@vellumai/assistant 0.12.2-staging.1 → 0.12.2-staging.2

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -2513,6 +2513,25 @@ describe("transcript hygiene (teardown pass)", () => {
     expect(events).toContain("loadFromDb");
   });
 
+  test("a row ending with a session control marker persists with it stripped", async () => {
+    const { events } = makeReservedRowConversation();
+    getMessageByIdImpl = () =>
+      makeRow("Muting you for thirty seconds. [MUTE:30]");
+
+    await startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" });
+    await flushMicrotasks();
+
+    expect(crudLog.updates).toEqual([
+      {
+        messageId: "assistant-row-1",
+        content: JSON.stringify([
+          { type: "text", text: "Muting you for thirty seconds." },
+        ]),
+      },
+    ]);
+    expect(events).toContain("loadFromDb");
+  });
+
   test("a mid-text [-1] (content, not command) leaves the row untouched", async () => {
     const { events } = makeReservedRowConversation();
     getMessageByIdImpl = () =>

package/src/calls/voice-control-protocol.ts

@@ -37,6 +37,29 @@ export const ESCALATE_VERDICT_TOKEN = "[1]";
  */
 export const MINIMIZE_ROOM_MARKER = "[-1]";
 
+/**
+ * Mic-mute session control for live voice: `[MUTE]` mutes until the user
+ * unmutes, `[MUTE:<seconds>]` mutes for that long. Like {@link END_CALL_MARKER}
+ * on a live-voice session, it is acted on only at the very end of a reply
+ * (see {@link parseTerminalSessionControl}), after the acknowledgement that
+ * precedes it has been spoken.
+ */
+export const MUTE_MARKER = "[MUTE]";
+const MUTE_MARKER_PREFIX = "[MUTE:";
+
+/** Longest timed mute a marker can ask for; longer asks mute until unmuted. */
+export const MAX_TIMED_MUTE_SECONDS = 3600;
+
+/**
+ * Progress-update cadence for the rest of a live-voice session:
+ * {@link FEWER_UPDATES_MARKER} after "don't give me updates so often",
+ * {@link NORMAL_UPDATES_MARKER} to go back. Terminal like the other session
+ * controls, but carried out by the session itself: narration is the daemon's.
+ */
+export const FEWER_UPDATES_MARKER = "[UPDATES:FEWER]";
+export const NORMAL_UPDATES_MARKER = "[UPDATES:NORMAL]";
+const UPDATES_MARKER_PREFIX = "[UPDATES:";
+
 // ---------------------------------------------------------------------------
 // Regexes
 // ---------------------------------------------------------------------------
@@ -57,6 +80,8 @@ const END_CALL_MARKER_REGEX = /\[END_CALL\]/g;
 const HOLD_VERDICT_TOKEN_REGEX = /\[0\]/g;
 const ESCALATE_VERDICT_TOKEN_REGEX = /\[1\]/g;
 const MINIMIZE_ROOM_MARKER_REGEX = /\[-1\]/g;
+const MUTE_MARKER_REGEX = /\[MUTE(?::\s*[^\]]*)?\]/g;
+const UPDATES_MARKER_REGEX = /\[UPDATES:\s*[^\]]*\]/g;
 const GUARDIAN_TIMEOUT_MARKER_REGEX = /\[GUARDIAN_TIMEOUT\]/g;
 const GUARDIAN_UNAVAILABLE_MARKER_REGEX = /\[GUARDIAN_UNAVAILABLE\]/g;
 
