@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/src/config/default-profile-catalog.ts

@@ -73,7 +73,7 @@ type ProfileImpls = Record<DefaultProfileKey, DefaultProfileTemplate>;
  */
 const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   balanced: {
-    model: "gpt-5.6-luna",
+    model: "accounts/fireworks/models/glm-5p2",
     provider: "vellum",
     source: "managed",
     label: "Balanced",
@@ -130,8 +130,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     // provisioned in every environment, and it alone selects the upstream:
     // `provider` below is the provider-agnostic managed sentinel, so
     // `getManagedUpstream` resolves the real upstream from the model's catalog
-    // owner. Sharing `balanced`'s model is deliberate: the split is effort
-    // and thinking, and this model is the one live-voice TTFT drives validated.
+    // owner. This model is the one live-voice TTFT drives validated.
     model: "gpt-5.6-luna",
     provider: "vellum",
     source: "managed",
@@ -165,8 +164,8 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
  * arm is remote input, and an object lookup would resolve `constructor` or
  * `toString` to an inherited `Object.prototype` member instead of missing.
  *
- * `glm-5p2` is text-only: Balanced does not pass `doesSupportVision` on that
- * arm, so image input routes through the image-fallback captioning plugin.
+ * `glm-5p2` names the same model as the shipped pin and stays in the table so
+ * the arm keeps its meaning if the shipped pin moves again.
  */
 const BALANCED_EXPERIMENT_MODELS = new Map<string, string>([
   ["terra", "gpt-5.6-terra"],
@@ -206,7 +205,7 @@ const CHATGPT_PROFILE_IMPLS: ProfileImpls = {
     source: "managed",
     label: "Balanced",
     description: "Good balance of quality, cost, and speed",
-    // Matches the vellum column's Balanced (same model): the Codex path
+    // Matches the vellum column's Balanced token budget: the Codex path
     // sends no max_output_tokens, so this only sizes internal budgeting.
     maxTokens: 32000,
     effort: "high",

