@aparte/core 0.19.3 → 0.20.0

package/dist/{dialog-triggers-ChnPFG9M.js → dialog-triggers-3Rk7PuZa.js}

@@ -92,6 +92,8 @@ const APARTE_DEFAULT_LOCALE = {
   stopButton: "Stop",
   elicitationRecommended: "Recommended",
   elicitationSkip: "Skip",
+  elicitationHide: "Hide for now",
+  elicitationWaiting: "Waiting for your answer",
   elicitationYes: "Yes",
   elicitationNo: "No",
   elicitationAnswerLabel: "Your answer",
@@ -113,10 +115,13 @@ const APARTE_DEFAULT_LOCALE = {
   approvalArgsLabel: "Arguments",
   actionUpload: "Attach file",
   removeAttachment: "Remove {name}",
+  messageFrom: "Message from {name}",
   selectSearchPlaceholder: "Search…",
   selectSearchLabel: "Search options",
   loading: "Loading…",
   download: "Download",
+  openArtifact: "Open",
+  modelContextWindow: "{n} context",
   previewPending: "Press Preview to run this artifact.",
   sandboxError: "The sandbox failed during generation.",
   sandboxErrorHint: "Common cause: the model produced invalid code (undefined variable, wrong argument type). Retry the request — the model may produce different code.",
@@ -148,6 +153,7 @@ const APARTE_DEFAULT_LOCALE = {
   messageInfo: "Details",
   newChat: "New Chat",
   loadingConversations: "Loading conversations",
+  conversationSearchEmpty: "No conversation matches",
   conversationList: "Conversations",
   loadingConversation: "Loading the conversation",
   deleteConversation: "Delete",
@@ -1025,6 +1031,46 @@ function renumberSegments(segments) {
     segments[i] = { ...segment, index: i };
   }
 }
+const APARTE_HOST_ATTR = "data-aparte-host";
+const CONFIG_SLOT = Symbol.for("aparte.instanceConfig");
+function notifyConfigChanged(root, next, previous) {
+  if (next === previous) return;
+  const call = (el2) => {
+    const hook = el2.aparteConfigChanged;
+    if (typeof hook === "function") hook.call(el2, next, previous);
+  };
+  call(root);
+  for (const el2 of root.querySelectorAll("*")) call(el2);
+}
+function attachConfig(el2, config) {
+  const previous = el2[CONFIG_SLOT] ?? resolveConfig(el2.parentElement);
+  el2[CONFIG_SLOT] = config;
+  el2.setAttribute(APARTE_HOST_ATTR, "");
+  notifyConfigChanged(el2, config, previous);
+}
+function detachConfig(el2) {
+  const previous = el2[CONFIG_SLOT];
+  delete el2[CONFIG_SLOT];
+  el2.removeAttribute(APARTE_HOST_ATTR);
+  if (previous) notifyConfigChanged(el2, resolveConfig(el2.parentElement), previous);
+}
+function resolveConfig(el2) {
+  const host = el2?.closest?.(`[${APARTE_HOST_ATTR}]`);
+  return host?.[CONFIG_SLOT] ?? aparteGlobalConfig;
+}
+let _renderConfig = null;
+function runWithConfig(config, fn) {
+  const prev = _renderConfig;
+  _renderConfig = config;
+  try {
+    return fn();
+  } finally {
+    _renderConfig = prev;
+  }
+}
+function contextConfig(el2) {
+  return _renderConfig ?? resolveConfig(el2);
+}
 function dispatchLifecycleEvent(target, name, detail, targetId) {
   const id = targetId ?? (target.id || void 0);
   const stamped = detail && typeof detail === "object" ? { targetId: id, ...detail } : detail;
@@ -1061,8 +1107,7 @@ function createStreamAdapter(opts) {
           const seg = {
             id: `think-${uuid()}`,
             type: "thinking",
-            content: thinkingContent,
-            collapsed: true
+            content: thinkingContent
           };
           thinkingId = seg.id;
           streaming.add(seg.id);
@@ -1074,7 +1119,9 @@ function createStreamAdapter(opts) {
       }
       case "text-delta": {
         if (thinkingId && !thinkingCollapsed) {
-          target.updateSegment?.(thinkingId, { collapsed: true, isStreaming: false });
+          const chatConfig = typeof Element !== "undefined" && target instanceof Element ? resolveConfig(target) : config;
+          const keepOpen = chatConfig.getSegmentDefaults("thinking")?.collapsed === false;
+          target.updateSegment?.(thinkingId, keepOpen ? { isStreaming: false } : { collapsed: true, isStreaming: false });
           thinkingCollapsed = true;
         }
         const result = parser.parse(e.delta);
@@ -1813,6 +1860,26 @@ const APARTE_DEFAULT_HOST_HANDLERS = {
 };
 const NOOP = () => {
 };
+const renderingVersions = /* @__PURE__ */ new WeakMap();
+function renderingVersionOf(cfg) {
+  return renderingVersions.get(cfg) ?? 0;
+}
+function bumpRenderingVersion(cfg) {
+  renderingVersions.set(cfg, renderingVersionOf(cfg) + 1);
+}
+function drawingOf(provider, name) {
+  if (!provider || !(name in provider) || name in Object.prototype) return void 0;
+  const fn = provider[name];
+  return typeof fn === "function" ? fn.bind(provider) : void 0;
+}
+const iconLayers = /* @__PURE__ */ new WeakSet();
+function namesOf(provider) {
+  const names = /* @__PURE__ */ new Set();
+  for (let o = provider; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
+    for (const name of Object.getOwnPropertyNames(o)) if (name !== "constructor") names.add(name);
+  }
+  return [...names];
+}
 class AparteConfig {
   _markdownProvider;
   _streamingMarkdownProvider;
@@ -1844,15 +1911,13 @@ class AparteConfig {
   /**
    * What `refreshProviderModels()` last brought back, per provider.
    *
-   * Without it, `getCurrentModel()` read `provider.getModels()` only — the
-   * SYNCHRONOUS, hand-declared list, which every preset of
-   * `@aparte/provider-openai-compat` leaves empty because a compat endpoint's
-   * list is fetched at runtime. So the current model resolved to `undefined`
-   * for the documented primary path, and everything that reads a capability off
-   * it silently got nothing: `AparteClient._toolsForCurrentModel()` gates tools
-   * on `capabilities.includes('function_calling')`, so NO tool was ever sent to
-   * the model. A registered tool, an approval gate, `<aparte-elicitation>` — all
-   * dead, with the model answering, correctly, that it had been given no tools.
+   * `getCurrentModel()` reads it beside `provider.getModels()`, the SYNCHRONOUS,
+   * hand-declared list, which every preset of `@aparte/provider-openai-compat`
+   * leaves empty because a compat endpoint's list is fetched at runtime. Without
+   * the fetched list the current model resolves to `undefined`, and its declared
+   * capabilities are unknown: `AparteClient._toolsForCurrentModel()` still sends the
+   * tools then, and it is the fetched list that lets a model which declares no
+   * `function_calling` be honoured.
    */
   _fetchedModels = /* @__PURE__ */ new Map();
   _modelConfig = {};
@@ -1887,9 +1952,8 @@ class AparteConfig {
    *     silently, because the warning fires at most once per config.
    *
    * Each entry carries the element that registered it, so a request naming a `target`
-   * is routed to the presenter in the SAME chat. `AparteElicitationRequest.target` was
-   * already documented as "used to resolve WHICH instance presents"; the single slot
-   * is what made that impossible.
+   * is routed to the presenter in the SAME chat, as `AparteElicitationRequest.target`
+   * documents ("used to resolve WHICH instance presents").
    */
   _elicitationPresenters = [];
   /** Warn once per config, not once per request — a tool loop can ask repeatedly. */
@@ -1899,22 +1963,21 @@ class AparteConfig {
    *
    * One request reaches the presenter at a time — not because a presenter could not
    * cope, but because the COMPOSER cannot: it has one panel slot, and a second
-   * request used to clobber the first's DOM. The previous protection lived in the
-   * default presenter, which answered the second request `cancel` on the spot; that
-   * is a refusal invented for a question nobody was ever shown, the same class of
-   * lie as telling the model a stopped turn was refused. WAITING is the honest
-   * behaviour.
+   * request would clobber the first's DOM. A second request WAITS: answering it
+   * `cancel` on the spot would be a refusal invented for a question nobody was ever
+   * shown.
