@k2b/cloud 0.29.1 → 0.30.0

package/src/ai/chat/blocks.tsx

@@ -2,12 +2,15 @@ import { dates } from "@k2b/stdlib";
 import { mutation } from "@k2b/stdlib/solid";
 import { Button, ButtonLink, Chat, isStructuredDataValue, MarkdownView, SplitButton, StructuredDataPreview, useLocale } from "@k2b/ui";
 import { createSignal, createUniqueId, For, type JSX, Match, Show, Switch, untrack } from "solid-js";
+import { capabilityApprovalReason, capabilityApprovalReasonLabel } from "../../_internal/capability-sentences";
 import type { CapabilityActionReview } from "../../contracts/capabilities";
 import { markdown } from "../../shared";
 import type { AiTurnBlock } from "../protocol";
+import { toolOutcome, toolSubject } from "./action-sentences";
 import { hasSpecializedBuiltinToolView, SpecializedBuiltinToolBlock } from "./builtin-tools";
 import { hasCapabilityTable } from "./capability-result";
 import { CapabilityTablePreview } from "./capability-table";
+import { CloudChartBlock } from "./chart-block";
 import { PresentToolBlock } from "./file-tools";
 import { useAiChatActions } from "./message-actions";
 import {
@@ -18,6 +21,7 @@ import {
   fetchFileErrorPresentation,
   formatToolDetailText,
   isCardToolName,
+  isChartToolName,
   isRecord,
   isSurveyToolName,
   isTextEditorToolName,
@@ -216,11 +220,17 @@ export function ApprovalBlockView(props: { turnId: string; block: ToolBlock; onD
     decision = { callId: props.block.callId, approved: input.approved };
     void approval.mutate(input);
   };
-  const title = () => props.block.presentation?.title ?? displayToolName(props.block.name, locale());
+  // The heading says what will happen in the owning app's words; the app or the assistant name stays beside it.
+  const title = () => toolSubject(props.block, locale()) ?? props.block.presentation?.title ?? displayToolName(props.block.name, locale());
   const ownerName = () => props.block.presentation?.appName ?? t().assistant;
+  const capability = () => props.block.presentation?.kind === "capability";
+  // The model's own reason, labelled as such, only where Cloud offered it; it adds to the app's sentence and never replaces it.
+  const reason = () => (props.block.presentation?.approvalReason ? capabilityApprovalReason(props.block.args) : null);
   const description = () => {
     const reviewMessage = props.block.approval?.review?.message.trim();
     if (reviewMessage) return reviewMessage;
+    // An app Action's approval text repeats its heading and reason for text-only readers; the card shows them itself.
+    if (capability()) return null;
     const message = props.block.approval?.message?.trim();
     if (!message) return null;
     const duplicateTitle = props.block.presentation ? `${props.block.presentation.appName}: ${props.block.presentation.title}` : "";
@@ -259,10 +269,10 @@ export function ApprovalBlockView(props: { turnId: string; block: ToolBlock; onD
       <div class="ai-approval__head">
         <i class={`ai-approval__icon ${aiToolIcon(props.block.name, props.block.presentation?.appIcon)}`} aria-hidden="true" />
         <div class="min-w-0">
-          <h3 class="ai-approval__title">
-            {ownerName()} · {title()}
-          </h3>
-          <p class="ai-approval__sub">{t().approvalRunsAfter}</p>
+          <h3 class="ai-approval__title">{title()}</h3>
+          <p class="ai-approval__sub">
+            {ownerName()} · {t().approvalRunsAfter}
+          </p>
         </div>
       </div>
       <Show when={reviewLines().length > 0}>
@@ -318,6 +328,14 @@ export function ApprovalBlockView(props: { turnId: string; block: ToolBlock; onD
           )}
         </For>
       </Show>
+      <Show when={reason()}>
+        {(text) => (
+          <p class="ai-approval__text whitespace-pre-wrap">
