@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/daemon/conversation-turn-finalize.ts

@@ -63,6 +63,8 @@ interface TurnTailContext {
 /** Minimal per-run handler state {@link settleTurnContent} consumes. */
 interface TurnContentState {
   readonly lastAssistantMessageId: string | undefined;
+  /** Earlier reply rows that must join the final disk-view export. */
+  readonly assistantMessageIdsToSync: ReadonlySet<string>;
   /** In-flight content writers the turn left behind (see EventHandlerState). */
   readonly inflightWriters: Map<string, InflightContentWriter>;
 }
@@ -224,20 +226,31 @@ export async function settleTurnContent(params: {
     );
   }
 
-  // Mirror the final assistant row into the JSONL disk view. Guarded like the
-  // steps above: this runs AFTER the terminal SSE, so a throw here must not
-  // escape into the loop's outer catch and emit a second, contradictory
-  // terminal event for a turn the client already saw complete.
-  try {
-    if (state.lastAssistantMessageId && liveConversation) {
-      syncMessageToDisk(
-        ctx.conversationId,
-        state.lastAssistantMessageId,
-        liveConversation.createdAt,
-      );
+  // Mirror every assistant row finalized by this turn into the JSONL disk
+  // view. Most turns contribute only their last row. A turn that delivered its
+  // reply through `send_user_message` can also contribute an earlier row that
+  // received the reply attachment. Set insertion order preserves the reply's
+  // position, while adding the last row deduplicates the ordinary case where
+  // both ids are the same.
+  if (liveConversation) {
+    const messageIds = new Set(state.assistantMessageIdsToSync);
+    if (state.lastAssistantMessageId) {
+      messageIds.add(state.lastAssistantMessageId);
+    }
+    for (const messageId of messageIds) {
+      try {
+        syncMessageToDisk(
+          ctx.conversationId,
+          messageId,
+          liveConversation.createdAt,
+        );
+      } catch (err) {
+        rlog.warn(
+          { err, messageId },
+          "Failed to sync assistant message to disk (non-fatal)",
+        );
+      }
     }
-  } catch (err) {
-    rlog.warn({ err }, "Failed to sync assistant message to disk (non-fatal)");
   }
 }
 

package/src/daemon/conversation.ts

@@ -16,7 +16,7 @@
  */
 
 import { repairHistory } from "../agent/history-repair/history-repair.js";
-import type { AgentLoopConfig } from "../agent/loop.js";
+import type { AgentLoopConfig, PreparedModelCall } from "../agent/loop.js";
 import { AgentLoop } from "../agent/loop.js";
 import type { AssistantActivityStateEvent } from "../api/events/assistant-activity-state.js";
 import type { ConfirmationStateChangedEvent } from "../api/events/confirmation-state-changed.js";
@@ -39,6 +39,7 @@ import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
 import { resolveSendUserMessageActive } from "../config/send-user-message-gate.js";
+import { isSessionGroupsEnabled } from "../config/session-groups-gate.js";
 import {
   derefToolResultReReads,
   postTurnTruncateToolResults,
@@ -92,6 +93,7 @@ import {
   markV3LiveBlock,
   MEMORY_V3_POINTER_BLOCK_METADATA_KEY,
 } from "../plugins/defaults/memory/v3/types.js";
+import { resolveDelegateIndependentTasks } from "../prompts/delegation-gate.js";
 import {
   applyBootstrapTemplate,
   buildSystemPrompt,
@@ -117,6 +119,8 @@ import { withSqliteRetry } from "../util/sqlite-retry.js";
 import type { WorkspaceGitService } from "../workspace/git-service.js";
 import type { commitTurnChanges } from "../workspace/turn-commit.js";
 import type { AssistantAttachmentDraft } from "./assistant-attachments.js";
+import { BrowserModeSessionProducer } from "./browser-mode-session.js";
+import { ComputerUseModeSessionProducer } from "./computer-use-mode-session.js";
 import type { AssistantSurface } from "./conversation-agent-loop.js";
 import {
   applyCompactionResult,
@@ -140,6 +144,7 @@ import {
   persistUserMessage as persistUserMessageImpl,
   redirectToSecurePrompt as redirectToSecurePromptImpl,
 } from "./conversation-messaging.js";
+import { ConversationModeSessionCoordinator } from "./conversation-mode-session.js";
 // Extracted modules
 import { registerConversationNotifiers } from "./conversation-notifiers.js";
 import type { ProcessMessageOptions } from "./conversation-process.js";
@@ -181,6 +186,7 @@ import {
   canSpawnSubagentsForTurn,
   createResolveToolsCallback,
   createToolExecutor,
+  createWireToolSurfaceRecorder,
 } from "./conversation-tool-setup.js";
 import { canonicalizeTimeZone } from "./date-context.js";
 import { HostAppControlProxy } from "./host-app-control-proxy.js";
@@ -191,6 +197,7 @@ import { filterMessagesForUntrustedActor } from "./message-provenance.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import { isHostProxyTransport } from "./message-types/conversations.js";
 import { conversationMetadataSyncTag } from "./message-types/sync.js";
+import { bestEffortModeSessionTracking } from "./mode-session-tracking.js";
 import { renderReactionHistoryText } from "./reaction-history-render.js";
 import type { QueuedReactionRecord } from "./reaction-record.js";
 import {
@@ -199,6 +206,7 @@ import {
 } from "./summarize-boundary.js";
 
