@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/runtime/routes/__tests__/webhook-routes.test.ts

@@ -0,0 +1,201 @@
+/**
+ * Unit tests for the webhooks_register route handler's callback-URL
+ * resolution order (LUM-2863).
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { InternalError, UnprocessableEntityError } from "../errors.js";
+
+let isPlatform = false;
+let config: Record<string, unknown> = {};
+let platformContextEnabled = false;
+let registerCallbackRouteError: Error | undefined;
+
+const registerCallbackRouteMock = mock(
+  async (callbackPath: string, _type: string, _source?: string) => {
+    if (registerCallbackRouteError) {
+      throw registerCallbackRouteError;
+    }
+    return `https://gateway.vellum.ai/assistant-123/${callbackPath}`;
+  },
+);
+
+// Spread the real modules: these are broad barrels and replacing them wholesale
+// breaks unrelated importers pulled in by the module under test.
+const actualEnvRegistry = await import("../../../config/env-registry.js");
+mock.module("../../../config/env-registry.js", () => ({
+  ...actualEnvRegistry,
+  getIsPlatform: () => isPlatform,
+}));
+
+const actualLoader = await import("../../../config/loader.js");
+mock.module("../../../config/loader.js", () => ({
+  ...actualLoader,
+  getConfig: () => config,
+}));
+
+mock.module("../../../inbound/platform-callback-registration.js", () => ({
+  registerCallbackRoute: registerCallbackRouteMock,
+  resolvePlatformCallbackRegistrationContext: async () => ({
+    isPlatform,
+    platformBaseUrl: "https://api.vellum.ai",
+    assistantId: platformContextEnabled ? "assistant-123" : "",
+    hasAssistantApiKey: platformContextEnabled,
+    authHeader: platformContextEnabled ? "Api-Key secret" : null,
+    enabled: platformContextEnabled,
+  }),
+}));
+
+const { ROUTES } = await import("../webhook-routes.js");
+
+const registerRoute = ROUTES.find(
+  (r) => r.operationId === "webhooks_register",
+)!;
+
+const register = (body: Record<string, unknown>) =>
+  registerRoute.handler({ body });
+
+describe("webhooks_register callback URL resolution", () => {
+  beforeEach(() => {
+    isPlatform = false;
+    config = {};
+    platformContextEnabled = false;
+    registerCallbackRouteError = undefined;
+    registerCallbackRouteMock.mockClear();
+  });
+
+  test("platform pods register with the platform gateway", async () => {
+    isPlatform = true;
+    platformContextEnabled = true;
+
+    expect(await register({ type: "telegram" })).toEqual({
+      callbackUrl: "https://gateway.vellum.ai/assistant-123/webhooks/telegram",
+      type: "telegram",
+      path: "webhooks/telegram",
+      mode: "platform",
+    });
+  });
+
+  // The bug: a local assistant that IS connected to the platform used to fall
+  // through to the self-hosted branch and 422 when it had no public ingress.
+  test("platform-connected local assistant with no ingress gets the platform callback URL", async () => {
+    platformContextEnabled = true;
+
+    expect(await register({ type: "telegram" })).toEqual({
+      callbackUrl: "https://gateway.vellum.ai/assistant-123/webhooks/telegram",
+      type: "telegram",
+      path: "webhooks/telegram",
+      mode: "platform",
+    });
+    expect(registerCallbackRouteMock).toHaveBeenCalledWith(
+      "webhooks/telegram",
+      "telegram",
+      undefined,
+    );
+  });
+
+  test("disconnected local assistant uses the configured publicBaseUrl", async () => {
+    config = { ingress: { publicBaseUrl: "https://abc.ngrok.io" } };
+
