@jini-ai/chat 0.6.15 → 0.6.17

package/dist/embed-widget/browser/frontend-session-bridge.js

@@ -0,0 +1,384 @@
+import { decodeSseFrames } from '@jini-ai/core/primitives';
+/**
+ * @module agent-bridge/frontend-session-bridge
+ *
+ * The browser half of agent-driven frontend control: one SSE connection to the daemon, and the
+ * routing that turns each relayed invocation into a call on something in this page.
+ *
+ * Everything on the server side already existed — `FrontendSessionRegistry` addresses a run to a
+ * surface, the frontend-session routes carry invocations out and answers back, and
+ * `createFrontendControl` assembles them. `ChatPaneAgentBridgeAccess` declared the contract this
+ * satisfies and had **zero implementations**, which is why an agent could reach a tool and the
+ * tool could reach nothing.
+ *
+ * Design notes worth knowing before changing this:
+ *
+ * - **The connection is owned here, not by `subscribe`.** `ChatPaneAgentBridgeAccess.subscribe` is
+ *   called by the chat pane's own effect, so tying the stream's lifetime to it would mean page
+ *   control dies when the pane unmounts — and the page is drivable whether or not a chat pane
+ *   exists. `subscribe` registers a listener; `close()` tears the connection down.
+ * - **Capabilities are claimed from what is actually wired.** The claim sent at connect time is
+ *   derived from the presence of a `pageDriver` and the keys of `executors`, never from a static
+ *   list. A surface that claims what it cannot serve turns a fast, named refusal into a timeout.
+ * - **An executed invocation is never executed twice.** If the stream drops between the daemon
+ *   delivering an invocation and this page POSTing the answer, the daemon correctly fails that
+ *   call — but the click already happened. Without the `executed` set below, the retry clicks
+ *   again. Buttons are not idempotent.
+ * - **The bind token never leaves this module except to the host.** It arrives on the `attached`
+ *   event and must ride to run-start; it deliberately does not appear in any URL (see
+ *   `@jini-ai/daemon`'s `FrontendSessionHandle`).
+ * - **Read the bind token at send time, not once.** `EventSource` reconnects on its own — after a
+ *   daemon restart, a sleeping laptop, or an ordinary network blip — and each reattach mints a new
+ *   session and a new token. A host that captured `ready`'s token keeps sending a dead one, every
+ *   later run fails to bind, and the only trace is a daemon-side log line: the agent is simply told
+ *   "no frontend is bound to this run". `ready` therefore answers "has it attached at least once";
+ *   {@link FrontendSessionBridge.bindToken} answers "what is valid now", and only the latter
+ *   belongs in a run request.
+ */
+import { CHAT_CAPABILITIES } from '../../core/index.js';
+import { PAGE_CAPABILITIES, executePageCapability } from '@jini-ai/agentic';
+/** How many settled invocation ids to remember for replay suppression. */
+const EXECUTED_MEMORY = 256;
+/** Ids this surface can actually serve, given what the host wired up. */
+function claimedCapabilities(options) {
+    if (options.capabilityIds)
+        return [...options.capabilityIds];
+    const claims = CHAT_CAPABILITIES.map((capability) => capability.id);
+    if (options.pageDriver !== undefined) {
+        claims.push(...PAGE_CAPABILITIES.map((capability) => capability.id));
+    }
+    // Dialog-support handshake only; page.approval is not an executable tool id.
+    if (options.pageApproval)
+        claims.push('page.approval');
+    claims.push(...Object.keys(options.executors ?? {}));
+    return claims;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Parses a frame's data into an object, or says why it is not one. */
+function parseFrameObject(data) {
+    let parsed;
+    try {
+        parsed = JSON.parse(data);
+    }
+    catch (error) {
+        return { error };
+    }
+    // `JSON.parse` succeeds on any valid JSON value, not just objects — a bare `null`, number,
+    // string or boolean parses cleanly and would throw *outside* this try/catch on the very next
+    // `frame['type']` read (`null` is the one of those that actually throws; the others just read
+    // back `undefined` harmlessly). Guarding here routes every one of those through the same
+    // `onError` path as an unparseable frame, rather than only some of them crashing the listener.