 const log = getLogger("conversation");
+const PROMPT_CACHE_WARM_MAX_TOKENS = 16;
 
 /**
  * First text block of a persisted message row's content, mirroring
@@ -452,6 +460,41 @@ export class Conversation {
    * @internal
    */
   toolContextPin?: WakeToolContextPin;
+  /**
+   * Tool definitions sent verbatim in place of the resolved wire array, for
+   * a wake replaying its source conversation's recorded surface
+   * (`recordConversationToolSurface`). Set and restored alongside the
+   * allowlist by `scopeWakeAllowedTools`; read only where the resolver returns
+   * the wire array, so it never widens what may execute.
+   * @internal
+   */
+  wireToolReplay?: readonly ToolDefinition[];
+  /**
+   * The delegation section's rendered state a wake replaying its source's
+   * recorded surface carries into its system prompt, in place of the answer
+   * derived from the wake's own scope (`canSpawnSubagentsForTurn`). Set and
+   * restored alongside {@link wireToolReplay} by `scopeWakeAllowedTools`;
+   * read only by {@link buildCurrentSystemPrompt}, so it never widens what
+   * may execute.
+   * @internal
+   */
+  delegateIndependentTasksReplay?: boolean;
+  /**
+   * The delegation-section state the system prompt most recently built by
+   * {@link buildCurrentSystemPrompt} rendered: the value the loop's prompt
+   * carries until the next build. `null` when that prompt is a verbatim
+   * override, unset before the first build. Read by the wire-surface recorder
+   * so the recorded state is the one the provider received, not a
+   * re-derivation that a config change mid-turn could flip.
+   * @internal
+   */
+  renderedDelegateIndependentTasks?: boolean | null;
+  /**
+   * Hash of the wire surface last recorded for this conversation in this
+   * process, so an unchanged surface is not rewritten on every provider call.
+   * @internal
+   */
+  recordedToolSurfaceHash?: string;
   /** @internal */ readonly skillProjectionState = new Map<string, string>();
   /** @internal */ readonly skillProjectionCache: SkillProjectionCache = {};
   /** @internal */ usageStats: UsageStats = {
@@ -488,6 +531,13 @@ export class Conversation {
    */
   enabledPlugins: string[] | null = null;
   /** @internal */ currentRequestId?: string;
+  /** Canonical recorded-session ownership for this conversation. */
+  readonly modeSessions: ConversationModeSessionCoordinator;
+  /** Computer-use producer mapped onto the canonical session coordinator. */
+  readonly computerUseModeSessions: ComputerUseModeSessionProducer;
+  /** Browser producer mapped onto the canonical session coordinator. */
+  readonly browserModeSessions: BrowserModeSessionProducer;
+  private liveVoiceResidencyLeases = 0;
   /**
    * The `clientMessageId` the running turn was started by, recorded in the same
    * synchronous step that takes the processing lock.
@@ -746,17 +796,22 @@ export class Conversation {
    */
   pendingInterruptActivityBridge = false;
   /**
-   * Set by `interruptRunningTurn` when the abort it ran landed with no tool
-   * call in flight, and consumed exactly once by the persist of the
-   * interrupting user message, which appends
+   * Set by `interruptRunningTurn` on every handover it completes, and consumed
+   * exactly once by the first user message persisted after it, which appends
    * {@link INTERRUPTED_TURN_NOTE_TEXT} to that message's LLM-facing content
    * and stamps `interruptedPriorTurn` on the row.
    *
-   * An interrupt caught mid-tool needs nothing here: the synthetic
-   * `tool_result` the loop or the repair writes already tells the model a
-   * message preempted it. Caught mid-provider-call there is no `tool_use` to
-   * answer, so the note is the only signal, and it rides on the message that
-   * did the interrupting.
+   * The note is the only place the behavior after an interrupt is spelled out.
+   * A synthetic `tool_result` states what happened to the one call it answers
+   * and nothing more, so an interrupt caught mid-tool arms this too.
+   *
+   * It belongs to the history position, not to the send that armed it. That
+   * first row is the one sitting directly under the work the handover stopped,
+   * so it is the row whose note the model reads in the right place. Normally it
