@jini-ai/chat 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.5.3 — 2026-10-06
+
+- New `createLastConversationStore({ scope }, { storage? })` (react): remembers one conversation id per caller identity under a versioned localStorage key (`jini.chat.last-conversation.v1.<scope>`); corrupt or foreign entries read as nothing remembered. Selection stays host-owned.
+- Restored staged attachments keep their upload batch: the draft cache records the batch id beside each conversation's attachment references, and `useChatPane` resumes that batch on mount and on a conversation switch, so a second attachment after a remount no longer fails the turn ("Attachments must belong to one batch").
+- A display-only A2UI surface (`surfaceProperties.displayOnly`, e.g. a drawn chart) no longer reads as "Waiting for your answer above".
+- A run held on an open form reads as waiting, not working: new `isAwaitingAnswer`, passed to ext event renderers as `awaitingAnswer`.
+- One row per delegated tool call: `isDelegatedWrapperToolName` covers both delegated gateways (bare or `mcp__<server>__`-prefixed) and `foldDelegatedWrapperCalls` drops a wrapper call once its canonical call exists (`useToolTimeline`, `ToolCard`).
+- Markdown: `[label](url)` links render (relative and parenthesized URLs, unsafe schemes kept as text, off-site links open in a new tab); intraword underscores never open or close emphasis.
+- A late scroll event no longer unsticks the transcript from the bottom; only a move up does.
+- Requires `@jini-ai/agentic` ^0.4.2 (`displayOnlySurfaceIdOf`).
+
 ## 0.5.2 — 2026-10-05
 
 - `useChatPane` holds a draft typed for a question that has since closed (answered elsewhere, expired, or refused with `'not-pending'`): `send` shows the `'not-pending'` notice instead of queueing it as a new paid run. Only clearing the draft or the new `sendAsNewMessage()` (the notice's "Send as a new message" button in `ChatPane`) lets it out as an ordinary turn. New pure `findAwaitedTypedAnswerId`.

package/dist/core/run-activity.d.ts

@@ -1,22 +1,3 @@
-/**
- * @module run-activity
- *
- * What a running turn is doing right now, as one short line ("Running Page Fill… 1 m 20 s").
- *
- * Why: once a turn's first tool row appeared, nothing on screen showed the run was still alive —
- * the old "Thinking…" placeholder only showed while the message was completely empty. Model think
- * time, long tool calls, held cards and API overload retries all looked identical: dead.
- *
- * Shape: {@link deriveRunActivity} reads the events the pane already has and returns the latest
- * signal; {@link RUN_ACTIVITY_LABELS} is the ONE table that turns a signal into words. The clock
- * (seconds since the signal began) is the caller's: the React hook ticks it once a second. Nothing
- * here special-cases a particular tool.
- *
- * Status events this reads (a host translates its runtime's heartbeats into them):
- * - `code: 'api_retry'`, `data: { attempt, maxAttempts, service? }` — the model API is overloaded.
- * - `code: 'tool_progress'`, `data: { elapsedSeconds }` — a tool call is still running.
- * - `code: 'thinking'` — the model is reasoning (keeps the idle timer honest).
- */
 import type { AgentEvent } from './events.js';
 /** The latest thing a running turn is doing. */
 export type RunActivity = {
@@ -57,7 +38,8 @@ export declare function humanizeToolName({ name }: {
  * The latest signal in a running turn's events.
  *
  * Precedence, newest wins: an API retry with nothing visible after it; a card that arrived while a
- * tool call is still open (the tool is waiting on the person); the newest open tool call; else
+ * tool call is still open (the tool is waiting on the person; a display-only A2UI surface is not a
+ * card); the newest open tool call; else
  * writing (last visible event is text) or thinking.
  *
  * @complexity O(n) in events, O(open tool calls) extra space.
@@ -65,6 +47,16 @@ export declare function humanizeToolName({ name }: {
 export declare function deriveRunActivity({ events }: {
     events: readonly AgentEvent[] | undefined;
 }): RunActivityState;
+/**
+ * Whether the run is waiting on the person: a card (form, confirm, sign-in) arrived while its tool
+ * call is still open. Hosts use it to hide "still working" notices, which read as a hung run while
+ * the run is really waiting for an answer.
+ *
+ * @complexity O(n) in events.
+ */
+export declare function isAwaitingAnswer({ events }: {
+    events: readonly AgentEvent[] | undefined;
+}): boolean;
 /** `4` → `"4 s"`, `80` → `"1 m 20 s"`, `120` → `"2 m 0 s"`. */
 export declare function formatActivityClock({ totalSeconds }: {
     totalSeconds: number;

