@k2b/cloud 0.25.0 → 0.27.0

package/src/ai/provider-fetch.ts

@@ -1,27 +1,63 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 
 /**
- * Dates the provider response headers and the first body byte of the inference
- * call that is currently streaming, without touching the wire. nessi adapters
- * call the global `fetch`; the wrapper is installed once, on first use, and
- * only observes requests made inside `runWithProviderFetchMarks`.
+ * Observes the provider request of the inference call that is currently
+ * running, without touching the wire: when its headers and first body byte
+ * arrived, whether the provider certainly did not process it, and how long a
+ * rejecting provider asked the caller to wait. nessi adapters call the global
+ * `fetch`; the wrapper is installed once, on first use, and only observes
+ * requests made inside `runWithProviderFetchMarks`. Scopes nest, so an outer
+ * retry policy and the inner per-call accounting each see the same request.
  *
  * Nothing here logs: frames may carry reasoning text and headers carry keys.
  */
-export type ProviderFetchMarks = { headersAt?: number; firstByteAt?: number };
+export type ProviderFetchMarks = {
+  headersAt?: number;
+  firstByteAt?: number;
+  /** The request never reached the provider, or the provider answered with a status that says it did not process it. */
+  refused?: boolean;
+  retryAfterMs?: number;
+};
 
-const marks = new AsyncLocalStorage<ProviderFetchMarks>();
+const scopes = new AsyncLocalStorage<readonly ProviderFetchMarks[]>();
 let installed = false;
 
 export const runWithProviderFetchMarks = <T>(store: ProviderFetchMarks, run: () => Promise<T>): Promise<T> => {
   install();
-  return marks.run(store, run);
+  return scopes.run([...(scopes.getStore() ?? []), store], run);
+};
+
+/** `retry-after-ms` (OpenAI) wins over the standard `retry-after` seconds or HTTP date. */
+export const retryAfterMs = (headers: Headers, now = Date.now()): number | undefined => {
+  const milliseconds = Number(headers.get("retry-after-ms")?.trim() || Number.NaN);
+  if (Number.isFinite(milliseconds) && milliseconds >= 0) return milliseconds;
+  const value = headers.get("retry-after")?.trim();
+  if (!value) return undefined;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return seconds >= 0 ? seconds * 1_000 : undefined;
+  const date = Date.parse(value);
+  return Number.isFinite(date) ? Math.max(0, date - now) : undefined;
 };
 
-const firstByteObserver = (store: ProviderFetchMarks) =>
+/**
+ * A client error, 503, or Anthropic's overloaded 529 says the provider did not
+ * process the request. Other server errors, such as a gateway's 502 or 504, can
+ * follow processing upstream.
+ */
+const refusedStatus = (status: number) => (status >= 400 && status < 500) || status === 503 || status === 529;
+
+/** Bun's codes for a request that never left: no connection, or no address for the host. */
+const unsentCodes = new Set(["ConnectionRefused", "ENOTFOUND"]);
+const unsent = (error: unknown) =>
+  typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && unsentCodes.has(error.code);
+
+const firstByteObserver = (stores: readonly ProviderFetchMarks[]) =>
   new TransformStream<Uint8Array, Uint8Array>({
     transform(chunk, controller) {
-      if (chunk.byteLength > 0 && store.firstByteAt === undefined) store.firstByteAt = Date.now();
+      if (chunk.byteLength > 0)
+        for (const store of stores) {
+          store.firstByteAt ??= Date.now();
+        }
       controller.enqueue(chunk);
     },
   });
@@ -31,13 +67,29 @@ const install = (): void => {
   installed = true;
   const realFetch = globalThis.fetch;
   const instrumented = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const store = marks.getStore();
-    // Only the first request of a call is the provider request; nessi retries create a new call.
-    if (store === undefined || store.headersAt !== undefined) return realFetch(input, init);
-    const response = await realFetch(input, init);
-    store.headersAt = Date.now();
+    // Only the first request of a scope is its provider request; a retry opens a new scope.
+    const stores = (scopes.getStore() ?? []).filter((store) => store.headersAt === undefined);
+    if (stores.length === 0) return realFetch(input, init);
+    let response: Response;
+    try {
+      response = await realFetch(input, init);
+    } catch (error) {
+      // A reset, an abort, or a timeout can follow delivery, so only an unsent request counts as refused.
+      if (unsent(error))
+        for (const store of stores) {
+          store.refused = true;
+        }
+      throw error;
+    }
+    const headersAt = Date.now();
+    const wait = response.ok ? undefined : retryAfterMs(response.headers, headersAt);
+    for (const store of stores) {
+      store.headersAt = headersAt;
+      store.refused = refusedStatus(response.status);
+      if (wait !== undefined) store.retryAfterMs = wait;
+    }
     if (!response.body) return response;
-    return new Response(response.body.pipeThrough(firstByteObserver(store)), {
+    return new Response(response.body.pipeThrough(firstByteObserver(stores)), {
       status: response.status,
       statusText: response.statusText,
       headers: response.headers,

