@k2b/cloud 0.39.0 → 0.40.0

package/src/ai/store.ts

@@ -1,13 +1,19 @@
 import type { DoneReason, InboundEvent, LoopAggregate, Message, SessionStore, StoreEntry } from "@k2b/nessi";
 import type { Usage } from "@k2b/nessi/ai";
 import { type SQL, sql } from "bun";
-import { type CapabilityActionReview, CapabilityActionReviewSchema } from "../contracts/capabilities";
+import { type CapabilityActionReviewData, CapabilityActionReviewDataSchema } from "../contracts/capabilities";
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
+import { AI_TOOL_CHECK_STALE_MS, type AiActionCheck, type AiStoredActionReview } from "./action-review";
+
+export { AI_TOOL_CHECK_STALE_MS };
+
 import { AI_WEBSITE_APPROVAL_TOOL } from "./approvals";
+import { projectSettledAiToolChecks } from "./capability-result";
 import { aiTurnErrorText } from "./chat/turn-error";
 import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 import type { AiTurnBlock } from "./protocol";
+import { collectRecentSentResourceRefs, RECENT_SENT_CONVERSATION_SCAN_LIMIT, RECENT_SENT_MESSAGE_SCAN_LIMIT } from "./recent-sent-refs";
 import { AiRunTimeout } from "./run-timeout";
 import { withAiShortId, withAiShortIdForDb } from "./short-id";
 import { parseAiTodoPlan } from "./todo-contracts";
@@ -65,6 +71,45 @@ export const resolveAiTurnShortIds = async (input: {
   return new Map(rows.map((row) => [row.id, row.short_id]));
 };
 
+/**
+ * Marker texts of the owner's latest sent messages, newest first. The candidates carry no message bodies; only the
+ * newest few are read for their resource markers.
+ */
+export const recentSentResourceMarkersQuery = (ownerUserId: string) => sql<
+  { conversation_id: string; short_id: string; created_at: Date | string; markers: string[] }[]
+>`
+      WITH conversations AS MATERIALIZED (
+        SELECT id FROM ai.conversations
+        WHERE created_by_user_id = ${ownerUserId}::uuid AND archived_at IS NULL
+        ORDER BY updated_at DESC
+        LIMIT ${RECENT_SENT_CONVERSATION_SCAN_LIMIT}
+      ), recent_messages AS MATERIALIZED (
+        SELECT candidate.id, candidate.conversation_id, candidate.created_at FROM conversations
+        CROSS JOIN LATERAL (
+          SELECT message.id, message.conversation_id, message.created_at
+          FROM ai.messages message
+          WHERE message.conversation_id = conversations.id
+            AND message.role = 'user' AND message.kind = 'message'
+            AND NOT (COALESCE(message.meta, '{}'::jsonb) ? 'scheduledTask')
+            AND NOT (COALESCE(message.meta, '{}'::jsonb) ? 'agentMessage')
+          ORDER BY message.seq DESC
+          LIMIT ${RECENT_SENT_MESSAGE_SCAN_LIMIT}
+        ) candidate
+        ORDER BY candidate.created_at DESC, candidate.id DESC
+        LIMIT ${RECENT_SENT_MESSAGE_SCAN_LIMIT}
+      )
+      SELECT recent_messages.conversation_id, sent.short_id, recent_messages.created_at,
+             array_agg(part->>'text' ORDER BY ordinal) AS markers
+      FROM recent_messages
+      JOIN ai.messages sent ON sent.id = recent_messages.id
+      CROSS JOIN LATERAL jsonb_array_elements(
+        CASE WHEN jsonb_typeof(sent.message->'content') = 'array' THEN sent.message->'content' ELSE '[]'::jsonb END
+      ) WITH ORDINALITY AS content(part, ordinal)
+      WHERE part->>'type' = 'text' AND ltrim(part->>'text') LIKE '[Attached Cloud resource %'
+      GROUP BY recent_messages.id, recent_messages.conversation_id, sent.short_id, recent_messages.created_at
+      ORDER BY recent_messages.created_at DESC, recent_messages.id DESC
+    `;
+
 type ConversationSearchBackend = "native" | "bm25";
 let conversationSearchBackendPromise: Promise<ConversationSearchBackend> | null = null;
 
