@k2b/cloud 0.28.0 → 0.29.0

package/src/ai/files-store.ts

@@ -1,5 +1,7 @@
 import { type SQL, sql } from "bun";
+import { stripImageMetadata } from "../services/image-metadata";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
+import { isAiImage } from "./file-media-type";
 
 export { guessAiMediaType } from "./file-media-type";
 
@@ -79,9 +81,11 @@ export const createUniqueAiFileInTransaction = async (
     throw new AiFileWriteError("STORAGE_FULL", `File exceeds the per-file limit of ${Math.floor(maxFile / (1024 * 1024))} MB.`);
   }
 
+  const bytes = isAiImage(input.path, input.mediaType ?? "application/octet-stream") ? stripImageMetadata(input.bytes) : input.bytes;
+
   await tx`SELECT id FROM ai.conversations WHERE id = ${input.conversationId} FOR UPDATE`;
   const total = await aiConversationStoredBytes(tx, input.conversationId);
-  if (total + input.bytes.byteLength > maxConversation) {
+  if (total + bytes.byteLength > maxConversation) {
     throw new AiFileWriteError("STORAGE_FULL", `Conversation storage limit of ${Math.floor(maxConversation / (1024 * 1024))} MB exceeded.`);
   }
 
@@ -89,7 +93,7 @@ export const createUniqueAiFileInTransaction = async (
     const path = numberedAiFilePath(input.path, number);
     const rows = await tx<FileRow[]>`
         INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, dictation_recorded_at, updated_at)
-        SELECT ${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, ${input.origin}, ${input.dictationRecordedAt ?? null}, now()
+        SELECT ${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, ${input.origin}, ${input.dictationRecordedAt ?? null}, now()
         WHERE NOT EXISTS (
           SELECT 1 FROM ai.files WHERE conversation_id = ${input.conversationId} AND normalize(path, NFC) = ${path.normalize("NFC")}
         )
@@ -191,7 +195,8 @@ export const aiFileStore = {
     producerCallKey: string;
     mediaType: string;
   }): Promise<AiFileStat> {
-    if (input.bytes.byteLength > AI_FILES_MAX_FILE_BYTES_DEFAULT)
+    const bytes = isAiImage(input.path, input.mediaType) ? stripImageMetadata(input.bytes) : input.bytes;
+    if (bytes.byteLength > AI_FILES_MAX_FILE_BYTES_DEFAULT)
       throw new AiFileWriteError("STORAGE_FULL", "File exceeds the destination file limit; nothing was written.");
     if (!normalizeAiFilePath(input.path)) {
       throw new Error("Invalid tool artifact path or file size.");
@@ -210,18 +215,18 @@ export const aiFileStore = {
           Number(row.version) === 1 &&
           row.producer_call_key === input.producerCallKey &&
           row.media_type === input.mediaType &&
-          Buffer.from(row.bytes).equals(Buffer.from(input.bytes))
+          Buffer.from(row.bytes).equals(Buffer.from(bytes))
         )
           return toStat(row);
         throw new AiFileWriteError("CONFLICT", "Destination file already exists. Choose another path; nothing was written.");
       }
       const total = await aiConversationStoredBytes(tx, input.conversationId);
-      if (total + input.bytes.byteLength > AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT) {
+      if (total + bytes.byteLength > AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT) {
         throw new AiFileWriteError("STORAGE_FULL", "Conversation storage limit exceeded.");
       }
       const rows = await tx<FileRow[]>`
         INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, producer_call_key)
-        VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType}, ${input.bytes.byteLength}, 'assistant', ${input.producerCallKey})
+        VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType}, ${bytes.byteLength}, 'assistant', ${input.producerCallKey})
         RETURNING path, size, media_type, origin, dictation_recorded_at, updated_at, version
       `;
       return toStat(rows[0]!);
@@ -364,6 +369,8 @@ export const aiFileStore = {
       throw new AiFileWriteError("STORAGE_FULL", `File exceeds the per-file limit of ${Math.floor(maxFile / (1024 * 1024))} MB.`);
     }
 
