@jini-ai/chat 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.23
+
+- Security hardening.
+
 ## 0.6.22
 
 - The full CLI access notice shows once per conversation, also after replay or remount.

package/dist/core/assistant-client/ag-ui-transport.js

@@ -1,10 +1,16 @@
 import { EventType } from "@ag-ui/core";
 import { createAgUiToAgentTranslationState, translateAgUiEventToAgentEvent } from "../ag-ui/entry.js";
-/** Only the originating attachment can authorize page execution. Read its token for every turn;
- * caller-supplied tool definitions never authorize or execute a transcript event. */
+/** Only the originating attachment can authorize page execution. Read its token and tab for every
+ * turn; caller-supplied tool definitions never authorize or execute a transcript event.
+ * @complexity O(1) time and space.
+ * @overallScore 100 */
 function frontendBinding({ input }, _options = {}) {
     const token = input.context?.["frontendBindToken"];
-    return typeof token === "string" && token.length > 0 ? { frontendBindToken: token } : {};
+    const tabId = input.context?.["frontendTabId"];
+    return {
+        ...(typeof token === "string" && token.length > 0 ? { frontendBindToken: token } : {}),
+        ...(typeof tabId === "string" && tabId.length > 0 ? { frontendTabId: tabId } : {}),
+    };
 }
 /** Bind the official client without adding its dependency to every chat consumer. */
 export function createAgUiRunClient({ ports }, _options = {}) {

package/dist/core/assistant-client/transport.js

@@ -458,18 +458,25 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
      * and a spread would let any future `runContext` key silently shadow it — an identity field being
      * overwritten by a UI prop is not a failure mode worth leaving open to save one line.
      *
-     * Returns `{}` (omitting the field entirely) when absent, which is a normal state, not an error:
+     * The tab id accompanies the token so the host can verify the session owner before binding.
+     * @complexity O(1) time and space.
+     * @overallScore 100
+     * Returns `{}` (omitting the fields entirely) when absent, which is a normal state, not an error:
      * the daemon treats a run with no bind token as one with no screen to drive
      * (`agent-daemon-server.ts`).
      */
-    function frontendBindTokenField(input) {
+    function frontendBindingFields(input) {
         const frontendBindToken = input.context?.["frontendBindToken"];
-        return typeof frontendBindToken === "string" && frontendBindToken.length > 0 ? { frontendBindToken } : {};
+        const frontendTabId = input.context?.["frontendTabId"];
+        return {
+            ...(typeof frontendBindToken === "string" && frontendBindToken.length > 0 ? { frontendBindToken } : {}),
+            ...(typeof frontendTabId === "string" && frontendTabId.length > 0 ? { frontendTabId } : {}),
+        };
     }
     /**
      * The Local CLI picker's live model selection, from `ChatPane`'s `runContext` prop
      * (`AssistantDock.tsx`'s `resolveRunContext`). Same "read by name, not spread" reasoning as
-     * {@link frontendBindTokenField} above, and the same "omit when absent" convention. Forwarded as an
+     * {@link frontendBindingFields} above, and the same "omit when absent" convention. Forwarded as an
      * opaque string — `agent-daemon-server.ts` forwards it the same way, and `AgentExecutor.run()`'s
      * def-level `buildArgs` is what decides what an absent or `'default'` value means for a given CLI
      * (`@jini-ai/agent-runtime`'s `models.ts`/`resolveModelForAgent`).
@@ -498,7 +505,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
      * re-validated paths via `AttachmentStore.claim()`. Nothing on this side of the wire is trusted; the
      * id is inert until the daemon claims it.
      *
-     * Returns `{}`, same convention as {@link frontendBindTokenField} above — a run with no attachments
+     * Returns `{}`, same convention as {@link frontendBindingFields} above — a run with no attachments
      * is the overwhelmingly common case and should not carry a key for it.
      */
     function attachmentIdsField(input) {
@@ -509,7 +516,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
     /**
      * Opaque Agent Plugin ids (`plugin.json`'s own `name`, e.g. `"ui-ux-design"`) the operator has
      * pinned as composer chips — `AssistantDock.tsx`'s `useSelectedAgentPlugins`, threaded here via
-     * `ChatPane`'s `runContext` prop the same way {@link frontendBindTokenField}/{@link modelField}
+     * `ChatPane`'s `runContext` prop the same way {@link frontendBindingFields}/{@link modelField}
      * above already are. Same "read by name, not spread" and "omit when absent" conventions as those
      * two fields: this is not the plugin's CONTENT, only a reference to it —
      * `agent-daemon-server.ts`'s `onStarted` is where a ref gets resolved against the real installed
@@ -528,7 +535,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
     }
     /**
      * The active conversation id, from `ChatPane`'s `runContext` prop (`AssistantDock.tsx`'s
-     * `chats.activeId`, the same `useRunContext` seam {@link frontendBindTokenField}/{@link modelField}/
+     * `chats.activeId`, the same `useRunContext` seam {@link frontendBindingFields}/{@link modelField}/
      * {@link pluginRefIdsField} above already ride). Lets `agent-daemon-server.ts`'s `onStarted` resume
      * this conversation's agent-CLI session across turns instead of spawning cold every time
      * (`server/inbound/assistant/agent-session-resume.ts`) — see that file's own doc. Returns `{}`, same
@@ -581,7 +588,7 @@ export function createAssistantTransportClient({ ports }, _options = {}) {
             // daemon JSON boundary. Replaying an old signal reports another paste on every later turn.
             ...(newestUserMessage({ history: input.history }, {})?.secretRedaction?.secretRedacted ? { secretRedacted: true } : {}),
             assistantMessageId: input.assistantMessageId,
-            ...frontendBindTokenField(input),
+            ...frontendBindingFields(input),
             ...modelField(input),
             ...reasoningField(input),
             ...attachmentIdsField(input),

