@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.1 → 0.4.3

package/src/context/ChatBotContext.tsx

@@ -25,12 +25,18 @@ import type {
   Message,
   ServicePermission,
 } from '@bytexbyte/nxtlinq-ai-agent-core-development';
+import {
+  authorizeTextFrontendTool,
+  hasRecordedWalletVerification,
+  validateWalletSession,
+} from '@bytexbyte/nxtlinq-ai-agent-core-development';
 import {
   AIModel,
   ChatBotContextType,
   ChatBotProps,
   PresetMessage
 } from '../types/ChatBotTypes';
+import { PendingTextToolRetryController } from '../pendingTextToolRetry';
 
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 
@@ -212,6 +218,22 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const permissionsRef = React.useRef(permissions);
   const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
   const signerRef = React.useRef(signer);
+  const pendingTextToolRetryRef = React.useRef(new PendingTextToolRetryController());
+  const sendMessageRef = React.useRef<ChatBotContextType['sendMessage']>(async () => {});
+  const retryPendingTextTool = React.useCallback(() => {
+    const controller = pendingTextToolRetryRef.current;
+    return controller.retry(async (request) => {
+      // This attempt consumes the old request. A still-blocked preflight will
+      // record it again with the next required recovery step.
+      controller.clear();
+      await sendMessageRef.current(
+        request.content,
+        1,
+        request.isPresetMessage,
+        request.attachments,
+      );
+    });
+  }, []);
 
   // Helper function to combine customUsername with Adilas customUserInfo
   const getFinalCustomUsername = React.useCallback((username: string | undefined): string | undefined => {
@@ -996,7 +1018,9 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
 
   // Refresh AIT
   const refreshAIT = async (forceUpdatePermissions = false) => {
-    if (!hitAddress) {
+    const currentHitAddress = hitAddressRef.current || hitAddress;
+    const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
+    if (!currentHitAddress) {
       setAit(null);
       setPermissions([]);
       setWalletInfo(null);
@@ -1006,13 +1030,18 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
 
     setIsAITLoading(true);
     try {
+      let walletAllowsAITLookup = !requireWalletIDVVerification;
+
       // Get wallet info first - always try to get wallet info if we have a token
-      if (nxtlinqAITServiceAccessToken) {
+      if (currentToken) {
         try {
-          const walletResponse = await nxtlinqApi.wallet.getWallet({ address: hitAddress }, nxtlinqAITServiceAccessToken);
+          const walletResponse = await nxtlinqApi.wallet.getWallet({ address: currentHitAddress }, currentToken);
           if (!('error' in walletResponse)) {
             setWalletInfo(walletResponse);
+            walletAllowsAITLookup = !requireWalletIDVVerification
+              || hasRecordedWalletVerification(walletResponse);
           } else {
+            setWalletInfo(null);
             // Check if the error is due to invalid/expired token
             if (walletResponse.error.includes('Invalid or expired token')) {
               console.log('Token appears to be invalid during wallet info fetch, clearing it');
@@ -1020,17 +1049,26 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             }
           }
         } catch (error) {
+          setWalletInfo(null);
           console.error('Failed to fetch wallet info:', error);
         }
       }
 
+      // AIT existence is not identity verification. In strict mode, stop before
+      // the legacy AIT lookup can synthesize a custom wallet record.
+      if (currentToken && !walletAllowsAITLookup) {
+        setAit(null);
+        setPermissions([]);
+        return;
+      }
+
       // Only try to fetch AIT if we have a token
-      if (nxtlinqAITServiceAccessToken) {
+      if (currentToken) {
         const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
           serviceId,
-          controller: hitAddress,
+          controller: currentHitAddress,
           customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-        }, nxtlinqAITServiceAccessToken);
+        }, currentToken);
 
         if ('error' in response) {
           console.error('Failed to fetch AIT:', response.error);
@@ -1062,17 +1100,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const isNeedSignInWithWallet = React.useMemo(() => {
     if (!hitAddress) return false;
     if (!nxtlinqAITServiceAccessToken) return true;
-
-    try {
-      const payload = JSON.parse(atob(nxtlinqAITServiceAccessToken.split('.')[1]));
-      const address = payload.address;
-      if (address !== hitAddress) return true;
-
-      return false;
-    } catch (error) {
-      console.error('Error parsing token:', error);
-      return true;
-    }
+    return !validateWalletSession(nxtlinqAITServiceAccessToken, hitAddress).valid;
   }, [hitAddress, nxtlinqAITServiceAccessToken]);
 
