@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/contacts/contact-store.ts

@@ -184,6 +184,27 @@ export function getContact(id: string): ContactWithChannels | null {
 /** @deprecated Use {@link getContact} directly. */
 export const getContactInternal = getContact;
 
+/** INFO-only contact fields, joined locally by contact ID. */
+export interface ContactInfo {
+  notes: string | null;
+  interactionCount: number;
+}
+
+/**
+ * Look up a contact's INFO fields (notes, interaction count) by ID.
+ *
+ * Carries no ACL state (status/policy/verification) — those are owned by the
+ * gateway-stamped trust verdict. Returns null when the contact does not exist.
+ */
+export function findContactInfoById(contactId: string): ContactInfo | null {
+  const contact = getContact(contactId);
+  if (!contact) return null;
+  return {
+    notes: contact.notes,
+    interactionCount: contact.interactionCount,
+  };
+}
+
 /**
  * Look up a single contact channel by its primary key.
  * Returns the parsed channel row, or null if it does not exist.

package/src/contacts/contacts-write.ts

@@ -30,6 +30,9 @@ import type {
  * Returns true when a guardian channel was found and revoked, false otherwise.
  */
 export function revokeGuardianBinding(channel: string): boolean {
+  // Local-store read, not the gateway: this read selects the row that the
+  // updateChannelStatus write below mutates, so it must stay transactionally
+  // consistent with that write. Leave for Combo 11 / gateway-bootstrap-binding.
   const guardian = findGuardianForChannel(channel);
   if (!guardian) return false;
 