package/dist/core/durable-runs/ports.d.ts

@@ -1,5 +1,5 @@
 import type { AgentEvent, ChatMessage } from "../index.js";
-import type { RunRef, RunSettlement } from "./run-contracts.js";
+import type { RunProgress, RunRef, RunSettlement } from "./run-contracts.js";
 export interface AcceptedRunRequest {
     readonly agentId?: string;
     readonly contextRef: string;
@@ -122,6 +122,9 @@ export interface RecoveryPorts {
         run: DurableRun;
         request: AcceptedRunRequest;
     }, optional: {}) => Promise<void>;
+    /** Save a launch-response diagnostic without declaring the uncertain attempt dead. Uses the
+     * host's existing fenced ledger checkpoint; no new storage format or polling is required. */
+    readonly checkpoint?: (required: RunProgress, optional: {}) => Promise<boolean>;
     readonly cancelAttempt: (required: DurableRun, optional: {}) => Promise<void>;
     readonly verifyChildDead: (required: {
         pid: number;

package/dist/embed-widget/browser/frontend-session-bridge.d.ts

@@ -109,4 +109,22 @@ export declare function openFetchFrontendStream({ url, headers }: {
     fetch?: typeof globalThis.fetch;
     reconnectMs?: number;
 }): Pick<EventSource, 'addEventListener' | 'close'>;
+export interface FrontendNavigationGuard {
+    noteNavigation(): void;
+    preparePageInput(required: {
+        action: ChatPaneAgentToolAction;
+    }): Record<string, unknown>;
+    onBeforeResponse(required: {
+        action: ChatPaneAgentToolAction;
+        output: unknown;
+    }): unknown;
+}
+/** Fence a protected browser effect to the exact view in which its human card was proposed.
+ * Hosts call noteNavigation synchronously for every navigation, including a return to an old URL.
+ * Internal metadata is checked and removed before the page capability's public schema sees it.
+ * @returns Existing bridge callbacks plus the host-owned navigation notification.
+ * @complexity O(input keys) time/space per prepared action; O(1) retained revision counter.
+ * @overallScore 100
+ */
+export declare function createFrontendNavigationGuard(_required: Record<string, never>, _optional?: Record<string, never>): FrontendNavigationGuard;
 //# sourceMappingURL=frontend-session-bridge.d.ts.map

package/dist/embed-widget/browser/frontend-session-bridge.js

@@ -454,4 +454,31 @@ async function assertFrontendResponse({ response, invocationId, body, scoped, re
             throw new Error('Page invocation expired or was cancelled; no action was taken');
     }
 }
+/** Fence a protected browser effect to the exact view in which its human card was proposed.
+ * Hosts call noteNavigation synchronously for every navigation, including a return to an old URL.
+ * Internal metadata is checked and removed before the page capability's public schema sees it.
+ * @returns Existing bridge callbacks plus the host-owned navigation notification.
+ * @complexity O(input keys) time/space per prepared action; O(1) retained revision counter.
+ * @overallScore 100
+ */
+export function createFrontendNavigationGuard(_required, _optional = {}) {
+    let revision = 0;
+    return {
+        noteNavigation: () => { revision += 1; },
+        preparePageInput: ({ action }) => {
+            const { __frontendNavigationRevision: expected, ...input } = action.input;
+            if (Object.hasOwn(action.input, '__frontendNavigationRevision') && (!Number.isSafeInteger(expected) || expected !== revision)) {
+                throw new Error('The page changed while confirmation was pending; propose this action again.');
+            }
+            return input;
+        },
+        onBeforeResponse: ({ action, output }) => {
+            if (action.capabilityId !== 'page.find_elements')
+                return output;
+            if (output === null || typeof output !== 'object' || Array.isArray(output))
+                return output;
+            return { ...output, navigationRevision: revision };
+        },
+    };
+}
 //# sourceMappingURL=frontend-session-bridge.js.map

