@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/runtime/routes/oauth-commands-routes.ts

@@ -19,7 +19,7 @@ import {
   ServicesSchema,
 } from "../../config/schemas/services.js";
 import type { OAuthConnectionRequest } from "../../oauth/connection.js";
-import { jsonSafeOAuthBody } from "../../oauth/connection.js";
+import { isBinaryOAuthBody, jsonSafeOAuthBody } from "../../oauth/connection.js";
 import {
   resolveOAuthConnection,
   type ResolveOAuthConnectionOptions,
@@ -42,6 +42,7 @@ import { matchHostPattern } from "../../tools/credentials/host-pattern-match.js"
 import { getLogger } from "../../util/logger.js";
 import {
   findContentTypeHeader,
+  parseRequestBodyBytes,
   parseRequestBodyData,
 } from "../../util/oauth-request-body.js";
 import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
@@ -729,7 +730,8 @@ async function handleToken({ body = {} }: RouteHandlerArgs) {
 /**
  * Resolve a raw `data` string into a request body. A non-JSON Content-Type
  * keeps the payload as the caller's exact string so multipart and other
- * byte-sensitive payloads survive; files are read as UTF-8 text.
+ * byte-sensitive payloads survive. Files are read as raw bytes: valid UTF-8
+ * stays text, and anything else stays a Buffer.
  */
 function readBodyData(data: string, contentType: string | undefined): unknown {
   if (data === "@-") {
@@ -744,7 +746,7 @@ function readBodyData(data: string, contentType: string | undefined): unknown {
 
   if (data.startsWith("@")) {
     const filePath = data.slice(1);
-    return parseRequestBodyData(readFileSync(filePath, "utf-8"), contentType);
+    return parseRequestBodyBytes(readFileSync(filePath), contentType);
   }
 
   return parseRequestBodyData(data, contentType);
@@ -760,6 +762,8 @@ export async function handleRequest({ body = {} }: RouteHandlerArgs) {
     parsed_data?: unknown;
     /** Raw data string (for direct API callers, not the CLI). */
     data?: string;
+    /** When set to base64, `parsed_data` / `data` is a base64 string of raw bytes. */
+    body_encoding?: "base64";
     force_get?: boolean;
     head?: boolean;
     account?: string;
@@ -864,7 +868,15 @@ export async function handleRequest({ body = {} }: RouteHandlerArgs) {
         : undefined;
 
   if (resolvedData !== undefined) {
-    const rawBody = resolvedData;
+    let rawBody = resolvedData;
+    if (b.body_encoding === "base64") {
+      if (typeof rawBody !== "string") {
+        throw new BadRequestError(
+          "body_encoding=base64 requires a string body",
+        );
+      }
+      rawBody = Buffer.from(rawBody, "base64");
+    }
 
     if (b.force_get) {
       if (typeof rawBody === "string") {
@@ -882,7 +894,8 @@ export async function handleRequest({ body = {} }: RouteHandlerArgs) {
       } else if (
         rawBody !== null &&
         typeof rawBody === "object" &&
-        !Array.isArray(rawBody)
+        !Array.isArray(rawBody) &&
+        !isBinaryOAuthBody(rawBody)
       ) {
         for (const [key, value] of Object.entries(
           rawBody as Record<string, unknown>,

package/src/runtime/routes/route-host-worker-routes.ts

@@ -50,7 +50,7 @@ const statusResponseSchema = z.object({
 async function startRouteHostWorker() {
   let result: { pid: number; alreadyRunning: boolean };
   try {
-    result = await spawnRouteHostWorkerProcess({ detached: false });
+    result = await spawnRouteHostWorkerProcess();
   } catch (err) {
     const message =
       err instanceof RouteHostSpawnError || err instanceof Error

package/src/runtime/routes/schedule-worker-routes.ts

@@ -50,7 +50,7 @@ const statusResponseSchema = z.object({
 async function startScheduleWorker() {
   let result: { pid: number; alreadyRunning: boolean };
   try {
-    result = await spawnScheduleWorkerProcess({ detached: false });
+    result = await spawnScheduleWorkerProcess();
   } catch (err) {
     const message =
       err instanceof ScheduleWorkerSpawnError || err instanceof Error

package/src/runtime/tool-grant-request-helper.ts

@@ -11,6 +11,8 @@
  * - Notification routing goes through emitNotificationSignal().
  */
 
