@jini-ai/chat 0.6.16 → 0.6.19

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 0.6.19
+
+- A direct MCP call (`mcp__<server>__X`, any CLI) shows as one row even when the MCP server normalized its arguments before the bridge saw them: once the CLI's own result has arrived, the call pairs by name with the bridge's `X` row between the two. Equal-input pairing still runs first across the turn; refusals and open calls never pair by name.
+- The chat model picker names raw catalog ids friendly ("Claude Opus 5.5", context and date suffixes kept), shows "Offline fallback" only once the live model list has actually failed rather than while the host is still probing, and closes on Escape from the menu or its trigger even when an ancestor stops the keydown.
+- A reply's "Done · time" runs from the person's send to the run's end for every CLI; the CLI's own reported duration, which leaves out its start-up wait, is only the fallback.
+- Keep failed tool receipts visible unless a matching canonical call also failed, including buffered CLI receipts.
+- Remove an obsolete hook lint directive for an uninstalled rule.
+- Document the two 0.6.x fetch fallback exceptions, inject fetch in repo hosts, and redact expiry/React callback exception logs.
+
+## 0.6.17
+
+### Patch Changes
+
+- Carry picked folders as per-message folder references, with draft and sent-message chips, persistence and replay.
+- Preserve ordinary typed paths while redacting glued-on secrets and slash-containing keys.
+- Handle npm 12 pack JSON through the shared parser in isolated-consumer tests.
+- Treat Node builtin dependencies as builtins when copying isolated runtime fixtures.
+
 ## 0.6.13
 
 ### Patch Changes

package/dist/core/accepted-input.d.ts

@@ -9,6 +9,8 @@ export interface AcceptedChatInput {
     answerText?: string;
     /** Absent for legacy/ordinary inputs; consumed only after a CLI UUID receipt. */
     deliveryState?: 'queued' | 'consumed';
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
     secretRedaction?: ChatMessage['secretRedaction'];
     /** Wire ids replaced by this receipt remain seen by recall. */
@@ -71,5 +73,15 @@ export declare function projectAcceptedInputEvents({ events }: {
 export declare function acceptedInputsFromMessages({ messages }: {
     messages: readonly ChatMessage[];
 }, _options?: {}): AcceptedChatInput[];
+/** Preserve folder metadata through existing event JSON storage; no attachment lifecycle or schema.
+ * Existing per-input receipts already own queued variants and must retain their identities.
+ */
+export declare function withFolderReceipt({ message }: {
+    message: ChatMessage;
+}, _options?: {}): ChatMessage;
+/** Hydrate the message's folder list from its accepted receipts after a database read. */
+export declare function foldersFromReceipts({ events }: {
+    events: unknown;
+}, _options?: {}): string[];
 export {};
 //# sourceMappingURL=accepted-input.d.ts.map

package/dist/core/accepted-input.js

@@ -17,9 +17,11 @@ export function projectAcceptedInputMessages({ messages }, _options = {}) {
             return [message];
         const turn = { ...message };
         delete turn.attachments;
+        delete turn.folders;
         delete turn.secretRedaction;
         // MOVE: Older receipts have no per-input files; retain those legacy files on the final bubble.
         return inputs.map((input, index) => ({ ...turn, id: input.id, content: input.text,
+            folders: input.folders ?? (index === inputs.length - 1 ? message.folders ?? [] : []),
             attachments: input.attachments ?? (index === inputs.length - 1 ? message.attachments ?? [] : []), ...(input.secretRedaction ? { secretRedaction: input.secretRedaction } : {}) }));
     });
 }
@@ -246,7 +248,7 @@ export function acceptedInputsFromMessages({ messages }, _options = {}) {
                 const input = acceptedInputEvent({ event });
                 return input ? [input.data] : [];
             });
-            return receipts.length > 0 ? receipts : [{ id: message.id, text: message.content }];
+            return receipts.length > 0 ? receipts : [{ id: message.id, text: message.content, ...(message.folders ? { folders: message.folders } : {}) }];
         }
         return projectAcceptedInputEvents({ events: message.events ?? [] }).flatMap(event => {
             const input = acceptedInputEvent({ event });
@@ -256,4 +258,30 @@ export function acceptedInputsFromMessages({ messages }, _options = {}) {
         });
     });
 }
+/** Preserve folder metadata through existing event JSON storage; no attachment lifecycle or schema.
+ * Existing per-input receipts already own queued variants and must retain their identities.
+ */
+export function withFolderReceipt({ message }, _options = {}) {
+    if (message.role !== 'user' || !message.folders?.length)
+        return message;
+    const events = message.events ?? [];
+    if (events.some(event => acceptedInputEvent({ event })))
+        return message;
+    return { ...message, events: [...events, acceptedInputUserEvent({ input: {
+                    id: message.id, text: message.content, folders: message.folders,
+                    ...(message.secretRedaction ? { secretRedaction: message.secretRedaction } : {}),
+                    ...(message.attachments ? { attachments: message.attachments } : {}),
+                } }, { receipt: 'accepted' })] };
+}
+/** Hydrate the message's folder list from its accepted receipts after a database read. */
+export function foldersFromReceipts({ events }, _options = {}) {
+    if (!Array.isArray(events))
+        return [];
+    return events.flatMap(event => {
+        if (event === null || typeof event !== 'object')
+            return [];
+        const folders = acceptedInputEvent({ event })?.data.folders;
+        return Array.isArray(folders) ? folders.filter((path) => typeof path === 'string') : [];
+    });
+}
 //# sourceMappingURL=accepted-input.js.map

