@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.4 → 0.4.7

package/src/context/ChatBotContext.tsx

@@ -23,6 +23,7 @@ import type {
   Attachment,
   ClientTtsVoiceSettings,
   Message,
+  RuntimeAITResult,
   ServicePermission,
 } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 import {
@@ -38,6 +39,24 @@ import {
 } from '../types/ChatBotTypes';
 import { AuthorizationLoadingState } from '../authorizationLoadingState';
 import { PendingTextToolRetryController } from '../pendingTextToolRetry';
+import { completePiiScan } from '../piiMessageState';
+import { filterSuggestions } from '../suggestionState';
+import {
+  dispatchRuntimeAITCompleteReplacement,
+  removeOneDeniedPermission,
+  replaceCurrentMaximumDenyList,
+  RuntimeAITMutationQueue,
+  RuntimeAITRecomputeCoordinator,
+  StaleRuntimeAITResponseError,
+  runtimeAITContextKey,
+  runtimeAITSubjectKey,
+  runtimeAuthorizationMatchesContext,
+  runtimeAuthorizationState,
+  unavailableRuntimeAuthorization,
+  useProviderRuntimeCommit,
+  useRuntimeAITContextCommit,
+  type RuntimeAITContext,
+} from '../permissionState';
 
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 
@@ -68,6 +87,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   environment = 'production',
   onVerifyWallet,
   permissionGroup,
+  roles,
   children,
   // AI Model related attributes
   onModelChange,
@@ -90,9 +110,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   debugVoiceRms = false,
   sttGlossary,
 }) => {
-  // Set API hosts immediately based on environment (before any API calls)
-  setApiHosts(environment);
-
   const nxtlinqApi = React.useMemo(
     () => (serviceToken || getAuthToken
       ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
@@ -152,7 +169,22 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [hitAddress, setHitAddress] = React.useState<string | null>(null);
   const [ait, setAit] = React.useState<AIT | null>(null);
   const [permissions, setPermissions] = React.useState<string[]>([]);
-  const [availablePermissions, setAvailablePermissions] = React.useState<ServicePermission[]>([]);
+  const [maximumPermissions, setMaximumPermissions] = React.useState<string[]>([]);
+  const [deniedPermissions, setDeniedPermissions] = React.useState<string[]>([]);
+  const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+  const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] =
+    React.useState<string | null>(null);
+  const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState<ServicePermission[]>([]);
+  const availablePermissions = React.useMemo(
+    () => maximumPermissions.map((label) =>
+      servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+      }),
+    [maximumPermissions, servicePermissionCatalog],
+  );
   const [showPermissionForm, setShowPermissionForm] = React.useState(false);
   const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
   const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -161,6 +193,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [walletInfo, setWalletInfo] = React.useState<any>(null);
   const [isWalletLoading, setIsWalletLoading] = React.useState(false);
   const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+  const runtimeRolesKey = JSON.stringify(roles ?? null);
 
   // Persistent data (always use localStorage)
   const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage<string>('nxtlinqAITServiceAccessToken', '');
@@ -217,6 +250,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const hitAddressRef = React.useRef(hitAddress);
   const aitRef = React.useRef(ait);
   const permissionsRef = React.useRef(permissions);
+  const deniedPermissionsRef = React.useRef(deniedPermissions);
   const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
   const signerRef = React.useRef(signer);
   const authorizationLoadingStateRef = React.useRef(
@@ -238,6 +272,14 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       );
     });
   }, []);
+  const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+  const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+  useProviderRuntimeCommit(
+    hitAddressRef,
+    hitAddress,
+    environment,
+    setApiHosts,
+  );
 
