@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/runtime/routes/channel-route-shared.ts

@@ -2,7 +2,6 @@
  * Shared types, constants, and utilities used across channel route modules.
  */
 import type { ChannelId } from "../../channels/types.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import {
   type ApprovalAction,
   type ApprovalDecisionResult,
@@ -10,11 +9,6 @@ import {
   isApprovalAction,
 } from "../channel-approval-types.js";
 
-/** Canonicalize assistantId for channel ingress paths. */
-export function canonicalChannelAssistantId(_assistantId: string): string {
-  return DAEMON_INTERNAL_ASSISTANT_ID;
-}
-
 // ---------------------------------------------------------------------------
 // Actor role
 // ---------------------------------------------------------------------------

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -159,13 +159,13 @@ async function handleExchange(args: RouteHandlerArgs) {
 
   const existing = getConnection(db, CONNECTION_NAME);
   if (existing) {
-    // Stamp the provider with the auth: this row is the subscription
-    // connection by name, and dispatch derives auth from the provider for
-    // managed rows, so a claiming row with e.g. provider "vellum" would
-    // otherwise strand the fresh token behind derived platform auth.
+    // Stamp the provider with the auth: this row IS the subscription route
+    // (auth modality = provider identity), and dispatch derives the openai
+    // upstream from the identity per-request. Stamping also heals a
+    // claiming row whose provider would otherwise misroute the fresh token.
     const updateResult = updateConnection(db, CONNECTION_NAME, {
       auth: authInput,
-      provider: "openai",
+      provider: "chatgpt",
     });
     if (!updateResult.ok) {
       log.error(
@@ -177,7 +177,7 @@ async function handleExchange(args: RouteHandlerArgs) {
   } else {
     const createResult = createConnection(db, {
       name: CONNECTION_NAME,
-      provider: "openai",
+      provider: "chatgpt",
       auth: authInput,
     });
     if (!createResult.ok) {

package/src/runtime/routes/conversation-list-routes.ts

@@ -3,6 +3,7 @@
  *
  * GET    /v1/conversations              — paginated conversation list
  * GET    /v1/conversations/unread-count - count of unseen foreground conversations
+ * GET    /v1/conversations/sections     - per-section totals for the sidebar index
  * POST   /v1/conversations/seen         — record a seen signal (single)
  * POST   /v1/conversations/seen/bulk    — record seen signals (batch)
  * POST   /v1/conversations/unread       — mark a conversation unread
@@ -29,6 +30,7 @@ import { resolveConversationId } from "../../persistence/conversation-key-store.
 import {
   type ConversationListFilter,
   countConversations,
+  countConversationSections,
   countUnreadConversations,
   listConversations,
   listPinnedConversations,
@@ -155,6 +157,42 @@ const unreadConversationCountResponseSchema = z.object({
   count: z.number(),
 });
 
+const sectionCountFields = {
+  total: z.number(),
+  unread: z.number(),
+};
+
+/**
+ * One renderable sidebar section. Discriminated by `kind` so clients get a
+ * typed union: group sections carry their metadata inline (one consistent
+ * snapshot, no join against `GET /v1/groups` that could disagree with it),
+ * channel sections carry only the id (labels are client-side i18n), and
+ * `chats` is the ungrouped-native bucket. In a view without channel sections
+ * the Chats card holds every ungrouped row: the buckets are disjoint, so
+ * that reading is `chats` plus the sum of `channel` entries.
+ */
+const conversationSectionSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("pinned"), ...sectionCountFields }),
+  z.object({
+    kind: z.literal("group"),
+    groupId: z.string(),
+    name: z.string(),
+    icon: z.string().nullable(),
+    sortPosition: z.number(),
+    ...sectionCountFields,
+  }),
+  z.object({
+    kind: z.literal("channel"),
+    channelId: z.string(),
+    ...sectionCountFields,
+  }),
+  z.object({ kind: z.literal("chats"), ...sectionCountFields }),
+]);
+
+const conversationSectionsResponseSchema = z.object({
+  sections: z.array(conversationSectionSchema),
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -171,28 +209,41 @@ function resolveOrThrow(rawId: string): string {
 // Handlers
 // ---------------------------------------------------------------------------
 
