@vellumai/assistant 0.6.4 → 0.6.5

package/src/daemon/pkb-context-tracker.test.ts

@@ -0,0 +1,169 @@
+import path from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import type { ContentBlock, Message } from "../providers/types.js";
+import type { Conversation } from "./conversation.js";
+import { getInContextPkbPaths } from "./pkb-context-tracker.js";
+
+const WORKING_DIR = path.resolve("/tmp/test-pkb-root");
+const PKB_ROOT = path.join(WORKING_DIR, "pkb");
+
+// The helper only reads `conversation.messages`. Constructing a real
+// `Conversation` instance would require a full daemon setup; casting a
+// minimal object through `unknown` keeps the test isolated and pure while
+// still exercising the public type.
+function makeConversation(messages: Message[]): Conversation {
+  return { messages } as unknown as Conversation;
+}
+
+function fileReadToolUse(filePath: string): ContentBlock {
+  return {
+    type: "tool_use",
+    id: `toolu_${Math.random().toString(36).slice(2, 10)}`,
+    name: "file_read",
+    input: { path: filePath },
+  };
+}
+
+function assistantMessageWithBlocks(blocks: ContentBlock[]): Message {
+  return { role: "assistant", content: blocks };
+}
+
+describe("getInContextPkbPaths", () => {
+  test("auto-inject paths are always present (even with empty conversation)", () => {
+    const conversation = makeConversation([]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["notes/index.md", "journal/2026-04-18.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([
+        path.join(PKB_ROOT, "notes/index.md"),
+        path.join(PKB_ROOT, "journal/2026-04-18.md"),
+      ]),
+    );
+  });
+
+  test("includes a file_read tool_use with a path inside pkbRoot", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/thoughts.md");
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse(insidePath)]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set([insidePath]));
+  });
+
+  test("excludes a file_read tool_use whose path is outside pkbRoot", () => {
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse("/etc/hosts")]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("excludes a non-file_read tool_use with a PKB-like path", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/thoughts.md");
+    const bogus: ContentBlock = {
+      type: "tool_use",
+      id: "toolu_bogus",
+      name: "file_write",
+      input: { path: insidePath },
+    };
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([bogus]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("post-compaction context-summary user message returns only auto-inject paths", () => {
+    // After compaction, the structured tool_use blocks have been serialized
+    // away and the conversation is just a user-role text message containing
+    // the summary.
+    const summaryMessage: Message = {
+      role: "user",
+      content: [
+        {
+          type: "text",
+          text: "[Context summary] Previously you read notes/thoughts.md and journal/2026-04-18.md...",
+        },
+      ],
+    };
+    const conversation = makeConversation([summaryMessage]);
+    const autoInject = ["profile/identity.md"];
+    const result = getInContextPkbPaths(
+      conversation,
+      autoInject,
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([path.join(PKB_ROOT, "profile/identity.md")]),
+    );
+  });
+
+  test("path-traversal attempt via ../../etc/passwd is excluded", () => {
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([
+        fileReadToolUse("../../etc/passwd"),
+        fileReadToolUse("notes/../../../etc/shadow"),
+      ]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("relative file_read path outside pkbRoot is excluded", () => {
+    // These are resolved against `workingDir` (matching `file_read`'s own
+    // rule), land outside `pkbRoot`, and are correctly ignored.
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([
+        fileReadToolUse("notes.md"),
+        fileReadToolUse("./deep/subdir/file.md"),
+      ]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("workspace-relative file_read path inside pkb/ is recognized", () => {
+    // The model emits workspace-relative paths like `pkb/threads.md`.
+    // The tracker resolves them against `workingDir` (matching `file_read`'s
+    // own rule) and verifies the result falls inside `pkbRoot`.
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse("pkb/threads.md")]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set([path.join(PKB_ROOT, "threads.md")]));
+  });
+
+  test("resolves relative auto-inject paths against pkbRoot", () => {
+    const conversation = makeConversation([]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["./notes/relative.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([path.join(PKB_ROOT, "notes/relative.md")]),
+    );
+  });
+
+  test("auto-inject and file_read paths union (no duplicates)", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/shared.md");
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse(insidePath)]),
+    ]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["notes/shared.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result.size).toBe(1);
+    expect(result.has(insidePath)).toBe(true);
+  });
+});

