@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.4 → 0.4.7

package/dist/context/ChatBotContext.js

@@ -8,6 +8,9 @@ import { createNxtlinqApi, setApiHosts, synthesizeSpeechToBuffer, streamSpeechTo
 import { authorizeTextFrontendTool, hasRecordedWalletVerification, validateWalletSession, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 import { AuthorizationLoadingState } from '../authorizationLoadingState';
 import { PendingTextToolRetryController } from '../pendingTextToolRetry';
+import { completePiiScan } from '../piiMessageState';
+import { filterSuggestions } from '../suggestionState';
+import { dispatchRuntimeAITCompleteReplacement, removeOneDeniedPermission, replaceCurrentMaximumDenyList, RuntimeAITMutationQueue, RuntimeAITRecomputeCoordinator, StaleRuntimeAITResponseError, runtimeAITContextKey, runtimeAITSubjectKey, runtimeAuthorizationMatchesContext, runtimeAuthorizationState, unavailableRuntimeAuthorization, useProviderRuntimeCommit, useRuntimeAITContextCommit, } from '../permissionState';
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 const ChatBotContext = React.createContext(undefined);
 export const useChatBot = () => {
@@ -17,7 +20,7 @@ export const useChatBot = () => {
     }
     return context;
 };
-export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, children, 
+export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, roles, children, 
 // AI Model related attributes
 onModelChange, 
 // Storage mode configuration
@@ -34,8 +37,6 @@ idvBannerDismissSeconds = 86400,
 isStopRecordingOnSend = false, 
 // Custom error message to display in chat
 customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
-    // Set API hosts immediately based on environment (before any API calls)
-    setApiHosts(environment);
     const nxtlinqApi = React.useMemo(() => (serviceToken || getAuthToken
         ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
         : createNxtlinqApi(apiKey ?? '', apiSecret ?? '')), [apiKey, apiSecret, serviceToken, getAuthToken]);
@@ -87,7 +88,17 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const [hitAddress, setHitAddress] = React.useState(null);
     const [ait, setAit] = React.useState(null);
     const [permissions, setPermissions] = React.useState([]);
-    const [availablePermissions, setAvailablePermissions] = React.useState([]);
+    const [maximumPermissions, setMaximumPermissions] = React.useState([]);
+    const [deniedPermissions, setDeniedPermissions] = React.useState([]);
+    const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+    const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] = React.useState(null);
+    const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState([]);
+    const availablePermissions = React.useMemo(() => maximumPermissions.map((label) => servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+    }), [maximumPermissions, servicePermissionCatalog]);
     const [showPermissionForm, setShowPermissionForm] = React.useState(false);
     const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
     const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -96,6 +107,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const [walletInfo, setWalletInfo] = React.useState(null);
     const [isWalletLoading, setIsWalletLoading] = React.useState(false);
     const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+    const runtimeRolesKey = JSON.stringify(roles ?? null);
     // Persistent data (always use localStorage)
     const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage('nxtlinqAITServiceAccessToken', '');
     const [pseudoId, setPseudoId] = useLocalStorage('pseudoId', uuidv4());
@@ -144,6 +156,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const hitAddressRef = React.useRef(hitAddress);
     const aitRef = React.useRef(ait);
     const permissionsRef = React.useRef(permissions);
+    const deniedPermissionsRef = React.useRef(deniedPermissions);
     const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
     const signerRef = React.useRef(signer);
     const authorizationLoadingStateRef = React.useRef(new AuthorizationLoadingState(isAITLoading, isAutoConnecting));
@@ -158,6 +171,9 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             await sendMessageRef.current(request.content, 1, request.isPresetMessage, request.attachments);
         });
     }, []);
+    const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+    const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+    useProviderRuntimeCommit(hitAddressRef, hitAddress, environment, setApiHosts);
     // Helper function to combine customUsername with Adilas customUserInfo
     const getFinalCustomUsername = React.useCallback((username) => {
         if (!username)
@@ -187,6 +203,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const textInputRef = React.useRef(null);
     const lastPartialRangeRef = React.useRef(null);
     const lastAutoSentTranscriptRef = React.useRef('');
+    const presetSendInFlightRef = React.useRef(false);
     const autoSendTimerRef = React.useRef(null);
     const isCorrectingRef = React.useRef(false);
     const lastCustomErrorRef = React.useRef(undefined);
@@ -476,9 +493,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         }
     }, []);
     // Update refs when state changes