+/**
+ * Read a query parameter that admits a closed set of values. Absent or empty
+ * reads as `undefined`; anything outside `accepted` is a 400. The strictness
+ * is the point: silently coercing a typo or a newer client's value to "no
+ * filter" would hand back the full list where a subset was asked for, and
+ * that skew is invisible to the client (it masks version skew too).
+ */
+function parseEnumQueryParam<const T extends readonly string[]>(
+  queryParams: Record<string, string | undefined>,
+  name: string,
+  accepted: T,
+): T[number] | undefined {
+  const raw = queryParams[name];
+  if (raw === undefined || raw === "") {
+    return undefined;
+  }
+  if ((accepted as readonly string[]).includes(raw)) {
+    return raw as T[number];
+  }
+  throw new BadRequestError(
+    `Unknown ${name} "${raw}"; expected ${accepted.map((v) => `"${v}"`).join(" or ")}.`,
+  );
+}
+
 function handleListConversations({ queryParams = {} }: RouteHandlerArgs) {
   const limit = Number(queryParams.limit ?? 50);
   const offset = Number(queryParams.offset ?? 0);
   // "background" is the back-compat umbrella (background + scheduled); newer
   // clients can pass "scheduled" to load only the Scheduled section. Absent
-  // defaults to the standard foreground list. Any other value is rejected so
-  // an unrecognized type surfaces as a 400 rather than being silently coerced
-  // to the foreground list (which would mask client/daemon version skew).
-  const rawConversationType = queryParams.conversationType;
-  let conversationType: ConversationType = "standard";
-  if (rawConversationType !== undefined && rawConversationType !== "") {
-    if (
-      rawConversationType === "background" ||
-      rawConversationType === "scheduled"
-    ) {
-      conversationType = rawConversationType;
-    } else {
-      throw new BadRequestError(
-        `Unknown conversationType "${rawConversationType}"; expected "background" or "scheduled".`,
-      );
-    }
-  }
+  // defaults to the standard foreground list.
+  const conversationType: ConversationType =
+    parseEnumQueryParam(queryParams, "conversationType", [
+      "background",
+      "scheduled",
+    ]) ?? "standard";
   // Defaults to `active` so sidebar restores no longer pull archived rows.
   // The Archive page opts into `archived` to render only archived rows
   // without dragging the entire live history through pagination first.
@@ -213,11 +264,23 @@ function handleListConversations({ queryParams = {} }: RouteHandlerArgs) {
       ? queryParams.groupId
       : undefined;
 
+  const needsAttention =
+    parseEnumQueryParam(queryParams, "needsAttention", ["true"]) === "true"
+      ? true
+      : undefined;
+
+  const foregroundOnly =
+    parseEnumQueryParam(queryParams, "foregroundOnly", ["true"]) === "true"
+      ? true
+      : undefined;
+
   const filter: ConversationListFilter = {
     conversationType,
     archiveStatus,
     originChannel,
     groupId,
+    needsAttention,
+    foregroundOnly,
   };
   let rows = listConversations({ ...filter, limit, offset });
   const totalCount = countConversations(filter);
@@ -232,15 +295,20 @@ function handleListConversations({ queryParams = {} }: RouteHandlerArgs) {
   // Skipped for group-scoped queries for the same reason: a caller asking
   // for one group gets that group, and a client that fetches the Pinned
   // section via `groupId=system:pinned` has no use for rows appended to
-  // some other group's page. This is the compatibility shim for clients
-  // that still read Pinned out of the unfiltered list; it goes away once
-  // every section fetches its own group.
+  // some other group's page. Skipped for attention-scoped and
+  // foreground-only queries too: the caller asked for a subset, and a
+  // pinned row outside it appended to the page would sit there while
+  // `hasMore` is computed from the filtered count. This is the
+  // compatibility shim for clients that still read Pinned out of the
+  // unfiltered list; it goes away once every section fetches its own group.
   if (
     offset === 0 &&
     conversationType === "standard" &&
     archiveStatus === "active" &&
     originChannel === undefined &&
-    groupId === undefined
+    groupId === undefined &&
+    needsAttention === undefined &&
+    foregroundOnly === undefined
   ) {
     const pinned = listPinnedConversations(archiveStatus);
     const seen = new Set(rows.map((c) => c.id));
@@ -292,6 +360,64 @@ function handleGetUnreadConversationCount() {
   return { count: countUnreadConversations() };
 }
 