+import { isGuardianRequestExpired } from "@vellumai/gateway-client";
+
 import {
   createGuardianRequest,
   listGuardianRequestsOrEmpty,
@@ -124,8 +126,10 @@ export async function createOrReuseToolGrantRequest(
     kind: "tool_grant_request",
     toolName,
   });
+  // Past-deadline rows never dedupe: see the access-request helper's note.
   const dedupeMatch = existing.find(
     (r) =>
+      !isGuardianRequestExpired(r) &&
       r.inputDigest === inputDigest &&
       r.guardianExternalUserId === binding.guardianExternalUserId,
   );

package/src/schedule/run-script.ts

@@ -66,6 +66,7 @@ export async function runScript(
     detached: true,
     stdout: "pipe",
     stderr: "pipe",
+    windowsHide: true,
     env: {
       ...buildSanitizedEnv(),
       // __SCHEDULE_ID lets a saved command find its own dir; __SCHEDULE_RUN_ID

package/src/schedule/scheduler.ts

@@ -360,7 +360,7 @@ export function startScheduler(): SchedulerHandle {
   scheduleWorkerSupervisor = createWorkerSupervisor({
     label: "Schedule worker",
     probe: probeScheduleWorker,
-    respawn: () => spawnScheduleWorkerProcess({ detached: false }),
+    respawn: () => spawnScheduleWorkerProcess(),
     isSuppressed: isScheduleWorkerAdministrativelyStopped,
     killChild: (pid) => {
       try {

package/src/schedule/worker-control.ts

@@ -119,13 +119,13 @@ export function stopScheduleWorkerProcess(): WorkerProcessStatus {
 
 /**
  * Daemon-lifecycle entry point: spawn the schedule worker as a child of the
- * daemon (`detached: false`, so it appears in `assistant ps` and is torn down
+ * daemon (so it appears in the daemon's process tree and is torn down
  * on shutdown). Fire-and-forget — a worker failure must never block boot. A
  * worker that comes up late is still the desired sole schedule runner
  * (`terminateOnTimeout` is deliberately not set).
  */
 export function startScheduleWorker(): void {
-  void spawnScheduleWorkerProcess({ detached: false })
+  void spawnScheduleWorkerProcess()
     .then((r) =>
       log.info(
         { pid: r.pid, alreadyRunning: r.alreadyRunning },

package/src/security/oauth2.ts

@@ -20,6 +20,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer, type Server } from "node:http";
 
 import { getIsPlatform } from "../config/env-registry.js";
+import { parseScopeList } from "../oauth/scope-utils.js";
 import { getLogger } from "../util/logger.js";
 import { renderOAuthCompletionPage as renderLoopbackPage } from "./oauth-completion-page.js";
 
@@ -249,19 +250,9 @@ export async function exchangeCodeForTokens(
       (tokenData.token_type as string | undefined),
   };
 
-  // Defensive split: providers (e.g. GitHub, Slack) may return comma-separated
-  // scopes in token responses regardless of the scope_separator used to join
-  // outbound authorize URLs, so we tolerate both spaces and commas here. When
-  // a provider explicitly configures a non-default separator (e.g. Linear uses
-  // ","), we honor that to keep symmetric round-tripping of configured scopes.
-  const splitPattern =
-    config.scopeSeparator === " " ? /[ ,]/ : config.scopeSeparator;
   const grantedScopes =
     typeof tokens.scope === "string"
-      ? tokens.scope
-          .split(splitPattern)
-          .map((s) => s.trim())
-          .filter(Boolean)
+      ? parseScopeList(tokens.scope, config.scopeSeparator)
       : [...config.scopes];
 
   return { tokens, grantedScopes, rawTokenResponse: tokenData };

package/src/security/secure-keys.ts

@@ -60,6 +60,7 @@ export type {
   CredentialListResult,
   DeleteResult,
 } from "./credential-backend.js";
+import { ACP_OAUTH_TOKEN_FIELD, ACP_SERVICE } from "../acp/acp-credentials.js";
 