   // Helper function to combine customUsername with Adilas customUserInfo
   const getFinalCustomUsername = React.useCallback((username: string | undefined): string | undefined => {
@@ -268,6 +310,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const textInputRef = React.useRef<HTMLInputElement | null>(null);
   const lastPartialRangeRef = React.useRef<{ start: number; end: number } | null>(null);
   const lastAutoSentTranscriptRef = React.useRef<string>('');
+  const presetSendInFlightRef = React.useRef(false);
   const autoSendTimerRef = React.useRef<NodeJS.Timeout | null>(null);
   const isCorrectingRef = React.useRef(false);
   const lastCustomErrorRef = React.useRef<string | undefined>(undefined);
@@ -570,10 +613,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   }, []);
 
   // Update refs when state changes
-  React.useEffect(() => {
-    hitAddressRef.current = hitAddress;
-  }, [hitAddress]);
-
   React.useEffect(() => {
     aitRef.current = ait;
   }, [ait]);
@@ -590,6 +629,10 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     authorizationLoadingStateRef.current.setAutoConnecting(isAutoConnecting);
   }, [isAutoConnecting]);
 
+  React.useEffect(() => {
+    deniedPermissionsRef.current = deniedPermissions;
+  }, [deniedPermissions]);
+
   React.useEffect(() => {
     nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
   }, [nxtlinqAITServiceAccessToken]);
@@ -1020,7 +1063,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         console.error('Failed to fetch permissions:', result.error);
         return undefined;
       }
-      setAvailablePermissions(result.permissions);
+      setServicePermissionCatalog(result.permissions);
       return result.permissions;
     } catch (error) {
       console.error('Error fetching permissions:', error);
@@ -1028,7 +1071,109 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  // Refresh AIT
+  const clearRuntimeAuthorization = React.useCallback(() => {
+    const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    setAit(cleared.ait);
+    setPermissions(cleared.effectivePermissions);
+    setMaximumPermissions(cleared.maximumPermissions);
+    setRuntimePermissionsUnavailable(cleared.unavailable);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+
+  const applyRuntimeResult = React.useCallback((result: RuntimeAITResult, context: RuntimeAITContext) => {
+    const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+    aitRef.current = next.ait;
+    permissionsRef.current = next.effectivePermissions;
+    setAit(next.ait);
+    setPermissions(next.effectivePermissions);
+    setMaximumPermissions(next.maximumPermissions);
+    setDeniedPermissions(next.deniedPermissions);
+    deniedPermissionsRef.current = next.deniedPermissions;
+    setRuntimePermissionsUnavailable(false);
+    setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+    return result;
+  }, []);
+
+  const runtimeContext = React.useMemo<RuntimeAITContext | null>(() => hitAddress ? {
+    controller: hitAddress,
+    serviceId,
+    ...(roles !== undefined ? { roles: [...roles] } : {}),
+    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+  } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+  const invalidateCommittedRuntimeContext = React.useCallback(() => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    deniedPermissionsRef.current = [];
+    setAit(null);
+    setPermissions([]);
+    setMaximumPermissions([]);
+    setDeniedPermissions([]);
+    setRuntimePermissionsUnavailable(activeContext !== null);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+  useRuntimeAITContextCommit(
+    runtimeRecomputeCoordinatorRef.current,
+    runtimeContext,
+    invalidateCommittedRuntimeContext,
+  );
+
+  const recomputeRuntimeAIT = React.useCallback(async (context: RuntimeAITContext) => {
+    const capturedContext: RuntimeAITContext = {
+      controller: context.controller,
+      serviceId: context.serviceId,
+      ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+      ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+    };
+    return runtimeRecomputeCoordinatorRef.current.run(
+      capturedContext,
+      () => nxtlinqApi.ait.recomputeAIT(capturedContext),
+      applyRuntimeResult,
+      clearRuntimeAuthorization,
+    );
+  }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+
+  const queueRuntimeAITRefresh = React.useCallback(
+    (context: RuntimeAITContext) => runtimeMutationQueueRef.current.run(
+      runtimeAITSubjectKey(context),
+      async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+      },
+    ),
+    [recomputeRuntimeAIT],
+  );
+
+  const convergeRuntimeAITSubject = React.useCallback(async (subjectKey: string) => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+      return;
+    }
+    await recomputeRuntimeAIT(activeContext);
+  }, [recomputeRuntimeAIT]);
+
+  const dispatchRuntimeDenyListReplacement = React.useCallback(async (
+    context: RuntimeAITContext,
+    nextDeniedPermissions: string[],
+  ) => dispatchRuntimeAITCompleteReplacement(
+    runtimeRecomputeCoordinatorRef.current,
+    context,
+    () => nxtlinqApi.ait.updatePermissionDenyList({
+      ...context,
+      deniedPermissions: nextDeniedPermissions,
+    }),
+    convergeRuntimeAITSubject,
+    clearRuntimeAuthorization,
+  ), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+
+  // Refresh the authoritative runtime AIT state.
   const refreshAIT = async (forceUpdatePermissions = false) => {
     const currentHitAddress = hitAddressRef.current || hitAddress;
     const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
@@ -1037,8 +1182,10 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       permissionsRef.current = [];
       setAit(null);
       setPermissions([]);
+      setMaximumPermissions([]);
       setWalletInfo(null);
       authorizationLoadingStateRef.current.setAITLoading(false);
+      setRuntimePermissionsUnavailable(false);
       setIsAITLoading(false);
       return;
     }
@@ -1070,53 +1217,23 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         }
       }
 
