@vellumai/assistant 0.11.3-staging.1 → 0.11.3-staging.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.3-staging.1",
+  "version": "0.11.3-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/conversation-process-app-control-preactivation.test.ts

@@ -86,6 +86,7 @@ import {
   MessageQueue,
   type QueuedMessage,
 } from "../daemon/conversation-queue-manager.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 // ---------------------------------------------------------------------------
 // Fake context — captures preactivation calls, satisfies the bare minimum
@@ -172,6 +173,7 @@ function makeQueuedMessage(opts: {
   content?: string;
   turnInterfaceContext?: TurnInterfaceContext;
   sourceActorPrincipalId?: string;
+  trustContext?: TrustContext;
 }): QueuedMessage {
   return {
     content: opts.content ?? "follow up",
@@ -185,6 +187,7 @@ function makeQueuedMessage(opts: {
     authContext: opts.sourceActorPrincipalId
       ? ({ actorPrincipalId: opts.sourceActorPrincipalId } as never)
       : undefined,
+    trustContext: opts.trustContext,
   };
 }
 
@@ -371,6 +374,126 @@ describe("drainQueue preactivation re-add for host-proxy interfaces", () => {
     expect(ctx.currentTurnSourceActorPrincipalId).toBe("trusted-contact-user");
   });
 
+  test("drainSingleMessage runs the turn under the queued sender's trust, not the live slot", async () => {
+    // The conversation-level slot holds whichever actor sent most recently.
+    // A message that waited while someone else sent must still run as its own
+    // sender: trust decides `trustClass`, `executionChannel`, and
+    // `requesterExternalUserId`, so reading the slot hands the whole
+    // tool-approval path the wrong identity in both directions -- a contact
+    // inheriting guardian self-approval, or a guardian's own call escalating
+    // back to her as a contact's grant request.
+    const contactTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact",
+        trustContext: contactTrust,
+      }),
+    );
+    const ctx = makeFakeContext({ queue });
+    // Someone else sent after this message was queued, moving the slot.
+    ctx.trustContext = {
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    };
+
+    await drainQueue(ctx);
+
+    expect(ctx.currentTurnTrustContext?.trustClass).toBe("trusted_contact");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+    expect(ctx.currentTurnTrustContext?.sourceChannel).toBe("slack");
+    // The slot itself is left alone; only the turn's view is corrected.
+    expect(ctx.trustContext?.trustClass).toBe("guardian");
+  });
+
+  test("buildPassthroughBatch refuses to coalesce two channel senders", async () => {
+    // Channel senders carry no principal, so the `sourceActorPrincipalId`
+    // boundary sees `undefined === undefined` and would batch two different
+    // Slack contacts into one turn running under the head's trust. The batch
+    // must split on the sender's trust identity instead.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-a",
+        content: "from A",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-alex",
+        },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-b",
+        content: "from B",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-blake",
+        },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    // B stays queued: it gets its own turn under its own trust.
+    expect(queue.length).toBe(1);
+    expect(queue.peek(0)?.requestId).toBe("req-contact-b");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe("U-alex");
+  });
+
+  test("buildPassthroughBatch still coalesces two messages from the same sender", async () => {
+    // Sensitivity check on the split above: identical trust must still batch,
+    // otherwise the boundary would be splitting on something incidental and
+    // the test above would pass for the wrong reason.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const sameTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-alex",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a1",
+        content: "first",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a2",
+        content: "second",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    expect(queue.length).toBe(0);
+  });
+
   test("drainSingleMessage does NOT re-add 'app-control' for web-sourced message when no capable client is connected", async () => {
     // mockCapabilityClients remains [] (reset by afterEach from prior test)
     const queue = new MessageQueue();

package/src/__tests__/conversation-queue.test.ts

@@ -556,6 +556,174 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("enqueueMessage captures the sender's trust, immune to a later slot change", async () => {
+    // Trust must ride with the queued message. The conversation-level slot is
+    // rewritten by whoever sends next, so a message that reads it at drain time
+    // would run as the wrong actor. Capturing at enqueue is what makes the
+    // drain's identity independent of who sent afterwards.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // A different actor sends while the message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    const queued = conversation.queue.peek(0);
+    expect(queued?.requestId).toBe("req-2");
+    expect(queued?.trustContext?.trustClass).toBe("trusted_contact");
+    expect(queued?.trustContext?.requesterExternalUserId).toBe("U-contact");
+
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a drained turn keeps its sender's trust once the agent loop is running", async () => {
+    // Exercises the real drain -> runAgentLoop ordering against a live
+    // Conversation. The loop re-initializes the per-turn trust snapshot on
+    // entry, so a drain that only stamped the field before calling it would
+    // have that stamp silently undone and the turn would execute as whoever
+    // sent most recently. Asserting inside the run is the point: checking
+    // before the loop starts passes either way.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // The guardian sends while the contact's message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    // Finish the first turn so the queue drains into a second run.
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Read while run 2 is in flight: this is what tool setup and the
+    // guardian-request producers resolve against.
+    expect(conversation.currentTurnTrustContext?.trustClass).toBe(
+      "trusted_contact",
+    );
+    expect(conversation.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a processMessage turn keeps its turn-start trust when the slot moves before the loop opens", async () => {
+    // processMessage is the third turn entry point, and the one a web turn
+    // takes on an idle conversation (the route only enqueues while
+    // isProcessing). It captures trust at turn start, then awaits several
+    // times before the agent loop opens. The conversation slot is writable
+    // throughout that window by paths that do not own this turn: live-voice
+    // hydration stamp-and-restore, pointer elevation, the voice bridge.
+    //
+    // Driving a real Conversation with only AgentLoop.run mocked is what makes
+    // this observable. A double that stubs runAgentLoop itself would skip the
+    // re-read entirely and pass either way.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    // Land another actor's slot write inside the window, after the turn-start
+    // capture and before the loop opens. persistUserMessage is awaited there.
+    const originalPersist = conversation.persistUserMessage.bind(conversation);
+    let slotMoved = false;
+    (
+      conversation as unknown as {
+        persistUserMessage: typeof conversation.persistUserMessage;
+      }
+    ).persistUserMessage = async (opts) => {
+      const result = await originalPersist(opts);
+      conversation.setTrustContext({
+        trustClass: "guardian",
+        sourceChannel: "vellum",
+        requesterExternalUserId: "guardian-principal",
+      });
+      // Also move the per-turn field, which is writable out-of-band: a wake
+      // that settles inside this window restores its prior value there
+      // (agent-wake stamps at :1470 and restores in a `finally` at :1554).
+      // Covers both writers, so a fix that reads either one back at the agent
+      // loop call still fails this test.
+      conversation.currentTurnTrustContext = {
+        trustClass: "guardian",
+        sourceChannel: "vellum",
+        requesterExternalUserId: "guardian-principal",
+      };
+      slotMoved = true;
+      return result;
+    };
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    // Guard the test itself: if the injection stopped running, the assertions
+    // below would pass for the wrong reason.
+    expect(slotMoved).toBe(true);
+    expect(conversation.trustContext?.trustClass).toBe("guardian");
+
+    // Read mid-run: this is what tool setup and the guardian-request producers
+    // resolve against while the turn executes.
+    expect(conversation.currentTurnTrustContext?.trustClass).toBe(
+      "trusted_contact",
+    );
+    expect(conversation.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("[experimental] queued passthrough siblings drain as a single batched run", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();

