@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/providers/inference/backfill.ts

@@ -3,7 +3,7 @@
  * `provider` + `source` model to the new `provider_connection` model.
  *
  * Walks three locations in `llm.*` on every boot:
- *   - `llm.default`           — the base profile every dispatch falls back on
+ *   - `llm.default`           — the legacy raw base blob still present in older configs
  *   - `llm.profiles.*`        — named alternate profiles (fast/balanced/...)
  *   - `llm.callSites.*`       — per-call-site overrides with bare `provider`
  *
@@ -17,15 +17,18 @@
  * default profile and on any legacy bare-`provider` callsite override.
  */
 
+import { MANAGED_PROFILE_NAMES } from "../../config/default-profile-catalog.js";
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import type { DrizzleDb } from "../../persistence/db-connection.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { getLogger } from "../../util/logger.js";
+import { isConnectionCompatibleWithModel } from "../connection-model-compat.js";
 import { MANAGED_ROUTABLE_PROVIDERS } from "../vellum-model-routing.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "./auth.js";
 import {
   createConnection,
   getConnection,
+  listConnections,
   seedCanonicalConnections,
   VELLUM_MANAGED_CONNECTION_NAME,
 } from "./connections.js";
@@ -63,7 +66,9 @@ export function runProviderConnectionsBackfill(db: DrizzleDb): void {
 function backfillConfigProfiles(db: DrizzleDb): void {
   const raw = loadRawConfig();
   const llm = raw.llm as Record<string, unknown> | undefined;
-  if (!llm) return;
+  if (!llm) {
+    return;
+  }
 
   const isPlatform =
     process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
@@ -87,13 +92,17 @@ function backfillConfigProfiles(db: DrizzleDb): void {
   if (profiles && typeof profiles === "object") {
     for (const [profileName, profileVal] of Object.entries(profiles)) {
       const profile = profileVal as Record<string, unknown>;
-      if (!profile || typeof profile !== "object") continue;
+      if (!profile || typeof profile !== "object") {
+        continue;
+      }
       if (ensureProviderConnection(profile, profileName, db, globalMode)) {
         profiles[profileName] = profile;
         changed = true;
       }
     }
-    if (changed) llm.profiles = profiles;
+    if (changed) {
+      llm.profiles = profiles;
+    }
   }
 
   // 3. Per-call-site overrides. Only legacy entries with a bare `provider`
@@ -103,11 +112,15 @@ function backfillConfigProfiles(db: DrizzleDb): void {
   if (callSites && typeof callSites === "object") {
     for (const [callSiteName, callSiteVal] of Object.entries(callSites)) {
       const callSite = callSiteVal as Record<string, unknown>;
-      if (!callSite || typeof callSite !== "object") continue;
+      if (!callSite || typeof callSite !== "object") {
+        continue;
+      }
       // Only touch overrides that explicitly set `provider` — the typical
       // case is `{profile: "fast"}`, which has no provider and inherits
       // through `resolveCallSiteConfig` deep-merge.
-      if (callSite.provider == null) continue;
+      if (callSite.provider == null) {
+        continue;
+      }
       if (
         ensureProviderConnection(
           callSite,
@@ -120,7 +133,9 @@ function backfillConfigProfiles(db: DrizzleDb): void {
         changed = true;
       }
     }
-    if (changed) llm.callSites = callSites;
+    if (changed) {
+      llm.callSites = callSites;
+    }
   }
 
   if (changed) {
@@ -152,10 +167,14 @@ function ensureProviderConnection(
   // at runtime. Self-heal those alongside null/undefined.
   const existing = entry.provider_connection;
   const hasValid = typeof existing === "string" && existing.trim() !== "";
-  if (hasValid) return false;
+  if (hasValid) {
+    return false;
+  }
 
   const provider = entry.provider as string | undefined;
-  if (!provider) return false;
+  if (!provider) {
+    return false;
+  }
 
   if (PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)) {
     log.warn(
@@ -167,7 +186,39 @@ function ensureProviderConnection(
 
   let connectionName: string;
 