package/src/contacts/guardian-delivery-reader.ts

@@ -0,0 +1,223 @@
+/**
+ * Gateway-backed guardian binding + delivery reader.
+ *
+ * Resolves the active guardian binding(s) and their per-channel delivery
+ * endpoints from the gateway via the `resolve_guardian_delivery` IPC route,
+ * validating the response against {@link ResolveGuardianDeliveryResponseSchema}.
+ *
+ * Guardian binding is near-static — it only changes on guardian onboarding /
+ * verification or revocation — yet this reader sits on many hot paths. To keep
+ * those paths off the IPC, results are cached behind a minutes-scale TTL and
+ * coalesced single-flight so a cold cache storms the gateway at most once.
+ *
+ * Freshness comes from two sources: the {@link invalidateGuardianDeliveryCache}
+ * subscription to `onContactChange` (contact mutations clear the cache), and
+ * {@link getGuardianDeliveryFresh} reads on existence guards (gateway-side
+ * binding writes don't invalidate the daemon cache, so those paths read fresh).
+ *
+ * Returns `null` on ANY failure (transport failure, malformed shape, timeout,
+ * or thrown error); failures are NOT cached, so a recovered gateway is retried
+ * on the next call.
+ */
+
+import {
+  type GuardianDelivery,
+  ResolveGuardianDeliveryResponseSchema,
+} from "@vellumai/gateway-client";
+
+import { ipcCall } from "../ipc/gateway-client.js";
+import { onContactChange } from "./contact-events.js";
+
+// Short IPC timeout so the read resolves promptly rather than stalling a hot
+// path on a gateway that accepts the socket but hangs.
+const GUARDIAN_DELIVERY_IPC_TIMEOUT_MS = 2_000;
+
+// Guardian binding is near-static, so a minutes-scale TTL is safe; freshness is
+// driven primarily by event-based invalidation, not by this backstop expiry.
+const GUARDIAN_DELIVERY_CACHE_TTL_MS = 300_000;
+
+interface CacheEntry {
+  guardians: GuardianDelivery[];
+  fetchedAt: number;
+}
+
+const cache = new Map<string, CacheEntry>();
+// Tracks whether the in-flight fetch was a force-refresh, so a fresh read never
+// coalesces with an older non-force fetch that may predate a gateway-side write.
+const inFlight = new Map<
+  string,
+  { promise: Promise<GuardianDelivery[] | null>; fresh: boolean }
+>();
+
+// Bumped on every invalidation. A fetch captures the generation when it starts
+// and only writes its result to the cache if the generation is unchanged on
+// resolve, so an invalidation mid-flight can't repopulate a stale pre-change
+// result and mask a guardian-binding change.
+let cacheGeneration = 0;
+
+function cacheKey(channelTypes?: string[]): string {
+  if (!channelTypes || channelTypes.length === 0) return "ALL";
+  return [...channelTypes].sort().join(",");
+}
+
+async function fetchGuardianDelivery(
+  input: { channelTypes?: string[] },
+): Promise<GuardianDelivery[] | null> {
+  try {
+    const result = await ipcCall(
+      "resolve_guardian_delivery",
+      input,
+      GUARDIAN_DELIVERY_IPC_TIMEOUT_MS,
+    );
+    if (!result) return null;
+
+    const parsed = ResolveGuardianDeliveryResponseSchema.safeParse(result);
+    return parsed.success ? parsed.data.guardians : null;
+  } catch {
+    return null;
+  }
+}
+
+// Shared fetch path for both the cached and fresh public surfaces. When
+// `forceRefresh` is set the cached entry is bypassed; the read is still
+// single-flight and still populates the cache with the fresh result.
+async function readGuardianDelivery(
+  input: { channelTypes?: string[]; forceRefresh?: boolean },
+): Promise<GuardianDelivery[] | null> {
+  const key = cacheKey(input.channelTypes);
+
+  if (!input.forceRefresh) {
+    const cached = cache.get(key);
+    if (
+      cached &&
+      Date.now() - cached.fetchedAt < GUARDIAN_DELIVERY_CACHE_TTL_MS
+    ) {
+      return cached.guardians;
+    }
+  }
+
+  // A non-force read may coalesce with any in-flight fetch. A force read may
+  // only coalesce with another force fetch — never with a non-force fetch that
+  // could have started before a gateway-side binding write and resolve stale.
+  const pending = inFlight.get(key);
+  if (pending && (!input.forceRefresh || pending.fresh)) return pending.promise;
+
+  const startGen = cacheGeneration;