package/src/config/feature-flag-registry.json

@@ -92,14 +92,6 @@
       "description": "Enable the Quick Input popover on right-click of the menu bar icon",
       "defaultEnabled": false
     },
-    {
-      "id": "companion-surface",
-      "scope": "client",
-      "key": "companion-surface",
-      "label": "Companion Surface",
-      "description": "Show the macOS companion surface: the floating avatar that carries Talk, Type and the running call, and its tray item. Read in the Electron main process, which decides whether the window opens at all",
-      "defaultEnabled": false
-    },
     {
       "id": "expand-completed-steps",
       "scope": "client",
@@ -108,14 +100,6 @@
       "description": "Auto-expand completed tool call step groups instead of showing them collapsed",
       "defaultEnabled": false
     },
-    {
-      "id": "collapse-assistant-intermediates",
-      "scope": "client",
-      "key": "collapse-assistant-intermediates",
-      "label": "Collapse Assistant Intermediates",
-      "description": "Collapse completed intermediary assistant activity behind Earlier activity while keeping the final response visible",
-      "defaultEnabled": false
-    },
     {
       "id": "backward-releases",
       "scope": "assistant",
@@ -152,8 +136,16 @@
       "id": "fork-from-message",
       "scope": "client",
       "key": "fork-from-message",
-      "label": "Fork from Message",
-      "description": "Show the 'Fork from here' option in message overflow menus",
+      "label": "Internal Thread Actions (legacy key)",
+      "description": "Legacy key for `internal-thread-actions`. The client grants the internal thread affordances when either key is enabled, so the platform may serve the gate under either name. Declared here so the flag mapper keeps the value instead of dropping it as undeclared.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "internal-thread-actions",
+      "scope": "client",
+      "key": "internal-thread-actions",
+      "label": "Internal Thread Actions",
+      "description": "Show the internal thread affordances: 'Fork from here' on messages, 'Fork Conversation', 'Analyze Conversation', and 'Copy conversation ID' in the thread menu, plus the LLM inspector surfaces. The flag is the sole gate: any session that enables it gets the affordances, including local sessions with no platform identity.",
       "defaultEnabled": false
     },
     {
@@ -237,11 +229,11 @@
       "defaultEnabled": false
     },
     {
-      "id": "web-remote-ingress",
+      "id": "paired-devices-ui",
       "scope": "client",
-      "key": "web-remote-ingress",
-      "label": "Web Remote Ingress",
-      "description": "Show the pair-a-device card in web settings. Visibility only; pairing itself is always available.",
+      "key": "paired-devices-ui",
+      "label": "Paired Devices UI",
+      "description": "Show the paired-devices list and revoke controls inside the pair-a-device settings card. Visibility only; `vellum devices` on the host stays available.",
       "defaultEnabled": false
     },
     {
@@ -324,14 +316,6 @@
       "description": "Persist chat secret redactions as sentinel markers instead of the legacy HTML marker, enriched with the vault identity when the value byte-matches a credential revealed this turn. Also gates the `credentials reveal --for-chat` channel and the live-stream swap that replaces an echoed reveal plaintext with its sentinel before emission. Redaction itself is NOT gated: a route-proven reveal plaintext stays out of persisted rows in both modes. Client chip rendering is gated on daemon version, not on this flag.",
       "defaultEnabled": false
     },
-    {
