@k2b/cloud 0.30.0 → 0.32.0

package/src/ai/fetch-file-tool.ts

@@ -3,6 +3,7 @@ import { type RequestOptions as HttpsRequestOptions, request as httpsRequest } f
 import { z } from "zod";
 import { type PublicNetworkAddress, resolvePublicNetworkAddresses } from "../services/network-security";
 import { AI_FILES_MAX_FILE_BYTES_DEFAULT, aiFileStore, guessAiMediaType, normalizeAiFilePath } from "./files-store";
+import { authorizeWebRead } from "./firecrawl-tools";
 import { defineAiTool } from "./tools";
 
 const FETCH_FILE_MAX_REDIRECTS = 5;
@@ -225,9 +226,12 @@ const responseLocation = (headers: IncomingHttpHeaders): string | null => {
   return typeof value === "string" && value.trim() ? value : null;
 };
 
+/** How a download that a website approval let through may proceed: only on that origin, each request shown first. */
+type WebsiteApprovedDownload = { origin: string; onRequest: (url: URL, hop: number) => Promise<void> };
+
 export const downloadPublicFile = async (
   rawUrl: string,
-  options: FetchFileDependencies & { maxBytes?: number; signal?: AbortSignal } = {},
+  options: FetchFileDependencies & { maxBytes?: number; signal?: AbortSignal; approvedWebsite?: WebsiteApprovedDownload } = {},
 ): Promise<{ bytes: Uint8Array; headers: IncomingHttpHeaders; url: URL }> => {
   const resolve = options.resolve ?? resolvePublicNetworkAddresses;
   const perform =
@@ -238,6 +242,14 @@ export const downloadPublicFile = async (
   let url = publicHttpsUrl(rawUrl);
 
   for (let redirects = 0; redirects <= FETCH_FILE_MAX_REDIRECTS; redirects++) {
+    if (options.approvedWebsite) {
+      // A website approval covers its own origin only; an open redirect must not carry the address to another one.
+      if (url.origin !== options.approvedWebsite.origin)
+        throw new Error(
+          `Redirect to another website — The file moved to ${url.toString()}, which this chat has not allowed. Download that address directly so the person can decide.`,
+        );
+      await options.approvedWebsite.onRequest(url, redirects);
+    }
     const addresses = await resolveFileAddresses(resolve, url.hostname);
     const response = await perform(url, addresses, { maxBytes, signal: options.signal });
     if (response.statusCode >= 300 && response.statusCode < 400) {
@@ -280,11 +292,15 @@ const responseMediaType = (headers: IncomingHttpHeaders, path: string): string =
 
 export const runCloudAiFetchFile = async (
   input: z.infer<typeof CloudAiFetchFileInputSchema>,
-  context: { conversationId?: string; signal?: AbortSignal },
+  context: { conversationId?: string; signal?: AbortSignal; approvedWebsite?: WebsiteApprovedDownload },
   dependencies: FetchFileDependencies = {},
 ): Promise<z.infer<typeof CloudAiFetchFileOutputSchema>> => {
   if (!context.conversationId) throw new Error("The fetch_file tool needs a conversation context.");
-  const downloaded = await downloadPublicFile(input.url, { ...dependencies, signal: context.signal });
+  const downloaded = await downloadPublicFile(input.url, {
+    ...dependencies,
+    signal: context.signal,
+    approvedWebsite: context.approvedWebsite,
+  });
   const path = normalizeAiFilePath(`/imports/${safeFilename(input.filename, downloaded.url)}`);
   if (!path) throw new Error("Could not derive a valid conversation file path.");
   const stat = await aiFileStore.createAssistantFile({
@@ -307,7 +323,28 @@ export const createCloudAiFetchFileTool = (dependencies: FetchFileDependencies =
     timeoutMs: 90_000,
     promptHint:
       "fetch an exact public HTTPS source file into the chat when the user provides a file link; inspect it with read_file or view_image and present it when useful.",
-  }).server((input, context) => runCloudAiFetchFile(input, context, dependencies));
+  }).server(async (input, context) => {
+    const url = publicHttpsUrl(input.url);
+    const allowedForChat = await authorizeWebRead("file", url.toString(), context);
+    return runCloudAiFetchFile(
+      input,
+      {
+        ...context,
+        ...(allowedForChat
+          ? {
+              approvedWebsite: {
+                origin: url.origin,
+                // The first request's receipt is already shown; each redirect on the same website adds one.
+                onRequest: async (next: URL, hop: number) => {
+                  if (hop > 0) await context.reportWebsiteReceipts?.([{ index: hop, method: "GET", url: next.toString() }]);
+                },
+              },
+            }
+          : {}),
+      },
+      dependencies,
+    );
+  });
 