package/dist/core/assistant-client/transport.js

@@ -375,6 +375,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
         return {
             messages: byokMessages({ history: input.history }, {}),
             ...attachmentIdsField(input),
+            ...(input.folders?.length ? { folders: input.folders } : {}),
             ...conversationIdField(input),
             agentPluginState: input.context?.["agentPluginState"],
             userPrompt: input.context?.["userPrompt"],
@@ -584,6 +585,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
             ...modelField(input),
             ...reasoningField(input),
             ...attachmentIdsField(input),
+            ...(input.folders?.length ? { folders: input.folders } : {}),
             ...pluginRefIdsField(input),
             agentPluginState: input.context?.["agentPluginState"],
             userPrompt: input.context?.["userPrompt"],

package/dist/core/events.d.ts

@@ -56,6 +56,12 @@ export type AgentEvent = {
     id: string;
     name: string;
     input: unknown;
+    bridgeCall?: {
+        name: string;
+        input: unknown;
+        buffered?: boolean;
+    };
+    toolOrigin?: 'bridge';
 } | {
     kind: 'tool_result';
     toolUseId: string;

package/dist/core/messages.d.ts

@@ -58,6 +58,8 @@ export interface ChatMessage {
     lastRunEventId?: string;
     startedAt?: number;
     endedAt?: number;
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
 }
 //# sourceMappingURL=messages.d.ts.map

package/dist/core/run-events/entry.js

@@ -5,8 +5,19 @@
  * Authenticated routing, ownership, boot repair and storage transactions remain host responsibilities. */
 import { decodeSseFrames, parseSseRecord } from "@jini-ai/core/primitives";
 import { assistantContentFromEvents } from "../assistant-content.js";
+import { recoverableSurfaceResource } from '../surface-recovery.js';
 import { mergeAdjacentTextEvents } from "../compact-events.js";
 import { dedupeToolUsesById } from "../tool-events.js";
+/** Retain executor-decoded display correlation through both live and saved chat reduction.
+ * Only the delegated bridge marks canonical rows; malformed optional metadata is ignored. O(1). */
+function toolCallCorrelation({ payload }) {
+    const call = payload.bridgeCall;
+    return {
+        ...(payload.toolOrigin === 'bridge' ? { toolOrigin: 'bridge' } : {}),
+        ...(isRecord(call) && typeof call.name === 'string' ? { bridgeCall: { name: call.name, input: call.input,
+                ...(call.buffered === true ? { buffered: true } : {}) } } : {}),
+    };
+}
 function wireString(v) {
     if (typeof v === "string")
         return v;
@@ -84,7 +95,8 @@ export function translateRunAgentPayload({ payload }, _options = {}) {
         case "thinking_delta":
             return { kind: "thinking", text: wireString(payload.delta) };
         case "tool_use":
-            return { kind: "tool_use", id: wireString(payload.id), name: wireString(payload.name), input: payload.input };
+            return { kind: "tool_use", id: wireString(payload.id), name: wireString(payload.name), input: payload.input,
+                ...toolCallCorrelation({ payload }) };
         case "tool_result":
             return toolResultEvent(payload);
         case "usage":
@@ -126,7 +138,8 @@ function translateEnvelopePayload(payload) {
         // worst possible failure for a confirmation dialog. Unwrapping here is what makes the two ends
         // meet. `name` must stay `"mcp-ui"` to match `MCP_UI_EXT_EVENT_NAME`.
         case "mcp-ui":
-            return { kind: "ext", name: "mcp-ui", data: payload.resource };
+            return { kind: "ext", name: "mcp-ui", data: recoverableSurfaceResource({ resource: payload.resource,
+                    exchange: 'surfaceExchange' in payload ? payload.surfaceExchange : undefined }) };
         // A2UI's own agent->renderer envelope (`@jini-ai/core`'s `SurfaceEmission` with
         // `channel: "a2ui"`, injected by `@jini-ai/daemon`'s `delegated-tool-bridge.ts` as
         // `{type: "a2ui", message: <AgentToRendererMessage>}`). Unwrapped to the bare `.message` here,

