@k2b/cloud 0.32.0 → 0.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -105,10 +105,10 @@
     "@simplewebauthn/server": "14.0.3",
     "@tabler/icons": "3.48.0",
     "@tailwindcss/typography": "0.5.20",
-    "@k2b/nessi": "0.17.1",
-    "@k2b/ssr": "0.15.0",
-    "@k2b/ui": "0.23.0",
-    "@k2b/stdlib": "0.28.0",
+    "@k2b/nessi": "0.18.0",
+    "@k2b/ssr": "0.15.1",
+    "@k2b/ui": "0.24.0",
+    "@k2b/stdlib": "0.29.0",
     "@k2b/sync": "7.0.0",
     "@nats-io/jetstream": "3.4.0",
     "@nats-io/transport-node": "3.4.0",

package/src/_internal/define-app.ts

@@ -74,7 +74,7 @@ import { createSyncOpsRoutes } from "../services/sync-ops";
 import { capabilityMessages } from "../shared/capability-messages";
 import { normalizeLocale } from "../shared/locale";
 import { escapeHtml } from "../shared/markdown/shared";
-import { themeBootstrapScript } from "../shared/theme";
+import { type CloudThemePreference, readThemePreferenceFromCookieHeader, themeBootstrapScript } from "../shared/theme";
 import { appFaviconHref } from "./app-favicon";
 import { compileAppPresentation } from "./app-presentation";
 import { readBoundedJson } from "./bounded-json";
@@ -102,6 +102,7 @@ const v = Date.now();
 export type PageOptions = {
   title?: string;
   description?: string;
+  /** Fix public displays such as Pulse, Weather and Venue monitors to one theme; otherwise follow the person's preference. */
   theme?: "light" | "dark";
   /** Framework-resolved BCP 47 document language — always the canonical request locale, never a page override. */
   lang?: string;
@@ -109,7 +110,7 @@ export type PageOptions = {
   pwa?: { name: string };
 };
 
-type ResolvedPageOptions = PageOptions & { performanceRoute?: string };
+type ResolvedPageOptions = PageOptions & { performanceRoute?: string; themePreference?: CloudThemePreference };
 
 // ── Public types ────────────────────────────────────────────────────────────
 
@@ -411,17 +412,24 @@ export const defineApp = <
     // Every island instance already mounts inside its own error boundary; this
     // only gives the fallback Cloud's look and the reader's language.
     errorFallback: fileURLToPath(new URL("../ssr/IslandError.tsx", import.meta.url)),
-    template: ({ body, scripts, title, description, theme, lang, performanceRoute, pwa }) => {
-      const themeFixed = theme !== undefined;
+    template: ({ body, scripts, title, description, theme, themePreference, lang, performanceRoute, pwa }) => {
+      const fixed = theme !== undefined;
+      const resolved = theme ?? (themePreference === "light" || themePreference === "dark" ? themePreference : undefined);
       // App pages paint the canvas before any stylesheet and give it to the
       // status bar. No status-bar style: `black-translucent` lays a blur band
       // over the top edge on iOS 26.
-      const canvas = PWA_CANVAS_COLORS[theme ?? "light"];
+      const canvas = resolved ? PWA_CANVAS_COLORS[resolved] : undefined;
       const head = pwa
         ? {
-            html: ` style="background-color:${canvas}"`,
+            html: canvas ? ` style="background-color:${canvas}"` : "",
             viewport: "width=device-width, initial-scale=1, viewport-fit=cover",
-            app: `<meta name="theme-color" content="${canvas}">
+            app: `${
+              canvas
+                ? `<meta name="theme-color" content="${canvas}">`
+                : `<meta name="theme-color" media="(prefers-color-scheme: light)" content="${PWA_CANVAS_COLORS.light}">
+    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="${PWA_CANVAS_COLORS.dark}">
+    <style data-cloud-canvas>html{background-color:${PWA_CANVAS_COLORS.light}}@media (prefers-color-scheme: dark){html{background-color:${PWA_CANVAS_COLORS.dark}}}</style>`
+            }
     <link rel="manifest" href="${PWA_MANIFEST_PATH}">
     <link rel="apple-touch-icon" href="/branding/apple-touch-icon.png">
     <meta name="apple-mobile-web-app-title" content="${escapeHtml(pwa.name)}">`,
@@ -442,7 +450,7 @@ export const defineApp = <
       // stylesheet declares a layer. Tailwind's `properties` layer resets
       // `--tw-*` in browsers without `@property` and must stay lowest.
       return `<!DOCTYPE html>
-<html lang="${normalizeLocale(lang)}" class="${theme ?? "light"}"${themeFixed ? " data-theme-fixed" : ""}${head.html}>
+<html lang="${normalizeLocale(lang)}" class="${resolved ?? "light"}"${fixed ? " data-theme-fixed" : ""}${head.html}>
   <head><meta charset="UTF-8"><meta name="viewport" content="${head.viewport}">
     <meta name="view-transition" content="same-origin">
     <title>${escapeHtml(title ?? "Cloud")}</title>
@@ -480,6 +488,7 @@ export const defineApp = <
   const ssr = Object.assign(
     createStatusPreservingSsrHandler<ResolvedPageOptions>(html, async (c) => {
       c.get("page").lang = getLocale(c);
+      c.get("page").themePreference = readThemePreferenceFromCookieHeader(c.req.header("Cookie"));
       const user = c.get("user");
       c.get("page").performanceRoute =
         user && c.get("settings")?.observability?.web_vitals?.enabled === true ? (matchedRouteTemplate(c) ?? undefined) : undefined;

