@jini-ai/chat 0.6.15 → 0.6.17

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.6.17
+
+### Patch Changes
+
+- Carry picked folders as per-message folder references, with draft and sent-message chips, persistence and replay.
+- Preserve ordinary typed paths while redacting glued-on secrets and slash-containing keys.
+- Handle npm 12 pack JSON through the shared parser in isolated-consumer tests.
+- Treat Node builtin dependencies as builtins when copying isolated runtime fixtures.
+
 ## 0.6.13
 
 ### Patch Changes

package/README.md

@@ -197,12 +197,17 @@ required argument objects: e.g. `isTerminalRunStatus({ status })`,
 `registerExtEventRenderer({ name, renderer }, { slotKey })`. A slot-key callback receives `{ data }`.
 `interleaveMessageBlocks({ events, content, rows }, { slotOf })` retains its reconstruction checks.
 The isolated `core/run-events`, `core/ag-ui`, `server/run-finalizer`, `react/embed`,
-`transports/fetch-sse`, `browser/session-store` and `browser/page-actions` subpaths are published.
+`transports/fetch-sse`, `browser/session-store` and `browser/frontend-session-bridge` subpaths are published. Page control uses the shared frontend bridge and page executor; the retired directive executor and cross-page action queue have been removed.
 `FrontendSessionBridgeArgs` is exported from `react`; hosts pass baseUrl and openStream, optionally request or native fetch.
 The SSE transport takes an injected decoder; browser hosts must supply a browser-safe module.
 
 ## React integration boundaries
 
+`ChatPane` accepts an optional `sendingLabel?: string` for host-localized startup feedback,
+for example `<ChatPane transport={transport} sendingLabel="Connecting to the assistant…" />`.
+The active, sending activity line displays it verbatim until run acceptance. Omitting the prop
+restores the translated `Sending…` label; it has no effect once sending ends.
+
 Model/provider selection belongs to the host-injected `ModelAgentPickerSlot`, because choosing
 an LLM or agent is a provider concern rather than a chat-domain concern. The unused internal
 picker was removed after a fresh caller check confirmed that only its own tests reached it.

package/dist/core/accepted-input.d.ts

@@ -9,6 +9,8 @@ export interface AcceptedChatInput {
     answerText?: string;
     /** Absent for legacy/ordinary inputs; consumed only after a CLI UUID receipt. */
     deliveryState?: 'queued' | 'consumed';
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
     secretRedaction?: ChatMessage['secretRedaction'];
     /** Wire ids replaced by this receipt remain seen by recall. */
@@ -71,5 +73,15 @@ export declare function projectAcceptedInputEvents({ events }: {
 export declare function acceptedInputsFromMessages({ messages }: {
     messages: readonly ChatMessage[];
 }, _options?: {}): AcceptedChatInput[];
+/** Preserve folder metadata through existing event JSON storage; no attachment lifecycle or schema.
+ * Existing per-input receipts already own queued variants and must retain their identities.
+ */
+export declare function withFolderReceipt({ message }: {
+    message: ChatMessage;
+}, _options?: {}): ChatMessage;
+/** Hydrate the message's folder list from its accepted receipts after a database read. */
+export declare function foldersFromReceipts({ events }: {
+    events: unknown;
+}, _options?: {}): string[];
 export {};
 //# sourceMappingURL=accepted-input.d.ts.map

