@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/daemon/conversation-agent-loop.ts

@@ -116,7 +116,10 @@ import {
 } from "./conversation-runtime-assembly.js";
 import type { CurrentTurnSurface } from "./conversation-surfaces.js";
 import { markSurfaceCompleted } from "./conversation-surfaces.js";
-import { runDeferredTurnTail } from "./conversation-turn-finalize.js";
+import {
+  runDeferredTurnTail,
+  settleTurnContent,
+} from "./conversation-turn-finalize.js";
 import { recordUsage } from "./conversation-usage.js";
 import { resolveTurnTimezoneContext } from "./date-context.js";
 import { getDiskPressureStatus } from "./disk-pressure-guard.js";
@@ -133,6 +136,7 @@ import {
   MEMORY_CONTEXT_PHASE_KEY,
   TurnLatencyTracker,
 } from "./turn-latency-tracker.js";
+import { chainTurnTail } from "./turn-tail-chain.js";
 
 const log = getLogger("conversation-agent-loop");
 
@@ -152,6 +156,43 @@ const DISK_PRESSURE_ERROR_CATEGORY = "disk_pressure";
 const OUT_OF_CREDITS_ASSISTANT_REPLY =
   "I couldn't reply because you ran out of credits. Add credits in Settings → Billing and we can pick up where we left off.";
 
+/**
+ * Assistant-voice wording persisted as the synthetic assistant row when a turn
+ * terminates because the daily credit limit is reached. The shared
+ * classification (`dailyLimitClassification` in conversation-error.ts) keeps
+ * its `userMessage` in banner voice because it also feeds the live
+ * `conversation_error` event the composer renders; here the row re-enters LLM
+ * history and is displayed as assistant speech, so first-person copy is
+ * accurate. Says "stop" rather than "reply" because the row can land mid-turn,
+ * after a tool round-trip the user already saw. Phrased about the past failure,
+ * not the current limit, because the row stays in the transcript (and renders
+ * as a plain bubble) after the limit resets.
+ */
+const DAILY_LIMIT_REACHED_ASSISTANT_REPLY =
+  "I had to stop because you hit your daily credit limit. Raise the limit in Settings → Billing and we can pick up where we left off, or I can continue once it resets.";
+
+/**
+ * The assistant-voice text a managed-billing failure persists in place of the
+ * classification's own `userMessage`, or `null` when the classification copy is
+ * already right for a transcript row.
+ */
+function managedBillingAssistantReply(
+  providerErrorCode: string | null,
+  providerErrorCategory: string | null,
+): string | null {
+  if (providerErrorCode !== "PROVIDER_BILLING") {
+    return null;
+  }
+  switch (providerErrorCategory) {
+    case "credits_exhausted":
+      return OUT_OF_CREDITS_ASSISTANT_REPLY;
+    case "daily_limit_reached":
+      return DAILY_LIMIT_REACHED_ASSISTANT_REPLY;
+    default:
+      return null;
+  }
+}
+
 /** Title-cased friendly labels for tool names, used in confirmation chips. */
 const TOOL_FRIENDLY_LABEL: Record<string, string> = {
   bash: "Run Command",
@@ -325,6 +366,13 @@ export async function runAgentLoopImpl(
      * scheduled execute turn attributes its LLM spend to that firing.
      */
     cronRunId?: string | null;
+    /**
+     * Trust this turn runs under. Queue drains pass the trust captured from
+     * the sender at enqueue; without it the initialization below would reset
+     * the turn to the conversation slot, which holds whichever actor sent
+     * most recently rather than the one this turn belongs to.
+     */
+    turnTrustContext?: TrustContext;
   },
 ): Promise<void> {
   if (!ctx.abortController) {
@@ -335,9 +383,21 @@ export async function runAgentLoopImpl(
   // voice-session-bridge, regenerate, etc.) that invoke runAgentLoop directly
   // without going through processMessage/drainQueue. This ensures the system
   // prompt callback always reads a valid snapshot rather than undefined.
-  // processMessage/drainQueue set these fields before calling runAgentLoop;
-  // those existing assignments remain correct and are merely redundant here.
-  ctx.currentTurnTrustContext = ctx.trustContext;
+  //
+  // The invariant: a turn runs under the trust captured when that turn
+  // started, never under whatever the slot holds when the loop happens to
+  // open. Awaits sit between capture and this line, and the slot is writable
+  // throughout by paths that do not own the turn (channel ingress for another
+  // actor, live-voice hydration, pointer elevation, the voice bridge).
+  //
+  // Callers that own a turn are expected to capture at turn start and pass
+  // `turnTrustContext`. This has not been swept across all 13 call sites, so
+  // the fallback below is load-bearing for two different populations: callers
+  // that legitimately have no turn to capture (subagent manager, voice
+  // bridge, regenerate), and callers that should pass it and do not yet.
+  // Treat a caller reaching the fallback as unverified, not as correct.
+  // LUM-3148 removes the ambiguity by making trust ride the turn.
+  ctx.currentTurnTrustContext = options?.turnTrustContext ?? ctx.trustContext;
   ctx.currentTurnChannelCapabilities = ctx.channelCapabilities;
 
