@k2b/cloud 0.29.1 → 0.31.0

package/src/ai/index.ts

@@ -1,13 +1,20 @@
+export { type AiAppSkillIssue, aiAppSkills, appSkillsRegistryState, reconcileAppSkills } from "./app-skill-store";
 export { type AiApprovalPreferenceRoutes, type AiApprovalPreferenceView, createAiApprovalPreferenceRoutes } from "./approval-routes";
 export {
+  AI_WEBSITE_APPROVAL_TOOL,
   type AiToolApprovalContext,
   type AiToolApprovalPreference,
+  type AiToolApprovalRemember,
   aiToolAllowsAlways,
   aiToolApprovalScope,
   aiToolNeedsApproval,
+  aiTurnAllowsWebsiteApprovals,
+  aiWebsiteApprovalScope,
+  findRememberedAiToolApproval,
   forgetAiToolApproval,
   hasRememberedAiToolApproval,
   listAiToolApprovalPreferences,
+  parseAiWebsiteApprovalScope,
   rememberAiToolApproval,
   revokeAiToolApprovalPreference,
 } from "./approvals";
@@ -47,11 +54,17 @@ export { authorizeCodeExecution } from "./code-execution";
 export { CODE_SOURCE_TOOLS, type CodeSourceToolName } from "./code-source-contracts";
 export { listAiCredentialProfileIds } from "./credentials";
 export {
+  CLOUD_AI_CHART_MAX_SERIES,
+  CLOUD_AI_CHART_MAX_VALUES,
   CLOUD_AI_TEXT_EDITOR_MAX_CHARS,
   type CloudAiCardInput,
   CloudAiCardInputSchema,
   type CloudAiCardOutput,
   CloudAiCardOutputSchema,
+  type CloudAiChartInput,
+  CloudAiChartInputSchema,
+  type CloudAiChartOutput,
+  CloudAiChartOutputSchema,
   type CloudAiLocalBashInput,
   CloudAiLocalBashInputSchema,
   type CloudAiLocalBashOutput,
@@ -64,6 +77,7 @@ export {
   CloudAiTextEditorInputSchema,
   type CloudAiTextEditorOutput,
   CloudAiTextEditorOutputSchema,
+  parseCloudAiChartInput,
 } from "./default-tool-contracts";
 export {
   type AiChatEnrichment,
@@ -258,6 +272,7 @@ export {
   type AiSkillAccess,
   type AiSkillAdminListItem,
   type AiSkillAdminSummary,
+  AiSkillAppForbiddenError,
   AiSkillInputError,
   AiSkillLastAdminError,
   type AiSkillPermission,
@@ -265,7 +280,6 @@ export {
   AiSkillRevisionConflictError,
   type AiSkillSummary,
   aiSkills,
-  seedCloudAiSkills,
 } from "./skills";
 export { type AiSkillsRoutes, aiSkillsRoutes } from "./skills-routes";
 export { aiConversations } from "./store";
@@ -301,6 +315,7 @@ export {
 } from "./transcription";
 export type {
   AiAccessResult,
+  AiApprovalTarget,
   AiCapabilityToolPresentation,
   AiClientToolId,
   AiConversation,
@@ -352,6 +367,7 @@ export type {
   AiTurnStatus,
   AiTurnToolSource,
   AiUserContentPart,
+  AiWebsiteReceipt,
 } from "./types";
 export { AI_MESSAGE_FEEDBACK_REASONS, isAiImageMediaType } from "./types";
 export { isAiSettingsError } from "./validate";

package/src/ai/migrate.ts

@@ -1,4 +1,6 @@
 import { sql } from "bun";
+import { CapabilityActionReviewSchema } from "../contracts/capabilities";
+import { APPROVAL_MAX_WAIT_MS, approvalAssurance, approvalScopeFromToolName, approvals, migrateApprovals } from "../services/approvals";
 import { migrateAiMessageQueue } from "./message-queue";
 import { migrateAiModelAccess } from "./model-access-migrate";
 import { migrateAiQuotas } from "./quotas-migrate";
@@ -21,6 +23,8 @@ export const migrateCloudAi = async (): Promise<void> => {
   if (!outbox?.ready) {
     throw new Error("AI live updates write to events.outbox, which does not exist. Run Core's events migration before the AI migration.");
   }
+  // Approval requests reference auth.users, so they follow the check that Core's own migrations ran.
+  await migrateApprovals();
   await sql`CREATE SCHEMA IF NOT EXISTS ai`.simple();
   console.log("  ✓ ai schema");
 
