feat(ai-chat): agent write tools, provenance wiring, chat panel + provider settings UI" -m "Backend:

- Add reversible write tools to the per-user agent toolset (page create/update/
  move/soft-delete; comment reply + resolve), exposed under the user's JWT and
  enforced by Docmost CASL; no permanent/force delete (D3).
- Non-spoofable agent provenance: sign actor/aiChatId into the access and collab
  tokens (TokenService), propagate via jwt.strategy onto the request, and set
  pages.last_updated_source/last_updated_ai_chat_id on REST create/update/move and
  comments.created_source/resolved_source/ai_chat_id.
- packages/mcp: add an optional getCollabToken provider (content-edit provenance)
  and guard against empty tokens; service-account /mcp path unchanged.

Frontend:
- Admin 'AI / Models' settings section: provider/model/embedding/base URL, a
  write-only API key field, system prompt, and Test connection.
- AI chat panel (useChat + DefaultChatTransport): conversation list, streamed
  messages, tool-call action log and page citations; header entry point gated on
  settings.ai.chat.

Compile-verified (server nest build + client tsc/vite); not yet live-tested.
Known gaps: history 'AI agent' badge (C3), vector RAG (D), external MCP (E);
chat tool-card citation links pending a fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/mcp/build/client.js

@@ -29,6 +29,10 @@ export class DocmostClient {
     // Per-user token provider. When set, login() calls it to obtain a BARE access
     // JWT instead of performLogin, and the 401/403 re-auth path re-calls it.
     getTokenFn = null;
+    // Optional collab-token provider. When set, getCollabTokenWithReauth() returns
+    // its token instead of calling POST /auth/collab-token; on a 401/403 it is
+    // re-invoked once. Used by the internal agent to carry signed provenance.
+    getCollabTokenFn = null;
     // In-flight login dedup: when the token expires, the 401 interceptor,
     // ensureAuthenticated, getCollabTokenWithReauth and the two multipart retries
     // can all call login() at once. Memoizing a single promise collapses that
@@ -50,6 +54,11 @@ export class DocmostClient {
             this.email = config.email;
             this.password = config.password;
         }
+        // Optional, available to both variants. When present, content mutations get
+        // their collab token from here instead of POST /auth/collab-token.
+        if (config.getCollabToken) {
+            this.getCollabTokenFn = config.getCollabToken;
+        }
         this.client = axios.create({
             baseURL: this.apiUrl,
             // Default request timeout so a hung connection cannot wedge a per-page
@@ -112,6 +121,13 @@ export class DocmostClient {
                 : performLogin(this.apiUrl, this.email, this.password);
             this.loginPromise = fetchToken
                 .then((token) => {
+                // Guard against an empty/invalid token (e.g. a getToken provider that
+                // resolves to "" or null): without this an empty token would set a
+                // literal "Authorization: Bearer null"/"Bearer " header and every
+                // request would 401 with a confusing error. Fail loudly instead.
+                if (typeof token !== "string" || token.length === 0) {
+                    throw new Error("getToken returned an empty token");
+                }
                 this.token = token;
                 this.client.defaults.headers.common["Authorization"] =
                     `Bearer ${token}`;
@@ -135,6 +151,37 @@ export class DocmostClient {
      * expired-token auth error perform a fresh login and retry exactly once.
      */
     async getCollabTokenWithReauth() {
+        // Collab-token PROVIDER path: when a getCollabToken provider was supplied
+        // (the internal agent's provenance collab token), use it instead of the
+        // REST /auth/collab-token endpoint. Re-invoke it once on a 401/403 (e.g. the
+        // signed token expired between content mutations in a long agent turn).
+        if (this.getCollabTokenFn) {
+            try {
+                const token = await this.getCollabTokenFn();
+                if (typeof token !== "string" || token.length === 0) {
+                    throw new Error("getCollabToken returned an empty token");
+                }
+                return token;
+            }
+            catch (e) {
+                const axiosStatus = axios.isAxiosError(e)
+                    ? e.response?.status
+                    : undefined;
+                const attachedStatus = e?.status;
+                const isAuthError = axiosStatus === 401 ||
+                    axiosStatus === 403 ||
+                    attachedStatus === 401 ||
+                    attachedStatus === 403;
+                if (isAuthError) {
+                    const token = await this.getCollabTokenFn();
+                    if (typeof token !== "string" || token.length === 0) {
+                        throw new Error("getCollabToken returned an empty token");
+                    }
+                    return token;
+                }
+                throw e;
+            }
+        }
         await this.ensureAuthenticated();
         try {
             return await getCollabToken(this.apiUrl, this.token);
@@ -1466,6 +1513,25 @@ export class DocmostClient {
             .post("/comments/delete", { commentId })
             .then((res) => res.data);
     }
+    /**
+     * Resolve or reopen a top-level comment thread (reversible — `resolved`
+     * toggles the state). Only top-level comments can be resolved; the server
+     * rejects resolving a reply. Hits POST /comments/resolve.
+     */
+    async resolveComment(commentId, resolved) {
+        await this.ensureAuthenticated();
+        const response = await this.client.post("/comments/resolve", {
+            commentId,
+            resolved,
+        });
+        const comment = response.data?.data ?? response.data;
+        return {
+            success: true,
+            commentId,
+            resolved,
+            comment,
+        };
+    }
     /**
      * Check for new comments across pages in a space (optionally scoped to a
      * subtree): pages updated after `since` are scanned and their comments