package/dist/react/components/MessageRow.js

@@ -187,16 +187,23 @@ function UserMessageRow({ message, renderAttachment }) {
     const gallery = useAttachmentGallery({ attachments: message.attachments ?? NO_ATTACHMENTS });
     return (_jsxs("div", { className: "jini-message jini-message-user", "data-message-id": message.id, "data-agent-element": `chat-message-${message.id}`, "data-agent-role": "region", "data-agent-label": "A message from the user", children: [(message.attachments?.length || message.folders?.length) ? (_jsxs("div", { className: "jini-message-attachments", children: [_jsx(FolderChips, { folders: message.folders }), (message.attachments ?? []).map((a) => (_jsx(SentAttachmentButton, { attachment: a, onOpen: gallery.open, renderAttachment: renderAttachment }, a.path)))] })) : null, _jsx("div", { className: "jini-message-content", children: message.content }), _jsx("div", { className: "jini-message-actions jini-message-actions--user", children: _jsx(CopyMessageButton, { text: message.content, label: t('Copy message') }) }), gallery.opened ? (_jsx(AttachmentPreviewModal, { attachment: gallery.opened, onClose: gallery.close, navigation: gallery.navigation })) : null] }));
 }
+// A validated extension may already show the explanation. Keep the generic fallback when its
+// renderer is absent or refuses the payload, so malformed history never hides a failed turn.
+function assistantTerminalNotice({ message, runStreaming, runSucceeded, extGroups, registry }, _options = {}) {
+    const extensionExplainsFailure = !runStreaming && !runSucceeded && extGroups.some(group => registry.hasTerminalNotice(group));
+    return extensionExplainsFailure ? null : terminalMessageNotice({ message }, {});
+}
+/** Only a completed reply without footer usage can own the final inline usage label. */
+function lastFinishedReplyIndex({ runInProgress, usage }, _options = {}) {
+    return !runInProgress && !usage.footer ? usage.replies.findLastIndex(value => value !== undefined) : -1;
+}
 function AssistantMessageRow({ showAccessNotice = true, message, usageSummary, showUsageTotal, showUsageLine, toolCallDisplay, showThinking, runStreaming, runSending, sendingLabel, runSucceeded, questionFormInteractive, questionFormSubmittedAnswers, onQuestionFormSubmit, projectFileNames, onRequestOpenFile, }) {
     const registry = useExtEventRendererRegistry();
     const messageUsage = useMessageUsage({ message, ...(usageSummary === undefined ? {} : { summary: usageSummary }) });
     const timeline = useToolTimeline({ events: message.events }, { runStreaming, runSucceeded });
     const extGroups = useExtEventGroups({ events: message.events }, { slotOf: (name, data) => registry.slot({ name, data }) });
     const answeredCards = useAnsweredCards({ slotOf: registry.slot, events: message.events ?? [], groups: extGroups, runStreaming, runStatus: message.runStatus });
-    // A validated extension may already show the explanation. Keep the generic fallback when its
-    // renderer is absent or refuses the payload, so malformed history never hides a failed turn.
-    const extensionExplainsFailure = !runStreaming && !runSucceeded && extGroups.some(group => registry.hasTerminalNotice(group));
-    const terminalNotice = extensionExplainsFailure ? null : terminalMessageNotice({ message }, {});
+    const terminalNotice = assistantTerminalNotice({ message, runStreaming, runSucceeded, extGroups, registry });
     const visibleContent = stripArtifact({ content: message.content });
     const displayBlocks = messageBlocks({ message, rows: timeline.rows, registry }, { toolCallDisplay, includeThinking: showThinking });
     // Artifact stripping trims/replaces text, invalidating the event offsets for rendering. Keep the
@@ -209,7 +216,7 @@ function AssistantMessageRow({ showAccessNotice = true, message, usageSummary, s
         runStreaming: runStreaming && !isTerminalRunStatus({ status: message.runStatus }),
     });
     const footerUsage = showUsageLine ? usage.footer : undefined;
-    const lastFinishedReply = !runInProgress && !usage.footer ? usage.replies.findLastIndex(value => value !== undefined) : -1;
+    const lastFinishedReply = lastFinishedReplyIndex({ runInProgress, usage });
     const retriedRows = retriedToolRowIds({ rows: timeline.rows });
     const renderToolCard = (row) => (_jsx(ToolCard, { retried: retriedRows.has(row.id), use: row.use, result: row.result, runStreaming: runStreaming, runSucceeded: runSucceeded, ...(projectFileNames !== undefined ? { projectFileNames } : {}), ...(onRequestOpenFile !== undefined ? { onRequestOpenFile } : {}) }, row.id));
     // Hidden mode reuses the same disclosure and card renderer for unrecovered failures.