package/dist/core/run-activity.js

@@ -1,3 +1,24 @@
+/**
+ * @module run-activity
+ *
+ * What a running turn is doing right now, as one short line ("Running Page Fill… 1 m 20 s").
+ *
+ * Why: once a turn's first tool row appeared, nothing on screen showed the run was still alive —
+ * the old "Thinking…" placeholder only showed while the message was completely empty. Model think
+ * time, long tool calls, held cards and API overload retries all looked identical: dead.
+ *
+ * Shape: {@link deriveRunActivity} reads the events the pane already has and returns the latest
+ * signal; {@link RUN_ACTIVITY_LABELS} is the ONE table that turns a signal into words. The clock
+ * (seconds since the signal began) is the caller's: the React hook ticks it once a second. Nothing
+ * here special-cases a particular tool.
+ *
+ * Status events this reads (a host translates its runtime's heartbeats into them):
+ * - `code: 'api_retry'`, `data: { attempt, maxAttempts, service? }` — the model API is overloaded.
+ * - `code: 'tool_progress'`, `data: { elapsedSeconds }` — a tool call is still running.
+ * - `code: 'thinking'` — the model is reasoning (keeps the idle timer honest).
+ */
+import { a2uiSurfaceIdOf, displayOnlySurfaceIdOf } from '@jini-ai/agentic/a2ui';
+import { isDelegatedWrapperToolName } from './tool-events.js';
 /** Tool names whose only job is finding the right tool (MCP tool search / schema lookup). */
 const DISCOVERY_TOOL_NAMES = new Set([
     'ToolSearch',
@@ -6,10 +27,10 @@ const DISCOVERY_TOOL_NAMES = new Set([
     'mcp__jini__search_tools',
     'mcp__jini__describe_tool',
 ]);
-/** Transport wrappers whose real tool id is in `input.toolId`. */
-const WRAPPER_TOOL_NAMES = new Set(['execute_delegated_tool', 'mcp__jini__execute_delegated_tool']);
 /** Ext events that are a card for the person (a form, a confirm, a sign-in). */
 const CARD_EXT_NAMES = new Set(['mcp-ui', 'a2ui']);
+/** The A2UI ext name: its surfaces may declare themselves display-only (`@jini-ai/agentic/a2ui`). */
+const A2UI_EXT_NAME = 'a2ui';
 /** After this long with nothing new on screen, a thinking/writing line says "Still working…". */
 export const RUN_ACTIVITY_IDLE_MS = 20_000;
 function isRecord(value) {
@@ -25,7 +46,8 @@ function stringField(data, key) {
 }
 /** `"page.fill"` → `"Page Fill"`, `"mcp__supabase__list_projects"` → `"List Projects"`. Display only. */
 export function humanizeToolName({ name }, { input } = {}) {
-    const real = WRAPPER_TOOL_NAMES.has(name) ? (stringField(input, 'toolId') ?? name) : name;
+    // A transport wrapper's real tool id is in `input.toolId`.
+    const real = isDelegatedWrapperToolName({ name: name }) ? (stringField(input, 'toolId') ?? name) : name;
     const bare = real.startsWith('mcp__') ? real.split('__').slice(2).join('__') || real : real;
     return bare
         .split(/[._\s]+/)
@@ -36,6 +58,23 @@ export function humanizeToolName({ name }, { input } = {}) {
 function isVisible(event) {
     return event.kind === 'text' ? event.text.length > 0 : event.kind === 'tool_use' || event.kind === 'tool_result' || event.kind === 'ext';
 }
+/**
+ * Whether an ext event is a card the person must answer. A display-only A2UI surface shows
+ * something and asks nothing, so a tool holding its call open after drawing one (assistant_render_ui
+ * waits a few seconds to hear a browser refusal) must not read as "Waiting for your answer above"
+ * (demo V3, 2026-10-05).
+ */
+function isAnswerCard(scan, name, data) {
+    if (!CARD_EXT_NAMES.has(name))
+        return false;
+    if (name !== A2UI_EXT_NAME)
+        return true;
+    const displayOnlyId = displayOnlySurfaceIdOf({ message: data });
+    if (displayOnlyId !== undefined)
+        scan.displayOnlySurfaces.add(displayOnlyId);
+    const surfaceId = a2uiSurfaceIdOf({ message: data });
+    return surfaceId === undefined || !scan.displayOnlySurfaces.has(surfaceId);
+}
 function scanEvent(scan, event, index) {
     if (isVisible(event)) {
         scan.lastVisible = { index, kind: event.kind };
@@ -48,7 +87,7 @@ function scanEvent(scan, event, index) {
     else if (event.kind === 'tool_result') {
         scan.open = scan.open.filter((tool) => tool.id !== event.toolUseId);
     }
-    else if (event.kind === 'ext' && CARD_EXT_NAMES.has(event.name)) {
+    else if (event.kind === 'ext' && isAnswerCard(scan, event.name, event.data)) {
         scan.lastCardIndex = index;
     }
     else if (event.kind === 'status' && event.code === 'api_retry') {
@@ -64,13 +103,14 @@ function scanEvent(scan, event, index) {
  * The latest signal in a running turn's events.
  *
  * Precedence, newest wins: an API retry with nothing visible after it; a card that arrived while a
- * tool call is still open (the tool is waiting on the person); the newest open tool call; else
+ * tool call is still open (the tool is waiting on the person; a display-only A2UI surface is not a
+ * card); the newest open tool call; else
  * writing (last visible event is text) or thinking.
  *
  * @complexity O(n) in events, O(open tool calls) extra space.
  */
 export function deriveRunActivity({ events }) {
-    const scan = { open: [], lastVisible: null, lastCardIndex: -1, retry: null, progress: null, visibleCount: 0 };
+    const scan = { open: [], lastVisible: null, lastCardIndex: -1, retry: null, progress: null, visibleCount: 0, displayOnlySurfaces: new Set() };
     (events ?? []).forEach((event, index) => scanEvent(scan, event, index));
     const visibleCount = scan.visibleCount;
     const lastVisibleIndex = scan.lastVisible?.index ?? -1;
@@ -114,6 +154,16 @@ export function deriveRunActivity({ events }) {
     }
     return { activity: { kind: 'thinking' }, key: `thinking:${lastVisibleIndex}`, visibleCount };
 }
+/**
+ * Whether the run is waiting on the person: a card (form, confirm, sign-in) arrived while its tool
+ * call is still open. Hosts use it to hide "still working" notices, which read as a hung run while
+ * the run is really waiting for an answer.
+ *
+ * @complexity O(n) in events.
+ */
+export function isAwaitingAnswer({ events }) {
+    return deriveRunActivity({ events }).activity.kind === 'awaiting-answer';
+}
 /** `4` → `"4 s"`, `80` → `"1 m 20 s"`, `120` → `"2 m 0 s"`. */
 export function formatActivityClock({ totalSeconds }) {
     const seconds = Math.max(0, Math.floor(totalSeconds));
@@ -133,7 +183,9 @@ export const RUN_ACTIVITY_LABELS = {
         : t('Writing…'),
     'finding-tool': (_a, clock, t) => t('Finding the right tool… {time}', { time: formatActivityClock({ totalSeconds: clock.seconds }) }),
     'running-tool': (a, clock, t) => t('Running {tool}… {time}', { tool: a.tool, time: formatActivityClock({ totalSeconds: clock.seconds }) }),
-    'awaiting-answer': (_a, clock, t) => t('Waiting for your answer above · {time}', { time: formatActivityClock({ totalSeconds: clock.seconds }) }),
+    // No clock: the run is waiting on the person, not working, and a ticking timer under an open
+    // form read as a hung run (demo dry-run, 2026-10-05).
+    'awaiting-answer': (_a, _clock, t) => t('Waiting for your answer above'),
     retrying: (a, _clock, t) => {
         const who = a.service ? t("{service}'s servers are busy", { service: a.service }) : t('The AI service is busy');
         return a.attempt !== undefined && a.maxAttempts !== undefined

package/dist/core/tool-events.d.ts

@@ -17,4 +17,38 @@ import type { AgentEvent } from './events.js';
 export declare function dedupeToolUsesById({ events }: {
     events: AgentEvent[] | undefined;
 }): AgentEvent[];
+/**
+ * Whether `name` is a delegated-tool transport wrapper — `execute_delegated_tool` or
+ * `execute_readonly_delegated_tool`, bare or as an MCP client names it (`mcp__<server>__…`). Its real
+ * tool id is in `input.toolId`. The one shared definition, so a renderer and the run-activity line
+ * cannot disagree about which names are wrappers (both once missed the read-only gateway).
+ *
+ * @complexity O(n) in the length of `name`.
+ */
+export declare function isDelegatedWrapperToolName({ name }: {
+    name: string;
+}): boolean;
+/**
+ * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * so one call shows as one row.
+ *
+ * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
+ * (`mcp__jini__execute_delegated_tool {toolId, input}`, with the CLI's `toolu_…` id) and the
+ * daemon bridge's canonical `tool_use` named after the real tool (`content_stats`, with a fresh
+ * UUID from `@jini-ai/mcp`). The ids differ, so {@link dedupeToolUsesById} cannot merge them, and a
+ * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
+ * name, input and result.
+ *
+ * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
+ * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
+ * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
+ * hidden.
+ *
+ * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * @returns A new array without the folded wrappers, or the original reference when none fold.
+ * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ */
+export declare function foldDelegatedWrapperCalls({ events }: {
+    events: AgentEvent[] | undefined;
+}): AgentEvent[];
 //# sourceMappingURL=tool-events.d.ts.map

package/dist/core/tool-events.js

@@ -33,4 +33,65 @@ export function dedupeToolUsesById({ events }) {
     }
     return deduped ?? events;
 }
+/** The two delegated-tool gateways `@jini-ai/mcp` hosts: the write gateway and its read-only companion. */
+const DELEGATED_WRAPPER_PATTERN = /^(?:mcp__.+__)?execute_(?:readonly_)?delegated_tool$/;
+/**
+ * Whether `name` is a delegated-tool transport wrapper — `execute_delegated_tool` or
+ * `execute_readonly_delegated_tool`, bare or as an MCP client names it (`mcp__<server>__…`). Its real
+ * tool id is in `input.toolId`. The one shared definition, so a renderer and the run-activity line
+ * cannot disagree about which names are wrappers (both once missed the read-only gateway).
+ *
+ * @complexity O(n) in the length of `name`.
+ */
+export function isDelegatedWrapperToolName({ name }) {
+    return DELEGATED_WRAPPER_PATTERN.test(name);
+}
+function wrapperToolId(event) {
+    if (event.kind !== 'tool_use' || !isDelegatedWrapperToolName({ name: event.name }))
+        return undefined;
+    const input = event.input;
+    const toolId = typeof input === 'object' && input !== null ? input.toolId : undefined;
+    return typeof toolId === 'string' && toolId ? toolId : undefined;
+}
+/**
+ * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * so one call shows as one row.
+ *
+ * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
+ * (`mcp__jini__execute_delegated_tool {toolId, input}`, with the CLI's `toolu_…` id) and the
+ * daemon bridge's canonical `tool_use` named after the real tool (`content_stats`, with a fresh
+ * UUID from `@jini-ai/mcp`). The ids differ, so {@link dedupeToolUsesById} cannot merge them, and a
+ * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
+ * name, input and result.
+ *
+ * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
+ * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
+ * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
+ * hidden.
+ *
+ * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * @returns A new array without the folded wrappers, or the original reference when none fold.
+ * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ */
+export function foldDelegatedWrapperCalls({ events }) {
+    if (!events || events.length === 0)
+        return [];
+    const claimed = new Set();
+    const folded = new Set();
+    events.forEach((event, i) => {
+        const toolId = wrapperToolId(event);
+        // A replayed wrapper (same id) must not claim a second canonical row.
+        if (toolId === undefined || event.kind !== 'tool_use' || folded.has(event.id))
+            return;
+        const match = events.findIndex((other, j) => j > i && !claimed.has(j) && other.kind === 'tool_use' && other.name === toolId);
+        if (match === -1)
+            return;
+        claimed.add(match);
+        folded.add(event.id);
+    });
+    if (folded.size === 0)
+        return events;
+    return events.filter((event) => !((event.kind === 'tool_use' && folded.has(event.id)) ||
+        (event.kind === 'tool_result' && folded.has(event.toolUseId))));
+}
 //# sourceMappingURL=tool-events.js.map

