@k2b/cloud 0.40.0 → 0.42.0

package/src/ai/executor.ts

@@ -1,9 +1,9 @@
 import type { AssistantMessage, CompactEvent, LoopAggregate, Message, NessiLoop, OutboundEvent } from "@k2b/nessi";
 import { compact, nessi } from "@k2b/nessi";
 import { capabilityReviewRememberScope } from "../_internal/capability-reviews";
-import { listCapabilities } from "../_internal/registry";
+import { getCapability, listCapabilities } from "../_internal/registry";
 import type { CapabilityActionReviewData } from "../contracts/capabilities";
-import { capabilityActionPolicy } from "../contracts/capabilities";
+import { CapabilityActionReviewDataSchema, capabilityActionPolicy } from "../contracts/capabilities";
 import type { AccessSubject, RequestActor } from "../server";
 import { approvalAssurance, approvalScopeFromToolName, approvals } from "../services/approvals";
 import { createHelpReader } from "../services/help";
@@ -73,6 +73,7 @@ import {
 import { retryTransientProviderErrors } from "./provider-retry";
 import { assistantQuotaProvider, inferenceProvider } from "./quota-provider";
 import { collectConversationResourceObservations } from "./resource-refs";
+import { compactCapabilityReview } from "./review-content";
 import { AiRunTimeout } from "./run-timeout";
 import { isAiVisionModelConfigured, type resolveAiModel } from "./settings";
 import { mergeAiSkillCatalog, selectAiSkillCatalog } from "./skill-catalog";
@@ -456,7 +457,12 @@ const approvalReviewForCallId = (
  * to (attempt, turn) so re-claimed attempts never collide, and (b) maintains
  * tool blocks keyed by callId, enriched with Cloud status/approval metadata.
  */
-const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowRememberedApprovals = true) => {
+const createEventMapper = (
+  attempt: number,
+  seedBlocks: AiTurnBlock[],
+  allowRememberedApprovals = true,
+  location?: { conversationId: string; turnId: string },
+) => {
   const toolBlocks = new Map<string, Extract<AiTurnBlock, { kind: "tool" }>>();
   /** Website receipts by the call that shows them and their index; every later state of that call keeps them. */
   const receiptsByCall = new Map<string, Map<number, { method: string; url: string }>>();
@@ -586,7 +592,8 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
         return [setTool(event.callId, { name: event.name, args: event.args, status: "running" })];
       case "tool_action_request":
         const displayCallId = event.kind === "custom_approval" ? (customApprovalParentCallId(event.callId) ?? event.callId) : event.callId;
-        const review = approvalReviewForCallId(approvalReviews, event.callId);
+        const rawReview = approvalReviewForCallId(approvalReviews, event.callId);
+        const review = rawReview && location ? compactCapabilityReview(rawReview, { ...location, callId: displayCallId }) : rawReview;
         const target = event.kind === "custom_approval" ? approvalTargets.get(event.callId) : undefined;
         const allowAlways = target
           ? target.always
@@ -919,9 +926,9 @@ export class AiTurnExecutor {
     const helpEnabled = toolActor !== null;
     const toolDiscoveryEnabled = toolActor !== null;
     const appToolsEnabled = toolActor !== null && defaultToolSource?.appTools === true;
-    let capabilityAuthority: Awaited<ReturnType<typeof resolveAiCapabilityActor>> | null = null;
+    let toolAuthority: Awaited<ReturnType<typeof resolveAiCapabilityActor>> | null = null;
     try {
-      capabilityAuthority = appToolsEnabled
+      toolAuthority = toolActor
         ? await resolveAiCapabilityActor({ conversationId, persistedActor: material.actor, store: aiConversations })
         : null;
     } catch (error) {
@@ -940,7 +947,10 @@ export class AiTurnExecutor {
       );
       return;
     }
-    if (capabilityAuthority) material.actor = capabilityAuthority.actor;
+    if (toolAuthority) material.actor = toolAuthority.actor;
+    // Skills and Help need current authority even when application operations are disabled.
+    // Keep the appTools switch responsible for exposing and executing those operations.
+    const capabilityAuthority = appToolsEnabled ? toolAuthority : null;
 
