@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.1 → 0.4.3

package/dist/context/ChatBotContext.js

@@ -5,6 +5,8 @@ import * as React from 'react';
 import { flushSync } from 'react-dom';
 import { v4 as uuidv4 } from 'uuid';
 import { createNxtlinqApi, setApiHosts, synthesizeSpeechToBuffer, streamSpeechToAudioContext, useLocalStorage, useSessionStorage, useSpeechToTextFromMic, useVoiceMode, metakeepClient, getEthers, sleep, walletTextUtils, } from '@bytexbyte/nxtlinq-ai-agent-web-development';
+import { authorizeTextFrontendTool, hasRecordedWalletVerification, validateWalletSession, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
+import { PendingTextToolRetryController } from '../pendingTextToolRetry';
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 const ChatBotContext = React.createContext(undefined);
 export const useChatBot = () => {
@@ -143,6 +145,17 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const permissionsRef = React.useRef(permissions);
     const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
     const signerRef = React.useRef(signer);
+    const pendingTextToolRetryRef = React.useRef(new PendingTextToolRetryController());
+    const sendMessageRef = React.useRef(async () => { });
+    const retryPendingTextTool = React.useCallback(() => {
+        const controller = pendingTextToolRetryRef.current;
+        return controller.retry(async (request) => {
+            // This attempt consumes the old request. A still-blocked preflight will
+            // record it again with the next required recovery step.
+            controller.clear();
+            await sendMessageRef.current(request.content, 1, request.isPresetMessage, request.attachments);
+        });
+    }, []);
     // Helper function to combine customUsername with Adilas customUserInfo
     const getFinalCustomUsername = React.useCallback((username) => {
         if (!username)
@@ -859,7 +872,9 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     };
     // Refresh AIT
     const refreshAIT = async (forceUpdatePermissions = false) => {
-        if (!hitAddress) {
+        const currentHitAddress = hitAddressRef.current || hitAddress;
+        const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
+        if (!currentHitAddress) {
             setAit(null);
             setPermissions([]);
             setWalletInfo(null);
@@ -868,14 +883,18 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         }
         setIsAITLoading(true);
         try {
+            let walletAllowsAITLookup = !requireWalletIDVVerification;
             // Get wallet info first - always try to get wallet info if we have a token
-            if (nxtlinqAITServiceAccessToken) {
+            if (currentToken) {
                 try {
-                    const walletResponse = await nxtlinqApi.wallet.getWallet({ address: hitAddress }, nxtlinqAITServiceAccessToken);
+                    const walletResponse = await nxtlinqApi.wallet.getWallet({ address: currentHitAddress }, currentToken);
                     if (!('error' in walletResponse)) {
                         setWalletInfo(walletResponse);
+                        walletAllowsAITLookup = !requireWalletIDVVerification
+                            || hasRecordedWalletVerification(walletResponse);
                     }
                     else {
+                        setWalletInfo(null);
                         // Check if the error is due to invalid/expired token
                         if (walletResponse.error.includes('Invalid or expired token')) {
                             console.log('Token appears to be invalid during wallet info fetch, clearing it');
@@ -884,16 +903,24 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     }
                 }
                 catch (error) {
+                    setWalletInfo(null);
                     console.error('Failed to fetch wallet info:', error);
                 }
             }
+            // AIT existence is not identity verification. In strict mode, stop before
+            // the legacy AIT lookup can synthesize a custom wallet record.