package/dist/core/accepted-input.js

@@ -17,9 +17,11 @@ export function projectAcceptedInputMessages({ messages }, _options = {}) {
             return [message];
         const turn = { ...message };
         delete turn.attachments;
+        delete turn.folders;
         delete turn.secretRedaction;
         // MOVE: Older receipts have no per-input files; retain those legacy files on the final bubble.
         return inputs.map((input, index) => ({ ...turn, id: input.id, content: input.text,
+            folders: input.folders ?? (index === inputs.length - 1 ? message.folders ?? [] : []),
             attachments: input.attachments ?? (index === inputs.length - 1 ? message.attachments ?? [] : []), ...(input.secretRedaction ? { secretRedaction: input.secretRedaction } : {}) }));
     });
 }
@@ -246,7 +248,7 @@ export function acceptedInputsFromMessages({ messages }, _options = {}) {
                 const input = acceptedInputEvent({ event });
                 return input ? [input.data] : [];
             });
-            return receipts.length > 0 ? receipts : [{ id: message.id, text: message.content }];
+            return receipts.length > 0 ? receipts : [{ id: message.id, text: message.content, ...(message.folders ? { folders: message.folders } : {}) }];
         }
         return projectAcceptedInputEvents({ events: message.events ?? [] }).flatMap(event => {
             const input = acceptedInputEvent({ event });
@@ -256,4 +258,30 @@ export function acceptedInputsFromMessages({ messages }, _options = {}) {
         });
     });
 }
+/** Preserve folder metadata through existing event JSON storage; no attachment lifecycle or schema.
+ * Existing per-input receipts already own queued variants and must retain their identities.
+ */
+export function withFolderReceipt({ message }, _options = {}) {
+    if (message.role !== 'user' || !message.folders?.length)
+        return message;
+    const events = message.events ?? [];
+    if (events.some(event => acceptedInputEvent({ event })))
+        return message;
+    return { ...message, events: [...events, acceptedInputUserEvent({ input: {
+                    id: message.id, text: message.content, folders: message.folders,
+                    ...(message.secretRedaction ? { secretRedaction: message.secretRedaction } : {}),
+                    ...(message.attachments ? { attachments: message.attachments } : {}),
+                } }, { receipt: 'accepted' })] };
+}
+/** Hydrate the message's folder list from its accepted receipts after a database read. */
+export function foldersFromReceipts({ events }, _options = {}) {
+    if (!Array.isArray(events))
+        return [];
+    return events.flatMap(event => {
+        if (event === null || typeof event !== 'object')
+            return [];
+        const folders = acceptedInputEvent({ event })?.data.folders;
+        return Array.isArray(folders) ? folders.filter((path) => typeof path === 'string') : [];
+    });
+}
 //# sourceMappingURL=accepted-input.js.map

package/dist/core/antigravity/tool-presentation.d.ts

@@ -0,0 +1,13 @@
+/** Antigravity's saved CLI receipts use capitalized argument keys. Display only: never rewrite history. */
+type Call = {
+    name: string;
+    input: unknown;
+};
+/** Translate agy's MCP envelope and file arguments into the generic chat presentation contract.
+ * Returns undefined for other shapes. Pure; O(k) when copying k file argument keys, otherwise O(1).
+ */
+export declare function antigravityToolPresentation({ name, input }: Call, _options?: Record<string, never>): (Call & {
+    wrapper?: Call;
+}) | undefined;
+export {};
+//# sourceMappingURL=tool-presentation.d.ts.map

package/dist/core/antigravity/tool-presentation.js

@@ -0,0 +1,20 @@
+/** A transport envelope must name both server and tool before its arguments can be unwrapped. */
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/** Translate agy's MCP envelope and file arguments into the generic chat presentation contract.
+ * Returns undefined for other shapes. Pure; O(k) when copying k file argument keys, otherwise O(1).
+ */
+export function antigravityToolPresentation({ name, input }, _options = {}) {
+    if (input === null || typeof input !== 'object')
+        return undefined;
+    const args = input;
+    if (name === 'read_file' && typeof args.Path === 'string') {
+        return { name, input: { ...args, file_path: args.Path } };
+    }
+    if (name !== 'call_mcp_tool' || !nonEmptyString(args.ServerName) || !nonEmptyString(args.ToolName))
+        return undefined;
+    const call = { name: args.ToolName, input: args.Arguments };
+    return { ...call, wrapper: call };
+}
+//# sourceMappingURL=tool-presentation.js.map

