feat(agent): adopt AI SDK v7 — crash safety, context pruning, HITL approvals (#3362)

* docs(adr): propose agent AI SDK v7 adoption plan

* fix(ai): bind analyzeResume through aiService in service test

The test destructured analyzeResume as a named export that does not exist; main was red.

* test(agent): keep pure ai helpers real via spread-actual mock factory

* feat(agent): add run guards, patch version guard, run wall-clock timeout

* feat(agent): validate UI messages at the send boundary

* feat(agent): crash-safe draft-row persistence and server-side cancellation

* feat(agent): reap stale run claims at boot, on send, and on thread open

* feat(agent): fresh-document patch output and tiered context pruning

* feat(ai): shared agent tool contracts and message metadata schema

* feat(agent): add per-thread review-patches setting with update endpoint

* feat(agent): gate resume patches behind hmac-signed tool approval

* feat(agent): merge question answers and approval decisions before run claim

* feat(agent): approval ui with composed auto-send and fixture-driven tests

* feat(agent): usage metadata, tool activity cards, smoother streaming

* feat(agent): tool-call repair, input examples, structured step logging

* chore(i18n): translate new agent workspace strings across all locales

* fix(agent): gate stale-run draft cancellation on winning the claim clear

Snapshot streaming drafts before the conditional clear and skip the flip entirely when another reaper or a replacement run already cleared the claim. Also address review nits in eleven locale catalogs.

* fix(agent): flip reaped drafts only when their snapshotted state is unchanged

* fix(agent): address review findings across run lifecycle, context budget, and approval flow

- bind patches to the revision the model read via signed baseUpdatedAt
- claim the run before consuming a continuation; recorded-but-unexecuted approvals retry as pending continuations
- keep run ownership on stop() until cancellation persists; preserve the claim for the reaper when final persistence fails
- estimate tokens without serializing binary attachments (tokenx) and enforce the budget by dropping oldest whole turns
- mark crash-recovered patch results as snapshot boundaries; strip /data prefixes at execution time
- retry failed continuations without regenerate; mount a single AgentChat; disable response controls on read-only threads; freeze review toggle during runs (client+server)
- accumulate usage across continuations and match the SDK's nested usage shape; label-form token strings; reorderable source label; accessible note field; state-neutral web-search label

* chore(i18n): translate revised agent strings across all locales

* fix(agent): harden baseUpdatedAt validation and address review follow-ups

- bundle tokenx in the server runtime dependencies (e2e boot failure)
- strict ISO schema for baseUpdatedAt plus loud executor rejection of unparseable values
- it-IT source label consistency (Fonte)
- prove penultimate-turn retention in the context pruning test

