@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/acp/session-manager.ts

@@ -15,7 +15,15 @@ import { getDb } from "../persistence/db-connection.js";
 import { acpSessionHistory } from "../persistence/schema/index.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { getLogger } from "../util/logger.js";
+import { markAcpConnectCardRaised } from "./acp-connect-card-state.js";
 import { AcpAgentProcess } from "./agent-process.js";
+import {
+  ACP_AUTH_RECOVERY_GUIDANCE,
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  CLAUDE_ACP_COMMAND,
+  isAcpAuthRequired,
+  isClaudeAuthFailureMessage,
+} from "./auth-required.js";
 import { resolveAgentWithAutoInstall } from "./auto-install.js";
 import { VellumAcpClientHandler } from "./client-handler.js";
 import { deriveFailureError } from "./failure-error.js";
@@ -26,6 +34,30 @@ import type { AcpAgentConfig, AcpSessionState } from "./types.js";
 
 const log = getLogger("acp:session-manager");
 
+/**
+ * The `authCode` for a run that failed on its Claude credential, or undefined
+ * for any other failure. Adapter-gated first: the signals are Claude-specific,
+ * and the marker promises a repair only the Connect Claude flow can perform.
+ * Checks both auth-failure shapes (see `auth-required.ts`) against both the
+ * raw rejection and the derived failure message, since `deriveFailureError`
+ * may replace one with the other.
+ */
+function claudeAuthRequiredCode(
+  err: unknown,
+  failureMessage: string,
+  entry: { command: string },
+): string | undefined {
+  if (entry.command !== CLAUDE_ACP_COMMAND) {
+    return undefined;
+  }
+  const rawMessage = err instanceof Error ? err.message : String(err);
+  return isAcpAuthRequired(err) ||
+    isClaudeAuthFailureMessage(rawMessage) ||
+    isClaudeAuthFailureMessage(failureMessage)
+    ? ACP_CLAUDE_AUTH_REQUIRED_CODE
+    : undefined;
+}
+
 /**
  * The manager's "unknown session id" error. Thrown whenever an operation
  * references an acpSessionId with no in-memory entry (and, for resume, no
@@ -1093,6 +1125,11 @@ export class AcpSessionManager {
             err.message,
             current.process.stderrSince(stderrMark),
           );
+          const errorCode = claudeAuthRequiredCode(
+            err,
+            failureMessage,
+            current,
+          );
           if (current.state.status !== "cancelled") {
             current.state.status = "failed";
             current.state.completedAt = Date.now();
@@ -1100,14 +1137,40 @@ export class AcpSessionManager {
           }
           current.currentPrompt = null;
           log.error(
-            { acpSessionId, error: err.message, failureMessage },
+            { acpSessionId, error: err.message, failureMessage, errorCode },
             "ACP prompt failed",
           );
+          // `acp_session_error` keeps its pre-existing shape so older packaged
+          // clients still parse it; the recovery signal rides its own event
+          // below (see `api/events/acp-auth-required.ts`).
           current.sendToVellum({
             type: "acp_session_error",
             acpSessionId,
             error: failureMessage,
           });
+          // The recovery surface (event, model guidance, prompt-dedup marker)
+          // is raised as a unit, and only when a spawning tool call exists to
+          // anchor the card AND the user did not already stop the run. A
+          // cancelled run renders no card (the client guards it), so marking
+          // the never-cleared prompt-dedup registry here would suppress the
+          // secure token prompt against a card that never appears.
+          const recoveryAnchor =
+            errorCode !== undefined && current.state.status !== "cancelled"
+              ? current.parentToolUseId
+              : undefined;
+          if (errorCode !== undefined && recoveryAnchor !== undefined) {
+            current.sendToVellum({
+              type: "acp_auth_required",
+              acpSessionId,
+              authCode: errorCode,
+              agent: current.state.agentId,
+              parentToolUseId: recoveryAnchor,
+            });
+            // Same registry as the missing-token spawn path, so the
+            // credential-prompt route redirects a redundant secure prompt at
+            // the card instead of stacking a second one.
+            markAcpConnectCardRaised(current.parentConversationId);
+          }
 