package/src/__tests__/conversation-routes-hidden-queue.test.ts

@@ -164,7 +164,11 @@ function makeConversationWithPendingConfirmation(
       promoteToHead: (requestId: string) => ({ requestId }),
     },
     pendingSteerRepair: false,
-    setTrustContext: () => {},
+    // Stores rather than discarding, so a test can observe which trust the
+    // route resolved and move the slot afterwards.
+    setTrustContext(this: { trustContext: unknown }, ctx: unknown) {
+      this.trustContext = ctx;
+    },
     updateClient: () => {},
     emitConfirmationStateChanged: () => {},
     emitActivityState: () => {},
@@ -354,3 +358,62 @@ describe("hidden sends to an idle conversation with a pending confirmation", ()
     expect(spies.agentLoopOptions()?.isHiddenPrompt).toBeUndefined();
   });
 });
+
+describe("POST /messages turn trust", () => {
+  test("the idle send path runs its turn under the trust resolved for the request", async () => {
+    // The idle web path does not go through `processMessage`; it persists and
+    // calls `runAgentLoop` directly. Without the captured trust travelling
+    // with that call, the loop re-reads the conversation slot when it opens,
+    // and the slot is writable in between by paths that do not own this turn
+    // (channel ingress for another actor, live-voice hydration, pointer
+    // elevation, the voice bridge).
+    //
+    // The defect here is at the call site, not inside the loop, so observing
+    // the options the route passes is sufficient. The re-read *inside* the
+    // loop is covered separately against a real Conversation, since a stub
+    // like this one cannot see it.
+    const spies = makeConversationWithPendingConfirmation(false);
+    setConversation(CONV_ID, spies.conversation);
+
+    const conversation = spies.conversation as unknown as {
+      trustContext: unknown;
+      persistUserMessage: () => Promise<{ id: string; deduplicated: boolean }>;
+    };
+
+    // Another actor writes the slot inside the window, after the route
+    // resolves this request's trust and before the loop call.
+    let slotMoved = false;
+    conversation.persistUserMessage = async () => {
+      conversation.trustContext = {
+        trustClass: "trusted_contact",
+        sourceChannel: "slack",
+        requesterExternalUserId: "U-other-actor",
+      };
+      slotMoved = true;
+      return { id: "persisted-user-id", deduplicated: false };
+    };
+
+    const res = await callHandler(
+      (args) => handleSendMessage(args, makeDeps(spies.conversation)),
+      makeRequest({ content: "run a command" }),
+      undefined,
+      202,
+    );
+
+    expect(res.status).toBe(202);
+    // Guard the test itself: if the injection stopped running the assertion
+    // below would pass for the wrong reason.
+    expect(slotMoved).toBe(true);
+    expect(
+      (conversation.trustContext as { trustClass?: string } | undefined)
+        ?.trustClass,
+    ).toBe("trusted_contact");
+
+    // The turn carries the trust this request resolved, not the moved slot.
+    const turnTrust = spies.agentLoopOptions()?.turnTrustContext as
+      | { trustClass?: string }
+      | undefined;
+    expect(turnTrust).toBeDefined();
+    expect(turnTrust?.trustClass).toBe("guardian");
+  });
+});

package/src/__tests__/oauth-provider-seed-logos.test.ts

@@ -1,7 +1,44 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
 import { PROVIDER_SEED_DATA } from "../oauth/seed-providers.js";
 