@@ -640,7 +644,11 @@ export const migrateCloudAi = async (): Promise<void> => {
     PRIMARY KEY (turn_id, request_id)
   )`.simple();
 
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS approval_id UUID`.simple();
   await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS review JSONB`.simple();
+  // A code run asks for its nested HTTP requests and Actions; their remembered approval names a website or Action, not the run.
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS remember_tool_name TEXT`.simple();
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS allow_chat BOOLEAN NOT NULL DEFAULT FALSE`.simple();
 
   await sql`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_pending_actions_turn_call
@@ -700,13 +708,39 @@ export const migrateCloudAi = async (): Promise<void> => {
     FROM ai.tool_approval_preferences
     WHERE tool_name ~ '^[a-z][a-z0-9-]*__(query|action)__'
       AND NOT (length(tool_name) = 64 AND tool_name ~ '__[0-9a-f]{12}$')
-    ON CONFLICT (actor_user_id, tool_name, approval_scope) DO NOTHING
+    ON CONFLICT DO NOTHING
   `.simple();
   await sql`
     DELETE FROM ai.tool_approval_preferences
     WHERE tool_name ~ '^[a-z][a-z0-9-]*__(query|action)__'
   `.simple();
 
+  // An approval limited to one chat ends with that chat. NULL means it applies everywhere.
+  await sql`
+    ALTER TABLE ai.tool_approval_preferences
+    ADD COLUMN IF NOT EXISTS conversation_id UUID REFERENCES ai.conversations(id) ON DELETE CASCADE
+  `.simple();
+  await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS ai_tool_approval_preferences_reach
+    ON ai.tool_approval_preferences(actor_user_id, tool_name, approval_scope, conversation_id) NULLS NOT DISTINCT
+  `.simple();
+  await sql`ALTER TABLE ai.tool_approval_preferences DROP CONSTRAINT IF EXISTS ai_tool_approval_preferences_unique`.simple();
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_ai_tool_approval_preferences_conversation
+    ON ai.tool_approval_preferences(conversation_id)
+    WHERE conversation_id IS NOT NULL
+  `.simple();
+  // Addresses a chat's web searches returned and the pages it read link to, normalized; web_extract and fetch_file
+  // read them without asking. Recorded when the tool runs, so a read never scans stored results.
+  await sql`
+    CREATE TABLE IF NOT EXISTS ai.web_addresses (
+      conversation_id UUID NOT NULL REFERENCES ai.conversations(id) ON DELETE CASCADE,
+      address TEXT NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      PRIMARY KEY (conversation_id, address)
+    )
+  `.simple();
+
   await sql`
     CREATE TABLE IF NOT EXISTS ai.tool_calls (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -724,9 +758,23 @@ export const migrateCloudAi = async (): Promise<void> => {
       rejected_at TIMESTAMPTZ,
       completed_at TIMESTAMPTZ,
       CONSTRAINT ai_tool_calls_status_check CHECK (status IN ('pending', 'running', 'waiting_for_approval', 'waiting_for_frontend', 'completed', 'failed', 'rejected')),
-      CONSTRAINT ai_tool_calls_approval_state_check CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_always', 'approved_by_preference', 'rejected'))
+      CONSTRAINT ai_tool_calls_approval_state_check CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_for_chat', 'approved_always', 'approved_by_preference', 'rejected'))
     )
   `.simple();
+  await sql`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ai_tool_calls_approval_state_check'
+          AND pg_get_constraintdef(oid) LIKE '%approved_for_chat%'
+      ) THEN
+        ALTER TABLE ai.tool_calls DROP CONSTRAINT IF EXISTS ai_tool_calls_approval_state_check;
+        ALTER TABLE ai.tool_calls ADD CONSTRAINT ai_tool_calls_approval_state_check
+          CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_for_chat', 'approved_always', 'approved_by_preference', 'rejected'));
+      END IF;
+    END $$
+  `.simple();
 
   await sql`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_tool_calls_turn_call
@@ -738,6 +786,7 @@ export const migrateCloudAi = async (): Promise<void> => {
     ON ai.tool_calls(conversation_id, created_at DESC)
   `.simple();
 