package/dist/react/features/chat-pane/components/AgentRuntimePicker.js

@@ -34,7 +34,7 @@ function NativeToolPolicyWarning({ agent, policy, isApi }) {
     if (!agent || isApi)
         return null;
     const warning = policy ? assessNativeToolPolicy({ def: agent, policy }) : null;
-    return _jsxs(_Fragment, { children: [agent.fullCliAccessNote ? _jsx(FullAccessNoteTip, { note: agent.fullCliAccessNote, t: t }) : null, warning ? _jsx("p", { role: "alert", children: t(warning) }) : null] });
+    return _jsxs(_Fragment, { children: [agent.fullCliAccessNote ? _jsx(FullAccessNoteTip, { note: agent.fullCliAccessNote, t: t }) : null, warning ? _jsx(InfoTip, { label: t(warning), triggerLabel: t('Agent permissions required'), placement: "top", icon: _jsx(RemixIcon, { name: "alert-line", size: 16 }) }) : null] });
 }
 function RuntimeModeButtons({ executionMode, daemonOnline, apiModeAvailable, onExecutionModeChange, t, }) {
     const localModeLabel = executionMode === 'local' ? t('active') : '';

package/dist/react/features/chat-pane/components/ChatPane.js

@@ -363,6 +363,7 @@ export function ChatPane(props) {
             uploadAttachments: p.uploadAttachments,
             onActivityChange: p.onActivityChange,
             onMessagesChange: p.onMessagesChange,
+            subscribeToSurfaces: p.subscribeToSurfaces,
             redactUserText: p.redactUserText,
             onSecretRedacted: p.onSecretRedacted,
             workingDirectory: p.workingDirectory,

package/dist/react/features/chat-pane/create-frontend-request-caller.d.ts

@@ -0,0 +1,23 @@
+import type { SurfaceEmission } from '@jini-ai/core';
+export interface FrontendRequestCallerRequired {
+    readonly path: string;
+    readonly fetch: typeof globalThis.fetch;
+    readonly bindToken: () => string | undefined;
+    readonly onSurface: (emission: SurfaceEmission) => void;
+}
+export interface FrontendRequestInput {
+    readonly capabilityId: string;
+    readonly input: Record<string, unknown>;
+    readonly signal: AbortSignal;
+}
+/** Execute one browser-requested capability through the host's authenticated gate, never retrying.
+ * The current bind token and serialized arguments are captured before the first asynchronous wait.
+ * @returns A caller that renders cards immediately and resolves only after the tool settles.
+ * @throws On absent attachment, HTTP refusal, cancellation or an incomplete execution stream.
+ * @complexity O(request + response bytes) time; O(largest response frame) space, capped at 5 MiB.
+ * @overallScore 100
+ */
+export declare function createFrontendRequestCaller({ path, fetch, bindToken, onSurface }: FrontendRequestCallerRequired, { headers }?: {
+    headers?: () => Record<string, string>;
+}): (required: FrontendRequestInput, optional?: Record<string, never>) => Promise<unknown>;
+//# sourceMappingURL=create-frontend-request-caller.d.ts.map

package/dist/react/features/chat-pane/create-frontend-request-caller.js

@@ -0,0 +1,56 @@
+import { readSurfaceFrames } from './surface-recovery-stream.js';
+/** Execute one browser-requested capability through the host's authenticated gate, never retrying.
+ * The current bind token and serialized arguments are captured before the first asynchronous wait.
+ * @returns A caller that renders cards immediately and resolves only after the tool settles.
+ * @throws On absent attachment, HTTP refusal, cancellation or an incomplete execution stream.
+ * @complexity O(request + response bytes) time; O(largest response frame) space, capped at 5 MiB.
+ * @overallScore 100
+ */
+export function createFrontendRequestCaller({ path, fetch, bindToken, onSurface }, { headers = () => ({}) } = {}) {
+    return async ({ capabilityId, input, signal }, _optional = {}) => {
+        const token = bindToken();
+        if (!token)
+            throw new Error('Page control has not attached to this browser tab. Reopen the assistant to retry.');
+        const response = await fetch(path, { method: 'POST', credentials: 'same-origin',
+            headers: { ...headers(), 'content-type': 'application/json' },
+            body: JSON.stringify({ capabilityId, input, bindToken: token }), signal,
+        });
+        if (!response.ok) {
+            const body = await response.json();
+            throw new Error(body.error ?? `The page request was refused (HTTP ${response.status}).`);
+        }
+        let completed = false;
+        let output;
+        await readSurfaceFrames({ response, onFrame: frame => {
+                switch (frame.type) {
+                    case 'surface':
+                        if (frame.emission)
+                            onSurface(frame.emission);
+                        return;
+                    case 'throw':
+                        throw new Error(frame.error?.message ?? 'The page action could not be executed.');
+                    case 'result':
+                        if (completed)
+                            throw new Error('The page action returned more than one result.');
+                        output = completedOutput(frame.result);
+                        completed = true;
+                        return;
+                    default: return;
+                }
+            } });
+        if (!completed)
+            throw new Error('The page action ended without a result. Its outcome is unknown; it was not retried.');
+        return output;
+    };
+}
+/** Only a completed gated execution has an output; refusals keep the host's specific message.
+ * @complexity O(1) time and space.
+ * @overallScore 100
+ */
+function completedOutput(value) {
+    const result = value;
+    if (result?.status !== 'completed')
+        throw new Error(result?.error ?? `The page action was ${result?.status ?? 'not completed'}.`);
+    return result.output;
+}
+//# sourceMappingURL=create-frontend-request-caller.js.map