   // Connect wallet
@@ -1182,7 +1210,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   }, [nxtlinqAITServiceAccessToken, refreshAIT, isNeedSignInWithWallet, requireWalletIDVVerification, customUsername, nxtlinqApi]);
 
-  const signInWallet = async (autoShowSuccessMessage = true) => {
+  const signInWallet = async (autoShowSuccessMessage = true): Promise<boolean> => {
     // Use refs to get latest state values for consistency with hasPermission
     const currentHitAddress = hitAddressRef.current;
     const currentSigner = signerRef.current;
@@ -1215,7 +1243,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       if (autoShowSuccessMessage) {
         showError(walletTextUtils.getWalletText('Please connect your wallet first.', serviceId));
       }
-      return;
+      return false;
     }
 
     if (!signerToUse) {
@@ -1223,7 +1251,13 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       if (autoShowSuccessMessage) {
         showError(walletTextUtils.getWalletText('Please connect your wallet first.', serviceId));
       }
-      return;
+      return false;
+    }
+
+    const currentToken = nxtlinqAITServiceAccessTokenRef.current;
+    if (currentToken && validateWalletSession(currentToken, addressToUse).valid) {
+      await refreshAIT();
+      return true;
     }
 
     try {
@@ -1232,7 +1266,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         if (autoShowSuccessMessage) {
           showError(normalizeErrorForUser(nonceResponse.error));
         }
-        return;
+        return false;
       }
 
       const payload = {
@@ -1253,10 +1287,11 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         if (autoShowSuccessMessage) {
           showError(normalizeErrorForUser(response.error));
         }
-        return;
+        return false;
       }
       const { accessToken } = response;
       setNxtlinqAITServiceAccessToken(accessToken);
+      nxtlinqAITServiceAccessTokenRef.current = accessToken;
 
       // Wait for state to update before refreshing AIT
       await new Promise(resolve => setTimeout(resolve, 100));
@@ -1265,372 +1300,83 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       if (autoShowSuccessMessage) {
         showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
       }
+      return true;
     } catch (error) {
       console.error('Failed to sign in:', error);
       if (autoShowSuccessMessage) {
         showError('Failed to sign in. Please try again.');
       }
+      return false;
     }
   };
 
   // Check permissions
-  const hasPermission = async (requiredPermission: string, autoRetry = true, onAutoConnect?: () => void, onAutoSignIn?: () => void): Promise<boolean> => {
+  const hasPermission = async (
+    requiredPermission: string,
+  ): Promise<boolean> => {
     // Use refs to get latest state values
     const currentHitAddress = hitAddressRef.current;
-    const currentAit = aitRef.current;
-    const currentPermissions = permissionsRef.current;
     const currentToken = nxtlinqAITServiceAccessTokenRef.current;
 