+/**
+ * One row per non-empty sidebar section, no conversation rows. What this
+ * exists to answer without a list drain: which sections render at all,
+ * and what their rail badges say.
+ *
+ * A count row whose `group_id` names no existing non-system group is
+ * skipped rather than surfaced: those rows are unreachable as a section
+ * (the sidebar builds group sections from the groups table), and a
+ * dangling id is a transient state around group deletion, not a section.
+ */
+function handleGetConversationSections() {
+  const counts = countConversationSections();
+  const groupsById = new Map(listGroups().map((g) => [g.id, g]));
+  const sections: Array<z.infer<typeof conversationSectionSchema>> = [];
+
+  for (const row of counts.groups) {
+    if (row.groupId === "system:pinned") {
+      sections.push({ kind: "pinned", total: row.total, unread: row.unread });
+      continue;
+    }
+    const meta = groupsById.get(row.groupId);
+    if (!meta || meta.isSystemGroup) {
+      continue;
+    }
+    sections.push({
+      kind: "group",
+      groupId: row.groupId,
+      name: meta.name,
+      icon: meta.icon,
+      sortPosition: meta.sortPosition,
+      total: row.total,
+      unread: row.unread,
+    });
+  }
+
+  for (const row of counts.channels) {
+    if (row.channel === "vellum") {
+      sections.push({ kind: "chats", total: row.total, unread: row.unread });
+      continue;
+    }
+    sections.push({
+      kind: "channel",
+      channelId: row.channel,
+      total: row.total,
+      unread: row.unread,
+    });
+  }
+
+  /* Every other section exists only when it has rows; Chats is the leftover
+     bucket and renders regardless, so its counts are part of the contract
+     even at zero. */
+  if (!sections.some((s) => s.kind === "chats")) {
+    sections.push({ kind: "chats", total: 0, unread: 0 });
+  }
+
+  return { sections };
+}
+
 function handleRecordSeen({ body = {}, headers }: RouteHandlerArgs) {
   const rawConversationId = body.conversationId as string | undefined;
   if (!rawConversationId) {
@@ -482,7 +608,23 @@ export const ROUTES: RouteDefinition[] = [
         type: "string",
         required: false,
         description:
-          'Filter to a single group, so each sidebar section can load independently of the paginated list. Pass "system:all" for conversations in no group, "system:pinned" for the Pinned section, or a custom group id. A group-scoped request is ordered by the user\'s arrangement (display order, then recency) and never has pinned rows appended to it. Omit to span every group.',
+          'Filter to a single group, so each sidebar section can load independently of the paginated list. Pass "system:all" for conversations in no group, "system:pinned" for the Pinned section, or a custom group id. A group-scoped request is recency-ordered like every list read (COALESCE(last_message_at, updated_at) descending) and never has pinned rows appended to it. Omit to span every group.',
+      },
+      {
+        name: "needsAttention",
+        type: "string",
+        required: false,
+        description:
+          'Pass "true" to return only conversations whose latest assistant message the user has not seen: the same predicate behind the unread count and the section index, so a client that keeps no complete conversation list can ask for exactly the rows its attention surfaces need. Composes with every other filter. Any value other than "true" is rejected. Omit to span every conversation.',
+        schema: { type: "string", enum: ["true"] },
+      },
+      {
+        name: "foregroundOnly",
+        type: "string",
+        required: false,
+        description:
+          'Pass "true" to return only user-facing foreground conversations, dropping the automated background and scheduled runs the standard listing admits when they are filed in a custom group (a surfaced run stays). This is the same predicate the unread count and the section index apply, so a client can ask for the newest conversation a user can open in one row instead of paging past runs it would skip. Composes with every other filter; a foreground-only first page never has pinned rows appended to it. Any value other than "true" is rejected. Omit to keep every visible row.',
+        schema: { type: "string", enum: ["true"] },
       },
     ],
     responseBody: listConversationsResponseSchema,
@@ -503,6 +645,21 @@ export const ROUTES: RouteDefinition[] = [
     responseBody: unreadConversationCountResponseSchema,
     handler: handleGetUnreadConversationCount,
   },
+  {
+    operationId: "getConversationSections",
+    endpoint: "conversations/sections",
+    method: "GET",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Sidebar section index",
+    description:
+      "One row per renderable sidebar section (Pinned, each non-empty custom group, each origin channel with unassigned conversations, Chats) with total and unread counts and no conversation rows. Lets a client know which sections exist, and what their badges say, without fetching any conversation list. Totals follow the standard listing visibility; unread applies the same rules as GET /v1/conversations/unread-count scoped to the section. Chats is always present, even at zero: it is the leftover bucket and renders regardless.",
+    tags: ["conversations"],
+    responseBody: conversationSectionsResponseSchema,
+    handler: handleGetConversationSections,
+  },
   {
     operationId: "recordConversationSeen",
     endpoint: "conversations/seen",
@@ -572,7 +729,8 @@ export const ROUTES: RouteDefinition[] = [
     },
     pathParams: [{ name: "id", type: "uuid" }],
     summary: "Get conversation detail",
-    description: "Retrieve a single conversation with full metadata.",
+    description:
+      "Retrieve a single conversation with full metadata. Rows the listing hides by type (legacy private rows) are not found here either.",
     tags: ["conversations"],
     responseBody: conversationDetailResponseSchema,
     handler: handleGetConversation,

