@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/daemon/__tests__/plugin-mcp-reconcile.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The plugin source reconcile drives MCP reload.
+ *
+ * Without this, installing a plugin leaves its `mcp.json` servers
+ * unconnected and its tools unregistered until an explicit MCP reload, a
+ * config edit, or a restart — and, worse in the other direction, an
+ * uninstalled or disabled plugin's connected client and registered tools
+ * stay callable. The reconcile is the seam every install / uninstall /
+ * upgrade / enable / disable already funnels through.
+ *
+ * The guard is equally load-bearing: a reconcile also fires for plugin
+ * edits that touch no `mcp.json`, and reloading on those would tear down
+ * every healthy workspace connection to rebuild it for nothing.
+ */
+
+import { beforeEach, describe, expect, jest, mock, test } from "bun:test";
+
+let pluginServersChanged = true;
+
+const managerStop = jest.fn(async () => {});
+const managerStart = jest.fn(async () => []);
+
+mock.module("../../mcp/effective-config.js", () => ({
+  buildEffectiveMcpConfig: () => ({
+    servers: {
+      unabyss: {
+        transport: { type: "streamable-http", url: "https://mcp.example/x" },
+        enabled: true,
+        defaultRiskLevel: "low",
+        maxTools: 20,
+        source: "plugin",
+      },
+    },
+    globalMaxTools: 50,
+  }),
+  pluginMcpServersChangedSinceLastBuild: () => pluginServersChanged,
+}));
+
+mock.module("../../mcp/manager.js", () => ({
+  getMcpServerManager: () => ({ stop: managerStop, start: managerStart }),
+}));
+
+mock.module("../../mcp/mcp-header-store.js", () => ({
+  migrateLegacyMcpHeaders: async () => {},
+}));
+
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({ mcp: { servers: {}, globalMaxTools: 50 } }),
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../../tools/registry.js", () => ({
+  registerMcpTools: () => [],
+  unregisterAllMcpTools: () => {},
+}));
+
+const { reconcilePluginMcpServers } = await import("../mcp-reload-service.js");
+
+describe("reconcilePluginMcpServers", () => {
+  beforeEach(() => {
+    managerStop.mockClear();
+    managerStart.mockClear();
+  });
+
+  test("reloads when the plugin-declared set changed", async () => {
+    pluginServersChanged = true;
+
+    await reconcilePluginMcpServers();
+
+    expect(managerStop).toHaveBeenCalledTimes(1);
+    expect(managerStart).toHaveBeenCalledTimes(1);
+  });
+
+  test("does nothing when no plugin changed the set", async () => {
+    pluginServersChanged = false;
+
+    await reconcilePluginMcpServers();
+
+    expect(managerStop).not.toHaveBeenCalled();
+    expect(managerStart).not.toHaveBeenCalled();
+  });
+});

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -143,6 +143,7 @@ import type {
   WebSearchResultItem,
 } from "./message-types/web-activity.js";
 import { referenceMediaBlocksForPersist } from "./persist-media-references.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import type { TurnLatencyTracker } from "./turn-latency-tracker.js";
 
 const log = getLogger("agent-loop-handlers");
@@ -1330,7 +1331,7 @@ function buildAssistantChannelMetadata(
   deps: EventHandlerDeps,
 ): Record<string, unknown> {
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(deps.ctx.trustContext),
+    ...provenanceFromTrustContext(turnOrRestingTrust(deps.ctx)),
     userMessageChannel: deps.turnChannelContext.userMessageChannel,
     assistantMessageChannel: deps.turnChannelContext.assistantMessageChannel,
     userMessageInterface: deps.turnInterfaceContext.userMessageInterface,
@@ -1340,15 +1341,19 @@ function buildAssistantChannelMetadata(
   };
 