   // Re-resolve the system prompt under the snapshots just set and push it into
@@ -560,6 +620,11 @@ export async function runAgentLoopImpl(
   // applies to later tool executions and nested subagents in the same turn.
   ctx.currentTurnOverrideProfile = turnOverrideProfile;
 
+  // Mirrored onto the live conversation for `createToolExecutor` to read into
+  // `ToolContext.cronRunId`, so a tool that delegates LLM work (subagent spawn
+  // or message) stamps the delegated usage with this firing.
+  ctx.currentTurnCronRunId = turnCronRunId;
+
   // Capture the turn channel context *before* any awaits so a second
   // message from a different channel can't overwrite it mid-flight.
   // When context is unavailable (e.g. regenerate after daemon restart),
@@ -637,6 +702,7 @@ export async function runAgentLoopImpl(
   );
   ctx.diskPressureCleanupModeActive =
     diskPressureDecision.action === "allow-cleanup-mode";
+  const toolsDisabledForTurn = ctx.toolsDisabledDepth > 0;
 
   ctx.lastAssistantAttachments = [];
   ctx.lastAttachmentWarnings = [];
@@ -659,14 +725,106 @@ export async function runAgentLoopImpl(
     | { outcome: "failed" | "cancelled"; failureCode?: string }
     | undefined;
   // True once a replied terminal SSE (message_complete / generation_handoff)
-  // has been emitted. Guards the catch block: an error thrown afterwards
-  // (deferred turn-tail bookkeeping) must not relabel a visibly-replied turn.
+  // has been emitted. Guards the catch block: an error thrown by the
+  // content-settle steps that run after it must not relabel a visibly-replied
+  // turn.
   let turnReplied = false;
   // Narrower than `turnReplied`: true only for a `message_complete` branch that
   // produced a genuine reply. A handed-off generation continues the run, and a
   // provider-error turn's only assistant row is the synthetic error text, so
   // the deferred tail must not treat either as a final reply.
   let turnCompleted = false;
+  // True once `releaseTurn` has run. The happy path releases as soon as the
+  // turn's content is settled; the `finally` calls it again as the backstop for
+  // the cancel/error paths that never reached the early release.
+  let turnReleased = false;
+
+  /**
+   * Free the conversation for its next turn.
+   *
+   * Ordering is load-bearing and identical on both call paths: stamp the
+   * turn's abnormal outcome first, because the telemetry reporter's
+   * settled-turn barrier only releases this turn once processing stops; null
+   * `abortController` before clearing the flag so a concurrent abort takes the
+   * force-clear branch rather than signalling a dead controller; unregister the
+   * in-flight turn only after processing stops, since daemon-side callers fall
+   * back to the live seq counter once that registration is gone (safe because
+   * `settlePendingPartialFlush` has already flushed the turn's content).
+   * Idempotent, so the `finally` can call it unconditionally.
+   *
+   * The release frees direct sends only. Queued messages are drained from the
+   * loop's `finally`, after the turn-boundary commit, so a dequeued turn's
+   * first file writes cannot be swept into the finished turn's commit.
+   */
+  const releaseTurn = (): void => {
+    if (turnReleased) {
+      return;
+    }
+    turnReleased = true;
+    if (abnormalOutcome) {
+      try {
