@k2b/cloud 0.30.0 → 0.32.0

package/src/ai/executor.ts

@@ -1,8 +1,9 @@
-import type { AssistantMessage, CompactEvent, LoopAggregate, NessiLoop, OutboundEvent } from "@k2b/nessi";
+import type { AssistantMessage, CompactEvent, LoopAggregate, Message, NessiLoop, OutboundEvent } from "@k2b/nessi";
 import { compact, nessi } from "@k2b/nessi";
 import { listCapabilities } from "../_internal/registry";
 import type { CapabilityActionReview } from "../contracts/capabilities";
 import type { AccessSubject, RequestActor } from "../server";
+import { approvalAssurance, approvalScopeFromToolName, approvals } from "../services/approvals";
 import { createHelpReader } from "../services/help";
 import { logger } from "../services/logging";
 import { getMandate } from "../services/mandates";
@@ -10,6 +11,7 @@ import type { MandatePolicyV1 } from "../services/mandates/policy";
 import { coreSettings } from "../services/settings/api";
 import { normalizeLocale } from "../shared/locale";
 import {
+  AI_WEBSITE_APPROVAL_TOOL,
   type AiToolApprovalContext,
   aiToolAllowsAlways,
   aiToolApprovalScope,
@@ -24,8 +26,21 @@ import { aiChatMessages } from "./chat/messages";
 import { aiTurnErrorText } from "./chat/turn-error";
 import { AiChatTaskAuthorityError, aiChatTasks } from "./chat-tasks";
 import { createCloudCompactFn } from "./compaction";
-import { createCloudAiCodeTools, createCloudAiLocalBashTool, createConfiguredDefaultCloudAiTools } from "./default-tools";
+import {
+  createCloudAiCodeTools,
+  createCloudAiLocalBashTool,
+  createCloudAiLocalTools,
+  createConfiguredDefaultCloudAiTools,
+} from "./default-tools";
 import { aiFileStore } from "./files-store";
+import { AI_LOCAL_TOOL_NAMES } from "./local-tool-contracts";
+import {
+  countMalformedToolCallRepairs,
+  createMalformedToolCallRepair,
+  isMalformedToolCallId,
+  withMalformedToolCallRepair,
+  withMalformedToolCallResults,
+} from "./malformed-tool-call-repair";
 import { aiMemories } from "./memories";
 import { createCloudAiMemoryTool } from "./memory-tool";
 import { recordAiMemoryWorkflowEvidence } from "./memory-workflow-evidence";
@@ -40,6 +55,7 @@ import {
   type AiWireEvent,
   applyWireEventToBlocks,
   buildBlocksFromMessages,
+  canonicalToolName,
   compactionBlockId,
   reconcileResolvedTurnActions,
   steerAppliedBlockId,
@@ -52,16 +68,16 @@ import { assistantQuotaProvider, inferenceProvider } from "./quota-provider";
 import { collectConversationResourceObservations } from "./resource-refs";
 import { AiRunTimeout } from "./run-timeout";
 import { isAiVisionModelConfigured, type resolveAiModel } from "./settings";
-import { selectAiSkillCatalog } from "./skill-catalog";
+import { mergeAiSkillCatalog, selectAiSkillCatalog } from "./skill-catalog";
 import { createCloudAiLoadSkillTool, createCloudAiSearchSkillsTool, loadSelectedAiSkills } from "./skill-tool";
 import { aiSkills } from "./skills";
-import { aiConversations } from "./store";
+import { aiConversations, recordAiWebsiteReceipts } from "./store";
 import { AI_LIVE_SNAPSHOT_INTERVAL_MS, publishAiWireEvent } from "./stream";
 import { composeAiSystemPrompt } from "./system-prompt";
 import { aiToolAudit } from "./tool-audit";
 import { acceptCanonicalToolNames } from "./tool-call-names";
 import { resolveAiToolResultMaxChars } from "./tool-result-budget";
-import { aiToolPromptHints, type PreparedAiTools, prepareAiTools } from "./tools";
+import { type AiApprovalUse, aiApprovalAskedLater, aiToolPromptHints, type PreparedAiTools, prepareAiTools } from "./tools";
 import { AiTranscriptionError } from "./transcription";
 import {
   AiTurnFailure,
@@ -75,6 +91,7 @@ import { type AiTurnGuidance, loadAiTurnGuidance } from "./turn-guidance";
 import { type AiTurnPolicyToolCall, applyAiTurnPolicy } from "./turn-policy";
 import { createTurnTimingRecorder, withDurableTurnTiming } from "./turn-timing";
 import type {
+  AiApprovalTarget,
   AiChatTurnRunConfig,
   AiFrontendToolMode,
   AiPendingTurnActionRecord,
@@ -85,6 +102,7 @@ import type {
   AiTurnFinalizedEvent,
   AiTurnRunConfig,
   AiTurnSteer,
+  AiWebsiteReceipt,
 } from "./types";
 import { isAiImageMediaType } from "./types";
 import { validateAiTurnRequest } from "./validate";
@@ -96,17 +114,18 @@ const AI_COALESCE_MAX_CHARS = 512;
 const AI_ACTION_BUDGET_MS = 24 * 60 * 60_000;
 