 export type CloudAiFetchFileInput = z.infer<typeof CloudAiFetchFileInputSchema>;
 export type CloudAiFetchFileOutput = z.infer<typeof CloudAiFetchFileOutputSchema>;

package/src/ai/file-error.ts

@@ -0,0 +1,2 @@
+export const aiMissingChatFileError = (path: string, localToolsEnabled?: boolean, message = `No such file: ${path}`): Error =>
+  new Error(`${message}${localToolsEnabled ? " This is a chat path. Upload local files with local_upload first." : ""}`);

package/src/ai/file-tools.ts

@@ -6,6 +6,7 @@ import {
 } from "@k2b/cloud/services/document-extraction";
 import { z } from "zod";
 import type { RequestActor } from "../server";
+import { aiMissingChatFileError } from "./file-error";
 import {
   AI_PROJECT_FILE_MOUNT,
   AI_SKILL_FILE_MOUNT,
@@ -14,8 +15,9 @@ import {
   mountAiProjectFilePath,
   mountAiSkillFilePath,
 } from "./file-mount";
-import { aiFileStore, guessAiMediaType, isAiWorkingFilePath, normalizeAiFilePath } from "./files-store";
+import { aiFileStore, assertAiModelWritablePath, guessAiMediaType, isAiWorkingFilePath, normalizeAiFilePath } from "./files-store";
 import { defineAiTool } from "./tools";
+import { CLOUD_AI_VIEW_MAX_BYTES, CloudAiViewSummarySchema, cloudAiViewSummary, isAiViewFile, parseCloudAiView } from "./view-block";
 
 const FILE_READ_MAX_BYTES = 64 * 1024;
 const FILE_WRITE_MAX_BYTES = 100 * 1024;
@@ -234,7 +236,7 @@ export const createCloudAiReadFileTool = () => {
             length: input.length,
           })
         : null);
-    if (!stored) throw new Error(`No such file: ${path}`);
+    if (!stored) throw aiMissingChatFileError(path, ctx.localToolsEnabled);
     const extractAsDocument = shouldExtractDocument(path, stored.mediaType);
     if (isTextMediaType(stored.mediaType) && !extractAsDocument) {
       if (input.offset > stored.size) throw new Error(`Offset ${input.offset} is past the end of ${path} (${stored.size} bytes).`);
@@ -271,7 +273,7 @@ export const createCloudAiReadFileTool = () => {
           ? await aiFileStore.readTurnFile({ turnId: ctx.turnId, path })
           : await aiFileStore.read({ conversationId: conversationId(ctx.conversationId, "read_file"), path });
       if (!fullFile) {
-        throw new Error(snapshot ? `Attached file snapshot is unavailable: ${path}` : `No such file: ${path}`);
+        throw snapshot ? new Error(`Attached file snapshot is unavailable: ${path}`) : aiMissingChatFileError(path, ctx.localToolsEnabled);
       }
       try {
         extracted = await extractDocumentMarkdown({ bytes: fullFile.bytes, filename: path, signal: ctx.signal });
@@ -328,6 +330,7 @@ export const createCloudAiWriteFileTool = () =>
     const id = conversationId(ctx.conversationId, "write_file");
     const path = toolPath(input.path, "write");
     assertConversationFilePath(path, "written");
+    assertAiModelWritablePath(path);
     const existing = await aiFileStore.stat({ conversationId: id, path });
     if (existing?.origin === "user") throw new Error(`Cannot overwrite user-uploaded file ${path}. Choose another path.`);
     const bytes = new TextEncoder().encode(input.content);
@@ -356,13 +359,29 @@ export const CloudAiPresentInputSchema = z.object({
       "One sentence in the user's language that says what the file is and what it is for, without repeating its name. Shown next to the file in the chat's results.",
     ),
 });
-export const CloudAiPresentOutputSchema = z.object({ path: z.string(), size: z.number(), mediaType: z.string() });
+export const CloudAiPresentOutputSchema = z.object({
+  path: z.string(),
+  size: z.number(),
+  mediaType: z.string(),
+  view: CloudAiViewSummarySchema.optional(),
+});
+
+/** A view file as it is now; invalid user edits leave an ordinary file. */
+const readView = async (conversationId: string, path: string) => {
+  const file = await aiFileStore.read({ conversationId, path });
+  if (!file || !isAiViewFile(file) || file.bytes.byteLength > CLOUD_AI_VIEW_MAX_BYTES) return undefined;
+  try {
+    return parseCloudAiView(JSON.parse(new TextDecoder().decode(file.bytes)));
+  } catch {
+    return undefined;
+  }
+};
 