package/dist/core/tools.d.ts

@@ -10,7 +10,7 @@
  * archived provenance ledger.
  */
 import type { ToolResultEvent, ToolResultMediaBlock, ToolUseEvent } from './events.js';
-export { dedupeToolUsesById } from './tool-events.js';
+export { dedupeToolUsesById, foldDelegatedWrapperCalls, isDelegatedWrapperToolName } from './tool-events.js';
 /** The four-state tool-call lifecycle agreed across AG-UI / CopilotKit / LangGraph render props. */
 export type ToolStatus = 'inProgress' | 'executing' | 'complete' | 'error';
 /** The render-prop payload a tool-call UI needs, independent of any framework. */

package/dist/core/tools.js

@@ -1,4 +1,4 @@
-export { dedupeToolUsesById } from './tool-events.js';
+export { dedupeToolUsesById, foldDelegatedWrapperCalls, isDelegatedWrapperToolName } from './tool-events.js';
 /**
  * Map a tool call to its AG-UI-style lifecycle status.
  *

package/dist/react/components/Markdown.js

@@ -34,7 +34,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
  * renderer covers:
  * ATX headings (`#`…`###`), fenced code blocks, ordered/unordered lists,
  * blockquotes, a horizontal rule, paragraphs, and inline `` `code` ``/
- * `**bold**`/`*italic*`/bare autolinks — including inside table cells, via
+ * `**bold**`/`*italic*`/`[label](url)` links/bare autolinks — including inside table cells, via
  * the same `renderInline` pass every other block uses. TODO(follow-up): port
  * the code-comment directive syntax once a host needs it.
  */
@@ -370,21 +370,52 @@ function TableBlock(props) {
                         setExpanded(false);
                 }, children: [_jsx("button", { type: "button", className: "jini-md-table-modal-close", onClick: () => setExpanded(false), "aria-label": "Close", children: "\u00D7" }), _jsx("div", { className: "jini-md-table-modal-body", children: expanded ? renderTableElement(props) : null })] })] }));
 }
-// Inline pass: `code`, **bold**, *italic*/_italic_, bare http(s) autolinks.
+// Inline pass: `code`, [label](url) links, **bold**, *italic*/_italic_, bare http(s) autolinks.
 // Processes left-to-right with a single regex alternation so spans never
 // nest incorrectly across kinds.
-const INLINE_RE = /(`[^`]+`)|(\*\*[^*]+\*\*)|(\*[^*]+\*|_[^_]+_)|(https?:\/\/[^\s)]+)/g;
+//
+// `_italic_` follows CommonMark's word-boundary rule: an `_` with a letter,
+// digit or `_` on its outer side never opens or closes emphasis, and an `_`
+// between two word characters inside the span is content. The plain
+// `_[^_]+_` this replaced matched intraword, so a tool-result name like
+// `ANALYTICS_ROOT_KEY_SEED` rendered as `ANALYTICS<em>ROOT</em>KEY_SEED`.
+// `*` stays permissive — CommonMark allows intraword `*` emphasis.
+const UNDERSCORE_EM = String.raw `(?<![\p{L}\p{N}_])_(?![\s_])(?:[^_]|_(?=[\p{L}\p{N}]))+?(?<!\s)_(?![\p{L}\p{N}_])`;
+// `[label](url)`: the URL may hold one level of balanced parentheses (`Foo_(bar)`), and the whole
+// link may itself sit inside parentheses (`([edit](/admin/pages/x))`) — the outer `)` is left as text.
+const MD_LINK = String.raw `\[[^\]\n]+\]\((?:[^()\s]|\([^()\s]*\))+\)`;
+const MD_LINK_PARTS = /^\[([^\]\n]+)\]\((.+)\)$/u;
+const INLINE_RE = new RegExp(String.raw `(\x60[^\x60]+\x60)|(${MD_LINK})|(\*\*[^*]+\*\*)|(\*[^*]+\*|${UNDERSCORE_EM})|(https?:\/\/[^\s)]+)`, 'gu');
+// Only these targets become anchors; anything else (`javascript:`, `data:`, protocol-relative
+// `//host`) stays literal text, since the text is untrusted model output.
+const SAFE_LINK_HREF = /^(?:https?:\/\/|mailto:|\/(?!\/)|#)/iu;
+// Off-site links open in a new tab; a same-origin path stays in the tab so the host's in-app link
+// interceptor (an SPA router) can take it without a reload.
+const OFFSITE_LINK_HREF = /^(?:https?:|mailto:)/iu;
+function renderMarkdownLink(source, key) {
+    // `MD_LINK` already matched `source`, so these two groups always capture.
+    const [, label, href] = MD_LINK_PARTS.exec(source);
+    if (!SAFE_LINK_HREF.test(href))
+        return source;
+    const offsite = OFFSITE_LINK_HREF.test(href);
+    return (_jsx("a", { href: href, ...(offsite ? { target: '_blank', rel: 'noreferrer' } : {}), children: renderInline(label) }, key));
+}
 function renderInline(text) {
     const nodes = [];
     let lastIndex = 0;
     let key = 0;
-    let match = INLINE_RE.exec(text);
+    // A fresh copy per call, not the shared `g` regex: a link label recurses into this function
+    // mid-loop, and a shared `lastIndex` would be reset under the outer scan.
+    const inlineRe = new RegExp(INLINE_RE);
+    let match = inlineRe.exec(text);
     while (match !== null) {
         if (match.index > lastIndex)
             nodes.push(text.slice(lastIndex, match.index));
-        const [whole, code, bold, italic, link] = match;
+        const [whole, code, mdLink, bold, italic, link] = match;
         if (code)
             nodes.push(_jsx("code", { children: code.slice(1, -1) }, key++));
+        else if (mdLink)
+            nodes.push(renderMarkdownLink(mdLink, key++));
         else if (bold)
             nodes.push(_jsx("strong", { children: bold.slice(2, -2) }, key++));
         else if (italic)
@@ -395,7 +426,7 @@ function renderInline(text) {
         // defined (if possibly empty) full-match string at index 0, so this
         // fallback is unreachable (same dead-fallback reasoning as above).
         lastIndex = match.index + whole.length;
-        match = INLINE_RE.exec(text);
+        match = inlineRe.exec(text);
     }
     if (lastIndex < text.length)
         nodes.push(text.slice(lastIndex));