-    React.useEffect(() => {
-        hitAddressRef.current = hitAddress;
-    }, [hitAddress]);
     React.useEffect(() => {
         aitRef.current = ait;
     }, [ait]);
@@ -491,6 +505,9 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     React.useEffect(() => {
         authorizationLoadingStateRef.current.setAutoConnecting(isAutoConnecting);
     }, [isAutoConnecting]);
+    React.useEffect(() => {
+        deniedPermissionsRef.current = deniedPermissions;
+    }, [deniedPermissions]);
     React.useEffect(() => {
         nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
     }, [nxtlinqAITServiceAccessToken]);
@@ -870,7 +887,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 console.error('Failed to fetch permissions:', result.error);
                 return undefined;
             }
-            setAvailablePermissions(result.permissions);
+            setServicePermissionCatalog(result.permissions);
             return result.permissions;
         }
         catch (error) {
@@ -878,7 +895,74 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             return undefined;
         }
     };
-    // Refresh AIT
+    const clearRuntimeAuthorization = React.useCallback(() => {
+        const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        setAit(cleared.ait);
+        setPermissions(cleared.effectivePermissions);
+        setMaximumPermissions(cleared.maximumPermissions);
+        setRuntimePermissionsUnavailable(cleared.unavailable);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    const applyRuntimeResult = React.useCallback((result, context) => {
+        const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+        aitRef.current = next.ait;
+        permissionsRef.current = next.effectivePermissions;
+        setAit(next.ait);
+        setPermissions(next.effectivePermissions);
+        setMaximumPermissions(next.maximumPermissions);
+        setDeniedPermissions(next.deniedPermissions);
+        deniedPermissionsRef.current = next.deniedPermissions;
+        setRuntimePermissionsUnavailable(false);
+        setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+        return result;
+    }, []);
+    const runtimeContext = React.useMemo(() => hitAddress ? {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+    } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+    const invalidateCommittedRuntimeContext = React.useCallback(() => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        deniedPermissionsRef.current = [];
+        setAit(null);
+        setPermissions([]);
+        setMaximumPermissions([]);
+        setDeniedPermissions([]);
+        setRuntimePermissionsUnavailable(activeContext !== null);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    useRuntimeAITContextCommit(runtimeRecomputeCoordinatorRef.current, runtimeContext, invalidateCommittedRuntimeContext);
+    const recomputeRuntimeAIT = React.useCallback(async (context) => {
+        const capturedContext = {
+            controller: context.controller,
+            serviceId: context.serviceId,
+            ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+            ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+        };
+        return runtimeRecomputeCoordinatorRef.current.run(capturedContext, () => nxtlinqApi.ait.recomputeAIT(capturedContext), applyRuntimeResult, clearRuntimeAuthorization);
+    }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+    const queueRuntimeAITRefresh = React.useCallback((context) => runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+    }), [recomputeRuntimeAIT]);
+    const convergeRuntimeAITSubject = React.useCallback(async (subjectKey) => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+            return;
+        }
+        await recomputeRuntimeAIT(activeContext);
+    }, [recomputeRuntimeAIT]);
+    const dispatchRuntimeDenyListReplacement = React.useCallback(async (context, nextDeniedPermissions) => dispatchRuntimeAITCompleteReplacement(runtimeRecomputeCoordinatorRef.current, context, () => nxtlinqApi.ait.updatePermissionDenyList({
+        ...context,
+        deniedPermissions: nextDeniedPermissions,
+    }), convergeRuntimeAITSubject, clearRuntimeAuthorization), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+    // Refresh the authoritative runtime AIT state.
     const refreshAIT = async (forceUpdatePermissions = false) => {
         const currentHitAddress = hitAddressRef.current || hitAddress;
         const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
@@ -887,8 +971,10 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             permissionsRef.current = [];
             setAit(null);
             setPermissions([]);
+            setMaximumPermissions([]);
             setWalletInfo(null);
             authorizationLoadingStateRef.current.setAITLoading(false);
+            setRuntimePermissionsUnavailable(false);
             setIsAITLoading(false);
             return;
         }
@@ -919,52 +1005,24 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     console.error('Failed to fetch wallet info:', error);
                 }
             }
-            // AIT existence is not identity verification. In strict mode, stop before
-            // the legacy AIT lookup can synthesize a custom wallet record.
