@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/runtime/routes/credential-prompt-routes.ts

@@ -55,14 +55,11 @@ const CredentialPromptParams = z.object({
  *
  * The prompt blocks until the user answers, so by the time a caller reads the
  * result the secure input is already gone from the UI. A bare `ok: true` reads
- * as "the prompt opened successfully", which leads a model to follow up with
- * "the prompt is open, paste your value there" — pointing the user at a surface
- * that has already closed. The user, having just submitted, re-answers a prompt
- * that never reappears, and the flow loops. State the close explicitly so the
- * only available reading is the correct one.
+ * as "the prompt opened successfully", which invites a follow-up telling the
+ * user to paste into a surface that has already closed. Stating the close
+ * leaves only the correct reading.
  */
-const PROMPT_CLOSED_NOTICE =
-  "The secure prompt has closed — do not ask the user to enter this value again.";
+const PROMPT_CLOSED_NOTICE = "The secure prompt has closed.";
 
 export type CredentialPromptResult = {
   ok: boolean;

package/src/runtime/routes/credential-routes.ts

@@ -16,22 +16,13 @@
 
 import { z } from "zod";
 
-import {
-  ACP_SERVICE,
-  AcpCredentialFormatError,
-  assertAcpCredentialFormat,
-} from "../../acp/acp-credentials.js";
+import { AcpCredentialFormatError } from "../../acp/acp-credentials.js";
 import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import {
   fetchManagedCatalog,
   type ManagedCredentialDescriptor,
 } from "../../credential-execution/managed-catalog.js";
 import { buildForChatSentinel } from "../../daemon/chat-credential-redaction.js";
-import {
-  isNonSecretPlatformField,
-  scrubStoredCredentialFromTranscripts,
-} from "../../daemon/credential-transcript-scrub.js";
-import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import {
   disconnectOAuthProvider,
   getConnectionByProvider,
@@ -39,14 +30,11 @@ import {
   type OAuthConnectionRow,
 } from "../../oauth/oauth-store.js";
 import { credentialKey } from "../../security/credential-key.js";
-import { normalizeSecretValue } from "../../security/secret-normalize.js";
 import {
   deleteSecureKeyAsync,
   getActiveBackendInfoAsync,
-  getActiveBackendName,
   getSecureKeyAsync,
   getSecureKeyResultAsync,
-  setSecureKeyAsync,
 } from "../../security/secure-keys.js";
 import {
   assertMetadataWritable,
@@ -55,10 +43,13 @@ import {
   getCredentialMetadata,
   getCredentialMetadataById,
   listCredentialMetadata,
-  upsertCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import type { CredentialInjectionTemplate } from "../../tools/credentials/policy-types.js";
-import { getLogger } from "../../util/logger.js";
+import {
+  CredentialStorageError,
+  InvalidCredentialInputError,
+  storeCredentialValue,
+} from "../../tools/credentials/store.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { recordForChatMint } from "../for-chat-mint-registry.js";
 import { recordRevealSuccess } from "../reveal-success-registry.js";
@@ -66,8 +57,6 @@ import { InjectionTemplateSchema } from "./credential-prompt-routes.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-const log = getLogger("credential-routes");
-
 // ---------------------------------------------------------------------------
 // Shared helpers
 // ---------------------------------------------------------------------------
@@ -458,74 +447,29 @@ async function handleCredentialsSet({ body }: RouteHandlerArgs) {
     throw new BadRequestError("value is required");
   }
 