 // Failed generation can contain calls that nessi deliberately never executes or resumes.
+// Cloud's repair calls are skipped too: the live run never counts them.
 const isToolRound = (message: AssistantMessage): boolean =>
   message.stopReason !== "error" &&
   message.stopReason !== "interrupted" &&
   message.stopReason !== "aborted" &&
-  message.content.some((block) => block.type === "tool_call");
+  message.content.some((block) => block.type === "tool_call" && !isMalformedToolCallId(block.id));
 
 const toolRoundState = (messages: AiStoredMessage[]): { issued: number; completed: number } => {
   const completedCallIds = new Set(messages.flatMap(({ message }) => (message.role === "tool_result" ? [message.callId] : [])));
   const rounds = messages.flatMap(({ message }) => {
     if (message.role !== "assistant" || !isToolRound(message)) return [];
-    const callIds = message.content.flatMap((block) => (block.type === "tool_call" ? [block.id] : []));
+    const callIds = message.content.flatMap((block) => (block.type === "tool_call" && !isMalformedToolCallId(block.id) ? [block.id] : []));
     return callIds.length > 0 ? [callIds] : [];
   });
   return {
@@ -267,6 +286,7 @@ export type ExecutorConfig = {
   validateTurn?: typeof validateAiTurnRequest;
   /** Runs after the durable turn state and final wire event are flushed. */
   onTurnFinalized?: (event: AiTurnFinalizedEvent) => Promise<void>;
+  onApprovalRequested?: (event: { approvalId: string }) => Promise<void>;
   /** Waits before retrying a transient provider failure without Retry-After; tests shorten them. */
   providerRetryDelaysMs?: readonly number[];
 };
@@ -274,6 +294,29 @@ export type ExecutorConfig = {
 type ResolvedModel = Awaited<ReturnType<typeof resolveAiModel>>;
 type ValidatedTurn = { settings: Awaited<ReturnType<typeof validateAiTurnRequest>>["settings"]; resolved: ResolvedModel };
 