-    if (!currentHitAddress) {
-      if (autoRetry) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: walletTextUtils.getWalletText('Please connect your HIT wallet to continue.', serviceId),
-          role: 'assistant',
-          timestamp: new Date().toISOString(),
-          button: 'connectWallet'
-        }]);
-
-        try {
-          setIsAutoConnecting(true); // Mark as auto-connecting
-          await connectWallet(false); // Don't show sign-in message yet
-          setIsAutoConnecting(false); // Clear auto-connecting state
-
-          // Show brief success message for auto-connect
-          showSuccess(walletTextUtils.getWalletText('Auto wallet connection successful', serviceId));
-
-
-          onAutoConnect?.(); // Call callback if provided
-          await new Promise(resolve => setTimeout(resolve, 2000));
-
-          // After auto connect, if not signed in, then auto sign-in
-          const tokenAfterConnect = nxtlinqAITServiceAccessTokenRef.current;
-          if (!tokenAfterConnect) {
-            setIsAutoConnecting(true);
-            await signInWallet(false);
-            onAutoSignIn?.(); // Call callback if provided
-            setIsAutoConnecting(false);
-            showSuccess(walletTextUtils.getWalletText('Auto sign-in successful after wallet connect', serviceId));
-            await refreshAIT();
-            // Wait for AIT to be fully loaded with polling
-            let attempts = 0;
-            const maxAttempts = 5;
-            while (!aitRef.current && attempts < maxAttempts) {
-              await new Promise(resolve => setTimeout(resolve, 2000));
-              attempts++;
-            }
-          }
-
-          // If connection (and sign-in if needed) successful, continue with permission check
-          const result = await hasPermission(requiredPermission, false);
-          return result;
-        } catch (error) {
-          console.error('Failed to auto-connect wallet:', error);
-          setIsAutoConnecting(false); // Clear auto-connecting state on error
-          return false;
-        }
-      }
-      // If autoRetry is false, don't show message again, just return false
-      return false;
-    }
-
-    if (!currentToken) {
-      if (autoRetry) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: walletTextUtils.getWalletText('Please sign in with your HIT wallet to continue.', serviceId),
-          role: 'assistant',
-          timestamp: new Date().toISOString(),
-          button: 'signIn'
-        }]);
-
-        try {
-          setIsAutoConnecting(true); // Mark as auto-signing
-          await signInWallet(false); // Don't show success message yet
-          onAutoSignIn?.(); // Call callback if provided
-          setIsAutoConnecting(false); // Clear auto-signing state
-
-          // Show brief success message for auto-sign-in
-          showSuccess('Auto sign-in successful');
-
-          // Ensure AIT is refreshed after sign-in
-          await refreshAIT();
-
-          // Wait for AIT to be fully loaded with polling
-          let attempts = 0;
-          const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-          while (!aitRef.current && attempts < maxAttempts) {
-            await new Promise(resolve => setTimeout(resolve, 2000));
-            attempts++;
-          }
-
-          // Only continue if AIT is actually loaded
-          if (aitRef.current) {
-            // Wait a bit more to ensure permissions are also loaded
-            await new Promise(resolve => setTimeout(resolve, 2000));
-            // If sign-in successful, continue with permission check
-            const result = await hasPermission(requiredPermission, false);
-            return result;
-          } else {
-            return false;
-          }
-        } catch (error) {
-          console.error('Failed to auto-sign-in wallet:', error);
-          setIsAutoConnecting(false); // Clear auto-signing state on error
-          return false;
-        }
-      }
-      // If autoRetry is false, don't show message again, just return false
-      return false;
-    }
-
-    try {
-      const payload = JSON.parse(atob(currentToken.split('.')[1]));
-      const address = payload.address;
-      if (address !== currentHitAddress) {
-        setNxtlinqAITServiceAccessToken('');
-        if (autoRetry) {
-          setIsLoading(false); // Stop thinking before showing message
-          setMessages(prev => [...prev, {
-            id: Date.now().toString(),
-            content: walletTextUtils.getWalletText('Wallet address mismatch. Please sign in with the correct wallet.', serviceId),
-            role: 'assistant',
-            timestamp: new Date().toISOString(),
-            button: 'signIn'
-          }]);
-
-          try {
-            setIsAutoConnecting(true); // Mark as auto-signing
-            await signInWallet(false); // Don't show success message yet
-            onAutoSignIn?.(); // Call callback if provided
-            setIsAutoConnecting(false); // Clear auto-signing state
-
-            // Show brief success message for auto-sign-in after address mismatch
-            showSuccess('Auto sign-in successful after address mismatch');
-
-            // Ensure AIT is refreshed after sign-in
-            await refreshAIT();
-
-            // Wait for AIT to be fully loaded with polling
-            let attempts = 0;
