@vellumai/assistant 0.6.6 → 0.7.0

package/src/daemon/config-watcher.ts

@@ -12,12 +12,10 @@ import {
 } from "node:fs";
 import { join } from "node:path";
 
-import { clearFeatureFlagOverridesCache } from "../config/assistant-feature-flags.js";
 import { getConfig, invalidateConfigCache } from "../config/loader.js";
 import type { MemoryCleanupConfig } from "../config/schemas/memory-lifecycle.js";
 import { resetCleanupScheduleThrottle } from "../memory/cleanup-schedule-state.js";
 import { clearEmbeddingBackendCache } from "../memory/embedding-backend.js";
-import { clearCache as clearTrustCache } from "../permissions/trust-store.js";
 import { initializeProviders } from "../providers/registry.js";
 import { handleBashSignal } from "../signals/bash.js";
 import { handleCancelSignal } from "../signals/cancel.js";
@@ -30,7 +28,6 @@ import { getLogger } from "../util/logger.js";
 import {
   AVATAR_IMAGE_FILENAME,
   getAvatarDir,
-  getProtectedDir,
   getSignalsDir,
   getSoundsDir,
   getWorkspaceDir,
@@ -113,7 +110,6 @@ export class ConfigWatcher {
     if (fingerprint === this.lastFingerprint) {
       return false;
     }
-    clearTrustCache();
     clearEmbeddingBackendCache();
     // If cleanup retention settings changed, reset the cleanup scheduler
     // throttle so the next worker tick re-enqueues jobs with the new values
@@ -139,7 +135,6 @@ export class ConfigWatcher {
     onSoundsConfigChanged?: () => void,
     onAvatarChanged?: () => void,
     onConfigChanged?: () => void,
-    onFeatureFlagsChanged?: () => void,
   ): void {
     const workspaceDir = getWorkspaceDir();
 
@@ -212,7 +207,6 @@ export class ConfigWatcher {
       this.startAvatarWatcher(onAvatarChanged);
     }
 
-    this.startFeatureFlagsWatcher(onFeatureFlagsChanged);
     this.startSignalsWatcher();
     this.startUsersWatcher(onConversationEvict);
     this.startSkillsWatchers(onConversationEvict);
@@ -325,54 +319,6 @@ export class ConfigWatcher {
     }
   }
 
-  private startFeatureFlagsWatcher(onFeatureFlagsChanged?: () => void): void {
-    const protectedDir = process.env.GATEWAY_SECURITY_DIR || getProtectedDir();
-
-    try {
-      if (!existsSync(protectedDir)) {
-        mkdirSync(protectedDir, { recursive: true });
-      }
-    } catch {
-      // If we can't create it, watching will also fail — handled below.
-    }
-
-    const FLAG_FILES = new Set([
-      "feature-flags.json",
-      "feature-flags-remote.json",
-    ]);
-
-    try {
-      const watcher = watch(protectedDir, (_eventType, filename) => {
-        if (!filename) return;
-        const file = String(filename);
-        if (!FLAG_FILES.has(file)) return;
-        this.debounceTimers.schedule(
-          "file:feature-flags",
-          () => {
-            log.info(
-              { file },
-              "Feature flags file changed, invalidating cache",
-            );
-            clearFeatureFlagOverridesCache();
-            onFeatureFlagsChanged?.();
-          },
-          500,
-        );
-      });
-      attachWatcherErrorHandler(watcher, protectedDir);
-      this.watchers.push(watcher);
-      log.info(
-        { dir: protectedDir },
-        "Watching protected directory for feature flag changes",
-      );
-    } catch (err) {
-      log.warn(
-        { err, dir: protectedDir },
-        "Failed to watch protected directory for feature flags. Flag changes will require a restart.",
-      );
-    }
-  }
-
   private startSignalsWatcher(): void {
     const signalsDir = getSignalsDir();
     try {
@@ -561,6 +507,20 @@ function safeGetCleanupConfig(): MemoryCleanupConfig | undefined {
  *
  * Exported for unit testing.
  */
+// ─── Module-level singleton ──────────────────────────────────────────────────
+
+let _instance: ConfigWatcher | undefined;
+
+/**
+ * Return the global ConfigWatcher instance, lazily creating it on first access.
+ */
+export function getConfigWatcher(): ConfigWatcher {
+  if (!_instance) {
+    _instance = new ConfigWatcher();
+  }
+  return _instance;
+}
+
 export function cleanupSettingsChanged(
   prev: MemoryCleanupConfig | undefined,
   next: MemoryCleanupConfig | undefined,

