@jxsuite/studio 5.5.0 → 5.7.0

package/src/services/harness/turn-hooks.ts

@@ -0,0 +1,50 @@
+/**
+ * Turn-hooks.ts — what Studio does between the turn engine's steps.
+ *
+ * @license MIT
+ */
+
+import type { TurnHooks } from "@jxsuite/ai/harness";
+import { ensureProxyProbe, resetModelCache } from "../ai-models";
+
+/** What Studio's hooks act on, injected so the hooks hold no state of their own. */
+export interface StudioTurnHookDeps {
+  /** Whether the conversation the turn answers has left the transcript (another chat was opened). */
+  superseded: () => boolean;
+  /** Called once a call settles into a transcript that replaced the turn's own. */
+  onSuperseded: () => void;
+  /** Re-anchor the undo batch on the document the tools now edit (specs/ai.md §3.3). */
+  reanchor: () => void;
+}
+
+/**
+ * Studio's turn hooks.
+ *
+ * - **After each call**, a turn whose conversation has been replaced stops there: its reply belongs
+ *   to a request that is no longer on screen, and writing it would land a stray `tool` message in
+ *   the other conversation. Otherwise the undo batch follows the document the tools moved to, which
+ *   a tool, project adoption or the author clicking another tab can each change.
+ * - **On a stream error**, a lapsed hosted grant (`cf_reconnect_required`) drops the model reading
+ *   and re-probes (specs/ai.md §2.1): the probe settles once at boot, so without this every gate
+ *   keeps offering an assistant that cannot answer, and the failed send is the only evidence.
+ *
+ * @param {StudioTurnHookDeps} deps
+ * @returns {TurnHooks}
+ */
+export function studioTurnHooks(deps: StudioTurnHookDeps): TurnHooks {
+  return {
+    afterTool() {
+      if (deps.superseded()) {
+        deps.onSuperseded();
+        return;
+      }
+      deps.reanchor();
+    },
+    onStreamError(error) {
+      if (error.code === "cf_reconnect_required") {
+        resetModelCache();
+        ensureProxyProbe();
+      }
+    },
+  };
+}

package/src/services/tool-executor.ts

@@ -1,60 +1,40 @@
 /**
- * Tool-executor.js — Agentic loop driver for the document AI assistant
+ * Tool-executor.js — the agent loop, as Studio runs it.
  *
- * Streams a chat round, executes any tool calls the model makes (via a ToolRegistry backed by
- * `transactDoc()`), feeds the results back as `tool` messages, and re-streams — up to a capped
- * number of rounds (specs/ai.md §3.2 to §3.4).
+ * The loop itself is the turn engine in `@jxsuite/ai/harness` (specs/ai.md §3.8): it streams each
+ * round, runs the calls the model made, feeds their results back, and decides how the turn ends.
+ * What stays here is Studio's side of a turn, which no other host shares:
  *
- * Two `ai.md` §3.2 honesty rules live here rather than in the panel, because they are properties of
- * the RUN and a panel can only render what the run recorded:
- *
- * - **A partial success is not a failure.** Running out of rounds called `setError`, which paints
- *   the turn red and — in `chat-state.ts` — DELETES the streaming message, so a turn that applied
- *   four edits and then hit the cap reported as an error that had also erased its own account of
- *   the four edits. The cap is now an ordinary assistant message whenever anything was applied, and
- *   an error only when nothing was. **Applied means it wrote**: a call counts when it succeeded with
- *   a summary AND the write ledger grew by an `ok` write while it ran, not merely when it returned a
- *   summary, because a read returns a summary too, and a turn that only looked around was reported
- *   as having changed things.
- * - **A turn that drew nothing says so.** A model that answered with neither text nor a tool call
- *   left the author's message sitting there with no reply at all. That turn ends on an error row,
- *   with Retry, instead.
- * - **A batch belongs to the tab it edits.** `beginBatch(getTab())` ran once, against whichever tab
- *   happened to be active when the loop started. A turn that then moved to a second document closed
- *   its batch against the FIRST tab, so the second document's edits got neither a history snapshot
- *   nor a collab publish. The loop re-anchors the batch whenever the active tab changes under it.
+ * - **The chat store is the transcript of record.** The engine's events are applied to it as they
+ *   happen (`services/harness/chat-reducer.ts`), and each round's request is projected from it, as
+ *   it always was, so the provider sees the conversation the panel shows, with whatever the send
+ *   path trimmed or sealed before the turn began.
+ * - **A batch belongs to the tab it edits** (§3.3). The undo batch opens on the active tab and is
+ *   re-anchored after every call whose tools moved to another document, so a turn that edits two
+ *   documents gives each its own history step and collab publish.
+ * - **The ledger is filed under the last message the turn drew** (§3.2), in this module's `finally`,
+ *   so the transcript draws the turn's changed-files summary under it.
  *
  * @license MIT
  */
 