-      "id": "assistant-switcher",
-      "scope": "client",
-      "key": "assistant-switcher",
-      "label": "Assistant Switcher",
-      "description": "Show the Switch Assistant section in General settings, linking to the assistant chooser. Covers local clients, signed-in cloud-hub users, remote-gateway origins, and native mobile shells; remote-gateway desktop browsers hand off to the hub chooser with a self-registration param. Also makes the chooser's selection authoritative for the app's active assistant on every surface including the platform hub, a job that previously belonged to multi-platform-assistant alone.",
-      "defaultEnabled": false
-    },
     {
       "id": "marketing-pricing-takeover",
       "scope": "client",
@@ -356,22 +340,38 @@
       "description": "Gates whether a `chat.assistant_reply` push is suppressed while a Mac desktop client reports itself attended. On by default; turn it off to restore unconditional reply pushes.",
       "defaultEnabled": true
     },
+    {
+      "id": "web-presence-suppression",
+      "scope": "assistant",
+      "key": "web-presence-suppression",
+      "label": "Web Presence Suppression",
+      "description": "Gates whether a `chat.assistant_reply` push is suppressed while a browser tab reports itself visible on that conversation. On by default; turn it off to restore unconditional reply pushes for web-visible conversations.",
+      "defaultEnabled": true
+    },
     {
       "id": "plugin-schedules",
       "scope": "assistant",
       "key": "plugin-schedules",
       "label": "Plugin Schedules",
       "description": "Plugins declare recurring schedules as files that register and run automatically",
-      "defaultEnabled": false
+      "defaultEnabled": true
     },
     {
       "id": "experiment-balanced-model-2026-08-06",
       "scope": "assistant",
       "key": "experiment-balanced-model-2026-08-06",
       "label": "Experiment: Balanced Profile Model",
-      "description": "Multivariate experiment on the model the managed Balanced inference profile resolves to. control = gpt-5.6-luna (the shipped pin); terra = gpt-5.6-terra; glm-5p2 = accounts/fireworks/models/glm-5p2. Only the managed (vellum) implementation moves: ChatGPT-subscription and BYOK installs run the provider the user chose and are outside the experiment. Rollout and targeting are managed in the LaunchDarkly dashboard; any value that is not an arm name resolves to control.",
+      "description": "Multivariate experiment on the model the managed Balanced inference profile resolves to. control = the shipped pin (accounts/fireworks/models/glm-5p2); terra = gpt-5.6-terra; glm-5p2 = accounts/fireworks/models/glm-5p2. Only the managed (vellum) implementation moves: ChatGPT-subscription and BYOK installs run the provider the user chose and are outside the experiment. Rollout and targeting are managed in the LaunchDarkly dashboard; any value that is not an arm name resolves to control.",
       "defaultEnabled": "control",
       "values": ["control", "terra", "glm-5p2"]
+    },
+    {
+      "id": "obscure-credits",
+      "scope": "client",
+      "key": "obscure-credits",
+      "label": "Obscure Credits",
+      "description": "Replaces the dollar amounts on the billing Plan section with a usage-relative view: the current-plan tile trades its price footer for a Usage Balance bar (managed spend this billing cycle against the package's included credits) and the credits spec chip reads \"<Package> usage, reset monthly\" instead of naming a dollar bundle. Spec chips wrap horizontally to fit the shorter labels. Off leaves the Plan section exactly as it ships today.",
+      "defaultEnabled": false
     }
   ]
 }

