@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/api/constants/app-tools.ts

@@ -0,0 +1,34 @@
+/**
+ * The app tools that mutate the stored app set, and what each one leaves
+ * behind. Mirrors `document-tools.ts`: a single declaration both the daemon and
+ * the web client derive their tool sets from, so a new mutating app tool is
+ * added here once and every consumer picks it up.
+ *
+ * Tool names are the ones the runner sees. Calls arriving through the bundled
+ * `app-builder` skill reach the daemon already unwrapped to the inner tool
+ * name, and the web client unwraps the `skill_execute` envelope itself.
+ */
+
+export interface AppMutationTool {
+  /** The executed tool name. */
+  readonly name: string;
+  /**
+   * Whether the app is still openable once the tool has run. A deleted app has
+   * nothing to open, so it cannot anchor a card back to itself.
+   */
+  readonly reopenable: boolean;
+}
+
+export const APP_MUTATION_TOOLS: readonly AppMutationTool[] = [
+  { name: "app_create", reopenable: true },
+  { name: "app_update", reopenable: true },
+  { name: "app_delete", reopenable: false },
+];
+
+/**
+ * The mutating app tools that leave the app openable. The web transcript
+ * anchors its end-of-response app cards on these, so a delete never produces a
+ * card pointing at an app that is gone.
+ */
+export const APP_MUTATION_TOOL_NAMES: readonly string[] =
+  APP_MUTATION_TOOLS.filter((tool) => tool.reopenable).map((tool) => tool.name);

package/src/api/events/resource-pressure-status-changed.ts

@@ -0,0 +1,53 @@
+/**
+ * `resource_pressure_status_changed` SSE event.
+ *
+ * Global broadcast pushed when the daemon's resource-pressure snapshot
+ * changes. Mirrors the REST `GET /resource-pressure/status` shape so the
+ * client's monitor can apply stream updates and polled fetches through
+ * the same code path. Carries no `conversationId`: it is workspace-wide.
+ *
+ * Canonical wire-contract source. Daemon code imports the type
+ * directly from this file; external consumers import via
+ * `@vellumai/assistant-api`.
+ */
+
+import { z } from "zod";
+
+export const ResourcePressureStateSchema = z.enum([
+  "disabled",
+  "ok",
+  "elevated",
+  "unknown",
+]);
+
+export type ResourcePressureState = z.infer<typeof ResourcePressureStateSchema>;
+
+export const ResourcePressureStatusSchema = z.object({
+  enabled: z.boolean(),
+  state: ResourcePressureStateSchema,
+  /** Latest CPU sample as a percent of the CPU allocation. */
+  cpuPercent: z.number().nullable(),
+  /** Working set as a percent of the memory limit. */
+  memoryPercent: z.number().nullable(),
+  /** Whether the CPU signal is holding the `elevated` state. */
+  cpuElevated: z.boolean(),
+  /** Whether the memory signal is holding the `elevated` state. */
+  memoryElevated: z.boolean(),
+  cpuThresholdPercent: z.number(),
+  memoryThresholdPercent: z.number(),
+  lastCheckedAt: z.string().nullable(),
+  error: z.string().nullable(),
+});
+
+export type ResourcePressureStatus = z.infer<
+  typeof ResourcePressureStatusSchema
+>;
+
+export const ResourcePressureStatusChangedEventSchema = z.object({
+  type: z.literal("resource_pressure_status_changed"),
+  status: ResourcePressureStatusSchema,
+});
+
+export type ResourcePressureStatusChangedEvent = z.infer<
+  typeof ResourcePressureStatusChangedEventSchema
+>;