-  if (globalMode === "managed" && MANAGED_ROUTABLE_PROVIDERS.has(provider)) {
+  // For user-owned entries, an existing connection for the entry's provider
+  // wins over the mode-derived default. Only user-brought connections can
+  // match — the canonical `vellum` row carries the `vellum` sentinel
+  // provider, never a concrete upstream. Without this, the managed branch
+  // would silently switch a connection-less BYOK-intent profile onto the
+  // billed managed connection, and the your-own branch would create a
+  // parallel `-personal` row (pointing at an empty credential slot) when a
+  // custom-named connection already exists.
+  //
+  // Managed-owned entries are excluded: a managed preset must stay on the
+  // platform-managed route, not start dispatching against a key the user
+  // brought for their own profiles. Managed-owned means `source: "managed"`
+  // or a canonical managed name without an explicit `source: "user"` —
+  // legacy seeders wrote canonical entries source-less, and only an explicit
+  // user source marks a shadow the user took ownership of (mirrors
+  // workspace migration 109). `entryLabel` is the profile name for the
+  // `llm.profiles.*` walk; the other walks pass bracketed labels that never
+  // collide with canonical names.
+  const isManagedOwned =
+    entry.source === "managed" ||
+    (entry.source !== "user" && MANAGED_PROFILE_NAMES.has(entryLabel));
+  const entryModel = typeof entry.model === "string" ? entry.model : undefined;
+  const existingForProvider = isManagedOwned
+    ? undefined
+    : listConnections(db, { provider }).find((c) =>
+        isConnectionCompatibleWithModel(c, entryModel),
+      );
+  if (existingForProvider) {
+    connectionName = existingForProvider.name;
+  } else if (
+    globalMode === "managed" &&
+    MANAGED_ROUTABLE_PROVIDERS.has(provider)
+  ) {
     // All managed-routable providers share the single provider-agnostic
     // `vellum` connection; the upstream is recovered per-request from the
     // profile's `provider` field.

package/src/providers/inference/connection-availability.ts

@@ -174,14 +174,15 @@ export async function computeConnectionAvailability(
         message: `Connection "${resolvedConnectionName}" uses Vellum platform auth, which cannot serve provider "${provider}". Add an API-key connection for "${provider}" ${SETTINGS_HINT}.`,
       };
     case "none": {
-      // Keyless providers (catalog setupMode "keyless", e.g. ollama)
+      // Keyless providers (catalog setupMode "keyless", e.g. ollama) and
+      // openai-compatible endpoints (dual-mode: local servers are keyless)
       // legitimately dispatch with none-auth — mirror
       // `createAdapterFromConnection`, which only rejects none-auth for
       // keyed catalog entries.
       const isKeyless =
         PROVIDER_CATALOG.find((entry) => entry.id === provider)?.setupMode ===
         "keyless";
-      if (isKeyless) {
+      if (isKeyless || provider === "openai-compatible") {
         return { status: "ok" };
       }
       return {

package/src/providers/inference/resolve-auth.ts

@@ -84,7 +84,15 @@ export async function resolveAuth(
     }
 
     case "none":
-      return { ok: true, resolved: { kind: "none" } };
+      // Keyless endpoints still need their custom baseUrl threaded through
+      // (LM Studio / vLLM openai-compatible servers).
+      return {
+        ok: true,
+        resolved: {
+          kind: "none",
+          ...(safeBaseUrl ? { baseUrl: safeBaseUrl } : {}),
+        },
+      };
 
     case "oauth_subscription": {
       // Extract the credential prefix from the credential key.

package/src/providers/model-catalog.ts

@@ -1945,6 +1945,43 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     apiKeyUrl: "https://www.atlascloud.ai/console",
     apiKeyPlaceholder: "apikey-...",
   },
+  {
+    id: "baseten",
+    displayName: "Baseten",
+    subtitle: "Open models served by Baseten. Requires a Baseten API key.",
+    setupMode: "api-key",
+    setupHint: "Enter your Baseten API key to enable Baseten models.",
+    envVar: "BASETEN_API_KEY",
+    credentialsGuide: {
+      description: "Sign in to the Baseten dashboard and create an API key.",
+      url: "https://app.baseten.co/settings/api_keys",
+      linkLabel: "Open Baseten Dashboard",
+    },
+    models: [
+      {
+        id: "thinkingmachines/inkling",
+        displayName: "Inkling",
+        // Baseten serves Inkling with a 1,048K-token input window.
+        contextWindowTokens: 1048576,
+        maxOutputTokens: 32768,
+        supportsThinking: true,
+        supportsCaching: true,
+        supportsVision: true,
+        supportsToolUse: true,
+        // Baseten's reasoning_effort for Inkling tops out at "xhigh" (no
+        // "max"), matching the chat-completions client's default ceiling.
+        maxEffort: "xhigh",
+        pricing: {
+          inputPer1mTokens: 1.0,
+          outputPer1mTokens: 4.05,
+          cacheReadPer1mTokens: 0.17,
+        },
+      },
+    ],
+    defaultModel: "thinkingmachines/inkling",
+    apiKeyUrl: "https://app.baseten.co/settings/api_keys",
+    apiKeyPlaceholder: "Your Baseten API key",
+  },
 ];
 
 export const PROVIDER_CATALOG: ProviderCatalogEntry[] =

package/src/providers/openai/__tests__/api-error-normalization.test.ts

@@ -322,7 +322,9 @@ describe("captureRawErrorBodyFetch", () => {
   });
 });
 