package/src/daemon/connection-policy.ts

@@ -27,20 +27,6 @@ export function hasNoAuthOverride(
   return true;
 }
 
-/**
- * True when VELLUM_DAEMON_NOAUTH is set but the safety gate
- * VELLUM_UNSAFE_AUTH_BYPASS=1 is missing — used for warning messages.
- */
-export function hasUngatedNoAuthOverride(
-  env: Record<string, string | undefined> = process.env,
-): boolean {
-  const value = env.VELLUM_DAEMON_NOAUTH?.trim();
-  if (value !== "1" && value !== "true") return false;
-
-  const safetyGate = env.VELLUM_UNSAFE_AUTH_BYPASS?.trim();
-  return safetyGate !== "1";
-}
-
 export function shouldAutoStartDaemon(
   env: Record<string, string | undefined> = process.env,
 ): boolean {

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -155,6 +155,11 @@ export interface EventHandlerState {
     string,
     { decision: string; label: string }
   >;
+  /** Stores risk metadata keyed by tool_use_id (populated in handleToolResult). */
+  readonly toolRiskOutcomes: Map<
+    string,
+    { riskLevel: string; riskReason?: string; autoApproved: boolean }
+  >;
   /** tool_use_ids emitted in the current turn (populated in handleToolUse, cleared after annotation). */
   currentTurnToolUseIds: string[];
   /** Wall-clock time (ms since epoch) when the agent loop turn started, used as the display timestamp for assistant messages. */
@@ -211,6 +216,7 @@ export function createEventHandlerState(): EventHandlerState {
     currentToolUseId: undefined,
     requestIdToToolUseId: new Map(),
     toolConfirmationOutcomes: new Map(),
+    toolRiskOutcomes: new Map(),
     currentTurnToolUseIds: [],
     turnStartedAt: Date.now(),
   };
@@ -218,7 +224,7 @@ export function createEventHandlerState(): EventHandlerState {
 
 // ── Shared Helper ────────────────────────────────────────────────────
 
-export function emitLlmCallStartedIfNeeded(
+function emitLlmCallStartedIfNeeded(
   state: EventHandlerState,
   deps: EventHandlerDeps,
 ): void {
@@ -265,7 +271,7 @@ function friendlyToolName(name: string): string {
 
 // ── Individual Handlers ──────────────────────────────────────────────
 
-export function handleTextDelta(
+function handleTextDelta(
   state: EventHandlerState,
   deps: EventHandlerDeps,
   event: Extract<AgentEvent, { type: "text_delta" }>,
@@ -295,7 +301,7 @@ export function handleTextDelta(
   }
 }
 
-export function handleThinkingDelta(
+function handleThinkingDelta(
   state: EventHandlerState,
   deps: EventHandlerDeps,
   event: Extract<AgentEvent, { type: "thinking_delta" }>,
@@ -383,7 +389,7 @@ export function handleToolUsePreviewStart(
   );
 }
 
-export function handleToolOutputChunk(
+function handleToolOutputChunk(
   _state: EventHandlerState,
   deps: EventHandlerDeps,
   event: Extract<AgentEvent, { type: "tool_output_chunk" }>,
@@ -502,6 +508,23 @@ export function handleToolResult(
   if (ts) ts.completedAt = Date.now();
   state.currentToolUseId = undefined;
 
