@k2b/cloud 0.35.0 → 0.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -106,8 +106,8 @@
     "@tabler/icons": "3.48.0",
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.18.0",
-    "@k2b/ssr": "0.16.0",
-    "@k2b/ui": "0.25.0",
+    "@k2b/ssr": "0.17.0",
+    "@k2b/ui": "0.27.0",
     "@k2b/stdlib": "0.29.0",
     "@k2b/sync": "7.0.0",
     "@nats-io/jetstream": "3.4.0",

package/scripts/README.md

@@ -3,6 +3,7 @@
 - `build.ts` — production build for one Cloud app (`APP_ID`); used by the Dockerfiles and `bun run build` targets.
 - `preload.ts` — dev-mode preload that registers the SSR plugin and builds CSS before app code loads.
 - `build-canvas-workers.ts` — packages the isolated canvas workers (PDF pages, mobile app icons) and the native canvas for bundles that start them.
+- `cli-pack.ts` — packs a standalone `cld` module with its verified manifest and skill references: `bun run packages/cloud/scripts/cli-pack.ts <module.ts> --references <dir> --out <dir>`. Reads the package name and version from the current directory; publish the output with `npm publish <dir>` or archive it with `npm pack <dir>`.
 - `app-favicon.ts` — generates app favicons from Tabler icons; imported by `build.ts` and `preload.ts`.
 - `browser-performance.ts` — bundles the web-vitals browser asset for core; imported by `build.ts` and `preload.ts`.
 - `runtime-recovery-acceptance.ts` — shared-runtime recovery acceptance on disposable Docker containers: `bun packages/cloud/scripts/runtime-recovery-acceptance.ts` (also `bun run test:runtime-recovery`).