package/src/api/index.ts

@@ -102,6 +102,7 @@ import {
   RecordingStopEventSchema,
 } from "./events/recording.js";
 import { RelationshipStateUpdatedEventSchema } from "./events/relationship-state-updated.js";
+import { ResourcePressureStatusChangedEventSchema } from "./events/resource-pressure-status-changed.js";
 import { ScheduleConversationCreatedEventSchema } from "./events/schedule-conversation-created.js";
 import { SecretRequestEventSchema } from "./events/secret-request.js";
 import { ServiceGroupUpdateCompleteEventSchema } from "./events/service-group-update-complete.js";
@@ -134,6 +135,11 @@ import { WorkflowLeafStartedEventSchema } from "./events/workflow-leaf-started.j
 import { WorkflowProgressEventSchema } from "./events/workflow-progress.js";
 import { WorkflowStartedEventSchema } from "./events/workflow-started.js";
 
+export {
+  APP_MUTATION_TOOL_NAMES,
+  APP_MUTATION_TOOLS,
+  type AppMutationTool,
+} from "./constants/app-tools.js";
 export {
   CALL_SITE_COMPACTION_AGENT,
   CALL_SITE_SYNTHETIC_AGENT_ERROR_MESSAGE,
@@ -536,6 +542,14 @@ export {
   type RelationshipStateUpdatedEvent,
   RelationshipStateUpdatedEventSchema,
 } from "./events/relationship-state-updated.js";
+export {
+  type ResourcePressureState,
+  ResourcePressureStateSchema,
+  type ResourcePressureStatus,
+  type ResourcePressureStatusChangedEvent,
+  ResourcePressureStatusChangedEventSchema,
+  ResourcePressureStatusSchema,
+} from "./events/resource-pressure-status-changed.js";
 export {
   type ScheduleConversationCreatedEvent,
   ScheduleConversationCreatedEventSchema,
@@ -802,6 +816,10 @@ export {
   type MemoryV3SelectionRow,
   MemoryV3SelectionRowSchema,
 } from "./responses/memory-v3-selection-log.js";
+export {
+  type ResourcePressureStatusResponse,
+  ResourcePressureStatusResponseSchema,
+} from "./responses/resource-pressure-status.js";
 export {
   type SubagentDetailEvent,
   SubagentDetailEventSchema,
@@ -987,6 +1005,7 @@ export const AssistantEventSchema = z.discriminatedUnion("type", [
   RecordingStartEventSchema,
   RecordingStopEventSchema,
   RelationshipStateUpdatedEventSchema,
+  ResourcePressureStatusChangedEventSchema,
   ScheduleConversationCreatedEventSchema,
   SecretRequestEventSchema,
   ServiceGroupUpdateCompleteEventSchema,

package/src/api/responses/resource-pressure-status.ts

@@ -0,0 +1,25 @@
+/**
+ * Wire contract for the resource-pressure REST endpoint
+ * (`GET /resource-pressure/status`). Returns the current snapshot
+ * wrapped as `{ status }`.
+ *
+ * Reuses the canonical `ResourcePressureStatusSchema` defined alongside
+ * the `resource_pressure_status_changed` SSE event so the polled REST
+ * fetch and the streamed update share a single shape.
+ *
+ * Canonical wire-contract source. Assistant code imports the types
+ * directly from this file via relative paths; external consumers
+ * (web client, gateway, evals) import via `@vellumai/assistant-api`.
+ */
+
+import { z } from "zod";
+
+import { ResourcePressureStatusSchema } from "../events/resource-pressure-status-changed.js";
+
+export const ResourcePressureStatusResponseSchema = z.object({
+  status: ResourcePressureStatusSchema,
+});
+
+export type ResourcePressureStatusResponse = z.infer<
+  typeof ResourcePressureStatusResponseSchema
+>;

package/src/approvals/guardian-channel-delivery.ts

@@ -1,11 +1,12 @@
 /**
- * Shared addressing helpers for guardian requester-facing channel notices.
+ * Shared addressing helpers for guardian-flow channel notices.
  *
- * Requester notices (approval, denial, expiry) are delivered straight to the
- * requester's chat via `deliverChannelReply` — independent of the
- * guardian-facing notification pipeline. Centralizing the addressing rules here
- * keeps the decision resolvers and the timer-driven expiry sweep from drifting
- * apart on how a requester is reached.
+ * Requester notices (approval, denial, expiry) and the guardian's own approval
+ * prompt are delivered straight to a chat via `deliverChannelReply` -
+ * independent of the guardian-facing notification pipeline. Centralizing the
+ * addressing rules here keeps the decision resolvers, the timer-driven expiry
+ * sweep and the in-turn approval prompt from drifting apart on who a message
+ * is put in front of.
  */
 