    *
    * Here rather than in the presenter because this is the only place that sees
-   * EVERY request whatever raised it — a tool handler, an app's own button, and
-   * (soon) the tool-approval gate. A custom presenter registered by a consumer gets
-   * the same protection for free, which it previously had none of.
+   * EVERY request whatever raised it — a tool handler, an app's own button, the
+   * tool-approval gate. A custom presenter registered by a consumer gets the same
+   * protection for free.
    */
   _elicitationQueue = /* @__PURE__ */ new Map();
   // Tool Registry
   _tools = /* @__PURE__ */ new Map();
   _toolRenderers = /* @__PURE__ */ new Map();
   _toolSummaries = /* @__PURE__ */ new Map();
+  _toolInputFormatters = /* @__PURE__ */ new Map();
   /** Tagged blocks the stream parser recognises in the prose — see {@link registerStreamBlock}. */
   _streamBlocks = /* @__PURE__ */ new Map();
   _segmentDefaults = /* @__PURE__ */ new Map();
@@ -2007,6 +2070,8 @@ class AparteConfig {
    */
   setMarkdownProvider(fn) {
     this._markdownProvider = fn;
+    bumpRenderingVersion(this);
+    this._notify();
   }
   /**
    * Set an incremental (streaming) Markdown renderer provider. Optional —
@@ -2021,6 +2086,8 @@ class AparteConfig {
    */
   setStreamingMarkdownProvider(fn) {
     this._streamingMarkdownProvider = fn;
+    bumpRenderingVersion(this);
+    this._notify();
   }
   /**
    * Create an incremental Markdown renderer bound to `target`, or `null` when
@@ -2036,6 +2103,8 @@ class AparteConfig {
    */
   setHighlightProvider(fn) {
     this._highlightProvider = fn;
+    bumpRenderingVersion(this);
+    this._notify();
   }
   /**
    * Whether a syntax-highlight provider is registered. Lets consumers (e.g.
@@ -2103,30 +2172,54 @@ class AparteConfig {
     return resolved.trim() || null;
   }
   /**
-   * Set a custom Icon provider (e.g., Lucide, FontAwesome, Material)
+   * Set a custom Icon provider (e.g., Lucide, FontAwesome, Material). It replaces the
+   * whole set, icons added with `registerIcons` included; a name it leaves out keeps
+   * core's drawing.
    * @param provider Object implementing AparteIconProvider interface
    */
   setIconProvider(provider) {
     this._iconProvider = provider;
     this._notify();
   }
+  /**
+   * Add icons to the set, or redraw some of it, keeping the others. A name core does not
+   * draw is welcome: an action's `icon`, `<aparte-composer-action icon>` and
+   * `<aparte-icon name>` then find it. To type such a name, merge it into
+   * `AparteIconProvider`: `declare module '@aparte/core' { interface AparteIconProvider { share?: () => string } }`.
+   *
+   * @example
+   * aparteGlobalConfig.registerIcons({ share: () => '<svg class="aparte-icon" viewBox="0 0 24 24">…</svg>' });
+   * aparteGlobalConfig.registerAction({ id: 'share', icon: 'share', label: 'Share', zones: ['bubble'] });
+   */
+  registerIcons(icons) {
+    const current = this._iconProvider;
+    if (current && iconLayers.has(current)) {
+      Object.assign(current, icons);
+    } else {
+      const layer = Object.assign(Object.create(current ?? null), icons);
+      iconLayers.add(layer);
+      this._iconProvider = layer;
+    }
+    this._notify();
+  }
   /**
    * The icon set as a **complete** provider: every name resolves, falling back
    * to `APARTE_DEFAULT_ICON_FALLBACKS` for anything the registered provider doesn't
    * implement. Callers (bubble action bar, composer controls) can therefore
    * invoke `icons.copy()` unconditionally.
    *
-   * It used to hand back the registered provider verbatim, so a provider that
-   * implemented a subset — which `getIcon()` has always supported, and which
-   * the type now states — crashed every other icon with
-   * "icons.retry is not a function".
+   * A registered provider may implement only a subset of the names; the missing ones
+   * fall back, so `icons.retry()` never throws "is not a function".
    */
   getIconProvider() {
     const registered = this._iconProvider;
     const complete = {};
     for (const name of Object.keys(APARTE_DEFAULT_ICON_FALLBACKS)) {
-      const fn = registered?.[name];
-      complete[name] = fn ?? (() => APARTE_DEFAULT_ICON_FALLBACKS[name]);
+      complete[name] = drawingOf(registered, name) ?? (() => APARTE_DEFAULT_ICON_FALLBACKS[name]);
+    }
+    for (const name of namesOf(registered)) {
+      const fn = drawingOf(registered, name);
+      if (fn && !(name in complete)) complete[name] = fn;
     }
     return complete;
   }
@@ -2258,14 +2351,10 @@ class AparteConfig {
     this._locale = { ...this._locale, ...translations };
     this._notify();
   }
-  /**
-   * Get icon HTML string by name
-   * Falls back to textual representation if no provider is set
-   */
   getIcon(name) {
-    const icon = this._iconProvider?.[name];
+    const icon = drawingOf(this._iconProvider, name);
     if (icon) return icon();
-    return APARTE_DEFAULT_ICON_FALLBACKS[name];
+    return Object.prototype.hasOwnProperty.call(APARTE_DEFAULT_ICON_FALLBACKS, name) ? APARTE_DEFAULT_ICON_FALLBACKS[name] : void 0;
   }
   /**
    * Set a custom Key provider (e.g., AparteVault override)
@@ -2412,11 +2501,14 @@ class AparteConfig {
   /**
    * Register a model preference provider for agnostic persistence.
    * The host app decides how/where to store the selected provider & model.
+   * `load` answers `{ provider, model }` — the names {@link AparteModelPreference} reads —
+   * and {@link AparteConfig.restoreModelPreference | restoreModelPreference()} applies it.
    * @example
    * aparteGlobalConfig.setModelPreferenceProvider({
-   *   save: (p, m) => localStorage.setItem('model', JSON.stringify({p, m})),
-   *   load: () => JSON.parse(localStorage.getItem('model') ?? 'null')
+   *   save: (provider, model) => localStorage.setItem('model', JSON.stringify({ provider, model })),
+   *   load: () => JSON.parse(localStorage.getItem('model') ?? 'null'),
    * });
+   * aparteGlobalConfig.restoreModelPreference();
    */
   setModelPreferenceProvider(provider) {
     this._modelPreferenceProvider = provider;
@@ -2463,7 +2555,7 @@ class AparteConfig {
     return { verdict: tool?.needsApproval ? "ask" : "allow" };
   }
   /**
-   * Restore previously saved model preference via the registered provider.
+   * Restore the saved model preference via the registered provider.
    * Should be called once at app startup, before any component mounts.
    * No-op if no provider is registered or nothing was saved. The saved selection is
    * applied without being saved again.
@@ -2527,25 +2619,17 @@ class AparteConfig {
   /**
    * Elicitation policy: whether a choice offers a free-text "Other…" escape.
    *
-   * This is the HOST's decision, not the model's. `ask_user` used to carry an
-   * `allow_other` field in the schema it hands the model, which meant the model
-   * decided your UX — and a small model fills a field it does not understand: one
-   * sent two questions with `allow_other: true` and no options at all, so the
-   * panel rendered a radio list whose only entry was "Other…", twice.
-   *
-   * Every serious implementation of this pattern makes the escape hatch a property
-   * of the surface rather than of the request. Default `true`, which is what the
-   * panel did before, so nothing a user sees changes — only who gets to say so.
-   * A direct `requestUserInput` caller can still set `allowOther` per field; that
-   * is the app talking, and it wins.
+   * This is the HOST's decision, not the model's: the `ask_user` schema handed to the
+   * model carries no `allow_other` field, because a small model fills a field it does
+   * not understand (a question with `allow_other: true` and no options renders a radio
+   * list whose only entry is "Other…"). Default `true`. A direct `requestUserInput`
+   * caller can still set `allowOther` per field; that is the app talking, and it wins.
    *
    * `layout` decides how a form of SEVERAL questions is presented.
    * `'stepped'` (default) asks them one at a time with a chip per question;
-   * `'stacked'` puts them all in the panel at once. Stacked was the only shape,
-   * inherited unexamined from MCP elicitation — which describes a FORM for
-   * collecting structured data, not two different questions asked mid-conversation.
-   * No product asks a person two questions by stacking them in one box; it is kept
-   * as an option because the form case is real, not because it was the right default.