package/scripts/cli-pack.ts

@@ -0,0 +1,123 @@
+#!/usr/bin/env bun
+/**
+ * Pack a `cld` module as a package plugin, for authors without a Cloud
+ * application:
+ *
+ *   bun run node_modules/@k2b/cloud/scripts/cli-pack.ts src/cli.ts --references src/cli-references --out dist/cld-plugin
+ *
+ * Writes the same verified bundle the application build writes to
+ * `dist/cli/<name>/` (`cli.js`, `references/`, `manifest.json`), plus a
+ * `package.json` whose `cld.manifest` points at the manifest. Name and version
+ * come from `package.json` in the current directory.
+ */
+import { lstat, readdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { buildCliPlugin, writeCliPlugin } from "../src/_internal/cli-plugins";
+import { validateCloudCliModule } from "../src/cli/plugin";
+
+const USAGE = "Usage: bun run node_modules/@k2b/cloud/scripts/cli-pack.ts <module.ts> --references <dir> --out <dir>";
+
+const HELP = `${USAGE}
+
+Packs a cld module as a package plugin: the bundled module cli.js, the skill
+references (index.md plus further Markdown files), manifest.json with the
+SHA-512 of every file, and a package.json with "cld": { "manifest": "manifest.json" }.
+Name and version come from package.json in the current directory.
+
+--out must be missing, empty, or an earlier pack output, which is replaced.
+Ship the result with \`npm publish <out>\` or \`npm pack <out>\`.`;
+
+const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null && !Array.isArray(value);
+
+const readJson = (path: string): Promise<unknown> =>
+  readFile(path, "utf8")
+    .then(JSON.parse)
+    .catch(() => null);
+
+const parseArgs = (args: string[]) => {
+  const [module, ...rest] = args;
+  const flags = new Map<string, string>();
+  for (let index = 0; index < rest.length; index += 2) {
+    const [flag, value] = [rest[index]!, rest[index + 1]];
+    if (!["--references", "--out"].includes(flag) || !value || value.startsWith("-") || flags.has(flag)) throw new Error(USAGE);
+    flags.set(flag, value);
+  }
+  const references = flags.get("--references");
+  const out = flags.get("--out");
+  if (!module || module.startsWith("-") || !references || !out) throw new Error(USAGE);
+  return { module: resolve(module), references: resolve(references), out: resolve(out) };
+};
+
+const containsPath = (directory: string, path: string): boolean => {
+  const inside = relative(directory, path);
+  return inside !== ".." && !inside.startsWith(`..${sep}`) && !isAbsolute(inside);
+};
+
+/** Empty `out` for a fresh pack; anything but an earlier pack output stays untouched. */
+const prepareOut = async (out: string, inputs: string[]): Promise<void> => {
+  const refusal = `Refusing --out ${out}: it must be missing, empty, or an earlier pack output.`;
+  const output = await realpath(out).catch(() => out);
+  for (const input of inputs) {
+    const path = await realpath(input).catch(() => input);
+    if (containsPath(out, input) || containsPath(output, path)) throw new Error(refusal);
+  }
+  const info = await lstat(out).catch(() => null);
+  if (!info) return;
+  if (!info.isDirectory()) throw new Error(refusal);
+  const entries = await readdir(out);
+  if (entries.length === 0) return;
+  const previous = await readJson(join(out, "package.json"));
+  if (
+    entries.some((entry) => !["package.json", "manifest.json", "cli.js", "references"].includes(entry)) ||
+    !isRecord(previous) ||
+    !isRecord(previous.cld) ||
+    previous.cld.manifest !== "manifest.json"
+  )
+    throw new Error(refusal);
+  await rm(out, { recursive: true });
+};
+
+const pack = async (args: string[]): Promise<void> => {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(HELP);
+    return;
+  }
+  const options = parseArgs(args);
+  const cwd = process.cwd();
+  const manifest = await readJson(join(cwd, "package.json"));
+  if (
+    !isRecord(manifest) ||
+    typeof manifest.name !== "string" ||
+    !manifest.name ||
+    typeof manifest.version !== "string" ||
+    !manifest.version
+  ) {
+    throw new Error(`${join(cwd, "package.json")} needs a string name and version.`);
+  }
+  const { name: packageName, version } = manifest;
+  await prepareOut(options.out, [cwd, options.module, options.references]);
+  const loaded: unknown = await import(pathToFileURL(options.module).href);
+  const module = validateCloudCliModule(isRecord(loaded) ? loaded.default : undefined);
+  const plugin = await buildCliPlugin({
+    appDir: cwd,
+    appId: packageName,
+    name: module.name,
+    declaration: { module: options.module, references: options.references },
+    version,
+  });
+  await writeCliPlugin(options.out, plugin);
+  await writeFile(
+    join(options.out, "package.json"),
+    `${JSON.stringify({ name: packageName, version, type: "module", cld: { manifest: "manifest.json" } }, null, 2)}\n`,
+  );
+  const references = plugin.manifest.files.filter((file) => file.path.startsWith("references/")).length;
+  console.log(
+    `Packed ${packageName}@${version} (module "${module.name}", ${references} reference files) to ${options.out}. Ship it with \`npm publish ${options.out}\` or \`npm pack ${options.out}\`.`,
+  );
+};
+
+pack(Bun.argv.slice(2)).catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message.replace(/\s*\n\s*/g, " ") : String(error));
+  process.exitCode = 1;
+});

package/src/_internal/shell-focus.ts

@@ -0,0 +1,11 @@
+export const SHELL_FOCUS_COOKIE = "cloud_shell_focus";
+
+export const readShellFocusCookie = (cookieHeader: string | null | undefined): boolean =>
+  cookieHeader
+    ?.split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${SHELL_FOCUS_COOKIE}=`))
+    ?.slice(SHELL_FOCUS_COOKIE.length + 1) === "1";
+
+export const shellFocusCookie = (hidden: boolean, secure: boolean): string =>
+  `${SHELL_FOCUS_COOKIE}=${hidden ? "1" : ""}; Path=/; Max-Age=${hidden ? 31536000 : 0}; SameSite=Lax${secure ? "; Secure" : ""}`;

