@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/src/runtime/routes/conversation-query-routes.ts

@@ -48,6 +48,7 @@ import {
 import { AssistantConfigSchema } from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
 import {
+  collectFallbackProfileIssues,
   DefaultProviderSchema,
   LLMConfigBase,
   LLMConfigFragment,
@@ -156,6 +157,7 @@ type LlmContextRouteResult = Omit<LlmContextNormalizationResult, "summary"> & {
 import {
   CODE_OWNED_PROFILE_NAMES,
   getEffectiveProfilesForProvider,
+  getUserSelectableProfilesForProvider,
   INVARIANT_PROFILE_NAMES,
   MANAGED_PROFILE_NAMES,
   resolveDefaultProfileForProvider,
@@ -241,6 +243,13 @@ function replaceInferenceProfileConfig(
   for (const key of INFERENCE_PROFILE_UI_KEYS) {
     delete nextProfile[key];
   }
+  // Converting a profile to a mix is an explicit replacement: a mix carries
+  // no model route of its own to fall back from, so an existing
+  // `fallbackProfile` pointer is dropped rather than preserved alongside
+  // `mix` (a combination `LLMSchema` rejects on the next full reload).
+  if (fragment.mix != null) {
+    delete nextProfile.fallbackProfile;
+  }
   const fragmentTopLevel = { ...fragment };
   delete fragmentTopLevel.contextWindow;
   profiles[name] = { ...nextProfile, ...fragmentTopLevel };
@@ -891,7 +900,7 @@ function overlayEffectiveProfilesForWire(config: unknown): void {
   if (!existingLlm) {
     root.llm = llm;
   }
-  llm.profiles = getEffectiveProfilesForProvider(
+  llm.profiles = getUserSelectableProfilesForProvider(
     readPlainObject(llm.profiles) as Record<string, ProfileEntry> | undefined,
     getConfig().llm.defaultProvider ?? null,
   );
@@ -1399,6 +1408,28 @@ function assertRoutableIdentityEntries(
   }
 }
 
+/**
+ * Reject writes that would persist unsupported `fallbackProfile` metadata.
+ * Automatic fallbacks are code-owned for managed default profiles. The write
+ * paths save raw config without a full-schema parse, so this check keeps a
+ * custom pointer from reaching disk. It runs unconditionally so an existing
+ * hand-edited pointer blocks unrelated rewrites until the user clears it with
+ * `null`.
+ */
+function assertCodeOwnedFallbackProfiles(raw: Record<string, unknown>): void {
+  const llm = readPlainObject(raw.llm);
+  const profiles = readPlainObject(llm?.profiles);
+  // The sibling `llm.defaultProvider` decides whether the managed backups are
+  // valid fallback targets: they resolve on the managed column alone.
+  const issues = collectFallbackProfileIssues(
+    profiles ?? undefined,
+    llm?.defaultProvider,
+  );
+  if (issues.length > 0) {
+    throw new BadRequestError(issues.map((issue) => issue.message).join(" "));
+  }
+}
+
 export async function commitConfigWrite(
   raw: Record<string, unknown>,
   opLabel: string,
@@ -1411,6 +1442,7 @@ export async function commitConfigWrite(
   completeChangedCustomProfiles(preWrite, raw);
   assertInvariantProfilesPreserved(preWrite, raw);
   assertRoutableIdentityEntries(preWrite, raw);
+  assertCodeOwnedFallbackProfiles(raw);
 
