@k2b/cloud 0.28.0 → 0.29.1

package/src/ai/default-tools.ts

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import type { AccessSubject } from "../server";
+import { resolveAssistantAudioModel } from "./assistant-models";
 import { createCloudAiTranscribeAudioTool } from "./audio-tool";
 import {
   CODE_RUNTIME_TOOL_NAMES,
@@ -158,7 +160,7 @@ export const createCloudAiCodeTools = () => [
   defineAiTool({
     name: "code_check",
     description:
-      "Mandatory HTML app self-test: write files and steps.json (at most 20 main-flow steps), call code_check({id} OR {files}), look at EVERY screenshot with view_image, fix and check again, then code_open/code_present/code_publish. Runs desktop 1280×800 and phone 390×844 in opposite themes on separate throwaway copies of database, shared KV/files and only your own KV.user. Steps run in both views; reload keeps the copy. Match accessible role/name, label or text exactly, then case-insensitively, then by substring; ambiguous targets fail with candidates, placeholders are never names. Fill numbers with a dot. Upload file is an app-relative source path or chat file path/name. AI runs for real; HTTP, capability effects and approvals are unavailable; read-only granted capabilities run except in background turns. Returns passed, content hash (files, steps and tables), height, issues, calls, captured downloads, three PNG chat paths and an untrusted aria tree (4 KiB). Passing means not broken: inspect screenshots for cut-off, red, tight or doubled content. Self-test is a workflow guard, not a security mechanism. Aborting closes pages and discards copies. Bounded to 45 seconds, 1000 copied rows/16 MiB (schema only beyond), 64 downloads/250 MiB total/50 MiB per file.",
+      "Mandatory HTML app self-test: write files and steps.json (at most 20 main-flow steps, ending in the filled main state), call code_check({id} OR {files}), fix every error and layout warning, call view_image({path, prompt: review.prompt}) for EVERY path in review.paths (screenshots and PDFs), fix what it finds and check again, then code_open/code_present/code_publish. Runs desktop 1280×800 and phone 390×844 in opposite themes on separate throwaway copies of database, shared KV/files and only your own KV.user. Steps run in both views; reload keeps the copy. Match accessible role/name, label or text exactly, then case-insensitively, then by substring; ambiguous targets fail with candidates, placeholders are never names. Fill numbers with a dot. Upload file is an app-relative source path or chat file path/name. AI runs for real; HTTP, capability effects and approvals are unavailable; read-only granted capabilities run except in background turns. Returns passed, content hash (files, steps and tables), height, issues, calls, captured downloads, three whole-page PNG chat paths (up to 2000 px tall; cropped marks a longer page), review and an untrusted aria tree (4 KiB). Passing means not broken; misaligned rows, also in PDFs, and broken values only warn. Self-test is a workflow guard, not a security mechanism. Aborting closes pages and discards copies. Bounded to 45 seconds, 1000 copied rows/16 MiB (schema only beyond), 64 downloads/250 MiB total/50 MiB per file.",
     inputSchema: CodeCheckInput,
     outputSchema: z.json(),
     approval: "never",
@@ -198,6 +200,7 @@ export const CLOUD_AI_DEFERRED_BUILTIN_TOOL_NAMES = new Set<string>([
 
 export const createConfiguredDefaultCloudAiTools = async (config?: {
   firecrawlApiKey?: string | null;
+  accessSubject?: AccessSubject | null;
   fetch?: typeof fetch;
   allowedDataBoundaries?: AiDataBoundary[];
 }) => {
@@ -213,8 +216,12 @@ export const createConfiguredDefaultCloudAiTools = async (config?: {
     createCloudAiPresentTool(),
     createCloudAiCalculateTool(),
     createCloudAiViewImageTool(),
-    createCloudAiTranscribeAudioTool(),
   ];
+  const audioModelConfigured = await resolveAssistantAudioModel(config?.accessSubject ?? null, config?.allowedDataBoundaries).then(
+    () => true,
+    () => false,
+  );
+  if (audioModelConfigured) tools.push(createCloudAiTranscribeAudioTool());
   const firecrawlConfigured =
     config && "firecrawlApiKey" in config ? Boolean(config.firecrawlApiKey?.trim()) : await isCloudAiFirecrawlConfigured();
   if (firecrawlConfigured) {

