@k2b/cloud 0.39.0 → 0.41.0

package/src/ai/chat/view-block.tsx

@@ -39,8 +39,11 @@ import { ReferenceText } from "./reference-text";
 const VISIBLE_ROWS = 100;
 /** Rows the viewport shows before it scrolls; it reserves their height from the first frame. */
 const VIEWPORT_ROWS = 8;
-/** A compact row: 12px text on a 16px line, 6px padding above and below, a 1px line. */
-const ROW_REM = 1.8125;
+/** A compact DataTable row and its totals row, and the quieter header row above them. */
+const ROW_REM = 2.5;
+const HEADER_REM = 2.125;
+/** DataTable draws a hairline between rows only above this many columns. */
+const HAIRLINE_ABOVE_COLUMNS = 8;
 
 /** Loads a view file with the viewer's access and validates it again: a file is untrusted whoever wrote it. */
 async function loadView(url: string, path: string, signal: AbortSignal): Promise<CloudAiView | null> {
@@ -75,9 +78,16 @@ type ChartSummary = Extract<CloudAiViewSummary, { view: "chart" }>;
 type GroupSummary = Extract<CloudAiViewSummary, { view: "group" }>;
 type ExplorerSummary = Extract<CloudAiViewSummary, { view: "explorer" }>;
 
-/** The header row, the rows up to the viewport's, and the totals row when there is one. */
-const tableHeight = (summary: TableSummary) =>
-  `${(Math.max(1, Math.min(summary.rows, VIEWPORT_ROWS)) + 1 + Number(summary.footer)) * ROW_REM}rem`;
+/**
+ * The header row, the rows up to the viewport's, and the totals row when there is one, inside the paper's 1px frame.
+ * Wide tables add a 1px hairline after each visible body row with a following body row; the footer adds none.
+ */
+const tableHeight = (summary: TableSummary) => {
+  const bodyRows = Math.max(1, Math.min(summary.rows, VIEWPORT_ROWS));
+  const rows = bodyRows + Number(summary.footer);
+  const lines = summary.columns > HAIRLINE_ABOVE_COLUMNS ? bodyRows - 1 + Number(summary.rows > VIEWPORT_ROWS) : 0;
+  return `calc(${HEADER_REM + rows * ROW_REM}rem + ${2 + lines}px)`;
+};
 
 /**
  * A table view: title, Copy data and a sortable table in a viewport whose height follows the row count of its

package/src/ai/chat-task-contracts.ts

@@ -55,7 +55,10 @@ export type AiChatTaskOccurrenceView = {
 export const toAiChatTaskView = (task: AiChatTask): AiChatTaskView => ({
   title: task.title,
   name: task.name,
-  reason: task.reasonCode && task.reasonAt ? { code: task.reasonCode, at: task.reasonAt } : null,
+  reason:
+    task.reasonCode && task.reasonAt
+      ? { code: task.reasonCode, at: task.reasonAt, ...(task.reasonAction ? { action: task.reasonAction } : {}) }
+      : null,
   id: task.shortId,
   chatId: task.chatId,
   chatTitle: task.chatTitle,

