@k2b/cloud 0.40.0 → 0.42.0

package/src/ai/tool-wording.ts

@@ -4,13 +4,12 @@ import {
   capabilityActionSubject,
   capabilityReviewSentence,
   capabilitySentenceText,
-  resolveCapabilityActionSentences,
 } from "../_internal/capability-sentences";
 import { CapabilityActionReceiptSchema } from "../contracts/capabilities";
 import { type AiStoredActionReview, isLegacyActionReview, storedActionReview } from "./action-review";
-import { displayToolName, isRecord } from "./chat/message-utils";
+import { isRecord } from "./chat/message-utils";
 import type { AiTurnBlock } from "./protocol";
-import { CLOUD_AI_TOOL_PRESENTATION } from "./tool-sentences";
+import { cloudToolReview } from "./tool-sentences";
 
 type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
 
@@ -20,7 +19,7 @@ const reviewOf = (block: ToolBlock): AiStoredActionReview | null =>
 
 /**
  * How the chat words one call that acts on something: an app Action through its saved presentation, a
- * Cloud tool through Cloud's own catalog of the same shape. `null` for calls that only read.
+ * Cloud tool through its per-call review. `null` for calls that only read.
  */
 export const toolWording = (block: ToolBlock, locale: string): CapabilityActionWording | null => {
   const presentation = block.presentation;
@@ -32,8 +31,10 @@ export const toolWording = (block: ToolBlock, locale: string): CapabilityActionW
       ...(presentation.fields ? { fields: presentation.fields } : {}),
     };
   }
-  const sentences = resolveCapabilityActionSentences(block.name, CLOUD_AI_TOOL_PRESENTATION, locale);
-  return sentences ? { title: displayToolName(block.name, locale), sentences } : null;
+  const review = cloudToolReview(block.name, block.args, locale);
+  return review
+    ? { title: capabilitySentenceText(review.sentence.action, review.slots, { locale: review.locale, timeZone: "UTC" }) }
+    : null;
 };
 
 /**
@@ -45,6 +46,8 @@ export const toolSubject = (block: ToolBlock, locale: string, timeZone: string):
   const review = reviewOf(block);
   if (review && !isLegacyActionReview(review))
     return capabilitySentenceText(review.sentence.action, review.slots, { locale: review.locale, timeZone });
+  const cloudReview = cloudToolReview(block.name, block.args, locale);
+  if (cloudReview) return capabilitySentenceText(cloudReview.sentence.action, cloudReview.slots, { locale: cloudReview.locale, timeZone });
   const wording = toolWording(block, locale);
   return wording ? capabilityActionSubject(wording, block.args, { locale, timeZone }) : null;
 };
@@ -59,6 +62,9 @@ export const toolOutcome = (block: ToolBlock, key: "done" | "rejected" | "notRun
     return capabilityReviewSentence(review, key, { timeZone });
   }
   if (review && key === "done" && review.legacy.summary) return review.legacy.summary;
+  const cloudReview = cloudToolReview(block.name, block.args, locale);
+  // Only a form the tool names; otherwise the card keeps Cloud's own outcome words for the call.
+  if (cloudReview) return key === "done" || cloudReview.sentence[key] ? capabilityReviewSentence(cloudReview, key, { timeZone }) : null;
   const wording = toolWording(block, locale);
   if (!wording) return null;
   // App Actions return their data inside the result envelope; Cloud tools return the data itself.

package/src/ai/tools.ts

@@ -1,6 +1,7 @@
 import type { Tool, ToolContext } from "@k2b/nessi";
 import { defineTool as defineNessiTool } from "@k2b/nessi";
 import type { z } from "zod";
+import type { CapabilityActionCallReview } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import { aiToolNeedsApproval } from "./approvals";
 import type {
@@ -64,7 +65,7 @@ export const defineAiTool = <TInput extends z.ZodType, TOutput extends z.ZodType
           /** Localized short status; never include payloads or secrets. */
           reportProgress?: (message: string) => Promise<void>;
           /** Asks like `requestApproval`, and lets the person remember the approval of `target`. */
-          requestApprovalFor?: (message: string, target: AiApprovalTarget) => Promise<boolean>;
+          requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
           /** Relays a decision for an effect another platform component consumes and executes. */
           requestRelayedApproval?: (message: string, options: { approvalId?: string; target?: AiApprovalTarget }) => Promise<boolean>;
           /** Shows requests a website approval let through as they go out, so the chat keeps them whatever the outcome. */
@@ -122,6 +123,8 @@ export type AiToolPreparationContext = {
   linkApproval?: (approvalCallId: string, approvalId: string) => void;
   /** Hears what a nested approval asks for before the approval is requested. */
   describeApproval?: (approvalCallId: string, target: AiApprovalTarget) => void;
+  /** Registers the deterministic review before requesting or consuming a nested approval. */
+  describeReview?: (approvalCallId: string, review: CapabilityActionCallReview) => void | Promise<void>;
   reportWebsiteReceipts?: (callId: string, receipts: AiWebsiteReceipt[]) => Promise<void>;
 };
 