+    expect(await register({ type: "telegram" })).toEqual({
+      callbackUrl: "https://abc.ngrok.io/webhooks/telegram",
+      type: "telegram",
+      path: "webhooks/telegram",
+      mode: "self-hosted",
+    });
+    expect(registerCallbackRouteMock).not.toHaveBeenCalled();
+  });
+
+  test("disconnected local assistant with no ingress is still unprocessable", async () => {
+    await expect(register({ type: "telegram" })).rejects.toBeInstanceOf(
+      UnprocessableEntityError,
+    );
+  });
+
+  // A logged-in local assistant holds platform credentials for the LLM proxy,
+  // so credential presence must not override an explicitly configured tunnel.
+  test("a configured publicBaseUrl wins over platform connectivity", async () => {
+    platformContextEnabled = true;
+    config = { ingress: { publicBaseUrl: "https://abc.ngrok.io" } };
+
+    expect(await register({ type: "telegram" })).toMatchObject({
+      callbackUrl: "https://abc.ngrok.io/webhooks/telegram",
+      mode: "self-hosted",
+    });
+    expect(registerCallbackRouteMock).not.toHaveBeenCalled();
+  });
+
+  // The gateway publishes the Velay tunnel URL into ingress.publicBaseUrl, so
+  // a tunneled platform-connected assistant already resolves to a stable
+  // platform-owned URL through the ingress tier.
+  test("a Velay-managed publicBaseUrl resolves through the ingress tier", async () => {
+    platformContextEnabled = true;
+    config = {
+      ingress: {
+        publicBaseUrl: "https://velay.vellum.ai/assistant-123",
+        publicBaseUrlManagedBy: "velay",
+      },
+    };
+
+    expect(await register({ type: "twilio_voice" })).toEqual({
+      callbackUrl:
+        "https://velay.vellum.ai/assistant-123/webhooks/twilio/voice",
+      type: "twilio_voice",
+      path: "webhooks/twilio/voice",
+      mode: "self-hosted",
+    });
+  });
+
+  test("explicitly disabled ingress is not routed around via the platform", async () => {
+    platformContextEnabled = true;
+    config = { ingress: { enabled: false } };
+
+    await expect(register({ type: "telegram" })).rejects.toBeInstanceOf(
+      UnprocessableEntityError,
+    );
+    expect(registerCallbackRouteMock).not.toHaveBeenCalled();
+  });
+
+  test("the source identifier is forwarded to the platform registration", async () => {
+    platformContextEnabled = true;
+
+    await register({ type: "telegram", source: "@my_bot" });
+
+    expect(registerCallbackRouteMock).toHaveBeenCalledWith(
+      "webhooks/telegram",
+      "telegram",
+      "@my_bot",
+    );
+  });
+
+  test("a failed platform registration surfaces as a 500", async () => {
+    platformContextEnabled = true;
+    registerCallbackRouteError = new Error(
+      "Platform callback route registration failed (HTTP 502)",
+    );
+
+    await expect(register({ type: "telegram" })).rejects.toBeInstanceOf(
+      InternalError,
+    );
+  });
+
+  test("a missing platform registration context surfaces as a 422", async () => {
+    platformContextEnabled = true;
+    registerCallbackRouteError = new Error(
+      "Platform callbacks not available — missing platform registration context",
+    );
+
+    await expect(register({ type: "telegram" })).rejects.toBeInstanceOf(
+      UnprocessableEntityError,
+    );
+  });
+
+  test("a path override replaces the derived webhook path", async () => {
+    platformContextEnabled = true;
+
+    expect(
+      await register({ type: "custom", path: "webhooks/my-provider" }),
+    ).toMatchObject({ path: "webhooks/my-provider" });
+  });
+});