             if (currentToken && !walletAllowsAITLookup) {
-                aitRef.current = null;
-                permissionsRef.current = [];
-                setAit(null);
-                setPermissions([]);
+                clearRuntimeAuthorization();
                 return;
             }
-            // Only try to fetch AIT if we have a token
+            // Recompute is the sole mint/reuse path and the only permission authority.
             if (currentToken) {
-                const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                    serviceId,
-                    controller: currentHitAddress,
-                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, currentToken);
-                if ('error' in response) {
-                    console.error('Failed to fetch AIT:', response.error);
-                    aitRef.current = null;
-                    permissionsRef.current = [];
-                    setAit(null);
-                    setPermissions([]);
-                    return;
-                }
-                aitRef.current = response;
-                setAit(response);
-                if (!isPermissionFormOpen || forceUpdatePermissions) {
-                    const newPermissions = response.metadata?.permissions || [];
-                    permissionsRef.current = newPermissions;
-                    setPermissions(newPermissions);
+                if (runtimeContext) {
+                    await queueRuntimeAITRefresh(runtimeContext);
                 }
             }
             else {
-                // No token available, clear AIT data
-                aitRef.current = null;
-                permissionsRef.current = [];
-                setAit(null);
-                setPermissions([]);
+                clearRuntimeAuthorization();
             }
         }
         catch (error) {
-            console.error('Failed to fetch AIT:', error);
-            aitRef.current = null;
-            permissionsRef.current = [];
-            setAit(null);
-            setPermissions([]);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to recompute AIT:', error);
+            }
         }
         finally {
             // Keep the authorization snapshot current before refreshAIT resolves.
@@ -1151,9 +1209,13 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             const { accessToken } = response;
             setNxtlinqAITServiceAccessToken(accessToken);
             nxtlinqAITServiceAccessTokenRef.current = accessToken;
-            // Wait for state to update before refreshing AIT
-            await new Promise(resolve => setTimeout(resolve, 100));
-            await refreshAIT();
+            localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+            await queueRuntimeAITRefresh({
+                controller: addressToUse,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            });
             if (autoShowSuccessMessage) {
                 showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
             }
@@ -1188,6 +1250,8 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 loading: authorizationLoadingStateRef.current.isLoading(),
             },
             ...authFields(),
+            ...(roles !== undefined ? { roles: [...roles] } : {}),
+            ...(permissionGroup !== undefined ? { permissionGroup } : {}),
             customUsername: (!requireWalletIDVVerification && customUsername)
                 ? getFinalCustomUsername(customUsername)
                 : undefined,
@@ -1252,7 +1316,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         }
         return effectiveAvailableModels[safeIndex];
     }, [effectiveAvailableModels, selectedModelIndex]);
-    const updateSuggestions = React.useCallback(async (pseudoId, externalId) => {
+    const updateSuggestions = React.useCallback(async (pseudoId, externalId, lastUserMessage) => {
         const result = await nxtlinqApi.agent.generateSuggestions({
             ...authFields(),
             pseudoId,
@@ -1263,11 +1327,8 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             setSuggestions([]);
             return;
         }
-        setSuggestions(result.suggestions.map((sug) => ({
-            text: sug,
-            autoSend: true
-        })));
-    }, []);
+        setSuggestions(filterSuggestions(result.suggestions.map((sug) => ({ text: sug, autoSend: true })), lastUserMessage));
+    }, [nxtlinqApi, authFields, setSuggestions]);
     // Updated sendMessage function to support different AI models and attachments
     const sendMessage = async (content, retryCount = 0, isPresetMessage = false, attachments, clientPipelineOverride) => {
         const hasContent = content.trim() || (attachments && attachments.length > 0);
@@ -1387,15 +1448,15 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                         const updated = [...prev];
                         for (let i = updated.length - 1; i >= 0; i--) {
                             if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
-                                const patch = { piiStep };
-                                // scan_complete carries anonymized data — set piiProtection early for immediate redact
-                                if (step === 'scan_complete' && data?.anonymizedUserMessage) {
-                                    patch.piiProtection = {
-                                        anonymizedContent: data.anonymizedUserMessage,
-                                        mapping: data.mapping || {},
-                                    };
+                                if (step === 'scan_complete') {
+                                    // PII work is complete independently of any later tool
+                                    // authorization. Never leave the bubble in Sending while
+                                    // waiting for wallet recovery or permission elevation.