     // Personalization applies to user-backed personal conversations.
     const user = aiActorUser(material.actor);
@@ -959,7 +969,9 @@ export class AiTurnExecutor {
     // executions must not gain an implicit database dependency or extra tools.
     const skillSubject =
       defaultToolSource && resolved.profile.capabilities.includes("tools") ? accessSubjectForActor(material.actor) : null;
-    const availableSkills = skillSubject ? (await aiSkills.list(skillSubject)).filter((skill) => skill.enabled) : [];
+    const availableSkills = skillSubject
+      ? (await aiSkills.list(skillSubject, { authority: toolAuthority })).filter((skill) => skill.enabled)
+      : [];
     const localClient = !config.background && !config.mandate ? config.client : undefined;
     const localContext = localClient ? config.localContext : undefined;
     const localSkills = (localContext?.skills ?? []).map((skill) => ({
@@ -996,15 +1008,15 @@ export class AiTurnExecutor {
         : undefined;
     const skillFiles = skillSubject
       ? {
-          list: () => aiSkills.listTurnFiles(turnId, skillSubject),
-          read: (path: string) => aiSkills.readTurnFile(turnId, path, skillSubject),
+          list: () => aiSkills.listTurnFiles(turnId, skillSubject, toolAuthority),
+          read: (path: string) => aiSkills.readTurnFile(turnId, path, skillSubject, toolAuthority),
         }
       : undefined;
     const runtimeTools = [
       ...material.tools,
       ...(memoryActive ? [createCloudAiMemoryTool(query)] : []),
-      ...(skillSubject && availableSkills.length ? [createCloudAiLoadSkillTool(skillSubject)] : []),
-      ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(skillSubject, localSkills)] : []),
+      ...(skillSubject && availableSkills.length ? [createCloudAiLoadSkillTool(skillSubject, toolAuthority)] : []),
+      ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(skillSubject, localSkills, toolAuthority)] : []),
       ...(config.project && resolvedProjectId && projectSubject
         ? [
             createCloudAiSearchProjectTool(resolvedProjectId, projectSubject),
@@ -1055,6 +1067,8 @@ export class AiTurnExecutor {
     const approvalTargets = new Map<string, AiApprovalTarget>();
     const linkedApprovals = new Map<string, string>();
     const freshApprovalRequired = new Set<string>();
+    const capabilityActionReviews = new Map<string, CapabilityActionReviewData>();
+    const storedReviews = new Map<string, AiStoredActionReview>();
     const dynamicToolRuntimeContext = {
       turnId,
       reportToolProgress: (callId: string, message: string) => pipeline.reportToolProgress(callId, message),
@@ -1096,6 +1110,13 @@ export class AiTurnExecutor {
         return "changed";
       },
       describeApproval: (approvalCallId: string, target: AiApprovalTarget) => approvalTargets.set(approvalCallId, target),
+      describeReview: async (approvalCallId: string, review: CapabilityActionReviewData) => {
+        capabilityActionReviews.set(approvalCallId, review);
+        const callId = customApprovalParentCallId(approvalCallId) ?? approvalCallId;
+        const stored = await recordAiToolReview({ conversationId, turnId, callId, review: storedActionReview(review) });
+        storedReviews.set(callId, stored);
+        await pipeline.setToolReview(callId, stored);
+      },
     };
     const prepared = prepareAiTools({
       tools: activeTools,
@@ -1105,8 +1126,6 @@ export class AiTurnExecutor {
     });
     let backgroundError: string | null = null;
     const rememberableCapabilityApprovals = new Map<string, string>();
-    const capabilityActionReviews = new Map<string, CapabilityActionReviewData>();
-    const storedReviews = new Map<string, AiStoredActionReview>();
     const onCapabilityReview = async (
       callId: string,
       review: CapabilityActionReviewData,
@@ -1117,8 +1136,12 @@ export class AiTurnExecutor {
       const scope = capabilityReviewRememberScope(review, approval);
       if (scope) rememberableCapabilityApprovals.set(callId, scope);
       else rememberableCapabilityApprovals.delete(callId);
-      const stored = storedActionReview(review, capabilityActionPolicy(entry.app.manifest, entry.operation.localId));
-      await recordAiToolReview({ conversationId, turnId, callId, review: stored });
+      const stored = await recordAiToolReview({
+        conversationId,
+        turnId,
+        callId,
+        review: storedActionReview(review, capabilityActionPolicy(entry.app.manifest, entry.operation.localId)),
+      });
       storedReviews.set(callId, stored);
       await pipeline.setToolReview(callId, stored);
     };
@@ -1245,7 +1268,8 @@ export class AiTurnExecutor {
     const tools = toolActor
       ? createAiToolResolver({
           conversationId,
-          actor: capabilityAuthority?.actor ?? toolActor,
+          actor: toolAuthority?.actor ?? toolActor,
+          authority: toolAuthority,
           staticTools: activeTools,
           ...(activeTools.some((tool) => tool.def.name === "load_skill") ? { skillNames: availableSkills.map((skill) => skill.name) } : {}),
           allowedTools,
@@ -1464,6 +1488,7 @@ export class AiTurnExecutor {
       turnId,
       skillSubject,
       activeTools.some((tool) => tool.def.name === "load_skill"),
+      toolAuthority,
     );
     const chat = await aiConversations.getConversation({ conversationId });
     const workingPlan = chat?.todoPlan;
@@ -1734,7 +1759,7 @@ export class AiTurnExecutor {
     approvalContext?: AiToolApprovalContext;
     allowRememberedApprovals: boolean;
     rememberableCapabilityApprovals: ReadonlyMap<string, string>;
-    capabilityActionReviews: ReadonlyMap<string, CapabilityActionReviewData>;
+    capabilityActionReviews: Map<string, CapabilityActionReviewData>;
     approvalTargets: ReadonlyMap<string, AiApprovalTarget>;
     linkedApprovals: ReadonlyMap<string, string>;
     freshApprovalRequired?: ReadonlySet<string>;
@@ -1919,7 +1944,7 @@ export class AiTurnExecutor {
     approvalContext?: AiToolApprovalContext;
     allowRememberedApprovals: boolean;
     rememberableCapabilityApprovals: ReadonlyMap<string, string>;
-    capabilityActionReviews: ReadonlyMap<string, CapabilityActionReviewData>;
+    capabilityActionReviews: Map<string, CapabilityActionReviewData>;
     approvalTargets: ReadonlyMap<string, AiApprovalTarget>;
     linkedApprovals: ReadonlyMap<string, string>;
     freshApprovalRequired?: ReadonlySet<string>;
@@ -2008,7 +2033,7 @@ export class AiTurnExecutor {
       }
     }
 