package/src/access/GroupCoverage.tsx

@@ -68,12 +68,13 @@ const firstPage = (coverage: GroupCoverage) => coverage.members.pages()[0];
  * The members toggle beside the group name. Its label never changes, so
  * loading the members moves nothing in the row; the count leads the list.
  */
-export function GroupCoverageToggle(props: { coverage: GroupCoverage; groupName: string }) {
+export function GroupCoverageToggle(props: { coverage: GroupCoverage; groupName: string; disabled?: boolean }) {
   const locale = useLocale();
   const t = () => accessMessages.resolve([locale()]).t;
   return (
     <button
       type="button"
+      disabled={props.disabled}
       aria-expanded={props.coverage.open()}
       aria-controls={props.coverage.panelId}
       // The group name tells several group rows apart.

package/src/access/PermissionEditor.browser-harness.tsx

@@ -0,0 +1,46 @@
+import { LocaleProvider } from "@k2b/ui";
+import { render } from "solid-js/web";
+import PermissionEditor from "./PermissionEditor";
+
+const host = document.getElementById("root");
+if (!host) throw new Error("Missing harness root");
+render(
+  () => (
+    <LocaleProvider locale="en">
+      <PermissionEditor
+        initialEntries={["Mara Lind", "Lea Sommer", "Jonas Weber"].map((displayName, index) => ({
+          id: `access-${index}`,
+          principal: { type: "user", userId: `user-${index}` },
+          displayName,
+          permission: "read",
+          createdAt: "2026-10-15T07:00:00.000Z",
+        }))}
+        // Equal-width labels isolate pending-state layout from a normal change in label width.
+        allowedLevels={[
+          { level: "read", label: "Level 1" },
+          { level: "write", label: "Level 2" },
+        ]}
+        allowAuthenticated={false}
+        grantAccess={async () => {
+          throw new Error("Not used");
+        }}
+        updateAccess={() =>
+          new Promise<void>((resolve) => {
+            // The test waits for this mark, so it does not depend on how the editor shows a pending change.
+            document.documentElement.dataset.saving = "true";
+            document.addEventListener(
+              "settle-access",
+              () => {
+                delete document.documentElement.dataset.saving;
+                resolve();
+              },
+              { once: true },
+            );
+          })
+        }
+        revokeAccess={async () => {}}
+      />
+    </LocaleProvider>
+  ),
+  host,
+);

package/src/access/PermissionEditor.tsx

@@ -1,14 +1,14 @@
 import { mutation } from "@k2b/stdlib/solid";
-import { IconButton, Placeholder, prompts, SelectChip, Tooltip, useLocale } from "@k2b/ui";
-import { createMemo, For, Show } from "solid-js";
-import { createStore } from "solid-js/store";
+import { announce, IconButton, Placeholder, prompts, SelectChip, Tooltip, useLocale } from "@k2b/ui";
+import { createMemo, createSignal, For, onCleanup, Show } from "solid-js";
+import { createStore, reconcile } from "solid-js/store";
 import { CloudAvatar } from "../account/Avatar";
 import type { AccessEntry, PermissionLevel, Principal, ServiceAccountKind } from "../contracts/shared";
 import { groupDisplayName } from "../shared/account-display";
 import { createGroupCoverage, type GroupCoverage, GroupCoveragePanel, GroupCoverageToggle } from "./GroupCoverage";
 import { isManagerEntry } from "./managers";
 import { accessMessages } from "./messages";
-import PrincipalPicker from "./PrincipalPicker";
+import PrincipalPicker, { principalKey } from "./PrincipalPicker";
 import { serviceAccountKindDisplay } from "./service-account-kind";
 