package/dist/core/assistant-client/ag-ui-transport.js

@@ -1,5 +1,11 @@
 import { EventType } from "@ag-ui/core";
 import { createAgUiToAgentTranslationState, translateAgUiEventToAgentEvent } from "../ag-ui/entry.js";
+/** Only the originating attachment can authorize page execution. Read its token for every turn;
+ * caller-supplied tool definitions never authorize or execute a transcript event. */
+function frontendBinding({ input }, _options = {}) {
+    const token = input.context?.["frontendBindToken"];
+    return typeof token === "string" && token.length > 0 ? { frontendBindToken: token } : {};
+}
 /** Bind the official client without adding its dependency to every chat consumer. */
 export function createAgUiRunClient({ ports }, _options = {}) {
     /** In-flight AG-UI turns' driving `HttpAgent`, keyed by the client-minted runId — the ONLY way
@@ -54,8 +60,11 @@ export function createAgUiRunClient({ ports }, _options = {}) {
         // none yet (e.g. the very first turn).
         const threadId = input.conversationId ?? ports.mintId({}, {});
         const agent = ports.createAgent({ url: ports.endpoint, threadId }, {});
+        if (input.signal.aborted)
+            throw new DOMException("Run cancelled", "AbortError");
         agUiAgents.set(runId, agent);
-        input.signal?.addEventListener("abort", () => agent.abortRun());
+        const abort = () => agent.abortRun();
+        input.signal.addEventListener("abort", abort, { once: true });
         const messages = input.history.filter((message) => message.content.trim().length > 0).map(toAgUiMessage);
         const runAgentInput = {
             threadId,
@@ -65,6 +74,7 @@ export function createAgUiRunClient({ ports }, _options = {}) {
             tools: [],
             context: [],
             forwardedProps: {
+                ...frontendBinding({ input }),
                 ...(input.agentId ? { agentId: input.agentId } : {}),
                 ...(input.history.findLast(message => message.role === "user")?.secretRedaction?.secretRedacted ? { secretRedacted: true } : {}),
             },
@@ -76,6 +86,7 @@ export function createAgUiRunClient({ ports }, _options = {}) {
                 return;
             settled = true;
             agUiAgents.delete(runId);
+            input.signal.removeEventListener("abort", abort);
             handlers.onDone(collected);
         };
         const state = createAgUiToAgentTranslationState({ customEventNames: ports.customEventNames }, {});
@@ -96,6 +107,7 @@ export function createAgUiRunClient({ ports }, _options = {}) {
                 },
                 error: (error) => {
                     agUiAgents.delete(runId);
+                    input.signal.removeEventListener("abort", abort);
                     const err = error instanceof Error ? error : new Error(String(error));
                     if (!startSettled) {
                         startSettled = true;

package/dist/core/assistant-client/transport.js

@@ -375,6 +375,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
         return {
             messages: byokMessages({ history: input.history }, {}),
             ...attachmentIdsField(input),
+            ...(input.folders?.length ? { folders: input.folders } : {}),
             ...conversationIdField(input),
             agentPluginState: input.context?.["agentPluginState"],
             userPrompt: input.context?.["userPrompt"],
@@ -584,6 +585,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
             ...modelField(input),
             ...reasoningField(input),
             ...attachmentIdsField(input),
+            ...(input.folders?.length ? { folders: input.folders } : {}),
             ...pluginRefIdsField(input),
             agentPluginState: input.context?.["agentPluginState"],
             userPrompt: input.context?.["userPrompt"],

package/dist/core/events.d.ts

@@ -17,7 +17,7 @@
  * not depend on `@jini-ai/protocol` (or, by the same reasoning, on `@jini-ai/daemon`), the same
  * "translate the wire, don't import it" posture `assistant-ag-ui.ts` documents for its own port of
  * this package's vocabulary in the other direction. Keep in sync by hand if the daemon's shape
- * changes — there are exactly two fields, so drift is easy to spot in review.
+ * changes — the image arm has two required and two optional fields, so drift is easy to spot in review.
  */
 export type ToolResultMediaBlock = {
     readonly type: 'text';
@@ -26,6 +26,10 @@ export type ToolResultMediaBlock = {
     readonly type: 'image';
     readonly mimeType: string;
     readonly data: string;
+    /** Optional caption and alt text (e.g. the media item's title). */
+    readonly title?: string;
+    /** Optional link to the full file; the renderer only links a safe (http(s) or same-site) target. */
+    readonly href?: string;
 };
 /**
  * A single renderable unit of agent output. Covers every generic variant a