package/src/runtime/routes/conversation-management-routes.ts

@@ -308,9 +308,8 @@ async function handleSummarizeConversation({ body = {} }: RouteHandlerArgs) {
         statusText: "Summarizing conversation",
       });
       // The context-window usage push goes out on the same broadcast path as
-      // the result card below: this route resolves its conversation outside
-      // the send path, so the instance may still hold the store's no-op
-      // sender and a `sendToClient` emit would reach nobody.
+      // the result card below, so the two can never be delivered to different
+      // places.
       const result = await conversation.summarizeUpToMessage(
         beforeMessageId,
         broadcastMessage,
@@ -692,17 +691,16 @@ async function handleRetryLastAssistantTurn({
   const conversation = await getOrCreateConversationInstance(conversationId);
   touchConversation(conversationId);
 
-  // Bind the requesting actor's trust before the turn. A freshly hydrated
-  // conversation has no trust context, and `loadFromDb` under an unset
-  // context filters guardian-provenance history — the re-run would see an
-  // empty transcript.
+  // Resolved before the busy gate so the awaits stay outside the
+  // check-then-claim window below, but bound only once the claim succeeds: a
+  // retry that loses the race is rejected, and a rejected request must not
+  // repoint the conversation's actor at its requester.
   const actorPrincipalId = headers?.["x-vellum-actor-principal-id"];
-  conversation.setTrustContext(
-    await resolveVellumActorTrustContext(actorPrincipalId, {
-      healResetDrift: true,
-    }),
+  const retryTrustContext = await resolveVellumActorTrustContext(
+    actorPrincipalId,
+    { healResetDrift: true },
   );
-  conversation.currentTurnSourceActorPrincipalId =
+  const retrySourceActorPrincipalId =
     await resolveActorPrincipalIdForLocalGuardian(actorPrincipalId);
 