package/dist/core/surface-recovery.d.ts

@@ -0,0 +1,19 @@
+/** Wire metadata belongs to the channel adapter, never to rendered HTML or model context. */
+export declare const SURFACE_EXCHANGE_META = "jini/surface-exchange";
+export interface SurfaceRecoveryInfo {
+    readonly exchangeId: string;
+    readonly toolId: string;
+    readonly runId: string;
+}
+/** Read only server-issued exchange identity; original tool arguments never cross this boundary.
+ * @complexity O(1). */
+export declare function surfaceRecoveryInfo({ value }: {
+    value: unknown;
+}, _options?: {}): SurfaceRecoveryInfo | undefined;
+/** Preserve the existing bare-resource renderer contract while attaching recovery identity.
+ * @complexity O(1), shallow copies only. Malformed resources remain the renderer's responsibility. */
+export declare function recoverableSurfaceResource({ resource, exchange }: {
+    resource: unknown;
+    exchange: unknown;
+}, _options?: {}): unknown;
+//# sourceMappingURL=surface-recovery.d.ts.map

package/dist/core/surface-recovery.js

@@ -0,0 +1,26 @@
+/** Wire metadata belongs to the channel adapter, never to rendered HTML or model context. */
+export const SURFACE_EXCHANGE_META = 'jini/surface-exchange';
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Read only server-issued exchange identity; original tool arguments never cross this boundary.
+ * @complexity O(1). */
+export function surfaceRecoveryInfo({ value }, _options = {}) {
+    if (!record(value))
+        return undefined;
+    if (typeof value.exchangeId !== 'string' || typeof value.toolId !== 'string' || typeof value.runId !== 'string')
+        return undefined;
+    if (!value.exchangeId || !value.toolId || !value.runId)
+        return undefined;
+    return { exchangeId: value.exchangeId, toolId: value.toolId, runId: value.runId };
+}
+/** Preserve the existing bare-resource renderer contract while attaching recovery identity.
+ * @complexity O(1), shallow copies only. Malformed resources remain the renderer's responsibility. */
+export function recoverableSurfaceResource({ resource, exchange }, _options = {}) {
+    const info = surfaceRecoveryInfo({ value: exchange });
+    if (!info || !record(resource) || !record(resource.resource))
+        return resource;
+    const meta = record(resource.resource._meta) ? resource.resource._meta : {};
+    return { ...resource, resource: { ...resource.resource, _meta: { ...meta, [SURFACE_EXCHANGE_META]: info } } };
+}
+//# sourceMappingURL=surface-recovery.js.map

package/dist/core/tool-events.d.ts

@@ -45,9 +45,14 @@ export declare function isDelegatedWrapperToolName({ name }: {
  * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
  * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
  * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * Receipt and canonical failure states must match: a success cannot consume a failed row,
+ * and an identical successful or pending call cannot account for a refusal before the bridge,
+ * regardless of buffered receipt ordering.
  * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
  * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
- * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * before the CLI's own result for it; failing that, once that result has arrived, onto the first
+ * unclaimed same-name row between the two, since argument normalization can change the bridge's
+ * input (see {@link findCanonicalRow}). No canonical row is claimed twice, and a folded wrapper's
  * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
  * bridge, e.g. a read-only 403) stays, so its error is not hidden.
  *