package/dist/react/components/MessageList.hooks.js

@@ -5,7 +5,7 @@
  * "transport-agnostic hooks never touch DOM" contract.
  */
 import { useEffect, useRef } from 'react';
-import { isScrolledToBottom, startsNewTurn } from './MessageList.rules.js';
+import { nextStickToBottom, startsNewTurn } from './MessageList.rules.js';
 export function useMessageListAutoScroll({ messages, scrollIntent }, { onScrolled } = {}) {
     const containerRef = useRef(null);
     // Whether the transcript was scrolled to its bottom as of the last user scroll or programmatic
@@ -14,6 +14,10 @@ export function useMessageListAutoScroll({ messages, scrollIntent }, { onScrolle
     // Starts true: a freshly mounted pane opens on the latest turn, same as scrollIntent's own default.
     const stickToBottomRef = useRef(true);
     const previousMessagesRef = useRef(messages);
+    // `scrollTop` at the previous `scroll` event — `nextStickToBottom` needs the direction of travel.
+    // Only scroll events write it (a browser fires one for programmatic scrolls too). Starts at
+    // Infinity, "no position seen yet", so a first event away from the bottom unsticks as it always did.
+    const lastScrollTopRef = useRef(Number.POSITIVE_INFINITY);
     // Runs BEFORE the scroll effect below (effects run in declaration order), so a send re-sticks in
     // time for that same commit's scroll. The user's own send (or retry) is an explicit "take me to
     // the latest turn": without this, a user who had scrolled up to read history and then sent stayed
@@ -69,7 +73,9 @@ export function useMessageListAutoScroll({ messages, scrollIntent }, { onScrolle
         return () => observer.disconnect();
     }, [messages]);
     const onScroll = (event) => {
-        stickToBottomRef.current = isScrolledToBottom(event.currentTarget);
+        const el = event.currentTarget;
+        stickToBottomRef.current = nextStickToBottom(el, { wasSticking: stickToBottomRef.current, previousScrollTop: lastScrollTopRef.current });
+        lastScrollTopRef.current = el.scrollTop;
     };
     return { containerRef, onScroll };
 }

package/dist/react/components/MessageList.rules.d.ts

@@ -11,6 +11,24 @@ export declare function isScrolledToBottom(el: {
     scrollTop: number;
     clientHeight: number;
 }): boolean;
+/**
+ * The sticky-follow flag after a `scroll` event.
+ *
+ * At the bottom always re-sticks. Otherwise only a move UP (the position went down since the last
+ * event) unsticks. A `scroll` event is dispatched a frame after the scroll that caused it, so the
+ * event for an auto-scroll can arrive after more streamed rows already grew the content: the
+ * position is unchanged but no longer at the bottom. Reading that as "the user scrolled away" is
+ * what left a tool-heavy run's final reply below the fold (demo dry-run, 2026-10-05). Content growth
+ * never lowers `scrollTop`; a user scrolling up always does.
+ */
+export declare function nextStickToBottom(el: {
+    scrollHeight: number;
+    scrollTop: number;
+    clientHeight: number;
+}, { wasSticking, previousScrollTop }: {
+    wasSticking: boolean;
+    previousScrollTop: number;
+}): boolean;
 /**
  * Whether `next` starts a turn the user themself asked for, relative to `previous`: a user message
  * that was not there before (a send — `useConversation.sendMessage` appends it optimistically), or

package/dist/react/components/MessageList.rules.js

@@ -4,6 +4,21 @@ export const AT_BOTTOM_THRESHOLD_PX = 4;
 export function isScrolledToBottom(el) {
     return el.scrollHeight - el.scrollTop - el.clientHeight <= AT_BOTTOM_THRESHOLD_PX;
 }
+/**
+ * The sticky-follow flag after a `scroll` event.
+ *
+ * At the bottom always re-sticks. Otherwise only a move UP (the position went down since the last
+ * event) unsticks. A `scroll` event is dispatched a frame after the scroll that caused it, so the
+ * event for an auto-scroll can arrive after more streamed rows already grew the content: the
+ * position is unchanged but no longer at the bottom. Reading that as "the user scrolled away" is
+ * what left a tool-heavy run's final reply below the fold (demo dry-run, 2026-10-05). Content growth
+ * never lowers `scrollTop`; a user scrolling up always does.
+ */
+export function nextStickToBottom(el, { wasSticking, previousScrollTop }) {
+    if (isScrolledToBottom(el))
+        return true;
+    return el.scrollTop < previousScrollTop ? false : wasSticking;
+}
 /**
  * Whether `next` starts a turn the user themself asked for, relative to `previous`: a user message
  * that was not there before (a send — `useConversation.sendMessage` appends it optimistically), or

package/dist/react/components/MessageRow.js

@@ -50,7 +50,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  * chunk stopped arriving.
  */
 import React, { useState } from 'react';
-import { isTerminalRunStatus, splitOnQuestionForms, stripArtifact } from '../../core/index.js';
+import { isAwaitingAnswer, isTerminalRunStatus, splitOnQuestionForms, stripArtifact } from '../../core/index.js';
 import { useToolTimeline } from '../hooks/useToolTimeline.js';
 import { useExtEventGroups } from '../hooks/useExtEventGroups.js';
 import { useCopyToClipboard } from '../hooks/useCopyToClipboard.js';
@@ -160,6 +160,7 @@ export function MessageRow({ message, runStreaming = false, runSucceeded = false
         : null;
     const pending = isPendingWithNoContent(message, visibleContent, timeline.rows.length);
     const runInProgress = isRunInProgress(message.runStatus);
+    const awaitingAnswer = runStreaming && runInProgress && isAwaitingAnswer({ events: message.events });
     const renderToolCard = (row) => (_jsx(ToolCard, { use: row.use, result: row.result, runStreaming: runStreaming, runSucceeded: runSucceeded, ...(projectFileNames !== undefined ? { projectFileNames } : {}), ...(onRequestOpenFile !== undefined ? { onRequestOpenFile } : {}) }, row.id));
     const renderExtGroup = (group) => {
         const renderer = getExtEventRenderer({ name: group.name });
@@ -170,6 +171,7 @@ export function MessageRow({ message, runStreaming = false, runSucceeded = false
             events: group.events,
             runStreaming,
             runSucceeded,
+            awaitingAnswer,
             runId: message.runId,
             ...(group.call === undefined ? {} : { call: group.call }),
         });