+        stampTurnOutcome(userMessageId, abnormalOutcome.outcome, {
+          failureCode: abnormalOutcome.failureCode,
+        });
+      } catch (err) {
+        rlog.warn(
+          { err },
+          "Failed to stamp turn outcome (non-fatal); releasing the turn anyway",
+        );
+      }
+    }
+    ctx.abortController = null;
+    ctx.setProcessing(false);
+    unregisterInflightTurn(ctx.conversationId, state);
+
+    // Tear down the remaining per-turn state in the same synchronous step as
+    // the release, so a turn that starts against the freed conversation cannot
+    // inherit stale turn scope (task-run permissions, allowed tools, override
+    // profile, command intent) or observe a half-cleared conversation.
+    ctx.onConfirmationOutcome = undefined;
+    ctx.surfaceActionRequestIds.delete(ctx.currentRequestId ?? "");
+    ctx.approvedViaPromptThisTurn = false;
+    ctx.currentRequestId = undefined;
+    ctx.currentActiveSurfaceId = undefined;
+    ctx.allowedToolNames = undefined;
+    ctx.diskPressureCleanupModeActive = false;
+    ctx.preactivatedSkillIds = undefined;
+    ctx.currentTurnOverrideProfile = undefined;
+    ctx.currentTurnCronRunId = undefined;
+    ctx.currentTurnModelProfileNoticeKey = undefined;
+    // Turn-scoped interactivity. Clear it so paths that bypass this loop
+    // (e.g. opportunity wakes calling `agentLoop.run` directly) don't inherit
+    // a stale value and instead fall back to live client state in the tool
+    // context.
+    ctx.currentTurnIsNonInteractive = undefined;
+    // Turn-scoped request origin. Clear so a later turn on a reused
+    // conversation cannot inherit a stale origin-scoped permission grant.
+    ctx.currentTurnRequestOrigin = undefined;
+    // Channel command intents (e.g. Telegram /start) are single-turn
+    // metadata. Clear at turn end so they never leak into subsequent
+    // unrelated messages.
+    ctx.commandIntent = undefined;
+    // The app on screen is view state owned by the message that reported it,
+    // not durable conversation state: nothing tells the daemon when the user
+    // closes an app. Clear both copies at turn end so a later turn that brings
+    // no client transport (a scheduled wake, a background follow-up) cannot
+    // claim the user is looking at an app they may have closed. Every inbound
+    // send re-applies it from transport before its own turn, including the
+    // queue drain, so live turns are unaffected.
+    ctx.visibleAppId = undefined;
+    ctx.currentTurnVisibleAppId = undefined;
+    // taskRunId scopes ephemeral task-run permissions to a single turn. Clear
+    // before the queue drain so queued/drained turns on a reused conversation
+    // cannot inherit stale in-task-run scope from the turn that just finished.
+    ctx.taskRunId = undefined;
+
+    // Close the turn's profiling window here rather than after the queue
+    // drain: the profiler is per-conversation and the next turn's
+    // `startToolProfilingRequest` resets it, so a summary emitted after a
+    // drained turn started would report that turn's window under this turn's
+    // request id.
+    emitToolProfilingSummary(ctx.conversationId, reqId);
+  };
 
   const publishLoopMessagesChanged = (): void => {
     if (
@@ -717,14 +875,20 @@ export async function runAgentLoopImpl(
       return;
     }
 