+            <strong class="ai-approval__label">{capabilityApprovalReasonLabel(locale())}: </strong>
+            {text()}
+          </p>
+        )}
+      </Show>
       <Show when={detailsOpen()}>
         <div id={detailsId} class="w-full min-w-0" role="region" aria-label={t().detailsFor({ title: title() })}>
           <Show when={detailData()} fallback={<pre class="ai-approval__preview text-[11px]">{jsonPreview(props.block.args)}</pre>}>
@@ -518,11 +536,11 @@ function CapabilityToolView(props: { block: ToolBlock }) {
 function RejectedToolView(props: { block: ToolBlock }) {
   const locale = useLocale();
   const presentation = () => props.block.presentation;
-  const title = () => presentation()?.title ?? displayToolName(props.block.name, locale());
+  const title = () => toolSubject(props.block, locale()) ?? presentation()?.title ?? displayToolName(props.block.name, locale());
   return (
     <Chat.Activity
       icon={aiToolIcon(props.block.name, presentation()?.appIcon)}
-      label={aiChatMessages(locale()).toolRejected({ title: title() })}
+      label={toolOutcome(props.block, "rejected", locale()) ?? aiChatMessages(locale()).toolRejected({ title: title() })}
       accent={presentation()?.appAccent}
     />
   );
@@ -694,6 +712,9 @@ function ToolBlockView(props: { turnId: string; block: ToolBlock; active?: boole
         <Match when={isCardToolName(props.block.name) && !props.block.isError}>
           <CloudCardBlock args={props.block.args} />
         </Match>
+        <Match when={isChartToolName(props.block.name) && !props.block.isError}>
+          <CloudChartBlock args={props.block.args} completed={status() === "completed"} />
+        </Match>
         <Match when={isSurveyToolName(props.block.name) && !props.block.isError}>
           <SurveyToolView turnId={props.turnId} block={props.block} active={props.active} />
         </Match>
@@ -791,7 +812,22 @@ export function CompactToolRow(props: { block: ToolBlock; busy?: boolean }) {
   const locale = useLocale();
   const t = () => aiChatMessages(locale());
   const args = () => (isRecord(props.block.args) ? props.block.args : {});
-  const detail = () => [args().path, args().name, args().query, args().title].find((value) => typeof value === "string");
+  /**
+   * A call that acts on something reads as its sentence, which already names what it acts on: what it will do while
+   * it runs or waits, what it did once done, and what did not happen when it was rejected.
+   */
+  const sentence = () => {
+    const status = props.block.status;
+    const outcome =
+      status === "completed" && !props.block.isError
+        ? toolOutcome(props.block, "done", locale())
+        : status === "rejected"
+          ? toolOutcome(props.block, "rejected", locale())
+          : null;
+    return outcome ?? toolSubject(props.block, locale());
+  };
+  const detail = () =>
+    sentence() ? undefined : [args().path, args().name, args().query, args().title].find((value) => typeof value === "string");
   const waiting = () => props.block.status === "awaiting_client" || props.block.status === "awaiting_approval";
   const state = () =>
     waiting() ? t().stepWaiting : props.block.status === "rejected" ? t().stepRejected : isFailedTool(props.block) ? t().stepFailed : "";
@@ -819,7 +855,7 @@ export function CompactToolRow(props: { block: ToolBlock; busy?: boolean }) {
   return (
     <AiToolActivity
       blockId={props.block.id}
-      label={props.block.presentation?.title ?? displayToolName(props.block.name, locale())}
+      label={sentence() ?? props.block.presentation?.title ?? displayToolName(props.block.name, locale())}
       description={[
         props.block.status === "running" ? (props.block.progress ?? "") : "",
         typeof detail() === "string" ? String(detail()) : "",