* chore(deps): exempt tokenx from knip for the externalized server bundle

apps/web/locales/af-ZA.po

@@ -543,6 +543,14 @@ msgstr "Aansoek gedoen"
 msgid "Applied on"
 msgstr "Toegepas op"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Approve"
+msgstr "Keur goed"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Approved — waiting for the agent…"
+msgstr "Goedgekeur — wag vir die agent…"
+
 #: src/libs/locale.ts
 msgid "Arabic"
 msgstr "Arabies"
@@ -1462,6 +1470,14 @@ msgstr "Besig om jou API-sleutel uit te vee..."
 msgid "Deleting your resume..."
 msgstr "Besig om jou CV uit te vee..."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Denied — waiting for the agent…"
+msgstr "Geweier — wag vir die agent…"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Deny"
+msgstr "Weier"
+
 #: src/libs/resume/ats.ts
 msgid "Describe what you did so the entry contributes keywords for matching."
 msgstr "Beskryf wat jy gedoen het sodat die inskrywing sleutelwoorde vir passing bydra."
@@ -1530,6 +1546,10 @@ msgstr "Skenk"
 msgid "Donate to Reactive Resume"
 msgstr "Skenk aan Reactive Resume"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Done"
+msgstr "Klaar"
+
 #. Action button to download two-factor backup codes as a text file
 #. Primary action in the builder header to open resume download options
 #: src/dialogs/auth/enable-two-factor.tsx
@@ -1642,6 +1662,10 @@ msgstr "Bewerk inhoud in volskermmodus"
 msgid "Edit date"
 msgstr "Wysig datum"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Edit declined"
+msgstr "Wysiging afgekeur"
+
 #. Resume card context menu action to edit resume metadata
 #. Resume card dropdown action to edit resume metadata
 #: src/routes/builder/$resumeId/-components/header.tsx
@@ -1837,6 +1861,10 @@ msgstr "Voer jou CV onmiddellik na PDF uit, sonder enige wagtyd of vertragings."
 msgid "Exported pipeline-flow.png"
 msgstr "Uitgevoerde pyplyn-vloei.png"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Failed"
+msgstr "Misluk"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/resume-analysis.tsx
 msgid "Failed to analyze resume."
 msgstr "Het misluk om die CV te ontleed."
@@ -1967,6 +1995,10 @@ msgstr "Misluk om die verskaffer los te koppel. Probeer asseblief weer."
 msgid "Failed to update provider."
 msgstr "Kon nie verskaffer opdateer nie."
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Failed to update thread settings."
+msgstr "Kon nie draadinstellings opdateer nie."
+
 #. Fallback toast when changing account password fails
 #: src/dialogs/auth/change-password.tsx
 msgid "Failed to update your password. Please try again."
@@ -3153,6 +3185,14 @@ msgstr "OpenRouter"
 msgid "opens in new tab"
 msgstr "maak in nuwe oortjie oop"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Optional note for the agent"
+msgstr "Opsionele nota vir die agent"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Optional note for the agent…"
+msgstr "Opsionele nota vir die agent…"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/sharing.tsx
 msgid "Optionally, set a password so that only people with the password can view your resume through the link."
 msgstr "Jy kan opsioneel 'n wagwoord stel sodat slegs mense met die wagwoord jou CV via die skakel kan bekyk."
@@ -3499,6 +3539,10 @@ msgstr "Publikasies"
 msgid "Publisher"
 msgstr "Uitgewer"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Raw JSON"
+msgstr "Rou JSON"
+
 #: src/features/applications/components/application-ai-copilot.tsx
 msgid "Re-score"
 msgstr "Hertelling"
@@ -3546,10 +3590,18 @@ msgstr "Reaktiewe CV v<0>{__APP_VERSION__}</0>"
 msgid "Reactive Resume v4 (JSON)"
 msgstr "Reaktiewe CV v4 (JSON)"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Read an attachment"
+msgstr "Het 'n aanhegsel gelees"
+
 #: src/features/resume/stylesheet/editor.tsx
 msgid "Read the Applying Custom Styles guide."
 msgstr "Lees die gids oor die toepassing van persoonlike style."
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Read the resume"
+msgstr "Het die CV gelees"
+
 #: src/features/applications/components/application-form-sheet.tsx
 msgid "Reading the posting…"
 msgstr "Lees die werksplasing…"
@@ -3700,8 +3752,8 @@ msgid "Restore"
 msgstr "Herstel"
 
 #: src/routes/agent/-components/agent-chat.tsx
-msgid "Restore the resume to before this patch? This will roll back this patch and any patches applied after it."
-msgstr "Herstel die CV na voor hierdie opdatering? Dit sal hierdie opdatering en enige opdaterings wat daarna toegepas is, terugrol."
+msgid "Restore the resume to before this patch?"
+msgstr "Herstel die CV na die toestand voor hierdie pleister?"
 