   // Suppress the file-watcher callback for the duration of the debounce
   // window. Without this, the ConfigWatcher detects the config.json write
@@ -1714,6 +1746,18 @@ async function handleReplaceInferenceProfile({
   const isManaged =
     MANAGED_PROFILE_NAMES.has(name) &&
     (existingProfile == null || existingProfile.source === "managed");
+  if (CODE_OWNED_PROFILE_NAMES.has(name)) {
+    // A code-owned profile resolves from the catalog whatever the workspace
+    // holds, so even a status re-enable would persist a stub that never
+    // governs anything. Reject the write rather than accept a silent no-op.
+    // Checked ahead of the availability gate below so the code-owned backups,
+    // which are always available yet are not `DEFAULT_PROFILE_KEYS` members,
+    // report why the write is refused rather than claiming they do not exist.
+    throw new BadRequestError(
+      `Profile "${name}" is code-owned and cannot be edited. ` +
+        `Duplicate it to a custom profile to customize.`,
+    );
+  }
   // A flag-gated managed name (`os-beta`) with no materialized entry cannot
   // be patched: it only resolves while the flag reconcile has created its
   // stub, so writing status here would persist an entry that fights the
@@ -1728,15 +1772,6 @@ async function handleReplaceInferenceProfile({
       `Profile "${name}" is not currently available and cannot be edited.`,
     );
   }
-  if (CODE_OWNED_PROFILE_NAMES.has(name)) {
-    // A code-owned profile resolves from the catalog whatever the workspace
-    // holds, so even a status re-enable would persist a stub that never
-    // governs anything. Reject the write rather than accept a silent no-op.
-    throw new BadRequestError(
-      `Profile "${name}" is code-owned and cannot be edited. ` +
-        `Duplicate it to a custom profile to customize.`,
-    );
-  }
   if (isManaged) {
     // Managed profiles are daemon-seeded and read-only — the commit guard
     // (`assertInvariantProfilesPreserved`) rejects every write to them
@@ -1808,6 +1843,59 @@ async function handleReplaceInferenceProfile({
         );
       }
     });
+    // A fallback target must stay a standard profile: converting one to a
+    // mix would leave another profile's fallbackProfile pointing at a mix,
+    // which `LLMSchema.superRefine` rejects on the next full reparse.
+    for (const [otherName, other] of Object.entries(existingProfiles)) {
+      if (otherName !== name && other?.fallbackProfile === name) {
+        throw new BadRequestError(
+          `Profile "${otherName}" declares profile "${name}" as its fallbackProfile; a fallback must be a standard profile, so "${name}" cannot become a mix.`,
+        );
+      }
+    }
+  }
+
+  // `fallbackProfile` references another profile by name. As with `mix`, the
+  // cross-profile integrity rules `LLMSchema.superRefine` enforces on
+  // full-config load (target exists, no self-reference, target is not a mix,
+  // single hop) must be checked here against the live profile set; otherwise
+  // a dangling or chained pointer would persist and break the next full
+  // config reparse.
+  if (parsed.data.fallbackProfile != null) {
+    const fallback = parsed.data.fallbackProfile;
+    if (fallback === name) {
+      throw new BadRequestError(
+        `Profile "${name}" cannot declare itself as its fallbackProfile.`,
+      );
+    }
+    const { llm: parsedLlm } = getConfig();
+    const existingProfiles = getEffectiveProfilesForProvider(
+      parsedLlm.profiles,
+      parsedLlm.defaultProvider ?? null,
+    );
+    const target = existingProfiles[fallback];
+    if (target == null) {
+      throw new BadRequestError(
+        `Profile "${name}" declares fallbackProfile "${fallback}" which is not defined.`,
+      );
+    }
+    if (target.mix != null) {
+      throw new BadRequestError(
+        `Profile "${name}" declares fallbackProfile "${fallback}" which is a mix profile; a fallback must be a standard profile.`,
+      );
+    }
+    if (target.fallbackProfile != null) {
+      throw new BadRequestError(
+        `Profile "${name}" declares fallbackProfile "${fallback}" which sets its own fallbackProfile; fallback is a single hop, chains are not allowed.`,
+      );
+    }
+    for (const [otherName, other] of Object.entries(existingProfiles)) {
+      if (otherName !== name && other?.fallbackProfile === name) {
+        throw new BadRequestError(
+          `Profile "${otherName}" already declares profile "${name}" as its fallbackProfile; fallback is a single hop, chains are not allowed.`,
+        );
+      }
+    }
   }
 
