@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/runtime/routes/inference-profiles-routes.ts

@@ -20,7 +20,7 @@ import { z } from "zod";
 
 import { validateInferenceProfileConfig } from "../../api/constants/profile-config-validation.js";
 import {
-  getEffectiveProfilesForProvider,
+  getUserSelectableProfilesForProvider,
   MANAGED_PROFILE_NAMES,
   resolveDefaultProfileForProvider,
 } from "../../config/default-profile-catalog.js";
@@ -436,8 +436,9 @@ function fragmentFromBody(
 
 /**
  * Enumerate every live reference to profile `name` in the raw `llm` config
- * block: `activeProfile`, `advisorProfile`, each `callSites.<id>.profile`, and
- * every mix arm (`profiles.<mix>.mix[].profile`). Deleting a profile while any
+ * block: `activeProfile`, `advisorProfile`, each `callSites.<id>.profile`,
+ * every mix arm (`profiles.<mix>.mix[].profile`), and every fallback pointer
+ * (`profiles.<p>.fallbackProfile`). Deleting a profile while any
  * of these point at it would leave a dangling reference that `LLMSchema`'s
  * superRefine rejects on the next load — silently resetting the user's chat
  * model or call-site pins. The delete handler rejects instead.
@@ -467,13 +468,17 @@ export function collectProfileReferences(
   const profiles = asPlainObject(llm.profiles);
   if (profiles) {
     for (const [profileName, profileEntry] of Object.entries(profiles)) {
-      const mix = asPlainObject(profileEntry)?.mix;
+      const entry = asPlainObject(profileEntry);
+      const mix = entry?.mix;
       if (
         Array.isArray(mix) &&
         mix.some((arm) => asPlainObject(arm)?.profile === name)
       ) {
         refs.push(`llm.profiles.${profileName}.mix`);
       }
+      if (entry?.fallbackProfile === name) {
+        refs.push(`llm.profiles.${profileName}.fallbackProfile`);
+      }
     }
   }
   return refs;
@@ -514,7 +519,7 @@ function assertSaneMaxTokens(
 
 async function handleListProfiles() {
   const config = getConfigReadOnly();
-  const effective = getEffectiveProfilesForProvider(
+  const effective = getUserSelectableProfilesForProvider(
     config.llm.profiles,
     config.llm.defaultProvider ?? null,
   );
@@ -870,7 +875,7 @@ async function handleSetActiveProfile({ body = {} }: RouteHandlerArgs) {
   // is rejected here instead of silently stripped on the next config load —
   // which would reset the user's chat-model selection.
   const config = getConfigReadOnly();
-  const effective = getEffectiveProfilesForProvider(
+  const effective = getUserSelectableProfilesForProvider(
     config.llm.profiles,
     config.llm.defaultProvider ?? null,
   );
@@ -1011,7 +1016,7 @@ export const ROUTES: RouteDefinition[] = [
       "404": { description: "Profile not found" },
       "409": {
         description:
-          "Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, or a mix arm",
+          "Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, a mix arm, or another profile's fallbackProfile",
       },
     },
     handler: handleDeleteProfile,

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -86,7 +86,7 @@ const savedConnectionResponseSchema = ProviderConnectionSchema.extend({
  * Parse and validate `base_url` and `models` from the request body.
  *
  * `base_url` is only accepted for providers in
- * `PROVIDERS_ALLOWING_CUSTOM_BASE_URL` (openai-compatible and ollama).
+ * `PROVIDERS_ALLOWING_CUSTOM_BASE_URL` (openai-compatible, ollama, opencode).
  * For all other providers, supplying `base_url` returns a 400. This prevents
  * API-key exfiltration: an attacker cannot create an `anthropic` connection
  * with a `base_url` pointing to their own server, which would redirect all
@@ -119,7 +119,7 @@ async function parseCustomProviderFields(
       !PROVIDERS_ALLOWING_CUSTOM_BASE_URL.has(provider)
     ) {
       throw new BadRequestError(
-        `base_url is only valid for openai-compatible and ollama providers. Remove base_url or use a provider that accepts a custom endpoint.`,
+        `base_url is only valid for openai-compatible, ollama, and opencode providers. Remove base_url or use a provider that accepts a custom endpoint.`,
       );
     }
 

package/src/runtime/routes/inference-send-routes.ts

@@ -7,7 +7,7 @@
 
 import { z } from "zod";
 