 export const createCloudAiPresentTool = () =>
   defineAiTool({
     name: "present",
     description:
-      "Present a conversation file to the user as an openable and downloadable chat attachment. The returned path is a conversation-local file identifier, not a website URL. Refer to the delivered attachment by title; do not turn its path into a Markdown link.",
+      "Present a conversation file to the user as an openable and downloadable chat attachment. The returned path is a conversation-local file identifier, not a website URL. Refer to the delivered attachment by title; do not turn its path into a Markdown link. A view file from cloud.view.* (/views/…view.json) shows inline as its chart, group, table, stats or details view, so present every view the person should see.",
     inputSchema: CloudAiPresentInputSchema,
     outputSchema: CloudAiPresentOutputSchema,
     approval: "never",
@@ -372,8 +391,9 @@ export const createCloudAiPresentTool = () =>
     const path = toolPath(input.path, "read");
     assertConversationFilePath(path, "presented");
     const stat = await aiFileStore.stat({ conversationId: id, path });
-    if (!stat) throw new Error(`No such file: ${path}`);
-    return { path: stat.path, size: stat.size, mediaType: stat.mediaType };
+    if (!stat) throw aiMissingChatFileError(path, ctx.localToolsEnabled);
+    const view = isAiViewFile(stat) && stat.size <= CLOUD_AI_VIEW_MAX_BYTES ? await readView(id, path) : undefined;
+    return { path: stat.path, size: stat.size, mediaType: stat.mediaType, ...(view ? { view: cloudAiViewSummary(view) } : {}) };
   });
 
 type MathToken = { kind: "number"; value: number } | { kind: "ident"; name: string } | { kind: "op"; op: string };

package/src/ai/files-store.ts

@@ -2,6 +2,14 @@ import { type SQL, sql } from "bun";
 import { stripImageMetadata } from "../services/image-metadata";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 import { isAiImage } from "./file-media-type";
+import {
+  CLOUD_AI_VIEW_MAX_BYTES,
+  CLOUD_AI_VIEW_SUFFIX,
+  type CloudAiViewSummary,
+  checkCloudAiView,
+  cloudAiViewSummary,
+  isAiViewPath,
+} from "./view-block";
 
 export { guessAiMediaType } from "./file-media-type";
 
@@ -697,6 +705,7 @@ export async function createAiConversationArtifact(input: {
   const { aiConversations } = await import("./store");
   const conversation = await aiConversations.getConversation({ conversationId: input.conversationId, ownerUserId: input.ownerUserId });
   if (!conversation || conversation.archivedAt) throw new Error("Conversation access denied");
+  assertAiModelWritablePath(input.path);
   return aiFileStore.createToolArtifact(input);
 }
 
@@ -710,6 +719,57 @@ export async function writeAiConversationFile(input: {
   expectedVersion: string | null;
 }): Promise<AiFileStat> {
   if (normalizeAiFilePath(input.path) !== input.path) throw new Error("Invalid file path");
+  assertAiModelWritablePath(input.path);
   const current = await aiFileStore.stat(input);
   return aiFileStore.write({ ...input, origin: current?.origin ?? "assistant", allowUserOverwrite: current?.origin === "user" });
 }
+
+export function assertAiModelWritablePath(path: string): void {
+  if (isAiViewPath(normalizeAiFilePath(path) ?? path))
+    throw new Error("The /views folder holds views that code runs create with cloud.view.*; choose another path.");
+}
+export class AiViewInvalidError extends Error {
+  constructor(readonly issues: string[]) {
+    super(`View rejected: ${issues.join("; ")}`);
+    this.name = "AiViewInvalidError";
+  }
+}
+
+/** Run-produced views use the same ownership, budget and retry rules as other chat artifacts. */
+export async function createAiConversationView(input: {
+  conversationId: string;
+  ownerUserId: string;
+  turnId: string;
+  runId: string;
+  index: number;
+  view: unknown;
+}): Promise<{ path: string } & CloudAiViewSummary> {
+  const { aiConversations } = await import("./store");
+  const conversation = await aiConversations.getConversation({ conversationId: input.conversationId, ownerUserId: input.ownerUserId });
+  if (!conversation || conversation.archivedAt) throw new Error("Conversation access denied");
+  const checked = checkCloudAiView(input.view);
+  if ("issues" in checked) throw new AiViewInvalidError(checked.issues);
+  const bytes = new TextEncoder().encode(JSON.stringify(checked.view));
+  if (bytes.byteLength > CLOUD_AI_VIEW_MAX_BYTES)
+    throw new AiViewInvalidError([`view: At most ${CLOUD_AI_VIEW_MAX_BYTES} bytes are allowed.`]);
+  const slug =
+    checked.view.title
+      .normalize("NFKD")
+      .replace(/\p{M}/gu, "")
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 48)
+      .replace(/-+$/g, "") || "view";
+  const key = `${input.turnId}:${input.runId}:${input.index}`;
+  const digest = new Bun.CryptoHasher("sha256").update(key).digest("hex").slice(0, 8);
+  const path = `/views/${slug}-${digest}${CLOUD_AI_VIEW_SUFFIX}`;
+  await aiFileStore.createToolArtifact({
+    conversationId: input.conversationId,
+    path,
+    bytes,
+    mediaType: "application/json",
+    producerCallKey: `view:${key}`,
+  });
+  return { path, ...cloudAiViewSummary(checked.view) };
+}