+            if (currentToken && !walletAllowsAITLookup) {
+                setAit(null);
+                setPermissions([]);
+                return;
+            }
             // Only try to fetch AIT if we have a token
-            if (nxtlinqAITServiceAccessToken) {
+            if (currentToken) {
                 const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
                     serviceId,
-                    controller: hitAddress,
+                    controller: currentHitAddress,
                     customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, nxtlinqAITServiceAccessToken);
+                }, currentToken);
                 if ('error' in response) {
                     console.error('Failed to fetch AIT:', response.error);
                     setAit(null);
@@ -927,17 +954,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             return false;
         if (!nxtlinqAITServiceAccessToken)
             return true;
-        try {
-            const payload = JSON.parse(atob(nxtlinqAITServiceAccessToken.split('.')[1]));
-            const address = payload.address;
-            if (address !== hitAddress)
-                return true;
-            return false;
-        }
-        catch (error) {
-            console.error('Error parsing token:', error);
-            return true;
-        }
+        return !validateWalletSession(nxtlinqAITServiceAccessToken, hitAddress).valid;
     }, [hitAddress, nxtlinqAITServiceAccessToken]);
     // Connect wallet
     const connectWallet = React.useCallback(async (autoShowSignInMessage = true) => {
@@ -1067,14 +1084,19 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             if (autoShowSuccessMessage) {
                 showError(walletTextUtils.getWalletText('Please connect your wallet first.', serviceId));
             }
-            return;
+            return false;
         }
         if (!signerToUse) {
             console.log('No signer available, returning early');
             if (autoShowSuccessMessage) {
                 showError(walletTextUtils.getWalletText('Please connect your wallet first.', serviceId));
             }
-            return;
+            return false;
+        }
+        const currentToken = nxtlinqAITServiceAccessTokenRef.current;
+        if (currentToken && validateWalletSession(currentToken, addressToUse).valid) {
+            await refreshAIT();
+            return true;
         }
         try {
             const nonceResponse = await nxtlinqApi.auth.getNonce({ address: addressToUse });
@@ -1082,7 +1104,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 if (autoShowSuccessMessage) {
                     showError(normalizeErrorForUser(nonceResponse.error));
                 }
-                return;
+                return false;
             }
             const payload = {
                 address: addressToUse,
@@ -1099,357 +1121,91 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 if (autoShowSuccessMessage) {
                     showError(normalizeErrorForUser(response.error));
                 }
-                return;
+                return false;
             }
             const { accessToken } = response;
             setNxtlinqAITServiceAccessToken(accessToken);
+            nxtlinqAITServiceAccessTokenRef.current = accessToken;
             // Wait for state to update before refreshing AIT
             await new Promise(resolve => setTimeout(resolve, 100));
             await refreshAIT();
             if (autoShowSuccessMessage) {
                 showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
             }
+            return true;
         }
         catch (error) {
             console.error('Failed to sign in:', error);
             if (autoShowSuccessMessage) {
                 showError('Failed to sign in. Please try again.');
             }
+            return false;
         }
     };
     // Check permissions
-    const hasPermission = async (requiredPermission, autoRetry = true, onAutoConnect, onAutoSignIn) => {
+    const hasPermission = async (requiredPermission) => {
         // Use refs to get latest state values
         const currentHitAddress = hitAddressRef.current;
-        const currentAit = aitRef.current;
-        const currentPermissions = permissionsRef.current;
         const currentToken = nxtlinqAITServiceAccessTokenRef.current;
-        if (!currentHitAddress) {
-            if (autoRetry) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: walletTextUtils.getWalletText('Please connect your HIT wallet to continue.', serviceId),
-                        role: 'assistant',
-                        timestamp: new Date().toISOString(),
-                        button: 'connectWallet'
-                    }]);
-                try {
-                    setIsAutoConnecting(true); // Mark as auto-connecting
-                    await connectWallet(false); // Don't show sign-in message yet
-                    setIsAutoConnecting(false); // Clear auto-connecting state
-                    // Show brief success message for auto-connect
-                    showSuccess(walletTextUtils.getWalletText('Auto wallet connection successful', serviceId));
-                    onAutoConnect?.(); // Call callback if provided
-                    await new Promise(resolve => setTimeout(resolve, 2000));
-                    // After auto connect, if not signed in, then auto sign-in
-                    const tokenAfterConnect = nxtlinqAITServiceAccessTokenRef.current;
-                    if (!tokenAfterConnect) {
-                        setIsAutoConnecting(true);
-                        await signInWallet(false);
-                        onAutoSignIn?.(); // Call callback if provided
-                        setIsAutoConnecting(false);
-                        showSuccess(walletTextUtils.getWalletText('Auto sign-in successful after wallet connect', serviceId));
-                        await refreshAIT();
-                        // Wait for AIT to be fully loaded with polling
-                        let attempts = 0;
-                        const maxAttempts = 5;