 /**
  * Re-export shared-package secure-key abstractions so downstream consumers
@@ -673,8 +674,40 @@ export async function getSecureKeyAsync(
 }
 
 /**
- * Store a secret in secure storage. Writes to exactly one backend —
- * no dual-writing. Forces a CES reconnection when the backend is dead —
+ * Post-write side effects keyed on which credential was actually stored.
+ *
+ * Every path that lands a credential runs through this, single writes and bulk
+ * restores alike, so a behaviour that has to follow a credential does not
+ * depend on a list of call sites that drifts as write paths are added.
+ *
+ * Deliberately not where a Connect card is retired. A card is retired by the
+ * marker it came from no longer matching the credential a spawn would resolve,
+ * which is a comparison made when the marker is read. Nothing here has to fire
+ * at the right moment for that to happen, so this is a notification rather
+ * than a mechanism, and a failure costs freshness rather than correctness.
+ *
+ * Imported on demand and only on a match, so the ACP module graph stays out of
+ * this module's load path.
+ */
+async function onCredentialsWritten(accounts: string[]): Promise<void> {
+  if (!accounts.includes(credentialKey(ACP_SERVICE, ACP_OAUTH_TOKEN_FIELD))) {
+    return;
+  }
+  try {
+    // The Connect flow repairs the spawn policy *after* this write, so a token
+    // whose read is still denied here is retried by `storeAcpClaudeToken` once
+    // that repair lands. This pass covers every other writer.
+    const { notifyAcpConnectRetired } =
+      await import("../acp/acp-claude-oauth.js");
+    await notifyAcpConnectRetired();
+  } catch (err) {
+    log.warn({ err }, "ACP Connect card notification failed after a write");
+  }
+}
+
+/**
+ * Store a secret in secure storage. Writes to exactly one backend, with no
+ * dual-writing. Forces a CES reconnection when the backend is dead, because
  * callers (e.g. the post-login platform credential push) do not retry a
  * failed write.
  */
@@ -682,10 +715,10 @@ export async function setSecureKeyAsync(
   account: string,
   value: string,
 ): Promise<boolean> {
-  return withCredentialTimeout(async () => {
+  const ok = await withCredentialTimeout(async () => {
     const backend = await resolveBackendAsync({ forceReconnect: true });
-    const ok = await backend.set(account, value);
-    if (!ok) {
+    const stored = await backend.set(account, value);
+    if (!stored) {
       log.warn(
         { account, backend: backend.name },
         "Credential backend set failed",
@@ -693,9 +726,19 @@ export async function setSecureKeyAsync(
     } else {
       log.info({ account, backend: backend.name }, "Credential stored");
     }
-    updateCesHttpReachability(backend, !ok);
-    return ok;
+    updateCesHttpReachability(backend, !stored);
+    return stored;
   }, false);
+  // Detached, because it neither decides the result nor gates it. Under the
+  // deadline its cost could turn a stored credential into a reported failure;
+  // awaited after it, the cost merely held the caller at "signing in" while a
+  // scan and a broadcast finished. Nothing downstream depends on it having
+  // run: a card is retired by the marker comparison at read time, and the
+  // credential prompt re-checks the registry entry before honouring it.
+  if (ok) {
+    void onCredentialsWritten([account]);
+  }
+  return ok;
 }
 
 /**
@@ -726,7 +769,7 @@ export async function deleteSecureKeyAsync(
 export async function bulkSetSecureKeysAsync(
   credentials: Array<{ account: string; value: string }>,
 ): Promise<Array<{ account: string; ok: boolean }>> {
-  return withCredentialTimeout(
+  const results = await withCredentialTimeout(
     async () => {
       const backend = await resolveBackendAsync({ forceReconnect: true });
       let results: Array<{ account: string; ok: boolean }>;
@@ -760,6 +803,10 @@ export async function bulkSetSecureKeysAsync(
     },
     credentials.map((c) => ({ account: c.account, ok: false })),
   );
+  // Same as the single-write path: detached, so a bundle's notifications
+  // neither decide nor delay its result.
+  void onCredentialsWritten(results.filter((r) => r.ok).map((r) => r.account));
+  return results;
 }
 