@@ -485,9 +530,9 @@ const parseJsonValue = <T>(value: unknown): T => {
   return value as T;
 };
 
-const parseCapabilityActionReview = (value: unknown): CapabilityActionReview | undefined => {
+const parseCapabilityActionReview = (value: unknown): CapabilityActionReviewData | undefined => {
   if (value === null || value === undefined) return undefined;
-  const parsed = CapabilityActionReviewSchema.safeParse(parseJsonValue(value));
+  const parsed = CapabilityActionReviewDataSchema.safeParse(parseJsonValue(value));
   return parsed.success ? parsed.data : undefined;
 };
 
@@ -530,6 +575,13 @@ const conversationRunStatus = (status: AiTurnStatus | null | undefined, browserP
 const todoMessageJson = () => sql`(CASE WHEN jsonb_typeof(message) = 'string' THEN (message #>> '{}')::jsonb ELSE message END)`;
 const todoMetaJson = () => sql`(CASE WHEN jsonb_typeof(meta) = 'string' THEN (meta #>> '{}')::jsonb ELSE meta END)`;
 
+/** What a copied message keeps of its meta: its todo plan, and its calls' reviews and checks, so a fork reads the same. */
+const copiedMessageMetaJson = () => sql`NULLIF(jsonb_strip_nulls(jsonb_build_object(
+  'todoPlan', ${todoMetaJson()}->'todoPlan',
+  'toolReviews', ${todoMetaJson()}->'toolReviews',
+  'toolChecks', ${todoMetaJson()}->'toolChecks'
+)), '{}'::jsonb)`;
+
 // A scheduled result arriving during an interactive turn becomes context on the next turn.
 const visibleToTurn = (turnId?: string) => sql`(
   ${turnId ?? null}::text IS NULL OR NOT COALESCE(meta ? 'scheduledTask', false) OR seq < ALL (
@@ -929,6 +981,114 @@ export const recordAiWebsiteReceipts = async (input: {
   `;
 };
 