-            const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-            while (!aitRef.current && attempts < maxAttempts) {
-              await new Promise(resolve => setTimeout(resolve, 2000));
-              attempts++;
-            }
-
-            // Only continue if AIT is actually loaded
-            if (aitRef.current) {
-              // Wait a bit more to ensure permissions are also loaded
-              await new Promise(resolve => setTimeout(resolve, 2000));
-              // If sign-in successful, continue with permission check
-              const result = await hasPermission(requiredPermission, false);
-              return result;
-            } else {
-              return false;
-            }
-          } catch (error) {
-            console.error('Failed to auto-sign-in after address mismatch:', error);
-            setIsAutoConnecting(false); // Clear auto-signing state on error
-            return false;
-          }
-        }
-        // If autoRetry is false, don't show message again, just return false
-        return false;
-      }
-    } catch (error) {
-      console.error('Error parsing token:', error);
-      setNxtlinqAITServiceAccessToken('');
-      if (autoRetry) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: walletTextUtils.getWalletText('Invalid wallet session. Please sign in again.', serviceId),
-          role: 'assistant',
-          timestamp: new Date().toISOString(),
-          button: 'signIn'
-        }]);
-
-        try {
-          setIsAutoConnecting(true); // Mark as auto-signing
-          await signInWallet(false); // Don't show success message yet
-          onAutoSignIn?.(); // Call callback if provided
-          setIsAutoConnecting(false); // Clear auto-signing state
-
-          // Show brief success message for auto-sign-in after token parse error
-          showSuccess('Auto sign-in successful after token error');
-
-          // Ensure AIT is refreshed after sign-in
-          await refreshAIT();
-
-          // Wait for AIT to be fully loaded with polling
-          let attempts = 0;
-          const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-          while (!aitRef.current && attempts < maxAttempts) {
-            await new Promise(resolve => setTimeout(resolve, 2000));
-            attempts++;
-          }
-
-          // Only continue if AIT is actually loaded
-          if (aitRef.current) {
-            // Wait a bit more to ensure permissions are also loaded
-            await new Promise(resolve => setTimeout(resolve, 2000));
-            // If sign-in successful, continue with permission check
-            const result = await hasPermission(requiredPermission, false);
-            return result;
-          } else {
-            return false;
-          }
-        } catch (signInError) {
-          console.error('Failed to auto-sign-in after token parse error:', signInError);
-          setIsAutoConnecting(false); // Clear auto-signing state on error
-          return false;
-        }
-      }
-      // If autoRetry is false, don't show message again, just return false
-      return false;
-    }
-
-    if (!currentAit) {
-      // Show loading message if AIT is still loading
-      if (isAITLoading) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: walletTextUtils.getWalletText('Loading your wallet configuration... Please wait a moment.', serviceId),
-          role: 'assistant',
-          timestamp: new Date().toISOString()
-        }]);
-        return false;
-      }
-
-      // If AIT is not loaded but we have a token, try to refresh it once
-      if (currentToken && !isAITLoading) {
-        try {
-          await refreshAIT();
-          // Wait for AIT to be loaded with polling
-          let attempts = 0;
-          const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-          while (!aitRef.current && attempts < maxAttempts) {
-            await new Promise(resolve => setTimeout(resolve, 2000));
-            attempts++;
-          }
-          // Check again after refresh
-          if (!aitRef.current) {
-            setIsLoading(false); // Stop thinking before showing message
-            setMessages(prev => [...prev, {
-              id: Date.now().toString(),
-              content: walletTextUtils.getWalletText('No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.', serviceId),
-              role: 'assistant',
-              timestamp: new Date().toISOString()
-            }]);
-            return false;
-          }
-        } catch (error) {
-          console.error('Failed to refresh AIT during permission check:', error);
-          setIsLoading(false); // Stop thinking before showing message
-          setMessages(prev => [...prev, {
-            id: Date.now().toString(),
-            content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-            role: 'assistant',
-            timestamp: new Date().toISOString()
-          }]);
-          return false;
-        }
-      } else {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-          role: 'assistant',
-          timestamp: new Date().toISOString()
-        }]);
-        return false;
-      }
-    }
-
-    if (availablePermissions.length === 0) {
-      setIsLoading(false); // Stop thinking before showing message
-      setMessages(prev => [...prev, {
-        id: Date.now().toString(),
-        content: `No permissions available for your current identity provider. Please check your service configuration or contact support. Service ID: ${serviceId}, Permission Group: ${permissionGroup || 'None'}`,