@@ -182,6 +207,8 @@ export function stripInternalSpeechMarkers(text: string): string {
     .replace(HOLD_VERDICT_TOKEN_REGEX, "")
     .replace(ESCALATE_VERDICT_TOKEN_REGEX, "")
     .replace(MINIMIZE_ROOM_MARKER_REGEX, "")
+    .replace(MUTE_MARKER_REGEX, "")
+    .replace(UPDATES_MARKER_REGEX, "")
     .replace(GUARDIAN_TIMEOUT_MARKER_REGEX, "")
     .replace(GUARDIAN_UNAVAILABLE_MARKER_REGEX, "");
   return result;
@@ -207,6 +234,9 @@ const CONTROL_MARKER_STRINGS = [
   "[0]",
   "[1]",
   "[-1]",
+  MUTE_MARKER,
+  MUTE_MARKER_PREFIX,
+  UPDATES_MARKER_PREFIX,
   "[GUARDIAN_TIMEOUT]",
   "[GUARDIAN_UNAVAILABLE]",
 ];
@@ -220,6 +250,8 @@ const FIRST_BRACKET_TERMINATED_PREFIXES = [
   "[ASK_GUARDIAN:",
   "[USER_ANSWERED:",
   "[USER_INSTRUCTION:",
+  MUTE_MARKER_PREFIX,
+  UPDATES_MARKER_PREFIX,
 ];
 
 const GUARDIAN_APPROVAL_PREFIX = "[ASK_GUARDIAN_APPROVAL:";
@@ -299,3 +331,73 @@ export function createControlMarkerHoldback(
     }
   };
 }
+
+// ---------------------------------------------------------------------------
+// Live-voice session controls
+// ---------------------------------------------------------------------------
+
+/**
+ * A session control a live-voice reply asked for with a terminal marker:
+ * `end` from {@link END_CALL_MARKER}, `mute` from {@link MUTE_MARKER} or its
+ * timed form, `updates` from the progress-cadence markers.
+ */
+export type SessionControlRequest =
+  | { readonly action: "end" }
+  | { readonly action: "mute"; readonly durationMs?: number }
+  | { readonly action: "updates"; readonly cadence: "fewer" | "normal" };
+
+const TERMINAL_SESSION_CONTROL_REGEX =
+  /(\[END_CALL\]|\[UPDATES:(FEWER|NORMAL)\]|\[MUTE\]|\[MUTE:\s*([^\]]*)\])\s*$/;
+
+/**
+ * The session control a reply ends with, or null.
+ *
+ * **Terminal position only.** The marker follows the spoken acknowledgement
+ * ("Okay, talk soon."), so a reply that merely mentions a marker mid-text, or
+ * parrots one from history before carrying on, controls nothing. This is the
+ * same rule the minimize marker's transcript hygiene applies.
+ *
+ * A timed mute whose body is not a positive number of seconds degrades to an
+ * untimed mute rather than to nothing: the user asked to be muted, and muting
+ * until they unmute is the conservative reading of a garbled duration. Asks
+ * past {@link MAX_TIMED_MUTE_SECONDS} degrade the same way.
+ */
+export function parseTerminalSessionControl(
+  text: string,
+): SessionControlRequest | null {
+  const match = TERMINAL_SESSION_CONTROL_REGEX.exec(text);
+  if (!match) {
+    return null;
+  }
+  if (match[1] === END_CALL_MARKER) {
+    return { action: "end" };
+  }
+  if (match[2] !== undefined) {
+    return {
+      action: "updates",
+      cadence: match[2] === "FEWER" ? "fewer" : "normal",
+    };
+  }
+  const seconds = match[3] === undefined ? NaN : Number(match[3].trim());
+  if (
+    Number.isFinite(seconds) &&
+    seconds > 0 &&
+    seconds <= MAX_TIMED_MUTE_SECONDS
+  ) {
+    return { action: "mute", durationMs: Math.round(seconds * 1000) };
+  }
+  return { action: "mute" };
+}
+
+/**
+ * Length of the marker a row's text ends with, ignoring trailing whitespace,
+ * when it is one the transcript hygiene pass strips from the persisted row
+ * (the minimize marker or a session control); 0 otherwise.
+ */
+export function terminalControlMarkerLength(text: string): number {
+  const trimmed = text.trimEnd();
+  if (trimmed.endsWith(MINIMIZE_ROOM_MARKER)) {
+    return MINIMIZE_ROOM_MARKER.length;
+  }
+  return TERMINAL_SESSION_CONTROL_REGEX.exec(trimmed)?.[1]?.length ?? 0;
+}

