@k2b/cloud 0.30.0 → 0.31.0

package/src/ai/migrate.ts

@@ -1,4 +1,6 @@
 import { sql } from "bun";
+import { CapabilityActionReviewSchema } from "../contracts/capabilities";
+import { APPROVAL_MAX_WAIT_MS, approvalAssurance, approvalScopeFromToolName, approvals, migrateApprovals } from "../services/approvals";
 import { migrateAiMessageQueue } from "./message-queue";
 import { migrateAiModelAccess } from "./model-access-migrate";
 import { migrateAiQuotas } from "./quotas-migrate";
@@ -21,6 +23,8 @@ export const migrateCloudAi = async (): Promise<void> => {
   if (!outbox?.ready) {
     throw new Error("AI live updates write to events.outbox, which does not exist. Run Core's events migration before the AI migration.");
   }
+  // Approval requests reference auth.users, so they follow the check that Core's own migrations ran.
+  await migrateApprovals();
   await sql`CREATE SCHEMA IF NOT EXISTS ai`.simple();
   console.log("  ✓ ai schema");
 
@@ -640,7 +644,11 @@ export const migrateCloudAi = async (): Promise<void> => {
     PRIMARY KEY (turn_id, request_id)
   )`.simple();
 
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS approval_id UUID`.simple();
   await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS review JSONB`.simple();
+  // A code run asks for its nested HTTP requests and Actions; their remembered approval names a website or Action, not the run.
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS remember_tool_name TEXT`.simple();
+  await sql`ALTER TABLE ai.pending_actions ADD COLUMN IF NOT EXISTS allow_chat BOOLEAN NOT NULL DEFAULT FALSE`.simple();
 
   await sql`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_pending_actions_turn_call
@@ -700,13 +708,39 @@ export const migrateCloudAi = async (): Promise<void> => {
     FROM ai.tool_approval_preferences
     WHERE tool_name ~ '^[a-z][a-z0-9-]*__(query|action)__'
       AND NOT (length(tool_name) = 64 AND tool_name ~ '__[0-9a-f]{12}$')
-    ON CONFLICT (actor_user_id, tool_name, approval_scope) DO NOTHING
+    ON CONFLICT DO NOTHING
   `.simple();
   await sql`
     DELETE FROM ai.tool_approval_preferences
     WHERE tool_name ~ '^[a-z][a-z0-9-]*__(query|action)__'
   `.simple();
 
+  // An approval limited to one chat ends with that chat. NULL means it applies everywhere.
+  await sql`
+    ALTER TABLE ai.tool_approval_preferences
+    ADD COLUMN IF NOT EXISTS conversation_id UUID REFERENCES ai.conversations(id) ON DELETE CASCADE
+  `.simple();
+  await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS ai_tool_approval_preferences_reach
+    ON ai.tool_approval_preferences(actor_user_id, tool_name, approval_scope, conversation_id) NULLS NOT DISTINCT
+  `.simple();
+  await sql`ALTER TABLE ai.tool_approval_preferences DROP CONSTRAINT IF EXISTS ai_tool_approval_preferences_unique`.simple();
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_ai_tool_approval_preferences_conversation
+    ON ai.tool_approval_preferences(conversation_id)
+    WHERE conversation_id IS NOT NULL
+  `.simple();
+  // Addresses a chat's web searches returned and the pages it read link to, normalized; web_extract and fetch_file
+  // read them without asking. Recorded when the tool runs, so a read never scans stored results.
+  await sql`
+    CREATE TABLE IF NOT EXISTS ai.web_addresses (
+      conversation_id UUID NOT NULL REFERENCES ai.conversations(id) ON DELETE CASCADE,
+      address TEXT NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      PRIMARY KEY (conversation_id, address)
+    )
+  `.simple();
+
   await sql`
     CREATE TABLE IF NOT EXISTS ai.tool_calls (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -724,9 +758,23 @@ export const migrateCloudAi = async (): Promise<void> => {
       rejected_at TIMESTAMPTZ,
       completed_at TIMESTAMPTZ,
       CONSTRAINT ai_tool_calls_status_check CHECK (status IN ('pending', 'running', 'waiting_for_approval', 'waiting_for_frontend', 'completed', 'failed', 'rejected')),
-      CONSTRAINT ai_tool_calls_approval_state_check CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_always', 'approved_by_preference', 'rejected'))
+      CONSTRAINT ai_tool_calls_approval_state_check CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_for_chat', 'approved_always', 'approved_by_preference', 'rejected'))
     )
   `.simple();
+  await sql`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ai_tool_calls_approval_state_check'
+          AND pg_get_constraintdef(oid) LIKE '%approved_for_chat%'
+      ) THEN
+        ALTER TABLE ai.tool_calls DROP CONSTRAINT IF EXISTS ai_tool_calls_approval_state_check;
+        ALTER TABLE ai.tool_calls ADD CONSTRAINT ai_tool_calls_approval_state_check
+          CHECK (approval_state IN ('not_required', 'waiting', 'approved_once', 'approved_for_chat', 'approved_always', 'approved_by_preference', 'rejected'));
+      END IF;
+    END $$
+  `.simple();
 