+/** Reviews and outcome checks belong to the assistant message containing the call, including scheduled turns. */
+const recordAiToolMeta = async (
+  input: { conversationId: string; turnId: string; callId: string },
+  key: "toolReviews" | "toolChecks",
+  value: AiStoredActionReview | AiActionCheck,
+  db = sql,
+): Promise<void> => {
+  let written = false;
+  for (const table of ["ai.messages", "ai.task_messages"]) {
+    const rows = await db<{ id: string }[]>`
+      UPDATE ${db(table)}
+      SET meta = COALESCE(meta, '{}'::jsonb) || jsonb_build_object(
+        ${key}::text, COALESCE(meta->${key}::text, '{}'::jsonb) ||
+          jsonb_build_object(${input.callId}::text, ${JSON.stringify(value)}::text::jsonb)
+      )
+      WHERE conversation_id = ${input.conversationId}::uuid AND loop_id = ${input.turnId}::text
+        AND role = 'assistant'
+        AND message->'content' @> jsonb_build_array(jsonb_build_object('type', 'tool_call', 'id', ${input.callId}::text))
+      RETURNING id`;
+    written ||= rows.length > 0;
+  }
+  if (!written) throw new Error("AI tool call message is unavailable.");
+};
+
+export const recordAiToolReview = (input: { conversationId: string; turnId: string; callId: string; review: AiStoredActionReview }) =>
+  recordAiToolMeta(input, "toolReviews", input.review);
+
+export const recordAiToolCheck = (input: { conversationId: string; turnId: string; callId: string; check: AiActionCheck }, db = sql) =>
+  recordAiToolMeta(input, "toolChecks", input.check, db);
+
+/**
+ * Writes one call's check only where `allowed` holds for its current state, in one statement per table, so two Core
+ * replicas or the executor and a person's re-check can never both hold a check, and a settled result is never replaced.
+ */
+const writeAiToolCheckWhere = async (
+  input: { conversationId: string; turnId: string; callId: string },
+  check: AiActionCheck,
+  allowed: (current: SQL.Query<unknown>) => SQL.Query<unknown>,
+): Promise<boolean> => {
+  let written = false;
+  for (const table of ["ai.messages", "ai.task_messages"]) {
+    const current = sql`meta->'toolChecks'->${input.callId}::text`;
+    const rows = await sql<{ id: string }[]>`
+      UPDATE ${sql(table)}
+      SET meta = COALESCE(meta, '{}'::jsonb) || jsonb_build_object(
+        'toolChecks', COALESCE(meta->'toolChecks', '{}'::jsonb) ||
+          jsonb_build_object(${input.callId}::text, ${JSON.stringify(check)}::text::jsonb)
+      )
+      WHERE conversation_id = ${input.conversationId}::uuid AND loop_id = ${input.turnId}::text
+        AND role = 'assistant'
+        AND message->'content' @> jsonb_build_array(jsonb_build_object('type', 'tool_call', 'id', ${input.callId}::text))
+        AND (${allowed(current)})
+      RETURNING id`;
+    written ||= rows.length > 0;
+  }
+  return written;
+};
+
+/**
+ * Claims the check of one call: stores `checking` at `at`, which is the claim's token, when no check holds and none
+ * settled. A call without any check yet may be claimed only with `first`, which the executor uses after an unknown
+ * outcome. A `checking` older than `staleBefore` belonged to a worker or request that stopped and may be taken over.