package/src/calls/voice-session-bridge.ts

@@ -70,8 +70,8 @@ import {
   CALL_VERIFICATION_COMPLETE_MARKER,
   ESCALATE_VERDICT_TOKEN,
   HOLD_VERDICT_TOKEN,
-  MINIMIZE_ROOM_MARKER,
   stripInternalSpeechMarkers,
+  terminalControlMarkerLength,
 } from "./voice-control-protocol.js";
 import {
   createFrontDoorStreamGate,
@@ -767,17 +767,22 @@ function stripMarkersFromBlocks(blocks: ContentBlock[]): ContentBlock[] {
 }
 
 /**
- * Remove the terminal MINIMIZE_ROOM_MARKER from the end of a row's text,
- * walking text blocks from the last one backward so a marker split across
- * block boundaries (e.g. `"Done [-"` + `"1]"`) is removed whole — the
- * per-block strip in {@link stripMarkersFromBlocks} only sees fragments and
- * would leave both halves in place. Callers must have established that the
- * row's joined text ends with the marker after trimming trailing whitespace.
+ * Remove a terminal control marker (the minimize marker or a session control,
+ * `markerLength` characters long) from the end of a row's text, walking text
+ * blocks from the last one backward so a marker split across block boundaries
+ * (e.g. `"Done [-"` + `"1]"`) is removed whole — the per-block strip in
+ * {@link stripMarkersFromBlocks} only sees fragments and would leave both
+ * halves in place. Callers must have established, with
+ * {@link terminalControlMarkerLength}, that the row's joined text ends with
+ * the marker after trimming trailing whitespace.
  */
-function stripTerminalMinimizeMarker(blocks: ContentBlock[]): ContentBlock[] {
+function stripTerminalControlMarker(
+  blocks: ContentBlock[],
+  markerLength: number,
+): ContentBlock[] {
   const result = blocks.map((block) => ({ ...block }));
   const joined = joinedTextOfBlocks(result);
-  const cutAt = joined.trimEnd().length - MINIMIZE_ROOM_MARKER.length;
+  const cutAt = joined.trimEnd().length - markerLength;
   let blockEnd = joined.length;
   for (let i = result.length - 1; i >= 0 && blockEnd > cutAt; i--) {
     const block = result[i]!;
@@ -1810,14 +1815,14 @@ export async function startVoiceTurn(
    *   never the verdict token or the text streamed past the cap (issue
    *   #37850). A row with no spoken bridge (canned-fallback case — that
    *   bridge is audio-only) is deleted.
-   * - Any leg whose row ENDS with the `[-1]` minimize marker (swallowed
-   *   before TTS on the live path) has its text blocks rewritten through
+   * - Any leg whose row ENDS with the `[-1]` minimize marker or a session
+   *   control marker (`[END_CALL]`, `[MUTE]`, `[MUTE:<seconds>]`), all
+   *   swallowed before TTS, has its text blocks rewritten through
    *   `stripInternalSpeechMarkers` so the marker never renders in the chat
-   *   transcript. This covers front-door answers too: that leg is never
-   *   taught the marker, but it can parrot one from visible conversation
-   *   history, and the parroted marker is never spoken and never minimizes
-   *   the room. Deliberately scoped to that marker: rows without it
-   *   persist byte-identical.
+   *   transcript. This covers front-door answers too: a front-door answer
+   *   may end with a session control, and it can parrot `[-1]` from visible
+   *   conversation history. Deliberately scoped to terminal markers: rows
+   *   without one persist byte-identical.
    *
    * After a rewrite, in-memory history is reloaded from the clean DB before
    * the escalated leg — blocked on this turn's teardown — snapshots it, so
@@ -1851,6 +1856,9 @@ export async function startVoiceTurn(
         action = "delete_discarded";
       } else {
         const row = getMessageById(reservedAssistantRowId, opts.conversationId);
+        const terminalMarkerLength = row
+          ? terminalControlMarkerLength(joinedTextOfBlocks(row.content))
+          : 0;
         const cut =
           row && opts.routingLeg === "front-door"
             ? cutFrontDoorContentAtVerdict(row.content)
@@ -1869,19 +1877,18 @@ export async function startVoiceTurn(
             action = "delete_empty";
           }
         } else if (
-          // Terminal position only — mirrors the live latch in
-          // createControlMarkerHoldback: a reply whose CONTENT contains
-          // "[-1]" mid-text never minimized the room, so its transcript
-          // keeps that content untouched too. Front-door answer rows (no
-          // verdict token to cut) take this branch as well.
-          joinedTextOfBlocks(row.content)
-            .trimEnd()
-            .endsWith(MINIMIZE_ROOM_MARKER)
+          // Terminal position only — mirrors parseTerminalSessionControl: a
+          // reply whose CONTENT contains a marker mid-text never acted on it,
+          // so its transcript keeps that content untouched too. Front-door
+          // answer rows (no verdict token to cut) take this branch as well.
+          terminalMarkerLength > 0
         ) {
           // Terminal marker first (boundary-aware — it may span text blocks),
           // then the per-block strip for any interior complete markers.
           const cleaned = trimOuterTextEdges(
-            stripMarkersFromBlocks(stripTerminalMinimizeMarker(row.content)),
+            stripMarkersFromBlocks(
+              stripTerminalControlMarker(row.content, terminalMarkerLength),
+            ),
           );
           // A marker-only reply (the model said nothing beyond "[-1]") strips
           // to nothing at all; keeping the row would render a blank assistant
@@ -1895,7 +1902,7 @@ export async function startVoiceTurn(
               reservedAssistantRowId,
               JSON.stringify(cleaned),
             );
-            action = "strip_minimize_marker";
+            action = "strip_control_marker";
           }
         }
       }