package/src/_internal/page-responses.ts

@@ -5,6 +5,7 @@ import { PWA_AUTH_PATH, PWA_SCOPE } from "../contracts/pwa";
 import { getLocale } from "../server/locale";
 import { preloadLayoutAnnouncements } from "../server/middleware/settings";
 import { createLoginRedirectUrl } from "../shared/redirect";
+import { readThemePreferenceFromCookieHeader } from "../shared/theme";
 import type { PageOptions } from "./define-app";
 
 export type PageErrorOptions = {
@@ -21,7 +22,10 @@ export type PageErrorStatus = ClientErrorStatusCode | ServerErrorStatusCode;
 export const createPageResponses = (html: HtmlFn<PageOptions>) => {
   const error = async (c: Context, status: PageErrorStatus, options: PageErrorOptions = {}): Promise<Response> => {
     // Auth middleware may reject before ssr() initializes page metadata.
-    c.set("page", { lang: getLocale(c) });
+    c.set("page", {
+      lang: getLocale(c),
+      themePreference: readThemePreferenceFromCookieHeader(c.req.header("Cookie")),
+    });
     c.header("Cache-Control", "private, no-store");
     if (options.layout !== "pwa") await preloadLayoutAnnouncements(c);
     // Load JSX only after the application's SSR plugin has been installed.

package/src/ai/code-source-contracts.ts

@@ -283,9 +283,24 @@ export const CODE_SOURCE_TOOLS = {
     input: Id.extend(ArtifactMetadata.shape),
   },
   code_create: {
+    promptHint:
+      "build every app, calculator, converter, timer, form or other tool the person asks for as a saved Studio app. In one turn, load_skill assistant-code-mode and load_tools code_create, code_write, code_check and code_open.",
     description:
-      "Create a private reusable App: an index.html interface with optional style.css and app.js, published actions and optional persistence. Starts with a minimal index.html. For one-off analysis, use code_run with code instead. Returns id and entry path; write source with code_write. Optional icon uses the complete class, e.g. ti ti-chart-bar; omit it when unsure. Does not run or share anything.",
-    input: ArtifactCreate.pick({ title: true, description: true, icon: true }),
+      "Create a saved Studio app; it appears in the person's Studio Apps and can be opened, reused and shared. Use it for every app, calculator, converter, timer, form or other interactive tool the person asks for, even when it keeps no data. Pass the complete first version as html (a small app is this one file) and steps (its steps.json), so one call creates it; add style.css, app.js or more files with code_write. Without html it starts with a minimal index.html. Returns id, revision and the lines and length of every file; with html or steps also diagnostics, like code_write. Optional icon uses the complete class, e.g. ti ti-calculator; omit it when unsure. For a one-off analysis use code_run instead. Does not run, check or share anything.",
+    input: ArtifactCreate.pick({ title: true, description: true, icon: true }).extend({
+      html: z
+        .string()
+        .max(1024 * 1024)
+        .optional()
+        .describe(
+          'Complete index.html. A small app fits in this one file: put its script in <script type="module"> and its CSS in <style>. Omit it to start with a minimal page.',
+        ),
+      steps: z
+        .string()
+        .max(1024 * 1024)
+        .optional()
+        .describe("Complete steps.json text for code_check: the main flow, at most 20 steps."),
+    }),
   },
   // Source text stays top-level because some providers corrupt strings nested in arrays.
   // Imports carry only references, so they keep an array and one review per batch.

package/src/ai/code-source-tools.ts

@@ -50,6 +50,7 @@ export function createCodeSourceTool(name: CodeSourceToolName) {
     inputSchema: definition.input,
     outputSchema: z.unknown(),
     approval: "never",
+    promptHint: "promptHint" in definition ? definition.promptHint : undefined,
   }).server(async (input, context) => {
     if (!context.conversationId) throw new Error("Code tools require an Assistant conversation.");
     const { actor } = await resolveAiCapabilityActor({

