@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/daemon/conversation-surfaces.ts

@@ -85,6 +85,8 @@ import type {
 } from "./message-protocol.js";
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
 import { isRowVisibleToUntrustedActor } from "./message-provenance.js";
+import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 export {
   buildSurfaceShowPair,
   type CurrentTurnSurface,
@@ -138,16 +140,40 @@ const ModelActionSchema = SurfaceActionSchema.extend({
 
 const MAX_UNDO_DEPTH = 10;
 
+/**
+ * Whether a surface-action turn (a user clicked a button or submitted a form on
+ * a UI surface) runs with a human declared present. The handler does not yet
+ * learn the actor's interface, so it cannot declare presence the way the send
+ * route does; the turn runs non-interactive, which is what the state-derived
+ * fallback resolved to between turns. Deriving it from the actor's interface
+ * is a policy change tracked separately.
+ */
+const SURFACE_ACTION_TURN_IS_INTERACTIVE = false;
+
 /**
  * Pending surface types that do not hold the one-interactive-surface-at-a-time
- * lock. Both render content the user reads rather than a question they must
- * answer, so a live one must not block the next surface.
+ * lock. Each renders content the user reads (or settles on its own) rather
+ * than a question they must answer, so a live one must not block the next
+ * surface.
  */
 const NON_BLOCKING_PENDING_SURFACE_TYPES = new Set<SurfaceType>([
   "dynamic_page",
   "visual",
+  "voice_picker",
 ]);
 
+/**
+ * Surface types that carry no terminal action: the card settles when the user
+ * interacts with it, so no click could ever satisfy an attached `actions`
+ * entry or an explicit `await_action`. Both are generic ui_show params though,
+ * so nothing stops the model attaching them here, and doing so wedges the
+ * turn: the client latches `awaiting_user_input` on the presence of actions
+ * alone and no action ever arrives to clear it, leaving the composer disabled
+ * and Stop hidden while the daemon is still streaming. Stripping them makes
+ * the "never blocks a turn" contract structural rather than advisory.
+ */
+const ACTIONLESS_SURFACE_TYPES = new Set<SurfaceType>(["voice_picker"]);
+
 /**
  * Debounce window for persisting `ui_surface_update` data back to the
  * message row. Surfaces typically receive bursts of updates (e.g. a
@@ -1358,7 +1384,7 @@ export function openChannelSetupPanel(
       data: safeParseSurfaceData("channel_setup", data) ?? {},
     });
 
-    ctx.sendToClient({
+    ctx.emit({
       type: "open_panel",
       panelType: "channel_setup",
       data,
@@ -1496,7 +1522,7 @@ function pushUndoState(
 export function handleSurfaceUndo(ctx: Conversation, surfaceId: string): void {
   const stack = ctx.surfaceUndoStacks.get(surfaceId);
   if (!stack || stack.length === 0) {
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_undo_result",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1509,7 +1535,7 @@ export function handleSurfaceUndo(ctx: Conversation, surfaceId: string): void {
   const previousHtml = stack.pop()!;
   const stored = ctx.surfaceState.get(surfaceId);
   if (!stored || stored.surfaceType !== "dynamic_page") {
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_undo_result",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1543,7 +1569,7 @@ export function handleSurfaceUndo(ctx: Conversation, surfaceId: string): void {
         html: previousHtml,
       };
       s.data = revertedData;
-      ctx.sendToClient({
+      ctx.emit({
         type: "ui_surface_update",
         conversationId: ctx.conversationId,
         surfaceId: sid,
@@ -1580,7 +1606,7 @@ export function handleSurfaceUndo(ctx: Conversation, surfaceId: string): void {
       html: previousHtml,
     };
     stored.data = revertedData;
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_update",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -1588,7 +1614,7 @@ export function handleSurfaceUndo(ctx: Conversation, surfaceId: string): void {
     });
   }
 