 // ─────────────────────────────────────────────────────────────────────────
@@ -180,6 +180,12 @@ export default function PermissionEditor(props: PermissionEditorProps) {
   // A store keeps each row's identity across level changes, so an expanded member list stays open. It holds
   // copies: store writes go into the objects themselves, and the caller's entries are not the editor's to change.
   const [entries, setEntries] = createStore<AccessEntry[]>(props.initialEntries.map((entry) => ({ ...entry })));
+  const [pending, setPending] = createSignal<string | null>(null);
+  const grantPending = () => pending() !== null;
+  let disposed = false;
+  onCleanup(() => {
+    disposed = true;
+  });
   const canEdit = () => props.canEdit !== false;
   const allowPublic = () => props.allowPublic === true;
   const allowAuthenticated = () => props.allowAuthenticated !== false;
@@ -196,22 +202,50 @@ export default function PermissionEditor(props: PermissionEditorProps) {
     }
   }
 
-  const grantMut = mutation.create({
-    mutation: async (data: {
-      principal: Principal;
-      permission: GrantableLevel;
-      scope: string | undefined;
-      display: { displayName: string; serviceAccountKind?: ServiceAccountKind };
-    }) => props.grantAccess(data.principal, data.permission, data.display, data.scope),
-    onSuccess: (newEntry) => {
-      setEntries(entries.length, { ...newEntry });
-    },
-    onError: (err) => prompts.error(err.message),
-  });
+  const grant = async (principal: Principal, display: { displayName: string; serviceAccountKind?: ServiceAccountKind }) => {
+    if (disposed || grantPending() || updateMut.loading() || revokeMut.loading()) return;
+    const key = principalKey(principal);
+    if (entries.some((entry) => principalKey(entry.principal) === key)) return;
+    const first = allowed(principal)[0];
+    if (!first) return;
+    const id = `pending:${key}`;
+    setPending(id);
+    setEntries(entries.length, {
+      id,
+      principal,
+      permission: first.level,
+      scope: first.scope,
+      createdAt: new Date().toISOString(),
+      ...display,
+    });
+    try {
+      const entry = await props.grantAccess(principal, first.level, display, first.scope);
+      if (disposed) return;
+      const index = entries.findIndex((entry) => entry.id === id);
+      if (index !== -1) setEntries(index, reconcile({ ...entry }));
+      announce(t().accessGranted({ name: display.displayName }));
+    } catch (err) {
+      if (!disposed) setEntries((current) => current.filter((entry) => entry.id !== id));
+      // Prompts are global, so a grant that fails after its dialog closed still says so.
+      if (!(typeof err === "object" && err !== null && "name" in err && err.name === "AbortError")) {
+        prompts.error(err instanceof Error ? err.message : String(err));
+      }
+    } finally {
+      if (!disposed) setPending(null);
+    }
+  };
 
   type LevelChange = { accessId: string; permission: GrantableLevel; scope: string | undefined };
+  // The row whose change is saving: it shows the chosen level with a spinner, the other rows wait.
+  const [updating, setUpdating] = createSignal<LevelChange | null>(null);
+  const [revoking, setRevoking] = createSignal<string | null>(null);
+  const updatingRow = (accessId: string) => {
+    const change = updating();
+    return change?.accessId === accessId ? change : undefined;
+  };
   const updateMut = mutation.create<LevelChange, LevelChange>({
     mutation: async (data) => {
+      setUpdating(data);
       await props.updateAccess(data.accessId, data.permission, data.scope);
       return data;
     },
@@ -221,6 +255,9 @@ export default function PermissionEditor(props: PermissionEditorProps) {
       }
     },
     onError: (err) => prompts.error(err.message),
+    onFinally: () => {
+      if (!disposed) setUpdating(null);
+    },
   });
 