 // ---------------------------------------------------------------------------

package/src/skills/catalog-install.ts

@@ -16,8 +16,9 @@ import { gunzipSync } from "node:zlib";
 
 import { getPlatformBaseUrl } from "../config/env.js";
 import { loadSkillCatalog } from "../config/skills.js";
+import { isBunVirtualPath } from "../util/bundled-asset.js";
 import { getLogger } from "../util/logger.js";
-import { getWorkspaceSkillsDir } from "../util/platform.js";
+import { addToPathEnv, getWorkspaceSkillsDir } from "../util/platform.js";
 import { computeSkillHash, writeInstallMeta } from "./install-meta.js";
 import {
   isSkillCompatibleWithPlatform,
@@ -67,7 +68,7 @@ export interface CatalogSkill {
 export function getRepoSkillsDir(): string | undefined {
   const importDir = import.meta.dir;
 
-  if (importDir.startsWith("/$bunfs/")) {
+  if (isBunVirtualPath(importDir)) {
     const execDir = dirname(process.execPath);
     // macOS .app bundle: binary in Contents/MacOS/, resources in Contents/Resources/
     const resourcesPath = join(
@@ -415,12 +416,14 @@ export async function installSkillDependenciesIfPresent(
   if (!existsSync(join(skillDir, "package.json"))) {
     return;
   }
-  const bunPath = `${homedir()}/.bun/bin`;
+  const env = { ...process.env };
+  addToPathEnv(env, [join(homedir(), ".bun", "bin")]);
   await new Promise<void>((resolve, reject) => {
     const child = spawn("bun", ["install"], {
       cwd: skillDir,
       stdio: "inherit",
-      env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
+      env,
+      windowsHide: true,
     });
     child.on("error", reject);
     child.on("close", (code) => {

package/src/skills/clawhub.ts

@@ -195,6 +195,7 @@ async function runClawhub(
     env: { ...process.env, CLAWHUB_DISABLE_TELEMETRY: "1" },
     stdout: "pipe",
     stderr: "pipe",
+    windowsHide: true,
   });
 
   let timer: ReturnType<typeof setTimeout>;

package/src/skills/inline-command-runner.ts

@@ -125,6 +125,7 @@ export async function runInlineCommand(
         cwd: workingDir,
         env,
         stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);