-                        while (!aitRef.current && attempts < maxAttempts) {
-                            await new Promise(resolve => setTimeout(resolve, 2000));
-                            attempts++;
-                        }
-                    }
-                    // If connection (and sign-in if needed) successful, continue with permission check
-                    const result = await hasPermission(requiredPermission, false);
-                    return result;
-                }
-                catch (error) {
-                    console.error('Failed to auto-connect wallet:', error);
-                    setIsAutoConnecting(false); // Clear auto-connecting state on error
-                    return false;
-                }
-            }
-            // If autoRetry is false, don't show message again, just return false
-            return false;
-        }
-        if (!currentToken) {
-            if (autoRetry) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: walletTextUtils.getWalletText('Please sign in with your HIT wallet to continue.', serviceId),
-                        role: 'assistant',
-                        timestamp: new Date().toISOString(),
-                        button: 'signIn'
-                    }]);
-                try {
-                    setIsAutoConnecting(true); // Mark as auto-signing
-                    await signInWallet(false); // Don't show success message yet
-                    onAutoSignIn?.(); // Call callback if provided
-                    setIsAutoConnecting(false); // Clear auto-signing state
-                    // Show brief success message for auto-sign-in
-                    showSuccess('Auto sign-in successful');
-                    // Ensure AIT is refreshed after sign-in
-                    await refreshAIT();
-                    // Wait for AIT to be fully loaded with polling
-                    let attempts = 0;
-                    const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                    while (!aitRef.current && attempts < maxAttempts) {
-                        await new Promise(resolve => setTimeout(resolve, 2000));
-                        attempts++;
-                    }
-                    // Only continue if AIT is actually loaded
-                    if (aitRef.current) {
-                        // Wait a bit more to ensure permissions are also loaded
-                        await new Promise(resolve => setTimeout(resolve, 2000));
-                        // If sign-in successful, continue with permission check
-                        const result = await hasPermission(requiredPermission, false);
-                        return result;
-                    }
-                    else {
-                        return false;
-                    }
-                }
-                catch (error) {
-                    console.error('Failed to auto-sign-in wallet:', error);
-                    setIsAutoConnecting(false); // Clear auto-signing state on error
-                    return false;
-                }
-            }
-            // If autoRetry is false, don't show message again, just return false
-            return false;
-        }
-        try {
-            const payload = JSON.parse(atob(currentToken.split('.')[1]));
-            const address = payload.address;
-            if (address !== currentHitAddress) {
-                setNxtlinqAITServiceAccessToken('');
-                if (autoRetry) {
-                    setIsLoading(false); // Stop thinking before showing message
-                    setMessages(prev => [...prev, {
-                            id: Date.now().toString(),
-                            content: walletTextUtils.getWalletText('Wallet address mismatch. Please sign in with the correct wallet.', serviceId),
-                            role: 'assistant',
-                            timestamp: new Date().toISOString(),
-                            button: 'signIn'
-                        }]);
-                    try {
-                        setIsAutoConnecting(true); // Mark as auto-signing
-                        await signInWallet(false); // Don't show success message yet
-                        onAutoSignIn?.(); // Call callback if provided
-                        setIsAutoConnecting(false); // Clear auto-signing state
-                        // Show brief success message for auto-sign-in after address mismatch
-                        showSuccess('Auto sign-in successful after address mismatch');
-                        // Ensure AIT is refreshed after sign-in
-                        await refreshAIT();
-                        // Wait for AIT to be fully loaded with polling
-                        let attempts = 0;
-                        const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                        while (!aitRef.current && attempts < maxAttempts) {
-                            await new Promise(resolve => setTimeout(resolve, 2000));
-                            attempts++;
-                        }
-                        // Only continue if AIT is actually loaded
-                        if (aitRef.current) {
-                            // Wait a bit more to ensure permissions are also loaded
-                            await new Promise(resolve => setTimeout(resolve, 2000));
-                            // If sign-in successful, continue with permission check
-                            const result = await hasPermission(requiredPermission, false);
-                            return result;
-                        }
-                        else {
-                            return false;
-                        }
-                    }
-                    catch (error) {
-                        console.error('Failed to auto-sign-in after address mismatch:', error);
-                        setIsAutoConnecting(false); // Clear auto-signing state on error
-                        return false;
-                    }
-                }
-                // If autoRetry is false, don't show message again, just return false
-                return false;
-            }
-        }
-        catch (error) {