@@ -168,10 +171,11 @@ export const prepareAiTools = (input: AiToolPreparationContext & { tools?: AiRun
     }
     // Nessi numbers the approvals of one execution in request order; count them to name each one's call ID.
     let approvals = 0;
-    const requestApproval = async (message: string, target?: AiApprovalTarget): Promise<boolean> => {
+    const requestApproval = async (message: string, target?: AiApprovalTarget, review?: CapabilityActionCallReview): Promise<boolean> => {
       while (true) {
         const approvalCallId = `${callId}-approval-${approvals++}`;
         if (target) input.describeApproval?.(approvalCallId, target);
+        if (review) await input.describeReview?.(approvalCallId, review);
         if (!(await ctx.requestApproval(message))) return false;
         const used = await use(approvalCallId);
         if (used === "approved") return true;
@@ -182,7 +186,8 @@ export const prepareAiTools = (input: AiToolPreparationContext & { tools?: AiRun
     return {
       ...ctx,
       requestApproval,
-      requestApprovalFor: (message: string, target: AiApprovalTarget) => requestApproval(message, target),
+      requestApprovalFor: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) =>
+        requestApproval(message, target, review),
       requestRelayedApproval: async (message: string, options: { approvalId?: string; target?: AiApprovalTarget }) => {
         const approvalCallId = `${callId}-approval-${approvals++}`;
         if (options.approvalId) input.linkApproval?.(approvalCallId, options.approvalId);

package/src/ai/types.ts

@@ -13,7 +13,12 @@ import type {
 import type { Usage } from "@k2b/nessi/ai";
 import type { z } from "zod";
 import type { CapabilitySentenceField } from "../_internal/capability-sentences";
-import type { CapabilityActionReviewData, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
+import type {
+  CapabilityActionCallReview,
+  CapabilityActionReviewPresentation,
+  CapabilityActionSentences,
+  CloudResourceRef,
+} from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import type { AiActionCheck, AiStoredActionReview } from "./action-review";
 import type { AiLocalClient, AiLocalContext, AiLocalToolName } from "./local-tool-contracts";
@@ -451,7 +456,14 @@ export type AiPendingTurnAction =
       name: string;
       args: unknown;
       message?: string;
-      review?: CapabilityActionReviewData;
+      /** Stored review, including the declared ask reason for new-shape reviews. */
+      review?: CapabilityActionReviewPresentation;
+      /** Owning application, with its registry name in the turn's request locale. */
+      app?: { id: string; name: string };
+      /** The chat's current title, when known. */
+      chatTitle?: string | null;
+      /** Expiry of the platform approval request, as an ISO timestamp. */
+      expiresAt?: string;
       allowAlways: boolean;
       /** Whether the approval can be remembered for this chat. */
       allowChat: boolean;
@@ -487,7 +499,7 @@ export type AiPendingTurnActionRecord = {
   name: string;
   args: unknown;
   message?: string;
-  review?: CapabilityActionReviewData;
+  review?: CapabilityActionReviewPresentation;
   approvalScope: string;
   allowAlways: boolean;
   /** Whether the approval can be remembered for this chat; defaults to `allowAlways`. */
@@ -724,7 +736,14 @@ export type AiTurnSweepResult = {
 };
 