-      // AIT existence is not identity verification. In strict mode, stop before
-      // the legacy AIT lookup can synthesize a custom wallet record.
       if (currentToken && !walletAllowsAITLookup) {
-        aitRef.current = null;
-        permissionsRef.current = [];
-        setAit(null);
-        setPermissions([]);
+        clearRuntimeAuthorization();
         return;
       }
 
-      // Only try to fetch AIT if we have a token
+      // Recompute is the sole mint/reuse path and the only permission authority.
       if (currentToken) {
-        const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-          serviceId,
-          controller: currentHitAddress,
-          customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-        }, currentToken);
-
-        if ('error' in response) {
-          console.error('Failed to fetch AIT:', response.error);
-          aitRef.current = null;
-          permissionsRef.current = [];
-          setAit(null);
-          setPermissions([]);
-          return;
-        }
-
-        aitRef.current = response;
-        setAit(response);
-        if (!isPermissionFormOpen || forceUpdatePermissions) {
-          const newPermissions = response.metadata?.permissions || [];
-          permissionsRef.current = newPermissions;
-          setPermissions(newPermissions);
+        if (runtimeContext) {
+          await queueRuntimeAITRefresh(runtimeContext);
         }
       } else {
-        // No token available, clear AIT data
-        aitRef.current = null;
-        permissionsRef.current = [];
-        setAit(null);
-        setPermissions([]);
+        clearRuntimeAuthorization();
       }
     } catch (error) {
-      console.error('Failed to fetch AIT:', error);
-      aitRef.current = null;
-      permissionsRef.current = [];
-      setAit(null);
-      setPermissions([]);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to recompute AIT:', error);
+      }
     } finally {
       // Keep the authorization snapshot current before refreshAIT resolves.
       // React may not commit setState until the immediate pending-tool retry.
@@ -1321,10 +1438,13 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       const { accessToken } = response;
       setNxtlinqAITServiceAccessToken(accessToken);
       nxtlinqAITServiceAccessTokenRef.current = accessToken;
-
-      // Wait for state to update before refreshing AIT
-      await new Promise(resolve => setTimeout(resolve, 100));
-      await refreshAIT();
+      localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+      await queueRuntimeAITRefresh({
+        controller: addressToUse,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      });
 
       if (autoShowSuccessMessage) {
         showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
@@ -1363,6 +1483,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         loading: authorizationLoadingStateRef.current.isLoading(),
       },
       ...authFields(),
+      ...(roles !== undefined ? { roles: [...roles] } : {}),
+      ...(permissionGroup !== undefined ? { permissionGroup } : {}),
       customUsername: (!requireWalletIDVVerification && customUsername)
         ? getFinalCustomUsername(customUsername)
         : undefined,
@@ -1433,7 +1555,11 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     return effectiveAvailableModels[safeIndex];
   }, [effectiveAvailableModels, selectedModelIndex]);
 