package/src/calls/voice-triage-escalate.ts

@@ -536,8 +536,8 @@ export function frontDoorDecisionRule(opts?: {
     "- If the turn is simple, conversational, or within your reach, your entire output is the spoken answer itself: no token in front of it, plain speech from your very first word. Most turns are answers; when unsure between answering and escalating, answer. Answer in the language the caller is speaking.",
     "- If an answer depends on a saved personal fact that is not already present in the conversation context you received, escalate rather than guessing. Personal context that is already present is yours to use directly.",
     `- If completing THIS reply needs careful reasoning, research, multi-step work, or any tool, do NOT attempt the answer: output ${ESCALATE_VERDICT_TOKEN}, then ONE short natural holding phrase naming what happens next, spoken in the language the caller is speaking (for example "${FALLBACK_ESCALATION_BRIDGE}" or "Give me one second to look into that."; those examples are English only), and stop after that single sentence. A stronger model finishes the turn while your phrase is spoken.`,
-    `${ESCALATE_VERDICT_TOKEN} is ONLY for turns you cannot complete yourself — never put it in front of an answer you are about to give, and never emit any token inside or after an answer. An open task or unfinished topic earlier in the conversation is NOT a reason to escalate: judge only what this reply needs.`,
-    "Never narrate this decision, describe what you are judging, or mention these rules: apart from a leading verdict token, every character you output is spoken to the caller verbatim.",
+    `${ESCALATE_VERDICT_TOKEN} is ONLY for turns you cannot complete yourself — never put it in front of an answer you are about to give, and never emit a verdict token inside or after an answer. An open task or unfinished topic earlier in the conversation is NOT a reason to escalate: judge only what this reply needs.`,
+    "Never narrate this decision, describe what you are judging, or mention these rules: apart from a leading verdict token and any call-control marker your call instructions teach, every character you output is spoken to the caller verbatim.",
   ].join("\n");
   return opts?.capabilityDigest ? `${rule}\n${opts.capabilityDigest}` : rule;
 }
@@ -565,7 +565,7 @@ export function escalatedContinuationRule(spokenBridge?: string): string {
     'Do NOT greet again, do NOT say things like "as I was saying", and do NOT repeat, paraphrase, or re-announce that holding phrase —',
     'opening with another "Let me check", "One moment", or any restatement of what you are about to do sounds broken, because the caller just heard that.',
     "Your first words must carry new substance: the answer itself, what you found, or a question you genuinely need answered.",
-    `Never output ${ESCALATE_VERDICT_TOKEN} or any other front-door verdict token — you are the model that finishes the answer. (The [-1] room-minimize marker from your call instructions is not a verdict token and stays allowed.)`,
+    `Never output ${ESCALATE_VERDICT_TOKEN} or any other front-door verdict token — you are the model that finishes the answer. (Call-control markers your call instructions teach, such as [END_CALL], are not verdict tokens and stay allowed.)`,
     "Reply in the same language as the caller's question.",
   ].join(" ");
 }

