feat: add AI agent workspace (#3062)

* chore(ai): remove local AI store now that providers live server-side

The Zustand-based useAIStore has been replaced by the server-side
aiProviders oRPC router (encrypted credentials persisted in DB).
Delete the dead store + tests, drop the ./store export, and remove
zustand/immer deps which are no longer referenced anywhere in
packages/ai/src/.

* feat(agent): archive/delete actions and read-only state for agent threads

- Backend: mark archived threads as read-only in threads.get and reject
  messages.send with CONFLICT when the thread is archived.
- Frontend: render archived threads in the sidebar with muted styling and
  an Archived badge; add a per-thread dropdown menu in the chat header
  with Archive (non-destructive) and Delete (with confirmation); show a
  read-only banner above the message list that disambiguates archived
  vs. missing-resource causes; suppress the Retry and Stop buttons in
  read-only mode.
- Tests: new packages/api/src/services/agent.test.ts covering the
  archived-thread isReadOnly flag and the archived-thread send refusal.

* fix(agent): abort run on archive and verify ownership before deleting thread

- threads.archive: before flipping status, abort any in-flight run controller
  and clear the active-run state on the thread; cleanup failures are logged
  but do not block the status update.
- threads.delete: assert thread ownership via getThread before destructive
  work so an authenticated user cannot wipe another user's attachment rows
  by passing a foreign threadId.

Adds focused tests for both behaviors.

* feat(agent): display patch diffs and surface revert conflicts

Render apply_resume_patch tool messages with a status-aware card (applied/
reverted/conflicted), expandable operation list, and a Revert button that
correctly handles RESUME_VERSION_CONFLICT responses. Adds unit tests for
the inverse-patch builder and the agentService.actions.revert flow.

* chore(agent): remove out-of-scope attachment tests accidentally added in Task 6

The Task 6 commit (73ef1acca) accidentally re-introduced three attachment-
related tests that belong to a separate task:

- `buildAttachmentModelParts > converts text, image, supported binary, and
  unsupported attachments into model parts`
- `agentService.messages.send > persists the user message with file UI parts
  and links selected attachments to it` (was failing — the `ToolLoopAgent`
  mock is not callable as a constructor)
- `agentService.messages.send > rejects attachments that are missing, foreign,
  or already linked before persisting a message`

These were likely re-added during a stash recovery and were not requested
for Task 6, whose scope was limited to the `agentService.actions.revert`
flow. Remove them along with the helpers/fixtures (`buildAttachment`,
`buildActiveThread`, `selectWhereResult`, `selectOrderByResult`) that they
were the only consumers of. `selectLimitResult` is preserved because it is
used by the revert tests.

* chore(agent): configure runtime dependencies

* feat(db): add agent workspace schema

* feat(api): add agent backend services

* feat(web): add agent workspace UI

* chore(agent): remove legacy builder assistant

* test(agent): make agent stream mocks constructible

* chore(web): remove unused resume replacement hook

* feat(api): add unsafe AI base URL flag

* chore(dev): expose local services in compose

* fix(web): normalize resume preview gaps

* feat(api): improve agent tool handling

* feat(web): polish agent workspace UI

* chore: update dependencies

* fix(api,web): address PR review feedback for agent workspace

Security/correctness:
- Restrict AI provider URLs to http/https even in unsafe mode
- Stop exposing Redis on host network by default
- Make .env.local optional and drop app profile in compose.dev.yml
- Store agent attachments with private ACL on S3
- Reset provider test status when provider/model/baseURL changes
- Decouple non-agent AI endpoints from REDIS_URL requirement
- Fix JSON Patch add inverse for existing object members
- Wrap resume patch + agent action insert in db transaction
- Validate partialMessage at runtime and rate-limit attachment uploads
- Add unique index on agent_messages (thread_id, sequence)

UX/bugs:
- Mark agent thread route as ssr: false and guard SSE chunk parsing
- Show config-specific banner only on known configuration error
- Gate AI provider checks behind loading state in resume import
- Fix relative-time formatter blank gap between 45-59 seconds
- Clarify thread delete confirmation message