package/src/ai/chat-task-reasons-migrate.ts

@@ -4,6 +4,7 @@ import { canonicalLocale } from "../shared/locale";
 /** Called in a transaction; new columns and reason repairs commit together. */
 export const migrateChatTaskReasons = async (sql: SQL): Promise<void> => {
   await sql`ALTER TABLE ai.chat_tasks ADD COLUMN IF NOT EXISTS reason_code TEXT`.simple();
+  await sql`ALTER TABLE ai.chat_tasks ADD COLUMN IF NOT EXISTS reason_action TEXT`.simple();
   await sql`ALTER TABLE ai.chat_tasks ADD COLUMN IF NOT EXISTS reason_at TIMESTAMPTZ`.simple();
   await sql`ALTER TABLE ai.chat_tasks ADD COLUMN IF NOT EXISTS title TEXT`.simple();
   const [column] = await sql`SELECT 1 FROM information_schema.columns
@@ -39,6 +40,11 @@ export const migrateChatTaskReasons = async (sql: SQL): Promise<void> => {
         ALTER TABLE ai.chat_tasks ADD CONSTRAINT ai_chat_tasks_reason_code_check
           CHECK (reason_code IN ('paused', 'chat_archived', 'owner_inactive', 'failed', 'rights_changed', 'needs_approval'));
       END IF;
+      -- Bounded only: an older Core clears reason_code without knowing reason_action, so readers pair the two.
+      IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ai_chat_tasks_reason_action_length_check') THEN
+        ALTER TABLE ai.chat_tasks ADD CONSTRAINT ai_chat_tasks_reason_action_length_check
+          CHECK (reason_action IS NULL OR char_length(reason_action) BETWEEN 1 AND 200);
+      END IF;
       IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ai_chat_tasks_title_check') THEN
         ALTER TABLE ai.chat_tasks ADD CONSTRAINT ai_chat_tasks_title_check CHECK (char_length(btrim(title)) BETWEEN 1 AND 80);
       END IF;
@@ -49,6 +55,7 @@ export const migrateChatTaskReasons = async (sql: SQL): Promise<void> => {
           WHEN state = 'paused' THEN 'paused'
           WHEN last_error IN ('Scheduled task mandate revision changed', 'Scheduled task mandate or sponsor is unavailable') THEN 'rights_changed'
           ELSE 'failed' END,
+          reason_action = NULL,
           reason_at = CASE WHEN state IN ('paused', 'needs_attention') THEN updated_at ELSE NULL END
         WHERE NOT (
           (state IN ('paused', 'needs_attention')) = (reason_code IS NOT NULL)

package/src/ai/chat-task-reasons.ts

@@ -28,7 +28,7 @@ const messages = i18n.define({
       failed: "The last run failed.",
       rights_changed: "What it may do changed. Please confirm again.",
       needs_approval: ({ action }: { action?: string }) =>
-        `${action ? `Tried to ${action}. ` : ""}That needs your approval every time, and routines never ask.`,
+        `${action ? `Tried to ${action.replace(/^\p{Lu}(?=\p{Ll})/u, (first) => first.toLowerCase())}. ` : ""}That needs your approval every time, and routines never ask.`,
       stopped: ({ list }: { list: string }) =>
         list
           ? `Stopped while the routine was running. Already done: ${list}. Nothing was undone.`