   // Synchronous check-then-claim (no await between them) so a concurrent
@@ -715,6 +713,13 @@ async function handleRetryLastAssistantTurn({
   }
   conversation.setProcessing(true);
 
+  // Bind the requesting actor's trust for the turn we just claimed. A freshly
+  // hydrated conversation has no trust context, and `loadFromDb` under an
+  // unset context filters guardian-provenance history — the re-run would see
+  // an empty transcript.
+  conversation.setTrustContext(retryTrustContext);
+  conversation.currentTurnSourceActorPrincipalId = retrySourceActorPrincipalId;
+
   const requestId = uuidv7();
   const abortController = new AbortController();
   let discarded: ReturnType<typeof discardLastAssistantDisplayTurn>;

package/src/runtime/routes/conversation-query-routes.ts

@@ -41,7 +41,10 @@ import {
   withSuppressedConfigDiskWrites,
   withSuppressedConfigDiskWritesSync,
 } from "../../config/loader.js";
-import { completeCustomProfile } from "../../config/profile-materialization.js";
+import {
+  completeCustomProfile,
+  mergePreservingUnknownKeys,
+} from "../../config/profile-materialization.js";
 import { AssistantConfigSchema } from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
 import {
@@ -50,6 +53,7 @@ import {
   LLMConfigFragment,
   ProfileEntry,
   routingIdentityModelIssue,
+  unknownLlmProviderIssue,
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
@@ -96,6 +100,7 @@ import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
 import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
+import { writableProfileProviderIssue } from "../../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
@@ -1252,30 +1257,6 @@ function assertInvariantProfilesPreserved(
   }
 }
 
-/**
- * `{...raw, ...completed}` recursively: completed (schema-known) values win,
- * raw keys the schema stripped survive at every depth.
- */
-function mergePreservingUnknownKeys(
-  raw: Record<string, unknown>,
-  completed: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw, ...completed };
-  for (const [key, value] of Object.entries(completed)) {
-    const rawValue = raw[key];
-    if (
-      readPlainObject(value) !== undefined &&
-      readPlainObject(rawValue) !== undefined
-    ) {
-      out[key] = mergePreservingUnknownKeys(
-        rawValue as Record<string, unknown>,
-        value as Record<string, unknown>,
-      );
-    }
-  }
-  return out;
-}
-
 /**
  * Custom profiles persist as complete overrides: any user-source, non-mix
  * profile entry this write creates or changes is completed against the
@@ -1343,7 +1324,9 @@ function completeChangedCustomProfiles(
  * would let the pair reach disk and be stripped on the next read — a silent
  * no-op where the user expects a saved override.
  */
-function assertRoutableIdentityEntries(raw: Record<string, unknown>): void {
+function collectProviderEntries(
+  raw: Record<string, unknown>,
+): [string, { provider?: unknown; model?: unknown }][] {
   const llm = raw.llm as
     | {
         default?: { provider?: unknown; model?: unknown } | null;
@@ -1371,10 +1354,40 @@ function assertRoutableIdentityEntries(raw: Record<string, unknown>): void {
       }
     }
   }
+  return entries;
+}
+
+function assertRoutableIdentityEntries(
+  preWrite: Record<string, unknown>,
+  raw: Record<string, unknown>,
+): void {
+  const entries = collectProviderEntries(raw);
+  const priorProviders = new Map(
+    collectProviderEntries(preWrite).flatMap(([label, entry]) =>
+      typeof entry.provider === "string" ? [[label, entry.provider]] : [],
+    ),
+  );
   for (const [label, entry] of entries) {
     if (typeof entry.provider !== "string") {
       continue;
     }
+    // The provider schema is an open string (a stored value outside the
+    // known set parses instead of stripping its profile), so write-time
+    // membership is enforced here and at the profiles route. Scoped to
+    // providers this write introduces or changes: a stored value outside
+    // the known set is readable and dispatchable by design, and
+    // re-validating it on every write would make all later settings saves
+    // fail with no in-product repair path. Profiles accept entry names;
+    // call-site fragments and the legacy default blob stay vendor-only
+    // (overrides become model-only with the entries demolition).
+    if (entry.provider !== priorProviders.get(label)) {
+      const providerIssue = label.startsWith("llm.profiles.")
+        ? writableProfileProviderIssue(entry.provider)
+        : unknownLlmProviderIssue(entry.provider);
+      if (providerIssue) {
+        throw new BadRequestError(`${providerIssue} (${label})`);
+      }
+    }
     const issue = routingIdentityModelIssue(
       entry.provider,
       typeof entry.model === "string" ? entry.model : undefined,
@@ -1396,7 +1409,7 @@ export async function commitConfigWrite(
   const preWrite = loadRawConfig();
   completeChangedCustomProfiles(preWrite, raw);
   assertInvariantProfilesPreserved(preWrite, raw);
-  assertRoutableIdentityEntries(raw);
+  assertRoutableIdentityEntries(preWrite, raw);
 