   await sql`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_tool_calls_turn_call
@@ -738,6 +786,7 @@ export const migrateCloudAi = async (): Promise<void> => {
     ON ai.tool_calls(conversation_id, created_at DESC)
   `.simple();
 
+  await sql`ALTER TABLE ai.tool_calls ADD COLUMN IF NOT EXISTS approval_decided_via TEXT`.simple();
   await sql`ALTER TABLE ai.tool_calls ADD COLUMN IF NOT EXISTS idempotency_key TEXT`.simple();
 
   // Capability shape, outcome, and latency belong to capabilities.executions,
@@ -2525,5 +2574,67 @@ export const migrateCloudAi = async (): Promise<void> => {
       `  ! ${legacyPaths.files} conversation and ${legacyPaths.project_files} project file paths keep a non-NFC Unicode form because a normalized twin exists`,
     );
   }
+  await backfillApprovalRequests();
   console.log("  ✓ ai conversation tables");
 };
+
+const backfillApprovalRequests = async (): Promise<void> => {
+  const decoded = (value: unknown): unknown => (typeof value === "string" ? JSON.parse(value) : value);
+  while (true) {
+    const count = await sql.begin(async (db) => {
+      // Completed turns and ownerless chats cannot still ask a person; leave their legacy rows alone.
+      const rows = await db<
+        {
+          id: string;
+          turn_id: string;
+          call_id: string;
+          tool_name: string;
+          approval_scope: string;
+          message: string | null;
+          review: unknown;
+          args: unknown;
+          allow_always: boolean;
+          allow_chat: boolean;
+          owner: string;
+          title: string;
+          expiry: Date;
+        }[]
+      >`SELECT a.*, c.created_by_user_id AS owner, c.title,
+        COALESCE(t.deadline, a.created_at + interval '24 hours') AS expiry
+        FROM ai.pending_actions a JOIN ai.turns t ON t.id=a.turn_id JOIN ai.conversations c ON c.id=a.conversation_id
+        WHERE a.status='pending' AND a.kind IN ('approval','custom_approval') AND a.approval_id IS NULL
+          AND c.created_by_user_id IS NOT NULL AND t.status='waiting_for_action'
+          -- A running Assistant may already have asked again for this action; keep the request it saw.
+          AND NOT EXISTS (SELECT 1 FROM approvals.requests r
+            WHERE r.requester_kind='assistant_turn' AND r.requester_ref=a.turn_id::text || '/' || a.call_id)
+        ORDER BY a.created_at, a.id LIMIT 200 FOR UPDATE OF a SKIP LOCKED`;
+      for (const row of rows) {
+        const review = CapabilityActionReviewSchema.safeParse(row.review == null ? null : decoded(row.review));
+        // request computes both canonical digests; preserve the original wait deadline, including expiry.
+        const record = await approvals.request(
+          {
+            ...approvalScopeFromToolName(row.tool_name),
+            approvalScope: row.approval_scope,
+            requester: { kind: "assistant_turn", ref: `${row.turn_id}/${row.call_id}`, appId: "assistant", title: row.title },
+            subjectId: row.owner,
+            approverUserId: row.owner,
+            // Every turn that can ask allows remembering, so these flags hold what the call offers.
+            assurance: approvalAssurance(row.allow_always || row.allow_chat),
+            sentence: row.message ?? row.tool_name,
+            review: review.success ? review.data : null,
+            input: decoded(row.args),
+            expiresInMs: Math.min(APPROVAL_MAX_WAIT_MS, row.expiry.getTime() - Date.now()),
+          },
+          db,
+        );
+        if (!record.ok) continue;
+        await db`UPDATE approvals.requests SET expires_at=${row.expiry},
+          status=CASE WHEN ${row.expiry} <= now() THEN 'expired' ELSE status END
+          WHERE id=${record.id}::uuid AND status='pending'`;
+        await db`UPDATE ai.pending_actions SET approval_id=${record.id}::uuid WHERE id=${row.id}::uuid`;
+      }
+      return rows.length;
+    });
+    if (!count) return;
+  }
+};