+   * is the interrupting message itself. When that send loses the lock race and
+   * queues, the message that persists first was also sent while the assistant
+   * was working, and the note is true of it; the queued one drains after a
+   * completed turn, where the same note would be stale.
    * @internal
    */
   pendingInterruptNote = false;
@@ -938,6 +993,16 @@ export class Conversation {
     const { maxTokens, speedOverride, cacheTtl, modelOverride } = options ?? {};
     const enableNativeWebSearch = options?.enableNativeWebSearch ?? false;
     this.conversationId = conversationId;
+    this.modeSessions = new ConversationModeSessionCoordinator(conversationId);
+    this.computerUseModeSessions = new ComputerUseModeSessionProducer(
+      this.modeSessions,
+      isSessionGroupsEnabled,
+    );
+    this.browserModeSessions = new BrowserModeSessionProducer(
+      this.modeSessions,
+      1,
+      isSessionGroupsEnabled,
+    );
     this.parentConversationId = options?.parentConversationId;
     this.systemPrompt = systemPrompt;
     this.provider = provider;
@@ -1038,6 +1103,7 @@ export class Conversation {
       tools: toolDefs.length > 0 ? toolDefs : undefined,
       toolExecutor: toolDefs.length > 0 ? toolExecutor : undefined,
       resolveTools,
+      onToolsSent: createWireToolSurfaceRecorder(this),
       resolveConversationDir: () => {
         const conv = getConversation(this.conversationId);
         if (!conv) {
@@ -1132,23 +1198,40 @@ export class Conversation {
    * the provider's prefix cache).
    */
   buildCurrentSystemPrompt(): string {
-    return this.hasSystemPromptOverride
-      ? this.systemPrompt
-      : buildSystemPrompt({
-          hasNoClient: this.hasNoClient,
-          trustContext: this.currentTurnTrustContext,
-          channelCapabilities: this.currentTurnChannelCapabilities,
-          personaOverride: this.wakePersonaOverride,
-          onboardingContext: this.getOnboardingContext(),
-          conversationId: this.conversationId,
-          sendUserMessageTool: resolveSendUserMessageActive(this),
-          // Read off this turn's resolved tool surface: a workspace
-          // `tools.exclude` entry, a background run's `allowedTools` scope, a
-          // read-only subagent pass, or tools disabled all answer no, and the
-          // delegation section renders off rather than pointing at a tool the
-          // turn cannot call.
-          canSpawnSubagents: canSpawnSubagentsForTurn(this),
-        });
+    if (this.hasSystemPromptOverride) {
+      this.renderedDelegateIndependentTasks = null;
+      return this.systemPrompt;
+    }
+    // Resolved once here, handed to the builder, and kept for the
+    // wire-surface recorder, so the prompt the provider receives and the state
+    // a fork replays are the same value by construction. A wake replaying its
+    // source's recorded surface renders the section the source's live turn
+    // rendered; otherwise the answer is read off this turn's resolved tool
+    // surface: a workspace `tools.exclude` entry, a background run's
+    // `allowedTools` scope, a read-only subagent pass, or tools disabled all
+    // answer no, and the section renders off rather than pointing at a tool
+    // the turn cannot call.
+    const delegateIndependentTasks =
+      this.delegateIndependentTasksReplay ??
+      resolveDelegateIndependentTasks({
+        canSpawnSubagents: canSpawnSubagentsForTurn(this),
+        channelCapabilities: this.currentTurnChannelCapabilities,
+      });
+    const prompt = buildSystemPrompt({
+      hasNoClient: this.hasNoClient,
+      trustContext: this.currentTurnTrustContext,
+      channelCapabilities: this.currentTurnChannelCapabilities,
+      personaOverride: this.wakePersonaOverride,
+      onboardingContext: this.getOnboardingContext(),
+      conversationId: this.conversationId,
+      sendUserMessageTool: resolveSendUserMessageActive(this),
+      delegateIndependentTasks,
+    });
+    // Recorded only once the build succeeds: a wake's prompt sync swallows a
+    // failed rebuild and runs on the previous prompt, whose state must stay
+    // the recorded one.
+    this.renderedDelegateIndependentTasks = delegateIndependentTasks;
+    return prompt;
   }
 