package/src/ai/chat/chart-block.tsx

@@ -0,0 +1,79 @@
+import { ChartExplorer, type ChartExplorerColumn, prepareChartSnapshot, useLocale } from "@k2b/ui";
+import { createMemo, Show } from "solid-js";
+import {
+  type CloudAiChartColumn,
+  type CloudAiChartRow,
+  cloudAiChartMarkKey,
+  cloudAiChartRenderOptions,
+  cloudAiChartRows,
+} from "../chart-block";
+import { parseCloudAiChartInput } from "../default-tool-contracts";
+import { aiChatMessages } from "./messages";
+
+const tooltip = (columns: CloudAiChartColumn[], row: CloudAiChartRow) => {
+  const [first, ...rest] = columns;
+  const named = first && !first.numeric;
+  return {
+    title: named ? row.cells[first.id] : undefined,
+    rows: (named ? rest : columns).map((column) => ({ label: column.label, value: row.cells[column.id] ?? "" })),
+  };
+};
+
+/**
+ * One `chart` tool call: the shared chart with its data table and Copy data. The block takes its full size with its
+ * first frame and keeps it; switching to the table scrolls inside the same height. A call whose arguments are not a
+ * valid chart shows nothing while it runs, because the model gets the validation error and the call fails.
+ */
+export function CloudChartBlock(props: { args: unknown; completed: boolean }) {
+  const locale = useLocale();
+  // Live updates replace the block with equal arguments; only a real change redraws.
+  const source = createMemo(() => JSON.stringify(props.args ?? null));
+  const chart = createMemo(() => {
+    // The tool schema drew the chart once to accept it; here it is drawn once more, for display, and the table is
+    // filled from that drawing.
+    const input = parseCloudAiChartInput(JSON.parse(source()));
+    if (!input) return null;
+    try {
+      const rows = cloudAiChartRows(input, locale());
+      const snapshot = prepareChartSnapshot(cloudAiChartRenderOptions(input, locale()), {
+        key: ({ datum }) => cloudAiChartMarkKey(datum),
+        tooltip: ({ datum }) => {
+          const row = rows.add(datum);
+          return tooltip(rows.columns(), row);
+        },
+      });
+      return snapshot.marks.length > 0 ? { input, table: rows.table(), snapshot } : null;
+    } catch {
+      return null;
+    }
+  });
+  return (
+    <Show
+      when={chart()}
+      fallback={
+        <Show when={props.completed}>
+          <p class="text-sm text-secondary">{aiChatMessages(locale()).chartUnavailable}</p>
+        </Show>
+      }
+    >
+      {(value) => (
+        <ChartExplorer
+          title={value().input.title}
+          description={value().input.subtitle ? <span class="text-sm text-secondary">{value().input.subtitle}</span> : undefined}
+          height={value().input.kind === "sparkline" ? "8rem" : "18rem"}
+          data={{ chart: value().snapshot, rows: value().table.rows }}
+          columns={value().table.columns.map(
+            (column): ChartExplorerColumn<CloudAiChartRow> => ({
+              id: column.id,
+              label: column.label,
+              value: (row) => row.cells[column.id] ?? "",
+              sortValue: (row) => row.values[column.id] ?? null,
+              align: column.numeric ? "right" : "left",
+            }),
+          )}
+          renderDetails={false}
+        />
+      )}
+    </Show>
+  );
+}

package/src/ai/chat/message-utils.ts

@@ -311,6 +311,8 @@ export const isRecord = (value: unknown): value is Record<string, unknown> =>
 
 export const isCardToolName = (name: string) => name === "card" || name === "cloud_card";
 
+export const isChartToolName = (name: string) => name === "chart";
+
 export const isSurveyToolName = (name: string) => name === "survey" || name === "cloud_survey";
 
 export const isTextEditorToolName = (name: string) => name === "text_editor" || name === "cloud_text_editor";
@@ -326,6 +328,7 @@ export const displayToolName = (name: string, locale: string) => {
 const BUILT_IN_TOOL_ICONS = new Map<string, string>([
   ["card", "ti ti-layout-cards"],
   ["cloud_card", "ti ti-layout-cards"],
+  ["chart", "ti ti-chart-bar"],
   ["survey", "ti ti-forms"],
   ["cloud_survey", "ti ti-forms"],
   ["text_editor", "ti ti-edit"],