package/src/ai/chat-tasks.ts

@@ -1,6 +1,7 @@
 import type { Message } from "@k2b/nessi";
 import { type SQL, sql } from "bun";
 import { getCapability } from "../_internal/registry";
+import { type CapabilityActionPolicy, capabilityActionPolicy } from "../contracts/capabilities";
 import { logger } from "../services/logging";
 import {
   createMandate,
@@ -48,6 +49,7 @@ export type AiChatTask = {
   locale: string | null;
   reasonCode: ChatTaskReasonCode | null;
   reasonAt: string | null;
+  reasonAction: string | null;
   id: string;
   shortId: string;
   chatId: string;
@@ -88,6 +90,7 @@ type TaskRow = {
   locale: string | null;
   reason_code: ChatTaskReasonCode | null;
   reason_at: Date | string | null;
+  reason_action: string | null;
   id: string;
   short_id: string;
   conversation_id: string;
@@ -172,7 +175,14 @@ const validateTaskGrants = async (input: unknown): Promise<TaskGrant[]> => {
       (item) => item.localId === grant.capabilityId,
     );
     if (!operation) throw new Error(`Capability unavailable: ${grant.appId}.${grant.capabilityId}`);
-    if (grant.kind === "action" && (!("approval" in operation) || (operation.approval !== "none" && operation.approval !== "rememberable")))
+    const policy = entry ? capabilityActionPolicy(entry.manifest, grant.capabilityId) : undefined;
+    if (grant.kind === "action" && policy && (!("silent" in policy) || policy.routines === false))
+      throw new Error(`Capability requires interactive approval: ${grant.appId}.${grant.capabilityId}`);
+    if (
+      grant.kind === "action" &&
+      !policy &&
+      (!("approval" in operation) || (operation.approval !== "none" && operation.approval !== "rememberable"))
+    )
       throw new Error(`Capability always requires interactive approval: ${grant.appId}.${grant.capabilityId}`);
     const properties = operation.inputSchema.properties ?? {};
     for (const key of Object.keys(grant.fixedInput))
@@ -255,7 +265,7 @@ const stopTaskAdmission = async (
   const state = chatTaskReasonState(code);
   const [stopped] = await db<TaskRow[]>`
     UPDATE ai.chat_tasks
-    SET state = ${state}, last_error = ${reason}, reason_code = ${code}, reason_at = now(),
+    SET state = ${state}, last_error = ${reason}, reason_code = ${code}, reason_action = NULL, reason_at = now(),
         mandate_revision = COALESCE(${pausedMandateRevision ?? null}::bigint, mandate_revision),
         revision = revision + 1, updated_at = now()
     WHERE id = ${task.id}::uuid AND state = ${task.state} RETURNING *
@@ -387,6 +397,8 @@ const toTask = (row: TaskRow): AiChatTask => ({
   locale: row.locale,
   reasonCode: row.reason_code,
   reasonAt: nullableIso(row.reason_at),
+  // An older Core may leave a stale action beside another code; the action belongs only to needs_approval.
+  reasonAction: row.reason_code === "needs_approval" ? row.reason_action : null,
   id: row.id,
   shortId: row.short_id,
   chatId: row.conversation_short_id,
@@ -672,6 +684,7 @@ export const aiChatTasks = {
     kind: "query" | "action";
     input: unknown;
     approval?: "none" | "rememberable" | "always";
+    policy?: CapabilityActionPolicy;
   }): Promise<void> => {
     const result = await validateMandateIssueAuthority({
       mandateId: input.mandate.id,
@@ -681,6 +694,7 @@ export const aiChatTasks = {
       operation: `capability.${input.kind === "query" ? "query" : "action.run"}:${input.capabilityId}`,
       input: input.input,
       capabilityApproval: input.approval,
+      capabilityPolicy: input.policy,
     });
     if (!result.ok) {
       const policyDenied = result.error.code === "FORBIDDEN" && result.error.message === MANDATE_POLICY_DENIED_MESSAGE;
@@ -908,6 +922,7 @@ export const aiChatTasks = {
               ELSE NULL
             END,
             reason_code = CASE WHEN ${authorityStopped} OR task.state = 'paused' OR (task.state = 'completed' AND ${scheduleChanged} = false) THEN task.reason_code ELSE NULL END,
+            reason_action = CASE WHEN ${authorityStopped} OR task.state = 'paused' OR (task.state = 'completed' AND ${scheduleChanged} = false) THEN task.reason_action ELSE NULL END,
