@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/daemon/handlers/shared.ts

@@ -1,3 +1,7 @@
+import {
+  neutralizeRedactedSentinels,
+  SENTINEL_REDACTION_VERSION,
+} from "@vellumai/service-contracts/redacted-credential";
 import { v4 as uuid } from "uuid";
 
 import type {
@@ -11,6 +15,7 @@ import { getConfig } from "../../config/loader.js";
 import type { LLMCallSite, Speed } from "../../config/schemas/llm.js";
 import { ipcCall as gatewayIpcCall } from "../../ipc/gateway-client.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompt-types.js";
+import type { ConversationCreateType } from "../../persistence/conversation-types.js";
 import { resolveMediaSourceData } from "../../providers/media-resolve.js";
 import { isPlaceholderSentinelText } from "../../providers/placeholder-sentinels.js";
 import type { MediaSource } from "../../providers/types.js";
@@ -180,6 +185,13 @@ export interface ConversationCreateOptions {
    * chronological renderer to consume.
    */
   slackInbound?: SlackInboundMessageMetadata;
+  /**
+   * Conversation type for newly created conversations. When omitted,
+   * defaults to `"standard"` (visible in the sidebar). Set to
+   * `"background"` for plugin-driven conversations that should not
+   * appear in the sidebar's Recents grouping.
+   */
+  conversationType?: ConversationCreateType;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -315,6 +327,10 @@ export function renderHistoryContent(
     } else {
       text = unwrapExternalContentForDisplay(String(content));
     }
+    // Raw-string rows predate the block-shaped persist path entirely, so
+    // they can never carry the `_redactionVersion` rider — always run the
+    // sentinel forgery guard (see the rider check in the block walk below).
+    text = neutralizeRedactedSentinels(text);
     return {
       text,
       toolCalls: [],
@@ -445,7 +461,22 @@ export function renderHistoryContent(
     }
 
     if (block.type === "text" && typeof block.text === "string") {
-      const displayText = unwrapExternalContentForDisplay(block.text);
+      // Forgery guard for pre-feature history: blocks persisted before the
+      // chat-credential sentinel work never had sentinel-shaped strings
+      // neutralized at write, so a forged `〔redacted:…〕` in an old row could
+      // manufacture a reveal chip on a chip-enabled client surface. Blocks
+      // written by the neutralization-aware persist path carry the
+      // `_redactionVersion` rider (internal, never shipped on the wire) and
+      // pass through verbatim — their surviving sentinels are
+      // redactor-authored. Everything else is neutralized here at the read
+      // boundary, the same belt-and-suspenders posture as the
+      // `<no_response/>` and placeholder-sentinel strips below.
+      const rawText =
+        typeof block._redactionVersion === "number" &&
+        block._redactionVersion >= SENTINEL_REDACTION_VERSION
+          ? block.text
+          : neutralizeRedactedSentinels(block.text);
+      const displayText = unwrapExternalContentForDisplay(rawText);
       // Skip empty/whitespace-only text blocks. During streaming the client
       // discards empty text deltas (guard !text.isEmpty), so including them
       // here produces a contentOrder that differs from the live streaming
@@ -673,7 +704,7 @@ export function renderHistoryContent(
               continue;
             }
             const resolved = resolveMediaSourceData(source);
-            if (resolved) imageDataList.push(resolved.data);
+            if (resolved) {imageDataList.push(resolved.data);}
           }
         }
       }

package/src/daemon/lifecycle.ts

@@ -156,8 +156,8 @@ export async function runDaemon(): Promise<void> {
   // so a fast-reconnecting client could otherwise resolve a turn against a
   // partial profile in the window between readiness and the post-overlay
   // ensure call below. Sync, DB-free, and idempotent. Skipped when an
-  // unconsumed onboarding overlay is pending: the overlay can rewrite
-  // llm.default later this boot, and baking against the pre-overlay default
+  // unconsumed onboarding overlay is pending: the overlay can rewrite the
+  // llm config later this boot, and baking against the pre-overlay default
   // would pin the wrong baseline — on that single boot (a fresh hatch, with
   // no established clients to race the window) the post-overlay pass owns
   // materialization; the overlay file is consumed on merge, so every
@@ -235,7 +235,7 @@ export async function runDaemon(): Promise<void> {
     } else {
       setDbMigrationFailed();
       log.error(
-        "Daemon startup: DB opened but one or more migrations failed — /readyz will remain unready",
+        "Daemon startup: DB opened but one or more migrations failed or were deferred — /readyz will remain unready",
       );
     }
     // Migrations have settled (successfully or in the failed degraded mode),
@@ -553,7 +553,7 @@ export async function runDaemon(): Promise<void> {
   }
 