+// One entry per steering text returned to nessi, including repairs that have no user steer to acknowledge.
+const createChatSteering =
+  (input: {
+    repair: ReturnType<typeof createMalformedToolCallRepair>;
+    appliedSteers: (AiTurnSteer | null)[];
+    takePendingSteers: () => Promise<AiTurnSteer[]>;
+    noteSteering: () => void;
+  }) =>
+  async ({ signal }: { signal: AbortSignal }) => {
+    if (signal.aborted) return undefined;
+    // Exhaustion fails before consuming any pending user input.
+    const repairText = input.repair.takeSteering();
+    const steers = await input.takePendingSteers();
+    input.appliedSteers.push(...steers);
+    if (steers.length > 0) input.noteSteering();
+    const texts = steers.map((steer) => steer.text);
+    if (repairText) {
+      texts.push(repairText);
+      input.appliedSteers.push(null);
+    }
+    return texts.length > 0 ? texts : undefined;
+  };
+
 // ---------------------------------------------------------------------------
 // Baseline rebuild — reconstruct the full active-turn view from persisted rounds
 // ---------------------------------------------------------------------------
@@ -296,7 +339,15 @@ const rebuildBlocksFromMessages = (
         callId: action.callId,
         status: action.kind === "client_tool" ? "awaiting_client" : "awaiting_approval",
         approval:
-          action.kind === "client_tool" ? undefined : { message: action.message, review: action.review, allowAlways: action.allowAlways },
+          action.kind === "client_tool"
+            ? undefined
+            : {
+                message: action.message,
+                review: action.review,
+                allowAlways: action.allowAlways,
+                allowChat: action.allowChat ?? action.allowAlways,
+                ...(action.rememberToolName === AI_WEBSITE_APPROVAL_TOOL ? { website: action.approvalScope } : {}),
+              },
         frontendMode: action.frontendMode,
       };
     }
@@ -381,9 +432,25 @@ const approvalReviewForCallId = (
  */
 const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowRememberedApprovals = true) => {
   const toolBlocks = new Map<string, Extract<AiTurnBlock, { kind: "tool" }>>();
+  /** Website receipts by the call that shows them and their index; every later state of that call keeps them. */
+  const receiptsByCall = new Map<string, Map<number, { method: string; url: string }>>();
   for (const block of seedBlocks) {
-    if (block.kind === "tool") toolBlocks.set(block.callId, block);
+    if (block.kind !== "tool") continue;
+    toolBlocks.set(block.callId, block);
+    // A pending nested approval shows on its parent call's block; receipts belong to that block.
+    const shownCallId = block.id === toolBlockId(block.callId) ? block.callId : (customApprovalParentCallId(block.callId) ?? block.callId);
+    if (block.receipts?.length) receiptsByCall.set(shownCallId, new Map(block.receipts.map((receipt, index) => [index, receipt])));
   }
+  const receiptsOf = (callId: string) => {
+    const receipts = receiptsByCall.get(callId);
+    return receipts ? [...receipts].sort(([a], [b]) => a - b).map(([, receipt]) => receipt) : undefined;
+  };
+  const addReceipts = (callId: string, receipts: AiWebsiteReceipt[]) => {
+    const known = receiptsByCall.get(callId) ?? new Map<number, { method: string; url: string }>();
+    for (const { index, method, url } of receipts) known.set(index, { method, url });
+    receiptsByCall.set(callId, known);
+    return receiptsOf(callId) ?? [];
+  };
   /** Real frontend mode per tool name — set once the turn's tools are prepared.
    *  Getting this wrong is not cosmetic: the client auto-resolves plain "client"
    *  blocks, so a mislabeled client_interaction tool (survey) would be answered
@@ -408,6 +475,10 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
   const setApprovalPolicies = (items: PreparedAiTools["approvalPolicies"]) => {
     approvalPolicies = items;
   };
+  let approvalTargets: ReadonlyMap<string, AiApprovalTarget> = new Map();
+  const setApprovalTargets = (items: ReadonlyMap<string, AiApprovalTarget>) => {
+    approvalTargets = items;
+  };
   let rejectedCallIds = new Set<string>();
   const setRejectedCallIds = (items: Set<string>) => {
     rejectedCallIds = items;
@@ -433,12 +504,14 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
       name,
       args: "args" in patch ? patch.args : existing?.args,
       status: patch.status ?? existing?.status ?? "running",
+      at: patch.at ?? existing?.at,
       result: "result" in patch ? patch.result : existing?.result,
       isError: "isError" in patch ? patch.isError : existing?.isError,
-      approval: approval && !allowRememberedApprovals ? { ...approval, allowAlways: false } : approval,
+      approval: approval && !allowRememberedApprovals ? { ...approval, allowAlways: false, allowChat: false } : approval,
       frontendMode: patch.frontendMode ?? existing?.frontendMode,
       presentation: patch.presentation ?? existing?.presentation ?? presentations.get(rawName) ?? presentations.get(name),
       ...(approvedCallIds.has(callId) || approvedCallIds.has(displayCallId) || existing?.approved ? { approved: true } : {}),
+      ...(receiptsOf(displayCallId) ? { receipts: receiptsOf(displayCallId) } : {}),
     };
     toolBlocks.set(callId, block);
     return { type: "block_set", block };
@@ -484,6 +557,10 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
       case "tool_action_request":
         const displayCallId = event.kind === "custom_approval" ? (customApprovalParentCallId(event.callId) ?? event.callId) : event.callId;
         const review = approvalReviewForCallId(approvalReviews, event.callId);
+        const target = event.kind === "custom_approval" ? approvalTargets.get(event.callId) : undefined;
+        const allowAlways = target
+          ? target.always
+          : review?.approvalScope !== undefined || aiToolAllowsAlways(approvalPolicies.get(event.name));
         return [
           setTool(
             event.callId,
@@ -497,7 +574,9 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
                   : {
                       message: event.message,
                       review,
-                      allowAlways: review?.approvalScope !== undefined || aiToolAllowsAlways(approvalPolicies.get(event.name)),
+                      allowAlways,
+                      allowChat: target !== undefined || allowAlways,
+                      ...(target?.toolName === AI_WEBSITE_APPROVAL_TOOL ? { website: target.approvalScope } : {}),
                     },
               frontendMode: event.kind === "client_tool" ? (frontendModes.get(event.name) ?? "client") : undefined,
             },
@@ -509,6 +588,7 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
           setTool(event.callId, {
             name: event.name,
             status: rejectedCallIds.has(event.callId) ? "rejected" : event.isError ? "failed" : "completed",
+            at: new Date().toISOString(),
             result: event.result,
             isError: Boolean(event.isError),
             clearApproval: true,
@@ -520,7 +600,15 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
         if (callId && toolBlocks.has(callId)) {
           const existing = toolBlocks.get(callId);
           if (existing && existing.status !== "completed" && existing.status !== "failed") {
-            return [setTool(callId, { status: "failed", result: event.issue.message, isError: true, clearApproval: true })];
+            return [
+              setTool(callId, {
+                status: "failed",
+                at: new Date().toISOString(),
+                result: event.issue.message,
+                isError: true,
+                clearApproval: true,
+              }),
+            ];
           }
         }
         return [];
@@ -534,16 +622,34 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
     }
   };
 