package/dist/react/features/chat-pane/hooks/useChatPane.hooks.d.ts

@@ -1,4 +1,5 @@
 import { type AcceptedChatInput } from '../../../../core/accepted-input.js';
+import type { SurfaceEmission } from '@jini-ai/core';
 import type { UserTextRedactionOptions } from '../../../../core/user-text-redaction.js';
 import { type ChatPaneSendBlocker } from '../rules.js';
 import type { ChatPaneActivity, ChatPaneAgent, ChatPaneAttachmentUploadOptions, ChatPaneAgentSelection, ChatPaneRunContext, ChatPaneWorkingDirectoryAccess, DeliverMidRunMessage, DeliverTypedAnswer, TypedAnswerNotice } from '../types.js';
@@ -28,6 +29,7 @@ export interface UseChatPaneOptions extends UserTextRedactionOptions {
     uploadAttachments?: (files: File[], options?: ChatPaneAttachmentUploadOptions) => Promise<ChatAttachment[]>;
     onActivityChange?: (activity: ChatPaneActivity) => void;
     onMessagesChange?: (messages: ChatMessage[]) => void;
+    subscribeToSurfaces?: (listener: (emission: SurfaceEmission) => void) => () => void;
     workingDirectory?: string | null;
     initialWorkingDirectory?: string | null;
     onChangeWorkingDirectory?: (workingDirectory: string | null) => void;

package/dist/react/features/chat-pane/hooks/useChatPane.hooks.js

@@ -246,6 +246,14 @@ export function useChatPane(options) {
             // absent), so only the falsy "no agent selected" case should omit the key.
             agentId: selection.agentId || undefined,
         } }));
+    useEffect(() => options.subscribeToSurfaces?.(emission => {
+        // Browser-requested cards are not agent turns and cannot supply run/answer authority.
+        const data = emission.channel === 'mcp-ui' ? emission.payload.resource : emission.payload;
+        conversation.setMessages(messages => [...messages, {
+                id: createChatLocalId({}), role: 'assistant', content: '', createdAt: Date.now(),
+                events: [{ kind: 'ext', name: emission.channel, data }],
+            }]);
+    }), [options.subscribeToSurfaces, conversation.setMessages]);
     const composer = useComposer(definedProps({ source: {
             initialDraft: options.initialDraft,
             historyMessages: conversation.messages,

package/dist/react/features/chat-pane/surface-recovery-stream.d.ts

@@ -1,7 +1,15 @@
 import type { SurfaceEmission } from '@jini-ai/core';
-/** Read bounded NDJSON frames as they arrive: waiting for response.text() would hide the very
- * card the held request is waiting on. The final frame is value-free, never the tool result.
- * @complexity O(response bytes), O(largest frame) space, capped at 5 MiB per frame.
+/** Read bounded NDJSON frames as they arrive; waiting for response.text() would hide a held card.
+ * @complexity O(response bytes) time; O(largest frame) space, capped at 5 MiB per frame.
+ * @overallScore 100
+ */
+export declare function readSurfaceFrames({ response, onFrame }: {
+    response: Response;
+    onFrame: (frame: Record<string, unknown>) => void;
+}, _options?: {}): Promise<void>;
+/** Restore cards through the same bounded stream reader used by runless frontend requests.
+ * @complexity O(response bytes) time; O(largest frame) space.
+ * @overallScore 100
  */
 export declare function readSurfaceRecoveryStream({ response, onSurface }: {
     response: Response;