   if (deps.turnChannelContext.assistantMessageChannel === "slack") {
-    const channelId = deps.ctx.trustContext?.requesterChatId;
+    // The whole envelope resolves from one turn-local snapshot: the actor the
+    // provenance above names is the actor whose channel and thread the row
+    // routes to. Reading the live slot here instead would let a concurrent
+    // inbound repoint the reply mid-turn, and could stamp one actor's class
+    // beside another actor's routing identity.
+    const rowTrust = turnOrRestingTrust(deps.ctx);
+    const channelId = rowTrust?.requesterChatId;
     if (channelId) {
-      // Resolve the reply thread from this turn's own inbound thread id,
-      // captured turn-locally on the trust context at ingress (the same field
-      // guardian-approval cards read). This is deliberately not the shared
-      // conversation binding: on a legacy flat→thread aliased Slack
-      // conversation a concurrent inbound can rewrite the binding's
-      // externalThreadId mid-turn, whereas the trust context is per-turn.
-      const turnThreadTs = deps.ctx.trustContext?.sourceThreadId;
+      // This turn's own inbound thread id (the same field guardian-approval
+      // cards read). Deliberately not the shared conversation binding: on a
+      // legacy flat→thread aliased Slack conversation a concurrent inbound
+      // can rewrite the binding's externalThreadId mid-turn.
+      const turnThreadTs = rowTrust?.sourceThreadId;
       const threadTs = isSlackTs(turnThreadTs) ? turnThreadTs : undefined;
       const timestampTimezone = resolveAssistantReplyTimestampTimezone(
         deps.ctx,
@@ -1896,7 +1901,7 @@ function buildToolResultMetadata(
   deps: EventHandlerDeps,
 ): Record<string, unknown> {
   return {
-    ...provenanceFromTrustContext(deps.ctx.trustContext),
+    ...provenanceFromTrustContext(turnOrRestingTrust(deps.ctx)),
     userMessageChannel: deps.turnChannelContext.userMessageChannel,
     assistantMessageChannel: deps.turnChannelContext.assistantMessageChannel,
     userMessageInterface: deps.turnInterfaceContext.userMessageInterface,

package/src/daemon/conversation-agent-loop.ts

@@ -61,7 +61,11 @@ import { HOOKS } from "../plugin-api/constants.js";
 import type { ConversationGraphMemory } from "../plugins/defaults/memory/graph/conversation-graph-memory.js";
 import { enqueueMemoryRetrospectiveOnCompaction } from "../plugins/defaults/memory/memory-retrospective-enqueue.js";
 import { runHook } from "../plugins/pipeline.js";
-import { isManagedConnectionRoute } from "../providers/connection-resolution.js";
+import {
+  dispatchProviderResolvable,
+  isManagedConnectionRoute,
+  resolveEntryConnectionName,
+} from "../providers/connection-resolution.js";
 import {
   ConnectionResolutionError,
   resolveRoutingIdentity,
@@ -130,6 +134,7 @@ import {
 } from "./inflight-turn-registry.js";
 import type { UsageStats } from "./message-protocol.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveTurnCallSite } from "./turn-call-site.js";
 import { runWithLatencySubSpans } from "./turn-latency-sub-spans.js";
 import {
@@ -315,6 +320,8 @@ export async function runAgentLoopImpl(
      * the turn.
      */
     isHiddenPrompt?: boolean;
+    /** Daemon-authored kind of the user row that triggered this turn. */
+    messageKind?: string;
     /**
      * Row the end-of-turn reply notification should treat as the prompt this
      * turn answers. Defaults to `userMessageId`; a coalesced batch overrides it
@@ -399,6 +406,17 @@ export async function runAgentLoopImpl(
   // LUM-3148 removes the ambiguity by making trust ride the turn.
   ctx.currentTurnTrustContext = options?.turnTrustContext ?? ctx.trustContext;
   ctx.currentTurnChannelCapabilities = ctx.channelCapabilities;
+  // Presence is the third per-turn snapshot: whether a human is present to see
+  // UI and answer prompts. Callers declare it via `isInteractive`; a caller
+  // that omits it gets a non-interactive turn. Set before the prompt build
+  // below, which reads it (through `hasNoClient`).
+  const isInteractiveResolved = options?.isInteractive ?? false;
+  // Resolved once and threaded into every re-injection (including the
+  // post-compaction hook) rather than re-read per assembly call, and exposed
+  // to tool execution so tools (e.g. ask_question) see whether a human is
+  // present rather than re-deriving it from live state.
+  const isNonInteractive = !isInteractiveResolved;
+  ctx.currentTurnIsNonInteractive = isNonInteractive;
 