-        role: 'assistant',
-        timestamp: new Date().toISOString()
-      }]);
-      return false;
-    }
-
-    const checkToolPermissionResult = await nxtlinqApi.agent.checkToolPermission({
+    const authorization = await authorizeTextFrontendTool({
+      api: nxtlinqApi,
+      serviceId,
+      toolName: requiredPermission,
+      snapshot: {
+        walletAddress: currentHitAddress,
+        walletToken: currentToken,
+        // Legacy AIT issuance is unscoped (`externalId=''`). Do not impose a
+        // wallet-address subject until issuance/migration supports it.
+        externalId: undefined,
+        requireWalletIDVVerification,
+        loading: isAITLoading || isAutoConnecting,
+      },
       ...authFields(),
-      aitToken: currentToken!,
-      controller: currentHitAddress!,
-      toolName: requiredPermission
-    })
-
-    if ('error' in checkToolPermissionResult) {
-      // Check if AIT is still loading or if we just auto-connected
-      if (isAITLoading || isAutoConnecting) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: walletTextUtils.getWalletText('Loading your wallet configuration... Please wait a moment.', serviceId),
-          role: 'assistant',
-          timestamp: new Date().toISOString()
-        }]);
-        return false;
-      }
-
-      // Refresh service permissions before judging; use latest result to decide message
-      const freshAvailablePermissions = await fetchAvailablePermissions();
-      const latestAvailablePermissions = freshAvailablePermissions ?? availablePermissions;
-
-      const requiredPermission = checkToolPermissionResult.requiredPermission;
-      const isInServiceList = latestAvailablePermissions.some((p) => p.label === requiredPermission);
-
-      // Permission not in service's available list → "not available for your current identity provider"
-      if (!isInServiceList) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: `This permission (${requiredPermission}) is not available for your current identity provider.`,
-          role: 'assistant',
-          timestamp: new Date().toISOString()
-        }]);
-        return false;
-      }
-
-      // AIT loaded but permissions empty (no AIT found)
-      if (currentAit && currentPermissions.length === 0) {
-        setIsLoading(false); // Stop thinking before showing message
-        setMessages(prev => [...prev, {
-          id: Date.now().toString(),
-          content: 'No AIT found for your wallet. Please click the settings button (⚙️) to configure your AIT permissions.',
-          role: 'assistant',
-          timestamp: new Date().toISOString()
-        }]);
-        return false;
-      }
-
-      // User has AIT but hasn't enabled this permission → prompt to enable
-      setIsLoading(false); // Stop thinking before showing message
-      const permissionMsg = `You don't have the required AIT permission: ${requiredPermission}. Would you like to enable AIT permission?`;
-      setMessages(prev => [
-        ...prev,
-        {
-          id: Date.now().toString(),
-          content: permissionMsg,
-          role: 'assistant',
-          timestamp: new Date().toISOString(),
-          button: 'enableAIT',
-          metadata: { requiredPermission }
-        }
-      ]);
-      return false;
-    }
-
-    return true;
+      customUsername: (!requireWalletIDVVerification && customUsername)
+        ? getFinalCustomUsername(customUsername)
+        : undefined,
+    });
+    if (authorization.status === 'allowed') return true;
+
+    setIsLoading(false);
+    const recovery: Message = {
+      id: Date.now().toString(),
+      content: 'Authorization is temporarily unavailable. Please try again.',
+      role: 'assistant',
+      timestamp: new Date().toISOString(),
+    };
+    switch (authorization.status) {
+      case 'wallet_disconnected':
+        recovery.content = walletTextUtils.getWalletText('Please connect your HIT wallet to continue.', serviceId);
+        recovery.button = 'connectWallet';
+        break;
+      case 'wallet_signed_out':
+        recovery.content = walletTextUtils.getWalletText('Please sign in with your HIT wallet to continue.', serviceId);
+        recovery.button = 'signIn';
+        break;
+      case 'wallet_session_invalid':
+        recovery.content = walletTextUtils.getWalletText('Invalid wallet session. Please sign in again.', serviceId);
+        recovery.button = 'signIn';
+        break;
+      case 'wallet_verification_required':
+        recovery.content = 'Please verify your wallet identity before using this tool.';
+        recovery.button = 'verifyWallet';
+        setIsPermissionFormOpen(true);
+        setShowPermissionForm(true);
+        break;
+      case 'ait_not_found':
+        recovery.content = 'No AIT found for your wallet. Please open settings to configure your AIT.';
+        break;
+      case 'permission_denied':
+        recovery.content = `You don't have the required AIT permission: ${authorization.requiredPermission}. Would you like to enable AIT permission?`;
+        recovery.button = 'enableAIT';
+        recovery.metadata = { requiredPermission: authorization.requiredPermission };
+        break;
+      case 'authorization_unavailable':
+        break;
+    }
+    setMessages(prev => [...prev, recovery]);
+    return false;
   };
 