 import type { createChatState } from "@jxsuite/ai/chat-state";
+import { DEFAULT_TURN_POLICY, runTurn } from "@jxsuite/ai/harness";
+import type { TurnRun } from "@jxsuite/ai/harness";
+import { toChatMessages, toOpenAITools } from "@jxsuite/ai/messages";
 import type { StreamingClient } from "@jxsuite/ai/streaming-client";
-import { createSessionFacts, createToolContext, linkCallSignal } from "@jxsuite/ai/tools";
-import type { Actor, SessionFacts, ToolRegistry } from "@jxsuite/ai/tools";
+import { createSessionFacts } from "@jxsuite/ai/tools";
+import type { SessionFacts, ToolRegistry } from "@jxsuite/ai/tools";
 
 import type { Tab } from "../tabs/tab";
-import type { ImportProgressEvent } from "../types";
 import { batchTab, beginBatch, endBatch } from "../tabs/transact";
-import { ensureProxyProbe, resetModelCache } from "./ai-models";
 import { estimatePromptTokens } from "./context-manager";
 import { fileTurn, openTurnLedger, turnAnchor } from "./ai-writes";
-import { recordImportProgress } from "./import-run";
-
-const MAX_ROUNDS = 5;
+import { applyHarnessEvent } from "./harness/chat-reducer";
+import { studioTurnHooks } from "./harness/turn-hooks";
 
 /** What a turn that drew nothing says: the model answered with neither text nor a tool call. */
-export const EMPTY_TURN_TEXT = "The model sent back an empty reply.";
-
-/**
- * Hard ceiling on rounds of every kind, so the loop terminates whatever the model does.
- *
- * {@link MAX_ROUNDS} bounds AUTONOMOUS work, and a round that ends by blocking on a person is the
- * opposite of runaway — it cannot advance without them, which is the property the cap was ever a
- * proxy for. So an interactive round does not spend that budget. This one is the backstop that
- * keeps `runAgentLoop` provably terminating anyway; a human answering ten questions will have
- * stopped it long before.
- */
-const MAX_TOTAL_ROUNDS = 25;
+export const EMPTY_TURN_TEXT = DEFAULT_TURN_POLICY.emptyText;
 
 interface RunAgentLoopOptions {
   chatState: ReturnType<typeof createChatState>;
@@ -80,35 +60,15 @@ export async function runAgentLoop({
   getTab,
   session = createSessionFacts(),
 }: RunAgentLoopOptions): Promise<void> {
-  const allErrors: string[] = [];
-  const appliedSummaries: string[] = [];
-
   /* The ledger is filed under the turn's last DRAWN assistant message (see services/ai-writes), so
      the scan starts at the message this turn answers. */
   const turnUserId = chatState.messages.findLast((m) => m.role === "user")?.id;
-  /* What every call's context carries (specs/ai.md §3.7): this turn's ledger, the conversation's
-     facts, and who the calls act as. The signal and the call id are the call's own, below. */
   const ledger = openTurnLedger(`turn:${chatState.messages.length}`);
-  const actor: Actor = {
-    id: `assistant:${session.sessionId ?? "local"}:${ledger.turnId}`,
-    kind: "assistant",
-    model: chatState.model,
-    sessionId: session.sessionId,
-    turnId: ledger.turnId,
-  };
 