package/dist/core/messages.d.ts

@@ -58,6 +58,8 @@ export interface ChatMessage {
     lastRunEventId?: string;
     startedAt?: number;
     endedAt?: number;
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
 }
 //# sourceMappingURL=messages.d.ts.map

package/dist/core/tool-events.d.ts

@@ -29,7 +29,7 @@ export declare function isDelegatedWrapperToolName({ name }: {
     name: string;
 }): boolean;
 /**
- * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * Drop each delegated or direct MCP wrapper call that the daemon also reported as its own canonical row,
  * so one call shows as one row.
  *
  * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
@@ -39,16 +39,26 @@ export declare function isDelegatedWrapperToolName({ name }: {
  * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
  * name, input and result.
  *
- * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
- * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
- * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
- * hidden.
+ * A direct call (`mcp__jini__theme_read_file`) arrives twice the same way: the CLI's `mcp__<server>__X`
+ * row and the bridge's `X` row with the same input, so every direct Jini MCP call drew two rows.
  *
- * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
+ * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
+ * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
+ * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
+ * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
+ * bridge, e.g. a read-only 403) stays, so its error is not hidden.
+ *
+ * @param events - One assistant turn's events, normally already passed through {@link dedupeToolUsesById}.
  * @returns A new array without the folded wrappers, or the original reference when none fold.
- * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·w·s): n events, w wrappers, s canonical input serialization cost (including key sorting).
+ * O(n + s) extra space; inputs and events are not mutated.
+ * @example foldDelegatedWrapperCalls({ events }); // canonical rows retain their own results
  */
 export declare function foldDelegatedWrapperCalls({ events }: {
     events: AgentEvent[] | undefined;
-}): AgentEvent[];
+}, _options?: Record<string, never>): AgentEvent[];
 //# sourceMappingURL=tool-events.d.ts.map