 /**
@@ -111,3 +112,66 @@ export function resolveRequesterDeliveryTarget(params: {
   }
   return requesterChatId;
 }
+
+/**
+ * Reduce a reply callback to its channel route, dropping every query param.
+ *
+ * A callback addresses the turn it came from. The gateway hangs the turn's
+ * coordinates on it as params, and each transport reads a different one:
+ * Slack a `threadTs`, Telegram a forum topic `threadId`, Discord a `threadId`
+ * that replaces the destination outright rather than narrowing it. Carried
+ * onto a delivery aimed elsewhere they either fail the send or quietly win
+ * over the new address, and a redirect that leaves one behind is
+ * indistinguishable from no redirect at all.
+ *
+ * Everything is dropped rather than a named set, so a channel added later, or
+ * a param a transport starts reading later, cannot silently escape this. The
+ * channel itself survives because it is the path, which is also what
+ * `isDirectDelivery` resolves a transport from, and nothing the gateway hangs
+ * on a deliver callback is needed to authorize or route the send.
+ *
+ * Relative or malformed URLs are returned as-is; they carry no params.
+ */
+export function stripTurnDestination(replyCallbackUrl: string): string {
+  try {
+    const url = new URL(replyCallbackUrl);
+    url.search = "";
+    return url.toString();
+  } catch {
+    return replyCallbackUrl;
+  }
+}
+
+/**
+ * Resolve where a guardian's own approval prompt is delivered.
+ *
+ * The prompt is raised by a turn the guardian is having, and that turn can be
+ * running in a room: a shared Slack channel, a Telegram group. The card
+ * carries the tool name and a preview of the command, so delivering it where
+ * the turn is shows both to everyone there.
+ *
+ * It goes to the guardian's own bound chat instead, the address they
+ * nominated when they verified and the one the notification pipeline already
+ * sends guardian cards to. No channel is named in this rule and none can be
+ * forgotten by it: a bound chat is the guardian's by definition, on any
+ * channel, including ones not built yet.
+ *
+ * A bound chat equal to the turn's chat means the turn is already there, so
+ * nothing moves. That also covers a turn where no binding resolved, since the
+ * trust context falls back to the turn's own chat, leaving delivery exactly as
+ * it is rather than dropping it.
+ */
+export function resolveGuardianPromptDelivery(params: {
+  turnChatId: string;
+  turnCallbackUrl: string;
+  guardianChatId: string | undefined;
+}): { chatId: string; callbackUrl: string } {
+  const { turnChatId, turnCallbackUrl, guardianChatId } = params;
+  if (!guardianChatId || guardianChatId === turnChatId) {
+    return { chatId: turnChatId, callbackUrl: turnCallbackUrl };
+  }
+  return {
+    chatId: guardianChatId,
+    callbackUrl: stripTurnDestination(turnCallbackUrl),
+  };
+}

package/src/approvals/guardian-request-resolvers.ts

@@ -23,8 +23,10 @@ import type {
   GuardianRequestWire,
 } from "../channels/gateway-guardian-requests.js";
 import { getGuardianRequestOrNull } from "../channels/gateway-guardian-requests.js";
+import { audienceForReader } from "../channels/message-audience.js";
 import { findContactChannel } from "../contacts/contact-store.js";
 import { findConversation } from "../daemon/conversation-registry.js";
+import { isSlackDmConversation } from "../messaging/providers/slack/message-metadata.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { parseQuestionAnswerActionId } from "../notifications/guardian-question-mode.js";
 import {
@@ -62,6 +64,7 @@ import {
   channelDeliversToUserId,
   resolveDeliverCallbackUrlForChannel,
   resolveRequesterDeliveryTarget,
+  stripTurnDestination,
 } from "./guardian-channel-delivery.js";
 