package/src/stt/__tests__/room-noise-floor.test.ts

@@ -0,0 +1,108 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  NOISE_FLOOR_BLOCK_COUNT,
+  NOISE_FLOOR_BLOCK_MS,
+  RoomNoiseFloor,
+} from "../room-noise-floor.js";
+
+/** Audio needed before the estimator will report anything at all. */
+const FULL_WINDOW_MS = NOISE_FLOOR_BLOCK_MS * NOISE_FLOOR_BLOCK_COUNT;
+
+/** Feed `ms` of audio at a steady amplitude, in 50ms chunks like the client. */
+function feed(floor: RoomNoiseFloor, amplitude: number, ms: number): void {
+  for (let elapsed = 0; elapsed < ms; elapsed += 50) {
+    floor.observe(amplitude, 50);
+  }
+}
+
+describe("RoomNoiseFloor", () => {
+  test("has no opinion until the window is full", () => {
+    const floor = new RoomNoiseFloor();
+    feed(floor, 300, FULL_WINDOW_MS - NOISE_FLOOR_BLOCK_MS);
+
+    // A partial window would report the loudest thing it has heard as the room.
+    expect(floor.floor).toBeNull();
+
+    feed(floor, 300, NOISE_FLOOR_BLOCK_MS);
+    expect(floor.floor).toBeCloseTo(300, 5);
+  });
+
+  test("ignores intermittent speech and keeps the quiet second", () => {
+    const floor = new RoomNoiseFloor();
+    // Someone talking over a 250-level room, with one pause in the window.
+    feed(floor, 2_400, FULL_WINDOW_MS - NOISE_FLOOR_BLOCK_MS);
+    feed(floor, 250, NOISE_FLOOR_BLOCK_MS);
+
+    // The minimum picks the second nobody spoke in, not the average of the ten.
+    expect(floor.floor).toBeCloseTo(250, 5);
+  });
+
+  test("a block averages across syllable gaps rather than latching onto one", () => {
+    const floor = new RoomNoiseFloor();
+    // Speech with brief pauses inside it: alternating loud and room-level
+    // chunks throughout. A per-chunk minimum would call this room 250.
+    for (let elapsed = 0; elapsed < FULL_WINDOW_MS; elapsed += 100) {
+      floor.observe(2_400, 50);
+      floor.observe(250, 50);
+    }
+
+    expect(floor.floor).toBeCloseTo(1_325, 5);
+  });
+
+  test("forgets a room it has left, once the window has rolled", () => {
+    const floor = new RoomNoiseFloor();
+    feed(floor, 200, FULL_WINDOW_MS);
+    expect(floor.floor).toBeCloseTo(200, 5);
+
+    // Walk somewhere loud and stay there past the retention window.
+    feed(floor, 900, FULL_WINDOW_MS);
+
+    expect(floor.floor).toBeCloseTo(900, 5);
+  });
+
+  test("weights by duration so an odd-sized tail cannot skew a block", () => {
+    const floor = new RoomNoiseFloor();
+    for (let block = 0; block < NOISE_FLOOR_BLOCK_COUNT; block += 1) {
+      floor.observe(100, NOISE_FLOOR_BLOCK_MS - 10);
+      floor.observe(10_000, 10);
+    }
+
+    // 10ms of a loud tail moves a 1s block by ~1%, not by half.
+    expect(floor.floor).toBeCloseTo(
+      (100 * (NOISE_FLOOR_BLOCK_MS - 10) + 10_000 * 10) / NOISE_FLOOR_BLOCK_MS,
+      5,
+    );
+  });
+
+  test("interrupt() drops the partial block without losing completed ones", () => {
+    const floor = new RoomNoiseFloor();
+    feed(floor, 300, FULL_WINDOW_MS);
+    // Half a block of near-silence, then playback starts and observation stops.
+    feed(floor, 10, NOISE_FLOOR_BLOCK_MS / 2);
+    floor.interrupt();
+    // Resume after playback; the two halves must not merge into one block that
+    // measures neither side of the gap.
+    feed(floor, 300, NOISE_FLOOR_BLOCK_MS);
+
+    expect(floor.floor).toBeCloseTo(300, 5);
+  });
+
+  test("ignores non-positive durations and non-finite amplitudes", () => {
+    const floor = new RoomNoiseFloor();
+    floor.observe(500, 0);
+    floor.observe(500, -50);
+    floor.observe(Number.NaN, 50);
+
+    feed(floor, 300, FULL_WINDOW_MS);
+    expect(floor.floor).toBeCloseTo(300, 5);
+  });
+
+  test("reset() clears completed blocks too", () => {
+    const floor = new RoomNoiseFloor();
+    feed(floor, 300, FULL_WINDOW_MS);
+    floor.reset();
+
+    expect(floor.floor).toBeNull();
+  });
+});