package/dist/core/tool-events.js

@@ -61,15 +61,21 @@ function directMcpToolName({ name }) {
  * Antigravity's adapter-described wrappers require equal inner inputs but may arrive buffered.
  */
 function wrapperCall({ event }, _options = {}) {
-    const wrapper = toolPresentation(event).wrapper;
+    const wrapper = event.bridgeCall ?? toolPresentation(event).wrapper;
+    const bridgeOnly = event.bridgeCall !== undefined;
+    const buffered = bridgeOnly ? event.bridgeCall?.buffered === true : wrapper !== undefined;
     const call = wrapper ?? event;
     if (!isDelegatedWrapperToolName({ name: call.name })) {
         const name = wrapper ? wrapper.name : directMcpToolName({ name: call.name });
-        return name ? { name, input: call.input, matchInput: true, buffered: wrapper !== undefined } : undefined;
+        return name ? { name, input: call.input, matchInput: true, buffered, bridgeOnly } : undefined;
     }
-    const args = call.input !== null && typeof call.input === 'object' ? call.input : {};
-    const name = args.toolId;
-    return typeof name === 'string' && name ? { name, input: args.input, matchInput: wrapper !== undefined, buffered: wrapper !== undefined } : undefined;
+    const inner = delegatedCall({ input: call.input });
+    return inner ? { ...inner, matchInput: wrapper !== undefined, buffered, bridgeOnly } : undefined;
+}
+/** The shared delegated gateway contract, independent of the CLI's envelope. Pure, O(1). */
+function delegatedCall({ input }, _options = {}) {
+    const args = input !== null && typeof input === 'object' ? input : {};
+    return typeof args.toolId === 'string' && args.toolId ? { name: args.toolId, input: args.input } : undefined;
 }
 /**
  * Drop each delegated or direct MCP wrapper call that the daemon also reported as its own canonical row,
@@ -88,9 +94,14 @@ function wrapperCall({ event }, _options = {}) {
  * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
  * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
  * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * Receipt and canonical failure states must match: a success cannot consume a failed row,
+ * and an identical successful or pending call cannot account for a refusal before the bridge,
+ * regardless of buffered receipt ordering.
  * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
  * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
- * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * before the CLI's own result for it; failing that, once that result has arrived, onto the first
+ * unclaimed same-name row between the two, since argument normalization can change the bridge's
+ * input (see {@link findCanonicalRow}). No canonical row is claimed twice, and a folded wrapper's
  * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
  * bridge, e.g. a read-only 403) stays, so its error is not hidden.
  *
@@ -106,19 +117,24 @@ export function foldDelegatedWrapperCalls({ events }, _options = {}) {
         return [];
     const claimed = new Set();
     const folded = new Set();
-    events.forEach((event, i) => {
-        if (event.kind !== 'tool_use')
-            return;
-        const call = wrapperCall({ event });
-        // A replayed wrapper (same id) must not claim a second canonical row.
-        if (call === undefined || folded.has(event.id))
-            return;
-        const match = findCanonicalRow({ events, wrapper: event, wrapperIndex: i, call, claimed });
-        if (match === -1)
-            return;
-        claimed.add(match);
-        folded.add(event.id);
-    });
+    const failedResults = new Set(events.flatMap(event => event.kind === 'tool_result' && event.isError ? [event.toolUseId] : []));
+    // Equal inputs pair first across the whole turn, so a by-name pairing never takes the row an
+    // exact match needed; only then may a direct call pair by name inside its closed window.
+    for (const byName of [false, true]) {
+        events.forEach((event, i) => {
+            if (event.kind !== 'tool_use')
+                return;
+            const call = wrapperCall({ event });
+            // A replayed wrapper (same id) must not claim a second canonical row.
+            if (call === undefined || folded.has(event.id))
+                return;
+            const match = findCanonicalRow({ events, wrapper: event, wrapperIndex: i, call, claimed, failedResults }, { byName });
+            if (match === -1)
+                return;
+            claimed.add(match);
+            folded.add(event.id);
+        });
+    }
     if (folded.size === 0)
         return events;