Polish:
- Raise ENCRYPTION_SECRET minimum to 32 characters
- Bucket AI rate limits by resumeId/threadId/messageId
- Trim form values before submitting AI provider config
- Use single key identifier and nullish-coalesce baseURL display

* fix: address ai agent review feedback

* fix: preserve mobile agent chat state

* docs: add ai agent workspace guides

* feat: introduce design system for Reactive Resume

apps/web/src/routes/builder/$resumeId/-components/assistant-store.test.ts

@@ -1,28 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { useBuilderAssistantStore } from "./assistant-store";
-
-afterEach(() => useBuilderAssistantStore.setState({ isOpen: false }));
-
-describe("useBuilderAssistantStore", () => {
-	it("starts closed", () => {
-		expect(useBuilderAssistantStore.getState().isOpen).toBe(false);
-	});
-
-	it("setOpen overrides the open state directly", () => {
-		useBuilderAssistantStore.getState().setOpen(true);
-		expect(useBuilderAssistantStore.getState().isOpen).toBe(true);
-
-		useBuilderAssistantStore.getState().setOpen(false);
-		expect(useBuilderAssistantStore.getState().isOpen).toBe(false);
-	});
-
-	it("toggleOpen flips the state", () => {
-		const { toggleOpen } = useBuilderAssistantStore.getState();
-
-		toggleOpen();
-		expect(useBuilderAssistantStore.getState().isOpen).toBe(true);
-
-		toggleOpen();
-		expect(useBuilderAssistantStore.getState().isOpen).toBe(false);
-	});
-});

apps/web/src/routes/builder/$resumeId/-components/assistant-store.ts

@@ -1,13 +0,0 @@
-import { create } from "zustand/react";
-
-type BuilderAssistantStore = {
-	isOpen: boolean;
-	setOpen: (isOpen: boolean) => void;
-	toggleOpen: () => void;
-};
-
-export const useBuilderAssistantStore = create<BuilderAssistantStore>((set) => ({
-	isOpen: false,
-	setOpen: (isOpen) => set({ isOpen }),
-	toggleOpen: () => set((state) => ({ isOpen: !state.isOpen })),
-}));

apps/web/src/routes/builder/$resumeId/-components/dock.tsx

@@ -14,6 +14,7 @@ import {
 	MagnifyingGlassMinusIcon,
 	MagnifyingGlassPlusIcon,
 } from "@phosphor-icons/react";
+import { useNavigate } from "@tanstack/react-router";
 import { motion } from "motion/react";
 import { useCallback, useMemo, useState } from "react";
 import { useControls } from "react-zoom-pan-pinch";
@@ -27,7 +28,6 @@ import { cn } from "@reactive-resume/utils/style";
 import { useCurrentResume } from "@/components/resume/builder-resume-draft";
 import { authClient } from "@/libs/auth/client";
 import { createResumePdfBlob } from "@/libs/resume/pdf-document";
-import { useBuilderAssistantStore } from "./assistant-store";
 
 type BuilderDockProps = {
 	pageLayout: BuilderPreviewPageLayout;
@@ -37,13 +37,12 @@ type BuilderDockProps = {
 export function BuilderDock({ pageLayout, onTogglePageLayout }: BuilderDockProps) {
 	const { data: session } = authClient.useSession();
 	const resume = useCurrentResume();
+	const navigate = useNavigate();
 
 	const [_, copyToClipboard] = useCopyToClipboard();
 	const { zoomIn, zoomOut, centerView } = useControls();
 
 	const [isPrinting, setIsPrinting] = useState(false);
-	const isAssistantOpen = useBuilderAssistantStore((state) => state.isOpen);
-	const toggleAssistant = useBuilderAssistantStore((state) => state.toggleOpen);
 