package/src/ai/firecrawl-tools.ts

@@ -1,8 +1,13 @@
 import { isIP } from "node:net";
-import { truncateMiddle } from "@k2b/nessi";
+import { type ToolContext, truncateMiddle } from "@k2b/nessi";
 import { z } from "zod";
+import type { RequestActor } from "../server";
 import { coreSettings } from "../services";
+import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsWebsiteApprovals, aiWebsiteApprovalScope, findRememberedAiToolApproval } from "./approvals";
+import { aiConversations } from "./store";
 import { defineAiTool } from "./tools";
+import type { AiApprovalTarget, AiWebsiteReceipt } from "./types";
+import { hasWebAddressProvenance, recordWebAddresses, webAddressesIn } from "./web-provenance";
 
 export const AI_FIRECRAWL_API_KEY_SETTING_KEY = "ai.firecrawl_api_key";
 
@@ -274,13 +279,70 @@ export const createCloudAiWebSearchTool = (config: FirecrawlToolConfig = {}) =>
         ...result,
         snippet: truncateSnippet(result.snippet),
       })),
-  }).server(async (input, ctx) => runCloudAiWebSearch(input, { ...config, signal: ctx.signal }));
+  }).server(async (input, ctx) => {
+    const results = await runCloudAiWebSearch(input, { ...config, signal: ctx.signal });
+    if (ctx.conversationId)
+      await recordWebAddresses(
+        ctx.conversationId,
+        results.flatMap((result) => [...webAddressesIn(result.url)]),
+      );
+    return results;
+  });
+
+const webReadApprovalMessage = (kind: "page" | "file", url: string, locale: string | undefined) =>
+  locale?.startsWith("de")
+    ? [
+        `${kind === "page" ? "Webseite lesen" : "Datei laden"}: ${url}`,
+        "Diese Adresse steht nicht in deiner Nachricht, in einem Suchergebnis oder als Link einer gelesenen Seite.",
+        "Die vollständige Adresse geht an die Website.",
+      ].join("\n")
+    : [
+        `${kind === "page" ? "Read web page" : "Download file"}: ${url}`,
+        "This address is not in your message, in a search result, or linked from a page read earlier.",
+        "The full address goes to the website.",
+      ].join("\n");
+
+export type WebReadContext = Pick<ToolContext, "requestApproval"> & {
+  actor: RequestActor;
+  conversationId?: string;
+  turnId?: string;
+  locale?: string;
+  requestApprovalFor?: (message: string, target: AiApprovalTarget) => Promise<boolean>;
+  reportWebsiteReceipts?: (receipts: AiWebsiteReceipt[]) => Promise<void>;
+};
+
+/**
+ * Lets a public web read through when the chat supplied its address. A read sends its full address to the website,
+ * and an address the chat did not supply may carry private data the model put into it, so any other address asks
+ * like an HTTP request from code: with the full URL, and with the website approval of a signed-in chat. Returns
+ * whether such an approval let it through without asking; the chat then shows the receipt before the read goes out.
+ * Throws when the person declines.
+ */
+export const authorizeWebRead = async (kind: "page" | "file", url: string, ctx: WebReadContext): Promise<boolean> => {
+  if (ctx.conversationId && (await hasWebAddressProvenance(ctx.conversationId, url))) return false;
+  const target = { toolName: AI_WEBSITE_APPROVAL_TOOL, approvalScope: aiWebsiteApprovalScope(new URL(url).origin), always: false };
+  const runConfig = ctx.conversationId
+    ? await aiConversations.getTurnRunConfig({ conversationId: ctx.conversationId, turnId: ctx.turnId ?? "" }).catch(() => null)
+    : null;
+  const actorUserId = ctx.actor.kind === "user" ? ctx.actor.user.id : (ctx.actor.delegatedUser?.id ?? "");
+  if (
+    aiTurnAllowsWebsiteApprovals(runConfig) &&
+    (await findRememberedAiToolApproval({ actorUserId }, { ...target, conversationId: ctx.conversationId, chatOnly: true })) !== null
+  ) {
+    await ctx.reportWebsiteReceipts?.([{ index: 0, method: "GET", url }]);
+    return true;
+  }
+  const message = webReadApprovalMessage(kind, url, ctx.locale);
+  const approved = ctx.requestApprovalFor ? await ctx.requestApprovalFor(message, target) : await ctx.requestApproval(message);
+  if (!approved) throw new Error("The person did not allow reading this address. Use an address from their message or a search result.");
+  return false;
+};
 