+  const promise = fetchGuardianDelivery({ channelTypes: input.channelTypes })
+    .then((guardians) => {
+      // Skip the write if an invalidation fired during the fetch: the result
+      // may predate the change. Return it to this caller (freshest it has) but
+      // leave the cache empty so the next call re-fetches.
+      if (guardians && cacheGeneration === startGen) {
+        cache.set(key, { guardians, fetchedAt: Date.now() });
+      }
+      return guardians;
+    })
+    .finally(() => {
+      // Only clear the slot if it still holds this fetch — a concurrent force
+      // read may have replaced a non-force entry (or vice versa).
+      if (inFlight.get(key)?.promise === promise) inFlight.delete(key);
+    });
+
+  inFlight.set(key, { promise, fresh: !!input.forceRefresh });
+  return promise;
+}
+
+/**
+ * Resolve active guardian deliveries, optionally filtered by channel type.
+ * Returns the cached list when fresh, otherwise fetches (single-flight) and
+ * caches on success. Returns `null` on failure without caching.
+ *
+ * To force an uncached read, call {@link getGuardianDeliveryFresh} — the only
+ * public fresh-read entry point.
+ */
+export async function getGuardianDelivery(
+  input?: { channelTypes?: string[] },
+): Promise<GuardianDelivery[] | null> {
+  return readGuardianDelivery({ channelTypes: input?.channelTypes });
+}
+
+/**
+ * Synchronous read of the already-cached guardian deliveries, without any IO.
+ *
+ * Returns the fresh cached list for the given channel filter, or `undefined`
+ * when the cache is cold or expired. Used by sync hot paths (SSE subscribe)
+ * that cannot await {@link getGuardianDelivery} but must resolve the SAME
+ * gateway-owned principal the async paths land on. A cold/expired return lets
+ * the caller fall back to the local store as before.
+ */
+export function peekCachedGuardianDelivery(
+  input?: { channelTypes?: string[] },
+): GuardianDelivery[] | undefined {
+  const cached = cache.get(cacheKey(input?.channelTypes));
+  if (!cached) return undefined;
+  if (Date.now() - cached.fetchedAt >= GUARDIAN_DELIVERY_CACHE_TTL_MS) {
+    return undefined;
+  }
+  return cached.guardians;
+}
+
+/**
+ * Fresh (uncached) variant of {@link getGuardianDelivery}. Existence guards read
+ * fresh because gateway-side binding writes don't invalidate the daemon cache.
+ * Still single-flight, and still populates the cache with the fresh result.
+ */
+export async function getGuardianDeliveryFresh(
+  input?: { channelTypes?: string[] },
+): Promise<GuardianDelivery[] | null> {
+  return readGuardianDelivery({
+    channelTypes: input?.channelTypes,
+    forceRefresh: true,
+  });
+}
+
+/**
+ * Clear ALL cached guardian deliveries. Subscribed to `onContactChange` so
+ * contact mutations refetch on the next read; also exported for any caller that
+ * wants to invalidate explicitly.
+ */
+export function invalidateGuardianDeliveryCache(): void {
+  cacheGeneration += 1;
+  cache.clear();
+  inFlight.clear();
+}
+
+onContactChange(invalidateGuardianDeliveryCache);
+
+/** First active guardian delivery for the given channel type, if any. */
+export function guardianForChannel(
+  list: GuardianDelivery[],
+  channelType: string,
+): GuardianDelivery | undefined {
+  return list.find(
+    (g) => g.channelType === channelType && g.status === "active",
+  );
+}
+
+/** First guardian delivery overall — the `listGuardianChannels` fallback. */
+export function anyGuardian(
+  list: GuardianDelivery[],
+): GuardianDelivery | undefined {
+  return list[0];
+}
+
+/**
+ * Resolve a guardian displayName for voice surfaces: prefer the phone-channel
+ * guardian, falling back to any guardian. Returns `undefined` when the list is
+ * absent or no guardian carries a displayName.
+ */
+export function voiceGuardianDisplayName(
+  list: GuardianDelivery[] | null,
+): string | undefined {
+  const guardian = list
+    ? (guardianForChannel(list, "phone") ?? anyGuardian(list))
+    : undefined;
+  return guardian?.displayName ?? undefined;
+}
+
+/** Test-only: reset cache + in-flight state for deterministic test runs. */
+export function __resetGuardianDeliveryCacheForTest(): void {
+  cache.clear();
+  inFlight.clear();
+  cacheGeneration = 0;
+}