+    const bytes = isAiImage(input.path, input.mediaType ?? "application/octet-stream") ? stripImageMetadata(input.bytes) : input.bytes;
+
     return sql.begin(async (tx) => {
       const [conversation] = await tx<
         { id: string; created_by_user_id: string; archived_at: Date | null }[]
@@ -384,7 +391,7 @@ export const aiFileStore = {
         if (version !== input.expectedVersion) throw new AiFileVersionConflict();
       }
       const otherBytes = await aiConversationStoredBytes(tx, input.conversationId, path);
-      if (otherBytes + input.bytes.byteLength > maxConversation) {
+      if (otherBytes + bytes.byteLength > maxConversation) {
         throw new AiFileWriteError(
           "STORAGE_FULL",
           `Conversation storage limit of ${Math.floor(maxConversation / (1024 * 1024))} MB exceeded.`,
@@ -394,7 +401,7 @@ export const aiFileStore = {
         if (input.allowUserOverwrite) {
           const written = await tx<{ id: string }[]>`
             UPDATE ai.files
-            SET dictation_recorded_at = NULL, bytes = ${input.bytes}, media_type = ${input.mediaType ?? "application/octet-stream"}, size = ${input.bytes.byteLength}, updated_at = now(), version = version + 1
+            SET dictation_recorded_at = NULL, bytes = ${bytes}, media_type = ${input.mediaType ?? "application/octet-stream"}, size = ${bytes.byteLength}, updated_at = now(), version = version + 1
             WHERE conversation_id = ${input.conversationId} AND path = ${path} AND origin = 'user'
             RETURNING id
           `;
@@ -402,13 +409,13 @@ export const aiFileStore = {
         } else {
           await tx`
             INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, updated_at)
-            VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, 'user', now())
+            VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, 'user', now())
           `;
         }
       } else {
         const written = await tx<{ id: string }[]>`
           INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, updated_at)
-          VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, 'assistant', now())
+          VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, 'assistant', now())
           ON CONFLICT (conversation_id, path) DO UPDATE SET
             bytes = EXCLUDED.bytes,
             media_type = EXCLUDED.media_type,

package/src/ai/http.ts

@@ -122,6 +122,15 @@ export type AiTurnContentPart = z.infer<typeof AiUserContentPartSchema>;
 
 export const AiClientToolIdSchema = z.enum(["local_bash", ...CODE_RUNTIME_TOOL_NAMES] satisfies [AiClientToolId, ...AiClientToolId[]]);
 
+// Names use aiCapabilityToolName's provider grammar and 64-character limit. The 64-item cap matches allowedTools, with headroom
+// for retired and not-yet-known names; 64 names × 64 ASCII characters bounds advertised name text to 4 KiB.
+const AI_CLIENT_TOOL_MAX_ITEMS = 64;
+const AiClientToolIdsSchema = z
+  .array(z.string().regex(/^[a-zA-Z0-9_-]{1,64}$/))
+  .max(AI_CLIENT_TOOL_MAX_ITEMS)
+  .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
+  .transform((ids) => ids.filter((id): id is AiClientToolId => AiClientToolIdSchema.safeParse(id).success));
+
 export const AiTurnInputSchema = z
   .object({
     message: z.string().trim().max(20000).optional(),
@@ -131,11 +140,7 @@ export const AiTurnInputSchema = z
       .max(AI_TURN_ATTACHMENT_MAX_ITEMS * 2 + 1)
       .optional(),
     modelProfileId: z.string().trim().min(1).optional(),
-    clientToolIds: z
-      .array(AiClientToolIdSchema)
-      .max(1 + CODE_RUNTIME_TOOL_NAMES.length)
-      .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
-      .optional(),
+    clientToolIds: AiClientToolIdsSchema.optional(),
   })
   .refine((input) => Boolean(input.message?.trim() || input.content?.length), {
     message: "Message or content is required.",
@@ -156,11 +161,7 @@ export const AiSubmitConversationDraftInputSchema = z.object({
   queueId: z.uuid().optional(),
   draftRevision: z.number().int().min(1),
   modelProfileId: z.string().trim().min(1).optional(),
-  clientToolIds: z
-    .array(AiClientToolIdSchema)
-    .max(1 + CODE_RUNTIME_TOOL_NAMES.length)
-    .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
-    .optional(),
+  clientToolIds: AiClientToolIdsSchema.optional(),
 });
 
 export const AiSteerInputSchema = z.object({

package/src/ai/index.ts

@@ -76,6 +76,7 @@ export {
 } from "./enrich";
 export { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 export { aiConversationFileManifest } from "./file-context";
+export { isAiImage } from "./file-media-type";
 export { AiFileLocation, AiFileReference } from "./file-reference-contracts";
 export {
   AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT,