package/dist/core/tool-events.js

@@ -1,3 +1,5 @@
+import { canonicalJson } from '@jini-ai/core/records';
+import { toolPresentation } from './tool-presentation.js';
 /**
  * Drop repeated `tool_use` events that share an `id`. A retried/duplicated
  * stream can replay the same tool-call id (e.g. reconnect-and-replay landing
@@ -46,15 +48,31 @@ const DELEGATED_WRAPPER_PATTERN = /^(?:mcp__.+__)?execute_(?:readonly_)?delegate
 export function isDelegatedWrapperToolName({ name }) {
     return DELEGATED_WRAPPER_PATTERN.test(name);
 }
-function wrapperToolId({ event }) {
-    if (!isDelegatedWrapperToolName({ name: event.name }))
+/** The tool `mcp__<server>__X` names (`X`), or undefined for any other name. O(n) in the name length. */
+function directMcpToolName({ name }) {
+    if (!name.startsWith('mcp__'))
         return undefined;
-    const input = event.input;
-    const toolId = typeof input === 'object' && input !== null ? input.toolId : undefined;
-    return typeof toolId === 'string' && toolId ? toolId : undefined;
+    // The server segment is at least one character, so its closing `__` starts at index 6 or later.
+    const separator = name.indexOf('__', 6);
+    return separator === -1 ? undefined : name.slice(separator + 2);
+}
+/** Resolve the generic wrapper contract or an MCP gateway/direct name. Pure; O(n) in the name.
+ * Legacy gateways retain name-only matching for malformed-input bridge errors;
+ * Antigravity's adapter-described wrappers require equal inner inputs but may arrive buffered.
+ */
+function wrapperCall({ event }, _options = {}) {
+    const wrapper = toolPresentation(event).wrapper;
+    const call = wrapper ?? event;
+    if (!isDelegatedWrapperToolName({ name: call.name })) {
+        const name = wrapper ? wrapper.name : directMcpToolName({ name: call.name });
+        return name ? { name, input: call.input, matchInput: true, buffered: wrapper !== undefined } : undefined;
+    }
+    const args = call.input !== null && typeof call.input === 'object' ? call.input : {};
+    const name = args.toolId;
+    return typeof name === 'string' && name ? { name, input: args.input, matchInput: wrapper !== undefined, buffered: wrapper !== undefined } : undefined;
 }
 /**
- * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * Drop each delegated or direct MCP wrapper call that the daemon also reported as its own canonical row,
  * so one call shows as one row.
  *
  * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
@@ -64,16 +82,26 @@ function wrapperToolId({ event }) {
  * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
  * name, input and result.
  *
- * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
- * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
- * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
- * hidden.
+ * A direct call (`mcp__jini__theme_read_file`) arrives twice the same way: the CLI's `mcp__<server>__X`
+ * row and the bridge's `X` row with the same input, so every direct Jini MCP call drew two rows.
  *
- * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
+ * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
+ * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
+ * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
+ * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
+ * bridge, e.g. a read-only 403) stays, so its error is not hidden.
+ *
+ * @param events - One assistant turn's events, normally already passed through {@link dedupeToolUsesById}.
  * @returns A new array without the folded wrappers, or the original reference when none fold.
- * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·w·s): n events, w wrappers, s canonical input serialization cost (including key sorting).
+ * O(n + s) extra space; inputs and events are not mutated.
+ * @example foldDelegatedWrapperCalls({ events }); // canonical rows retain their own results
  */
-export function foldDelegatedWrapperCalls({ events }) {
+export function foldDelegatedWrapperCalls({ events }, _options = {}) {
     if (!events || events.length === 0)
         return [];
     const claimed = new Set();
@@ -81,11 +109,11 @@ export function foldDelegatedWrapperCalls({ events }) {
     events.forEach((event, i) => {
         if (event.kind !== 'tool_use')
             return;
-        const toolId = wrapperToolId({ event });
+        const call = wrapperCall({ event });
         // A replayed wrapper (same id) must not claim a second canonical row.
-        if (toolId === undefined || folded.has(event.id))
+        if (call === undefined || folded.has(event.id))
             return;
-        const match = events.findIndex((other, j) => j > i && !claimed.has(j) && other.kind === 'tool_use' && other.name === toolId);
+        const match = findCanonicalRow({ events, wrapper: event, wrapperIndex: i, call, claimed });
         if (match === -1)
             return;
         claimed.add(match);
@@ -96,4 +124,32 @@ export function foldDelegatedWrapperCalls({ events }) {
     return events.filter((event) => !((event.kind === 'tool_use' && folded.has(event.id)) ||
         (event.kind === 'tool_result' && folded.has(event.toolUseId))));
 }
+/**
+ * Index of the first unclaimed canonical row in the wrapper's matching window, or -1. Legacy gateways match
+ * on name alone; direct calls and adapter-described wrappers also require equal inner input.
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·s): n events, s canonical input serialization cost.
+ */
+function findCanonicalRow({ events, wrapper, wrapperIndex, call, claimed }) {
+    const inputKey = call.matchInput ? canonicalJson({ value: { input: call.input } }) : undefined;
+    const [start, end] = canonicalSearchWindow({ events, wrapper, wrapperIndex, call });
+    for (let j = start; j < end; j += 1) {
+        const other = events[j];
+        if (claimed.has(j) || other.kind !== 'tool_use' || other.name !== call.name)
+            continue;
+        if (inputKey === undefined || canonicalJson({ value: { input: other.input } }) === inputKey)
+            return j;
+    }
+    return -1;
+}
+/** Pure matching bounds within one turn; O(n) time, O(1) space for n events.
+ * Antigravity's buffered receipts cannot establish arrival/result boundaries. Direct MCP calls
+ * retain their later-only window so a completed/refused call cannot consume a separate retry.
+ */
+function canonicalSearchWindow({ events, wrapper, wrapperIndex, call }, _options = {}) {
+    if (call.buffered)
+        return [0, events.length];
+    const resultIndex = !call.matchInput ? -1 : events.findIndex(other => other.kind === 'tool_result' && other.toolUseId === wrapper.id);
+    return [wrapperIndex + 1, resultIndex === -1 ? events.length : resultIndex];
+}
 //# sourceMappingURL=tool-events.js.map