+  await sql`ALTER TABLE ai.tool_calls ADD COLUMN IF NOT EXISTS approval_decided_via TEXT`.simple();
   await sql`ALTER TABLE ai.tool_calls ADD COLUMN IF NOT EXISTS idempotency_key TEXT`.simple();
 
   // Capability shape, outcome, and latency belong to capabilities.executions,
@@ -1620,18 +1669,65 @@ export const migrateCloudAi = async (): Promise<void> => {
   await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_skills_name ON ai.skills(name)`.simple();
   await sql`ALTER TABLE ai.skills ADD COLUMN IF NOT EXISTS managed_key TEXT`.simple();
   await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_skills_managed_key ON ai.skills(managed_key) WHERE managed_key IS NOT NULL`.simple();
-  await sql`
-    CREATE TABLE IF NOT EXISTS ai.skill_seeds (
-      key TEXT PRIMARY KEY,
-      seeded_at TIMESTAMPTZ NOT NULL DEFAULT now()
-    )
-  `.simple();
-  // A seed's UUID deliberately has no FK: it is a durable deletion tombstone.
-  await sql`ALTER TABLE ai.skill_seeds ADD COLUMN IF NOT EXISTS skill_id UUID`.simple();
-  await sql`ALTER TABLE ai.skill_seeds ADD COLUMN IF NOT EXISTS catalog_version INTEGER NOT NULL DEFAULT 0`.simple();
-  await sql`ALTER TABLE ai.skills ADD COLUMN IF NOT EXISTS template_id TEXT,
-    ADD COLUMN IF NOT EXISTS template_version INTEGER, ADD COLUMN IF NOT EXISTS template_hash TEXT`.simple();
-  await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_skills_template_id ON ai.skills(template_id) WHERE template_id IS NOT NULL`.simple();
+  await sql.begin(async (tx) => {
+    await tx`SELECT pg_advisory_xact_lock(hashtext('cloud:ai:app-skills'))`;
+    await tx`CREATE TABLE IF NOT EXISTS ai.app_skill_catalogs (
+      app_id text NOT NULL, manifest_hash text NOT NULL, skills jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(), last_seen_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (app_id, manifest_hash)
+    )`.simple();
+    await tx`CREATE INDEX IF NOT EXISTS idx_ai_app_skill_catalogs_last_seen ON ai.app_skill_catalogs(last_seen_at)`.simple();
+    await tx`CREATE TABLE IF NOT EXISTS ai.app_skills (
+      key text PRIMARY KEY, app_id text NOT NULL, app_name text NOT NULL, name text NOT NULL,
+      skill_id uuid NULL, source jsonb NULL, source_hash text NULL, applied_hash text NULL,
+      manifest_hash text NULL, available boolean NOT NULL DEFAULT false, required_roles text[] NULL,
+      conflict text NULL CHECK (conflict IN ('name_taken', 'invalid')),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )`.simple();
+    await tx`CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_app_skills_skill ON ai.app_skills(skill_id) WHERE skill_id IS NOT NULL`.simple();
+    await tx`CREATE INDEX IF NOT EXISTS idx_ai_app_skills_app ON ai.app_skills(app_id)`.simple();
+    // Adopt only durable seed associations. A missing linked row remains a deletion tombstone.
+    await tx`DO $$ BEGIN
+      IF to_regclass('ai.skill_seeds') IS NOT NULL THEN
+        -- Installations from before seed links lack these columns; their seeds adopt nothing.
+        ALTER TABLE ai.skill_seeds ADD COLUMN IF NOT EXISTS skill_id uuid;
+        ALTER TABLE ai.skills ADD COLUMN IF NOT EXISTS template_id text, ADD COLUMN IF NOT EXISTS template_hash text;
+        -- A seed never installed its Skill again. An unlinked seed whose name is free stays deleted through a link
+        -- to no Skill; when a Skill holds the name, it stays unlinked and an administrator decides who owns it.
+        INSERT INTO ai.app_skills(key, app_id, app_name, name, skill_id, applied_hash)
+        SELECT 'app:' || mapping.app_id || '/' || mapping.name, mapping.app_id, mapping.app_name, mapping.name,
+          CASE WHEN seed.skill_id IS NOT NULL THEN seed.skill_id
+            WHEN NOT EXISTS (SELECT 1 FROM ai.skills named WHERE named.name = mapping.name) THEN gen_random_uuid() END,
+          CASE WHEN skill.template_id = seed.key THEN skill.template_hash ELSE NULL END
+        FROM ai.skill_seeds seed
+        JOIN (VALUES
+          ('grids:cloud-grids', 'grids', 'Grids', 'cloud-grids'),
+          ('assistant:cloud-assistant', 'assistant', 'Assistant', 'cloud-assistant'),
+          ('assistant:scheduled-tasks', 'assistant', 'Assistant', 'scheduled-tasks'),
+          ('core:skill-creator', 'assistant', 'Assistant', 'skill-creator'),
+          ('mail:cloud-mail', 'mail', 'Mail', 'cloud-mail'),
+          ('notebooks:cloud-notebooks', 'notebooks', 'Notebooks', 'cloud-notebooks'),
+          ('contacts:cloud-contacts', 'contacts', 'Contacts', 'cloud-contacts'),
+          ('spaces:cloud-spaces', 'spaces', 'Spaces', 'cloud-spaces'),