             reason_at = CASE WHEN ${authorityStopped} OR task.state = 'paused' OR (task.state = 'completed' AND ${scheduleChanged} = false) THEN task.reason_at ELSE NULL END,
             revision = task.revision + 1, updated_at = now()
         WHERE id = ${current.id}::uuid
@@ -970,7 +985,7 @@ export const aiChatTasks = {
           const [restored] = await tx`SELECT 1 FROM ai.conversations WHERE id = ${input.conversationId}::uuid
             AND archived_at IS NULL FOR SHARE`;
           if (current?.reason_code === "chat_archived" && restored)
-            await tx`UPDATE ai.chat_tasks SET reason_code = 'paused', updated_at = now() WHERE id = ${current.id}::uuid`;
+            await tx`UPDATE ai.chat_tasks SET reason_code = 'paused', reason_action = NULL, updated_at = now() WHERE id = ${current.id}::uuid`;
         });
       } catch (error) {
         if (!(error instanceof AiChatTaskAuthorityError)) throw error;
@@ -1008,7 +1023,8 @@ export const aiChatTasks = {
           AND task.updated_at < now() - make_interval(secs => ${graceSeconds}::double precision)
         ORDER BY task.id LIMIT ${limit}
         FOR UPDATE OF task SKIP LOCKED FOR SHARE OF conversation SKIP LOCKED`;
-      for (const row of rows) await tx`UPDATE ai.chat_tasks SET reason_code = 'paused', updated_at = now() WHERE id = ${row.id}::uuid`;
+      for (const row of rows)
+        await tx`UPDATE ai.chat_tasks SET reason_code = 'paused', reason_action = NULL, updated_at = now() WHERE id = ${row.id}::uuid`;
       return rows.length;
     });
   },
@@ -1063,6 +1079,7 @@ export const aiChatTasks = {
         UPDATE ai.chat_tasks task
         SET state = ${input.state === "paused" ? chatTaskReasonState("paused") : "active"}, mandate_revision = ${revision},
             reason_code = ${input.state === "paused" ? "paused" : null},
+            reason_action = NULL,
             reason_at = CASE WHEN ${input.state} = 'active' THEN NULL WHEN task.reason_code = 'paused' THEN task.reason_at ELSE now() END,
             last_error = CASE WHEN task.state = ${input.state} THEN task.last_error ELSE NULL END,
             revision = CASE WHEN task.state = ${input.state} THEN task.revision ELSE task.revision + 1 END,
@@ -1278,7 +1295,7 @@ export const aiChatTasks = {
         task.id AS task_row_id, task.short_id AS task_short_id, task.conversation_id, conversation.short_id AS conversation_short_id,
         conversation.title AS conversation_title, task.sponsor_user_id, task.mandate_id, task.mandate_revision,
         (SELECT policy FROM auth.mandates WHERE id = task.mandate_id) AS mandate_policy,
-        task.title, task.locale, task.reason_code, task.reason_at, task.prompt, task.schedule_kind, task.run_at, task.cron,
+        task.title, task.locale, task.reason_code, task.reason_at, task.reason_action, task.prompt, task.schedule_kind, task.run_at, task.cron,
         task.timezone, task.state AS task_state, task.revision, task.last_error, task.created_at AS task_created_at, task.updated_at
       FROM (
         SELECT candidate.*,
@@ -1353,7 +1370,7 @@ export const aiChatTasks = {
         const revision = await pauseTerminalTaskMandate(task, tx);
         await tx`
           UPDATE ai.chat_tasks
-          SET state = ${chatTaskReasonState(input.code)}, reason_code = ${input.code}, reason_at = CASE WHEN reason_code = ${input.code} THEN COALESCE(reason_at, now()) ELSE now() END, last_error = ${input.error}, mandate_revision = ${revision},
+          SET state = ${chatTaskReasonState(input.code)}, reason_code = ${input.code}, reason_action = NULL, reason_at = CASE WHEN reason_code = ${input.code} THEN COALESCE(reason_at, now()) ELSE now() END, last_error = ${input.error}, mandate_revision = ${revision},
               revision = revision + 1, updated_at = now()
           WHERE id = ${rows[0].task_id}::uuid AND revision = ${rows[0].task_revision}::bigint
         `;
@@ -1481,6 +1498,13 @@ export const aiChatTasks = {
       return { delivered: true as const, conversationId: occurrence.conversation_id, turnId };
     }),
 