package/src/ai/provider-retry.ts

@@ -0,0 +1,105 @@
+import { setTimeout as delay } from "node:timers/promises";
+import type { NessiIssue, Provider, ProviderIssue, StreamEvent, TimeoutIssue } from "@k2b/nessi/ai";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
+
+/** Waits before the first and the second retry when the provider names none. nessi itself never retries. */
+export const AI_PROVIDER_RETRY_DELAYS_MS: readonly number[] = [1_000, 4_000];
+
+/**
+ * The longest Retry-After that is honored, the bound the OpenAI and Anthropic
+ * SDKs apply. A provider that asks for a longer wait is unavailable for this
+ * turn, so the call fails now with the provider's message.
+ */
+const AI_PROVIDER_MAX_RETRY_AFTER_MS = 60_000;
+
+export type AiProviderRetry = {
+  /** 1 for the first retry. */
+  retry: number;
+  delayMs: number;
+  issue: ProviderIssue | TimeoutIssue;
+};
+
+const transientIssue = (issue: NessiIssue): issue is ProviderIssue | TimeoutIssue =>
+  (issue.kind === "provider_error" && issue.retryable && !issue.contextOverflow) ||
+  (issue.kind === "timeout" && issue.retryable && issue.scope !== "tool");
+
+const isBlockEvent = (event: StreamEvent) => event.type === "block_start" || event.type === "block_delta" || event.type === "block_end";
+
+/**
+ * Repeats a model call that failed transiently (429, 5xx, a lost connection, a
+ * provider timeout) before it produced any output. Each attempt passes through
+ * `provider` again, so quota admission and accounting see every request.
+ *
+ * Once a block event was emitted the attempt is final: streamed text cannot be
+ * taken back, so a failure mid-stream still ends the call. Context overflow is
+ * left to compaction. Waits follow the provider's Retry-After, otherwise
+ * `delaysMs`, end before `deadline`, and stop on the request's abort signal.
+ */
+export function retryTransientProviderErrors(
+  provider: Provider,
+  options: {
+    /** Epoch milliseconds by which a wait must end; null when the turn has no run time limit. */
+    deadline: number | null;
+    delaysMs?: readonly number[];
+    /** Announces a wait before it starts. */
+    onRetry?: (retry: AiProviderRetry) => Promise<void>;
+  },
+): Provider {
+  const delays = options.delaysMs ?? AI_PROVIDER_RETRY_DELAYS_MS;
+  const waitFor = (retry: number, marks: ProviderFetchMarks, signal: AbortSignal | undefined): number | null => {
+    if (retry >= delays.length || signal?.aborted) return null;
+    const delayMs = marks.retryAfterMs ?? delays[retry]!;
+    if (delayMs > AI_PROVIDER_MAX_RETRY_AFTER_MS) return null;
+    if (options.deadline !== null && Date.now() + delayMs >= options.deadline) return null;
+    return delayMs;
+  };
+  return {
+    name: provider.name,
+    family: provider.family,
+    model: provider.model,
+    contextWindow: provider.contextWindow,
+    capabilities: provider.capabilities,
+    complete: (request) => provider.complete(request),
+    stream: async function* (request) {
+      for (let retry = 0; ; retry += 1) {
+        const marks: ProviderFetchMarks = {};
+        const events = provider.stream(request)[Symbol.asyncIterator]();
+        const next = () => runWithProviderFetchMarks(marks, () => events.next());
+        // Events before the first block (usage, issues) are held so that a retried attempt leaves no trace.
+        const held: StreamEvent[] = [];
+        let committed = false;
+        let pending: AiProviderRetry | null = null;
+        try {
+          for (let step = await next(); !step.done; step = await next()) {
+            const event = step.value;
+            if (!committed && event.type === "issue" && transientIssue(event.issue)) {
+              const delayMs = waitFor(retry, marks, request.signal);
+              if (delayMs !== null) {
+                pending = { retry: retry + 1, delayMs, issue: event.issue };
+                break;
+              }
+            }
+            if (!committed && !isBlockEvent(event)) {
+              held.push(event);
+              continue;
+            }
+            if (!committed) {
+              committed = true;
+              yield* held.splice(0);
+            }
+            yield event;
+          }
+        } finally {
+          // Settles the failed attempt's accounting before the wait starts.
+          await events.return?.();
+        }
+        if (!pending) {
+          yield* held;
+          return;
+        }
+        await options.onRetry?.(pending);
+        await delay(pending.delayMs, undefined, { signal: request.signal });
+      }
+    },
+  };
+}