package/src/stt/room-noise-floor.ts

@@ -0,0 +1,140 @@
+/**
+ * Rolling estimate of a room's continuous background noise level, on the same
+ * 16-bit mean-absolute-amplitude scale as `speech-energy.ts`.
+ *
+ * ## Why an estimate is needed at all
+ *
+ * `detectPcm16SpeechActivity` compares a chunk against a fixed absolute
+ * threshold. A constant works only if every room delivers roughly the same
+ * silence, and rooms do not: a quiet home office and a cafe differ by more
+ * than the gap between silence and speech. Set the constant for the cafe and a
+ * soft talker is never heard; set it for the office and the cafe's background
+ * reads as continuous speech, which in a live-voice session means room noise
+ * repeatedly cancels the assistant mid-reply.
+ *
+ * ## Why the minimum of block means, and not an average
+ *
+ * The hard part is estimating background noise from a signal that also
+ * contains the user. Averaging fails: it folds the user's own speech into the
+ * floor, so the floor climbs while they talk and the gate goes deaf exactly
+ * when someone is using it. An envelope with a slow time constant fails the
+ * same way for the same reason, because "a person talking" and "a noisier
+ * room" both last about as long as each other, and a time constant cannot
+ * separate two things that differ only in level.
+ *
+ * What does separate them is that **speech is intermittent and room noise is
+ * continuous.** Any ten seconds of a real conversation contains at least one
+ * second in which nobody is speaking, and in that second the microphone hears
+ * the room and nothing else. So: average within a one-second block, then take
+ * the *minimum* across the retained blocks. Block-averaging first matters,
+ * because a minimum taken over raw chunks would latch onto the quietest 50 ms
+ * gap between two syllables, which is a pause inside speech, not the room.
+ *
+ * The estimate degrades honestly rather than dangerously. Ten unbroken seconds
+ * of speech (a monologue with no breath) raises the floor, because there was
+ * genuinely no quiet second to measure; it recovers on the first pause. The
+ * caller bounds what a raised floor is allowed to do.
+ *
+ * Pure and transport-neutral: amplitudes in, an estimate out, no session or
+ * provider state.
+ */
+
+/** Audio duration averaged into one block before it joins the estimate. */
+export const NOISE_FLOOR_BLOCK_MS = 1_000;
+
+/**
+ * Completed blocks retained. Ten seconds is the shortest window that reliably
+ * contains a conversational pause, and short enough that walking somewhere
+ * quieter is reflected within a turn or two.
+ */
+export const NOISE_FLOOR_BLOCK_COUNT = 10;
+
+/**
+ * Tracks the quietest recent second of microphone audio.
+ *
+ * Feed it every chunk's mean amplitude while the near end is *not* playing
+ * audio back; feeding it during playback would teach it the assistant's own
+ * echo. Call {@link interrupt} when observation stops for that reason, so a
+ * block never averages across the gap.
+ */
+export class RoomNoiseFloor {
+  private readonly blockMs: number;
+  private readonly blockCount: number;
+  /** Completed block means, oldest first, at most `blockCount` of them. */
+  private readonly blocks: number[] = [];
+  /** Duration-weighted amplitude sum of the block being filled. */
+  private pendingWeightedSum = 0;
+  private pendingMs = 0;
+
+  constructor(
+    blockMs: number = NOISE_FLOOR_BLOCK_MS,
+    blockCount: number = NOISE_FLOOR_BLOCK_COUNT,
+  ) {
+    this.blockMs = blockMs;
+    this.blockCount = blockCount;
+  }
+
+  /**
+   * Fold one chunk's mean amplitude into the estimate.
+   *
+   * Weighted by duration so an irregular chunk size cannot skew a block: the
+   * client's framing is its own business, and a 10 ms tail must not count as
+   * much as the 50 ms frame before it.
+   */
+  observe(meanAmplitude: number, durationMs: number): void {
+    if (!(durationMs > 0) || !Number.isFinite(meanAmplitude)) {
+      return;
+    }
+    this.pendingWeightedSum += meanAmplitude * durationMs;
+    this.pendingMs += durationMs;
+    if (this.pendingMs < this.blockMs) {
+      return;
+    }
+    this.blocks.push(this.pendingWeightedSum / this.pendingMs);
+    if (this.blocks.length > this.blockCount) {
+      this.blocks.shift();
+    }
+    this.pendingWeightedSum = 0;
+    this.pendingMs = 0;
+  }
+
+  /**
+   * Drop the partially-filled block, keeping everything already completed.
+   *
+   * Call this when observation is about to pause (assistant playback starting)
+   * or resume after a gap. Without it a single block could average a half
+   * second of room from before the gap with a half second from after it, which
+   * is a measurement of neither.
+   */
+  interrupt(): void {
+    this.pendingWeightedSum = 0;
+    this.pendingMs = 0;
+  }
+
+  /**
+   * The quietest retained second, or `null` until the window is **full**.
+   *
+   * Waiting for a full window is what makes the minimum safe. Over ten seconds
+   * the claim "at least one of these seconds contains no speech" holds; over
+   * one second it does not, and a partial window would happily report the first
+   * second of a sentence as the room's noise floor. That over-estimate is the
+   * dangerous direction: it raises the gate against the very voice it measured.
+   *
+   * `null` means "no opinion yet" and callers must fall back to their
+   * configured constant rather than treating it as a floor of zero. Since only
+   * non-playback audio is observed, the window fills with accumulated listening
+   * time rather than wall clock, which in a real session is a turn or two.
+   */
+  get floor(): number | null {
+    if (this.blocks.length < this.blockCount) {
+      return null;
+    }
+    return Math.min(...this.blocks);
+  }
+
+  /** Forget everything, e.g. when the input route changes under the session. */
+  reset(): void {
+    this.blocks.length = 0;
+    this.interrupt();
+  }
+}