package/src/ai/memories.ts

@@ -412,6 +412,7 @@ export const aiMemories = {
    * Apply one model proposal as an ownership-checked transaction. Background
    * learning may only mutate normal background memories; user, agent, and
    * pinned entries remain authoritative.
+   * The source chat must still be active; the row lock makes this atomic with archiving.
    */
   async applyBackgroundProposal(input: {
     userId: string;
@@ -437,6 +438,7 @@ export const aiMemories = {
         FROM ai.conversations c
         WHERE c.id = ${input.sourceConversationId}::uuid
           AND c.created_by_user_id = ${input.userId}::uuid
+          AND c.archived_at IS NULL
           AND (${input.sourceMessageId ?? null}::uuid IS NULL OR EXISTS (
             SELECT 1 FROM ai.messages m
             WHERE m.id = ${input.sourceMessageId ?? null}::uuid AND m.conversation_id = c.id

package/src/ai/memory-learning.ts

@@ -12,6 +12,7 @@ import { type AiMemoryLearningChange, aiMemoryLearningRuns } from "./memory-lear
 import {
   type AiMemoryWorkflowEvidence,
   type AiMemoryWorkflowPattern,
+  isAiWorkflowPatternEligible,
   listAiPendingWorkflowPatterns,
   listAiTurnWorkflowEvidence,
   markAiWorkflowPatternReviewed,
@@ -199,6 +200,21 @@ const markFailed = async (candidate: Candidate): Promise<void> => {
 
 const learningEnabled = async (userId: string): Promise<boolean> => (await aiUserPrefs.get(userId)).memoryLearningEnabled;
 