+  const storedMessage = (message: Message, at: string): BlockOp[] =>
+    message.role === "tool_result" && isMalformedToolCallId(message.callId)
+      ? [
+          setTool(message.callId, {
+            name: canonicalToolName(message.name),
+            args: {},
+            status: "failed",
+            at,
+            result: message.result,
+            isError: true,
+            clearApproval: true,
+          }),
+        ]
+      : [];
+
   return {
     translate,
+    storedMessage,
     compaction,
     setFrontendModes,
     setPresentations,
     setCanonicalNames,
     setApprovalPolicies,
     setApprovalReviews,
+    setApprovalTargets,
     setRejectedCallIds,
     setApprovedCallIds,
+    addReceipts,
   };
 };
 
@@ -573,7 +679,7 @@ const materializeChatConfig = async (config: AiChatTurnRunConfig, signal: AbortS
               allowedDataBoundaries: config.modelPolicy?.allowedDataBoundaries,
             })),
             // Cloud runs the code tools itself; only tools a client must run wait for that client to declare them.
-            ...[createCloudAiLocalBashTool(), ...createCloudAiCodeTools()].filter(
+            ...[createCloudAiLocalBashTool(), ...createCloudAiLocalTools(), ...createCloudAiCodeTools()].filter(
               (tool) => tool.location === "server" || config.clientToolIds?.some((name) => name === tool.def.name),
             ),
           ]
@@ -825,7 +931,22 @@ export class AiTurnExecutor {
     const skillSubject =
       defaultToolSource && resolved.profile.capabilities.includes("tools") ? accessSubjectForActor(material.actor) : null;
     const availableSkills = skillSubject ? (await aiSkills.list(skillSubject)).filter((skill) => skill.enabled) : [];
-    const skillCatalog = selectAiSkillCatalog(availableSkills, resolved.provider.contextWindow ?? 0, query);
+    const localClient = !config.background && !config.mandate ? config.client : undefined;
+    const localContext = localClient ? config.localContext : undefined;
+    const localSkills = (localContext?.skills ?? []).map((skill) => ({
+      name: skill.name,
+      description: skill.description,
+      manualOnly: skill.manualOnly,
+      source: "local" as const,
+    }));
+    const skillCatalog = selectAiSkillCatalog(
+      mergeAiSkillCatalog(
+        availableSkills.map(({ name, description, manualOnly }) => ({ name, description, manualOnly })),
+        localSkills,
+      ),
+      resolved.provider.contextWindow ?? 0,
+      query,
+    );
     const projectFiles =
       project && resolvedProjectId && projectSubject
         ? {
@@ -854,7 +975,7 @@ export class AiTurnExecutor {
       ...material.tools,
       ...(memoryActive ? [createCloudAiMemoryTool(query)] : []),
       ...(skillSubject && availableSkills.length ? [createCloudAiLoadSkillTool(skillSubject)] : []),
-      ...(skillSubject && skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(skillSubject)] : []),
+      ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(skillSubject, localSkills)] : []),
       ...(config.project && resolvedProjectId && projectSubject
         ? [
             createCloudAiSearchProjectTool(resolvedProjectId, projectSubject),
@@ -887,7 +1008,13 @@ export class AiTurnExecutor {
     // Built-ins that exist but this turn does not offer: client tools without their client, tools a
     // task cannot use, and tools outside the conversation's fixed scope. load_tools explains each one.
     const unofferedTools = [
-      ...new Set([...sourceToolNames, ...runtimeTools.map((tool) => tool.def.name), ...CODE_RUNTIME_TOOL_NAMES, "local_bash"]),
+      ...new Set([
+        ...sourceToolNames,
+        ...runtimeTools.map((tool) => tool.def.name),
+        ...CODE_RUNTIME_TOOL_NAMES,
+        "local_bash",
+        ...AI_LOCAL_TOOL_NAMES,
+      ]),
     ].filter((name) => !offeredToolNames.has(name));
     const memoryToolEnabled = activeTools.some((tool) => tool.def.name === "memory");
     const projectToolEnabled = activeTools.some((tool) => tool.def.name === "search_project");
@@ -900,9 +1027,14 @@ export class AiTurnExecutor {
       });
     }
 
