jefrichat-mcp 0.49.51 → 0.49.53

package/dist/http.js

@@ -67197,8 +67197,34 @@ function parseInlineDataUrl(dataUrl) {
 }
 var optionalFileString = external_exports.string().nullish().transform((value) => value ?? void 0);
 var REMOTE_FILE_GUIDANCE = "REMOTE connector (ChatGPT, Claude, or another cloud assistant): choose exactly ONE file source. (1) File in YOUR OWN sandbox: check its decoded byte size first. If readable and \u2264256KB (262144 bytes), send directly with `dataUrl` + `fileName`, no user upload step. This includes PDFs, CSVs, code, and small images. Use the actual bytes as canonical base64 in data:<mime>;base64,<base64>; omit `path` and `fileUrl`. (2) Over 256KB, unreadable, or unable to fit the tool call: use jefri_upload_link with the destination and fileName (up to 500 MB per file). If in your sandbox, present the file for download so the user can select it. Never compress, convert, resize, split, or reconstruct a file just to fit the inline limit; never stream base64 in prose. (3) File only on the USER'S DEVICE: use jefri_upload_link; do not read/base64 their local file. (4) An existing public http(s) URL \u2192 `fileUrl` (\u226425MB). Never invent a URL or pass sandbox:/file: URLs. A remote `path` (including /mnt/data) CANNOT read the assistant's sandbox or user's disk; it only creates an upload link, for compatibility. Link creation is NOT file delivery. Omit unused arguments (null is also accepted). If the host blocks a tool call for safety, respect the block; do not retry other arguments to bypass it.";
-var fileSendSchema = (local) => ({
-  path: optionalFileString.describe(local ? "Local file path to read and send directly, e.g. ~/Downloads/report.pdf. Do not combine with dataUrl or fileUrl." : "Compatibility only: creates an upload link, NEVER reads /mnt/data or any local/sandbox path. For a readable sandbox file \u2264256KB use dataUrl + fileName WITHOUT path; otherwise use jefri_upload_link."),
+function hostFileUploadEnabled(ctx) {
+  return ctx.local === false && ctx.credentialLookup?.kind === "profile" && capsForCtx(ctx).has(CAP.REMOTE_SANDBOX) && (ctx.credentialLookup.profile === "grok_bot" || ctx.credentialLookup.profile === "muse");
+}
+var HOST_FILE_GUIDANCE = "Grok Bot/Muse REMOTE connector: choose by where the original file bytes live and the tools actually available. If YOUR OWN runtime can read the file and has an allowed outbound HTTP upload tool, use jefri_upload_link with the destination and fileName, then upload the original binary body from YOUR runtime to its scoped POST URL (up to 500 MB per file). Do not ask the user to re-upload a file you can upload yourself. The connector cannot read your runtime or the user's disk; a remote path only prepares an upload grant, never sends bytes. If no permitted binary upload tool is available, readable files \u2264256KB (262144 bytes) can use dataUrl + fileName with canonical data:<mime>;base64,<base64>, omitting path and fileUrl. Otherwise present the file for download and give the user the manual upload link. Files only on the USER'S DEVICE also need that manual upload. An existing public http(s) file URL can use fileUrl (\u226425MB); never invent a URL, use sandbox:/file: URLs, or make a private file public for this. Choose exactly ONE source; omit unused arguments (null is also accepted). Never compress, convert, resize, split, or reconstruct files to fit limits; never print file bytes or large base64 in prose. Link creation is NOT file delivery: confirm the upload's HTTP/JSON receipt; after an uncertain result check the conversation before retrying. Respect host permissions and safety blocks; never switch routes to bypass a block.";
+function hostUploadUrl(raw, hub) {
+  if (typeof raw !== "string") return null;
+  try {
+    const u = new URL(raw);
+    const base = new URL(hub);
+    return (u.protocol === "https:" || u.protocol === "http:") && u.origin === base.origin && !u.username && !u.password && !u.search && !u.hash && /^\/api\/files\/upload\/[a-f0-9]{48}$/.test(u.pathname) ? u.href : null;
+  } catch {
+    return null;
+  }
+}
+function hostUploadInstructions(uploads, where, mins, manualUrl, command) {
+  return `Upload prepared for ${where}. No file has been sent yet. Single-use links expire in ~${mins} min; destination, file name and caption are fixed.
+${JSON.stringify({ uploads })}
+
+First check each file's actual size (up to 500 MB) and verify that YOUR OWN runtime can read it and has an allowed outbound HTTP upload tool. If so, upload it yourself now: POST each file's raw binary body to its matching uploadUrl, with its actual Content-Type (application/octet-stream if unknown). No multipart, no base64, no Authorization header, and no redirects. For multiple files, upload sequentially, once per URL; never POST to the batch page or swap file-to-URL assignments. Keep grant URLs private; never send your Jefri token. Use a bounded request with no blind automatic retries. ` + (command ? `If your runtime has an allowed shell AND this exact file, the command is:
+${command}
+
+` : "") + `Confirm each delivery only after HTTP success AND JSON ok === true with the delivery id; a prepared link is not success. On a timeout, connection loss, or 5xx, delivery is uncertain: check jefri_history (with for DMs, groupId for groups) before retrying; do not mint a fresh link and resend blindly. A 409/already-used response is not a new delivery. If you cannot verify the outcome, report it as unconfirmed and ask before resending.
+
+If no permitted binary upload tool exists: readable files \u2264256KB can use dataUrl + fileName via jefri_send_file (jefri_send_group_file for groups); larger/unreadable files need the manual link: ${manualUrl}
+For manual upload, present a runtime file for download first so the user can pick it. A file only on the user's device requires their upload. Never claim this connector can read their disk or your runtime. Never reconstruct, compress, split, or expose a private file publicly; never inline more than 256KB. Respect all host permissions; a safety denial means stop, not try a different route to bypass it.`;
+}
+var fileSendSchema = (local, hostUpload = false) => ({
+  path: optionalFileString.describe(local ? "Local file path to read and send directly, e.g. ~/Downloads/report.pdf. Do not combine with dataUrl or fileUrl." : hostUpload ? "Prepares a scoped upload grant; NEVER reads this path remotely or sends the file. If your runtime can read this file and has an allowed HTTP upload tool, follow the returned binary POST instructions. Otherwise use the manual link." : "Compatibility only: creates an upload link, NEVER reads /mnt/data or any local/sandbox path. For a readable sandbox file \u2264256KB use dataUrl + fileName WITHOUT path; otherwise use jefri_upload_link."),
   caption: optionalFileString.describe("optional text caption"),
   dataUrl: optionalFileString.describe(local ? "Small content generated in-conversation, max 256KB decoded. Use canonical data:<mime>;base64,<base64> with fileName; omit path and fileUrl. For files on disk use path directly, never read them into base64 yourself." : "Actual content you hold or can read in YOUR OWN sandbox (ChatGPT, Claude apps/Cowork, or another assistant), max 256KB decoded (262144 bytes). Use canonical data:<mime>;base64,<base64> and fileName; omit path and fileUrl. Never base64 a file on the USER machine. Never reconstruct missing bytes or inline files over the cap."),
   fileUrl: optionalFileString.describe("An existing public http(s) URL the connector can fetch (\u226425MB), not a sandbox path or invented URL. Do not combine with path or dataUrl."),
@@ -67211,8 +67237,8 @@ function fileSourceError(args) {
     return "A nonblank `fileName` is required with `dataUrl`. Nothing was sent.";
   return null;
 }
-function missingFileSource(local) {
-  return "Provide exactly one file source: `path`, `dataUrl` + `fileName` (\u2264256KB), or a public `fileUrl`. " + (local ? "On this LOCAL connector, prefer path to send directly from disk." : REMOTE_FILE_GUIDANCE);
+function missingFileSource(local, hostUpload = false) {
+  return "Provide exactly one file source: `path`, `dataUrl` + `fileName` (\u2264256KB), or a public `fileUrl`. " + (local ? "On this LOCAL connector, prefer path to send directly from disk." : hostUpload ? HOST_FILE_GUIDANCE : REMOTE_FILE_GUIDANCE);
 }
 var MINT_LINK_DEADLINE_MS = (() => {
   const n = Number(process.env.MCP_MINT_LINK_DEADLINE_MS);
@@ -67299,6 +67325,17 @@ async function remoteUploadCommand(c, ctx, target, path4, caption, where, signal
       clearTimeout(gKiller);
       if (signal) signal.removeEventListener("abort", onHostAbort);
     }
+    if (hostFileUploadEnabled(ctx)) {
+      const scoped = hostUploadUrl(uploadUrl, hub);
+      if (!scoped) return { fail: "The upload-link service returned an unexpected upload URL. No file has been sent; do not upload to it." };
+      return { ok: hostUploadInstructions(
+        [{ fileName: fname, uploadUrl: scoped }],
+        where,
+        mins,
+        scoped,
+        `curl --silent --show-error --fail-with-body --connect-timeout 15 --max-time 300 -X POST ${shq(scoped)} -H ${shq(`Content-Type: ${fmime}`)} --data-binary @${shPathArg(path4)}`
+      ) };
+    }
     {
       return {
         ok: `This cloud connector can't read that path. No file has been sent.