package/src/ai/provider.ts

@@ -11,9 +11,10 @@ const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
   contextWindow: profile.contextWindow,
   temperature: profile.temperature,
   timeouts: PROVIDER_TIMEOUTS,
+  extraBody: profile.extraBody,
 });
 
-export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Provider => {
+export const createAiProvider = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {
   if (profile.capabilities.includes("transcription")) throw new Error("Transcription profiles cannot be used for chat generation.");
   switch (profile.provider) {
     case "openai":
@@ -32,6 +33,7 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
         timeouts: PROVIDER_TIMEOUTS,
+        extraBody: profile.extraBody,
       });
     case "vllm":
       return openAICompatible({
@@ -39,9 +41,11 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         model: profile.model,
         baseURL: profile.baseURL ?? "http://localhost:8000/v1",
         apiKey,
+        headers,
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
         timeouts: PROVIDER_TIMEOUTS,
+        extraBody: profile.extraBody,
         compat: {
           toolCallIdPolicy: "passthrough",
           supportsUsageInStreaming: true,
@@ -58,9 +62,11 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         model: profile.model,
         baseURL: profile.baseURL,
         apiKey,
+        headers,
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
         timeouts: PROVIDER_TIMEOUTS,
+        extraBody: profile.extraBody,
       });
   }
 };

package/src/ai/quota-provider.ts

@@ -5,7 +5,7 @@ import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
 import { isAssistantChatTurn } from "./assistant-models";
 import { AiBackgroundAdmissionError, type AiCallContext, type AiCallDetails, beginAiCall, finishAiCall } from "./inference-calls";
-import { runWithProviderFetchMarks } from "./provider-fetch";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
 import type { AiModelProfile } from "./types";
 
 const log = logger("ai:quotas");
@@ -54,8 +54,8 @@ export function inferenceProvider(
             ctx,
             inputTokens,
             request.maxOutputTokens ?? profile.maxOutputTokens,
-            // Nessi's Anthropic adapter defaults to 1024; other adapters use the model default.
-            provider.family === "anthropic" ? 1024 : provider.contextWindow,
+            // Nessi's Anthropic adapter defaults to 8192; other adapters use the model default.
+            provider.family === "anthropic" ? 8192 : provider.contextWindow,
           );
         } catch (error) {
           if (!(error instanceof AiBackgroundAdmissionError) || !error.retryable || Date.now() >= deadline) throw error;
@@ -93,7 +93,7 @@ export function inferenceProvider(
       let status: "ok" | "failed" = "failed";
       let error: string | undefined;
       const requestStartedAt = Date.now();
-      const marks: { headersAt?: number; firstByteAt?: number } = {};
+      const marks: ProviderFetchMarks = {};
       try {
         const result = await runWithProviderFetchMarks(marks, () =>
           provider.complete({ ...request, maxOutputTokens: call.maxOutputTokens }),
@@ -112,7 +112,9 @@ export function inferenceProvider(
         throw thrown;
       } finally {
         call.stop();
-        if (!usage && status === "failed") usage = { input: call.inputTokens, output: 0, estimated: true };
+        // A request the provider refused or never received cost nothing; any other failure may have been processed.
+        if (!usage && status === "failed")
+          usage = marks.refused ? { input: 0, output: 0 } : { input: call.inputTokens, output: 0, estimated: true };
         const cancelled = request.signal?.aborted === true;
         await finish(call.id, usage, cancelled && status === "failed" ? "aborted" : status, {
           error: cancelled ? null : error,
@@ -133,7 +135,7 @@ export function inferenceProvider(
       const outputBlocks = new Map<string, number>();
       let generated = false;
       const requestStartedAt = Date.now();
-      const marks: { headersAt?: number; firstByteAt?: number; firstBlockAt?: number } = {};
+      const marks: ProviderFetchMarks & { firstBlockAt?: number } = {};
       // The wrapped adapter reads lazily, so the request only leaves once the first pull runs inside the marked scope.
       const events = provider.stream({ ...request, maxOutputTokens: call.maxOutputTokens })[Symbol.asyncIterator]();
       const next = () => runWithProviderFetchMarks(marks, () => events.next());
@@ -158,7 +160,14 @@ export function inferenceProvider(
             outputBlocks.set(event.blockId, size);
           }
           if (event.type === "block_start" || event.type === "block_delta" || event.type === "block_end") generated = true;
-          if (event.type === "issue" && event.issue.kind === "provider_error" && event.issue.contextOverflow && !generated && !usage)
+          // A provider that refused the request, or never received it, did not process it.
+          if (
+            event.type === "issue" &&
+            event.issue.kind === "provider_error" &&
+            (event.issue.contextOverflow || marks.refused) &&
+            !generated &&
+            !usage
+          )
             usage = { input: 0, output: 0 };
           if (event.type === "usage") {
             if (event.finishReason === "aborted" || event.finishReason === "interrupted" || event.finishReason === "error") failed = true;