package/src/daemon/pkb-context-tracker.ts

@@ -0,0 +1,125 @@
+/**
+ * pkb-context-tracker
+ *
+ * Pure helper that reports which PKB file paths are already "in context" for
+ * a given conversation. A path is considered in context if either:
+ *
+ *   1. It was explicitly auto-injected (caller supplies `autoInjectPaths`),
+ *      typically via a system-reminder that embeds the file contents.
+ *   2. The conversation history contains a structured `file_read` tool_use
+ *      block whose `input.path` — resolved the same way `file_read` itself
+ *      resolves it (absolute as-is, relative against `workingDir`) — lands
+ *      inside `pkbRoot`.
+ *
+ * Used by the PKB system reminder so we don't suggest files the model has
+ * already loaded.
+ *
+ * Post-compaction note: structured `tool_use` blocks get serialized into a
+ * plain-text summary and dropped from the live message array. After a
+ * compaction, this helper will naturally only see the `autoInjectPaths` —
+ * which is the desired semantics.
+ *
+ * No I/O, no globals, no side effects.
+ */
+
+import path from "node:path";
+
+import type { ContentBlock, Message } from "../providers/types.js";
+
+/**
+ * Minimal shape this helper needs from a `Conversation`. Defining it as an
+ * interface (rather than importing the full `Conversation` class) keeps the
+ * helper pure and trivial to unit-test without constructing a real daemon
+ * conversation.
+ */
+export interface PkbContextConversation {
+  messages: Message[];
+}
+
+/**
+ * The structured tool_use block name the assistant emits when reading files
+ * from the workspace (see `assistant/src/tools/filesystem/read.ts`).
+ */
+const FILE_READ_TOOL_NAME = "file_read";
+
+/**
+ * Resolve `candidate` against `pkbRoot` and return the absolute path ONLY if
+ * it stays inside `pkbRoot`. Otherwise return `undefined`. Guards against
+ * `..`-style path traversal.
+ */
+function resolveInsidePkbRoot(
+  candidate: string,
+  pkbRoot: string,
+): string | undefined {
+  if (typeof candidate !== "string" || candidate.length === 0) {
+    return undefined;
+  }
+  const resolved = path.resolve(pkbRoot, candidate);
+  // `path.resolve` normalizes any `..` segments in `candidate`. We still need
+  // to verify the result is inside `pkbRoot`. Comparing with a trailing
+  // separator avoids treating `<pkbRoot>somethingElse` as inside the root.
+  if (resolved === pkbRoot) {
+    return resolved;
+  }
+  const rootWithSep = pkbRoot.endsWith(path.sep) ? pkbRoot : pkbRoot + path.sep;
+  if (resolved.startsWith(rootWithSep)) {
+    return resolved;
+  }
+  return undefined;
+}
+
+/**
+ * Returns the set of absolute PKB file paths already in the conversation's
+ * in-memory context. This is the union of `autoInjectPaths` (resolved into
+ * `pkbRoot`) and any `file_read` tool_use block inputs found in
+ * `conversation.messages` that resolve inside `pkbRoot`.
+ *
+ * `file_read` resolves its `path` argument against `workingDir` (the tool's
+ * working directory), so this helper mirrors that rule: relative tool paths
+ * are resolved against `workingDir`, absolute paths are taken as-is, and the
+ * resulting absolute path is then accepted only if it falls inside `pkbRoot`.
+ *
+ * Paths outside `pkbRoot` (including `..`-traversal attempts) are excluded.
+ * Tool uses whose `name` is not `file_read` are ignored.
+ */
+export function getInContextPkbPaths(
+  conversation: PkbContextConversation,
+  autoInjectPaths: string[],
+  pkbRoot: string,
+  workingDir: string,
+): Set<string> {
+  const normalizedRoot = path.resolve(pkbRoot);
+  const normalizedWorkingDir = path.resolve(workingDir);
+  const inContext = new Set<string>();
+
+  for (const candidate of autoInjectPaths) {
+    const resolved = resolveInsidePkbRoot(candidate, normalizedRoot);
+    if (resolved !== undefined) {
+      inContext.add(resolved);
+    }
+  }
+
+  for (const message of conversation.messages) {
+    if (!Array.isArray(message.content)) continue;
+    for (const block of message.content as ContentBlock[]) {
+      if (block.type !== "tool_use") continue;
+      if (block.name !== FILE_READ_TOOL_NAME) continue;
+      const rawPath = block.input?.path;
+      if (typeof rawPath !== "string" || rawPath.length === 0) continue;
+      // Mirror `file_read`'s own path resolution: absolute paths are taken
+      // as-is; relative paths resolve against the tool's working directory
+      // (NOT `pkbRoot`). Resolving relative paths against `pkbRoot` would
+      // double-prefix workspace-relative inputs like `pkb/threads.md` into
+      // `<pkbRoot>/pkb/threads.md` and miss the actually-loaded file.
+      const absolute = path.isAbsolute(rawPath)
+        ? path.resolve(rawPath)
+        : path.resolve(normalizedWorkingDir, rawPath);
+      const resolved = resolveInsidePkbRoot(absolute, normalizedRoot);
+      if (resolved !== undefined) {
+        inContext.add(resolved);
+      }
+    }
+  }
+
+  return inContext;
+}