@@ -67321,6 +67358,9 @@ Never base64 anything over 256KB through dataUrl \u2014 that is minutes of model
     }
   } catch {
   }
+  if (hostFileUploadEnabled(ctx)) return {
+    fail: "The upload-link service did not provide a usable grant. No file has been sent. Do not upload or expose your token. Retry jefri_upload_link when the service recovers; if the host denied permission, stop instead. " + HOST_FILE_GUIDANCE
+  };
   const web = hub.replace("acp-hub.", "acp-web.").replace(":4000", ":4321");
   const dropLink = target.to ? `${web}/?to=${encodeURIComponent(target.to)}` : `${web}/?group=${encodeURIComponent(target.groupId)}`;
   const q = (target.to ? `to=${encodeURIComponent(target.to)}` : `groupId=${encodeURIComponent(target.groupId)}`) + `&fileName=${encodeURIComponent(fname)}` + (caption ? `&caption=${encodeURIComponent(caption)}` : "");
@@ -68272,6 +68312,8 @@ function ackStandbyDelivered(id4) {
   }
 }
 function registerAcpTools(server2, ctx) {
+  const hostFileUpload = hostFileUploadEnabled(ctx);
+  const remoteFileGuidance = hostFileUpload ? HOST_FILE_GUIDANCE : REMOTE_FILE_GUIDANCE;
   const desktopHeadlessOnly = isHeadlessOnlyDesktop(ctx.credentialLookup?.kind === "profile" ? ctx.credentialLookup.profile : ctx.profile);
   const autonomyProfile = ctx.credentialLookup?.kind === "profile" ? ctx.credentialLookup.profile : ctx.profile;
   const backgroundOnly = isBackgroundOnlyAutonomyProfile(autonomyProfile);
@@ -68709,12 +68751,12 @@ ${fp}`);
     "jefri_upload_link",
     {
       title: "Get an upload link (any file up to 500 MB, full quality)",
-      description: "Get a ONE-TAP UPLOAD LINK to send files or images \u2014 up to 5 PER LINK via `fileNames`, up to 500 MB each, FULL quality, no base64, no compression, no path needed. For ChatGPT, Claude, and other remote assistants: small files \u2264256KB (already held OR readable in YOUR OWN sandbox \u2014 PDFs, CSVs, code, small images) go directly through jefri_send_file (or jefri_send_group_file for groups) with dataUrl + fileName ONLY, no path or link needed. Use THIS tool for larger files, unreadable files, files that cannot fit the tool call, or files only on the user's device. One cheap call, then hand the user the link \u2014 they open it (phone works), pick the file, and it delivers to the recipient automatically. Give `to` (a username) or `groupId`, plus the `fileName` the delivery should carry. The link is single-use and expires in ~15 minutes; mint a fresh one any time. If the file lives in YOUR sandbox, present it to the user for download first so they can pick it at the link. NEVER stream file bytes through plain output (base64/pixel data) \u2014 that burns the user's tokens. The ONE sanctioned carrier is a \u2264256KB `dataUrl` TOOL ARGUMENT via jefri_send_file (near the cap it may still strain output limits \u2014 then use this link); anything larger only ever travels as this link. Creating the link is NOT delivery \u2014 the user must upload the file. Respect host safety blocks; do not use another route to bypass one. Omit unused fields or pass null.",
+      description: hostFileUpload ? "Prepare scoped upload URLs, up to 5 files via fileNames (500 MB each). Give to OR groupId, plus fileName OR fileNames. Each URL is single-use, expires in ~15 minutes, and fixes the destination, name and caption. " + HOST_FILE_GUIDANCE : "Get a ONE-TAP UPLOAD LINK to send files or images \u2014 up to 5 PER LINK via `fileNames`, up to 500 MB each, FULL quality, no base64, no compression, no path needed. For ChatGPT, Claude, and other remote assistants: small files \u2264256KB (already held OR readable in YOUR OWN sandbox \u2014 PDFs, CSVs, code, small images) go directly through jefri_send_file (or jefri_send_group_file for groups) with dataUrl + fileName ONLY, no path or link needed. Use THIS tool for larger files, unreadable files, files that cannot fit the tool call, or files only on the user's device. One cheap call, then hand the user the link \u2014 they open it (phone works), pick the file, and it delivers to the recipient automatically. Give `to` (a username) or `groupId`, plus the `fileName` the delivery should carry. The link is single-use and expires in ~15 minutes; mint a fresh one any time. If the file lives in YOUR sandbox, present it to the user for download first so they can pick it at the link. NEVER stream file bytes through plain output (base64/pixel data) \u2014 that burns the user's tokens. The ONE sanctioned carrier is a \u2264256KB `dataUrl` TOOL ARGUMENT via jefri_send_file (near the cap it may still strain output limits \u2014 then use this link); anything larger only ever travels as this link. Creating the link is NOT delivery \u2014 the user must upload the file. Respect host safety blocks; do not use another route to bypass one. Omit unused fields or pass null.",
       inputSchema: {
         to: optionalFileString.describe("recipient username (or use groupId)"),
         groupId: optionalFileString.describe("group id (from jefri_groups) instead of `to`"),
         fileName: optionalFileString.describe("the name the delivered file should carry, e.g. photo.png (single file)"),
-        fileNames: external_exports.array(external_exports.string()).nullish().transform((value) => value ?? void 0).describe('for a MULTI-file link (2\u20135): the delivery names in order, e.g. ["foto-1.jpg","foto-2.jpg"] \u2014 one link, the user picks them all'),
+        fileNames: external_exports.array(external_exports.string()).nullish().transform((value) => value ?? void 0).describe(hostFileUpload ? "For 2\u20135 files: delivery names in order. Returns one binary POST URL per file plus a manual batch page." : 'for a MULTI-file link (2\u20135): the delivery names in order, e.g. ["foto-1.jpg","foto-2.jpg"] \u2014 one link, the user picks them all'),
         caption: optionalFileString.describe("optional text caption delivered with the file")
       }
     },
@@ -68771,6 +68813,23 @@ ${fp}`);
         const mins = Math.round(body.expiresInMs / 6e4);
         const where = to ? `@${safeHandle(to)}` : "the group";
         const delivers = names.length ? `${names.length} files: ${names.map((n) => `\u{1F4CE} ${n}`).join(", ")}` : `\u{1F4CE} ${fileName}`;
+        if (hostFileUpload) {
+          const expectedNames = (names.length ? names : [fileName]).map((name) => (name.split(/[\\/]/).pop() ?? "file").slice(0, 300) || "file");
+          const rawUploads = names.length ? body.uploads : [{ fileName: expectedNames[0], uploadUrl: body.uploadUrl }];
+          if (!Array.isArray(rawUploads) || rawUploads.length !== expectedNames.length)
+            return fail("The upload-link service returned incomplete file upload data. No file has been sent; do not upload to it.");
+          const uploads = [];
+          for (const [i, upload] of rawUploads.entries()) {
+            const scoped = hostUploadUrl(upload?.uploadUrl, hub);
+            if (!scoped || upload?.fileName !== expectedNames[i] || uploads.some((u) => u.uploadUrl === scoped))
+              return fail("The upload-link service returned unexpected file upload data. No file has been sent; do not upload to it.");
+            uploads.push({ fileName: expectedNames[i], uploadUrl: scoped });
+          }
+          const expectedManual = names.length ? `${hub}/api/files/upload-batch/${uploads.map((u) => u.uploadUrl.split("/").pop()).join(".")}` : uploads[0].uploadUrl;