   /**
@@ -1182,48 +1265,91 @@ export class Conversation {
   // ── Prompt Cache Warming ─────────────────────────────────────────
 
   /**
-   * Fire-and-forget LLM call with max_tokens=1 to populate the provider's
-   * prompt cache (system prompt + tools). Called after the canned first
-   * greeting so the user's next real message gets a cache hit.
+   * Non-rejecting LLM call with a minimal output budget to populate the selected
+   * provider's prompt cache (system prompt + tools).
    */
-  warmPromptCache(): void {
+  async warmPromptCache(options?: {
+    callSite?: LLMCallSite;
+    overrideProfile?: string;
+    forceOverrideProfile?: boolean;
+    signal?: AbortSignal;
+    systemPrompt?: string | null;
+    tools?: ToolDefinition[];
+  }): Promise<void> {
     this.cacheWarmAbort?.abort();
     const abort = new AbortController();
     this.cacheWarmAbort = abort;
 
-    const systemPrompt = this.buildCurrentSystemPrompt();
-    const tools = getAllToolDefinitions();
-    const provider = this.provider;
+    const externalSignal = options?.signal;
+    const relayAbort = (): void => abort.abort(externalSignal?.reason);
+    if (externalSignal?.aborted) {
+      relayAbort();
+    } else {
+      externalSignal?.addEventListener("abort", relayAbort, { once: true });
+    }
 
-    const warmMessage: Message = {
-      role: "user",
-      content: [{ type: "text", text: "hi" }],
-    };
+    const callSite = options?.callSite ?? "mainAgent";
 