+const turnEligible = async (candidate: Candidate): Promise<boolean> => {
+  const [row] = await sql<{ id: string }[]>`
+    SELECT turn.id
+    FROM ai.turns turn
+    JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
+    WHERE turn.id = ${candidate.turnId}::uuid
+      AND conversation.id = ${candidate.conversationId}::uuid
+      AND conversation.created_by_user_id = ${candidate.userId}::uuid
+      AND conversation.archived_at IS NULL
+      AND turn.status = 'completed'
+      AND turn.memory_learned_at IS NULL
+  `;
+  return Boolean(row);
+};
+
 const monthlyAccountedTokens = async (userId: string): Promise<number> => {
   const [row] = await sql<{ tokens: number }[]>`
     SELECT COALESCE(sum(accounted_tokens), 0)::int AS tokens
@@ -342,6 +358,7 @@ const applyChanges = async (
 const workflowPatternInput = async (
   pattern: AiMemoryWorkflowPattern,
 ): Promise<{ input: string; source: TurnEvidence | null; mutableMemoryIds: Set<string> }> => {
+  if (!(await isAiWorkflowPatternEligible(pattern))) return { input: "", source: null, mutableMemoryIds: new Set() };
   const sources = await Promise.all(
     pattern.turnIds.map(async (turnId) => {
       const [row] = await sql<{ conversation_id: string; completed_as_of: string; fail_count: number }[]>`
@@ -349,6 +366,7 @@ const workflowPatternInput = async (
         FROM ai.turns turn
         JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
         WHERE turn.id = ${turnId}::uuid AND conversation.created_by_user_id = ${pattern.userId}::uuid
+          AND conversation.archived_at IS NULL
       `;
       if (!row) return null;
       return loadTurnEvidence({
@@ -361,6 +379,7 @@ const workflowPatternInput = async (
     }),
   );
   const evidence = sources.filter((source): source is TurnEvidence => Boolean(source));
+  if (evidence.length !== pattern.turnIds.length) return { input: "", source: null, mutableMemoryIds: new Set() };
   const query = evidence.map((source) => source.userText).join(" ");
   const selected = await aiMemories.selectHot(pattern.userId, query);
   const examples = evidence
@@ -441,6 +460,12 @@ export const learnAiMemoriesFromPrivateChats = async (
     let runId: string | null = null;
     let changes: AiMemoryLearningChange[] = [];
     try {
+      if (!(await turnEligible(candidate))) {
+        await markLearned(candidate);
+        summary.skipped += 1;
+        processedCandidates += 1;
+        continue;
+      }
       const evidence = await loadTurnEvidence(candidate);
       if (!evidence.userText) {
         await markLearned(candidate);
@@ -458,7 +483,6 @@ export const learnAiMemoriesFromPrivateChats = async (
       });
       const reservedTokens = estimatedTokens(systemPrompt, taskInput);
       if ((await readMonthlyUsage(candidate.userId)) + reservedTokens > monthlyTokenBudget) continue;
-      // Read the choice again right before the turn can reach the model.
       if (!(await learningEnabled(candidate.userId))) continue;
       runId = await aiMemoryLearningRuns.start({
         userId: candidate.userId,
@@ -468,6 +492,22 @@ export const learnAiMemoriesFromPrivateChats = async (
         modelProfileId: resolved.profile.id,
         accountedTokens: reservedTokens,
       });
+      // Claiming the run also awaits the database: recheck immediately before inference.
+      // runAiStructured may still wait for background admission; checks after the call discard results for chats that became ineligible.
+      if (!(await turnEligible(candidate))) {
+        await markLearned(candidate);
+        if (runId)
+          await aiMemoryLearningRuns.finish({
+            runId,
+            status: "skipped",
+            durationMs: Date.now() - startedAt,
+            changes: [],
+            accountedTokens: 0,
+          });
+        summary.skipped += 1;
+        processedCandidates += 1;
+        continue;
+      }
       if (!runId) continue;
       const result = await structured({
         task: "memory-learn-turn",
@@ -481,7 +521,7 @@ export const learnAiMemoriesFromPrivateChats = async (
         signal: input.signal,
         resolveModel: async () => resolved,
       });
-      if (!(await learningEnabled(candidate.userId))) {
+      if (!(await learningEnabled(candidate.userId)) || !(await turnEligible(candidate))) {
         await markLearned(candidate);
       } else {
         changes = await applyChanges(
@@ -547,7 +587,8 @@ export const learnAiMemoriesFromPrivateChats = async (
     try {
       const context = await workflowPatternInput(pattern);
       if (!context.source) {
-        await markAiWorkflowPatternReviewed(pattern);
+        // Archive retires its own receipts; preserve other chats' evidence for a later pattern.
+        summary.skipped += 1;
         continue;
       }
       const locale = await resolveLearningLocale(context.source.candidate.locale);
@@ -568,6 +609,18 @@ export const learnAiMemoriesFromPrivateChats = async (
         modelProfileId: resolved.profile.id,
         accountedTokens: reservedTokens,
       });
+      if (!(await isAiWorkflowPatternEligible(pattern))) {
+        if (runId)
+          await aiMemoryLearningRuns.finish({
+            runId,
+            status: "skipped",
+            durationMs: Date.now() - startedAt,
+            changes: [],
+            accountedTokens: 0,
+          });
+        summary.skipped += 1;
+        continue;
+      }
       if (!runId) continue;
       const result = await structured({
         task: "memory-learn-workflow",
@@ -586,7 +639,8 @@ export const learnAiMemoriesFromPrivateChats = async (
         resolveModel: async () => resolved,
       });
       let changes: AiMemoryLearningChange[] = [];
-      if (result.output.workflow && (await learningEnabled(pattern.userId))) {
+      // The write locks only the source chat; check the other examples right before it.
+      if (result.output.workflow && (await learningEnabled(pattern.userId)) && (await isAiWorkflowPatternEligible(pattern))) {
         const memoryIds = result.output.workflow.memoryIds;
         const action = memoryIds.length > 1 ? "merge" : memoryIds.length === 1 ? "replace" : "add";
         changes = await applyChanges(
@@ -603,7 +657,7 @@ export const learnAiMemoriesFromPrivateChats = async (
           context.mutableMemoryIds,
         );
       }
-      await markAiWorkflowPatternReviewed(pattern);
+      if (await isAiWorkflowPatternEligible(pattern)) await markAiWorkflowPatternReviewed(pattern);
       await aiMemoryLearningRuns.finish({
         runId,
         status: changes.length > 0 ? "ok" : "skipped",