     return events.filter((event) => !((event.kind === 'tool_use' && folded.has(event.id)) ||
@@ -127,29 +143,60 @@ export function foldDelegatedWrapperCalls({ events }, _options = {}) {
 /**
  * Index of the first unclaimed canonical row in the wrapper's matching window, or -1. Legacy gateways match
  * on name alone; direct calls and adapter-described wrappers also require equal inner input.
+ *
+ * `byName` (the second pass) lets a direct `mcp__<server>__X` call pair with a same-name row whose
+ * input differs, but only inside a CLOSED window: after the call and before the CLI's own result for
+ * it. The MCP server normalizes arguments before the bridge sees them (an integer string read as the
+ * integer, an alias renamed, see `@jini-ai/mcp`'s `tool-arguments.ts`), so the bridge row's input is
+ * not always the CLI's (demo practice run, 2026-11-02: every such call showed twice). The CLI's result
+ * only returns after the bridge row its call caused, so a same-name row in that window is that call.
+ * An open window (no CLI result yet) and buffered or legacy wrappers never pair by name.
  * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
  * @complexity O(n·s): n events, s canonical input serialization cost.
  */
-function findCanonicalRow({ events, wrapper, wrapperIndex, call, claimed }) {
-    const inputKey = call.matchInput ? canonicalJson({ value: { input: call.input } }) : undefined;
-    const [start, end] = canonicalSearchWindow({ events, wrapper, wrapperIndex, call });
+function findCanonicalRow({ events, wrapper, wrapperIndex, call, claimed, failedResults }, { byName = false } = {}) {
+    const [start, end, closed] = canonicalSearchWindow({ events, wrapper, wrapperIndex, call });
+    const match = matchRule({ call, byName, closed });
+    if (match === undefined)
+        return -1;
+    const inputKey = match.compareInput ? canonicalJson({ value: { input: call.input } }) : undefined;
+    const wrapperFailed = failedResults.has(wrapper.id);
     for (let j = start; j < end; j += 1) {
         const other = events[j];
-        if (claimed.has(j) || other.kind !== 'tool_use' || other.name !== call.name)
-            continue;
-        if (inputKey === undefined || canonicalJson({ value: { input: other.input } }) === inputKey)
+        if (!claimed.has(j) && isCandidateRow({ other, call, wrapperFailed, failedResults, inputKey }))
             return j;
     }
     return -1;
 }
+/** How one pass matches `call`, or undefined when this pass must skip it. Pass two (`byName`) only
+ * revisits direct calls whose window is closed; everything else already had its chance. Pure; O(1). */
+function matchRule({ call, byName, closed }, _options = {}) {
+    if (!byName)
+        return { compareInput: call.matchInput };
+    return closed && call.matchInput && !call.buffered ? { compareInput: false } : undefined;
+}
+/** Whether `other` is an unclaimed row's possible canonical twin: a same-name `tool_use` with the same
+ * outcome and, when `inputKey` is given, structurally equal input. Pure; O(s) input serialization. */
+function isCandidateRow({ other, call, wrapperFailed, failedResults, inputKey }, _options = {}) {
+    if (other.kind !== 'tool_use' || other.name !== call.name)
+        return false;
+    // Adapter-proposed bare/native matches must be bridge rows, never independent CLI executions.
+    if (call.bridgeOnly && other.toolOrigin !== 'bridge')
+        return false;
+    // Outcome parity keeps successes from consuming failed rows and duplicating later refusals.
+    if (wrapperFailed !== failedResults.has(other.id))
+        return false;
+    return inputKey === undefined || canonicalJson({ value: { input: other.input } }) === inputKey;
+}
 /** Pure matching bounds within one turn; O(n) time, O(1) space for n events.
  * Antigravity's buffered receipts cannot establish arrival/result boundaries. Direct MCP calls
  * retain their later-only window so a completed/refused call cannot consume a separate retry.
+ * `closed` is true only when the CLI's own result ends the window (the by-name pass needs it).
  */
 function canonicalSearchWindow({ events, wrapper, wrapperIndex, call }, _options = {}) {
     if (call.buffered)
-        return [0, events.length];
+        return [0, events.length, false];
     const resultIndex = !call.matchInput ? -1 : events.findIndex(other => other.kind === 'tool_result' && other.toolUseId === wrapper.id);
-    return [wrapperIndex + 1, resultIndex === -1 ? events.length : resultIndex];
+    return resultIndex === -1 ? [wrapperIndex + 1, events.length, false] : [wrapperIndex + 1, resultIndex, true];
 }
 //# sourceMappingURL=tool-events.js.map