 export type AiConversationService = {
+  getDraftSubmission(input: {
+    conversationId: string;
+    ownerUserId: string;
+    revision: number;
+  }): Promise<{ messageId: string; turnId: string | null } | null>;
   createConversation(input: {
+    /** Stable identity for one logical creation; replay never creates a replacement. */
+    requestId?: string;
     ownerUserId: string;
     title?: string;
     description?: string;
@@ -1032,6 +1051,8 @@ export type AiConversationService = {
   getPendingTurnAction(input: { conversationId: string; turnId: string; callId: string }): Promise<AiPendingTurnActionRecord | null>;
   findPendingTurnActionByApproval(input: { approvalId: string; ownerUserId: string }): Promise<AiPendingTurnActionRecord | null>;
   listPendingActionRecords(input: { conversationId: string; turnId: string }): Promise<AiPendingTurnActionRecord[]>;
+  /** The reviews Cloud stored with a turn's tool calls, keyed by call ID; the newest message wins. */
+  listTurnToolReviews(input: { conversationId: string; turnId: string }): Promise<Map<string, AiStoredActionReview>>;
   listResolvedPendingActions(input: { conversationId: string; turnId: string }): Promise<AiPendingTurnActionRecord[]>;
   resolvePendingTurnAction(input: {
     conversationId: string;
@@ -1151,7 +1172,7 @@ export type AiToolRuntime<TInput extends z.ZodType = z.ZodType, TOutput extends
           /** Localized short status; never include payloads or secrets. */
           reportProgress?: (message: string) => Promise<void>;
           /** Asks like `requestApproval`, and lets the person remember the approval of `target`. */
-          requestApprovalFor?: (message: string, target: AiApprovalTarget) => Promise<boolean>;
+          requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
           /** Relays a decision for an effect another platform component consumes and executes. */
           requestRelayedApproval?: (message: string, options: { approvalId?: string; target?: AiApprovalTarget }) => Promise<boolean>;
           /** Shows requests a website approval let through as they go out, so the chat keeps them whatever the outcome. */

package/src/ai/usage.ts

@@ -317,8 +317,8 @@ export const aiUsage = {
             : field === "appId"
               ? sql`e.app_id`
               : sql`e.task`;
-    const label = field === "userId" ? sql`COALESCE(NULLIF(u.display_name,''),u.uid,sa.name,e.user_id::text)` : key;
-    return sql<{ id: string; label: string }[]>`SELECT DISTINCT ${key} AS id,${label} AS label FROM (${events(since, until)}) e
+    const label = field === "userId" ? sql`COALESCE(NULLIF(u.display_name,''),u.uid,sa.name)` : key;
+    return sql<{ id: string; label: string | null }[]>`SELECT DISTINCT ${key} AS id,${label} AS label FROM (${events(since, until)}) e
       LEFT JOIN auth.users u ON u.id=e.user_id LEFT JOIN auth.service_accounts sa ON sa.id=e.user_id WHERE ${key} IS NOT NULL
       AND (position(lower(${search}) in lower(${label}))>0 OR ${key}=${search} OR (${field === "userId"} AND position(lower(${search}) in lower(COALESCE(u.uid,'')))>0))
       ORDER BY label,id LIMIT ${query.perPage}`;

package/src/api/admin-core-settings.ts

@@ -39,6 +39,7 @@ import { GotenbergRenderError, testGotenberg } from "../services/pdf";
 import * as settings from "../services/settings";
 import { SETTINGS_MAP, validateSettingValue } from "../services/settings/defaults";
 
+import { assertGeoBudgetPair, GeoBudgetSettingError } from "../services/settings/geo-budget";
 import { invalidateSettingsCacheForAdmin } from "../services/settings/store";
 
 const BulkSaveSchema = z.union([
@@ -67,6 +68,9 @@ const settingsNotSavedMessage = (locale: string): string =>
   locale.startsWith("de") ? "Die Einstellungen wurden nicht gespeichert." : "The settings were not saved.";
 
 const isKnownSetting = (key: string): boolean => SETTINGS_MAP.has(key);
+// The Geoapify key is written only where Cloud verifies it with the provider first, so a refused key never replaces a working one.
+const GEO_KEY = "geo.api_key";
+const GEO_KEY_DEDICATED = "Set or remove the Geoapify key with /api/admin/core/geo/key, which verifies it first.";
 