-  const normalizedValue = normalizeSecretValue(value);
-  if (normalizedValue.length === 0) {
-    throw new BadRequestError("value is required");
-  }
-
-  // Reject an Anthropic API key pasted into the ACP OAuth-token field (a 401
-  // footgun) as a 400 rather than letting the guard surface as a 500.
-  if (service === ACP_SERVICE) {
-    try {
-      assertAcpCredentialFormat(field, normalizedValue);
-    } catch (err) {
-      if (err instanceof AcpCredentialFormatError) {
-        throw new BadRequestError(err.message);
-      }
-      throw err;
+  try {
+    return await storeCredentialValue({
+      service,
+      field,
+      value,
+      alias: label,
+      usageDescription: description,
+      allowedTools,
+      allowedDomains,
+      injectionTemplates,
+    });
+  } catch (err) {
+    if (
+      err instanceof InvalidCredentialInputError ||
+      err instanceof AcpCredentialFormatError
+    ) {
+      throw new BadRequestError(err.message);
     }
-  }
-
-  assertMetadataWritable();
-
-  const key = credentialKey(service, field);
-  const stored = await setSecureKeyAsync(key, normalizedValue);
-  if (!stored) {
-    throw new InternalError(
-      `Failed to store credential in secure storage (backend: ${getActiveBackendName()})`,
-    );
-  }
-
-  // The stored plaintext may already sit in recent transcripts: the user
-  // message that pasted it, the persisted tool_use input, the tool result
-  // echoing the command. This route is the scrub seam — not
-  // setSecureKeyAsync, which also fires on OAuth refresh rotations and MCP
-  // header writes whose values never transited a transcript. The scrub runs
-  // immediately after the secure-store write, BEFORE the metadata upsert and
-  // connection sync: those side effects can throw (oauth-store work), and a
-  // stored-but-unscrubbed secret must not depend on them succeeding. The
-  // credential IS stored at this point; the scrub is best-effort hygiene and
-  // must stay invisible to the caller.
-  if (!isNonSecretPlatformField(service, field)) {
-    try {
-      const scrubbed =
-        await scrubStoredCredentialFromTranscripts(normalizedValue);
-      log.info(
-        { service, field, ...scrubbed },
-        "Credential stored; scrubbed value from recent transcripts",
-      );
-    } catch (err) {
-      log.warn(
-        { err, service, field },
-        "Credential stored, but transcript scrub failed",
-      );
+    if (err instanceof CredentialStorageError) {
+      throw new InternalError(err.message);
     }
+    throw err;
   }
-
-  const metadata = upsertCredentialMetadata(service, field, {
-    alias: label,
-    usageDescription: description,
-    allowedTools,
-    allowedDomains,
-    injectionTemplates,
-  });
-  await syncManualTokenConnection(service);
-
-  return {
-    credentialId: metadata.credentialId,
-    service,
-    field,
-  };
 }
 
 async function handleCredentialsDelete({ body }: RouteHandlerArgs) {

package/src/runtime/routes/default-provider-routes.ts

@@ -25,6 +25,7 @@ import {
   DEFAULT_PROVIDER_CHOICES,
   DefaultProviderSchema,
 } from "../../config/schemas/llm.js";
+import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import {
   computeConnectionAvailability,
   CONNECTION_AVAILABILITY_STATUSES,
@@ -93,6 +94,20 @@ async function handlePutDefaultProvider({
       )}; "connectionName" is optional and must be a non-empty string.`,
     );
   }
+  // Routing identities dispatch through their canonical row regardless of
+  // any stored pin (`resolveRoutingIdentity`), so a noncanonical
+  // connectionName would be judged by availability and the deletion guards
+  // while inference uses a different row. Reject it here rather than
+  // persisting a pin that status and dispatch disagree about.
+  const { provider, connectionName } = result.data;
+  if (connectionName != null && ROUTING_IDENTITY_PROVIDERS.has(provider)) {
+    const canonical = resolveDefaultConnectionName({ provider });
+    if (connectionName !== canonical) {
+      throw new BadRequestError(
+        `Provider "${provider}" always dispatches through its canonical connection "${canonical}". Omit "connectionName" or pass "${canonical}".`,
+      );
+    }
+  }
   setDefaultProvider(result.data);
   return handleGetDefaultProvider();
 }

package/src/runtime/routes/documents-routes.ts

@@ -4,20 +4,12 @@
  * Exposes document CRUD over HTTP, sharing business logic with the
  * handlers in `daemon/handlers/documents.ts`.
  */
-import { randomUUID } from "node:crypto";
-import { readFileSync, statSync } from "node:fs";
-import { basename, extname } from "node:path";
-
 import { z } from "zod";
 