-            console.error('Error parsing token:', error);
-            setNxtlinqAITServiceAccessToken('');
-            if (autoRetry) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: walletTextUtils.getWalletText('Invalid wallet session. Please sign in again.', serviceId),
-                        role: 'assistant',
-                        timestamp: new Date().toISOString(),
-                        button: 'signIn'
-                    }]);
-                try {
-                    setIsAutoConnecting(true); // Mark as auto-signing
-                    await signInWallet(false); // Don't show success message yet
-                    onAutoSignIn?.(); // Call callback if provided
-                    setIsAutoConnecting(false); // Clear auto-signing state
-                    // Show brief success message for auto-sign-in after token parse error
-                    showSuccess('Auto sign-in successful after token error');
-                    // Ensure AIT is refreshed after sign-in
-                    await refreshAIT();
-                    // Wait for AIT to be fully loaded with polling
-                    let attempts = 0;
-                    const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                    while (!aitRef.current && attempts < maxAttempts) {
-                        await new Promise(resolve => setTimeout(resolve, 2000));
-                        attempts++;
-                    }
-                    // Only continue if AIT is actually loaded
-                    if (aitRef.current) {
-                        // Wait a bit more to ensure permissions are also loaded
-                        await new Promise(resolve => setTimeout(resolve, 2000));
-                        // If sign-in successful, continue with permission check
-                        const result = await hasPermission(requiredPermission, false);
-                        return result;
-                    }
-                    else {
-                        return false;
-                    }
-                }
-                catch (signInError) {
-                    console.error('Failed to auto-sign-in after token parse error:', signInError);
-                    setIsAutoConnecting(false); // Clear auto-signing state on error
-                    return false;
-                }
-            }
-            // If autoRetry is false, don't show message again, just return false
-            return false;
-        }
-        if (!currentAit) {
-            // Show loading message if AIT is still loading
-            if (isAITLoading) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: walletTextUtils.getWalletText('Loading your wallet configuration... Please wait a moment.', serviceId),
-                        role: 'assistant',
-                        timestamp: new Date().toISOString()
-                    }]);
-                return false;
-            }
-            // If AIT is not loaded but we have a token, try to refresh it once
-            if (currentToken && !isAITLoading) {
-                try {
-                    await refreshAIT();
-                    // Wait for AIT to be loaded with polling
-                    let attempts = 0;
-                    const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                    while (!aitRef.current && attempts < maxAttempts) {
-                        await new Promise(resolve => setTimeout(resolve, 2000));
-                        attempts++;
-                    }
-                    // Check again after refresh
-                    if (!aitRef.current) {
-                        setIsLoading(false); // Stop thinking before showing message
-                        setMessages(prev => [...prev, {
-                                id: Date.now().toString(),
-                                content: walletTextUtils.getWalletText('No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.', serviceId),
-                                role: 'assistant',
-                                timestamp: new Date().toISOString()
-                            }]);
-                        return false;
-                    }
-                }
-                catch (error) {
-                    console.error('Failed to refresh AIT during permission check:', error);
-                    setIsLoading(false); // Stop thinking before showing message
-                    setMessages(prev => [...prev, {
-                            id: Date.now().toString(),
-                            content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-                            role: 'assistant',
-                            timestamp: new Date().toISOString()
-                        }]);
-                    return false;
-                }
-            }
-            else {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-                        role: 'assistant',
-                        timestamp: new Date().toISOString()
-                    }]);
-                return false;
-            }
-        }
-        if (availablePermissions.length === 0) {
-            setIsLoading(false); // Stop thinking before showing message
-            setMessages(prev => [...prev, {
-                    id: Date.now().toString(),
-                    content: `No permissions available for your current identity provider. Please check your service configuration or contact support. Service ID: ${serviceId}, Permission Group: ${permissionGroup || 'None'}`,
-                    role: 'assistant',
-                    timestamp: new Date().toISOString()
-                }]);
-            return false;
-        }
-        const checkToolPermissionResult = await nxtlinqApi.agent.checkToolPermission({
+        const authorization = await authorizeTextFrontendTool({
+            api: nxtlinqApi,
+            serviceId,
+            toolName: requiredPermission,
+            snapshot: {
+                walletAddress: currentHitAddress,
+                walletToken: currentToken,
+                // Legacy AIT issuance is unscoped (`externalId=''`). Do not impose a
+                // wallet-address subject until issuance/migration supports it.