-  ctx.sendToClient({
+  ctx.emit({
     type: "ui_surface_undo_result",
     conversationId: ctx.conversationId,
     surfaceId,
@@ -1880,7 +1906,13 @@ export async function handleSurfaceAction(
   // reconstruct the same-user binding for host proxies (CU / app-control),
   // mirroring the normal message path.
   sourceActorPrincipalId?: string,
+  // Trust of the actor committing this action, resolved by the route from the
+  // verified requester. Passed rather than read back off the conversation so a
+  // click that lands mid-turn is attributed to its clicker instead of to
+  // whoever occupies the resting slot.
+  requesterTrustContext?: TrustContext,
 ): Promise<SurfaceActionResult> {
+  const actionTrustContext = requesterTrustContext ?? restingTrust(ctx);
   // ── Standalone surface interception ──────────────────────────────
   // Daemon-driven surfaces (from `requestInteractiveUi`) register a
   // pending entry in `pendingStandaloneSurfaces`. When the user clicks
@@ -2026,7 +2058,7 @@ export async function handleSurfaceAction(
     // `await` resolves as soon as the conversation is created + titled +
     // published to the event hub. The HTTP POST /v1/surface-actions
     // response returns promptly — the seed turn runs in the background.
-    const originTrustContext = ctx.trustContext;
+    const originTrustContext = actionTrustContext;
     const { conversationId } = await launchConversation({
       title,
       seedPrompt,
@@ -2045,14 +2077,11 @@ export async function handleSurfaceAction(
     return { accepted: true, conversationId };
   }
 
-  // Trust of the actor committing THIS action. `POST /v1/surface-actions`
-  // stamps the verified requester's trust onto the conversation before
-  // dispatching here, and `loadFromDb` derives the live history filter from
-  // the same value, so the completion path's persisted read stays scoped to
-  // exactly what this actor's live view would have held. Unresolvable trust
-  // fails closed to the untrusted filter.
+  // Trust of the actor committing THIS action, so the completion path's
+  // persisted read stays scoped to exactly what this actor's live view would
+  // have held. Unresolvable trust fails closed to the untrusted filter.
   const requesterCanAccessMemory = resolveCapabilities(
-    ctx.trustContext?.trustClass,
+    actionTrustContext?.trustClass,
   ).canAccessMemory;
 
   const pending = ctx.pendingSurfaceActions.get(surfaceId);
@@ -2198,6 +2227,8 @@ export async function handleSurfaceAction(
       activeSurfaceId: surfaceId,
       displayContent,
       sourceActorPrincipalId,
+      trustContext: actionTrustContext,
+      isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
       // Rides the metadata bag rather than a typed option: the queue
       // round-trips `metadata` but not `PersistMessageOptions`.
       metadata: { scripted: isSyntheticSurfaceActionContent(content) },
@@ -2260,6 +2291,10 @@ export async function handleSurfaceAction(
         activeSurfaceId: surfaceId,
         displayContent,
         sourceActorPrincipalId,
+        // Reached only when `enqueueMessage` declined to queue: the click is
+        // starting this turn, so it is the actor the run belongs to.
+        trustContext: actionTrustContext,
+        isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
         scripted: isSyntheticSurfaceActionContent(content),
       })
       .catch((err) => {
@@ -2446,6 +2481,8 @@ export async function handleSurfaceAction(
     activeSurfaceId: surfaceId,
     displayContent,
     sourceActorPrincipalId,
+    trustContext: actionTrustContext,
+    isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
     // Rides the metadata bag rather than a typed option: the queue
     // round-trips `metadata` but not `PersistMessageOptions`.
     metadata: { scripted: isSyntheticSurfaceActionContent(content) },
@@ -2518,6 +2555,10 @@ export async function handleSurfaceAction(
       activeSurfaceId: surfaceId,
       displayContent,
       sourceActorPrincipalId,
+      // Same as the history-restored branch: the enqueue declined, so this
+      // click is the turn about to run.
+      trustContext: actionTrustContext,
+      isInteractive: SURFACE_ACTION_TURN_IS_INTERACTIVE,
       scripted: isSyntheticSurfaceActionContent(content),
     })
     .catch((err) => {
@@ -2582,7 +2623,7 @@ export function refreshSurfacesForApp(
     }
 
     // Push the update to the client
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_update",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -3279,8 +3320,12 @@ export async function surfaceProxyResolver(
       }
       inputActions = valid.length > 0 ? valid : undefined;
     }
-    const actions =
-      choiceData !== undefined ? buildChoiceActions(choiceData) : inputActions;
+    const isActionless = ACTIONLESS_SURFACE_TYPES.has(surfaceType);
+    const actions = isActionless
+      ? undefined
+      : choiceData !== undefined
+        ? buildChoiceActions(choiceData)
+        : inputActions;
     const hasActions = Array.isArray(actions) && actions.length > 0;
     if (surfaceType === "choice" && !hasActions) {
       return {
@@ -3332,7 +3377,11 @@ export async function surfaceProxyResolver(
           : surfaceType === "table"
             ? hasActions
             : INTERACTIVE_SURFACE_TYPES.includes(surfaceType);
-    const awaitAction = (input.await_action as boolean) ?? isInteractive;
+    // An explicit `await_action: true` is honored for every other type; an
+    // actionless surface has nothing to await, so it is forced false.
+    const awaitAction = isActionless
+      ? false
+      : ((input.await_action as boolean) ?? isInteractive);
 