 const log = getLogger("guardian-request-resolvers");
@@ -70,38 +73,6 @@ const log = getLogger("guardian-request-resolvers");
 // Helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Determines whether a Slack delivery should use ephemeral mode.
- *
- * Ephemeral messages (`chat.postEphemeral`) require a real channel ID
- * (starts with `C` for public/private channels, or `D` for DM conversations).
- * When the chat ID is a user ID (starts with `U`), `chat.postEphemeral` fails
- * with `channel_not_found`. In that case the message is already going to a DM
- * opened by `chat.postMessage`, so ephemeral isn't needed.
- *
- * Returns `true` only when the source channel is Slack AND the chatId is a
- * shared channel (starts with `C`), meaning other users could see the message.
- */
-function shouldUseEphemeral(sourceChannel: string, chatId: string): boolean {
-  return sourceChannel === "slack" && chatId.startsWith("C");
-}
-
-/**
- * Strip the `threadTs` query param from a reply callback URL. The param
- * addresses the guardian's channel thread; reusing it for a DM delivery
- * raises `thread_not_found`. Relative or malformed URLs are returned as-is —
- * they carry no threadTs to strip.
- */
-function stripThreadTsParam(replyCallbackUrl: string): string {
-  try {
-    const url = new URL(replyCallbackUrl);
-    url.searchParams.delete("threadTs");
-    return url.toString();
-  } catch {
-    return replyCallbackUrl;
-  }
-}
-
 /**
  * Deliver the verification code straight to the requester's DM so the
  * guardian is never an out-of-band courier for the secret.
@@ -125,7 +96,7 @@ async function deliverVerificationCodeToRequester(params: {
   verificationCode: string;
   assistantId: string;
 }): Promise<boolean> {
-  const callbackUrl = stripThreadTsParam(params.replyCallbackUrl);
+  const callbackUrl = stripTurnDestination(params.replyCallbackUrl);
 
   try {
     await deliverChannelReply(callbackUrl, {
@@ -194,13 +165,13 @@ function buildRequesterChannelNotice(params: {
     text: params.text,
     assistantId: params.assistantId,
   };
-  if (
-    shouldUseEphemeral(params.channel, params.requesterChatId) &&
-    params.requesterExternalUserId
-  ) {
-    payload.ephemeral = true;
-    payload.user = params.requesterExternalUserId;
-  }
+  payload.audience = audienceForReader(
+    params.channel,
+
+    params.requesterChatId,
+
+    params.requesterExternalUserId,
+  );
   return payload;
 }
 
@@ -1309,16 +1280,11 @@ const accessRequestResolver: GuardianRequestResolver = {
         };
         // On Slack shared channels, deliver the verification code as ephemeral
         // so only the guardian sees the secret — not all channel members.
-        if (
-          shouldUseEphemeral(
-            ctx.actor.channel,
-            guardianInBandContext.guardianChatId,
-          ) &&
-          ctx.actor.actorExternalUserId
-        ) {
-          codePayload.ephemeral = true;
-          codePayload.user = ctx.actor.actorExternalUserId;
-        }
+        codePayload.audience = audienceForReader(
+          ctx.actor.channel,
+          guardianInBandContext.guardianChatId,
+          ctx.actor.actorExternalUserId,
+        );
         await deliverChannelReply(
           guardianInBandContext.replyCallbackUrl,
           codePayload,
@@ -1339,9 +1305,9 @@ const accessRequestResolver: GuardianRequestResolver = {
         codeDelivered &&
         ctx.actor.channel === "slack" &&
         guardianUserId &&
-        !guardianInBandContext.guardianChatId.startsWith("D")
+        !isSlackDmConversation(guardianInBandContext.guardianChatId)
       ) {
-        const dmCallbackUrl = stripThreadTsParam(
+        const dmCallbackUrl = stripTurnDestination(
           guardianInBandContext.replyCallbackUrl,
         );
 