-    provider
-      .sendMessage([warmMessage], {
-        tools,
-        systemPrompt,
+    try {
+      const hasSystemPrompt =
+        options !== undefined &&
+        Object.prototype.hasOwnProperty.call(options, "systemPrompt");
+      const systemPrompt = hasSystemPrompt
+        ? (options.systemPrompt ?? undefined)
+        : this.buildCurrentSystemPrompt();
+      const tools =
+        options?.tools ?? this.agentLoop.getResolvedTools(this.messages);
+      const providerConfig = {
+        ...(options?.overrideProfile !== undefined
+          ? { overrideProfile: options.overrideProfile }
+          : {}),
+        ...(options?.forceOverrideProfile !== undefined
+          ? { forceOverrideProfile: options.forceOverrideProfile }
+          : {}),
+        selectionSeed: this.conversationId,
+      };
+      const warmMessage: Message = {
+        role: "user",
+        content: [{ type: "text", text: "hi" }],
+      };
+
+      await this.provider.sendMessage([warmMessage], {
+        tools: tools.length > 0 ? tools : undefined,
+        ...(systemPrompt !== undefined ? { systemPrompt } : {}),
         config: {
-          max_tokens: 1,
-          callSite: "mainAgent",
-          usageTracking: "manual",
+          max_tokens: PROMPT_CACHE_WARM_MAX_TOKENS,
+          callSite,
+          ...providerConfig,
+          conversationId: this.conversationId,
         },
         signal: abort.signal,
-      })
-      .then(() => {
-        log.info("Prompt cache warmed successfully");
-      })
-      .catch((err) => {
-        if (!abort.signal.aborted) {
-          log.warn({ err }, "Prompt cache warming failed (non-fatal)");
-        }
-      })
-      .finally(() => {
-        if (this.cacheWarmAbort === abort) {
-          this.cacheWarmAbort = undefined;
-        }
       });
+      if (!abort.signal.aborted) {
+        log.info(
+          {
+            callSite,
+            profile: options?.overrideProfile ?? null,
+          },
+          "Prompt cache warmed successfully",
+        );
+      }
+    } catch (err) {
+      if (!abort.signal.aborted) {
+        log.warn(
+          {
+            err,
+            callSite,
+            profile: options?.overrideProfile ?? null,
+          },
+          "Prompt cache warming failed (non-fatal)",
+        );
+      }
+    } finally {
+      externalSignal?.removeEventListener("abort", relayAbort);
+      if (this.cacheWarmAbort === abort) {
+        this.cacheWarmAbort = undefined;
+      }
+    }
   }
 
   // ── Lifecycle ────────────────────────────────────────────────────
@@ -2454,14 +2580,31 @@ export class Conversation {
     return !this.queue.isEmpty;
   }
 
+  acquireLiveVoiceResidency(): () => void {
+    this.liveVoiceResidencyLeases += 1;
+    let released = false;
+    return () => {
+      if (released) {
+        return;
+      }
+      released = true;
+      this.liveVoiceResidencyLeases = Math.max(
+        0,
+        this.liveVoiceResidencyLeases - 1,
+      );
+    };
+  }
+
   /**
    * True when dropping this instance would lose work that is still in flight:
-   * a live turn, a queued successor, or a child subagent.
+   * a live turn, queued successor, child subagent, or mode-session lifecycle.
    */
   hasInFlightWork(): boolean {
     return (
       this.isProcessing() ||
       this.hasQueuedMessages() ||
+      this.liveVoiceResidencyLeases > 0 ||
+      this.modeSessions.hasResidentWork() ||
       getSubagentManager().hasActiveChildren(this.conversationId)
     );
   }
@@ -2588,6 +2731,16 @@ export class Conversation {
 
   setHostCuProxy(proxy: HostCuProxy | undefined): void {
     if (this.hostCuProxy && this.hostCuProxy !== proxy) {
+      const previousProxy = this.hostCuProxy;
+      bestEffortModeSessionTracking("computer use proxy replacement", () => {
+        this.computerUseModeSessions.endTask({
+          turnId: this.currentRequestId,
+          source: {
+            sourceId: previousProxy.sourceId,
+            generation: previousProxy.resetGeneration,
+          },
+        });
+      });
       this.hostCuProxy.dispose();
     }
     this.hostCuProxy = proxy;
@@ -3362,6 +3515,8 @@ export class Conversation {
        */
       replyDeliveredInAppOnly?: boolean;
       callSite?: LLMCallSite;
+      /** Provider configuration source when distinct from turn semantics. */
+      inferenceCallSite?: LLMCallSite;
       /**
        * Optional ad-hoc inference-profile override applied to every LLM call
        * the loop issues for this turn. Forwarded into
@@ -3373,6 +3528,8 @@ export class Conversation {
       overrideProfile?: string;
       /** Float `overrideProfile` above call-site layers for this run. */
       forceOverrideProfile?: boolean;
+      /** Observe the first finalized model request without delaying it. */
+      onFirstModelCallPrepared?: (prepared: PreparedModelCall) => void;
       /**
        * Firing's `cron_runs.id` stamped onto this turn's usage rows. Per-turn:
        * forwarded into {@link runAgentLoopImpl} and threaded to `recordUsage`.