+                externalId: undefined,
+                requireWalletIDVVerification,
+                loading: isAITLoading || isAutoConnecting,
+            },
             ...authFields(),
-            aitToken: currentToken,
-            controller: currentHitAddress,
-            toolName: requiredPermission
+            customUsername: (!requireWalletIDVVerification && customUsername)
+                ? getFinalCustomUsername(customUsername)
+                : undefined,
         });
-        if ('error' in checkToolPermissionResult) {
-            // Check if AIT is still loading or if we just auto-connected
-            if (isAITLoading || isAutoConnecting) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: walletTextUtils.getWalletText('Loading your wallet configuration... Please wait a moment.', serviceId),
-                        role: 'assistant',
-                        timestamp: new Date().toISOString()
-                    }]);
-                return false;
-            }
-            // Refresh service permissions before judging; use latest result to decide message
-            const freshAvailablePermissions = await fetchAvailablePermissions();
-            const latestAvailablePermissions = freshAvailablePermissions ?? availablePermissions;
-            const requiredPermission = checkToolPermissionResult.requiredPermission;
-            const isInServiceList = latestAvailablePermissions.some((p) => p.label === requiredPermission);
-            // Permission not in service's available list → "not available for your current identity provider"
-            if (!isInServiceList) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: `This permission (${requiredPermission}) is not available for your current identity provider.`,
-                        role: 'assistant',
-                        timestamp: new Date().toISOString()
-                    }]);
-                return false;
-            }
-            // AIT loaded but permissions empty (no AIT found)
-            if (currentAit && currentPermissions.length === 0) {
-                setIsLoading(false); // Stop thinking before showing message
-                setMessages(prev => [...prev, {
-                        id: Date.now().toString(),
-                        content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-                        role: 'assistant',
-                        timestamp: new Date().toISOString()
-                    }]);
-                return false;
-            }
-            // User has AIT but hasn't enabled this permission → prompt to enable
-            setIsLoading(false); // Stop thinking before showing message
-            const permissionMsg = `You don't have the required AIT permission: ${requiredPermission}. Would you like to enable AIT permission?`;
-            setMessages(prev => [
-                ...prev,
-                {
-                    id: Date.now().toString(),
-                    content: permissionMsg,
-                    role: 'assistant',
-                    timestamp: new Date().toISOString(),
-                    button: 'enableAIT',
-                    metadata: { requiredPermission }
-                }
-            ]);
-            return false;
-        }
-        return true;
+        if (authorization.status === 'allowed')
+            return true;
+        setIsLoading(false);
+        const recovery = {
+            id: Date.now().toString(),
+            content: 'Authorization is temporarily unavailable. Please try again.',
+            role: 'assistant',
+            timestamp: new Date().toISOString(),
+        };
+        switch (authorization.status) {
+            case 'wallet_disconnected':
+                recovery.content = walletTextUtils.getWalletText('Please connect your HIT wallet to continue.', serviceId);
+                recovery.button = 'connectWallet';
+                break;
+            case 'wallet_signed_out':
+                recovery.content = walletTextUtils.getWalletText('Please sign in with your HIT wallet to continue.', serviceId);
+                recovery.button = 'signIn';
+                break;
+            case 'wallet_session_invalid':
+                recovery.content = walletTextUtils.getWalletText('Invalid wallet session. Please sign in again.', serviceId);