   // Batch all tool-call mutations into a single undo step, anchored on the tab being edited.
   if (getTab) {
     beginBatch(getTab());
   }
-
-  /**
-   * Close the batch and re-open it when the tools have moved to a different document.
-   *
-   * Runs after every tool execution rather than only inside `open_document`, because a tool is not
-   * the only thing that can change the active tab: project adoption replaces every tab in the
-   * workspace, and the user is free to click another tab while the model is still streaming.
-   */
   const reanchorBatch = () => {
     if (!getTab) {
       return;
@@ -120,237 +80,58 @@ export async function runAgentLoop({
     }
   };
 
+  /* The placeholder `sendMessage` pushed is round one's message, so the turn answers into it; the
+     conversation the turn continues is everything before it. */
+  const last = chatState.messages.at(-1);
+  const placeholder =
+    chatState.status === "streaming" && last?.role === "assistant" ? last : undefined;
+  const history = toChatMessages(
+    placeholder ? chatState.messages.slice(0, -1) : chatState.messages,
+  );
+
+  /* Once another chat has replaced the one this turn answers, nothing more of the turn is written
+     into the transcript: its events belong to a conversation that is no longer on screen. */
+  let superseded = false;
+  let run: TurnRun | undefined;
   try {
-    /* Rounds that DID something, which is what MAX_ROUNDS bounds — see MAX_TOTAL_ROUNDS. */
-    let workRounds = 0;
-    for (let round = 1; round <= MAX_TOTAL_ROUNDS && workRounds < MAX_ROUNDS; round++) {
-      const messages = chatState.toMessagesArray();
-      const tools = toolRegistry.listForLLM();
-
-      const toolCalls = new Map<string, { name: string; arguments: string }>();
-      let stopReason = "stop";
-      let streamError = null;
-      let streamErrorCode: string | undefined;
-
-      for await (const event of streamingClient.streamChat(
-        messages,
-        tools,
-        systemPrompt,
-        signal as AbortSignal,
-      )) {
-        switch (event.type) {
-          case "delta": {
-            chatState.appendDelta(event.content);
-            break;
-          }
-          case "reasoning": {
-            /* Kept on the turn, not shown as answer text — the next round has to replay it (see
-               chat-state's toMessagesArray). */
-            chatState.appendReasoning(event.content);
-            break;
-          }
-          case "tool_call_start": {
-            chatState.appendToolCallStart(event.id, event.name);
-            toolCalls.set(event.id, { name: event.name, arguments: "" });
-            break;
-          }
-          case "tool_call_delta": {
-            chatState.appendToolCallDelta(event.id, event.args);
-            const tc = toolCalls.get(event.id);
-            if (tc) {
-              tc.arguments += event.args;
-            }
-            break;
-          }
-          case "tool_call_end": {
-            chatState.appendToolCallEnd(event.id);
-            break;
-          }
-          case "usage": {
-            /* The provider's own count replaces the four-characters-per-token estimate. The prompt
-               it covered is recorded with it, because the next send rebuilds the prompt. */
-            chatState.recordUsage(event, { systemTokens: estimatePromptTokens(systemPrompt) });
-            break;
-          }
-          case "done": {
-            ({ stopReason } = event);
-            break;
-          }
-          case "error": {
-            streamError = event.message;
-            streamErrorCode = event.code;
-            break;
-          }
-          default: {
-            break;
-          }
-        }
-      }
-
-      if (streamError) {
-        /* A lapsed hosted grant is the one stream error that makes the app's OWN reading wrong.
-           The probe settles once at boot, so without this every gate keeps offering an assistant
-           that cannot answer, and the send that just failed is the only evidence anyone has. Drop
-           the reading and re-probe, so the next paint carries the Reconnect CTA instead. */
-        if (streamErrorCode === "cf_reconnect_required") {
-          resetModelCache();
-          ensureProxyProbe();
-        }