package/src/config/webhook-routing.ts

@@ -83,6 +83,14 @@ function isIngressExplicitlyDisabled(): boolean {
  *
  * `allowManagedCallbacks` gates both platform tiers: channels that can only be
  * served by a self-hosted ingress pass `false` and never see them.
+ *
+ * The gateway's Telegram webhook reconciler implements this same resolution
+ * order when deciding what URL to hand Telegram's setWebhook
+ * (`resolveExpectedTelegramWebhookUrl` in
+ * `gateway/src/telegram/webhook-manager.ts`). The two must stay in agreement:
+ * a tier this derivation reports as configured but the reconciler declines
+ * leaves Telegram setup reporting success while no webhook is ever
+ * registered. Change the tiers in both places or not at all.
  */
 export async function hasWebhookRoutingConfigured(
   allowManagedCallbacks = false,

package/src/context/compactor.ts

@@ -39,6 +39,10 @@ import type {
 } from "../providers/types.js";
 import { type TrustClass } from "../runtime/actor-trust-resolver.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
+import {
+  hasValidJpegStructure,
+  sniffImageMimeType,
+} from "../util/image-conversion.js";
 import { getLogger } from "../util/logger.js";
 import { preModelCallSanitize } from "./outbound-sanitize.js";
 import { stripInjectionsForCompaction } from "./strip-injections.js";
@@ -865,7 +869,8 @@ function resolveTailFloorIndex(messages: Message[], tailIndex: number): number {
 // Retained-image hydration
 // ---------------------------------------------------------------------------
 
-async function buildRetainedImageBlocks(
+/** Exported for unit testing (the corrupt-bytes drop gate). */
+export async function buildRetainedImageBlocks(
   filenames: string[],
   manifest: ManifestEntry[],
 ): Promise<{ blocks: ImageContent[]; resolved: string[]; missing: string[] }> {
@@ -883,7 +888,11 @@ async function buildRetainedImageBlocks(
       missing.push(name);
       continue;
     }
-    const sourceMime = guessMimeFromFilename(name);
+    // Sniff the declared MIME from the stored bytes rather than the filename:
+    // clients derive extensions from user input, and providers reject an image
+    // whose bytes disagree with the declared media type.
+    const sourceMime =
+      sniffImageMimeType(content) ?? guessMimeFromFilename(name);
     // Run the same downscale pass the agent uses when first sending an
     // image. Without this, attachments that exceed the provider's per-image
     // byte limit (Anthropic: 5 MB) crash the next turn after compaction.
@@ -891,6 +900,26 @@ async function buildRetainedImageBlocks(
       content.toString("base64"),
       sourceMime,
     );
+    // Last-line gate before the bytes are baked into the rebuilt history: a
+    // corrupt payload would be rejected by the provider with a 400 on EVERY
+    // subsequent turn, wedging the conversation. Dropping the image loses a
+    // retained picture; shipping it loses the conversation. Format sniffing
+    // alone is not enough for JPEG: a truncated JPEG (e.g. persisted from a
+    // torn conversion-cache read) keeps its SOI header, so JPEG payloads must
+    // also walk to a terminal EOI marker.
+    const optimizedBytes = Buffer.from(optimized.data, "base64");
+    const optimizedFormat = sniffImageMimeType(optimizedBytes);
+    const bytesAreValidImage =
+      optimizedFormat != null &&
+      (optimizedFormat !== "image/jpeg" ||
+        hasValidJpegStructure(optimizedBytes));
+    if (!bytesAreValidImage) {
+      log.warn(
+        { filename: name, attachmentId: entry.attachmentId },
+        "Retained image bytes are not a valid image after transport optimization; dropping",
+      );
+      continue;
+    }
     blocks.push({
       type: "image",
       source: {