package/dist/react/components/ToolCard.js

@@ -21,14 +21,13 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * generic rendering for it.
  */
 import { useState } from 'react';
-import { formatToolOutputForDisplay, isTodoWriteToolName, parseTodoWriteInput, toRenderProps } from '../../core/index.js';
+import { formatToolOutputForDisplay, isDelegatedWrapperToolName, isTodoWriteToolName, parseTodoWriteInput, toRenderProps } from '../../core/index.js';
 import { useT } from '../hooks/context.js';
 import { getToolRenderer } from '../tool-renderer-registry.js';
 import { Icon } from './Icon.js';
 import { TodoCard } from './TodoCard.js';
 /** A Jini registry tool id: dotted, lowercase, snake_case segments — `page.fill`, `daemon.db.vacuum`, `chat.send_message`. Never matches an agent-vendor tool name (`Bash`, `Write`, `mcp__jini__execute_delegated_tool`), which is the point — this is how a canonical delegated-tool event is told apart from everything else. */
 const JINI_TOOL_ID_PATTERN = /^[a-z][a-z_]*(\.[a-z][a-z_]*)+$/;
-const EXECUTE_DELEGATED_TOOL_NAMES = new Set(['execute_delegated_tool', 'mcp__jini__execute_delegated_tool']);
 const SEARCH_TOOLS_NAMES = new Set(['search_tools', 'mcp__jini__search_tools']);
 const DESCRIBE_TOOL_NAMES = new Set(['describe_tool', 'mcp__jini__describe_tool']);
 export function ToolCard({ use, result, runStreaming, runSucceeded, projectFileNames, onRequestOpenFile }) {
@@ -64,8 +63,12 @@ function renderToolCardBody(name, use, result, isStreaming, isSucceeded, fileCtx
     // action twice. Suppressed only on a *successful* result: a wrapper-level failure (a genuine
     // transport error, not a tool-execution failure — those come back as a normal 'completed' result
     // with status:'failed' inside it) has no matching canonical row to fall back on, so it must stay
-    // visible rather than disappear silently.
-    if (EXECUTE_DELEGATED_TOOL_NAMES.has(name) && result && !result.isError)
+    // visible rather than disappear silently. (A wrapper that failed AFTER the bridge emitted its
+    // canonical row — e.g. a 400 on a refused input — never reaches here when rendered through
+    // `useToolTimeline`: `foldDelegatedWrapperCalls` drops it in favour of that canonical row. This
+    // check still covers a host that renders `<ToolCard>` straight from raw events.)
+    // Covers the read-only gateway (`execute_readonly_delegated_tool`) too.
+    if (isDelegatedWrapperToolName({ name: name }) && result && !result.isError)
         return null;
     if (isTodoWriteToolName({ name: name }))
         return _jsx(TodoCard, { todos: parseTodoWriteInput({ input: use.input }), runStreaming: isStreaming });
@@ -85,7 +88,7 @@ function renderToolCardBody(name, use, result, isStreaming, isSucceeded, fileCtx
         return _jsx(WebFetchCard, { input: use.input, result: result, runStreaming: isStreaming, runSucceeded: isSucceeded });
     if (name === 'WebSearch' || name === 'web_search')
         return _jsx(WebSearchCard, { input: use.input, result: result, runStreaming: isStreaming, runSucceeded: isSucceeded });
-    if (JINI_TOOL_ID_PATTERN.test(name) || EXECUTE_DELEGATED_TOOL_NAMES.has(name)) {
+    if (JINI_TOOL_ID_PATTERN.test(name) || isDelegatedWrapperToolName({ name: name })) {
         // The unsuppressed (failed-wrapper) case falls through here too: `name` is still
         // `execute_delegated_tool`, so `jiniToolIdFromInput` recovers the real id from
         // `{toolId, input}` instead of `DelegatedToolCard` receiving its own wrapper name as the title.
@@ -133,8 +136,8 @@ function DelegatedToolCard({ name, input, result, runStreaming, runSucceeded })
     // Wrapper form (only reached on a failed wrapper call, per ToolCard's suppression comment):
     // the real id and args are nested under {toolId, input}, not `input` itself.
     const wrapper = (input ?? {});
-    const toolId = EXECUTE_DELEGATED_TOOL_NAMES.has(name) ? (wrapper.toolId ?? name) : name;
-    const args = EXECUTE_DELEGATED_TOOL_NAMES.has(name) ? wrapper.input : input;
+    const toolId = isDelegatedWrapperToolName({ name: name }) ? (wrapper.toolId ?? name) : name;
+    const args = isDelegatedWrapperToolName({ name: name }) ? wrapper.input : input;
     const target = primaryTarget(args);
     const isRunning = runStreaming && !result;
     return (_jsxs("div", { className: "op-card op-jini-tool", children: [_jsxs("button", { type: "button", className: "op-card-head", onClick: () => setOpen((o) => !o), children: [_jsx(ResultBadge, { result: result, runStreaming: runStreaming, runSucceeded: runSucceeded }), _jsxs("span", { className: `op-title${isRunning ? ' shimmer-text' : ''}`, children: [t('Tool call'), " \u00B7 ", humanizeToolId(toolId)] }), target ? _jsx("span", { className: "op-meta", children: target }) : null, _jsx("span", { className: "op-expand-chev", "aria-hidden": true, children: _jsx(Icon, { name: open ? 'chevron-down' : 'chevron-right', size: 11 }) })] }), _jsx("div", { className: `accordion-collapsible${open ? ' open' : ''}`, children: _jsx("div", { className: "accordion-collapsible-inner", children: _jsxs("div", { className: "op-card-detail", children: [_jsx("pre", { className: "op-command", children: JSON.stringify(args ?? {}) }), result?.content ? _jsx("pre", { className: "op-output", children: truncate(formatToolOutputForDisplay({ text: result.content }), 2000) }) : null, _jsx(ToolResultMedia, { result: result })] }) }) }), _jsx(FileErrorDetail, { result: result })] }));

package/dist/react/ext-event-renderer-registry.d.ts

@@ -40,6 +40,13 @@ export interface ExtEventRenderProps {
     /** Whether the owning run is still streaming — more events with this `name` may still arrive. */
     runStreaming: boolean;
     runSucceeded: boolean;
+    /**
+     * Whether the owning run is waiting on the person — a card (form, confirm, sign-in) sits on a
+     * still-open tool call (`isAwaitingAnswer` in `core/run-activity.ts`). A "still working" notice
+     * should hide while this is true. Always `false` once the run stops streaming. Optional so a host
+     * that builds these props itself (tests, wrappers) keeps compiling; `MessageRow` always sets it.
+     */
+    awaitingAnswer?: boolean;
     /** The owning message's `ChatMessage.runId`, if known — a renderer that needs to send something back to this specific run (e.g. an A2UI action) needs this; omitted (`undefined`) for a message with no run association. */
     runId: string | undefined;
     /** See {@link ExtEventCall}. Absent when the group's first event arrived outside any tool call. */

package/dist/react/features/chat-pane/hooks/useChatPane.hooks.js

@@ -2,6 +2,7 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { describeChatPaneSendBlocker, findAwaitedTypedAnswerId, findChatPaneSendBlocker, isChatPaneQueueableBlocker, isTypedAnswerTurn, resolveChatPaneSelection, } from '../rules.js';
 import { definedProps } from '../../../util/defined-props.js';
 import { cacheAttachmentPreviewSource } from '../../../hooks/attachment-preview-cache.js';
+import { readCachedAttachmentBatchId, writeCachedAttachmentBatchId, } from '../../../hooks/composer-draft-cache.js';
 import { useComposer } from '../../../hooks/useComposer.js';
 import { useConversation, } from '../../../hooks/useConversation.js';
 import { useChatPaneWorkingDirectory, } from './useChatPaneWorkingDirectory.hooks.js';
@@ -96,7 +97,12 @@ export function useChatPane(options) {
     const queuedConversationIdRef = useRef(undefined);
     const mountedRef = useRef(true);
     const attachmentGenerationRef = useRef(0);
-    const attachmentBatchIdRef = useRef(createAttachmentBatchId());
+    // Every attachment staged for one turn must share one upload batch (the daemon refuses a turn
+    // spanning two). So a mount that will restore cached attachments starts in THEIR batch rather
+    // than a new one; see `readCachedAttachmentBatchId`.
+    const [initialAttachmentBatchId] = useState(() => readCachedAttachmentBatchId({ conversationId: options.conversationId }) ?? createAttachmentBatchId());
+    const attachmentBatchIdRef = useRef(initialAttachmentBatchId);
+    const batchConversationIdRef = useRef(options.conversationId);
     const activeUploadsRef = useRef(new Set());
     const [internalSelection, setInternalSelection] = useState(options.initialSelection ?? { agentId: '' });
     const workingDirectoryState = useChatPaneWorkingDirectory(definedProps({ source: {
@@ -199,10 +205,31 @@ export function useChatPane(options) {
         typedAnswerGenerationRef.current += 1;
         heldAnswerQuestionIdRef.current = null;
     }, [options.conversationId]);
+    // A conversation switch without a remount: adopt the batch of the attachments the composer is
+    // about to restore for the new conversation, else start a fresh one so two conversations never
+    // share a batch directory (the agent is granted the whole directory, not just the claimed files).
+    // An id arriving where there was none is the same conversation finally getting a key — the
+    // composer keeps what is staged (see `useComposer`), so the batch stays too.
+    useEffect(() => {
+        const previousConversationId = batchConversationIdRef.current;
+        if (options.conversationId === previousConversationId)
+            return;
+        batchConversationIdRef.current = options.conversationId;
+        const restoredBatchId = readCachedAttachmentBatchId({ conversationId: options.conversationId });
+        if (restoredBatchId !== null) {
+            attachmentBatchIdRef.current = restoredBatchId;
+            return;
+        }
+        if (previousConversationId == null)
+            return;
+        attachmentBatchIdRef.current = createAttachmentBatchId();
+    }, [options.conversationId]);
     const addAttachments = useCallback(async (files) => {
         if (files.length === 0 || options.uploadAttachments === undefined)
             return;
         const generation = attachmentGenerationRef.current;
+        const batchId = attachmentBatchIdRef.current;
+        const conversationId = options.conversationId;
         const controller = new AbortController();
         activeUploadsRef.current.add(controller);
         setActiveUploadCount(activeUploadsRef.current.size);
@@ -211,7 +238,7 @@ export function useChatPane(options) {
             await uploadAttachmentBatch(files, {
                 upload: options.uploadAttachments,
                 signal: controller.signal,
-                batchId: attachmentBatchIdRef.current,
+                batchId,
                 stillWanted: () => mountedRef.current
                     && !controller.signal.aborted
                     && generation === attachmentGenerationRef.current,
@@ -221,6 +248,9 @@ export function useChatPane(options) {
                 // `attachment-preview-cache.ts`'s module doc for why this is the only place that copy can
                 // ever be captured.
                 onAttachment: (attachment, file) => {
+                    // Recorded before staging so the cache entry that persists this attachment carries its
+                    // batch, which is what lets a later mount restore the batch along with the attachment.
+                    writeCachedAttachmentBatchId({ conversationId, batchId });
                     composer.addAttachment(attachment);
                     if (file)
                         cacheAttachmentPreviewSource({ path: attachment.path, file });
@@ -233,7 +263,7 @@ export function useChatPane(options) {
                 setActiveUploadCount(activeUploadsRef.current.size);
             }
         }
-    }, [composer, options.uploadAttachments]);
+    }, [composer, options.conversationId, options.uploadAttachments]);
     const sendPrompt = useCallback(async (prompt) => {
         const trimmed = prompt.trim();
         if (!trimmed)