+    if (parsed === null || typeof parsed !== 'object') {
+        return { error: new Error(`malformed frame: expected a JSON object, got ${JSON.stringify(parsed)}`) };
+    }
+    return { frame: parsed };
+}
+/** Reads an `invocation` frame into the pane's action shape, refusing one with no usable id. */
+function readInvocation(frame) {
+    const rawInvocationId = frame['invocationId'];
+    if (typeof rawInvocationId !== 'string' || rawInvocationId.length === 0) {
+        return { kind: 'malformed', error: new Error('invocation frame missing invocationId') };
+    }
+    return {
+        kind: 'invocation',
+        action: {
+            invocationId: rawInvocationId,
+            capabilityId: String(frame['capabilityId']),
+            input: (frame['input'] ?? {}),
+        },
+    };
+}
+/** Classifies one frame's raw data; the listener only applies the result. */
+function readFrame(data) {
+    const parsed = parseFrameObject(data);
+    if ('error' in parsed)
+        return { kind: 'malformed', error: parsed.error };
+    const { frame } = parsed;
+    switch (frame['type']) {
+        case 'cancelled':
+            return { kind: 'cancelled', invocationId: String(frame['invocationId']) };
+        case 'attached':
+            return { kind: 'attached', sessionId: String(frame['sessionId']), bindToken: String(frame['bindToken']) };
+        case 'error':
+            return { kind: 'refused', message: String(frame['message']) };
+        case 'invocation':
+            return readInvocation(frame);
+        default:
+            // Unknown frame types are ignored rather than treated as errors, so the daemon's event
+            // vocabulary can grow without every deployed surface needing to ship first.
+            return { kind: 'ignored' };
+    }
+}
+/**
+ * Opens the surface's connection and starts routing invocations.
+ *
+ * @param options - What this page can serve and where the daemon is.
+ * @returns The pane's bridge, the attach result, and a teardown.
+ */
+export function createFrontendSessionBridge({ baseUrl: base, openStream, request, fetch, endpointPrefix = '/api/frontend-sessions', headers }, options = {}) {
+    const capabilities = claimedCapabilities(options);
+    // The only caller (`respond`) never passes its own signal, so the deadline is the whole signal.
+    const send = request ?? (({ url, init, timeoutMs }) => (fetch ?? globalThis.fetch)(url, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+    let sessionId;
+    /** Replaced on every reattach; a promise resolved once could never carry this. */
+    let currentBindToken;
+    // Definite assignment rather than no-op placeholders: a Promise executor runs synchronously, so
+    // both are set before this line finishes, and placeholders would only add two functions that
+    // can never be called.
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    /** Chat-pane listeners. The pane registers exactly one; a second host could register another. */
+    const chatListeners = new Set();
+    /** Invocation ids already run here, so a stream reconnect cannot double-click a button. */
+    const executed = new Set();
+    const pending = new Map();
+    // A page driver owns one live screen. Serialize its observations, effect and acknowledgement;
+    // otherwise a second invocation could overwrite the first one's host-bound navigation plan.
+    let pageQueue = Promise.resolve();
+    const abortPending = () => {
+        for (const controller of pending.values()) {
+            controller.abort();
+        }
+        pending.clear();
+    };
+    const query = capabilities.map((id) => `capability=${encodeURIComponent(id)}`).join('&');
+    const source = openStream({ url: `${base}${endpointPrefix}/stream?${query}`, ...(headers ? { headers: headers() } : {}) });
+    async function respond(invocationId, body) {
+        if (sessionId === undefined)
+            throw new Error('the surface is not attached yet');
+        const wire = boundedFrontendResponse({ invocationId, body, maxBytes: options.maxResponseBytes });
+        const response = await send({
+            url: `${base}${endpointPrefix}/${encodeURIComponent(sessionId)}/responses`,
+            init: { method: 'POST', headers: { 'content-type': 'application/json', ...headers?.(), ...(headers ? { 'x-frontend-bind-token': currentBindToken ?? '' } : {}) }, body: wire.payload },
+            timeoutMs: 15_000,
+        });
+        await assertFrontendResponse({ response, invocationId, body, scoped: Boolean(headers), refused: wire.refused });
+    }
+    const respondSuccess = (invocationId, output) => respond(invocationId, { ok: true, output });
+    const respondError = (invocationId, message) => respond(invocationId, { ok: false, message });
+    /** Freeze once, ask on the app's existing human-only channel, then use the same page executor.