+          ('weather:cloud-weather', 'weather', 'Weather', 'cloud-weather'),
+          ('assistant:code-mode', 'assistant', 'Assistant', 'assistant-code-mode'),
+          ('assistant:data-analysis', 'assistant', 'Assistant', 'assistant-data-analysis')
+        ) mapping(seed_key, app_id, app_name, name) ON mapping.seed_key = seed.key
+        LEFT JOIN ai.skills skill ON skill.id = seed.skill_id
+        WHERE true
+        ON CONFLICT (key) DO NOTHING;
+        DROP TABLE ai.skill_seeds;
+      END IF;
+    END $$`.simple();
+    // Only alter ai.skills once: ALTER TABLE takes an exclusive lock even when nothing changes.
+    await tx`DO $$ BEGIN
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'ai' AND table_name = 'skills'
+        AND column_name IN ('template_id', 'template_version', 'template_hash')) THEN
+        ALTER TABLE ai.skills DROP COLUMN IF EXISTS template_id,
+          DROP COLUMN IF EXISTS template_version, DROP COLUMN IF EXISTS template_hash;
+      END IF;
+    END $$`.simple();
+  });
   await backfillAiShortIds(
     "idx_ai_skills_short_id",
     await sql<{ id: string }[]>`SELECT id FROM ai.skills WHERE short_id IS NULL`,
@@ -2478,5 +2574,67 @@ export const migrateCloudAi = async (): Promise<void> => {
       `  ! ${legacyPaths.files} conversation and ${legacyPaths.project_files} project file paths keep a non-NFC Unicode form because a normalized twin exists`,
     );
   }
+  await backfillApprovalRequests();
   console.log("  ✓ ai conversation tables");
 };
+
+const backfillApprovalRequests = async (): Promise<void> => {
+  const decoded = (value: unknown): unknown => (typeof value === "string" ? JSON.parse(value) : value);
+  while (true) {
+    const count = await sql.begin(async (db) => {
+      // Completed turns and ownerless chats cannot still ask a person; leave their legacy rows alone.
+      const rows = await db<
+        {
+          id: string;
+          turn_id: string;
+          call_id: string;
+          tool_name: string;
+          approval_scope: string;
+          message: string | null;
+          review: unknown;
+          args: unknown;
+          allow_always: boolean;
+          allow_chat: boolean;
+          owner: string;
+          title: string;
+          expiry: Date;
+        }[]
+      >`SELECT a.*, c.created_by_user_id AS owner, c.title,
+        COALESCE(t.deadline, a.created_at + interval '24 hours') AS expiry
+        FROM ai.pending_actions a JOIN ai.turns t ON t.id=a.turn_id JOIN ai.conversations c ON c.id=a.conversation_id
+        WHERE a.status='pending' AND a.kind IN ('approval','custom_approval') AND a.approval_id IS NULL
+          AND c.created_by_user_id IS NOT NULL AND t.status='waiting_for_action'
+          -- A running Assistant may already have asked again for this action; keep the request it saw.
+          AND NOT EXISTS (SELECT 1 FROM approvals.requests r
+            WHERE r.requester_kind='assistant_turn' AND r.requester_ref=a.turn_id::text || '/' || a.call_id)
+        ORDER BY a.created_at, a.id LIMIT 200 FOR UPDATE OF a SKIP LOCKED`;
+      for (const row of rows) {
+        const review = CapabilityActionReviewSchema.safeParse(row.review == null ? null : decoded(row.review));
+        // request computes both canonical digests; preserve the original wait deadline, including expiry.
+        const record = await approvals.request(
+          {
+            ...approvalScopeFromToolName(row.tool_name),
+            approvalScope: row.approval_scope,
+            requester: { kind: "assistant_turn", ref: `${row.turn_id}/${row.call_id}`, appId: "assistant", title: row.title },
+            subjectId: row.owner,
+            approverUserId: row.owner,
+            // Every turn that can ask allows remembering, so these flags hold what the call offers.
+            assurance: approvalAssurance(row.allow_always || row.allow_chat),
+            sentence: row.message ?? row.tool_name,
+            review: review.success ? review.data : null,
+            input: decoded(row.args),
+            expiresInMs: Math.min(APPROVAL_MAX_WAIT_MS, row.expiry.getTime() - Date.now()),
+          },
+          db,
+        );
+        if (!record.ok) continue;
+        await db`UPDATE approvals.requests SET expires_at=${row.expiry},
+          status=CASE WHEN ${row.expiry} <= now() THEN 'expired' ELSE status END
+          WHERE id=${record.id}::uuid AND status='pending'`;
+        await db`UPDATE ai.pending_actions SET approval_id=${record.id}::uuid WHERE id=${row.id}::uuid`;
+      }
+      return rows.length;
+    });
+    if (!count) return;
+  }
+};