package/src/contacts/member-status.ts

@@ -0,0 +1,9 @@
+import type { ChannelStatus } from "./types.js";
+
+/** Map ChannelStatus to the API-facing member status (excludes "unverified"). */
+export function channelStatusToMemberStatus(
+  status: ChannelStatus,
+): Exclude<ChannelStatus, "unverified"> {
+  if (status === "unverified") return "pending";
+  return status;
+}

package/src/credential-health/credential-health-service.ts

@@ -24,6 +24,7 @@ import {
   type OAuthConnectionRow,
   type OAuthProviderRow,
 } from "../oauth/oauth-store.js";
+import { scopeDifference } from "../oauth/scope-utils.js";
 import {
   TokenExpiredError,
   withValidToken,
@@ -77,11 +78,6 @@ function safeJsonParse<T>(raw: string | null | undefined, fallback: T): T {
   }
 }
 
-function scopeDifference(required: string[], granted: string[]): string[] {
-  const grantedSet = new Set(granted);
-  return required.filter((s) => !grantedSet.has(s));
-}
-
 // ── Liveness ping ─────────────────────────────────────────────────────
 
 /** @internal Exposed for test injection. */

package/src/daemon/__tests__/conversation-tool-setup.test.ts

@@ -47,6 +47,20 @@ mock.module("../../runtime/assistant-event-hub.js", () => ({
   broadcastMessage: () => {},
 }));
 
+// Control the advisor profile gate to verify the advisor tool is wired to it.
+// The gate's own config semantics (default-on, active-profile fallback) are
+// covered by advisor-gate.test.ts; here we only assert the wiring and the
+// profile argument isToolActiveForContext passes through.
+let advisorGateResult = true;
+const advisorGateProfiles: (string | null)[] = [];
+
+mock.module("../../plugins/defaults/advisor/advisor-gate.js", () => ({
+  advisorEnabledForProfile: (profile: string | null) => {
+    advisorGateProfiles.push(profile);
+    return advisorGateResult;
+  },
+}));
+
 // Dynamic imports after mock.module calls so the stubs take effect
 // before the modules under test are loaded.
 const { HOST_TOOL_NAMES, HOST_TOOL_TO_CAPABILITY, isToolActiveForContext } =
@@ -597,6 +611,36 @@ describe("isToolActiveForContext — ask_question macOS gating", () => {
   });
 });
 
+describe("isToolActiveForContext — advisor profile gate", () => {
+  beforeEach(() => {
+    advisorGateResult = true;
+    advisorGateProfiles.length = 0;
+  });
+
+  test("advisor is active when the profile enables it", () => {
+    advisorGateResult = true;
+    expect(isToolActiveForContext("advisor", makeCtx())).toBe(true);
+  });
+
+  test("advisor is NOT active when the profile disables it", () => {
+    advisorGateResult = false;
+    expect(isToolActiveForContext("advisor", makeCtx())).toBe(false);
+  });
+
+  test("consults the gate with the per-turn override profile", () => {
+    isToolActiveForContext(
+      "advisor",
+      makeCtx({ currentTurnOverrideProfile: "cost-optimized" }),
+    );
+    expect(advisorGateProfiles).toEqual(["cost-optimized"]);
+  });
+
+  test("consults the gate with null when no per-turn override is set", () => {
+    isToolActiveForContext("advisor", makeCtx());
+    expect(advisorGateProfiles).toEqual([null]);
+  });
+});
+
 describe("HOST_TOOL_NAMES derivation", () => {
   test("HOST_TOOL_NAMES is derived from HOST_TOOL_TO_CAPABILITY", () => {
     // Sanity check: every tool in the names set has a capability mapping.

package/src/daemon/app-source-watcher.ts

@@ -11,11 +11,9 @@
 
 import { existsSync, type FSWatcher, watch } from "node:fs";
 
-import {
-  getAppsDir,
-  resolveAppIdByDirName,
-} from "../memory/app-store.js";
+import { getAppsDir, resolveAppIdByDirName } from "../memory/app-store.js";
 import { DebouncerMap } from "../util/debounce.js";
+import { attachFsWatcherErrorHandler } from "../util/fs-watcher-error.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("app-source-watcher");
@@ -51,8 +49,10 @@ function resolveAppIdFromRelPath(relPath: string): string | null {
 
   // Skip non-source directories (include bare directory names for fs.watch events)
   if (
-    innerPath === "records" || innerPath.startsWith("records/") ||
-    innerPath === "dist" || innerPath.startsWith("dist/")
+    innerPath === "records" ||
+    innerPath.startsWith("records/") ||
+    innerPath === "dist" ||
+    innerPath.startsWith("dist/")
   ) {
     return null;
   }
@@ -89,7 +89,9 @@ export class AppSourceWatcher {
     try {
       appsDir = getAppsDir();
     } catch {
-      log.warn("Could not resolve apps directory; app source watching disabled");
+      log.warn(
+        "Could not resolve apps directory; app source watching disabled",
+      );
       return;
     }
 