 import {
   addDocumentConversation,
-  createFileBackedDocument,
   getDocumentById,
-  getDocumentByWorkspacePath,
   getDocumentsForConversation,
-  isDocumentAssociatedWithConversation,
-  refreshDocumentContentFromFile,
   saveDocument,
 } from "../../documents/document-store.js";
 import { rawAll } from "../../persistence/raw-query.js";
@@ -28,18 +20,9 @@ import {
   publishDocumentsChanged,
 } from "../sync/resource-sync-events.js";
 import { renderMarkdownToPDF } from "./document-pdf-renderer.js";
-import {
-  BadRequestError,
-  InternalError,
-  NotFoundError,
-  UnprocessableEntityError,
-} from "./errors.js";
-import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
 import { RouteResponse } from "./types.js";
-import {
-  resolveWorkspacePath,
-  toWorkspaceRelativePath,
-} from "./workspace-utils.js";
 
 const log = getLogger("documents-routes");
 
@@ -85,14 +68,7 @@ function listAllDocuments(): Array<{
   }
 }
 
-// ---------------------------------------------------------------------------
-// File-backed documents
-// ---------------------------------------------------------------------------
-
-/** Extensions the document editor round-trips faithfully as markdown. */
-const MARKDOWN_EXTENSIONS = new Set([".md", ".markdown"]);
-
-/** The document payload shape shared by `GET documents/{id}` and its siblings. */
+/** The document payload shape returned by `GET documents/{id}`. */
 const documentPayloadSchema = z.object({
   success: z.boolean(),
   surfaceId: z.string(),
@@ -102,173 +78,8 @@ const documentPayloadSchema = z.object({
   wordCount: z.number(),
   createdAt: z.number(),
   updatedAt: z.number(),
-  workspacePath: z
-    .string()
-    .nullable()
-    .describe("Workspace-relative file this document is bound to, or null"),
 });
 