+    const approvalTargets = new Map<string, AiApprovalTarget>();
+    const linkedApprovals = new Map<string, string>();
+    const freshApprovalRequired = new Set<string>();
     const dynamicToolRuntimeContext = {
       turnId,
       reportToolProgress: (callId: string, message: string) => pipeline.reportToolProgress(callId, message),
+      reportWebsiteReceipts: (callId: string, receipts: AiWebsiteReceipt[]) => pipeline.reportWebsiteReceipts(callId, receipts),
+      localToolsEnabled: activeTools.some((tool) => tool.def.name === "local_upload"),
       attachedFilePaths: new Set(config.files?.attached.map((file) => file.path) ?? []),
       allowedDataBoundaries: material.modelPolicy?.allowedDataBoundaries,
       projectFiles,
@@ -910,6 +1042,35 @@ export class AiTurnExecutor {
       selectedModel: resolved,
       locale: promptLocale,
       timeZone,
+      linkApproval: (approvalCallId: string, approvalId: string) => {
+        linkedApprovals.set(approvalCallId, approvalId);
+      },
+      consumeApproval: async (approvalCallId: string, input: unknown): Promise<AiApprovalUse> => {
+        const pending = await aiConversations.getPendingTurnAction({ conversationId, turnId, callId: approvalCallId });
+        if (!pending?.approvalId) return "approved";
+        const result = await approvals.consume(pending.approvalId, {
+          input,
+          review: approvalReviewForCallId(capabilityActionReviews, approvalCallId) ?? null,
+          requester: { kind: "assistant_turn", ref: `${turnId}/${approvalCallId}` },
+        });
+        if (result.ok) return "approved";
+        if (result.code === "ALREADY_CONSUMED") {
+          // A later question of the same call proves this run resumes after it, not after a crash during the effect.
+          const [open, resolved] = await Promise.all([
+            aiConversations.listPendingActionRecords({ conversationId, turnId }),
+            aiConversations.listResolvedPendingActions({ conversationId, turnId }),
+          ]);
+          return aiApprovalAskedLater(
+            approvalCallId,
+            [...open, ...resolved].map((action) => action.callId),
+          )
+            ? "approved"
+            : "used";
+        }
+        freshApprovalRequired.add(customApprovalParentCallId(approvalCallId) ?? approvalCallId);
+        return "changed";
+      },
+      describeApproval: (approvalCallId: string, target: AiApprovalTarget) => approvalTargets.set(approvalCallId, target),
     };
     const prepared = prepareAiTools({
       tools: activeTools,
@@ -920,6 +1081,7 @@ export class AiTurnExecutor {
     let backgroundError: string | null = null;
     const rememberableCapabilityApprovals = new Map<string, string>();
     const capabilityActionReviews = new Map<string, CapabilityActionReview>();
+    pipeline.setApprovalTargets(approvalTargets);
     pipeline.setFrontendModes(prepared.frontendModes);
     pipeline.setCanonicalNames(prepared.canonicalNames);
     pipeline.setApprovalPolicies(prepared.approvalPolicies);
@@ -989,7 +1151,7 @@ export class AiTurnExecutor {
       await pipeline.emitBaseline();
     }
 
-    const appliedSteers: AiTurnSteer[] = [];
+    const appliedSteers: (AiTurnSteer | null)[] = [];
 