           // Persist the terminal row before teardown clears the buffer.
           this.persistTerminal(acpSessionId, current);
@@ -1123,7 +1186,10 @@ export class AcpSessionManager {
           if (current.state.status !== "cancelled") {
             this.notifyParent(
               current,
-              `[ACP agent "${current.state.agentId}" failed]\n\n${failureMessage}`,
+              `[ACP agent "${current.state.agentId}" failed]\n\n${failureMessage}` +
+                (recoveryAnchor !== undefined
+                  ? `\n\n${ACP_AUTH_RECOVERY_GUIDANCE}`
+                  : ""),
             );
           }
         }

package/src/api/events/acp-auth-required.ts

@@ -0,0 +1,55 @@
+/**
+ * `acp_auth_required` SSE event.
+ *
+ * Server to client notification that an ACP run failed because the agent
+ * rejected its stored credential and the client can offer a re-authentication
+ * affordance. Always emitted immediately AFTER the `acp_session_error` that
+ * carries the human-readable failure.
+ *
+ * It is a separate event rather than a field on `acp_session_error` because
+ * every event schema here is `.strict()` and clients fall back to an inert
+ * `unknown` event when parsing fails: a new FIELD makes an older packaged
+ * client (iOS/macOS bundle the web app) reject the whole error event and
+ * render the run as still active, while an unknown event TYPE is simply
+ * ignored. Additive signals on existing events need their own event type for
+ * the same reason.
+ *
+ * Canonical wire-contract source. Re-exported to external consumers via
+ * `@vellumai/assistant-api` (the `api/index.ts` barrel).
+ */
+
+import { z } from "zod";
+
+/**
+ * The code for a `claude-agent-acp` run whose Claude credential needs to be
+ * reconnected: the `authCode` on this event for post-spawn failures, and the
+ * `errorCode` on the failed `acp_spawn` tool result for pre-spawn ones.
+ * Single source for both sides of the wire: the daemon re-exports it via
+ * `acp/auth-required.ts`, the web client via
+ * `domains/chat/utils/acp-connect.ts`.
+ */
+export const ACP_CLAUDE_AUTH_REQUIRED_CODE = "acp_claude_auth_required";
+
+export const AcpAuthRequiredEventSchema = z
+  .object({
+    type: z.literal("acp_auth_required"),
+    acpSessionId: z.string(),
+    /**
+     * Machine-readable classification of what kind of re-authentication is
+     * needed, so clients branch on a stable value rather than on the failure
+     * text (which varies by adapter and failure mode). Currently only
+     * {@link ACP_CLAUDE_AUTH_REQUIRED_CODE}.
+     */
+    authCode: z.string(),
+    /** Agent id the run was spawned with, for display. */
+    agent: z.string(),
+    /**
+     * Tool-use id of the `acp_spawn` call that started this run, so the
+     * client anchors the inline affordance to the right transcript row.
+     * Absent when the run was not started by a tool call.
+     */
+    parentToolUseId: z.string().optional(),
+  })
+  .strict();
+
+export type AcpAuthRequiredEvent = z.infer<typeof AcpAuthRequiredEventSchema>;

package/src/api/index.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { AcpAuthRequiredEventSchema } from "./events/acp-auth-required.js";
 import { AcpSessionCompletedEventSchema } from "./events/acp-session-completed.js";
 import { AcpSessionErrorEventSchema } from "./events/acp-session-error.js";
 import { AcpSessionSpawnedEventSchema } from "./events/acp-session-spawned.js";
@@ -149,6 +150,11 @@ export {
   SSE_REPLAY_RING_COUNT_LIMIT,
 } from "./constants/sse-replay.js";
 export { DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC } from "./constants/tool-execution.js";
+export {
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  type AcpAuthRequiredEvent,
+  AcpAuthRequiredEventSchema,
+} from "./events/acp-auth-required.js";
 export {
   type AcpSessionCompletedEvent,
   AcpSessionCompletedEventSchema,
@@ -895,6 +901,7 @@ export {
  * migration recipe.
  */
 export const AssistantEventSchema = z.discriminatedUnion("type", [
+  AcpAuthRequiredEventSchema,
   AcpSessionCompletedEventSchema,
   AcpSessionErrorEventSchema,
   AcpSessionSpawnedEventSchema,

package/src/api/surfaces.ts

@@ -591,6 +591,7 @@ export const SURFACE_TYPES = [
   "skill_card",
   "call_summary",
   "visual",
+  "voice_picker",
 ] as const;
 