   // Refresh the consent cache regardless of dev mode so record-time telemetry
-  // writes (gated on getCachedShareAnalytics()) work in dev too. The usage
+  // writes (which drop on a confirmed opt-out) work in dev too. The usage
   // telemetry reporter re-checks share_analytics on every flush, so dev still
   // never sends telemetry to the platform. Fire-and-forget: startConsentRefresh()
   // runs an immediate non-blocking refresh, so the startup hot path is never

package/src/daemon/message-types/conversations.ts

@@ -8,6 +8,7 @@ import type { ConversationNoticeEvent } from "../../api/events/conversation-noti
 import type { ConversationTitleUpdatedEvent } from "../../api/events/conversation-title-updated.js";
 import type { GenerationCancelledEvent } from "../../api/events/generation-cancelled.js";
 import type { GenerationHandoffEvent } from "../../api/events/generation-handoff.js";
+import type { OpenConversationEvent } from "../../api/events/open-conversation.js";
 import type { UsageProgressEvent } from "../../api/events/usage-progress.js";
 import type { UsageUpdateEvent } from "../../api/events/usage-update.js";
 import type {
@@ -505,22 +506,10 @@ export interface ScheduleConversationCreated {
   title: string;
 }
 
-/**
- * Server push — instructs the client to open and focus a conversation. If
- * the conversation isn't already present in the client's sidebar list (e.g.
- * it was just created via `POST /v1/conversations`), the client should stub
- * a sidebar entry using the provided `title` before navigating.
- */
-export interface OpenConversation {
-  type: "open_conversation";
-  conversationId: string;
-  /** Optional conversation title; supplied when the client may not yet have the conversation in its list. */
-  title?: string;
-  /** Optional message ID to scroll to after focus. */
-  anchorMessageId?: string;
-  /** When `false`, the client should register the conversation in its sidebar (so it's visible and navigable) but must NOT switch focus to it. Omitting the field defaults to `true` for backward compatibility with existing single-target 'jump to conversation' callers. */
-  focus?: boolean;
-}
+// `open_conversation` is a migrated event: its canonical wire contract lives
+// in `../../api/events/open-conversation.ts` (imported as
+// `OpenConversationEvent`). Instructs the client to open and, by default,
+// focus a conversation — see that file for the full field docs.
 
 // --- Domain-level union aliases (consumed by the barrel file) ---
 
@@ -565,4 +554,4 @@ export type _ConversationsServerMessages =
   | MessageContentResponse
   | ConversationListInvalidatedEvent
   | ScheduleConversationCreated
-  | OpenConversation;
+  | OpenConversationEvent;

package/src/daemon/providers-setup.ts

@@ -1,3 +1,4 @@
+import { maybeDefaultSpeechToManaged } from "../config/managed-speech-defaults.js";
 import { rehydratePlatformCredentials } from "../config/platform-rehydration.js";
 import type { AssistantConfig } from "../config/types.js";
 import { getMcpServerManager } from "../mcp/manager.js";
@@ -32,6 +33,13 @@ export async function initializeProvidersAndTools(
   // overrides are normally only set by the secret-routes handlers at runtime.
   await rehydratePlatformCredentials();
 
+  // Speech defaulting normally fires when the platform credentials land
+  // (secret-routes); evaluating it once per boot also covers assistants whose
+  // connection predates that trigger, so voice works for every connected
+  // assistant with no configured speech credentials. Idempotent, and detached
+  // per the startup philosophy — must not block boot.
+  void maybeDefaultSpeechToManaged();
+
   await initializeProviders(config);
   // initializeTools() also loads workspace tool overrides from
   // `<workspaceDir>/tools/` once core tools have settled, so they own