   // Re-resolve the system prompt under the snapshots just set and push it into
   // the loop when the persona changed. The loop reuses the prompt frozen at
@@ -491,10 +509,13 @@ export async function runAgentLoopImpl(
   const turnErrorAttribution = (): ConversationErrorAttribution => {
     try {
       const overrideProfile = readCurrentOverrideProfile();
+      // Mirrors dispatch's selection (including the resolvable-provider
+      // healing) so attribution names the profile that actually ran.
       const resolveOpts = {
         overrideProfile,
         forceOverrideProfile,
         selectionSeed: ctx.conversationId,
+        isResolvableProvider: dispatchProviderResolvable,
       };
       const { config: resolved, profileName } =
         resolveCallSiteConfigWithProfile(turnCallSite, config.llm, resolveOpts);
@@ -509,6 +530,10 @@ export async function runAgentLoopImpl(
         }
         connectionName = error.connectionName;
       }
+      // An entry-name provider IS the connection name, matching the
+      // dispatch-side translation.
+      connectionName ??=
+        resolveEntryConnectionName(resolved.provider) ?? undefined;
       // Managed-ness comes from the connection row, matching what dispatch
       // decides. The profile's own provider can't stand in: a concrete
       // provider tweak over a managed winner keeps the managed connection
@@ -666,19 +691,6 @@ export async function runAgentLoopImpl(
     };
   })();
 
-  const isInteractiveResolved =
-    options?.isInteractive ?? (!ctx.hasNoClient && !ctx.headlessLock);
-  // Whether the in-flight turn has no human present to answer clarification
-  // questions. Derived from the loop's `isInteractive` option (which can fall
-  // back to mutable client/headless state that flips mid-turn), so it is
-  // resolved once here and threaded into every re-injection — including the
-  // post-compaction hook — rather than re-read per assembly call.
-  const isNonInteractive = !isInteractiveResolved;
-  // Expose the resolved turn-level interactivity to tool execution so tools
-  // (e.g. ask_question) see whether a human is present to answer, rather than
-  // re-deriving it from live client state that misclassifies a scheduled turn
-  // running on a client-attached conversation.
-  ctx.currentTurnIsNonInteractive = isNonInteractive;
   const diskPressureDecision = classifyDiskPressureTurnPolicy(
     getDiskPressureStatus(),
     {
@@ -1192,6 +1204,7 @@ export async function runAgentLoopImpl(
       requestId: reqId,
       prompt: options?.titleText ?? content,
       isHiddenPrompt: options?.isHiddenPrompt === true,
+      messageKind: options?.messageKind,
       originalMessages: Object.freeze([...ctx.messages]),
       latestMessages: ctx.messages,
       modelProfileKey,
@@ -1283,8 +1296,7 @@ export async function runAgentLoopImpl(
     // context, then the fallback — matching the trust the runtime injection
     // assembly resolves for the same turn. The loop's other turn-identity
     // fields self-resolve from its own conversation id.
-    const loopTrust =
-      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+    const loopTrust = ctx.getTurnOrRestingTrust() ?? FALLBACK_TURN_TRUST;
 
     /**
      * Shared closure: runs the agent loop with the wrapper's turn context and
@@ -1404,7 +1416,7 @@ export async function runAgentLoopImpl(
     // row here rather than writing a duplicate.
     if (state.pendingToolResults.size > 0) {
       const toolResultMetadata = {
-        ...provenanceFromTrustContext(ctx.trustContext),
+        ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
         userMessageChannel: capturedTurnChannelContext.userMessageChannel,
         assistantMessageChannel:
           capturedTurnChannelContext.assistantMessageChannel,
@@ -1431,7 +1443,7 @@ export async function runAgentLoopImpl(
         budgetYieldClassification.userMessage,
       );
       const yieldNoticeMetadata = {
-        ...provenanceFromTrustContext(ctx.trustContext),
+        ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
         userMessageChannel: capturedTurnChannelContext.userMessageChannel,
         assistantMessageChannel:
           capturedTurnChannelContext.assistantMessageChannel,
@@ -1565,7 +1577,7 @@ export async function runAgentLoopImpl(
         state.lastAssistantMessageId = undefined;
       } else {
         const errChannelMeta = {
-          ...provenanceFromTrustContext(ctx.trustContext),
+          ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
           userMessageChannel: capturedTurnChannelContext.userMessageChannel,
           assistantMessageChannel:
             capturedTurnChannelContext.assistantMessageChannel,

