feat(agent): adopt AI SDK v7 — crash safety, context pruning, HITL approvals (#3362)

* docs(adr): propose agent AI SDK v7 adoption plan

* fix(ai): bind analyzeResume through aiService in service test

The test destructured analyzeResume as a named export that does not exist; main was red.

* test(agent): keep pure ai helpers real via spread-actual mock factory

* feat(agent): add run guards, patch version guard, run wall-clock timeout

* feat(agent): validate UI messages at the send boundary

* feat(agent): crash-safe draft-row persistence and server-side cancellation

* feat(agent): reap stale run claims at boot, on send, and on thread open

* feat(agent): fresh-document patch output and tiered context pruning

* feat(ai): shared agent tool contracts and message metadata schema

* feat(agent): add per-thread review-patches setting with update endpoint

* feat(agent): gate resume patches behind hmac-signed tool approval

* feat(agent): merge question answers and approval decisions before run claim

* feat(agent): approval ui with composed auto-send and fixture-driven tests

* feat(agent): usage metadata, tool activity cards, smoother streaming

* feat(agent): tool-call repair, input examples, structured step logging

* chore(i18n): translate new agent workspace strings across all locales

* fix(agent): gate stale-run draft cancellation on winning the claim clear

Snapshot streaming drafts before the conditional clear and skip the flip entirely when another reaper or a replacement run already cleared the claim. Also address review nits in eleven locale catalogs.

* fix(agent): flip reaped drafts only when their snapshotted state is unchanged

* fix(agent): address review findings across run lifecycle, context budget, and approval flow

- bind patches to the revision the model read via signed baseUpdatedAt
- claim the run before consuming a continuation; recorded-but-unexecuted approvals retry as pending continuations
- keep run ownership on stop() until cancellation persists; preserve the claim for the reaper when final persistence fails
- estimate tokens without serializing binary attachments (tokenx) and enforce the budget by dropping oldest whole turns
- mark crash-recovered patch results as snapshot boundaries; strip /data prefixes at execution time
- retry failed continuations without regenerate; mount a single AgentChat; disable response controls on read-only threads; freeze review toggle during runs (client+server)
- accumulate usage across continuations and match the SDK's nested usage shape; label-form token strings; reorderable source label; accessible note field; state-neutral web-search label

* chore(i18n): translate revised agent strings across all locales

* fix(agent): harden baseUpdatedAt validation and address review follow-ups

- bundle tokenx in the server runtime dependencies (e2e boot failure)
- strict ISO schema for baseUpdatedAt plus loud executor rejection of unparseable values
- it-IT source label consistency (Fonte)
- prove penultimate-turn retention in the context pruning test