-    // Ensure workspace git repo is initialized before any tools run.
-    try {
-      const getWorkspaceGitServiceFn =
-        ctx.getWorkspaceGitService ?? getWorkspaceGitService;
-      const gitService = getWorkspaceGitServiceFn(ctx.workingDir);
-      await gitService.ensureInitialized();
-    } catch (err) {
-      rlog.warn({ err }, "Failed to initialize workspace git repo (non-fatal)");
+    // Workspace Git readiness is required only when tools can run. Tool-less
+    // callers use the same depth gate consumed by tool resolution.
+    if (!toolsDisabledForTurn) {
+      try {
+        const getWorkspaceGitServiceFn =
+          ctx.getWorkspaceGitService ?? getWorkspaceGitService;
+        const gitService = getWorkspaceGitServiceFn(ctx.workingDir);
+        await gitService.ensureInitialized();
+      } catch (err) {
+        rlog.warn(
+          { err },
+          "Failed to initialize workspace git repo (non-fatal)",
+        );
+      }
     }
 
     // Auto-complete stale interactive surfaces from previous turns.
@@ -737,13 +901,20 @@ export async function runAgentLoopImpl(
         if (entry.surfaceType === "dynamic_page") {
           continue;
         }
+        // Persist before announcing: a client told the card was dismissed
+        // while the write failed would watch the next reseed revert it.
+        // An unannounced dismissal keeps its pending entry so client and
+        // daemon agree the card is still live and the one-interactive-surface
+        // gate keeps holding; the next user message sweeps it again.
+        if (!markSurfaceCompleted(ctx, surfaceId, "Dismissed")) {
+          continue;
+        }
         onEvent({
           type: "ui_surface_complete",
           conversationId: ctx.conversationId,
           surfaceId,
           summary: "Dismissed",
         });
-        markSurfaceCompleted(ctx, surfaceId, "Dismissed");
         ctx.pendingSurfaceActions.delete(surfaceId);
       }
     }
@@ -1341,9 +1512,16 @@ export async function runAgentLoopImpl(
       return { ...msg, content: cleanedBlocks };
     });
 
-    const hasAssistantResponse = newMessages.some(
-      (msg) => msg.role === "assistant",
-    );
+    // "The run delivered a final assistant reply", not "the run produced any
+    // assistant-role message". A run that called tools already carries
+    // assistant `tool_use` messages, and those are not a delivered reply: a
+    // provider error that kills the run mid-turn leaves the tail as the
+    // tool_result (user role), while a run that replied normally ends on the
+    // assistant message. Testing only the tail keeps the synthetic error row
+    // below reachable for mid-turn failures, which is the only durable record
+    // of why the turn stopped.
+    const hasAssistantResponse =
+      newMessages[newMessages.length - 1]?.role === "assistant";
     if (
       !hasAssistantResponse &&
       state.providerErrorUserMessage &&
@@ -1403,13 +1581,13 @@ export async function runAgentLoopImpl(
           providerErrorCategory: state.providerErrorCategory ?? undefined,
         };
         // The persisted row re-enters LLM history and is displayed as
-        // assistant speech, so managed-credits exhaustion swaps the
-        // context-neutral classification copy for assistant-voice wording.
+        // assistant speech, so the managed-billing categories swap the
+        // banner-voice classification copy for assistant-voice wording.
         const persistedErrorText =
-          state.providerErrorCode === "PROVIDER_BILLING" &&
-          state.providerErrorCategory === "credits_exhausted"
-            ? OUT_OF_CREDITS_ASSISTANT_REPLY
-            : state.providerErrorUserMessage;
+          managedBillingAssistantReply(
+            state.providerErrorCode,
+            state.providerErrorCategory,
+          ) ?? state.providerErrorUserMessage;
         const errorAssistantMessage =
           createAssistantMessage(persistedErrorText);
         const errorRow = await addMessage(
@@ -1471,10 +1649,10 @@ export async function runAgentLoopImpl(
     // compaction/overflow recovery (where a cache miss is expected).
     //
     // Post-turn tool-result truncation (spooling large results to disk and
-    // shrinking the next turn's context) is deferred to `runDeferredTurnTail`
+    // shrinking the next turn's context) is deferred to `settleTurnContent`
     // below. It only rewrites the in-memory history the NEXT turn is built
-    // from — never the just-delivered reply — so it must not sit on the
-    // critical path to the terminal SSE that re-enables the composer.
+    // from, never the just-delivered reply, so it must not sit on the critical
+    // path to the terminal SSE that re-enables the composer.
     ctx.messages = restoredHistory;
 