package/src/ai/executor.ts

@@ -1,10 +1,12 @@
-import type { CompactEvent, LoopAggregate, NessiLoop, OutboundEvent } from "@k2b/nessi";
+import type { AssistantMessage, CompactEvent, LoopAggregate, NessiLoop, OutboundEvent } from "@k2b/nessi";
 import { compact, nessi } from "@k2b/nessi";
 import { listCapabilities } from "../_internal/registry";
 import type { CapabilityActionReview } from "../contracts/capabilities";
 import type { AccessSubject, RequestActor } from "../server";
 import { createHelpReader } from "../services/help";
 import { logger } from "../services/logging";
+import { getMandate } from "../services/mandates";
+import type { MandatePolicyV1 } from "../services/mandates/policy";
 import { coreSettings } from "../services/settings/api";
 import { normalizeLocale } from "../shared/locale";
 import {
@@ -14,13 +16,13 @@ import {
   aiTurnAllowsRememberedApprovals,
   hasRememberedAiToolApproval,
 } from "./approvals";
-import { isAssistantChatTurn } from "./assistant-models";
+import { aiChatAccessSubject, isAssistantChatTurn, resolveAssistantAudioModel } from "./assistant-models";
 import { CODE_RUNTIME_TOOL_NAMES } from "./browser-code-contracts";
-import { createAiToolResolver, createRunToolStore } from "./capabilities";
+import { type AiCapabilityCatalogEntry, createAiToolResolver, createRunToolStore } from "./capabilities";
 import { AiCapabilityExecutionError, executeAiCapability, resolveAiCapabilityActor, reviewAiCapability } from "./capability-execution";
 import { aiChatMessages } from "./chat/messages";
 import { aiTurnErrorText } from "./chat/turn-error";
-import { aiChatTasks } from "./chat-tasks";
+import { AiChatTaskAuthorityError, aiChatTasks } from "./chat-tasks";
 import { createCloudCompactFn } from "./compaction";
 import { createCloudAiCodeTools, createCloudAiLocalBashTool, createConfiguredDefaultCloudAiTools } from "./default-tools";
 import { aiFileStore } from "./files-store";
@@ -60,6 +62,7 @@ import { aiToolAudit } from "./tool-audit";
 import { acceptCanonicalToolNames } from "./tool-call-names";
 import { resolveAiToolResultMaxChars } from "./tool-result-budget";
 import { aiToolPromptHints, type PreparedAiTools, prepareAiTools } from "./tools";
+import { AiTranscriptionError } from "./transcription";
 import {
   AiTurnFailure,
   type AiTurnFailureInfo,
@@ -68,6 +71,7 @@ import {
   aiTurnReasonFromThrown,
   rememberProviderErrors,
 } from "./turn-failure";
+import { type AiTurnGuidance, loadAiTurnGuidance } from "./turn-guidance";
 import { type AiTurnPolicyToolCall, applyAiTurnPolicy } from "./turn-policy";
 import { createTurnTimingRecorder, withDurableTurnTiming } from "./turn-timing";
 import type {
@@ -91,10 +95,17 @@ const AI_COALESCE_MS = 25;
 const AI_COALESCE_MAX_CHARS = 512;
 const AI_ACTION_BUDGET_MS = 24 * 60 * 60_000;
 