package/src/ai/memory-workflow-evidence.ts

@@ -25,8 +25,8 @@ export type AiMemoryWorkflowPattern = {
 
 /**
  * Persist only successful, schema-valid capability/resource receipts, and only
- * while learning is on for the user: receipts from a time it was off never
- * count toward a workflow pattern.
+ * while learning is on for the user and the chat is active: receipts from a
+ * time it was off or the chat was archived never count toward a pattern.
  */
 export const recordAiMemoryWorkflowEvidence = async (input: {
   userId: string;
@@ -70,6 +70,7 @@ export const recordAiMemoryWorkflowEvidence = async (input: {
         WHERE turn.id = ${input.turnId}::uuid
           AND conversation.id = ${input.conversationId}::uuid
           AND conversation.created_by_user_id = ${input.userId}::uuid
+          AND conversation.archived_at IS NULL
           AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
         ON CONFLICT (turn_id, capability_id, resource_type, resource_id)
         DO UPDATE SET resource_title = COALESCE(EXCLUDED.resource_title, ai.memory_workflow_evidence.resource_title)
@@ -96,6 +97,7 @@ export const listAiTurnWorkflowEvidence = async (userId: string, turnId: string)
     WHERE evidence.user_id = ${userId}::uuid
       AND evidence.turn_id = ${turnId}::uuid
       AND conversation.created_by_user_id = evidence.user_id
+      AND conversation.archived_at IS NULL
     ORDER BY evidence.capability_id, evidence.resource_type, evidence.resource_id
   `;
   return rows.map((row) => ({
@@ -127,6 +129,7 @@ export const listAiPendingWorkflowPatterns = async (limit = 5): Promise<AiMemory
     JOIN ai.conversations conversation
       ON conversation.id = evidence.conversation_id AND conversation.created_by_user_id = evidence.user_id
     WHERE evidence.reviewed_at IS NULL
+      AND conversation.archived_at IS NULL
       AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
     GROUP BY evidence.user_id, evidence.capability_id, evidence.resource_type, evidence.resource_id
     HAVING count(*) >= 3
@@ -136,14 +139,17 @@ export const listAiPendingWorkflowPatterns = async (limit = 5): Promise<AiMemory
   return Promise.all(
     groups.map(async (group) => {
       const turns = await sql<{ turn_id: string }[]>`
-        SELECT turn_id
-        FROM ai.memory_workflow_evidence
-        WHERE user_id = ${group.user_id}::uuid
-          AND capability_id = ${group.capability_id}
-          AND resource_type = ${group.resource_type}
-          AND resource_id = ${group.resource_id}
-          AND reviewed_at IS NULL
-        ORDER BY observed_at DESC, turn_id DESC
+        SELECT evidence.turn_id
+        FROM ai.memory_workflow_evidence evidence
+        JOIN ai.conversations conversation
+          ON conversation.id = evidence.conversation_id AND conversation.created_by_user_id = evidence.user_id
+        WHERE evidence.user_id = ${group.user_id}::uuid
+          AND evidence.capability_id = ${group.capability_id}
+          AND evidence.resource_type = ${group.resource_type}
+          AND evidence.resource_id = ${group.resource_id}
+          AND evidence.reviewed_at IS NULL
+          AND conversation.archived_at IS NULL
+        ORDER BY evidence.observed_at DESC, evidence.turn_id DESC
         LIMIT 3
       `;
       return {
@@ -158,6 +164,25 @@ export const listAiPendingWorkflowPatterns = async (limit = 5): Promise<AiMemory
   );
 };
 
+/** Every example used by the model must still belong to pending, active evidence. */
+export const isAiWorkflowPatternEligible = async (pattern: AiMemoryWorkflowPattern): Promise<boolean> => {
+  if (pattern.turnIds.length < 3) return false;
+  const [row] = await sql<{ count: number }[]>`
+    SELECT count(*)::int AS count
+    FROM ai.memory_workflow_evidence evidence
+    JOIN ai.conversations conversation
+      ON conversation.id = evidence.conversation_id AND conversation.created_by_user_id = evidence.user_id
+    WHERE evidence.user_id = ${pattern.userId}::uuid
+      AND evidence.capability_id = ${pattern.capabilityId}
+      AND evidence.resource_type = ${pattern.resourceRef.type}
+      AND evidence.resource_id = ${pattern.resourceRef.id}
+      AND evidence.turn_id IN ${sql(pattern.turnIds)}
+      AND evidence.reviewed_at IS NULL
+      AND conversation.archived_at IS NULL
+  `;
+  return row?.count === pattern.turnIds.length;
+};
+
 export const markAiWorkflowPatternReviewed = async (pattern: AiMemoryWorkflowPattern): Promise<void> => {
   await sql`
     UPDATE ai.memory_workflow_evidence