package/src/ai/request-headers.ts

@@ -0,0 +1,117 @@
+import { sql } from "bun";
+import { toPgTextArray } from "../services/postgres";
+import { decryptValue, encryptValue } from "../services/settings/crypto";
+import {
+  AI_REQUEST_HEADERS_PROVIDER_ERROR,
+  AiRequestHeadersSchema,
+  patchAiRequestHeaders,
+  providerSupportsRequestHeaders,
+} from "../shared/ai-request-options";
+import type { AiModelProfile } from "./types";
+
+type SqlClient = typeof sql;
+export type AiRequestHeaderPatch = { profileId: string; patch: unknown };
+
+const decryptHeaders = async (profileId: string, secret: string): Promise<Record<string, string>> => {
+  try {
+    const parsed = AiRequestHeadersSchema.safeParse(await decryptValue(secret));
+    if (parsed.success && Object.values(parsed.data).every((value) => typeof value === "string"))
+      return patchAiRequestHeaders({}, parsed.data);
+  } catch {}
+  console.warn(`[ai] ignoring unreadable request headers for profile ${JSON.stringify(profileId)}`);
+  return {};
+};
+
+/** Secrets stay server-side, in a separate encrypted row like provider API keys. */
+export const getAiRequestHeaders = async (profileId: string, db: SqlClient = sql): Promise<Record<string, string>> => {
+  const [row] = await db<{ secret: string }[]>`SELECT secret FROM ai.model_request_headers WHERE profile_id = ${profileId}`;
+  return row ? decryptHeaders(profileId, row.secret) : {};
+};
+
+export const setAiRequestHeaders = async (profileId: string, headers: Record<string, string>, db: SqlClient = sql): Promise<void> => {
+  const normalized = patchAiRequestHeaders({}, headers);
+  if (!Object.keys(normalized).length) {
+    await db`DELETE FROM ai.model_request_headers WHERE profile_id = ${profileId}`;
+    return;
+  }
+  const encrypted = await encryptValue(normalized);
+  await db`INSERT INTO ai.model_request_headers (profile_id, secret) VALUES (${profileId}, ${encrypted})
+    ON CONFLICT (profile_id) DO UPDATE SET secret = EXCLUDED.secret, updated_at = now()`;
+};
+
+/** Admin reads contain names only. Never serialize header values into profiles. */
+export const listAiRequestHeaderNames = async (db: SqlClient = sql): Promise<Record<string, string[]>> => {
+  const rows = await db<{ profile_id: string; secret: string }[]>`SELECT profile_id, secret FROM ai.model_request_headers`;
+  const names: Record<string, string[]> = {};
+  for (const row of rows)
+    Object.defineProperty(names, row.profile_id, {
+      value: Object.keys(await decryptHeaders(row.profile_id, row.secret)).sort(),
+      enumerable: true,
+    });
+  return names;
+};
+
+export const pruneAiRequestHeaders = async (keepProfileIds: readonly string[], db: SqlClient = sql): Promise<void> => {
+  if (!keepProfileIds.length) await db`DELETE FROM ai.model_request_headers`;
+  else await db`DELETE FROM ai.model_request_headers WHERE profile_id <> ALL(${toPgTextArray([...keepProfileIds])}::text[])`;
+};
+
+/** Follow credentials: changing provider discards stored secrets; omission preserves them on the same provider. */
+export const planAiProfileRequestHeaders = (input: {
+  currentProfiles: readonly AiModelProfile[];
+  nextProfiles: readonly AiModelProfile[];
+  existingNames: Record<string, string[]>;
+  submitted: readonly AiRequestHeaderPatch[];
+}): { keepHeaderProfileIds: string[]; patches: { profileId: string; patch: Record<string, string | null> }[]; error?: string } => {