+                                    updated[i] = completePiiScan(updated[i], data);
+                                }
+                                else {
+                                    updated[i] = { ...updated[i], piiStep };
                                 }
-                                updated[i] = { ...updated[i], ...patch };
                                 break;
                             }
                         }
@@ -1403,6 +1464,26 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     });
                 } : undefined,
             });
+            // PII scanning is complete when the Agent response arrives, regardless
+            // of whether a later frontend-tool authorization step can continue.
+            if (piiDisplayMode === 'redacted') {
+                const anonymizedUserMsg = response.piiProtection?.anonymizedUserMessage;
+                const piiMappingData = response.piiProtection?.mapping ?? undefined;
+                setMessages(prev => {
+                    const updated = [...prev];
+                    for (let i = updated.length - 1; i >= 0; i--) {
+                        if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
+                            updated[i] = completePiiScan(updated[i], {
+                                entityCount: piiMappingData ? Object.keys(piiMappingData).length : 0,
+                                anonymizedUserMessage: anonymizedUserMsg,
+                                mapping: piiMappingData,
+                            });
+                            break;
+                        }
+                    }
+                    return updated;
+                });
+            }
             if (!('error' in response && response.error)) {
                 const tr = response;
                 if (tr.ttsVoice &&
@@ -1527,7 +1608,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 if (!replyText.trim()) {
                     replyText = 'Sorry, I cannot understand your question';
                 }
-                updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+                updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
                 setMessages(prev => prev.map(m => m.id === streamAssistantId
                     ? {
                         ...m,
@@ -1666,7 +1747,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                             // Don't block the UI if update fails
                         }
                     }
-                    updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+                    updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
                     // Skip creating a new botResponse since we already updated the streaming message
                 }
                 else {
@@ -1705,7 +1786,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                             // Don't block the UI if update fails
                         }
                     }
-                    updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+                    updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
                     const newBotResponse = {
                         id: (Date.now() + 1).toString(),
                         content: mergedContent,
@@ -1731,7 +1812,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                         .map((item) => item.text)
                         .join(' ') || 'Sorry, I cannot understand your question'
                     : response.reply || 'Sorry, I cannot understand your question';
-                updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+                updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
                 const newBotResponse = {
                     id: (Date.now() + 1).toString(),
                     content: replyText,
@@ -1769,38 +1850,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 setMessages(prev => [...prev, newBotResponse]);
                 botResponse = newBotResponse;
             }
-            // ===== PII Protection: Update user message with anonymized version =====
-            const anonymizedUserMsg = response.piiProtection?.anonymizedUserMessage;
-            const piiMappingData = response.piiProtection?.mapping ?? undefined;
-            if (anonymizedUserMsg) {
-                setMessages(prev => {
-                    const updated = [...prev];
-                    for (let i = updated.length - 1; i >= 0; i--) {
-                        if (updated[i].role === 'user') {
-                            updated[i] = {
-                                ...updated[i],
-                                piiProtection: { anonymizedContent: anonymizedUserMsg, mapping: piiMappingData },
-                                piiStatus: 'complete',
-                            };
-                            break;
-                        }
-                    }
-                    return updated;
-                });
-            }
-            else if (piiDisplayMode === 'redacted') {
-                // No PII detected — set piiStatus to 'none' to trigger "No sensitive data" indicator
-                setMessages(prev => {
-                    const updated = [...prev];
-                    for (let i = updated.length - 1; i >= 0; i--) {
-                        if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
-                            updated[i] = { ...updated[i], piiStatus: 'none' };
-                            break;
-                        }
-                    }
-                    return updated;
-                });
-            }
             // Execute redirect after all message processing is complete
             if (redirectUrl) {
                 // Use setTimeout to ensure the message is displayed before redirect
@@ -2141,20 +2190,18 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         return { url: result.url };
     }, [nxtlinqApi, authFields, pseudoId]);
     // Handle preset message
-    const handlePresetMessage = (message) => {
+    const handlePresetMessage = async (message) => {
         // If preset is configured as auto-send, avoid duplicate sends when user clicks repeatedly
         if (message.autoSend) {
             const trimmedText = (message.text || '').trim();
             if (!trimmedText)
                 return;
             // Prevent sending messages while AI Agent is processing
-            if (isLoading) {
-                return;
-            }
-            // If this exact preset text was just sent (by auto-send / manual / preset), skip to prevent duplicates
-            if (lastAutoSentTranscriptRef.current === trimmedText) {
+            if (isLoading || presetSendInFlightRef.current) {
                 return;
             }
