feat(workshop): retain daily assistant quotas

apps/docs/docs/workshop/homarr-provider.mdx

@@ -38,8 +38,10 @@ its server; changing the browser clock cannot bypass them.
 Workshop keeps the OpenRouter API key on its server. Homarr and the browser never receive it.
 
 Prompts, attachments, tools, and tool results pass through Workshop and OpenRouter. Workshop does not retain this
-content or the responses. It stores only the user, UTC day, and counters needed to enforce allowances. OpenRouter is
-configured for zero data retention with data collection disabled. Homarr does not use this content to train models.
+content or the responses. It stores only the user, UTC day, and counters needed to enforce allowances. Each active day
+has a separate quota record so Workshop operators can inspect per-user daily usage without seeing request content.
+OpenRouter is configured for zero data retention with data collection disabled. Homarr does not use this content to
+train models.
 
 We would rather become millionaires in a more ethical manner.
 

apps/docs/docs/workshop/operator.mdx

@@ -72,6 +72,9 @@ per-request telemetry. It accepts only uploaded image data, conservatively bound
 allows at most two concurrent requests per user and 100 across the service. Keep an OpenRouter account-level credit
 limit as the final monetary backstop because request quotas are not dollar accounting.
 
+PocketBase stores one `assistant_quotas` record per user and active UTC day. Workshop superusers can use this private
+collection for a daily usage breakdown; regular users cannot list or view its records.
+
 Run `pnpm test:workshop` to test authentication, streaming, UTC reset, atomic per-user and global quota enforcement,
 failed-request accounting, identity attribution, server-selected model routing, function tools, input and output
 controls, privacy routing, spoofing resistance, absence of request logs, and migration rollback.

apps/nextjs/src/app/api/assistant/chat/assistant-tool-input-repair.ts

@@ -89,8 +89,9 @@ const repairIconSearchInput = <T extends AssistantToolCallInput>(toolCall: T): T
   };
 };
 
-const repairCustomWidgetToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null => {
-  if (!toolCall.toolName.startsWith("customWidget_")) return null;
+const repairMultilineToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null => {
+  const isCustomWidgetTool = toolCall.toolName.startsWith("customWidget_");
+  if (!isCustomWidgetTool && toolCall.toolName !== "configure_board_settings") return null;
   if (customWidgetNoInputToolNames.has(toolCall.toolName)) {
     try {
       const input = JSON.parse(toolCall.input) as unknown;
@@ -114,4 +115,4 @@ const repairCustomWidgetToolInput = <T extends AssistantToolCallInput>(toolCall:
 };
 
 export const repairAssistantToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null =>
-  repairIconSearchInput(toolCall) ?? repairCustomWidgetToolInput(toolCall);
+  repairIconSearchInput(toolCall) ?? repairMultilineToolInput(toolCall);

apps/nextjs/src/app/api/assistant/chat/route.ts

@@ -146,12 +146,12 @@ Homarr concepts:
 