+ */
+export const claimAiToolCheck = (input: {
+  conversationId: string;
+  turnId: string;
+  callId: string;
+  at: string;
+  staleBefore: string;
+  first?: boolean;
+}): Promise<boolean> =>
+  writeAiToolCheckWhere(
+    input,
+    { state: "checking", at: input.at },
+    (current) => sql`
+      ${input.first ? sql`${current} IS NULL OR` : sql``}
+      ${current}->>'state' IN ('pending', 'failed')
+      OR (${current}->>'state' = 'checking' AND COALESCE(${current}->>'at', '') < ${input.staleBefore}::text)`,
+  );
+
+/** Stores the result of the claim made at `claimedAt`, only while that claim still holds. */
+export const settleAiToolCheck = (input: {
+  conversationId: string;
+  turnId: string;
+  callId: string;
+  claimedAt: string;
+  check: AiActionCheck;
+}): Promise<boolean> =>
+  writeAiToolCheckWhere(
+    input,
+    input.check,
+    (current) => sql`${current}->>'state' = 'checking' AND ${current}->>'at' = ${input.claimedAt}::text`,
+  );
+
+/** The stored check of one call, or null. */
+export const readAiToolCheck = async (input: { conversationId: string; turnId: string; callId: string }): Promise<AiActionCheck | null> => {
+  for (const table of ["ai.messages", "ai.task_messages"]) {
+    const [row] = await sql<{ check: AiActionCheck | null }[]>`
+      SELECT meta->'toolChecks'->${input.callId}::text AS check FROM ${sql(table)}
+      WHERE conversation_id = ${input.conversationId}::uuid AND loop_id = ${input.turnId}::text
+        AND role = 'assistant'
+        AND message->'content' @> jsonb_build_array(jsonb_build_object('type', 'tool_call', 'id', ${input.callId}::text))
+      LIMIT 1`;
+    if (row?.check) return row.check;
+  }
+  return null;
+};
+
 /** Insert a message inside an open conversation-lock transaction and bump the conversation. */
 const insertMessageLocked = async (
   input: {
@@ -1219,15 +1379,17 @@ export const aiConversations: AiConversationService = {
       );
       const target = rows[0];
       if (!target) throw new Error("Failed to fork conversation.");
+      // Copies keep their original send time because Recent orders by it.
       await tx`
         INSERT INTO ai.messages (
           short_id, conversation_id, seq, kind, role, message, search_text, loop_id,
-          model_profile_id, provider_model, usage, stop_reason, loop_aggregate, loop_done_reason, meta
+          model_profile_id, provider_model, usage, stop_reason, loop_aggregate, loop_done_reason, meta, created_at
         )
         SELECT
           short_id, ${target.id}::uuid, seq, kind, role, message, search_text, loop_id,
           model_profile_id, provider_model, usage, stop_reason, loop_aggregate, loop_done_reason,
-          CASE WHEN ${todoMetaJson()} ? 'todoPlan' THEN jsonb_build_object('todoPlan', ${todoMetaJson()}->'todoPlan') ELSE NULL END
+          ${copiedMessageMetaJson()},
+          created_at
         FROM ai.messages
         WHERE conversation_id = ${input.sourceConversationId}::uuid
           AND compacted_at IS NULL
@@ -1563,6 +1725,18 @@ export const aiConversations: AiConversationService = {
     };
   },
 