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import type { ResolutionFallbackReason } from "../../config/llm-resolver.js";
 import { selectWinningProfile } from "../../config/llm-resolver.js";
 import { getConfigReadOnly } from "../../config/loader.js";
@@ -42,7 +42,7 @@ async function handleInferenceSend({ body = {} }: RouteHandlerArgs) {
   // Validate --profile against the configured profile catalog.
   if (profile !== undefined) {
     const { llm } = getConfigReadOnly();
-    const profiles = getEffectiveProfilesForProvider(
+    const profiles = getUserSelectableProfilesForProvider(
       llm?.profiles,
       llm?.defaultProvider ?? null,
     );

package/src/runtime/routes/ingress-status-routes.ts

@@ -24,9 +24,9 @@ import { z } from "zod";
 import {
   getIngressConfigResult,
   isVelayManagedIngress,
-  loadLastTunnelRecord,
   loadPairingTunnelRecord,
   loadRecordedAssistantId,
+  loadRestartTunnelRecord,
 } from "../../daemon/handlers/config-ingress.js";
 import { probeTunnel } from "../../inbound/tunnel-probe.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -100,7 +100,7 @@ async function handleIngressStatus(): Promise<IngressStatusResponse> {
   if (isVelayManagedIngress() && !pairingTunnel) {
     return { state: "unconfigured" };
   }
-  const lastTunnel = pairingTunnel ?? loadLastTunnelRecord();
+  const lastTunnel = loadRestartTunnelRecord();
 
   const publicBaseUrl =
     pairingTunnel?.publicBaseUrl ?? config.publicBaseUrl.trim();

package/src/runtime/routes/integrations/discord.ts

@@ -0,0 +1,119 @@
+/**
+ * Route handlers for Discord channel configuration.
+ *
+ * GET    /v1/integrations/discord/config: whether a bot token is stored
+ * POST   /v1/integrations/discord/config: validate and store a bot token
+ * DELETE /v1/integrations/discord/config: clear it, disconnecting the bot
+ *
+ * The bot the assistant is reached through, not the user-scoped `discord`
+ * OAuth provider, which is a separate surface.
+ */
+
+import { z } from "zod";
+
+import {
+  clearDiscordChannelConfig,
+  DiscordChannelConfigResultSchema,
+  getDiscordChannelConfig,
+  setDiscordChannelConfig,
+} from "../../../daemon/handlers/config-discord-channel.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
+import { BadRequestError, ServiceUnavailableError } from "../errors.js";
+import { parseBody } from "../parse-body.js";
+import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
+
+/**
+ * One named schema for the connect body, parsed at the boundary and reused as
+ * the route's declaration. `requestBody` is a codegen signal, not a runtime
+ * check: the router hands the body straight to the handler, so a cast here
+ * would narrow nothing while a bot token flowed to secure storage.
+ */
+const SetDiscordConfigBodySchema = z.object({
+  botToken: z.string().min(1).describe("Discord bot token"),
+});
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+async function handleGetDiscordConfig() {
+  return getDiscordChannelConfig();
+}
+
+async function handleSetDiscordConfig({ body = {} }: RouteHandlerArgs) {
+  const { botToken } = parseBody(SetDiscordConfigBodySchema, body);
+  const result = await setDiscordChannelConfig(botToken);
+  if (!result.success) {
+    throw new BadRequestError(
+      result.error ?? "Failed to set Discord channel config",
+    );
+  }
+  return result;
+}
+
+async function handleClearDiscordConfig() {
+  const result = await clearDiscordChannelConfig();
+  if (!result.success) {
+    // The token is still stored and the bot still connected; a 200 envelope
+    // here reads as a completed disconnect to every generated client.
+    throw new ServiceUnavailableError(
+      result.error ?? "Failed to clear Discord channel config",
+    );
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "integrations_discord_config_get",
+    endpoint: "integrations/discord/config",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Get Discord config",
+    description: "Check whether a Discord bot token is configured.",
+    tags: ["integrations"],
+    responseBody: DiscordChannelConfigResultSchema,
+    handler: () => handleGetDiscordConfig(),
+  },
+  {
+    operationId: "integrations_discord_config_post",
+    endpoint: "integrations/discord/config",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Set Discord config",
+    description:
+      "Validate a Discord bot token and store it. Storing it is what " +
+      "connects the bot: the gateway's Discord client is credential-gated " +
+      "and starts on the watcher's next tick.",
+    tags: ["integrations"],
+    handler: handleSetDiscordConfig,
+    requestBody: SetDiscordConfigBodySchema,
+    responseBody: DiscordChannelConfigResultSchema,
+  },
+  {
+    operationId: "integrations_discord_config_delete",
+    endpoint: "integrations/discord/config",
+    method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Clear Discord config",
+    description:
+      "Clear the stored Discord bot token, which disconnects the bot on the " +
+      "gateway's next watcher tick. Room choices are left alone.",
+    tags: ["integrations"],
+    responseBody: DiscordChannelConfigResultSchema,
+    handler: () => handleClearDiscordConfig(),
+  },
+];