 const AI_PROFILES_KEY = "ai.model_profiles_json";
 const AI_ENABLED_KEY = "ai.enabled";
@@ -333,7 +337,10 @@ const app = new Hono<AuthContext>()
       return c.json({ ok: true, bytes: result.bytes, contentType: result.contentType });
     } catch (error) {
       if (error instanceof GotenbergRenderError) {
-        return c.json({ message: error.message, code: error.code, status: error.status }, error.code === "not_configured" ? 400 : 502);
+        return c.json(
+          { message: error.message, code: error.code, status: error.status },
+          error.code === "busy" ? 503 : error.code === "not_configured" ? 400 : 502,
+        );
       }
       return c.json({ message: "Failed to test Gotenberg PDF rendering" }, 500);
     }
@@ -384,6 +391,7 @@ const app = new Hono<AuthContext>()
           ownership[key] = `Setting "${key}" cannot be updated and reset in the same save`;
         }
       }
+      if (keys.includes(GEO_KEY)) ownership[GEO_KEY] = GEO_KEY_DEDICATED;
       if (Object.keys(ownership).length > 0) {
         return c.json({ message: "Invalid keys", errors: ownership }, 400);
       }
@@ -469,11 +477,12 @@ const app = new Hono<AuthContext>()
         // Every settings and AI credential write runs on the transaction's own
         // connection, so a failure rolls the whole save back.
         await sql.begin(async (tx) => {
+          await assertGeoBudgetPair(tx, validatedValues, resets);
           for (const [key, value] of Object.entries(validatedValues)) {
             try {
               await settings.set(key, value, tx, { replaceUnreadable: replace.has(key) });
             } catch (error) {
-              fieldErrors[key] = `Failed to update ${key}`;
+              fieldErrors[key] = `Failed to save ${key}`;
               throw error;
             }
           }
@@ -514,6 +523,7 @@ const app = new Hono<AuthContext>()
           }
         });
       } catch (error) {
+        if (error instanceof GeoBudgetSettingError) return error.getResponse();
         if (error instanceof settings.SettingUnreadableError) {
           return c.json(
             {
@@ -553,6 +563,7 @@ const app = new Hono<AuthContext>()
     if (!isKnownSetting(key)) {
       return c.json({ message: `Unknown setting "${key}"` }, 400);
     }
+    if (key === GEO_KEY) return c.json({ message: GEO_KEY_DEDICATED, errors: { [GEO_KEY]: GEO_KEY_DEDICATED } }, 400);
 
     let aiPlan: AiSettingsMutationPlan;
     try {
@@ -567,6 +578,7 @@ const app = new Hono<AuthContext>()
 
     try {
       await sql.begin(async (tx) => {
+        await assertGeoBudgetPair(tx, {}, [key]);
         await settings.remove(key, tx);
         if (key.startsWith("user.category."))
           await audit.record(
@@ -588,6 +600,7 @@ const app = new Hono<AuthContext>()
         }
       });
     } catch (error) {
+      if (error instanceof GeoBudgetSettingError || error instanceof settings.SettingUnreadableError) return error.getResponse();
       console.error(`[settings] failed to reset "${key}"`, error);
       return c.json({ message: "Reset failed" }, 500);
     }