package/src/runtime/routes/acp-routes.ts

@@ -18,8 +18,8 @@ import {
   AcpSessionNotFoundError,
 } from "../../acp/session-manager.js";
 import type { AcpSessionState } from "../../acp/types.js";
+import type { AssistantEvent } from "../../api/index.js";
 import { getConfig } from "../../config/loader.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import { createGuardianRequestForConfirmation } from "../../permissions/confirmation-guardian-request.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getDb } from "../../persistence/db-connection.js";
@@ -159,7 +159,7 @@ function awaitRouteApproval(args: {
         settle(decision, decision === "allow" ? "approved" : "rejected"),
     });
 
-    const confirmationMsg: ServerMessage & {
+    const confirmationMsg: AssistantEvent & {
       type: "confirmation_request";
     } = {
       type: "confirmation_request",

package/src/runtime/routes/bookmark-routes.ts

@@ -20,33 +20,21 @@ import {
 } from "../../persistence/bookmark-crud.js";
 import { getMessageById } from "../../persistence/conversation-crud.js";
 import { getDb } from "../../persistence/db-connection.js";
-import { getLogger } from "../../util/logger.js";
-import { buildAssistantEvent } from "../assistant-event.js";
-import { assistantEventHub } from "../assistant-event-hub.js";
+import { broadcastMessage } from "../assistant-event-hub.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-const log = getLogger("bookmark-routes");
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
 function publishBookmarkCreated(bookmark: BookmarkSummary): void {
-  assistantEventHub
-    .publish(buildAssistantEvent({ type: "bookmark.created", bookmark }))
-    .catch((err) => {
-      log.warn({ err }, "Failed to publish bookmark.created");
-    });
+  broadcastMessage({ type: "bookmark.created", bookmark });
 }
 
 function publishBookmarkDeleted(payload: { messageId: string }): void {
-  assistantEventHub
-    .publish(buildAssistantEvent({ type: "bookmark.deleted", ...payload }))
-    .catch((err) => {
-      log.warn({ err }, "Failed to publish bookmark.deleted");
-    });
+  broadcastMessage({ type: "bookmark.deleted", ...payload });
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/canned-message-complete.ts

@@ -1,5 +1,5 @@
 import { createAssistantMessage } from "../../agent/message-types.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
+import type { AssistantEvent } from "../../api/index.js";
 import {
   addMessage,
   recordConversationPersistedSeq,
@@ -28,7 +28,7 @@ import { publishConversationMessagesChanged } from "../sync/resource-sync-events
 // `state.assistantTurnId` directly, grep for `emitCannedMessageComplete` to
 // find every call site and inline-then-delete.
 export function emitCannedMessageComplete(
-  send: (msg: ServerMessage) => void,
+  send: (msg: AssistantEvent) => void,
   conversationId: string,
   persistedAssistantId: string,
 ): void {

package/src/runtime/routes/consolidation-routes.ts

@@ -29,7 +29,8 @@ import {
 } from "../../persistence/jobs-store.js";
 import { getUsageCostForConversationWindow } from "../../persistence/llm-usage-store.js";
 import { GRAPH_MAINTENANCE_CHECKPOINTS } from "../../plugins/defaults/memory/jobs-worker.js";
-import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/v3/substrate/constants.js";
+import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/substrate/constants.js";
+import { resolveSubstrateTuning } from "../../plugins/defaults/memory/substrate/tuning.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import {
@@ -46,7 +47,12 @@ function isConsolidationAvailable(): boolean {
 }
 
 function consolidationIntervalMs(): number {
-  return getConfig().memory.v2.consolidation_interval_hours * 60 * 60 * 1000;
+  return (
+    resolveSubstrateTuning(getConfig().memory).consolidation_interval_hours *
+    60 *
+    60 *
+    1000
+  );
 }
 
 function readLastRunAt(): number | null {

package/src/runtime/routes/conversation-list-routes.ts

@@ -10,6 +10,7 @@
 
 import { z } from "zod";
 
+import { CHANNEL_IDS } from "../../channels/types.js";
 import { channelBindingSchema } from "../../messaging/channel-binding-schema.js";
 import {
   type Confidence,
@@ -57,16 +58,7 @@ const log = getLogger("conversation-list-routes");
 // Response schemas
 // ---------------------------------------------------------------------------
 
-const channelIdSchema = z.enum([
-  "telegram",
-  "phone",
-  "vellum",
-  "whatsapp",
-  "slack",
-  "email",
-  "platform",
-  "a2a",
-]);
+const channelIdSchema = z.enum(CHANNEL_IDS);
 
 const assistantAttentionSchema = z.object({
   hasUnseenLatestAssistantMessage: z.boolean(),
@@ -453,15 +445,7 @@ export const ROUTES: RouteDefinition[] = [
           "Filter by origin channel. When provided, only conversations with this exact origin_channel value are returned. Omit to include all channels.",
         schema: {
           type: "string",
-          enum: [
-            "slack",
-            "telegram",
-            "whatsapp",
-            "email",
-            "a2a",
-            "vellum",
-            "phone",
-          ],
+          enum: [...CHANNEL_IDS],
         },
       },
     ],