package/src/daemon/conversation-messaging.ts

@@ -68,6 +68,7 @@ import type { SlackInboundMessageMetadata } from "./handlers/shared.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("conversation-messaging");
 
@@ -863,7 +864,10 @@ export async function persistQueuedMessageBody(
     const turnIfCtx =
       extractTurnInterfaceContext(metadata) ?? ctx.getTurnInterfaceContext();
     const provenance = provenanceFromTrustContext(
-      options.trustContext ?? ctx.trustContext,
+      // Callers that own a turn pass the sender's trust; the fallback serves
+      // ingress paths that persist before any per-turn stamp exists, where
+      // the slot their own resolution just wrote is the right actor.
+      options.trustContext ?? restingTrust(ctx),
     );
     const imageSourcePaths = extractImageSourcePaths(attachments);
 

package/src/daemon/conversation-notifiers.ts

@@ -3,8 +3,10 @@
  * the Conversation constructor and dispose/abort methods.
  *
  * Notifier callbacks read from the provided context object at invocation
- * time (not registration time), so they always see the latest sendToClient
- * and messages references even after updateClient().
+ * time (not registration time), so they always see the latest messages
+ * reference. They emit through the conversation, whose sink is fixed for its
+ * life, so an out-of-turn notification reaches every subscribed client
+ * without any per-turn wiring.
  */
 
 import { createAssistantMessage } from "../agent/message-types.js";
@@ -25,13 +27,14 @@ import {
 } from "../persistence/conversation-crud.js";
 import type { Message } from "../providers/types.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 /**
  * Subset of Conversation state that notifier callbacks need to read at
  * invocation time. Properties are read lazily from this reference.
  */
 export interface NotifierConversationContext {
-  sendToClient: (msg: AssistantEvent) => void;
+  emit: (msg: AssistantEvent) => void;
   messages: Message[];
   trustContext?: TrustContext;
 }
@@ -58,7 +61,14 @@ export function registerConversationNotifiers(
         JSON.stringify([{ type: "text", text: questionText }]),
         {
           metadata: {
-            ...provenanceFromTrustContext(ctx.trustContext),
+            ...provenanceFromTrustContext(
+              // This callback fires after the voice turn has settled: the
+              // per-turn field may still hold that turn's actor (nothing
+              // clears it at release), while voice cleanup has restored the
+              // conversation's resting trust. The owner is the right actor
+              // for a row persisted outside any turn.
+              restingTrust(ctx),
+            ),
             userMessageChannel: "phone",
             assistantMessageChannel: "phone",
             userMessageInterface: "phone",
@@ -69,12 +79,12 @@ export function registerConversationNotifiers(
 
       ctx.messages.push(createAssistantMessage(questionText));
 
-      ctx.sendToClient({
+      ctx.emit({
         type: "assistant_text_delta",
         text: questionText,
         conversationId: conversationId,
       });
-      ctx.sendToClient({
+      ctx.emit({
         type: "message_complete",
         conversationId: conversationId,
         messageId: msg.id,
@@ -89,12 +99,12 @@ export function registerConversationNotifiers(
       const speakerLabel = speaker === "caller" ? "Caller" : "Assistant";
       const transcriptText = `**Live call transcript**\n${speakerLabel}: ${text}`;
 
-      ctx.sendToClient({
+      ctx.emit({
         type: "assistant_text_delta",
         text: transcriptText,
         conversationId: conversationId,
       });
-      ctx.sendToClient({
+      ctx.emit({
         type: "message_complete",
         conversationId: conversationId,
         source: "aux",
@@ -105,12 +115,12 @@ export function registerConversationNotifiers(
   registerCallCompletionNotifier(conversationId, (callSessionId: string) => {
     const summaryText = buildCallCompletionMessage(callSessionId);
 