package/dist/react/features/chat-pane/surface-recovery-stream.js

@@ -1,22 +1,22 @@
-/** Read bounded NDJSON frames as they arrive: waiting for response.text() would hide the very
- * card the held request is waiting on. The final frame is value-free, never the tool result.
- * @complexity O(response bytes), O(largest frame) space, capped at 5 MiB per frame.
+/** Read bounded NDJSON frames as they arrive; waiting for response.text() would hide a held card.
+ * @complexity O(response bytes) time; O(largest frame) space, capped at 5 MiB per frame.
+ * @overallScore 100
  */
-export async function readSurfaceRecoveryStream({ response, onSurface }, _options = {}) {
+export async function readSurfaceFrames({ response, onFrame }, _options = {}) {
     const reader = response.body?.getReader();
     if (!reader)
-        throw new Error('The restored card stream is unavailable.');
+        throw new Error('The interactive page response stream is unavailable.');
     const decoder = new TextDecoder();
     let buffer = '';
-    let restored = false;
     const accept = (text) => {
         if (!text.trim())
             return;
+        if (text.length > 5 * 1024 * 1024)
+            throw new Error('The interactive card is too large.');
         const frame = JSON.parse(text);
-        if (frame.type === 'surface' && frame.emission)
-            onSurface?.(frame.emission);
-        if (frame.type === 'restored')
-            restored = frame.ok === true;
+        if (!frame || typeof frame !== 'object' || Array.isArray(frame))
+            throw new Error('The interactive response contains an invalid frame.');
+        onFrame(frame);
     };
     try {
         for (;;) {
@@ -24,24 +24,34 @@ export async function readSurfaceRecoveryStream({ response, onSurface }, _option
             buffer += decoder.decode(chunk.value, { stream: !chunk.done });
             const lines = buffer.split('\n');
             buffer = lines.pop();
-            for (const line of lines) {
-                if (line.length > 5 * 1024 * 1024)
-                    throw new Error('The restored card is too large.');
+            for (const line of lines)
                 accept(line);
-            }
             if (buffer.length > 5 * 1024 * 1024)
-                throw new Error('The restored card is too large.');
+                throw new Error('The interactive card is too large.');
             if (chunk.done)
                 break;
         }
         accept(buffer);
-        if (!restored)
-            throw new Error('The card could not be restored.');
-        return { delivered: true };
     }
     finally {
         await reader.cancel();
         reader.releaseLock();
     }
 }
+/** Restore cards through the same bounded stream reader used by runless frontend requests.
+ * @complexity O(response bytes) time; O(largest frame) space.
+ * @overallScore 100
+ */
+export async function readSurfaceRecoveryStream({ response, onSurface }, _options = {}) {
+    let restored = false;
+    await readSurfaceFrames({ response, onFrame: frame => {
+            if (frame.type === 'surface' && frame.emission)
+                onSurface?.(frame.emission);
+            if (frame.type === 'restored')
+                restored = frame.ok === true;
+        } });
+    if (!restored)
+        throw new Error('The card could not be restored.');
+    return { delivered: true };
+}
 //# sourceMappingURL=surface-recovery-stream.js.map

package/dist/react/features/chat-pane/types.d.ts

@@ -1,3 +1,4 @@
+import type { SurfaceEmission } from '@jini-ai/core';
 import type { UserTextRedactionOptions } from '../../../core/user-text-redaction.js';
 import type { NativeToolPolicyInput } from '@jini-ai/agent-runtime/native-tool-policy';
 import type { CSSProperties, ReactNode, RefObject } from 'react';
@@ -226,6 +227,8 @@ export interface ChatPaneProps extends UserTextRedactionOptions {
     onActivityChange?: (activity: ChatPaneActivity) => void;
     /** Fires with the full message list whenever it changes — the read side of an otherwise write-only pane, for a host that needs to inspect or test what the conversation actually contains. */
     onMessagesChange?: (messages: ChatMessage[]) => void;
+    /** Host-only request surfaces enter the current transcript through its existing sandbox renderer. */
+    subscribeToSurfaces?: (listener: (emission: SurfaceEmission) => void) => () => void;
     onRescanAgents?: () => void;
     scanningAgents?: boolean;
     daemonOnline?: boolean;