package/src/ai/default-tools.ts

@@ -99,12 +99,12 @@ export const createCloudAiCardTool = () =>
 export const createCloudAiChartTool = () =>
   defineAiTool({
     name: "chart",
-    description: `Show one chart in the chat from a few values you already have that did not come from a code run, such as figures from the conversation, a web page or a small capability result: bar, line (area: true fills it), scatter, pie, donut, histogram, gauge, sparkline, boxplot, heatmap, barGauge or stat. Several related measures go into one call as a group of small charts (charts, at most ${CLOUD_AI_GROUP_MAX_CHARTS}); linkX shares the x cursor between line charts with the same kind of x. There is no second y axis: compare measures with different units as a group. Cloud draws it with the renderer of cloud.chart() and gives the reader a data table and Copy data; no code, sandbox or app check is involved. Values computed in code_run never go here: the script shows them itself with cloud.view.chart, cloud.view.group, cloud.view.table, cloud.view.stats, cloud.view.details or cloud.view.explorer, and you present the returned path. Aggregate first. Say what the chart shows in title and put the unit, period or source in subtitle; formats are data ({ style: "percent" } takes fractions). The chart has no state, filters or actions: filters, steps and comparison over computed rows come from cloud.view.explorer in code_run; for other interaction show an app in the chat with code_present, and build a saved Studio App only when data must be kept or the app reused. After the chart, state the finding instead of repeating its values.`,
+    description: `Show one chart in the chat from a few values you already have that did not come from a code run, such as figures from the conversation, a web page or a small capability result: bar, line (area: true fills it), scatter, pie, donut, histogram, gauge, sparkline, boxplot, heatmap, barGauge or stat. Several related measures go into one call as a group of small charts (charts, at most ${CLOUD_AI_GROUP_MAX_CHARTS}); linkX shares the x cursor between line charts with the same kind of x. There is no second y axis: compare measures with different units as a group. Cloud draws it with the renderer of cloud.chart() and gives the reader a data table and Copy data; no code, sandbox or app check is involved. Values computed in code_run never go here: the script shows them itself with cloud.view.chart, cloud.view.group, cloud.view.table, cloud.view.stats, cloud.view.details or cloud.view.explorer, and you present the returned path. Aggregate first. Say what the chart shows in title and put the unit, period or source in subtitle; formats are data ({ style: "percent" } takes fractions). The chart has no state, filters or actions: filters, steps and comparison over computed rows come from cloud.view.explorer in code_run; anything else the person interacts with, such as a calculator, converter or form, is a Studio app built with code_create. After the chart, state the finding instead of repeating its values.`,
     inputSchema: CloudAiChartInputSchema,
     outputSchema: CloudAiChartOutputSchema,
     approval: "never",
     promptHint:
-      "show a few values you already have (not from a code run) as a chart in the chat. Code results use cloud.view.* and present; filters, steps and comparison use cloud.view.explorer in code_run; interaction beyond that needs a chat app (code_present).",
+      "show a few values you already have (not from a code run) as a chart in the chat. Code results use cloud.view.* and present; filters, steps and comparison use cloud.view.explorer in code_run; an app or tool to interact with is a Studio app (code_create).",
   }).clientView();
 
 export const createCloudAiSurveyTool = () =>
@@ -246,7 +246,7 @@ export const createCloudAiCodeTools = () => [
   defineAiTool({
     name: "code_open",
     description:
-      "Show the app beside the chat without starting it; HTML apps require a passing code_check for the current files and tables. For one-off calculations, return the result instead of opening an app.",
+      "Show a saved Studio app beside the chat without starting it; HTML apps require a passing code_check for the current files and tables. When the person only wants one calculated result, answer it instead of building an app.",
     inputSchema: CodeOpenInput,
     outputSchema: z.json(),
     approval: "never",
@@ -262,7 +262,7 @@ export const createCloudAiCodeTools = () => [
   defineAiTool({
     name: "code_present",
     description:
-      "Show an HTML app as a card in this chat after a passing code_check for exactly these files and table definitions. Pass files (index.html plus optional style.css and app.js) for a one-off app without saved data, or the id of a saved app to run it live with its data. The person starts the card with a click. Static problems such as CDN scripts, inline handlers or a missing index.html are rejected before anything is saved. For a reusable app beside the chat use code_open.",
+      "Show a saved Studio app as a card in this chat: pass its id after a passing code_check for its current files and tables; it runs live with its data, and the person starts the card with a click. Every app, calculator, converter, form or tool the person asks for is a Studio app created with code_create; code_open shows it beside the chat instead. files (index.html plus optional style.css and app.js) instead of id show a throwaway card that is not saved and does not appear in Studio: only when the person explicitly asks for a preview they do not want to keep, after a passing code_check for exactly these files. Static problems such as CDN scripts, inline handlers or a missing index.html are rejected before anything is saved.",
     inputSchema: CodePresentInput,
     outputSchema: z.json(),
     approval: "never",

package/src/ai/memories.ts

@@ -7,6 +7,10 @@ export const AI_MEMORY_CONTENT_MAX_CHARS = 500;
 export const AI_MEMORY_HOT_MAX_ITEMS = 20;
 export const AI_MEMORY_HOT_MAX_CHARS = 6_000;
 
+// PostgreSQL stores at most 16,383 word positions per tsvector; a parsed token takes at least
+// one character. 12,000 characters keep every position distinct for the stop-word pairing below.
+const AI_MEMORY_RELEVANCE_MAX_CHARS = 12_000;
+
 export type AiMemoryKind = "fact" | "preference" | "workflow";
 export type AiMemoryPriority = "normal" | "pinned";
 export type AiMemorySource = "user" | "agent" | "background";
@@ -131,6 +135,49 @@ const listActive = async (userId: string, limit: number): Promise<AiMemory[]> =>
   return rows.map(toMemory);
 };
 