 Action rules:
 - Prefer read-only tools before actions.
-- Whenever you need an answer from the user before choosing the next action, call ask_user. Never end a prose response with a question that expects the user to type a reply. Offer distinct choices, categorize agreement or proceeding as affirmative, refusal as negative, and unrelated selections as alternative, then leave the freeform Other answer enabled. A confirmation question must have exactly one affirmative option. Purely rhetorical questions and open-ended conversation that does not block an action may remain prose, but optional next steps should be stated declaratively instead of phrased as a question.
+- Whenever you need an answer from the user before choosing the next action, call ask_user. Never use ask_user to confirm a board settings or custom CSS change before configure_board_settings, or to confirm another change whose inputs are already sufficient for its native review form or mutating tool. Never end a prose response with a question that expects the user to type a reply. Offer distinct choices, categorize agreement or proceeding as affirmative, refusal as negative, and unrelated selections as alternative, then leave the freeform Other answer enabled. A confirmation question must have exactly one affirmative option. Purely rhetorical questions and open-ended conversation that does not block an action may remain prose, but optional next steps should be stated declaratively instead of phrased as a question.
 - Mutating Homarr tools already pause for native user approval. Calling a mutation only proposes the action; it cannot execute until the user selects Approve and run. Once the requested change is sufficiently specified, call the mutation immediately so the approval UI appears.
 - A prose response such as "Please confirm if you would like me to proceed", "Would you like me to proceed?", or a parameter summary that asks for confirmation is incorrect. Never ask for a second textual confirmation before an approval-gated tool call.
 - Do not retry a denied action.
 - Before creating an app, call configure_app with the app name and every useful default you can infer, including its description, href, pingUrl, and an icon URL returned by icon_findIcons. The user reviews Homarr's native app form. Its icon picker searches Homarr's local icon repository. Use the returned values for app_create. If the user asked to place it on a board, call configure_widget afterward with kind "app" and options { appId: the returned appId }.
-- Before changing a board's custom CSS or visual and behavior settings, call board_getBoardSettings to read the current values, then call configure_board_settings with only the requested proposed changes. The user can edit the complete CSS and settings in Homarr's native form. Use its returned flat object for board_savePartialBoardSettings, which then shows the mutation approval. Never overwrite existing CSS rules unless the user explicitly requests replacement.
+- Before changing a board's custom CSS or visual and behavior settings, call board_getBoardSettings to read the current values, then immediately call configure_board_settings with only the requested proposed changes. For a custom CSS request, include the complete resulting stylesheet in changes.customCss so the native form is prefilled and previews the proposed CSS. The native form is the user's review and confirmation step, so never insert ask_user between these calls when the requested change is known. Use the form's returned flat object for board_savePartialBoardSettings, which then shows the mutation approval. Never overwrite existing CSS rules unless the user explicitly requests replacement.
 - Before adding any widget to a board, call configure_widget with the target board, widget kind, proposed options, and any integration IDs selected from integration_all. Homarr's native widget editor applies defaults, validates the options, and restricts the picker to compatible integrations the user can access. Use the returned boardId, kind, options, and integrationIds exactly as the input to board_addItem. If configure_widget returns cancelled, do not add the widget.
 - To create a formatted note on a dashboard, call configure_widget with kind "notebook". Put valid Tiptap-compatible HTML in options.content and set options.showToolbar and options.allowReadOnlyCheck when useful. Use semantic paragraphs, headings, lists, task lists, blockquotes, tables, links, emphasis, and images as appropriate. Never include scripts, styles, iframes, event handlers, or unsafe URL protocols.
 - When choosing an app icon without configure_app, call the Homarr icon findIcons tool first and use one of its returned local icon URLs. Never invent a third-party icon CDN URL.

apps/nextjs/src/components/assistant/assistant-tool-contracts.ts

@@ -54,7 +54,7 @@ export const assistantBoardSettingsChangesSchema = z
 export const browserToolContracts = {
   ask_user: {
     description:
-      "Pause and ask the user one concise structured question. Use this for missing information or a meaningful choice, never as a second confirmation before a mutating tool. Provide 2-4 distinct options and classify every option: agreement, approval, or proceeding is affirmative; refusal or stopping is negative; unrelated selections are alternative. A confirmation question must have exactly one affirmative option. The UI adds a freeform Other choice when allowOther is not false.",
+      "Pause and ask the user one concise structured question. Use this only for missing information or a meaningful choice, never to confirm details that are already sufficient for a native review form or mutating tool. In particular, do not use ask_user before configure_app, configure_board_settings, or configure_widget when their inputs are known. Provide 2-4 distinct options and classify every option: agreement, approval, or proceeding is affirmative; refusal or stopping is negative; unrelated selections are alternative. A confirmation question must have exactly one affirmative option. The UI adds a freeform Other choice when allowOther is not false.",
     parameters: z.object({
       question: z.string().trim().min(1).max(240),
       description: z.string().trim().max(400).optional(),
@@ -82,7 +82,7 @@ export const browserToolContracts = {
   },
   configure_board_settings: {
     description:
-      "Open Homarr's native board settings and custom CSS review form. Always call board_getBoardSettings first, then pass only the requested proposed changes here. The user can edit the complete stylesheet and all supported settings. Use the returned flat object directly with board_savePartialBoardSettings; do not ask for confirmation in prose.",
+      "Open Homarr's native board settings and custom CSS review form. This form is the user's confirmation step. Always call board_getBoardSettings first, then call this tool directly with only the requested proposed changes, including the complete resulting stylesheet in changes.customCss for a CSS request. Do not call ask_user between those tools when the requested changes are known. The user can edit the complete stylesheet and all supported settings. Use the returned flat object directly with board_savePartialBoardSettings.",
     parameters: z.object({
       boardId: z.string().trim().min(1).max(64),
       boardName: z.string().trim().min(1).max(255),