+// Failed generation can contain calls that nessi deliberately never executes or resumes.
+const isToolRound = (message: AssistantMessage): boolean =>
+  message.stopReason !== "error" &&
+  message.stopReason !== "interrupted" &&
+  message.stopReason !== "aborted" &&
+  message.content.some((block) => block.type === "tool_call");
+
 const toolRoundState = (messages: AiStoredMessage[]): { issued: number; completed: number } => {
   const completedCallIds = new Set(messages.flatMap(({ message }) => (message.role === "tool_result" ? [message.callId] : [])));
   const rounds = messages.flatMap(({ message }) => {
-    if (message.role !== "assistant") return [];
+    if (message.role !== "assistant" || !isToolRound(message)) return [];
     const callIds = message.content.flatMap((block) => (block.type === "tool_call" ? [block.id] : []));
     return callIds.length > 0 ? [callIds] : [];
   });
@@ -557,7 +568,10 @@ const materializeChatConfig = async (config: AiChatTurnRunConfig, signal: AbortS
     tools:
       source.kind === "default"
         ? [
-            ...(await createConfiguredDefaultCloudAiTools()),
+            ...(await createConfiguredDefaultCloudAiTools({
+              accessSubject: aiChatAccessSubject(config.actor),
+              allowedDataBoundaries: config.modelPolicy?.allowedDataBoundaries,
+            })),
             // Cloud runs the code tools itself; only tools a client must run wait for that client to declare them.
             ...[createCloudAiLocalBashTool(), ...createCloudAiCodeTools()].filter(
               (tool) => tool.location === "server" || config.clientToolIds?.some((name) => name === tool.def.name),
@@ -855,6 +869,20 @@ export class AiTurnExecutor {
           (tool) => (!allowed || allowed.has(tool.def.name)) && !(config.mandate && ["code_open", "code_secret"].includes(tool.def.name)),
         )
       : [];
+    let audioUnavailableInstruction: string | undefined;
+    if (
+      defaultToolSource &&
+      toolsSupported &&
+      [...(config.files?.attached ?? []), ...(config.files?.available ?? [])].some((file) => file.mediaType.startsWith("audio/")) &&
+      !sourceToolNames.includes("transcribe_audio")
+    ) {
+      try {
+        await resolveAssistantAudioModel(aiChatAccessSubject(config.actor), material.modelPolicy?.allowedDataBoundaries);
+      } catch (error) {
+        const reason = error instanceof AiTranscriptionError ? error.message : "Audio transcription is not available right now.";
+        audioUnavailableInstruction = `Audio files in this conversation cannot be transcribed: ${reason} Tell the user this reason when they ask about audio content.`;
+      }
+    }
     const offeredToolNames = new Set(activeTools.map((tool) => tool.def.name));
     // Built-ins that exist but this turn does not offer: client tools without their client, tools a
     // task cannot use, and tools outside the conversation's fixed scope. load_tools explains each one.
@@ -963,6 +991,52 @@ export class AiTurnExecutor {
 
     const appliedSteers: AiTurnSteer[] = [];
 