-        /* `setError` alone, never after `finishStream`: it removes the round's partial message,
-           and only while that message is still the streaming one. Finishing first let go of it, so
-           the partial (a tool call cut off mid-arguments, as often as not) stayed in the
-           transcript and went out on the next send. */
-        chatState.setError(streamError);
-        return;
-      }
-
-      /* A turn that has drawn nothing by the end of a round with no calls ends here, as an error
-         the author can see and retry, rather than as silence under their message. `setError`
-         before `finishStream`, so it removes the empty reply. A stopped round is not empty: the
-         author ended it. */
-      const stopped = stopReason === "cancelled" || signal?.aborted === true;
-      if (toolCalls.size === 0 && !stopped && turnAnchor(chatState.messages, turnUserId) === null) {
-        chatState.setError(EMPTY_TURN_TEXT);
-        return;
-      }
-
-      chatState.finishStream(stopReason);
-
-      /* The calls the model streamed decide whether tools run, not the finish reason the provider
-         reported beside them. Some OpenAI-compatible backends (Workers AI among them) end a
-         tool-calling turn with `finish_reason: "stop"`, and gating on `tool_calls` dropped those
-         calls unrun — the turn ended looking finished, and the next send sealed them as failures.
-         A call cut off by `length` still runs: its arguments fail to parse, and the model reads
-         that as a tool error it can correct.
-
-         Cancellation is the exception, and it is not a finish reason at all: it is the author
-         pressing Stop. A stopped round runs nothing it streamed, including calls whose arguments
-         were already complete, because Stop is the one control that must not be outrun. */
-      if (toolCalls.size === 0 || stopReason === "cancelled" || signal?.aborted) {
-        return;
-      }
-
-      let didWork = false;
-      for (const [id, call] of toolCalls) {
-        /* A Stop that lands between calls (while `ask_user` waits, or during a long import) stops
-           the calls after it too. They stay unanswered, and the send path seals them. */
-        if (signal?.aborted) {
-          return;
+    run = runTurn({
+      history,
+      system: [{ text: systemPrompt }],
+      /* Projected from the chat store, the transcript of record. The streaming client is read on
+         every round, and the turn's own signal is the host's, so a request is the one it was. */
+      model: (request) =>
+        streamingClient.streamChat(
+          chatState.toMessagesArray(),
+          toOpenAITools(request.tools),
+          systemPrompt,
+          signal as AbortSignal,
+        ),
+      modelInfo: { family: "openai-compat", model: chatState.model },
+      tools: toolRegistry,
+      ...(signal ? { signal } : {}),
+      turnId: ledger.turnId,
+      ...(placeholder ? { firstMessageId: placeholder.id } : {}),
+      policy: { estimateTokens: estimatePromptTokens },
+      hooks: studioTurnHooks({
+        superseded: () =>
+          turnUserId !== undefined && !chatState.messages.some((m) => m.id === turnUserId),
+        onSuperseded: () => {
+          superseded = true;
+          run?.cancel("superseded");
+        },
+        reanchor: reanchorBatch,
+      }),
+      session,
+      ledger,
+      onEvent: (event) => {
+        if (!superseded) {
+          applyHarnessEvent(chatState, event);
         }
-        let result;
-        // The ledger's length before the call, so the call can be judged by what it recorded.
-        const writesBefore = ledger.writes.length;
-        /* The call's own signal: it aborts with the turn, so a tool waiting on a person or a crawl
-           learns of a Stop, and it is unlinked once the call settles, so a Stop later in the turn
-           reaches nothing that has already finished. */
-        const link = signal ? linkCallSignal(signal) : null;
-        const ctx = createToolContext({
-          actor,
-          callId: id,
-          ledger,
-          progress: (event) => {
-            recordImportProgress(id, event as unknown as ImportProgressEvent);
-          },
-          session,