package/src/daemon/__tests__/provider-rejection-log-fields.test.ts

@@ -0,0 +1,272 @@
+/**
+ * Tests that an unclassified 4xx provider rejection logs the upstream
+ * response body (bounded) plus the offending request content-part coordinates,
+ * so the failing message can be identified from the daemon log alone.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { AssistantEvent } from "../../api/index.js";
+import { ProviderError } from "../../util/errors.js";
+import * as loggerModule from "../../util/logger.js";
+import type {
+  EventHandlerDeps,
+  EventHandlerState,
+} from "../conversation-agent-loop-handlers.js";
+import {
+  buildProviderRejectionLogFields,
+  MAX_LOGGED_UPSTREAM_BODY_CHARS,
+} from "../provider-rejection-log-fields.js";
+
+const logRecords: Record<string, unknown>[] = [];
+
+mock.module("../../util/logger.js", () => ({
+  ...loggerModule,
+  getLogger: () => ({
+    error: (record: Record<string, unknown>) => {
+      logRecords.push(record);
+    },
+    warn: () => {},
+    info: () => {},
+    debug: () => {},
+    trace: () => {},
+  }),
+}));
+
+// The handlers module binds its logger at import time, so it is loaded
+// dynamically once the logger stub is installed above.
+const { createEventHandlerState, dispatchAgentEvent } =
+  await import("../conversation-agent-loop-handlers.js");
+
+function createDeps(): EventHandlerDeps {
+  return {
+    ctx: {
+      conversationId: "conv-provider-rejection",
+      provider: { name: "openai" },
+      streamThinking: false,
+      emitActivityState: () => {},
+      markWorkspaceTopLevelDirty: () => {},
+      currentTurnSurfaces: [],
+    } as unknown as EventHandlerDeps["ctx"],
+    onEvent: (_msg: AssistantEvent) => {},
+    reqId: "req-provider-rejection",
+    isFirstMessage: false,
+    shouldGenerateTitle: false,
+    rlog: new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }) as unknown as EventHandlerDeps["rlog"],
+    turnChannelContext: {
+      userMessageChannel: "vellum",
+      assistantMessageChannel: "vellum",
+    } as EventHandlerDeps["turnChannelContext"],
+    turnInterfaceContext: {
+      userMessageInterface: "macos",
+      assistantMessageInterface: "macos",
+    } as EventHandlerDeps["turnInterfaceContext"],
+  } as EventHandlerDeps;
+}
+
+describe("buildProviderRejectionLogFields", () => {
+  test("carries the verbatim upstream body", () => {
+    // GIVEN a provider rejection that captured the upstream 400 body
+    const rawBody = JSON.stringify({
+      error: {
+        message: "Invalid body: failed to parse JSON value from the request.",
+        type: "invalid_request_error",
+        code: "invalid_body",
+      },
+    });
+    const error = new ProviderError(
+      "API error (400): Invalid body",
+      "openai",
+      400,
+      {
+        rawBody,
+        apiErrorCode: "invalid_body",
+        apiErrorType: "invalid_request_error",
+        requestId: "req_abc123",
+      },
+    );
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the body and the upstream metadata ride the record
+    expect(fields.upstreamErrorBody).toBe(rawBody);
+    expect(fields.upstreamErrorBodyTruncated).toBeUndefined();
+    expect(fields.apiErrorCode).toBe("invalid_body");
+    expect(fields.apiErrorType).toBe("invalid_request_error");
+    expect(fields.requestId).toBe("req_abc123");
+  });
+
+  test("bounds the body to 4 KB and flags the truncation", () => {
+    // GIVEN an upstream body larger than the logged ceiling
+    const rawBody = "x".repeat(MAX_LOGGED_UPSTREAM_BODY_CHARS + 500);
+    const error = new ProviderError("API error (400): huge", "openai", 400, {
+      rawBody,
+    });
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the logged body stops at the ceiling
+    expect(fields.upstreamErrorBody).toHaveLength(
+      MAX_LOGGED_UPSTREAM_BODY_CHARS,
+    );
+    // AND the record says the body was cut
+    expect(fields.upstreamErrorBodyTruncated).toBe(true);
+  });
+
+  test("parses the offending content-part coordinates for oversized strings", () => {
+    // GIVEN an oversized-content-part rejection naming the request position
+    const error = new ProviderError(
+      "API error (400): Invalid 'input[191].content[1].text': string too long. Expected a string with maximum length 10485760, but got a string with length 11436754 instead.",
+      "openai",
+      400,
+      { apiErrorCode: "string_above_max_length" },
+    );
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the message and content indices are logged for a follow-up query
+    expect(fields.offendingMessageIndex).toBe(191);
+    expect(fields.offendingContentIndex).toBe(1);
+  });
+
+  test("parses coordinates out of the Chat Completions `messages[N]` shape", () => {
+    // GIVEN a rejection using the Chat Completions request shape
+    const error = new ProviderError(