package/src/api/admin-geo.ts

@@ -0,0 +1,54 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { GeoBudgetInputSchema, GeoKeyInputSchema } from "../contracts/geo-admin";
+import { type AuthContext, auth, v } from "../server";
+import { GeoAdminError, geoAdmin } from "../services/geo/admin";
+
+export const createAdminGeoRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service: Pick<typeof geoAdmin, "status" | "usage" | "setKey" | "removeKey" | "saveBudget"> = geoAdmin,
+) =>
+  new Hono<AuthContext>()
+    .use(authenticate)
+    .onError((error, c) => {
+      if (error instanceof GeoAdminError) return c.json(error.body, error.status);
+      if (c.req.raw.signal.aborted) return new Response(null, { status: 499 });
+      throw error;
+    })
+    .get(
+      "/",
+      describeRoute({ tags: ["Places and maps"], summary: "Show the Geoapify key state, plan and budgets" }),
+      auth.requireOAuthScope("read", "admin"),
+      async (c) => c.json(await service.status(c.get("user"))),
+    )
+    .get(
+      "/usage",
+      describeRoute({ tags: ["Places and maps"], summary: "Show this month's and today's geo credits with shares per function" }),
+      auth.requireOAuthScope("read", "admin"),
+      async (c) => c.json(await service.usage(c.get("user"))),
+    )
+    .put(
+      "/key",
+      describeRoute({
+        tags: ["Places and maps"],
+        summary: "Verify a Geoapify key with one provider lookup, then store it; a refused key changes nothing",
+      }),
+      auth.requireOAuthScope("write", "admin"),
+      v("json", GeoKeyInputSchema),
+      async (c) => c.json(await service.setKey(c.get("user"), c.req.valid("json").apiKey, c.req.raw.signal)),
+    )
+    .delete(
+      "/key",
+      describeRoute({ tags: ["Places and maps"], summary: "Remove the Geoapify key; places and maps turn off for everyone" }),
+      auth.requireOAuthScope("write", "admin"),
+      async (c) => c.json(await service.removeKey(c.get("user"))),
+    )
+    .put(
+      "/budget",
+      describeRoute({ tags: ["Places and maps"], summary: "Save the plan, the monthly budget and the daily limit per person" }),
+      auth.requireOAuthScope("write", "admin"),
+      v("json", GeoBudgetInputSchema),
+      async (c) => c.json(await service.saveBudget(c.get("user"), c.req.valid("json"))),
+    );
+
+export default createAdminGeoRoutes();

package/src/api/admin-linux-identities.ts

@@ -6,7 +6,9 @@ import { type AuthContext, auth, v } from "../server";
 import { PosixError, posix } from "../services/accounts/posix";
 
 const Id = z.object({ id: z.uuid() });
-const Configure = z.object({ config: LinuxIdentityConfigurationSchema, rangeReserved: z.boolean() }).strict();
+const Configure = z
+  .object({ config: LinuxIdentityConfigurationSchema, rangeReserved: z.boolean(), replaceUnreadable: z.boolean().optional() })
+  .strict();
 
 export const createAdminLinuxIdentityRoutes = (
   authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
@@ -32,12 +34,13 @@ export const createAdminLinuxIdentityRoutes = (
       describeRoute({
         tags: ["Linux identities"],
         summary: "Configure automatic local Linux identity assignment; does not enable computer login",
+        description: "Unreadable stored configuration returns 409 setting_unreadable unless replaceUnreadable is explicitly true.",
       }),
       v("json", Configure),
       async (c) => {
-        const { config, rangeReserved } = c.req.valid("json");
+        const { config, rangeReserved, replaceUnreadable } = c.req.valid("json");
         if (config.enabled && !rangeReserved) throw new PosixError("range_confirmation_required", 400);
-        return c.json(await service.configure(c.get("user"), config));
+        return c.json(await service.configure(c.get("user"), config, { replaceUnreadable }));
       },
     )
     .get(

package/src/api/admin-outgoing-mail.ts

@@ -17,15 +17,18 @@ import { type AuthContext, auth, jsonResponse, requiresAdmin } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { audit } from "../services/audit";
 import { outgoingMailLog } from "../services/outgoing-mail/admin";
-import { MAIL_RETENTION_KEYS, readMailRetention } from "../services/outgoing-mail/retention";
+import { MAIL_RETENTION_KEYS, readMailRetentionSettings } from "../services/outgoing-mail/retention";
 import { type MailAuditContext, OutgoingMailError, outgoingMailStore } from "../services/outgoing-mail/store";
 import { outgoingMailTest } from "../services/outgoing-mail/test-send";
 import * as settings from "../services/settings";
 
-const retentionInput = MailRetentionSchema.refine((value) => value.recordDays >= value.contentDays, {
-  message: "Record retention must be at least content retention.",
-  path: ["recordDays"],
-});
+const retentionView = MailRetentionSchema.extend({ unreadable: z.record(z.string(), z.boolean()) });
+const retentionInput = MailRetentionSchema.partial()
+  .extend({ replaceUnreadable: z.array(z.enum(MAIL_RETENTION_KEYS)).optional() })
+  .refine((value) => value.recordDays === undefined || value.contentDays === undefined || value.recordDays >= value.contentDays, {
+    message: "Record retention must be at least content retention.",
+    path: ["recordDays"],
+  });
 