package/dist/core/tool-presentation.d.ts

@@ -0,0 +1,14 @@
+type Call = {
+    name: string;
+    input: unknown;
+};
+/** Display-only call and, when present, the transport's inner call to correlate with the bridge. */
+export type ToolPresentation = Call & {
+    wrapper?: Call;
+};
+/** Resolve CLI argument dialects at one boundary. Raw/persisted events remain untouched.
+ * Pure; O(k) only when an adapter copies k argument keys, otherwise O(1).
+ */
+export declare function toolPresentation(call: Call, _options?: Record<string, never>): ToolPresentation;
+export {};
+//# sourceMappingURL=tool-presentation.d.ts.map

package/dist/core/tool-presentation.js

@@ -0,0 +1,8 @@
+import { antigravityToolPresentation } from './antigravity/tool-presentation.js';
+/** Resolve CLI argument dialects at one boundary. Raw/persisted events remain untouched.
+ * Pure; O(k) only when an adapter copies k argument keys, otherwise O(1).
+ */
+export function toolPresentation(call, _options = {}) {
+    return antigravityToolPresentation(call) ?? call;
+}
+//# sourceMappingURL=tool-presentation.js.map

package/dist/core/transport.d.ts

@@ -57,6 +57,8 @@ export interface StartRunInput {
     history: ChatMessage[];
     agentId?: string;
     conversationId?: string | null;
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
     context?: RunContext;
     /** Stops the browser-side subscription; the run continues host-side. */

package/dist/core/user-text-redaction.d.ts

@@ -19,7 +19,8 @@ export interface UserTextRedactionOptions {
 export declare const SECRET_REDACTED_NOTICE = "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.";
 export declare const CREDENTIAL_CARD_GUIDANCE = "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.";
 /** Stricter than error redaction: also detects unlabelled long tokens, while retaining ordinary URLs,
- * hexadecimal hashes, identifiers and prose. Strong credential syntax inside a URL is still caught. */
+ * filesystem paths, hexadecimal hashes, identifiers and prose. Strong credential syntax inside
+ * URLs or paths is still caught. */
 export declare function redactUserText({ text }: {
     readonly text: string;
 }, { secretField }?: {