-          ...(link ? { signal: link.signal } : {}),
-        });
-        try {
-          result = await toolRegistry.execute(call.name, parseToolArguments(call.arguments), ctx);
-        } catch (error) {
-          result = {
-            success: false,
-            error: `Failed to parse arguments: ${(error as Error).message}`,
-          };
-        } finally {
-          link?.release();
-        }
-        /* The transcript was replaced while the call ran: another chat was opened from Chat
-           History, which stops the turn. The reply belongs to a request that is no longer there,
-           so writing it would land a stray `tool` message in the other conversation, and could
-           overwrite a restored record's result where a provider reuses call ids. */
-        if (turnUserId !== undefined && !chatState.messages.some((m) => m.id === turnUserId)) {
-          return;
-        }
-        // A call that suspends the turn on a person does not spend its work budget.
-        if (toolRegistry.getDefinition(call.name)?.interactive !== true) {
-          didWork = true;
-        }
-        reanchorBatch();
-        if (!result.success && result.error) {
-          allErrors.push(result.error);
-        }
-        const wrote = ledger.writes.slice(writesBefore).some((write) => write.ok);
-        if (result.success && result.summary && wrote) {
-          appliedSummaries.push(result.summary);
-        }
-        chatState.appendToolResult(id, result);
-        chatState.pushToolResultMessage(id, JSON.stringify(result));
-      }
-
-      if (didWork) {
-        workRounds += 1;
-      }
-      /* A Stop that landed during the round's last call. Nothing is left to stop in this round, so
-         without this the loop opened the next one: a placeholder pushed after the author stopped,
-         and a request streamed on the aborted signal. */
-      if (signal?.aborted) {
-        return;
-      }
-      if (workRounds < MAX_ROUNDS && round < MAX_TOTAL_ROUNDS) {
-        chatState.beginAssistantTurn();
-      }
-    }
-
-    /*
-     * The round cap. Surface the actual errors so the user knows what went wrong, not just a
-     * generic "I couldn't do it" — and, when anything was applied, say it as the ASSISTANT rather
-     * than as a failure (`ai.md` §3.2). A partial success is not a failure.
-     */
-    const uniqueErrors = [...new Set(allErrors)];
-    const applied =
-      appliedSummaries.length > 0
-        ? `\n\nChanges applied so far:\n${appliedSummaries.map((s) => `- ${s}`).join("\n")}`
-        : "";
-    const errors =
-      uniqueErrors.length > 0
-        ? `\n\nErrors encountered:\n${uniqueErrors.map((e) => `- ${e}`).join("\n")}`
-        : "";
-    const tail =
-      `I ran out of tool-call rounds (${MAX_ROUNDS}) before finishing.${applied}${errors}` +
-      `\n\nYou can continue by sending another message, or try a more specific request.`;
-    if (appliedSummaries.length > 0) {
-      chatState.beginAssistantTurn();
-      chatState.appendDelta(tail);
-      chatState.finishStream("length");
-      return;
-    }
-    chatState.setError(tail);
+      },
+    });
+    await run.outcome;
   } finally {
     endBatch();
     fileTurn(turnAnchor(chatState.messages, turnUserId) ?? "", ledger.writes);
   }
 }
-
-/**
- * A call's arguments as the object a tool takes.
- *
- * An empty string is no arguments. JSON that parses to something other than an object (`null`, an
- * array, a number) is refused here with its own sentence, rather than reaching the registry, where
- * a validator reading a property of `null` threw a message about the validator. The prefix is the
- * one a JSON syntax error already carries, so the model reads both as one kind of mistake.
- *
- * @param {string} text - The call's accumulated argument text
- * @returns {object}
- * @throws {SyntaxError | TypeError} Caught by the loop and returned to the model as a tool error
- */
-function parseToolArguments(text: string): object {
-  if (!text) {
-    return {};
-  }
-  const parsed = JSON.parse(text) as unknown;
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    const type = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
-    throw new TypeError(`arguments must be a JSON object, got ${type}`);
-  }
-  return parsed;
-}