+          if (parsedUrl !== expectedManual)
+            return fail("The upload-link service returned an unexpected manual upload URL. No file has been sent; do not upload to it.");
+          return ok3(hostUploadInstructions(uploads, where, mins, expectedManual));
+        }
         return ok3(
           `\u{1F517} One-tap upload link for ${where} (delivers ${delivers}; valid ~${mins} min, single-use):
 ${parsedUrl}
@@ -68883,10 +68942,10 @@ ${lines.join("\n")}`
     "jefri_send_file",
     {
       title: "Send a file, PDF, or image",
-      description: ctx.local ? "Send a file to a Jefri Chat user/agent \u2014 PDF, image, video, any document. On this LOCAL connector, `path` reads the file off disk and sends it DIRECTLY (up to 500 MB) \u2014 always prefer `path`; never read a file into base64 yourself. `dataUrl` + `fileName` is only for small (\u2264256KB) content you generated in-conversation, and `fileUrl` fetches a public URL. Optional `caption` always." : "Send a file to a Jefri Chat user/agent. " + REMOTE_FILE_GUIDANCE,
+      description: ctx.local ? "Send a file to a Jefri Chat user/agent \u2014 PDF, image, video, any document. On this LOCAL connector, `path` reads the file off disk and sends it DIRECTLY (up to 500 MB) \u2014 always prefer `path`; never read a file into base64 yourself. `dataUrl` + `fileName` is only for small (\u2264256KB) content you generated in-conversation, and `fileUrl` fetches a public URL. Optional `caption` always." : "Send a file to a Jefri Chat user/agent. " + remoteFileGuidance,
       inputSchema: {
         to: external_exports.string().describe("recipient username"),
-        ...fileSendSchema(!!ctx.local)
+        ...fileSendSchema(!!ctx.local, hostFileUpload)
       }
     },
     async ({ to, path: path4, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c) => {
@@ -68921,7 +68980,7 @@ ${lines.join("\n")}`
           return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
         }
       } else {
-        return fail(missingFileSource(!!ctx.local));
+        return fail(missingFileSource(!!ctx.local, hostFileUpload));
       }
       const rawBytes = inlineBytes ?? Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
@@ -69745,10 +69804,10 @@ Or just upload ${fname} from the agent's page in the web app.`
     "jefri_send_group_file",
     {
       title: "Send a file to a group",
-      description: ctx.local ? "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). On this LOCAL connector, `path` sends the file DIRECTLY off disk (up to 500 MB) \u2014 always prefer `path`; `dataUrl` only for small generated content; `fileUrl` for a public URL." : "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). " + REMOTE_FILE_GUIDANCE,
+      description: ctx.local ? "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). On this LOCAL connector, `path` sends the file DIRECTLY off disk (up to 500 MB) \u2014 always prefer `path`; `dataUrl` only for small generated content; `fileUrl` for a public URL." : "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). " + remoteFileGuidance,
       inputSchema: {
         groupId: external_exports.string().describe("the group's id (from jefri_groups or jefri_inbox)"),
-        ...fileSendSchema(!!ctx.local)
+        ...fileSendSchema(!!ctx.local, hostFileUpload)
       }
     },
     async ({ groupId, path: path4, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c) => {
@@ -69781,7 +69840,7 @@ Or just upload ${fname} from the agent's page in the web app.`
           return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
         }
       } else {
-        return fail(missingFileSource(!!ctx.local));
+        return fail(missingFileSource(!!ctx.local, hostFileUpload));
       }
       const rawBytes = inlineBytes ?? Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
@@ -71561,15 +71620,16 @@ function registerGrokMessageTool(server2, options) {
   if (options.lookup.kind !== "profile" || options.lookup.profile !== "grok_bot") return;
   server2.registerTool("jefri_grok_read_message", {
     title: "Read the exact message behind a Grok webhook",
-    description: "Read one plain incoming DM by the webhook's from and hubMessageId (or captionMessageId). Works after inbox acknowledgement. Read-only; never marks anything seen. Verify jefri_whoami matches the event's agent and server first. For a file, use jefri_download_file with its exact messageId to retrieve bytes.",
+    description: "Read one plain incoming DM or group message by the webhook's from and hubMessageId (or captionMessageId). Pass groupId only when present in the event; reply to that same group with jefri_send_group, never a DM fallback. Works after inbox acknowledgement. Read-only; never marks anything seen. Verify jefri_whoami matches the event's agent and server first. For a file, use jefri_download_file with its exact messageId and groupId when present to retrieve bytes.",
     inputSchema: {
       from: external_exports.string().min(1).max(120).describe("Exact sender username from the webhook"),
-      messageId: external_exports.string().min(1).max(200).describe("Exact hubMessageId or captionMessageId from the webhook")
+      messageId: external_exports.string().min(1).max(200).describe("Exact hubMessageId or captionMessageId from the webhook"),
+      groupId: external_exports.string().min(1).max(200).optional().describe("Exact groupId from a group webhook; omit for DMs")
     },
     annotations: { readOnlyHint: true }
-  }, async ({ from, messageId }, extra) => {
+  }, async ({ from, messageId, groupId }, extra) => {
     const fail2 = (text5) => ({ isError: true, content: [{ type: "text", text: text5 }] });
-    if (!isRoutingKey(from) || !/^[A-Za-z0-9_-]{1,200}$/.test(messageId)) return fail2("Invalid sender or message id.");
+    if (!isRoutingKey(from) || !/^[A-Za-z0-9_-]{1,200}$/.test(messageId) || groupId !== void 0 && !/^[A-Za-z0-9_-]{1,200}$/.test(groupId)) return fail2("Invalid sender, message or group id.");
     const me2 = options.client.identity?.username;
     if (!me2 || !options.client.token) return fail2("Jefri identity is not verified. Reconnect this Grok connector.");
     const controller = new AbortController();
@@ -71579,7 +71639,7 @@ function registerGrokMessageTool(server2, options) {
     const timeout = setTimeout(onAbort, 1e4);
     try {
       const url = new URL(options.hub.replace(/\/$/, "") + "/api/history");
-      url.searchParams.set("conversationId", dmConversationId(me2, from));
+      url.searchParams.set("conversationId", groupId ? groupConversationId(groupId) : dmConversationId(me2, from));
       url.searchParams.set("around", messageId);
       url.searchParams.set("peek", "1");
       const response = await (options.fetch ?? fetch)(url, {
@@ -71590,13 +71650,14 @@ function registerGrokMessageTool(server2, options) {
       if (!response.ok || !response.body) return fail2("The exact message is unavailable or access was denied. Do not substitute another message.");
       const data = JSON.parse((await readCapped(response.body, 2 * 1024 * 1024)).toString("utf8"));
       const row = Array.isArray(data.messages) ? data.messages.find((m) => m.id === messageId) : null;
-      if (!row || row.senderUsername !== from || row.receiver !== me2 || row.groupId || row.encryptionMode !== "audited" || !["text", "file"].includes(row.kind) || typeof row.content !== "string")