package/src/ai/protocol.ts

@@ -44,7 +44,15 @@ export type AiTurnBlock =
       result?: unknown;
       isError?: boolean;
       /** Present while status is awaiting_approval. */
-      approval?: { message?: string; review?: CapabilityActionReview; allowAlways: boolean };
+      approval?: {
+        message?: string;
+        review?: CapabilityActionReview;
+        allowAlways: boolean;
+        /** Whether the approval can be remembered for this chat. */
+        allowChat?: boolean;
+        /** The website origin a chat approval would allow, for an HTTP request a code run makes. */
+        website?: string;
+      };
       /**
        * `true` once the user approved this call in the chat; `false` when its turn ended while the approval still
        * waited. Either way the approval stays visible as a receipt.
@@ -54,6 +62,8 @@ export type AiTurnBlock =
       frontendMode?: AiFrontendToolMode;
       /** Saved Cloud-owned display snapshot for capability calls. */
       presentation?: AiToolPresentation;
+      /** Requests a website approval let through without asking, in order; shown whatever the call's outcome. */
+      receipts?: { method: string; url: string }[];
     }
   | { id: string; kind: "compaction"; status: "running" | "completed" | "skipped" | "failed"; result?: CompactResult };
 
@@ -215,6 +225,14 @@ const canonicalToolName = (name: string, presentation?: AiToolPresentation): str
   return candidates.length === 1 ? candidates[0]! : name;
 };
 
+/** The receipts of one tool call, keyed by their index, in the order the requests went out. */
+export const orderedWebsiteReceipts = (
+  receipts: Record<string, { method: string; url: string }> | undefined,
+): { method: string; url: string }[] =>
+  Object.entries(receipts ?? {})
+    .sort(([a], [b]) => Number(a) - Number(b))
+    .map(([, receipt]) => receipt);
+
 /**
  * Convert persisted loop messages into the block model. Shared by the executor
  * (baseline rebuild on claim) and the client (rendering finished turns), so a
@@ -228,6 +246,7 @@ export const buildBlocksFromMessages = (
       steerId?: string;
       toolPresentations?: Record<string, AiToolPresentation>;
       toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
+      websiteReceipts?: Record<string, Record<string, { method: string; url: string }>>;
     } | null;
   }[],
 ): AiTurnBlock[] => {
@@ -243,6 +262,7 @@ export const buildBlocksFromMessages = (
           blocks.push({ id: messageBlockId(seq, index), kind: "thinking", text: block.thinking });
         } else if (block.type === "tool_call") {
           const outcome = meta?.toolOutcomes?.[block.id];
+          const receipts = orderedWebsiteReceipts(meta?.websiteReceipts?.[block.id]);
           toolIndex.set(block.id, blocks.length);
           blocks.push({
             id: toolBlockId(block.id),
@@ -255,6 +275,7 @@ export const buildBlocksFromMessages = (
             // A turn that ended before an approved call returned records the approval on the call's message, and an
             // approval it left waiting as expired.
             ...(outcome === "approved" || outcome === "expired" ? { approved: outcome === "approved" } : {}),
+            ...(receipts.length ? { receipts } : {}),
           });
         }
       });