+   * `'stacked'` puts them all in the panel at once — the shape of an MCP elicitation
+   * FORM collecting structured data, which is why it stays an option, but not the
+   * right default for two different questions asked mid-conversation.
    *
    * `answerOnClick` decides how a question asked ON ITS OWN with a single choice — an
    * `enum` without `multiple` or a `default`, a `boolean` without a `default` — is
@@ -2745,8 +2829,8 @@ class AparteConfig {
    * is a string, so a consumer's own segment type is covered by the same call.
    *
    * The problem it solves: a consumer streaming a reply does not CONSTRUCT its
-   * segments — the parser does — so there was no hook at all for "reasoning blocks
-   * open in my app". Per-segment fields only reach segments you build yourself.
+   * segments — the parser does — so a per-segment field cannot express "reasoning
+   * blocks open in my app": per-segment fields only reach segments you build yourself.
    *
    * Applied where identity is stamped (`utils/segments.ts`), so it covers every
    * path a segment can arrive by — the parser, `addSegment`, and the segments
@@ -2787,8 +2871,8 @@ class AparteConfig {
    * Say what a call targets, in the default row, after the tool's name.
    *
    * The default row names the tool and keeps its arguments behind a disclosure, so a
-   * reader saw that a file was read, not which one. Replacing the row with
-   * `registerToolRenderer` for that one line meant re-implementing its six states,
+   * reader sees that a file was read, not which one. Replacing the row with
+   * `registerToolRenderer` for that one line would mean re-implementing its six states,
    * the spinner, the disclosure and the relabel contract. This keeps all of them and
    * adds the line. A tool with its own renderer draws its own row, so its summary is
    * never read.
@@ -2814,6 +2898,27 @@ class AparteConfig {
   getToolSummary(toolName) {
     return this._toolSummaries.get(toolName);
   }
+  /**
+   * Show a tool's arguments as a person reads them, in the approval panel and in the
+   * default tool row's disclosure — one formatter for both. Without one, both show the
+   * JSON the model sent.
+   *
+   * @example
+   * // Approve "write_file notes.md (2 KB)" rather than a JSON object.
+   * aparteGlobalConfig.registerToolInputFormatter('write_file', (input) =>
+   *     `${String(input['path'] ?? '')} (${Math.ceil(String(input['content'] ?? '').length / 1024)} KB)`);
+   */
+  registerToolInputFormatter(toolName, formatter) {
+    this._toolInputFormatters.set(toolName, formatter);
+  }
+  /** Unregister a tool's input formatter. */
+  unregisterToolInputFormatter(toolName) {
+    this._toolInputFormatters.delete(toolName);
+  }
+  /** Get the input formatter for a tool name. Returns undefined if none registered. */
+  getToolInputFormatter(toolName) {
+    return this._toolInputFormatters.get(toolName);
+  }
   /**
    * Teach the stream parser a tagged block: `<tag attr="…">…</tag>` in the model's
    * prose becomes the segment `toSegment` builds, streamed delta by delta.
@@ -2908,7 +3013,7 @@ class AparteConfig {
    * the same chat is the right one — found by comparing chat boundaries rather than by
    * `contains`, because the presenter is a sibling of the transcript, not an ancestor
    * of it. With no target, no match, or no boundary to compare, the top of the stack
-   * is the answer, which is exactly the old single-slot behaviour.
+   * is the answer.
    */
   _presenterFor(target) {
     const stack = this._elicitationPresenters;
@@ -2959,11 +3064,10 @@ class AparteConfig {
    *
    * The wait exists so a second question cannot take the panel away from the one on
    * screen — a property of ONE panel, and `_present` routes by target, so a chat is
-   * the right unit. It used to be one queue for the whole config: two chats on the
-   * global config shared it, and an approval waiting for an answer in the first (which
-   * is all an approval does) held the second's question behind it for ever, with
-   * nothing on screen to answer. Requests that name no chat keep sharing the `null`
-   * queue, because they all reach the same presenter — the top of the stack.
+   * the right unit. One queue for the whole config would let an approval waiting in
+   * the first chat hold the second chat's question behind it for ever. Requests that
+   * name no chat share the `null` queue, because they all reach the same presenter —
+   * the top of the stack.
    */
   _elicitationQueueKey(request) {
     return chatBoundaryOf(request.target);
@@ -2981,7 +3085,14 @@ class AparteConfig {
       return Promise.reject(new AparteElicitationAbortError("no-presenter"));
     }
     if (request.signal?.aborted) return Promise.reject(new AparteElicitationAbortError("aborted"));
-    return presenter(request);
+    const answer = presenter(request);
+    const signal = request.signal;
+    if (!signal) return answer;
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(new AparteElicitationAbortError("aborted"));
+      signal.addEventListener("abort", onAbort, { once: true });
+      answer.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    });
   }
   /**
    * Put the configuration back to its defaults: the providers and the selected model,
@@ -3018,6 +3129,7 @@ class AparteConfig {
     this._tools.clear();
     this._toolRenderers.clear();
     this._toolSummaries.clear();
+    this._toolInputFormatters.clear();
     this._streamBlocks.clear();
     this._modelConfig = {};
     this._requireModelSelection = false;
@@ -3053,46 +3165,6 @@ function getGlobalConfig() {
   return new AparteConfig();
 }
 const aparteGlobalConfig = getGlobalConfig();
-const APARTE_HOST_ATTR = "data-aparte-host";
-const CONFIG_SLOT = Symbol.for("aparte.instanceConfig");
-function notifyConfigChanged(root, next, previous) {
-  if (next === previous) return;
-  const call = (el2) => {
-    const hook = el2.aparteConfigChanged;
-    if (typeof hook === "function") hook.call(el2, next, previous);
-  };
-  call(root);
-  for (const el2 of root.querySelectorAll("*")) call(el2);
-}
-function attachConfig(el2, config) {
-  const previous = el2[CONFIG_SLOT] ?? resolveConfig(el2.parentElement);
-  el2[CONFIG_SLOT] = config;
-  el2.setAttribute(APARTE_HOST_ATTR, "");
-  notifyConfigChanged(el2, config, previous);
-}
-function detachConfig(el2) {
-  const previous = el2[CONFIG_SLOT];
-  delete el2[CONFIG_SLOT];
-  el2.removeAttribute(APARTE_HOST_ATTR);
-  if (previous) notifyConfigChanged(el2, resolveConfig(el2.parentElement), previous);
-}
-function resolveConfig(el2) {
-  const host = el2?.closest?.(`[${APARTE_HOST_ATTR}]`);
-  return host?.[CONFIG_SLOT] ?? aparteGlobalConfig;
-}
-let _renderConfig = null;
-function runWithConfig(config, fn) {
-  const prev = _renderConfig;
-  _renderConfig = config;
-  try {
-    return fn();
-  } finally {
-    _renderConfig = prev;
-  }
-}
-function contextConfig(el2) {
-  return _renderConfig ?? resolveConfig(el2);
-}
 const APARTE_CONFIG_CHANGE = "aparte-config-change";
 function subscribeConfigChange(el2, handler) {
   const listener = (e) => {
@@ -3150,6 +3222,7 @@ function writeStreamedMarkdown(host, contentEl, content, streaming) {
   contentEl.innerHTML = contextConfig().renderMarkdown(content);
 }
 function highlightMarkdownFences(contentEl) {
+  if (!contextConfig().hasHighlightProvider()) return;
   const blocks = contentEl.querySelectorAll("pre > code:not([data-aparte-highlighted])");
   for (const block of blocks) {
     const pre = block.parentElement;
@@ -3166,6 +3239,16 @@ function highlightMarkdownFences(contentEl) {
 const textRenderer = {
   type: "text",
   render: (segment) => `<div class="aparte-segment aparte-segment-text" data-segment-id="${escapeHtml(segment.id)}"><div class="aparte-segment-content">${contextConfig().renderMarkdown(segment.content)}</div></div>`,
+  /*
+   * A fence in a settled text segment is highlighted, as the thinking renderer does for
+   * its own. The parser turns a streamed fence into a `code` segment, so this only ever
+   * mattered for text built by hand (`setSegments`, a restored message, a server's) — and
+   * the bubble's own pass skips any message that has segments, so that fence stayed bare.