package/src/runtime/routes/llm-call-sites-routes.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 import { CALL_SITE_DEFAULTS } from "../../config/call-site-defaults.js";
-import { getEffectiveProfilesForProvider } from "../../config/default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
 import { loadConfig } from "../../config/loader.js";
 import {
@@ -66,7 +66,7 @@ export type LlmProfilesListResult = z.infer<
 
 async function handleListProfiles(): Promise<LlmProfilesListResult> {
   const { llm } = loadConfig();
-  const profiles = getEffectiveProfilesForProvider(
+  const profiles = getUserSelectableProfilesForProvider(
     llm?.profiles,
     llm?.defaultProvider ?? null,
   );

package/src/runtime/routes/mcp-auth-routes.ts

@@ -15,7 +15,11 @@
 import { z } from "zod";
 
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
-import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
+import {
+  DEFAULT_MCP_RISK_LEVEL,
+  type McpConfig,
+  type McpServerConfig,
+} from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
 import { McpClient } from "../../mcp/client.js";
@@ -312,7 +316,7 @@ async function handleMcpList(_args: {
         status,
         transport: safeTransport as McpServerEntry["transport"],
         enabled,
-        defaultRiskLevel: config.defaultRiskLevel ?? "high",
+        defaultRiskLevel: config.defaultRiskLevel ?? DEFAULT_MCP_RISK_LEVEL,
         hasOAuth,
         hasStaticAuth,
         authType,
@@ -551,10 +555,9 @@ async function handleMcpAdd({
   const { name, transportType, url, command, args, risk, disabled, headers } =
     parseBody(McpAddParams, body);
 
-  const riskLevel = risk ?? "high";
-  if (!["low", "medium", "high"].includes(riskLevel)) {
+  if (risk !== undefined && !["low", "medium", "high"].includes(risk)) {
     throw new BadRequestError(
-      `Invalid risk level: ${riskLevel}. Must be low, medium, or high`,
+      `Invalid risk level: ${risk}. Must be low, medium, or high`,
     );
   }
 
@@ -597,10 +600,13 @@ async function handleMcpAdd({
     );
   }
 
+  // Writing no `defaultRiskLevel` when the caller named none leaves the level
+  // to `McpServerConfigSchema`, so the entry tracks the shipped default
+  // instead of freezing whichever level was current on the day it was added.
   serverMap[name] = {
     transport,
     enabled: !disabled,
-    defaultRiskLevel: riskLevel,
+    ...(risk === undefined ? {} : { defaultRiskLevel: risk }),
   };
 
   // Store auth headers in credential store, not config

package/src/runtime/routes/migration-routes.ts

@@ -44,6 +44,7 @@ import {
 } from "../../security/secure-keys.js";
 import {
   getCredentialMetadata,
+  persistCredentialMetadata,
   upsertCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import { getLogger } from "../../util/logger.js";
@@ -156,7 +157,8 @@ export async function reconcileVellumMetadataFromCes(warningSink: {
       if (getCredentialMetadata("vellum", field)) {
         continue;
       }
-      upsertCredentialMetadata("vellum", field, {});
+      const metadata = upsertCredentialMetadata("vellum", field, {});
+      await persistCredentialMetadata(metadata);
       log.info(
         { field },
         "Reconciled vellum:* metadata entry from CES after import",

