@k2b/cloud 0.29.0 → 0.30.0

package/src/ai/chat/turn-view.tsx

@@ -17,17 +17,34 @@ import {
 import { markdown } from "../../shared";
 import { AI_TURN_LEASE_MS, type AiTurnBlock } from "../protocol";
 import type { AiTurnError } from "../types";
-import { ApprovalBlockView, CompactionBlockView, CompactToolRow, SurveyToolView, TextEditorToolView } from "./blocks";
+import { toolOutcome, toolSubject } from "./action-sentences";
+import {
+  type AiApprovalDecision,
+  ApprovalBlockView,
+  CompactionBlockView,
+  CompactToolRow,
+  SurveyToolView,
+  TextEditorToolView,
+} from "./blocks";
 import { CapabilityTablePreview } from "./capability-table";
+import { CloudChartBlock } from "./chart-block";
 import { PresentToolBlock } from "./file-tools";
 import { useAiChatActions } from "./message-actions";
-import { aiToolIcon, capabilityErrorDescription, displayToolName, isCardToolName, isRecord, isSurveyToolName } from "./message-utils";
+import {
+  aiToolIcon,
+  capabilityErrorDescription,
+  displayToolName,
+  isCardToolName,
+  isChartToolName,
+  isRecord,
+  isSurveyToolName,
+} from "./message-utils";
 import { aiChatMessages } from "./messages";
 import { AssistantMarkdownBlock } from "./primitives";
 import { AiToolActivity, AiToolDisclosureProvider, type AiToolDisclosureState } from "./tool-disclosure";
-import { type AiWorkEntry, countWorkSteps, groupWorkBlocks, summarizeToolGroup } from "./tool-groups";
+import { type AiWorkEntry, type AiWorkItem, countWorkSteps, groupWorkBlocks } from "./tool-groups";
 import { aiTurnErrorCanContinue, aiTurnErrorDescription } from "./turn-error";
-import type { AiTurnAction, AiTurnLayout, AiTurnPhase, AiTurnResult } from "./turn-layout";
+import type { AiTurnAction, AiTurnActionState, AiTurnLayout, AiTurnPhase, AiTurnResult } from "./turn-layout";
 import { CloudCardBlock } from "./visual-tools";
 
 type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
@@ -88,10 +105,12 @@ export const formatWorkClock = (ms: number): string => {
 
 const basename = (value: string) => value.slice(value.lastIndexOf("/") + 1) || value;
 
+/** What a call acts on: the file name of its path, or its name, title, or query as given. */
 const toolTarget = (block: ToolBlock): string => {
   const args = isRecord(block.args) ? block.args : {};
-  const value = [args.path, args.name, args.title, args.query].find((entry) => typeof entry === "string" && entry.trim());
-  return typeof value === "string" ? basename(value.trim()) : "";
+  if (typeof args.path === "string" && args.path.trim()) return basename(args.path.trim());
+  const value = [args.name, args.title, args.query].find((entry) => typeof entry === "string" && entry.trim());
+  return typeof value === "string" ? value.trim() : "";
 };
 
 /** A step that runs longer than this shows its duration, so a long step does not look like a stalled one. */
@@ -124,6 +143,7 @@ const stepPhrase = (block: AiTurnBlock | null, t: Messages, withTargets: boolean
   if (name === "present") return withTarget(t.stepDeliveringFile);
   if (name === "code_present") return withTarget(t.stepPreparingView);
   if (isCardToolName(name)) return t.stepPreparingCard;
+  if (isChartToolName(name)) return t.stepPreparingChart;
   if (["code_write", "code_create", "code_update", "code_fork", "code_remove", "code_restore"].includes(name))
     return withTarget(t.stepWritingCode);
   if (["code_run", "code_action", "code_sql"].includes(name)) return withTarget(t.stepRunningCode);
@@ -234,6 +254,7 @@ function ThoughtRow(props: { block: Extract<AiTurnBlock, { kind: "thinking" }>;
         blockId={props.block.id}
         label={firstLine()}
         icon="ti ti-bulb"
+        bodyInset={false}
         renderBody={() => <p class="ai-turn-steps__thought">{props.block.text.trim()}</p>}
       />
     </Show>
@@ -254,25 +275,26 @@ function WorkEntryRow(props: { entry: AiWorkEntry; busy: boolean }) {
   );
 }
 