     emitUsage(
@@ -1504,7 +1682,7 @@ export async function runAgentLoopImpl(
     // Fast-path: when the user cancelled, skip expensive post-loop work
     // (attachment resolution) and emit the cancellation event immediately
     // so the client can re-enable the UI without delay. Disk sync and the rest
-    // of the bookkeeping run in `runDeferredTurnTail` after this SSE.
+    // of the bookkeeping run after this SSE.
     if (abortController.signal.aborted) {
       abnormalOutcome = { outcome: "cancelled" };
       ctx.emitActivityState("idle", "generation_cancelled", {
@@ -1600,24 +1778,42 @@ export async function runAgentLoopImpl(
 
     // The terminal SSE for this turn has now been emitted (message_complete,
     // generation_handoff, or generation_cancelled), so the composer is already
-    // re-enabling. Settle any pending debounced partial flush FIRST — a
+    // re-enabling. Settle any pending debounced partial flush FIRST: a
     // cancelled turn exits with the timer still pending, and a flush firing
-    // after the tail's stranded fold (or the voice bridge's transcript
-    // hygiene) would write raw content into an already-settled row. Then
-    // drain the deferred bookkeeping — after the SSE, before the `finally`
-    // commits and drains the queue for the next turn.
+    // after the stranded fold (or the voice bridge's transcript hygiene) would
+    // write raw content into an already-settled row. Then settle the rest of
+    // the turn's content, which rewrites state the next turn also writes and so
+    // has to complete under the processing lock.
     await settlePendingPartialFlush(state, deps);
-    await runDeferredTurnTail({
-      ctx,
-      state,
-      rlog,
-      generationCompletedAt,
-      turnCompleted,
-      userMessageId: options?.notifyUserMessageId ?? userMessageId,
-      ...(options?.replyDeliveredInAppOnly
-        ? { replyDeliveredInAppOnly: true }
-        : {}),
-    });
+    await settleTurnContent({ ctx, state, rlog });
+
+    // Content is settled, so the conversation is free. Release before the
+    // deferred tail rather than in the `finally`: the tail's memory indexing is
+    // network-bound and unbounded, and holding the lock across it is what makes
+    // a fully-delivered reply still answer a follow-up send with a queue slot.
+    // The queue itself is drained later, from the `finally` after the
+    // turn-boundary commit.
+    const criticalSectionMs = Date.now() - generationCompletedAt;
+    releaseTurn();
+
+    // Detached, and chained on the conversation's tail chain so two turns'
+    // tails run in turn order instead of concurrently. The chain is keyed by
+    // conversation id rather than held on this instance, because the tail runs
+    // while the conversation reads idle and can therefore outlive the instance
+    // that scheduled it.
+    chainTurnTail(ctx.conversationId, () =>
+      runDeferredTurnTail({
+        conversationId: ctx.conversationId,
+        state,
+        rlog,
+        criticalSectionMs,
+        turnCompleted,
+        userMessageId: options?.notifyUserMessageId ?? userMessageId,
+        ...(options?.replyDeliveredInAppOnly
+          ? { replyDeliveredInAppOnly: true }
+          : {}),
+      }),
+    );
   } catch (err) {
     clearConversationNotices(ctx.conversationId);
     const errorCtx = {
@@ -1625,9 +1821,9 @@ export async function runAgentLoopImpl(
       aborted: abortController.signal.aborted,
     };
     if (isUserCancellation(err, errorCtx)) {