package/src/ai/chat/messages.ts

@@ -9,6 +9,7 @@ const messages = i18n.define({
       tableLinks: "Links",
       tableOpen: "Open",
       tableEmpty: "No matching rows.",
+      chartUnavailable: "This chart cannot be shown.",
       tableCapped: "Showing the first 100 returned rows. The full tool result remains available in details.",
       tableMore: "More rows are available. Ask for the next page or open the result in the application.",
       assistantTurns: "Assistant turns",
@@ -84,6 +85,7 @@ const messages = i18n.define({
       stepDeliveringFile: "Delivering a file",
       stepPreparingView: "Preparing a view",
       stepPreparingCard: "Preparing a card",
+      stepPreparingChart: "Preparing a chart",
       stepCompacting: "Summarizing the conversation",
       stepTool: "Using a tool",
       stepFailed: "failed",
@@ -98,7 +100,7 @@ const messages = i18n.define({
       groupLoad: "Loaded tools and guidance",
       groupFailed: ({ count }: { count: number }) => `${count} failed`,
       groupRejected: ({ count }: { count: number }) => `${count} rejected`,
-      receiptDone: ({ title }: { title: string }) => `${title} done`,
+      receiptDone: ({ title }: { title: string }) => `Done: ${title}`,
       receiptApproved: ({ title }: { title: string }) => `Approved: ${title}`,
       receiptRunning: ({ title }: { title: string }) => `Running: ${title}`,
       approvalNeeded: ({ title }: { title: string }) => `Approval needed: ${title}`,
@@ -106,6 +108,7 @@ const messages = i18n.define({
       receiptRejected: ({ title }: { title: string }) => `Rejected: ${title}`,
       receiptFailed: ({ title }: { title: string }) => `Failed: ${title}`,
       receiptNotRun: ({ title, stopped }: { title: string; stopped: boolean }) => `Not run: ${title}${stopped ? " · stopped" : ""}`,
+      receiptNotRunSentence: ({ sentence, stopped }: { sentence: string; stopped: boolean }) => `${sentence}${stopped ? " · stopped" : ""}`,
       workSteps: "Work steps",
       streamLoginRequired: "Your session has ended. Sign in again to continue this chat.",
       streamAccessDenied: "You no longer have access to this chat.",
@@ -290,6 +293,7 @@ const messages = i18n.define({
       tableLinks: "Links",
       tableOpen: "Öffnen",
       tableEmpty: "Keine passenden Zeilen.",
+      chartUnavailable: "Dieses Diagramm kann nicht angezeigt werden.",
       tableCapped:
         "Die ersten 100 zurückgegebenen Zeilen werden angezeigt. Das vollständige Werkzeugergebnis bleibt in den Details verfügbar.",
       tableMore: "Weitere Zeilen sind verfügbar. Frage nach der nächsten Seite oder öffne das Ergebnis in der Anwendung.",
@@ -372,6 +376,7 @@ const messages = i18n.define({
       stepDeliveringFile: "Stellt eine Datei bereit",
       stepPreparingView: "Bereitet eine Ansicht vor",
       stepPreparingCard: "Bereitet eine Karte vor",
+      stepPreparingChart: "Bereitet ein Diagramm vor",
       stepCompacting: "Fasst das Gespräch zusammen",
       stepTool: "Nutzt ein Werkzeug",
       stepFailed: "fehlgeschlagen",
@@ -386,7 +391,7 @@ const messages = i18n.define({
       groupLoad: "Werkzeuge und Wissen geladen",
       groupFailed: ({ count }) => `${count} fehlgeschlagen`,
       groupRejected: ({ count }) => `${count} abgelehnt`,
-      receiptDone: ({ title }) => `${title} erledigt`,
+      receiptDone: ({ title }) => `Erledigt: ${title}`,
       receiptApproved: ({ title }) => `Freigegeben: ${title}`,
       receiptRunning: ({ title }) => `Wird ausgeführt: ${title}`,
       approvalNeeded: ({ title }) => `Freigabe nötig: ${title}`,
@@ -394,6 +399,7 @@ const messages = i18n.define({
       receiptRejected: ({ title }) => `Abgelehnt: ${title}`,
       receiptFailed: ({ title }) => `Fehlgeschlagen: ${title}`,
       receiptNotRun: ({ title, stopped }) => `Nicht ausgeführt: ${title}${stopped ? " · gestoppt" : ""}`,
+      receiptNotRunSentence: ({ sentence, stopped }) => `${sentence}${stopped ? " · gestoppt" : ""}`,
       workSteps: "Arbeitsschritte",
       streamLoginRequired: "Deine Sitzung ist abgelaufen. Melde dich erneut an, um diesen Chat fortzusetzen.",
       streamAccessDenied: "Du hast keinen Zugriff mehr auf diesen Chat.",

package/src/ai/chat/tool-names.ts

@@ -10,6 +10,7 @@ const toolNames = i18n.define({
     en: {
       calculate: "Calculate",
       card: "Card",
+      chart: "Chart",
       survey: "Survey",
       text_editor: "Text editor",
       local_bash: "Local Bash",
@@ -77,6 +78,7 @@ const toolNames = i18n.define({
     de: {
       calculate: "Rechnen",
       card: "Karte",
+      chart: "Diagramm",
       survey: "Umfrage",
       text_editor: "Texteditor",
       local_bash: "Lokale Bash",