     // Only one non-persistent interactive surface at a time. If another
     // surface is already awaiting user input, reject this one so the LLM
@@ -3411,7 +3460,7 @@ export async function surfaceProxyResolver(
       "Sending ui_surface_show to client",
     );
 
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_show",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -3530,7 +3579,7 @@ export async function surfaceProxyResolver(
       mergedData = patch;
     }
 
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_update",
       conversationId: ctx.conversationId,
       surfaceId,
@@ -3588,7 +3637,7 @@ export async function surfaceProxyResolver(
           isError: true,
         };
       }
-      ctx.sendToClient({
+      ctx.emit({
         type: "ui_surface_complete",
         conversationId: ctx.conversationId,
         surfaceId,
@@ -3596,7 +3645,7 @@ export async function surfaceProxyResolver(
         submittedData: lastAction.data,
       });
     } else {
-      ctx.sendToClient({
+      ctx.emit({
         type: "ui_surface_dismiss",
         conversationId: ctx.conversationId,
         surfaceId,
@@ -3698,7 +3747,7 @@ export async function surfaceProxyResolver(
       // Inline-only preview card emitted during app_create — do not open a
       // workspace panel and do not register surface state. The client renders
       // this as a tappable inline card that opens the app on demand.
-      ctx.sendToClient({
+      ctx.emit({
         type: "ui_surface_show",
         conversationId: ctx.conversationId,
         surfaceId,
@@ -3728,7 +3777,7 @@ export async function surfaceProxyResolver(
       title: app.name,
     });
 
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_show",
       conversationId: ctx.conversationId,
       surfaceId,

package/src/daemon/conversation-tool-setup.ts

@@ -245,9 +245,7 @@ export function createToolExecutor(
   toolUseId?: string,
 ) => Promise<ToolExecutionResult> {
   // Register the conversation's sendToClient for browser screencast surface messages
-  registerConversationSender(ctx.conversationId, (msg) =>
-    ctx.sendToClient(msg),
-  );
+  registerConversationSender(ctx.conversationId, (msg) => ctx.emit(msg));
 
   // Execution-layer allowlist gate (`subagentToolGateMode === "execution"`,
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
@@ -389,8 +387,7 @@ export function createToolExecutor(
     // Per-turn trust snapshot: prefer the snapshot captured at turn start so
     // a concurrent owner meta command (/status, /clean) that mutates the live
     // trustContext cannot elevate the in-flight turn to guardian.
-    const turnTrust =
-      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+    const turnTrust = ctx.getTurnOrRestingTrust() ?? FALLBACK_TURN_TRUST;
 
     const toolContext: ToolContext = {
       workingDir: ctx.workingDir,
@@ -441,7 +438,7 @@ export function createToolExecutor(
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
         // signature, but at runtime these are always AssistantEvent instances.
-        ctx.sendToClient(msg as AssistantEvent);
+        ctx.emit(msg as AssistantEvent);
         if (msg.type === "ui_surface_show") {
           // The tool-context sendToClient signature is loose, so the show
           // message's fields are untyped here; map them through the same