     let mandatePolicy: MandatePolicyV1 | null | undefined;
     if (config.background && config.mandate) {
@@ -1043,6 +1205,7 @@ export class AiTurnExecutor {
           conversationId,
           actor: capabilityAuthority?.actor ?? toolActor,
           staticTools: activeTools,
+          ...(activeTools.some((tool) => tool.def.name === "load_skill") ? { skillNames: availableSkills.map((skill) => skill.name) } : {}),
           allowedTools,
           mandatePolicy,
           unofferedTools,
@@ -1151,8 +1314,8 @@ export class AiTurnExecutor {
     );
     const chat = await aiConversations.getConversation({ conversationId });
     const workingPlan = chat?.todoPlan;
-    const skillCatalogOffered = activeTools.some((tool) => tool.def.name === "load_skill");
-    const skillCreatorAvailable = availableSkills.some((skill) => skill.name === "skill-creator");
+    const skillCatalogOffered = activeTools.some((tool) => ["load_skill", "load_local_skill"].includes(tool.def.name));
+    const skillCreatorAvailable = availableSkills.some((skill) => skill.name === "skill-creator" && !skill.manualOnly);
     // Offer hints and the recent-work summary only guide a fresh turn a person follows; a resumed
     // attempt after an approval or a scheduled run gets neither.
     let guidance: AiTurnGuidance = {};
@@ -1181,7 +1344,16 @@ export class AiTurnExecutor {
     }
     const systemPrompt = composeAiSystemPrompt({
       globalInstructions: settings.globalInstructions,
-      loadedSkills,
+      loadedSkills: [...loadedSkills, ...(localContext?.selectedSkills ?? []).map((skill) => ({ ...skill, source: "local" as const }))],
+      localClient: localClient
+        ? {
+            client: localClient,
+            cloudUrl: (await coreSettings.get<string>("app.url")) || "",
+            instructions: settings.localClientInstructions,
+          }
+        : undefined,
+      workspaceInstructions: localContext?.instructions,
+      localSkillsAvailable: skillCatalogOffered && localSkills.some((skill) => !skill.manualOnly),
       turnInstructions: [
         material.systemPrompt,
         audioUnavailableInstruction,
@@ -1217,8 +1389,9 @@ export class AiTurnExecutor {
       skillCreatorAvailable,
       recentWork: guidance.recentWork,
     });
-    // The turn policy counts the whole turn, including rounds that compaction archived.
+    // The turn policy and repair budget count the whole turn, including rounds that compaction archived.
     const turnMessages = await aiConversations.listTurnMessages({ conversationId, loopId: turnId, includeCompacted: true });
+    const malformedToolCallRepair = createMalformedToolCallRepair(countMalformedToolCallRepairs(turnMessages));
     const turnBlocks = buildBlocksFromMessages(turnMessages);
     const providerNamesByCallId = new Map(
       turnMessages.flatMap(({ message }) =>
@@ -1261,7 +1434,11 @@ export class AiTurnExecutor {
       runBudgetMs: claim.turn.runBudgetMs ?? null,
       finishedToolCalls: turnBlocks
         .slice(turnBlocks.findLastIndex((block) => block.kind === "steer_applied") + 1)
-        .flatMap((block) => (block.kind === "tool" ? [{ ...block, name: providerNamesByCallId.get(block.callId) ?? block.name }] : [])),
+        .flatMap((block) =>
+          block.kind === "tool" && !isMalformedToolCallId(block.callId)
+            ? [{ ...block, name: providerNamesByCallId.get(block.callId) ?? block.name }]
+            : [],
+        ),
       onDecision: (decision) =>
         decision.kind === "hint"
           ? log.warn("AI turn got a loop hint", { conversationId, turnId, hints: decision.hints })
@@ -1271,21 +1448,20 @@ export class AiTurnExecutor {
       agentId: "cloud",
       loopId: turnId,
       ...(isFresh ? { input: turnInput } : {}),
-      provider: turnPolicy.provider,
+      provider: withMalformedToolCallRepair(turnPolicy.provider, malformedToolCallRepair),
       systemPrompt,
-      store,
-      steering: async ({ signal: steeringSignal }) => {
-        if (steeringSignal.aborted) return undefined;
-        const steers = await aiConversations.takePendingTurnSteers({
-          conversationId,
-          turnId,
-          leaseOwner: this.config.leaseOwner,
-        });
-        appliedSteers.push(...steers);
-        if (steers.length === 0) return undefined;
-        turnPolicy.noteSteering();
-        return steers.map((steer) => steer.text);
-      },
+      store: withMalformedToolCallResults(store, malformedToolCallRepair),
+      steering: createChatSteering({
+        repair: malformedToolCallRepair,
+        appliedSteers,
+        takePendingSteers: () =>
+          aiConversations.takePendingTurnSteers({
+            conversationId,
+            turnId,
+            leaseOwner: this.config.leaseOwner,
+          }),
+        noteSteering: turnPolicy.noteSteering,
+      }),
       tools: async () => {
         try {
           return await turnPolicy.tools();
@@ -1332,6 +1508,9 @@ export class AiTurnExecutor {
       allowRememberedApprovals: aiTurnAllowsRememberedApprovals(config),
       rememberableCapabilityApprovals,
       capabilityActionReviews,
+      approvalTargets,
+      linkedApprovals,
+      freshApprovalRequired,
       appliedSteers,
       noteToolRound: turnPolicy.noteToolRound,
       noteToolCall: turnPolicy.noteToolCall,
@@ -1401,7 +1580,10 @@ export class AiTurnExecutor {
     allowRememberedApprovals: boolean;
     rememberableCapabilityApprovals: ReadonlyMap<string, string>;
     capabilityActionReviews: ReadonlyMap<string, CapabilityActionReview>;
-    appliedSteers: AiTurnSteer[];
+    approvalTargets: ReadonlyMap<string, AiApprovalTarget>;
+    linkedApprovals: ReadonlyMap<string, string>;
+    freshApprovalRequired?: ReadonlySet<string>;
+    appliedSteers: (AiTurnSteer | null)[];
     noteToolRound: () => void;
     noteToolCall: (call: AiTurnPolicyToolCall) => void;
     /**
@@ -1423,6 +1605,7 @@ export class AiTurnExecutor {
       allowRememberedApprovals,
       rememberableCapabilityApprovals,
       capabilityActionReviews,
+      approvalTargets,
       appliedSteers,
       noteToolRound,
       noteToolCall,
@@ -1446,7 +1629,11 @@ export class AiTurnExecutor {
             allowRememberedApprovals,
             rememberableCapabilityApprovals,
             capabilityActionReviews,
+            approvalTargets,
+            linkedApprovals: input.linkedApprovals,
+            freshApprovalRequired: input.freshApprovalRequired,
             onBackgroundBlocked: input.onBackgroundBlocked,
+            signal: abortController.signal,
           });
           if (suspended) {
             abortController.abort();
@@ -1549,7 +1736,11 @@ export class AiTurnExecutor {
     allowRememberedApprovals: boolean;
     rememberableCapabilityApprovals: ReadonlyMap<string, string>;
     capabilityActionReviews: ReadonlyMap<string, CapabilityActionReview>;
+    approvalTargets: ReadonlyMap<string, AiApprovalTarget>;
+    linkedApprovals: ReadonlyMap<string, string>;
+    freshApprovalRequired?: ReadonlySet<string>;
     onBackgroundBlocked?: (message: string) => void;
+    signal: AbortSignal;
   }): Promise<boolean> {
     const {
       event,
@@ -1562,6 +1753,7 @@ export class AiTurnExecutor {
       allowRememberedApprovals,
       rememberableCapabilityApprovals,
       capabilityActionReviews,
+      approvalTargets,
     } = input;
     const approvalPolicy = prepared.approvalPolicies.get(event.name);
     const toolName = prepared.canonicalNames.get(event.name) ?? event.name;
@@ -1571,8 +1763,13 @@ export class AiTurnExecutor {
       event.kind === "custom_approval"
         ? rememberableCapabilityApprovals.get(customApprovalParentCallId(event.callId) ?? event.callId)
         : undefined;
-    const approvalScope = capabilityApprovalScope ?? aiToolApprovalScope(toolName, approvalPolicy);
-    const allowAlways = allowRememberedApprovals && (capabilityApprovalScope !== undefined || aiToolAllowsAlways(approvalPolicy));
+    // A tool that names what it asks for (a code run's HTTP request or Action, a web page to read) already looked up
+    // its own remembered approvals under its own rules; the approval is remembered for that target, not the tool.
+    const target = event.kind === "custom_approval" ? approvalTargets.get(event.callId) : undefined;
+    const approvalScope = target?.approvalScope ?? capabilityApprovalScope ?? aiToolApprovalScope(toolName, approvalPolicy);
+    const allowAlways =
+      allowRememberedApprovals && (target ? target.always : capabilityApprovalScope !== undefined || aiToolAllowsAlways(approvalPolicy));
+    const allowChat = allowRememberedApprovals && (target !== undefined || allowAlways);
 