-function WorkGroup(props: { id: string; entries: AiWorkEntry[]; active: boolean }) {
+/** Housekeeping folded into one row at step level. It opens in place: its steps follow at the same indent. */
+function HousekeepingGroup(props: { id: string; entries: AiWorkEntry[]; active: boolean }) {
   const locale = useLocale();
-  const tools = () => props.entries.filter((entry): entry is ToolBlock => entry.kind === "tool");
   const last = () => props.entries.at(-1)!;
   return (
-    <Show when={props.entries.length > 1} fallback={<WorkEntryRow entry={last()} busy={props.active} />}>
-      <AiToolActivity
-        blockId={`group:${props.id}`}
-        label={tools().length ? summarizeToolGroup(tools(), locale()) : aiChatMessages(locale()).reasoning}
-        description={countWorkSteps(props.entries, locale())}
-        icon="ti ti-stack-2"
-        busy={props.active && last().kind === "tool" && (last() as ToolBlock).status === "running"}
-        renderBody={() => (
+    <AiToolActivity
+      blockId={`group:${props.id}`}
+      label={aiChatMessages(locale()).groupLoad}
+      description={countWorkSteps(props.entries, locale())}
+      icon="ti ti-stack-2"
+      bodyInset={false}
+      busy={props.active && last().kind === "tool" && (last() as ToolBlock).status === "running"}
+      renderBody={() => (
+        <div class="ai-turn-steps">
           <For each={props.entries}>
             {(entry, index) => <WorkEntryRow entry={entry} busy={props.active && index() === props.entries.length - 1} />}
           </For>
-        )}
-      />
-    </Show>
+        </div>
+      )}
+    />
   );
 }
 
@@ -288,34 +310,46 @@ function WorkText(props: { text: string }) {
   );
 }
 
-/** Expanded work: intermediate texts as quiet paragraphs, the steps between them as groups. One indent, one size. */
+const workItemKey = (item: AiWorkItem): string =>
+  item.kind === "text" ? `text:${item.block.id}` : item.kind === "step" ? `step:${item.entry.id}` : `group:${item.id}`;
+
+/**
+ * Expanded work, one indent below the work line and one size: intermediate texts as quiet paragraphs, the steps between
+ * them directly, and housekeeping folded at step level. A row shown while this list is open never folds away under the
+ * reader, also when reasoning or arguments that would fold it arrive later; the next time it opens, it folds like in
+ * history.
+ */
 function AiWorkSteps(props: { blocks: AiTurnBlock[]; active: boolean }) {
-  const groups = createMemo(() => groupWorkBlocks(props.blocks));
-  const keyed = createMemo(
-    () => new Map(groups().map((group) => [group.kind === "text" ? `text:${group.block.id}` : `steps:${group.id}`, group])),
-  );
-  const keys = createMemo(() => [...keyed().keys()]);
+  const shown = new Set<string>();
+  const items = createMemo(() => {
+    const work = groupWorkBlocks(props.blocks, shown);
+    for (const item of work) if (item.kind === "step") shown.add(item.entry.id);
+    return new Map(work.map((item) => [workItemKey(item), item]));
+  });
+  const keys = createMemo(() => [...items().keys()]);
   return (
     <div class="ai-turn-steps">
       <For each={keys()}>
         {(key, index) => {
-          const group = () => keyed().get(key);
+          const item = () => items().get(key);
           const text = () => {
-            const value = group();
+            const value = item();
             return value?.kind === "text" ? value.block.text : undefined;
           };
-          const steps = () => {
-            const value = group();
-            return value?.kind === "steps" ? value : undefined;
+          const step = () => {
+            const value = item();
+            return value?.kind === "step" ? value.entry : undefined;
+          };
+          const group = () => {
+            const value = item();
+            return value?.kind === "housekeeping" ? value : undefined;
           };
+          const active = () => props.active && index() === keys().length - 1;
           return (
             <Switch>
-              <Match when={text() !== undefined}>
-                <WorkText text={text()!} />
-              </Match>
-              <Match when={steps()}>
-                {(value) => <WorkGroup id={value().id} entries={value().entries} active={props.active && index() === keys().length - 1} />}
-              </Match>
+              <Match when={text()}>{(value) => <WorkText text={value()} />}</Match>
+              <Match when={step()}>{(entry) => <WorkEntryRow entry={entry()} busy={active()} />}</Match>
+              <Match when={group()}>{(value) => <HousekeepingGroup id={value().id} entries={value().entries} active={active()} />}</Match>
             </Switch>
           );
         }}
@@ -413,6 +447,9 @@ function AiTurnResultView(props: { result: Accessor<AiTurnResult | undefined>; r
           <Match when={isCardToolName(current().name)}>
             <CloudCardBlock args={current().args} />
           </Match>
+          <Match when={isChartToolName(current().name)}>
+            <CloudChartBlock args={current().args} completed={current().status === "completed"} />
+          </Match>
           <Match when={true}>
             <Show when={!props.receipt()}>
               <CapabilityResultRow block={current()} />
@@ -428,31 +465,51 @@ function AiTurnResultView(props: { result: Accessor<AiTurnResult | undefined>; r
   );
 }
 