package/src/ai/chat/turn-layout.ts

@@ -1,7 +1,7 @@
 import { type AiTurnBlock, isRenderableTurnBlock } from "../protocol";
 import type { AiStoredMessage } from "../types";
 import { hasCapabilityTable } from "./capability-result";
-import { isCardToolName, isRecord, isSurveyToolName, isTextEditorToolName } from "./message-utils";
+import { isCardToolName, isChartToolName, isRecord, isSurveyToolName, isTextEditorToolName } from "./message-utils";
 import { isFailedTool } from "./tool-groups";
 
 type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
@@ -69,7 +69,7 @@ const isResult = (block: ToolBlock, phase: AiTurnPhase, codePresentations: boole
   // A running delivery reserves its place once its arguments arrived: a new version of an earlier result must find the
   // earlier place before it takes one of its own.
   const delivered = block.status === "completed" || (live(phase) && block.status === "running" && block.args !== undefined);
-  if (block.name === "present" || isCardToolName(block.name)) return delivered;
+  if (block.name === "present" || isCardToolName(block.name) || isChartToolName(block.name)) return delivered;
   if (block.name === "code_present") return codePresentations && delivered;
   return hasCapabilityTable(block);
 };

package/src/ai/chat/turn-view.tsx

@@ -17,6 +17,7 @@ import {
 import { markdown } from "../../shared";
 import { AI_TURN_LEASE_MS, type AiTurnBlock } from "../protocol";
 import type { AiTurnError } from "../types";
+import { toolOutcome, toolSubject } from "./action-sentences";
 import {
   type AiApprovalDecision,
   ApprovalBlockView,
@@ -26,9 +27,18 @@ import {
   TextEditorToolView,
 } from "./blocks";
 import { CapabilityTablePreview } from "./capability-table";
+import { CloudChartBlock } from "./chart-block";
 import { PresentToolBlock } from "./file-tools";
 import { useAiChatActions } from "./message-actions";
-import { aiToolIcon, capabilityErrorDescription, displayToolName, isCardToolName, isRecord, isSurveyToolName } from "./message-utils";
+import {
+  aiToolIcon,
+  capabilityErrorDescription,
+  displayToolName,
+  isCardToolName,
+  isChartToolName,
+  isRecord,
+  isSurveyToolName,
+} from "./message-utils";
 import { aiChatMessages } from "./messages";
 import { AssistantMarkdownBlock } from "./primitives";
 import { AiToolActivity, AiToolDisclosureProvider, type AiToolDisclosureState } from "./tool-disclosure";
@@ -133,6 +143,7 @@ const stepPhrase = (block: AiTurnBlock | null, t: Messages, withTargets: boolean
   if (name === "present") return withTarget(t.stepDeliveringFile);
   if (name === "code_present") return withTarget(t.stepPreparingView);
   if (isCardToolName(name)) return t.stepPreparingCard;
+  if (isChartToolName(name)) return t.stepPreparingChart;
   if (["code_write", "code_create", "code_update", "code_fork", "code_remove", "code_restore"].includes(name))
     return withTarget(t.stepWritingCode);
   if (["code_run", "code_action", "code_sql"].includes(name)) return withTarget(t.stepRunningCode);
@@ -436,6 +447,9 @@ function AiTurnResultView(props: { result: Accessor<AiTurnResult | undefined>; r
           <Match when={isCardToolName(current().name)}>
             <CloudCardBlock args={current().args} />
           </Match>
+          <Match when={isChartToolName(current().name)}>
+            <CloudChartBlock args={current().args} completed={current().status === "completed"} />
+          </Match>
           <Match when={true}>
             <Show when={!props.receipt()}>
               <CapabilityResultRow block={current()} />
@@ -455,33 +469,37 @@ type ReceiptState = Exclude<AiTurnActionState, "open" | "interaction">;
 