+     * The server pauses its execution deadline only after acknowledging the bounded human wait. */
+    async function servePage(action, signal) {
+        const input = options.preparePageInput ? options.preparePageInput({ action }) : structuredClone(action.input);
+        const args = { capabilityId: action.capabilityId, input };
+        if (options.pageApproval && !options.pageApproval.isDirect(args)) {
+            await respond(action.invocationId, { phase: 'approval-pending' });
+            const answer = await options.pageApproval.request({ ...args, input: structuredClone(input), signal });
+            // Report the decision before effects, including decline/expiry; the server audits it.
+            await respond(action.invocationId, { phase: 'execution-started', decision: answer.confirmed ? 'approved' : answer.reason });
+            if (!answer.confirmed)
+                return { executed: false, reason: answer.reason };
+        }
+        if (signal.aborted)
+            return { executed: false, reason: 'abandoned' };
+        return executePageCapability({ driver: options.pageDriver, ...args }, { signal });
+    }
+    /** Runs one non-chat invocation here and answers it. Chat ones go to the pane instead. */
+    async function serveLocally(action, controller) {
+        let output;
+        try {
+            controller.signal.throwIfAborted();
+            if (options.pageDriver !== undefined && action.capabilityId.startsWith('page.')) {
+                output = await servePage(action, controller.signal);
+            }
+            else {
+                const entry = Object.entries(options.executors ?? {})
+                    .find(([prefix]) => action.capabilityId.startsWith(prefix));
+                if (entry === undefined)
+                    throw new Error(`nothing on this page serves "${action.capabilityId}"`);
+                output = await entry[1](action.capabilityId, action.input);
+            }
+        }
+        catch (error) {
+            pending.delete(action.invocationId);
+            await respondError(action.invocationId, errorMessage(error)).catch(options.onError ?? (() => undefined));
+            return;
+        }
+        await acknowledge({ action, output, signal: controller.signal });
+        pending.delete(action.invocationId);
+    }
+    async function acknowledge({ action, output, signal }) {
+        try {
+            signal.throwIfAborted();
+            const projected = await options.onBeforeResponse?.({ action, output });
+            const acceptedOutput = projected ?? output;
+            await respondSuccess(action.invocationId, acceptedOutput);
+            signal.throwIfAborted();
+            await options.onAfterResponse?.({ action, output: acceptedOutput });
+        }
+        catch (error) {
+            options.onError?.(error);
+        }
+    }
+    function remember(invocationId) {
+        executed.add(invocationId);
+        if (executed.size > EXECUTED_MEMORY) {
+            const oldest = executed.values().next().value;
+            if (oldest !== undefined)
+                executed.delete(oldest);
+        }
+    }
+    /** Runs one well-formed invocation: replay check, announcement, then pane or local serving. */
+    function handleInvocation(action) {
+        // A redelivery after a dropped answer must not re-run the side effect.
+        if (executed.has(action.invocationId)) {
+            void respondError(action.invocationId, 'already executed on this surface').catch(() => undefined);
+            return;
+        }
+        if (options.capabilityIds && !options.capabilityIds.includes(action.capabilityId)) {
+            void respondError(action.invocationId, 'Capability unavailable').catch(() => undefined);
+            return;
+        }
+        remember(action.invocationId);
+        options.onInvocation?.(action);
+        if (action.capabilityId.startsWith('chat.')) {
+            for (const listener of chatListeners)
+                listener(action);
+            return;
+        }
+        const controller = new AbortController();
+        pending.set(action.invocationId, controller);
+        if (action.capabilityId.startsWith('page.')) {
+            pageQueue = pageQueue.then(() => serveLocally(action, controller)).catch(error => options.onError?.(error));
+        }
+        else
+            void serveLocally(action, controller);
+    }
+    source.addEventListener('message', (event) => {
+        const frame = readFrame(event.data);
+        switch (frame.kind) {
+            case 'cancelled':
+                pending.get(frame.invocationId)?.abort();
+                return;
+            case 'attached':
+                abortPending();
+                sessionId = frame.sessionId;
+                currentBindToken = frame.bindToken;
+                // A no-op after the first attach — which is exactly why `currentBindToken` exists.