@@ -102,19 +104,30 @@ export class AppSourceWatcher {
     if (!onChange) return;
 
     try {
-      this.watcher = watch(appsDir, { recursive: true }, (_eventType, filename) => {
-        if (!filename) return;
-
-        const appId = resolveAppIdFromRelPath(filename);
-        if (!appId) return;
-
-        this.debouncer.schedule(`app:${appId}`, () => {
-          onChange(appId);
-        });
-      });
+      this.watcher = watch(
+        appsDir,
+        { recursive: true },
+        (_eventType, filename) => {
+          if (!filename) return;
+
+          const appId = resolveAppIdFromRelPath(filename);
+          if (!appId) return;
+
+          this.debouncer.schedule(`app:${appId}`, () => {
+            onChange(appId);
+          });
+        },
+      );
+      // Recursive watches over app trees (incl. node_modules) can exhaust the
+      // inotify watch limit and emit ENOSPC asynchronously. Without an 'error'
+      // listener that unhandled emitter error crashes the daemon.
+      attachFsWatcherErrorHandler(this.watcher, log, appsDir);
       log.info("App source watcher started");
     } catch (err) {
-      log.warn({ err }, "Failed to watch apps directory; source watching disabled");
+      log.warn(
+        { err },
+        "Failed to watch apps directory; source watching disabled",
+      );
     }
   }
 

package/src/daemon/assistant-attachments.ts

@@ -256,6 +256,88 @@ export function parseDirectives(text: string): DirectiveParseResult {
   };
 }
 
+// ---------------------------------------------------------------------------
+// vellum:// markdown link extraction
+// ---------------------------------------------------------------------------
+
+/**
+ * Match markdown links with `vellum://workspace/` or `vellum://host/` URLs.
+ *
+ * Captures:
+ *   [1] = link text (filename)
+ *   [2] = scheme authority: "workspace" or "host"
+ *   [3] = path after the authority
+ *
+ * The link text is NOT stripped from the assistant's message — unlike
+ * `<vellum-attachment />` tags, the markdown link is valid user-facing
+ * content that renders as a clickable download link.
+ */
+const VELLUM_LINK_RE = /\[([^\]]+)\]\(vellum:\/\/(workspace|host)(\/[^)]*)\)/g;
+
+interface VellumLinkExtractResult {
+  directiveRequests: DirectiveRequest[];
+  parseWarnings: string[];
+}
+
+/**
+ * Extract `[text](vellum://workspace/path)` and `[text](vellum://host/path)`
+ * markdown links from assistant text and return corresponding directive
+ * requests. The text is NOT modified — the links remain as rendered markdown.
+ */
+export function extractVellumLinks(text: string): VellumLinkExtractResult {
+  const directiveRequests: DirectiveRequest[] = [];
+  const parseWarnings: string[] = [];
+
+  let m: RegExpExecArray | null;
+  while ((m = VELLUM_LINK_RE.exec(text)) != null) {
+    const linkText = m[1]!;
+    const authority = m[2]!;
+    const rawPath = m[3]!;
+
+    if (authority === "workspace") {
+      // Strip the leading "/" to get a workspace-relative path
+      const path = rawPath.startsWith("/") ? rawPath.slice(1) : rawPath;
+      if (!path) {
+        parseWarnings.push(
+          `Ignored vellum://workspace link "${linkText}": empty path.`,
+        );
+        continue;
+      }
+      directiveRequests.push({
+        source: "sandbox",
+        path,
+        filename: linkText || undefined,
+        mimeType: undefined,
+      });
+    } else {
+      // host: rawPath is already absolute (starts with /)
+      if (!rawPath || rawPath === "/") {
+        parseWarnings.push(
+          `Ignored vellum://host link "${linkText}": empty path.`,
+        );
+        continue;
+      }
+      directiveRequests.push({
+        source: "host",
+        path: rawPath,
+        filename: linkText || undefined,
+        mimeType: undefined,
+      });
+    }
+  }
+
+  return { directiveRequests, parseWarnings };
+}
+
+/**
+ * Replace `[text](vellum://...)` markdown links with their link text.
+ * Used to sanitize text before channel delivery (Slack, Telegram, etc.)
+ * where the `vellum://` scheme has no meaning.
+ */
+export function stripVellumLinks(text: string): string {
+  return text.replace(VELLUM_LINK_RE, "$1");
+}
+
 /**
  * Drain streamed assistant text while stripping only valid, complete
  * self-closing `<vellum-attachment ... />` directives.
@@ -707,10 +789,18 @@ export function cleanAssistantContent(content: readonly unknown[]): {
       const b = block as Record<string, unknown>;
       if (b.type !== "text") return block;
       const text = b.text as string;
-      // Only run the directive parser when the text actually contains a
-      // potential tag. This avoids unintentional whitespace normalisation
-      // (parseDirectives trims and collapses blank lines) on plain messages.
-      if (!text.includes("<vellum-attachment")) return block;
+
+      // Extract vellum:// markdown links (non-destructive — links stay in text)
+      if (text.includes("vellum://")) {
+        const linkResult = extractVellumLinks(text);
+        directives.push(...linkResult.directiveRequests);
+        warnings.push(...linkResult.parseWarnings);
+      }
+
+      // Strip legacy <vellum-attachment /> tags from the text
+      if (!text.includes("<vellum-attachment")) {
+        return block;
+      }
       const result = parseDirectives(text);
       directives.push(...result.directiveRequests);
       warnings.push(...result.parseWarnings);