+const REPO_ROOT = dirname(dirname(dirname(import.meta.dir)));
+const WEB_PUBLIC_DIR = join(REPO_ROOT, "clients/web/public");
+const INTEGRATION_ICON_SOURCE = join(
+  REPO_ROOT,
+  "clients/web/src/components/integrations/integration-icon.tsx",
+);
+
+/**
+ * Provider keys the web client draws without a `BUNDLED_LOGO_URLS` entry.
+ * Google's mark is multi-colour, so it ships as the `GoogleLogo` component
+ * and is returned before the bundled-asset lookup runs.
+ */
+const COMPONENT_RENDERED_PROVIDERS = new Set(["google"]);
+
+/** `publicAsset("/images/...")` paths from `BUNDLED_LOGO_URLS`, by key. */
+function readBundledLogoMap(): Map<string, string> {
+  const source = readFileSync(INTEGRATION_ICON_SOURCE, "utf8");
+  const block = source.match(
+    /const BUNDLED_LOGO_URLS: Record<string, string> = \{([\s\S]*?)\n\};/,
+  );
+  if (!block) {
+    throw new Error(
+      `Could not find BUNDLED_LOGO_URLS in ${INTEGRATION_ICON_SOURCE}. If it ` +
+        `was renamed or restructured, update this test rather than deleting it.`,
+    );
+  }
+  const entries = new Map<string, string>();
+  for (const [, key, path] of block[1]!.matchAll(
+    /(\w+):\s*publicAsset\("([^"]+)"\)/g,
+  )) {
+    entries.set(key!, path!);
+  }
+  return entries;
+}
+
 /**
  * Allowed CDN prefixes for the ``logoUrl`` field on ``PROVIDER_SEED_DATA``
  * (``assistant/src/oauth/seed-providers.ts``):
@@ -41,3 +78,31 @@ describe("PROVIDER_SEED_DATA logo URLs", () => {
     expect(invalid).toEqual([]);
   });
 });
+
+/**
+ * The `logoUrl` above is a fallback for providers registered at runtime. Every
+ * provider we seed ourselves must draw from an asset we ship, because an icon
+ * CDN can drop a brand at any time and the client then degrades to an initials
+ * avatar with nothing in CI to notice: the prefix check above passes just as
+ * happily for a URL that 404s. Simple Icons hosts no Microsoft mark and no
+ * Slack mark, so the seeded URLs for those brands do not resolve there.
+ */
+describe("PROVIDER_SEED_DATA bundled logo coverage", () => {
+  test("every seeded provider renders from a bundled asset", () => {
+    const bundled = readBundledLogoMap();
+    const uncovered = Object.keys(PROVIDER_SEED_DATA).filter(
+      (provider) =>
+        !bundled.has(provider) && !COMPONENT_RENDERED_PROVIDERS.has(provider),
+    );
+
+    expect(uncovered).toEqual([]);
+  });
+
+  test("every bundled logo path resolves to a file on disk", () => {
+    const missingFiles = [...readBundledLogoMap()]
+      .filter(([, path]) => !existsSync(join(WEB_PUBLIC_DIR, path)))
+      .map(([provider, path]) => ({ provider, path }));
+
+    expect(missingFiles).toEqual([]);
+  });
+});

package/src/__tests__/tool-grant-request-escalation.test.ts

@@ -101,17 +101,20 @@ import {
   getRegisteredKinds,
   getResolver,
 } from "../approvals/guardian-request-resolvers.js";
+import { getConfig } from "../config/loader.js";
 import { getDb } from "../persistence/db-connection.js";
 import { getSqlite } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import {
+  TC_GRANT_WAIT_MAX_MS,
   ToolApprovalHandler,
   waitForInlineGrant,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
+import { setConfig } from "./helpers/set-config.js";
 
-/** Short wait config for tests — avoids blocking test suite on the 60s default. */
+/** Short wait config for tests: keeps escalation cases off the real budget. */
 const TEST_INLINE_WAIT_CONFIG = { maxWaitMs: 100, intervalMs: 20 };
 
 await initializeDb();
@@ -490,6 +493,42 @@ describe("inline wait-and-resume", () => {
     expect(elapsed).toBeLessThan(500);
   });
 
+  test("waitForInlineGrant spends timeouts.permissionTimeoutSec when no explicit budget is given", async () => {
+    // The guardian's escalation window must track the configured approval
+    // budget rather than a compiled-in constant, so an operator raising
+    // permissionTimeoutSec actually widens the window a guardian has to
+    // answer in. Omitting maxWaitMs is what production does.
+    const priorTimeouts = getConfig().timeouts;
+    setConfig("timeouts", {
+      ...priorTimeouts,
+      permissionTimeoutSec: 0.15,
+    });
+    try {
+      const req = seedGrantRequest("sha256:configbudget");
+
+      const start = Date.now();
+      const result = await waitForInlineGrant(
+        req.id,
+        {
+          toolName: "bash",
+          inputDigest: "sha256:configbudget",
+          consumingRequestId: "consume-config-budget",
+        },
+        { intervalMs: 20 },
+      );
+      const elapsed = Date.now() - start;
+
+      expect(result.outcome).toBe("timeout");
+      // Bounded well under TC_GRANT_WAIT_MAX_MS: a regression that ignores
+      // config and falls back to the constant blows this ceiling by ~400x.
+      expect(elapsed).toBeGreaterThanOrEqual(120);
+      expect(elapsed).toBeLessThan(3_000);
+      expect(elapsed).toBeLessThan(TC_GRANT_WAIT_MAX_MS);
+    } finally {
+      setConfig("timeouts", priorTimeouts);
+    }
+  }, 10_000);
+
   test("waitForInlineGrant returns aborted when signal fires during wait", async () => {
     const req = seedGrantRequest("sha256:abortwait");
 

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -170,6 +170,7 @@ mock.module("../channels/gateway-guardian-requests.js", () => sim.module);
 import { applyGuardianDecision } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
+import { getConfig } from "../config/loader.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
@@ -177,12 +178,14 @@ import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
 import { resolveRoutingState } from "../runtime/trust-context-resolver.js";
 import {
+  resolveInlineGrantWaitMs,
   TC_GRANT_WAIT_MAX_MS,
   ToolApprovalHandler,
   waitForInlineGrant,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
 import { seedContactChannel } from "./helpers/seed-contact-channel.js";
+import { setConfig } from "./helpers/set-config.js";
 
 await initializeDb();
 
@@ -754,7 +757,10 @@ describe("(f) timeout/stale flow: stale guardian decision after inline wait time
   test("inline_wait_active staleness guard: expired marker allows retry notification", async () => {
     // Create a guardian request with a stale inline_wait_active marker
     // that simulates a daemon crash during the wait.
-    const staleTimestamp = Date.now() - TC_GRANT_WAIT_MAX_MS - 60_000;
+    // Age the marker past the real wait budget, which the resolver's
+    // staleness threshold tracks. Deriving it from the same helper the
+    // waiter uses keeps this case meaningful if the budget changes.
+    const staleTimestamp = Date.now() - resolveInlineGrantWaitMs() - 60_000;
     const req = sim.seedRequest({
       id: `req-stale-${Date.now()}`,
       kind: "tool_grant_request",
@@ -802,6 +808,67 @@ describe("(f) timeout/stale flow: stale guardian decision after inline wait time
     expect(retryNotifications.length).toBeGreaterThan(0);
   });
 