apps/workshop/homarr_provider.go

@@ -605,7 +605,12 @@ func (provider *homarrProvider) loadQuota(
 	user *core.Record,
 	now time.Time,
 ) (*core.Record, quotaSnapshot, bool, error) {
-	quota, err := app.FindFirstRecordByFilter("assistant_quotas", "user = {:user}", dbx.Params{"user": user.Id})
+	day := now.Format(time.DateOnly)
+	quota, err := app.FindFirstRecordByFilter(
+		"assistant_quotas",
+		"user = {:user} && day = {:day}",
+		dbx.Params{"user": user.Id, "day": day},
+	)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
 		return nil, quotaSnapshot{}, false, err
 	}
@@ -617,10 +622,7 @@ func (provider *homarrProvider) loadQuota(
 		}
 		quota = core.NewRecord(collection)
 		quota.Set("user", user.Id)
-		changed = true
-	}
-	if quota.GetString("day") != now.Format(time.DateOnly) {
-		quota.Set("day", now.Format(time.DateOnly))
+		quota.Set("day", day)
 		quota.Set("used", 0)
 		changed = true
 	}

apps/workshop/pb_migrations/1787670446_daily_assistant_quotas.js

@@ -0,0 +1,36 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+migrate(
+  (app) => {
+    const quotas = app.findCollectionByNameOrId("assistant_quotas");
+    quotas.removeIndex("idx_assistant_quotas_user");
+    quotas.addIndex("idx_assistant_quotas_user_day", true, "user, day", "");
+    app.save(quotas);
+  },
+  (app) => {
+    const quotas = app.findCollectionByNameOrId("assistant_quotas");
+    quotas.removeIndex("idx_assistant_quotas_user_day");
+
+    // The previous schema can keep only one record per user. Retain the latest UTC day when rolling back.
+    app
+      .db()
+      .newQuery(`
+        DELETE FROM assistant_quotas
+        WHERE id NOT IN (
+          SELECT (
+            SELECT candidate.id
+            FROM assistant_quotas candidate
+            WHERE candidate.user = quota_user.user
+            ORDER BY candidate.day DESC, candidate.created DESC, candidate.id DESC
+            LIMIT 1
+          )
+          FROM assistant_quotas quota_user
+          GROUP BY quota_user.user
+        )
+      `)
+      .execute();
+
+    quotas.addIndex("idx_assistant_quotas_user", true, "user", "");
+    app.save(quotas);
+  },
+);

apps/workshop/tests/workshop-contracts.mjs

@@ -82,6 +82,14 @@ for (const forbidden of ['name: "assistant_requests"', 'name: "assistant_activit
   if (providerMigration.includes(forbidden)) throw new Error(`Homarr provider must not persist ${forbidden}`);
 }
 
+const dailyQuotaMigration = await read("apps/workshop/pb_migrations/1787670446_daily_assistant_quotas.js");
+for (const required of [
+  'removeIndex("idx_assistant_quotas_user")',
+  'addIndex("idx_assistant_quotas_user_day", true, "user, day", "")',
+]) {
+  if (!dailyQuotaMigration.includes(required)) throw new Error(`Daily quota migration is missing: ${required}`);
+}
+
 const providerBackend = await read("apps/workshop/homarr_provider.go");
 for (const required of [
   '"homarr/model"',

apps/workshop/tests/workshop.integration.mjs

@@ -436,9 +436,21 @@ const resetUsage = await request("/api/ai/usage", { headers: authorSession.heade
 if (resetUsage.limit !== 50 || resetUsage.used !== 0 || resetUsage.remaining !== 50) {
   throw new Error(`Quota did not reset at the UTC day boundary: ${JSON.stringify(resetUsage)}`);
 }
-const resetQuota = (
+const today = new Date().toISOString().slice(0, 10);
+const resetQuotas = (
   await request("/api/collections/assistant_quotas/records?perPage=20", { headers: rootHeaders })
-).items.find((item) => item.user === author.id);
+).items.filter((item) => item.user === author.id);
+const historicalQuota = resetQuotas.find((item) => item.id === authorQuota.id);
+const resetQuota = resetQuotas.find((item) => item.day === today);
+if (
+  resetQuotas.length !== 2 ||
+  historicalQuota?.day !== "2000-01-01" ||
+  historicalQuota.used !== 49 ||
+  !resetQuota ||
+  resetQuota.used !== 0
+) {
+  throw new Error(`Daily quota history was not preserved: ${JSON.stringify(resetQuotas)}`);
+}
 await request(`/api/collections/assistant_quotas/records/${resetQuota.id}`, {
   method: "PATCH",
   headers: rootHeaders,