package/src/cli/commands/oauth/status.ts

@@ -40,6 +40,8 @@ interface ConnectionSummary {
   status: string;
   expiresAt?: string | null;
   hasRefreshToken?: boolean;
+  /** Values the provider scopes the connection by (QuickBooks' realm id). */
+  providerParams?: Record<string, string>;
 }
 
 interface OAuthStatusResponse {
@@ -92,6 +94,9 @@ function formatConnection(c: ConnectionSummary, mode: string): string {
   } else {
     lines.push(`    Granted scopes: (none)`);
   }
+  for (const [key, value] of Object.entries(c.providerParams ?? {})) {
+    lines.push(`    ${key}: ${value}`);
+  }
   if (mode === "byo") {
     if (c.expiresAt) {
       lines.push(`    Expires: ${c.expiresAt}`);

package/src/config/bundled-skills/computer-use/SKILL.md

@@ -25,16 +25,25 @@ desktop client and is never handled locally by the assistant.
 
 ## Observations
 
-Every computer-use step returns the accessibility tree. A screenshot comes with
-a desktop's first look, with window-scoped observations, or when you call
-`computer_use_observe` with `include_screenshot: true`. Ask for one whenever the
-tree is not enough to act on: a canvas, a game, a custom-drawn view, few or
+Every computer-use step returns the accessibility tree. Every action also
+returns a screenshot taken after it ran (one at the end of a
+`computer_use_sequence`), so check it to see what your action did. An
+observation comes with a screenshot on a desktop's first look, when it is
+window-scoped, or when you pass `include_screenshot: true`. Ask for one whenever
+the tree is not enough to act on: a canvas, a game, a custom-drawn view, few or
 unlabeled controls, or a layout question.
 
 The tree is walked to a limited depth to keep steps fast, and says when it was
 cut off. If the element you need is not in it, call `computer_use_observe` with
 `full_tree: true`.
 
+## Typing is not sending
+
+Pressing enter in a chat, email or form usually sends or submits it, and that
+cannot be taken back. Send only when the user asked you to send, post or
+submit. When they asked you to type, write or draft something, type it and stop
+before pressing enter; tell them it is ready to send.
+
 ## Batching known steps (macOS)
 