-function AiReceipt(props: { action: AiTurnAction; stopped: boolean }) {
+type ReceiptState = Exclude<AiTurnActionState, "open" | "interaction">;
+
+/**
+ * One line for an action in place 4, the same element while it runs and once it is done, rejected, failed, or not run.
+ * It says what happened in the owning app's words: its sentence for the outcome, such as "Moved report.pdf to the
+ * trash", else, once done, the application's own summary of the call. Without either it puts the state in the reader's
+ * language before what the call does, such as "Rejected: Write report.md", or before its title and target.
+ */
+function AiReceipt(props: { block: ToolBlock; state: ReceiptState; stopped: boolean }) {
   const locale = useLocale();
   const t = () => aiChatMessages(locale());
-  const block = () => props.action.block;
-  const title = () => block().presentation?.title ?? displayToolName(block().name, locale());
-  const links = () => (props.action.state === "done" ? resultLinks(block()) : []);
+  const block = () => props.block;
+  const subject = () => {
+    const sentence = toolSubject(block(), locale());
+    if (sentence) return sentence;
+    const title = block().presentation?.title ?? displayToolName(block().name, locale());
+    const target = toolTarget(block());
+    return target ? `${title} · ${target}` : title;
+  };
+  const capabilityAction = () => block().presentation?.kind === "capability";
+  const links = () => (props.state === "done" ? resultLinks(block()) : []);
   const label = () => {
-    const state = props.action.state;
+    const state = props.state;
+    if (state === "running") return t().receiptRunning({ title: subject() });
     if (state === "done") {
-      const summary = resultSummary(block());
-      if (summary) return summary;
       // A tool that is not a Cloud action has no effect of its own to report; the receipt records the decision.
-      return block().presentation?.kind === "capability" ? t().receiptDone({ title: title() }) : t().receiptApproved({ title: title() });
+      if (!capabilityAction()) return t().receiptApproved({ title: subject() });
+      return toolOutcome(block(), "done", locale()) || resultSummary(block()) || t().receiptDone({ title: subject() });
     }
-    if (state === "rejected") return t().receiptRejected({ title: title() });
-    if (state === "failed") return t().receiptFailed({ title: title() });
-    return t().receiptNotRun({ title: title(), stopped: props.stopped });
+    if (state === "rejected") return toolOutcome(block(), "rejected", locale()) ?? t().receiptRejected({ title: subject() });
+    if (state === "failed") return t().receiptFailed({ title: subject() });
+    const notRun = toolOutcome(block(), "notRun", locale());
+    return notRun
+      ? t().receiptNotRunSentence({ sentence: notRun, stopped: props.stopped })
+      : t().receiptNotRun({ title: subject(), stopped: props.stopped });
   };
+  const declined = () => props.state === "rejected" || props.state === "not_run";
   return (
     <Chat.Activity
       class="ai-turn-receipt"
-      icon={aiToolIcon(block().name, block().presentation?.appIcon)}
-      accent={block().presentation?.appAccent}
+      icon={declined() ? "ti ti-circle-off" : aiToolIcon(block().name, block().presentation?.appIcon)}
+      accent={declined() ? undefined : block().presentation?.appAccent}
       label={label()}
-      description={props.action.state === "failed" ? capabilityErrorDescription(block().result) : undefined}
+      busy={props.state === "running"}
+      description={props.state === "failed" ? capabilityErrorDescription(block().result) : undefined}
       trailing={links().length > 0 ? <ResultLinks links={links()} /> : undefined}
     />
   );
@@ -463,8 +520,26 @@ function AiTurnActionView(props: { action: Accessor<AiTurnAction | undefined>; t
   let row!: HTMLDivElement;
   // Set while focus is in this place, including after the focused control disappeared with the decided card.
   let focusedHere = false;
+  // The decision the server accepted for a card here; its receipt replaces the card before the turn reports it. It
+  // belongs to the call it answered: code that asks again shows the next request on the same block as a new card.