 export const createCloudAiWebExtractTool = (config: FirecrawlToolConfig = {}) =>
   defineAiTool({
     name: "web_extract",
     description:
-      "Read one web page by URL and return clean Markdown. Inspect the relevant pages needed to support the answer; for research or comparison, prefer primary sources and read more than one useful source when warranted.",
+      "Read one web page by URL and return clean Markdown. Inspect the relevant pages needed to support the answer; for research or comparison, prefer primary sources and read more than one useful source when warranted. Use addresses exactly as the user wrote them, as web_search returned them, or as a page you already read links them; any other address asks the user first.",
     inputSchema: CloudAiWebExtractInputSchema,
     outputSchema: CloudAiWebExtractOutputSchema,
     approval: "never",
@@ -297,7 +359,28 @@ export const createCloudAiWebExtractTool = (config: FirecrawlToolConfig = {}) =>
         truncated: output.truncated || content !== output.content,
       };
     },
-  }).server(async (input, ctx) => runCloudAiWebExtract(input, { ...config, signal: ctx.signal }));
+  }).server(async (input, ctx) => {
+    const url = assertPublicHttpUrl(input.url);
+    const allowedForChat = await authorizeWebRead("page", url, ctx);
+    const output = await runCloudAiWebExtract({ url }, { ...config, signal: ctx.signal });
+    const final = URL.canParse(output.url) ? new URL(output.url) : null;
+    if (allowedForChat && final && final.href !== url) {
+      // Firecrawl follows redirects on its side. The chat shows where the read ended, and a website approval covers
+      // only content from its own origin.
+      await ctx.reportWebsiteReceipts?.([{ index: 1, method: "GET", url: final.href }]);
+      if (final.origin !== new URL(url).origin)
+        throw new Error(
+          `The page redirected to ${final.href}, which this chat has not allowed. Read that address directly so the person can decide.`,
+        );
+    }
+    // The page and every address it links to may be read again without asking.
+    if (ctx.conversationId)
+      await recordWebAddresses(
+        ctx.conversationId,
+        new Set([...webAddressesIn(url), ...webAddressesIn(output.url), ...webAddressesIn(output.content)]),
+      );
+    return output;
+  });
 
 export type CloudAiWebSearchInput = z.infer<typeof CloudAiWebSearchInputSchema>;
 export type CloudAiWebSearchOutput = z.infer<typeof CloudAiWebSearchOutputSchema>;

package/src/ai/html-pdf-tool.ts

@@ -8,6 +8,7 @@ import {
   type RenderHtmlToPdfResult,
   renderHtmlToPdfWithConfig,
 } from "../services/pdf";
+import { aiMissingChatFileError } from "./file-error";
 import { aiProjectFilePathFromMount, aiSkillFilePathFromMount } from "./file-mount";
 import { type AiFileContent, type AiFileStat, aiFileStore, normalizeAiFilePath } from "./files-store";
 import { withAiPdfConversionSlot } from "./pdf-conversions";
@@ -122,7 +123,7 @@ export const createCloudAiHtmlToPdfTool = (dependencies: HtmlPdfToolDependencies
     for (const path of [sourcePath, cssPath, headerPath, footerPath, ...assetPaths]) {
       if (path === undefined) continue;
       const file = await stat({ conversationId, path });
-      if (!file) throw new Error(`No such file: ${path}`);
+      if (!file) throw aiMissingChatFileError(path, ctx.localToolsEnabled);
       if (path === sourcePath && file.origin !== "assistant") {
         throw new Error(`Create an assistant-owned HTML file with write_file before converting ${sourcePath}.`);
       }
@@ -134,7 +135,7 @@ export const createCloudAiHtmlToPdfTool = (dependencies: HtmlPdfToolDependencies
 