package/src/daemon/conversation.ts

@@ -41,6 +41,7 @@ import {
   derefToolResultReReads,
   postTurnTruncateToolResults,
 } from "../context/post-turn-tool-result-truncation.js";
+import { isGuardianCardRow } from "../notifications/approval-card-data.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { UserDecision } from "../permissions/types.js";
@@ -319,7 +320,21 @@ export class Conversation {
   /** @internal */ prompter: PermissionPrompter;
   /** @internal */ secretPrompter: SecretPrompter;
   private executor: ToolExecutor;
-  /** @internal */ sendToClient: (msg: AssistantEvent) => void;
+  /**
+   * The conversation's event sink, fixed for its whole life. Top-level
+   * conversations deliver to the SSE hub, so every subscribed client sees
+   * every event without any per-turn wiring; a subagent's sink re-envelopes
+   * its events under the parent conversation. Reached only through
+   * {@link emit}, which also notifies {@link addEventObserver} observers.
+   */
+  private readonly sendToClient: (msg: AssistantEvent) => void;
+  /**
+   * Observers notified after every {@link emit}, in registration order. An
+   * observer sees the event after the sink delivered it, so anything it does
+   * in response (e.g. voice auto-resolving a confirmation) lands on the wire
+   * after the event itself.
+   */
+  private readonly eventObservers = new Set<(msg: AssistantEvent) => void>();
   /** @internal */ workingDir: string;
   /** @internal */ allowedToolNames?: Set<string>;
   /**
@@ -435,7 +450,18 @@ export class Conversation {
    * @internal
    */
   currentCallSite?: LLMCallSite;
-  /** @internal */ hasNoClient = false;
+  /**
+   * Whether no human is present to see UI or answer prompts. Derived from the
+   * in-flight turn's interactivity ({@link currentTurnIsNonInteractive}); a
+   * conversation with no turn in flight has no client. Presence is a property
+   * of the turn, never of where events are delivered, so there is no setter:
+   * dispatch paths declare interactivity per turn (`isInteractive` on
+   * `runAgentLoop`, or a wake's pin), and this reads it.
+   * @internal
+   */
+  get hasNoClient(): boolean {
+    return this.currentTurnIsNonInteractive ?? true;
+  }
   /**
    * For subagent conversations, the id of the parent that spawned this one; set
    * once at construction and never reassigned. `undefined` for top-level
@@ -757,10 +783,10 @@ export class Conversation {
     this.workingDir = workingDir;
     this.sendToClient = sendToClient;
     this.graphMemory = new ConversationGraphMemory(conversationId);
-    this.prompter = new PermissionPrompter(sendToClient);
+    // The prompter emits through the conversation so its confirmation_request
+    // reaches the sink and every observer (voice policy) like any other event.
+    this.prompter = new PermissionPrompter((msg) => this.emit(msg));
     this.prompter.setOnStateChanged((requestId, state, source, toolUseId) => {
-      // Route through emitConfirmationStateChanged so the event reaches
-      // the client via sendToClient (wired to the SSE hub for HTTP conversations).
       this.emitConfirmationStateChanged({
         conversationId: this.conversationId,
         requestId,
@@ -1316,6 +1342,16 @@ export class Conversation {
       parsedMessages.length,
     );
     for (const [index, message] of parsedMessages.entries()) {
+      // Applied after the compaction slice, never before it: the slice and
+      // `rowToHistoryIndex` are both computed against the full row list, so
+      // dropping earlier would shift them. A dropped row maps to a null
+      // history index exactly like a fully-injected user row that strips to
+      // nothing. `index` is shared with `slicedDbMessages`, which
+      // `parsedMessages` maps 1:1.
+      if (isGuardianCardRow(slicedDbMessages[index]?.content)) {
+        preRepairIndexBySlicedRow[index] = null;
+        continue;
+      }
       const stripped =
         index < preStrippedCount
           ? stripInjectionsForCompaction([message])
@@ -1418,7 +1454,7 @@ export class Conversation {
       messageCount: this.messages.length,
     });
 
-    this.restoreSurfaceStateFromHistory();
+    this.restoreSurfaceStateFromHistory(parsedMessages);
     this.graphMemory.restoreState();
 
     // Row→history correspondence for this load: slice offset, then the
@@ -1450,14 +1486,19 @@ export class Conversation {
    * populate surfaceState so that findConversationBySurfaceId works for
    * surfaces restored from history (e.g. after daemon restart).
    *
-   * Only scans live (non-compacted) messages in this.messages — not all DB
-   * rows — because surface IDs are not globally unique and restoring stale
-   * compacted surfaces would let findConversationBySurfaceId route actions
-   * to the wrong conversation.
+   * Scans the live (non-compacted) window only, never all DB rows, because
+   * surface IDs are not globally unique and restoring stale compacted
+   * surfaces would let findConversationBySurfaceId route actions to the wrong
+   * conversation.
+   *
+   * Takes that window as rows rather than reading `this.messages`, because a
+   * surface's lifecycle and the model's context are different questions. A
+   * guardian card is absent from `this.messages`, but it is exactly the card
+   * whose Approve/Reject buttons must still route after a restart.
    */
-  private restoreSurfaceStateFromHistory(): void {
+  private restoreSurfaceStateFromHistory(liveWindow: Message[]): void {
     this.surfaceState.clear();
-    for (const msg of this.messages) {
+    for (const msg of liveWindow) {
       if (!Array.isArray(msg.content)) {
         continue;
       }
@@ -1489,31 +1530,55 @@ export class Conversation {
     await this.loadFromDb();
   }
 