-function n(over: Partial<NormalizedOpenAIAPIError> = {}): NormalizedOpenAIAPIError {
+function n(
+  over: Partial<NormalizedOpenAIAPIError> = {},
+): NormalizedOpenAIAPIError {
   return { message: "boom", ...over };
 }
 
@@ -389,6 +391,24 @@ describe("deriveReason", () => {
     );
   });
 
+  test("403 spend-cap 'Key limit exceeded' → insufficient_credits", () => {
+    // OpenRouter returns 403 with this body when a key's configured credit
+    // limit is reached — a billing condition, not a rejected key. The billing
+    // gate precedes the 401/403 credential branch, so it routes to credits.
+    expect(deriveReason(n({ message: "Key limit exceeded" }), 403)).toBe(
+      "insufficient_credits",
+    );
+    expect(
+      deriveReason(
+        n({
+          message: "Forbidden",
+          rawBody: '{"error":{"code":403,"message":"Key limit exceeded"}}',
+        }),
+        403,
+      ),
+    ).toBe("insufficient_credits");
+  });
+
   test("429 → rate_limited", () => {
     expect(deriveReason(n(), 429)).toBe("rate_limited");
   });
@@ -414,6 +434,8 @@ describe("deriveReason", () => {
   });
 
   test("no status, no signal → unknown", () => {
-    expect(deriveReason(n({ message: "who knows" }), undefined)).toBe("unknown");
+    expect(deriveReason(n({ message: "who knows" }), undefined)).toBe(
+      "unknown",
+    );
   });
 });

package/src/providers/openai/api-key-validation.ts

@@ -0,0 +1,70 @@
+import OpenAI from "openai";
+
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("provider-key-validation");
+
+/** Validation-specific timeout (10s) so a stalled network doesn't block key submission. */
+const VALIDATION_TIMEOUT_MS = 10_000;
+
+export type ApiKeyValidationResult =
+  | { valid: true }
+  | { valid: false; reason: string };
+
+export interface OpenAICompatibleKeyValidation {
+  apiKey: string;
+  /** The provider's OpenAI-compatible endpoint to list models against. */
+  baseURL: string;
+  /** Human-readable provider name used in error messages and logs. */
+  providerLabel: string;
+}
+
+/**
+ * Validate an API key by listing models against an OpenAI-compatible
+ * endpoint. Definitive auth failures (401/403) reject the key; transient
+ * errors (429, 5xx, network) allow the key to be stored so a flaky network
+ * doesn't block setup.
+ */
+export async function validateOpenAICompatibleApiKey({
+  apiKey,
+  baseURL,
+  providerLabel,
+}: OpenAICompatibleKeyValidation): Promise<ApiKeyValidationResult> {
+  try {
+    const client = new OpenAI({
+      apiKey,
+      baseURL,
+      timeout: VALIDATION_TIMEOUT_MS,
+      maxRetries: 0,
+    });
+    await client.models.list();
+    return { valid: true };
+  } catch (error) {
+    if (error instanceof OpenAI.APIError) {
+      if (error.status === 401) {
+        return { valid: false, reason: "API key is invalid or expired." };
+      }
+      if (error.status === 403) {
+        return {
+          valid: false,
+          reason: `${providerLabel} API error (${error.status}): ${error.message}`,
+        };
+      }
+      // Transient errors (429, 5xx, etc.) — allow the key to be stored.
+      log.warn(
+        { provider: providerLabel, status: error.status },
+        "API returned a transient error during key validation — allowing key",
+      );
+      return { valid: true };
+    }
+    // Network errors — allow the key to be stored.
+    log.warn(
+      {
+        provider: providerLabel,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      "Network error during key validation — allowing key",
+    );
+    return { valid: true };
+  }
+}

package/src/providers/retry.ts

@@ -55,6 +55,7 @@ const EFFORT_SUPPORTED_PROVIDERS = new Set([
   "vercel-ai-gateway",
   "fireworks",
   "together",
+  "baseten",
 ]);
 