+  markNeedsApproval: async (input: { turnId: string; action: string }): Promise<void> => {
+    await sql`UPDATE ai.turns SET run_config = jsonb_set(run_config, '{background,needsApproval}',
+      jsonb_build_object('action', ${input.action.slice(0, 200)}::text))
+      WHERE id = ${input.turnId}::uuid AND run_config ? 'background'
+        AND run_config #> '{background,needsApproval}' IS NULL`;
+  },
+
   finalizeTurn: async (input: {
     turnId: string;
     status: AiTurnStatus;
@@ -1506,6 +1530,8 @@ export const aiChatTasks = {
         return occurrence ? { occurrenceId: occurrence.id, failed: false } : null;
       }
       if (!task) return null;
+      const needsApproval = turn.run_config.background?.needsApproval;
+      const approvalError = needsApproval ? `NEEDS_APPROVAL: ${needsApproval.action} requires approval for every call` : null;
       const rows = await tx<
         {
           occurrence_id: string;
@@ -1517,12 +1543,15 @@ export const aiChatTasks = {
           task_revision: number | bigint;
           current_revision: number | bigint;
           turn_error: string | null;
+          needs_approval: boolean;
           completed_at: Date | string;
         }[]
       >`
         UPDATE ai.chat_task_occurrences occurrence
-        SET state = ${input.status === "completed" ? "completed" : "failed"},
+        SET state = CASE WHEN ${approvalError}::text IS NOT NULL AND occurrence.task_revision = task.revision THEN 'failed'
+              ELSE ${input.status === "completed" ? "completed" : "failed"} END,
             error = CASE
+              WHEN ${approvalError}::text IS NOT NULL AND occurrence.task_revision = task.revision THEN ${approvalError}
               WHEN ${input.status} = 'completed' THEN NULL
               ELSE COALESCE(${input.error ?? null}, turn.error, ${`Scheduled turn ${input.status}`})
             END,
@@ -1531,10 +1560,12 @@ export const aiChatTasks = {
         WHERE occurrence.task_id = task.id AND occurrence.turn_id = ${input.turnId}::uuid AND turn.id = occurrence.turn_id
           AND occurrence.state = 'running'
         RETURNING occurrence.id AS occurrence_id, occurrence.task_id, task.schedule_kind, occurrence.trigger,
-          occurrence.scheduled_for, task.run_at, occurrence.task_revision, task.revision AS current_revision, turn.error AS turn_error, occurrence.completed_at
+          occurrence.scheduled_for, task.run_at, occurrence.task_revision, task.revision AS current_revision, turn.error AS turn_error, (${approvalError}::text IS NOT NULL AND occurrence.task_revision = task.revision) AS needs_approval, occurrence.completed_at
       `;
       const row = rows[0];
       if (!row) return null;
+      const failed = row.needs_approval || input.status !== "completed";
+      const failureCode = row.needs_approval ? "needs_approval" : "failed";
       const responses = await tx<{ message: Message }[]>`
         SELECT message FROM ai.task_messages WHERE loop_id = ${input.turnId} AND role = 'assistant' ORDER BY seq DESC
       `;
@@ -1549,36 +1580,35 @@ export const aiChatTasks = {
               .join("\n")
               .trim();
           })
-          .find(Boolean) || (input.status === "completed" ? "Background task completed." : "");
+          .find(Boolean) || (!failed ? "Background task completed." : "");
       const unchangedSinceStart = Number(row.task_revision) === Number(row.current_revision);