package/src/ai/protocol.ts

@@ -44,7 +44,15 @@ export type AiTurnBlock =
       result?: unknown;
       isError?: boolean;
       /** Present while status is awaiting_approval. */
-      approval?: { message?: string; review?: CapabilityActionReview; allowAlways: boolean };
+      approval?: {
+        message?: string;
+        review?: CapabilityActionReview;
+        allowAlways: boolean;
+        /** Whether the approval can be remembered for this chat. */
+        allowChat?: boolean;
+        /** The website origin a chat approval would allow, for an HTTP request a code run makes. */
+        website?: string;
+      };
       /**
        * `true` once the user approved this call in the chat; `false` when its turn ended while the approval still
        * waited. Either way the approval stays visible as a receipt.
@@ -54,6 +62,8 @@ export type AiTurnBlock =
       frontendMode?: AiFrontendToolMode;
       /** Saved Cloud-owned display snapshot for capability calls. */
       presentation?: AiToolPresentation;
+      /** Requests a website approval let through without asking, in order; shown whatever the call's outcome. */
+      receipts?: { method: string; url: string }[];
     }
   | { id: string; kind: "compaction"; status: "running" | "completed" | "skipped" | "failed"; result?: CompactResult };
 
@@ -215,6 +225,14 @@ const canonicalToolName = (name: string, presentation?: AiToolPresentation): str
   return candidates.length === 1 ? candidates[0]! : name;
 };
 