package/src/runtime/routes/conversation-management-routes.ts

@@ -71,7 +71,6 @@ import { deleteSchedule } from "../../schedule/schedule-store.js";
 import { UserError } from "../../util/errors.js";
 import { safeParseRecord } from "../../util/json.js";
 import { getLogger } from "../../util/logger.js";
-import { silentlyWithLog } from "../../util/silently.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
@@ -337,10 +336,7 @@ async function handleSummarizeConversation({ body = {} }: RouteHandlerArgs) {
         conversation.abortController = null;
       }
       conversation.setProcessing(false);
-      silentlyWithLog(
-        conversation.drainQueue(),
-        "summarize-command queue drain",
-      );
+      void conversation.kickDrainQueue("loop_complete", "summarize_command");
     }
   })();
 

package/src/runtime/routes/conversation-query-routes.ts

@@ -55,6 +55,10 @@ import {
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
+import {
+  describeShadowedConfigSet,
+  findSubstrateShadowing,
+} from "../../config/substrate-twin-shadowing.js";
 import { getConfigWatcher } from "../../daemon/config-watcher.js";
 import {
   getEmbeddingConfigInfo,
@@ -88,9 +92,9 @@ import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embeddi
 import { getLlmRequestLogSource } from "../../persistence/llm-request-log-source.js";
 import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
-import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/memory-v2-activation-log-store.js";
+import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/substrate/constants.js";
+import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
-import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/v3/substrate/constants.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
@@ -459,10 +463,10 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
  * response needs the same treatment so external clients (macOS, web, CLI)
  * see the effective value rather than `undefined` when the daemon hasn't
  * persisted an explicit choice yet. For example, on a freshly-hatched
- * platform-managed assistant, `services.image-generation.mode` may be absent
- * from disk (only `llm.profiles` was written by `seedInferenceProfiles`); the
- * fill pass ensures clients receive `"managed"` rather than falling back to
- * their own defaults.
+ * platform-managed assistant, `services.image-generation.provider` may be
+ * absent from disk (only `llm.profiles` was written by
+ * `seedInferenceProfiles`); the fill pass ensures clients receive `"vellum"`
+ * rather than falling back to their own defaults.
  *
  * Guards against `loadRawConfig()` handing us a value that is technically
  * valid JSON but not a plain object (e.g. literal `null`, a number, or an
@@ -703,7 +707,10 @@ const ConfigGetResponseSchema = z
           .passthrough()
           .optional(),
         "image-generation": z
-          .object({ mode: ServiceModeSchema.optional() })
+          .object({
+            provider: z.string().optional(),
+            model: z.string().optional(),
+          })
           .passthrough()
           .optional(),
         inference: z
@@ -807,7 +814,10 @@ const ConfigPatchRequestSchema = z
           .nullable()
           .optional(),
         "image-generation": z
-          .object({ mode: ServiceModeSchema.optional() })
+          .object({
+            provider: z.string().optional(),
+            model: z.string().optional(),
+          })
           .passthrough()
           .nullable()
           .optional(),
@@ -1449,6 +1459,28 @@ export async function commitConfigWrite(
   }
 }
 
+/**
+ * Web clients pair provider writes with a legacy `mode` key so their saves
+ * stay valid on daemons whose schemas still carry it. The provider-only
+ * services (web-search, image-generation) parse-strip that key, but the
+ * deep-merge would still persist it to raw config.json on every save —
+ * scrub it so the removed field cannot be resurrected on disk.
+ */
+function scrubRemovedServiceModes(raw: Record<string, unknown>): void {
+  const services = raw.services as
+    | Record<string, Record<string, unknown> | undefined>
+    | undefined;
+  if (!services) {
+    return;
+  }
+  for (const key of ["web-search", "image-generation"]) {
+    const entry = services[key];
+    if (entry && typeof entry === "object" && "mode" in entry) {
+      delete entry.mode;
+    }
+  }
+}
+
 async function handlePatchConfig({ body }: RouteHandlerArgs) {
   if (
     !body ||
@@ -1467,6 +1499,7 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
   const patch = body as Record<string, unknown>;
   backfillNewCallSiteEntries(raw, patch);
   deepMergeOverwrite(raw, patch);
+  scrubRemovedServiceModes(raw);
 
   await commitConfigWrite(raw, "patch");
 