package/src/daemon/pkb-reminder-builder.test.ts

@@ -0,0 +1,70 @@
+import { describe, expect, test } from "bun:test";
+
+import { buildPkbReminder } from "./pkb-reminder-builder.js";
+
+// Byte-for-byte fixture of the original PKB_SYSTEM_REMINDER from
+// conversation-runtime-assembly.ts. If this ever needs to change, the
+// matching string in conversation-runtime-assembly.ts must change too.
+const ORIGINAL_REMINDER =
+  "<system_reminder>" +
+  "\nRead any unread Personal Knowledge Base files that might be even partially relevant to this conversation" +
+  "\nUse `remember` for anything you learn immediately" +
+  "\n</system_reminder>";
+
+describe("buildPkbReminder", () => {
+  test("empty hints returns exact original reminder byte-for-byte", () => {
+    expect(buildPkbReminder([])).toBe(ORIGINAL_REMINDER);
+  });
+
+  test("single hint renders one bullet with no duplicates or trailing blank line", () => {
+    const out = buildPkbReminder(["projects/alpha.md"]);
+    const expected =
+      "<system_reminder>" +
+      "\nRead any unread Personal Knowledge Base files that might be even partially relevant to this conversation." +
+      "\nBased on the current context, these files look especially relevant:" +
+      "\n- projects/alpha.md" +
+      "\nUse `remember` for anything you learn immediately" +
+      "\n</system_reminder>";
+    expect(out).toBe(expected);
+
+    // Exactly one bullet.
+    const bulletCount = (out.match(/^- /gm) ?? []).length;
+    expect(bulletCount).toBe(1);
+
+    // No blank line before closing tag.
+    expect(out.includes("\n\n</system_reminder>")).toBe(false);
+  });
+
+  test("three hints render all three in order", () => {
+    const hints = ["a.md", "sub/b.md", "c/d/e.md"];
+    const out = buildPkbReminder(hints);
+    const expected =
+      "<system_reminder>" +
+      "\nRead any unread Personal Knowledge Base files that might be even partially relevant to this conversation." +
+      "\nBased on the current context, these files look especially relevant:" +
+      "\n- a.md" +
+      "\n- sub/b.md" +
+      "\n- c/d/e.md" +
+      "\nUse `remember` for anything you learn immediately" +
+      "\n</system_reminder>";
+    expect(out).toBe(expected);
+
+    // Order check — each should appear after the previous.
+    const idxA = out.indexOf("- a.md");
+    const idxB = out.indexOf("- sub/b.md");
+    const idxC = out.indexOf("- c/d/e.md");
+    expect(idxA).toBeGreaterThan(-1);
+    expect(idxB).toBeGreaterThan(idxA);
+    expect(idxC).toBeGreaterThan(idxB);
+  });
+
+  test("hints with special chars (< and &) are emitted verbatim (no escaping)", () => {
+    const hints = ["weird<name>.md", "foo&bar.md"];
+    const out = buildPkbReminder(hints);
+    expect(out).toContain("- weird<name>.md");
+    expect(out).toContain("- foo&bar.md");
+    // Ensure no HTML-style escaping happened.
+    expect(out).not.toContain("&lt;");
+    expect(out).not.toContain("&amp;");
+  });
+});