* chore(deps): exempt tokenx from knip for the externalized server bundle

apps/web/locales/sl-SI.po

@@ -543,6 +543,14 @@ msgstr "Prijavljeno"
 msgid "Applied on"
 msgstr "Uporabljeno na"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Approve"
+msgstr "Odobri"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Approved — waiting for the agent…"
+msgstr "Odobreno — čakanje na agenta…"
+
 #: src/libs/locale.ts
 msgid "Arabic"
 msgstr "Arabščina"
@@ -1462,6 +1470,14 @@ msgstr "Brišem vaš API ključ ..."
 msgid "Deleting your resume..."
 msgstr "Brišem vaš življenjepis..."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Denied — waiting for the agent…"
+msgstr "Zavrnjeno — čakanje na agenta…"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Deny"
+msgstr "Zavrni"
+
 #: src/libs/resume/ats.ts
 msgid "Describe what you did so the entry contributes keywords for matching."
 msgstr "Opišite, kaj ste storili, da vnos prispeva ključne besede za ujemanje."
@@ -1530,6 +1546,10 @@ msgstr "Donirajte"
 msgid "Donate to Reactive Resume"
 msgstr "Donirajte za Reactive Resume"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Done"
+msgstr "Končano"
+
 #. Action button to download two-factor backup codes as a text file
 #. Primary action in the builder header to open resume download options
 #: src/dialogs/auth/enable-two-factor.tsx
@@ -1642,6 +1662,10 @@ msgstr "Urejanje vsebine v celozaslonskem načinu"
 msgid "Edit date"
 msgstr "Uredi datum"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Edit declined"
+msgstr "Sprememba zavrnjena"
+
 #. Resume card context menu action to edit resume metadata
 #. Resume card dropdown action to edit resume metadata
 #: src/routes/builder/$resumeId/-components/header.tsx
@@ -1837,6 +1861,10 @@ msgstr "Izvozite svoj življenjepis v PDF takoj, brez čakanja ali zamud."
 msgid "Exported pipeline-flow.png"
 msgstr "Izvožen pipeline-flow.png"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Failed"
+msgstr "Ni uspelo"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/resume-analysis.tsx
 msgid "Failed to analyze resume."
 msgstr "Ni uspelo analizirati življenjepisa."
@@ -1967,6 +1995,10 @@ msgstr "Ni uspelo odvezati ponudnika. Poskusite znova."
 msgid "Failed to update provider."
 msgstr "Ponudnika ni bilo mogoče posodobiti."
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Failed to update thread settings."
+msgstr "Nastavitev niti ni bilo mogoče posodobiti."
+
 #. Fallback toast when changing account password fails
 #: src/dialogs/auth/change-password.tsx
 msgid "Failed to update your password. Please try again."
@@ -3153,6 +3185,14 @@ msgstr "OpenRouter"
 msgid "opens in new tab"
 msgstr "odpre se v novem zavihku"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Optional note for the agent"
+msgstr "Neobvezna opomba za agenta"
+
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Optional note for the agent…"
+msgstr "Neobvezna opomba za agenta…"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/sharing.tsx
 msgid "Optionally, set a password so that only people with the password can view your resume through the link."
 msgstr "Po želji nastavite geslo, tako da si lahko vaš življenjepis preko povezave ogledajo le tisti, ki imajo geslo."
@@ -3499,6 +3539,10 @@ msgstr "Publikacije"
 msgid "Publisher"
 msgstr "Založnik"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Raw JSON"
+msgstr "Neobdelan JSON"
+
 #: src/features/applications/components/application-ai-copilot.tsx
 msgid "Re-score"
 msgstr "Ponovno rezultat"
@@ -3546,10 +3590,18 @@ msgstr "Reaktivni življenjepis v<0>{__APP_VERSION__}</0>"
 msgid "Reactive Resume v4 (JSON)"
 msgstr "Reaktivni življenjepis v4 (JSON)"
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Read an attachment"
+msgstr "Prebral prilogo"
+
 #: src/features/resume/stylesheet/editor.tsx
 msgid "Read the Applying Custom Styles guide."
 msgstr "Preberite vodnik Uporaba slogov po meri."
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Read the resume"
+msgstr "Prebral življenjepis"
+
 #: src/features/applications/components/application-form-sheet.tsx
 msgid "Reading the posting…"
 msgstr "Branje objave…"
@@ -3700,8 +3752,8 @@ msgid "Restore"
 msgstr "Obnovi"
 
 #: src/routes/agent/-components/agent-chat.tsx
-msgid "Restore the resume to before this patch? This will roll back this patch and any patches applied after it."
-msgstr "Želite obnoviti življenjepis na stanje pred tem popravkom? S tem boste povrnili ta popravek in vse popravke, ki so bili uporabljeni po njem."
+msgid "Restore the resume to before this patch?"
+msgstr "Želite obnoviti življenjepis v stanje pred tem popravkom?"
 