-/**
- * Resolve a client-supplied workspace path to the markdown file it names.
- *
- * Uses the same resolution as the workspace file routes, so a path that
- * escapes the workspace (traversal, absolute, symlinked out, dot-segment) is
- * rejected here exactly as it would be there.
- */
-function resolveWorkspaceMarkdownFile(path: string): {
-  absolutePath: string;
-  relativePath: string;
-} {
-  const resolved = resolveWorkspacePath(path);
-  if (resolved === undefined) {
-    throw new BadRequestError("Invalid path");
-  }
-
-  if (!MARKDOWN_EXTENSIONS.has(extname(resolved).toLowerCase())) {
-    throw new UnprocessableEntityError(
-      "Only markdown files (.md, .markdown) can back a document",
-    );
-  }
-
-  return {
-    absolutePath: resolved,
-    relativePath: toWorkspaceRelativePath(resolved),
-  };
-}
-
-/** Current text of a workspace file, or `null` when it is gone or not a file. */
-function readWorkspaceFileText(absolutePath: string): string | null {
-  try {
-    if (!statSync(absolutePath).isFile()) {
-      return null;
-    }
-    return readFileSync(absolutePath, "utf-8");
-  } catch {
-    return null;
-  }
-}
-
-/** Load a document by surface ID for a response, or fail loudly if it vanished. */
-function loadDocumentPayload(surfaceId: string): Record<string, unknown> {
-  const doc = getDocumentById(surfaceId);
-  if (!doc) {
-    throw new InternalError("Document could not be loaded after persisting");
-  }
-  return { success: true, ...doc };
-}
-
-/**
- * Find or create the document bound to a workspace markdown file.
- *
- * The file is the source of truth at open time: when a bound document's stored
- * content has drifted from the bytes on disk (the file was edited outside the
- * editor), the row is refreshed from the file before it is returned. Writes go
- * the other way — the document store writes through to the file.
- *
- * The publishes here carry no origin client id on purpose. The only caller,
- * `viewer-store.loadWorkspaceFileDocument`, opens the file and never
- * invalidates its own document queries, so the client that creates the row is
- * the one that most needs to hear about it: suppressing its own echo would
- * leave its assets pill and Library without the document it just opened.
- */
-function handleDocumentForWorkspaceFile({
-  body,
-}: RouteHandlerArgs): Record<string, unknown> {
-  const { path, conversationId } = (body ?? {}) as {
-    path?: string;
-    conversationId?: string;
-  };
-
-  if (!path || typeof path !== "string") {
-    throw new BadRequestError("path is required");
-  }
-  if (!conversationId || typeof conversationId !== "string") {
-    throw new BadRequestError("conversationId is required");
-  }
-
-  const { absolutePath, relativePath } = resolveWorkspaceMarkdownFile(path);
-  const existing = getDocumentByWorkspacePath(relativePath);
-  const fileText = readWorkspaceFileText(absolutePath);
-
-  if (fileText === null) {
-    // A bound document whose file is gone is reported distinctly: the client
-    // needs to tell "this file was deleted" apart from "no such file", and the
-    // document must never be used to resurrect the file.
-    if (existing) {
-      throw new NotFoundError(
-        `The file backing this document no longer exists: ${relativePath}`,
-      );
-    }
-    throw new NotFoundError("File not found");
-  }
-
-  if (existing) {
-    // Opening the file from another conversation grants that conversation
-    // access, the same association the link route writes.
-    const alreadyLinked = isDocumentAssociatedWithConversation(
-      existing.surfaceId,
-      conversationId,
-    );
-    addDocumentConversation(existing.surfaceId, conversationId);
-
-    let refreshed = false;
-    if (existing.content !== fileText) {
-      const refresh = refreshDocumentContentFromFile(
-        existing.surfaceId,
-        fileText,
-      );
-      if (!refresh.success) {
-        throw new InternalError(refresh.error);
-      }
-      refreshed = true;
-      log.info(
-        { surfaceId: existing.surfaceId, workspacePath: relativePath },
-        "Refreshed file-backed document from disk",
-      );
-    }
-
-    // Reopening an unchanged, already-linked file writes nothing, so it must
-    // not invalidate every client's document list on each open.
-    if (!alreadyLinked || refreshed) {
-      publishDocumentsChanged();
-    }
-    return loadDocumentPayload(existing.surfaceId);
-  }
-
-  const surfaceId = `doc-${randomUUID()}`;
-  const created = createFileBackedDocument({
-    surfaceId,
-    conversationId,
-    title: basename(relativePath),
-    content: fileText,
-    workspacePath: relativePath,
-  });
-
-  if (!created.success) {
-    // A concurrent request may have won the unique index on workspace_path.
-    const raced = getDocumentByWorkspacePath(relativePath);
-    if (!raced) {
-      throw new InternalError(created.error);
-    }
-    const racedAlreadyLinked = isDocumentAssociatedWithConversation(
-      raced.surfaceId,
-      conversationId,
-    );
-    addDocumentConversation(raced.surfaceId, conversationId);
-    if (!racedAlreadyLinked) {
-      publishDocumentsChanged();
-    }
-    return loadDocumentPayload(raced.surfaceId);
-  }
-
-  log.info(
-    { surfaceId, workspacePath: relativePath, conversationId },
-    "Bound workspace file to a new document",
-  );
-  publishDocumentsChanged();
-  return loadDocumentPayload(surfaceId);
-}
-
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -403,36 +214,6 @@ export const ROUTES: RouteDefinition[] = [
     },
   },
 
-  {
-    operationId: "documentForWorkspaceFile",
-    endpoint: "documents/for-workspace-file",
-    method: "POST",
-    policy: {
-      requiredScopes: ["settings.write"],
-      allowedPrincipalTypes: ACTOR_PRINCIPALS,
-    },
-    summary: "Get or create the document for a workspace markdown file",
-    description:
-      "Return the document bound to a workspace markdown file, creating it on " +
-      "first open. The file is the source of truth at open time: stored " +
-      "content that has drifted from the file is refreshed from disk before " +
-      "the document is returned.",
-    tags: ["documents"],
-    requestBody: z.object({
-      path: z
-        .string()
-        .describe("Workspace-relative path to a .md/.markdown file"),
-      conversationId: z
-        .string()
-        .describe("Conversation the document is opened from"),
-    }),
-    responseBody: documentPayloadSchema,
-    additionalResponses: {
-      "422": { description: "Path is not a markdown file" },
-    },
-    handler: handleDocumentForWorkspaceFile,
-  },
-
   {
     operationId: "linkDocumentConversation",
     endpoint: "documents/:id/conversations",

package/src/runtime/routes/inbound-message-handler.ts

@@ -101,7 +101,6 @@ import {
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { deliverChannelReply } from "../gateway-client.js";
 import { trustContextFromVerdict } from "../trust-verdict-consumer.js";
-import { canonicalChannelAssistantId } from "./channel-route-shared.js";
 import { BadRequestError } from "./errors.js";
 import { handleApprovalInterception } from "./guardian-approval-interception.js";
 import {
@@ -371,16 +370,6 @@ export async function handleChannelInbound({
     throw new BadRequestError("content or attachmentIds is required");
   }
 