-      // Only label the turn when it hadn't already replied — a cancellation
-      // surfacing after the terminal SSE (deferred turn-tail bookkeeping)
-      // must not relabel a visibly-replied turn.
+      // Only label the turn when it hadn't already replied: a cancellation
+      // surfacing after the terminal SSE (the content-settle steps) must not
+      // relabel a visibly-replied turn.
       if (!turnReplied) {
         abnormalOutcome = { outcome: "cancelled" };
       }
@@ -1665,112 +1861,86 @@ export async function runAgentLoopImpl(
       publishLoopMessagesChanged();
     }
   } finally {
-    // Clear the processing flag first. It is the release that frees the
-    // conversation for its next turn, so nothing that can throw (the
-    // turn-boundary commit, profiling) is allowed to run ahead of it and leave
-    // the row latched "mid-turn". Stamp the turn's abnormal outcome first
-    // because the telemetry reporter's settled-turn barrier only releases this
-    // turn once processing stops; null `abortController` first so a concurrent
-    // abort takes the force-clear branch rather than signalling a dead one.
-    if (abnormalOutcome) {
-      stampTurnOutcome(userMessageId, abnormalOutcome.outcome, {
-        failureCode: abnormalOutcome.failureCode,
-      });
-    }
-    ctx.abortController = null;
-    ctx.setProcessing(false);
-    // The turn's content is fully flushed by here (`settlePendingPartialFlush`
-    // ran inside the try), so daemon-side callers can safely fall back to the
-    // live seq counter once this registration is gone.
-    unregisterInflightTurn(ctx.conversationId, state);
+    // Backstop release for the cancel/error paths, which throw out of the try
+    // before the happy path's release runs. Idempotent, so the happy path
+    // reaches here already released. It stays first in the `finally` so the
+    // turn-boundary commit below cannot throw ahead of it and leave the row
+    // latched "mid-turn".
+    releaseTurn();
+
+    // The queue drain runs after the turn-boundary commit, under a `finally`
+    // so a throw in the commit section cannot strand the queue with nothing
+    // left to re-trigger it. Ordering is load-bearing: `commitTurnChanges`
+    // attributes the working tree's changes to the finished turn, so a queued
+    // turn that started while it was preparing would have its first file
+    // writes swept into the wrong commit. The wait is deadline-bounded, and
+    // direct sends are already unblocked by the release above.
+    try {
+      if (turnStarted) {
+        ctx.turnCount++;
+        const runTurnCommit = async (): Promise<void> => {
+          const config = getConfig();
+          const maxWait = config.workspaceGit?.turnCommitMaxWaitMs ?? 4000;
+          const deadlineMs = Date.now() + maxWait;
+
+          const commitTurnChangesFn =
+            ctx.commitTurnChanges ?? commitTurnChanges;
+          const commitPromise = commitTurnChangesFn(
+            ctx.workingDir,
+            ctx.conversationId,
+            ctx.turnCount,
+            undefined,
+            deadlineMs,
+          );
+          const outcome = await raceWithTimeout(commitPromise, maxWait);
+          if (outcome === "timed_out") {
+            rlog.warn(
+              {
+                turnNumber: ctx.turnCount,
+                maxWaitMs: maxWait,
+                conversationId: ctx.conversationId,
+              },
+              "Turn-boundary commit timed out; continuing without waiting (commit still runs in background)",
+            );
+          }
+        };
 