 export const SurfaceTypeSchema = z.enum(SURFACE_TYPES);
@@ -662,9 +663,10 @@ export type SurfaceData =
  * and serves verbatim but whose shape it does not model, which is why they
  * are absent from the renderable `SurfaceData` union: `channel_setup` (a
  * side-effect command forwarded to the setup panel), `task_preferences` (a
- * fixed grid that reads no data), and `skill_card` / `call_summary` (cards
- * the daemon appends to history directly — the memory retrospective and a
- * call summary — and whose data shape is owned by their client renderers).
+ * fixed grid that reads no data), `voice_picker` (a settings card that reads
+ * its own config), and `skill_card` / `call_summary` (cards the daemon appends
+ * to history directly, the memory retrospective and a call summary, whose
+ * data shape is owned by their client renderers).
  */
 export interface SurfaceDataByType {
   card: CardSurfaceData;
@@ -684,6 +686,7 @@ export interface SurfaceDataByType {
   skill_card: Record<string, unknown>;
   call_summary: Record<string, unknown>;
   visual: VisualSurfaceData;
+  voice_picker: Record<string, unknown>;
 }
 
 /** Any surface `data` payload, including the opaque (non-renderable) types. */
@@ -717,6 +720,7 @@ export const SURFACE_DATA_SCHEMAS: {
   skill_card: z.record(z.string(), z.unknown()),
   call_summary: z.record(z.string(), z.unknown()),
   visual: VisualSurfaceDataSchema,
+  voice_picker: z.record(z.string(), z.unknown()),
 };
 
 /**

package/src/apps/app-store.ts

@@ -1422,6 +1422,9 @@ export function backfillAppConversationIds(): void {
   }
 
   try {
+    // Unfinalized rows cannot match: their content is a { ref } pointer,
+    // never inline surface JSON, so this scan sees finalized content only by
+    // shape. No completeness predicate needed.
     const rows = rawAll<{ conversation_id: string; content: string }>(
       "apps:backfillConversationIds",
       `SELECT conversation_id, content FROM messages WHERE content LIKE '%"type":"ui_surface"%'`,

package/src/bundler/package-resolver.ts

@@ -6,7 +6,7 @@
  */
 
 import { existsSync } from "node:fs";
-import { mkdir, stat } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 
 import { ensureBun } from "../util/bun-runtime.js";
@@ -24,8 +24,8 @@ export const ALLOWED_PACKAGES: readonly string[] = [
   "clsx",
 ] as const;
 
+/** Bounds a runaway install; the allowlist above bounds what may be installed. */
 const INSTALL_TIMEOUT_MS = 10_000;
-const MAX_PACKAGE_SIZE_BYTES = 5 * 1024 * 1024; // 5 MB
 
 /** In-flight install promises keyed by package name, to deduplicate concurrent requests. */
 const inflight = new Map<string, Promise<string | null>>();
@@ -148,37 +148,9 @@ async function installPackage(
       return null;
     }
 
-    // Enforce max size
-    if (existsSync(pkgDir)) {
-      const size = await dirSize(pkgDir);
-      if (size > MAX_PACKAGE_SIZE_BYTES) {
-        log.warn({ pkg, size }, "Package exceeds size limit, removing");
-        const { rm } = await import("node:fs/promises");
-        await rm(pkgDir, { recursive: true, force: true });
-        return null;
-      }
-    }
-
     return existsSync(pkgDir) ? nodeModulesDir : null;
   } catch (err) {
     log.warn({ pkg, err }, "Package resolution failed");
     return null;
   }
 }
-
-/** Recursively sum file sizes under a directory. */
-async function dirSize(dir: string): Promise<number> {
-  const { readdir } = await import("node:fs/promises");
-  const entries = await readdir(dir, { withFileTypes: true });
-  let total = 0;
-  for (const entry of entries) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      total += await dirSize(full);
-    } else {
-      const s = await stat(full);
-      total += s.size;
-    }
-  }
-  return total;
-}

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -73,7 +73,11 @@ mock.module("../../persistence/conversation-crud.js", () => ({
 import { setConfig } from "../../__tests__/helpers/set-config.js";
 import { ABORT_WATCHDOG_MS } from "../../daemon/abort-watchdog.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { CALL_OPENING_MARKER } from "../voice-control-protocol.js";
+import {
+  CALL_OPENING_MARKER,
+  ESCALATE_VERDICT_TOKEN,
+  HOLD_VERDICT_TOKEN,
+} from "../voice-control-protocol.js";
 import {
   cutFrontDoorContentAtVerdict,
   preSpeechLanguageRuleFragment,
@@ -1701,6 +1705,174 @@ describe("cutFrontDoorContentAtVerdict", () => {
   });
 });
 