+const selectRelevant = async (input: { userId: string; text: string; total: number; limit: number }): Promise<AiMemory[]> => {
+  const text = (
+    input.text.length > AI_MEMORY_RELEVANCE_MAX_CHARS
+      ? `${input.text.slice(0, AI_MEMORY_RELEVANCE_MAX_CHARS / 2)}\n${input.text.slice(-AI_MEMORY_RELEVANCE_MAX_CHARS / 2)}`
+      : input.text
+  ).trim();
+  if (!text) return [];
+
+  const rows = await sql<MemoryRow[]>`
+    WITH english AS (
+      SELECT position, token.lexeme
+      FROM unnest(to_tsvector('english', ${text}::text)) AS token, unnest(token.positions) AS position
+    ), german AS (
+      SELECT position, token.lexeme
+      FROM unnest(to_tsvector('german', ${text}::text)) AS token, unnest(token.positions) AS position
+    ), words AS (
+      -- Both configurations parse the same tokens, so a position missing in one holds that language's stop word.
+      SELECT row_number() OVER () AS word, english, german
+      FROM (SELECT DISTINCT english.lexeme AS english, german.lexeme AS german FROM english JOIN german USING (position)) AS pairs
+    ), lexemes AS (
+      SELECT DISTINCT words.word, lexeme FROM words, unnest(ARRAY[words.english, words.german]) AS lexeme
+    ), matches AS (
+      SELECT DISTINCT memory.id, lexemes.word
+      FROM ai.memories AS memory
+      CROSS JOIN LATERAL unnest(tsvector_to_array(memory.stem_document)) AS document(lexeme)
+      JOIN lexemes ON lexemes.lexeme = document.lexeme
+      WHERE memory.user_id = ${input.userId}::uuid AND memory.deleted_at IS NULL AND memory.superseded_by_id IS NULL
+    ), scores AS (
+      -- A word found in fewer of the user's memories says more about relevance.
+      SELECT id, sum(ln((${input.total} + 1)::float8 / matching)) AS score
+      FROM (SELECT id, count(*) OVER (PARTITION BY word) AS matching FROM matches) AS weighted
+      GROUP BY id
+    )
+    SELECT memory.id, memory.short_id, memory.user_id, memory.kind, memory.content, memory.priority, memory.source,
+           memory.source_conversation_id, memory.source_message_id, memory.resource_type, memory.resource_id,
+           memory.created_at, memory.updated_at
+    FROM ai.memories AS memory JOIN scores ON scores.id = memory.id
+    ORDER BY scores.score DESC, memory.updated_at DESC, memory.id ASC
+    LIMIT ${input.limit}
+  `;
+  return rows.map(toMemory);
+};
+
 const searchRows = async (input: { userId: string; query: string; limit: number; backend: SearchBackend }): Promise<AiMemory[]> => {
   const query = input.query.trim();
   if (!query) return listActive(input.userId, input.limit);
@@ -609,7 +656,7 @@ export const aiMemories = {
 
     const [pinned, relevant, recent] = await Promise.all([
       listActive(userId, 50).then((items) => items.filter((item) => item.priority === "pinned")),
-      search({ userId, query, limit: 40 }),
+      selectRelevant({ userId, text: query, total: count, limit: 40 }),
       listActive(userId, 40),
     ]);
     const seen = new Set<string>();

package/src/ai/memory-learning.ts

@@ -57,6 +57,7 @@ type Candidate = {
   conversationId: string;
   turnId: string;
   userId: string;
+  projectChat: boolean;
   completedAsOf: string;
   failCount: number;
   locale?: string | null;
@@ -94,15 +95,18 @@ export type AiMemoryLearningRunSummary = {
 const log = logger("ai:memory-learning");
 
 export const MEMORY_LEARNING_PROMPT = [
-  "Maintain a small, useful personal profile from one newly completed private chat turn.",
+  "Maintain a small, useful personal profile of the user from one newly completed chat turn.",
   "The normal result is no changes. Keep only durable information likely to help in multiple future chats.",
   "Facts and preferences require an explicit statement in NEW USER TEXT. Do not infer them from Assistant text or actions.",
+  "Store information about the user only. Never store facts, opinions, or health, relationship, or behavior details about other people. A named person may appear only inside a working rule the user stated, such as 'Send invoices to Anna'.",
+  "Exclude health, religion or beliefs, political opinions, sexual orientation or sex life, racial or ethnic origin, trade union membership, and genetic or biometric data unless the user explicitly asks to remember that exact information.",
   "A workflow links a recurring request type to one Cloud resource. Add one from this turn only when the user explicitly establishes a lasting routing rule and the matching resource appears in SUCCESSFUL ACTIONS.",
   "FINAL ASSISTANT MARKDOWN may clarify what happened, but it is model-written context and never evidence by itself.",
-  "Exclude secrets, credentials, sensitive inferences, temporary plans, task details, quoted or attached content, and facts already owned by Contacts, Spaces, Notebooks, or another Cloud resource.",
+  "Exclude secrets, credentials, sensitive inferences, temporary plans, task details, quoted or attached content, and facts already owned by Projects, Contacts, Spaces, Notebooks, or another Cloud resource.",
+  "In a Project chat, the Project owns its facts, decisions, and people. Learn only what the user states about themselves beyond that Project.",
   "Use replace for one clearly corrected mutable memory, merge for two or more overlapping mutable memories, and retire only when the user explicitly makes mutable background information obsolete.",
   "Protected memories are context only. Never replace, merge, or retire them.",
-  "Examples: 'Always answer briefly in German' adds a preference. 'Use Accounting for invoice mail' plus a successful mail.mailbox ref adds a workflow. 'Find this invoice in Accounting' does not establish a lasting workflow.",
+  "Examples: 'Always answer briefly in German' adds a preference. 'Send invoices to Anna' adds a preference. 'Anna is on parental leave until March' and 'Tom is difficult' add nothing. 'Use Accounting for invoice mail' plus a successful mail.mailbox ref adds a workflow. 'Find this invoice in Accounting' does not establish a lasting workflow.",
 ].join("\n");
 