+                recovery.button = 'signIn';
+                break;
+            case 'wallet_verification_required':
+                recovery.content = 'Please verify your wallet identity before using this tool.';
+                recovery.button = 'verifyWallet';
+                setIsPermissionFormOpen(true);
+                setShowPermissionForm(true);
+                break;
+            case 'ait_not_found':
+                recovery.content = 'No AIT found for your wallet. Please open settings to configure your AIT.';
+                break;
+            case 'permission_denied':
+                recovery.content = `You don't have the required AIT permission: ${authorization.requiredPermission}. Would you like to enable AIT permission?`;
+                recovery.button = 'enableAIT';
+                recovery.metadata = { requiredPermission: authorization.requiredPermission };
+                break;
+            case 'authorization_unavailable':
+                break;
+        }
+        setMessages(prev => [...prev, recovery]);
+        return false;
     };
     // AI Model related functions
     const handleModelChange = React.useCallback((modelIndex) => {
@@ -1488,9 +1244,18 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     // Updated sendMessage function to support different AI models and attachments
     const sendMessage = async (content, retryCount = 0, isPresetMessage = false, attachments, clientPipelineOverride) => {
         const hasContent = content.trim() || (attachments && attachments.length > 0);
-        if (!hasContent || isLoading)
+        // Recovery retries may run immediately after a completion handler calls
+        // setIsLoading(false), before React has committed that state update.
+        if (!hasContent || (retryCount === 0 && isLoading))
             return;
+        if (retryCount === 0) {
+            // A new user turn supersedes any older interrupted tool request.
+            pendingTextToolRetryRef.current.clear();
+        }
         setPendingAutoTts(null);
+        const turnExternalId = typeof window !== 'undefined'
+            ? localStorage.getItem('walletAddress') || undefined
+            : hitAddressRef.current || undefined;
         const currentModel = getCurrentModel();
         // Initialize with current model, will be updated with actual model from backend response
         let actualModelUsed = currentModel.value;
@@ -1562,7 +1327,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 model: currentModel.value,
                 ...authFields(),
                 pseudoId: pseudoId,
-                externalId: localStorage.getItem('walletAddress') || undefined,
+                externalId: turnExternalId,
                 customUserInfo,
                 customUsername,
                 message: content || (attachments && attachments.length > 0 ? `Uploaded ${attachments.length} file(s)` : ''),
@@ -1776,84 +1541,20 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 const toolUse = response.toolCall.toolUse;
                 let toolMsg = '';
                 if (onToolUse) {
-                    let wasAutoConnected = false;
-                    let wasAutoSignedIn = false;
-                    // Added: Mark if permission denied due to missing AIT permission
-                    let permissionDenied = false;
-                    // Use requiredPermission from response if available, otherwise fall back to toolUse.name
-                    const permissionToCheck = response?.requiredPermission || toolUse.name;
-                    const isToolAllowed = await hasPermission(permissionToCheck, true, () => { wasAutoConnected = true; }, () => { wasAutoSignedIn = true; });
-                    // If currentPermissions does not include permissionToCheck and availablePermissionLabels includes permissionToCheck, it means AIT permission is missing
-                    if (!isToolAllowed && !permissions.includes(permissionToCheck) && availablePermissions.map(p => p.label).includes(permissionToCheck)) {
-                        permissionDenied = true;
-                    }
+                    const isToolAllowed = await hasPermission(toolUse.name);
+                    // Typed preflight already emitted the only permitted recovery UI.