package/src/services/tool-outcomes.ts

@@ -4,27 +4,29 @@
  * A tool call's outcome is recorded twice while a turn runs: as the `result` on its
  * `ToolCallRecord`, which the chip renders, and as the `tool` message that answers it, which the
  * provider reads. The second is the one that must survive, because it is the one the wire carries,
- * and it is the one that always did: until the turn became accountable (specs/ai.md §3.2) the first was never populated for a
- * finished call (the loop looked for the record after closing the stream), so every persisted
- * `result` was `null`: every restored chip rendered as still pending, and an answered question as
- * one still open (specs/ai.md §3.4).
+ * and it is the one that always did: until the turn became accountable (specs/ai.md §3.2) the first
+ * was never populated for a finished call (the loop looked for the record after closing the
+ * stream), so every persisted `result` was `null`: every restored chip rendered as still pending,
+ * and an answered question as one still open (specs/ai.md §3.4).
  *
  * So the tool message is the single source. A save strips `result` from every record, which keeps
  * the payload free of a second, disagreeing copy; a restore backfills each record from the reply
- * that answers it. A question nothing answered keeps no result, which is what makes it render
- * inert rather than as one still waiting; an ordinary call nothing answered never completed, and
- * says so.
+ * that answers it. A question nothing answered keeps no result, which is what makes it render inert
+ * rather than as one still waiting; an ordinary call nothing answered never completed, and says
+ * so.
  *
  * **A seal is not an answer.** When a question was left open, the send path seals its request with
  * a synthesized failure so the wire stays well-formed (`pruneOrphanToolMessages`). For an ordinary
  * call that failure IS the outcome to show: it never completed. For a question it is the absence of
  * an answer, so a restore leaves it without a result, and the chip draws the inert "still open when
- * the session was reloaded" card rather than a failure.
+ * the session was reloaded" card rather than a failure. Either seal counts, the one for a call that
+ * was cut off mid-arguments as well (`isSealContent`).
  *
- * @docs studio/ai/chat
  * @license MIT
+ * @docs studio/ai/chat
  */
 
+import { isSealContent } from "@jxsuite/ai/messages";
 import type { ToolResult } from "@jxsuite/ai/tools";
 import type { PersistedMessage } from "./ai-session-store";
 import { UNANSWERED_TOOL_RESULT } from "./context-manager";
@@ -114,7 +116,7 @@ export function backfillToolResults(messages: readonly PersistedMessage[]): Pers
       const result = parseToolResult(reply.content);
       if (typeof reply.toolCallId === "string" && result && !replies.has(reply.toolCallId)) {
         replies.set(reply.toolCallId, result);
-        if (reply.content === UNANSWERED_TOOL_RESULT) {
+        if (isSealContent(reply.content)) {
           sealed.add(reply.toolCallId);
         }
       }

package/src/settings/preferences-accounts.ts

@@ -30,7 +30,9 @@ import { clearCfConnection, getCfAccountId, getCfToken } from "../services/cf-se
 import { clearAiProvider, getBaseUrl, hasOpenAiKey } from "../services/ai-settings";
 import { preferredModel, resetModelCache } from "../services/ai-models";
 import { getPlatform, hasPlatform } from "../platform";
-import type { CfConnection } from "../types";
+import { getAccountEntries } from "../account-status";
+import { runOfferedAction } from "../account/action-flow";
+import type { AccountEntry, CfConnection, OfferedAction } from "../types";
 
 /** One thing a row can do besides existing. */
 export interface AccountAction {
@@ -228,11 +230,47 @@ function localCloudflareRecord(): AccountRecord {
   };
 }
 