-        return fail2("No matching plain incoming DM was found. Do not substitute another message.");
+      if (!row || row.senderUsername !== from || row.debateId || row.encryptionMode !== "audited" || (groupId ? row.groupId !== groupId || row.receiver != null : row.receiver !== me2 || !!row.groupId) || !["text", "file"].includes(row.kind) || typeof row.content !== "string")
+        return fail2("No matching plain incoming message was found. Do not substitute another message.");
       const message = {
         id: row.id,
         from: row.senderUsername,
         agent: me2,
         kind: row.kind,
+        ...groupId ? { groupId } : {},
         text: row.kind === "text" ? row.content : null,
         fileId: row.kind === "file" ? row.id : null,
         fileName: row.kind === "file" ? row.fileName : null,

package/dist/index.js

@@ -75,7 +75,7 @@ from gateway.platforms.event import MessageEvent, MessageType, ProcessingOutcome
 from gateway.platforms._shared import extra_or_secret, get_scoped_secret
 from gateway.status import acquire_scoped_lock, release_scoped_lock
 
-from .native_state import NativeState, read_config, private_write
+from .native_state import NativeState, read_config
 from .sdk_client import JefriClient
 from .recovery import HistoryRecovery
 from .delivery import deliver, delivery_code, reply_chunks
@@ -132,6 +132,7 @@ class JefriAdapter(BasePlatformAdapter):
         self.waiter = None
         self.current = None
         self.last_error = None
+        self.delivery_error = None
         self.stopping = False
         self.send_index = 0
         self.sent_keys = {}
@@ -191,6 +192,8 @@ class JefriAdapter(BasePlatformAdapter):
             self.observed_revision = read_config(self.connection_file).get("controlRevision")
             self.recovery = HistoryRecovery()
             self.recovery_error = self.connection_error = self.last_error = None
+            if self.state.recovered_uncertain:
+                self.last_error = "Interrupted native tasks need attention and will not be replayed; the owner's ON/OFF setting is unchanged"
             self.next_recovery = self.next_connection_check = self.retry_work_after = 0
             try:
                 self.version = json.loads((Path(self.connection_file).parent / "runtime/package.json").read_text())["version"]
@@ -510,9 +513,8 @@ class JefriAdapter(BasePlatformAdapter):
             return
         self.last_error = detail
         await self._notice(message, "This task needs attention: execution or reply delivery could not be confirmed. I will not repeat its actions automatically.", "attention")
-        current = read_config(self.connection_file)
-        if self.state.owner() and current.get("controlRevision") == self.turn_revision:
-            private_write(self.connection_file, {**current, "enabled": False})
+        # This ID is now fenced against execution. Keep the owner's intent and
+        # the rest of the queue intact, including if a notice races an OFF/ON.
 
     async def _work(self):
         while not self.stopping:
@@ -536,6 +538,7 @@ class JefriAdapter(BasePlatformAdapter):
                 self.started_at = time.monotonic()
                 self.next_notice = self.started_at + self.notice_delay
                 self.send_index = 0
+                self.delivery_error = None
                 self.sent_keys = {}
                 self.send_receipts = {}
                 self.edits = {}
@@ -563,7 +566,7 @@ class JefriAdapter(BasePlatformAdapter):
                     self.last_error = None
                     self.last_processed = int(time.time() * 1000)
                 else:
-                    await self._uncertain(item, m, "No confirmed final delivery; inspect native session and Jefri history")
+                    await self._uncertain(item, m, self.delivery_error or "Native completion unconfirmed; inspect native session and Jefri history. This task will not be replayed; other eligible messages can continue")
                     self._warning("delivery_uncertain")
             except Exception as error:
                 if not dispatched:
@@ -571,7 +574,7 @@ class JefriAdapter(BasePlatformAdapter):
                     self.retry_work_after = time.monotonic() + 30
                     self._warning("preflight_retry")
                     continue
-                await self._uncertain(item, m, "Native execution/delivery unconfirmed (" + delivery_code(error) + "); inspect session before retrying")
+                await self._uncertain(item, m, "Native execution unconfirmed (" + delivery_code(error) + "); inspect session before retrying. This task will not be replayed; other eligible messages can continue")
                 self._warning("execution_uncertain")
             finally:
                 self._retire_questions()
@@ -588,6 +591,7 @@ class JefriAdapter(BasePlatformAdapter):
             self.waiter.set_result(outcome)
 
     async def send(self, chat_id, content, reply_to=None, metadata=None):
+        turn_id = None
         try:
             if isinstance(metadata, dict) and metadata.get("expect_edits"):
                 # Some Hermes proxy/older paths still construct a stream for
@@ -618,6 +622,8 @@ class JefriAdapter(BasePlatformAdapter):
             return SendResult(success=True, message_id=self.send_receipts[chunk_key])
         except Exception as error:
             self._warning("send_unconfirmed")
+            if turn_id and self.current and self.current["id"] == turn_id and native_turn.get() == turn_id:
+                self.delivery_error = "Native reply delivery unconfirmed (" + delivery_code(error) + "); inspect Jefri history. This task will not be replayed; other eligible messages can continue"
             # Suppress Hermes's differently formatted fallback after an unknown
             # result: changing the payload/key could duplicate an accepted send.
             return SendResult(success=False, error="Jefri send timed out or is unconfirmed (" + delivery_code(error) + "); inspect history before retrying")
@@ -757,10 +763,9 @@ class NativeState:
         self.db.execute("CREATE TABLE IF NOT EXISTS turns (id TEXT PRIMARY KEY, chat TEXT NOT NULL, message TEXT, state TEXT NOT NULL, at INTEGER NOT NULL, reply TEXT, sent INTEGER NOT NULL DEFAULT 0, detail TEXT)")
         self.db.execute("CREATE TABLE IF NOT EXISTS sibling_admissions (id TEXT PRIMARY KEY, sender TEXT NOT NULL, at INTEGER NOT NULL)")
         self.db.execute("CREATE TABLE IF NOT EXISTS group_rearm (id TEXT PRIMARY KEY, cutoff TEXT NOT NULL)")
-        recovered = self.db.execute("UPDATE turns SET state='uncertain',detail='Gateway stopped mid-turn; inspect native session and Jefri history before retrying' WHERE state IN ('running','sending')").rowcount
-        if recovered:
-            private_write(self.file, {**read_config(self.file), "enabled": False})
-            self.cancel_queued()
+        self.recovered_uncertain = self.db.execute("UPDATE turns SET state='uncertain',detail='Gateway stopped mid-turn; inspect native session and Jefri history before retrying' WHERE state IN ('running','sending')").rowcount
+        # Fence interrupted IDs, not the whole responder. A restart must not
+        # change the owner's saved choice or discard undispatched queued work.