                     if (!isToolAllowed) {
-                        // If permission denied due to missing AIT permission return
-                        if (permissionDenied) {
-                            setIsLoading(false);
-                            return;
-                        }
-                        if (isSemiAutomaticMode) {
-                            setIsLoading(false);
-                            setMessages(prev => [...prev, {
-                                    id: Date.now().toString(),
-                                    content: 'Click button to continue using tool',
-                                    role: 'assistant',
-                                    timestamp: new Date().toISOString(),
-                                    button: 'continue'
-                                }]);
-                            return;
-                        }
-                        else {
-                            // Only retry for auto-connect/auto-sign-in scenarios
-                            if (wasAutoConnected && retryCount < 1) {
-                                // Clear loading state and retry immediately
-                                setIsLoading(false);
-                                // Check if wallet is already signed in
-                                const currentToken = nxtlinqAITServiceAccessTokenRef.current;
-                                if (!currentToken) {
-                                    // If not signed in, directly retry the message without waiting for AIT
-                                    setTimeout(() => {
-                                        sendMessage(content, retryCount + 1, isPresetMessage);
-                                    }, 2000);
-                                }
-                                else {
-                                    // If already signed in, wait for AIT to be fully loaded before retrying
-                                    setTimeout(async () => {
-                                        // Wait for AIT to be loaded if needed
-                                        if (!aitRef.current && nxtlinqAITServiceAccessTokenRef.current) {
-                                            await refreshAIT();
-                                        }
-                                        // Wait for AIT to be fully loaded with polling
-                                        let attempts = 0;
-                                        const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                                        while (!aitRef.current && attempts < maxAttempts) {
-                                            await new Promise(resolve => setTimeout(resolve, 2000));
-                                            attempts++;
-                                        }
-                                        // Only retry if AIT is actually loaded
-                                        if (aitRef.current) {
-                                            // Wait a bit more to ensure permissions are also loaded
-                                            await new Promise(resolve => setTimeout(resolve, 3000));
-                                            sendMessage(content, retryCount + 1, isPresetMessage);
-                                        }
-                                    }, 2000);
-                                }
-                            }
-                            return;
-                        }
-                    }
-                    if (isSemiAutomaticMode && wasAutoSignedIn) {
+                        pendingTextToolRetryRef.current.set({
+                            content,
+                            isPresetMessage,
+                            attachments,
+                        });
                         setIsLoading(false);
-                        setMessages(prev => [...prev, {
-                                id: Date.now().toString(),
-                                content: 'Click button to continue using tool',
-                                role: 'assistant',
-                                timestamp: new Date().toISOString(),
-                                button: 'continue'
-                            }]);
                         return;
                     }
+                    // Authorization passed. Clear before invoking the host callback so
+                    // concurrent completion events cannot execute this tool twice.
+                    pendingTextToolRetryRef.current.clear();
                     // Create streaming message for tool execution
                     const streamingMessageId = `streaming-${Date.now()}`;
                     const streamingMessage = {
@@ -2146,6 +1847,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             setIsLoading(false);
         }
     };
+    sendMessageRef.current = sendMessage;
     // Handle submit
     const handleSubmit = async (e, attachments) => {
         e.preventDefault();
@@ -2635,6 +2337,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             setShowPermissionForm(false);
             setIsPermissionFormOpen(false);
             await refreshAIT(true);
+            await retryPendingTextTool();
         }
         catch (error) {
             console.error('Failed to generate AIT:', error);
@@ -2713,7 +2416,8 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                                 }
                                 setIsLoading(false);
                                 showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
-                                refreshAIT();
+                                await refreshAIT();
+                                await retryPendingTextTool();
                                 return;
                             }
                             showError(verifyWalletResponse.error);
@@ -2753,7 +2457,8 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                         }
                         setIsLoading(false);
                         showSuccess('Wallet verification completed successfully! Your wallet is now verified and ready to use.');
-                        refreshAIT();
+                        await refreshAIT();
+                        await retryPendingTextTool();
                         return;
                     }
                     catch (error) {
@@ -2793,6 +2498,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                             await refreshAIT();
                             setIsLoading(false);
                             showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
+                            await retryPendingTextTool();
                             return;
                         }
                         // Handle specific error messages
@@ -2809,6 +2515,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     await refreshAIT();
                     setIsLoading(false);
                     showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
+                    await retryPendingTextTool();
                     return;
                 }
                 catch (error) {
@@ -2977,6 +2684,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         // Functions
         connectWallet,
         signInWallet,
+        retryPendingTextTool,
         sendMessage,
         handleSubmit,
         handlePresetMessage,