   // Suppress the file-watcher callback for the duration of the debounce
   // window. Without this, the ConfigWatcher detects the config.json write

package/src/runtime/routes/conversation-routes.ts

@@ -1849,6 +1849,11 @@ export async function handleSendMessage(
 
   // Resolve guardian context from the AuthContext's actorPrincipalId via the
   // gateway guardian binding: a vellum principal is the guardian or nobody.
+  //
+  // Resolved into a local; the conversation's slot is stamped only where this
+  // request commits to running a turn, since that write is what supplies the
+  // acting actor for a run and must not fire for a send that merely queues.
+  let resolvedTrustCtx: TrustContext;
   if (actorPrincipalId) {
     // Dev bypass (HTTP auth disabled): the synthetic "dev-bypass" principal
     // won't match any guardian binding. Resolve the real guardian principal and
@@ -1874,7 +1879,7 @@ export async function handleSendMessage(
           trustCtx = healed;
         }
       }
-      conversation.setTrustContext(trustCtx);
+      resolvedTrustCtx = trustCtx;
     } else {
       let trustCtx = withSourceChannel(
         sourceChannel,
@@ -1907,22 +1912,19 @@ export async function handleSendMessage(
           );
         }
       }
-      conversation.setTrustContext(trustCtx);
+      resolvedTrustCtx = trustCtx;
     }
   } else {
     // Service principals (svc_gateway) or tokens without an actor ID
     // get a minimal guardian context so downstream code has something.
-    conversation.setTrustContext({ trustClass: "guardian", sourceChannel });
+    resolvedTrustCtx = { trustClass: "guardian", sourceChannel };
   }
 
-  // The trust this request's turn runs under, captured here rather than read
-  // back at the agent loop below. Every branch above has just written it and
-  // nothing awaits in between, so this is the resolved sender. Between here
-  // and the loop the conversation slot is writable by paths that do not own
-  // this turn (channel ingress for another actor, live-voice hydration,
-  // pointer elevation, the voice bridge), and the loop would otherwise
-  // re-read it and run this turn as whoever wrote last.
-  const turnTrustContext = conversation.trustContext;
+  // The trust this request's turn runs under: the sender resolved above,
+  // never a read of the shared slot. Between here and the loop that slot is
+  // writable by paths that do not own this turn (channel ingress for another
+  // actor, live-voice hydration, pointer elevation, the voice bridge).
+  const turnTrustContext = resolvedTrustCtx;
 