@@ -1568,6 +1601,17 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
   }
 
   await commitConfigWrite(raw, "set");
+  // A `memory.v2` substrate tunable whose `memory.substrate` twin is set does
+  // not mean what an unpaired write means: the substrate namespace wins in
+  // `resolveSubstrateTuning`, and for the three twins the v2 injection engine
+  // reads directly the two namespaces diverge instead. Report which case this
+  // is alongside the success so the caller can tell the operator.
+  const shadowing = findSubstrateShadowing(raw, path);
+  if (shadowing) {
+    const warning = describeShadowedConfigSet(shadowing, path);
+    log.warn({ path, substratePath: shadowing.substratePath }, warning);
+    return { ok: true, warning };
+  }
   return { ok: true };
 }
 

package/src/runtime/routes/conversation-routes.ts

@@ -16,6 +16,7 @@ import {
   createAssistantMessage,
   createUserMessage,
 } from "../../agent/message-types.js";
+import type { AssistantEvent } from "../../api/index.js";
 import {
   BackgroundToolCompletionSchema,
   type ConversationContentBlock,
@@ -81,7 +82,6 @@ import {
   shouldAttachHostProxyForCapability,
 } from "../../daemon/host-proxy-preactivation.js";
 import { getAssistantName } from "../../daemon/identity-helpers.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import type {
   HostProxyTransportMetadata,
   NonHostProxyTransportMetadata,
@@ -142,7 +142,6 @@ import {
   getWorkspaceDir,
   getWorkspacePromptPath,
 } from "../../util/platform.js";
-import { silentlyWithLog } from "../../util/silently.js";
 import { assistantEventHub, broadcastMessage } from "../assistant-event-hub.js";
 import { getCurrentSeq } from "../assistant-stream-state.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -457,11 +456,26 @@ async function collectGuardianRequestHintIds(
 async function expireOrphanedGuardianRequests(
   conversationId: string,
 ): Promise<void> {
-  const sourceScoped = await listGuardianRequestsOrEmpty({
-    sourceConversationId: conversationId,
-    status: "pending",
-    kind: "tool_approval",
-  });
+  const [toolApprovals, pendingQuestions] = await Promise.all([
+    listGuardianRequestsOrEmpty({
+      sourceConversationId: conversationId,
+      status: "pending",
+      kind: "tool_approval",
+    }),
+    listGuardianRequestsOrEmpty({
+      sourceConversationId: conversationId,
+      status: "pending",
+      kind: "pending_question",
+    }),
+  ]);
+
+  // Voice-call questions (callSessionId present) track their lifecycle in the
+  // calls domain, not `pendingInteractions` — never treat them as orphaned
+  // here. Only ask_question rows are interaction-bound.
+  const sourceScoped = [
+    ...toolApprovals,
+    ...pendingQuestions.filter((req) => !req.callSessionId),
+  ];
 
   for (const req of sourceScoped) {
     // Skip requests that still have a live in-memory pending interaction —
@@ -494,7 +508,7 @@ async function tryConsumeGuardianReply(params: {
     filePath?: string;
   }>;
   conversation: Conversation;
-  onEvent: (msg: ServerMessage) => void;
+  onEvent: (msg: AssistantEvent) => void;
   approvalConversationGenerator?: ApprovalConversationGenerator;
   /** Verified actor identity from actor-token middleware. */
   verifiedActorExternalUserId?: string;
@@ -1963,10 +1977,7 @@ export async function handleSendMessage(
         recordConversationPersistedSeq(conversationId, getCurrentSeq());
         publishConversationMessagesChanged(conversationId, originClientId);
         conversation.setProcessing(false);
-        silentlyWithLog(
-          conversation.drainQueue(),
-          "canned-greeting queue drain",
-        );
+        void conversation.kickDrainQueue("loop_complete", "canned_greeting");
 
         conversation.warmPromptCache();
       }, 0);
@@ -1980,7 +1991,7 @@ export async function handleSendMessage(
     } finally {
       if (!cleanupDeferred && conversation.isProcessing()) {
         conversation.setProcessing(false);
-        silentlyWithLog(conversation.drainQueue(), "error-path queue drain");
+        void conversation.kickDrainQueue("loop_complete", "send_error_path");
       }
     }
   }
@@ -2292,7 +2303,7 @@ export async function handleSendMessage(
         recordConversationPersistedSeq(conversationId, getCurrentSeq());
         publishConversationMessagesChanged(conversationId, originClientId);
         conversation.setProcessing(false);
-        silentlyWithLog(conversation.drainQueue(), "slash-command queue drain");
+        void conversation.kickDrainQueue("loop_complete", "slash_command");
       }, 0);
 