+  const current = new Map(input.currentProfiles.map((profile) => [profile.id, profile]));
+  const keepHeaderProfileIds = input.nextProfiles
+    .filter(
+      (profile) =>
+        providerSupportsRequestHeaders(profile.provider) &&
+        current.get(profile.id)?.provider === profile.provider &&
+        !profile.capabilities.includes("transcription"),
+    )
+    .map((profile) => profile.id);
+  const patches: { profileId: string; patch: Record<string, string | null> }[] = [];
+  for (const submitted of input.submitted) {
+    const profile = input.nextProfiles.find((profile) => profile.id === submitted.profileId);
+    const parsed = AiRequestHeadersSchema.safeParse(submitted.patch);
+    if (!parsed.success)
+      return { keepHeaderProfileIds: [], patches: [], error: `requestHeaders: ${zodHeaderMessage(parsed.error.issues)}` };
+    if (!profile || !providerSupportsRequestHeaders(profile.provider))
+      return { keepHeaderProfileIds: [], patches: [], error: AI_REQUEST_HEADERS_PROVIDER_ERROR };
+    if (profile.capabilities.includes("transcription"))
+      return {
+        keepHeaderProfileIds: [],
+        patches: [],
+        error: "requestHeaders: Request settings are not supported on transcription profiles.",
+      };
+    const oldNames =
+      keepHeaderProfileIds.includes(profile.id) && Object.hasOwn(input.existingNames, profile.id) ? input.existingNames[profile.id]! : [];
+    try {
+      patchAiRequestHeaders(Object.fromEntries(oldNames.map((name) => [name, ""])), parsed.data);
+    } catch {
+      return {
+        keepHeaderProfileIds: [],
+        patches: [],
+        error: "requestHeaders: At most 32 extra headers are allowed after applying the patch.",
+      };
+    }
+    patches.push({ profileId: profile.id, patch: parsed.data });
+  }
+  return { keepHeaderProfileIds, patches };
+};
+
+const zodHeaderMessage = (issues: readonly { path: readonly PropertyKey[]; message: string }[]) =>
+  issues.map((issue) => `${issue.path.map(String).join(".") || "headers"}: ${issue.message}`).join("; ");
+
+/** Apply after pruning so a provider change cannot inherit old secrets. Call inside the settings transaction. */
+export const storeAiRequestHeaderPlan = async (
+  plan: ReturnType<typeof planAiProfileRequestHeaders>,
+  db: SqlClient = sql,
+): Promise<void> => {
+  if (plan.error) throw new Error(plan.error);
+  await pruneAiRequestHeaders(plan.keepHeaderProfileIds, db);
+  for (const { profileId, patch } of plan.patches)
+    await setAiRequestHeaders(profileId, patchAiRequestHeaders(await getAiRequestHeaders(profileId, db), patch), db);
+};

package/src/ai/routes.ts

@@ -168,10 +168,26 @@ const resourcesQuerySchema = (scope: "conversation" | "user") =>
     limit: z.coerce.number().int().min(1).max(100).optional(),
   });
 const ConversationResourcesQuerySchema = resourcesQuerySchema("conversation");
+const ConversationSourcesQuerySchema = ConversationResourcesQuerySchema.extend({
+  /** Kinds separated by commas, for example `web,activity,resource`. */
+  kind: z
+    .string()
+    .max(64)
+    .transform((value) => value.split(","))
+    .pipe(z.array(z.enum(["result", "web", "file", "resource", "activity"])).min(1))
+    .optional(),
+  observed: z.enum(["true", "false"]).optional(),
+});
 const UserResourcesQuerySchema = resourcesQuerySchema("user");
 