package/dist/react/index.d.ts

@@ -154,8 +154,8 @@ export type { JiniChatProviderProps, JiniChatSlots } from './components/JiniChat
  * `createDomPageDriver`/`currentAgentPage` moved to `@jini-ai/agentic/dom` in the 2026-07-26
  * extraction — re-exported here so existing `@jini-ai/chat-react` importers keep working.
  */
-export { createFrontendSessionBridge } from './agent-bridge/frontend-session-bridge.js';
-export type { FrontendSessionBridge, FrontendSessionBridgeArgs, FrontendSessionBridgeOptions, } from './agent-bridge/frontend-session-bridge.js';
+export { createFrontendSessionBridge, createFrontendNavigationGuard } from './agent-bridge/frontend-session-bridge.js';
+export type { FrontendSessionBridge, FrontendNavigationGuard, FrontendSessionBridgeArgs, FrontendSessionBridgeOptions, } from './agent-bridge/frontend-session-bridge.js';
 export { createDomPageDriver, currentAgentPage, type DomPageDriverOptions } from '@jini-ai/agentic/dom';
 export { createBrowserComposerHistoryStorage } from './hooks/composer-history-storage.js';
 export type { ComposerHistoryStoragePort } from '../core/composer-history.js';
@@ -175,4 +175,6 @@ export type { AgentPluginUsage, AgentPluginUsage as Usage } from '../core/agent-
 export { acceptedInputEvent, acceptedInputUserEvent, projectAcceptedInputEvents } from '../core/accepted-input.js';
 export type { AcceptedChatInput } from '../core/accepted-input.js';
 export { isAwaitingAnswer } from '../core/run-activity.js';
+export { createFrontendRequestCaller } from './features/chat-pane/create-frontend-request-caller.js';
+export type { FrontendRequestCallerRequired, FrontendRequestInput } from './features/chat-pane/create-frontend-request-caller.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/index.js

@@ -133,7 +133,7 @@ export { JiniChatProvider, useJiniChatSlots, useOnFeedback } from './components/
  * `createDomPageDriver`/`currentAgentPage` moved to `@jini-ai/agentic/dom` in the 2026-07-26
  * extraction — re-exported here so existing `@jini-ai/chat-react` importers keep working.
  */
-export { createFrontendSessionBridge } from './agent-bridge/frontend-session-bridge.js';
+export { createFrontendSessionBridge, createFrontendNavigationGuard } from './agent-bridge/frontend-session-bridge.js';
 export { createDomPageDriver, currentAgentPage } from '@jini-ai/agentic/dom';
 export { createBrowserComposerHistoryStorage } from './hooks/composer-history-storage.js';
 // ChatPane consumers share the same redaction and draft/preview state owners.
@@ -147,4 +147,5 @@ export { isTerminalRunStatus } from '../core/messages.js';
 export { AGENT_PLUGIN_STATE_CHANGED, readAgentPluginChatState, writeAgentPluginChatState } from '../core/agent-plugin-chat-state.js';
 export { acceptedInputEvent, acceptedInputUserEvent, projectAcceptedInputEvents } from '../core/accepted-input.js';
 export { isAwaitingAnswer } from '../core/run-activity.js';
+export { createFrontendRequestCaller } from './features/chat-pane/create-frontend-request-caller.js';
 //# sourceMappingURL=index.js.map