@@ -1543,13 +1509,13 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
               text: `Your request to use "${request.toolName}" has been denied by the guardian.`,
               assistantId,
             };
-          if (
-            shouldUseEphemeral(request.sourceChannel ?? "", requesterChatId) &&
-            request.requesterExternalUserId
-          ) {
-            grantDenialPayload.ephemeral = true;
-            grantDenialPayload.user = request.requesterExternalUserId;
-          }
+          grantDenialPayload.audience = audienceForReader(
+            request.sourceChannel,
+
+            requesterChatId,
+
+            request.requesterExternalUserId,
+          );
           await deliverChannelReply(
             channelDeliveryContext.replyCallbackUrl,
             grantDenialPayload,
@@ -1642,13 +1608,13 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
             text: `Your request to use "${request.toolName}" has been approved. Please retry your request.`,
             assistantId,
           };
-        if (
-          shouldUseEphemeral(request.sourceChannel ?? "", requesterChatId) &&
-          request.requesterExternalUserId
-        ) {
-          grantApprovalPayload.ephemeral = true;
-          grantApprovalPayload.user = request.requesterExternalUserId;
-        }
+        grantApprovalPayload.audience = audienceForReader(
+          request.sourceChannel,
+
+          requesterChatId,
+
+          request.requesterExternalUserId,
+        );
         await deliverChannelReply(
           channelDeliveryContext.replyCallbackUrl,
           grantApprovalPayload,

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -31,6 +31,14 @@ mock.module("../../daemon/conversation-store.js", () => ({
   getOrCreateConversation: async () => fakeConversation,
 }));
 