+  listRecentSentResourceRefs: async ({ ownerUserId }) => {
+    const rows = await recentSentResourceMarkersQuery(ownerUserId);
+    return collectRecentSentResourceRefs(
+      rows.map((row) => ({
+        conversationId: row.conversation_id,
+        messageId: row.short_id,
+        lastSentAt: iso(row.created_at),
+        markers: row.markers,
+      })),
+    );
+  },
+
   listUserConversationResources: async (input) => {
     const limit = Math.min(Math.max(Math.floor(input.limit ?? 20), 1), 100);
     const pattern = searchPattern(input.search);
@@ -2507,6 +2681,7 @@ export const aiConversations: AiConversationService = {
 
     await sql.begin(async (tx) => {
       await tx`SELECT id FROM ai.conversations WHERE id = ${input.targetConversationId} FOR UPDATE`;
+      // Copies keep their original send time because Recent orders by it.
       await tx`
         INSERT INTO ai.messages (
           short_id,
@@ -2523,7 +2698,8 @@ export const aiConversations: AiConversationService = {
           stop_reason,
           loop_aggregate,
           loop_done_reason,
-          meta
+          meta,
+          created_at
         )
         SELECT
           short_id,
@@ -2540,7 +2716,8 @@ export const aiConversations: AiConversationService = {
           stop_reason,
           loop_aggregate,
           loop_done_reason,
-          CASE WHEN ${todoMetaJson()} ? 'todoPlan' THEN jsonb_build_object('todoPlan', ${todoMetaJson()}->'todoPlan') ELSE NULL END
+          ${copiedMessageMetaJson()},
+          created_at
         FROM ai.messages
         WHERE conversation_id = ${input.sourceConversationId}
           AND compacted_at IS NULL
@@ -2862,10 +3039,33 @@ export const aiConversations: AiConversationService = {
     `;
     if (!rows[0]) return null;
     // The waits let a reconnecting client show work time without time spent waiting for the user.
-    const waits = await activeTurnWaits(rows[0].id);
+    const [waits, metadata] = await Promise.all([
+      activeTurnWaits(rows[0].id),
+      sql<{ tool_reviews: Record<string, AiStoredActionReview> | null; tool_checks: Record<string, AiActionCheck> | null }[]>`
+        SELECT meta->'toolReviews' AS tool_reviews, meta->'toolChecks' AS tool_checks
+        FROM (
+          SELECT meta, seq, conversation_id, loop_id, role FROM ai.messages
+          UNION ALL
+          SELECT meta, seq, conversation_id, loop_id, role FROM ai.task_messages
+        ) messages
+        WHERE conversation_id = ${input.conversationId}
+          AND loop_id = ${rows[0].id}
+          AND role = 'assistant'
+          AND (meta ? 'toolReviews' OR meta ? 'toolChecks')
+        ORDER BY seq ASC
+      `,
+    ]);
+    // A person may re-check while the model continues. Durable checks outrank the worker's earlier live snapshot.
+    const reviews = new Map(metadata.flatMap((row) => Object.entries(row.tool_reviews ?? {})));
+    const checks = new Map(metadata.flatMap((row) => Object.entries(row.tool_checks ?? {})));
     return {
       turn: rowToTurn(rows[0]),
-      liveBlocks: rowToLiveBlocks(rows[0]),
+      liveBlocks: rowToLiveBlocks(rows[0]).map((block) => {
+        if (block.kind !== "tool") return block;
+        const review = reviews.get(block.callId);
+        const check = checks.get(block.callId);
+        return { ...block, ...(review ? { review } : {}), ...(check ? { check } : {}) };
+      }),
       liveSeq: Number(rows[0].live_seq ?? 0),
       actionWaitMs: Math.max(0, Math.round(waits.actionWaitMs)),
       waitingSince: waits.waitingSince,
@@ -3578,7 +3778,7 @@ export const aiConversations: AiConversationService = {
       if (input.background && input.turnId) {
         const own = await aiConversations.listTurnMessages({ conversationId: input.conversationId, loopId: input.turnId });
         const context = input.background.context;
-        return [...context, ...own.map((row) => ({ seq: context.length + row.seq, kind: row.kind, message: row.message }))];
+        return [...context, ...projectSettledAiToolChecks(own.map((row) => ({ ...row, seq: context.length + row.seq })))];
       }
       // Results delivered after this turn started belong to the next turn's context.
       // Compare durable message sequences rather than wall-clock timestamps.
@@ -3592,20 +3792,23 @@ export const aiConversations: AiConversationService = {
           `
           ).map(rowToMessage)
         : await aiConversations.listContextMessages({ conversationId: input.conversationId });
-      return rows.map((row) => ({
-        seq: row.seq,
-        kind: row.kind,
-        message:
-          input.turnInput !== undefined && input.turnId === row.loopId && row.message.role === "user" && !row.meta?.steerId
-            ? {
-                role: "user" as const,
-                content:
-                  typeof input.turnInput === "string"
-                    ? [{ type: "text" as const, text: input.turnInput }]
-                    : input.turnInput.map((part) => (typeof part === "string" ? { type: "text" as const, text: part } : part)),
-              }
-            : row.message,
-      }));
+      return projectSettledAiToolChecks(
+        rows.map((row) => ({
+          seq: row.seq,
+          kind: row.kind,
+          meta: row.meta,
+          message:
+            input.turnInput !== undefined && input.turnId === row.loopId && row.message.role === "user" && !row.meta?.steerId
+              ? {
+                  role: "user" as const,
+                  content:
+                    typeof input.turnInput === "string"
+                      ? [{ type: "text" as const, text: input.turnInput }]
+                      : input.turnInput.map((part) => (typeof part === "string" ? { type: "text" as const, text: part } : part)),
+                }
+              : row.message,
+        })),
+      );
     },
     append: async (message, opts) => {
       // Initial input and durable steering are already persisted transactionally before Nessi appends them.

package/src/ai/tool-audit.ts

@@ -30,6 +30,14 @@ export const aiToolAudit = {
       LIMIT 1`;
     return row?.conversation_id ?? null;
   },
+  hasCapabilityDispatch: async (input: { turnId: string; callId: string }): Promise<boolean> => {
+    const rows = await sql`
+      SELECT 1 FROM ai.tool_calls
+      WHERE turn_id = ${input.turnId} AND call_id = ${input.callId} AND request_id IS NOT NULL
+      LIMIT 1
+    `;
+    return rows.length > 0;
+  },
   noteCapabilityDispatch: async (input: {
     conversationId: string;
     turnId: string;