+   */
+  setup: (el2, segment) => {
+    const contentEl = el2.querySelector(".aparte-segment-content");
+    if (contentEl && segment.isStreaming !== true) highlightMarkdownFences(contentEl);
+  },
   update: (el2, segment) => {
     const contentEl = el2.querySelector(".aparte-segment-content");
     if (!contentEl) return;
@@ -3175,6 +3258,7 @@ const textRenderer = {
       segment.content,
       segment.isStreaming !== false
     );
+    if (segment.isStreaming === false) highlightMarkdownFences(contentEl);
   },
   getStyles: () => ``
 };
@@ -3406,10 +3490,7 @@ const errorRenderer = {
     `;
   },
   /**
-   * The icon and the heading. The heading used to be the hardcoded literal `Error`
-   * while `locale.error` — a REQUIRED key, documented, and already translated to
-   * "Erreur" — was read by nothing at all. A translated string with no consumer and
-   * a literal with no translation, in the same card.
+   * The icon and the heading (`locale.error`).
    *
    * Not the message: that is the model's or the transport's text, in whatever
    * language it arrived in. Relabelling it would be inventing content.
@@ -3422,8 +3503,15 @@ const errorRenderer = {
   },
   getStyles: () => ``
 };
-function describeToolInput(input) {
+function describeToolInput(input, format) {
   if (!input || typeof input !== "object" || Object.keys(input).length === 0) return "";
+  if (format) {
+    try {
+      const text = format(input);
+      if (typeof text === "string") return text;
+    } catch {
+    }
+  }
   try {
     return JSON.stringify(input, null, 2);
   } catch {
@@ -3431,7 +3519,7 @@ function describeToolInput(input) {
   }
 }
 function describeInput(segment) {
-  return describeToolInput(segment.toolCall?.input);
+  return describeToolInput(segment.toolCall?.input, contextConfig().getToolInputFormatter(segment.toolCall?.name ?? ""));
 }
 function stateBadge(segment) {
   const cfg = contextConfig();
@@ -3795,6 +3883,19 @@ function withoutDerivedTree(tree) {
     messages: tree.messages.map((entry) => ({ ...entry, message: withoutDerived(entry.message) }))
   };
 }
+function stableStringify(value) {
+  return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, v[k]])) : v);
+}
+function asContent(message) {
+  return adoptMessageSegments(withoutDerived(message));
+}
+function contentOf(messages) {
+  return stableStringify(messages.map(asContent));
+}
+function treeContentOf(tree) {
+  const byId = [...tree.messages].sort((a, b) => a.message.id < b.message.id ? -1 : a.message.id > b.message.id ? 1 : 0);
+  return stableStringify(byId.map((entry) => ({ parentId: entry.parentId, message: asContent(entry.message) })));
+}
 class AparteConversationManager {
   _adapter;
   _conversations = [];
@@ -3985,9 +4086,9 @@ class AparteConversationManager {
    *
    * One append at a time per conversation: two sends that overlap (a suggestion and a
    * quick type, coalesced into one new conversation) both suspend before reading the
-   * record — for the messages, then for the title provider — so both used to read a
-   * conversation with no user message in it yet, and the second one's text became the
-   * title.
+   * record — for the messages, then for the title provider — so the queue keeps the
+   * second one from reading a conversation with no user message in it yet and
+   * taking its text as the title.
    */
   async addMessage(convId, msg) {
     const previous = this._appending.get(convId);
@@ -4040,8 +4141,14 @@ class AparteConversationManager {
     let contentChanged = true;
     let treeChanged = tree !== void 0;
     try {
-      contentChanged = JSON.stringify(storedMessages) !== JSON.stringify(withoutDerivedSegments(conv.messages));
-      if (storedTree !== void 0) treeChanged = JSON.stringify(storedTree) !== JSON.stringify(conv.tree);
+      if (storedTree !== void 0 && conv.tree !== void 0) {
+        const treesDiffer = treeContentOf(storedTree) !== treeContentOf(conv.tree);
+        contentChanged = treesDiffer || storedTree.headId === conv.tree.headId && contentOf(storedMessages) !== contentOf(conv.messages);
+        treeChanged = treesDiffer || storedTree.headId !== conv.tree.headId;
+      } else {
+        contentChanged = contentOf(storedMessages) !== contentOf(conv.messages);
+        if (storedTree !== void 0) treeChanged = true;
+      }
     } catch {
     }
     let title;
@@ -4202,6 +4309,7 @@ function revokeAttachmentUrls(attachments) {
     if (attachment.url?.startsWith("blob:")) URL.revokeObjectURL(attachment.url);
   }
 }
+const MAX_COMPACTION_SAVE_WAITS = 6;
 class AparteConversationController {
   _binding;
   _options;
@@ -4217,6 +4325,7 @@ class AparteConversationController {
   _onMessageAborted = null;
   _onMessagePaused = null;
   _onSelectConversation = null;
+  _onCompactDone = null;
   _unsubscribeManager = null;
   /** The manager the subscription above is on, so a replaced manager is re-subscribed. */
   _subscribedTo = null;
@@ -4279,9 +4388,9 @@ class AparteConversationController {
   /**
    * Degraded mode is legitimate — a host that never opted into the conversation
    * lifecycle has no manager and should not be nagged. Registering one on the
-   * WRONG config is not: the four wrapper hooks used to write it to the global
-   * singleton unconditionally, so `config` + persistence looked like it worked
-   * (the optimistic UI still appends) and saved nothing at all.
+   * WRONG config is not: a manager registered on the global singleton while the chat
+   * uses its own `config` looks like it works (the optimistic UI still appends) and
+   * saves nothing at all.
    *
    * Warned once per controller, and only in the case that is unambiguously a
    * mistake: no manager here, but one on the global.
@@ -4354,8 +4463,14 @@ class AparteConversationController {
       if (targetId && targetId !== this._binding.hostId) return;
       void this.setConversationId(evt.detail?.id ?? null);
     };
+    this._onCompactDone = (e) => {
+      const detail = e.detail;
+      if (detail?.targetId && detail.targetId !== this._binding.hostId) return;
+      queueMicrotask(() => this._persistOnceSummarised(detail?.summary, 0));
+    };
     if (typeof window !== "undefined") {
       window.addEventListener("aparte-conversation-select", this._onSelectConversation);
+      window.addEventListener("aparte-compact-done", this._onCompactDone);
     }
     this._bound = true;
     this._manager();
@@ -4399,6 +4514,10 @@ class AparteConversationController {
       host.removeEventListener("aparte-message-paused", this._onMessagePaused);
       this._onMessagePaused = null;
     }
+    if (this._onCompactDone && typeof window !== "undefined") {
+      window.removeEventListener("aparte-compact-done", this._onCompactDone);
+      this._onCompactDone = null;
+    }
     if (this._onSelectConversation && typeof window !== "undefined") {
       window.removeEventListener("aparte-conversation-select", this._onSelectConversation);
       this._onSelectConversation = null;
@@ -4542,6 +4661,22 @@ class AparteConversationController {
    * re-enter streaming UI (caret, spinner, no action buttons) for content
    * that was partially written before a switch or component destruction.
    */
+  /**
+   * Save once the binding holds the summary a compaction announced. A transcript kept in
+   * a framework store reaches the binding only when that framework renders, so a save on
+   * the microtask wrote the conversation as it stood before the compaction. Bounded: a
+   * run with no summary (skipped), or a binding that never shows it, is saved as it is.
+   */
+  _persistOnceSummarised(summary, waits) {
+    const holds = !summary || this._binding.getMessages().some(
+      (m) => m.compaction === true && typeof m.content === "string" && m.content.endsWith(summary)
+    );
+    if (holds || !this._binding.afterRender || waits >= MAX_COMPACTION_SAVE_WAITS) {
+      this._persistActive();
+      return;
+    }
+    this._binding.afterRender(() => this._persistOnceSummarised(summary, waits + 1));
+  }
   _persistActive() {
     if (!this._activeId) return;
     const manager = this._manager();
@@ -4599,7 +4734,27 @@ class AparteConversationController {
 function cssEscape(value) {
   return value.replace(/["\\]/g, "\\$&").replace(/[\n\r\f]/g, (c) => `\\${c.charCodeAt(0).toString(16)} `);
 }
+function gateGlide(el2) {
+  if (el2.hasAttribute("data-glide")) return () => {
+  };
+  const doc = el2.ownerDocument;
+  const off = () => {
+    doc.removeEventListener("pointerdown", lift, true);
+    doc.removeEventListener("keydown", lift, true);
+    el2.removeEventListener("aparte-send", lift);
+  };
+  const lift = () => {
+    el2.setAttribute("data-glide", "");
+    off();
+  };
+  doc.addEventListener("pointerdown", lift, true);
+  doc.addEventListener("keydown", lift, true);
+  el2.addEventListener("aparte-send", lift);
+  return off;
+}
 const MAX_SIBLING_RETRIES = 6;
+const TREE_OWNED_FIELDS = /* @__PURE__ */ new Set(["id", "branches", "activeBranchIndex", "isStreaming"]);
+const ALWAYS_PRESENT_FIELDS = /* @__PURE__ */ new Set(["content", "segments", "status"]);
 class AparteChatHost {
   binding;
   options;
@@ -4658,6 +4813,7 @@ class AparteChatHost {
     }
     this._installHostMethods(host);
     this._installLifecycleListeners(host);
+    this._teardown.push(gateGlide(host));
     this._installViewportListeners();
     this._createController(host);
     return () => this.unbind();
@@ -4737,6 +4893,9 @@ class AparteChatHost {
       importTree: (tree) => {
         this._vp()?.importTree?.(tree);
       },
+      // The framework's list arrives at its render, so a save that must see a write
+      // the app made to its own store (a compaction through `resolveTarget`) waits for it.