package/src/daemon/pkb-reminder-builder.ts

@@ -0,0 +1,31 @@
+/**
+ * Render the PKB system_reminder text, optionally with a bulleted list of
+ * hint paths that look especially relevant to the current conversation.
+ *
+ * When `hints` is empty, returns the legacy two-line reminder byte-for-byte.
+ * When `hints` is non-empty, renders an extended reminder with a bullet per
+ * hint. Hints are emitted verbatim — they are trusted internal paths, not
+ * user input, so no escaping is performed.
+ *
+ * Caller is responsible for capping the hints array at 3 entries.
+ */
+export function buildPkbReminder(hints: ReadonlyArray<string>): string {
+  if (hints.length === 0) {
+    return (
+      "<system_reminder>" +
+      "\nRead any unread Personal Knowledge Base files that might be even partially relevant to this conversation" +
+      "\nUse `remember` for anything you learn immediately" +
+      "\n</system_reminder>"
+    );
+  }
+
+  const bullets = hints.map((h) => `- ${h}`).join("\n");
+  return (
+    "<system_reminder>" +
+    "\nRead any unread Personal Knowledge Base files that might be even partially relevant to this conversation." +
+    "\nBased on the current context, these files look especially relevant:" +
+    `\n${bullets}` +
+    "\nUse `remember` for anything you learn immediately" +
+    "\n</system_reminder>"
+  );
+}

package/src/daemon/providers-setup.ts

@@ -27,6 +27,12 @@ import { googleCalendarProvider } from "../watcher/providers/google-calendar.js"
 import { linearProvider } from "../watcher/providers/linear.js";
 import { outlookProvider } from "../watcher/providers/outlook.js";
 import { outlookCalendarProvider } from "../watcher/providers/outlook-calendar.js";
+
+// Side-effect import: runs each bundled first-party skill's tool
+// registration before `initializeTools()` so external tools are visible
+// to the LLM. See `external-skills-bootstrap.ts` for the rationale.
+import "./external-skills-bootstrap.js";
+
 const log = getLogger("lifecycle");
 
 export async function initializeProvidersAndTools(

package/src/daemon/server.ts

@@ -27,6 +27,7 @@ import type { CesProcessManager } from "../credential-execution/process-manager.
 import type { FilingService } from "../filing/filing-service.js";
 import type { HeartbeatService } from "../heartbeat/heartbeat-service.js";
 import { CliIpcServer } from "../ipc/cli-server.js";
+import { registerBrowserIpcContextResolver } from "../ipc/routes/browser-context.js";
 import { getApp, getAppDirPath, isMultifileApp } from "../memory/app-store.js";
 import * as attachmentsStore from "../memory/attachments-store.js";
 import {
@@ -49,6 +50,7 @@ import {
 import { getOrCreateConversation } from "../memory/conversation-key-store.js";
 import { syncIdentityNameToPlatform } from "../platform/sync-identity.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
+import { CallSiteRoutingProvider } from "../providers/call-site-routing.js";
 import { RateLimitProvider } from "../providers/ratelimit.js";
 import { getProvider, initializeProviders } from "../providers/registry.js";
 import {
@@ -60,6 +62,7 @@ import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getSigningKeyFingerprint } from "../runtime/auth/token-service.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
+import { registerInteractiveUiResolver } from "../runtime/interactive-ui.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { checkIngressForSecrets } from "../security/secret-ingress.js";
 import { redactSecrets } from "../security/secret-scanner.js";
@@ -90,10 +93,14 @@ import {
 } from "./conversation.js";
 import { ConversationEvictor } from "./conversation-evictor.js";
 import { registerLaunchConversationDeps } from "./conversation-launch.js";
+import { buildSlackMetaForPersistence } from "./conversation-messaging.js";
 import { formatCompactResult } from "./conversation-process.js";
 import { resolveChannelCapabilities } from "./conversation-runtime-assembly.js";
 import { resolveSlash, type SlashContext } from "./conversation-slash.js";
-import { refreshSurfacesForApp } from "./conversation-surfaces.js";
+import {
+  refreshSurfacesForApp,
+  showStandaloneSurface,
+} from "./conversation-surfaces.js";
 import { undoLastMessage } from "./handlers/conversations.js";
 import { parseIdentityFields } from "./handlers/identity.js";
 import type {
@@ -813,6 +820,11 @@ export class DaemonServer {
     // DB, exposing only the narrow surface the wake helper needs.
     registerDefaultWakeResolver(async (conversationId) => {
       try {
+        // Only resolve existing conversations — don't create ghost
+        // conversations for stale targets (e.g. meetings that ended
+        // but a delayed opportunity callback still fires).
+        const existing = getConversation(conversationId);
+        if (!existing) return null;
         const conversation = await this.getOrCreateConversation(conversationId);
         return conversationToWakeTarget(conversation);
       } catch (err) {
@@ -824,6 +836,59 @@ export class DaemonServer {
       }
     });
 