 const validate = <Target extends "param" | "json" | "query", Schema extends z.ZodType>(
   target: Target,
@@ -113,9 +116,9 @@ export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<Au
         summary: "Read outgoing mail retention",
         tags: ["Outgoing mail"],
         ...requiresAdmin,
-        responses: { 200: jsonResponse(MailRetentionSchema, "Effective retention in days") },
+        responses: { 200: jsonResponse(retentionView, "Effective retention in days") },
       }),
-      async (c) => c.json(await readMailRetention()),
+      async (c) => c.json(await readMailRetentionSettings()),
     )
     .put(
       "/retention",
@@ -124,19 +127,30 @@ export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<Au
         tags: ["Outgoing mail"],
         ...requiresAdmin,
         responses: {
-          200: jsonResponse(MailRetentionSchema, "Updated retention in days"),
+          200: jsonResponse(retentionView, "Updated retention in days"),
           400: jsonResponse(z.object({ code: z.literal("bad_input"), message: z.string() }), "Invalid retention"),
+          409: jsonResponse(
+            z.object({ code: z.literal("setting_unreadable"), message: z.string() }),
+            "Stored period needs explicit replacement",
+          ),
         },
       }),
       validate("json", retentionInput, "bad_input"),
       async (c) => {
         const next = c.req.valid("json");
-        const old = await readMailRetention();
         await sql.begin(async (tx) => {
-          // complete value from explicit admin input; nothing is merged over a read (#1303)
-          await settings.set(MAIL_RETENTION_KEYS[0], next.contentDays, tx, { replaceUnreadable: true });
-          // complete value from explicit admin input; nothing is merged over a read (#1303)
-          await settings.set(MAIL_RETENTION_KEYS[1], next.recordDays, tx, { replaceUnreadable: true });
+          await tx`SELECT pg_advisory_xact_lock(hashtextextended('outgoing-mail.retention-settings', 0))`;
+          const old = await readMailRetentionSettings(tx);
+          if ((next.recordDays ?? old.recordDays) < (next.contentDays ?? old.contentDays))
+            throw new OutgoingMailError("bad_input", "Record retention must be at least content retention.");
+          if (next.contentDays !== undefined)
+            await settings.set(MAIL_RETENTION_KEYS[0], next.contentDays, tx, {
+              replaceUnreadable: next.replaceUnreadable?.includes(MAIL_RETENTION_KEYS[0]) === true,
+            });
+          if (next.recordDays !== undefined)
+            await settings.set(MAIL_RETENTION_KEYS[1], next.recordDays, tx, {
+              replaceUnreadable: next.replaceUnreadable?.includes(MAIL_RETENTION_KEYS[1]) === true,
+            });
           await audit.record(
             {
               ...context(c),
@@ -149,7 +163,7 @@ export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<Au
           );
         });
         await settings.invalidateSettingsCache(MAIL_RETENTION_KEYS);
-        return c.json(next);
+        return c.json(await readMailRetentionSettings());
       },
     )
     .get(
@@ -245,7 +259,7 @@ export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<Au
     .put(
       "/apps/:appId/log-access",
       describeRoute({
-        summary: "Set application mail log access",
+        summary: "Replace application metadata and content mail log access",
         tags: ["Outgoing mail"],
         ...requiresAdmin,
         responses: {

package/src/api/app-approval-actions.ts

@@ -1,20 +1,44 @@
 import { submitAiTurnAction } from "../ai/runtime";
 import { aiConversations } from "../ai/store";
-import { APP_ACTION_LIMITS } from "../contracts/app-approval";
+import { APP_ACTION_LIMITS, type AppActionSummary } from "../contracts/app-approval";
+import { APPROVALS_PAGE_SIZE } from "../contracts/approvals";
 import type { AppDeviceActions } from "../services/app-approval";
-import { listPending } from "../services/approvals";
-import { appActionSummary, appActionView } from "../services/approvals/device";
+import { listPending, loadApprovalActionPolicies, pendingApprovalCard } from "../services/approvals";
+import { appActionOffered, appActionSummary, appActionView } from "../services/approvals/device";
+
+/** Pages of open requests one inbox poll reads at most while it skips browser-only questions. */
+const INBOX_PAGES = 5;
 