+      afterRender: (cb) => this.binding.afterRender(cb),
       // One writer for the wait. A wrapper that hears `onLoadingChange` draws the
       // wait itself and writes the viewport's attribute from its own
       // `loading || hostLoading` — so the host writing it too meant that, with the
@@ -4899,11 +5058,8 @@ class AparteChatHost {
    *     the same direct path `appendToken` uses;
    *  2. into the framework's message list, **coalesced to once per frame**.
    *
-   * It used to do only (2), synchronously: a full list rebuild plus
-   * `setMessages` + `onMessagesChange` for every chunk, i.e. one complete
-   * framework render per token. At 60 tok/s from a local model that is unusable,
-   * and nothing in the imperative API hinted that `appendToSegment` cost so much
-   * more than `injectTokenStream`. Consumers had to write their own rAF batcher.
+   * Coalescing (2) avoids a full list rebuild plus `setMessages` +
+   * `onMessagesChange`, i.e. one complete framework render, for every chunk.
    *
    * Any structural change flushes the buffer first (see
    * {@link _flushStreamState}), so ordering is never observable.
@@ -4989,9 +5145,7 @@ class AparteChatHost {
   /**
    * Clear all messages + reset viewport state. The option travels to the viewport
    * untouched: a compaction passes `{ revokeAttachments: false }` because it re-appends
-   * the turns it keeps and revokes the dropped ones' object URLs itself — under a
-   * framework wrapper this bridge used to drop the argument, and every surviving
-   * attachment came back broken.
+   * the turns it keeps and revokes the dropped ones' object URLs itself.
    */
   clearMessages(options) {
     this._beginConversationSwap();
@@ -5035,10 +5189,9 @@ class AparteChatHost {
    *
    * Each token reaches the bubble immediately and the framework's message list
    * is synced **once per frame** (same discipline as {@link appendToSegment}),
-   * with a guaranteed flush before completion and on abort. Before that sync
-   * existed the two disagreed: the DOM had the reply, the framework list still
-   * held `content: ''` — so any re-render from state wiped it, and a custom
-   * bubble (which renders from that state) showed nothing at all.
+   * with a guaranteed flush before completion and on abort, so the framework list
+   * and the DOM agree and a custom bubble (which renders from that state) shows the
+   * reply.
    */
   async streamTokens(messageId, tokens) {
     this.stopTokenStream();
@@ -5149,7 +5302,18 @@ class AparteChatHost {
         if (msg.segments !== void 0) updates.segments = msg.segments;
         if (msg.status !== void 0) updates.status = msg.status;
         if (msg.usage !== void 0) updates.usage = msg.usage;
+        if (msg.model !== void 0) updates.model = msg.model;
         if (Object.keys(updates).length > 0) vp.updateMessage?.(msg.id, updates);
+        const stored = vp.getMessage?.(msg.id);
+        if (stored) {
+          for (const [key, value] of Object.entries(msg)) {
+            if (value !== void 0 && !(key in updates) && !TREE_OWNED_FIELDS.has(key)) stored[key] = value;
+          }
+          const own = msg;
+          for (const key of Object.keys(stored)) {
+            if (!TREE_OWNED_FIELDS.has(key) && !ALWAYS_PRESENT_FIELDS.has(key) && own[key] === void 0) delete stored[key];
+          }
+        }
       }
     }
   }
@@ -5157,17 +5321,10 @@ class AparteChatHost {
    * Write the branch counts onto their bubbles — and RESCHEDULE for the ones that are
    * not on the page yet, instead of dropping them.
    *
-   * This used to `continue` past a missing bubble and then clear `_pendingSiblings`
-   * unconditionally, which lost the fork for good. That is the "1 / 1" defect: the
-   * bubble kept its default of one sibling, the picker hid itself, and the other version
-   * became unreachable for the life of the page.
-   *
-   * It needed a framework that renders LATE, which is every framework here. React's
-   * `afterRender` is `requestAnimationFrame(() => cb())` — a bet that the next paint
-   * lands after React's commit, and it does not always; the repo has lost that same bet
-   * before (`25f356b`, "a bet on rAF phase"). The fix is here rather than in the
-   * wrapper's rAF call, because ANY binding whose `afterRender` can precede its commit
-   * hits this, and one fix at the host covers all four.
+   * Frameworks render LATE: a binding's `afterRender` can run before its commit, so a
+   * bubble may not exist yet when its count arrives. A count that was dropped would
+   * leave the bubble at one sibling, the picker hidden and the other version
+   * unreachable. The retry lives here rather than in a wrapper, so it covers all four.
    *
    * Bounded, because a sibling can legitimately never arrive — a message that left the
    * path has no bubble and never will, and an unbounded retry would hold a callback for
@@ -5215,12 +5372,11 @@ class AparteChatHost {
    * The bubble the streaming writes below belong to: the one carrying that message's
    * id, and NOTHING when it is not on the page yet.
    *
-   * It used to be "the last bubble in the viewport", which is a different message
+   * It is not "the last bubble in the viewport", which is a different message
    * whenever the DOM is a render behind the list — which is every framework here.
-   * `appendMessage` puts the new reply in React's state and React paints it on its own
-   * schedule, so a first chunk arriving in between went into the PREVIOUS reply's
-   * bubble; `syncBubbles` then wrote the same segment onto the real one, and the same
-   * `data-segment-id` was on two bubbles.
+   * `appendMessage` puts the new reply in the framework's state and the framework
+   * paints it on its own schedule, so a first chunk arriving in between would go into
+   * the PREVIOUS reply's bubble.
    *
    * Skipping the paint is safe because it is only ever a paint: the message list is
    * written either way, and `syncBubbles` — called by the framework after each render,
@@ -5828,9 +5984,11 @@ let askSeq = 0;
 function buildApprovalPanel(message, options, onChange, details) {
   const cfg = contextConfig();
   const panel = el("div", "aparte-elic-panel aparte-approval-panel");
+  const body = el("div", "aparte-elic-body");
+  panel.appendChild(body);
   const askText = () => typeof message === "function" ? message() : message;
   const ask = askText() ? el("p", "aparte-elic-message", askText()) : null;
-  if (ask) panel.appendChild(ask);
+  if (ask) body.appendChild(ask);
   let argsLabel = null;
   if (details) {
     argsLabel = el("div", "aparte-approval-args-label", cfg.t("approvalArgsLabel"));
@@ -5840,7 +5998,7 @@ function buildApprovalPanel(message, options, onChange, details) {
     pre.setAttribute("role", "group");
     pre.setAttribute("aria-labelledby", argsLabel.id);
     pre.tabIndex = 0;
-    panel.append(argsLabel, pre);
+    body.append(argsLabel, pre);
   }
   const dismiss = el("div", "aparte-elic-dismiss");
   panel.appendChild(dismiss);
@@ -5871,13 +6029,13 @@ function buildApprovalPanel(message, options, onChange, details) {
     row.appendChild(button);
     labelled.push({ button, option });
   }
-  panel.appendChild(row);
+  body.appendChild(row);
   const instruction = el("textarea", "aparte-approval-instruction");
   instruction.rows = 1;
   instruction.placeholder = cfg.t("approvalInstructionPlaceholder");
   instruction.setAttribute("aria-label", cfg.t("approvalInstructionPlaceholder"));
   instruction.addEventListener("input", onChange);
-  panel.appendChild(instruction);
+  body.appendChild(instruction);
   const typed = () => instruction.value.trim();
   return {
     el: panel,
@@ -5906,6 +6064,8 @@ function requestUserInput(request) {
   return resolveConfig(request.target ?? null).requestUserInput(request);
 }
 const COMPACTION_PREAMBLE = "The earlier part of this conversation was compacted. This is a summary of what came before; continue from it.";
+const NOT_RUN_AFTER_A_REFUSAL = "Not run: an earlier call of the same step was refused.";
+const approvalKey = (call) => JSON.stringify([call.id, call.name, call.input]);
 const warnedUninlinedFiles = /* @__PURE__ */ new Set();
 const CHAT_SELECTOR = "aparte-chat, aparte-chat-viewport, [data-aparte-chat]";
 function remoteProvider(id) {
@@ -5932,15 +6092,13 @@ class AparteClient {
   /**
    * Does this window event belong to this client?