+// Vision capability of the image pin's target profile. Install-dependent in
+// production (a BYO provider resolves the profile key through its own column
+// of the intent matrix), so it is scripted rather than read from a catalog.
+let pinProfileSupportsVision = true;
+mock.module("../../plugin-api/vision-support.js", () => ({
+  doesSupportVision: () => pinProfileSupportsVision,
+}));
+
 // Conversation-CRUD doubles for the teardown transcript-hygiene pass. The
 // real module is spread so every other export keeps its production behavior;
 // only the functions the hygiene pass (and discard) touch are recorded.
@@ -133,6 +141,7 @@ interface FakeConversation {
     opts?: { decisionContext?: string },
   ) => void;
   runAgentLoop: (...args: unknown[]) => Promise<void>;
+  getMessages: () => Array<{ role: string; content: unknown[] }>;
   abort: (reason?: unknown) => void;
   loadFromDb: () => Promise<void>;
   toolsDisabledDepth: number;
@@ -149,6 +158,8 @@ function makeFakeConversation(opts: {
   onPersist?: (attempt: number) => void;
   /** Workspace root; pass empty to model a missing boundary. */
   workingDir?: string;
+  /** In-memory history the profile pin reads; undefined models a text-only call. */
+  messages?: Array<{ role: string; content: unknown[] }>;
 }) {
   const waitForIdleCalls: WaitForIdleCall[] = [];
   const confirmationDecisions: Array<{ requestId: string; decision: string }> =
@@ -206,6 +217,7 @@ function makeFakeConversation(opts: {
       confirmationDecisions.push({ requestId, decision });
     },
     runAgentLoop: () => (opts.runAgentLoop ?? (async () => {}))(),
+    getMessages: () => opts.messages ?? [],
     abort: () => {},
     loadFromDb: async () => {
       opts.events?.push("loadFromDb");
@@ -2165,3 +2177,105 @@ describe("transcript hygiene (teardown pass)", () => {
     expect(crudLog.deletes).toContain("assistant-row-1");
   });
 });
+
+describe("startVoiceTurn image-bearing profile pin", () => {
+  /** A persisted user message carrying a photo taken mid-call. */
+  const PHOTO_HISTORY = [
+    { role: "user", content: [{ type: "text", text: "here's a photo:" }] },
+    {
+      role: "user",
+      content: [
+        { type: "text", text: "here's a photo:" },
+        { type: "image", source: { type: "base64", data: "abc" } },
+      ],
+    },
+  ];
+
+  beforeEach(() => {
+    pinProfileSupportsVision = true;
+  });
+
+  async function runOptionsFor(opts: {
+    messages?: Array<{ role: string; content: unknown[] }>;
+    turn?: Record<string, unknown>;
+  }): Promise<Record<string, unknown>> {
+    const fake = makeFakeConversation({
+      processing: false,
+      ...(opts.messages ? { messages: opts.messages } : {}),
+    });
+    fakeConversation = fake.conversation;
+    let runOptions: Record<string, unknown> = {};
+    fake.conversation.runAgentLoop = async (...args: unknown[]) => {
+      runOptions = args[2] as Record<string, unknown>;
+    };
+    await startVoiceTurn({ ...makeTurnOptions(), ...(opts.turn ?? {}) });
+    return runOptions;
+  }
+
+  test("a text-only call keeps the call-site profile", async () => {
+    const runOptions = await runOptionsFor({});
+
+    expect(runOptions.overrideProfile).toBeUndefined();
+    expect(runOptions.forceOverrideProfile).toBeUndefined();
+  });
+
+  test("an image in history pins the image-capable profile", async () => {
+    // `callAgent`'s balanced profile carries no guarantee that its model takes
+    // an image, and a model that rejects one fails the whole leg.
+    const runOptions = await runOptionsFor({ messages: PHOTO_HISTORY });
+
+    expect(runOptions.overrideProfile).toBe("latency-optimized");
+    // callAgent is not `mainAgent`, so an unforced override would sit below
+    // the call-site profile and never apply.
+    expect(runOptions.forceOverrideProfile).toBe(true);
+  });
+
+  test("an image nested in a tool result counts too", async () => {
+    const runOptions = await runOptionsFor({
+      messages: [
+        {
+          role: "user",
+          content: [
+            {
+              type: "tool_result",
+              contentBlocks: [{ type: "image", source: { data: "abc" } }],
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(runOptions.overrideProfile).toBe("latency-optimized");
+  });
+
+  test("a front-door leg is left alone — its own call site pins it", async () => {
+    const runOptions = await runOptionsFor({
+      messages: PHOTO_HISTORY,
+      turn: { routingLeg: "front-door" },
+    });
+
+    expect(runOptions.overrideProfile).toBeUndefined();
+    expect(runOptions.callSite).toBe("voiceFrontDoor");
+  });
+
+  test("no pin when the pin target can't take an image either", async () => {
+    // Fireworks: `latency-optimized` resolves to a text-only model while
+    // `balanced` is vision-capable, so pinning would break the very turn the
+    // pin exists to save.
+    pinProfileSupportsVision = false;
+
+    const runOptions = await runOptionsFor({ messages: PHOTO_HISTORY });
+
+    expect(runOptions.overrideProfile).toBeUndefined();
+    expect(runOptions.forceOverrideProfile).toBeUndefined();
+  });
+
+  test("an explicit routing pin wins over the image pin", async () => {
+    const runOptions = await runOptionsFor({
+      messages: PHOTO_HISTORY,
+      turn: { overrideProfile: "quality-optimized" },
+    });
+
+    expect(runOptions.overrideProfile).toBe("quality-optimized");
+  });
+});

package/src/calls/voice-session-bridge.ts

@@ -35,8 +35,9 @@ import {
   updateMessageContent,
 } from "../persistence/conversation-crud.js";
 import { VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND } from "../plugin-api/constants.js";
+import { doesSupportVision } from "../plugin-api/vision-support.js";
 import { pinnedListeningLanguage } from "../providers/speech-to-text/provider-catalog.js";
-import type { ContentBlock } from "../providers/types.js";
+import type { ContentBlock, Message } from "../providers/types.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
@@ -67,6 +68,40 @@ import {
 
 const log = getLogger("voice-session-bridge");
 