-  const updateSuggestions = React.useCallback(async (pseudoId: string, externalId?: string) => {
+  const updateSuggestions = React.useCallback(async (
+    pseudoId: string,
+    externalId?: string,
+    lastUserMessage?: string,
+  ) => {
     const result = await nxtlinqApi.agent.generateSuggestions({
       ...authFields(),
       pseudoId,
@@ -1446,11 +1572,11 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       return;
     }
 
-    setSuggestions(result.suggestions.map((sug: string) => ({
-      text: sug,
-      autoSend: true
-    })));
-  }, [])
+    setSuggestions(filterSuggestions(
+      result.suggestions.map((sug: string) => ({ text: sug, autoSend: true })),
+      lastUserMessage,
+    ));
+  }, [nxtlinqApi, authFields, setSuggestions])
 
   // Updated sendMessage function to support different AI models and attachments
   const sendMessage = async (
@@ -1586,15 +1712,14 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             const updated = [...prev];
             for (let i = updated.length - 1; i >= 0; i--) {
               if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
-                const patch: Partial<typeof updated[0]> = { piiStep };
-                // scan_complete carries anonymized data — set piiProtection early for immediate redact
-                if (step === 'scan_complete' && data?.anonymizedUserMessage) {
-                  patch.piiProtection = {
-                    anonymizedContent: data.anonymizedUserMessage,
-                    mapping: data.mapping || {},
-                  };
+                if (step === 'scan_complete') {
+                  // PII work is complete independently of any later tool
+                  // authorization. Never leave the bubble in Sending while
+                  // waiting for wallet recovery or permission elevation.
+                  updated[i] = completePiiScan(updated[i], data);
+                } else {
+                  updated[i] = { ...updated[i], piiStep };
                 }
-                updated[i] = { ...updated[i], ...patch };
                 break;
               }
             }
@@ -1603,6 +1728,27 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         } : undefined,
       });
 
+      // PII scanning is complete when the Agent response arrives, regardless
+      // of whether a later frontend-tool authorization step can continue.
+      if (piiDisplayMode === 'redacted') {
+        const anonymizedUserMsg = response.piiProtection?.anonymizedUserMessage;
+        const piiMappingData = response.piiProtection?.mapping ?? undefined;
+        setMessages(prev => {
+          const updated = [...prev];
+          for (let i = updated.length - 1; i >= 0; i--) {
+            if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
+              updated[i] = completePiiScan(updated[i], {
+                entityCount: piiMappingData ? Object.keys(piiMappingData).length : 0,
+                anonymizedUserMessage: anonymizedUserMsg,
+                mapping: piiMappingData,
+              });
+              break;
+            }
+          }
+          return updated;
+        });
+      }
+
       if (!('error' in response && (response as { error?: string }).error)) {
         const tr = response as AgentResponse;
         if (
@@ -1732,7 +1878,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
           replyText = 'Sorry, I cannot understand your question';
         }
 
-        updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+        updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
 
         setMessages(prev => prev.map(m =>
           m.id === streamAssistantId
@@ -1893,7 +2039,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             }
           }
 
-          updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+          updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
 
           // Skip creating a new botResponse since we already updated the streaming message
         } else {
@@ -1933,7 +2079,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             }
           }
 
-          updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+          updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
           const newBotResponse: Message = {
             id: (Date.now() + 1).toString(),
             content: mergedContent,
@@ -1959,7 +2105,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
             .join(' ') || 'Sorry, I cannot understand your question'
           : response.reply || 'Sorry, I cannot understand your question';
 