    *
-   * One rule for all four handlers, because it used to be near-copies and
-   * one omission: `aparte-compact` (answered here until 0.16.0) had no guard at all, so in the two-client
-   * layout the JSDoc documents, a single compact event made BOTH clients run —
-   * two paid summarisation calls against whichever chat the DOM scan found
-   * first, and a global reset that wiped the other conversation.
+   * One rule for all the window-event handlers, so none of them can lack the guard:
+   * in a two-client layout an unguarded event would make BOTH clients run — two paid
+   * calls against whichever chat the DOM scan found first.
    *
-   * A scoped client also answers only events ADDRESSED to it. The old guard let
-   * an untargeted event through to every scoped client, which turned one
-   * broadcast into an action on every chat on the page.
+   * A scoped client also answers only events ADDRESSED to it; an untargeted event is
+   * not let through to every scoped client, or one broadcast would act on every chat
+   * on the page.
    */
   _isForThisInstance(e) {
     if (!e) return true;
@@ -5980,17 +6138,15 @@ class AparteClient {
   /**
    * What every fresh user action does before it starts a turn.
    *
-   * Clearing the abort flag has to happen at the START of the action rather than inside
+   * Clearing the abort flag happens at the START of the action rather than inside
    * `_streamTurn`, which runs after the auth and file-reading awaits — a reset there
-   * erased an abort that arrived while the user was still waiting for a large attachment
-   * to be read.
+   * would erase an abort that arrived while the user was still waiting for a large
+   * attachment to be read.
    *
    * The superseded turn's TOOL handlers are not cancelled here, and do not need a
    * registry of their own: `_streamTurn` aborts the previous `_streamController`, and
    * the engine links every tool handler's controller to that run signal
-   * (`invokeToolHandler`), so cutting the stream cuts its tools. A `Set<AbortController>`
-   * used to sit here for that job and was never added to — three lines of loop over an
-   * empty set, plus a paragraph describing a cancellation the method did not perform.
+   * (`invokeToolHandler`), so cutting the stream cuts its tools.
    */
   _beginUserTurn() {
     this._isAborted = false;
@@ -5999,10 +6155,9 @@ class AparteClient {
    * Put this client's `keyResolver` on its config, and hold the teardown so
    * `stop()` can take it back off.
    *
-   * The registration used to be fire-and-forget, so it outlived the client that
-   * made it: a stopped client kept signing model-list requests, and a remount —
-   * the way the wrappers document swapping options — added a source behind the
-   * one it meant to replace instead of replacing it. Idempotent, so the usual
+   * The teardown means a stopped client stops signing model-list requests, and a
+   * remount — the way the wrappers document swapping options — replaces the source
+   * instead of adding one behind it. Idempotent, so the usual
    * `new AparteClient({…}).start()` registers once.
    */
   _registerKeyResolver() {
@@ -6104,41 +6259,24 @@ class AparteClient {
     this._isAborted = true;
     this._streamController?.abort();
   }
-  /*
-   * Two docblocks stood here, both describing `_awaitToolDecision` — the method
-   * this replaced. Deleting a method and leaving its documentation is worse than
-   * leaving the method: only the LAST comment before a declaration is its JSDoc,
-   * so those two were floating prose, and one of them explained a DOM-containment
-   * check as a live security property. It was the fix for a cross-chat hazard that
-   * only existed because the decision travelled as a bubbling `document` event.
-   * Routing through `requestUserInput` removed the hazard rather than guarding it,
-   * so the guard is gone too — and a reader who found that comment would have
-   * believed a containment check was still protecting them.
-   */
   /**
    * Ask the human at the COMPOSER, and report what they decided.
    *
-   * The default channel, replacing a `document` listener for `aparte-tool-decision`
-   * that existed only because the buttons lived in a segment renderer with no
-   * reference to this client. Routing through `requestUserInput` puts the decision
+   * The default channel. Routing through `requestUserInput` puts the decision
    * where every other request for the user already goes, which is the whole point:
    * one queue, one panel slot, one teardown, and the same behaviour whether the
    * request came from a tool handler or from this gate.
    *
    * The tool NAME is the question and its ARGUMENTS are the body, because the
    * arguments are what is being approved — a decision surface that names the act and
-   * hides its subject asks for a signature on a blank page. This paragraph used to
-   * say the opposite ("the arguments stay in the transcript"), and the guide beside
-   * it had always promised what the panel did not do. The transcript row stays the
-   * anchor; it is no longer the only place the call can be read. The panel is capped
+   * hides its subject asks for a signature on a blank page. The transcript row stays the
+   * anchor, but it is not the only place the call can be read. The panel is capped
    * at 50vh and the block inside it scrolls, so a long input cannot push the options
    * off the surface they are asked on.
    *
-   * `aparte-tool-decision` is GONE with the buttons that dispatched it, and so is the
-   * `document` listener that answered it. It existed only because a segment renderer
-   * has no reference to this client; two seams that can disagree about who answers a
-   * decision are one seam too many, and the ratified elicitation rule already said so
-   * — "a typed presenter registered per config instance, never window events". A host
+   * There is no `aparte-tool-decision` event and no `document` listener that answers
+   * one: a decision is answered by a typed presenter registered per config instance,
+   * never by a window event. A host
    * that wants to answer programmatically registers an `approvalResolver` (headless,
    * no DOM) or its own presenter, both strictly more capable than an id on an event.
    */
@@ -6153,13 +6291,14 @@ class AparteClient {
        */
       message: () => {
         const loc = this._config.getLocale();
-        return (loc.approvalAsk ?? "Run {tool}?").replace("{tool}", event.name);
+        return (loc.approvalAsk ?? "Run {tool}?").replace("{tool}", () => event.name);
       },
-      // A plain string, not a function: the arguments are wire format — the JSON
-      // the model sent — and re-reading them on a language switch would produce
-      // exactly the same bytes. Same text the transcript row shows, from the same
-      // function, so the two surfaces cannot disagree about what is being run.
-      details: describeToolInput(event.input),
+      // A plain string, not a function: the arguments are the model's — its JSON, or
+      // the tool's own formatter's reading of it — and do not change with the
+      // language. Same text the transcript row shows, from the same function and the
+      // same config — the chat's, which the row renders with — so the two surfaces
+      // cannot disagree about what is being run.
+      details: describeToolInput(event.input, resolveConfig(target).getToolInputFormatter(event.name)),
       // Functions, not strings, same as the question: these follow a language
       // switch while the request is open, which a resolved string cannot.
       options: [
@@ -6255,6 +6394,8 @@ class AparteClient {
       let result = opts?.resume ? { usage: void 0, suspended: opts.resume } : await this._streamLoop(targetElement, messageId, provider, baseRequest, authConfig, streamController);
       const maxResumes = this.options.maxTurns ?? 10;
       let resumes = 0;
+      let approvedAtLastPause = /* @__PURE__ */ new Set();
+      const rowEvents = createStreamAdapter({ target: targetElement, config: this._config, messageId, ...chatId ? { targetId: chatId } : {} });
       while (result.suspended) {
         const stopped = this._isAborted || streamController.signal.aborted;
         if (!stopped && ++resumes > maxResumes) {
@@ -6264,7 +6405,9 @@ class AparteClient {
           );
           break;
         }
-        const outcomes = stopped ? void 0 : await this._answerDeferred(targetElement, result.suspended.pending, streamController.signal);
+        const approvedNow = /* @__PURE__ */ new Set();
+        const outcomes = stopped ? void 0 : await this._answerDeferred(targetElement, result.suspended.pending, streamController.signal, rowEvents, approvedAtLastPause, approvedNow);
+        approvedAtLastPause = approvedNow;
         if (!outcomes) {
           this._closeOpenCalls(targetElement, messageId);
           if (this._isAborted || streamController.signal.aborted) {
@@ -6313,29 +6456,21 @@ class AparteClient {
   /**
    * The registered tools, unless the current model says it cannot call one.