package/src/ai/routes.ts

@@ -18,6 +18,7 @@ import {
   v,
 } from "../server";
 import { isRequestCredentialCurrent } from "../server/middleware/auth";
+import { approvalDecisionChannel } from "../services/approvals";
 import { ImageMetadataError } from "../services/image-metadata";
 import { logger } from "../services/logging";
 import { coreSettings } from "../services/settings/api";
@@ -93,6 +94,8 @@ type AiChatRequestContext = {
   ownerUserId: string;
   modelPolicy: AiModelPolicy;
   toolApprovalContext: AiToolApprovalContext;
+  /** A person in a signed-in browser session, not `cld`, an API key, or another delegated credential. */
+  signedInSession: boolean;
 };
 
 const actorUser = (actor: RequestActor) => (actor.kind === "user" ? actor.user : actor.delegatedUser);
@@ -106,6 +109,7 @@ const resolveContext = async (c: Context<AuthContext>): Promise<AiChatRequestCon
     ownerUserId: user.id,
     modelPolicy: personalAiModelPolicy,
     toolApprovalContext: { actorUserId: user.id },
+    signedInSession: actor.kind === "user" && !actor.delegation && c.get("credentialKind") === "session",
   };
 };
 
@@ -890,6 +894,7 @@ export const aiRoutes = (() => {
         try {
           const submission = {
             assistantChat: true as const,
+            ...(ctx.signedInSession ? { signedInSession: true as const } : {}),
             conversationId: conversation.id,
             chatId: conversation.shortId,
             input,
@@ -999,6 +1004,7 @@ export const aiRoutes = (() => {
           }
           const result = await submitAiChatTurn({
             assistantChat: true,
+            ...(ctx.signedInSession ? { signedInSession: true as const } : {}),
             conversationId: conversation.id,
             chatId: conversation.shortId,
             input,
@@ -1121,7 +1127,12 @@ export const aiRoutes = (() => {
           turnId: turn.id,
           callId,
           action: c.req.valid("json"),
+          decidedBy: {
+            userId: ctx.ownerUserId,
+            via: approvalDecisionChannel({ credentialKind: c.get("credentialKind"), actor: ctx.actor }),
+          },
           toolApprovalContext: ctx.toolApprovalContext,
+          signedInSession: ctx.signedInSession,
         });
         if (!result.ok) return toAiActionFailureResponse(c, result);
         return respond(c, ok({ ok: true }));