 export const createDeviceActions = (appName: (appId: string, locale: string) => string): AppDeviceActions => {
   const view: AppDeviceActions["view"] = async ({ userId, issuer, actionId }) => {
     const { items } = await listPending({ approverUserId: userId, id: actionId, limit: 1 });
-    return items[0] ? appActionView(items[0], { issuer, appName }) : null;
+    const row = items[0];
+    if (!row) return null;
+    const policy = (await loadApprovalActionPolicies([row]))(row);
+    const mapped = await appActionView(row, { issuer, appName, policy });
+    return appActionOffered(mapped, pendingApprovalCard(row, appName, policy), policy) ? mapped : null;
   };
   return {
     inbox: async ({ userId, issuer }) => {
-      const { items, count } = await listPending({ approverUserId: userId, limit: APP_ACTION_LIMITS.inboxActions });
-      const views = await Promise.all(items.map((row) => appActionView(row, { issuer, appName })));
-      return { actions: views.map(appActionSummary), moreActions: Math.max(0, count - items.length) };
+      // Browser-only questions are skipped, so read on past them. One poll reads at most this many pages of open
+      // requests, newest first, which keeps each 5-second poll bounded.
+      const actions: AppActionSummary[] = [];
+      let count = 0;
+      let cursor: string | undefined;
+      for (let page = 0; page < INBOX_PAGES && actions.length < APP_ACTION_LIMITS.inboxActions; page += 1) {
+        const result = await listPending({ approverUserId: userId, limit: APPROVALS_PAGE_SIZE, ...(cursor ? { cursor } : {}) });
+        count = result.count;
+        const policyOf = await loadApprovalActionPolicies(result.items);
+        for (const row of result.items) {
+          const policy = policyOf(row);
+          const mapped = await appActionView(row, { issuer, appName, policy });
+          if (appActionOffered(mapped, pendingApprovalCard(row, appName, policy), policy)) actions.push(appActionSummary(mapped));
+          if (actions.length === APP_ACTION_LIMITS.inboxActions) break;
+        }
+        if (!result.nextCursor) break;
+        cursor = result.nextCursor;
+      }
+      return { actions, moreActions: Math.max(0, count - actions.length) };
     },
     view,
     decide: async ({ userId, deviceId, issuer, actionId, digest, approved }) => {

package/src/api/approvals-loader.ts

@@ -3,7 +3,7 @@ import { HTTPException } from "hono/http-exception";
 import { listCapabilities } from "../_internal/registry";
 import { resolveAiChatRequestContext } from "../ai/request-context";
 import type { ApprovalListQuery, ApprovalPage } from "../contracts/approvals";
-import { CapabilityActionCallReviewSchema, capabilityActionPolicy } from "../contracts/capabilities";
+import { CapabilityActionReviewPresentationSchema, capabilityActionPolicy } from "../contracts/capabilities";
 import type { AuthContext } from "../server/middleware/auth";
 import { listPending, presentPendingApproval } from "../services/approvals/list";
 import { logger } from "../services/logging";
@@ -16,8 +16,8 @@ export const loadPendingApprovals = async <T extends AuthContext>(c: Context<T>,
   const apps = getLocalizedRuntimeContext(c).apps;
   const needsPolicy = page.items.some((row) => {
     if (row.storedReview && "sentence" in row.storedReview) return false;
-    const review = CapabilityActionCallReviewSchema.safeParse(row.details);
-    return review.success && !review.data.ask;
+    const review = CapabilityActionReviewPresentationSchema.safeParse(row.details);
+    return review.success && "sentence" in review.data && !review.data.ask;
   });
   const capabilities = needsPolicy
     ? await listCapabilities().catch((error: unknown) => {

package/src/api/approvals.ts

@@ -4,6 +4,7 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { toAiActionFailureResponse } from "../ai/http";
 import { resolveAiChatRequestContext } from "../ai/request-context";
+import { readReviewContent } from "../ai/review-content";
 import { submitAiTurnAction } from "../ai/runtime";
 import { aiConversations } from "../ai/store";
 import {
@@ -14,6 +15,7 @@ import {
   ApprovalListQuerySchema,
   ApprovalPageSchema,
 } from "../contracts/approvals";
+import { CapabilityReviewContentSchema } from "../contracts/capabilities";
 import { ErrorResponseSchema } from "../contracts/shared";
 import { rateLimit } from "../server";
 import { respond } from "../server/api";
@@ -23,6 +25,7 @@ import { jsonResponse, requiresAuth } from "../server/middleware/openapi";
 import { v } from "../server/middleware/validator";
 import { ok } from "../server/services";
 import { approvalDecisionChannel, countPending } from "../services/approvals";
+import { readApprovalContent } from "../services/approvals/content";
 import { decodeApprovalCursor } from "../services/approvals/cursor";
 import { loadPendingApprovals } from "./approvals-loader";
 