-const FilesListQuerySchema = z.object({ prefix: z.string().optional() });
+const FilesListQuerySchema = z.object({
+  prefix: z.string().optional(),
+  /** Pages by path: pass the last path of a page as `after`. Without `limit`, every file comes newest first. */
+  limit: z.coerce.number().int().min(1).max(1000).optional(),
+  after: z.string().max(4096).optional(),
+});
 const FilePathQuerySchema = z.object({ path: z.string().min(1) });
+const FileDeleteQuerySchema = FilePathQuerySchema.extend({ recursive: z.enum(["true", "false"]).optional() });
 const FileWriteSchema = z.object({
   path: z.string().min(1),
   content: z.string().max(12_000_000),
@@ -425,6 +441,7 @@ export const aiRoutes = (() => {
           memory: memory?.text,
           timeZone,
           locale: promptLocale,
+          skillCreatorAvailable: availableSkills.some((skill) => skill.name === "skill-creator"),
         });
         return respond(c, ok({ prompt, renderedAt: new Date().toISOString() }));
       })
@@ -629,7 +646,7 @@ export const aiRoutes = (() => {
           ),
         );
       })
-      .get("/conversations/:conversationId/sources", v("query", ConversationResourcesQuerySchema), async (c) => {
+      .get("/conversations/:conversationId/sources", v("query", ConversationSourcesQuerySchema), async (c) => {
         const ctx = await resolveContext(c);
         if (ctx instanceof Response) return ctx;
         const conversation = await loadConversation(c, ctx);
@@ -643,6 +660,8 @@ export const aiRoutes = (() => {
               search: query.q,
               before: query.cursor,
               limit: query.limit,
+              kinds: query.kind,
+              observed: query.observed === "true",
             }),
           ),
         );
@@ -1127,7 +1146,12 @@ export const aiRoutes = (() => {
         if (ctx instanceof Response) return ctx;
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
-        const files = await aiFileStore.list({ conversationId: conversation.id, prefix: c.req.valid("query").prefix ?? "/" });
+        const query = c.req.valid("query");
+        const files = await aiFileStore.list({
+          conversationId: conversation.id,
+          prefix: query.prefix ?? "/",
+          ...(query.limit ? { limit: query.limit, after: query.after } : {}),
+        });
         return respond(c, ok({ files, totalBytes: await aiFileStore.totalBytes(conversation.id) }));
       })
       .post("/conversations/:conversationId/dictations", bodyLimit({ maxSize: AI_AUDIO_MAX_BYTES + 65_536 }), async (c) => {
@@ -1307,14 +1331,18 @@ export const aiRoutes = (() => {
           "Cache-Control": "private, no-store",
         });
       })
-      .delete("/conversations/:conversationId/files", v("query", FilePathQuerySchema), async (c) => {
+      .delete("/conversations/:conversationId/files", v("query", FileDeleteQuerySchema), async (c) => {
         const ctx = await resolveContext(c);
         if (ctx instanceof Response) return ctx;
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
-        const path = normalizeAiFilePath(c.req.valid("query").path);
+        const query = c.req.valid("query");
+        const path = normalizeAiFilePath(query.path);
         if (!path) return fileNotFound(c);
-        const removed = await aiFileStore.remove({ conversationId: conversation.id, path, recursive: false });
+        // A folder goes with everything below it, never the whole chat at once.
+        const recursive = query.recursive === "true";
+        if (recursive && path === "/") return respond(c, fail(err.badInput("Choose a folder below /.")));
+        const removed = await aiFileStore.remove({ conversationId: conversation.id, path, recursive });
         if (removed === 0) return fileNotFound(c);
         return respond(c, ok({ deleted: true }));
       })

