@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/__tests__/agent-wake.test.ts

@@ -87,6 +87,13 @@ interface WakeConversationProbe {
    * persistent `setTrustContext`) and restores the prior value in its finally.
    */
   turnTrustContextSets: Array<{ ctx: unknown; order: number }>;
+  /**
+   * `setTrustContext` writes to the persistent `conversation.trustContext`,
+   * in order. A trust-carrying wake's resolver leaves its trust here; the
+   * wake must put the prior value back so it doesn't linger for a later
+   * no-trust wake.
+   */
+  trustContextSets: unknown[];
   /**
    * Every assignment to `conversation.wakePersonaOverride`, in order. A
    * wake that applies an override records `[override, undefined]` — the
@@ -340,6 +347,10 @@ import type {
   AgentLoopRunResult,
 } from "../../agent/loop.js";
 import type { Conversation } from "../../daemon/conversation.js";
+import {
+  deleteConversation,
+  setConversation,
+} from "../../daemon/conversation-registry.js";
 import { ContextOverflowError, type Message } from "../../providers/types.js";
 import {
   __resetWakeChainForTests,
@@ -387,6 +398,8 @@ function makeWakeConversation(options: {
    * (always under the mocked 200k window).
    */
   estimatedInputTokens?: number;
+  /** Seed for the conversation's resting `trustContext`. */
+  initialTrustContext?: unknown;
 }): WakeConversation {
   const conversationId = options.conversationId ?? "conv-test";
   const probe: WakeConversationProbe = {
@@ -401,6 +414,7 @@ function makeWakeConversation(options: {
     processingDuringDrain: [],
     allowedToolSnapshots: [],
     turnTrustContextSets: [],
+    trustContextSets: [],
     personaOverrideSets: [],
     persistedAtEachEmit: [],
     maybeCompactOrders: [],
@@ -413,6 +427,7 @@ function makeWakeConversation(options: {
   let activeAllowedTools = options.initialAllowedTools;
   let wakePersonaOverride: unknown;
   let currentTurnTrustContext: unknown;
+  let persistentTrustContext: unknown = options.initialTrustContext;
   const snapshotAllowedTools = (): string[] | undefined =>
     activeAllowedTools ? [...activeAllowedTools].sort() : undefined;
 
@@ -526,7 +541,14 @@ function makeWakeConversation(options: {
     },
     getTurnChannelContext: () => null,
     getTurnInterfaceContext: () => null,
-    trustContext: undefined,
+    get trustContext() {
+      return persistentTrustContext;
+    },
+    // Mirrors Conversation.setTrustContext (coerces null → undefined).
+    setTrustContext(ctx: unknown) {
+      persistentTrustContext = ctx ?? undefined;
+      probe.trustContextSets.push(ctx);
+    },
     buildCurrentSystemPrompt: () => "mock-system-prompt",
     modelOverride: undefined,
     ...(drainQueue ? { drainQueue } : {}),
@@ -1535,6 +1557,141 @@ describe("wakeAgentForOpportunity", () => {
     expect(conversation.currentTurnTrustContext).toBeUndefined();
   });
 