package/src/daemon/daemon-control.ts

@@ -43,7 +43,7 @@ function isPositiveInteger(v: unknown): v is number {
 
 /**
  * Read daemon timeout values directly from the config JSON file, bypassing
- * loadConfig() and its ensureMigratedDataDir()/ensureDataDir() side effects.
+ * loadConfig() and its ensureDataDir() side effects.
  * Falls back to hardcoded defaults on any error (missing file, malformed JSON,
  * unexpected shape) so daemon stop/start never fails due to config issues.
  */
@@ -258,15 +258,11 @@ async function getDaemonStatus(): Promise<{
   return { running: true, pid };
 }
 
-function getStartupLockPath(): string {
-  return getDaemonStartupLockPath();
-}
-
 /** Attempt to acquire a startup lock. Returns true on success. Stale locks
  *  (older than STARTUP_LOCK_STALE_MS) are forcibly removed to prevent
  *  permanent deadlocks from a crashed caller. */
 function acquireStartupLock(): boolean {
-  const lockPath = getStartupLockPath();
+  const lockPath = getDaemonStartupLockPath();
   try {
     // Ensure the root directory exists before attempting the lock file write.
     // On a first-time run, getRootDir() may not exist yet, and writeFileSync
@@ -293,7 +289,7 @@ function acquireStartupLock(): boolean {
 
 function releaseStartupLock(): void {
   try {
-    unlinkSync(getStartupLockPath());
+    unlinkSync(getDaemonStartupLockPath());
   } catch {
     /* already removed */
   }

package/src/daemon/handlers/config-model.ts

@@ -98,14 +98,16 @@ export function setImageGenModel(modelId: string, ctx: ModelSetContext): void {
   // Keep the derived provider in sync with the selected model so downstream
   // routing never sends a Gemini request to an OpenAI model (or vice versa).
   // The prefix logic is shared with workspace migration 006-services-config
-  // via providerForImageModelPrefix(). Provider "vellum" is exempt: it is
-  // managed for every model (the backend derives from the model at request
-  // time), and rewriting it here would silently move a managed user onto a
-  // BYOK provider they may hold no key for.
+  // via providerForImageModelPrefix(). Providers "vellum" and "openrouter"
+  // are exempt: vellum is managed for every model, and openrouter owns every
+  // selected slug (including google/ and openai/ prefixes). Rewriting either
+  // would silently move the user onto a BYOK provider they may hold no key
+  // for.
   const services = raw.services as
     | Record<string, { provider?: string }>
     | undefined;
-  if (services?.["image-generation"]?.provider !== "vellum") {
+  const currentProvider = services?.["image-generation"]?.provider;
+  if (currentProvider !== "vellum" && currentProvider !== "openrouter") {
     setServiceField(
       raw,
       "image-generation",

package/src/daemon/handlers/shared.ts

@@ -3,8 +3,13 @@ import {
   SENTINEL_REDACTION_VERSION,
 } from "@vellumai/service-contracts/redacted-credential";
 import { v4 as uuid } from "uuid";
+import { z } from "zod";
 
 import { AnsweredQuestionSchema } from "../../api/events/question-answered.js";
+import {
+  type ToolActivityMetadata,
+  ToolActivityMetadataSchema,
+} from "../../api/events/tool-result.js";
 import type {
   ConversationContentBlock,
   ConversationMessageAttachment,
@@ -246,6 +251,33 @@ export interface ConversationCreateOptions {
   conversationType?: ConversationCreateType;
 }
 