+  test("inline_wait_active marker older than the fallback constant but inside the real budget still suppresses retry", async () => {
+    // The staleness threshold must track the wait budget, not the fallback
+    // constant. A marker aged past TC_GRANT_WAIT_MAX_MS + buffer but still
+    // well inside the configured budget belongs to a waiter that is very
+    // much alive: telling the requester to retry would race a call that is
+    // about to resume, and the retry then fails against the one-time grant
+    // the live waiter consumes.
+    const priorTimeouts = getConfig().timeouts;
+    // Seed the budget rather than leaning on the ambient default, so the
+    // window this case probes exists no matter what the suite's config holds.
+    setConfig("timeouts", { ...priorTimeouts, permissionTimeoutSec: 300 });
+    try {
+      const budgetMs = resolveInlineGrantWaitMs();
+      // Comfortably past the old 90s threshold, comfortably short of the budget.
+      const markerAgeMs = TC_GRANT_WAIT_MAX_MS + 45_000;
+      const liveTimestamp = Date.now() - markerAgeMs;
+      expect(markerAgeMs).toBeLessThan(budgetMs);
+
+      const req = sim.seedRequest({
+        id: `req-live-${Date.now()}`,
+        kind: "tool_grant_request",
+        sourceType: "channel",
+        sourceChannel: "telegram",
+        sourceConversationId: "conv-live-1",
+        requesterExternalUserId: "requester-1",
+        requesterChatId: "requester-chat-1",
+        guardianExternalUserId: "guardian-1",
+        guardianPrincipalId: "test-principal-id",
+        toolName: "bash",
+        inputDigest: "sha256:livewait",
+        expiresAt: Date.now() + 60_000,
+      });
+
+      await sim.module.updateGuardianRequest(req.id, {
+        followupState: `inline_wait_active:${liveTimestamp}`,
+      });
+
+      deliveredReplies.length = 0;
+      const approvalResult = await applyGuardianDecision({
+        requestId: req.id,
+        action: "approve_once",
+        actorContext: guardianActor(),
+        channelDeliveryContext: {
+          replyCallbackUrl: "http://localhost:3000/reply",
+          guardianChatId: "guardian-chat-1",
+          assistantId: "self",
+        },
+      });
+      expect(approvalResult.applied).toBe(true);
+
+      const retryNotifications = deliveredReplies.filter(
+        (r) =>
+          typeof r.payload.text === "string" &&
+          (r.payload.text as string).includes("Please retry"),
+      );
+      expect(retryNotifications.length).toBe(0);
+    } finally {
+      setConfig("timeouts", priorTimeouts);
+    }
+  });
+
   test("fresh inline_wait_active marker suppresses retry notification", async () => {
     // Create a request with a FRESH inline_wait_active marker
     const freshTimestamp = Date.now();

package/src/approvals/guardian-request-resolvers.ts

@@ -54,7 +54,7 @@ import {
   readBatchMetadata,
   resolvePendingQuestion,
 } from "../runtime/question-resolution.js";
-import { TC_GRANT_WAIT_MAX_MS } from "../tools/tool-approval-handler.js";
+import { resolveInlineGrantWaitMs } from "../tools/tool-approval-handler.js";
 import { getLogger } from "../util/logger.js";
 import {
   channelCanAddressOneReaderInBand,
@@ -1587,7 +1587,10 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
     // outlive the actual waiter if the daemon crashes or restarts during
     // the wait. To avoid permanently suppressing the retry notification, we
     // treat the marker as stale if the encoded start timestamp is older than
-    // the maximum wait budget plus a 30s buffer.
+    // the maximum wait budget plus a 30s buffer. The budget is read from the
+    // same resolver the waiter itself uses, so a config change moves both
+    // together; sizing this off a constant would let it fall below the real
+    // wait and declare a live waiter dead.
     const INLINE_WAIT_STALENESS_BUFFER_MS = 30_000;
     const freshRequest = await getGuardianRequestOrNull(request.id);
     const followupState = freshRequest?.followupState ?? "";
@@ -1604,7 +1607,7 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
         ? Date.now() - waitStartMs
         : Infinity; // Treat unparseable timestamps as stale for safety.
       const stalenessThresholdMs =
-        TC_GRANT_WAIT_MAX_MS + INLINE_WAIT_STALENESS_BUFFER_MS;
+        resolveInlineGrantWaitMs() + INLINE_WAIT_STALENESS_BUFFER_MS;
       if (markerAgeMs > stalenessThresholdMs) {
         log.warn(
           {

package/src/config/schemas/timeouts.ts

@@ -26,7 +26,7 @@ export const TimeoutConfigSchema = z
       .positive("timeouts.permissionTimeoutSec must be a positive number")
       .default(300)
       .describe(
-        "How long to wait for user permission approval before timing out (seconds)",
+        "How long to wait for a human to approve a tool call before timing out (seconds). Spent by both approval paths: the interactive permission prompt, and the inline wait when a contact's sensitive tool call is escalated to the guardian.",
       ),
     questionResponseTimeoutSec: z
       .number({ error: "timeouts.questionResponseTimeoutSec must be a number" })