package/dist/core/transport.d.ts

@@ -57,6 +57,8 @@ export interface StartRunInput {
     history: ChatMessage[];
     agentId?: string;
     conversationId?: string | null;
+    /** Picked directory paths, kept byte-exact and separate from upload references. */
+    folders?: string[];
     attachments?: ChatAttachment[];
     context?: RunContext;
     /** Stops the browser-side subscription; the run continues host-side. */

package/dist/core/turn-usage.d.ts

@@ -40,7 +40,7 @@ export declare function turnUsage({ events }: {
     agentId?: string;
 }): UsageEvent | undefined;
 /** Derive per-turn charges and prefix totals from persisted events_json, for live and reloaded
- * chats alike. Single replies without reported duration use the message's elapsed run time.
+ * chats alike. A single reply's duration is the message's elapsed run time, from send to finish.
  * A message with mid-run replies also gets per-reply `segments`. O(e + m) for e events
  * and m messages; no per-row transcript scans or I/O.
  * @example conversationUsage({ messages: savedMessages }).get('assistant-2') */

package/dist/core/turn-usage.js

@@ -113,7 +113,7 @@ function addUsage({ total, usage }, _optional = {}) {
     return next;
 }
 /** Derive per-turn charges and prefix totals from persisted events_json, for live and reloaded
- * chats alike. Single replies without reported duration use the message's elapsed run time.
+ * chats alike. A single reply's duration is the message's elapsed run time, from send to finish.
  * A message with mid-run replies also gets per-reply `segments`. O(e + m) for e events
  * and m messages; no per-row transcript scans or I/O.
  * @example conversationUsage({ messages: savedMessages }).get('assistant-2') */
@@ -157,9 +157,11 @@ function messageUsage({ message, sessions, totalCostUsd }, _optional = {}) {
     }
     return { usage, segments, totalCostUsd: prefixTotal };
 }
-/** Use the message's elapsed run time when no reply reported a duration; invalid timestamps stay unknown. */
+/** Time one reply from the person's send (`startedAt`) to the run's end, the same way for every CLI.
+ * A CLI's own reported duration leaves out its start-up wait (Claude Code said 42 s for a turn that took
+ * 46.5 s from send to finish), so it is only the fallback when the timestamps are missing or invalid. */
 function fillRunDuration({ usage, message }, _optional = {}) {
-    if (usage.durationMs !== undefined || message.startedAt === undefined || message.endedAt === undefined)
+    if (message.startedAt === undefined || message.endedAt === undefined)
         return;
     const durationMs = message.endedAt - message.startedAt;
     if (Number.isFinite(durationMs) && durationMs >= 0)