+                resolveReady({ sessionId, bindToken: currentBindToken });
+                return;
+            case 'refused':
+                rejectReady(new Error(frame.message));
+                return;
+            case 'malformed':
+                options.onError?.(frame.error);
+                return;
+            case 'invocation':
+                handleInvocation(frame.action);
+                return;
+            case 'ignored':
+                return;
+        }
+    });
+    source.addEventListener('error', (event) => {
+        abortPending();
+        // The daemon deletes a session's bind token the instant that connection drops, so by the time
+        // this fires the token in hand is already gone from the registry. Holding it until the next
+        // `attached` frame leaves a window where `bindToken()` hands back something dead, and a run
+        // started in that window fails to bind — reported to the agent only as "no frontend is bound
+        // to this run", with the real reason (a reconnect it never saw) nowhere in view.
+        // Reporting no token is the honest answer for a surface that is, right now, not attached.
+        currentBindToken = undefined;
+        sessionId = undefined;
+        options.onError?.(event);
+    });
+    const bridgeAccess = {
+        subscribe(onAction) {
+            chatListeners.add(onAction);
+            // Removes this listener only. The connection outlives any one pane — see the module doc.
+            return () => chatListeners.delete(onAction);
+        },
+        respondSuccess,
+        respondError,
+    };
+    return {
+        bridgeAccess,
+        ready,
+        bindToken: () => currentBindToken,
+        close() {
+            abortPending();
+            source.close();
+            chatListeners.clear();
+            // A closed bridge serves nothing, so binding a run to it would strand that run rather than
+            // fail it — this is what stops a torn-down surface (a StrictMode remount, a route change)
+            // from handing its dead token to the next run.
+            currentBindToken = undefined;
+            sessionId = undefined;
+        },
+    };
+}
+/** Authenticated streaming replacement for EventSource when credentials belong in headers.
+ * Uses the shared SSE decoder; reconnect creates a new attachment and clears the old token.
+ * O(stream bytes), bounded frame buffer; close aborts fetch/readers and the reconnect timer. */
+export function openFetchFrontendStream({ url, headers }, { fetch: send = globalThis.fetch, reconnectMs = 1000 } = {}) {
+    const events = new EventTarget();
+    const abort = new AbortController();
+    let retry;
+    let delay = reconnectMs;
+    async function connect() {
+        let retryable = true;
+        try {
+            const response = await send(url, { credentials: 'same-origin', mode: 'same-origin', redirect: 'error', headers: headers(), signal: abort.signal });
+            retryable = ![401, 403, 404, 429].includes(response.status);
+            if (!response.ok || !response.body)
+                throw new Error('Frontend stream unavailable');
+            for await (const frame of decodeSseFrames({ source: streamChunks(response.body) }, { maxBufferChars: 128_000 })) {
+                delay = reconnectMs; // A delivered event proves the connection recovered.