     // Display-only client_view tools (cards, charts) need neither a browser nor input: Cloud answers them itself, in
     // background runs too, whose transcript shows them later. The block goes from running straight to completed:
@@ -1609,8 +1806,15 @@ export class AiTurnExecutor {
     }
 
     // Remembered approvals resolve inline too.
-    if (event.kind !== "client_tool" && allowAlways && approvalContext) {
-      const remembered = await hasRememberedAiToolApproval(approvalContext, { toolName, approvalScope }).catch(() => false);
+    if (
+      event.kind !== "client_tool" &&
+      !target &&
+      allowAlways &&
+      approvalContext &&
+      // A stale decided snapshot needs another human decision, even if the first response also remembered it.
+      !input.freshApprovalRequired?.has(customApprovalParentCallId(event.callId) ?? event.callId)
+    ) {
+      const remembered = await hasRememberedAiToolApproval(approvalContext, { toolName, approvalScope, conversationId }).catch(() => false);
       if (remembered) {
         await aiToolAudit
           .noteApprovalResolved({ turnId, callId: event.callId, approvalState: "approved_by_preference" })
@@ -1620,7 +1824,40 @@ export class AiTurnExecutor {
       }
     }
 
+    const review = event.kind === "custom_approval" ? approvalReviewForCallId(capabilityActionReviews, event.callId) : undefined;
+    let approvalId: string | undefined;
+    let presented = event;
+    if (event.kind !== "client_tool") {
+      const conversation = await aiConversations.getConversation({ conversationId });
+      const owner = conversation?.createdByUserId;
+      if (!owner) throw new Error("Approval requires a conversation owner");
+      const linked = input.linkedApprovals.get(event.callId);
+      if (linked) {
+        const record = await approvals.get(linked);
+        if (!record || record.status !== "pending" || record.requesterKind !== "studio_app" || record.approverUserId !== owner)
+          throw new Error("Approval does not belong to an open Studio request of the conversation owner");
+        approvalId = linked;
+        // The card shows the question the effect's own record holds, never the text the relay sent.
+        presented = { ...event, message: record.sentence };
+      } else {
+        const record = await approvals.request({
+          ...approvalScopeFromToolName(toolName),
+          approvalScope,
+          requester: { kind: "assistant_turn", ref: `${turnId}/${event.callId}`, appId: "assistant", title: conversation.title },
+          subjectId: owner,
+          approverUserId: owner,
+          assurance: approvalAssurance(target !== undefined || capabilityApprovalScope !== undefined || aiToolAllowsAlways(approvalPolicy)),
+          sentence: event.message ?? toolName,
+          review,
+          input: event.args,
+          expiresInMs: AI_ACTION_BUDGET_MS,
+        });
+        if (!record.ok) throw new Error("This approval was already decided or has expired.");
+        approvalId = record.id;
+      }
+    }
     await aiConversations.savePendingTurnAction({
+      approvalId,
       turnId,
       conversationId,
       callId: event.callId,
@@ -1628,10 +1865,12 @@ export class AiTurnExecutor {
       status: "pending",
       name: toolName,
       args: event.args,
-      message: event.message,
-      review: event.kind === "custom_approval" ? approvalReviewForCallId(capabilityActionReviews, event.callId) : undefined,
+      message: presented.message,
+      review,
       approvalScope,
       allowAlways,
+      allowChat,
+      ...(target ? { rememberToolName: target.toolName } : {}),
       frontendMode,
       resolvedEvent: null,
     });
@@ -1653,7 +1892,33 @@ export class AiTurnExecutor {
         .catch(() => undefined);
     }
 