   const revokeMut = mutation.create<string | null, AccessEntry>({
@@ -231,6 +268,7 @@ export default function PermissionEditor(props: PermissionEditorProps) {
         variant: "danger",
       });
       if (!confirmed) return null;
+      setRevoking(entry.id);
       await props.revokeAccess(entry.id);
       return entry.id;
     },
@@ -238,12 +276,16 @@ export default function PermissionEditor(props: PermissionEditorProps) {
       if (accessId) setEntries((current) => current.filter((entry) => entry.id !== accessId));
     },
     onError: (err) => prompts.error(err.message),
+    onFinally: () => {
+      if (!disposed) setRevoking(null);
+    },
   });
-  const busy = () => grantMut.loading() || updateMut.loading() || revokeMut.loading();
+  const busy = () => grantPending() || updateMut.loading() || revokeMut.loading();
   // The service refuses to remove the last manager; the row says so up front.
   const lastManagerId = createMemo(() => {
     // A grant on part of the resource never manages it.
-    const managers = (props.effectiveEntries?.(entries) ?? entries).filter((entry) => !entry.scope && isManagerEntry(entry));
+    const granted = entries.filter((entry) => entry.id !== pending());
+    const managers = (props.effectiveEntries?.(granted) ?? granted).filter((entry) => !entry.scope && isManagerEntry(entry));
     return managers.length === 1 ? managers[0]!.id : null;
   });
 
@@ -260,6 +302,9 @@ export default function PermissionEditor(props: PermissionEditorProps) {
                 entry={entry}
                 coverage={coverage}
                 canEdit={canEdit()}
+                pending={entry.id === pending()}
+                updating={updatingRow(entry.id)}
+                revoking={entry.id === revoking()}
                 disabled={busy()}
                 lastManager={entry.id === lastManagerId()}
                 allowed={allowed(entry.principal)}
@@ -288,11 +333,9 @@ export default function PermissionEditor(props: PermissionEditorProps) {
           allowPublic={allowPublic()}
           allowAuthenticated={allowAuthenticated()}
           allowServiceAccounts={props.allowServiceAccounts}
-          disabled={busy()}
-          onSelect={(principal, display) => {
-            const first = allowed(principal)[0];
-            if (first && !busy()) grantMut.mutate({ principal, permission: first.level, scope: first.scope, display });
-          }}
+          readOnly={grantPending()}
+          disabled={updateMut.loading() || revokeMut.loading()}
+          onSelect={(principal, display) => void grant(principal, display)}
         />
       </Show>
     </div>
@@ -306,7 +349,14 @@ export default function PermissionEditor(props: PermissionEditorProps) {
 function AccessEntryRow(props: {
   entry: AccessEntry;
   canEdit: boolean;
+  /** Another change is saving: the row keeps its controls, disabled. */
   disabled: boolean;
+  /** This row's grant is saving. */
+  pending?: boolean;
+  /** This row's level change is saving. */
+  updating?: { permission: GrantableLevel; scope: string | undefined };
+  /** This row's removal is saving. */
+  revoking?: boolean;
   /** The only entry that manages the resource: it keeps its level and cannot be removed. */
   lastManager: boolean;
   allowed: ResolvedLevel[];
@@ -325,25 +375,28 @@ function AccessEntryRow(props: {
   const display = () => resolveEntryDisplay(props.entry.permission, props.entry.scope, props.allowed, t());
   const manageLabel = () => resolveEntryDisplay("admin", undefined, props.allowed, t()).label;
   const removeLabel = () => (props.lastManager ? t().lastManager({ level: manageLabel() }) : t().remove({ name: displayName() }));
-  const isInteractive = () =>
-    props.canEdit && !props.disabled && !props.singlePicker && props.allowed.some((option) => option.key === entryKey());
+  // Whether the row offers a picker depends only on what the viewer may do, never on a change in flight, so a
+  // saving change never swaps the picker for the badge and the rows keep their size.
+  const hasPicker = () => props.canEdit && !props.singlePicker && props.allowed.some((option) => option.key === entryKey());
+  const saving = () => props.pending || props.updating !== undefined || props.revoking === true;
+  // While a level change saves, the picker already shows the chosen level.
+  const shownKey = () => (props.updating ? levelKey(props.updating.permission, props.updating.scope) : entryKey());
+  const shownDisplay = () =>
+    props.updating ? resolveEntryDisplay(props.updating.permission, props.updating.scope, props.allowed, t()) : display();
 