-        updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined);
+        updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
 
         const newBotResponse: Message = {
           id: (Date.now() + 1).toString(),
@@ -1999,38 +2145,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         botResponse = newBotResponse;
       }
 
-      // ===== PII Protection: Update user message with anonymized version =====
-      const anonymizedUserMsg = response.piiProtection?.anonymizedUserMessage;
-      const piiMappingData = response.piiProtection?.mapping ?? undefined;
-      if (anonymizedUserMsg) {
-        setMessages(prev => {
-          const updated = [...prev];
-          for (let i = updated.length - 1; i >= 0; i--) {
-            if (updated[i].role === 'user') {
-              updated[i] = {
-                ...updated[i],
-                piiProtection: { anonymizedContent: anonymizedUserMsg, mapping: piiMappingData },
-                piiStatus: 'complete',
-              };
-              break;
-            }
-          }
-          return updated;
-        });
-      } else if (piiDisplayMode === 'redacted') {
-        // No PII detected — set piiStatus to 'none' to trigger "No sensitive data" indicator
-        setMessages(prev => {
-          const updated = [...prev];
-          for (let i = updated.length - 1; i >= 0; i--) {
-            if (updated[i].role === 'user' && updated[i].piiStatus === 'scanning') {
-              updated[i] = { ...updated[i], piiStatus: 'none' };
-              break;
-            }
-          }
-          return updated;
-        });
-      }
-
       // Execute redirect after all message processing is complete
       if (redirectUrl) {
         // Use setTimeout to ensure the message is displayed before redirect
@@ -2400,21 +2514,19 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   }, [nxtlinqApi, authFields, pseudoId]);
 
   // Handle preset message
-  const handlePresetMessage = (message: PresetMessage) => {
+  const handlePresetMessage = async (message: PresetMessage): Promise<void> => {
     // If preset is configured as auto-send, avoid duplicate sends when user clicks repeatedly
     if (message.autoSend) {
       const trimmedText = (message.text || '').trim();
       if (!trimmedText) return;
 
       // Prevent sending messages while AI Agent is processing
-      if (isLoading) {
+      if (isLoading || presetSendInFlightRef.current) {
         return;
       }
 
-      // If this exact preset text was just sent (by auto-send / manual / preset), skip to prevent duplicates
-      if (lastAutoSentTranscriptRef.current === trimmedText) {
-        return;
-      }
+      presetSendInFlightRef.current = true;
+      setSuggestions(previous => filterSuggestions(previous, trimmedText));
 
       // For preset messages, we need to add the user message first since sendMessage won't add it on retries
       const userMessage: Message = {
@@ -2434,114 +2546,16 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       lastAutoSentTranscriptRef.current = trimmedText;
 
       // Pass a flag to indicate this is a preset message so sendMessage won't add user message again
-      sendMessage(trimmedText, 0, true);
+      try {
+        await sendMessage(trimmedText, 0, true);
+      } finally {
+        presetSendInFlightRef.current = false;
+      }
     } else {
       setInputValue(message.text);
     }
   };
 