     const load = async (path: string): Promise<AiFileContent> => {
       const file = await read({ conversationId, path });
-      if (!file) throw new Error(`No such file: ${path}`);
+      if (!file) throw aiMissingChatFileError(path, ctx.localToolsEnabled);
       return file;
     };
     const text = async (path: string | undefined): Promise<string | undefined> => (path === undefined ? undefined : utf8(await load(path)));

package/src/ai/http.ts

@@ -6,6 +6,7 @@ import { type AuthContext, err, fail, respond } from "../server";
 import { aiAttachmentMarker } from "./attachments";
 import { CODE_RUNTIME_TOOL_NAMES } from "./browser-code-contracts";
 import { AI_TURN_ATTACHMENT_MAX_ITEMS } from "./limits";
+import { AI_LOCAL_TOOL_NAMES, AiLocalClientSchema, AiLocalContextSchema } from "./local-tool-contracts";
 import { AiQuotaError } from "./quotas";
 import { AiResourceMarkerSchema } from "./resource-markers";
 import { AI_SHORT_ID_PATTERN } from "./short-id";
@@ -120,7 +121,10 @@ export const AiUserContentPartSchema = z.union([
 
 export type AiTurnContentPart = z.infer<typeof AiUserContentPartSchema>;
 
-export const AiClientToolIdSchema = z.enum(["local_bash", ...CODE_RUNTIME_TOOL_NAMES] satisfies [AiClientToolId, ...AiClientToolId[]]);
+export const AiClientToolIdSchema = z.enum(["local_bash", ...AI_LOCAL_TOOL_NAMES, ...CODE_RUNTIME_TOOL_NAMES] satisfies [
+  AiClientToolId,
+  ...AiClientToolId[],
+]);
 
 // Names use aiCapabilityToolName's provider grammar and 64-character limit. The 64-item cap matches allowedTools, with headroom
 // for retired and not-yet-known names; 64 names × 64 ASCII characters bounds advertised name text to 4 KiB.
@@ -157,12 +161,21 @@ export const AiTurnInputSchema = z
 
 export type AiTurnInput = z.infer<typeof AiTurnInputSchema>;
 
-export const AiSubmitConversationDraftInputSchema = z.object({
-  queueId: z.uuid().optional(),
-  draftRevision: z.number().int().min(1),
-  modelProfileId: z.string().trim().min(1).optional(),
-  clientToolIds: AiClientToolIdsSchema.optional(),
-});
+export const AiSubmitConversationDraftInputSchema = z
+  .object({
+    queueId: z.uuid().optional(),
+    draftRevision: z.number().int().min(1),
+    modelProfileId: z.string().trim().min(1).optional(),
+    clientToolIds: AiClientToolIdsSchema.optional(),
+    /** Set by a local client such as cld; the web never sends it. */
+    client: AiLocalClientSchema.optional(),
+    /** AGENTS.md files and local Skills a local client found; only valid together with client. */
+    localContext: AiLocalContextSchema.optional(),
+  })
+  .refine((input) => !input.localContext || Boolean(input.client), {
+    message: "Local context requires a local client.",
+    path: ["localContext"],
+  });
 
 export const AiSteerInputSchema = z.object({
   message: z.string().trim().min(1).max(20000),
@@ -187,6 +200,13 @@ export const AiMessageRetryInputSchema = z
       .max(AI_TURN_ATTACHMENT_MAX_ITEMS * 2 + 1)
       .optional(),
     modelProfileId: z.string().trim().min(1).optional(),
+    clientToolIds: AiClientToolIdsSchema.optional(),
+    client: AiLocalClientSchema.optional(),
+    localContext: AiLocalContextSchema.omit({ selectedSkills: true }).optional(),
+  })
+  .refine((input) => !input.localContext || Boolean(input.client), {
+    message: "Local context requires a local client.",
+    path: ["localContext"],
   })
   .refine(
     (input) =>
@@ -272,13 +292,18 @@ export const toAiErrorResponse = (c: Context<AuthContext>, error: unknown) => {
   return respond(c, fail(err.internal(message)));
 };
 