+/** The receipts of one tool call, keyed by their index, in the order the requests went out. */
+export const orderedWebsiteReceipts = (
+  receipts: Record<string, { method: string; url: string }> | undefined,
+): { method: string; url: string }[] =>
+  Object.entries(receipts ?? {})
+    .sort(([a], [b]) => Number(a) - Number(b))
+    .map(([, receipt]) => receipt);
+
 /**
  * Convert persisted loop messages into the block model. Shared by the executor
  * (baseline rebuild on claim) and the client (rendering finished turns), so a
@@ -228,6 +246,7 @@ export const buildBlocksFromMessages = (
       steerId?: string;
       toolPresentations?: Record<string, AiToolPresentation>;
       toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
+      websiteReceipts?: Record<string, Record<string, { method: string; url: string }>>;
     } | null;
   }[],
 ): AiTurnBlock[] => {
@@ -243,6 +262,7 @@ export const buildBlocksFromMessages = (
           blocks.push({ id: messageBlockId(seq, index), kind: "thinking", text: block.thinking });
         } else if (block.type === "tool_call") {
           const outcome = meta?.toolOutcomes?.[block.id];
+          const receipts = orderedWebsiteReceipts(meta?.websiteReceipts?.[block.id]);
           toolIndex.set(block.id, blocks.length);
           blocks.push({
             id: toolBlockId(block.id),
@@ -255,6 +275,7 @@ export const buildBlocksFromMessages = (
             // A turn that ended before an approved call returned records the approval on the call's message, and an
             // approval it left waiting as expired.
             ...(outcome === "approved" || outcome === "expired" ? { approved: outcome === "approved" } : {}),
+            ...(receipts.length ? { receipts } : {}),
           });
         }
       });

package/src/ai/routes.ts

@@ -18,6 +18,7 @@ import {
   v,
 } from "../server";
 import { isRequestCredentialCurrent } from "../server/middleware/auth";
+import { approvalDecisionChannel } from "../services/approvals";
 import { ImageMetadataError } from "../services/image-metadata";
 import { logger } from "../services/logging";
 import { coreSettings } from "../services/settings/api";
@@ -93,6 +94,8 @@ type AiChatRequestContext = {
   ownerUserId: string;
   modelPolicy: AiModelPolicy;
   toolApprovalContext: AiToolApprovalContext;
+  /** A person in a signed-in browser session, not `cld`, an API key, or another delegated credential. */
+  signedInSession: boolean;
 };
 
 const actorUser = (actor: RequestActor) => (actor.kind === "user" ? actor.user : actor.delegatedUser);
@@ -106,6 +109,7 @@ const resolveContext = async (c: Context<AuthContext>): Promise<AiChatRequestCon
     ownerUserId: user.id,
     modelPolicy: personalAiModelPolicy,
     toolApprovalContext: { actorUserId: user.id },
+    signedInSession: actor.kind === "user" && !actor.delegation && c.get("credentialKind") === "session",
   };
 };
 
@@ -890,6 +894,7 @@ export const aiRoutes = (() => {
         try {
           const submission = {
             assistantChat: true as const,
+            ...(ctx.signedInSession ? { signedInSession: true as const } : {}),
             conversationId: conversation.id,
             chatId: conversation.shortId,
             input,
@@ -999,6 +1004,7 @@ export const aiRoutes = (() => {
           }
           const result = await submitAiChatTurn({
             assistantChat: true,
+            ...(ctx.signedInSession ? { signedInSession: true as const } : {}),
             conversationId: conversation.id,
             chatId: conversation.shortId,
             input,
@@ -1121,7 +1127,12 @@ export const aiRoutes = (() => {
           turnId: turn.id,
           callId,
           action: c.req.valid("json"),
+          decidedBy: {
+            userId: ctx.ownerUserId,
+            via: approvalDecisionChannel({ credentialKind: c.get("credentialKind"), actor: ctx.actor }),
+          },
           toolApprovalContext: ctx.toolApprovalContext,
+          signedInSession: ctx.signedInSession,
         });
         if (!result.ok) return toAiActionFailureResponse(c, result);
         return respond(c, ok({ ok: true }));

package/src/ai/runtime-tools.ts

@@ -2,6 +2,7 @@ export { CloudAiTranscribeAudioInputSchema, CloudAiTranscribeAudioOutputSchema,
 export {
   CLOUD_AI_DEFERRED_BUILTIN_TOOL_NAMES,
   createCloudAiCardTool,
+  createCloudAiChartTool,
   createCloudAiCodeTools,
   createCloudAiLocalBashTool,
   createCloudAiSurveyTool,