package/src/daemon/tool-setup-types.ts

@@ -33,7 +33,7 @@ export type SubagentToolGateMode = "wire" | "execution";
  * but the definitions themselves are resolved from the live context: a
  * fork-retrospective wake hydrates clientless (`hasNoClient = true`, no
  * transport interface, no channel capabilities), which drops client-gated
- * tools (`host_*`, `ui_*`, `app_open`, `request_system_permission`) from
+ * tools (`host_*`, `ui_*`, `ask_question`, `request_system_permission`) from
  * the wire definitions and breaks the cache prefix anyway. When this pin is
  * set on the conversation, `isToolActiveForContext` reads `hasNoClient` and
  * `transportInterface` exclusively from the pin and treats channel
@@ -80,6 +80,12 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   allowedToolNames?: Set<string>;
   /** When set, the subagent/wake tool allowlist (see {@link subagentToolGateMode}). */
   subagentAllowedTools?: Set<string>;
+  /**
+   * Collects tool names the subagent attempted but that
+   * {@link subagentAllowedTools} denied, for parent-visible reporting. The
+   * executor records into this Set (shared by reference with the Conversation).
+   */
+  subagentDeniedToolNames?: Set<string>;
   /**
    * How {@link subagentAllowedTools} is enforced. Absent or `"wire"` keeps
    * the historical behavior (definitions filtered before the provider

package/src/daemon/wake-conversation-ops.ts

@@ -342,28 +342,37 @@ export async function persistWakeTriggerMessage(
  * inputs for tool-definition resolution — see {@link WakeToolContextPin}.
  * Its `requestOrigin`, when set, is stamped onto the conversation's per-turn
  * origin so the permission checker's origin-scoped auto-grants fire for the
- * wake. All are set and restored alongside the allowlist.
+ * wake. `preactivateSkillIds`, when non-empty, activates those skills' bundled
+ * tools in the turn's active set (`allowedToolNames`) for the wake so they are
+ * callable without a prior `skill_load`. All are set and restored alongside the
+ * allowlist.
  */
 export function scopeWakeAllowedTools(
   conversation: Conversation,
   tools: ReadonlySet<string>,
   gateMode: SubagentToolGateMode = "wire",
   toolContextPin?: WakeToolContextPin,
+  preactivateSkillIds?: readonly string[],
 ): () => void {
   const previous = conversation.subagentAllowedTools;
   const previousGateMode = conversation.subagentToolGateMode;
   const previousToolContextPin = conversation.toolContextPin;
   const previousRequestOrigin = conversation.currentTurnRequestOrigin;
+  const previousPreactivated = conversation.preactivatedSkillIds;
   conversation.setSubagentAllowedTools(new Set(tools));
   conversation.subagentToolGateMode = gateMode;
   conversation.toolContextPin = toolContextPin;
   if (toolContextPin?.requestOrigin !== undefined) {
     conversation.currentTurnRequestOrigin = toolContextPin.requestOrigin;
   }
+  if (preactivateSkillIds && preactivateSkillIds.length > 0) {
+    conversation.setPreactivatedSkillIds([...preactivateSkillIds]);
+  }
   return () => {
     conversation.setSubagentAllowedTools(previous);
     conversation.subagentToolGateMode = previousGateMode;
     conversation.toolContextPin = previousToolContextPin;
     conversation.currentTurnRequestOrigin = previousRequestOrigin;
+    conversation.setPreactivatedSkillIds(previousPreactivated);
   };
 }

package/src/hooks/types.ts

@@ -173,6 +173,15 @@ export interface UserPromptSubmitInputContext {
    * user speech (e.g. title generation) should skip these turns.
    */
   readonly isHiddenPrompt?: boolean;
+  /**
+   * How the triggering message was initiated when it was sent on the
+   * user's behalf by the UI rather than typed by hand (`body.source` on
+   * `POST /v1/messages`, persisted as `metadata.userMessageSource`).
+   * Current value: `"nav_redirect"` — a navigation shortcut redirected the
+   * user into chat with a pre-filled message. Unset for hand-typed
+   * messages.
+   */
+  readonly messageSource?: string;
   /**
    * The user's original message list, immutable for the hook. Plugins
    * may snapshot or compare against this but MUST NOT mutate it.

package/src/ipc/__tests__/email-ipc.test.ts

@@ -11,6 +11,9 @@
 // Must be first — before any imports that resolve socket paths
 delete process.env.ASSISTANT_IPC_SOCKET_DIR;
 