package/src/ai/projects-routes.ts

@@ -3,7 +3,9 @@ import { z } from "zod";
 import { getCapability } from "../_internal/registry";
 import { CloudResourceRefSchema, cloudResourceRefAppId, resolveCapabilityResourceReader } from "../contracts/capabilities";
 import { AuthenticatedPrincipalSchema } from "../contracts/shared";
-import { type AuthContext, auth, err, fail, ok, rateLimit, respond, v } from "../server";
+import { type AuthContext, auth, err, fail, getLocale, ok, rateLimit, respond, v } from "../server";
+import { ImageMetadataError } from "../services/image-metadata";
+import { aiChatMessages } from "./chat/messages";
 import { decodeAiFileContent } from "./files-store";
 import {
   AI_PROJECT_DESCRIPTION_MAX_CHARS,
@@ -188,6 +190,8 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
           : null;
         return file ? respond(c, ok({ file: publicFile(file, project!.shortId) }), 201) : notFound(c);
       } catch (error) {
+        if (error instanceof ImageMetadataError)
+          return respond(c, { ok: false, error: aiChatMessages(getLocale(c)).malformedImage, status: 422, code: error.code });
         return respond(c, fail(err.badInput(error instanceof Error ? error.message : "Invalid project file.")));
       }
     })

package/src/ai/projects.ts

@@ -10,8 +10,10 @@ import {
   type PermissionLevel,
   type Principal,
 } from "../server/services/access";
+import { stripImageMetadata } from "../services/image-metadata";
 import { toPgUuidArray } from "../services/postgres";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
+import { isAiImage } from "./file-media-type";
 import { mountAiProjectFilePath } from "./file-mount";
 import { pickStoredAiFilePath } from "./files-store";
 import { withAiShortIdForDb } from "./short-id";
@@ -819,6 +821,8 @@ export const aiProjects = {
     if (!(await requireProject(projectId, subject, "write"))) return null;
     if (input.bytes.byteLength > AI_PROJECT_FILE_MAX_BYTES)
       throw new AiFileWriteError("STORAGE_FULL", "Project file exceeds the size limit; nothing was written.");
+    const mimeType = input.mediaType.trim() || "application/octet-stream";
+    const bytes = isAiImage(input.path, mimeType) ? stripImageMetadata(input.bytes) : input.bytes;
     const path = normalizeProjectPath(input.path);
     return sql.begin(async (tx) => {
       const [row] = await tx<ProjectRow[]>`SELECT * FROM ai.projects WHERE id=${projectId}::uuid FOR UPDATE`;
@@ -836,7 +840,7 @@ export const aiProjects = {
         "idx_ai_project_files_short_id",
         (attempt, shortId) => attempt<FileRow[]>`
         INSERT INTO ai.project_files (short_id, project_id, path, media_type, bytes, size, created_by_user_id)
-        VALUES (${shortId}, ${projectId}::uuid, ${path}, ${input.mediaType.trim() || "application/octet-stream"}, ${input.bytes}, ${input.bytes.byteLength}, ${actorUserId(subject)}::uuid)
+        VALUES (${shortId}, ${projectId}::uuid, ${path}, ${mimeType}, ${bytes}, ${bytes.byteLength}, ${actorUserId(subject)}::uuid)
         ON CONFLICT (project_id, path) DO UPDATE SET
           media_type = EXCLUDED.media_type, bytes = EXCLUDED.bytes, size = EXCLUDED.size, updated_at = now()
         RETURNING id, short_id, project_id, path, media_type, size, updated_at

package/src/ai/protocol.ts

@@ -179,6 +179,39 @@ export const reconcileResolvedTurnActions = (
   });
 };
 