+    // Install the interactive UI resolver so skills and IPC handlers can
+    // present ad-hoc UI surfaces (confirmations, forms) to the user via
+    // `requestInteractiveUi()`. Interactive UI requires a client to be
+    // actively connected to the conversation (via SSE), which means the
+    // conversation must be in the in-memory map. If the conversation was
+    // evicted from memory the client is definitely disconnected, so
+    // hydration from persistent storage is pointless — the hydrated
+    // conversation would have hasNoClient=true, causing
+    // canShowInteractiveUi() to return false and the surface to be
+    // cancelled with no_interactive_surface. We skip that wasted work
+    // and return conversation_not_found directly.
+    registerInteractiveUiResolver(async (request) => {
+      const conversation = this.conversations.get(request.conversationId);
+
+      if (!conversation) {
+        log.warn(
+          {
+            conversationId: request.conversationId,
+            surfaceType: request.surfaceType,
+          },
+          "interactive-ui resolver: conversation not in memory (client not connected); failing closed",
+        );
+        return {
+          status: "cancelled" as const,
+          surfaceId: `ui-resolver-${Date.now()}`,
+          cancellationReason: "conversation_not_found" as const,
+        };
+      }
+
+      // Generate a unique surface ID and delegate to the conversation's
+      // standalone surface lifecycle. The returned Promise blocks until
+      // the user submits, cancels, or the timeout elapses.
+      const surfaceId = `ui-standalone-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      return showStandaloneSurface(conversation, request, surfaceId);
+    });
+
+    // Allow `browser_execute` IPC calls to reuse live conversation browser
+    // proxy wiring (when a caller passes a conversationId from
+    // __CONVERSATION_ID / __SKILL_CONTEXT_JSON). This keeps nested
+    // `assistant browser status` checks consistent with the parent turn's
+    // extension connectivity instead of always falling back to a synthetic
+    // browser-cli session that has no hostBrowserProxy.
+    registerBrowserIpcContextResolver((conversationId) => {
+      const conversation = this.conversations.get(conversationId);
+      if (!conversation) return null;
+      return {
+        conversationId,
+        trustClass: conversation.trustContext?.trustClass ?? "guardian",
+        hostBrowserProxy: conversation.hostBrowserProxy,
+        transportInterface: conversation.transportInterface,
+      };
+    });
+
     // Start the CLI IPC server. Built-in methods (wake_conversation) are
     // registered by the constructor; CLI commands connect to this socket to
     // invoke daemon-side operations that require in-process state.
@@ -1033,7 +1098,19 @@ export class DaemonServer {
 
       const createPromise = (async () => {
         const config = getConfig();
-        let provider = getProvider(config.services.inference.provider);
+        let provider = getProvider(config.llm.default.provider);
+        // Per-call `options.config.callSite` can resolve to a provider name
+        // that differs from `llm.default.provider`. Wrap the default
+        // provider so the actual transport routes correctly per call,
+        // rather than only forwarding metadata to the default's HTTP
+        // client. See `providers/call-site-routing.ts`.
+        provider = new CallSiteRoutingProvider(provider, (name) => {
+          try {
+            return getProvider(name);
+          } catch {
+            return undefined;
+          }
+        });
         const { rateLimit } = config;
         if (rateLimit.maxRequestsPerMinute > 0) {
           provider = new RateLimitProvider(
@@ -1046,7 +1123,8 @@ export class DaemonServer {
 
         const systemPrompt =
           storedOptions?.systemPromptOverride ?? buildSystemPrompt();
-        const maxTokens = storedOptions?.maxResponseTokens ?? config.maxTokens;
+        const maxTokens =
+          storedOptions?.maxResponseTokens ?? config.llm.default.maxTokens;
 
         const memoryPolicy = this.deriveMemoryPolicy(conversationId);
         // Resolve the shared CES client (may still be initializing).
@@ -1065,7 +1143,6 @@ export class DaemonServer {
           sharedCesClient,
           storedOptions?.speed,
           undefined,
-          storedOptions?.modelIntent,
           storedOptions?.modelOverride,
         );
         newConversation.updateClient(sendToClient, true);
@@ -1397,6 +1474,7 @@ export class DaemonServer {
       .runAgentLoop(content, messageId, onEvent, {
         isInteractive: options?.isInteractive ?? false,
         isUserMessage: true,
+        ...(options?.callSite ? { callSite: options.callSite } : {}),
       })
       .finally(() => {
         if (
@@ -1437,14 +1515,26 @@ export class DaemonServer {
       messageCount: conversation.getMessages().length,
       inputTokens: conversation.usageStats.inputTokens,
       outputTokens: conversation.usageStats.outputTokens,
-      maxInputTokens: config.contextWindow.maxInputTokens,
-      model: config.services.inference.model,
-      provider: config.services.inference.provider,
+      maxInputTokens: config.llm.default.contextWindow.maxInputTokens,
+      model: config.llm.default.model,
+      provider: config.llm.default.provider,
       estimatedCost: conversation.usageStats.estimatedCost,
       userMessageInterface: serverInterfaceCtx?.userMessageInterface,
     };
     const slashResult = await resolveSlash(content, slashContext);
 