 	const publicUrl = useMemo(() => {
 		if (!session?.user.username || !resume?.slug) return "";
@@ -114,9 +113,11 @@ export function BuilderDock({ pageLayout, onTogglePageLayout }: BuilderDockProps
 				/>
 				<DockIcon
 					icon={ChatCircleDotsIcon}
-					title={isAssistantOpen ? t`Close AI assistant` : t`Open AI assistant`}
-					onClick={toggleAssistant}
-					active={isAssistantOpen}
+					title={t`Open AI agent`}
+					onClick={() => {
+						if (!resume) return;
+						void navigate({ to: "/agent/new", search: { resumeId: resume.id } });
+					}}
 				/>
 				<div className="mx-1 h-8 w-px bg-border" />
 				<DockIcon icon={LinkSimpleIcon} title={t`Copy URL`} onClick={() => onCopyUrl()} />

apps/web/src/routes/builder/$resumeId/-components/preview-page.tsx

@@ -28,7 +28,7 @@ export function PreviewPage() {
 					wheel={{ step: 0.001 }}
 				>
 					<TransformComponent wrapperClass="h-full! w-full!">
-						<ResumePreview pageGap="2rem" pageLayout={pageLayout} showPageNumbers />
+						<ResumePreview showPageNumbers pageLayout={pageLayout} />
 					</TransformComponent>
 
 					<BuilderDock

apps/web/src/routes/builder/$resumeId/-sidebar/right/sections/resume-analysis.tsx

@@ -6,7 +6,6 @@ import { Link } from "@tanstack/react-router";
 import { useMemo } from "react";
 import { toast } from "sonner";
 import { match } from "ts-pattern";
-import { useAIStore } from "@reactive-resume/ai/store";
 import { Alert, AlertDescription } from "@reactive-resume/ui/components/alert";
 import { Badge } from "@reactive-resume/ui/components/badge";
 import { Button } from "@reactive-resume/ui/components/button";
@@ -50,13 +49,11 @@ export function ResumeAnalysisSectionBuilder() {
 	const queryClient = useQueryClient();
 
 	const resume = useResume();
-	const aiEnabled = useAIStore((state) => state.enabled);
-	const aiProvider = useAIStore((state) => state.provider);
-	const aiModel = useAIStore((state) => state.model);
-	const aiApiKey = useAIStore((state) => state.apiKey);
-	const aiBaseURL = useAIStore((state) => state.baseURL);
 
 	const resumeId = resume?.id ?? "";
+	const providersQuery = useQuery(orpc.aiProviders.list.queryOptions());
+	const aiEnabled =
+		providersQuery.data?.some((provider) => provider.enabled && provider.testStatus === "success") ?? false;
 
 	const analysisQuery = useQuery({
 		...orpc.resume.analysis.getById.queryOptions({ input: { id: resumeId } }),
@@ -106,12 +103,7 @@ export function ResumeAnalysisSectionBuilder() {
 		if (!resume) return;
 
 		analyzeResume({
-			provider: aiProvider,
-			model: aiModel,
-			apiKey: aiApiKey,
-			baseURL: aiBaseURL,
 			resumeId: resume.id,
-			resumeData: resume.data,
 		});
 	};
 

apps/web/src/routes/builder/$resumeId/route.tsx

@@ -17,7 +17,6 @@ import {
 } from "@/components/resume/builder-resume-draft";
 import { useIsMobile } from "@/hooks/use-mobile";
 import { orpc } from "@/libs/orpc/client";
-import { BuilderAssistant } from "./-components/assistant";
 import { BuilderHeader } from "./-components/header";
 import { BuilderSidebarLeft } from "./-sidebar/left";
 import { BuilderSidebarRight } from "./-sidebar/right";
@@ -168,8 +167,6 @@ function BuilderLayoutShell({ initialLayout }: BuilderLayoutShellProps) {
 					<BuilderSidebarRight />
 				</ResizablePanel>
 			</ResizableGroup>
-
-			<BuilderAssistant />
 		</div>
 	);
 }