-  // Generate and register AIT
-  const generateAndRegisterAIT = async (newPermissions?: string[], isFromAIAgent = false) => {
-    let currentSigner = signer;
-    let currentAddress = hitAddress;
-
-    // If we have an address but no signer, try to auto-connect wallet
-    if (currentAddress && !currentSigner) {
-      const storedWalletAddress = localStorage.getItem('walletAddress');
-      if (storedWalletAddress === currentAddress) {
-        try {
-          const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-          if (autoConnectResult) {
-            // Wait for state to update
-            await new Promise(resolve => setTimeout(resolve, 1000));
-            // Get the updated signer and address
-            currentSigner = signerRef.current || signer;
-            currentAddress = hitAddressRef.current || hitAddress;
-          }
-        } catch (error) {
-          console.error('Auto-connect failed during AIT generation:', error);
-        }
-      }
-    }
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-  };
-
-  // Generate and register AIT with explicit signer and address
-  const generateAndRegisterAITWithSigner = async (
-    newPermissions?: string[],
-    isFromAIAgent = false,
-    explicitSigner?: ethers.JsonRpcSigner,
-    explicitAddress?: string
-  ) => {
-    const currentSigner = explicitSigner || signer;
-    const currentAddress = explicitAddress || hitAddress;
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    // If AI Agent is creating, must check if user has existing AIT
-    if (isFromAIAgent && !aitRef.current) {
-      throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-    }
-
-    const timestamp = Math.floor(Date.now() / 1000);
-    const aitId = `did:polygon:nxtlinq:${currentAddress}:${timestamp}`;
-
-    const metadata = {
-      permissions: newPermissions || permissions,
-      issuedBy: currentAddress,
-    };
-
-    const metadataStr = stringify(metadata);
-    // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-    const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-
-    const uploadResponse = await nxtlinqApi.metadata.createMetadata(metadata, nxtlinqAITServiceAccessToken || '');
-    if ('error' in uploadResponse) {
-      throw new Error(`Failed to upload metadata: ${uploadResponse.error}`);
-    }
-
-    const { metadataCid } = uploadResponse;
-
-    const createAITParams = {
-      aitId,
-      controller: currentAddress,
-      serviceId,
-      metadataHash,
-      metadataCid,
-      isFromAIAgent: isFromAIAgent,
-      parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-    };
-
-    const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-
-    if ('error' in createAITResponse) {
-      throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-    }
-
-    const aitInfo = {
-      aitId,
-      controller: currentAddress,
-      metadata,
-      metadataHash,
-      metadataCid,
-    };
-
-    const nextPermissions = newPermissions || permissions;
-    aitRef.current = aitInfo;
-    permissionsRef.current = nextPermissions;
-    setAit(aitInfo);
-    setPermissions(nextPermissions);
-  };
-
-
-
   // Auto enable AIT permission
   const enableAIT = async (toolName: string) => {
     if (isAITEnabling) return false; // Prevent duplicate
@@ -2608,40 +2622,45 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
 