   // When the UI sends provider but no provider_connection, derive the connection

package/src/runtime/routes/conversation-routes.ts

@@ -39,7 +39,7 @@ import {
   supportsHostProxy,
 } from "../../channels/types.js";
 import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { getConfig } from "../../config/loader.js";
 import {
@@ -1559,7 +1559,7 @@ export async function handleSendMessage(
   }
   if (requestedInferenceProfile !== undefined) {
     const { llm } = getConfig();
-    const profiles = getEffectiveProfilesForProvider(
+    const profiles = getUserSelectableProfilesForProvider(
       llm.profiles,
       llm.defaultProvider ?? null,
     );

package/src/runtime/routes/credential-routes.ts

@@ -72,7 +72,8 @@ function scrubSecret(secret: string | undefined): string {
   if (secret.length <= 4) {
     return "****";
   }
-  return "****" + secret.slice(-4);
+  // Keep the leading 4 characters so vendor prefixes stay visible.
+  return secret.slice(0, 4) + "****";
 }
 
 function safeGetConnectionByProvider(

package/src/runtime/routes/guardian-approval-interception.ts

@@ -45,7 +45,8 @@ export interface ApprovalInterceptionParams {
   assistantId: string;
   approvalCopyGenerator?: ApprovalCopyGenerator;
   approvalConversationGenerator?: ApprovalConversationGenerator;
-  /** Original approval message timestamp (Slack ts) for editing after resolution. */
+  /** Id of the channel message holding the approval buttons (Slack ts,
+   * Telegram message id), for editing the card after resolution. */
   approvalMessageId?: string;
 }
 
@@ -242,7 +243,7 @@ export async function handleApprovalInterception(
             "Callback request ID does not match any pending interaction, ignoring stale button press",
           );
 
-          // Edit the original Slack approval message to remove stale buttons
+          // Edit the original approval message to remove stale buttons
           if (approvalMessageId) {
             editStaleApprovalMessage({
               replyCallbackUrl,
@@ -260,8 +261,10 @@ export async function handleApprovalInterception(
       const result = await handleChannelDecision(conversationId, cbDecision);
 
       if (result.applied) {
-        // Edit the original Slack approval message to show the decision
-        // and remove stale action buttons.
+        // Edit the original approval message to show the decision and drop
+        // its action buttons. Routed by the callback URL through the channel
+        // edit capability; a transport without edit declines, so this is
+        // safe to attempt on every channel.
         if (approvalMessageId) {
           const decisionOutcome: "approved" | "denied" =
             cbDecision.action === "reject" ? "denied" : "approved";
@@ -276,7 +279,7 @@ export async function handleApprovalInterception(
           }).catch((err) => {
             log.error(
               { err, conversationId, messageTs: approvalMessageId },
-              "Failed to edit Slack approval message after decision",
+              "Failed to edit approval message after decision",
             );
           });
         }
@@ -287,8 +290,8 @@ export async function handleApprovalInterception(
       }
 
       // Race condition: request was already resolved between the stale check
-      // above and the decision attempt.
-      // Edit the original Slack approval message to remove stale buttons
+      // above and the decision attempt. Edit the original approval message to
+      // remove stale buttons
       if (approvalMessageId) {
         editStaleApprovalMessage({
           replyCallbackUrl,
@@ -368,7 +371,7 @@ export async function handleApprovalInterception(
 }
 
 // ---------------------------------------------------------------------------
-// Slack approval message edit helper
+// Approval message edit helper
 // ---------------------------------------------------------------------------
 
 /**
@@ -399,7 +402,7 @@ function editStaleApprovalMessage(params: {
         conversationId: params.conversationId,
         messageId: params.messageId,
       },
-      "Failed to edit stale Slack approval message",
+      "Failed to edit stale approval message",
     );
   });
 }

package/src/runtime/routes/inbound-message-handler.ts

@@ -6,6 +6,7 @@
  * messages reach this handler.
  */
 import type { SourceMetadata } from "@vellumai/gateway-client";
+import { resolveInboundEventKind } from "@vellumai/gateway-client";
 import {
   ADMISSION_POLICY_DEFAULT,
   type AdmissionPolicy,
@@ -281,6 +282,7 @@ export async function handleChannelInbound({
     conversationExternalId?: string;
     externalMessageId?: string;
     content?: string;
+    eventKind?: string;
     isEdit?: boolean;
     actorDisplayName?: string;
     attachmentIds?: string[];
@@ -297,11 +299,16 @@ export async function handleChannelInbound({
     conversationExternalId,
     externalMessageId,
     content,
-    isEdit,
     attachmentIds,
     sourceMetadata,
   } = body;
 