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -2435,6 +2435,9 @@ export async function dispatchAgentEvent(
           );
         }
         break;
+      case "system_prompt_changed":
+        deps.ctx.systemPrompt = event.systemPrompt;
+        break;
     }
   } catch (err) {
     log.error(

package/src/daemon/conversation-agent-loop.ts

@@ -70,7 +70,6 @@ import type { UserPromptSubmitContext } from "../plugin-api/types.js";
 import { runHook } from "../plugins/pipeline.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
-import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
@@ -190,8 +189,8 @@ export interface AssistantSurface {
 // ── abort watchdog ───────────────────────────────────────────────────
 
 /**
- * Generous backstop that drives an aborted turn to its `finally` even if some
- * awaited operation fails to observe the abort signal.
+ * Backstop that drives an aborted turn to its `finally` even if some awaited
+ * operation fails to observe the abort signal.
  *
  * Abort is otherwise cooperative and already wired into the slow paths: the
  * provider call forwards the signal to its HTTP/streaming fetch, and tool
@@ -199,10 +198,11 @@ export interface AssistantSurface {
  * watchdog only fires when a future code path silently ignores abort — without
  * it, such a path would hang the loop forever and latch the conversation's
  * `processing` flag true (the wedged "Thinking…" indicator). It is
- * defense-in-depth, not the primary mechanism, so the timeout is deliberately
- * generous; in the common case abort settles in-flight work well before it.
+ * defense-in-depth, not the primary mechanism: in the common case abort settles
+ * in-flight work in well under a second, so a few seconds is ample headroom for
+ * a cooperative unwind while still releasing a genuinely wedged turn promptly.
  */
-const ABORT_WATCHDOG_MS = 45_000;
+const ABORT_WATCHDOG_MS = 5_000;
 
 /**
  * Race `work` against an abort watchdog. The watchdog stays disarmed until the
@@ -350,18 +350,11 @@ export async function runAgentLoopImpl(
 
   const config = getConfig();
 