package/src/subagent/notify.ts

@@ -9,7 +9,9 @@
  * pulling in the conversation/agent-loop core.
  *
  * Delivery targets the parent's in-process `Conversation` via the conversation
- * registry: a notification is injected only when the parent is live here.
+ * registry: a notification is injected only when the parent is live here. A
+ * stale idle parent is rebuilt through `getOrCreateConversation` first so the
+ * injected turn uses the current provider, prompt, and credentials.
  */
 
 import {
@@ -36,14 +38,58 @@ export function injectMessageIntoParent(
   message: string,
   metadata?: Record<string, unknown>,
 ): void {
-  const parentConversation = findConversation(parentConversationId);
-  if (!parentConversation) {
+  const existing = findConversation(parentConversationId);
+  if (!existing) {
     log.warn(
       { parentConversationId },
       "Subagent notification target parent conversation not found",
     );
     return;
   }
+  // A reload can mark the parent stale while children still run. Terminal
+  // injection is the first parent turn after the last child settles, so
+  // rebuild first when the instance is idle. Otherwise the completion turn
+  // would run on the construction-time provider, prompt, and credentials.
+  if (existing.isStale() && !existing.hasInFlightWork()) {
+    void import("../daemon/conversation-store.js")
+      .then(({ getOrCreateConversation }) =>
+        getOrCreateConversation(parentConversationId),
+      )
+      .then((parent) =>
+        deliverToParent(parent, parentConversationId, message, metadata),
+      )
+      .catch((err) => {
+        log.error(
+          { parentConversationId, err },
+          "Failed to rebuild stale parent before subagent notification",
+        );
+      });
+    return;
+  }
+  deliverToParent(existing, parentConversationId, message, metadata);
+}
+
+function deliverToParent(
+  parentConversation: {
+    enqueueMessage: (options: {
+      content: string;
+      metadata?: Record<string, unknown>;
+      isInteractive: boolean;
+    }) => { queued: boolean; rejected?: boolean };
+    persistUserMessage: (options: {
+      content: string;
+      metadata?: Record<string, unknown>;
+    }) => Promise<{ id: string }>;
+    runAgentLoop: (
+      message: string,
+      messageId: string,
+      options: { isInteractive: boolean },
+    ) => Promise<unknown>;
+  },
+  parentConversationId: string,
+  message: string,
+  metadata?: Record<string, unknown>,
+): void {
   // Machine-injected with no human asserted present, so the notification
   // turn runs non-interactive; it still streams to whoever is watching
   // through the parent's sink.

package/src/tools/__tests__/tool-input-schemas.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
 import { askQuestionTool } from "../ask-question/ask-question-tool.js";
+import { reactToMessageTool } from "../channel/react-to-message.js";
 import { fileEditTool } from "../filesystem/edit.js";
 import { fileListTool } from "../filesystem/list.js";
 import { fileReadTool } from "../filesystem/read.js";
@@ -140,6 +141,7 @@ describe("derived input_schema", () => {
     hostShellTool,
     requestSystemPermissionTool,
     notifyParentTool,
+    reactToMessageTool,
   ];
 
   test("every registered schema belongs to a tool whose input_schema is derived from it", () => {