-    await pipeline.apply(event);
+    await pipeline.apply(presented);
+    if (
+      event.kind === "client_tool" &&
+      frontendMode === "client" &&
+      (toolName === "local_bash" || AI_LOCAL_TOOL_NAMES.some((name) => name === toolName))
+    ) {
+      await pipeline.flush();
+      // One wait stays inside a heartbeat interval, keeping lease renewal and abort detection on their cadence.
+      const deadline = performance.now() + this.config.heartbeatMs / 2;
+      while (!input.signal.aborted && performance.now() < deadline) {
+        const action = await aiConversations.getPendingTurnAction({ conversationId, turnId, callId: event.callId });
+        if (action?.status === "resolved" && action.resolvedEvent) {
+          await aiConversations.markPendingTurnActionConsumedInline({ conversationId, turnId, callId: event.callId });
+          loop.push(action.resolvedEvent);
+          return false;
+        }
+        await new Promise<void>((resolve) => {
+          const done = () => {
+            clearTimeout(timer);
+            input.signal.removeEventListener("abort", done);
+            resolve();
+          };
+          const timer = setTimeout(done, 10);
+          input.signal.addEventListener("abort", done, { once: true });
+        });
+      }
+    }
     const suspended = await aiConversations.suspendTurn({
       conversationId,
       turnId,
@@ -1663,6 +1928,16 @@ export class AiTurnExecutor {
       waitingBudgetMs: AI_ACTION_BUDGET_MS,
     });
     await pipeline.flush().catch(() => undefined);
+    if (suspended && approvalId && this.config.onApprovalRequested) {
+      await this.config.onApprovalRequested({ approvalId }).catch((error) => {
+        log.warn("AI approval requested hook failed", {
+          conversationId,
+          turnId,
+          approvalId,
+          error: error instanceof Error ? error.message : "AI approval requested hook failed",
+        });
+      });
+    }
     return suspended;
   }
 
@@ -1871,7 +2146,9 @@ class StreamPipeline {
     this.blocks = this.allowRememberedApprovals
       ? blocks
       : blocks.map((block) =>
-          block.kind === "tool" && block.approval ? { ...block, approval: { ...block.approval, allowAlways: false } } : block,
+          block.kind === "tool" && block.approval
+            ? { ...block, approval: { ...block.approval, allowAlways: false, allowChat: false } }
+            : block,
         );
   }
 
@@ -1895,6 +2172,10 @@ class StreamPipeline {
     this.mapper.setApprovalPolicies(policies);
   }
 
+  setApprovalTargets(targets: ReadonlyMap<string, AiApprovalTarget>): void {
+    this.mapper.setApprovalTargets(targets);
+  }
+
   setRejectedCallIds(callIds: Set<string>): void {
     this.mapper.setRejectedCallIds(callIds);
   }
@@ -1913,6 +2194,8 @@ class StreamPipeline {
   }
 
   async emitMessage(message: AiStoredMessage): Promise<void> {
+    // A malformed call shows once its error result is saved, at the end of its response as in history.
+    for (const op of this.mapper.storedMessage(message.message, message.createdAt)) await this.emitOp(op);
     const seq = this.nextSeq();
     await this.publish(this.envelope({ type: "message_saved" as const, seq, message }));
     await this.maybeSnapshot();
@@ -1950,6 +2233,20 @@ class StreamPipeline {
     await this.maybeSnapshot();
   }
 
+  /**
+   * Shows requests a website approval let through on the call's block, and records them on its message before they go
+   * out, so the chat keeps each receipt and its revoke action whether the call succeeds, fails, or the turn stops.
+   */
+  async reportWebsiteReceipts(callId: string, receipts: AiWebsiteReceipt[]): Promise<void> {
+    if (!receipts.length) return;
+    await recordAiWebsiteReceipts({ conversationId: this.conversationId, turnId: this.turnId, callId, receipts });
+    const merged = this.mapper.addReceipts(callId, receipts);
+    const block = this.blocks.find((block) => block.kind === "tool" && block.id === toolBlockId(callId));
+    if (block?.kind !== "tool") return;
+    await this.emitOp({ type: "block_set", block: { ...block, receipts: merged } });
+    await this.maybeSnapshot();
+  }
+
   async reportToolProgress(callId: string, progress: string): Promise<void> {
     const block = this.blocks.find((block) => block.kind === "tool" && block.callId === callId);
     if (!block || block.kind !== "tool" || block.progress === progress) return;
@@ -2040,6 +2337,7 @@ class StreamPipeline {
 }
 
 export const __aiExecutorTest = {
+  createChatSteering,
   indexConversationToolSource,
   StreamPipeline,
   createEventMapper,