+  // The named event family. Stamped by every gateway producer; replayed
+  // retry payloads arrive unstamped and classify by their flag and sentinel
+  // fields instead.
+  const eventKind = resolveInboundEventKind(body);
+  const isEdit = eventKind === "edit";
+
   if (!body.sourceChannel || typeof body.sourceChannel !== "string") {
     throw new BadRequestError("sourceChannel is required");
   }
@@ -500,7 +507,10 @@ export async function handleChannelInbound({
   // untouched for audit purposes — rendering elides based on the deletedAt
   // marker. Gated behind ingress ACL so non-members cannot drive deletes
   // (matches the edit-intercept policy).
-  if (sourceChannel === "slack" && body.callbackData === "message_deleted") {
+  // The Slack gate mirrors the reaction intercept's: deletes are ingested
+  // from Slack alone today, and each further channel arrives as its own
+  // decision with its own wire shape.
+  if (sourceChannel === "slack" && eventKind === "delete") {
     const deletedMessageTs =
       typeof sourceMetadata?.messageId === "string"
         ? sourceMetadata.messageId
@@ -764,9 +774,10 @@ export async function handleChannelInbound({
   // re-verification challenge — §8.2). The gateway kill switch already
   // dropped `no_one` upstream, but the stage handles it defensively.
   //
-  // Internal channels (`vellum`, `platform`, `a2a`) short-circuit admit
-  // inside `enforceAdmissionPolicy` — defense in depth alongside the
-  // gateway's exempt-channel skip and the PUT-handler's 403.
+  // Exempt channels (`platform`, `a2a`) short-circuit admit inside
+  // `enforceAdmissionPolicy`: defense in depth alongside the gateway's
+  // exempt-channel skip and the PUT-handler's 403. `vellum` is hidden, not
+  // exempt: its floor is evaluated like any enforced channel's.
   //
   // Bootstrap deep-link: when ACL resolved a validated pending_bootstrap
   // session, skip the floor entirely. The bootstrap intercept stage below
@@ -1091,10 +1102,11 @@ export async function handleChannelInbound({
     !result.duplicate &&
     !guardianReplyResult.skipApprovalInterception
   ) {
-    // Extract the original approval message timestamp for Slack button
-    // cleanup. When a Slack block_actions payload is forwarded, the gateway
-    // sets sourceMetadata.messageId to the ts of the message containing
-    // the button. This lets us edit the message after resolution.
+    // The id of the message holding the approval buttons, for editing the
+    // card after resolution. The gateway sets sourceMetadata.messageId on
+    // every button-press forward: Slack's block_actions carry the ts of the
+    // message containing the button, Telegram's callback_query the id of the
+    // message the keyboard is attached to.
     const approvalMessageId =
       typeof sourceMetadata?.messageId === "string"
         ? sourceMetadata.messageId

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -6,10 +6,11 @@
  * Invite code/token redemption is intercepted at gateway ingress; redeemed
  * messages never reach this stage.
  */
-import type {
-  AdmissionPolicy,
-  SourceMetadata,
-  TrustVerdict,
+import {
+  ACCESS_DENIED_NOT_APPROVED_REPLY,
+  type AdmissionPolicy,
+  type SourceMetadata,
+  type TrustVerdict,
 } from "@vellumai/gateway-client";
 
 import type { VerificationSessionWire } from "../../../channels/gateway-verification-sessions.js";
@@ -78,7 +79,7 @@ export function composeAccessDenialReply(params: {
   if (params.guardianNotified) {
     return `Hmm looks like you don't have access to talk to me. I'll let ${resolveGuardianLabel(params.verdict)} know you tried talking to me and get back to you.`;
   }
-  return "Sorry, you haven't been approved to message this assistant.";
+  return ACCESS_DENIED_NOT_APPROVED_REPLY;
 }
 