+/** Decode complete provider names; hashes and ambiguous separators have no exact inverse. */
+const canonicalToolName = (name: string, presentation?: AiToolPresentation): string => {
+  if (name.length === 64 && /__[0-9a-f]{12}$/.test(name)) return name;
+  const decode = (value: string): string | undefined => {
+    const tokens = /[a-zA-Z0-9-]|__|_dot_|_u([0-9a-f]+)_/gy;
+    let decoded = "",
+      offset = 0;
+    while (offset < value.length) {
+      const token = tokens.exec(value);
+      if (!token) return undefined;
+      if (token[0] === "__") decoded += "_";
+      else if (token[0] === "_dot_") decoded += ".";
+      else if (token[1]) {
+        const codePoint = Number.parseInt(token[1], 16);
+        if (codePoint > 0x10ffff || codePoint.toString(16) !== token[1]) return undefined;
+        const character = String.fromCodePoint(codePoint);
+        if (/^[a-zA-Z0-9_.-]$/.test(character)) return undefined;
+        decoded += character;
+      } else decoded += token[0];
+      offset = tokens.lastIndex;
+    }
+    return decoded || undefined;
+  };
+  const candidates: string[] = [];
+  for (const match of name.matchAll(/(?=__(query|action)__)/g)) {
+    const appId = decode(name.slice(0, match.index));
+    const localId = decode(name.slice(match.index + match[1]!.length + 4));
+    if (appId && localId && (!presentation || (presentation.appId === appId && presentation.capabilityKind === match[1])))
+      candidates.push(`${appId}.${localId}`);
+  }
+  return candidates.length === 1 ? candidates[0]! : name;
+};
+
 /**
  * Convert persisted loop messages into the block model. Shared by the executor
  * (baseline rebuild on claim) and the client (rendering finished turns), so a
@@ -211,7 +244,7 @@ export const buildBlocksFromMessages = (
             id: toolBlockId(block.id),
             kind: "tool",
             callId: block.id,
-            name: block.name,
+            name: canonicalToolName(block.name, meta?.toolPresentations?.[block.id]),
             args: block.args,
             status: "running",
             presentation: meta?.toolPresentations?.[block.id],

package/src/ai/provider.ts

@@ -1,10 +1,25 @@
-import type { Provider } from "@k2b/nessi/ai";
+import type { Provider, ReasoningEffort } from "@k2b/nessi/ai";
 import { anthropic, gemini, mistral, ollama, openAICompatible, openai, openrouter } from "@k2b/nessi/ai";
 import type { AiModelProfile } from "./types";
 
 /** Bound provider stalls while allowing long-context requests up to 60s to begin streaming. */
 const PROVIDER_TIMEOUTS = { firstByteMs: 60_000, idleMs: 60_000 } as const;
 
+/**
+ * Reasoning for structured tasks and compaction: the requests every provider accepted before Nessi 0.17. A global
+ * "none" breaks models that cannot turn reasoning off, so Anthropic, Mistral and Ollama keep their model defaults.
+ */
+export const taskReasoningEffort = (provider: Pick<Provider, "family">): ReasoningEffort | undefined => {
+  switch (provider.family) {
+    case "openai-compatible":
+      return "low";
+    case "gemini":
+      return "none";
+    default:
+      return undefined;
+  }
+};
+
 const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
   apiKey,
   baseURL: profile.baseURL,

package/src/ai/quota-provider.ts

@@ -170,7 +170,10 @@ export function inferenceProvider(
           )
             usage = { input: 0, output: 0 };
           if (event.type === "usage") {
-            if (event.finishReason === "aborted" || event.finishReason === "interrupted" || event.finishReason === "error") failed = true;
+            if (event.finishReason === "aborted" || event.finishReason === "interrupted" || event.finishReason === "error") {
+              failed = true;
+              error ??= `The provider finished with ${event.finishReason}.`;
+            }
             const { input, output } = event.usage;
             // Some adapters synthesize all-zero usage when the endpoint reports none.
             if (Number.isSafeInteger(input) && Number.isSafeInteger(output) && input >= 0 && output >= 0 && input + output > 0)