+    let mandatePolicy: MandatePolicyV1 | null | undefined;
+    if (config.background && config.mandate) {
+      mandatePolicy = null;
+      try {
+        const mandate = await getMandate(config.mandate.id);
+        if (mandate && mandate.state === "active" && mandate.revision === config.mandate.revision) {
+          mandatePolicy = mandate.policy;
+        } else {
+          backgroundError = "Scheduled task mandate is unavailable or changed; recreate or update the task.";
+        }
+      } catch {
+        backgroundError = "Scheduled task mandate could not be loaded; retry or update the task.";
+      }
+    }
+    if (backgroundError) {
+      signal.removeEventListener("abort", onSignal);
+      await this.finalize(
+        conversationId,
+        turnId,
+        pipeline,
+        "failed",
+        { error: { code: "not_allowed" }, detail: backgroundError, message: backgroundError },
+        "chat",
+        promptLocale,
+      );
+      return;
+    }
+    const authorizeBackground =
+      config.background && config.mandate
+        ? async (entry: AiCapabilityCatalogEntry, args: unknown) => {
+            try {
+              await aiChatTasks.authorizeCapability({
+                mandate: config.mandate!,
+                appId: entry.appId,
+                capabilityId: entry.operation.localId,
+                kind: entry.kind,
+                input: args,
+                approval: entry.kind === "action" && "approval" in entry.operation ? entry.operation.approval : undefined,
+              });
+            } catch (error) {
+              if (!(error instanceof AiChatTaskAuthorityError && error.code === "MANDATE_POLICY_DENIED"))
+                backgroundError = error instanceof Error ? error.message : "Background capability access denied";
+              throw error;
+            }
+          }
+        : undefined;
     const toolStore = config.background ? createRunToolStore(await aiConversations.getLoadedTools({ conversationId })) : aiConversations;
     const tools = toolActor
       ? createAiToolResolver({
@@ -970,6 +1044,7 @@ export class AiTurnExecutor {
           actor: capabilityAuthority?.actor ?? toolActor,
           staticTools: activeTools,
           allowedTools,
+          mandatePolicy,
           unofferedTools,
           runtimeContext: dynamicToolRuntimeContext,
           store: toolStore,
@@ -995,25 +1070,7 @@ export class AiTurnExecutor {
                   }),
               }
             : {}),
-          ...(config.background && config.mandate
-            ? {
-                authorizeBackground: async (entry, args) => {
-                  try {
-                    await aiChatTasks.authorizeCapability({
-                      mandate: config.mandate!,
-                      appId: entry.appId,
-                      capabilityId: entry.operation.localId,
-                      kind: entry.kind,
-                      input: args,
-                      approval: entry.kind === "action" && "approval" in entry.operation ? entry.operation.approval : undefined,
-                    });
-                  } catch (error) {
-                    backgroundError = error instanceof Error ? error.message : "Background capability access denied";
-                    throw error;
-                  }
-                },
-              }
-            : {}),
+          authorizeBackground,
           onReview: (callId, review) => {
             capabilityActionReviews.set(callId, review);
             if (review.approvalScope) rememberableCapabilityApprovals.set(callId, review.approvalScope);
@@ -1022,16 +1079,7 @@ export class AiTurnExecutor {
             ? {
                 execute: async (entry, args, context) => {
                   try {
-                    if (config.background && config.mandate) {
-                      await aiChatTasks.authorizeCapability({
-                        mandate: config.mandate,
-                        appId: entry.appId,
-                        capabilityId: entry.operation.localId,
-                        kind: entry.kind,
-                        input: args,
-                        approval: entry.kind === "action" && "approval" in entry.operation ? entry.operation.approval : undefined,
-                      });
-                    }
+                    await authorizeBackground?.(entry, args);
                     const result = await executeAiCapability({
                       conversationId,
                       turnId,
@@ -1101,12 +1149,43 @@ export class AiTurnExecutor {
       skillSubject,
       activeTools.some((tool) => tool.def.name === "load_skill"),
     );
-    const workingPlan = (await aiConversations.getConversation({ conversationId }))?.todoPlan;
+    const chat = await aiConversations.getConversation({ conversationId });
+    const workingPlan = chat?.todoPlan;
+    const skillCatalogOffered = activeTools.some((tool) => tool.def.name === "load_skill");
+    const skillCreatorAvailable = availableSkills.some((skill) => skill.name === "skill-creator");
+    // Offer hints and the recent-work summary only guide a fresh turn a person follows; a resumed
+    // attempt after an approval or a scheduled run gets neither.
+    let guidance: AiTurnGuidance = {};
+    if (isFresh && !config.background && defaultToolSource && user && chat) {
+      try {
+        guidance = await loadAiTurnGuidance(
+          {
+            chat,
+            turnId,
+            ownerUserId: user.id,
+            input: config.input,
+            instructions: [settings.globalInstructions, config.project?.instructions, memory?.text],
+            skillOffers: skillCatalogOffered && skillCreatorAvailable && loadedSkills.length === 0,
+            memoryOffers: memoryToolEnabled,
+            hasAttachments: Boolean(config.files?.attached.length),
+          },
+          aiConversations,
+        );
+      } catch (error) {
+        log.warn("AI turn guidance unavailable; continuing without it", {
+          conversationId,
+          turnId,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    }
     const systemPrompt = composeAiSystemPrompt({
       globalInstructions: settings.globalInstructions,
       loadedSkills,
       turnInstructions: [
         material.systemPrompt,
+        audioUnavailableInstruction,
+        guidance.offerHint,
         workingPlan
           ? `Current working plan (new todo_write results supersede this):\n${JSON.stringify({ todos: workingPlan.todos })}`
           : undefined,
@@ -1122,7 +1201,7 @@ export class AiTurnExecutor {
       project: config.project,
       files: config.files,
       projectToolEnabled,
-      skills: activeTools.some((tool) => tool.def.name === "load_skill") ? skillCatalog.skills : undefined,
+      skills: skillCatalogOffered ? skillCatalog.skills : undefined,
       omittedSkillCount: activeTools.some((tool) => tool.def.name === "search_skills") ? skillCatalog.omitted : 0,
       user,
       memoryEnabled: memoryActive,
@@ -1135,11 +1214,19 @@ export class AiTurnExecutor {
       timeZone,
       locale: promptLocale,
       interactive: !config.background,
-      skillCreatorAvailable: availableSkills.some((skill) => skill.name === "skill-creator"),
+      skillCreatorAvailable,
+      recentWork: guidance.recentWork,
     });
     // The turn policy counts the whole turn, including rounds that compaction archived.
     const turnMessages = await aiConversations.listTurnMessages({ conversationId, loopId: turnId, includeCompacted: true });
     const turnBlocks = buildBlocksFromMessages(turnMessages);
+    const providerNamesByCallId = new Map(
+      turnMessages.flatMap(({ message }) =>
+        message.role === "assistant"
+          ? message.content.flatMap((part) => (part.type === "tool_call" ? [[part.id, part.name] as const] : []))
+          : [],
+      ),
+    );
     const priorToolRounds = toolRoundState(turnMessages);
     const quotaSubject = accessSubjectForActor(material.actor);
     const deadline = claim.turn.deadline ? Date.parse(claim.turn.deadline) : null;
@@ -1174,7 +1261,7 @@ export class AiTurnExecutor {
       runBudgetMs: claim.turn.runBudgetMs ?? null,
       finishedToolCalls: turnBlocks
         .slice(turnBlocks.findLastIndex((block) => block.kind === "steer_applied") + 1)
-        .flatMap((block) => (block.kind === "tool" ? [block] : [])),
+        .flatMap((block) => (block.kind === "tool" ? [{ ...block, name: providerNamesByCallId.get(block.callId) ?? block.name }] : [])),
       onDecision: (decision) =>
         decision.kind === "hint"
           ? log.warn("AI turn got a loop hint", { conversationId, turnId, hints: decision.hints })
@@ -1413,7 +1500,7 @@ export class AiTurnExecutor {
             result: event.result,
             isError: event.isError === true,
           });
-        } else if (event.type === "turn_end" && event.message.content.some((block) => block.type === "tool_call")) {
+        } else if (event.type === "turn_end" && !abortController.signal.aborted && isToolRound(event.message)) {
           noteToolRound();
         } else if (event.type === "issue") {
           lastIssueMessage = event.issue.message;