 /**
  * One line for an action in place 4, the same element while it runs and once it is done, rejected, failed, or not run.
- * It names the action in the reader's language with what it acted on, such as "Rejected: Run code · report.ts", or the
- * application's own summary of what it did.
+ * It says what happened in the owning app's words: its sentence for the outcome, such as "Moved report.pdf to the
+ * trash", else, once done, the application's own summary of the call. Without either it puts the state in the reader's
+ * language before what the call does, such as "Rejected: Write report.md", or before its title and target.
  */
 function AiReceipt(props: { block: ToolBlock; state: ReceiptState; stopped: boolean }) {
   const locale = useLocale();
   const t = () => aiChatMessages(locale());
   const block = () => props.block;
   const subject = () => {
+    const sentence = toolSubject(block(), locale());
+    if (sentence) return sentence;
     const title = block().presentation?.title ?? displayToolName(block().name, locale());
     const target = toolTarget(block());
     return target ? `${title} · ${target}` : title;
   };
+  const capabilityAction = () => block().presentation?.kind === "capability";
   const links = () => (props.state === "done" ? resultLinks(block()) : []);
   const label = () => {
     const state = props.state;
     if (state === "running") return t().receiptRunning({ title: subject() });
     if (state === "done") {
-      const summary = resultSummary(block());
-      if (summary) return summary;
       // A tool that is not a Cloud action has no effect of its own to report; the receipt records the decision.
-      return block().presentation?.kind === "capability"
-        ? t().receiptDone({ title: subject() })
-        : t().receiptApproved({ title: subject() });
+      if (!capabilityAction()) return t().receiptApproved({ title: subject() });
+      return toolOutcome(block(), "done", locale()) || resultSummary(block()) || t().receiptDone({ title: subject() });
     }
-    if (state === "rejected") return t().receiptRejected({ title: subject() });
+    if (state === "rejected") return toolOutcome(block(), "rejected", locale()) ?? t().receiptRejected({ title: subject() });
     if (state === "failed") return t().receiptFailed({ title: subject() });
-    return t().receiptNotRun({ title: subject(), stopped: props.stopped });
+    const notRun = toolOutcome(block(), "notRun", locale());
+    return notRun
+      ? t().receiptNotRunSentence({ sentence: notRun, stopped: props.stopped })
+      : t().receiptNotRun({ title: subject(), stopped: props.stopped });
   };
   const declined = () => props.state === "rejected" || props.state === "not_run";
   return (
@@ -529,7 +547,7 @@ function AiTurnActionView(props: { action: Accessor<AiTurnAction | undefined>; t
       if (next !== "open" || previous === "open" || !isLive(props.phase) || current?.block.status !== "awaiting_approval") return;
       announce(
         aiChatMessages(locale()).approvalNeeded({
-          title: current.block.presentation?.title ?? displayToolName(current.block.name, locale()),
+          title: toolSubject(current.block, locale()) ?? current.block.presentation?.title ?? displayToolName(current.block.name, locale()),
         }),
       );
     }),

package/src/ai/code-runtime-tools.ts

@@ -3,8 +3,10 @@ import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { getApp } from "../_internal/registry";
 import type { RequestActor } from "../server";
+import { IDENTITY_REFRESH_TIMEOUT_MS } from "../services/identity/constants";
 import { signInvocationToken } from "../services/identity/invocation-token";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
+import { logger } from "../services/logging";
 import { LOCALE_HEADER } from "../shared/locale";
 import { TIMEZONE_COOKIE } from "../shared/time";
 import { CodeToolFailure } from "./browser-code-contracts";
@@ -13,6 +15,9 @@ import { CODE_CAPABILITY_TOKEN_HEADER, codeCapabilityOperation } from "./code-ca
 import { authorizeCodeExecution } from "./code-execution";
 import { aiConversations } from "./store";
 