package/src/runtime/routes/oauth-pending-flows.ts

@@ -0,0 +1,136 @@
+/**
+ * In-memory registry of in-flight OAuth flows, keyed by a state token.
+ *
+ * Browser-mediated OAuth finishes out of band: the daemon starts a flow, hands
+ * the client a state token, and completes the flow in the background (loopback
+ * capture, device-code poll) or on a later request (a pasted code). The client
+ * polls a status route with the state token to learn the outcome.
+ *
+ * Each caller creates its own registry so flows from different providers never
+ * share a key space. Entries expire after a TTL so the map cannot grow
+ * unbounded; call `cleanupExpired()` when starting a flow.
+ */
+
+const DEFAULT_PENDING_FLOW_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+export type PendingFlowStatus = "pending" | "connected" | "error";
+
+/** Fields every tracked flow carries, whatever the provider or transport. */
+export interface PendingFlowFields {
+  status: PendingFlowStatus;
+  /** Human-readable failure detail, set when `status` is `error`. */
+  error?: string;
+  /** Machine-readable failure code, when the provider supplies one. */
+  errorCode?: string;
+  createdAt: number;
+}
+
+/** A tracked flow: the common fields plus whatever the caller stashed on it. */
+export type PendingFlow<TExtra extends object> = PendingFlowFields & TExtra;
+
+/** The subset of a flow that status routes report back to clients. */
+export interface PendingFlowStatusReport {
+  status: PendingFlowStatus;
+  error?: string;
+  errorCode?: string;
+}
+
+export interface PendingFlowMarkOptions {
+  error?: string;
+  errorCode?: string;
+}
+
+export interface PendingFlowRegistry<TExtra extends object> {
+  /** How long an entry lives before `cleanupExpired()` drops it. */
+  readonly ttlMs: number;
+  /** Track a new pending flow under `state` and return the stored entry. */
+  start(state: string, extra: TExtra): PendingFlow<TExtra>;
+  get(state: string): PendingFlow<TExtra> | undefined;
+  delete(state: string): void;
+  /** Update a tracked flow's status in place, if it still exists. */
+  mark(
+    state: string,
+    status: PendingFlowStatus,
+    options?: PendingFlowMarkOptions,
+  ): void;
+  isExpired(flow: PendingFlowFields, now?: number): boolean;
+  /** Status view of a tracked flow, or `undefined` when there is no such flow. */
+  readStatus(state: string): PendingFlowStatusReport | undefined;
+  /** Drop entries older than the TTL. */
+  cleanupExpired(): void;
+}
+
+export interface PendingFlowRegistryOptions {
+  ttlMs?: number;
+}
+
+export function createPendingFlowRegistry<
+  TExtra extends object = Record<string, never>,
+>(options: PendingFlowRegistryOptions = {}): PendingFlowRegistry<TExtra> {
+  const ttlMs = options.ttlMs ?? DEFAULT_PENDING_FLOW_TTL_MS;
+  const flows = new Map<string, PendingFlow<TExtra>>();
+
+  return {
+    ttlMs,
+
+    start(state, extra) {
+      const flow = {
+        ...extra,
+        status: "pending",
+        createdAt: Date.now(),
+      } as PendingFlow<TExtra>;
+      flows.set(state, flow);
+      return flow;
+    },
+
+    get(state) {
+      return flows.get(state);
+    },
+
+    delete(state) {
+      flows.delete(state);
+    },
+
+    mark(state, status, markOptions) {
+      const flow = flows.get(state);
+      if (!flow) {
+        return;
+      }
+      flow.status = status;
+      if (markOptions?.error !== undefined) {
+        flow.error = markOptions.error;
+      }
+      if (markOptions?.errorCode !== undefined) {
+        flow.errorCode = markOptions.errorCode;
+      }
+    },
+
+    isExpired(flow, now = Date.now()) {
+      return now - flow.createdAt > ttlMs;
+    },
+
+    readStatus(state) {
+      const flow = flows.get(state);
+      if (!flow) {
+        return undefined;
+      }
+      const report: PendingFlowStatusReport = { status: flow.status };
+      if (flow.error !== undefined) {
+        report.error = flow.error;
+      }
+      if (flow.errorCode !== undefined) {
+        report.errorCode = flow.errorCode;
+      }
+      return report;
+    },
+
+    cleanupExpired() {
+      const cutoff = Date.now() - ttlMs;
+      for (const [state, flow] of flows) {
+        if (flow.createdAt < cutoff) {
+          flows.delete(state);
+        }
+      }
+    },
+  };
+}