package/src/ai/tool-wording.ts

@@ -2,14 +2,22 @@ import {
   type CapabilityActionWording,
   capabilityActionOutcome,
   capabilityActionSubject,
+  capabilityReviewSentence,
+  capabilitySentenceText,
   resolveCapabilityActionSentences,
 } from "../_internal/capability-sentences";
+import { CapabilityActionReceiptSchema } from "../contracts/capabilities";
+import { type AiStoredActionReview, isLegacyActionReview, storedActionReview } from "./action-review";
 import { displayToolName, isRecord } from "./chat/message-utils";
 import type { AiTurnBlock } from "./protocol";
 import { CLOUD_AI_TOOL_PRESENTATION } from "./tool-sentences";
 
 type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
 
+/** The review Cloud stored for the call, else the one its open approval carries. */
+const reviewOf = (block: ToolBlock): AiStoredActionReview | null =>
+  block.review ?? (block.approval?.review ? storedActionReview(block.approval.review) : null);
+
 /**
  * How the chat words one call that acts on something: an app Action through its saved presentation, a
  * Cloud tool through Cloud's own catalog of the same shape. `null` for calls that only read.
@@ -28,17 +36,31 @@ export const toolWording = (block: ToolBlock, locale: string): CapabilityActionW
   return sentences ? { title: displayToolName(block.name, locale), sentences } : null;
 };
 
-/** What the call does or would do, as one sentence; `null` for calls that only read. */
+/**
+ * What the call does or would do, as one sentence; `null` for calls that only read. A stored review's action sentence
+ * wins, so it reads the same after a reload and after the app changed. An old review's message is the question of the
+ * card, not the call's short subject: steps and receipts keep the app's catalog sentence.
+ */
 export const toolSubject = (block: ToolBlock, locale: string, timeZone: string): string | null => {
+  const review = reviewOf(block);
+  if (review && !isLegacyActionReview(review))
+    return capabilitySentenceText(review.sentence.action, review.slots, { locale: review.locale, timeZone });
   const wording = toolWording(block, locale);
   return wording ? capabilityActionSubject(wording, block.args, { locale, timeZone }) : null;
 };
 
 /** The sentence for one outcome, or `null` when the tool has none that renders for this call. */
 export const toolOutcome = (block: ToolBlock, key: "done" | "rejected" | "notRun", locale: string, timeZone: string): string | null => {
+  const result = isRecord(block.result) ? block.result : undefined;
+  const review = reviewOf(block);
+  if (review && !isLegacyActionReview(review)) {
+    const receipt = key === "done" ? CapabilityActionReceiptSchema.safeParse(result?.receipt) : null;
+    if (receipt?.success) return capabilitySentenceText(receipt.data.text, receipt.data.slots ?? {}, { locale: review.locale, timeZone });
+    return capabilityReviewSentence(review, key, { timeZone });
+  }
+  if (review && key === "done" && review.legacy.summary) return review.legacy.summary;
   const wording = toolWording(block, locale);
   if (!wording) return null;
-  const result = isRecord(block.result) ? block.result : undefined;
   // App Actions return their data inside the result envelope; Cloud tools return the data itself.
   const data = block.presentation?.kind === "capability" ? result?.data : block.result;
   return capabilityActionOutcome(wording, key, { input: block.args, data }, { locale, timeZone });

package/src/ai/types.ts

@@ -13,11 +13,32 @@ import type {
 import type { Usage } from "@k2b/nessi/ai";
 import type { z } from "zod";
 import type { CapabilitySentenceField } from "../_internal/capability-sentences";
-import type { CapabilityActionReview, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
+import type { CapabilityActionReviewData, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
+import type { AiActionCheck, AiStoredActionReview } from "./action-review";
 import type { AiLocalClient, AiLocalContext, AiLocalToolName } from "./local-tool-contracts";
 import type { AiTurnBlock } from "./protocol";
 