 When you already know the next few actions and none depends on seeing the

package/src/config/bundled-skills/computer-use/TOOLS.json

@@ -17,7 +17,7 @@
           },
           "include_screenshot": {
             "type": "boolean",
-            "description": "Force a screenshot with this observation. The accessibility tree is returned every step; ask for pixels whenever the tree is not enough to act on, such as a canvas, a game, a custom-drawn view, a window with few or unlabeled controls, or a question about layout."
+            "description": "Force a screenshot with this observation. The accessibility tree is returned every step and actions always return a screenshot of their result; ask for pixels on an observation whenever the tree is not enough to act on, such as a canvas, a game, a custom-drawn view, a window with few or unlabeled controls, or a question about layout."
           },
           "full_tree": {
             "type": "boolean",

package/src/config/feature-flag-registry.json

@@ -175,7 +175,7 @@
       "scope": "client",
       "key": "teleport",
       "label": "Teleport",
-      "description": "Enable teleport UI in General settings for moving assistants between hosting environments",
+      "description": "Enable the local-to-platform teleport UI in General settings. Platform-to-local teleport is GA and not gated by this flag",
       "defaultEnabled": false
     },
     {
@@ -474,6 +474,14 @@
       "description": "Gates the seeded Figma OAuth provider. When off, the provider is hidden from GET /v1/oauth/providers, its get-by-id route, and the connect/update routes, so it cannot be listed or connected from the CLI, gateway, or web integrations list. The row is still seeded into oauth_providers on startup, and existing connections keep injecting credentials; only its visibility changes.",
       "defaultEnabled": false
     },
+    {
+      "id": "quickbooks-oauth",
+      "scope": "assistant",
+      "key": "quickbooks-oauth",
+      "label": "QuickBooks Integration",
+      "description": "Gates the seeded QuickBooks OAuth provider. When off, the provider is hidden from GET /v1/oauth/providers, its get-by-id route, and the connect/update routes, so it cannot be listed or connected from the CLI, gateway, or web integrations list. The row is still seeded into oauth_providers on startup, and existing connections keep injecting credentials; only its visibility changes.",
+      "defaultEnabled": false
+    },
     {
       "id": "shopify-oauth",
       "scope": "assistant",

package/src/config/loader.ts

@@ -183,6 +183,7 @@ export function getDeploymentContextDefaults(): Record<string, unknown> {
       "shopify-oauth": managed,
       "stripe-link-oauth": managed,
       "figma-oauth": managed,
+      "quickbooks-oauth": managed,
       "eventbrite-oauth": managed,
       "calendly-oauth": managed,
     },

package/src/config/schemas/services.ts

@@ -157,6 +157,13 @@ export const FigmaOAuthServiceSchema = BaseServiceSchema.extend({
 });
 export type FigmaOAuthService = z.infer<typeof FigmaOAuthServiceSchema>;
 
+export const QuickBooksOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
+export type QuickBooksOAuthService = z.infer<
+  typeof QuickBooksOAuthServiceSchema
+>;
+
 export const EventbriteOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
@@ -228,6 +235,9 @@ export const ServicesSchema = z.object({
   "figma-oauth": FigmaOAuthServiceSchema.default(
     FigmaOAuthServiceSchema.parse({}),
   ),
+  "quickbooks-oauth": QuickBooksOAuthServiceSchema.default(
+    QuickBooksOAuthServiceSchema.parse({}),
+  ),
   "eventbrite-oauth": EventbriteOAuthServiceSchema.default(
     EventbriteOAuthServiceSchema.parse({}),
   ),