@@ -30,6 +33,54 @@ export const approvalRoutes = new Hono<AuthContext>()
   .use("*", noTransform())
   .use(rateLimit())
   .use(auth.requireRole("authenticated"))
+  .get(
+    "/:id/content",
+    describeRoute({
+      tags: ["Approvals"],
+      summary: "Read one complete pending approval snapshot",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(CapabilityReviewContentSchema, "Complete reviewed content"),
+        404: jsonResponse(ErrorResponseSchema, "Snapshot unavailable"),
+      },
+    }),
+    v("param", z.object({ id: z.uuid() })),
+    v("query", z.object({ digest: z.string().regex(/^[a-f0-9]{64}$/) }).strict()),
+    async (c) => {
+      const ctx = await resolveAiChatRequestContext(c);
+      if (ctx instanceof Response) return ctx;
+      const content = await readApprovalContent({
+        ...c.req.valid("param"),
+        ...c.req.valid("query"),
+        approverUserId: ctx.ownerUserId,
+        signal: c.req.raw.signal,
+      });
+      c.header("Cache-Control", "private, no-store");
+      return content ? c.json(content) : c.json({ message: "This review is no longer available." }, 404);
+    },
+  )
+  .get(
+    "/conversations/:conversationId/turns/:turnId/reviews/:callId",
+    describeRoute({
+      tags: ["Approvals"],
+      summary: "Read one historical conversation review snapshot",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(CapabilityReviewContentSchema, "Complete reviewed content"),
+        404: jsonResponse(ErrorResponseSchema, "Snapshot unavailable"),
+      },
+    }),
+    v("param", z.object({ conversationId: z.uuid(), turnId: z.uuid(), callId: z.string().min(1).max(200) })),
+    v("query", z.object({ digest: z.string().regex(/^[a-f0-9]{64}$/) }).strict()),
+    async (c) => {
+      const ctx = await resolveAiChatRequestContext(c);
+      if (ctx instanceof Response) return ctx;
+      const location = c.req.valid("param");
+      c.header("Cache-Control", "private, no-store");
+      const content = await readReviewContent(location, c.req.valid("query").digest, ctx.ownerUserId, c.req.raw.signal);
+      return content ? c.json(content) : c.json({ message: "This review is no longer available." }, 404);
+    },
+  )
   .get(
     "/",
     describeRoute({

package/src/api/apps.ts

@@ -3,6 +3,8 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { ErrorResponseSchema } from "../contracts";
 import { type AuthContext, auth, jsonResponse, requiresAuth, v } from "../server";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableApps } from "../services/app-discovery";
 import { visibleNavigationApps } from "../ssr/app-navigation";
 import { getLocalizedRuntimeContext } from "../ssr/runtime";
 
@@ -35,9 +37,9 @@ export const appDiscoveryRoutes = new Hono<AuthContext>().use(auth.requireRole("
     },
   }),
   v("query", AppListQuerySchema),
-  (c) => {
+  async (c) => {
     const search = c.req.valid("query").search?.toLowerCase();
-    const items = visibleNavigationApps(getLocalizedRuntimeContext(c).apps, c.get("user"))
+    const items = visibleNavigationApps(await discoverableApps(appAccessAuthority(c), getLocalizedRuntimeContext(c).apps), c.get("user"))
       .map((app) => ({
         id: app.id,
         name: app.name,

package/src/api/auth/schemas.ts

@@ -54,6 +54,9 @@ export const AuthResponseSchema = z.object({
   user: UserSchema,
 });
 
+/** Password-change sign-in result; retry ending other sign-ins when signOutOthersFailed is true. */
+export const PasswordChangeAuthResponseSchema = AuthResponseSchema.extend({ signOutOthersFailed: z.boolean() });
+
 export const VerifyPasskeyAuthenticationSchema = z.object({
   response: z.unknown(),
   acceptedAgb: z.literal(true).optional(),