   // AI Model related functions
@@ -1684,8 +1430,17 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     clientPipelineOverride?: Array<{ name: string; durationMs: number }>
   ): Promise<void> => {
     const hasContent = content.trim() || (attachments && attachments.length > 0);
-    if (!hasContent || isLoading) return;
+    // Recovery retries may run immediately after a completion handler calls
+    // setIsLoading(false), before React has committed that state update.
+    if (!hasContent || (retryCount === 0 && isLoading)) return;
+    if (retryCount === 0) {
+      // A new user turn supersedes any older interrupted tool request.
+      pendingTextToolRetryRef.current.clear();
+    }
     setPendingAutoTts(null);
+    const turnExternalId = typeof window !== 'undefined'
+      ? localStorage.getItem('walletAddress') || undefined
+      : hitAddressRef.current || undefined;
 
     const currentModel = getCurrentModel();
     // Initialize with current model, will be updated with actual model from backend response
@@ -1764,7 +1519,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         model: currentModel.value,
         ...authFields(),
         pseudoId: pseudoId,
-        externalId: localStorage.getItem('walletAddress') || undefined,
+        externalId: turnExternalId,
         customUserInfo,
         customUsername,
         message: content || (attachments && attachments.length > 0 ? `Uploaded ${attachments.length} file(s)` : ''),
@@ -1994,96 +1749,25 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
 