+/**
+ * The front-door leg's raw stream is a control plane: its leading tokens are
+ * the routing verdict, not speech. The hub broadcast (web / passive devices)
+ * must never carry those tokens, and must still carry every word of real
+ * assistant content: an over-broad filter would leave the shared transcript
+ * silent or truncated, which is worse than the leak it fixes.
+ */
+describe("front-door hub stream gate", () => {
+  beforeEach(resetCrudLog);
+
+  /**
+   * Conversation whose scripted agent loop announces a reserved row, streams
+   * `deltas` in order, then ends the leg with `finalEvent`.
+   */
+  function makeStreamingConversation(
+    deltas: string[],
+    finalEvent:
+      | "message_complete"
+      | "generation_cancelled" = "message_complete",
+  ): void {
+    const fake = makeFakeConversation({ processing: false });
+    fake.conversation.runAgentLoop = async (...args: unknown[]) => {
+      const { onEvent } = args[2] as { onEvent: (msg: unknown) => void };
+      onEvent({
+        type: "assistant_turn_start",
+        messageId: "assistant-row-1",
+        conversationId: "conv-voice-bridge-test",
+      });
+      for (const text of deltas) {
+        onEvent({
+          type: "assistant_text_delta",
+          text,
+          messageId: "assistant-row-1",
+          conversationId: "conv-voice-bridge-test",
+        });
+      }
+      onEvent({
+        type: finalEvent,
+        ...(finalEvent === "message_complete"
+          ? { messageId: "assistant-row-1" }
+          : {}),
+        conversationId: "conv-voice-bridge-test",
+      });
+    };
+    fakeConversation = fake.conversation;
+  }
+
+  /** The text of every `assistant_text_delta` `turn` publishes to the hub. */
+  async function collectBroadcastText(
+    turn: () => Promise<unknown>,
+  ): Promise<string[]> {
+    const texts: string[] = [];
+    const subscription = assistantEventHub.subscribe({
+      type: "process",
+      filter: { conversationId: "conv-voice-bridge-test" },
+      callback: (event) => {
+        const msg = event.message as { type: string; text?: string };
+        if (msg.type === "assistant_text_delta") {
+          texts.push(msg.text ?? "");
+        }
+      },
+    });
+    try {
+      await turn();
+      // The hub publishes off a promise chain, so every broadcast costs a
+      // few microtask hops before it reaches a subscriber.
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      await flushMicrotasks();
+    } finally {
+      subscription.dispose();
+    }
+    return texts;
+  }
+
+  test("an escalating leg broadcasts only the capped bridge, never the verdict token", async () => {
+    makeStreamingConversation([
+      "[1]",
+      " Let me check your calendar.",
+      " weak answer past the cap",
+    ]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual(["Let me check your calendar."]);
+    expect(texts.join("")).not.toContain(ESCALATE_VERDICT_TOKEN);
+  });
+
+  test("a front-door answer reaches the hub in full", async () => {
+    makeStreamingConversation(["It is ", "Tuesday", ", and it is sunny."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts.join("")).toBe("It is Tuesday, and it is sunny.");
+  });
+
+  test("an answer that merely opens with a bracket is released in full", async () => {
+    // "[" alone could still become the escalate token, so the gate holds it;
+    // the next delta disproves the token and the whole prefix must come out.
+    makeStreamingConversation(["[", "A] is the option to pick."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts.join("")).toBe("[A] is the option to pick.");
+  });
+
+  test("a hold verdict broadcasts nothing", async () => {
+    makeStreamingConversation([HOLD_VERDICT_TOKEN]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({
+        ...makeTurnOptions(),
+        routingLeg: "front-door",
+        unifiedVerdict: true,
+      }),
+    );
+
+    expect(texts).toEqual([]);
+  });
+
+  test("a leg that completes mid-bridge broadcasts what it handed off with", async () => {
+    makeStreamingConversation(["[1] Let me check"]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual(["Let me check"]);
+  });
+
+  test("a leg cancelled mid-bridge never hands off, so it broadcasts nothing", async () => {
+    makeStreamingConversation(["[1] Let me check"], "generation_cancelled");
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual([]);
+  });
+
+  test("the escalated continuation streams to the hub untouched", async () => {
+    // The leg that produces the real answer is never gated: its deltas are
+    // assistant speech from the first token.
+    makeStreamingConversation(["Your next meeting ", "is at four."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "escalated" }),
+    );
+
+    expect(texts).toEqual(["Your next meeting ", "is at four."]);
+  });
+
+  test("an un-routed voice leg streams to the hub untouched", async () => {
+    makeStreamingConversation(["[1] not a verdict here"]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn(makeTurnOptions()),
+    );
+
+    expect(texts).toEqual(["[1] not a verdict here"]);
+  });
+});
+
 describe("transcript hygiene (teardown pass)", () => {
   beforeEach(resetCrudLog);
 