+            presetSendInFlightRef.current = true;
+            setSuggestions(previous => filterSuggestions(previous, trimmedText));
             // For preset messages, we need to add the user message first since sendMessage won't add it on retries
             const userMessage = {
                 id: Date.now().toString(),
@@ -2171,91 +2218,17 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             // Mark as last sent to guard against rapid re-clicks and other duplicate flows
             lastAutoSentTranscriptRef.current = trimmedText;
             // Pass a flag to indicate this is a preset message so sendMessage won't add user message again
-            sendMessage(trimmedText, 0, true);
+            try {
+                await sendMessage(trimmedText, 0, true);
+            }
+            finally {
+                presetSendInFlightRef.current = false;
+            }
         }
         else {
             setInputValue(message.text);
         }
     };
-    // Generate and register AIT
-    const generateAndRegisterAIT = async (newPermissions, isFromAIAgent = false) => {
-        let currentSigner = signer;
-        let currentAddress = hitAddress;
-        // If we have an address but no signer, try to auto-connect wallet
-        if (currentAddress && !currentSigner) {
-            const storedWalletAddress = localStorage.getItem('walletAddress');
-            if (storedWalletAddress === currentAddress) {
-                try {
-                    const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-                    if (autoConnectResult) {
-                        // Wait for state to update
-                        await new Promise(resolve => setTimeout(resolve, 1000));
-                        // Get the updated signer and address
-                        currentSigner = signerRef.current || signer;
-                        currentAddress = hitAddressRef.current || hitAddress;
-                    }
-                }
-                catch (error) {
-                    console.error('Auto-connect failed during AIT generation:', error);
-                }
-            }
-        }
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-    };
-    // Generate and register AIT with explicit signer and address
-    const generateAndRegisterAITWithSigner = async (newPermissions, isFromAIAgent = false, explicitSigner, explicitAddress) => {
-        const currentSigner = explicitSigner || signer;
-        const currentAddress = explicitAddress || hitAddress;
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        // If AI Agent is creating, must check if user has existing AIT
-        if (isFromAIAgent && !aitRef.current) {
-            throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-        }
-        const timestamp = Math.floor(Date.now() / 1000);
-        const aitId = `did:polygon:nxtlinq:${currentAddress}:${timestamp}`;
-        const metadata = {
-            permissions: newPermissions || permissions,
-            issuedBy: currentAddress,
-        };
-        const metadataStr = stringify(metadata);
-        // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-        const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-        const uploadResponse = await nxtlinqApi.metadata.createMetadata(metadata, nxtlinqAITServiceAccessToken || '');
-        if ('error' in uploadResponse) {
-            throw new Error(`Failed to upload metadata: ${uploadResponse.error}`);
-        }
-        const { metadataCid } = uploadResponse;
-        const createAITParams = {
-            aitId,
-            controller: currentAddress,
-            serviceId,
-            metadataHash,
-            metadataCid,
-            isFromAIAgent: isFromAIAgent,
-            parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-        };
-        const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-        if ('error' in createAITResponse) {
-            throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-        }
-        const aitInfo = {
-            aitId,
-            controller: currentAddress,
-            metadata,
-            metadataHash,
-            metadataCid,
-        };
-        const nextPermissions = newPermissions || permissions;
-        aitRef.current = aitInfo;
-        permissionsRef.current = nextPermissions;
-        setAit(aitInfo);
-        setPermissions(nextPermissions);
-    };
     // Auto enable AIT permission
     const enableAIT = async (toolName) => {
         if (isAITEnabling)
@@ -2317,35 +2290,41 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             }
         }
         try {
-            // Get available permissions to find the tool
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            if (!availablePermissionLabels.includes(toolName)) {
+            const context = {
+                controller: currentHitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const enabled = await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const current = await recomputeRuntimeAIT(context);
+                if (!current.maximumPermissions.includes(toolName)) {
+                    return false;
+                }
+                const nextDeniedPermissions = removeOneDeniedPermission(current.deniedPermissions, toolName);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+                return true;
+            });
+            if (!enabled) {
                 showError(`Tool ${toolName} is not available for your current identity provider`);
                 setIsAITEnabling(false);
                 return false;
             }
-            // Get current permissions from AIT metadata instead of React state
-            // This ensures we don't lose existing permissions when enabling new ones
-            const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-            const newPermissions = [...currentAITPermissions];
-            if (!newPermissions.includes(toolName)) {
-                newPermissions.push(toolName);
-            }
-            // Filter out deleted permissions before saving
-            const validPermissions = newPermissions.filter(permission => availablePermissionLabels.includes(permission));
-            // Generate and register AIT with new permissions
-            // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-            const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-            await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
             showSuccess('AIT permission enabled successfully! You can now use the AI agent.');
-            await refreshAIT(true);
             setIsAITEnabling(false);
             return true;
         }
         catch (error) {