 // For these providers, disabling reasoning is encoded through the same effort
@@ -66,6 +67,7 @@ const DISABLED_THINKING_USES_EFFORT_PROVIDERS = new Set([
   "together",
   "openrouter",
   "vercel-ai-gateway",
+  "baseten",
 ]);
 
 // Whether a disabled `thinking` config must be encoded as `effort: "none"`

package/src/providers/types.ts

@@ -215,7 +215,8 @@ export interface SendMessageConfig {
    * LLM call-site identifier. `RetryProvider` resolves
    * provider/model/maxTokens/effort/speed/verbosity/temperature/thinking/
    * contextWindow via `resolveCallSiteConfig(callSite, config.llm)`, falling
-   * back to `llm.default` when no callSite-specific entry is present.
+   * back to the shipped call-site defaults when no callSite-specific entry
+   * is present.
    */
   callSite?: LLMCallSite;
   /**
@@ -433,11 +434,17 @@ export function extractOverflowTokensFromMessage(message: string): {
   maxTokens?: number;
 } {
   const match = message.match(/(\d[\d,]*)\s*(?:tokens?\s*)?[>≥]\s*(\d[\d,]*)/i);
-  if (!match) return {};
+  if (!match) {
+    return {};
+  }
   const actual = parseInt(match[1].replace(/,/g, ""), 10);
   const max = parseInt(match[2].replace(/,/g, ""), 10);
   const out: { actualTokens?: number; maxTokens?: number } = {};
-  if (!isNaN(actual) && actual > 0) out.actualTokens = actual;
-  if (!isNaN(max) && max > 0) out.maxTokens = max;
+  if (!isNaN(actual) && actual > 0) {
+    out.actualTokens = actual;
+  }
+  if (!isNaN(max) && max > 0) {
+    out.maxTokens = max;
+  }
   return out;
 }

package/src/providers/vellum-model-routing.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 
 import {
   formatVellumModel,
+  getManagedUpstream,
   MANAGED_ROUTABLE_PROVIDERS,
   parseVellumModel,
 } from "./vellum-model-routing.js";
@@ -38,6 +39,31 @@ describe("vellum-model-routing", () => {
     expect(parseVellumModel("/foo")).toBeNull(); // empty provider
   });
 
+  test("getManagedUpstream resolves a bare catalog id to its owner", () => {
+    expect(getManagedUpstream("claude-fable-5")).toBe("anthropic");
+  });
+
+  test("getManagedUpstream resolves a routing string by its prefix", () => {
+    expect(
+      getManagedUpstream("fireworks/accounts/fireworks/models/minimax-m3"),
+    ).toBe("fireworks");
+  });
+
+  test("getManagedUpstream returns null for non-managed owners", () => {
+    expect(getManagedUpstream("MiniMax-M3")).toBeNull(); // minimax, not managed
+    expect(getManagedUpstream("openrouter/whatever")).toBeNull();
+  });
+
+  test("getManagedUpstream returns null for unknown models", () => {
+    expect(getManagedUpstream("not-a-real-model")).toBeNull();
+    expect(getManagedUpstream("")).toBeNull();
+  });
+
+  test("getManagedUpstream rejects managed-prefixed strings whose model is not cataloged under that provider", () => {
+    expect(getManagedUpstream("anthropic/definitely-not-a-model")).toBeNull();
+    expect(getManagedUpstream("openai/accounts/foo/bar")).toBeNull();
+  });
+
   test("managed set matches the platform proxy table", () => {
     // Guards against drift if PLATFORM_PROVIDER_META changes.
     expect([...MANAGED_ROUTABLE_PROVIDERS].sort()).toEqual([

package/src/providers/vellum-model-routing.ts

@@ -14,6 +14,10 @@
  * codec — no I/O, no wiring — so it can be adopted incrementally.
  */
 
+import {
+  getCatalogProviderForModel,
+  isModelInCatalog,
+} from "./model-catalog.js";
 import { PLATFORM_PROVIDER_META } from "./platform-proxy/constants.js";
 