package/src/calls/__tests__/voice-triage-escalate.test.ts

@@ -4,6 +4,7 @@ import { DEEPGRAM_MULTI_LANGUAGE_CODES } from "../../providers/speech-to-text/de
 import {
   capEscalationBridge,
   classifyFrontDoorLeading,
+  createFrontDoorStreamGate,
   ESCALATE_VERDICT_TOKEN,
   escalatedContinuationRule,
   ESCALATION_CONTINUATION_CONTENT,
@@ -439,3 +440,96 @@ describe("live-voice escalation orchestration (end-to-end — TODO)", () => {
     () => {},
   );
 });
+
+describe("createFrontDoorStreamGate", () => {
+  /** Feed `deltas` through a gate and return what it released, in order. */
+  function release(
+    deltas: string[],
+    opts?: { holdEnabled?: boolean; finish?: boolean },
+  ): string[] {
+    const gate = createFrontDoorStreamGate(opts?.holdEnabled === true);
+    const out = deltas
+      .map((delta) => gate.push(delta))
+      .filter((chunk) => chunk.length > 0);
+    if (opts?.finish !== false) {
+      const trailing = gate.finish();
+      if (trailing.length > 0) {
+        out.push(trailing);
+      }
+    }
+    return out;
+  }
+
+  test("an answer passes through delta by delta", () => {
+    expect(release(["It is ", "Tuesday."])).toEqual(["It is ", "Tuesday."]);
+  });
+
+  test("leading text held while the verdict was pending is not lost", () => {
+    expect(release(["[", "A] is the option."])).toEqual(["[A] is the option."]);
+  });
+
+  test("an escalation releases the capped bridge and nothing else", () => {
+    expect(
+      release([
+        ESCALATE_VERDICT_TOKEN,
+        " Let me check your calendar.",
+        " rambling past the cap",
+      ]),
+    ).toEqual(["Let me check your calendar."]);
+  });
+
+  test("a verdict token split across deltas still never escapes", () => {
+    expect(release(["[", "1", "] One moment.", " more"])).toEqual([
+      "One moment.",
+    ]);
+  });
+
+  test("a too-short bridge releases nothing, matching the audio-only fallback", () => {
+    // Under MIN_SPOKEN_BRIDGE_CHARS the session discards the model's bridge
+    // and plays a canned fallback with no caption and no persisted row, so
+    // releasing the capped text would show words the caller never heard.
+    expect(release([ESCALATE_VERDICT_TOKEN, " ok"])).toEqual([]);
+    expect(release([ESCALATE_VERDICT_TOKEN, " ."])).toEqual([]);
+  });
+
+  test("a too-short bridge releases nothing via finish either", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push(`${ESCALATE_VERDICT_TOKEN} ok`)).toBe("");
+    expect(gate.finish()).toBe("");
+  });
+
+  test("a bridge at the spoken threshold is still released", () => {
+    // The boundary belongs to the spoken side: the session speaks anything
+    // that is not BELOW the threshold, so the gate must release it too.
+    expect(release([ESCALATE_VERDICT_TOKEN, " Sure."])).toEqual(["Sure."]);
+  });
+
+  test("a bridge with no terminator is released by finish", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push("[1] Let me check")).toBe("");
+    expect(gate.finish()).toBe("Let me check");
+  });
+
+  test("a bridge is dropped when the leg never finishes (cancellation)", () => {
+    expect(release(["[1] Let me check"], { finish: false })).toEqual([]);
+  });
+
+  test("a hold verdict releases nothing", () => {
+    expect(release([HOLD_VERDICT_TOKEN], { holdEnabled: true })).toEqual([]);
+  });
+
+  test("the hold token is ordinary text on a leg that was never taught it", () => {
+    // A non-speculative leg's prompt has no hold branch, so its output must
+    // not be swallowed by a token it could only have parroted.
+    expect(release([`${HOLD_VERDICT_TOKEN} is the index.`])).toEqual([
+      `${HOLD_VERDICT_TOKEN} is the index.`,
+    ]);
+  });
+
+  test("nothing more escapes after the bridge is released", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push("[1] One moment.")).toBe("One moment.");
+    expect(gate.push(" and a leaked continuation")).toBe("");
+    expect(gate.finish()).toBe("");
+  });
+});