package/dist/react/features/chat-pane/rules.d.ts

@@ -83,9 +83,12 @@ export declare function isChatPaneQueueableBlocker({ blocker }: {
  * Only the question tool counts. Other tools park on cards too — a delete confirm, an approval —
  * but they take no typed answer: the server routes typed text only to the question tool, so treating
  * those as waiting would refuse the text with "no longer waiting" and drop it instead of queueing.
- * A call is the question tool when ANY `tool_use` for its id names it, since a vendor's wrapper row
- * (`execute_delegated_tool`) and the daemon's canonical row share the id and may arrive in either
- * order.
+ * A call is the question tool when ANY `tool_use` for its id names it, since the same call's
+ * `tool_use` can arrive more than once (the CLI re-emits it). A vendor's wrapper row
+ * (`execute_delegated_tool`) and the daemon's canonical row do NOT share an id — the wrapper carries
+ * the CLI's `toolu_…` id and the canonical row a fresh UUID from `@jini-ai/mcp`. The canonical row
+ * opens after its wrapper, so it is the newest open call when the surface arrives, and that is
+ * what attributes the surface to the question tool.
  *
  * A surface is attributed to the newest call still open when it arrived — the same rule
  * `useExtEventGroups` uses to give a card its `call` — so an older call returning does not settle

package/dist/react/features/chat-pane/rules.js

@@ -116,9 +116,12 @@ export function isChatPaneQueueableBlocker({ blocker }) {
  * Only the question tool counts. Other tools park on cards too — a delete confirm, an approval —
  * but they take no typed answer: the server routes typed text only to the question tool, so treating
  * those as waiting would refuse the text with "no longer waiting" and drop it instead of queueing.
- * A call is the question tool when ANY `tool_use` for its id names it, since a vendor's wrapper row
- * (`execute_delegated_tool`) and the daemon's canonical row share the id and may arrive in either
- * order.
+ * A call is the question tool when ANY `tool_use` for its id names it, since the same call's
+ * `tool_use` can arrive more than once (the CLI re-emits it). A vendor's wrapper row
+ * (`execute_delegated_tool`) and the daemon's canonical row do NOT share an id — the wrapper carries
+ * the CLI's `toolu_…` id and the canonical row a fresh UUID from `@jini-ai/mcp`. The canonical row
+ * opens after its wrapper, so it is the newest open call when the surface arrives, and that is
+ * what attributes the surface to the question tool.
  *
  * A surface is attributed to the newest call still open when it arrived — the same rule
  * `useExtEventGroups` uses to give a card its `call` — so an older call returning does not settle

package/dist/react/hooks/composer-draft-cache.d.ts

@@ -115,6 +115,34 @@ export declare function clearCachedDraft({ conversationId }: {
 export declare function readCachedAttachments({ conversationId }: {
     conversationId: string | null | undefined;
 }): readonly ChatAttachment[] | null;
+/**
+ * The upload batch `conversationId`'s cached attachments were uploaded under, so a pane that
+ * restores those attachments uploads the next file into the SAME batch.
+ *
+ * Why this exists: the daemon grants the agent exactly one batch directory per turn and refuses a
+ * turn whose attachments span two ("Attachments must belong to one batch"). A pane that restored an
+ * attachment after a remount, reload, or conversation switch used to upload the next file under a
+ * brand-new batch id, so every such turn failed before the agent started (2026-10-06).
+ *
+ * @returns The batch id, or `null` when there are no cached attachments to stay consistent with
+ * (none staged, attachment persistence off because the host supplied no validator, or an entry
+ * written before batch ids were recorded) — the caller then starts a fresh batch.
+ * @complexity Time/space: O(1) on an in-memory hit, O(n) in the stored count otherwise.
+ */
+export declare function readCachedAttachmentBatchId({ conversationId }: {
+    conversationId: string | null | undefined;
+}): string | null;
+/**
+ * Records the upload batch of an attachment about to be staged in `conversationId`'s composer.
+ * Memory only: the stored envelope picks it up on the {@link writeCachedAttachments} that persists
+ * that attachment, so it is never written ahead of the references it describes.
+ *
+ * @complexity Time/space: O(1) amortized.
+ */
+export declare function writeCachedAttachmentBatchId({ conversationId, batchId }: {
+    conversationId: string | null | undefined;
+    batchId: string;
+}): void;
 /**
  * Stores `attachments` for `conversationId` in both tiers.
  *