-export const toAiActionFailureResponse = (c: Context<AuthContext>, result: { ok: false; status: 400 | 404 | 409; message: string }) => {
+export const toAiActionFailureResponse = (
+  c: Context<AuthContext>,
+  result: { ok: false; status: 400 | 403 | 404 | 409; message: string },
+) => {
   const failure =
     result.status === 400
       ? err.badInput(result.message)
-      : result.status === 404
-        ? // err.notFound appends " not found" to its subject — the runtime message is already complete.
-          { code: "NOT_FOUND" as const, message: result.message, status: 404 as const }
-        : conflict(result.message);
+      : result.status === 403
+        ? err.forbidden(result.message)
+        : result.status === 404
+          ? // err.notFound appends " not found" to its subject — the runtime message is already complete.
+            { code: "NOT_FOUND" as const, message: result.message, status: 404 as const }
+          : conflict(result.message);
   return respond(c, fail(failure));
 };

package/src/ai/index.ts

@@ -1,14 +1,20 @@
 export { type AiAppSkillIssue, aiAppSkills, appSkillsRegistryState, reconcileAppSkills } from "./app-skill-store";
 export { type AiApprovalPreferenceRoutes, type AiApprovalPreferenceView, createAiApprovalPreferenceRoutes } from "./approval-routes";
 export {
+  AI_WEBSITE_APPROVAL_TOOL,
   type AiToolApprovalContext,
   type AiToolApprovalPreference,
+  type AiToolApprovalRemember,
   aiToolAllowsAlways,
   aiToolApprovalScope,
   aiToolNeedsApproval,
+  aiTurnAllowsWebsiteApprovals,
+  aiWebsiteApprovalScope,
+  findRememberedAiToolApproval,
   forgetAiToolApproval,
   hasRememberedAiToolApproval,
   listAiToolApprovalPreferences,
+  parseAiWebsiteApprovalScope,
   rememberAiToolApproval,
   revokeAiToolApprovalPreference,
 } from "./approvals";
@@ -50,7 +56,9 @@ export { listAiCredentialProfileIds } from "./credentials";
 export {
   CLOUD_AI_CHART_MAX_SERIES,
   CLOUD_AI_CHART_MAX_VALUES,
+  CLOUD_AI_GROUP_MAX_CHARTS,
   CLOUD_AI_TEXT_EDITOR_MAX_CHARS,
+  CLOUD_AI_VIEW_MAX_MARKS,
   type CloudAiCardInput,
   CloudAiCardInputSchema,
   type CloudAiCardOutput,
@@ -59,10 +67,13 @@ export {
   CloudAiChartInputSchema,
   type CloudAiChartOutput,
   CloudAiChartOutputSchema,
+  type CloudAiDateFormat,
+  type CloudAiFormat,
   type CloudAiLocalBashInput,
   CloudAiLocalBashInputSchema,
   type CloudAiLocalBashOutput,
   CloudAiLocalBashOutputSchema,
+  type CloudAiNumberFormat,
   type CloudAiSurveyInput,
   CloudAiSurveyInputSchema,
   type CloudAiSurveyOutput,
@@ -71,6 +82,10 @@ export {
   CloudAiTextEditorInputSchema,
   type CloudAiTextEditorOutput,
   CloudAiTextEditorOutputSchema,
+  cloudAiAppChartSchema,
+  cloudAiChartSchema,
+  cloudAiFormatSchema,
+  cloudAiNumberFormatSchema,
   parseCloudAiChartInput,
 } from "./default-tool-contracts";
 export {
@@ -93,7 +108,9 @@ export {
   type AiConversationFileOverview,
   type AiConversationWorkingGroup,
   type AiFileStat,
+  AiViewInvalidError,
   createAiConversationArtifact,
+  createAiConversationView,
   guessAiMediaType,
   isAiWorkingFilePath,
   listAiConversationFiles,
@@ -148,6 +165,50 @@ export {
   AiInvalidationDomainSchema,