   const badgeClass =
     "flex min-h-7 items-center gap-1 rounded-full border border-transparent bg-[var(--ui-surface-muted)] px-2.5 py-1 text-xs text-secondary";
 
   const badgeContent = (
     <>
-      <i class={`ti ${display().icon}`} />
+      <i class={props.pending ? "ti ti-loader-2 animate-spin" : `ti ${display().icon}`} />
       <span>{display().label}</span>
-      <Show when={isInteractive()}>
-        <i class="ti ti-chevron-down text-[10px]" />
-      </Show>
     </>
   );
 
   return (
     <div>
-      <div class="group/access-row flex items-center gap-2 py-1.5">
+      <div class="group/access-row flex items-center gap-2 py-1.5" aria-busy={saving() ? "true" : undefined}>
         <Show
           when={props.entry.principal.type === "user"}
           fallback={
@@ -381,15 +434,19 @@ function AccessEntryRow(props: {
           >
             {(label) => <span class="truncate text-xs text-dimmed">({label()})</span>}
           </Show>
-          <Show when={props.coverage}>{(coverage) => <GroupCoverageToggle coverage={coverage()} groupName={displayName()} />}</Show>
+          <Show when={props.coverage}>
+            {(coverage) => <GroupCoverageToggle coverage={coverage()} groupName={displayName()} disabled={props.pending} />}
+          </Show>
         </div>
 
         {/* Permission badge — interactive single-value picker when editable,
           plain span otherwise. */}
-        <Show when={isInteractive()} fallback={<span class={`${badgeClass} cursor-default`}>{badgeContent}</span>}>
+        <Show when={hasPicker()} fallback={<span class={`${badgeClass} cursor-default`}>{badgeContent}</span>}>
           <SelectChip
             aria-label={t().permissionFor({ name: displayName() })}
-            value={entryKey}
+            value={shownKey}
+            disabled={props.disabled}
+            loading={props.pending || props.updating !== undefined}
             options={props.allowed.map((option) => {
               const locked = props.lastManager && (option.level !== "admin" || option.scope !== undefined);
               return {
@@ -400,7 +457,7 @@ function AccessEntryRow(props: {
                 description: locked ? t().lastManagerOption({ level: manageLabel() }) : option.description,
               };
             })}
-            icon={`ti ${display().icon}`}
+            icon={`ti ${shownDisplay().icon}`}
             position="bottom-left"
             onValueChange={(key) => {
               const option = props.allowed.find((candidate) => candidate.key === key);
@@ -422,7 +479,8 @@ function AccessEntryRow(props: {
               variant="ghost"
               size="xs"
               onClick={props.onRevoke}
-              disabled={props.disabled || props.lastManager}
+              disabled={props.disabled || props.pending || props.lastManager}
+              loading={props.revoking}
               aria-label={t().remove({ name: displayName() })}
               // A disabled button takes no focus and touch has no hover, so the reason also reaches assistive technology.
               aria-description={props.lastManager ? removeLabel() : undefined}

package/src/access/PrincipalPicker.tsx

@@ -33,6 +33,7 @@ export default function PrincipalPicker(props: {
   allowAuthenticated?: boolean;
   allowServiceAccounts?: boolean;
   disabled?: boolean;
+  readOnly?: boolean;
   /** `serviceAccountKind` is set for service accounts so a new row can show the same kind as the result. */
   onSelect: (principal: Principal, display: { displayName: string; serviceAccountKind?: ServiceAccountKind }) => void;
 }) {
@@ -100,6 +101,7 @@ export default function PrincipalPicker(props: {
   return (
     <Combobox
       disabled={props.disabled}
+      readOnly={props.readOnly}
       placeholder={
         props.allowAuthenticated !== false || props.allowPublic
           ? props.allowServiceAccounts