 /**
@@ -117,3 +121,29 @@ export function parseVellumModel(
   }
   return { provider, model };
 }
+
+/**
+ * Resolve the managed upstream provider for a model referenced by a
+ * `provider: "vellum"` profile. Such a profile carries no upstream of its own,
+ * so the model alone determines it: a `<provider>/<model>` routing string
+ * names the upstream directly, and a bare id resolves to its catalog owner.
+ * Returns null when the model has no managed-routable upstream (unknown id,
+ * or owned by a non-managed provider like openrouter).
+ *
+ * A decoded routing string must also name a real catalog model under its
+ * prefix: OpenRouter/Vercel native ids share the `<provider>/<model>` shape
+ * (e.g. `anthropic/…`), so an unvalidated prefix match could route an
+ * arbitrary non-managed id through the managed proxy.
+ */
+export function getManagedUpstream(model: string): string | null {
+  const route = parseVellumModel(model);
+  if (route) {
+    return isModelInCatalog(route.provider, route.model)
+      ? route.provider
+      : null;
+  }
+  const owner = getCatalogProviderForModel(model);
+  return owner !== undefined && MANAGED_ROUTABLE_PROVIDERS.has(owner)
+    ? owner
+    : null;
+}

package/src/providers/voice-error-copy.ts

@@ -0,0 +1,47 @@
+/**
+ * Single source of truth for user- and model-facing voice (STT/TTS) failure
+ * copy. Provider adapters reject with raw upstream bodies (kept in logs only);
+ * these helpers turn a normalized error into friendly, actionable text that
+ * never leaks raw JSON or HTTP status noise into a conversation or the UI.
+ */
+
+import type { SttError, SttProviderId } from "../stt/types.js";
+import { getProviderEntry } from "./speech-to-text/provider-catalog.js";
+
+function sttProviderLabel(providerId?: SttProviderId): string {
+  const displayName = providerId
+    ? getProviderEntry(providerId)?.displayName
+    : undefined;
+  return displayName ?? "the speech-to-text provider";
+}
+
+/**
+ * Friendly, model-actionable copy for a normalized STT failure. Names the
+ * provider (when known) so the model can point the user at the right fix.
+ */
+export function describeSttFailure(
+  err: SttError,
+  providerId?: SttProviderId,
+): string {
+  const provider = sttProviderLabel(providerId);
+  switch (err.category) {
+    case "auth":
+      return `${provider} rejected the configured API key — it may be expired or invalid. Check the speech-to-text API key in Settings → Voice.`;
+    case "rate-limit":
+      return `${provider} is rate-limiting transcription requests right now. Try again shortly.`;
+    case "timeout":
+      return "Transcription timed out.";
+    case "invalid-audio":
+      return "The audio could not be transcribed (unsupported or corrupted format).";
+    default:
+      return `${provider} returned an error while transcribing.`;
+  }
+}
+
+/**
+ * Friendly copy for a TTS authentication failure (HTTP 401/403). Shared with
+ * the STT auth copy's "check the API key in Settings → Voice" guidance.
+ */
+export function describeTtsAuthFailure(providerDisplayName: string): string {
+  return `${providerDisplayName} rejected the configured API key (authentication failed) — check the ${providerDisplayName} API key in Settings → Voice.`;
+}