package/src/ai/file-media-type.ts

@@ -38,3 +38,7 @@ export const guessAiMediaType = (path: string): string => {
   const ext = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
   return MEDIA_TYPES[ext] ?? "application/octet-stream";
 };
+
+/** Image classification includes filenames when clients send a generic media type. */
+export const isAiImage = (path: string, mediaType: string): boolean =>
+  mediaType.startsWith("image/") || guessAiMediaType(path).startsWith("image/");

package/src/ai/files-store.ts

@@ -1,5 +1,7 @@
 import { type SQL, sql } from "bun";
+import { stripImageMetadata } from "../services/image-metadata";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
+import { isAiImage } from "./file-media-type";
 
 export { guessAiMediaType } from "./file-media-type";
 
@@ -79,9 +81,11 @@ export const createUniqueAiFileInTransaction = async (
     throw new AiFileWriteError("STORAGE_FULL", `File exceeds the per-file limit of ${Math.floor(maxFile / (1024 * 1024))} MB.`);
   }
 
+  const bytes = isAiImage(input.path, input.mediaType ?? "application/octet-stream") ? stripImageMetadata(input.bytes) : input.bytes;
+
   await tx`SELECT id FROM ai.conversations WHERE id = ${input.conversationId} FOR UPDATE`;
   const total = await aiConversationStoredBytes(tx, input.conversationId);
-  if (total + input.bytes.byteLength > maxConversation) {
+  if (total + bytes.byteLength > maxConversation) {
     throw new AiFileWriteError("STORAGE_FULL", `Conversation storage limit of ${Math.floor(maxConversation / (1024 * 1024))} MB exceeded.`);
   }
 