+  const [decided, setDecided] = createSignal<AiApprovalDecision | null>(null);
   const action = () => props.action();
   const state = () => action()?.state;
+  const decision = () => {
+    const current = action();
+    const value = decided();
+    return current && value?.callId === current.block.callId ? value.approved : null;
+  };
+  const card = () => {
+    const current = action();
+    return current?.state === "open" && current.block.status === "awaiting_approval" && decision() === null ? current.block : undefined;
+  };
+  const receipt = (): ReceiptState | undefined => {
+    const current = action();
+    if (!current || card()) return undefined;
+    if (current.state === "open" && current.block.status === "awaiting_approval") return decision() ? "running" : "rejected";
+    return current.state === "open" || current.state === "interaction" ? undefined : current.state;
+  };
   // Screen readers hear a waiting approval once, as one short line instead of the whole card, without moving focus.
   createEffect(
     on(state, (next, previous) => {
@@ -472,18 +547,22 @@ function AiTurnActionView(props: { action: Accessor<AiTurnAction | undefined>; t
       if (next !== "open" || previous === "open" || !isLive(props.phase) || current?.block.status !== "awaiting_approval") return;
       announce(
         aiChatMessages(locale()).approvalNeeded({
-          title: current.block.presentation?.title ?? displayToolName(current.block.name, locale()),
+          title: toolSubject(current.block, locale()) ?? current.block.presentation?.title ?? displayToolName(current.block.name, locale()),
         }),
       );
     }),
   );
-  // A card the user decided becomes its receipt in place. Focus stays on that place without scrolling.
+  // A card the user decided becomes its receipt in place, once, as the direct result of the decision. Focus stays on
+  // that place without scrolling.
   createEffect(
-    on(state, (next, previous) => {
-      if (previous !== "open" || next === "open" || !focusedHere || typeof document === "undefined") return;
-      const focused = document.activeElement;
-      if (!focused || focused === document.body || row.contains(focused)) row.focus({ preventScroll: true });
-    }),
+    on(
+      () => card() !== undefined,
+      (open, wasOpen) => {
+        if (!wasOpen || open || !focusedHere || typeof document === "undefined") return;
+        const focused = document.activeElement;
+        if (!focused || focused === document.body || row.contains(focused)) row.focus({ preventScroll: true });
+      },
+    ),
   );
   return (
     <div
@@ -500,11 +579,12 @@ function AiTurnActionView(props: { action: Accessor<AiTurnAction | undefined>; t
     >
       <Show when={action()}>
         {(current) => (
-          <Switch fallback={<AiReceipt action={current()} stopped={props.phase === "stopped"} />}>
-            <Match when={current().state === "open" && current().block.status === "awaiting_approval"}>
-              <ApprovalBlockView turnId={props.turnId} block={current().block} />
+          <Switch>
+            <Match when={card()}>{(block) => <ApprovalBlockView turnId={props.turnId} block={block()} onDecided={setDecided} />}</Match>
+            <Match when={receipt()}>
+              {(receiptState) => <AiReceipt block={current().block} state={receiptState()} stopped={props.phase === "stopped"} />}
             </Match>
-            <Match when={current().state === "open" || current().state === "interaction"}>
+            <Match when={true}>
               <Switch
                 fallback={
                   <Chat.Activity
@@ -522,14 +602,6 @@ function AiTurnActionView(props: { action: Accessor<AiTurnAction | undefined>; t
                 </Match>
               </Switch>
             </Match>
-            <Match when={current().state === "running"}>
-              <Chat.Activity
-                label={current().block.presentation?.title ?? displayToolName(current().block.name, locale())}
-                icon={aiToolIcon(current().block.name, current().block.presentation?.appIcon)}
-                accent={current().block.presentation?.appAccent}
-                busy
-              />
-            </Match>
           </Switch>
         )}
       </Show>