+                if (!abort.signal.aborted)
+                    events.dispatchEvent(new MessageEvent('message', { data: frame.data }));
+            }
+        }
+        catch { /* The stream error has one value-free notification below. */ }
+        if (abort.signal.aborted)
+            return;
+        events.dispatchEvent(new Event('error'));
+        if (retryable) {
+            retry = setTimeout(() => { void connect(); }, delay);
+            delay = Math.min(delay * 2, 30_000);
+        }
+    }
+    void connect();
+    return { addEventListener: events.addEventListener.bind(events),
+        close() { abort.abort(); clearTimeout(retry); } };
+}
+async function* streamChunks(body) {
+    const reader = body.getReader();
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done) {
+                return;
+            }
+            yield next.value;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+/** Transport bounds differ from executor output truncation: keep the envelope valid JSON. */
+function boundedFrontendResponse({ invocationId, body, maxBytes }) {
+    const payload = JSON.stringify({ invocationId, ...body });
+    if (maxBytes === undefined || new TextEncoder().encode(payload).length <= maxBytes)
+        return { payload, refused: false };
+    return { payload: JSON.stringify({ invocationId, ok: false, message: 'Frontend result too large; narrow the query.' }), refused: true };
+}
+async function assertFrontendResponse({ response, invocationId, body, scoped, refused }) {
+    if (!response.ok)
+        throw new Error(`answering "${invocationId}" failed: ${response.status}`);
+    if (refused)
+        throw new Error('Frontend result too large; narrow the query.');
+    if ('phase' in body || scoped) {
+        const result = await response.json();
+        if (!result.settled)
+            throw new Error('Page invocation expired or was cancelled; no action was taken');
+    }
+}
+//# sourceMappingURL=frontend-session-bridge.js.map

package/dist/embed-widget/browser/session-store.d.ts

@@ -15,15 +15,10 @@ export interface BrowserSessionStore {
         state: PersistedEmbedState;
     }): void;
     clear(args: Record<string, never>): void;
-    enqueue(args: {
-        action: unknown;
-    }): void;
-    drain(args: Record<string, never>): unknown | null;
 }
 export interface BrowserSessionStoreArgs {
     readonly storage: SessionStoragePort;
     readonly transcriptKey: string;
-    readonly actionKey: string;
     readonly maxMessages: number;
     readonly maxBytes: number;
     readonly validateMessage: (args: {
@@ -31,14 +26,13 @@ export interface BrowserSessionStoreArgs {
     }) => boolean;
 }
 /**
- * Creates bounded, fail-soft transcript storage and a single-slot action queue.
- * Corrupt transcripts are cleared as a whole. Actions are deleted before delivery,
- * and a failed delete prevents delivery. Serialization/storage failures never escape.
+ * Creates bounded, fail-soft transcript storage.
+ * Corrupt transcripts are cleared as a whole. Serialization/storage failures never escape.
  * Reject oversized stored envelopes before parsing, validate the whole message batch, then trim
  * oldest messages first. Circular serialization is fail-soft. Keys, limits, validator and Storage
  * are injected so separate controllers never accidentally share a product-selected namespace.
  * @complexity Load O(bytes + messages); save O(messages * serialized bytes) in the
- * worst trimming case; queue O(serialized action bytes). State is instance-local.
+ * worst trimming case. State is instance-local.
  */
 export declare function createBrowserSessionStore(args: BrowserSessionStoreArgs): BrowserSessionStore;
 //# sourceMappingURL=session-store.d.ts.map

package/dist/embed-widget/browser/session-store.js

@@ -1,17 +1,16 @@
 /**
- * Creates bounded, fail-soft transcript storage and a single-slot action queue.
- * Corrupt transcripts are cleared as a whole. Actions are deleted before delivery,
- * and a failed delete prevents delivery. Serialization/storage failures never escape.
+ * Creates bounded, fail-soft transcript storage.
+ * Corrupt transcripts are cleared as a whole. Serialization/storage failures never escape.
  * Reject oversized stored envelopes before parsing, validate the whole message batch, then trim
  * oldest messages first. Circular serialization is fail-soft. Keys, limits, validator and Storage
  * are injected so separate controllers never accidentally share a product-selected namespace.
  * @complexity Load O(bytes + messages); save O(messages * serialized bytes) in the
- * worst trimming case; queue O(serialized action bytes). State is instance-local.
+ * worst trimming case. State is instance-local.