package/src/ai/routes.ts

@@ -18,13 +18,15 @@ import {
   v,
 } from "../server";
 import { isRequestCredentialCurrent } from "../server/middleware/auth";
+import { ImageMetadataError } from "../services/image-metadata";
 import { logger } from "../services/logging";
 import { coreSettings } from "../services/settings/api";
 import { readThemeFromCookieHeader } from "../shared/theme";
 import type { AiToolApprovalContext } from "./approvals";
-import { assistantAiSettingsState, listAssistantAiModels, selectAssistantAiModelId } from "./assistant-models";
+import { assistantAiSettingsState, listAssistantAiModels, resolveAssistantAudioModel, selectAssistantAiModelId } from "./assistant-models";
 import { AI_AUDIO_MAX_BYTES } from "./audio-format";
 import { buildAiCapabilityCatalog } from "./capabilities";
+import { aiChatMessages } from "./chat/messages";
 import { getAiChatQuotas } from "./chat-quotas";
 import { createConfiguredDefaultCloudAiTools } from "./default-tools";
 import { enqueueAiDictation } from "./dictation-runtime";
@@ -58,7 +60,6 @@ import {
   queuedMessageAccepted,
   updateQueuedMessage,
 } from "./message-queue";
-import { aiModelAccess } from "./model-access";
 import { personalAiModelPolicy } from "./personal-agent";
 import { aiActorUser, aiPrefsUserId, aiUserPrefs } from "./prefs";
 import { aiProjects } from "./projects";
@@ -84,7 +85,6 @@ import { aiConversations } from "./store";
 import { createAiConversationStreamResponse, loadAiStreamState } from "./stream";
 import { composeAiSystemPrompt } from "./system-prompt";
 import { aiToolPromptHints } from "./tools";
-import { resolveAiAudioModel } from "./transcription";
 import type { AiConversation, AiModelPolicy, AiTurn } from "./types";
 
 /** Everything a resolved, authorized request needs to run against the shared runtime. */
@@ -420,7 +420,10 @@ export const aiRoutes = (() => {
         const skillCatalog = selectAiSkillCatalog(availableSkills, previewProfile?.contextWindow ?? 0, "");
         const tools = toolsSupported
           ? [
-              ...(await createConfiguredDefaultCloudAiTools()),
+              ...(await createConfiguredDefaultCloudAiTools({
+                accessSubject: c.get("accessSubject"),
+                allowedDataBoundaries: ctx.modelPolicy.allowedDataBoundaries,
+              })),
               ...(memoryEnabled ? [createCloudAiMemoryTool()] : []),
               ...(availableSkills.length ? [createCloudAiLoadSkillTool(c.get("accessSubject"))] : []),
               ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(c.get("accessSubject"))] : []),
@@ -526,7 +529,14 @@ export const aiRoutes = (() => {
             return respond(c, fail(err.internal("The live capability catalog is unavailable.")));
           }
         }
-        const builtInNames = new Set((await createConfiguredDefaultCloudAiTools()).map((tool) => tool.def.name));
+        const builtInNames = new Set(
+          (
+            await createConfiguredDefaultCloudAiTools({
+              accessSubject: c.get("accessSubject"),
+              allowedDataBoundaries: ctx.modelPolicy.allowedDataBoundaries,
+            })
+          ).map((tool) => tool.def.name),
+        );
         const preloadTools = (body.preloadTools ?? []).map((requested) => {
           if ("name" in requested) return builtInNames.has(requested.name) ? requested.name : null;
           return (
@@ -1178,11 +1188,7 @@ export const aiRoutes = (() => {
             conversationId: conversation.id,
             userId: ctx.ownerUserId,
             bytes: new Uint8Array(await file.arrayBuffer()),
-            resolveModel: async () => {
-              const model = await resolveAiAudioModel({ allowedDataBoundaries: ctx.modelPolicy.allowedDataBoundaries });
-              await aiModelAccess.assertAllowed(model.profile.id, c.get("accessSubject"));
-              return model;
-            },
+            resolveModel: () => resolveAssistantAudioModel(c.get("accessSubject"), ctx.modelPolicy.allowedDataBoundaries),
           });
           await enqueueAiDictation(dictation.id).catch(() => undefined); // The DB sweep heals failed delivery.
           return respond(c, ok(dictation));
@@ -1312,6 +1318,8 @@ export const aiRoutes = (() => {
           });
           return respond(c, ok({ file: stat }));
         } catch (error) {
+          if (error instanceof ImageMetadataError)
+            return respond(c, { ok: false, error: aiChatMessages(getLocale(c)).malformedImage, status: 422, code: error.code });
           logger("ai:files").warn("Conversation upload failed", {
             code: "file_upload_failed",
             conversationId: conversation.id,
@@ -1372,6 +1380,8 @@ export const aiRoutes = (() => {
             allowUserOverwrite: existing?.origin === "user",
           });
         } catch (error) {
+          if (error instanceof ImageMetadataError)
+            return respond(c, { ok: false, error: aiChatMessages(getLocale(c)).malformedImage, status: 422, code: error.code });
           return respond(c, fail(err.badInput(error instanceof Error ? error.message : "Failed to write file")));
         }
         return respond(c, ok({ file: await aiFileStore.stat({ conversationId: conversation.id, path }) }));