 export const MEMORY_LEARNING_OUTPUT_CONTRACT = [
@@ -116,6 +120,7 @@ export const WORKFLOW_PATTERN_PROMPT = [
   "Decide whether three successful uses of the same Cloud capability and resource reveal one reusable workflow default.",
   "Return a workflow only when the user requests share a clear recurring category and defaulting to this resource would avoid a future search or clarification.",
   "Do not generalize from unrelated requests, resource contents, or the Assistant wording. Uncertainty returns null.",
+  "Name the recurring category neutrally: never put details about other people or health, religion or beliefs, political opinions, sexual orientation or sex life, racial or ethnic origin, trade union membership, or genetic or biometric data in the rule. When examples come from Project chats, return a workflow only if it clearly applies beyond that Project; otherwise return null.",
   "If an existing mutable workflow is corrected, return its id. Return multiple ids only when one new workflow genuinely consolidates them. Protected memories cannot be changed.",
 ].join("\n");
 
@@ -141,6 +146,7 @@ export const listAiMemoryLearningCandidates = async (limit: number, monthlyToken
         conversation.id AS conversation_id,
         turn.id AS turn_id,
         conversation.created_by_user_id AS user_id,
+        conversation.project_id IS NOT NULL AS project_chat,
         turn.completed_at,
         turn.memory_learn_fail_count,
         turn.run_config->>'locale' AS locale,
@@ -168,6 +174,7 @@ export const listAiMemoryLearningCandidates = async (limit: number, monthlyToken
       conversation_id AS "conversationId",
       turn_id AS "turnId",
       user_id AS "userId",
+      project_chat AS "projectChat",
       completed_at::text AS "completedAsOf",
       memory_learn_fail_count AS "failCount",
       locale
@@ -292,6 +299,8 @@ const actionLines = (actions: AiMemoryWorkflowEvidence[]): string =>
 
 const learningInput = (evidence: TurnEvidence, memories: Awaited<ReturnType<typeof aiMemories.list>>): string =>
   [
+    evidence.candidate.projectChat ? "CHAT: Project chat" : "CHAT: chat outside Projects",
+    "",
     "NEW USER TEXT:",
     evidence.userText || "(none)",
     "",
@@ -361,8 +370,9 @@ const workflowPatternInput = async (
   if (!(await isAiWorkflowPatternEligible(pattern))) return { input: "", source: null, mutableMemoryIds: new Set() };
   const sources = await Promise.all(
     pattern.turnIds.map(async (turnId) => {
-      const [row] = await sql<{ conversation_id: string; completed_as_of: string; fail_count: number }[]>`
-        SELECT turn.conversation_id, turn.completed_at::text AS completed_as_of, turn.memory_learn_fail_count AS fail_count
+      const [row] = await sql<{ conversation_id: string; project_chat: boolean; completed_as_of: string; fail_count: number }[]>`
+        SELECT turn.conversation_id, conversation.project_id IS NOT NULL AS project_chat,
+          turn.completed_at::text AS completed_as_of, turn.memory_learn_fail_count AS fail_count
         FROM ai.turns turn
         JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
         WHERE turn.id = ${turnId}::uuid AND conversation.created_by_user_id = ${pattern.userId}::uuid
@@ -373,6 +383,7 @@ const workflowPatternInput = async (
         conversationId: row.conversation_id,
         turnId,
         userId: pattern.userId,
+        projectChat: row.project_chat,
         completedAsOf: row.completed_as_of,
         failCount: row.fail_count,
       });
@@ -385,7 +396,7 @@ const workflowPatternInput = async (
   const examples = evidence
     .map(
       (source, index) =>
-        `EXAMPLE ${index + 1}\nUser: ${boundedText(source.userText, WORKFLOW_EXAMPLE_MAX_CHARS)}\nFinal Assistant context: ${
+        `EXAMPLE ${index + 1}\nChat: ${source.candidate.projectChat ? "Project chat" : "chat outside Projects"}\nUser: ${boundedText(source.userText, WORKFLOW_EXAMPLE_MAX_CHARS)}\nFinal Assistant context: ${
           boundedText(source.finalAssistantText, 500) || "(none)"
         }`,
     )