-  updateClient(
-    sendToClient: (msg: AssistantEvent) => void,
-    hasNoClient = false,
-  ): void {
-    this.sendToClient = sendToClient;
-    this.hasNoClient = hasNoClient;
-    this.prompter.updateSender(sendToClient);
-
-    // Replay last activity state so a reconnecting client sees the current phase
-    // instead of being stuck on the last state it received before disconnection.
-    if (!hasNoClient && this.lastActivityStateMsg) {
+  /**
+   * Deliver an event through the conversation's sink, then to every observer.
+   * The single emission point for conversation-level events (activity state,
+   * confirmation prompts and state, notifier output, out-of-turn pushes); the
+   * agent loop's own stream rides its per-turn `onEvent`, which defaults to
+   * this when the caller passes none.
+   */
+  readonly emit = (msg: AssistantEvent): void => {
+    try {
+      this.sendToClient(msg);
+    } catch (err) {
+      log.warn(
+        { err, conversationId: this.conversationId, type: msg.type },
+        "conversation sink threw",
+      );
+    }
+    for (const observer of this.eventObservers) {
       try {
-        sendToClient(this.lastActivityStateMsg);
+        observer(msg);
       } catch (err) {
         log.warn(
-          { err, conversationId: this.conversationId },
-          "Failed to replay activity state on client reconnection",
+          { err, conversationId: this.conversationId, type: msg.type },
+          "conversation event observer threw",
         );
       }
     }
+  };
+
+  /**
+   * Observe every event this conversation emits, after the sink delivered it.
+   * For policy layered on delivery (voice auto-resolves approval prompts it
+   * has no UI for), not for delivery itself. Returns the disposer.
+   */
+  addEventObserver(observer: (msg: AssistantEvent) => void): () => void {
+    this.eventObservers.add(observer);
+    return () => {
+      this.eventObservers.delete(observer);
+    };
   }
 
-  /** Returns the current sendToClient reference for identity comparison. */
-  getCurrentSender(): (msg: AssistantEvent) => void {
-    return this.sendToClient;
+  /**
+   * Re-emit the last activity state so a client that reconnected mid-phase
+   * sees the current phase instead of the last one it received before
+   * disconnecting. The send route calls this on every interactive send.
+   */
+  replayActivityState(): void {
+    if (this.lastActivityStateMsg) {
+      this.emit(this.lastActivityStateMsg);
+    }
   }
 
   setSubagentAllowedTools(tools: Set<string> | undefined): void {
@@ -1801,7 +1866,7 @@ export class Conversation {
   } {
     return enqueueMessageImpl(this, {
       ...options,
-      onEvent: options.onEvent ?? this.sendToClient,
+      onEvent: options.onEvent ?? this.emit,
     });
   }
 
@@ -1976,14 +2041,7 @@ export class Conversation {
       type: "confirmation_state_changed",
       ...params,
     } as AssistantEvent;
-    try {
-      this.sendToClient(msg);
-    } catch (err) {
-      log.warn(
-        { err, conversationId: this.conversationId },
-        "sendToClient threw in emitConfirmationStateChanged",
-      );
-    }
+    this.emit(msg);
   }
 
   emitActivityState(
@@ -2008,14 +2066,7 @@ export class Conversation {
       ...(statusText ? { statusText } : {}),
     } as AssistantEvent;
     this.lastActivityStateMsg = msg;
-    try {
-      this.sendToClient(msg);
-    } catch (err) {
-      log.warn(
-        { err, conversationId: this.conversationId },
-        "sendToClient threw in emitActivityState",
-      );
-    }
+    this.emit(msg);
   }
 
   /**
@@ -2069,7 +2120,7 @@ export class Conversation {
     onEvent?: (msg: AssistantEvent) => void,
   ): void {
     try {
-      (onEvent ?? this.sendToClient)({
+      (onEvent ?? this.emit)({
         type: "context_window_usage",
         conversationId: this.conversationId,
         tokens,
@@ -2421,11 +2472,11 @@ export class Conversation {
     ) {
       await this.agentLoop.compactionCircuit.recordOutcome(
         result.summaryFailed,
-        this.sendToClient,
+        this.emit,
       );
     }
     if (result.compacted) {
-      await applyCompactionResult(this, result, this.sendToClient, null, {
+      await applyCompactionResult(this, result, this.emit, null, {
         slackContextCompactionWatermarkTs:
           fixedBoundarySlackWatermarkTs ??
           getSlackCompactionWatermarkForPrefix(
@@ -2488,6 +2539,54 @@ export class Conversation {
     return this.authContext;
   }
 