       const currentOnceSlot = row.run_at !== null && iso(row.run_at) === iso(row.scheduled_for);
-      if (
-        unchangedSinceStart &&
-        input.status === "completed" &&
-        row.schedule_kind === "once" &&
-        row.trigger === "scheduled" &&
-        currentOnceSlot
-      ) {
+      if (unchangedSinceStart && !failed && row.schedule_kind === "once" && row.trigger === "scheduled" && currentOnceSlot) {
         const revision = await pauseTerminalTaskMandate(task, tx);
         await tx`
           UPDATE ai.chat_tasks
-          SET state = 'completed', last_error = NULL, reason_code = NULL, reason_at = NULL, mandate_revision = ${revision}, revision = revision + 1, updated_at = now()
+          SET state = 'completed', last_error = NULL, reason_code = NULL, reason_action = NULL, reason_at = NULL, mandate_revision = ${revision}, revision = revision + 1, updated_at = now()
           WHERE id = ${row.task_id}::uuid AND revision = ${row.task_revision}::bigint
         `;
-      } else if (unchangedSinceStart && input.status !== "completed") {
-        const error = input.error || row.turn_error || `Scheduled turn ${input.status}`;
+      } else if (unchangedSinceStart && failed) {
+        const error = (row.needs_approval ? approvalError : null) || input.error || row.turn_error || `Scheduled turn ${input.status}`;
         const revision = await pauseTerminalTaskMandate(task, tx);
         await tx`
           UPDATE ai.chat_tasks
-          SET state = ${chatTaskReasonState("failed")}, reason_code = 'failed', reason_at = CASE WHEN reason_code = 'failed' THEN COALESCE(reason_at, now()) ELSE now() END, last_error = ${error}, mandate_revision = ${revision}, revision = revision + 1, updated_at = now()
+          SET state = ${chatTaskReasonState(failureCode)}, reason_code = ${failureCode},
+              reason_action = ${row.needs_approval ? needsApproval!.action : null},
+              reason_at = CASE WHEN reason_code = ${failureCode} THEN COALESCE(reason_at, now()) ELSE now() END, last_error = ${error}, mandate_revision = ${revision}, revision = revision + 1, updated_at = now()
           WHERE id = ${row.task_id}::uuid AND revision = ${row.task_revision}::bigint
         `;
       }
       const [current] = await tx<TaskRow[]>`SELECT * FROM ai.chat_tasks WHERE id = ${task.id}::uuid`;
-      const reason: ChatTaskReason | null =
-        input.status !== "completed"
-          ? { code: "failed", at: current?.reason_code === "failed" && current.reason_at ? iso(current.reason_at) : iso(row.completed_at) }
-          : null;
+      const reason: ChatTaskReason | null = failed
+        ? {
+            code: failureCode,
+            at: current?.reason_code === failureCode && current.reason_at ? iso(current.reason_at) : iso(row.completed_at),
+            ...(row.needs_approval ? { action: needsApproval!.action } : {}),
+          }
+        : null;
       await deliverOccurrenceResult(
         tx,
         task,
@@ -1586,7 +1616,7 @@ export const aiChatTasks = {
         resultText || (reason ? reasonSentence(task, reason, appLocale) : ""),
         reason ? { reason, ...(resultText ? {} : { reasonOnly: true as const }) } : {},
       );
-      return { occurrenceId: row.occurrence_id, failed: input.status !== "completed" };
+      return { occurrenceId: row.occurrence_id, failed };
     }),
 