+  // ── Persistent-trust restore ────────────────────────────────────────
+  // The resolver leaves the wake's trust on the conversation. The wake must
+  // put the prior resting value back, or a later no-trust wake inherits it
+  // through tool setup's `currentTurnTrustContext ?? trustContext` fallback.
+
+  const GUARDIAN_TRUST = {
+    sourceChannel: "vellum",
+    trustClass: "guardian",
+  } as const;
+
+  // The wake reads the prior trust from the live registry, so a test that
+  // wants to exercise the restore registers its double there and simulates
+  // the resolver's write by setting the trust in resolveTarget.
+  const withRegisteredConversation = async (
+    conversation: WakeConversation,
+    run: () => Promise<unknown>,
+  ): Promise<void> => {
+    setConversation(conversation.conversationId, conversation as Conversation);
+    try {
+      await run();
+    } finally {
+      deleteConversation(conversation.conversationId);
+    }
+  };
+
+  test("restores the conversation's prior trust once the wake ends", async () => {
+    const priorTrust = {
+      sourceChannel: "slack",
+      trustClass: "trusted_contact",
+    } as const;
+    const conversation = makeWakeConversation({
+      conversationId: "conv-trust-restore",
+      initialTrustContext: priorTrust,
+    });
+
+    await withRegisteredConversation(conversation, () =>
+      wakeAgentForOpportunity(
+        {
+          conversationId: "conv-trust-restore",
+          hint: "x",
+          source: "t",
+          trustContext: GUARDIAN_TRUST,
+        },
+        {
+          resolveTarget: async () => {
+            conversation.setTrustContext(GUARDIAN_TRUST);
+            return conversation;
+          },
+        },
+      ),
+    );
+
+    // Resolver installs guardian, wake restores the prior value.
+    expect(conversation.trustContextSets).toEqual([GUARDIAN_TRUST, priorTrust]);
+    expect(conversation.trustContext).toEqual(priorTrust);
+  });
+
+  test("restores the prior trust even when the agent loop throws", async () => {
+    const conversation = makeWakeConversation({
+      conversationId: "conv-trust-restore-throw",
+      runImpl: async () => {
+        throw new Error("boom");
+      },
+    });
+
+    await withRegisteredConversation(conversation, () =>
+      wakeAgentForOpportunity(
+        {
+          conversationId: "conv-trust-restore-throw",
+          hint: "x",
+          source: "t",
+          trustContext: GUARDIAN_TRUST,
+        },
+        {
+          resolveTarget: async () => {
+            conversation.setTrustContext(GUARDIAN_TRUST);
+            return conversation;
+          },
+        },
+      ),
+    );
+
+    // Nothing was resting before the wake, so it goes back to unset.
+    expect(conversation.trustContext).toBeUndefined();
+  });
+
+  test("leaves a trust that was re-set mid-run alone (identity guard)", async () => {
+    const replaced = {
+      sourceChannel: "vellum",
+      trustClass: "unknown",
+    } as const;
+    const conversation = makeWakeConversation({
+      conversationId: "conv-trust-guard",
+      runImpl: async (input) => {
+        conversation.setTrustContext(replaced);
+        return runResult(input);
+      },
+    });
+
+    await withRegisteredConversation(conversation, () =>
+      wakeAgentForOpportunity(
+        {
+          conversationId: "conv-trust-guard",
+          hint: "x",
+          source: "t",
+          trustContext: GUARDIAN_TRUST,
+        },
+        {
+          resolveTarget: async () => {
+            conversation.setTrustContext(GUARDIAN_TRUST);
+            return conversation;
+          },
+        },
+      ),
+    );
+
+    // The wake sees a different reference than it installed, so it doesn't
+    // restore: two writes (resolver install, mid-run replacement), no third.
+    expect(conversation.trustContext).toEqual(replaced);
+    expect(conversation.trustContextSets).toHaveLength(2);
+  });
+
+  test("never touches the persistent trust when the wake carries none", async () => {
+    const conversation = makeWakeConversation({
+      conversationId: "conv-trust-none",
+    });
+
+    await wakeAgentForOpportunity(
+      { conversationId: "conv-trust-none", hint: "x", source: "t" },
+      { resolveTarget: async () => conversation },
+    );
+
+    expect(conversation.trustContextSets).toHaveLength(0);
+  });
+
   test("two concurrent wakes on the same conversation are serialized", async () => {
     // Build a target whose agentLoop.run resolves only when we signal.
     const gate1 = Promise.withResolvers<void>();

package/src/runtime/__tests__/channel-verification-service.test.ts

@@ -73,7 +73,7 @@ describe("getGuardianBinding", () => {
     expect(binding?.verifiedVia).toBe("verified");
   });
 
-  test("falls back to empty strings for absent optional delivery fields", async () => {
+  test("a missing principal surfaces as null (unresolved), never an empty string", async () => {
     mockGuardianList = [
       {
         channelType: "telegram",
@@ -85,7 +85,7 @@ describe("getGuardianBinding", () => {
 
     const binding = await getGuardianBinding("asst-1", "telegram");
 
-    expect(binding?.guardianPrincipalId).toBe("");
+    expect(binding?.guardianPrincipalId).toBeNull();
     expect(binding?.guardianDeliveryChatId).toBe("");
     expect(binding?.verifiedAt).toBe(0);
   });

package/src/runtime/__tests__/trust-verdict-consumer.test.ts

@@ -128,6 +128,43 @@ describe("trustContextFromVerdict", () => {
     expect(result.memberPolicy).toBe("escalate");
   });
 