@@ -89,7 +93,7 @@ export const createUniqueAiFileInTransaction = async (
     const path = numberedAiFilePath(input.path, number);
     const rows = await tx<FileRow[]>`
         INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, dictation_recorded_at, updated_at)
-        SELECT ${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, ${input.origin}, ${input.dictationRecordedAt ?? null}, now()
+        SELECT ${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, ${input.origin}, ${input.dictationRecordedAt ?? null}, now()
         WHERE NOT EXISTS (
           SELECT 1 FROM ai.files WHERE conversation_id = ${input.conversationId} AND normalize(path, NFC) = ${path.normalize("NFC")}
         )
@@ -191,7 +195,8 @@ export const aiFileStore = {
     producerCallKey: string;
     mediaType: string;
   }): Promise<AiFileStat> {
-    if (input.bytes.byteLength > AI_FILES_MAX_FILE_BYTES_DEFAULT)
+    const bytes = isAiImage(input.path, input.mediaType) ? stripImageMetadata(input.bytes) : input.bytes;
+    if (bytes.byteLength > AI_FILES_MAX_FILE_BYTES_DEFAULT)
       throw new AiFileWriteError("STORAGE_FULL", "File exceeds the destination file limit; nothing was written.");
     if (!normalizeAiFilePath(input.path)) {
       throw new Error("Invalid tool artifact path or file size.");
@@ -210,18 +215,18 @@ export const aiFileStore = {
           Number(row.version) === 1 &&
           row.producer_call_key === input.producerCallKey &&
           row.media_type === input.mediaType &&
-          Buffer.from(row.bytes).equals(Buffer.from(input.bytes))
+          Buffer.from(row.bytes).equals(Buffer.from(bytes))
         )
           return toStat(row);
         throw new AiFileWriteError("CONFLICT", "Destination file already exists. Choose another path; nothing was written.");
       }
       const total = await aiConversationStoredBytes(tx, input.conversationId);
-      if (total + input.bytes.byteLength > AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT) {
+      if (total + bytes.byteLength > AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT) {
         throw new AiFileWriteError("STORAGE_FULL", "Conversation storage limit exceeded.");
       }
       const rows = await tx<FileRow[]>`
         INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, producer_call_key)
-        VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType}, ${input.bytes.byteLength}, 'assistant', ${input.producerCallKey})
+        VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType}, ${bytes.byteLength}, 'assistant', ${input.producerCallKey})
         RETURNING path, size, media_type, origin, dictation_recorded_at, updated_at, version
       `;
       return toStat(rows[0]!);
@@ -364,6 +369,8 @@ export const aiFileStore = {
       throw new AiFileWriteError("STORAGE_FULL", `File exceeds the per-file limit of ${Math.floor(maxFile / (1024 * 1024))} MB.`);
     }
 
+    const bytes = isAiImage(input.path, input.mediaType ?? "application/octet-stream") ? stripImageMetadata(input.bytes) : input.bytes;
+
     return sql.begin(async (tx) => {
       const [conversation] = await tx<
         { id: string; created_by_user_id: string; archived_at: Date | null }[]
@@ -384,7 +391,7 @@ export const aiFileStore = {
         if (version !== input.expectedVersion) throw new AiFileVersionConflict();
       }
       const otherBytes = await aiConversationStoredBytes(tx, input.conversationId, path);
-      if (otherBytes + input.bytes.byteLength > maxConversation) {
+      if (otherBytes + bytes.byteLength > maxConversation) {
         throw new AiFileWriteError(
           "STORAGE_FULL",
           `Conversation storage limit of ${Math.floor(maxConversation / (1024 * 1024))} MB exceeded.`,
@@ -394,7 +401,7 @@ export const aiFileStore = {
         if (input.allowUserOverwrite) {
           const written = await tx<{ id: string }[]>`
             UPDATE ai.files
-            SET dictation_recorded_at = NULL, bytes = ${input.bytes}, media_type = ${input.mediaType ?? "application/octet-stream"}, size = ${input.bytes.byteLength}, updated_at = now(), version = version + 1
+            SET dictation_recorded_at = NULL, bytes = ${bytes}, media_type = ${input.mediaType ?? "application/octet-stream"}, size = ${bytes.byteLength}, updated_at = now(), version = version + 1
             WHERE conversation_id = ${input.conversationId} AND path = ${path} AND origin = 'user'
             RETURNING id
           `;
@@ -402,13 +409,13 @@ export const aiFileStore = {
         } else {
           await tx`
             INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, updated_at)
-            VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, 'user', now())
+            VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, 'user', now())
           `;
         }
       } else {
         const written = await tx<{ id: string }[]>`
           INSERT INTO ai.files (conversation_id, path, bytes, media_type, size, origin, updated_at)
-          VALUES (${input.conversationId}, ${path}, ${input.bytes}, ${input.mediaType ?? "application/octet-stream"}, ${input.bytes.byteLength}, 'assistant', now())
+          VALUES (${input.conversationId}, ${path}, ${bytes}, ${input.mediaType ?? "application/octet-stream"}, ${bytes.byteLength}, 'assistant', now())
           ON CONFLICT (conversation_id, path) DO UPDATE SET
             bytes = EXCLUDED.bytes,
             media_type = EXCLUDED.media_type,