package/src/ai/code-runtime-tools.ts

@@ -3,8 +3,10 @@ import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { getApp } from "../_internal/registry";
 import type { RequestActor } from "../server";
+import { IDENTITY_REFRESH_TIMEOUT_MS } from "../services/identity/constants";
 import { signInvocationToken } from "../services/identity/invocation-token";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
+import { logger } from "../services/logging";
 import { LOCALE_HEADER } from "../shared/locale";
 import { TIMEZONE_COOKIE } from "../shared/time";
 import { CodeToolFailure } from "./browser-code-contracts";
@@ -13,6 +15,9 @@ import { CODE_CAPABILITY_TOKEN_HEADER, codeCapabilityOperation } from "./code-ca
 import { authorizeCodeExecution } from "./code-execution";
 import { aiConversations } from "./store";
 
+const log = logger("ai:code-runtime");
+const ISSUANCE_TIMEOUT_MS = 5_000;
+
 const Reply = z.object({
   ok: z.literal(true),
   data: z.object({
@@ -49,54 +54,64 @@ export const runManagedCodeTool =
     await context.reportProgress?.(context.locale?.startsWith("de") ? "Ausführungshost verbinden" : "Connecting execution host");
     const app = await getApp("assistant");
     if (!app) throw new Error("Assistant code host is unavailable");
+    const issue = async (audience: { targetAppId: string; callingAppId: string; operation: string }) => {
+      // A token is signed before its request goes out, so a timed-out issuance
+      // never reached the host and is safe to repeat. Retry long enough for a
+      // stalled shared refresh to finish or fall back to the cached key. Every
+      // timeout used up a full attempt or ended a shared load, so this cannot spin.
+      const giveUpAt = Date.now() + IDENTITY_REFRESH_TIMEOUT_MS + ISSUANCE_TIMEOUT_MS;
+      while (true) {
+        try {
+          return await withActiveIdentitySigner(
+            "invocation",
+            (signer) =>
+              signInvocationToken({
+                ...audience,
+                schemaHash: null,
+                authority: {
+                  sub: actor.user.id,
+                  principal_type: "user",
+                  access_subject_type: "user",
+                  access_subject_id: actor.user.id,
+                  credential_kind: "session",
+                  scopes: [],
+                },
+                signer,
+                issuer: signer.issuer,
+              }),
+            { signal: context.signal, timeoutMs: ISSUANCE_TIMEOUT_MS },
+          );
+        } catch (error) {
+          if (context.signal.aborted || !(error instanceof DOMException && error.name === "TimeoutError")) throw error;
+          if (Date.now() < giveUpAt) continue;
+          log.warn("Code call gave up on identity issuance", { tool: name, error: error.message });
+          throw new Error(
+            context.locale?.startsWith("de")
+              ? "Der Identitätsdienst hat nicht rechtzeitig geantwortet. Prüfe, ob dieser Aufruf schon gestartet ist, bevor du ihn erneut ausführst."
+              : "The identity service did not respond in time. Check whether this call already started before running it again.",
+            { cause: error },
+          );
+        }
+      }
+    };
+    // Polls run every 250 ms for as long as the code runs. Reuse both tokens
+    // while they stay valid for at least 10 s, so a long run or an approval
+    // round trip does not depend on a fresh issuance for every poll.
+    const usable = (token: Awaited<ReturnType<typeof signInvocationToken>> | undefined) =>
+      token && token.claims.exp * 1000 - Date.now() >= 10_000 ? token : undefined;
+    let signed: Awaited<ReturnType<typeof signInvocationToken>> | undefined;
     let callback: Awaited<ReturnType<typeof signInvocationToken>> | undefined;
     const request = async (decision?: { id: string; approved: boolean }) => {
       context.signal.throwIfAborted();
       await authorizeCodeExecution(context.conversationId!, context.turnId!, actor.user.id);
-      const signed = await withActiveIdentitySigner(
-        "invocation",
-        (signer) =>
-          signInvocationToken({
-            targetAppId: "assistant",
-            callingAppId: "core",
-            operation: `tool:${name}`,
-            schemaHash: null,
-            authority: {
-              sub: actor.user.id,
-              principal_type: "user",
-              access_subject_type: "user",
-              access_subject_id: actor.user.id,
-              credential_kind: "session",
-              scopes: [],
-            },
-            signer,
-            issuer: signer.issuer,
-          }),
-        { signal: context.signal, timeoutMs: 5000 },
-      );
-      if (!callback || callback.claims.exp * 1000 - Date.now() < 10_000) {
-        callback = await withActiveIdentitySigner(
-          "invocation",
-          (signer) =>
-            signInvocationToken({
-              targetAppId: "core",
-              callingAppId: "assistant",
-              operation: codeCapabilityOperation(context.conversationId!, context.turnId!),
-              schemaHash: null,
-              authority: {
-                sub: actor.user.id,
-                principal_type: "user",
-                access_subject_type: "user",
-                access_subject_id: actor.user.id,
-                credential_kind: "session",
-                scopes: [],
-              },
-              signer,
-              issuer: signer.issuer,
-            }),
-          { signal: context.signal, timeoutMs: 5000 },
-        );
-      }
+      signed = usable(signed) ?? (await issue({ targetAppId: "assistant", callingAppId: "core", operation: `tool:${name}` }));
+      callback =
+        usable(callback) ??
+        (await issue({
+          targetAppId: "core",
+          callingAppId: "assistant",
+          operation: codeCapabilityOperation(context.conversationId!, context.turnId!),
+        }));
       const headers = new Headers({ authorization: `Bearer ${signed.token}`, "content-type": "application/json" });
       headers.set(CODE_CAPABILITY_TOKEN_HEADER, callback.token);
       if (context.locale) headers.set(LOCALE_HEADER, context.locale);