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { afterEach, beforeEach, expect, mock, test } from "bun:test";
 
 import { runAssistantCommandFull } from "../../cli/__tests__/run-assistant-command.js";
@@ -358,6 +361,93 @@ test("send --json returns delivery_id", async () => {
   expect(process.exitCode).toBe(0);
 });
 
+test("send --attach reads the file and forwards base64 attachments to the platform", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "email-attach-"));
+  const filePath = join(dir, "report.pdf");
+  const fileBytes = "pdf-bytes-here";
+  writeFileSync(filePath, fileBytes);
+
+  let sendBody: Record<string, unknown> | null = null;
+  mockFetchFn = async (path, init) => {
+    if (path.includes("/email-addresses/")) {
+      return new Response(
+        JSON.stringify({
+          results: [{ id: "addr-1", address: "mybot@example.com" }],
+        }),
+        { status: 200 },
+      );
+    }
+    // send endpoint — capture the forwarded payload
+    sendBody = JSON.parse(init?.body as string);
+    return new Response(
+      JSON.stringify({ delivery_id: "del_attach", status: "accepted" }),
+      { status: 200 },
+    );
+  };
+
+  try {
+    await runAssistantCommandFull(
+      "email",
+      "--json",
+      "send",
+      "user@example.com",
+      "-s",
+      "Report",
+      "-b",
+      "Attached",
+      "--attach",
+      filePath,
+    );
+
+    expect(sendBody).not.toBeNull();
+    expect(sendBody!.attachments).toEqual([
+      {
+        filename: "report.pdf",
+        content_type: "application/pdf",
+        content: Buffer.from(fileBytes).toString("base64"),
+      },
+    ]);
+    expect(process.exitCode).toBe(0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("send with a missing --attach path fails without calling the platform", async () => {
+  let sendCalled = false;
+  mockFetchFn = async (path) => {
+    if (path.includes("/email-addresses/")) {
+      return new Response(
+        JSON.stringify({
+          results: [{ id: "addr-1", address: "mybot@example.com" }],
+        }),
+        { status: 200 },
+      );
+    }
+    sendCalled = true;
+    return new Response(
+      JSON.stringify({ delivery_id: "x", status: "accepted" }),
+      { status: 200 },
+    );
+  };
+
+  await runAssistantCommandFull(
+    "email",
+    "--json",
+    "send",
+    "user@example.com",
+    "-s",
+    "Report",
+    "-b",
+    "Attached",
+    "--attach",
+    join(tmpdir(), "does-not-exist-xyz.pdf"),
+  );
+
+  expect(process.exitCode).not.toBe(0);
+  expect(sendCalled).toBe(false);
+});
+
 test("send: 402 billing error surfaces", async () => {
   mockFetchFn = async (path) => {
     if (path.includes("/email-addresses/")) {

package/src/ipc/gateway-client.test.ts

@@ -9,12 +9,14 @@
 import { afterEach, describe, expect, test } from "bun:test";
 