package/src/calls/call-controller.ts

@@ -21,6 +21,7 @@ import type { TrustContext } from "../daemon/trust-context-types.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 import { getCatalogProvider } from "../tts/provider-catalog.js";
+import { createReasoningTagFilter } from "../tts/reasoning-tag-filter.js";
 import { extractSpeakableSegments } from "../tts/speakable-segments.js";
 import {
   type AudioStoreSink,
@@ -728,6 +729,12 @@ export class CallController {
     // could be the start of a control marker.
     let ttsBuffer = "";
     let fullResponseText = "";
+    // Reasoning models can inline <think> spans in the content stream when a
+    // profile has not opted into parseThinkTags. Neither the spoken path nor
+    // the post-turn consumers of fullResponseText (transcripts,
+    // assistant_spoke, END_CALL/ASK_GUARDIAN detection) may see them: both
+    // are fed only filtered text.
+    const reasoningFilter = createReasoningTagFilter();
 
     // Synthesized path: text is split at speakable boundaries as it streams
     // and each segment is synthesized while the LLM keeps generating. The
@@ -930,8 +937,13 @@ export class CallController {
         if (!this.isCurrentRun(runVersion)) {
           return;
         }
-        fullResponseText += text;
-        ttsBuffer += text;
+        // One filter feeds both consumers: the spoken stream and the text
+        // used for transcripts, assistant_spoke, and END_CALL/ASK_GUARDIAN
+        // marker detection. A control marker inside a reasoning span must
+        // never trigger a real action the caller did not hear.
+        const speakable = reasoningFilter.push(text);
+        fullResponseText += speakable;
+        ttsBuffer += speakable;
         ttsBuffer = stripInternalSpeechMarkers(ttsBuffer);
         flushSafeText();
       };
@@ -1010,7 +1022,11 @@ export class CallController {
       return fullResponseText;
     }
 
-    // Final sweep: strip any remaining control markers from the buffer
+    // Final sweep: release any held-back partial tag to both consumers,
+    // then strip any remaining control markers from the buffer.
+    const filterTail = reasoningFilter.flush();
+    fullResponseText += filterTail;
+    ttsBuffer += filterTail;
     ttsBuffer = stripInternalSpeechMarkers(ttsBuffer);
     if (ttsBuffer.length > 0) {
       emitSafeChunk(ttsBuffer);

package/src/calls/call-setup-flow.ts

@@ -1393,7 +1393,6 @@ export class CallSetupFlow {
 
     try {
       const accessResult = await ndeps.notifyGuardianOfAccessRequest({
-        canonicalAssistantId: accessRequest.assistantId,
         sourceChannel: "phone",
         conversationExternalId: accessRequest.fromNumber,
         actorExternalId: accessRequest.fromNumber,

package/src/calls/media-stream-stt-session.ts

@@ -538,6 +538,17 @@ export class MediaStreamSttSession {
     switch (event.type) {
       case "partial":
         return;
+      case "finalized":
+        return;
+      case "turn-start":
+      case "eager-turn-end":
+      case "turn-resumed":
+      case "turn-end":
+        // The local VAD and the provider's boundary finals own turn
+        // taking. Listed case-by-case rather than under `default` so the
+        // exhaustiveness check flags this site when turn detection is
+        // wired in.
+        return;
       case "final": {
         const durationMs = Math.round(this.utteranceAudioMs);
         this.utteranceAudioMs = 0;
@@ -570,6 +581,10 @@ export class MediaStreamSttSession {
           this.enterBatchMode();
         }
         return;
+      default: {
+        const _exhaustive: never = event;
+        return;
+      }
     }
   }