  */
 export function createBrowserSessionStore(args) {
-    const { storage, transcriptKey, actionKey, maxMessages, maxBytes, validateMessage } = args;
-    if (!transcriptKey || !actionKey || transcriptKey === actionKey) {
-        throw new Error('Transcript and action keys must be nonempty and distinct');
+    const { storage, transcriptKey, maxMessages, maxBytes, validateMessage } = args;
+    if (!transcriptKey) {
+        throw new Error('Transcript key must be nonempty');
     }
     if (!Number.isSafeInteger(maxMessages) || maxMessages < 0)
         throw new Error('Invalid message limit');
@@ -57,37 +56,6 @@ export function createBrowserSessionStore(args) {
             catch { /* The live conversation continues even when serialization or storage fails. */ }
         },
         clear,
-        enqueue({ action }) {
-            try {
-                const serialized = JSON.stringify(action);
-                if (serialized !== undefined)
-                    storage.setItem(actionKey, serialized);
-            }
-            catch { /* The live page continues without a queued action. */ }
-        },
-        drain(_args) {
-            let raw;
-            try {
-                raw = storage.getItem(actionKey);
-            }
-            catch {
-                return null;
-            }
-            if (raw === null)
-                return null;
-            try {
-                storage.removeItem(actionKey);
-            }
-            catch {
-                return null;
-            }
-            try {
-                return JSON.parse(raw);
-            }
-            catch {
-                return null;
-            }
-        },
     };
 }
 const utf8Bytes = (value) => new TextEncoder().encode(value).length;

package/dist/embed-widget/react/embed.d.ts

@@ -1,7 +1,6 @@
 import type { ChatTransport } from '../../core/transport.js';
 import type { ChatPaneAgent } from '../../react/chat-pane.js';
 import type { BrowserSessionStore } from '../browser/session-store.js';
-import type { PageActionPort } from '../../core/browser/page-actions.js';
 export { useEmbedChatDialog } from './dialog.hooks.js';
 import type { EmbedHeaderCopy, EscapeKeyPort } from './header.js';
 export { EmbedChatHeader } from './header.js';
@@ -10,18 +9,12 @@ export interface EmbedChatCopy extends EmbedHeaderCopy {
     readonly title: string;
     readonly fabLabel: string;
     readonly placeholder: string;
-    readonly proposalLabel: (args: {
-        title: string;
-    }) => string;
-    readonly proposalGo: string;
 }
 export interface EmbedChatWidgetArgs {
     readonly agent: ChatPaneAgent;
     readonly copy: EmbedChatCopy;
     readonly transport: ChatTransport;
     readonly session: BrowserSessionStore;
-    readonly pageActions: PageActionPort;
-    readonly directiveEventName: string;
     readonly keyboard: EscapeKeyPort;
     /** Schedules after host layout; returns cancellation. No browser global is captured. */
     readonly scheduleFrame: (args: {
@@ -29,10 +22,10 @@ export interface EmbedChatWidgetArgs {
     }) => () => void;
 }
 /**
- * Wires the existing pane/fab to per-instance transcript and page-action ports.
+ * Wires the existing pane/fab to per-instance transcript and transport ports.
  * Keep effect ports stable for the lifetime of a mounted widget; remount for a new
- * session/agent. Restored replies are marked processed before the pane mounts, so
- * rehydration cannot replay navigation. Reset remounts the pane after confirmation.
+ * session/agent. Page control lives on the shared frontend bridge, so transcript rehydration
+ * cannot replay effects. Reset remounts the pane after confirmation.
  * @complexity O(messages + latest reply events) per transcript update; O(message IDs) retained.