 
     @staticmethod
     def _db(file):
@@ -59492,6 +59497,31 @@ function parseInlineDataUrl(dataUrl) {
     };
   return { mime: m[1], bytes: bytes2 };
 }
+function hostFileUploadEnabled(ctx) {
+  return ctx.local === false && ctx.credentialLookup?.kind === "profile" && capsForCtx(ctx).has(CAP.REMOTE_SANDBOX) && (ctx.credentialLookup.profile === "grok_bot" || ctx.credentialLookup.profile === "muse");
+}
+function hostUploadUrl(raw, hub) {
+  if (typeof raw !== "string") return null;
+  try {
+    const u = new URL(raw);
+    const base = new URL(hub);
+    return (u.protocol === "https:" || u.protocol === "http:") && u.origin === base.origin && !u.username && !u.password && !u.search && !u.hash && /^\/api\/files\/upload\/[a-f0-9]{48}$/.test(u.pathname) ? u.href : null;
+  } catch {
+    return null;
+  }
+}
+function hostUploadInstructions(uploads, where, mins, manualUrl, command) {
+  return `Upload prepared for ${where}. No file has been sent yet. Single-use links expire in ~${mins} min; destination, file name and caption are fixed.
+${JSON.stringify({ uploads })}
+
+First check each file's actual size (up to 500 MB) and verify that YOUR OWN runtime can read it and has an allowed outbound HTTP upload tool. If so, upload it yourself now: POST each file's raw binary body to its matching uploadUrl, with its actual Content-Type (application/octet-stream if unknown). No multipart, no base64, no Authorization header, and no redirects. For multiple files, upload sequentially, once per URL; never POST to the batch page or swap file-to-URL assignments. Keep grant URLs private; never send your Jefri token. Use a bounded request with no blind automatic retries. ` + (command ? `If your runtime has an allowed shell AND this exact file, the command is:
+${command}
+
+` : "") + `Confirm each delivery only after HTTP success AND JSON ok === true with the delivery id; a prepared link is not success. On a timeout, connection loss, or 5xx, delivery is uncertain: check jefri_history (with for DMs, groupId for groups) before retrying; do not mint a fresh link and resend blindly. A 409/already-used response is not a new delivery. If you cannot verify the outcome, report it as unconfirmed and ask before resending.
+
+If no permitted binary upload tool exists: readable files \u2264256KB can use dataUrl + fileName via jefri_send_file (jefri_send_group_file for groups); larger/unreadable files need the manual link: ${manualUrl}
+For manual upload, present a runtime file for download first so the user can pick it. A file only on the user's device requires their upload. Never claim this connector can read their disk or your runtime. Never reconstruct, compress, split, or expose a private file publicly; never inline more than 256KB. Respect all host permissions; a safety denial means stop, not try a different route to bypass it.`;
+}
 function fileSourceError(args) {
   if ([args.path, args.dataUrl, args.fileUrl].filter(Boolean).length > 1)
     return "Choose exactly ONE file source: `path`, `dataUrl` + `fileName`, or `fileUrl`. Nothing was sent. For a readable sandbox file \u2264256KB, use `dataUrl` + `fileName` WITHOUT `path` or `fileUrl`.";
@@ -59499,8 +59529,8 @@ function fileSourceError(args) {
     return "A nonblank `fileName` is required with `dataUrl`. Nothing was sent.";
   return null;
 }
-function missingFileSource(local) {
-  return "Provide exactly one file source: `path`, `dataUrl` + `fileName` (\u2264256KB), or a public `fileUrl`. " + (local ? "On this LOCAL connector, prefer path to send directly from disk." : REMOTE_FILE_GUIDANCE);
+function missingFileSource(local, hostUpload = false) {
+  return "Provide exactly one file source: `path`, `dataUrl` + `fileName` (\u2264256KB), or a public `fileUrl`. " + (local ? "On this LOCAL connector, prefer path to send directly from disk." : hostUpload ? HOST_FILE_GUIDANCE : REMOTE_FILE_GUIDANCE);
 }
 async function mintFileLink(hub, token, fileId) {
   const ac = new AbortController();
@@ -59580,6 +59610,17 @@ async function remoteUploadCommand(c2, ctx, target, path39, caption, where, sign
       clearTimeout(gKiller);
       if (signal) signal.removeEventListener("abort", onHostAbort);
     }
+    if (hostFileUploadEnabled(ctx)) {
+      const scoped = hostUploadUrl(uploadUrl, hub);
+      if (!scoped) return { fail: "The upload-link service returned an unexpected upload URL. No file has been sent; do not upload to it." };
+      return { ok: hostUploadInstructions(
+        [{ fileName: fname, uploadUrl: scoped }],
+        where,
+        mins,
+        scoped,
+        `curl --silent --show-error --fail-with-body --connect-timeout 15 --max-time 300 -X POST ${shq(scoped)} -H ${shq(`Content-Type: ${fmime}`)} --data-binary @${shPathArg(path39)}`
+      ) };
+    }
     {
       return {
         ok: `This cloud connector can't read that path. No file has been sent.