-    const review = event.kind === "custom_approval" ? approvalReviewForCallId(capabilityActionReviews, event.callId) : undefined;
+    let review = event.kind === "custom_approval" ? approvalReviewForCallId(capabilityActionReviews, event.callId) : undefined;
     let approvalId: string | undefined;
     let presented = event;
     if (event.kind !== "client_tool") {
@@ -2023,6 +2048,24 @@ export class AiTurnExecutor {
         approvalId = linked;
         // The card shows the question the effect's own record holds, never the text the relay sent.
         presented = { ...event, message: record.sentence };
+        // A later linked question without structured details replaces an earlier child's review too.
+        review = record.details === null ? undefined : CapabilityActionReviewDataSchema.parse(record.details);
+        if (review) capabilityActionReviews.set(event.callId, review);
+        else capabilityActionReviews.delete(event.callId);
+        const callId = event.kind === "custom_approval" ? (customApprovalParentCallId(event.callId) ?? event.callId) : event.callId;
+        const capability = review && "sentence" in review && !review.ask ? await getCapability(record.appId).catch(() => null) : null;
+        // Keep the original proposal on the existing tool-call message as well as the approval.
+        // Its chat reference must remain readable after the approval has been consumed.
+        const stored = await recordAiToolReview({
+          conversationId,
+          turnId,
+          callId,
+          review: storedActionReview(
+            review ?? { message: record.sentence },
+            capability ? capabilityActionPolicy(capability.manifest, record.action) : undefined,
+          ),
+        });
+        await pipeline.setToolReview(callId, stored);
       } else {
         const record = await approvals.request({
           ...approvalScopeFromToolName(toolName),
@@ -2307,7 +2350,7 @@ class StreamPipeline {
     this.seq = input.startSeq;
     this.blocks = [];
     this.allowRememberedApprovals = input.allowRememberedApprovals;
-    this.mapper = createEventMapper(input.attempt, input.seedBlocks, input.allowRememberedApprovals);
+    this.mapper = createEventMapper(input.attempt, input.seedBlocks, input.allowRememberedApprovals, input);
   }
 