-  // Canonicalize the assistant ID so all DB-facing operations use the
-  // consistent 'self' key regardless of what the gateway sent.
-  const canonicalAssistantId = canonicalChannelAssistantId(assistantId);
-  if (canonicalAssistantId !== assistantId) {
-    log.debug(
-      { raw: assistantId, canonical: canonicalAssistantId },
-      "Canonicalized channel assistant ID",
-    );
-  }
-
   // Coerce actorExternalId to a string at the boundary — the field
   // comes from unvalidated JSON and may be a number, object, or other
   // non-string type. Non-string truthy values would throw inside
@@ -428,9 +417,10 @@ export async function handleChannelInbound({
   // 👍 never triggers a verification handshake or an access-request
   // notification, and a stranger's reaction creates no conversation/binding.
   // The interceptor drops strangers, records known contacts' reactions as
-  // transcript signals, and routes a guardian's reaction on an approval card
-  // through the guardian decision pipeline. Reactions never drive an
-  // agent turn.
+  // transcript signals in the conversation of the reacted message, and routes
+  // a guardian's reaction on an approval card through the guardian decision
+  // pipeline. Reactions never mint a conversation and never drive an agent
+  // turn.
   if (isSlackReactionEvent(body)) {
     return handleSlackReactionIntercept({
       callbackData: body.callbackData!,
@@ -438,14 +428,12 @@ export async function handleChannelInbound({
       sourceInterface,
       conversationExternalId,
       externalMessageId,
-      canonicalAssistantId,
       rawSenderId,
       canonicalSenderId,
       actorDisplayName: body.actorDisplayName,
       actorUsername: body.actorUsername,
       replyCallbackUrl: body.replyCallbackUrl,
       sourceMetadata: body.sourceMetadata,
-      slackChannelName,
       approvalConversationGenerator,
     });
   }
@@ -486,7 +474,6 @@ export async function handleChannelInbound({
     rawSenderId,
     sourceChannel,
     conversationExternalId,
-    canonicalAssistantId,
     trimmedContent,
     sourceMetadata: body.sourceMetadata,
     actorDisplayName: body.actorDisplayName,
@@ -709,7 +696,6 @@ export async function handleChannelInbound({
       externalMessageId,
       sourceMessageId,
       sourceThreadId: channelThreadId,
-      canonicalAssistantId,
       assistantId,
       content,
       channelId: resolvedMember?.channelId,
@@ -723,28 +709,24 @@ export async function handleChannelInbound({
     externalMessageId,
     {
       sourceMessageId,
-      assistantId: canonicalAssistantId,
       sourceThreadId: channelThreadId,
     },
   );
 
   const replyCallbackUrl = body.replyCallbackUrl;
 
-  // external_conversation_bindings is assistant-agnostic. Restrict writes to
-  // self so assistant-scoped legacy routes do not overwrite each other's
-  // channel binding metadata for the same chat.
-  if (canonicalAssistantId === DAEMON_INTERNAL_ASSISTANT_ID) {
-    upsertBinding({
-      conversationId: result.conversationId,
-      sourceChannel,
-      externalChatId: conversationExternalId,
-      externalChatName: slackChannelName,
-      externalThreadId: channelThreadId ?? null,
-      externalUserId: canonicalSenderId ?? rawSenderId ?? null,
-      displayName: body.actorDisplayName ?? null,
-      username: body.actorUsername ?? null,
-    });
-  }
+  // `external_conversation_bindings` is assistant-agnostic: one row per chat,
+  // whichever caller writes it.
+  upsertBinding({
+    conversationId: result.conversationId,
+    sourceChannel,
+    externalChatId: conversationExternalId,
+    externalChatName: slackChannelName,
+    externalThreadId: channelThreadId ?? null,
+    externalUserId: canonicalSenderId ?? rawSenderId ?? null,
+    displayName: body.actorDisplayName ?? null,
+    username: body.actorUsername ?? null,
+  });
 