package/dist/core/user-text-redaction.js

@@ -25,8 +25,27 @@ function entropy(text) {
     }
     return bits;
 }
+/** Recognize identifier paths, including the fragment after a space in a typed path.
+ * Require multiple segments and readable words: arbitrary base64 and long digit-mixed runs
+ * must still reach the entropy guard. Specific credential rules have already run. */
+function isIdentifierPath({ text }, _options = {}) {
+    const segments = text.replace(/^(?:[a-z]:|~)?[\\/]*/i, '').split(/[\\/]/).filter(Boolean);
+    return segments.length >= 2 && segments.every(segment => /^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/.test(segment)
+        || segment.split(/[-_.]/).every(word => /^[A-Z]$/.test(word)
+            || /^[A-Z]?[a-z]{2,}(?:[A-Z][a-z]{2,}|[0-9]{1,4}(?=[A-Z][a-z]{2,}|$))*$/.test(word)));
+}
+/** A piece of a random key: long, both letter cases, and a character-class change at most positions.
+ * Readable names (CamelCase, SCREAMING_CASE, dated file names) change class far less often, and
+ * every piece of a 40-character base64 key split by '/' is 12+ characters in most keys. */
+function isOpaqueSegment(segment) {
+    if (segment.length < 12 || !/[A-Z]/.test(segment) || !/[a-z]/.test(segment))
+        return false;
+    const changes = segment.match(/[A-Z](?=[^A-Z])|[a-z](?=[^a-z])|\d(?=\D)/g)?.length ?? 0;
+    return changes / (segment.length - 1) >= 0.4;
+}
 /** Stricter than error redaction: also detects unlabelled long tokens, while retaining ordinary URLs,
- * hexadecimal hashes, identifiers and prose. Strong credential syntax inside a URL is still caught. */
+ * filesystem paths, hexadecimal hashes, identifiers and prose. Strong credential syntax inside
+ * URLs or paths is still caught. */
 export function redactUserText({ text }, { secretField = false } = {}) {
     // Existing removal markers must survive a second pass through assignment rules (api_key=…).
     const literalMarkers = new Map();
@@ -40,10 +59,24 @@ export function redactUserText({ text }, { secretField = false } = {}) {
     }).replaceAll(REMOVED, INTERNAL_REMOVED);
     const base = redactSecretShapes({ text: protectedText, policy: { additionalRules: CHAT_RULES } });
     let count = base.redactions;
-    const urls = [...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+/gi)]
-        .map(match => ({ start: match.index, end: match.index + match[0].length }));
+    // Exempt locations only AFTER specific secret rules. Only quoted paths may contain whitespace;
+    // unquoted paths and URLs end there, and at , | ; and invisible separators, so an adjacent
+    // secret glued after them cannot inherit the exemption.
+    // A quoted path ends at its first matching quote, which must sit on a word boundary, so an
+    // apostrophe later in the line ("don't") cannot close an unterminated quote and exempt the gap.
+    // Require a root boundary so a slash inside an opaque token cannot exempt that token, and a
+    // folder after the root so a bare "/" + token is not mistaken for a path.
+    const locations = [
+        ...[...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`,|;\u200B-\u200D\uFEFF]+|(?<!\w)(["'`])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\r\n"'`\\/]+[\\/](?:(?!\1)[^\r\n])*\1(?!\w)|(?<![\w+\/=\\~.-])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\s<>"'`,|;\u200B-\u200D\uFEFF\\/]+[\\/][^\s<>"'`,|;\u200B-\u200D\uFEFF]*/gi)]
+            .map(match => ({ match, url: /^[a-z][a-z0-9+.-]*:\/\//i.test(match[0]) })),
+        // The part of a hand-typed unquoted path after a space (Work/CustomerPortal…) has no root.
+        ...[...base.text.matchAll(/[^\s<>"'`,|;\u200B-\u200D\uFEFF]+/g)]
+            .filter(match => isIdentifierPath({ text: match[0] })).map(match => ({ match, url: false })),
+    ].map(({ match, url }) => ({ start: match.index, end: match.index + match[0].length, url }));
     let cleaned = base.text.replace(/(?<![A-Za-z0-9_+\/=-])[A-Za-z0-9_+\/=-]{40,}(?![A-Za-z0-9_+\/=-])/g, (candidate, offset) => {
-        if (urls.some(url => offset >= url.start && offset < url.end))
+        const location = locations.find(span => offset >= span.start && offset + candidate.length <= span.end);
+        // A key glued straight onto a path (/proj/KEY) is still checked; URLs keep their opaque ids.
+        if (location && (location.url || !candidate.split(/[\\/]/).some(isOpaqueSegment)))
             return candidate;
         if (/^[a-f0-9]+$/i.test(candidate) || !/[A-Za-z]/.test(candidate))
             return candidate;