package/src/daemon/conversation-agent-loop.ts

@@ -366,6 +366,13 @@ export async function runAgentLoopImpl(
      * scheduled execute turn attributes its LLM spend to that firing.
      */
     cronRunId?: string | null;
+    /**
+     * Trust this turn runs under. Queue drains pass the trust captured from
+     * the sender at enqueue; without it the initialization below would reset
+     * the turn to the conversation slot, which holds whichever actor sent
+     * most recently rather than the one this turn belongs to.
+     */
+    turnTrustContext?: TrustContext;
   },
 ): Promise<void> {
   if (!ctx.abortController) {
@@ -376,9 +383,21 @@ export async function runAgentLoopImpl(
   // voice-session-bridge, regenerate, etc.) that invoke runAgentLoop directly
   // without going through processMessage/drainQueue. This ensures the system
   // prompt callback always reads a valid snapshot rather than undefined.
-  // processMessage/drainQueue set these fields before calling runAgentLoop;
-  // those existing assignments remain correct and are merely redundant here.
-  ctx.currentTurnTrustContext = ctx.trustContext;
+  //
+  // The invariant: a turn runs under the trust captured when that turn
+  // started, never under whatever the slot holds when the loop happens to
+  // open. Awaits sit between capture and this line, and the slot is writable
+  // throughout by paths that do not own the turn (channel ingress for another
+  // actor, live-voice hydration, pointer elevation, the voice bridge).
+  //
+  // Callers that own a turn are expected to capture at turn start and pass
+  // `turnTrustContext`. This has not been swept across all 13 call sites, so
+  // the fallback below is load-bearing for two different populations: callers
+  // that legitimately have no turn to capture (subagent manager, voice
+  // bridge, regenerate), and callers that should pass it and do not yet.
+  // Treat a caller reaching the fallback as unverified, not as correct.
+  // LUM-3148 removes the ambiguity by making trust ride the turn.
+  ctx.currentTurnTrustContext = options?.turnTrustContext ?? ctx.trustContext;
   ctx.currentTurnChannelCapabilities = ctx.channelCapabilities;
 
   // Re-resolve the system prompt under the snapshots just set and push it into

package/src/daemon/conversation-messaging.ts

@@ -565,6 +565,12 @@ export interface EnqueueMessageOptions {
   sourceActorPrincipalId?: string;
   /** Auth context snapshot captured for queued turn-scoped authorization. */
   authContext?: AuthContext;
+  /**
+   * Sender's trust, for the drain to run this message under. Defaults to the
+   * conversation's trust at enqueue time, which the sending route has just
+   * set to this sender.
+   */
+  trustContext?: TrustContext;
 }
 
 // ── enqueueMessage ───────────────────────────────────────────────────
@@ -593,6 +599,9 @@ export function enqueueMessage(
     options.sourceActorPrincipalId ??
     ctx.currentTurnSourceActorPrincipalId ??
     queuedAuthContext?.actorPrincipalId;
+  // Deliberately not falling back to `currentTurnTrustContext`: that is the
+  // in-flight turn's actor, which is precisely who this message is not from.
+  const queuedTrustContext = options.trustContext ?? ctx.trustContext;
 
   if (!ctx.isProcessing()) {
     return { queued: false, requestId };
@@ -619,6 +628,7 @@ export function enqueueMessage(
     isInteractive,
     sourceActorPrincipalId,
     authContext: queuedAuthContext,
+    trustContext: queuedTrustContext,
     transport,
     displayContent,
     sentAt: Date.now(),
@@ -668,6 +678,14 @@ export interface PersistMessageOptions {
   metadata?: Record<string, unknown>;
   displayContent?: string;
   clientMessageId?: string;
+  /**
+   * Trust to attribute the stored row to. Queue drains pass the sender's
+   * captured trust so persisted provenance names the same actor the turn
+   * executes as; the conversation slot may by then hold someone else.
+   * Defaults to the conversation's trust, which is correct for callers
+   * persisting a message the current actor just sent.
+   */
+  trustContext?: TrustContext;
   /**
    * Persist the row without indexing it (no memory segments, embeddings, or
    * lexical-index entry). For machine-authored prompts that must not enter
@@ -844,7 +862,9 @@ export async function persistQueuedMessageBody(
       extractTurnChannelContext(metadata) ?? ctx.getTurnChannelContext();
     const turnIfCtx =
       extractTurnInterfaceContext(metadata) ?? ctx.getTurnInterfaceContext();
-    const provenance = provenanceFromTrustContext(ctx.trustContext);
+    const provenance = provenanceFromTrustContext(
+      options.trustContext ?? ctx.trustContext,
+    );
     const imageSourcePaths = extractImageSourcePaths(attachments);
 
     // Strip the transient `slackInbound` carrier key from the persisted

package/src/daemon/conversation-process.ts

@@ -62,6 +62,7 @@ import { getModelInfo } from "./handlers/config-model.js";
 import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import { buildTransportHints } from "./transport-hints.js";
+import { sameTrustIdentity, type TrustContext } from "./trust-context-types.js";
 import { resolveVerificationSessionIntent } from "./verification-session-intent.js";
 
 const log = getLogger("conversation-process");
@@ -301,6 +302,13 @@ async function buildPassthroughBatch(
     if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId) {
       break;
     }
+    // Channel senders carry no principal, so the check above leaves two
+    // different Slack contacts looking identical (`undefined === undefined`).
+    // The batch runs under a single trust context, so split on the sender's
+    // trust identity too or a tail executes with the head's privileges.
+    if (!sameTrustIdentity(candidate.trustContext, head.trustContext)) {
+      break;
+    }
     if (classifySlash(candidate.content) !== "passthrough") {
       break;
     }
@@ -795,7 +803,11 @@ async function drainSingleMessage(
 
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.
-  conversation.currentTurnTrustContext = conversation.trustContext;
+  // Trust comes from the queued message, not the live slot: the slot holds
+  // whichever actor sent most recently, which is this sender only when nobody
+  // else sent while this message waited.
+  conversation.currentTurnTrustContext =
+    next.trustContext ?? conversation.trustContext;
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1135,6 +1147,9 @@ async function drainSingleMessage(
       metadata: { ...next.metadata, sentAt: next.sentAt },
       displayContent: next.displayContent,
       clientMessageId: next.clientMessageId,
+      // Attribute the stored row to the sender this turn runs as, not to
+      // whoever happens to occupy the conversation slot at drain time.
+      trustContext: next.trustContext,
       ...(next.transport?.clientOs
         ? { requestClientOs: next.transport.clientOs }
         : {}),
@@ -1258,7 +1273,14 @@ async function drainSingleMessage(
     isUserMessage?: boolean;
     titleText?: string;
     isHiddenPrompt?: boolean;
-  } = { isUserMessage: true };
+    turnTrustContext?: TrustContext;
+  } = {
+    isUserMessage: true,
+    // Carry the sender's trust into the run. The loop re-initializes the
+    // per-turn snapshot on entry, so without this the stamp above is undone
+    // and the turn reverts to the conversation's most recent actor.
+    turnTrustContext: conversation.currentTurnTrustContext,
+  };
   if (next.isInteractive !== undefined) {
     drainLoopOptions.isInteractive = next.isInteractive;
   }
@@ -1383,7 +1405,12 @@ async function drainBatch(
 