package/dist/react/hooks/composer-draft-cache.js

@@ -62,6 +62,10 @@ export const COMPOSER_DRAFT_STORAGE_PREFIX = 'jini.chat.composer-draft.v1.';
 export const COMPOSER_ATTACHMENTS_STORAGE_PREFIX = 'jini.chat.composer-attachments.v1.';
 const drafts = new Map();
 const stagedAttachments = new Map();
+// Kept beside `stagedAttachments` rather than inside it so `writeCachedAttachments` keeps its
+// attachments-only signature: `useComposer` persists the list and never sees a batch id, while
+// `useChatPane` (the one caller that uploads in batches) records the batch here.
+const stagedBatchIds = new Map();
 /**
  * The origin's `localStorage`, or `null` when it cannot be used.
  *
@@ -282,10 +286,11 @@ function isChatAttachment(candidate) {
     return true;
 }
 /**
- * Reads the stored attachment references for `conversationId`.
+ * Reads the stored attachment references (and their upload batch) for `conversationId`.
  *
  * Elements that do not validate are dropped individually rather than failing the whole entry — one
- * malformed row should cost the operator that row, not every attachment on the turn.
+ * malformed row should cost the operator that row, not every attachment on the turn. A missing or
+ * malformed batch id costs only the batch (`batchId: null`), never the references.
  *
  * @returns The stored references, or `null` when there are none, storage is unavailable, or nothing
  * in the entry validated.
@@ -302,6 +307,7 @@ function readStoredAttachments(conversationId) {
             return null;
         const parsed = JSON.parse(raw);
         const list = parsed?.a;
+        const batchId = parsed?.b;
         if (!Array.isArray(list)) {
             store.removeItem(key);
             return null;
@@ -311,7 +317,7 @@ function readStoredAttachments(conversationId) {
             store.removeItem(key);
             return null;
         }
-        return valid;
+        return { attachments: valid, batchId: typeof batchId === 'string' && batchId !== '' ? batchId : null };
     }
     catch {
         try {
@@ -345,8 +351,48 @@ export function readCachedAttachments({ conversationId }) {
     const stored = readStoredAttachments(conversationId);
     if (stored === null)
         return null;
-    stagedAttachments.set(conversationId, stored);
-    return stored;
+    stagedAttachments.set(conversationId, stored.attachments);
+    if (stored.batchId !== null)
+        stagedBatchIds.set(conversationId, stored.batchId);
+    return stored.attachments;
+}
+/**
+ * The upload batch `conversationId`'s cached attachments were uploaded under, so a pane that
+ * restores those attachments uploads the next file into the SAME batch.
+ *
+ * Why this exists: the daemon grants the agent exactly one batch directory per turn and refuses a
+ * turn whose attachments span two ("Attachments must belong to one batch"). A pane that restored an
+ * attachment after a remount, reload, or conversation switch used to upload the next file under a
+ * brand-new batch id, so every such turn failed before the agent started (2026-10-06).
+ *
+ * @returns The batch id, or `null` when there are no cached attachments to stay consistent with
+ * (none staged, attachment persistence off because the host supplied no validator, or an entry
+ * written before batch ids were recorded) — the caller then starts a fresh batch.
+ * @complexity Time/space: O(1) on an in-memory hit, O(n) in the stored count otherwise.
+ */
+export function readCachedAttachmentBatchId({ conversationId }) {
+    if (!conversationId)
+        return null;
+    if (readCachedAttachments({ conversationId: conversationId }) === null)
+        return null;
+    return stagedBatchIds.get(conversationId) ?? null;
+}
+/**
+ * Records the upload batch of an attachment about to be staged in `conversationId`'s composer.
+ * Memory only: the stored envelope picks it up on the {@link writeCachedAttachments} that persists
+ * that attachment, so it is never written ahead of the references it describes.
+ *
+ * @complexity Time/space: O(1) amortized.
+ */
+export function writeCachedAttachmentBatchId({ conversationId, batchId }) {
+    if (!conversationId)
+        return;
+    if (!stagedBatchIds.has(conversationId) && stagedBatchIds.size >= MAX_CACHED_CONVERSATION_DRAFTS) {
+        const oldest = stagedBatchIds.keys().next().value;
+        if (oldest !== undefined)
+            stagedBatchIds.delete(oldest);
+    }
+    stagedBatchIds.set(conversationId, batchId);
 }
 /**
  * Stores `attachments` for `conversationId` in both tiers.
@@ -362,6 +408,8 @@ export function writeCachedAttachments({ conversationId, attachments }) {
     const store = storage();
     if (attachments.length === 0) {
         stagedAttachments.delete(conversationId);
+        // A sent or cleared turn's batch is spent; the next upload starts a fresh one.
+        stagedBatchIds.delete(conversationId);
         try {
             store?.removeItem(key);
         }
@@ -381,7 +429,8 @@ export function writeCachedAttachments({ conversationId, attachments }) {
     try {
         if (store.getItem(key) === null)
             pruneStored(COMPOSER_ATTACHMENTS_STORAGE_PREFIX, MAX_CACHED_CONVERSATION_DRAFTS - 1);
-        const envelope = { v: 1, t: Date.now(), a: attachments };
+        const batchId = stagedBatchIds.get(conversationId);
+        const envelope = { v: 1, t: Date.now(), a: attachments, ...(batchId === undefined ? {} : { b: batchId }) };
         store.setItem(key, JSON.stringify(envelope));
     }
     catch {
@@ -399,6 +448,7 @@ export function writeCachedAttachments({ conversationId, attachments }) {
 export function __resetComposerDraftCacheForTests(options) {
     drafts.clear();
     stagedAttachments.clear();
+    stagedBatchIds.clear();
     if (options?.keepStorage === true)
         return;
     pruneStored(COMPOSER_DRAFT_STORAGE_PREFIX, 0);

package/dist/react/hooks/last-conversation-store.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @module last-conversation-store
+ *
+ * Remembers which conversation an operator last had open, so a host's chat surface can land back
+ * on it after a page reload, a closed tab, or a navigation away — instead of an empty new chat.
+ *
+ * Conversation SELECTION is host-owned (`ChatPane` is uncontrolled and takes a `conversationId`;
+ * `ConversationList` takes `activeConversationId` as a prop), so this module does not decide when
+ * to restore. It is only the durable slot: the host reads it once at mount, checks the id still
+ * exists for this caller, and writes it whenever its active conversation changes.
+ *
+ * Same storage discipline as `composer-draft-cache.ts`: a versioned key, every access wrapped, and a
+ * foreign or corrupt entry treated as "nothing remembered" and deleted. A private window, blocked
+ * site data or a quota rejection degrades this to remembering nothing — never a throw at the host.
+ *
+ * Unlike the draft cache this is NOT a module singleton. The partition here is the caller's
+ * identity (`scope`), which only the host knows — two users on one browser must never land in each
+ * other's chat — so a host constructs one store per scope and passes it down.
+ */
+/**
+ * Key prefix for the stored entry. Versioned (`.v1.`) so a future change to the stored shape can be
+ * introduced without interpreting, or mis-interpreting, entries written by this one.
+ */
+export declare const LAST_CONVERSATION_STORAGE_PREFIX = "jini.chat.last-conversation.v1.";
+/** The subset of Web Storage this module uses — `localStorage` satisfies it; tests pass a fake. */
+export interface LastConversationStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** The host-facing port. Every method is total: none throws, whatever storage does. */
+export interface LastConversationStore {
+    /** The remembered conversation id, or `null` when there is none or storage is unusable. */
+    read(): string | null;
+    /** Remembers `conversationId` as the one to land on next time, replacing any earlier one. */
+    write(conversationId: string): void;
+    /** Forgets the remembered id — for a conversation that was deleted or is no longer reachable. */
+    clear(): void;
+}
+/**
+ * Creates the last-conversation slot for one caller identity.
+ *
+ * @param required.scope Who this memory belongs to — e.g. `${workspaceId}:${userId}`. Part of the
+ *   key, so a different scope on the same browser reads nothing.
+ * @param optional.storage Defaults to the origin's `localStorage`, resolved on every call (not once)
+ *   so a store created during SSR still works after hydration. `null` disables persistence.
+ * @returns A {@link LastConversationStore}; see its methods for the never-throws contract.
+ * @example
+ * const store = createLastConversationStore({ scope: `${workspaceId}:${user.id}` });
+ * const id = store.read(); // land here if it still exists, else store.clear()
+ * @complexity Time/space: O(1) per call, plus O(n) in the entry's length for the JSON parse.
+ */
+export declare function createLastConversationStore({ scope }: {
+    scope: string;
+}, { storage }?: {
+    storage?: LastConversationStorage | null;
+}): LastConversationStore;
+//# sourceMappingURL=last-conversation-store.d.ts.map