  */
 export declare function EmbedChatWidget(args: EmbedChatWidgetArgs): import("react").JSX.Element;

package/dist/embed-widget/react/embed.js

@@ -1,11 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useCallback, useEffect, useRef, useState } from 'react';
+import { useCallback, useEffect, useState } from 'react';
 import { createRoot } from 'react-dom/client';
-import { isTerminalRunStatus } from '../../core/messages.js';
 import { ChatPane } from '../../react/chat-pane.js';
 import { ChatFab } from '../../react/components/ChatFab.js';
 import { JiniChatProvider } from '../../react/components/JiniChatProvider.js';
-import { extractPageActions, splitPageActions, isQueuedPageAction } from '../../core/browser/page-actions.js';
 import { EmbedChatHeader } from './header.js';
 import { useEmbedChatSurface } from './dialog.hooks.js';
 export { useEmbedChatDialog } from './dialog.hooks.js';
@@ -14,71 +12,29 @@ const shellStyles = `
 .jini-chat-embed__panel { position:fixed; right:var(--jini-embed-right,24px); bottom:var(--jini-embed-bottom,88px); width:min(var(--jini-embed-width,440px),calc(100vw - 32px)); height:min(var(--jini-embed-height,620px),calc(100dvh - 120px)); z-index:var(--jini-embed-z-index,1000); display:flex; flex-direction:column; }
 .jini-chat-embed__panel[hidden] { display:none; }
 .jini-chat-embed__panel > .jini-chat-pane { flex:1; min-height:0; }
-.jini-chat-embed__reset-confirm,.jini-chat-embed__proposal { display:flex; align-items:center; gap:8px; }
-.jini-chat-embed__proposal { padding:12px; background:var(--jini-embed-proposal-background,Canvas); color:var(--jini-embed-proposal-color,CanvasText); }
+.jini-chat-embed__reset-confirm { display:flex; align-items:center; gap:8px; }
 `;
 /**
- * Wires the existing pane/fab to per-instance transcript and page-action ports.
+ * Wires the existing pane/fab to per-instance transcript and transport ports.
  * Keep effect ports stable for the lifetime of a mounted widget; remount for a new
- * session/agent. Restored replies are marked processed before the pane mounts, so
- * rehydration cannot replay navigation. Reset remounts the pane after confirmation.
+ * session/agent. Page control lives on the shared frontend bridge, so transcript rehydration
+ * cannot replay effects. Reset remounts the pane after confirmation.
  * @complexity O(messages + latest reply events) per transcript update; O(message IDs) retained.
  */
 export function EmbedChatWidget(args) {
-    const { agent, copy, transport, session, pageActions, directiveEventName, keyboard, scheduleFrame } = args;
+    const { agent, copy, transport, session, keyboard } = args;
     const [initial] = useState(() => session.load({}));
     const [paneKey, setPaneKey] = useState(0);
     const { open, toggle, panelRef, launcherRef, panelId } = useEmbedChatSurface({ initialOpen: initial.open }, { resetKey: paneKey });
     const [messages, setMessages] = useState(initial.messages);
-    const [pending, setPending] = useState(null);
-    const processed = useRef(new Set(initial.messages.map(message => message.id)));
     useEffect(() => { session.save({ state: { open, messages } }); }, [session, open, messages]);
-    useEffect(() => {
-        const queued = { value: session.drain({}) };
-        if (!isQueuedPageAction(queued) || queued.value.type === 'navigate')
-            return undefined;
-        const action = queued.value;
-        return scheduleFrame({ callback: () => { pageActions.execute({ action }); } });
-    }, [session, pageActions, scheduleFrame]);
-    useEffect(() => () => pageActions.clearHighlight({}), [pageActions]);
     const reset = useCallback(() => {
         session.clear({});
         setMessages([]);
         setPaneKey(key => key + 1);
-        setPending(null);
-        processed.current.clear();
     }, [session]);
-    const go = useCallback((proposal, transcript) => {
-        if (!pageActions.allows({ action: proposal.navigate }))
-            return;
-        if (proposal.bundled && pageActions.allows({ action: proposal.bundled }))
-            session.enqueue({ action: proposal.bundled });
-        // Both writes must finish before the host navigation can tear down this page.