 import {
+  getMockPersistentCallCount,
   mockGatewayIpc,
   resetMockGatewayIpc,
 } from "../__tests__/mock-gateway-ipc.js";
 import {
   ipcCall,
   ipcCallPersistent,
+  ipcClassifyRisk,
   ipcGetFeatureFlags,
   resetPersistentClient,
 } from "./gateway-client.js";
@@ -132,3 +134,60 @@ describe("ipcGetFeatureFlags", () => {
     expect(flags).toEqual({});
   });
 });
+
+// ---------------------------------------------------------------------------
+// ipcClassifyRisk retry semantics
+// ---------------------------------------------------------------------------
+
+describe("ipcClassifyRisk retry", () => {
+  const CLASSIFY_OK = {
+    risk: "low",
+    reason: "safe",
+    matchType: "none",
+    scopeOptions: [],
+  };
+  const emptyParams = {} as unknown as Parameters<typeof ipcClassifyRisk>[0];
+
+  test("retries a transient failure and then succeeds", async () => {
+    mockGatewayIpc(null, {
+      failFirstN: 1,
+      results: { classify_risk: CLASSIFY_OK },
+    });
+
+    const result = await ipcClassifyRisk(emptyParams);
+    expect(result?.risk).toBe("low");
+    expect(getMockPersistentCallCount("classify_risk")).toBe(2);
+  });
+
+  test("returns undefined after exhausting retries (3 attempts)", async () => {
+    mockGatewayIpc(null, { error: true });
+
+    const result = await ipcClassifyRisk(emptyParams);
+    expect(result).toBeUndefined();
+    expect(getMockPersistentCallCount("classify_risk")).toBe(3);
+  });
+
+  test("does NOT retry a structured IpcCallError (fails after 1 attempt)", async () => {
+    mockGatewayIpc(null, {
+      failFirstN: 3,
+      ipcCallError: true,
+      results: { classify_risk: CLASSIFY_OK },
+    });
+
+    const result = await ipcClassifyRisk(emptyParams);
+    expect(result).toBeUndefined();
+    expect(getMockPersistentCallCount("classify_risk")).toBe(1);
+  });
+
+  test("stops retrying once the signal is aborted", async () => {
+    mockGatewayIpc(null, { error: true });
+    const controller = new AbortController();
+    controller.abort();
+
+    const result = await ipcClassifyRisk(emptyParams, controller.signal);
+    expect(result).toBeUndefined();
+    // An already-aborted signal short-circuits the retry loop after the first
+    // failed attempt rather than exhausting all three.
+    expect(getMockPersistentCallCount("classify_risk")).toBe(1);
+  });
+});

package/src/ipc/gateway-client.ts

@@ -12,6 +12,7 @@
 
 import {
   ipcCall as packageIpcCall,
+  IpcCallError,
   PersistentIpcClient as PackagePersistentIpcClient,
 } from "@vellumai/gateway-client/ipc-client";
 
@@ -20,6 +21,7 @@ import type {
   ClassifyRiskParams,
 } from "../permissions/ipc-risk-types.js";
 import { getLogger } from "../util/logger.js";
+import { abortableSleep, computeRetryDelay } from "../util/retry.js";
 import { resolveIpcSocketPath } from "./socket-path.js";
 
 const log = getLogger("gateway-ipc-client");
@@ -138,6 +140,19 @@ export async function ipcGetVelayStatus(): Promise<VelayTunnelStatus | null> {
   };
 }
 
+// classify_risk is an idempotent, side-effect-free read, so a transient gateway
+// blip (socket dropped between calls, momentary unreachability) is safe to
+// retry — the persistent client re-establishes its socket on the next call. The
+// budget is deliberately sized for SUB-SECOND blips, not restart-class outages:
+// each attempt uses a tighter timeout than the transport default so a wedged-
+// but-reachable gateway cannot multiply the worst-case wait, and total latency
+// against a hard-down gateway stays close to the single-attempt ceiling.
+// Deterministic failures — a structured IpcCallError, or a returned-but-
+// malformed payload — are NOT retried; they fail closed immediately.
+const CLASSIFY_RISK_MAX_RETRIES = 2; // 3 attempts total
+const CLASSIFY_RISK_RETRY_BASE_MS = 100; // ~[50,100] then ~[100,200] ms backoff
+const CLASSIFY_RISK_ATTEMPT_TIMEOUT_MS = 1_500; // per-attempt cap (< 5s default)
+
 /**
  * Classify risk for a tool invocation via the gateway's persistent IPC
  * connection.
@@ -146,41 +161,69 @@ export async function ipcGetVelayStatus(): Promise<VelayTunnelStatus | null> {
  * classification is on the hot path for every tool invocation and the
  * persistent connection avoids per-call connect overhead.
  *
- * Returns `undefined` when the gateway is unreachable, the response is
- * malformed, or the call fails for any reason — callers should throw
- * since there is no local fallback (gateway is a hard dependency).
+ * A transient transport failure is retried with bounded backoff (see the
+ * constants above) before giving up; a structured `IpcCallError` or a
+ * malformed payload fails fast without retrying. Returns `undefined` when the
+ * gateway is unreachable or the response is unusable after retries — callers
+ * should throw since there is no local fallback (gateway is a hard dependency).
+ * When a `signal` is supplied, retries stop as soon as it aborts.
  */
 export async function ipcClassifyRisk(
   params: ClassifyRiskParams,
+  signal?: AbortSignal,
 ): Promise<ClassificationResult | undefined> {
-  try {
-    const result = await ipcCallPersistent(
-      "classify_risk",
-      params as unknown as Record<string, unknown>,
-    );
-
-    // Validate the response has at minimum a `risk` field
-    if (!result || typeof result !== "object" || Array.isArray(result)) {
-      log.warn(
-        { result },
-        "ipcClassifyRisk: gateway returned non-object response",
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const result = await ipcCallPersistent(
+        "classify_risk",
+        params as unknown as Record<string, unknown>,
+        CLASSIFY_RISK_ATTEMPT_TIMEOUT_MS,
       );
-      return undefined;
-    }
 