+      "API error (400): Invalid 'messages[7].content[0].text': string too long.",
+      "openai",
+      400,
+      { apiErrorCode: "string_above_max_length" },
+    );
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the same coordinates are extracted
+    expect(fields.offendingMessageIndex).toBe(7);
+    expect(fields.offendingContentIndex).toBe(0);
+  });
+
+  test("leaves coordinates absent for codes that carry no content-part pointer", () => {
+    // GIVEN a rejection whose code is outside the narrow tap
+    const error = new ProviderError(
+      "API error (400): Invalid 'input[3].content[0].text': something else.",
+      "openai",
+      400,
+      { apiErrorCode: "model_not_found" },
+    );
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN no coordinates are inferred from a coincidental match
+    expect(fields.offendingMessageIndex).toBeUndefined();
+    expect(fields.offendingContentIndex).toBeUndefined();
+  });
+
+  test("scrubs secrets out of the upstream body", () => {
+    // GIVEN an upstream body that echoed back a credential
+    const projectKey = `sk-proj-${"A".repeat(48)}`;
+    const error = new ProviderError("API error (400): bad key", "openai", 400, {
+      rawBody: JSON.stringify({
+        error: { message: `Incorrect API key provided: ${projectKey}` },
+        headers: { authorization: "Bearer some-token-value" },
+      }),
+    });
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the credential never reaches the log record
+    expect(fields.upstreamErrorBody).not.toContain(projectKey);
+    expect(fields.upstreamErrorBody).not.toContain("some-token-value");
+    expect(fields.upstreamErrorBody).toContain("[REDACTED]");
+  });
+
+  test("reports a null body for errors that are not provider errors", () => {
+    // GIVEN a non-provider error
+    const error = new Error("socket hang up");
+
+    // WHEN diagnostic log fields are built for it
+    const fields = buildProviderRejectionLogFields(error);
+
+    // THEN the body is explicitly null rather than missing
+    expect(fields.upstreamErrorBody).toBeNull();
+  });
+});
+
+describe("unclassified 4xx log line", () => {
+  let state: EventHandlerState;
+
+  beforeEach(() => {
+    logRecords.length = 0;
+    state = createEventHandlerState();
+  });
+
+  test("includes the upstream response body", async () => {
+    // GIVEN an unclassified 4xx provider rejection carrying the upstream body
+    const rawBody = JSON.stringify({
+      error: {
+        message:
+          "Invalid body: failed to parse JSON value from the request. Common errors include trailing commas.",
+        type: "invalid_request_error",
+        code: "invalid_body",
+      },
+    });
+    const error = new ProviderError(
+      "API error (400): Invalid body: failed to parse JSON value from the request.",
+      "openai",
+      400,
+      { rawBody, apiErrorCode: "invalid_body" },
+    );
+
+    // WHEN the agent loop dispatches the error event
+    await dispatchAgentEvent(state, createDeps(), { type: "error", error });
+
+    // THEN the log record carries the body alongside the existing fields
+    const record = logRecords.find((r) => r.upstreamErrorBody !== undefined);
+    expect(record).toBeDefined();
+    expect(record?.upstreamErrorBody).toBe(rawBody);
+    expect(record?.conversationId).toBe("conv-provider-rejection");
+    expect(record?.statusCode).toBe(400);
+    expect(record?.provider).toBe("openai");
+  });
+
+  test("scrubs secrets out of the error message it logs", async () => {
+    // GIVEN a rejection whose normalized message echoes a credential
+    const error = new ProviderError(
+      "API error (400): rejected request with Authorization: Bearer some-token-value",
+      "openai",
+      400,
+      { rawBody: "{}" },
+    );
+
+    // WHEN the agent loop dispatches the error event
+    await dispatchAgentEvent(state, createDeps(), { type: "error", error });
+
+    // THEN the credential is redacted out of the logged message
+    const record = logRecords.find((r) => r.upstreamErrorBody !== undefined);
+    expect(record?.errorMessage).not.toContain("some-token-value");
+    expect(record?.errorMessage).toContain("Bearer [REDACTED]");
+  });
+
+  test("bounds a huge upstream body to 4 KB", async () => {
+    // GIVEN an unclassified 4xx rejection whose body exceeds the ceiling
+    const error = new ProviderError("API error (400): huge", "openai", 400, {
+      rawBody: "y".repeat(MAX_LOGGED_UPSTREAM_BODY_CHARS * 3),
+    });
+
+    // WHEN the agent loop dispatches the error event
+    await dispatchAgentEvent(state, createDeps(), { type: "error", error });
+
+    // THEN the logged body is capped
+    const record = logRecords.find((r) => r.upstreamErrorBody !== undefined);
+    expect(record?.upstreamErrorBody).toHaveLength(
+      MAX_LOGGED_UPSTREAM_BODY_CHARS,
+    );
+    expect(record?.upstreamErrorBodyTruncated).toBe(true);
+  });
+});