   // ── Actor role resolution ──
   // Built from the gateway-stamped trust verdict (ACL + identity). An absent
@@ -844,7 +826,6 @@ export async function handleChannelInbound({
     if (isCallbackInteraction) {
       if (floorSenderId) {
         handshakeInProgress = await isApprovalHandshakeInProgress({
-          canonicalAssistantId,
           sourceChannel,
           actorExternalId: floorSenderId,
         });
@@ -852,7 +833,6 @@ export async function handleChannelInbound({
     } else {
       try {
         const accessResult = await notifyGuardianOfAccessRequest({
-          canonicalAssistantId,
           sourceChannel,
           conversationExternalId,
           actorExternalId: floorSenderId,
@@ -925,7 +905,7 @@ export async function handleChannelInbound({
       const replyPayload: Parameters<typeof deliverChannelReply>[1] = {
         chatId: conversationExternalId,
         text: replyText,
-        assistantId: canonicalAssistantId,
+        assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
       };
       if (sourceChannel === "slack" && (canonicalSenderId ?? rawSenderId)) {
         replyPayload.ephemeral = true;
@@ -987,7 +967,7 @@ export async function handleChannelInbound({
       const replyPayload: Parameters<typeof deliverChannelReply>[1] = {
         chatId: conversationExternalId,
         text: DISK_PRESSURE_REMOTE_BLOCK_REPLY,
-        assistantId: canonicalAssistantId,
+        assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
       };
       if (sourceChannel === "slack" && (canonicalSenderId ?? rawSenderId)) {
         replyPayload.ephemeral = true;
@@ -1059,7 +1039,6 @@ export async function handleChannelInbound({
     isDuplicate: result.duplicate,
     commandIntent,
     rawSenderId,
-    canonicalAssistantId,
     sourceChannel,
     conversationExternalId,
     eventId: result.eventId,
@@ -1081,7 +1060,6 @@ export async function handleChannelInbound({
     callbackData: body.callbackData,
     rawSenderId,
     canonicalSenderId,
-    canonicalAssistantId,
     sourceChannel,
     conversationExternalId,
     conversationId: result.conversationId,
@@ -1123,7 +1101,7 @@ export async function handleChannelInbound({
       actorExternalId: canonicalSenderId ?? rawSenderId,
       replyCallbackUrl,
       trustCtx,
-      assistantId: canonicalAssistantId,
+      assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
       approvalCopyGenerator,
       approvalConversationGenerator,
       approvalMessageTs,
@@ -1219,7 +1197,7 @@ export async function handleChannelInbound({
           chatId: conversationExternalId,
           text: "This approval request has been resolved.",
           messageTs: approvalMessageTs,
-          assistantId: canonicalAssistantId,
+          assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
         }).catch((err) => {
           log.error(
             { err, conversationId: result.conversationId },
@@ -1255,7 +1233,6 @@ export async function handleChannelInbound({
       actorUsername: body.actorUsername,
       trustCtx,
       replyCallbackUrl,
-      canonicalAssistantId,
     });
 
     if (ingressResult.blocked) {
@@ -1296,7 +1273,6 @@ export async function handleChannelInbound({
         const admittedSenderId = canonicalSenderId ?? rawSenderId;
         if (admittedSenderId) {
           void maybeNotifyGuardianOfAdmittedContact({
-            canonicalAssistantId,
             sourceChannel,
             conversationExternalId,
             actorExternalId: admittedSenderId,
@@ -1497,7 +1473,7 @@ export async function handleChannelInbound({
         commandIntent,
         sourceLanguageCode,
         replyCallbackUrl,
-        assistantId: canonicalAssistantId,
+        assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
         approvalCopyGenerator,
         chatType: sourceChatType,
         clientTimezone: inboundClientTimezone,

package/src/runtime/routes/inbound-stages/acl-enforcement.test.ts

@@ -98,7 +98,6 @@ function makeParams(
     rawSenderId: "sender-1",
     sourceChannel: "telegram",
     conversationExternalId: "chat-1",
-    canonicalAssistantId: "assistant-1",
     trimmedContent: "hello",
     sourceMetadata: undefined,
     actorDisplayName: "Sender One",