+    // Slack inbound metadata is materialized once here for the slash-command
+    // bypass paths (unknown-slash and /compact), which persist the user row
+    // directly via `addMessage` and would otherwise drop the envelope. The
+    // agent-loop path does not consume this variable — it forwards
+    // `options.slackInbound` through `persistMetadata` and the envelope is
+    // built internally by `buildSlackMetaForPersistence` inside
+    // `persistQueuedMessageBody`.
+    const slackMeta = buildSlackMetaForPersistence({
+      slackInbound: options?.slackInbound,
+      turnChannel: conversation.getTurnChannelContext()?.userMessageChannel,
+    });
+
     if (slashResult.kind === "unknown") {
       const serverTurnCtx = conversation.getTurnChannelContext();
       const serverProvenance = provenanceFromTrustContext(
@@ -1476,13 +1566,20 @@ export class DaemonServer {
           ? { imageSourcePaths }
           : {}),
       };
+      // slackMeta encodes the inbound user message's ts/thread — it attaches
+      // to the user row only. The assistant's slash-command response does not
+      // originate from Slack and must not inherit the user's channelTs, which
+      // would break ordering in the chronological renderer.
+      const userMetaWithSlack = slackMeta
+        ? { ...serverChannelMeta, slackMeta }
+        : serverChannelMeta;
       const cleanMsg = createUserMessage(content, attachments);
       const llmMsg = enrichMessageWithSourcePaths(cleanMsg, attachments);
       const persisted = await addMessage(
         conversationId,
         "user",
         JSON.stringify(cleanMsg.content),
-        serverChannelMeta,
+        userMetaWithSlack,
       );
       conversation.getMessages().push(llmMsg);
 
@@ -1560,12 +1657,15 @@ export class DaemonServer {
             }
           : {}),
       };
+      const compactUserMeta = slackMeta
+        ? { ...compactChannelMeta, slackMeta }
+        : compactChannelMeta;
       const cleanMsg = createUserMessage(content, attachments);
       const persisted = await addMessage(
         conversationId,
         "user",
         JSON.stringify(cleanMsg.content),
-        compactChannelMeta,
+        compactUserMeta,
       );
       conversation.getMessages().push(cleanMsg);
 
@@ -1590,10 +1690,17 @@ export class DaemonServer {
     const resolvedContent = slashResult.content;
 
     const requestId = crypto.randomUUID();
+    // Slack inbound metadata captured at the channel ingress boundary is
+    // forwarded into the persistence call so `persistQueuedMessageBody` can
+    // emit a `slackMeta` envelope on the row's metadata column.
+    const persistMetadata = options?.slackInbound
+      ? { slackInbound: options.slackInbound }
+      : undefined;
     const messageId = await conversation.persistUserMessage(
       resolvedContent,
       attachments,
       requestId,
+      persistMetadata,
     );
 
     // Register pending interactions so channel approval interception can
@@ -1623,6 +1730,7 @@ export class DaemonServer {
       await conversation.runAgentLoop(resolvedContent, messageId, onEvent, {
         isInteractive: options?.isInteractive ?? false,
         isUserMessage: true,
+        ...(options?.callSite ? { callSite: options.callSite } : {}),
       });
     } finally {
       if (

package/src/daemon/tool-side-effects.ts

@@ -195,15 +195,6 @@ registerHook(
   },
 );
 
-// Broadcast tasks_changed so connected clients (e.g. macOS Tasks window)
-// auto-refresh when the LLM mutates the task queue via tools
-registerHook(
-  ["task_list_add", "task_list_update", "task_list_remove", "task_queue_run"],
-  (_name, _input, _result, { broadcastToAllClients }) => {
-    broadcastToAllClients?.({ type: "tasks_changed" });
-  },
-);
-
 // Broadcast voice config changes to all connected clients so every window
 // picks up the updated UserDefaults value immediately.
 registerHook(