+  test("carries the verdict's gateway-owned interaction count onto the context", () => {
+    const verdict = {
+      trustClass: "trusted_contact",
+      canonicalSenderId: "u-1",
+      contactId: "contact-1",
+      channelId: "channel-1",
+      status: "active",
+      policy: "allow",
+      interactionCount: 9,
+    } satisfies TrustVerdict;
+
+    const result = trustContextFromVerdict(verdict, {
+      sourceChannel: "slack",
+      conversationExternalId: CONV,
+    });
+
+    expect(result.requesterInteractionCount).toBe(9);
+  });
+
+  test("leaves interaction count undefined when the verdict carries none", () => {
+    const verdict = {
+      trustClass: "trusted_contact",
+      canonicalSenderId: "u-1",
+      contactId: "contact-1",
+      channelId: "channel-1",
+      status: "active",
+      policy: "allow",
+    } satisfies TrustVerdict;
+
+    const result = trustContextFromVerdict(verdict, {
+      sourceChannel: "slack",
+      conversationExternalId: CONV,
+    });
+
+    expect(result.requesterInteractionCount).toBeUndefined();
+  });
+
   test("memberless verdict leaves ACL member fields undefined", () => {
     const verdict = {
       trustClass: "unknown",
@@ -322,8 +359,6 @@ describe("actorTrustContextFromVerdict", () => {
     // INFO fields must be null/default placeholders.
     expect(memberRecord!.contact.notes).toBeNull();
     expect(memberRecord!.contact.userFile).toBeNull();
-    expect(memberRecord!.contact.interactionCount).toBe(0);
-    expect(memberRecord!.contact.lastInteraction).toBeNull();
   });
 
   test("guardian member verdict maps role guardian + principalId", () => {
@@ -436,10 +471,6 @@ describe("toTrustContext member grounding", () => {
       address: "+15550100",
       isPrimary: true,
       externalChatId: null,
-      inviteId: null,
-      lastSeenAt: null,
-      interactionCount: 0,
-      lastInteraction: null,
       updatedAt: null,
       createdAt: 0,
     };
@@ -451,8 +482,6 @@ describe("toTrustContext member grounding", () => {
       displayName: "Frank",
       notes: null,
       role: "contact",
-      lastInteraction: null,
-      interactionCount: 0,
       createdAt: 0,
       updatedAt: 0,
       contactType: "human",

package/src/runtime/access-request-helper.ts

@@ -26,6 +26,8 @@ import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import type { GuardianResolutionSource } from "../notifications/signal.js";
 import { getLogger } from "../util/logger.js";
 import { resolveAnchoredGuardian } from "./anchored-guardian.js";
+import { CHALLENGE_TTL_MS } from "./channel-verification-service.js";
+import { serializeRequesterSignals } from "./introduction-policy.js";
 import { GUARDIAN_APPROVAL_TTL_MS } from "./routes/channel-route-shared.js";
 
 const log = getLogger("access-request-helper");
@@ -44,6 +46,8 @@ export interface AccessRequestParams {
   previousMemberStatus?: Exclude<ChannelStatus, "unverified">;
   /** Preview of the requester's original message, shown to the guardian. */
   messagePreview?: string;
+  /** The sender is a bot / integration account (no verification handshake possible). */
+  isBot?: boolean;
   /** Slack-specific: user is from an external workspace (Slack Connect). */
   isStranger?: boolean;
   /** Slack-specific: user is a guest / restricted account. */
@@ -54,7 +58,98 @@ export interface AccessRequestParams {
 