package/dist/core/user-text-redaction.js

@@ -25,6 +25,24 @@ function entropy(text) {
     }
     return bits;
 }
+/** Recognize identifier paths, including the fragment after a space in a typed path.
+ * Require multiple segments and readable words: arbitrary base64 and long digit-mixed runs
+ * must still reach the entropy guard. Specific credential rules have already run. */
+function isIdentifierPath({ text }, _options = {}) {
+    const segments = text.replace(/^(?:[a-z]:|~)?[\\/]*/i, '').split(/[\\/]/).filter(Boolean);
+    return segments.length >= 2 && segments.every(segment => /^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/.test(segment)
+        || segment.split(/[-_.]/).every(word => /^[A-Z]$/.test(word)
+            || /^[A-Z]?[a-z]{2,}(?:[A-Z][a-z]{2,}|[0-9]{1,4}(?=[A-Z][a-z]{2,}|$))*$/.test(word)));
+}
+/** A piece of a random key: long, both letter cases, and a character-class change at most positions.
+ * Readable names (CamelCase, SCREAMING_CASE, dated file names) change class far less often, and
+ * every piece of a 40-character base64 key split by '/' is 12+ characters in most keys. */
+function isOpaqueSegment(segment) {
+    if (segment.length < 12 || !/[A-Z]/.test(segment) || !/[a-z]/.test(segment))
+        return false;
+    const changes = segment.match(/[A-Z](?=[^A-Z])|[a-z](?=[^a-z])|\d(?=\D)/g)?.length ?? 0;
+    return changes / (segment.length - 1) >= 0.4;
+}
 /** Stricter than error redaction: also detects unlabelled long tokens, while retaining ordinary URLs,
  * filesystem paths, hexadecimal hashes, identifiers and prose. Strong credential syntax inside
  * URLs or paths is still caught. */
@@ -42,15 +60,23 @@ export function redactUserText({ text }, { secretField = false } = {}) {
     const base = redactSecretShapes({ text: protectedText, policy: { additionalRules: CHAT_RULES } });
     let count = base.redactions;
     // Exempt locations only AFTER specific secret rules. Only quoted paths may contain whitespace;
-    // unquoted paths end there so an adjacent slash-bearing secret cannot inherit the exemption.
+    // unquoted paths and URLs end there, and at , | ; and invisible separators, so an adjacent
+    // secret glued after them cannot inherit the exemption.
     // A quoted path ends at its first matching quote, which must sit on a word boundary, so an
     // apostrophe later in the line ("don't") cannot close an unterminated quote and exempt the gap.
     // Require a root boundary so a slash inside an opaque token cannot exempt that token, and a
     // folder after the root so a bare "/" + token is not mistaken for a path.
-    const locations = [...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+|(?<!\w)(["'`])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\r\n"'`\\/]+[\\/](?:(?!\1)[^\r\n])*\1(?!\w)|(?<![\w+\/=\\~.-])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\s<>"'`\\/]+[\\/][^\s<>"'`]*/gi)]
-        .map(match => ({ start: match.index, end: match.index + match[0].length }));
+    const locations = [
+        ...[...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`,|;\u200B-\u200D\uFEFF]+|(?<!\w)(["'`])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\r\n"'`\\/]+[\\/](?:(?!\1)[^\r\n])*\1(?!\w)|(?<![\w+\/=\\~.-])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\s<>"'`,|;\u200B-\u200D\uFEFF\\/]+[\\/][^\s<>"'`,|;\u200B-\u200D\uFEFF]*/gi)]
+            .map(match => ({ match, url: /^[a-z][a-z0-9+.-]*:\/\//i.test(match[0]) })),
+        // The part of a hand-typed unquoted path after a space (Work/CustomerPortal…) has no root.
+        ...[...base.text.matchAll(/[^\s<>"'`,|;\u200B-\u200D\uFEFF]+/g)]
+            .filter(match => isIdentifierPath({ text: match[0] })).map(match => ({ match, url: false })),
+    ].map(({ match, url }) => ({ start: match.index, end: match.index + match[0].length, url }));
     let cleaned = base.text.replace(/(?<![A-Za-z0-9_+\/=-])[A-Za-z0-9_+\/=-]{40,}(?![A-Za-z0-9_+\/=-])/g, (candidate, offset) => {
-        if (locations.some(location => offset >= location.start && offset < location.end))
+        const location = locations.find(span => offset >= span.start && offset + candidate.length <= span.end);
+        // A key glued straight onto a path (/proj/KEY) is still checked; URLs keep their opaque ids.
+        if (location && (location.url || !candidate.split(/[\\/]/).some(isOpaqueSegment)))
             return candidate;
         if (/^[a-f0-9]+$/i.test(candidate) || !/[A-Za-z]/.test(candidate))
             return candidate;

package/dist/embed-widget/browser/frontend-session-bridge.d.ts

@@ -72,9 +72,22 @@ export interface FrontendSessionBridge {
         sessionId: string;
         bindToken: string;
     }>;
+    /**
+     * Ensure a connection and wait for its current attachment; an already live binding is reused.
+     * Call after successful host activation. Unlike `ready`, prior readiness cannot satisfy this wait.
+     * Cancellation rejects only this caller's wait; park/failure/close rejects all current waiters.
+     * @example await bridge.rebind({ signal }, {});
+     * @complexity O(1) per waiter; one shared stream, no automatic reconnect after park/failure.
+     */
+    rebind(required?: {
+        signal?: AbortSignal;
+    }, optional?: Record<string, never>): Promise<{
+        sessionId: string;
+        bindToken: string;
+    }>;
     /**
      * The token for the attachment that is live *now*, or `undefined` before the first attach and
-     * after {@link FrontendSessionBridge.close}. Read it at run-start; see the module doc.
+     * after park, suspension, failure or {@link FrontendSessionBridge.close}. Read it at run-start.
      */
     bindToken(): string | undefined;
     close(): void;