package/src/ai/runtime.ts

@@ -4,10 +4,11 @@ import type { QueueMessage } from "@k2b/sync";
 import { z } from "zod";
 import { lazySync } from "../_internal/process-sync";
 import type { RequestActor } from "../server";
+import { type ApprovalDecisionChannel, approvals } from "../services/approvals";
 import { logger } from "../services/logging";
 import { superviseRuntimeTask } from "../services/runtime-lifecycle";
 import { coreSettings } from "../services/settings/api";
-import { type AiToolApprovalContext, aiTurnAllowsRememberedApprovals, rememberAiToolApproval } from "./approvals";
+import { AI_WEBSITE_APPROVAL_TOOL, type AiToolApprovalContext, aiTurnAllowsRememberedApprovals, rememberAiToolApproval } from "./approvals";
 import { aiChatAccessSubject, selectAssistantAiModelId } from "./assistant-models";
 import { startAiDictationRuntime } from "./dictation-runtime";
 import { AiTurnExecutor } from "./executor";
@@ -87,6 +88,8 @@ export const enqueueExistingAiTurn = (input: AiTurnJob): Promise<unknown> => enq
 export type SubmitAiChatTurnInput = {
   /** Only interactive Assistant HTTP handlers set this server-owned marker. */
   assistantChat?: true;
+  /** Only a handler that saw a signed-in browser session sets this server-owned marker; see `AiChatTurnRunConfig`. */
+  signedInSession?: true;
   conversationId: string;
   /** Stable public ID exposed as runtime context, not instructions. */
   chatId?: string;
@@ -153,6 +156,7 @@ export const prepareAiChatTurn = async (input: SubmitAiChatTurnInput) => {
       ),
     ],
     ...(input.assistantChat ? { assistantChat: true } : {}),
+    ...(input.signedInSession ? { signedInSession: true } : {}),
     input: canonicalInput,
     chatId: input.chatId,
     actor: input.actor,
@@ -297,7 +301,7 @@ export const abortAiTurn = async (input: { conversationId: string; turnId: strin
 // ---------------------------------------------------------------------------
 
 export const AiTurnActionSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("approval_response"), approved: z.boolean(), remember: z.literal("always").optional() }),
+  z.object({ type: z.literal("approval_response"), approved: z.boolean(), remember: z.enum(["chat", "always"]).optional() }),
   z.object({ type: z.literal("tool_result"), result: z.unknown() }),
 ]);
 export type AiTurnActionInput = z.infer<typeof AiTurnActionSchema>;
@@ -312,7 +316,7 @@ export const listPendingAiTurnActions = async (input: { conversationId: string;
   const [actions, config] = await Promise.all([aiConversations.listPendingTurnActions(input), aiConversations.getTurnRunConfig(input)]);
   return aiTurnAllowsRememberedApprovals(config)
     ? actions
-    : actions.map((action) => (action.type === "approval_request" ? { ...action, allowAlways: false } : action));
+    : actions.map((action) => (action.type === "approval_request" ? { ...action, allowAlways: false, allowChat: false } : action));
 };
 
 export const submitAiTurnAction = async (input: {
@@ -320,7 +324,10 @@ export const submitAiTurnAction = async (input: {
   turnId: string;
   callId: string;
   action: AiTurnActionInput;
+  decidedBy: { userId: string; via: ApprovalDecisionChannel };
   toolApprovalContext?: AiToolApprovalContext;
+  /** Whether a person decides in a signed-in browser session; only such a decision may remember a website. */
+  signedInSession?: boolean;
 }): Promise<{ ok: true } | { ok: false; status: 400 | 404 | 409; message: string }> => {
   const pending = await aiConversations.getPendingTurnAction(input);
   if (!pending) return { ok: false, status: 404, message: "This request has expired — the assistant already moved on." };
@@ -338,18 +345,50 @@ export const submitAiTurnAction = async (input: {
 