   private ordered(run: () => Promise<void>): Promise<void> {

package/src/ai/fetch-file-tool.ts

@@ -3,6 +3,7 @@ import { type RequestOptions as HttpsRequestOptions, request as httpsRequest } f
 import { z } from "zod";
 import { DOCUMENT_EXTRACTION_MAX_INPUT_BYTES, DOCUMENT_EXTRACTION_MAX_OUTPUT_BYTES } from "../services/document-extraction";
 import { type PublicNetworkAddress, resolvePublicNetworkAddresses } from "../services/network-security";
+import { awaitNetworkOperation, readNetworkResponse, withNetworkDeadline } from "../services/network-transport";
 import { AI_FILES_MAX_FILE_BYTES_DEFAULT, aiFileStore, guessAiMediaType, normalizeAiFilePath } from "./files-store";
 import { authorizeWebRead } from "./firecrawl-tools";
 import { htmlToReadableMarkdown } from "./readable-html";
@@ -21,10 +22,11 @@ type PublicFileResponse = {
 type FetchFileDependencies = {
   resolve?: (hostname: string) => Promise<PublicNetworkAddress[]>;
   request?: RequestFactory;
+  timeoutMs?: number;
   requestPublicFile?: (
     url: URL,
     addresses: PublicNetworkAddress[],
-    options: { maxBytes: number; signal?: AbortSignal },
+    options: { maxBytes: number; signal: AbortSignal },
   ) => Promise<PublicFileResponse>;
 };
 
@@ -72,7 +74,6 @@ export const buildPinnedFetchFileRequestOptions = (url: URL, addresses: PublicNe
     },
     servername: url.hostname,
     rejectUnauthorized: true,
-    timeout: FETCH_FILE_REQUEST_TIMEOUT_MS,
   }));
 };
 
@@ -103,52 +104,40 @@ const httpFileError = (statusCode: number): Error => {
 const requestOneAddress = (
   request: RequestFactory,
   options: HttpsRequestOptions,
-  input: { maxBytes: number; signal?: AbortSignal },
-): Promise<PublicFileResponse> =>
-  new Promise((resolve, reject) => {
-    let settled = false;
-    let responseReceived = false;
-    let outgoing: ClientRequest;
-    const abort = () => outgoing.destroy(new Error("File download was cancelled."));
-    const finish = (result: { value?: PublicFileResponse; error?: Error }) => {
-      if (settled) return;
-      settled = true;
-      input.signal?.removeEventListener("abort", abort);
-      if (result.error) reject(responseReceived ? Object.assign(result.error, { responseReceived: true }) : result.error);
-      else resolve(result.value!);
-    };
-    outgoing = request(options, (incoming) => {
+  input: { maxBytes: number; signal: AbortSignal },
+): Promise<PublicFileResponse> => {
+  let responseReceived = false;
+  return readNetworkResponse<PublicFileResponse>({
+    request,
+    options,
+    signal: input.signal,
+    read: (incoming, resolve, reject) => {
       responseReceived = true;
       const statusCode = incoming.statusCode ?? 0;
       if (statusCode >= 300 && statusCode < 400) {
-        incoming.resume();
-        finish({ value: { statusCode, headers: incoming.headers, bytes: new Uint8Array() } });
+        resolve({ statusCode, headers: incoming.headers, bytes: new Uint8Array() });
         return;
       }
       if (statusCode < 200 || statusCode >= 300) {
-        incoming.resume();
-        finish({ error: httpFileError(statusCode) });
+        reject(httpFileError(statusCode));
         return;
       }
       const contentEncoding = String(incoming.headers["content-encoding"] ?? "identity")
         .trim()
         .toLowerCase();
       if (contentEncoding !== "" && contentEncoding !== "identity") {
-        incoming.destroy();
-        finish({ error: responseError("Unsupported file response — The server compressed the download unexpectedly.") });
+        reject(responseError("Unsupported file response — The server compressed the download unexpectedly."));
         return;
       }
       let declared: number | null;
       try {
         declared = declaredContentLength(incoming.headers);
       } catch (error) {
-        incoming.destroy();
-        finish({ error: responseError(error instanceof Error ? error.message : "File response length is invalid.") });
+        reject(responseError(error instanceof Error ? error.message : "File response length is invalid."));
         return;
       }
       if (declared !== null && declared > input.maxBytes) {
-        incoming.destroy();
-        finish({ error: responseError(`File is too large — The download exceeds the ${fileLimitLabel(input.maxBytes)} limit.`) });
+        reject(responseError(`File is too large — The download exceeds the ${fileLimitLabel(input.maxBytes)} limit.`));
         return;
       }
 