+/** Current reader-confirmed metadata for a recently sent resource. */
+export type AiRecentResource = {
+  ref: CloudResourceRef;
+  title: string;
+  icon?: string;
+  href?: string;
+  kind: string;
+  preview?: string;
+  appName: string;
+  count: number;
+};
+
+export type AiRecentSentResourceRef = {
+  ref: CloudResourceRef;
+  count: number;
+  lastSentAt: string;
+  /** Internal conversation UUID, only for authorized Studio reads. */
+  conversationId: string;
+};
+
 export const AI_MODEL_CAPABILITIES = ["streaming", "tools", "vision", "transcription"] as const;
 export type AiModelCapability = (typeof AI_MODEL_CAPABILITIES)[number];
 
@@ -308,6 +329,8 @@ export type AiStoredMessage = {
       trigger: "scheduled" | "manual";
     };
     toolPresentations?: Record<string, AiToolPresentation>;
+    toolReviews?: Record<string, AiStoredActionReview>;
+    toolChecks?: Record<string, AiActionCheck>;
     /** How the person decided an approval; `expired` when the turn ended while it still waited. */
     toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
     /** Requests a website approval let through, by tool call and then by `AiWebsiteReceipt.index`. */
@@ -428,7 +451,7 @@ export type AiPendingTurnAction =
       name: string;
       args: unknown;
       message?: string;
-      review?: CapabilityActionReview;
+      review?: CapabilityActionReviewData;
       allowAlways: boolean;
       /** Whether the approval can be remembered for this chat. */
       allowChat: boolean;
@@ -464,7 +487,7 @@ export type AiPendingTurnActionRecord = {
   name: string;
   args: unknown;
   message?: string;
-  review?: CapabilityActionReview;
+  review?: CapabilityActionReviewData;
   approvalScope: string;
   allowAlways: boolean;
   /** Whether the approval can be remembered for this chat; defaults to `allowAlways`. */
@@ -621,6 +644,7 @@ export type AiBackgroundRunContext = {
   trigger?: "scheduled" | "manual";
   timezone?: string;
   stopDeliveredAt?: string;
+  needsApproval?: { action: string };
   taskId: string;
   occurrenceId: string;
   context: Array<{ seq: number; kind: "message" | "summary"; message: Message }>;
@@ -765,6 +789,7 @@ export type AiConversationService = {
     before?: string;
     limit?: number;
   }): Promise<{ resources: AiConversationResourceRef[]; nextCursor?: string }>;
+  listRecentSentResourceRefs(input: { ownerUserId: string }): Promise<AiRecentSentResourceRef[]>;
   listUserConversationResources(input: {
     ownerUserId: string;
     search?: string;

package/src/api/accounts-entities.ts

@@ -14,6 +14,7 @@ import {
   UserProviderSchema,
 } from "../contracts";
 import { type AuthContext, auth, expectUserBackedActor, jsonResponse, requiresAuth, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { accountsAppService as accountsService } from "../services";
 
 const EntitiesListResponseSchema = z.object({
@@ -91,7 +92,7 @@ type AccountsEntitiesRouteDependencies = {
 };
 
 export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRouteDependencies = {}) =>
-  new Hono<AuthContext>().get(
+  new Hono<AuthContext>().use("/entities/*", noTransform()).get(
     "/entities",
     dependencies.authenticate ?? auth.requireRole("authenticated"),
     dependencies.requireUser ?? auth.requireUser(),

package/src/api/admin-ai-projects.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { AiProjectLastAdminError, aiProjects } from "../ai/projects";
 import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 
 const ListProjectsSchema = z
   .object({
@@ -20,6 +21,7 @@ const lastAdminConflict = (c: Parameters<typeof respond>[0], error: AiProjectLas
 
 export const createAdminAiProjectsRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get("/", v("query", ListProjectsSchema), async (c) => {
       const query = c.req.valid("query");