package/src/daemon/conversation-runtime-assembly.ts

@@ -819,10 +819,15 @@ export function applySightFrameRetention(
  * `null` on the happy path (desktop, full capabilities, no special context)
  * where no block is injected. Split from {@link injectChannelCapabilityContext}
  * so callers can capture the exact injected text for metadata persistence.
+ *
+ * Live vs clientless guidance belongs here, not in tool schemas. Tool
+ * definitions stay identical so the tools cache prefix can reuse; this block
+ * sits later in the system prompt and can describe the current turn.
  */
 export function buildChannelCapabilityBlock(
   caps: ChannelCapabilities,
   clientOs: string | undefined = caps.clientOS,
+  isNonInteractive = false,
 ): string | null {
   // Happy path: desktop with full capabilities and no special context — skip injection.
   if (
@@ -874,18 +879,24 @@ export function buildChannelCapabilityBlock(
       "- Do NOT reference the dashboard UI, settings panels, or visual preference pickers.",
     );
     if (!caps.supportsDynamicUi) {
-      if (caps.channel === "slack") {
+      if (isNonInteractive) {
         lines.push(
-          '- Do NOT use app_create. Only use ui_show/ui_update for card surfaces with template: "task_progress"; present all other information as text.',
+          "- ui_show, ui_update, and ui_dismiss persist conversation content for the next capable client that opens this conversation. Do not claim a surface is visible now or wait for an action.",
         );
       } else {
+        if (caps.channel === "slack") {
+          lines.push(
+            '- Do NOT use app_create. Only use ui_show/ui_update for card surfaces with template: "task_progress"; present all other information as text.',
+          );
+        } else {
+          lines.push(
+            "- Do NOT use ui_show, ui_update, or app_create. This channel cannot render them.",
+          );
+        }
         lines.push(
-          "- Do NOT use ui_show, ui_update, or app_create — this channel cannot render them.",
+          "- Present information as well-formatted text instead of dynamic UI.",
         );
       }
-      lines.push(
-        "- Present information as well-formatted text instead of dynamic UI.",
-      );
     }
     if (caps.channel === "whatsapp") {
       lines.push(
@@ -2853,6 +2864,7 @@ export async function applyRuntimeInjections(
       const channelCapabilityBlock = buildChannelCapabilityBlock(
         channelCapabilities,
         clientOs,
+        options.isNonInteractive === true,
       );
       if (channelCapabilityBlock !== null) {
         channelCapabilitiesCaptured = channelCapabilityBlock;

package/src/daemon/conversation-surfaces.ts

@@ -3180,7 +3180,7 @@ export async function surfaceProxyResolver(
           : typeof input.answer === "string"
             ? input.answer
             : "Task complete";
-      hostCuProxy.reset();
+      hostCuProxy.endTask(ctx.conversationId);
       return { content: summary, isError: false };
     }
 
@@ -3346,6 +3346,11 @@ export async function surfaceProxyResolver(
 
   if (toolName === "ui_show" || toolName === "ui_update") {
     const caps = ctx.channelCapabilities;
+    // Live non-dynamic channels reject unsupported surfaces. Clientless turns
+    // skip this gate so surfaces persist for a later capable client.
+    // `canShowInteractiveUi` fails closed on clientless turns because
+    // standalone surfaces have nobody to answer them, so it is not the
+    // predicate here.
     if (
       caps &&
       !ctx.hasNoClient &&

package/src/daemon/conversation-tool-setup.ts

@@ -62,10 +62,7 @@ import {
   type ToolContext,
   type ToolExecutionResult,
 } from "../tools/types.js";
-import {
-  injectActivationMomentParam,
-  projectUiToolsForChannel,
-} from "../tools/ui-surface/channel-variants.js";
+import { injectActivationMomentParam } from "../tools/ui-surface/channel-variants.js";
 import { loadWorkspaceTools } from "../tools/workspace-tools/loader.js";
 import {
   resolveUsageAttribution,
@@ -1147,18 +1144,13 @@ export function createResolveToolsCallback(
         : currentWorkspaceDefs
     ).filter((d) => !readOnlyHidesFromWire(d.name));
     const excluded = new Set(getConfig().tools.exclude);
-    // Swap UI surface tools for channel-appropriate variants (e.g. Slack's
-    // task_progress-only ui_show). Mirrors the pin handling in
-    // `isToolActiveForContext`: execution-gate-mode wakes pin channel
-    // capabilities to undefined, which resolves to the unprojected defs.
-    const channelForUiTools = ctx.toolContextPin
-      ? undefined
-      : ctx.channelCapabilities?.channel;
-    let allBaseDefs = projectUiToolsForChannel(
-      [...scopedCoreDefs, ...scopedWorkspaceDefs, ...scopedMcpDefs].filter(
-        (d) => !excluded.has(d.name),
-      ),
-      channelForUiTools,
+    // UI definitions stay identical across channel and background turns.
+    // Channel renderers enforce their supported surface subset at execution,
+    // while background calls persist the full surface content for the next
+    // capable client that opens the conversation. Skill tools stay off this
+    // list (`skill_execute` dispatch) and are a separate disclosure path.
+    let allBaseDefs = [...scopedCoreDefs, ...scopedWorkspaceDefs, ...scopedMcpDefs].filter(
+      (d) => !excluded.has(d.name),
     );
     // Activation-rail conversations carry the optional `activation_moment`
     // telemetry param on ui_show. The marker is written before the first