@@ -158,36 +147,29 @@ const requestOneAddress = (
         const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
         size += bytes.byteLength;
         if (size > input.maxBytes) {
-          incoming.destroy();
-          finish({ error: responseError(`File is too large — The download exceeds the ${fileLimitLabel(input.maxBytes)} limit.`) });
+          reject(responseError(`File is too large — The download exceeds the ${fileLimitLabel(input.maxBytes)} limit.`));
           return;
         }
         chunks.push(bytes);
       });
       incoming.on("end", () => {
         if (declared !== null && size !== declared) {
-          finish({ error: responseError("Incomplete file download — The received size did not match the server response.") });
+          reject(responseError("Incomplete file download — The received size did not match the server response."));
           return;
         }
         const body = Buffer.concat(chunks, size);
-        finish({ value: { statusCode, headers: incoming.headers, bytes: new Uint8Array(body) } });
+        resolve({ statusCode, headers: incoming.headers, bytes: new Uint8Array(body) });
       });
-      incoming.on("error", (error) => finish({ error }));
-    });
-    outgoing.on("timeout", () => outgoing.destroy(new Error("File server did not respond — Try again later.")));
-    outgoing.on("error", (error) => finish({ error }));
-    if (input.signal?.aborted) {
-      abort();
-      return;
-    }
-    input.signal?.addEventListener("abort", abort, { once: true });
-    outgoing.end();
+    },
+  }).catch((error) => {
+    throw responseReceived ? Object.assign(error, { responseReceived: true }) : error;
   });
+};
 
 const requestPublicFile = async (
   url: URL,
   addresses: PublicNetworkAddress[],
-  options: { maxBytes: number; signal?: AbortSignal },
+  options: { maxBytes: number; signal: AbortSignal },
   request: RequestFactory = httpsRequest,
 ): Promise<PublicFileResponse> => {
   let lastError: unknown;
@@ -235,42 +217,51 @@ type WebsiteApprovedDownload = { origin: string; onRequest: (url: URL, hop: numb
 export const downloadPublicFile = async (
   rawUrl: string,
   options: FetchFileDependencies & { maxBytes?: number; signal?: AbortSignal; approvedWebsite?: WebsiteApprovedDownload } = {},
-): Promise<{ bytes: Uint8Array; headers: IncomingHttpHeaders; url: URL }> => {
-  const resolve = options.resolve ?? resolvePublicNetworkAddresses;
-  const perform =
-    options.requestPublicFile ??
-    ((url: URL, addresses: PublicNetworkAddress[], input: { maxBytes: number; signal?: AbortSignal }) =>
-      requestPublicFile(url, addresses, input, options.request));
-  const maxBytes = options.maxBytes ?? AI_FILES_MAX_FILE_BYTES_DEFAULT;
-  let url = publicHttpsUrl(rawUrl);
+): Promise<{ bytes: Uint8Array; headers: IncomingHttpHeaders; url: URL }> =>
+  withNetworkDeadline(
+    options.timeoutMs ?? FETCH_FILE_REQUEST_TIMEOUT_MS,
+    options.signal,
+    new Error("File server did not respond — Try again later."),
+    async (signal) => {
+      const resolve = options.resolve ?? resolvePublicNetworkAddresses;
+      const perform =
+        options.requestPublicFile ??
+        ((url: URL, addresses: PublicNetworkAddress[], input: { maxBytes: number; signal: AbortSignal }) =>
+          requestPublicFile(url, addresses, input, options.request));
+      const maxBytes = options.maxBytes ?? AI_FILES_MAX_FILE_BYTES_DEFAULT;
+      let url = publicHttpsUrl(rawUrl);
 