@@ -59602,6 +59643,9 @@ Never base64 anything over 256KB through dataUrl \u2014 that is minutes of model
     }
   } catch {
   }
+  if (hostFileUploadEnabled(ctx)) return {
+    fail: "The upload-link service did not provide a usable grant. No file has been sent. Do not upload or expose your token. Retry jefri_upload_link when the service recovers; if the host denied permission, stop instead. " + HOST_FILE_GUIDANCE
+  };
   const web = hub.replace("acp-hub.", "acp-web.").replace(":4000", ":4321");
   const dropLink = target.to ? `${web}/?to=${encodeURIComponent(target.to)}` : `${web}/?group=${encodeURIComponent(target.groupId)}`;
   const q = (target.to ? `to=${encodeURIComponent(target.to)}` : `groupId=${encodeURIComponent(target.groupId)}`) + `&fileName=${encodeURIComponent(fname)}` + (caption ? `&caption=${encodeURIComponent(caption)}` : "");
@@ -60349,6 +60393,8 @@ function ackStandbyDelivered(id5) {
   }
 }
 function registerAcpTools(server2, ctx) {
+  const hostFileUpload = hostFileUploadEnabled(ctx);
+  const remoteFileGuidance = hostFileUpload ? HOST_FILE_GUIDANCE : REMOTE_FILE_GUIDANCE;
   const desktopHeadlessOnly = isHeadlessOnlyDesktop(ctx.credentialLookup?.kind === "profile" ? ctx.credentialLookup.profile : ctx.profile);
   const autonomyProfile = ctx.credentialLookup?.kind === "profile" ? ctx.credentialLookup.profile : ctx.profile;
   const backgroundOnly = isBackgroundOnlyAutonomyProfile(autonomyProfile);
@@ -60786,12 +60832,12 @@ ${fp}`);
     "jefri_upload_link",
     {
       title: "Get an upload link (any file up to 500 MB, full quality)",
-      description: "Get a ONE-TAP UPLOAD LINK to send files or images \u2014 up to 5 PER LINK via `fileNames`, up to 500 MB each, FULL quality, no base64, no compression, no path needed. For ChatGPT, Claude, and other remote assistants: small files \u2264256KB (already held OR readable in YOUR OWN sandbox \u2014 PDFs, CSVs, code, small images) go directly through jefri_send_file (or jefri_send_group_file for groups) with dataUrl + fileName ONLY, no path or link needed. Use THIS tool for larger files, unreadable files, files that cannot fit the tool call, or files only on the user's device. One cheap call, then hand the user the link \u2014 they open it (phone works), pick the file, and it delivers to the recipient automatically. Give `to` (a username) or `groupId`, plus the `fileName` the delivery should carry. The link is single-use and expires in ~15 minutes; mint a fresh one any time. If the file lives in YOUR sandbox, present it to the user for download first so they can pick it at the link. NEVER stream file bytes through plain output (base64/pixel data) \u2014 that burns the user's tokens. The ONE sanctioned carrier is a \u2264256KB `dataUrl` TOOL ARGUMENT via jefri_send_file (near the cap it may still strain output limits \u2014 then use this link); anything larger only ever travels as this link. Creating the link is NOT delivery \u2014 the user must upload the file. Respect host safety blocks; do not use another route to bypass one. Omit unused fields or pass null.",
+      description: hostFileUpload ? "Prepare scoped upload URLs, up to 5 files via fileNames (500 MB each). Give to OR groupId, plus fileName OR fileNames. Each URL is single-use, expires in ~15 minutes, and fixes the destination, name and caption. " + HOST_FILE_GUIDANCE : "Get a ONE-TAP UPLOAD LINK to send files or images \u2014 up to 5 PER LINK via `fileNames`, up to 500 MB each, FULL quality, no base64, no compression, no path needed. For ChatGPT, Claude, and other remote assistants: small files \u2264256KB (already held OR readable in YOUR OWN sandbox \u2014 PDFs, CSVs, code, small images) go directly through jefri_send_file (or jefri_send_group_file for groups) with dataUrl + fileName ONLY, no path or link needed. Use THIS tool for larger files, unreadable files, files that cannot fit the tool call, or files only on the user's device. One cheap call, then hand the user the link \u2014 they open it (phone works), pick the file, and it delivers to the recipient automatically. Give `to` (a username) or `groupId`, plus the `fileName` the delivery should carry. The link is single-use and expires in ~15 minutes; mint a fresh one any time. If the file lives in YOUR sandbox, present it to the user for download first so they can pick it at the link. NEVER stream file bytes through plain output (base64/pixel data) \u2014 that burns the user's tokens. The ONE sanctioned carrier is a \u2264256KB `dataUrl` TOOL ARGUMENT via jefri_send_file (near the cap it may still strain output limits \u2014 then use this link); anything larger only ever travels as this link. Creating the link is NOT delivery \u2014 the user must upload the file. Respect host safety blocks; do not use another route to bypass one. Omit unused fields or pass null.",
       inputSchema: {
         to: optionalFileString.describe("recipient username (or use groupId)"),
         groupId: optionalFileString.describe("group id (from jefri_groups) instead of `to`"),
         fileName: optionalFileString.describe("the name the delivered file should carry, e.g. photo.png (single file)"),
-        fileNames: external_exports.array(external_exports.string()).nullish().transform((value) => value ?? void 0).describe('for a MULTI-file link (2\u20135): the delivery names in order, e.g. ["foto-1.jpg","foto-2.jpg"] \u2014 one link, the user picks them all'),
+        fileNames: external_exports.array(external_exports.string()).nullish().transform((value) => value ?? void 0).describe(hostFileUpload ? "For 2\u20135 files: delivery names in order. Returns one binary POST URL per file plus a manual batch page." : 'for a MULTI-file link (2\u20135): the delivery names in order, e.g. ["foto-1.jpg","foto-2.jpg"] \u2014 one link, the user picks them all'),
         caption: optionalFileString.describe("optional text caption delivered with the file")
       }
     },
@@ -60848,6 +60894,23 @@ ${fp}`);
         const mins = Math.round(body.expiresInMs / 6e4);
         const where = to ? `@${safeHandle(to)}` : "the group";
         const delivers = names.length ? `${names.length} files: ${names.map((n) => `\u{1F4CE} ${n}`).join(", ")}` : `\u{1F4CE} ${fileName}`;
+        if (hostFileUpload) {
+          const expectedNames = (names.length ? names : [fileName]).map((name) => (name.split(/[\\/]/).pop() ?? "file").slice(0, 300) || "file");
+          const rawUploads = names.length ? body.uploads : [{ fileName: expectedNames[0], uploadUrl: body.uploadUrl }];
+          if (!Array.isArray(rawUploads) || rawUploads.length !== expectedNames.length)
+            return fail("The upload-link service returned incomplete file upload data. No file has been sent; do not upload to it.");
+          const uploads = [];
+          for (const [i, upload] of rawUploads.entries()) {
+            const scoped = hostUploadUrl(upload?.uploadUrl, hub);
+            if (!scoped || upload?.fileName !== expectedNames[i] || uploads.some((u) => u.uploadUrl === scoped))
+              return fail("The upload-link service returned unexpected file upload data. No file has been sent; do not upload to it.");
+            uploads.push({ fileName: expectedNames[i], uploadUrl: scoped });
+          }
+          const expectedManual = names.length ? `${hub}/api/files/upload-batch/${uploads.map((u) => u.uploadUrl.split("/").pop()).join(".")}` : uploads[0].uploadUrl;
+          if (parsedUrl !== expectedManual)
+            return fail("The upload-link service returned an unexpected manual upload URL. No file has been sent; do not upload to it.");
+          return ok3(hostUploadInstructions(uploads, where, mins, expectedManual));
+        }
         return ok3(
           `\u{1F517} One-tap upload link for ${where} (delivers ${delivers}; valid ~${mins} min, single-use):
 ${parsedUrl}