-    if (turnStarted) {
-      ctx.turnCount++;
-      const config = getConfig();
-      const maxWait = config.workspaceGit?.turnCommitMaxWaitMs ?? 4000;
-      const deadlineMs = Date.now() + maxWait;
+        if (toolsDisabledForTurn) {
+          // Let the caller and the queue drain below claim an immediate
+          // follow-up turn before starting Git. That turn will commit the
+          // accumulated disk view.
+          setImmediate(() => {
+            if (ctx.isProcessing()) {
+              return;
+            }
+            void runTurnCommit().catch((err) => {
+              rlog.warn({ err }, "Deferred turn-boundary commit failed");
+            });
+          });
+        } else {
+          await runTurnCommit();
+        }
 
-      const commitTurnChangesFn = ctx.commitTurnChanges ?? commitTurnChanges;
-      const commitPromise = commitTurnChangesFn(
-        ctx.workingDir,
-        ctx.conversationId,
-        ctx.turnCount,
-        undefined,
-        deadlineMs,
-      );
-      const outcome = await raceWithTimeout(commitPromise, maxWait);
-      if (outcome === "timed_out") {
-        rlog.warn(
-          {
-            turnNumber: ctx.turnCount,
-            maxWaitMs: maxWait,
-            conversationId: ctx.conversationId,
-          },
-          "Turn-boundary commit timed out — continuing without waiting (commit still runs in background)",
-        );
+        // Recompute relationship-state.json at turn boundary (fire-and-forget).
+        // The writer swallows its own errors, but we still guard with catch()
+        // here so a regression in the writer can never bubble out of the
+        // agent loop and reject an otherwise-complete turn.
+        void writeRelationshipState().catch(() => {});
       }
 
-      // Recompute relationship-state.json at turn boundary (fire-and-forget).
-      // The writer swallows its own errors, but we still guard with catch()
-      // here so a regression in the writer can never bubble out of the
-      // agent loop and reject an otherwise-complete turn.
-      void writeRelationshipState().catch(() => {});
+      // Consolidation deferred to compaction: keeping assistant + tool_result
+      // messages unconsolidated preserves the exact message structure sent to
+      // the API, enabling stable prefix caching across turns.  Compaction
+      // consolidates when it summarizes old messages (cache miss is expected).
+    } finally {
+      // kickDrainQueue never rejects: a drain failure here would otherwise be
+      // an unhandled rejection that strands the queue with nothing left to
+      // re-trigger it.
+      void ctx.kickDrainQueue(
+        yieldedForHandoff ? "checkpoint_handoff" : "loop_complete",
+        "agent_loop_finally",
+      );
     }
-
-    emitToolProfilingSummary(ctx.conversationId, reqId);
-
-    // Tear down the remaining per-turn state. Abort reliably drives the loop to
-    // this `finally` within a bounded time — cooperative signal propagation
-    // (provider fetch + tool race) backed by the abort watchdog — so a
-    // cancelled turn always unwinds before any resend can start a new one.
-    // There is therefore only ever one turn alive, and clearing the shared
-    // state below cannot clobber a concurrent turn.
-    ctx.onConfirmationOutcome = undefined;
-    ctx.surfaceActionRequestIds.delete(ctx.currentRequestId ?? "");
-    ctx.approvedViaPromptThisTurn = false;
-    ctx.currentRequestId = undefined;
-    ctx.currentActiveSurfaceId = undefined;
-    ctx.allowedToolNames = undefined;
-    ctx.diskPressureCleanupModeActive = false;
-    ctx.preactivatedSkillIds = undefined;
-    ctx.currentTurnOverrideProfile = undefined;
-    ctx.currentTurnModelProfileNoticeKey = undefined;
-    // Turn-scoped interactivity. Clear it so paths that bypass this loop (e.g.
-    // opportunity wakes calling `agentLoop.run` directly) don't inherit a stale
-    // value and instead fall back to live client state in the tool context.
-    ctx.currentTurnIsNonInteractive = undefined;
-    // Turn-scoped request origin. Clear so a later turn on a reused
-    // conversation cannot inherit a stale origin-scoped permission grant.
-    ctx.currentTurnRequestOrigin = undefined;
-    // Channel command intents (e.g. Telegram /start) are single-turn metadata.
-    // Clear at turn end so they never leak into subsequent unrelated messages.
-    ctx.commandIntent = undefined;
-    // The app on screen is view state owned by the message that reported it,
-    // not durable conversation state: nothing tells the daemon when the user
-    // closes an app. Clear both copies at turn end so a later turn that brings
-    // no client transport (a scheduled wake, a background follow-up) cannot
-    // claim the user is looking at an app they may have closed. Every inbound
-    // send re-applies it from transport before its own turn, including the
-    // queue drain, so live turns are unaffected.
-    ctx.visibleAppId = undefined;
-    ctx.currentTurnVisibleAppId = undefined;
-    // taskRunId scopes ephemeral task-run permissions to a single turn. Clear
-    // before drainQueue so queued/drained turns on a reused conversation can't
-    // inherit stale in-task-run scope from the turn that just finished.
-    ctx.taskRunId = undefined;
-
-    // Consolidation deferred to compaction: keeping assistant + tool_result
-    // messages unconsolidated preserves the exact message structure sent to
-    // the API, enabling stable prefix caching across turns.  Compaction
-    // consolidates when it summarizes old messages (cache miss is expected).
-
-    // kickDrainQueue never rejects — a drain failure here would otherwise be
-    // an unhandled rejection that strands the queue with nothing left to
-    // re-trigger it.
-    void ctx.kickDrainQueue(
-      yieldedForHandoff ? "checkpoint_handoff" : "loop_complete",
-      "agent_loop_finally",
-    );
   }
 }
 