package/src/ai/http.ts

@@ -122,6 +122,15 @@ export type AiTurnContentPart = z.infer<typeof AiUserContentPartSchema>;
 
 export const AiClientToolIdSchema = z.enum(["local_bash", ...CODE_RUNTIME_TOOL_NAMES] satisfies [AiClientToolId, ...AiClientToolId[]]);
 
+// Names use aiCapabilityToolName's provider grammar and 64-character limit. The 64-item cap matches allowedTools, with headroom
+// for retired and not-yet-known names; 64 names × 64 ASCII characters bounds advertised name text to 4 KiB.
+const AI_CLIENT_TOOL_MAX_ITEMS = 64;
+const AiClientToolIdsSchema = z
+  .array(z.string().regex(/^[a-zA-Z0-9_-]{1,64}$/))
+  .max(AI_CLIENT_TOOL_MAX_ITEMS)
+  .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
+  .transform((ids) => ids.filter((id): id is AiClientToolId => AiClientToolIdSchema.safeParse(id).success));
+
 export const AiTurnInputSchema = z
   .object({
     message: z.string().trim().max(20000).optional(),
@@ -131,11 +140,7 @@ export const AiTurnInputSchema = z
       .max(AI_TURN_ATTACHMENT_MAX_ITEMS * 2 + 1)
       .optional(),
     modelProfileId: z.string().trim().min(1).optional(),
-    clientToolIds: z
-      .array(AiClientToolIdSchema)
-      .max(1 + CODE_RUNTIME_TOOL_NAMES.length)
-      .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
-      .optional(),
+    clientToolIds: AiClientToolIdsSchema.optional(),
   })
   .refine((input) => Boolean(input.message?.trim() || input.content?.length), {
     message: "Message or content is required.",
@@ -156,11 +161,7 @@ export const AiSubmitConversationDraftInputSchema = z.object({
   queueId: z.uuid().optional(),
   draftRevision: z.number().int().min(1),
   modelProfileId: z.string().trim().min(1).optional(),
-  clientToolIds: z
-    .array(AiClientToolIdSchema)
-    .max(1 + CODE_RUNTIME_TOOL_NAMES.length)
-    .refine((ids) => new Set(ids).size === ids.length, "Client tool IDs must be unique")
-    .optional(),
+  clientToolIds: AiClientToolIdsSchema.optional(),
 });
 
 export const AiSteerInputSchema = z.object({

package/src/ai/index.ts

@@ -76,6 +76,7 @@ export {
 } from "./enrich";
 export { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 export { aiConversationFileManifest } from "./file-context";
+export { isAiImage } from "./file-media-type";
 export { AiFileLocation, AiFileReference } from "./file-reference-contracts";
 export {
   AI_FILES_MAX_CONVERSATION_BYTES_DEFAULT,

package/src/ai/memories.ts

@@ -412,6 +412,7 @@ export const aiMemories = {
    * Apply one model proposal as an ownership-checked transaction. Background
    * learning may only mutate normal background memories; user, agent, and
    * pinned entries remain authoritative.
+   * The source chat must still be active; the row lock makes this atomic with archiving.
    */
   async applyBackgroundProposal(input: {
     userId: string;
@@ -437,6 +438,7 @@ export const aiMemories = {
         FROM ai.conversations c
         WHERE c.id = ${input.sourceConversationId}::uuid
           AND c.created_by_user_id = ${input.userId}::uuid
+          AND c.archived_at IS NULL
           AND (${input.sourceMessageId ?? null}::uuid IS NULL OR EXISTS (
             SELECT 1 FROM ai.messages m
             WHERE m.id = ${input.sourceMessageId ?? null}::uuid AND m.conversation_id = c.id