    *
-   * Single source for the gate, so send / retry / edit cannot drift — that drift
-   * is what once shipped `tools` on the initial send while retry and edit omitted
-   * them.
+   * Single source for the gate, so send / retry / edit cannot drift.
    *
-   * The gate used to be "the model DECLARES function_calling", defaulting to
-   * stripping — and that made the whole tool surface unreachable on the primary
-   * documented path. Three things had to line up for a tool to be sent, and one
-   * never did: the app sets a model id by hand (`setModelConfig`) or a selector
-   * sets it from a fetched list, and in both cases the model's declared
-   * capabilities are commonly unknown. `undefined` capabilities then read as "no
-   * function calling", so `tools: []` went on the wire while `getTools()` held
-   * the tool the app had explicitly registered. The model answered, correctly,
-   * that it had no such tool, and nothing anywhere said why.
-   *
-   * So the question is now "did this model say it cannot", not "did it say it
-   * can". Registering a tool is an explicit act by the app; silently dropping it
+   * The question is "did this model say it cannot", not "did it say it can": the
+   * app sets a model id by hand (`setModelConfig`) or a selector sets it from a
+   * fetched list, and in both cases the model's declared capabilities are commonly
+   * unknown. `undefined` capabilities read as "can", or `tools: []` would go on
+   * the wire while `getTools()` held the tool the app had explicitly registered,
+   * and the model would answer that it had no such tool. Registering a tool is an explicit act by the app; silently dropping it
    * because a `/models` listing is terse is the library second-guessing the
    * developer. A model that declares its capabilities and omits function calling
    * is still honoured — that is a statement, and it is respected.
    *
    * Failure modes, both ways round: over-sending means a model that cannot use
    * tools does not call one, or its own endpoint rejects the array with an error
-   * the developer can read. Under-sending was silent, total, and looked like a
+   * the developer can read. Under-sending would be silent, total, and look like a
    * lying model.
    */
   _toolsForCurrentModel() {
@@ -6386,10 +6521,9 @@ class AparteClient {
    * The system messages a turn opens with: the app's own template, then the registered
    * tools' `systemPrompt`s.
    *
-   * A helper rather than three copies. The two lines it replaces were written out at each
-   * of the three turn entry points (send, retry, edit), which is exactly how the tool half
-   * would have been added to two of them and forgotten in the third — the same shape as
-   * the abort-flag asymmetry `_beginUserTurn` exists to prevent.
+   * One helper for the three turn entry points (send, retry, edit), so the tool half
+   * cannot be added to two of them and forgotten in the third — the same shape as the
+   * abort-flag asymmetry `_beginUserTurn` exists to prevent.
    */
   _systemMessages() {
     const messages = [];
@@ -6472,11 +6606,11 @@ class AparteClient {
    * The trees a lookup must search, the one the gesture came from FIRST.
    *
    * `document.getElementById` and `document.querySelectorAll` cannot see into a shadow
-   * root, so a chat mounted in one — the arrangement the theming guide endorses — was
-   * invisible to both: alone, the send was dropped with a warning; on a page that also
-   * holds a chat in the light DOM, the scan answered with the WRONG chat, so the
-   * person's message AND the model's reply landed in a transcript they never typed
-   * into. Nearest tree first is what keeps it from swapping the other way round.
+   * root, so a chat mounted in one — the arrangement the theming guide endorses — is
+   * invisible to both: alone, the send would be dropped with a warning; on a page that
+   * also holds a chat in the light DOM, the scan would answer with the WRONG chat, and
+   * the person's message AND the model's reply would land in a transcript they never
+   * typed into. Nearest tree first keeps it from swapping the other way round.
    */
   _rootsFor(event) {
     const roots = [];
@@ -6574,8 +6708,8 @@ class AparteClient {
    * The SLICE is each caller's own business — retry cuts before the reply it is
    * regenerating, edit cuts after the message being reworded, send cuts at the last
    * answered turn. What a message CONTRIBUTES to the wire is not: send, retry and
-   * edit must not disagree about it, and they did. This one had no filter at all,
-   * so a failed turn and a turn stopped before its first token both went out as
+   * edit must not disagree about it. A failed turn and a turn stopped before its
+   * first token are filtered out rather than sent as
    * `{ role: 'assistant', content: '' }` — a claim the assistant said nothing, which
    * some providers reject outright and the rest read as an empty reply worth
    * imitating.
@@ -6666,7 +6800,7 @@ class AparteClient {
       if (!this._warnedNoModel) {
         this._warnedNoModel = true;
         console.warn(
-          "[AparteClient] Send dropped: no model is selected. Call aparteGlobalConfig.setModelConfig({ defaultProvider, defaultModel }), mount <aparte-model-selector auto-select>, or register one provider with a single model — that one is selected on its own."
+          "[AparteClient] Send dropped: no model is selected. Call aparteGlobalConfig.setModelConfig({ defaultProvider, defaultModel }), mount <aparte-model-selector auto-select persist>, or register one provider with a single model — that one is selected on its own."
         );
       }
       this._handleLifecycleError(targetElement, messageId, new AparteError(
@@ -6733,12 +6867,12 @@ class AparteClient {
    * the question the history gates can ask is "is this still in flight?", never
    * "is this completed?".
    *
-   * The gates below used to ask the second one, and a host that SEEDS a transcript
+   * The gates below ask the first, because a host that SEEDS a transcript
    * — restoring a saved conversation, hydrating a server-rendered one — has no
-   * reason to invent a status for turns that are already over. With none, the
-   * cutoff never advanced past 0 and the whole transcript was sliced away: the
-   * model got the new question with no context, and nothing in the UI said so,
-   * because the viewport still showed every message.
+   * reason to invent a status for turns that are already over. Asking "is this
+   * completed?" would leave the cutoff at 0 and slice away the whole transcript: the
+   * model would get the new question with no context, and nothing in the UI would say
+   * so, because the viewport still shows every message.
    */
   static _inFlight(m) {
     return m.status === "streaming" || m.status === "pending";
@@ -6769,23 +6903,9 @@ ${text}` : text;
    * What the model is told it said last turn — reconstructed from what was
    * RENDERED, not from the raw-text field.
    *
-   * The order used to be the other way round, and it silently corrupted the
-   * context on the most common opening in a coding chat: a reply starting with a
-   * code fence was sent back as three backticks and nothing else. Three
-   * correct-in-isolation decisions composed into it:
-   *
-   *  1. the parser withholds an ambiguous prefix (``` ``` ```, `` ` ``, `<`)
-   *     waiting for the next delta, and creates no active segment while it waits;
-   *  2. so `_streamLoop` sees zero segments, concludes the parser produced
-   *     nothing, and appends the raw delta straight to `message.content`;
-   *  3. and this method preferred `content`.
-   *
-   * The bubble hides its content element as soon as segments exist, so the UI was
-   * perfect and only the NEXT request showed it. No unit test, no example and
-   * no browser test could see it.
-   *
-   * `content` stays as the fallback, and that is not vestigial: a non-streaming
-   * transport writes the whole reply there and creates no segments at all.
+   * The segments are what the reader saw, so they come first. `content` is the
+   * fallback, and that is not vestigial: a non-streaming transport writes the whole
+   * reply there and creates no segments at all.
    */
   _extractText(message) {
     const rendered = this._segmentsToText(message.segments);
@@ -6803,10 +6923,9 @@ ${text}` : text;
    * A type core does not know — a registered block grammar's (an artifact, a
    * citation, a file), a consumer's custom segment — follows one rule: its
    * `content` if it has one, else its `fallback`, else nothing. Dropping such a
-   * segment made a document the model had just produced invisible on the very next
-   * turn, so it could not be asked to change the thing it had built; there used to
-   * be an `artifact` branch here for exactly that, and the rule is what replaces it
-   * now that the artifact is a plugin's type like any other.
+   * segment would make a document the model had just produced invisible on the very
+   * next turn, so it could not be asked to change the thing it had built. An artifact
+   * is a plugin's type like any other and follows this rule.
    *
    * `thinking` and `tool_call` stay out on purpose — the first is the model's own
    * scratchpad, and most APIs neither want it back nor bill for it kindly; the
@@ -7026,10 +7145,15 @@ ${content}
    * nobody answered — the turn was stopped, or the channel gave up — and there is no
    * resume. A channel that CRASHES fails the turn, as it does for a run in the page.