package/dist/react/hooks/last-conversation-store.js

@@ -0,0 +1,112 @@
+/**
+ * @module last-conversation-store
+ *
+ * Remembers which conversation an operator last had open, so a host's chat surface can land back
+ * on it after a page reload, a closed tab, or a navigation away — instead of an empty new chat.
+ *
+ * Conversation SELECTION is host-owned (`ChatPane` is uncontrolled and takes a `conversationId`;
+ * `ConversationList` takes `activeConversationId` as a prop), so this module does not decide when
+ * to restore. It is only the durable slot: the host reads it once at mount, checks the id still
+ * exists for this caller, and writes it whenever its active conversation changes.
+ *
+ * Same storage discipline as `composer-draft-cache.ts`: a versioned key, every access wrapped, and a
+ * foreign or corrupt entry treated as "nothing remembered" and deleted. A private window, blocked
+ * site data or a quota rejection degrades this to remembering nothing — never a throw at the host.
+ *
+ * Unlike the draft cache this is NOT a module singleton. The partition here is the caller's
+ * identity (`scope`), which only the host knows — two users on one browser must never land in each
+ * other's chat — so a host constructs one store per scope and passes it down.
+ */
+/**
+ * Key prefix for the stored entry. Versioned (`.v1.`) so a future change to the stored shape can be
+ * introduced without interpreting, or mis-interpreting, entries written by this one.
+ */
+export const LAST_CONVERSATION_STORAGE_PREFIX = 'jini.chat.last-conversation.v1.';
+/**
+ * The origin's `localStorage`, or `null` when it cannot be used — a non-browser runtime, or a
+ * browser that throws on the property access itself (Safari and Chrome both do with site data
+ * blocked), which is why this is a try/catch rather than a `typeof` check alone.
+ * @complexity Time/space: O(1).
+ */
+function browserStorage() {
+    try {
+        return typeof localStorage === 'undefined' ? null : localStorage;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Validates one parsed entry as this module's own envelope.
+ * @complexity Time/space: O(1).
+ */
+function storedId(parsed) {
+    const entry = parsed;
+    if (entry?.v !== 1 || typeof entry.id !== 'string' || entry.id === '')
+        return null;
+    return entry.id;
+}
+/**
+ * Creates the last-conversation slot for one caller identity.
+ *
+ * @param required.scope Who this memory belongs to — e.g. `${workspaceId}:${userId}`. Part of the
+ *   key, so a different scope on the same browser reads nothing.
+ * @param optional.storage Defaults to the origin's `localStorage`, resolved on every call (not once)
+ *   so a store created during SSR still works after hydration. `null` disables persistence.
+ * @returns A {@link LastConversationStore}; see its methods for the never-throws contract.
+ * @example
+ * const store = createLastConversationStore({ scope: `${workspaceId}:${user.id}` });
+ * const id = store.read(); // land here if it still exists, else store.clear()
+ * @complexity Time/space: O(1) per call, plus O(n) in the entry's length for the JSON parse.
+ */
+export function createLastConversationStore({ scope }, { storage } = {}) {
+    const key = `${LAST_CONVERSATION_STORAGE_PREFIX}${encodeURIComponent(scope)}`;
+    const resolve = () => (storage === undefined ? browserStorage() : storage);
+    const remove = (store) => {
+        try {
+            store.removeItem(key);
+        }
+        catch {
+            /* storage is unusable; nothing further this module can do */
+        }
+    };
+    return {
+        read() {
+            const store = resolve();
+            if (!store)
+                return null;
+            try {
+                const raw = store.getItem(key);
+                if (raw === null)
+                    return null;
+                const id = storedId(JSON.parse(raw));
+                if (id === null)
+                    remove(store);
+                return id;
+            }
+            catch {
+                // A parse failure or a throwing read: a corrupt entry must not survive to be read again.
+                remove(store);
+                return null;
+            }
+        },
+        write(conversationId) {
+            const store = resolve();
+            if (!store)
+                return;
+            try {
+                const envelope = { v: 1, id: conversationId };
+                store.setItem(key, JSON.stringify(envelope));
+            }
+            catch {
+                /* blocked, full, or unusable storage — remembering nothing is the documented degraded mode */
+            }
+        },
+        clear() {
+            const store = resolve();
+            if (store)
+                remove(store);
+        },
+    };
+}
+//# sourceMappingURL=last-conversation-store.js.map

package/dist/react/hooks/useToolTimeline.js

@@ -3,17 +3,20 @@
  *
  * Per-tool lifecycle rows for a message's events: pairs each `tool_use` with
  * its `tool_result` (deduped by id via `@jini-ai/chat/core`'s
- * `dedupeToolUsesById`), derives a four-state status via
+ * `dedupeToolUsesById`, delegated wrapper calls folded onto their canonical
+ * rows via `foldDelegatedWrapperCalls`), derives a four-state status via
  * `deriveToolStatus`, and tracks per-row expand/collapse UI state. Pure over
  * `AgentEvent[]` — zero I/O. Per
  * `ADS-memory/reports/jini-port/recon/r4b-webui-design.md` §4.
  */
 import { useCallback, useMemo, useState } from 'react';
-import { dedupeToolUsesById, deriveToolStatus } from '../../core/index.js';
+import { dedupeToolUsesById, deriveToolStatus, foldDelegatedWrapperCalls } from '../../core/index.js';
 export function useToolTimeline({ events }, options = {}) {
     const { runStreaming = false, runSucceeded = false, defaultExpanded = false } = options;
     const [overrides, setOverrides] = useState({});
-    const deduped = useMemo(() => dedupeToolUsesById({ events: events }), [events]);
+    // A delegated call's wrapper row and the daemon's canonical row have different ids, so dedupe
+    // alone leaves both; the fold keeps the canonical one (see `foldDelegatedWrapperCalls`).
+    const deduped = useMemo(() => foldDelegatedWrapperCalls({ events: dedupeToolUsesById({ events: events }) }), [events]);
     const rows = useMemo(() => {
         const out = [];
         for (const ev of deduped) {

package/dist/react/index.d.ts

@@ -112,6 +112,12 @@ export type { TodoCardProps } from './components/TodoCard.js';
  */
 export { ConversationList } from './components/ConversationList.js';
 export type { ConversationListProps, ConversationListItem } from './components/ConversationList.js';
+/**
+ * The conversation an operator last had open, per caller identity — so a host's switcher lands
+ * back on it after a reload instead of an empty new chat. See the module doc for the contract.
+ */
+export { createLastConversationStore, LAST_CONVERSATION_STORAGE_PREFIX } from './hooks/last-conversation-store.js';
+export type { LastConversationStorage, LastConversationStore } from './hooks/last-conversation-store.js';
 export { ToolCard } from './components/ToolCard.js';
 export type { ToolCardProps } from './components/ToolCard.js';
 export { A2uiSurfaceCard } from './components/A2uiSurfaceCard.js';

package/dist/react/index.js

@@ -86,6 +86,11 @@ export { TodoCard } from './components/TodoCard.js';
  * `leadingAccessory` slot; it needs no changes to `ChatPane` itself.
  */
 export { ConversationList } from './components/ConversationList.js';
+/**
+ * The conversation an operator last had open, per caller identity — so a host's switcher lands
+ * back on it after a reload instead of an empty new chat. See the module doc for the contract.
+ */
+export { createLastConversationStore, LAST_CONVERSATION_STORAGE_PREFIX } from './hooks/last-conversation-store.js';
 export { ToolCard } from './components/ToolCard.js';
 export { A2uiSurfaceCard } from './components/A2uiSurfaceCard.js';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/chat",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Jini's chat/artifact frontend, consolidated into one package with two subpaths: framework-free chat vocabulary and pure parsers in `/core`, headless hooks + presentational components + slots in `/react`. Import only the layer you need.",
   "license": "Apache-2.0",
   "repository": {
@@ -145,10 +145,10 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/agentic": "^0.4.1",
-    "@jini-ai/ui": "^0.4.3",
-    "@jini-ai/core": "^0.4.1",
-    "@jini-ai/protocol": "^0.4.0"
+    "@jini-ai/agentic": "^0.4.2",
+    "@jini-ai/ui": "^0.4.4",
+    "@jini-ai/protocol": "^0.4.0",
+    "@jini-ai/core": "^0.4.1"
   },
   "peerDependencies": {
     "react": "^18.3.0 || ^19.0.0",
@@ -238,8 +238,8 @@
     "@electric-sql/pglite": "0.5.8",
     "pg": "8.23.0",
     "@ag-ui/core": "0.0.58",
-    "@jini-ai/agent-runtime": "0.4.0",
-    "@jini-ai/db": "0.3.0"
+    "@jini-ai/db": "0.3.0",
+    "@jini-ai/agent-runtime": "0.4.0"
   },
   "typesVersions": {
     "*": {