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.
-  conversation.currentTurnTrustContext = conversation.trustContext;
+  // The head's trust governs the batch, which is sound only because
+  // `buildPassthroughBatch` refuses to coalesce messages from different
+  // actors; without that boundary this would run a tail under the head's
+  // trust.
+  conversation.currentTurnTrustContext =
+    head.trustContext ?? conversation.trustContext;
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1488,6 +1515,9 @@ async function drainBatch(
         metadata: { ...qm.metadata, sentAt: qm.sentAt },
         displayContent: qm.displayContent,
         clientMessageId: qm.clientMessageId,
+        // Same attribution rule as the single-message drain. Batch members
+        // share one sender, so every row here names that sender.
+        trustContext: qm.trustContext,
         ...(qm.transport?.clientOs
           ? { requestClientOs: qm.transport.clientOs }
           : {}),
@@ -1719,8 +1749,12 @@ async function drainBatch(
     titleText?: string;
     isHiddenPrompt?: boolean;
     notifyUserMessageId?: string;
+    turnTrustContext?: TrustContext;
   } = {
     isUserMessage: true,
+    // Same reason as the single-message drain: the loop re-initializes the
+    // per-turn snapshot, so the head's trust has to travel with the call.
+    turnTrustContext: conversation.currentTurnTrustContext,
   };
   if (lastPushEligibleUserMessageId !== undefined) {
     drainLoopOptions.notifyUserMessageId = lastPushEligibleUserMessageId;
@@ -1842,7 +1876,14 @@ export async function processMessage(
   await conversation.ensureActorScopedHistory();
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.
-  conversation.currentTurnTrustContext = conversation.trustContext;
+  //
+  // Held in a local as well as on the conversation: the field is writable
+  // out-of-band while this turn is in flight (`agent-wake` stamps it and
+  // restores the prior value in a `finally`), so reading it back at the agent
+  // loop call below would reintroduce the late read this capture exists to
+  // avoid. The local is what the loop runs under.
+  const turnTrustContext = conversation.trustContext;
+  conversation.currentTurnTrustContext = turnTrustContext;
   conversation.currentTurnAuthContext = conversation.authContext;
   conversation.currentTurnSourceActorPrincipalId =
     sourceActorPrincipalId ?? conversation.authContext?.actorPrincipalId;
@@ -2311,7 +2352,16 @@ export async function processMessage(
     titleText?: string;
     callSite?: LLMCallSite;
     overrideProfile?: string;
-  } = { isUserMessage: true };
+    turnTrustContext?: TrustContext;
+  } = {
+    isUserMessage: true,
+    // Carry the trust captured at turn start into the run. Several awaits sit
+    // between that capture and the loop opening, and both the conversation
+    // slot and the per-turn field are writable throughout that window, so
+    // reading either here would run this turn as whoever wrote last. The
+    // local captured at turn start is the only value no other writer can move.
+    turnTrustContext,
+  };
   if (isInteractive !== undefined) {
     loopOptions.isInteractive = isInteractive;
   }

package/src/daemon/conversation-queue-manager.ts

@@ -14,6 +14,7 @@ import type { AuthContext } from "../runtime/auth/types.js";
 import { getLogger } from "../util/logger.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
+import type { TrustContext } from "./trust-context-types.js";
 
 const log = getLogger("conversation-queue");
 
@@ -33,6 +34,15 @@ export interface QueuedMessage {
   sourceActorPrincipalId?: string;
   /** Full auth snapshot captured at enqueue time for turn-scoped authorization decisions. */
   authContext?: AuthContext;
+  /**
+   * Sender's trust captured at enqueue time. The conversation-level
+   * `trustContext` is a single mutable slot holding whichever actor last sent
+   * a message, so a drain that read it would run this message under a
+   * different actor's trust whenever another actor sent in between. Trust
+   * governs `trustClass`, `executionChannel`, and `requesterExternalUserId`,
+   * so reading the wrong one misroutes the whole tool-approval path.
+   */
+  trustContext?: TrustContext;
   /** Transport metadata snapshot captured at enqueue time, applied when this message becomes active. */
   transport?: ConversationTransportMetadata;
   /** Original user message text to persist to DB when recording intent stripping produced a different `content`. */

package/src/daemon/conversation.ts

@@ -2661,6 +2661,12 @@ export class Conversation {
        * forwarded into {@link runAgentLoopImpl} and threaded to `recordUsage`.
        */
       cronRunId?: string | null;
+      /**
+       * See {@link runAgentLoopImpl}: trust this turn runs under. Queue
+       * drains pass the sender's trust captured at enqueue so the run is not
+       * reset to the conversation's most recent actor.
+       */
+      turnTrustContext?: TrustContext;
     },
   ): Promise<void> {
     const { onEvent, ...rest } = options ?? {};