   AiInvalidationSchema,
 } from "./live-events";
+export {
+  AI_LOCAL_BATCH_MAX_ITEMS,
+  AI_LOCAL_INSTRUCTIONS_MAX_BYTES,
+  AI_LOCAL_LIST_MAX_LIMIT,
+  AI_LOCAL_READ_MAX_BYTES,
+  AI_LOCAL_SELECTED_SKILLS_MAX_ITEMS,
+  AI_LOCAL_SKILL_FILES_MAX_ITEMS,
+  AI_LOCAL_SKILLS_MAX_ITEMS,
+  AI_LOCAL_TOOL_NAMES,
+  AI_LOCAL_WRITE_MAX_BYTES,
+  type AiLocalClient,
+  AiLocalClientSchema,
+  type AiLocalContext,
+  AiLocalContextSchema,
+  type AiLocalToolName,
+  type CloudAiLoadLocalSkillInput,
+  CloudAiLoadLocalSkillInputSchema,
+  type CloudAiLoadLocalSkillOutput,
+  CloudAiLoadLocalSkillOutputSchema,
+  type CloudAiLocalDownloadInput,
+  CloudAiLocalDownloadInputSchema,
+  type CloudAiLocalDownloadOutput,
+  CloudAiLocalDownloadOutputSchema,
+  type CloudAiLocalListInput,
+  CloudAiLocalListInputSchema,
+  type CloudAiLocalListOutput,
+  CloudAiLocalListOutputSchema,
+  type CloudAiLocalMoveInput,
+  CloudAiLocalMoveInputSchema,
+  type CloudAiLocalMoveOutput,
+  CloudAiLocalMoveOutputSchema,
+  type CloudAiLocalReadInput,
+  CloudAiLocalReadInputSchema,
+  type CloudAiLocalReadOutput,
+  CloudAiLocalReadOutputSchema,
+  type CloudAiLocalUploadInput,
+  CloudAiLocalUploadInputSchema,
+  type CloudAiLocalUploadOutput,
+  CloudAiLocalUploadOutputSchema,
+  type CloudAiLocalWriteInput,
+  CloudAiLocalWriteInputSchema,
+  type CloudAiLocalWriteOutput,
+  CloudAiLocalWriteOutputSchema,
+} from "./local-tool-contracts";
 export { AI_ENRICH_CRON_SETTING_KEY, AI_MEMORY_LEARNING_CRON_SETTING_KEY, aiMaintenanceJobs } from "./maintenance";
 export {
   AI_MEMORY_CONTENT_MAX_CHARS,
@@ -251,6 +312,8 @@ export {
   type AiSkillDocument,
   type AiSkillExtraFrontmatter,
   type AiSkillReferenceInput,
+  isAiSkillManualOnly,
+  mountAiSkillInstructionLinks,
   parseAiSkillMarkdown,
   serializeAiSkillMarkdown,
   validateAiSkillDescription,
@@ -309,6 +372,7 @@ export {
 } from "./transcription";
 export type {
   AiAccessResult,
+  AiApprovalTarget,
   AiCapabilityToolPresentation,
   AiClientToolId,
   AiConversation,
@@ -360,9 +424,43 @@ export type {
   AiTurnStatus,
   AiTurnToolSource,
   AiUserContentPart,
+  AiWebsiteReceipt,
 } from "./types";
 export { AI_MESSAGE_FEEDBACK_REASONS, isAiImageMediaType } from "./types";
 export { isAiSettingsError } from "./validate";
+export {
+  CLOUD_AI_STATS_MAX_ITEMS,
+  CLOUD_AI_TABLE_MAX_COLUMNS,
+  CLOUD_AI_TABLE_MAX_ROWS,
+  CLOUD_AI_VIEW_DIRECTORY,
+  CLOUD_AI_VIEW_MAX_BYTES,
+  CLOUD_AI_VIEW_SUFFIX,
+  type CloudAiChartView,
+  type CloudAiDetailsView,
+  type CloudAiExplorerRequest,
+  type CloudAiExplorerView,
+  type CloudAiGroupView,
+  type CloudAiStatsView,
+  type CloudAiTableView,
+  type CloudAiView,
+  type CloudAiViewReference,
+  type CloudAiViewSummary,
+  CloudAiViewSummarySchema,
+  type CloudAiViewTable,
+  checkCloudAiView,
+  cloudAiDetailsRows,
+  cloudAiExplorerControls,
+  cloudAiExplorerState,
+  cloudAiStatsTiles,
+  cloudAiTableTsv,
+  cloudAiViewSummary,
+  cloudAiViewTable,
+  isAiViewFile,
+  isAiViewPath,
+  parseCloudAiChartToolView,
+  parseCloudAiView,
+  sortCloudAiViewRows,
+} from "./view-block";
 export {
   type CloudAiViewImageInput,
   CloudAiViewImageInputSchema,