       cleanupDeferred = true;
@@ -2302,7 +2313,7 @@ export async function handleSendMessage(
       // setTimeout above), but still needed for error paths.
       if (!cleanupDeferred && conversation.isProcessing()) {
         conversation.setProcessing(false);
-        silentlyWithLog(conversation.drainQueue(), "error-path queue drain");
+        void conversation.kickDrainQueue("loop_complete", "send_error_path");
       }
     }
   }
@@ -2329,12 +2340,12 @@ export async function handleSendMessage(
       // throw from this initial persist never reaches it — reset here so the
       // conversation isn't stranded in queued mode.
       conversation.setProcessing(false);
-      silentlyWithLog(conversation.drainQueue(), "compact-command queue drain");
+      void conversation.kickDrainQueue("loop_complete", "compact_command");
       throw err;
     }
     if (persisted.deduplicated) {
       conversation.setProcessing(false);
-      silentlyWithLog(conversation.drainQueue(), "compact-dedup queue drain");
+      void conversation.kickDrainQueue("loop_complete", "compact_dedup");
       return {
         accepted: true,
         messageId: persisted.id,
@@ -2384,10 +2395,7 @@ export async function handleSendMessage(
         });
       } finally {
         conversation.setProcessing(false);
-        silentlyWithLog(
-          conversation.drainQueue(),
-          "compact-command queue drain",
-        );
+        void conversation.kickDrainQueue("loop_complete", "compact_command");
       }
     })();
 
@@ -2465,7 +2473,7 @@ export async function handleSendMessage(
       };
     } finally {
       conversation.setProcessing(false);
-      silentlyWithLog(conversation.drainQueue(), "clean-command queue drain");
+      void conversation.kickDrainQueue("loop_complete", "clean_command");
     }
   }
 
@@ -3007,6 +3015,12 @@ export const ROUTES: RouteDefinition[] = [
           "Plugin ids that scope this conversation to a subset of installed plugins (first-party defaults are always available). When present on a message, it sets/updates the conversation's plugin scope (the web client sends it only on the first message of a new chat). null clears the scope to default (all enabled plugins); omitting the field leaves the existing scope unchanged.",
         ),
       riskThreshold: z.enum(VALID_RISK_THRESHOLDS).optional(),
+      bypassSecretCheck: z
+        .boolean()
+        .optional()
+        .describe(
+          'When true, skip the secret-ingress scan for this message only. Set exclusively when the user explicitly confirms a client-side blocked send (the composer\'s "Send anyway" action); it is per-message and never persisted.',
+        ),
       hidden: z
         .boolean()
         .optional()

package/src/runtime/routes/credential-request-routes.ts

@@ -25,7 +25,6 @@ type GatewayMintResult =
   | { ok: false; error: string };
 
 const MINT_ERROR_MESSAGES: Record<string, string> = {
-  flag_disabled: "One-time credential links are not enabled",
   no_public_base_url:
     "No public ingress URL is configured — set ingress.publicBaseUrl first",
   rate_limited: "Too many credential links created — try again in a minute",

package/src/runtime/routes/filing-routes.ts

@@ -16,7 +16,7 @@
 import { z } from "zod";
 
 import { getConfig } from "../../config/loader.js";
-import { usesConceptPageMemory } from "../../config/memory-v3-gate.js";
+import { isMemoryV1Active } from "../../config/memory-v3-gate.js";
 import { getMemoryCheckpoint } from "../../persistence/checkpoints.js";
 import {
   enqueueMemoryJob,
@@ -29,12 +29,12 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 function isFilingAvailable(): boolean {
   const config = getConfig();
-  // Filing runs through the memory jobs worker, whose slow lane is parked
-  // while memory is disabled — an enqueued job would sit pending forever, so
-  // report unavailable (and reject run-now) rather than queue dead work.
-  return (
-    config.memory.enabled !== false && !usesConceptPageMemory(config.memory)
-  );
+  // PKB filing is v1 work, so it is available on exactly the v1 tier. That
+  // covers both cases the docstring names: under concept-page memory filing
+  // yields to consolidation, and while memory is disabled the jobs worker's
+  // slow lane is parked, so an enqueued job would sit pending forever. Report
+  // unavailable (and reject run-now) rather than queue dead work.
+  return isMemoryV1Active(config);
 }
 
 // ---------------------------------------------------------------------------