package/src/daemon/trust-context-types.ts

@@ -67,3 +67,42 @@ export interface TrustContext {
    */
   requesterInteractionCount?: number;
 }
+
+/**
+ * Whether two trust contexts describe the same acting identity at the same
+ * privilege, for callers that may only run work under one of them (batched
+ * turns being the case that matters).
+ *
+ * Compares the privilege (`trustClass`), the channel a grant is scoped to
+ * (`sourceChannel`), and every field that can carry who the actor is. The
+ * identity fields are covered exhaustively rather than by picking the usual
+ * ones: an ingress that populates only `requesterIdentifier` or
+ * `requesterContactId` would otherwise leave two distinct senders comparing
+ * equal on a pair of undefineds, which is the exact case this guards.
+ *
+ * Deliberately conservative: an absent field never matches a present one, so
+ * unknown identities are treated as distinct. Answering "different" when they
+ * match only costs a batching opportunity; answering "same" when they differ
+ * runs one actor's work under another's privileges.
+ */
+export function sameTrustIdentity(
+  a: TrustContext | undefined,
+  b: TrustContext | undefined,
+): boolean {
+  if (a === b) {
+    return true;
+  }
+  if (!a || !b) {
+    return false;
+  }
+  return (
+    a.trustClass === b.trustClass &&
+    a.sourceChannel === b.sourceChannel &&
+    a.requesterExternalUserId === b.requesterExternalUserId &&
+    a.requesterChatId === b.requesterChatId &&
+    a.requesterIdentifier === b.requesterIdentifier &&
+    a.requesterContactId === b.requesterContactId &&
+    a.guardianExternalUserId === b.guardianExternalUserId &&
+    a.guardianPrincipalId === b.guardianPrincipalId
+  );
+}

package/src/oauth/AGENTS.md

@@ -35,9 +35,11 @@ Managed-sign-in users should get the integration pre-enabled by setting `service
 
 ### 4. Set the logo URL — `seed-providers.ts`
 
-The `logoUrl` field in `seed-providers.ts` is the source of truth for a provider's logo. Most providers use a [Simple Icons](https://simpleicons.org) (CC0-licensed) CDN URL like `https://cdn.simpleicons.org/acme`. The web client resolves logos from this field (see `clients/web/src/components/integrations/integration-icon.tsx`) and falls back to an initials avatar.
+The `logoUrl` field in `seed-providers.ts` is the source of truth for a provider's logo. Most providers use a [Simple Icons](https://simpleicons.org) (CC0-licensed) CDN URL like `https://cdn.simpleicons.org/acme`.
 
-For brands Simple Icons doesn't host (e.g. Salesforce, which Simple Icons removed for trademark reasons), use the `glincker/thesvg` source via jsDelivr — `https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/<key>/default.svg`. The recognised `logoUrl` prefixes are enforced by `oauth-provider-seed-logos.test.ts`; if you need a third source, extend that allowlist.
+**Verify the URL actually resolves before you commit it.** `oauth-provider-seed-logos.test.ts` only checks the prefix, so a slug that Simple Icons has never hosted (or has since dropped) passes CI and then renders as an initials avatar in the client. Simple Icons removes brands on trademark request: Salesforce is gone, every Microsoft product went in v13, and Slack is currently absent pending permission from the trademark owner. For those, use the `glincker/thesvg` source via jsDelivr: `https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/<key>/default.svg`. The recognised `logoUrl` prefixes are enforced by `oauth-provider-seed-logos.test.ts`; if you need a third source, extend that allowlist.
+
+`logoUrl` is a fallback, not the last word. The web client prefers a logo bundled in `clients/web/public/images/integrations/` when one exists for the provider key, uses `logoUrl` when it doesn't, and only then falls back to an initials avatar (see `BUNDLED_LOGO_URLS` in `clients/web/src/components/integrations/integration-icon.tsx`). Bundling an asset for a new first-class provider is optional but preferred: it survives a CDN removal, works offline, and keeps the integrations list from telling a third party which providers a user is looking at.
 
 ### 5. Secret patterns (if applicable) — `packages/service-contracts/src/secret-detection.ts`
 

package/src/oauth/seed-providers.ts

@@ -167,7 +167,8 @@ export const PROVIDER_SEED_DATA: Record<
     description: "Workspace messaging",
     dashboardUrl: "https://api.slack.com/apps",
     clientIdPlaceholder: null,
-    logoUrl: "https://cdn.simpleicons.org/slack",
+    logoUrl:
+      "https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/slack/default.svg",
     defaultScopes: [
       "channels:join",
       "channels:read",
@@ -710,7 +711,8 @@ export const PROVIDER_SEED_DATA: Record<
     dashboardUrl:
       "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
     clientIdPlaceholder: "Application (client) ID from Azure portal",
-    logoUrl: "https://cdn.simpleicons.org/microsoftoutlook",
+    logoUrl:
+      "https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/microsoft-outlook/default.svg",
     defaultScopes: [
       "openid",
       "profile",
@@ -764,7 +766,8 @@ export const PROVIDER_SEED_DATA: Record<
     dashboardUrl: null,
     clientIdPlaceholder: null,
     requiresClientSecret: false,
-    logoUrl: "https://cdn.simpleicons.org/slack",
+    logoUrl:
+      "https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/slack/default.svg",
     defaultScopes: [],
     injectionTemplates: [
       {

package/src/runtime/routes/conversation-routes.ts

@@ -1915,6 +1915,15 @@ export async function handleSendMessage(
     conversation.setTrustContext({ trustClass: "guardian", sourceChannel });
   }
 
+  // The trust this request's turn runs under, captured here rather than read
+  // back at the agent loop below. Every branch above has just written it and
+  // nothing awaits in between, so this is the resolved sender. Between here
+  // and the loop the conversation slot is writable by paths that do not own
+  // this turn (channel ingress for another actor, live-voice hydration,
+  // pointer elevation, the voice bridge), and the loop would otherwise
+  // re-read it and run this turn as whoever wrote last.
+  const turnTrustContext = conversation.trustContext;
+
   const isInteractive = isInteractiveInterface(sourceInterface);
   // Translate the dev-bypass actor principal to the real guardian principal
   // before the same-actor host-proxy gate so web/iOS turns match the macOS
@@ -2691,6 +2700,7 @@ export async function handleSendMessage(
       onEvent: broadcastMessage,
       isInteractive,
       isUserMessage: true,
+      turnTrustContext,
       ...(body.hidden === true ? { isHiddenPrompt: true } : {}),
     })
     .catch((err) => {