 export type AccessRequestResult =
   | { notified: true; created: boolean; requestId: string }
-  | { notified: false; reason: "no_sender_id" };
+  | {
+      notified: false;
+      reason:
+        | "no_sender_id"
+        | "already_denied"
+        | "approval_pending_verification";
+    };
+
+// ---------------------------------------------------------------------------
+// Terminal-deny lookup
+// ---------------------------------------------------------------------------
+
+/**
+ * Assistant-scoped conversation id for an actor's access requests. Stable key
+ * that dedupes pending prompts and detects a prior terminal deny for the same
+ * (assistant, channel, actor).
+ */
+export function accessRequestConversationId(
+  canonicalAssistantId: string,
+  sourceChannel: string,
+  actorExternalId: string,
+): string {
+  return `access-req-${canonicalAssistantId}-${sourceChannel}-${actorExternalId}`;
+}
+
+/**
+ * Whether the guardian has already terminally denied an access request from
+ * this actor on this channel. Callers use it to suppress re-engagement — both
+ * the guardian prompt and the self-verify challenge — for a sender the guardian
+ * explicitly rejected. Reads the retained `denied` canonical request scoped by
+ * the assistant-scoped conversation id.
+ */
+export function isAccessRequestDenied(params: {
+  canonicalAssistantId: string;
+  sourceChannel: string;
+  actorExternalId: string;
+}): boolean {
+  const conversationId = accessRequestConversationId(
+    params.canonicalAssistantId,
+    params.sourceChannel,
+    params.actorExternalId,
+  );
+  return (
+    listCanonicalGuardianRequests({
+      status: "denied",
+      requesterExternalUserId: params.actorExternalId,
+      sourceChannel: params.sourceChannel,
+      kind: "access_request",
+      conversationId,
+    }).length > 0
+  );
+}
+
+/**
+ * Whether this sender is inside the post-approval verification window: the
+ * guardian approved their access request recently enough that the minted
+ * 6-digit code could still be redeemable. In that state the handshake is in
+ * progress — the sender needs to enter the code, not trigger a fresh access
+ * request.
+ *
+ * Keyed on the approval decision time (the request row's `updatedAt`) bounded
+ * by the verification-code TTL, deliberately NOT on live verification-session
+ * rows: session lookups cannot distinguish the approval-minted session from a
+ * self-verify challenge session the ACL mints on the same inbound, or from an
+ * unrelated session bound to the same identity (guardian-initiated
+ * verification, invites).
+ *
+ * Voice is excluded: phone approvals activate the caller directly and never
+ * mint a code.
+ */
+export function isApprovalHandshakeInProgress(params: {
+  canonicalAssistantId: string;
+  sourceChannel: string;
+  actorExternalId: string;
+}): boolean {
+  if (params.sourceChannel === "phone") {
+    return false;
+  }
+  const conversationId = accessRequestConversationId(
+    params.canonicalAssistantId,
+    params.sourceChannel,
+    params.actorExternalId,
+  );
+  const windowStart = Date.now() - CHALLENGE_TTL_MS;
+  return listCanonicalGuardianRequests({
+    status: "approved",
+    requesterExternalUserId: params.actorExternalId,
+    sourceChannel: params.sourceChannel,
+    kind: "access_request",
+    conversationId,
+  }).some((request) => request.updatedAt >= windowStart);
+}
 
 // ---------------------------------------------------------------------------
 // Helper
@@ -86,6 +181,7 @@ export async function notifyGuardianOfAccessRequest(
     actorUsername,
     previousMemberStatus,
     messagePreview,
+    isBot,
     isStranger,
     isRestricted,
     messageTs,
@@ -122,7 +218,11 @@ export async function notifyGuardianOfAccessRequest(
   // matches requests for the same assistant. Without this, a pending request
   // from assistant A could be returned for assistant B, allowing the caller
   // to piggyback on A's guardian approval.
-  const conversationId = `access-req-${canonicalAssistantId}-${sourceChannel}-${actorExternalId}`;
+  const conversationId = accessRequestConversationId(
+    canonicalAssistantId,
+    sourceChannel,
+    actorExternalId,
+  );
 
   // Deduplicate: skip creation if there is already a pending canonical request
   // for the same requester on this channel *and* assistant. Still return
@@ -147,6 +247,47 @@ export async function notifyGuardianOfAccessRequest(
     };
   }
 