 // ---------------------------------------------------------------------------
@@ -98,15 +99,20 @@ export interface AclEnforcementParams {
   replyCallbackUrl: string | undefined;
   assistantId: string;
   /**
-   * Effective admission policy for this request (gateway floor resolved with
-   * any per-conversation override). When set, ACL skips its hard-deny paths
-   * when the policy is permissive enough:
+   * Effective admission policy for this request (the gateway's per-channel
+   * floor). When set, ACL skips its hard-deny paths when the policy makes
+   * the floor stage the right place to answer:
    * - `strangers`: non-members and inactive (non-blocked) members are passed
    *   through so the admission floor can emit the final verdict.
-   * - `any_contact`: inactive `pending` members are passed through.
+   * - `guardian_only`: non-members and inactive `pending`/`unverified`
+   *   members are passed through; the floor denies everyone below guardian.
+   * - `any_contact`: inactive `pending`/`unverified` members are passed
+   *   through.
    *
-   * Passing this in avoids having ACL fire guardian notifications and canned
-   * replies for senders who will be admitted by the floor stage anyway.
+   * Passing this in keeps ACL from firing guardian notifications and canned
+   * replies for senders whose final answer belongs to the floor stage:
+   * admission under the permissive floors, or a `guardian_only` denial
+   * delivered without a misleading verification challenge.
    */
   effectiveAdmissionPolicy?: AdmissionPolicy;
   /**
@@ -880,8 +886,7 @@ export async function enforceIngressAcl(
           { sourceChannel, channelId: resolvedMember.channelId },
           "Ingress ACL: member policy deny",
         );
-        const denyReplyText =
-          "Sorry, you haven't been approved to message this assistant.";
+        const denyReplyText = ACCESS_DENIED_NOT_APPROVED_REPLY;
         let denyReplyDelivered = false;
         if (replyCallbackUrl) {
           const denyPayload: Parameters<typeof deliverChannelReply>[1] = {

package/src/runtime/routes/inbound-stages/admission-policy.ts

@@ -7,7 +7,7 @@
  * floor (`sourceMetadata.admissionPolicy`); this stage compares the floor
  * to the resolved trust class's rank and either admits or denies.
  *
- * Deny semantics — see `wave-b-plan.md` §8.2:
+ * Deny semantics (the locked §8.2 decisions):
  *
  * - `shouldChallenge: true` when the policy is one that re-verification
  *   could lift past (`any_contact`, `strangers`). The caller fires the
@@ -66,7 +66,7 @@ export type AdmissionPolicyResult =
        * resolved trust class could clear the floor after verification.
        */
       shouldChallenge: boolean;
-      /** Effective policy that produced the deny (after override resolution). */
+      /** Policy that produced the deny. */
       effectivePolicy: AdmissionPolicy;
     };
 

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -20,6 +20,7 @@
  * `unknown` (drop). Reactions never drive an agent turn.
  */
 import type { SourceMetadata } from "@vellumai/gateway-client";
+import { resolveInboundEventKind } from "@vellumai/gateway-client";
 
 import type { ChannelId, InterfaceId } from "../../../channels/types.js";
 import { getDiskPressureStatus } from "../../../daemon/disk-pressure-guard.js";
@@ -58,16 +59,16 @@ const log = getLogger("runtime-http");
  */
 export function isSlackReactionEvent(body: {
   sourceChannel?: string;
+  eventKind?: string;
   callbackData?: string;
 }): boolean {
-  if (body.sourceChannel !== "slack") {
-    return false;
-  }
-  const cb = body.callbackData;
-  if (typeof cb !== "string") {
-    return false;
-  }
-  return cb.startsWith("reaction:") || cb.startsWith("reaction_removed:");
+  // The Slack gate is deliberate, not residue: Slack is the only channel
+  // whose reactions are ingested today, and widening this is a per-channel
+  // decision made with that channel's reaction wire shape, not a fallthrough.
+  return (
+    body.sourceChannel === "slack" &&
+    resolveInboundEventKind(body) === "reaction"
+  );
 }
 