 #: src/routes/builder/$resumeId/-components/version-history.tsx
 msgid "Restore this version?"
@@ -3726,6 +3778,10 @@ msgstr "CV-analise voltooi."
 msgid "Resume content"
 msgstr "CV-inhoud"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Resume edit"
+msgstr "CV-wysiging"
+
 #: src/features/applications/components/application-detail-sheet.tsx
 msgid "Resume file"
 msgstr "CV-lêer"
@@ -3754,10 +3810,18 @@ msgstr "CV's"
 msgid "Retry"
 msgstr "Probeer weer"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Review edits"
+msgstr "Hersien wysigings"
+
 #: src/routes/agent/-components/agent-chat.tsx
 msgid "Review the resume against a job description and ask me questions before changing uncertain sections."
 msgstr "Hersien die CV teenoor 'n posbeskrywing en vra my vrae voordat jy onsekere afdelings verander."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Review this edit"
+msgstr "Hersien hierdie wysiging"
+
 #: src/routes/agent/-components/agent-chat.tsx
 msgid "Rework the summary so it targets a senior engineering manager role without sounding generic."
 msgstr "Hersien die opsomming sodat dit op 'n senior ingenieursbestuurderrol gemik is sonder om generies te klink."
@@ -3798,6 +3862,10 @@ msgstr "Rotasie"
 msgid "Run your first analysis to get a scorecard, strengths, and prioritized suggestions."
 msgstr "Voer jou eerste ontleding uit om 'n puntkaart, sterkpunte en geprioritiseerde voorstelle te kry."
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Running…"
+msgstr "Besig…"
+
 #: src/libs/locale.ts
 msgid "Russian"
 msgstr "Russies"
@@ -4253,6 +4321,15 @@ msgstr "Bron"
 msgid "Source Code"
 msgstr "Bronkode"
 
+#. placeholder {0}: operation.from
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Source: {0}"
+msgstr "Bron: {0}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Sources"
+msgstr "Bronne"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/page.tsx
 msgid "Spacing (Horizontal)"
 msgstr "Spasiëring (horisontaal)"
@@ -4604,6 +4681,10 @@ msgstr "Hierdie assistent kon nie oopgemaak word nie."
 msgid "This date will not be read correctly."
 msgstr "Hierdie datum sal nie korrek gelees word nie."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "This edit request can no longer be answered."
+msgstr "Hierdie wysigingsversoek kan nie meer beantwoord word nie."
+
 #: src/libs/resume/ats.ts
 msgid "This email address will not be recognized."
 msgstr "Hierdie e-posadres sal nie herken word nie."
@@ -4712,6 +4793,10 @@ msgstr "Dit sal jou help om dit later te identifiseer, as jy beplan om verskeie
 msgid "This will remove all items from this section."
 msgstr "Dit sal alle items uit hierdie afdeling verwyder."
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "This will roll back this patch and any patches applied after it."
+msgstr "Dit sal hierdie pleister en enige pleisters wat daarna toegepas is, terugrol."
+
 #: src/routes/agent/-components/agent-chat.tsx
 #: src/routes/agent/-components/thread-sidebar.tsx
 msgid "Thread actions"
@@ -4794,6 +4879,18 @@ msgstr "Skakel regterkantpaneel aan"
 msgid "Toggle threads"
 msgstr "Wissel drade"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {threadTokenTotal}"
+msgstr "Tokens: {threadTokenTotal}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {total}"
+msgstr "Tokens: {total}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {total} ({cached} cached)"
+msgstr "Tokens: {total} ({cached} gekas)"
+
 #: src/features/applications/components/application-form-sheet.tsx
 msgid "Track a job you're applying to and link the resume you sent."
 msgstr "Volg 'n werk waarvoor jy aansoek doen en skakel die CV wat jy gestuur het."
@@ -5213,6 +5310,10 @@ msgstr "Ons kon nie die formaat outomaties opspoor nie — kies dit asseblief hi
 msgid "We couldn't find that page"
 msgstr "Ons kon nie daardie bladsy vind nie"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Web search"
+msgstr "Websoektog"
+
 #: src/dialogs/resume/sections/award.tsx
 #: src/dialogs/resume/sections/certification.tsx
 #: src/dialogs/resume/sections/education.tsx
@@ -5445,4 +5546,3 @@ msgstr "Zoem uit"
 #: src/libs/locale.ts
 msgid "Zulu"
 msgstr "Zoeloe"
-