+  // Terminal-deny suppression: once the guardian has denied an access request
+  // for this sender on this channel, subsequent inbound must not re-prompt.
+  // The denied decision persists the sender as an unverified_contact (see the
+  // accessRequestResolver deny path); re-surfacing the same request the
+  // guardian already rejected would be noise. The guardian can still verify the
+  // contact manually — that path does not go through here. Checked before the
+  // handshake window below so a standing deny always wins over an earlier
+  // approval.
+  if (
+    isAccessRequestDenied({
+      canonicalAssistantId,
+      sourceChannel,
+      actorExternalId,
+    })
+  ) {
+    log.debug(
+      { sourceChannel, actorExternalId },
+      "Suppressing access request notification — guardian already denied this sender",
+    );
+    return { notified: false, reason: "already_denied" };
+  }
+
+  // Handshake-in-progress suppression: within the verification-code window
+  // after the guardian approves, the flow is waiting on the requester to enter
+  // their code. Inbound from the sender in that window must not create a new
+  // request or re-notify the guardian; once the window lapses unconsumed,
+  // re-prompting is allowed again.
+  if (
+    isApprovalHandshakeInProgress({
+      canonicalAssistantId,
+      sourceChannel,
+      actorExternalId,
+    })
+  ) {
+    log.debug(
+      { sourceChannel, actorExternalId },
+      "Suppressing access request notification — approval granted, verification window still open",
+    );
+    return { notified: false, reason: "approval_pending_verification" };
+  }
+
   const senderIdentifier = actorDisplayName || actorUsername || actorExternalId;
   const requestId = `access-req-${canonicalAssistantId}-${sourceChannel}-${actorExternalId}-${Date.now()}`;
 
@@ -162,6 +303,11 @@ export async function notifyGuardianOfAccessRequest(
     guardianPrincipalId: guardianPrincipalId ?? undefined,
     toolName: "ingress_access_request",
     questionText: `${senderIdentifier} is requesting access to the assistant`,
+    requesterSignals: serializeRequesterSignals({
+      isBot,
+      isStranger,
+      isRestricted,
+    }),
     expiresAt: Date.now() + GUARDIAN_APPROVAL_TTL_MS,
   });
 
@@ -207,14 +353,19 @@ export async function notifyGuardianOfAccessRequest(
       guardianResolutionSource,
       previousMemberStatus: previousMemberStatus ?? null,
       messagePreview: messagePreview ?? null,
+      ...(isBot !== undefined ? { isBot } : {}),
       ...(isStranger !== undefined ? { isStranger } : {}),
       ...(isRestricted !== undefined ? { isRestricted } : {}),
       ...(messageTs ? { messageTs } : {}),
     },
     dedupeKey: `access-request:${canonicalRequest.id}`,
     onConversationCreated: (info) => {
-      if (info.sourceEventName !== "ingress.access_request" || vellumDeliveryId)
+      if (
+        info.sourceEventName !== "ingress.access_request" ||
+        vellumDeliveryId
+      ) {
         return;
+      }
       vellumDeliveryId = recordApprovalCardDelivery({
         requestId: canonicalRequest.id,
         channel: "vellum",

package/src/runtime/actor-trust-resolver.ts

@@ -34,6 +34,7 @@ import type { TrustContext } from "../daemon/trust-context.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
 import { getLogger } from "../util/logger.js";
 import { getCachedMemberAcl } from "./member-verdict-cache.js";
+import type { TrustClass } from "./trust-class.js";
 
 const log = getLogger("actor-trust-resolver");
 
@@ -44,27 +45,11 @@ export type { TrustContext } from "../daemon/trust-context.js";
 // ---------------------------------------------------------------------------
 
 /**
- * Trust classification for an inbound actor.
- *
- * - `'guardian'`: The sender matches the active guardian binding for this
- *   (assistant, channel). Guardians have full control-plane access and
- *   self-approve tool invocations.
- * - `'trusted_contact'`: The sender is an active contact with a channel
- *   (not the guardian). Trusted contacts can invoke tools but require
- *   guardian approval for sensitive operations.
- * - `'unverified_contact'`: The sender matches a contact channel whose
- *   status is `pending` or `unverified` — known to the guardian but not yet
- *   verified. Treated identically to `trusted_contact` for every downstream
- *   capability/tool/approval decision; the distinction is admission-only.
- * - `'unknown'`: The sender has no contact record, no identity could be
- *   established, or the sender is a blocked/revoked contact. Unknown
- *   actors are fail-closed with no escalation path.
+ * Trust classification for an inbound actor. Defined once in `./trust-class.ts`
+ * (shared with the persistence metadata schema) and re-exported here, the
+ * canonical import site for the resolver's consumers.
  */
-export type TrustClass =
-  | "guardian"
-  | "trusted_contact"
-  | "unverified_contact"
-  | "unknown";
+export type { TrustClass };
 