 /**

package/src/runtime/routes/inbound-stages/transcribe-audio.ts

@@ -53,7 +53,7 @@ export async function tryTranscribeAudioAttachments(
     }
 
     // Resolve STT provider via daemon batch transcriber facade
-    const transcriber = await resolveBatchTranscriber();
+    const transcriber = await resolveBatchTranscriber({ role: "batch" });
     if (!transcriber) {
       return {
         status: "no_provider",

package/src/runtime/routes/index.ts

@@ -93,6 +93,7 @@ import { ROUTES as INFERENCE_PROVIDER_CONNECTION_ROUTES } from "./inference-prov
 import { ROUTES as INFERENCE_SEND_ROUTES } from "./inference-send-routes.js";
 import { ROUTES as INGRESS_STATUS_ROUTES } from "./ingress-status-routes.js";
 import { ROUTES as A2A_ROUTES } from "./integrations/a2a.js";
+import { ROUTES as DISCORD_CONFIG_ROUTES } from "./integrations/discord.js";
 import { ROUTES as SLACK_CHANNEL_CONFIG_ROUTES } from "./integrations/slack/channel.js";
 import { ROUTES as SLACK_CHANNELS_ROUTES } from "./integrations/slack/channels.js";
 import { ROUTES as SLACK_SHARE_ROUTES } from "./integrations/slack/share.js";
@@ -287,6 +288,7 @@ export const ROUTES: RouteDefinition[] = [
   ...SOUNDS_CONFIG_ROUTES,
   ...SKILL_ROUTES,
   ...A2A_ROUTES,
+  ...DISCORD_CONFIG_ROUTES,
   ...SLACK_CHANNEL_CONFIG_ROUTES,
   ...SLACK_CHANNEL_RESOLVE_ROUTES,
   ...SLACK_CHANNELS_ROUTES,

package/src/runtime/routes/inference-profile-session-handler.ts

@@ -14,7 +14,7 @@
 
 import { randomUUID } from "node:crypto";
 
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { loadConfig } from "../../config/loader.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
 import {
@@ -153,7 +153,7 @@ export async function setInferenceProfileSession({
 
   // --- Validate profile ---
   const { llm } = loadConfig();
-  const profiles = getEffectiveProfilesForProvider(
+  const profiles = getUserSelectableProfilesForProvider(
     llm?.profiles,
     llm?.defaultProvider ?? null,
   );

package/src/runtime/routes/inference-profiles-routes.ts

@@ -20,7 +20,7 @@ import { z } from "zod";
 
 import { validateInferenceProfileConfig } from "../../api/constants/profile-config-validation.js";
 import {
-  getEffectiveProfilesForProvider,
+  getUserSelectableProfilesForProvider,
   MANAGED_PROFILE_NAMES,
   resolveDefaultProfileForProvider,
 } from "../../config/default-profile-catalog.js";
@@ -436,8 +436,9 @@ function fragmentFromBody(
 
 /**
  * Enumerate every live reference to profile `name` in the raw `llm` config
- * block: `activeProfile`, `advisorProfile`, each `callSites.<id>.profile`, and
- * every mix arm (`profiles.<mix>.mix[].profile`). Deleting a profile while any
+ * block: `activeProfile`, `advisorProfile`, each `callSites.<id>.profile`,
+ * every mix arm (`profiles.<mix>.mix[].profile`), and every fallback pointer
+ * (`profiles.<p>.fallbackProfile`). Deleting a profile while any
  * of these point at it would leave a dangling reference that `LLMSchema`'s
  * superRefine rejects on the next load — silently resetting the user's chat
  * model or call-site pins. The delete handler rejects instead.
@@ -467,13 +468,17 @@ export function collectProfileReferences(
   const profiles = asPlainObject(llm.profiles);
   if (profiles) {
     for (const [profileName, profileEntry] of Object.entries(profiles)) {
-      const mix = asPlainObject(profileEntry)?.mix;
+      const entry = asPlainObject(profileEntry);
+      const mix = entry?.mix;
       if (
         Array.isArray(mix) &&
         mix.some((arm) => asPlainObject(arm)?.profile === name)
       ) {
         refs.push(`llm.profiles.${profileName}.mix`);
       }
+      if (entry?.fallbackProfile === name) {
+        refs.push(`llm.profiles.${profileName}.fallbackProfile`);
+      }
     }
   }
   return refs;
@@ -514,7 +519,7 @@ function assertSaneMaxTokens(
 