-  // Tool-based auto-routing: the switch_inference_profile tool lets the model
-  // self-select a different profile mid-turn. Reset the per-turn slot so a
-  // stale selection from a previous turn doesn't leak forward.
-  ctx.toolRoutedProfile = undefined;
-
   const turnOverrideProfile = userExplicitOverride;
   const forceOverrideProfile = options?.forceOverrideProfile === true;
 
   const readCurrentOverrideProfile = (): string | undefined =>
-    options?.overrideProfile ??
-    resolveOverrideProfile(ctx) ??
-    ctx.toolRoutedProfile;
+    options?.overrideProfile ?? resolveOverrideProfile(ctx);
 
   const effectiveContextWindow = resolveEffectiveContextWindow({
     llm: config.llm,
@@ -383,7 +376,6 @@ export async function runAgentLoopImpl(
   ctx.contextWindowManager.updateConfig(currentContextWindowConfig);
 
   let appliedOverrideProfile = turnOverrideProfile;
-  let emittedToolRoutedProfile: string | undefined;
   const refreshCurrentProfileState = (): string | undefined => {
     const currentOverrideProfile = readCurrentOverrideProfile();
     if (currentOverrideProfile !== appliedOverrideProfile) {
@@ -410,23 +402,6 @@ export async function runAgentLoopImpl(
       );
     }
 
-    // Emit turn_profile_auto_routed when the tool-based router selects a
-    // new profile. Deduplicated so the event fires at most once per profile.
-    if (
-      ctx.toolRoutedProfile &&
-      ctx.toolRoutedProfile !== emittedToolRoutedProfile
-    ) {
-      emittedToolRoutedProfile = ctx.toolRoutedProfile;
-      const profileEntry = config.llm.profiles?.[ctx.toolRoutedProfile];
-      const label = profileEntry?.label ?? ctx.toolRoutedProfile;
-      broadcastMessage({
-        type: "turn_profile_auto_routed",
-        conversationId: ctx.conversationId,
-        profile: ctx.toolRoutedProfile,
-        profileLabel: label,
-      });
-    }
-
     ctx.currentTurnOverrideProfile = currentOverrideProfile;
     return currentOverrideProfile;
   };
@@ -505,6 +480,11 @@ export async function runAgentLoopImpl(
   // resolved once here and threaded into every re-injection — including the
   // post-compaction hook — rather than re-read per assembly call.
   const isNonInteractive = !isInteractiveResolved;
+  // Expose the resolved turn-level interactivity to tool execution so tools
+  // (e.g. ask_question) see whether a human is present to answer, rather than
+  // re-deriving it from live client state that misclassifies a scheduled turn
+  // running on a client-attached conversation.
+  ctx.currentTurnIsNonInteractive = isNonInteractive;
   const diskPressureDecision = classifyDiskPressureTurnPolicy(
     getDiskPressureStatus(),
     {
@@ -790,10 +770,7 @@ export async function runAgentLoopImpl(
     // the post-compaction hook re-emits this same value during in-loop recovery
     // instead of re-resolving against contact/member registry state that may
     // have drifted mid-turn.
-    const actorContext = resolveTurnInboundActorContext(
-      ctx.trustContext,
-      ctx.assistantId,
-    );
+    const actorContext = resolveTurnInboundActorContext(ctx.trustContext);
     ctx.currentTurnInboundActorContext = actorContext;
 
     // Surface long gaps between user messages so the model can acknowledge
@@ -980,6 +957,7 @@ export async function runAgentLoopImpl(
           compactInPlace,
           isNonInteractive,
           modelProfileKey,
+          ...(ctx.modelOverride ? { model: ctx.modelOverride } : {}),
         }),
         abortController.signal,
         watchdogMs,
@@ -1542,6 +1520,10 @@ export async function runAgentLoopImpl(
     ctx.diskPressureCleanupModeActive = false;
     ctx.preactivatedSkillIds = undefined;
     ctx.currentTurnOverrideProfile = undefined;
+    // Turn-scoped interactivity. Clear it so paths that bypass this loop (e.g.
+    // opportunity wakes calling `agentLoop.run` directly) don't inherit a stale
+    // value and instead fall back to live client state in the tool context.
+    ctx.currentTurnIsNonInteractive = undefined;
     // Channel command intents (e.g. Telegram /start) are single-turn metadata.
     // Clear at turn end so they never leak into subsequent unrelated messages.
     ctx.commandIntent = undefined;