   if (input.action.type === "approval_response") {
     if (pending.kind === "client_tool") return { ok: false, status: 400, message: "Frontend tool requests require a tool result." };
-    if (input.action.remember === "always") {
+    const remember = input.action.remember;
+    if (remember) {
       const config = await aiConversations.getTurnRunConfig(input);
-      if (!input.action.approved || !pending.allowAlways || !input.toolApprovalContext || !aiTurnAllowsRememberedApprovals(config)) {
+      const toolName = pending.rememberToolName ?? pending.name;
+      const allowed = remember === "always" ? pending.allowAlways : (pending.allowChat ?? pending.allowAlways);
+      if (
+        !input.action.approved ||
+        !allowed ||
+        !input.toolApprovalContext ||
+        !aiTurnAllowsRememberedApprovals(config) ||
+        // A website is remembered only by a person in a signed-in session: `cld`, an API key, or another delegated
+        // credential can approve this one request, but cannot let the next ones through.
+        (toolName === AI_WEBSITE_APPROVAL_TOOL && (remember !== "chat" || !input.signedInSession))
+      ) {
         return { ok: false, status: 400, message: "This approval cannot be remembered." };
       }
-      await rememberAiToolApproval(input.toolApprovalContext, { toolName: pending.name, approvalScope: pending.approvalScope });
+    }
+    if (pending.approvalId) {
+      const decision = await approvals.decide(pending.approvalId, { approved: input.action.approved }, input.decidedBy);
+      if (!decision.ok)
+        return decision.code === "ALREADY_DECIDED"
+          ? { ok: false, status: 409, message: "AI action was already resolved with a different response." }
+          : { ok: false, status: 404, message: "This request has expired — the assistant already moved on." };
+    }
+    if (remember && input.toolApprovalContext) {
+      const toolName = pending.rememberToolName ?? pending.name;
+      await rememberAiToolApproval(input.toolApprovalContext, {
+        toolName,
+        approvalScope: pending.approvalScope,
+        conversationId: remember === "chat" ? input.conversationId : null,
+      });
     }
     await aiToolAudit
       .noteApprovalResolved({
         turnId: input.turnId,
         callId: input.callId,
-        approvalState: input.action.approved ? (input.action.remember === "always" ? "approved_always" : "approved_once") : "rejected",
+        decidedVia: input.decidedBy.via,
+        approvalState: input.action.approved
+          ? remember === "always"
+            ? "approved_always"
+            : remember === "chat"
+              ? "approved_for_chat"
+              : "approved_once"
+          : "rejected",
       })
       .catch(() => undefined);
 

package/src/ai/skill-content.ts

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import {
+  type AiSkillDocument,
+  type AiSkillExtraFrontmatter,
+  type AiSkillReferenceInput,
+  validateAiSkillDescription,
+  validateAiSkillExtraFrontmatter,
+  validateAiSkillInstructions,
+  validateAiSkillName,
+  validateAiSkillReferences,
+} from "./skill-format";
+
+export type AiSkillContent = AiSkillDocument & { references: readonly AiSkillReferenceInput[] };
+
+export const validateSkillContent = (input: {
+  name: string;
+  description: string;
+  instructions: string;
+  extraFrontmatter?: AiSkillExtraFrontmatter;
+  references?: readonly AiSkillReferenceInput[];
+}): AiSkillContent => ({
+  name: validateAiSkillName(input.name),
+  description: validateAiSkillDescription(input.description),
+  instructions: validateAiSkillInstructions(input.instructions),
+  extraFrontmatter: validateAiSkillExtraFrontmatter(input.extraFrontmatter),
+  references: validateAiSkillReferences(input.references ?? []).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+});
+
+// Keep the former template hash algorithm: key order and reference insertion order are immaterial.
+export const canonicalJson = (value: unknown): string => {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.entries(value)
+      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+      .map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`)
+      .join(",")}}`;
+  const result = JSON.stringify(value);
+  if (result === undefined) throw new Error("Skill content must be JSON.");
+  return result;
+};
+export const canonicalHash = (value: unknown): string => createHash("sha256").update(canonicalJson(value)).digest("hex");
+export const contentHash = (fields: AiSkillContent): string =>
+  canonicalHash({
+    name: fields.name,
+    description: fields.description,
+    instructions: fields.instructions,
+    extraFrontmatter: fields.extraFrontmatter,
+    references: [...fields.references].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+  });
+
+/** How an installed app Skill relates to its app: the app's version, an administrator's override, or an override with a newer app version. */
+export type AppSkillStatus = "current" | "modified" | "update_available";
+export const appSkillStatus = (rowHash: string, sourceHash: string | null, appliedHash: string | null): AppSkillStatus =>
+  rowHash === (sourceHash ?? appliedHash) ? "current" : sourceHash === null || sourceHash === appliedHash ? "modified" : "update_available";