectAccess => ({
           : { type: "public" },
   permission: row.permission,
   displayName: row.display_name ?? undefined,
+  ...(row.user_id ? { avatarHash: row.avatar_hash } : {}),
   serviceAccountKind: row.service_account_kind ?? undefined,
   createdAt: iso(row.created_at),
 });
@@ -290,9 +293,9 @@ const listProjectAccess = async (projectId: string, db: SQL = sql): Promise<AiPr
   const rows = await db<ProjectAccessRow[]>`
     SELECT project_access.short_id, access.user_id, access.group_id, access.service_account_id, access.authenticated_only,
            access.permission, access.created_at,
-           COALESCE(users.display_name, groups.name, service_accounts.name,
+           COALESCE(NULLIF(users.display_name, ''), users.uid, groups.name, service_accounts.name,
              CASE WHEN access.authenticated_only THEN 'All authenticated users' ELSE 'Public' END) AS display_name,
-           service_accounts.kind AS service_account_kind
+           users.avatar_hash, service_accounts.kind AS service_account_kind
     FROM ai.project_access project_access
     JOIN auth.access access ON access.id = project_access.access_id
     LEFT JOIN auth.users users ON users.id = access.user_id

package/src/ai/skills.ts

@@ -58,6 +58,7 @@ export type AiSkillAccess = {
   principal: Principal;
   permission: AiSkillPermission;
   displayName?: string;
+  avatarHash?: string | null;
   /** Kind of a `service_account` principal; presentation only. */
   serviceAccountKind?: ServiceAccountKind;
   createdAt: string;
@@ -130,6 +131,7 @@ type SkillAccessRow = {
   permission: AiSkillPermission;
   created_at: Date | string;
   display_name: string | null;
+  avatar_hash: string | null;
   service_account_kind: ServiceAccountKind | null;
 };
 
@@ -284,9 +286,9 @@ const listSkillAccess = async (skillId: string, db: SQL = sql): Promise<AiSkillA
   const rows = await db<SkillAccessRow[]>`
     SELECT skill_access.short_id, access.user_id, access.group_id, access.service_account_id, access.authenticated_only,
            access.permission, access.created_at,
-           COALESCE(users.display_name, groups.name, service_accounts.name,
+           COALESCE(NULLIF(users.display_name, ''), users.uid, groups.name, service_accounts.name,
              CASE WHEN access.authenticated_only THEN 'All authenticated users' ELSE 'Public' END) AS display_name,
-           service_accounts.kind AS service_account_kind
+           users.avatar_hash, service_accounts.kind AS service_account_kind
     FROM ai.skill_access skill_access
     JOIN auth.access access ON access.id = skill_access.access_id
     LEFT JOIN auth.users users ON users.id = access.user_id
@@ -309,6 +311,7 @@ const listSkillAccess = async (skillId: string, db: SQL = sql): Promise<AiSkillA
             : { type: "public" },
     permission: row.permission,
     displayName: row.display_name ?? undefined,
+    ...(row.user_id ? { avatarHash: row.avatar_hash } : {}),
     serviceAccountKind: row.service_account_kind ?? undefined,
     createdAt: iso(row.created_at),
   }));

package/src/ai/store.ts

@@ -4,6 +4,7 @@ import { type SQL, sql } from "bun";
 import { type CapabilityActionReview, CapabilityActionReviewSchema } from "../contracts/capabilities";
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
+import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 import type { AiTurnBlock } from "./protocol";
 import { withAiShortId, withAiShortIdForDb } from "./short-id";
 import { parseAiTodoPlan } from "./todo-contracts";
@@ -2801,6 +2802,19 @@ export const aiConversations: AiConversationService = {
             live_blocks = NULL
         WHERE id = ${input.turnId}
       `;
+      if (input.status === "completed") {
+        // Learning considers only turns that finish while it is on for the chat
+        // owner; turning it on later does not reach back to this turn.
+        await tx`
+          UPDATE ai.turns turn
+          SET memory_learned_at = turn.completed_at
+          FROM ai.conversations conversation
+          LEFT JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
+          WHERE turn.id = ${input.turnId}
+            AND conversation.id = turn.conversation_id
+            AND NOT COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
+        `;
+      }
       await tx`
         UPDATE ai.pending_actions
         SET status = 'aborted', resolved_at = COALESCE(resolved_at, now())