-            console.error('Failed to auto-enable AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to auto-enable AIT:', error);
+            }
             setIsAITEnabling(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return false;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2358,11 +2337,23 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const savePermissions = async (newPermissions) => {
         setIsDisabled(true);
         try {
-            // Filter out deleted permissions before saving
-            const permissionsToSave = newPermissions || permissions;
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            const validPermissions = permissionsToSave.filter(permission => availablePermissionLabels.includes(permission));
-            await generateAndRegisterAIT(validPermissions, false);
+            if (!hitAddress) {
+                throw new Error('Please connect your wallet first');
+            }
+            const context = {
+                controller: hitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const checkedPermissions = [...(newPermissions ?? permissions)];
+            await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const fresh = await recomputeRuntimeAIT(context);
+                const nextDeniedPermissions = replaceCurrentMaximumDenyList(fresh.deniedPermissions, fresh.maximumPermissions, checkedPermissions);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+            });
             showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
             setShowPermissionForm(false);
             setIsPermissionFormOpen(false);
@@ -2370,9 +2361,14 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             await retryPendingTextTool();
         }
         catch (error) {
-            console.error('Failed to generate AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to update AIT deny-list:', error);
+            }
             setIsDisabled(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2418,15 +2414,12 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                                     const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                                     if (!('error' in walletResponse)) {
                                         setWalletInfo(walletResponse);
-                                        const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                            serviceId,
+                                        await queueRuntimeAITRefresh({
                                             controller: address,
-                                            customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                        }, token);
-                                        if (!('error' in aitResponse)) {
-                                            aitRef.current = aitResponse;
-                                            setAit(aitResponse);
-                                        }
+                                            serviceId,
+                                            ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                            ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                        });
                                     }
                                 }
                                 finally {
@@ -2460,15 +2453,12 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                             const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                             if (!('error' in walletResponse)) {
                                 setWalletInfo(walletResponse);
-                                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                    serviceId,
+                                await queueRuntimeAITRefresh({
                                     controller: address,
-                                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                }, token);
-                                if (!('error' in aitResponse)) {
-                                    aitRef.current = aitResponse;
-                                    setAit(aitResponse);
-                                }
+                                    serviceId,
+                                    ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                });
                             }
                         }
                         finally {
@@ -2580,7 +2570,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         if (hitAddress && nxtlinqAITServiceAccessToken) {
             refreshAIT();
         }
-    }, [hitAddress, nxtlinqAITServiceAccessToken]);
+    }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
     // Set loading state when permission form opens
     React.useEffect(() => {
         if (isPermissionFormOpen && hitAddress) {
@@ -2660,6 +2650,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         };
         updateExternalId();
     }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
+    const runtimeAuthorizationMatchesRenderedContext = runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
     const contextValue = {
         // State
         messages,
@@ -2667,9 +2658,16 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         isLoading,
         isOpen,
         hitAddress,
-        ait,
-        permissions,
-        availablePermissions,
+        ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+        permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+        maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+        deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+        runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+            ? runtimePermissionsUnavailable
+            : runtimeContext !== null,
+        availablePermissions: runtimeAuthorizationMatchesRenderedContext
+            ? availablePermissions
+            : [],
         showPermissionForm,
         isPermissionFormOpen,
         isAITLoading,
@@ -2705,7 +2703,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         setIsOpen,
         setShowPermissionForm,
         setIsPermissionFormOpen,
-        setPermissions,
         setIsDisabled,
         setIsWalletLoading,
         setNotification,
@@ -2754,6 +2751,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         onVerifyWallet: (method) => handleVerifyWalletClick(method),
         serviceId,
         permissionGroup,
+        roles,
         // Props
         props: {
             onMessage,
@@ -2771,6 +2769,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             getAuthToken,
             onVerifyWallet,
             permissionGroup,
+            roles,
             onModelChange,
             storageMode,
             requireWalletIDVVerification,