package/src/ai/runtime.ts

@@ -13,6 +13,7 @@ import { startAiDictationRuntime } from "./dictation-runtime";
 import { AiTurnExecutor } from "./executor";
 import { canonicalizeAiConversationAttachments, snapshotAiConversationFiles } from "./file-context";
 import { drainQueuedMessages } from "./message-queue";
+import { AI_TURN_LEASE_MS } from "./protocol";
 import { aiQuotas } from "./quotas";
 import { parseAiResourceMarker } from "./resource-markers";
 import { isAiVisionModelConfigured } from "./settings";
@@ -43,7 +44,6 @@ export { isAiSettingsError, validateAiTurnRequest } from "./validate";
 const log = logger("ai:runtime");
 
 const AI_WORKER_ID = `worker-${crypto.randomUUID()}`;
-const AI_TURN_LEASE_MS = 45_000;
 const AI_TURN_HEARTBEAT_MS = 3_000;
 const AI_TURN_WORKER_CONCURRENCY = 8;
 const AI_TURN_MAX_ATTEMPTS = 5;

package/src/ai/settings.ts

@@ -1,9 +1,17 @@
 import { z } from "zod";
 import { coreSettings } from "../services";
 import { AiModelPricingSchema } from "../shared/ai-costs";
+import {
+  AI_REQUEST_HEADERS_PROVIDER_ERROR,
+  AiExtraBodySchema,
+  AiReasoningEffortSchema,
+  AiRequestHeadersSchema,
+  providerSupportsRequestHeaders,
+} from "../shared/ai-request-options";
 import { getAiCredential, listAiCredentialProfileIds } from "./credentials";
 import { AI_FIRECRAWL_API_KEY_SETTING_KEY } from "./firecrawl-tools";
 import { createAiProvider } from "./provider";
+import { getAiRequestHeaders } from "./request-headers";
 import {
   AI_DATA_BOUNDARIES,
   AI_MODEL_CAPABILITIES,
@@ -93,12 +101,20 @@ const ModelProfileSchema = z
     contextWindow: z.number().int().positive().optional(),
     temperature: z.number().min(0).max(2).optional(),
     maxOutputTokens: z.number().int().positive().optional(),
+    reasoningEffort: AiReasoningEffortSchema,
+    extraBody: AiExtraBodySchema.optional(),
+    requestHeaders: AiRequestHeadersSchema.optional(),
     maxLoadedTools: z.number().int().optional(),
     maxToolRounds: z.number().int().optional(),
     pricing: AiModelPricingSchema.optional(),
   })
   .superRefine((profile, ctx) => {
+    if (profile.requestHeaders !== undefined && !providerSupportsRequestHeaders(profile.provider))
+      ctx.addIssue({ code: "custom", path: ["requestHeaders"], message: AI_REQUEST_HEADERS_PROVIDER_ERROR });
     if (profile.capabilities?.includes("transcription")) {
+      for (const key of ["reasoningEffort", "extraBody", "requestHeaders"] as const)
+        if (profile[key] !== undefined)
+          ctx.addIssue({ code: "custom", path: [key], message: "Request settings are not supported on transcription profiles." });
       if (profile.pricing) ctx.addIssue({ code: "custom", path: ["pricing"], message: "Audio pricing is not supported." });
       if (profile.capabilities.some((capability) => capability !== "transcription")) {
         ctx.addIssue({ code: "custom", path: ["capabilities"], message: "Audio transcription cannot be combined with chat capabilities." });
@@ -128,7 +144,7 @@ const profileToPublic = (profile: AiModelProfile): AiPublicModelProfile => ({
 });
 
 const normalizeProfile = (raw: z.infer<typeof ModelProfileSchema>): AiModelProfile => {
-  const { capabilities, dataBoundary, dataPolicy: legacyDataPolicy, tags: _legacyTags, ...profile } = raw;
+  const { requestHeaders: _requestHeaders, capabilities, dataBoundary, dataPolicy: legacyDataPolicy, tags: _legacyTags, ...profile } = raw;
   return {
     ...profile,
     capabilities: normalizeCapabilities(capabilities),
@@ -522,7 +538,8 @@ export const resolveAiModelFromState = async (
     });
   }
 
-  return { profile, provider: createAiProvider(profile, credential?.trim() || undefined) };
+  const headers = providerSupportsRequestHeaders(profile.provider) ? await getAiRequestHeaders(profile.id) : {};
+  return { profile, provider: createAiProvider(profile, credential?.trim() || undefined, headers) };
 };
 
 const isUsableProfile = (profile: AiModelProfile, credentialProfileIds: ReadonlySet<string>): boolean =>