         let toolMsg = '';
         if (onToolUse) {
-          let wasAutoConnected = false;
-          let wasAutoSignedIn = false;
-          // Added: Mark if permission denied due to missing AIT permission
-          let permissionDenied = false;
-          // Use requiredPermission from response if available, otherwise fall back to toolUse.name
-          const permissionToCheck = (response as any)?.requiredPermission || toolUse.name;
-
           const isToolAllowed = await hasPermission(
-            permissionToCheck,
-            true,
-            () => { wasAutoConnected = true },
-            () => { wasAutoSignedIn = true }
+            toolUse.name,
           );
 
-          // If currentPermissions does not include permissionToCheck and availablePermissionLabels includes permissionToCheck, it means AIT permission is missing
-          if (!isToolAllowed && !permissions.includes(permissionToCheck) && availablePermissions.map(p => p.label).includes(permissionToCheck)) {
-            permissionDenied = true;
-          }
+          // Typed preflight already emitted the only permitted recovery UI.
           if (!isToolAllowed) {
-            // If permission denied due to missing AIT permission return
-            if (permissionDenied) {
-              setIsLoading(false);
-              return;
-            }
-
-            if (isSemiAutomaticMode) {
-              setIsLoading(false);
-              setMessages(prev => [...prev, {
-                id: Date.now().toString(),
-                content: 'Click button to continue using tool',
-                role: 'assistant',
-                timestamp: new Date().toISOString(),
-                button: 'continue'
-              }]);
-              return;
-            } else {
-              // Only retry for auto-connect/auto-sign-in scenarios
-              if (wasAutoConnected && retryCount < 1) {
-                // Clear loading state and retry immediately
-                setIsLoading(false);
-
-                // Check if wallet is already signed in
-                const currentToken = nxtlinqAITServiceAccessTokenRef.current;
-
-                if (!currentToken) {
-                  // If not signed in, directly retry the message without waiting for AIT
-                  setTimeout(() => {
-                    sendMessage(content, retryCount + 1, isPresetMessage);
-                  }, 2000);
-                } else {
-                  // If already signed in, wait for AIT to be fully loaded before retrying
-                  setTimeout(async () => {
-                    // Wait for AIT to be loaded if needed
-                    if (!aitRef.current && nxtlinqAITServiceAccessTokenRef.current) {
-                      await refreshAIT();
-                    }
-
-                    // Wait for AIT to be fully loaded with polling
-                    let attempts = 0;
-                    const maxAttempts = 5; // Wait up to 10 seconds (5 * 2000ms)
-                    while (!aitRef.current && attempts < maxAttempts) {
-                      await new Promise(resolve => setTimeout(resolve, 2000));
-                      attempts++;
-                    }
-
-                    // Only retry if AIT is actually loaded
-                    if (aitRef.current) {
-                      // Wait a bit more to ensure permissions are also loaded
-                      await new Promise(resolve => setTimeout(resolve, 3000));
-                      sendMessage(content, retryCount + 1, isPresetMessage);
-                    }
-                  }, 2000);
-                }
-              }
-              return;
-            }
-          }
-
-          if (isSemiAutomaticMode && wasAutoSignedIn) {
+            pendingTextToolRetryRef.current.set({
+              content,
+              isPresetMessage,
+              attachments,
+            });
             setIsLoading(false);
-            setMessages(prev => [...prev, {
-              id: Date.now().toString(),
-              content: 'Click button to continue using tool',
-              role: 'assistant',
-              timestamp: new Date().toISOString(),
-              button: 'continue'
-            }]);
             return;
           }
 
+          // Authorization passed. Clear before invoking the host callback so
+          // concurrent completion events cannot execute this tool twice.
+          pendingTextToolRetryRef.current.clear();
+
           // Create streaming message for tool execution
           const streamingMessageId = `streaming-${Date.now()}`;
           const streamingMessage: Message = {
@@ -2393,6 +2077,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       setIsLoading(false);
     }
   };
+  sendMessageRef.current = sendMessage;
 
   // Handle submit
   const handleSubmit = async (e: React.FormEvent, attachments?: Attachment[]) => {
@@ -2947,6 +2632,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       setShowPermissionForm(false);
       setIsPermissionFormOpen(false);
       await refreshAIT(true);
+      await retryPendingTextTool();
     } catch (error) {
       console.error('Failed to generate AIT:', error);
       setIsDisabled(false);
@@ -3025,7 +2711,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
                 }
                 setIsLoading(false);
                 showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
-                refreshAIT();
+                await refreshAIT();
+                await retryPendingTextTool();
                 return;
               }
               showError(verifyWalletResponse.error);
@@ -3063,7 +2750,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             }
             setIsLoading(false);
             showSuccess('Wallet verification completed successfully! Your wallet is now verified and ready to use.');
-            refreshAIT();
+            await refreshAIT();
+            await retryPendingTextTool();
             return;
           } catch (error) {
             let msg = 'Verification failed';
@@ -3103,6 +2791,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
               await refreshAIT();
               setIsLoading(false);
               showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
+              await retryPendingTextTool();
               return;
             }
             // Handle specific error messages
@@ -3118,6 +2807,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
           await refreshAIT();
           setIsLoading(false);
           showSuccess(walletTextUtils.getWalletText('Wallet verification completed successfully! Your wallet is now verified and ready to use.', serviceId));
+          await retryPendingTextTool();
           return;
         } catch (error) {
           console.error('Custom wallet verification failed:', error);
@@ -3298,6 +2988,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     // Functions
     connectWallet,
     signInWallet,
+    retryPendingTextTool,
     sendMessage,
     handleSubmit,
     handlePresetMessage,