+// ─── The platform's own rows ─────────────────────────────────────────────────
+
+/**
+ * One row the platform adds (desktop.md §10.4) — a membership, a role, a plan; Studio does not know
+ * which, and draws it in the platform's words.
+ *
+ * Its id is namespaced so no platform can shadow one of Studio's own rows by naming it `github`.
+ * `revoke` does nothing: whatever the row describes is not a credential this app holds, so there is
+ * nothing here to forget, and its verbs are the actions the platform offers with it.
+ */
+function platformAction(action: OfferedAction): AccountAction {
+  const verb: AccountAction = {
+    id: action.id,
+    label: action.label,
+    run: async () => {
+      await runOfferedAction(action);
+    },
+  };
+  if (action.primary) {
+    verb.variant = "accent";
+  }
+  return verb;
+}
+
+function platformRecord(entry: AccountEntry): AccountRecord {
+  return {
+    actions: (entry.actions ?? []).map((action) => platformAction(action)),
+    connected: entry.connected ?? false,
+    detail: entry.detail,
+    id: `platform:${entry.id}`,
+    label: entry.label,
+    revoke: () => {},
+  };
+}
+
 /**
- * The three accounts, always all three.
+ * The three accounts, always all three — then any rows the platform adds.
  *
  * A disconnected account still gets a row: "you are not signed in to GitHub" is information, and a
- * list that hides what is absent cannot answer the question the section exists to answer.
+ * list that hides what is absent cannot answer the question the section exists to answer. The
+ * platform's rows are the platform's to include or leave out; Studio adds none of its own.
  */
 export function listAccounts(): AccountRecord[] {
   const githubToken = githubTokenStored();
@@ -260,6 +298,7 @@ export function listAccounts(): AccountRecord[] {
       revoke: clearAiProvider,
     },
     platformBrokersCf() ? brokeredCloudflareRecord() : localCloudflareRecord(),
+    ...getAccountEntries().map((entry) => platformRecord(entry)),
   ];
 }
 

package/src/settings/preferences-dialog.ts

@@ -19,7 +19,7 @@
  *   this, `clearGithubToken()` had zero callers: signing out of GitHub was not expressible.
  * - **Keyboard** — GENERATED from `commands/reference.ts`'s `shortcutReference()`, the same
  *   projection `docs/studio/interface/shortcuts.md` is built from. The registry is the one place a
- *   chord is declared, so the sheet cannot drift from the app or from the docs. Per CLAUDE.md's
+ *   chord is declared, so the sheet cannot drift from the app or from the docs. Per AGENTS.md's
  *   Screenshot Policy there is deliberately no screenshot of it — photographing generated content
  *   is a bug. It is searchable two ways, because there are two questions ("what is the shortcut for
  *   X" and "what did I just press"), and rebindable — as a LAYER over the registry
@@ -44,6 +44,8 @@
 
 import { CHROME_THEMES, setChromeTheme, shell } from "../shell";
 import { layerHost } from "../ui/layers";
+import { hydrateAccountStatus } from "../account-status";
+import { getPlatform, hasPlatform } from "../platform";
 import { createAiCredentialsForm } from "../ui/ai-credentials-form";
 import { createManagedConnect } from "../ui/ai-managed-connect";
 import { activeRegistry } from "../commands/active-registry";
@@ -563,6 +565,11 @@ export function openPreferences(section?: string): Promise<null> {
      grant can lapse between visits, and a row that repaints the previous answer first is stating
      something it has no reason to believe. */
   resetCfConnectionCache();
+  /* And the platform's own account rows, for the same reason: whatever they report can change
+     between visits. They repaint when the answer lands; until then they show the last one. */
+  if (hasPlatform() && getPlatform().getAccountStatus) {
+    void hydrateAccountStatus().then(repaint);
+  }
   _section = section !== undefined && isPreferencesSection(section) ? section : _section;
   if (_surface) {
     repaint();