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -89,6 +89,7 @@ import {
 } from "../usage/pricing.js";
 import { ProviderError } from "../util/errors.js";
 import { faviconUrlForDomain } from "../util/favicon.js";
+import { redactLogString } from "../util/log-redact.js";
 import { getLogger } from "../util/logger.js";
 import { withSqliteRetry } from "../util/sqlite-retry.js";
 import type { DirectiveRequest } from "./assistant-attachments.js";
@@ -143,6 +144,7 @@ import type {
   WebSearchResultItem,
 } from "./message-types/web-activity.js";
 import { referenceMediaBlocksForPersist } from "./persist-media-references.js";
+import { buildProviderRejectionLogFields } from "./provider-rejection-log-fields.js";
 import { turnOrRestingTrust } from "./trust-context-types.js";
 import type { TurnLatencyTracker } from "./turn-latency-tracker.js";
 
@@ -2708,7 +2710,8 @@ function handleError(
           event.error instanceof ProviderError
             ? event.error.provider
             : undefined,
-        errorMessage: event.error.message,
+        errorMessage: redactLogString(event.error.message),
+        ...buildProviderRejectionLogFields(event.error),
       },
       "Provider rejected request with unclassified 4xx error",
     );

package/src/daemon/conversation-error.ts

@@ -11,6 +11,7 @@ import {
   isImageDimensionsTooLargeError,
   isImageMediaTypeMismatchError,
   isImageUnprocessableError,
+  isImageUnsupportedFormatError,
 } from "../plugins/defaults/image-recovery/detect.js";
 import { ConnectionResolutionError } from "../providers/connection-resolution.js";
 import { PROVIDER_CATALOG } from "../providers/model-catalog.js";
@@ -539,6 +540,18 @@ function classifyCore(
           errorCategory: "image_media_type_mismatch",
         };
       }
+      if (isImageUnsupportedFormatError(message)) {
+        // Same wire-code reuse as image_unprocessable above. The provider read
+        // the bytes and found no image it accepts, so no relabel or resize can
+        // rescue the attachment: name the accepted formats instead.
+        return {
+          code: "IMAGE_TOO_LARGE",
+          userMessage:
+            "An image in this conversation is not in a format the AI provider accepts (PNG, JPEG, GIF, and WebP are). Remove or convert it and send your message again.",
+          retryable: false,
+          errorCategory: "image_unsupported_format",
+        };
+      }
       if (isVisionNotSupportedError(message)) {
         return visionNotSupportedClassification();
       }

package/src/daemon/conversation-messaging.ts

@@ -69,6 +69,7 @@ import type { UserMessageAttachment } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type { TrustContext } from "./trust-context-types.js";
 import { restingTrust } from "./trust-context-types.js";
+import { postUnsendableImageNotice } from "./unsendable-image-notice.js";
 
 const log = getLogger("conversation-messaging");
 
@@ -855,7 +856,6 @@ export async function persistQueuedMessageBody(
       filePath: attachment.filePath,
     }),
   );
-  const cleanMessage = await createUserMessage(content, attachmentInputs);
   let pushedToHistory = false;
 
   try {
@@ -1015,6 +1015,14 @@ export async function persistQueuedMessageBody(
       attachmentInputs,
     );
 
+    // The turn sees exactly what was persisted: an attachment rejected during
+    // materialization is absent from both, so a file the store refused cannot
+    // reach the model through the in-memory message.
+    const sentAttachments = preparedAttachments.map(
+      (p) => attachmentInputs[p.position],
+    );
+    const cleanMessage = await createUserMessage(content, sentAttachments);
+
     // When displayContent is provided (e.g. original text before recording
     // intent stripping), persist that to DB so users see the full message
     // after restart. The in-memory userMessage (sent to the LLM) still uses
@@ -1119,7 +1127,7 @@ export async function persistQueuedMessageBody(
 
     const llmMessage = enrichMessageWithSourcePaths(
       cleanMessage,
-      attachmentInputs,
+      sentAttachments,
     );
     log.info(
       {
@@ -1144,6 +1152,18 @@ export async function persistQueuedMessageBody(
       );
     }
 
+    // Read after the content is final (including any link-failure repair), so
+    // the notice describes the blocks the send boundary will actually see.
+    const persistedImages = preparedAttachments.flatMap((p, idx) => {
+      const block = repairedBlocks?.[idx] ?? p.block;
+      if (block.type !== "image") {
+        return [];
+      }
+      const { filename } = attachmentInputs[p.position];
+      return [{ filename, source: block.source }];
+    });
+    await postUnsendableImageNotice(ctx.conversationId, persistedImages);
+
     return { id: persistedUserMessage.id, deduplicated: false };
   } catch (err) {
     if (pushedToHistory) {

package/src/daemon/conversation-process.ts

@@ -1827,6 +1827,13 @@ export interface ProcessMessageOptions {
   displayContent?: string;
   /** JWT-verified committer principal for turn-scoped host-proxy authorization. */
   sourceActorPrincipalId?: string;
+  /**
+   * The actor this turn is being started for. Stamped onto the conversation
+   * before history is scoped, so the run hydrates as its committer rather
+   * than as whoever last left the resting slot set. Callers with no actor of
+   * their own (internal dispatch) omit it and the resting actor stands.
+   */
+  trustContext?: TrustContext;
   /**
    * True when this turn was auto-sent on the user's behalf rather than typed
    * (see `PersistMessageOptions.scripted`). Forwarded to persistence so the
@@ -1873,7 +1880,11 @@ export async function processMessage(
     sourceActorPrincipalId,
     scripted,
     metadata: callerMetadata,
+    trustContext: committingTrustContext,
   } = options;
+  if (committingTrustContext) {
+    conversation.setTrustContext(committingTrustContext);
+  }
   await conversation.ensureActorScopedHistory();
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.