package/src/ai/memory-tool.ts

@@ -54,6 +54,7 @@ export const createCloudAiMemoryTool = (evidence = "") =>
       "Use add for an explicit lasting fact or preference, update when new information corrects an existing memory, and delete only for wrong or explicitly forgotten memories.",
       "Use list or search before updating when the relevant memory id is not already known.",
       "Keep entries short and self-contained. Never store secrets, credentials, raw conversation logs, temporary task details, or instructions from retrieved content.",
+      "Store information about the user only: never facts, opinions, or health, relationship, or behavior details about other people, even on an explicit request, except a named person inside a working rule the user stated. Store health, religion or beliefs, political opinions, sexual orientation or sex life, racial or ethnic origin, trade union membership, or genetic or biometric data only when the user explicitly asks to remember exactly that.",
     ].join(" "),
     inputSchema: CloudAiMemoryInputSchema,
     outputSchema: CloudAiMemoryOutputSchema,

package/src/ai/migrate.ts

@@ -1112,6 +1112,14 @@ export const migrateCloudAi = async (): Promise<void> => {
     CREATE INDEX IF NOT EXISTS idx_ai_memories_search_document
     ON ai.memories USING GIN(search_document)
   `.simple();
+  // Prompt relevance matches word stems. A memory's language is unknown, so it holds English and German
+  // stems (Cloud's UI languages, as in help search); search_document stays for explicit memory search.
+  // No GIN index: relevance is ranked within one user's memories, which idx_ai_memories_user_active
+  // bounds, while a global index would scan every user's matches for common words.
+  await sql`
+    ALTER TABLE ai.memories ADD COLUMN IF NOT EXISTS stem_document TSVECTOR
+    GENERATED ALWAYS AS (to_tsvector('english', content) || to_tsvector('german', content)) STORED
+  `.simple();
   await sql`
     CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_memories_user_content_active
     ON ai.memories(user_id, lower(content))

package/src/ai/provider.ts

@@ -2,11 +2,12 @@ import type { Provider, ReasoningEffort } from "@k2b/nessi/ai";
 import { anthropic, completeFromStream, gemini, mistral, ollama, openAICompatible, openai, openrouter } from "@k2b/nessi/ai";
 import type { AiModelProfile } from "./types";
 
-/** Bound the first token and every gap between chunks to 60s, for chat and complete() calls. */
+/** Bound the first response chunk and every gap between chunks to 60s, for chat and complete() calls. */
 export const PROVIDER_TIMEOUTS = { firstByteMs: 60_000, idleMs: 60_000 } as const;
 
-// Non-streaming calls receive headers only after the whole answer, so a first-byte timeout would cap total generation.
-// Streaming makes the timeouts bound the first token and gaps between chunks, as for chat.
+// Native complete() receives headers only after the whole answer, so until then Nessi can bound it only by total time
+// (totalMs), which cuts off slow healthy answers or detects a stall late. Streaming bounds the first response chunk and
+// every gap between chunks, as for chat. Any body chunk counts, including SSE keep-alive comments.
 export const completeThroughStream = (provider: Provider): Provider => ({
   ...provider,
   complete: (request) => completeFromStream(provider, request),

package/src/browser/navigation-search.ts

@@ -5,7 +5,10 @@ import type { AppMeta } from "../contracts/app";
 /** UI-only rows. The synthetic ref is a row key, never a readable resource. */
 export type NavigationSearchItem = SearchItem & { keywords?: readonly string[] };
 
-export const navigationSearchItems = (apps: readonly AppMeta[], visibleAppIds: readonly string[]): NavigationSearchItem[] => {
+export const navigationSearchItems = (
+  apps: readonly Pick<AppMeta, "id" | "name" | "icon" | "searchLinks">[],
+  visibleAppIds: readonly string[],
+): NavigationSearchItem[] => {
   const visible = new Set(visibleAppIds);
   return apps
     .filter((app) => visible.has(app.id))