package/src/daemon/conversation-attachments.ts

@@ -163,7 +163,7 @@ export async function resolveAssistantAttachments(
       const draft = assistantAttachments[i];
       let stored;
       try {
-        stored = attachInlineAttachmentToMessage(
+        stored = await attachInlineAttachmentToMessage(
           lastAssistantMessageId,
           i,
           draft.filename,

package/src/daemon/conversation-error.ts

@@ -6,6 +6,7 @@ import type {
   ConversationErrorCode,
   ConversationErrorEvent,
 } from "../api/events/conversation-error.js";
+import { getIsPlatform } from "../config/env-registry.js";
 import {
   isImageDimensionsTooLargeError,
   isImageMediaTypeMismatchError,
@@ -352,7 +353,7 @@ function connectionResolutionUserMessage(
     case "provider_mismatch":
       return `${connection}${usedBy} is bound to a different provider than the profile declares. Update the profile's connection in ${fixPath}.`;
     case "missing_connection":
-      return `No provider connection is configured${usedBy}. Add an API key or log in via ${fixPath}.`;
+      return `No provider connection is configured${usedBy}. Ask me to set one up right here, or add an API key in ${fixPath}.`;
     case "unroutable_managed_model":
       return `The model "${error.model ?? "<unset>"}"${usedBy} isn't served by the Vellum managed route. Pick a model from the Vellum catalog, or choose a concrete provider in ${fixPath}.`;
     case "missing_credential":
@@ -361,6 +362,12 @@ function connectionResolutionUserMessage(
       // doesn't.
       return `${connection}${usedBy} has no stored credential. Add an API key or reconnect it in ${fixPath}.`;
     case "platform_unauthenticated":
+      // A platform-managed assistant cannot log in or switch providers, and
+      // this classifier only sees the reason code, so one honest wording covers
+      // both the transient and the re-provision cases.
+      if (getIsPlatform()) {
+        return `${connection}${usedBy} is unavailable. If this persists, the platform credential may need to be re-provisioned on the Vellum platform.`;
+      }
       return `${connection}${usedBy} requires a Vellum platform login. Log in, or pick a different provider in ${fixPath}.`;
     case "model_incompatible":
       return `${error.model ? `Model "${error.model}"` : "The requested model"} isn't available on ${connectionName ? `connection "${connectionName}"` : "the configured connection"}${usedBy}. Pick a different model or connection in ${fixPath}.`;