   listTerminalRunningTurns: async (limit = 100): Promise<Array<{ turnId: string; status: "completed" | "failed" | "aborted" }>> => {

package/src/ai/client/controller.ts

@@ -1,5 +1,8 @@
 import { type Accessor, createMemo, createSignal, onCleanup } from "solid-js";
 import { createStore, reconcile } from "solid-js/store";
+import { z } from "zod";
+import { CapabilityActionReceiptSchema } from "../../contracts/capabilities";
+import { type AiActionCheck, preferredActionCheck } from "../action-review";
 import { type AiAttachmentRef, aiAttachmentMarker } from "../attachments";
 import { aiChatMessages } from "../chat/messages";
 import { AI_TURN_LEASE_MS, type AiStreamEvent, type AiTurnBlock, type AiTurnSnapshot, steerMessageBlockId } from "../protocol";
@@ -1349,6 +1352,61 @@ export const createAiChatController = (options: CreateAiChatControllerOptions) =
     return submitted;
   };
 
+  const checkAction = async (requestInput: { turnId: string; callId: string }): Promise<AiActionCheck> => {
+    const conversationId = activeConversationId();
+    if (!conversationId) throw new Error("No active conversation.");
+    const check = z
+      .object({
+        state: z.enum(["checking", "done", "not_done", "pending", "failed"]),
+        receipt: CapabilityActionReceiptSchema.optional(),
+        at: z.iso.datetime().optional(),
+      })
+      .strict()
+      .parse(
+        await request<unknown>(
+          `/conversations/${encodeURIComponent(conversationId)}/turns/${encodeURIComponent(requestInput.turnId)}/calls/${encodeURIComponent(requestInput.callId)}/check`,
+          { method: "POST" },
+          "Failed to check the Action outcome",
+        ),
+      );
+    const projection = isActiveConversation(conversationId) ? state : cache.get(conversationId);
+    let effective = check;
+    if (projection) {
+      const storedMessage = projection.messages.find(
+        (message) =>
+          message.loopId === requestInput.turnId &&
+          message.message.role === "assistant" &&
+          message.message.content.some((block) => block.type === "tool_call" && block.id === requestInput.callId),
+      );
+      const liveBlock =
+        projection.activeTurn?.turnId === requestInput.turnId
+          ? projection.activeTurn.blocks.find((block) => block.kind === "tool" && block.callId === requestInput.callId)
+          : undefined;
+      effective = preferredActionCheck(storedMessage?.meta?.toolChecks?.[requestInput.callId], effective);
+      effective = preferredActionCheck(liveBlock?.kind === "tool" ? liveBlock.check : undefined, effective);
+      const messages = projection.messages.map((message) =>
+        message.loopId === requestInput.turnId &&
+        message.message.role === "assistant" &&
+        message.message.content.some((block) => block.type === "tool_call" && block.id === requestInput.callId)
+          ? { ...message, meta: { ...message.meta, toolChecks: { ...message.meta?.toolChecks, [requestInput.callId]: effective } } }
+          : message,
+      );
+      const activeTurn =
+        projection.activeTurn?.turnId === requestInput.turnId
+          ? {
+              ...projection.activeTurn,
+              blocks: projection.activeTurn.blocks.map((block) =>
+                block.kind === "tool" && block.callId === requestInput.callId ? { ...block, check: effective } : block,
+              ),
+            }
+          : projection.activeTurn;
+      const next = { ...projection, messages, activeTurn };
+      cache.set(conversationId, next);
+      if (isActiveConversation(conversationId)) setState(reconcile(next));
+    }
+    return effective;
+  };
+
   const submitFrontendToolResult = async (request: { turnId: string; callId: string }, result: unknown) => {
     const conversationId = activeConversationId();
     if (!conversationId) return false;
@@ -1412,6 +1470,7 @@ export const createAiChatController = (options: CreateAiChatControllerOptions) =
     clearMessageFeedback,
     submitTurnAction,
     respondToApproval,
+    checkAction,
     submitFrontendToolResult,
     fileContentUrl,
   };

package/src/ai/default-tools.ts

@@ -59,7 +59,7 @@ import {
 import { createCloudAiMarkdownToPdfTool } from "./markdown-pdf-tool";
 import { createAiTodoTool } from "./todo-tool";
 import { defineAiTool } from "./tools";
-import type { AiDataBoundary, AiRuntimeTool } from "./types";
+import type { AiChatTurnRunConfig, AiDataBoundary, AiRuntimeTool } from "./types";
 import { createCloudAiViewImageTool } from "./vision-tool";
 
 export {
@@ -276,6 +276,14 @@ export const createCloudAiCodeTools = () => [
   }).server(runManagedCodeTool("code_export")),
 ];
 
+/** Server-run Code Mode and declared client tools, excluding app opening and secret entry under a mandate. */
+export const createAiTurnCodeAndClientTools = (config: Pick<AiChatTurnRunConfig, "clientToolIds" | "mandate">) =>
+  [createCloudAiLocalBashTool(), ...createCloudAiLocalTools(), ...createCloudAiCodeTools()].filter(
+    (tool) =>
+      (tool.location === "server" || config.clientToolIds?.some((name) => name === tool.def.name)) &&
+      !(config.mandate && ["code_open", "code_secret"].includes(tool.def.name)),
+  );
+
 export const createDefaultCloudAiTools = () => [
   createAiTodoTool(),
   createCloudAiSurveyTool(),