package/src/services/outbox.ts

@@ -14,9 +14,10 @@ import { logger } from "./logging";
  * the dispatcher publishes keys concurrently and the rows of one key in order,
  * then completes the batch in one statement. A batch starts no publish after
  * its claim has ended, because the next claim takes its rows. A row that never
- * failed is due at once. Claims stay proportional to the batch with an index on
- * the `where` columns and `sequence`, and one on the `where` columns and
- * `orderBy` limited to `claimed_until IS NOT NULL OR attempts > 0`.
+ * failed is due at once. Claims stay proportional to the batch, whatever the
+ * table's statistics say, with an index on the `where` columns and `sequence`,
+ * and one on the `where` columns and `orderBy` limited to
+ * `claimed_until IS NOT NULL OR attempts > 0`.
  *
  * Required columns: `id uuid`, `attempts int`, `next_attempt_at timestamptz`,
  * `claimed_until timestamptz`, `last_error text`, and the `orderBy` and
@@ -97,13 +98,20 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
       const cap = Math.min(Math.max(limit, 1), batchSize);
       // Claims take turns: a concurrent claim would skip this one's locked rows and take later rows of the same keys.
       // A claim that outlives its claim period is worthless, so neither a slow statement nor a vanished client holds the turn longer.
+      // Without sequential and bitmap scans, statistics of an empty or claimed outbox cannot make a claim scan and sort
+      // the whole backlog instead of walking the sequence index up to the batch. A disabled scan still counts as very
+      // expensive, which would compile every claim (JIT, ~0.4 s), so JIT stays off.
       await tx`
         SELECT set_config('statement_timeout', ${String(claimMs)}, true),
                set_config('idle_in_transaction_session_timeout', ${String(claimMs)}, true),
+               set_config('enable_seqscan', 'off', true),
+               set_config('enable_bitmapscan', 'off', true),
+               set_config('jit', 'off', true),
                pg_advisory_xact_lock(hashtextextended(${claimLock}, 0))
       `;
       // The busy probe runs per candidate (OFFSET 0 keeps the planner from turning it into a join, which
-      // stale statistics can make quadratic), against an index of claimed and retried rows per key.
+      // stale statistics can make quadratic), against an index of claimed and retried rows per key. The update looks
+      // its rows up by id for the same reason: as a join, it scanned the whole table per claim.
       return tx<Row[]>`
         WITH candidates AS MATERIALIZED (
           SELECT current.id
@@ -125,8 +133,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
         ), claimed AS (
           UPDATE ${table} outbox
           SET claimed_until = now() + (${claimMs} * interval '1 millisecond')
-          FROM candidates
-          WHERE outbox.id = candidates.id
+          WHERE outbox.id = ANY(ARRAY(SELECT id FROM candidates))
           RETURNING outbox.*
         )
         SELECT * FROM claimed ORDER BY ${sequence}

package/src/shared/ai-platform-prompt.ts

@@ -105,10 +105,11 @@ Use the conversation file tools for this chat's files: the user's uploads are re
 {%- if memoryEnabled %}
 
 # Personalization rules
-Use the dated facts, preferences, and workflow defaults at the end naturally and judge how current they are. A workflow default may select a likely Cloud resource, but never grants access; resolve it through the current authorized capability before use.
+Apply the dated facts, preferences, and workflow defaults at the end only when one changes the answer, and judge how current it is. Do not mention or recite them unless the user asks or one is directly relevant. The current message wins over a conflicting memory. A workflow default may select a likely Cloud resource, but never grants access; resolve it through the current authorized capability before use.
 {%- if memoryToolEnabled %}
 - When the user explicitly asks you to remember or forget something, or clearly frames a lasting preference with phrases such as "from now on", "always", or "never", call memory before replying.
-- Without a direct request, save only a fact or preference the user clearly stated that is durable and likely useful in future conversations.
+- These limits apply to explicit requests too: never save facts, opinions, or health, relationship, or behavior details about other people, except a named person inside a working rule the user stated. Say what you did not save and offer Contacts or the Project instead.
+- Without a direct request, save only a fact or preference the user clearly stated about themselves that is durable and likely useful in future conversations.
 - Search before correcting an entry whose id is unknown, update contradictions instead of adding duplicates, and delete wrong or explicitly forgotten memories.
 - Say you remembered, noted, or forgot something only after the corresponding memory call succeeded.
 {%- endif %}

package/src/shared/theme.ts

@@ -1,10 +1,13 @@
 export type CloudTheme = "light" | "dark";
+export type CloudThemePreference = CloudTheme | "system";
 
 const THEME_COOKIE = "theme";
 const COOKIE_MAX_AGE_SECONDS = 31536000;
 
 const isCloudTheme = (value: string): value is CloudTheme => value === "light" || value === "dark";
 
+const isCloudThemePreference = (value: string): value is CloudThemePreference => isCloudTheme(value) || value === "system";
+
 const decodeCookieValue = (value: string): string => {
   try {
     return decodeURIComponent(value);
@@ -13,28 +16,44 @@ const decodeCookieValue = (value: string): string => {
   }
 };
 
-/**
- * Resolve the persisted theme from a Cookie header.
- *
- * Browsers can send duplicate cookie names when legacy path-specific cookies
- * exist. RFC ordering puts more specific paths first, so the root preference
- * written by the current app is usually the last valid `theme` entry.
- */
-export const readThemeFromCookieHeader = (cookieHeader: string | null | undefined): CloudTheme => {
-  let resolved: CloudTheme = "light";
+/** More specific legacy paths arrive first; the root choice is the last valid entry. */
+const readCookieValue = <T extends string>(
+  cookieHeader: string | null | undefined,
+  name: string,
+  valid: (value: string) => value is T,
+): T | undefined => {
+  let result: T | undefined;
   for (const part of (cookieHeader ?? "").split(";")) {
     const trimmed = part.trim();
     const separatorIndex = trimmed.indexOf("=");
-    if (separatorIndex <= 0) continue;
-    if (trimmed.slice(0, separatorIndex) !== THEME_COOKIE) continue;
-
+    if (separatorIndex <= 0 || trimmed.slice(0, separatorIndex) !== name) continue;
     const value = decodeCookieValue(trimmed.slice(separatorIndex + 1));
-    if (isCloudTheme(value)) resolved = value;
+    if (valid(value)) result = value;
   }
-  return resolved;
+  return result;
 };
 