    */
-  async _answerDeferred(targetElement, pending, signal) {
+  async _answerDeferred(targetElement, pending, signal, rowEvents, approvedBefore = /* @__PURE__ */ new Set(), approvedNow = /* @__PURE__ */ new Set()) {
     const outcomes = {};
     const resolver = this._approvalResolverFor(targetElement, true);
-    for (const p of pending) {
+    const refuseTheRest = (after) => {
+      for (const rest of pending.slice(after + 1)) {
+        outcomes[rest.toolCallId] = { kind: "decision", approved: false, reason: NOT_RUN_AFTER_A_REFUSAL };
+      }
+    };
+    for (const [index, p] of pending.entries()) {
       if (signal.aborted) break;
       const call = { id: p.toolCallId, name: p.name, input: p.input ?? {} };
       if (p.reason === "approval") {
@@ -7041,11 +7165,34 @@ ${content}
         }
         if (!decision || signal.aborted) return void 0;
         outcomes[p.toolCallId] = { kind: "decision", ...decision };
+        if (decision.approved) approvedNow.add(approvalKey(call));
+        else {
+          refuseTheRest(index);
+          break;
+        }
       } else if (p.reason === "external") {
+        let gate = null;
+        const key = approvalKey(call);
+        if (!approvedBefore.has(key) && !approvedNow.has(key)) {
+          try {
+            gate = await this._gateBrowserTool(call, signal, targetElement, rowEvents);
+          } catch (error) {
+            if (!signal.aborted && error?.name !== "AbortError") throw error;
+            gate = void 0;
+          }
+        }
+        if (gate === void 0 || signal.aborted) return void 0;
+        if (gate && !gate.approved) {
+          outcomes[p.toolCallId] = { kind: "decision", ...gate };
+          refuseTheRest(index);
+          break;
+        }
+        const payload = gate?.payload;
+        const ran = payload && typeof payload === "object" && !Array.isArray(payload) ? { ...call, input: { ...call.input, ...payload } } : call;
         const handler = this._config.getToolHandler(p.name);
         try {
           if (!handler) throw new Error(`No browser handler is registered for "${p.name}".`);
-          const result = await handler(call, signal, { target: targetElement, config: this._config });
+          const result = await handler(ran, signal, { target: targetElement, config: this._config });
           outcomes[p.toolCallId] = {
             kind: "result",
             content: result.content,
@@ -7059,6 +7206,21 @@ ${content}
     }
     return signal.aborted ? void 0 : outcomes;
   }
+  /**
+   * Whether a browser tool a paused run asked for may run, decided as a run in the page
+   * decides it. With a host `approvalResolver`, the tool's own `needsApproval` says whether
+   * to ask and the resolver answers; without one, the approval policy and `needsApproval`
+   * rule (`ruleOnToolCall`) and the default channel asks. `null` when nothing gates the
+   * call, the decision when something did, `undefined` when nobody answered.
+   */
+  async _gateBrowserTool(call, signal, targetElement, rowEvents) {
+    const ruling = this.options.approvalResolver ? this._config.getTools().find((t) => t.name === call.name)?.needsApproval ? "ask" : "allow" : this._config.ruleOnToolCall(call).verdict;
+    if (ruling === "allow") return null;
+    if (ruling === "ask") rowEvents?.({ type: "tool-awaiting-approval", toolCallId: call.id, name: call.name, input: call.input });
+    const decision = await this._approvalResolverFor(targetElement)(call, signal) ?? void 0;
+    if (decision?.approved && ruling === "ask") targetElement.updateSegment?.(`tool-${call.id}`, { status: "pending" });
+    return decision;
+  }
   /**
    * The ticket is spent the moment the resume leaves: the server answers these calls
    * now, so a pause saved from here on — the conversation manager saves before it cuts a
@@ -7081,8 +7243,8 @@ ${content}
    * Close the reply's calls that can no longer finish — paused, queued, or running on a
    * server the page stopped listening to: each says it stopped, and forgets the pause.
    * A cut connection carries none of their last events, so nothing else would: the rows
-   * spun, and a queued call kept its ticket, which a reload then resumed against a
-   * server that had moved on. By the reply's id, not the chat's head — a retry during
+   * would spin, and a queued call would keep its ticket, which a reload would then
+   * resume against a server that had moved on. By the reply's id, not the chat's head — a retry during
    * the wait moves the head. A run in the page ends every call itself: nothing to do.
    */
   _closeOpenCalls(targetElement, messageId) {
@@ -7327,10 +7489,9 @@ class AparteMessageRepository {
   /**
    * Every message the tree holds — every branch, not just the active path.
    *
-   * `getMessages()` walks head → root, so a question about the whole conversation
-   * ("is anything still streaming?") answered from it could not see a turn that a
-   * retry had just taken off the path — and the viewport wrote that turn's remaining
-   * segments into the bubble which replaced it. No order is promised beyond
+   * Unlike `getMessages()`, which walks head → root, this also sees a turn that a
+   * retry has taken off the active path, so it answers questions about the whole
+   * conversation ("is anything still streaming?"). No order is promised beyond
    * insertion: a caller that needs the topology reads `export()`.
    */
   getAllMessages() {
@@ -7399,9 +7560,7 @@ class AparteMessageRepository {
    * Remove all descendants of `messageId` (inclusive) and, when the head was among
    * them, set `head` to the parent of `messageId`. Used by edit/truncate flows.
    *
-   * A head in a branch this call did not touch stays where it is: it used to be
-   * relocated regardless, which took the active path out of the version the reader was
-   * on for a truncate somewhere else entirely.
+   * A head in a branch this call did not touch stays where it is.
    *
    * @param messageId  The first message to remove
    */
@@ -7455,9 +7614,8 @@ class AparteMessageRepository {
   /**
    * Import a previously-exported snapshot, rebuilding the full tree and
    * restoring the active head. Replaces any existing content (calls `clear()`
-   * first). Messages must be in topological order (parent before child) —
-   * this is guaranteed by `export()` since `_nodes` is an insertion-order
-   * Map and parents are always inserted before their children.
+   * first). `export()` writes messages in topological order (parent before
+   * child), which is the order this expects.
    */
   import(exported) {
     this.clear();
@@ -7485,11 +7643,8 @@ class AparteMessageRepository {
    * Compatible with the assistant-ui ExportedMessageRepository format.
    *
    * Walked from the root through each node's `children`, so a parent is always
-   * written before its children. It used to iterate `_nodes` in insertion order and
-   * call that topological — which holds until `_relink` re-parents an EXISTING node
-   * under one inserted after it (`addOrUpdateMessage` with a known id and a newer
-   * parent). The snapshot then listed the child first, and `import()` threw "parent
-   * not found" on the very tree this method had just produced.
+   * written before its children, even after `addOrUpdateMessage` re-parented an
+   * existing node under a newer one; `import()` relies on that order.
    */
   export() {
     const messages = [];
@@ -7713,18 +7868,20 @@ export {
   uuid as a8,
   eventOrigin as a9,
   activeElementIn as aa,
-  mergeSegmentUpdate as ab,
-  writeStreamedMarkdown as ac,
-  stampSegmentActivity as ad,
-  stampSegmentOnInsert as ae,
-  stampSegmentOnUpdate as af,
-  renumberSegments as ag,
-  openSegmentIds as ah,
-  isTerminalStatus as ai,
-  adoptMessageSegments as aj,
-  APARTE_DERIVED_SEGMENTS as ak,
-  chatBoundaryOf as al,
-  rootOf as am,
+  gateGlide as ab,
+  renderingVersionOf as ac,
+  mergeSegmentUpdate as ad,
+  writeStreamedMarkdown as ae,
+  stampSegmentActivity as af,
+  stampSegmentOnInsert as ag,
+  stampSegmentOnUpdate as ah,
+  renumberSegments as ai,
+  openSegmentIds as aj,
+  isTerminalStatus as ak,
+  adoptMessageSegments as al,
+  APARTE_DERIVED_SEGMENTS as am,
+  chatBoundaryOf as an,
+  rootOf as ao,
   APARTE_DEFAULT_BUBBLE_ACTIONS as b,
   APARTE_DEFAULT_HOST_HANDLERS as c,
   APARTE_DEFAULT_ICON_FALLBACKS as d,
@@ -7751,4 +7908,4 @@ export {
   collectRendererStyles as y,
   contentToText as z
 };
-//# sourceMappingURL=dialog-triggers-ChnPFG9M.js.map
+//# sourceMappingURL=dialog-triggers-3Rk7PuZa.js.map