-    const obj = result as Record<string, unknown>;
-    if (typeof obj.risk !== "string") {
-      log.warn(
-        { result },
-        "ipcClassifyRisk: gateway response missing 'risk' field",
-      );
+      // Returned-but-malformed responses are deterministic, not transient:
+      // fail closed immediately (no retry).
+      if (!result || typeof result !== "object" || Array.isArray(result)) {
+        log.warn(
+          { result },
+          "ipcClassifyRisk: gateway returned non-object response",
+        );
+        return undefined;
+      }
+
+      const obj = result as Record<string, unknown>;
+      if (typeof obj.risk !== "string") {
+        log.warn(
+          { result },
+          "ipcClassifyRisk: gateway response missing 'risk' field",
+        );
+        return undefined;
+      }
+
+      return result as ClassificationResult;
+    } catch (err) {
+      // A structured gateway error means the gateway was reachable and
+      // deterministically rejected the request — not a transient blip.
+      const retryable = !(err instanceof IpcCallError);
+      if (
+        retryable &&
+        attempt < CLASSIFY_RISK_MAX_RETRIES &&
+        !signal?.aborted
+      ) {
+        log.warn(
+          { err, attempt },
+          "ipcClassifyRisk: transient IPC failure, retrying after backoff",
+        );
+        await abortableSleep(
+          computeRetryDelay(attempt, CLASSIFY_RISK_RETRY_BASE_MS),
+          signal,
+        );
+        if (!signal?.aborted) {
+          continue;
+        }
+      }
+      log.warn({ err }, "ipcClassifyRisk: persistent IPC call failed");
       return undefined;
     }
-
-    return result as ClassificationResult;
-  } catch (err) {
-    log.warn({ err }, "ipcClassifyRisk: persistent IPC call failed");
-    return undefined;
   }
 }
 

package/src/live-voice/__tests__/live-voice-events.test.ts

@@ -4,6 +4,7 @@ import type {
   VoiceTurnCallbacks,
   VoiceTurnOptions,
 } from "../../calls/voice-session-bridge.js";
+import { VOICE_NO_SETUP_FLOWS_RULE } from "../../calls/voice-session-bridge.js";
 import type {
   StreamingTranscriber,
   SttStreamServerEvent,
@@ -129,7 +130,9 @@ async function waitFor(
   message = "Timed out waiting for live voice event test condition",
 ): Promise<void> {
   for (let attempt = 0; attempt < 60; attempt += 1) {
-    if (predicate()) return;
+    if (predicate()) {
+      return;
+    }
     await new Promise((resolve) => setTimeout(resolve, 5));
   }
   throw new Error(message);
@@ -246,7 +249,16 @@ describe("LiveVoiceSession archive and metrics events", () => {
 
     await startReleasedTurn(session);
     expect(startVoiceTurn.mock.calls[0]?.[0]).toMatchObject({
-      approvalMode: "local-live-voice",
+      userMessageChannel: "vellum",
+      assistantMessageChannel: "vellum",
+      userMessageInterface: "macos",
+      assistantMessageInterface: "macos",
+      // Pins the full production control prompt, including the no-UI rule
+      // (voice turns are non-interactive — everything is conveyed in speech)
+      // and the shared no-setup-flows rule (no OAuth/browser flows mid-call).
+      voiceControlPrompt:
+        "You are speaking in a local live voice session. Keep replies brief and conversational. You cannot display cards, forms, or any on-screen UI during the call — convey everything in speech. " +
+        VOICE_NO_SETUP_FLOWS_RULE,
     });
     callbacks?.assistant_text_delta?.(makeTextDelta("Hello there."));
     callbacks?.message_complete?.(makeMessageComplete());