package/src/ai/runtime.ts

@@ -4,10 +4,11 @@ import type { QueueMessage } from "@k2b/sync";
 import { z } from "zod";
 import { lazySync } from "../_internal/process-sync";
 import type { RequestActor } from "../server";
+import { type ApprovalDecisionChannel, approvals } from "../services/approvals";
 import { logger } from "../services/logging";
 import { superviseRuntimeTask } from "../services/runtime-lifecycle";
 import { coreSettings } from "../services/settings/api";
-import { type AiToolApprovalContext, aiTurnAllowsRememberedApprovals, rememberAiToolApproval } from "./approvals";
+import { AI_WEBSITE_APPROVAL_TOOL, type AiToolApprovalContext, aiTurnAllowsRememberedApprovals, rememberAiToolApproval } from "./approvals";
 import { aiChatAccessSubject, selectAssistantAiModelId } from "./assistant-models";
 import { startAiDictationRuntime } from "./dictation-runtime";
 import { AiTurnExecutor } from "./executor";
@@ -87,6 +88,8 @@ export const enqueueExistingAiTurn = (input: AiTurnJob): Promise<unknown> => enq
 export type SubmitAiChatTurnInput = {
   /** Only interactive Assistant HTTP handlers set this server-owned marker. */
   assistantChat?: true;
+  /** Only a handler that saw a signed-in browser session sets this server-owned marker; see `AiChatTurnRunConfig`. */
+  signedInSession?: true;
   conversationId: string;
   /** Stable public ID exposed as runtime context, not instructions. */
   chatId?: string;
@@ -153,6 +156,7 @@ export const prepareAiChatTurn = async (input: SubmitAiChatTurnInput) => {
       ),
     ],
     ...(input.assistantChat ? { assistantChat: true } : {}),
+    ...(input.signedInSession ? { signedInSession: true } : {}),
     input: canonicalInput,
     chatId: input.chatId,
     actor: input.actor,
@@ -297,7 +301,7 @@ export const abortAiTurn = async (input: { conversationId: string; turnId: strin
 // ---------------------------------------------------------------------------
 
 export const AiTurnActionSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("approval_response"), approved: z.boolean(), remember: z.literal("always").optional() }),
+  z.object({ type: z.literal("approval_response"), approved: z.boolean(), remember: z.enum(["chat", "always"]).optional() }),
   z.object({ type: z.literal("tool_result"), result: z.unknown() }),
 ]);
 export type AiTurnActionInput = z.infer<typeof AiTurnActionSchema>;
@@ -312,7 +316,7 @@ export const listPendingAiTurnActions = async (input: { conversationId: string;
   const [actions, config] = await Promise.all([aiConversations.listPendingTurnActions(input), aiConversations.getTurnRunConfig(input)]);
   return aiTurnAllowsRememberedApprovals(config)
     ? actions
-    : actions.map((action) => (action.type === "approval_request" ? { ...action, allowAlways: false } : action));
+    : actions.map((action) => (action.type === "approval_request" ? { ...action, allowAlways: false, allowChat: false } : action));
 };
 
 export const submitAiTurnAction = async (input: {
@@ -320,7 +324,10 @@ export const submitAiTurnAction = async (input: {
   turnId: string;
   callId: string;
   action: AiTurnActionInput;
+  decidedBy: { userId: string; via: ApprovalDecisionChannel };
   toolApprovalContext?: AiToolApprovalContext;
+  /** Whether a person decides in a signed-in browser session; only such a decision may remember a website. */
+  signedInSession?: boolean;
 }): Promise<{ ok: true } | { ok: false; status: 400 | 404 | 409; message: string }> => {
   const pending = await aiConversations.getPendingTurnAction(input);
   if (!pending) return { ok: false, status: 404, message: "This request has expired — the assistant already moved on." };
@@ -338,18 +345,50 @@ export const submitAiTurnAction = async (input: {
 