+  /**
+   * Trust the in-flight turn is executing under.
+   *
+   * Use this for authorization and for routing a reply to the requester:
+   * cases where substituting the conversation's owner would be wrong rather
+   * than approximate. Provenance is not such a case; see
+   * {@link getTurnOrRestingTrust} and `docs/architecture/turn-actor.md`.
+   *
+   * `undefined` when no turn recorded one, which is a gap in the entry point
+   * rather than an answer. Deliberately does not fall back to the
+   * conversation's trust: a caller that can accept the conversation's owner
+   * instead spells `?? getTrustContext()`, so the substitution is visible
+   * where it happens.
+   */
+  getTurnTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext;
+  }
+
+  /**
+   * Trust of the actor the conversation belongs to, independent of any turn.
+   *
+   * Use this where there is no turn to speak of: routes reporting on a
+   * conversation, hydration, and persisting conversation-level options. A
+   * caller that wants the conversation's owner *rather than* whoever is
+   * currently acting should be obviously doing so; if it is not obvious,
+   * {@link getTurnTrust} is probably the one meant.
+   */
+  getTrustContext(): TrustContext | undefined {
+    return this.trustContext;
+  }
+
+  /**
+   * Trust of the in-flight turn, or the conversation's owner when the turn
+   * recorded none. The substitution is in the name: callers that can accept
+   * the owner as a stand-in ask this, including provenance stamping, whose
+   * readers treat an absent trust class as more trusted than `"unknown"`.
+   * Callers for which the owner would be wrong rather than approximate call
+   * {@link getTurnTrust} and handle `undefined`.
+   *
+   * The fallback half is load-bearing, not transitional politeness: a
+   * deferred wake fires with no inbound actor, and refusing it an answer
+   * denies every sensitive tool in the resumed turn (LUM-2929). It becomes
+   * removable in one place when every entry point records a turn actor.
+   */
+  getTurnOrRestingTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext ?? this.trustContext;
+  }
+
   /**
    * The actor principal that owns the current turn, for host-proxy routing.
    * Prefers the in-flight turn's actor over the conversation's resting
@@ -2633,6 +2732,8 @@ export class Conversation {
       titleText?: string;
       /** See {@link runAgentLoopImpl} — hidden machine-signal turn marker. */
       isHiddenPrompt?: boolean;
+      /** See {@link runAgentLoopImpl}: triggering row's daemon-authored kind. */
+      messageKind?: string;
       /**
        * See {@link runAgentLoopImpl}: the row the end-of-turn reply
        * notification treats as the prompt this turn answers.
@@ -2674,7 +2775,7 @@ export class Conversation {
       this,
       content,
       userMessageId,
-      onEvent ?? this.sendToClient,
+      onEvent ?? this.emit,
       rest,
     );
   }
@@ -2700,7 +2801,7 @@ export class Conversation {
     this.cacheWarmAbort = undefined;
     return processMessageImpl(this, {
       ...options,
-      onEvent: options.onEvent ?? this.sendToClient,
+      onEvent: options.onEvent ?? this.emit,
     });
   }
 
@@ -2728,6 +2829,7 @@ export class Conversation {
     actionId: string,
     data?: Record<string, unknown>,
     sourceActorPrincipalId?: string,
+    requesterTrustContext?: TrustContext,
   ): Promise<SurfaceActionResult> {
     return handleSurfaceActionImpl(
       this,
@@ -2735,6 +2837,7 @@ export class Conversation {
       actionId,
       data,
       sourceActorPrincipalId,
+      requesterTrustContext,
     );
   }
 

package/src/daemon/doordash-steps.ts

@@ -130,7 +130,7 @@ function pushStepsUpdate(
   };
   const updatedData = { ...card, templateData: updatedTemplateData };
   stored.data = updatedData;
-  ctx.sendToClient({
+  ctx.emit({
     type: "ui_surface_update",
     conversationId: ctx.conversationId,
     surfaceId: SURFACE_ID,
@@ -218,7 +218,7 @@ export function updateDoordashProgress(
       },
     } satisfies CardSurfaceData;
     ctx.surfaceState.set(SURFACE_ID, { surfaceType: "card", data });
-    ctx.sendToClient({
+    ctx.emit({
       type: "ui_surface_show",
       conversationId: ctx.conversationId,
       surfaceId: SURFACE_ID,