package/src/runtime/routes/secret-routes.ts

@@ -30,6 +30,8 @@ import {
   scrubStoredCredentialFromTranscripts,
 } from "../../daemon/credential-transcript-scrub.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
+import { syncAvatarToPlatform } from "../../platform/sync-avatar.js";
+import { syncWorkspaceIdentityToPlatform } from "../../platform/sync-identity.js";
 import { maybeReseedCapabilitiesAfterManagedCredential } from "../../plugins/defaults/memory/substrate/boot-maintenance.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
 import { validateAtlasCloudApiKey } from "../../providers/atlascloud/client.js";
@@ -423,6 +425,11 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
         // defaulting; the hook no-ops until the connection is complete.
         // Detached — must not block the response.
         void maybeDefaultSpeechToManaged();
+        // Same last-write-wins shape: the startup syncs no-op before live
+        // registration, so re-enqueue them here. Both dedup and no-op until
+        // the client and assistant id exist.
+        syncWorkspaceIdentityToPlatform();
+        syncAvatarToPlatform();
       }
       log.info({ service, field }, "Credential added via HTTP");
       return { success: true, type, name };

package/src/runtime/routes/stt-routes.ts

@@ -13,9 +13,15 @@ import { extname, join } from "node:path";
 
 import { z } from "zod";
 
-import { listProviderEntries } from "../../providers/speech-to-text/provider-catalog.js";
+import {
+  baseModelFamilyFor,
+  listProviderEntries,
+  listProviderModelFamilies,
+  turnDetectionLanguagesFor,
+} from "../../providers/speech-to-text/provider-catalog.js";
 import { resolveBatchTranscriber } from "../../providers/speech-to-text/resolve.js";
 import { normalizeSttError } from "../../stt/daemon-batch-transcriber.js";
+import type { SttRole } from "../../stt/roles.js";
 import type { BatchTranscriber, SttErrorCategory } from "../../stt/types.js";
 import { SttError } from "../../stt/types.js";
 import { getLogger } from "../../util/logger.js";
@@ -232,10 +238,12 @@ const STT_ERROR_MAP: Record<SttErrorCategory, () => RouteError> = {
  * surfaced verbatim. `null` means nothing is configured at all, and any other
  * throw is an unexpected resolver failure.
  */
-async function resolveBatchTranscriberOrUnavailable(): Promise<BatchTranscriber> {
+async function resolveBatchTranscriberOrUnavailable(
+  role: SttRole,
+): Promise<BatchTranscriber> {
   let transcriber: BatchTranscriber | null;
   try {
-    transcriber = await resolveBatchTranscriber();
+    transcriber = await resolveBatchTranscriber({ role });
   } catch (err) {
     if (err instanceof SttError) {
       throw new ServiceUnavailableError(err.message);
@@ -257,10 +265,30 @@ async function resolveBatchTranscriberOrUnavailable(): Promise<BatchTranscriber>
 // ---------------------------------------------------------------------------
 
 function handleListProviders() {
-  const entries = listProviderEntries();
+  // Model-family rows share their parent's credential and are selected
+  // through `services.stt.providers.<id>.model`, so a provider picker must
+  // not offer them as separate providers.
+  const entries = listProviderEntries().filter(
+    (entry) => entry.variantOf === undefined,
+  );
   const providers = entries.map((e) => ({
     id: e.id,
     displayName: e.displayName,
+    // The families selectable through `services.stt.providers.<id>.model`.
+    // Variant rows are filtered out above because a provider picker must not
+    // offer them as providers, which leaves this the only way a client can
+    // learn a family exists at all.
+    modelFamilies: listProviderModelFamilies(e.id),
+    // Which of those families the provider runs when none is named. Sent
+    // explicitly rather than left as "the first entry", so a client that
+    // needs to write the non-variant family is not depending on array order
+    // across the wire.
+    baseModelFamily: baseModelFamilyFor(e.id),
+    // The spoken languages this provider's turn-detecting family serves, when
+    // it has one. Reported rather than left for a client to know, so the
+    // roster lives in one place instead of being copied into every surface
+    // that has to decide whether to offer turn detection.
+    turnDetectionLanguages: turnDetectionLanguagesFor(e.id),
     subtitle: e.subtitle,
     setupMode: e.setupMode,
     setupHint: e.setupHint,
@@ -317,7 +345,7 @@ async function handleTranscribe({ body }: RouteHandlerArgs) {
   }
 
   // -- Resolve transcriber --------------------------------------------------
-  const transcriber = await resolveBatchTranscriberOrUnavailable();
+  const transcriber = await resolveBatchTranscriberOrUnavailable("dictation");
 
   // -- Transcribe with timeout ----------------------------------------------
   const abortController = new AbortController();
@@ -375,7 +403,7 @@ async function handleTranscribeFile({ body }: RouteHandlerArgs) {
     );
   }
 