   if (input.action.type === "approval_response") {
     if (pending.kind === "client_tool") return { ok: false, status: 400, message: "Frontend tool requests require a tool result." };
-    if (input.action.remember === "always") {
+    const remember = input.action.remember;
+    if (remember) {
       const config = await aiConversations.getTurnRunConfig(input);
-      if (!input.action.approved || !pending.allowAlways || !input.toolApprovalContext || !aiTurnAllowsRememberedApprovals(config)) {
+      const toolName = pending.rememberToolName ?? pending.name;
+      const allowed = remember === "always" ? pending.allowAlways : (pending.allowChat ?? pending.allowAlways);
+      if (
+        !input.action.approved ||
+        !allowed ||
+        !input.toolApprovalContext ||
+        !aiTurnAllowsRememberedApprovals(config) ||
+        // A website is remembered only by a person in a signed-in session: `cld`, an API key, or another delegated
+        // credential can approve this one request, but cannot let the next ones through.
+        (toolName === AI_WEBSITE_APPROVAL_TOOL && (remember !== "chat" || !input.signedInSession))
+      ) {
         return { ok: false, status: 400, message: "This approval cannot be remembered." };
       }
-      await rememberAiToolApproval(input.toolApprovalContext, { toolName: pending.name, approvalScope: pending.approvalScope });
+    }
+    if (pending.approvalId) {
+      const decision = await approvals.decide(pending.approvalId, { approved: input.action.approved }, input.decidedBy);
+      if (!decision.ok)
+        return decision.code === "ALREADY_DECIDED"
+          ? { ok: false, status: 409, message: "AI action was already resolved with a different response." }
+          : { ok: false, status: 404, message: "This request has expired — the assistant already moved on." };
+    }
+    if (remember && input.toolApprovalContext) {
+      const toolName = pending.rememberToolName ?? pending.name;
+      await rememberAiToolApproval(input.toolApprovalContext, {
+        toolName,
+        approvalScope: pending.approvalScope,
+        conversationId: remember === "chat" ? input.conversationId : null,
+      });
     }
     await aiToolAudit
       .noteApprovalResolved({
         turnId: input.turnId,
         callId: input.callId,
-        approvalState: input.action.approved ? (input.action.remember === "always" ? "approved_always" : "approved_once") : "rejected",
+        decidedVia: input.decidedBy.via,
+        approvalState: input.action.approved
+          ? remember === "always"
+            ? "approved_always"
+            : remember === "chat"
+              ? "approved_for_chat"
+              : "approved_once"
+          : "rejected",
       })
       .catch(() => undefined);
 

package/src/ai/store.ts

@@ -4,6 +4,7 @@ import { type SQL, sql } from "bun";
 import { type CapabilityActionReview, CapabilityActionReviewSchema } from "../contracts/capabilities";
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
+import { AI_WEBSITE_APPROVAL_TOOL } from "./approvals";
 import { aiTurnErrorText } from "./chat/turn-error";
 import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 import type { AiTurnBlock } from "./protocol";
@@ -36,6 +37,7 @@ import type {
   AiTurnStatus,
   AiTurnSteer,
   AiTurnSweepResult,
+  AiWebsiteReceipt,
 } from "./types";
 
 /** A queued turn this old without a claim is considered lost and re-enqueued by the sweep. */
@@ -191,6 +193,7 @@ type TurnRow = {
 };
 
 type PendingActionRow = {
+  approval_id: string | null;
   turn_id: string;
   conversation_id: string;
   call_id: string;
@@ -202,6 +205,8 @@ type PendingActionRow = {
   review: unknown | null;
   approval_scope: string;
   allow_always: boolean;
+  allow_chat: boolean | null;
+  remember_tool_name: string | null;
   frontend_mode: AiFrontendToolMode | null;
   resolved_event: unknown | null;
 };
@@ -678,9 +683,12 @@ const pendingActionToPublicEvent = (row: PendingActionRow): AiPendingTurnAction
         message: row.message ?? undefined,
         review: parseCapabilityActionReview(row.review),
         allowAlways: row.allow_always,
+        allowChat: row.allow_always || row.allow_chat === true,
+        ...(row.remember_tool_name === AI_WEBSITE_APPROVAL_TOOL ? { website: row.approval_scope } : {}),
       };
 
 const rowToPendingActionRecord = (row: PendingActionRow): AiPendingTurnActionRecord => ({
+  approvalId: row.approval_id ?? undefined,
   turnId: row.turn_id,
   conversationId: row.conversation_id,
   callId: row.call_id,
@@ -692,6 +700,8 @@ const rowToPendingActionRecord = (row: PendingActionRow): AiPendingTurnActionRec
   review: parseCapabilityActionReview(row.review),
   approvalScope: row.approval_scope,
   allowAlways: row.allow_always,
+  allowChat: row.allow_always || row.allow_chat === true,
+  ...(row.remember_tool_name ? { rememberToolName: row.remember_tool_name } : {}),
   frontendMode: row.frontend_mode ?? undefined,
   resolvedEvent: row.resolved_event ? parseJsonValue<InboundEvent>(row.resolved_event) : null,
 });
@@ -784,6 +794,18 @@ const messageSearchText = (message: Message): string => {
   return text.slice(0, SEARCH_TEXT_MAX_CHARS);
 };
 