package/dist/embed-widget/browser/frontend-session-bridge.d.ts

@@ -0,0 +1,99 @@
+import { type PageDriver } from '@jini-ai/agentic';
+import type { ApprovalAnswer } from '@jini-ai/core';
+import type { ChatPaneAgentToolAction, ChatPaneAgentBridgeAccess } from '../../react/features/chat-pane/types.js';
+export interface FrontendSessionBridgeOptions {
+    /** Host validates its server-bound envelope before the shared page executor sees plain args. */
+    readonly preparePageInput?: (args: {
+        action: ChatPaneAgentToolAction;
+    }) => Record<string, unknown>;
+    readonly capabilityIds?: readonly string[];
+    /** Bounds the HTTP envelope before it reaches a host JSON-body limit. Oversized reads refuse. */
+    readonly maxResponseBytes?: number;
+    /** Flush host state; a defined return replaces the machine response before acknowledgement. */
+    readonly onBeforeResponse?: (args: {
+        action: ChatPaneAgentToolAction;
+        output: unknown;
+    }) => unknown | Promise<unknown>;
+    readonly onAfterResponse?: (args: {
+        action: ChatPaneAgentToolAction;
+        output: unknown;
+    }) => void | Promise<void>;
+    /** Host policy and the existing app dialog. It never receives an assistant decision. */
+    readonly pageApproval?: {
+        isDirect(required: {
+            capabilityId: string;
+            input: Record<string, unknown>;
+        }): boolean;
+        request(required: {
+            capabilityId: string;
+            input: Record<string, unknown>;
+            signal: AbortSignal;
+        }): Promise<ApprovalAnswer>;
+    };
+    /** Supplying one claims the six `page.*` verbs. Omit for a chat-only surface. */
+    readonly pageDriver?: PageDriver;
+    /**
+     * Product capabilities, keyed by id prefix (`'cms.'`). Each claims every capability under it.
+     * This is how a consumer exposes verbs the engine has never heard of.
+     */
+    readonly executors?: Readonly<Record<string, (capabilityId: string, input: Record<string, unknown>) => Promise<unknown>>>;
+    /** Called for every invocation before it runs — the hook a product uses to show an activity trail. */
+    readonly onInvocation?: (action: ChatPaneAgentToolAction) => void;
+    /** Reported for failures that are nobody's tool call: stream errors, malformed frames. */
+    readonly onError?: (error: unknown) => void;
+}
+/** The host supplies its origin and stream transport; native fetch defaults may be overridden. */
+export interface FrontendSessionBridgeArgs {
+    /** Pass an empty string for the same-origin proxy used by a browser host. */
+    readonly baseUrl: string;
+    readonly endpointPrefix?: string;
+    readonly headers?: () => Record<string, string>;
+    readonly openStream: (args: {
+        url: string;
+        headers?: Record<string, string>;
+    }) => Pick<EventSource, 'addEventListener' | 'close'>;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly request?: (args: {
+        url: string;
+        init: RequestInit;
+        timeoutMs: number;
+    }) => Promise<Response>;
+}
+export interface FrontendSessionBridge {
+    /** Hand this to `ChatPane`'s `agentControl.bridgeAccess`. */
+    readonly bridgeAccess: ChatPaneAgentBridgeAccess;
+    /**
+     * Resolves the *first* time the daemon attaches this surface — an "is it live yet" signal.
+     *
+     * Its `bindToken` is only correct until the next reconnect, so do not stash it. Call
+     * {@link FrontendSessionBridge.bindToken} when building a run request instead.
+     */
+    readonly ready: Promise<{
+        sessionId: string;
+        bindToken: string;
+    }>;
+    /**
+     * The token for the attachment that is live *now*, or `undefined` before the first attach and
+     * after {@link FrontendSessionBridge.close}. Read it at run-start; see the module doc.
+     */
+    bindToken(): string | undefined;
+    close(): void;
+}
+/**
+ * Opens the surface's connection and starts routing invocations.
+ *
+ * @param options - What this page can serve and where the daemon is.
+ * @returns The pane's bridge, the attach result, and a teardown.
+ */
+export declare function createFrontendSessionBridge({ baseUrl: base, openStream, request, fetch, endpointPrefix, headers }: FrontendSessionBridgeArgs, options?: FrontendSessionBridgeOptions): FrontendSessionBridge;
+/** Authenticated streaming replacement for EventSource when credentials belong in headers.
+ * Uses the shared SSE decoder; reconnect creates a new attachment and clears the old token.
+ * O(stream bytes), bounded frame buffer; close aborts fetch/readers and the reconnect timer. */
+export declare function openFetchFrontendStream({ url, headers }: {
+    url: string;
+    headers: () => Record<string, string>;
+}, { fetch: send, reconnectMs }?: {
+    fetch?: typeof globalThis.fetch;
+    reconnectMs?: number;
+}): Pick<EventSource, 'addEventListener' | 'close'>;
+//# sourceMappingURL=frontend-session-bridge.d.ts.map