package/src/subagent/manager.ts

@@ -701,10 +701,17 @@ export class SubagentManager {
     // wins over parent inheritance: a parent that stamps trust per-turn (the
     // live-voice bridge) has already cleared it by the time a detached spawn
     // reads it, so its spawner resolves trust itself.
+    //
+    // Inherit the parent's *turn* trust ahead of its conversation-level slot:
+    // the slot holds whichever actor sent most recently, so a spawn during one
+    // actor's turn would otherwise run under another's privileges.
+    const parentTurnTrust =
+      parentConversation?.currentTurnTrustContext ??
+      parentConversation?.trustContext;
     if (config.trustContext) {
       conversation.setTrustContext({ ...config.trustContext });
-    } else if (parentConversation?.trustContext) {
-      conversation.setTrustContext({ ...parentConversation.trustContext });
+    } else if (parentTurnTrust) {
+      conversation.setTrustContext({ ...parentTurnTrust });
     }
     const parentAuthContext = parentConversation?.getAuthContext();
     if (parentAuthContext) {

package/src/tools/execution-timeout.ts

@@ -6,11 +6,18 @@ const TIMEOUT_SENTINEL = Symbol("tool-timeout");
 /**
  * Convert a config-provided seconds value to a safe milliseconds value,
  * falling back to the default if the input is NaN, non-finite, zero, or negative.
+ *
+ * `fallbackMs` lets callers governed by a different budget (e.g. the inline
+ * grant wait) keep their own floor instead of inheriting the tool-execution
+ * default.
  */
-export function safeTimeoutMs(sec: unknown): number {
+export function safeTimeoutMs(
+  sec: unknown,
+  fallbackMs: number = DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC * 1000,
+): number {
   const n = Number(sec);
   if (!Number.isFinite(n) || n <= 0) {
-    return DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC * 1000;
+    return fallbackMs;
   }
   return n * 1000;
 }

package/src/tools/tool-approval-handler.ts

@@ -39,6 +39,7 @@ import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 import { recordToolDenied, recordToolError } from "../telemetry/tool-audit.js";
 import { getLogger } from "../util/logger.js";
 import { resolveExecutionTarget } from "./execution-target.js";
+import { safeTimeoutMs } from "./execution-timeout.js";
 import { channelCoordinatesFromToolContext } from "./policy-context.js";
 import { getAllTools, getTool, getToolOwner } from "./registry.js";
 import { isSideEffectTool } from "./side-effects.js";
@@ -127,9 +128,39 @@ export function buildInactiveToolMessage(args: {
 
 /** Default polling interval for inline grant wait (ms). */
 const TC_GRANT_WAIT_INTERVAL_MS = 500;
-/** Default maximum wait time for inline grant wait (ms). */
+/**
+ * Fallback maximum wait for the inline grant wait (ms), used only when the
+ * deployed config cannot be read. The governing budget is
+ * `timeouts.permissionTimeoutSec` (see {@link resolveInlineGrantWaitMs}).
+ */
 export const TC_GRANT_WAIT_MAX_MS = 60_000;
 
+/**
+ * Resolve the wait budget for an escalated tool grant.
+ *
+ * A guardian answering an escalated tool call is making the same decision as a
+ * local user answering a permission prompt, so both paths spend the same
+ * budget: `timeouts.permissionTimeoutSec` (read by `permissions/prompter.ts`).
+ * If anything, this path needs the larger share of it: the prompter's user
+ * already has the prompt on screen, while the guardian is notified
+ * out-of-band and has to context-switch before deciding.
+ *
+ * Falls back to {@link TC_GRANT_WAIT_MAX_MS} rather than the tool-execution
+ * default on a non-positive value, so a bad config can never collapse the
+ * window to zero and auto-deny every escalation.
+ *
+ * Exported because the grant resolver sizes its `inline_wait_active` staleness
+ * threshold off this same budget: if the two drift, an approval arriving while
+ * a waiter is still live gets misread as a dead waiter and the requester is
+ * told to retry a call that is about to resume on its own.
+ */
+export function resolveInlineGrantWaitMs(): number {
+  return safeTimeoutMs(
+    getConfig().timeouts.permissionTimeoutSec,
+    TC_GRANT_WAIT_MAX_MS,
+  );
+}
+
 /**
  * Inline wait result for trusted-contact grant polling.
  * - `granted`: a grant was minted and consumed within the wait window.
@@ -152,13 +183,16 @@ export type InlineGrantWaitOutcome =
  * and atomically consume the grant).
  *
  * Only called for trusted_contact actors with valid guardian bindings.
+ *
+ * `options.maxWaitMs` overrides the wait budget; omitting it spends the
+ * configured one from {@link resolveInlineGrantWaitMs}.
  */
 export async function waitForInlineGrant(
   escalationRequestId: string,
   consumeParams: Parameters<typeof consumeGrantForInvocation>[0],
   options?: { maxWaitMs?: number; intervalMs?: number; signal?: AbortSignal },
 ): Promise<InlineGrantWaitOutcome> {
-  const maxWait = options?.maxWaitMs ?? TC_GRANT_WAIT_MAX_MS;
+  const maxWait = options?.maxWaitMs ?? resolveInlineGrantWaitMs();
   const interval = options?.intervalMs ?? TC_GRANT_WAIT_INTERVAL_MS;
   const signal = options?.signal;
   const deadline = Date.now() + maxWait;
@@ -592,9 +626,16 @@ export type PreExecutionGateResult =
     }
   | { allowed: false; result: ToolExecutionResult };
 
-/** Configuration for the inline grant wait behavior. */
+/**
+ * Overrides for the inline grant wait behavior. Production leaves this empty
+ * so the wait spends the configured budget; tests inject short waits to keep
+ * escalation cases fast.
+ */
 export interface InlineGrantWaitConfig {
-  /** Maximum time to wait for guardian approval (ms). Defaults to TC_GRANT_WAIT_MAX_MS. */
+  /**
+   * Maximum time to wait for guardian approval (ms). Defaults to the budget
+   * from {@link resolveInlineGrantWaitMs}.
+   */
   maxWaitMs?: number;
   /** Polling interval during the wait (ms). Defaults to TC_GRANT_WAIT_INTERVAL_MS. */
   intervalMs?: number;