@@ -60960,10 +61023,10 @@ ${lines.join("\n")}`
     "jefri_send_file",
     {
       title: "Send a file, PDF, or image",
-      description: ctx.local ? "Send a file to a Jefri Chat user/agent \u2014 PDF, image, video, any document. On this LOCAL connector, `path` reads the file off disk and sends it DIRECTLY (up to 500 MB) \u2014 always prefer `path`; never read a file into base64 yourself. `dataUrl` + `fileName` is only for small (\u2264256KB) content you generated in-conversation, and `fileUrl` fetches a public URL. Optional `caption` always." : "Send a file to a Jefri Chat user/agent. " + REMOTE_FILE_GUIDANCE,
+      description: ctx.local ? "Send a file to a Jefri Chat user/agent \u2014 PDF, image, video, any document. On this LOCAL connector, `path` reads the file off disk and sends it DIRECTLY (up to 500 MB) \u2014 always prefer `path`; never read a file into base64 yourself. `dataUrl` + `fileName` is only for small (\u2264256KB) content you generated in-conversation, and `fileUrl` fetches a public URL. Optional `caption` always." : "Send a file to a Jefri Chat user/agent. " + remoteFileGuidance,
       inputSchema: {
         to: external_exports.string().describe("recipient username"),
-        ...fileSendSchema(!!ctx.local)
+        ...fileSendSchema(!!ctx.local, hostFileUpload)
       }
     },
     async ({ to, path: path39, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c2) => {
@@ -60998,7 +61061,7 @@ ${lines.join("\n")}`
           return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
         }
       } else {
-        return fail(missingFileSource(!!ctx.local));
+        return fail(missingFileSource(!!ctx.local, hostFileUpload));
       }
       const rawBytes = inlineBytes ?? Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
@@ -61822,10 +61885,10 @@ Or just upload ${fname} from the agent's page in the web app.`
     "jefri_send_group_file",
     {
       title: "Send a file to a group",
-      description: ctx.local ? "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). On this LOCAL connector, `path` sends the file DIRECTLY off disk (up to 500 MB) \u2014 always prefer `path`; `dataUrl` only for small generated content; `fileUrl` for a public URL." : "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). " + REMOTE_FILE_GUIDANCE,
+      description: ctx.local ? "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). On this LOCAL connector, `path` sends the file DIRECTLY off disk (up to 500 MB) \u2014 always prefer `path`; `dataUrl` only for small generated content; `fileUrl` for a public URL." : "Send a file/image to a GROUP by its group id (from jefri_groups / jefri_inbox). " + remoteFileGuidance,
       inputSchema: {
         groupId: external_exports.string().describe("the group's id (from jefri_groups or jefri_inbox)"),
-        ...fileSendSchema(!!ctx.local)
+        ...fileSendSchema(!!ctx.local, hostFileUpload)
       }
     },
     async ({ groupId, path: path39, caption, dataUrl, fileUrl, fileName }, extra) => withClient(async (c2) => {
@@ -61858,7 +61921,7 @@ Or just upload ${fname} from the agent's page in the web app.`
           return fail(`Couldn't fetch that URL: ${e2?.message ?? e2}`);
         }
       } else {
-        return fail(missingFileSource(!!ctx.local));
+        return fail(missingFileSource(!!ctx.local, hostFileUpload));
       }
       const rawBytes = inlineBytes ?? Buffer.from(url.split(",")[1] ?? "", "base64");
       if (rawBytes.length > MAX_UPLOAD_BYTES)
@@ -62678,7 +62741,7 @@ function attachInbox(c2, inbox2, self, onIncoming) {
     c2.off("file_received", capture);
   };
 }
-var isStateless, crossBasename, DOWNLOAD_DIR_SH, downloadDirAbs, ensureDownloadDir, safeSaveName, shPathArg, psq, psPathArg, isTextyFile, DATAURL_INLINE_MAX, optionalFileString, REMOTE_FILE_GUIDANCE, fileSendSchema, MINT_LINK_DEADLINE_MS, forwardTip, MIME, mimeOf, MAX_UPLOAD_BYTES, posIntEnv, MAX_REMOTE_URL_BYTES, MAX_CONCURRENT_REMOTE_DOWNLOADS, REMOTE_DOWNLOAD_DEADLINE_MS, activeRemoteDownloads, MB, WS_SAFE_FILE_BYTES, extFromMime, shq, CAP, PROFILE_CAPS, LOCAL_CAPS, REMOTE_CAPS, LOCAL_PROFILES, PROFILE_LOOKUP_TIMEOUT_MS, CREDENTIAL_PROFILE_TTL_MS, CREDENTIAL_PROFILE_GRACE_MS, credentialProfiles, credentialEpochs, cacheKey, nextCredentialEpoch, epochOf, onAuthorityRejected, upgradeNotice, upgradeShownAt, UPGRADE_REPEAT_MS, ok3, okWithData, fail, AMBIGUOUS_OUTCOME, OUTCOME_META_KEY, AMBIGUOUS_CAVEAT, failAmbiguous, definiteHttpReject, okConnector, INLINE_IMAGE_MIMES, IMAGE_INLINE_MAX, IMAGE_MAX_PIXELS, IMAGE_MAX_FRAMES, IMAGE_RETAINED_FACTOR, retainedCost, IMAGE_BUDGET_MAX, imageBudgetInUse, IMAGE_HOLD_MAX_MS, dropBody, looksLikeImage, okWithImage, WATERMARK_FILE, inboxWatermark, STANDBY_ACKED_FILE, standbyAcked, pendingStandbyAck, STANDBY_VERIFY_MS;
+var isStateless, crossBasename, DOWNLOAD_DIR_SH, downloadDirAbs, ensureDownloadDir, safeSaveName, shPathArg, psq, psPathArg, isTextyFile, DATAURL_INLINE_MAX, optionalFileString, REMOTE_FILE_GUIDANCE, HOST_FILE_GUIDANCE, fileSendSchema, MINT_LINK_DEADLINE_MS, forwardTip, MIME, mimeOf, MAX_UPLOAD_BYTES, posIntEnv, MAX_REMOTE_URL_BYTES, MAX_CONCURRENT_REMOTE_DOWNLOADS, REMOTE_DOWNLOAD_DEADLINE_MS, activeRemoteDownloads, MB, WS_SAFE_FILE_BYTES, extFromMime, shq, CAP, PROFILE_CAPS, LOCAL_CAPS, REMOTE_CAPS, LOCAL_PROFILES, PROFILE_LOOKUP_TIMEOUT_MS, CREDENTIAL_PROFILE_TTL_MS, CREDENTIAL_PROFILE_GRACE_MS, credentialProfiles, credentialEpochs, cacheKey, nextCredentialEpoch, epochOf, onAuthorityRejected, upgradeNotice, upgradeShownAt, UPGRADE_REPEAT_MS, ok3, okWithData, fail, AMBIGUOUS_OUTCOME, OUTCOME_META_KEY, AMBIGUOUS_CAVEAT, failAmbiguous, definiteHttpReject, okConnector, INLINE_IMAGE_MIMES, IMAGE_INLINE_MAX, IMAGE_MAX_PIXELS, IMAGE_MAX_FRAMES, IMAGE_RETAINED_FACTOR, retainedCost, IMAGE_BUDGET_MAX, imageBudgetInUse, IMAGE_HOLD_MAX_MS, dropBody, looksLikeImage, okWithImage, WATERMARK_FILE, inboxWatermark, STANDBY_ACKED_FILE, standbyAcked, pendingStandbyAck, STANDBY_VERIFY_MS;
 var init_tools = __esm({
   "src/tools.ts"() {
     "use strict";
@@ -62727,8 +62790,9 @@ var init_tools = __esm({
     DATAURL_INLINE_MAX = 256 * 1024;
     optionalFileString = external_exports.string().nullish().transform((value) => value ?? void 0);
     REMOTE_FILE_GUIDANCE = "REMOTE connector (ChatGPT, Claude, or another cloud assistant): choose exactly ONE file source. (1) File in YOUR OWN sandbox: check its decoded byte size first. If readable and \u2264256KB (262144 bytes), send directly with `dataUrl` + `fileName`, no user upload step. This includes PDFs, CSVs, code, and small images. Use the actual bytes as canonical base64 in data:<mime>;base64,<base64>; omit `path` and `fileUrl`. (2) Over 256KB, unreadable, or unable to fit the tool call: use jefri_upload_link with the destination and fileName (up to 500 MB per file). If in your sandbox, present the file for download so the user can select it. Never compress, convert, resize, split, or reconstruct a file just to fit the inline limit; never stream base64 in prose. (3) File only on the USER'S DEVICE: use jefri_upload_link; do not read/base64 their local file. (4) An existing public http(s) URL \u2192 `fileUrl` (\u226425MB). Never invent a URL or pass sandbox:/file: URLs. A remote `path` (including /mnt/data) CANNOT read the assistant's sandbox or user's disk; it only creates an upload link, for compatibility. Link creation is NOT file delivery. Omit unused arguments (null is also accepted). If the host blocks a tool call for safety, respect the block; do not retry other arguments to bypass it.";
-    fileSendSchema = (local) => ({
-      path: optionalFileString.describe(local ? "Local file path to read and send directly, e.g. ~/Downloads/report.pdf. Do not combine with dataUrl or fileUrl." : "Compatibility only: creates an upload link, NEVER reads /mnt/data or any local/sandbox path. For a readable sandbox file \u2264256KB use dataUrl + fileName WITHOUT path; otherwise use jefri_upload_link."),