-  for (let redirects = 0; redirects <= FETCH_FILE_MAX_REDIRECTS; redirects++) {
-    if (options.approvedWebsite) {
-      // A website approval covers its own origin only; an open redirect must not carry the address to another one.
-      if (url.origin !== options.approvedWebsite.origin)
-        throw new Error(
-          `Redirect to another website — The file moved to ${url.toString()}, which this chat has not allowed. Download that address directly so the person can decide.`,
-        );
-      await options.approvedWebsite.onRequest(url, redirects);
-    }
-    const addresses = await resolveFileAddresses(resolve, url.hostname);
-    const response = await perform(url, addresses, { maxBytes, signal: options.signal });
-    if (response.statusCode >= 300 && response.statusCode < 400) {
-      const location = responseLocation(response.headers);
-      if (!location) throw new Error("Invalid file redirect — The server did not provide a destination.");
-      if (redirects === FETCH_FILE_MAX_REDIRECTS) throw new Error("Too many file redirects — Use the final file URL instead.");
-      try {
-        url = publicHttpsUrl(new URL(location, url).toString());
-      } catch (error) {
-        if (error instanceof Error && error.message.includes(" — ")) throw error;
-        throw new Error("Invalid file redirect — The server provided an invalid destination.");
+      for (let redirects = 0; redirects <= FETCH_FILE_MAX_REDIRECTS; redirects++) {
+        signal.throwIfAborted();
+        if (options.approvedWebsite) {
+          // A website approval covers its own origin only; an open redirect must not carry the address to another one.
+          if (url.origin !== options.approvedWebsite.origin)
+            throw new Error(
+              `Redirect to another website — The file moved to ${url.toString()}, which this chat has not allowed. Download that address directly so the person can decide.`,
+            );
+          await awaitNetworkOperation(options.approvedWebsite.onRequest(url, redirects), signal);
+        }
+        signal.throwIfAborted();
+        const addresses = await awaitNetworkOperation(resolveFileAddresses(resolve, url.hostname), signal);
+        signal.throwIfAborted();
+        const response = await awaitNetworkOperation(perform(url, addresses, { maxBytes, signal }), signal);
+        if (response.statusCode >= 300 && response.statusCode < 400) {
+          const location = responseLocation(response.headers);
+          if (!location) throw new Error("Invalid file redirect — The server did not provide a destination.");
+          if (redirects === FETCH_FILE_MAX_REDIRECTS) throw new Error("Too many file redirects — Use the final file URL instead.");
+          try {
+            url = publicHttpsUrl(new URL(location, url).toString());
+          } catch (error) {
+            if (error instanceof Error && error.message.includes(" — ")) throw error;
+            throw new Error("Invalid file redirect — The server provided an invalid destination.");
+          }
+          continue;
+        }
+        return { bytes: response.bytes, headers: response.headers, url };
       }
-      continue;
-    }
-    return { bytes: response.bytes, headers: response.headers, url };
-  }
-  throw new Error("Too many file redirects — Use the final file URL instead.");
-};
+      throw new Error("Too many file redirects — Use the final file URL instead.");
+    },
+  );
 
 const safeFilename = (requested: string | undefined, url: URL): string => {
   let basename = requested;

package/src/ai/firecrawl-tools.ts

@@ -1,10 +1,12 @@
 import { type ToolContext, truncateMiddle } from "@k2b/nessi";
 import { z } from "zod";
+import type { CapabilityActionCallReview } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import { coreSettings } from "../services";
 import { isUnsafeNetworkAddress, isUnsafeNetworkHostname, parseNetworkAddress } from "../shared/network-address";
 import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsWebsiteApprovals, aiWebsiteApprovalScope, findRememberedAiToolApproval } from "./approvals";
 import { aiConversations } from "./store";
+import { cloudToolReview } from "./tool-sentences";
 import { defineAiTool } from "./tools";
 import type { AiApprovalTarget, AiWebsiteReceipt } from "./types";
 import { hasWebAddressProvenance, recordWebAddresses, webAddressesIn } from "./web-provenance";
@@ -280,7 +282,7 @@ export type WebReadContext = Pick<ToolContext, "requestApproval"> & {
   conversationId?: string;
   turnId?: string;
   locale?: string;
-  requestApprovalFor?: (message: string, target: AiApprovalTarget) => Promise<boolean>;
+  requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
   reportWebsiteReceipts?: (receipts: AiWebsiteReceipt[]) => Promise<void>;
 };
 