+/**
+ * An ended turn uses no further approval: cancel its open questions and the turn's own approvals that no call used.
+ * A Studio request linked from the turn stays as decided, because the code run uses it when the call runs there.
+ */
+const cancelTurnApprovals = async (db: typeof sql, turnId: string): Promise<void> => {
+  await db`
+    UPDATE approvals.requests SET status = 'cancelled'
+    WHERE id IN (SELECT approval_id FROM ai.pending_actions WHERE turn_id = ${turnId} AND approval_id IS NOT NULL)
+      AND (status = 'pending' OR (status = 'approved' AND requester_kind = 'assistant_turn'))
+  `;
+};
+
 /**
  * Record how a turn ended on its messages when its loop could not record it: a stop while an approval waits, a run
  * time limit, or a turn the sweep finalizes. History reads the ending from the last assistant message, so such a turn
@@ -878,6 +900,35 @@ const recordTurnEnd = async (
   }
 };
 
+/**
+ * Records requests a website approval let through on the assistant message that holds the tool call, as each one
+ * goes out, so the chat keeps every receipt whether the call succeeds, fails, or its turn stops. Website approvals
+ * apply only to interactive chats, whose messages live in `ai.messages`. A receipt with a known index replaces itself.
+ */
+export const recordAiWebsiteReceipts = async (input: {
+  conversationId: string;
+  turnId: string;
+  callId: string;
+  receipts: AiWebsiteReceipt[];
+}): Promise<void> => {
+  if (!input.receipts.length) return;
+  const receipts = Object.fromEntries(input.receipts.map(({ index, method, url }) => [String(index), { method, url }]));
+  await sql`
+    UPDATE ai.messages
+    SET meta = COALESCE(meta, '{}'::jsonb) || jsonb_build_object(
+      'websiteReceipts',
+      COALESCE(meta->'websiteReceipts', '{}'::jsonb) || jsonb_build_object(
+        ${input.callId}::text,
+        COALESCE(meta->'websiteReceipts'->${input.callId}::text, '{}'::jsonb) || (${JSON.stringify(receipts)}::text)::jsonb
+      )
+    )
+    WHERE conversation_id = ${input.conversationId}::uuid
+      AND loop_id = ${input.turnId}::text
+      AND role = 'assistant'
+      AND message->'content' @> jsonb_build_array(jsonb_build_object('type', 'tool_call', 'id', ${input.callId}::text))
+  `;
+};
+
 /** Insert a message inside an open conversation-lock transaction and bump the conversation. */
 const insertMessageLocked = async (
   input: {
@@ -3017,6 +3068,7 @@ export const aiConversations: AiConversationService = {
         WHERE turn_id = ${input.turnId}
           AND status = 'pending'
       `;
+      await cancelTurnApprovals(tx, input.turnId);
       if (input.status !== "completed") {
         await recordTurnEnd(tx, {
           conversationId: input.conversationId,
@@ -3173,6 +3225,7 @@ export const aiConversations: AiConversationService = {
         WHERE turn_id = ${finalized.turnId}
           AND status = 'pending'
       `;
+      await cancelTurnApprovals(sql, finalized.turnId);
       await sql`
         UPDATE ai.turn_steers
         SET status = 'discarded', consumed_at = COALESCE(consumed_at, now())
@@ -3261,6 +3314,7 @@ export const aiConversations: AiConversationService = {
   savePendingTurnAction: async (input) => {
     await sql`
       INSERT INTO ai.pending_actions (
+        approval_id,
         turn_id,
         conversation_id,
         call_id,
@@ -3271,12 +3325,15 @@ export const aiConversations: AiConversationService = {
         review,
         approval_scope,
         allow_always,
+        allow_chat,
+        remember_tool_name,
         frontend_mode,
         status,
         resolved_event,
         resolved_at
       )
       VALUES (
+        ${input.approvalId ?? null}::uuid,
         ${input.turnId},
         ${input.conversationId},
         ${input.callId},
@@ -3287,6 +3344,8 @@ export const aiConversations: AiConversationService = {
         ${input.review ? JSON.stringify(input.review) : null}::text::jsonb,
         ${input.approvalScope},
         ${input.allowAlways},
+        ${input.allowChat ?? input.allowAlways},
+        ${input.rememberToolName ?? null},
         ${input.frontendMode ?? null},
         ${input.resolvedEvent ? "resolved" : "pending"},
         ${input.resolvedEvent ? JSON.stringify(input.resolvedEvent) : null}::text::jsonb,
@@ -3294,6 +3353,7 @@ export const aiConversations: AiConversationService = {
       )
       ON CONFLICT (turn_id, call_id)
       DO UPDATE SET
+        approval_id = EXCLUDED.approval_id,
         kind = EXCLUDED.kind,
         tool_name = EXCLUDED.tool_name,
         args = EXCLUDED.args,
@@ -3301,6 +3361,8 @@ export const aiConversations: AiConversationService = {
         review = EXCLUDED.review,
         approval_scope = EXCLUDED.approval_scope,
         allow_always = EXCLUDED.allow_always,
+        allow_chat = EXCLUDED.allow_chat,
+        remember_tool_name = EXCLUDED.remember_tool_name,
         frontend_mode = EXCLUDED.frontend_mode
     `;
   },
@@ -3370,12 +3432,15 @@ export const aiConversations: AiConversationService = {
 