 #: src/routes/builder/$resumeId/-components/version-history.tsx
 msgid "Restore this version?"
@@ -3726,6 +3778,10 @@ msgstr "Analiza življenjepisa je končana."
 msgid "Resume content"
 msgstr "Vsebina življenjepisa"
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Resume edit"
+msgstr "Urejanje življenjepisa"
+
 #: src/features/applications/components/application-detail-sheet.tsx
 msgid "Resume file"
 msgstr "Datoteka življenjepisa"
@@ -3754,10 +3810,18 @@ msgstr "Življenjepisi"
 msgid "Retry"
 msgstr "Poskusi znova"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Review edits"
+msgstr "Preglej spremembe"
+
 #: src/routes/agent/-components/agent-chat.tsx
 msgid "Review the resume against a job description and ask me questions before changing uncertain sections."
 msgstr "Preden spremenite negotove dele, preglejte življenjepis glede na opis delovnega mesta in mi postavite vprašanja."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Review this edit"
+msgstr "Preglej to spremembo"
+
 #: src/routes/agent/-components/agent-chat.tsx
 msgid "Rework the summary so it targets a senior engineering manager role without sounding generic."
 msgstr "Preoblikujte povzetek, da bo namenjen višjemu inženirskemu vodji, ne da bi zvenel generično."
@@ -3798,6 +3862,10 @@ msgstr "Rotacija"
 msgid "Run your first analysis to get a scorecard, strengths, and prioritized suggestions."
 msgstr "Izvedite prvo analizo in pridobite preglednico, prednosti in prednostne predloge."
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Running…"
+msgstr "Izvajanje…"
+
 #: src/libs/locale.ts
 msgid "Russian"
 msgstr "ruščina"
@@ -4253,6 +4321,15 @@ msgstr "Vir"
 msgid "Source Code"
 msgstr "Izvorna koda"
 
+#. placeholder {0}: operation.from
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "Source: {0}"
+msgstr "Vir: {0}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Sources"
+msgstr "Viri"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/page.tsx
 msgid "Spacing (Horizontal)"
 msgstr "Razmik (vodoravno)"
@@ -4604,6 +4681,10 @@ msgstr "Tega pomočnika ni bilo mogoče odpreti."
 msgid "This date will not be read correctly."
 msgstr "Ta datum ne bo pravilno prebran."
 
+#: src/routes/agent/-components/patch-approval-card.tsx
+msgid "This edit request can no longer be answered."
+msgstr "Na to zahtevo za urejanje ni več mogoče odgovoriti."
+
 #: src/libs/resume/ats.ts
 msgid "This email address will not be recognized."
 msgstr "Ta e-poštni naslov ne bo prepoznan."
@@ -4712,6 +4793,10 @@ msgstr "Če nameravate imeti več ključev, vam bo to pomagalo pri kasnejši ide
 msgid "This will remove all items from this section."
 msgstr "S tem boste odstranili vse elemente iz tega razdelka."
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "This will roll back this patch and any patches applied after it."
+msgstr "To bo razveljavilo ta popravek in vse popravke, uporabljene po njem."
+
 #: src/routes/agent/-components/agent-chat.tsx
 #: src/routes/agent/-components/thread-sidebar.tsx
 msgid "Thread actions"
@@ -4794,6 +4879,18 @@ msgstr "Preklapljanje desne stranske vrstice"
 msgid "Toggle threads"
 msgstr "Preklopi niti"
 
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {threadTokenTotal}"
+msgstr "Žetoni: {threadTokenTotal}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {total}"
+msgstr "Žetoni: {total}"
+
+#: src/routes/agent/-components/agent-chat.tsx
+msgid "Tokens: {total} ({cached} cached)"
+msgstr "Žetoni: {total} ({cached} predpomnjenih)"
+
 #: src/features/applications/components/application-form-sheet.tsx
 msgid "Track a job you're applying to and link the resume you sent."
 msgstr "Sledite delovnemu mestu, na katerega se prijavljate, in povežite življenjepis, ki ste ga poslali."
@@ -5213,6 +5310,10 @@ msgstr "Oblike ni bilo mogoče samodejno zaznati – izberite jo zgoraj."
 msgid "We couldn't find that page"
 msgstr "Te strani nismo mogli najti."
 
+#: src/routes/agent/-components/tool-part-card.tsx
+msgid "Web search"
+msgstr "Spletno iskanje"
+
 #: src/dialogs/resume/sections/award.tsx
 #: src/dialogs/resume/sections/certification.tsx
 #: src/dialogs/resume/sections/education.tsx
@@ -5445,4 +5546,3 @@ msgstr "Oddalji"
 #: src/libs/locale.ts
 msgid "Zulu"
 msgstr "Zuluščina"
-