+/** One schema per activity entry, so each entry validates on its own. */
+const ACTIVITY_ENTRY_SCHEMAS = Object.entries(
+  ToolActivityMetadataSchema.shape,
+).map(([key, schema]) => z.object({ [key]: schema }));
+
+/**
+ * Validates a persisted `_activityMetadata` rider one tool's entry at a time.
+ * Cards render these fields directly, so an entry that no longer matches its
+ * schema is dropped (its card degrades to the result text) without taking a
+ * valid sibling entry with it.
+ */
+function readPersistedActivityMetadata(
+  value: unknown,
+): ToolActivityMetadata | undefined {
+  if (!isRecord(value)) {
+    return undefined;
+  }
+  const activity: ToolActivityMetadata = {};
+  for (const schema of ACTIVITY_ENTRY_SCHEMAS) {
+    const parsed = schema.safeParse(value);
+    if (parsed.success) {
+      Object.assign(activity, parsed.data);
+    }
+  }
+  return Object.keys(activity).length > 0 ? activity : undefined;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value != null;
 }
@@ -661,12 +693,12 @@ export function renderHistoryContent(
         entry.riskDirectoryScopeOptions =
           block._riskDirectoryScopeOptions as HistoryToolCall["riskDirectoryScopeOptions"];
       }
-      // Read back tool activity (web_search / web_fetch) persisted by
-      // `annotatePersistedAssistantMessage` so the activity card survives a
-      // history reopen instead of degrading to the plain result text.
-      if (isRecord(block._activityMetadata)) {
-        entry.activityMetadata =
-          block._activityMetadata as HistoryToolCall["activityMetadata"];
+      // Read back tool activity persisted by `annotatePersistedAssistantMessage`
+      // so the activity card survives a history reopen instead of degrading to
+      // the plain result text.
+      const activity = readPersistedActivityMetadata(block._activityMetadata);
+      if (activity) {
+        entry.activityMetadata = activity;
       }
       // Read back the answered `ask_question` record so the answered card
       // rehydrates from history. Validated (rather than trusted like the
@@ -708,9 +740,9 @@ export function renderHistoryContent(
       }
       // Native server tools (Anthropic web_search) persist their activity on
       // the server_tool_use block, so read it back here too.
-      if (isRecord(block._activityMetadata)) {
-        entry.activityMetadata =
-          block._activityMetadata as HistoryToolCall["activityMetadata"];
+      const activity = readPersistedActivityMetadata(block._activityMetadata);
+      if (activity) {
+        entry.activityMetadata = activity;
       }
       toolCalls.push(entry);
       if (id) {
@@ -936,17 +968,24 @@ async function mintCollectionLinkFallback(
  *
  * Lifecycle state (resolver, timer) is registered in pendingInteractions — the
  * same tracker the in-conversation SecretPrompter uses — so `POST /v1/secret`
- * resolves the prompt generically. When a `conversationId` is supplied (the CLI
- * `credentials prompt` command forwards `__CONVERSATION_ID`), the broadcast is
- * scoped to that conversation so clients deliver it; otherwise it is
- * conversation-less. When that conversation's channel cannot render dynamic UI
- * (e.g. slack, telegram), resolves immediately with `unsupported_channel` —
- * carrying a one-time collection link when the gateway can mint one — instead
- * of broadcasting a request that can only time out.
+ * resolves the prompt generically. The broadcast is scoped to the supplied
+ * `conversationId` (the CLI `credentials prompt` command forwards
+ * `__CONVERSATION_ID`) so clients deliver it. Two cases have no surface that
+ * can render the card and resolve immediately with `unsupported_channel`,
+ * carrying a one-time collection link when the gateway can mint one, instead
+ * of broadcasting a request that can only time out:
+ *   - the conversation's channel cannot render dynamic UI (slack, telegram);
+ *   - there is no conversation at all (a headless exec such as Doctor's
+ *     `run_assistant_cli`). Clients drop conversation-scoped events without a
+ *     conversationId and `/v1/pending-interactions` is keyed by conversation,
+ *     so a conversation-less `secret_request` is invisible everywhere.
  */
 export function requestSecretStandalone(
   params: StandaloneSecretParams,
 ): Promise<SecretPromptResult> {
+  if (!params.conversationId) {
+    return mintCollectionLinkFallback(params);
+  }
   const conversation = findConversation(params.conversationId);
   if (conversation && !conversationSupportsDynamicUi(conversation)) {
     return mintCollectionLinkFallback(params);