package/src/api/admin-ai-skills.ts

@@ -4,6 +4,7 @@ import { aiAppSkills } from "../ai/app-skill-store";
 import { AiSkillInputError, AiSkillLastAdminError, AiSkillRevisionConflictError, aiSkills } from "../ai/skills";
 import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 
 const ListSkillsSchema = z
   .object({
@@ -32,6 +33,7 @@ const installAppSkill = async (c: Parameters<typeof respond>[0], install: () =>
 
 export const createAdminAiSkillsRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get("/", v("query", ListSkillsSchema), async (c) => {
       const query = c.req.valid("query");

package/src/api/admin-ai-usage.ts

@@ -3,6 +3,7 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { aiUsage } from "../ai/usage";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { AiUsageQuerySchema } from "../shared/ai-usage";
 
 export const createAdminAiUsageRoutes = (
@@ -10,6 +11,7 @@ export const createAdminAiUsageRoutes = (
   service: typeof aiUsage = aiUsage,
 ) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get(
       "/report",

package/src/api/admin-geoip.ts

@@ -0,0 +1,80 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { GEOIP_MAX_DATABASE_BYTES, GEOIP_MAX_REQUEST_BYTES } from "../contracts/geoip";
+import { type AuthContext, auth, v } from "../server";
+import { REQUEST_IDLE_TIMEOUT_MAX_SECONDS, REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "../server/request-timeout";
+import { GeoIpError, geoip } from "../services/geoip";
+
+export const createAdminGeoIpRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service: typeof geoip = geoip,
+) =>
+  new Hono<AuthContext>()
+    .use(authenticate)
+    .onError((error, c) => {
+      if (error instanceof GeoIpError)
+        return c.json(
+          {
+            code: error.code,
+            ...(error.code === "geoip_too_large" ? { maxDatabaseBytes: GEOIP_MAX_DATABASE_BYTES } : {}),
+            ...(error.code === "geoip_request_too_large" ? { maxRequestBytes: GEOIP_MAX_REQUEST_BYTES } : {}),
+          },
+          error.status,
+        );
+      if (c.req.raw.signal.aborted) return new Response(null, { status: 499 });
+      throw error;
+    })
+    .get(
+      "/",
+      describeRoute({ tags: ["Sign-in locations"], summary: "Show active sign-in location databases and upload limits" }),
+      auth.requireOAuthScope("read", "admin"),
+      async (c) => c.json(await service.status(c.get("user"))),
+    )
+    .put(
+      "/",
+      describeRoute({
+        tags: ["Sign-in locations"],
+        summary: "Replace a City or ASN database with a raw or gzip MMDB upload",
+        requestBody: {
+          required: true,
+          content: {
+            "application/octet-stream": { schema: { type: "string", format: "binary" } },
+            "application/gzip": { schema: { type: "string", format: "binary" } },
+          },
+        },
+      }),
+      auth.requireOAuthScope("write", "admin"),
+      async (c) => {
+        setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_MAX_SECONDS);
+        try {
+          const length = c.req.header("Content-Length");
+          return c.json(
+            await service.upload(
+              c.get("user"),
+              c.req.raw.body ??
+                new ReadableStream({
+                  start(controller) {
+                    controller.close();
+                  },
+                }),
+              {
+                contentLength: length === undefined ? undefined : Number(length),
+                signal: c.req.raw.signal,
+              },
+            ),
+          );
+        } finally {
+          setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_SECONDS);
+        }
+      },
+    )
+    .delete(
+      "/:kind",
+      describeRoute({ tags: ["Sign-in locations"], summary: "Reset one sign-in database to the bundled snapshot" }),
+      auth.requireOAuthScope("write", "admin"),
+      v("param", z.object({ kind: z.enum(["city", "asn"]) })),
+      async (c) => c.json(await service.reset(c.get("user"), c.req.valid("param").kind)),
+    );
+
+export default createAdminGeoIpRoutes();