@@ -306,7 +308,18 @@ export const authorizeWebRead = async (kind: "page" | "file", url: string, ctx:
     return true;
   }
   const message = webReadApprovalMessage(kind, url, ctx.locale);
-  const approved = ctx.requestApprovalFor ? await ctx.requestApprovalFor(message, target) : await ctx.requestApproval(message);
+  const review = cloudToolReview(kind === "page" ? "web_extract" : "fetch_file", { url }, ctx.locale ?? "en");
+  const question: CapabilityActionCallReview | undefined = review
+    ? {
+        ...review,
+        ask: "sends",
+        consequences: message
+          .split("\n")
+          .slice(1)
+          .map((text) => ({ text })),
+      }
+    : undefined;
+  const approved = ctx.requestApprovalFor ? await ctx.requestApprovalFor(message, target, question) : await ctx.requestApproval(message);
   if (!approved) throw new Error("The person did not allow reading this address. Use an address from their message or a search result.");
   return false;
 };

package/src/ai/http.ts

@@ -70,6 +70,7 @@ export const AiToolPreloadSchema = z.union([
 ]);
 
 export const AiCreateConversationInputSchema = z.object({
+  requestId: z.uuid().optional(),
   title: z.string().trim().min(1).max(120).optional(),
   projectId: z.string().regex(AI_SHORT_ID_PATTERN).optional(),
   draft: AiInitialConversationDraftInputSchema.optional(),

package/src/ai/index.ts

@@ -262,6 +262,7 @@ export {
   createCloudAiMemoryTool,
 } from "./memory-tool";
 export { migrateCloudAi } from "./migrate";
+export { type AiOpenQuestion, type AiOpenQuestions, listAiOpenQuestions } from "./open-questions";
 export { personalAiModelPolicy } from "./personal-agent";
 export { type AiUserPrefs, aiActorUser, aiPrefsUserId, aiUserPrefs } from "./prefs";
 export {

package/src/ai/migrate.ts

@@ -47,6 +47,17 @@ export const migrateCloudAi = async (): Promise<void> => {
     )
   `.simple();
 
+  // Keep the request identity after deletion: retrying a lost response must not resurrect a chat.
+  await sql`
+    CREATE TABLE IF NOT EXISTS ai.conversation_creations (
+      owner_user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+      request_id UUID NOT NULL,
+      input_hash TEXT NOT NULL,
+      conversation_id UUID REFERENCES ai.conversations(id) ON DELETE SET NULL,
+      PRIMARY KEY (owner_user_id, request_id)
+    )
+  `.simple();
+
   // AI chat ownership was unreleased and only backed local test data. Make the
   // product-model cut once, then keep only the global conversation contract.
   await sql`
@@ -2297,6 +2308,21 @@ export const migrateCloudAi = async (): Promise<void> => {
     AFTER UPDATE OF status, error, completed_at, cancel_requested_at ON ai.turns
     FOR EACH ROW EXECUTE FUNCTION ai.live_conversation_child_changed('conversation-list,conversation-detail')
   `.simple();
+  // Only questions for the person change the list of open questions; browser tool calls come and go per turn.
+  await sql`DROP TRIGGER IF EXISTS ai_live_pending_actions_changed ON ai.pending_actions`.simple();
+  await sql`DROP TRIGGER IF EXISTS ai_live_pending_actions_removed ON ai.pending_actions`.simple();
+  await sql`
+    CREATE TRIGGER ai_live_pending_actions_changed
+    AFTER INSERT OR UPDATE OF status ON ai.pending_actions
+    FOR EACH ROW WHEN (NEW.kind IN ('approval', 'custom_approval'))
+    EXECUTE FUNCTION ai.live_conversation_child_changed('conversation-list')
+  `.simple();
+  await sql`
+    CREATE TRIGGER ai_live_pending_actions_removed
+    AFTER DELETE ON ai.pending_actions
+    FOR EACH ROW WHEN (OLD.kind IN ('approval', 'custom_approval'))
+    EXECUTE FUNCTION ai.live_conversation_child_changed('conversation-list')
+  `.simple();
   await sql`DROP TRIGGER IF EXISTS ai_live_chat_tasks_changed ON ai.chat_tasks`.simple();
   await sql`
     CREATE TRIGGER ai_live_chat_tasks_changed AFTER INSERT OR UPDATE OR DELETE ON ai.chat_tasks
@@ -2642,6 +2668,8 @@ export const migrateCloudAi = async (): Promise<void> => {
     );
   }
   await backfillApprovalRequests();
+  await sql`CREATE INDEX IF NOT EXISTS idx_ai_messages_submitted_draft
+    ON ai.messages (conversation_id, (meta->>'submittedDraftRevision')) WHERE role = 'user'`.simple();
   console.log("  ✓ ai conversation tables");
 };