+const log = logger("ai:code-runtime");
+const ISSUANCE_TIMEOUT_MS = 5_000;
+
 const Reply = z.object({
   ok: z.literal(true),
   data: z.object({
@@ -49,54 +54,64 @@ export const runManagedCodeTool =
     await context.reportProgress?.(context.locale?.startsWith("de") ? "Ausführungshost verbinden" : "Connecting execution host");
     const app = await getApp("assistant");
     if (!app) throw new Error("Assistant code host is unavailable");
+    const issue = async (audience: { targetAppId: string; callingAppId: string; operation: string }) => {
+      // A token is signed before its request goes out, so a timed-out issuance
+      // never reached the host and is safe to repeat. Retry long enough for a
+      // stalled shared refresh to finish or fall back to the cached key. Every
+      // timeout used up a full attempt or ended a shared load, so this cannot spin.
+      const giveUpAt = Date.now() + IDENTITY_REFRESH_TIMEOUT_MS + ISSUANCE_TIMEOUT_MS;
+      while (true) {
+        try {
+          return await withActiveIdentitySigner(
+            "invocation",
+            (signer) =>
+              signInvocationToken({
+                ...audience,
+                schemaHash: null,
+                authority: {
+                  sub: actor.user.id,
+                  principal_type: "user",
+                  access_subject_type: "user",
+                  access_subject_id: actor.user.id,
+                  credential_kind: "session",
+                  scopes: [],
+                },
+                signer,
+                issuer: signer.issuer,
+              }),
+            { signal: context.signal, timeoutMs: ISSUANCE_TIMEOUT_MS },
+          );
+        } catch (error) {
+          if (context.signal.aborted || !(error instanceof DOMException && error.name === "TimeoutError")) throw error;
+          if (Date.now() < giveUpAt) continue;
+          log.warn("Code call gave up on identity issuance", { tool: name, error: error.message });
+          throw new Error(
+            context.locale?.startsWith("de")
+              ? "Der Identitätsdienst hat nicht rechtzeitig geantwortet. Prüfe, ob dieser Aufruf schon gestartet ist, bevor du ihn erneut ausführst."
+              : "The identity service did not respond in time. Check whether this call already started before running it again.",
+            { cause: error },
+          );
+        }
+      }
+    };
+    // Polls run every 250 ms for as long as the code runs. Reuse both tokens
+    // while they stay valid for at least 10 s, so a long run or an approval
+    // round trip does not depend on a fresh issuance for every poll.
+    const usable = (token: Awaited<ReturnType<typeof signInvocationToken>> | undefined) =>
+      token && token.claims.exp * 1000 - Date.now() >= 10_000 ? token : undefined;
+    let signed: Awaited<ReturnType<typeof signInvocationToken>> | undefined;
     let callback: Awaited<ReturnType<typeof signInvocationToken>> | undefined;
     const request = async (decision?: { id: string; approved: boolean }) => {
       context.signal.throwIfAborted();
       await authorizeCodeExecution(context.conversationId!, context.turnId!, actor.user.id);
-      const signed = await withActiveIdentitySigner(
-        "invocation",
-        (signer) =>
-          signInvocationToken({
-            targetAppId: "assistant",
-            callingAppId: "core",
-            operation: `tool:${name}`,
-            schemaHash: null,
-            authority: {
-              sub: actor.user.id,
-              principal_type: "user",
-              access_subject_type: "user",
-              access_subject_id: actor.user.id,
-              credential_kind: "session",
-              scopes: [],
-            },
-            signer,
-            issuer: signer.issuer,
-          }),
-        { signal: context.signal, timeoutMs: 5000 },
-      );
-      if (!callback || callback.claims.exp * 1000 - Date.now() < 10_000) {
-        callback = await withActiveIdentitySigner(
-          "invocation",
-          (signer) =>
-            signInvocationToken({
-              targetAppId: "core",
-              callingAppId: "assistant",
-              operation: codeCapabilityOperation(context.conversationId!, context.turnId!),
-              schemaHash: null,
-              authority: {
-                sub: actor.user.id,
-                principal_type: "user",
-                access_subject_type: "user",
-                access_subject_id: actor.user.id,
-                credential_kind: "session",
-                scopes: [],
-              },
-              signer,
-              issuer: signer.issuer,
-            }),
-          { signal: context.signal, timeoutMs: 5000 },
-        );
-      }
+      signed = usable(signed) ?? (await issue({ targetAppId: "assistant", callingAppId: "core", operation: `tool:${name}` }));
+      callback =
+        usable(callback) ??
+        (await issue({
+          targetAppId: "core",
+          callingAppId: "assistant",
+          operation: codeCapabilityOperation(context.conversationId!, context.turnId!),
+        }));
       const headers = new Headers({ authorization: `Bearer ${signed.token}`, "content-type": "application/json" });
       headers.set(CODE_CAPABILITY_TOKEN_HEADER, callback.token);
       if (context.locale) headers.set(LOCALE_HEADER, context.locale);