     try {
-      // Get available permissions to find the tool
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      if (!availablePermissionLabels.includes(toolName)) {
+      const context: RuntimeAITContext = {
+        controller: currentHitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const enabled = await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const current = await recomputeRuntimeAIT(context);
+          if (!current.maximumPermissions.includes(toolName)) {
+            return false;
+          }
+          const nextDeniedPermissions = removeOneDeniedPermission(
+            current.deniedPermissions,
+            toolName,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+          return true;
+        },
+      );
+      if (!enabled) {
         showError(`Tool ${toolName} is not available for your current identity provider`);
         setIsAITEnabling(false);
         return false;
       }
-
-      // Get current permissions from AIT metadata instead of React state
-      // This ensures we don't lose existing permissions when enabling new ones
-      const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-      const newPermissions = [...currentAITPermissions];
-      if (!newPermissions.includes(toolName)) {
-        newPermissions.push(toolName);
-      }
-
-      // Filter out deleted permissions before saving
-      const validPermissions = newPermissions.filter(permission =>
-        availablePermissionLabels.includes(permission)
-      );
-
-      // Generate and register AIT with new permissions
-      // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-      const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-
-      await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
       showSuccess('AIT permission enabled successfully! You can now use the AI agent.');
-      await refreshAIT(true);
       setIsAITEnabling(false);
       return true;
     } catch (error) {
-      console.error('Failed to auto-enable AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to auto-enable AIT:', error);
+      }
       setIsAITEnabling(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return false;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to enable AIT permission. Please try again.');
@@ -2654,23 +2673,43 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const savePermissions = async (newPermissions?: string[]) => {
     setIsDisabled(true);
     try {
-      // Filter out deleted permissions before saving
-      const permissionsToSave = newPermissions || permissions;
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      const validPermissions = permissionsToSave.filter(permission =>
-        availablePermissionLabels.includes(permission)
+      if (!hitAddress) {
+        throw new Error('Please connect your wallet first');
+      }
+      const context: RuntimeAITContext = {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const checkedPermissions = [...(newPermissions ?? permissions)];
+      await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const fresh = await recomputeRuntimeAIT(context);
+          const nextDeniedPermissions = replaceCurrentMaximumDenyList(
+            fresh.deniedPermissions,
+            fresh.maximumPermissions,
+            checkedPermissions,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+        },
       );
-
-      await generateAndRegisterAIT(validPermissions, false);
       showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
       setShowPermissionForm(false);
       setIsPermissionFormOpen(false);
       await refreshAIT(true);
       await retryPendingTextTool();
     } catch (error) {
-      console.error('Failed to generate AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to update AIT deny-list:', error);
+      }
       setIsDisabled(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to save permissions. Please try again.');
@@ -2719,15 +2758,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
                   const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                   if (!('error' in walletResponse)) {
                     setWalletInfo(walletResponse);
-                    const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                      serviceId,
+                    await queueRuntimeAITRefresh({
                       controller: address,
-                      customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                    }, token);
-                    if (!('error' in aitResponse)) {
-                      aitRef.current = aitResponse;
-                      setAit(aitResponse);
-                    }
+                      serviceId,
+                      ...(roles !== undefined ? { roles: [...roles] } : {}),
+                      ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                    });
                   }
                 } finally {
                   setIsWalletLoading(false);
@@ -2759,15 +2795,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
               const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
               if (!('error' in walletResponse)) {
                 setWalletInfo(walletResponse);
-                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                  serviceId,
+                await queueRuntimeAITRefresh({
                   controller: address,
-                  customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, token);
-                if (!('error' in aitResponse)) {
-                  aitRef.current = aitResponse;
-                  setAit(aitResponse);
-                }
+                  serviceId,
+                  ...(roles !== undefined ? { roles: [...roles] } : {}),
+                  ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                });
               }
             } finally {
               setIsWalletLoading(false);
@@ -2877,7 +2910,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     if (hitAddress && nxtlinqAITServiceAccessToken) {
       refreshAIT();
     }
-  }, [hitAddress, nxtlinqAITServiceAccessToken]);
+  }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
 
   // Set loading state when permission form opens
   React.useEffect(() => {
@@ -2966,6 +2999,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     updateExternalId()
   }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
 
+  const runtimeAuthorizationMatchesRenderedContext =
+    runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
   const contextValue: ChatBotContextType = {
     // State
     messages,
@@ -2973,9 +3008,16 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     isLoading,
     isOpen,
     hitAddress,
-    ait,
-    permissions,
-    availablePermissions,
+    ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+    permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+    maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+    deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+    runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+      ? runtimePermissionsUnavailable
+      : runtimeContext !== null,
+    availablePermissions: runtimeAuthorizationMatchesRenderedContext
+      ? availablePermissions
+      : [],
     showPermissionForm,
     isPermissionFormOpen,
     isAITLoading,
@@ -3012,7 +3054,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     setIsOpen,
     setShowPermissionForm,
     setIsPermissionFormOpen,
-    setPermissions,
     setIsDisabled,
     setIsWalletLoading,
     setNotification,
@@ -3063,6 +3104,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     onVerifyWallet: (method: 'berifyme' | 'custom') => handleVerifyWalletClick(method),
     serviceId,
     permissionGroup,
+    roles,
 
     // Props
     props: {
@@ -3081,6 +3123,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       getAuthToken,
       onVerifyWallet,
       permissionGroup,
+      roles,
       onModelChange,
       storageMode,
       requireWalletIDVVerification,