-        session.save({ state: { open, messages: transcript } });
-        pageActions.navigate({ action: proposal.navigate });
-    }, [session, pageActions, open]);
-    const onMessagesChange = useCallback((next) => {
-        setMessages(next);
-        const latest = next.at(-1);
-        if (!latest || latest.role !== 'assistant' || !isTerminalRunStatus({ status: latest.runStatus }) || processed.current.has(latest.id))
-            return;
-        processed.current.add(latest.id);
-        setPending(null);
-        const actions = extractPageActions({ events: latest.events, directiveEventName })
-            .filter(action => pageActions.allows({ action }));
-        const { navigate, other } = splitPageActions({ actions });
-        if (!navigate) {
-            if (other)
-                pageActions.execute({ action: other });
-            return;
-        }
-        const proposal = { navigate, bundled: other };
-        if (navigate.auto)
-            go(proposal, next);
-        else
-            setPending(proposal);
-    }, [directiveEventName, pageActions, go]);
-    return _jsxs("div", { className: "jini-chat-embed", children: [_jsx("style", { children: shellStyles }), _jsx("div", { ref: launcherRef, tabIndex: -1, children: _jsx(ChatFab, { open: open, onToggle: toggle, "aria-label": copy.fabLabel, label: copy.fabLabel, "aria-controls": panelId, "aria-haspopup": "dialog" }) }), _jsx(JiniChatProvider, { transport: transport, children: _jsxs("div", { id: panelId, className: "jini-chat-embed__panel", hidden: !open, ref: panelRef, role: "dialog", "aria-modal": "true", "aria-label": copy.title, children: [_jsx(ChatPane, { transport: transport, agents: [agent], initialSelection: { agentId: agent.id }, initialMessages: messages, title: copy.title, placeholder: copy.placeholder, variant: "embed", header: _jsx(EmbedChatHeader, { title: copy.title, hasMessages: messages.length > 0, onReset: reset, copy: copy, keyboard: keyboard }), onMessagesChange: onMessagesChange }, paneKey), pending ? _jsxs("div", { className: "jini-chat-embed__proposal", children: [_jsx("span", { children: copy.proposalLabel({ title: pending.navigate.target.title }) }), _jsx("button", { type: "button", onClick: () => { setPending(null); go(pending, messages); }, children: copy.proposalGo })] }) : null] }) })] });
+    const onMessagesChange = useCallback((next) => { setMessages(next); }, []);
+    return _jsxs("div", { className: "jini-chat-embed", children: [_jsx("style", { children: shellStyles }), _jsx("div", { ref: launcherRef, tabIndex: -1, children: _jsx(ChatFab, { open: open, onToggle: toggle, "aria-label": copy.fabLabel, label: copy.fabLabel, "aria-controls": panelId, "aria-haspopup": "dialog" }) }), _jsx(JiniChatProvider, { transport: transport, children: _jsx("div", { id: panelId, className: "jini-chat-embed__panel", hidden: !open, ref: panelRef, role: "dialog", "aria-modal": "true", "aria-label": copy.title, children: _jsx(ChatPane, { transport: transport, agents: [agent], initialSelection: { agentId: agent.id }, initialMessages: messages, title: copy.title, placeholder: copy.placeholder, variant: "embed", header: _jsx(EmbedChatHeader, { title: copy.title, hasMessages: messages.length > 0, onReset: reset, copy: copy, keyboard: keyboard }), onMessagesChange: onMessagesChange }, paneKey) }) })] });
 }
 /** Mounts into a host-provided node and returns lifecycle cleanup. O(1) plus React rendering. */
 export function mountEmbedChat({ element, widget }) {

package/dist/embed-widget/vanilla/index.d.ts

@@ -13,10 +13,6 @@ export interface VanillaChatCopy {
     readonly confirm: string;
     readonly confirmDraft?: string;
     readonly keep: string;
-    readonly proposalGo: string;
-    readonly proposalLabel: (args: {
-        title: string;
-    }) => string;
     readonly thinking: string;
     readonly greeting?: string;
     readonly suggestionsLabel?: string;
@@ -53,7 +49,6 @@ export declare function mountVanillaChat(args: MountVanillaChatArgs, options?: {
         send({ text }: {
             text: string;
         }, _opts?: {}): Promise<boolean>;
-        acceptProposal(_input?: Record<string, never>, _opts?: {}): void;
         cancel(_input?: Record<string, never>, _opts?: {}): void;
         reset(_input?: Record<string, never>, _opts?: {}): void;
         dispose(_input?: Record<string, never>, _opts?: {}): void;