package/src/daemon/host-cu-proxy.ts

@@ -225,6 +225,11 @@ export class HostCuProxy {
    * that reset cleared.
    */
   private _resetGeneration = 0;
+  /**
+   * Desktops a request has been sent to since the last reset, keyed by
+   * `observedTargetKey`, so the end of a task can reach each one.
+   */
+  private _dispatchedTargets = new Map<string, string | undefined>();
   /**
    * Owned request IDs mapped to whether their observation is scoped, whether
    * the helper was told to skip the screenshot, and when the request was
@@ -442,6 +447,7 @@ export class HostCuProxy {
         detachAbort = () => signal.removeEventListener("abort", onAbort);
       }
 
+      this._dispatchedTargets.set(targetKey, resolvedTargetClientId);
       this._ownedRequests.set(requestId, {
         scoped: scopedObservation,
         screenshotSkipped,
@@ -592,8 +598,36 @@ export class HostCuProxy {
     }
   }
 
+  /**
+   * Finish the task: tell every desktop this task drove that it is over, then
+   * reset. The notice rides `host_cu_cancel` with a fresh request ID, which
+   * matches nothing in flight; the helper treats any cancel as the run
+   * stopping and puts the pointer back where the user left it, instead of
+   * waiting out its idle fallback.
+   */
+  endTask(conversationId: string): void {
+    for (const targetClientId of this._dispatchedTargets.values()) {
+      try {
+        broadcastMessage(
+          {
+            type: "host_cu_cancel",
+            requestId: uuid(),
+            conversationId,
+            ...(targetClientId != null ? { targetClientId } : {}),
+          },
+          conversationId,
+          { targetClientId },
+        );
+      } catch {
+        // Best-effort: the helper still returns the pointer after its idle delay.
+      }
+    }
+    this.reset();
+  }
+
   /** Reset all CU state. Called on terminal tools (computer_use_done, etc.). */
   reset(): void {
+    this._dispatchedTargets.clear();
     this._stepCount = 0;
     this._previousAXTree = undefined;
     this._consecutiveUnchangedSteps = 0;
@@ -604,20 +638,24 @@ export class HostCuProxy {
 
   /**
    * Whether the request about to be dispatched should carry a screenshot. The
-   * accessibility tree comes back every step. Pixels come back on the first
-   * look since the last reset, for a window- or display-scoped capture, and
-   * when the model asks for them. Otherwise whether the tree is enough is the
-   * model's call.
+   * accessibility tree comes back every step. Pixels come back after every
+   * action, so the model sees what its action did, on the first look since
+   * the last reset, for a window- or display-scoped capture, and when the
+   * model asks for them. Only a plain observation leaves whether the tree is
+   * enough to the model.
    */
   private shouldAttachScreenshot(
     toolName: string,
     input: Record<string, unknown>,
     targetKey: string,
   ): boolean {
+    if (toolName !== "computer_use_observe") {
+      return true;
+    }
     return (
       !this._observedTargets.has(targetKey) ||
       hasCaptureTarget(input) ||
-      (toolName === "computer_use_observe" && input.include_screenshot === true)
+      input.include_screenshot === true
     );
   }