   clearPendingTurnActions: async (input) => {
     await sql`
-      UPDATE ai.pending_actions
+      WITH aborted AS (UPDATE ai.pending_actions
       SET status = 'aborted',
           resolved_at = COALESCE(resolved_at, now())
       WHERE conversation_id = ${input.conversationId}
         AND turn_id = ${input.turnId}
         AND status = 'pending'
+        RETURNING approval_id)
+      UPDATE approvals.requests SET status='cancelled'
+      WHERE id IN (SELECT approval_id FROM aborted WHERE approval_id IS NOT NULL) AND status='pending'
     `;
   },
 

package/src/ai/tool-audit.ts

@@ -1,4 +1,5 @@
 import { sql } from "bun";
+import type { ApprovalDecisionChannel } from "../services/approvals";
 
 /**
  * AI-specific tool-call state only: approval, turn linkage, and the request id
@@ -8,7 +9,14 @@ import { sql } from "bun";
  */
 export type AiToolCallLocation = "server" | "client" | "client_view" | "client_interaction";
 
-export type AiToolApprovalState = "not_required" | "waiting" | "approved_once" | "approved_always" | "approved_by_preference" | "rejected";
+export type AiToolApprovalState =
+  | "not_required"
+  | "waiting"
+  | "approved_once"
+  | "approved_for_chat"
+  | "approved_always"
+  | "approved_by_preference"
+  | "rejected";
 
 export const aiToolAudit = {
   /** Resolve the current server-recorded invocation, never a model-supplied chat id. */
@@ -140,12 +148,14 @@ export const aiToolAudit = {
     turnId: string;
     callId: string;
     approvalState: Exclude<AiToolApprovalState, "not_required" | "waiting">;
+    decidedVia?: ApprovalDecisionChannel;
   }): Promise<void> => {
     const approved = input.approvalState !== "rejected";
     await sql`
       UPDATE ai.tool_calls
       SET
         approval_state = ${input.approvalState},
+        approval_decided_via = ${input.decidedVia ?? null},
         status = CASE WHEN ${approved} THEN status ELSE 'rejected' END,
         approved_at = CASE WHEN ${approved} THEN now() ELSE approved_at END,
         rejected_at = CASE WHEN ${approved} THEN rejected_at ELSE now() END