   const isInteractive = isInteractiveInterface(sourceInterface);
   // Translate the dev-bypass actor principal to the real guardian principal
@@ -1979,20 +1981,18 @@ export async function handleSendMessage(
       sourceActorPrincipalId,
     );
   }
-  // Wire sendToClient to the SSE hub so all subsystems can reach the HTTP client.
-  // hasNoClient must remain `!isInteractive` so downstream tool gating
-  // (`isToolActiveForContext` for HOST_TOOL_NAMES, `createToolExecutor`'s
-  // `isInteractive: !ctx.hasNoClient`) keeps host_bash/host_file/host_cu
-  // tools gated for non-desktop interfaces. The chrome-extension interface
-  // is non-interactive (no SSE prompter UI) but still has a connected client
-  // that can service host_browser_request events; we restore that single
-  // proxy explicitly below without relaxing `hasNoClient`.
-  conversation.updateClient(broadcastMessage, !isInteractive);
+  // Delivery needs no wiring: the conversation's sink is the SSE hub for its
+  // whole life. Presence travels with the turn (`isInteractive` below), which
+  // is what keeps host_bash/host_file/host_cu gated for non-desktop
+  // interfaces. The chrome-extension interface is non-interactive (no SSE
+  // prompter UI) but still has a connected client that can service
+  // host_browser_request events; that single proxy is restored explicitly
+  // below without claiming a human is present.
   if (isInteractive) {
-    getSubagentManager().updateParentSender(
-      mapping.conversationId,
-      broadcastMessage,
-    );
+    // A client that reconnected mid-phase resyncs the current activity state
+    // and any subagent card it left stale while disconnected.
+    conversation.replayActivityState();
+    getSubagentManager().reannounceChildStatuses(mapping.conversationId);
   }
 
   // ── URL scan path: rewrite first message for scan onboarding ──
@@ -2055,12 +2055,15 @@ export async function handleSendMessage(
         requestId: uuidv7(),
         metadata: greetingMeta,
         clientMessageId,
+        // This path answers and returns without starting a turn, so it never
+        // reaches the stamp below; name the sender on the row directly.
+        trustContext: resolvedTrustCtx,
         ...(clientOs ? { requestClientOs: clientOs } : {}),
       });
 
       const conversationId = mapping.conversationId;
       const channelMeta = buildChannelMetadata(sourceChannel, sourceInterface, {
-        trustContext: conversation.trustContext,
+        trustContext: resolvedTrustCtx,
       });
 
       const assistantMsg = createAssistantMessage(cannedGreeting);
@@ -2167,10 +2170,9 @@ export async function handleSendMessage(
 
   // Resolve the verified actor's external user ID and principal for inline
   // approval routing from the conversation's guardian context.
-  const verifiedActorExternalUserId =
-    conversation.trustContext?.guardianExternalUserId;
+  const verifiedActorExternalUserId = resolvedTrustCtx.guardianExternalUserId;
   const verifiedActorPrincipalId =
-    conversation.trustContext?.guardianPrincipalId ?? undefined;
+    resolvedTrustCtx.guardianPrincipalId ?? undefined;
 
   // Try to consume the message as a guardian approval/rejection reply.
   // On failure, degrade to the existing queue/auto-deny path rather than
@@ -2244,6 +2246,10 @@ export async function handleSendMessage(
       sourceActorPrincipalId,
       transport,
       clientMessageId,
+      // The sender's own trust, so the drain runs this message as the actor
+      // who sent it rather than as whoever the slot happens to hold when the
+      // queue is worked.
+      trustContext: resolvedTrustCtx,
     });
     if (enqueueResult.rejected) {
       return new RouteResponse(
@@ -2342,7 +2348,15 @@ export async function handleSendMessage(
   // matching in-memory pending interaction (e.g. prompter timeouts).
   await expireOrphanedGuardianRequests(mapping.conversationId);
 
-  // Conversation is idle — persist and fire agent loop immediately
+  // Conversation is idle — persist and fire agent loop immediately.
+  //
+  // Stamping the sender here rather than at resolution is what keeps the two
+  // in step: the slot hydrates and scopes the turn started just below
+  // (`ensureActorScopedHistory`, persisted provenance, the loop's own trust),
+  // so it must name whoever this request is about to run as. A request that
+  // queues instead returns above without stamping — it is not starting a run,
+  // and its actor rides the queue item to the drain.
+  conversation.setTrustContext(resolvedTrustCtx);
   conversation.setTurnChannelContext({
     userMessageChannel: sourceChannel,
     assistantMessageChannel: sourceChannel,