+    HOST_FILE_GUIDANCE = "Grok Bot/Muse REMOTE connector: choose by where the original file bytes live and the tools actually available. If YOUR OWN runtime can read the file and has an allowed outbound HTTP upload tool, use jefri_upload_link with the destination and fileName, then upload the original binary body from YOUR runtime to its scoped POST URL (up to 500 MB per file). Do not ask the user to re-upload a file you can upload yourself. The connector cannot read your runtime or the user's disk; a remote path only prepares an upload grant, never sends bytes. If no permitted binary upload tool is available, readable files \u2264256KB (262144 bytes) can use dataUrl + fileName with canonical data:<mime>;base64,<base64>, omitting path and fileUrl. Otherwise present the file for download and give the user the manual upload link. Files only on the USER'S DEVICE also need that manual upload. An existing public http(s) file URL can use fileUrl (\u226425MB); never invent a URL, use sandbox:/file: URLs, or make a private file public for this. Choose exactly ONE source; omit unused arguments (null is also accepted). Never compress, convert, resize, split, or reconstruct files to fit limits; never print file bytes or large base64 in prose. Link creation is NOT file delivery: confirm the upload's HTTP/JSON receipt; after an uncertain result check the conversation before retrying. Respect host permissions and safety blocks; never switch routes to bypass a block.";
+    fileSendSchema = (local, hostUpload = false) => ({
+      path: optionalFileString.describe(local ? "Local file path to read and send directly, e.g. ~/Downloads/report.pdf. Do not combine with dataUrl or fileUrl." : hostUpload ? "Prepares a scoped upload grant; NEVER reads this path remotely or sends the file. If your runtime can read this file and has an allowed HTTP upload tool, follow the returned binary POST instructions. Otherwise use the manual link." : "Compatibility only: creates an upload link, NEVER reads /mnt/data or any local/sandbox path. For a readable sandbox file \u2264256KB use dataUrl + fileName WITHOUT path; otherwise use jefri_upload_link."),
       caption: optionalFileString.describe("optional text caption"),
       dataUrl: optionalFileString.describe(local ? "Small content generated in-conversation, max 256KB decoded. Use canonical data:<mime>;base64,<base64> with fileName; omit path and fileUrl. For files on disk use path directly, never read them into base64 yourself." : "Actual content you hold or can read in YOUR OWN sandbox (ChatGPT, Claude apps/Cowork, or another assistant), max 256KB decoded (262144 bytes). Use canonical data:<mime>;base64,<base64> and fileName; omit path and fileUrl. Never base64 a file on the USER machine. Never reconstruct missing bytes or inline files over the cap."),
       fileUrl: optionalFileString.describe("An existing public http(s) URL the connector can fetch (\u226425MB), not a sandbox path or invented URL. Do not combine with path or dataUrl."),
@@ -63480,17 +63544,14 @@ async function startOpenClawBridge(file, timing = { heartbeatMs: 1e3, recoveryMs
   }
   const journal = new NativeJournal(path11.join(path11.dirname(file), "turns.db"));
   const questions = new NativeQuestions(path11.join(path11.dirname(file), "questions.db"));
-  if (journal.recoveredUncertain) {
-    setNativeEnabled(file, false);
-    journal.cancelQueued();
-  }
   let socket, active, busy = false, stopping = false, closed = false;
   let activeGroup;
   let activeMessage, activeStartedAt = 0, nextNoticeAt = 0;
   let noticeTask;
   const notices = /* @__PURE__ */ new Set();
   let activeRevision;
-  let turnError = null, admissionError = null, recoveryError = null;
+  let turnError = journal.recoveredUncertain ? "Interrupted native tasks need attention and will not be replayed; the owner's ON/OFF setting is unchanged." : null;
+  let admissionError = null, recoveryError = null;
   let pumpAfter = 0, lastInboundAt = null, lastProcessedAt = null;
   let observedRevision = config2.controlRevision;
   let recoveryTask, recoveryAbort, nextRecoveryAt = 0;
@@ -63567,6 +63628,7 @@ async function startOpenClawBridge(file, timing = { heartbeatMs: 1e3, recoveryMs
       while (enabled() && socket?.online && (next = journal.next())) {
         const { id: id5, chat, message } = next;
         let dispatched = false;
+        let phase = "execution";
         const revision = readNativeConfig(file).controlRevision;
         const turnAllowed = async () => revision === readNativeConfig(file).controlRevision && await check2(message) && revision === readNativeConfig(file).controlRevision;
         try {
@@ -63589,8 +63651,10 @@ async function startOpenClawBridge(file, timing = { heartbeatMs: 1e3, recoveryMs
           const answer = questions.match(message, revision ?? null);
           const modelMessage = answer ? { ...message, content: `Answer to your question ${JSON.stringify(answer.pending.question.question)}: ${answer.label}` } : message;
           const reply = await runOpenClawTurn(config2, chat, modelMessage, signal);
+          phase = "reply authorization";
           if (!await turnAllowed()) throw Error("Native admission or group eligibility changed while working; reply withheld.");
           lock2.withOwnership(() => journal.reply(id5, reply));
+          phase = "reply delivery";
           for (const [part, text6] of splitNativeReply(reply).entries()) {
             if (!await turnAllowed()) throw Error("Reply stopped because eligibility changed.");
             const result = await deliverNative(() => send(text6, part), turnAllowed);
@@ -63610,15 +63674,11 @@ async function startOpenClawBridge(file, timing = { heartbeatMs: 1e3, recoveryMs
             pumpAfter = Date.now() + timing.recoveryMs;
             break;
           }
-          turnError = e?.name === "AbortError" || e?.name === "TimeoutError" ? "Native turn interrupted; platform actions may still finish." : `Native execution/delivery uncertain (${nativeDeliveryCode(e)}). Inspect gateway session and Jefri history; no automatic retry.`;
+          turnError = e?.name === "AbortError" || e?.name === "TimeoutError" ? "Native turn interrupted; platform actions may still finish. This task will not be replayed; the owner's ON/OFF setting is unchanged." : `Native ${phase} uncertain (${nativeDeliveryCode(e)}). Inspect gateway session and Jefri history; this task will not be replayed. Other eligible messages can continue.`;
           if (lock2.isOwner()) {
             lock2.withOwnership(() => journal.mark(id5, "uncertain", turnError));
             if (readNativeConfig(file).controlRevision === revision) {
               await notice(message, "This task needs attention: execution or reply delivery could not be confirmed. I will not repeat its actions automatically.", "attention");
-              if (lock2.isOwner() && readNativeConfig(file).controlRevision === revision) {
-                setNativeEnabled(file, false);
-                journal.cancelQueued();
-              }
             } else turnError = null;
           }
         } finally {
@@ -63731,7 +63791,7 @@ async function startOpenClawBridge(file, timing = { heartbeatMs: 1e3, recoveryMs
       await Promise.allSettled([...admissions]);
       while (busy) await new Promise((resolve) => setTimeout(resolve, 50));
       await Promise.allSettled([...notices]);
-      if (lock2.isOwner()) journal.cancelQueued();
+      if (lock2.isOwner() && !readNativeConfig(file).enabled) journal.cancelQueued();
       lock2.release();
       status();
       closed = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jefrichat-mcp",
-  "version": "0.49.51",
+  "version": "0.49.53",
   "engines": {
     "node": ">=22.13"
   },