package/src/runtime/agent-wake.ts

@@ -70,8 +70,6 @@ import type {
 import type { InterfaceId } from "../channels/types.js";
 import { resolveEffectiveContextWindow } from "../config/llm-context-resolution.js";
 import {
-  isOverrideOrDefaultResolutionEnabled,
-  resolveDefaultProfileKey,
   resolveProfilelessModelKey,
   selectWinningProfile,
 } from "../config/llm-resolver.js";
@@ -293,6 +291,14 @@ export interface WakeOptions {
    * absent.
    */
   toolContextPin?: WakeToolContextPin;
+  /**
+   * Skill IDs to preactivate for the wake so their bundled tools join the
+   * turn's active set (`allowedToolNames`) without a prior `skill_load`.
+   * Applied and restored alongside `allowedTools`; ignored when `allowedTools`
+   * is absent. Used by fork-based memory retrospectives to make the
+   * skill-management authoring tools callable directly.
+   */
+  preactivateSkillIds?: readonly string[];
   /**
    * Explicit persona/channel slugs for the wake's system-prompt build,
    * applied to the conversation for the duration of the run and restored
@@ -439,7 +445,9 @@ async function defaultResolveTarget(
     await import("../daemon/conversation-store.js");
   try {
     const existing = getConversation(conversationId);
-    if (!existing) return null;
+    if (!existing) {
+      return null;
+    }
     if (existing.archivedAt != null) {
       log.info(
         { conversationId },
@@ -589,7 +597,9 @@ function inspectWakeOutput(
   let hasVisibleText = false;
   const toolUseNames: string[] = [];
   for (const msg of tailMessages) {
-    if (msg.role !== "assistant") continue;
+    if (msg.role !== "assistant") {
+      continue;
+    }
     const blocks = Array.isArray(msg.content) ? msg.content : [];
     for (const block of blocks) {
       if (block.type === "text" && typeof block.text === "string") {
@@ -749,21 +759,14 @@ export async function wakeAgentForOpportunity(
       overrideProfile,
       forceOverrideProfile,
     });
-    // Same winner-selection sourcing as the agent loop's key: under
-    // override-or-default semantics a hand-mirrored chain would disagree
-    // with dispatch (a non-forced override now wins on every call site).
+    // Same winner-selection sourcing as the agent loop's key: a hand-mirrored
+    // chain would disagree with dispatch (a non-forced override wins on every
+    // call site).
     const modelProfileKey =
-      (isOverrideOrDefaultResolutionEnabled()
-        ? selectWinningProfile(callSite, config.llm, {
-            ...(overrideProfile != null ? { overrideProfile } : {}),
-            selectionSeed: conversationId,
-          }).profileName
-        : ((forceOverrideProfile || callSite === "mainAgent"
-            ? overrideProfile
-            : undefined) ??
-          resolveDefaultProfileKey(callSite, config.llm) ??
-          overrideProfile ??
-          resolveDefaultProfileKey("mainAgent", config.llm))) ??
+      selectWinningProfile(callSite, config.llm, {
+        ...(overrideProfile != null ? { overrideProfile } : {}),
+        selectionSeed: conversationId,
+      }).profileName ??
       resolveProfilelessModelKey(callSite, config.llm, {
         ...(overrideProfile != null ? { overrideProfile } : {}),
         ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
@@ -1123,7 +1126,9 @@ export async function wakeAgentForOpportunity(
     // and renames `text_delta` → `assistant_text_delta`; bypassing it
     // would ship malformed wire frames.
     const goLive = (currentHistory: Message[]): void => {
-      if (mode === "live") return;
+      if (mode === "live") {
+        return;
+      }
       if (!surfaceInjected) {
         if (!opts.suppressWakeSurface) {
           const tailStart = baselineLength + wakeHintMessageCount;
@@ -1186,7 +1191,9 @@ export async function wakeAgentForOpportunity(
       currentHistory: Message[],
     ): Promise<void> => {
       const start = baselineLength + wakeHintMessageCount + persistedTailIndex;
-      if (start >= currentHistory.length) return;
+      if (start >= currentHistory.length) {
+        return;
+      }
       const newMessages = currentHistory.slice(start);
       for (const msg of newMessages) {
         conversation.messages.push(msg);
@@ -1207,9 +1214,13 @@ export async function wakeAgentForOpportunity(
     let wakeToolScopeRestored = false;
     let restoreWakeToolScope: (() => void) | null = null;
     const restoreWakeAllowedTools = (): void => {
-      if (wakeToolScopeRestored) return;
+      if (wakeToolScopeRestored) {
+        return;
+      }
       wakeToolScopeRestored = true;
-      if (!restoreWakeToolScope) return;
+      if (!restoreWakeToolScope) {
+        return;
+      }
       try {
         restoreWakeToolScope();
       } catch (err) {
@@ -1220,13 +1231,16 @@ export async function wakeAgentForOpportunity(
       }
     };
     const applyWakeAllowedTools = (): boolean => {
-      if (!opts.allowedTools) return true;
+      if (!opts.allowedTools) {
+        return true;
+      }
       try {
         restoreWakeToolScope = scopeWakeAllowedTools(
           conversation,
           new Set(opts.allowedTools),
           opts.toolGateMode,
           opts.toolContextPin,
+          opts.preactivateSkillIds,
         );
         return true;
       } catch (err) {
@@ -1342,7 +1356,9 @@ export async function wakeAgentForOpportunity(
       const priorTurnTrust = conversation.currentTurnTrustContext;
       conversation.currentCallSite = callSite;
       conversation.currentTurnOverrideProfile = overrideProfile;
-      if (opts.clientless) conversation.hasNoClient = true;
+      if (opts.clientless) {
+        conversation.hasNoClient = true;
+      }
       // Per-turn guardian elevation for the wake's tools, set after the pre-run
       // reads so a pre-run failure can't leak it; restored in the finally.
       if (opts.trustContext) {