-    ctx.sendToClient({
+    ctx.emit({
       type: "assistant_text_delta",
       text: summaryText,
       conversationId: conversationId,
     });
-    ctx.sendToClient({
+    ctx.emit({
       type: "message_complete",
       conversationId: conversationId,
       source: "aux",

package/src/daemon/conversation-process.ts

@@ -63,6 +63,7 @@ import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import { buildTransportHints } from "./transport-hints.js";
 import { sameTrustIdentity, type TrustContext } from "./trust-context-types.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveVerificationSessionIntent } from "./verification-session-intent.js";
 
 const log = getLogger("conversation-process");
@@ -823,7 +824,7 @@ async function drainSingleMessage(
   if (slashResult.kind === "unknown") {
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainImageSourcePaths: Record<string, string> = {};
       for (let i = 0; i < next.attachments.length; i++) {
@@ -938,7 +939,7 @@ async function drainSingleMessage(
     let persistedCompactMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -1031,7 +1032,7 @@ async function drainSingleMessage(
     let persistedCleanMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -1826,6 +1827,13 @@ export interface ProcessMessageOptions {
   displayContent?: string;
   /** JWT-verified committer principal for turn-scoped host-proxy authorization. */
   sourceActorPrincipalId?: string;
+  /**
+   * The actor this turn is being started for. Stamped onto the conversation
+   * before history is scoped, so the run hydrates as its committer rather
+   * than as whoever last left the resting slot set. Callers with no actor of
+   * their own (internal dispatch) omit it and the resting actor stands.
+   */
+  trustContext?: TrustContext;
   /**
    * True when this turn was auto-sent on the user's behalf rather than typed
    * (see `PersistMessageOptions.scripted`). Forwarded to persistence so the
@@ -1872,7 +1880,11 @@ export async function processMessage(
     sourceActorPrincipalId,
     scripted,
     metadata: callerMetadata,
+    trustContext: committingTrustContext,
   } = options;
+  if (committingTrustContext) {
+    conversation.setTrustContext(committingTrustContext);
+  }
   await conversation.ensureActorScopedHistory();
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.
@@ -2024,7 +2036,9 @@ export async function processMessage(
   if (slashResult.kind === "unknown") {
     const pmTurnCtx = conversation.getTurnChannelContext();
     const pmInterfaceCtx = conversation.getTurnInterfaceContext();
-    const pmProvenance = provenanceFromTrustContext(conversation.trustContext);
+    const pmProvenance = provenanceFromTrustContext(
+      turnOrRestingTrust(conversation),
+    );
     const pmImageSourcePaths: Record<string, string> = {};
     for (let i = 0; i < attachments.length; i++) {
       const a = attachments[i];
@@ -2116,7 +2130,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,
@@ -2197,7 +2211,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,