package/src/access/messages.ts

@@ -14,6 +14,7 @@ export const accessMessages = i18n.define({
       publicDescription: "Anyone with the link, including people who are not signed in",
       removeAccessConfirm: ({ name }: { name: string }) => `Remove access for ${name}?`,
       removeAccess: "Remove access",
+      accessGranted: ({ name }: { name: string }) => `Added ${name}`,
       userBoundServiceAccount: "User-bound service account",
       resourceBoundServiceAccount: "Resource-bound service account",
       standaloneServiceAccount: "Service account",
@@ -92,6 +93,7 @@ export const accessMessages = i18n.define({
       publicDescription: "Alle mit dem Link, auch ohne Anmeldung",
       removeAccessConfirm: ({ name }) => `Zugriff für ${name} entfernen?`,
       removeAccess: "Zugriff entfernen",
+      accessGranted: ({ name }) => `${name} hinzugefügt`,
       userBoundServiceAccount: "Benutzergebundenes Dienstkonto",
       resourceBoundServiceAccount: "Ressourcengebundenes Dienstkonto",
       standaloneServiceAccount: "Dienstkonto",

package/src/access/ui.ts

@@ -6,6 +6,7 @@
  * from depending on Cloud's broad legacy UI entrypoint.
  */
 
+export { isManagerEntry, type ManagerCandidate } from "./managers";
 export type { AllowedLevel, GrantableLevel } from "./PermissionEditor";
 export { default as PermissionEditor } from "./PermissionEditor";
 export { default as PrincipalPicker, principalKey } from "./PrincipalPicker";

package/src/ai/chat/answer-links.ts

@@ -0,0 +1,8 @@
+/**
+ * Root scheme-less Cloud resource links in sanitized Assistant answer HTML.
+ * Normalized links stay root-relative under /app/ or /open/ and can never change origin.
+ */
+export function rootResourceLinks(html: string): string {
+  // sanitize-html emits double-quoted attributes with ", <, and > escaped in values.
+  return html.replace(/<a\b[^>]*>/g, (tag) => tag.replace(/(\shref=")((?:app|open)\/)/g, "$1/$2"));
+}

package/src/ai/chat/messages.ts

@@ -34,6 +34,7 @@ const messages = i18n.define({
       turnErrorReason: ({ code, limitMinutes }: AiTurnError) => {
         if (code === "model_unavailable") return "The model service did not answer.";
         if (code === "provider_stopped") return "The model provider ended this answer early.";
+        if (code === "tool_failed") return "A step failed, and the model stopped without an answer.";
         if (code === "quota_exhausted") return "Your AI usage limit for this period is reached. You can continue once it resets.";
         if (code === "context_full") return "This chat is too long for the model. Start a new chat to continue; this one stays as it is.";
         if (code === "time_limit")
@@ -336,6 +337,7 @@ const messages = i18n.define({
       turnErrorReason: ({ code, limitMinutes }) => {
         if (code === "model_unavailable") return "Der KI-Dienst hat nicht geantwortet.";
         if (code === "provider_stopped") return "Der KI-Anbieter hat diese Antwort vorzeitig beendet.";
+        if (code === "tool_failed") return "Ein Schritt ist fehlgeschlagen, und das Modell hat danach nicht geantwortet.";
         if (code === "quota_exhausted")
           return "Dein KI-Kontingent für diesen Zeitraum ist aufgebraucht. Du kannst weiterarbeiten, sobald es sich erneuert.";
         if (code === "context_full")

package/src/ai/chat/primitives.tsx

@@ -1,4 +1,5 @@
 import { createEffect, onCleanup, onMount } from "solid-js";
+import { rootResourceLinks } from "./answer-links";
 import { useAiChatActions } from "./message-actions";
 
 export function AssistantMarkdownBlock(props: { html: string }) {
@@ -41,5 +42,5 @@ export function AssistantMarkdownBlock(props: { html: string }) {
     element.addEventListener("click", handleClick);
     onCleanup(() => element.removeEventListener("click", handleClick));
   });
-  return <div ref={element} class="assistant-markdown-block" innerHTML={props.html} />;
+  return <div ref={element} class="assistant-markdown-block" innerHTML={rootResourceLinks(props.html)} />;
 }