+/**
+ * Profile an image-bearing voice leg is pinned to.
+ *
+ * The latency-class profile is the one voice already leans on (it fronts every
+ * turn through `voiceFrontDoor`); `callAgent`'s `balanced` profile carries no
+ * guarantee that its model takes images, and a model that rejects an image
+ * fails the whole leg rather than degrading it.
+ *
+ * Whether THIS profile takes images is an install-level question, not a
+ * constant: a BYO provider resolves the key through its own column of the
+ * intent matrix, and on Fireworks that lands on a text-only model while its
+ * `balanced` column is vision-capable. Pinning there would break the exact
+ * turns this pin exists to save, hence the capability check at the call site.
+ */
+const VOICE_IMAGE_PROFILE = "latency-optimized";
+
+/**
+ * Does this conversation's history carry an image?
+ *
+ * Images persist inline and are re-sent on every later turn, so one photo
+ * taken mid-call makes every remaining turn of that call an image turn -- the
+ * check is over the whole history, not just this turn's own content.
+ */
+function conversationCarriesImage(messages: readonly Message[]): boolean {
+  return messages.some((message) =>
+    message.content.some(
+      (block) =>
+        block.type === "image" ||
+        (block.type === "tool_result" &&
+          block.contentBlocks?.some((nested) => nested.type === "image")),
+    ),
+  );
+}
+
 /**
  * Front-door decision rule with the registry-derived capability digest. The
  * front-door leg runs toolless (see the `toolsDisabledDepth` bracket in
@@ -1657,6 +1692,23 @@ export async function startVoiceTurn(
         conversation.toolsDisabledDepth++;
         frontDoorToolsSuppressed = true;
       }
+      // Resolved once here rather than inside the options literal below, so
+      // the history scan happens once per leg. A front-door leg is skipped:
+      // its own call site already resolves to the same profile. The
+      // capability check comes before the scan because it is the cheaper of
+      // the two and it decides whether the pin is worth anything at all.
+      const carriesImage =
+        opts.routingLeg !== "front-door" &&
+        doesSupportVision(VOICE_IMAGE_PROFILE) &&
+        conversationCarriesImage(conversation.getMessages());
+      if (carriesImage) {
+        log.info(
+          { turnId, routingLeg: opts.routingLeg ?? null },
+          "Voice leg carries an image; pinning the image-capable profile",
+        );
+      }
+      const profilePin =
+        opts.overrideProfile ?? (carriesImage ? VOICE_IMAGE_PROFILE : null);
       await conversation.runAgentLoop(persistedContent, messageId, {
         onEvent: (msg: AssistantEvent) => {
           if (msg.type === "assistant_turn_start") {
@@ -1737,11 +1789,13 @@ export async function startVoiceTurn(
         // strong escalation profile. `forceOverrideProfile` floats it above the
         // callAgent call-site layers (callAgent is not `mainAgent`, so the
         // override would otherwise sit below the call-site profile).
-        ...(opts.overrideProfile != null
-          ? {
-              overrideProfile: opts.overrideProfile,
-              forceOverrideProfile: true,
-            }
+        //
+        // An explicit routing pin wins; failing that, a leg whose history
+        // carries an image is pinned to a profile whose model takes one. A
+        // front-door leg needs neither: its own call site already resolves
+        // there.
+        ...(profilePin != null
+          ? { overrideProfile: profilePin, forceOverrideProfile: true }
           : {}),
       });
       if (lastError) {