package/src/daemon/conversation-runtime-assembly.ts

@@ -44,6 +44,7 @@ import {
   type RenderedSlackTranscriptMessage,
   renderSlackTranscriptWithProvenance,
 } from "../messaging/providers/slack/render-transcript.js";
+import { isGuardianCardRow } from "../notifications/approval-card-data.js";
 import {
   getMessages as defaultGetMessages,
   type MessageRow,
@@ -520,7 +521,7 @@ function injectActiveSurfaceContext(
       "RULES FOR WORKSPACE MODIFICATION:",
       `1. Use \`file_edit\` to make surgical changes to app files. The file path is \`${getAppDirPath(ctx.appId)}/<path>\`.`,
       "2. Use `file_write` to create new files or rewrite files.",
-      "3. Use `file_read` to read any file with line numbers before editing.",
+      "3. Use `file_read` to read any file before editing, and `code_search` when you need a line reference.",
       "4. Use `bash ls` to see all files in the app directory.",
       `5. Call \`app_refresh\` with app_id "${ctx.appId}" ONCE after all changes are complete.`,
       "6. NEVER respond with only text — the user expects a visual update.",
@@ -1513,10 +1514,16 @@ export function loadSlackChronologicalContext(
     allRows,
     options.trustClass,
   );
+  // Applied after the compaction boundary, never before it: that filter
+  // indexes into the row list when no watermark is set, so dropping rows
+  // earlier would shift what it cuts. Same rule and same ordering constraint
+  // as `Conversation.loadFromDb` -- Slack builds the provider history from
+  // rows rather than `this.messages`, so a rule applied only there would
+  // exempt this channel entirely.
   const rows = filterRowsAfterSlackCompactionBoundary(
     messageRowsToSlackTranscriptRows(scopedRows),
     options,
-  );
+  ).filter((row) => !isGuardianCardRow(row.content));
   return assembleSlackChronologicalContext(rows, capabilities, {
     contextSummary: resolveCapabilities(options.trustClass).canAccessMemory
       ? options.contextSummary
@@ -2319,7 +2326,7 @@ export async function applyRuntimeInjections(
   // folded into the summary are excluded.
   const slackActiveThreadFocusBlock = channelCapabilities
     ? loadSlackActiveThreadFocusBlock(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
         slackContextCompactionWatermarkTs:
@@ -2337,7 +2344,7 @@ export async function applyRuntimeInjections(
   // boundary without the orchestrator threading a snapshot in.
   const slackChronologicalMessages = channelCapabilities
     ? loadSlackChronologicalMessages(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextSummary: liveConversation?.contextSummary,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
@@ -2380,8 +2387,7 @@ export async function applyRuntimeInjections(
     turnIndex: options.turnIndex ?? liveConversation?.turnCount ?? 0,
     trust:
       options.trust ??
-      liveConversation?.currentTurnTrustContext ??
-      liveConversation?.trustContext ??
+      liveConversation?.getTurnOrRestingTrust() ??
       fallbackTurnTrust(channelCapabilities),
     callSite: options.callSite ?? liveConversation?.currentCallSite,
     ...injectionInputs,

package/src/daemon/conversation-store.ts

@@ -27,6 +27,7 @@ import {
 } from "../providers/connection-resolution.js";
 import { RateLimitProvider } from "../providers/ratelimit.js";
 import { listProviders } from "../providers/registry.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getSubagentManager } from "../subagent/index.js";
 import { getSandboxWorkingDir } from "../util/platform.js";
 import { Conversation } from "./conversation.js";
@@ -150,13 +151,19 @@ function applyTransportMetadata(
  *
  * Handles provider setup, rate limiting, system prompt, memory policy,
  * and conversation hydration.
+ *
+ * The in-memory Conversation snapshots the tool registry at construction.
+ * An empty snapshot is an empty tool list on the wire for the life of the
+ * instance, so the create path initializes the registry before that
+ * constructor runs. A hit in `findConversation` already has its snapshot.
+ * `initializeTools` is idempotent: a process that already initialized at
+ * boot awaits the settled promise.
  */
 export async function getOrCreateConversation(
   conversationId: string,
   options?: ConversationCreateOptions,
 ): Promise<Conversation> {
   let conversation = findConversation(conversationId);
-  const sendToClient = () => {};
 
   // `taskRunId` and `ephemeral` are per-call scopes, not durable conversation
   // metadata, so they are stripped before the remaining options are merged
@@ -228,11 +235,16 @@ export async function getOrCreateConversation(
       const systemPrompt = await resolveInitialSystemPrompt(storedOptions);
       const maxTokens = storedOptions?.maxResponseTokens;
 
+      const { initializeTools } = await import("../tools/registry.js");
+      await initializeTools();
+
       const newConversation = new Conversation(
         conversationId,
         provider,
         systemPrompt,
-        sendToClient,
+        // Top-level conversations deliver to the SSE hub for their whole life,
+        // so every subscribed client sees every event with no per-turn wiring.
+        broadcastMessage,
         workingDir,
         {
           maxTokens,
@@ -240,8 +252,6 @@ export async function getOrCreateConversation(
           modelOverride: storedOptions?.modelOverride,
         },
       );
-      newConversation.updateClient(sendToClient, true);
-
       // Ensure the conversations row exists before hydrating from DB.
       // `getOrCreateConversation` builds the in-memory Conversation, but
       // the persisted row is what `loadFromDb` reads for conversationType,