-  const transcriber = await resolveBatchTranscriberOrUnavailable();
+  const transcriber = await resolveBatchTranscriberOrUnavailable("batch");
 
   const startTime = Date.now();
   let wavPath: string | null = null;
@@ -449,6 +477,10 @@ export const ROUTES: RouteDefinition[] = [
           conversationStreamingMode: z.string().optional(),
           // Optional on the wire so older generated clients keep validating.
           languageSelection: z.enum(["manual", "auto"]).optional(),
+          // Optional on the wire so older generated clients keep validating.
+          modelFamilies: z.array(z.string()).optional(),
+          baseModelFamily: z.string().optional(),
+          turnDetectionLanguages: z.array(z.string()).optional(),
           credentialsGuide: z.string().optional(),
         }),
       ),

package/src/runtime/routes/wake-conversation-routes.ts

@@ -94,7 +94,7 @@ export const ROUTES: RouteDefinition[] = [
           ? (getSchedule(scheduleId)?.inferenceProfile ?? null)
           : null;
 
-      return wakeAgentForOpportunity({
+      const result = await wakeAgentForOpportunity({
         conversationId,
         hint,
         source,
@@ -108,6 +108,13 @@ export const ROUTES: RouteDefinition[] = [
           ? { untrustedOutput: { content: externalContent, source: "webhook" } }
           : {}),
       });
+      // Pin the wire shape to the declared responseBody: WakeResult carries
+      // in-process diagnostics (exitReason) beyond this route's contract.
+      return {
+        invoked: result.invoked,
+        producedToolCalls: result.producedToolCalls,
+        ...(result.reason !== undefined ? { reason: result.reason } : {}),
+      };
     },
   },
 ];

package/src/runtime/routes/watch-routes.ts

@@ -6,7 +6,10 @@
  * deliberately not a second story: binary frames or base64 `audio` events in,
  * a `{ type: "stop" }` text frame to flush, and a `StreamingTranscriber`
  * resolved by `resolveStreamingTranscriber()` so provider selection,
- * credentials, and language live in exactly one place.
+ * credentials, and language live in exactly one place. Watch is its own STT
+ * consumer there (`services.stt.roles.watch`, falling back to the global
+ * provider), because it shares dictation's transport without sharing its
+ * batch fallback.
  *
  * What differs is everything downstream of a transcript. Dictation hands its
  * text back to the client; a watch session hands each final to
@@ -421,11 +424,12 @@ export class WatchStreamSession {
     }
     const { resolveStreamingTranscriber } =
       await import("../../providers/speech-to-text/resolve.js");
-    return resolveStreamingTranscriber(
-      this.options.sampleRate !== undefined
+    return resolveStreamingTranscriber({
+      role: "watch",
+      ...(this.options.sampleRate !== undefined
         ? { sampleRate: this.options.sampleRate }
-        : {},
-    );
+        : {}),
+    });
   }
 
   /**

package/src/runtime/sync/resource-sync-events.ts

@@ -5,6 +5,7 @@ import {
   conversationMetadataSyncTag,
   SYNC_TAGS,
 } from "../../daemon/message-types/sync.js";
+import { syncAvatarToPlatform } from "../../platform/sync-avatar.js";
 import { getAvatarImagePath } from "../../util/platform.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
 import { isStreamSeqStampingDisabled } from "../assistant-stream-state.js";
@@ -31,6 +32,7 @@ export function publishAvatarChanged(originClientId?: string): void {
     avatarPath: getAvatarImagePath(),
   });
   void publishSyncInvalidation([SYNC_TAGS.assistantAvatar], originClientId);
+  syncAvatarToPlatform();
 }
 
 export function publishIdentityChanged(

package/src/runtime/trust-verdict-consumer.ts

@@ -4,9 +4,9 @@
  *
  * The gateway resolves a per-actor verdict from its ACL DB and stamps it onto
  * inbound `sourceMetadata`. These pure mappers turn that verdict into the same
- * {@link TrustContext} the local resolver would have produced — ACL + identity
- * only. INFO fields (notes, userFile, contactType, interactionCount) are never
- * carried on the wire; the consumer re-joins them locally by contactId.
+ * {@link TrustContext} the local resolver would have produced: ACL + identity
+ * only. INFO fields (notes, userFile, contactType) are never carried on the
+ * wire; the consumer re-joins them locally by contactId.
  */
 
 import type { TrustVerdict } from "@vellumai/gateway-client";