 async function handleListProfiles() {
   const config = getConfigReadOnly();
-  const effective = getEffectiveProfilesForProvider(
+  const effective = getUserSelectableProfilesForProvider(
     config.llm.profiles,
     config.llm.defaultProvider ?? null,
   );
@@ -870,7 +875,7 @@ async function handleSetActiveProfile({ body = {} }: RouteHandlerArgs) {
   // is rejected here instead of silently stripped on the next config load —
   // which would reset the user's chat-model selection.
   const config = getConfigReadOnly();
-  const effective = getEffectiveProfilesForProvider(
+  const effective = getUserSelectableProfilesForProvider(
     config.llm.profiles,
     config.llm.defaultProvider ?? null,
   );
@@ -1011,7 +1016,7 @@ export const ROUTES: RouteDefinition[] = [
       "404": { description: "Profile not found" },
       "409": {
         description:
-          "Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, or a mix arm",
+          "Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, a mix arm, or another profile's fallbackProfile",
       },
     },
     handler: handleDeleteProfile,

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -86,7 +86,7 @@ const savedConnectionResponseSchema = ProviderConnectionSchema.extend({
  * Parse and validate `base_url` and `models` from the request body.
  *
  * `base_url` is only accepted for providers in
- * `PROVIDERS_ALLOWING_CUSTOM_BASE_URL` (openai-compatible and ollama).
+ * `PROVIDERS_ALLOWING_CUSTOM_BASE_URL` (openai-compatible, ollama, opencode).
  * For all other providers, supplying `base_url` returns a 400. This prevents
  * API-key exfiltration: an attacker cannot create an `anthropic` connection
  * with a `base_url` pointing to their own server, which would redirect all
@@ -119,7 +119,7 @@ async function parseCustomProviderFields(
       !PROVIDERS_ALLOWING_CUSTOM_BASE_URL.has(provider)
     ) {
       throw new BadRequestError(
-        `base_url is only valid for openai-compatible and ollama providers. Remove base_url or use a provider that accepts a custom endpoint.`,
+        `base_url is only valid for openai-compatible, ollama, and opencode providers. Remove base_url or use a provider that accepts a custom endpoint.`,
       );
     }
 

package/src/runtime/routes/inference-send-routes.ts

@@ -7,7 +7,7 @@
 
 import { z } from "zod";
 
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import type { ResolutionFallbackReason } from "../../config/llm-resolver.js";
 import { selectWinningProfile } from "../../config/llm-resolver.js";
 import { getConfigReadOnly } from "../../config/loader.js";
@@ -42,7 +42,7 @@ async function handleInferenceSend({ body = {} }: RouteHandlerArgs) {
   // Validate --profile against the configured profile catalog.
   if (profile !== undefined) {
     const { llm } = getConfigReadOnly();
-    const profiles = getEffectiveProfilesForProvider(
+    const profiles = getUserSelectableProfilesForProvider(
       llm?.profiles,
       llm?.defaultProvider ?? null,
     );

package/src/runtime/routes/ingress-status-routes.ts

@@ -24,9 +24,9 @@ import { z } from "zod";
 import {
   getIngressConfigResult,
   isVelayManagedIngress,
-  loadLastTunnelRecord,
   loadPairingTunnelRecord,
   loadRecordedAssistantId,
+  loadRestartTunnelRecord,
 } from "../../daemon/handlers/config-ingress.js";
 import { probeTunnel } from "../../inbound/tunnel-probe.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -100,7 +100,7 @@ async function handleIngressStatus(): Promise<IngressStatusResponse> {
   if (isVelayManagedIngress() && !pairingTunnel) {
     return { state: "unconfigured" };
   }
-  const lastTunnel = pairingTunnel ?? loadLastTunnelRecord();
+  const lastTunnel = loadRestartTunnelRecord();
 
   const publicBaseUrl =
     pairingTunnel?.publicBaseUrl ?? config.publicBaseUrl.trim();