 /**
  * Fully resolved trust context from the actor trust resolver.
@@ -211,7 +196,8 @@ export function resolveActorTrust(
     };
     guardianPrincipalId = guardianDelivery.principalId ?? undefined;
     isGuardian =
-      guardianDelivery.address.toLowerCase() === canonicalSenderId.toLowerCase();
+      guardianDelivery.address.toLowerCase() ===
+      canonicalSenderId.toLowerCase();
   }
 
   log.debug(

package/src/runtime/agent-wake.ts

@@ -108,6 +108,7 @@ import {
   type UntrustedContentSource,
   wrapUntrustedContent,
 } from "../security/untrusted-content.js";
+import type { CompletedBackgroundTool } from "../tools/background-tool-registry.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("agent-wake");
@@ -323,6 +324,12 @@ export interface WakeOptions {
    * framing outside the fence.
    */
   untrustedOutput?: WakeUntrustedOutput;
+  /**
+   * Structured terminal record for a backgrounded bash/host_bash run, stamped
+   * onto the persisted background-event wake so the web can rebuild the inline
+   * card from history after a daemon restart.
+   */
+  backgroundToolCompletion?: CompletedBackgroundTool;
   /**
    * Schedule-run id to stamp on the usage rows this wake records. Set when the
    * wake is triggered by a script-mode schedule (the firing's run id), so the
@@ -612,6 +619,18 @@ export async function wakeAgentForOpportunity(
   const startedAt = nowFn();
 
   return runSingleFlight(conversationId, async () => {
+    // Snapshot the conversation's resting trust before the resolver runs, so
+    // it can be restored after. The resolver leaves the wake's trust on the
+    // conversation, and a following no-trust wake would otherwise read it via
+    // tool setup's `currentTurnTrustContext ?? trustContext` fallback. Null
+    // when the conversation isn't resident yet (a fresh hydrate or a fork).
+    let priorPersistentTrust: TrustContext | null = null;
+    if (opts.trustContext) {
+      const { findConversation } =
+        await import("../daemon/conversation-registry.js");
+      priorPersistentTrust =
+        findConversation(conversationId)?.trustContext ?? null;
+    }
     const resolved = await resolveTarget(opts);
     if (resolved === "archived") {
       log.info(
@@ -633,6 +652,18 @@ export async function wakeAgentForOpportunity(
     }
     const conversation = resolved;
 
+    // Put the resting trust back on exit. The guard restores only our own
+    // elevation, so a trust re-set by another turn is left alone; it's also
+    // idempotent, so the several call sites below are safe.
+    const restorePersistentWakeTrust = (): void => {
+      if (
+        opts.trustContext &&
+        conversation.trustContext === opts.trustContext
+      ) {
+        conversation.setTrustContext(priorPersistentTrust);
+      }
+    };
+
     const { decision: diskPressureDecision, status: diskPressureStatus } =
       classifyWakeDiskPressurePolicy(opts);
     if (diskPressureDecision.action === "block") {
@@ -650,6 +681,7 @@ export async function wakeAgentForOpportunity(
         },
         "agent-wake: blocked by disk pressure cleanup mode",
       );
+      restorePersistentWakeTrust();
       return {
         invoked: false,
         producedToolCalls: false,
@@ -663,6 +695,7 @@ export async function wakeAgentForOpportunity(
         { conversationId, source },
         "agent-wake: conversation still processing after timeout; skipping",
       );
+      restorePersistentWakeTrust();
       return { invoked: false, producedToolCalls: false, reason: "timeout" };
     }
 
@@ -784,7 +817,12 @@ export async function wakeAgentForOpportunity(
       };
       conversation.messages.push(triggerMessage);
       try {
-        await persistWakeTriggerMessage(conversation, triggerMessage, source);
+        await persistWakeTriggerMessage(
+          conversation,
+          triggerMessage,
+          source,
+          opts.backgroundToolCompletion,
+        );
       } catch (err) {
         log.warn(
           { conversationId, source, err },
@@ -1412,6 +1450,8 @@ export async function wakeAgentForOpportunity(
 
       return { invoked: true, producedToolCalls };
     } finally {
+      // Put the conversation's resting trust back on every exit path.
+      restorePersistentWakeTrust();
       // The success path (above) already called setProcessing(false)
       // + drainQueue after tail persist. This catch-all handles the
       // error and early-return paths where no tail was produced — those