package/dist/server/durable-runs/recover.js

@@ -1,5 +1,5 @@
 import { recoveredRunEvents } from "../../core/index.js";
-import { classifyAgentServiceFailure } from "@jini-ai/agent-runtime";
+import { classifyAgentServiceFailure, startupFailureMessage } from "@jini-ai/agent-runtime";
 import { continuationRequest } from "../../core/durable-runs/continuation.js";
 import { isAwaitingAnswer } from "../../core/run-activity.js";
 import { RECOVERY_LIMIT, RUN_STALENESS_MS, SAVED_WORK_NOTICE, AWAITING_ANSWER_NOTICE, EXHAUSTED_NOTICE } from "../../core/durable-runs/policies.js";
@@ -73,6 +73,11 @@ function attemptFailure({ diagnostics }, _optional = {}) {
 }
 /** Keep the notice bounded and scoped to the same executor diagnostics as failure classification. */
 function lastDiagnosticLine({ diagnostics }, _optional = {}) {
+    // Startup evidence is already bounded, but redact again for older saved events. Keep the
+    // complete stage/cause block; a last-line/300-character tail erased its useful context.
+    const startup = diagnostics.lastIndexOf('Startup stage:');
+    if (startup >= 0)
+        return startupFailureMessage({ stage: 'saved startup failure', error: diagnostics.slice(startup) }, {});
     return diagnostics.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1)?.slice(0, 300);
 }
 function attemptFailureDetail({ run }, _optional = {}) {
@@ -130,6 +135,23 @@ function continuesNow({ run, trigger, now }, _optional = {}) {
 /** Recovery coordinator behind explicit host ports. One CAS owns both the attempt and its conversation slot.
  * Each recovery decision logs one `logger.info` line (default console) of run metadata. */
 export function createDurableRecovery(ports, { logger = console } = {}) {
+    /** Replay starts from attemptBase. Carry this attempt's saved launch notice into it too, so
+     * reconnect/reload cannot replace that evidence with the daemon's shorter replay prefix.
+     * O(e) in saved events; no additional store read, write, or polling. */
+    function attach(run) {
+        const events = run.message.events ?? [];
+        const noticeIndex = lastIndexWhere({ events, match: event => event.kind === 'status' && event.code === 'run_launch_unconfirmed' });
+        const marker = lastIndexWhere({ events, match: event => event.kind === 'status' && event.code === 'run_recovering' });
+        if (noticeIndex <= marker) {
+            ports.attach(run, {});
+            return;
+        }
+        const notice = events[noticeIndex];
+        const base = [...run.attemptBase];
+        if (!base.includes(notice))
+            base.push(notice);
+        ports.attach({ ...run, attemptBase: base }, {});
+    }
     async function finalize(run, notice, { canceled = false, detail } = {}) {
         await ports.cancelAttempt(run, {}).catch(() => undefined);
         // Persist the notice as an event: hook errors are live-only and would leave a reloaded
@@ -145,15 +167,30 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
             return false;
         return ports.verifyChildDead(run.child, {}).catch(() => false);
     }
+    /** Persist rejection evidence but leave liveness and retry decisions to the existing probe. */
     async function launchNext({ run, next, native }, _optional = {}) {
+        let stage = 'recovery launch';
         try {
             await ports.launch({ run: next, request: continuationRequest({ run: { ...run, message: next.message, transcript: next.transcript }, native }, {}) }, {});
+            stage = 'recovery clock';
             await ports.store.recoveryClock({ runId: next.runId, now: ports.now(), active: false }, {});
         }
-        catch {
+        catch (error) {
             // A rejected/lost start response is uncertain: the daemon may already be executing. The
             // same idempotent attempt is probed by the attached watcher before another CAS is possible.
+            const diagnostic = { kind: 'status', code: 'run_launch_unconfirmed',
+                label: 'The assistant start response was not confirmed. Checking whether this attempt is running.',
+                detail: startupFailureMessage({ stage, error }, {
+                    notice: 'The assistant start response was not confirmed. Wait while this attempt is checked.',
+                }) };
+            const events = [...(next.message.events ?? []), diagnostic];
+            // Preserve the saved answer and all prior events in the existing projection write. The
+            // checkpoint's generation fence rejects a concurrent stop or successor attempt.
+            await ports.checkpoint?.({ conversationId: next.conversationId, messageId: next.messageId,
+                runId: next.runId, content: next.message.content, events }, {}).catch(() => false);
+            return { ...next, message: { ...next.message, events } };
         }
+        return next;
     }
     async function continueDead(run) {
         await ports.cancelAttempt(run, {}).catch(() => undefined);
@@ -172,8 +209,8 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
             return "superseded";
         if (next.cancelReason)
             return finalize(next, STOPPED_NOTICE, { canceled: true });
-        await launchNext({ run, next, native });
-        ports.attach(next, {});
+        const launched = await launchNext({ run, next, native });
+        attach(launched);
         return "continued";
     }
     async function probeAttempt({ run, trigger, liveRunId }, _optional = {}) {
@@ -185,7 +222,7 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
     }
     async function reattach(run) {
         await ports.store.recoveryClock({ runId: run.runId, now: ports.now(), active: false }, {});
-        ports.attach(run, {});
+        attach(run);
         return "reattached";
     }
     async function finalizeFailure({ run, failure, diagnostics }, _optional = {}) {
@@ -259,7 +296,7 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
         // Give that idempotent launch time to appear before a 404 can advance its generation.
         if (continuesNow({ run, trigger, now: ports.now() }))
             return continueDead(run);
-        ports.attach(run, {});
+        attach(run);
         return "waiting";
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/chat",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Jini's chat/artifact frontend, consolidated into one package with two subpaths: framework-free chat vocabulary and pure parsers in `/core`, headless hooks + presentational components + slots in `/react`. Import only the layer you need.",
   "license": "Apache-2.0",
   "repository": {
@@ -214,8 +214,8 @@
   },
   "dependencies": {
     "kysely": "^0.29.6",
-    "@jini-ai/core": "^0.6.22",
-    "@jini-ai/agentic": "^0.6.19",
+    "@jini-ai/core": "^0.6.23",
+    "@jini-ai/agentic": "^0.6.23",
     "@jini-ai/diagnostics": "^0.6.22",
     "@jini-ai/db": "^0.6.19"
   },
@@ -261,12 +261,12 @@
     "pg": "8.23.0",
     "@ag-ui/core": "0.0.58",
     "fast-check": "4.3.0",
-    "@jini-ai/agent-runtime": "0.6.22",
-    "@jini-ai/agentic": "^0.6.19",
+    "@jini-ai/agentic": "^0.6.23",
+    "@jini-ai/agent-runtime": "0.6.23",
+    "@jini-ai/ui": "^0.6.23",
+    "@jini-ai/core": "^0.6.23",
     "@jini-ai/protocol": "^0.6.19",
-    "@jini-ai/core": "^0.6.22",
     "@jini-ai/diagnostics": "^0.6.22",
-    "@jini-ai/ui": "^0.6.22",
     "@jini-ai/db": "0.6.19"
   },
   "typesVersions": {