-export const themeBootstrapScript = `!function(){var e=document.documentElement;if(!e.hasAttribute("data-theme-fixed")){var t="light";document.cookie.split(";").forEach(function(e){var r=e.trim(),i=r.indexOf("=");if(i>0&&r.slice(0,i)==="theme"){var o;try{o=decodeURIComponent(r.slice(i+1))}catch(e){o=r.slice(i+1)}(o==="light"||o==="dark")&&(t=o)}});e.classList.remove("light","dark");e.classList.add(t)}}();`;
+/** The person's choice; a missing or invalid cookie means Automatic (`system`). */
+export const readThemePreferenceFromCookieHeader = (cookieHeader: string | null | undefined): CloudThemePreference =>
+  readCookieValue(cookieHeader, THEME_COOKIE, isCloudThemePreference) ?? "system";
+
+/**
+ * The resolved theme for server work such as the AI code runtime. For
+ * Automatic it is the scheme the browser last reported; browser code reads the
+ * `<html>` class instead.
+ */
+export const readThemeFromCookieHeader = (cookieHeader: string | null | undefined): CloudTheme => {
+  const preference = readThemePreferenceFromCookieHeader(cookieHeader);
+  return preference === "system" ? (readCookieValue(cookieHeader, "color-scheme", isCloudTheme) ?? "light") : preference;
+};
+
+/**
+ * Resolves the `<html>` class before first paint, because only the browser
+ * knows the device scheme, and follows scheme changes live. It also reports
+ * the scheme in the `color-scheme` cookie for the server. A constant, so a CSP
+ * hash of it stays valid.
+ */
+export const themeBootstrapScript = `!function(){var e=document.documentElement;if(e.hasAttribute("data-theme-fixed"))return;var m=matchMedia("(prefers-color-scheme: dark)");function r(n,s){var v;document.cookie.split(";").forEach(function(p){p=p.trim();var i=p.indexOf("=");if(i>0&&p.slice(0,i)===n){var t=p.slice(i+1);try{t=decodeURIComponent(t)}catch(e){}if(t==="light"||t==="dark"||s&&t==="system")v=t}});return v}function a(){var s=m.matches?"dark":"light";if(r("color-scheme")!==s)document.cookie="color-scheme="+s+"; path=/; max-age=31536000; SameSite=Lax"+(location.protocol==="https:"?"; Secure":"");var p=r("theme",true)||"system";e.classList.remove("light","dark");e.classList.add(p==="system"?s:p)}a();m.addEventListener("change",function(){a();window.dispatchEvent(new Event("cloud:theme-preference"))})}();`;
 
 const legacyThemeCookiePaths = (pathname: string): string[] => {
   const paths = new Set(["/", "/me", "/app", "/admin"]);
@@ -48,11 +67,13 @@ const legacyThemeCookiePaths = (pathname: string): string[] => {
   return [...paths];
 };
 
-export const setThemePreference = (mode: CloudTheme): CloudTheme => {
+export const setThemePreference = (mode: CloudThemePreference): CloudThemePreference => {
   if (typeof document === "undefined") return mode;
 
   document.documentElement.classList.remove("light", "dark");
-  document.documentElement.classList.add(mode);
+  document.documentElement.classList.add(
+    mode === "system" ? (window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light") : mode,
+  );
 
   const secure = location.protocol === "https:" ? "; Secure" : "";
   for (const path of legacyThemeCookiePaths(location.pathname)) {
@@ -62,7 +83,7 @@ export const setThemePreference = (mode: CloudTheme): CloudTheme => {
   return mode;
 };
 
-export const getCurrentThemePreference = (): CloudTheme => {
-  if (typeof document === "undefined") return "light";
-  return document.documentElement.classList.contains("dark") ? "dark" : "light";
+export const getCurrentThemePreference = (): CloudThemePreference => {
+  if (typeof document === "undefined") return "system";
+  return readThemePreferenceFromCookieHeader(document.cookie);
 };

package/src/ssr/AnnouncementBanners.tsx

@@ -0,0 +1,30 @@
+import { IconButton, MarkdownView, NoticeCard, useLocale } from "@k2b/ui";
+import { For } from "solid-js";
+import type { AnnouncementDisplayEntry } from "../contracts/announcements";
+import { platformMessages } from "./platform-messages";
+
+export default function AnnouncementBanners(props: { banners: AnnouncementDisplayEntry[] }) {
+  const locale = useLocale();
+  const t = () => platformMessages.resolve([locale()]).t;
+  if (props.banners.length === 0) return null;
+  return (
+    <div class="flex shrink-0 flex-col gap-1">
+      <For each={props.banners}>
+        {(banner) => (
+          <div class="cloud-announcement">
+            <NoticeCard tone={banner.tone} title={banner.title}>
+              <MarkdownView
+                trustedHtml={banner.bodyHtml}
+                headingScale="compact"
+                class="-mx-2 max-h-36 overflow-y-auto overscroll-contain pl-2 pr-3 [&_p]:my-0"
+              />
+            </NoticeCard>
+            <IconButton size="sm" label={t().dismissBanner} data-cloud-announcement-dismiss={banner.version}>
+              <i class="ti ti-x" aria-hidden="true" />
+            </IconButton>
+          </div>
+        )}
+      </For>
+    </div>
+  );
+}