+  // Capture risk metadata when present. autoApproved is true when the tool
+  // was NOT prompted for confirmation (no entry in toolConfirmationOutcomes).
+  // Confirmation outcomes are set BEFORE handleToolResult fires, so the map
+  // is fully populated at this point.
+  //
+  // Known limitation: non-interactive sessions that auto-deny a tool without
+  // prompting also have no confirmation outcome entry, so those denials are
+  // recorded as autoApproved=true. This field is for DB/log analytics only
+  // and has no UI impact; consult _confirmationDecision for denial signal.
+  if (event.riskLevel) {
+    state.toolRiskOutcomes.set(event.toolUseId, {
+      riskLevel: event.riskLevel,
+      riskReason: event.riskReason,
+      autoApproved: !state.toolConfirmationOutcomes.has(event.toolUseId),
+    });
+  }
+
   const toolName = state.toolUseIdToName.get(event.toolUseId);
   if (toolName === "file_write" || toolName === "bash") {
     deps.ctx.markWorkspaceTopLevelDirty();
@@ -577,6 +600,7 @@ export function handleToolResult(
     riskReason: event.riskReason,
     isContainerized: event.isContainerized,
     riskScopeOptions: event.riskScopeOptions,
+    riskDirectoryScopeOptions: event.riskDirectoryScopeOptions,
   });
 }
 
@@ -624,6 +648,13 @@ function annotatePersistedAssistantMessage(
         rec._confirmationLabel = confirmation.label;
         modified = true;
       }
+      const risk = state.toolRiskOutcomes.get(id);
+      if (risk) {
+        rec._riskLevel = risk.riskLevel;
+        if (risk.riskReason) rec._riskReason = risk.riskReason;
+        rec._autoApproved = risk.autoApproved;
+        modified = true;
+      }
     }
   }
 
@@ -655,7 +686,7 @@ function annotatePersistedAssistantMessage(
   state.currentTurnToolUseIds = [];
 }
 
-export function handleError(
+function handleError(
   state: EventHandlerState,
   deps: EventHandlerDeps,
   event: Extract<AgentEvent, { type: "error" }>,
@@ -928,7 +959,7 @@ export async function handleMessageComplete(
   );
 }
 
-export function handleUsage(
+function handleUsage(
   state: EventHandlerState,
   deps: EventHandlerDeps,
   event: Extract<AgentEvent, { type: "usage" }>,

package/src/daemon/conversation-agent-loop.ts

@@ -39,6 +39,7 @@ import type { ContextWindowManager } from "../context/window-manager.js";
 import type { ToolProfiler } from "../events/tool-profiling-listener.js";
 import { emitFeedEvent } from "../home/emit-feed-event.js";
 import { writeRelationshipState } from "../home/relationship-state-writer.js";
+import { rewriteFeedTitle } from "../home/rewrite-feed-title.js";
 import {
   clearSentryConversationContext,
   setSentryConversationContext,
@@ -51,6 +52,7 @@ import {
   getConversation,
   getConversationOriginChannel,
   getConversationOriginInterface,
+  getConversationOverrideProfileFromRow,
   getLastUserTimestampBefore,
   getMessageById,
   provenanceFromTrustContext,
@@ -65,6 +67,7 @@ import {
 import type { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
 import { recordMemoryRecallLog } from "../memory/memory-recall-log-store.js";
 import { PKB_WORKSPACE_SCOPE } from "../memory/pkb/types.js";
+import type { QdrantSparseVector } from "../memory/qdrant-client.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import { defaultCompactionTerminal } from "../plugins/defaults/compaction.js";
 import { defaultHistoryRepairTerminal } from "../plugins/defaults/history-repair.js";
@@ -145,7 +148,6 @@ import type {
   ChannelCapabilities,
   InboundActorContext,
   InjectionMode,
-  TrustContext,
 } from "./conversation-runtime-assembly.js";
 import {
   applyRuntimeInjections,
@@ -173,8 +175,10 @@ import type {
   UsageStats,
 } from "./message-protocol.js";
 import type { MemoryRecalled } from "./message-types/memory.js";
+import type { ConfirmationStateChanged } from "./message-types/messages.js";
 import { parseActualTokensFromError } from "./parse-actual-tokens-from-error.js";
 import type { TraceEmitter } from "./trace-emitter.js";
+import type { TrustContext } from "./trust-context.js";
 import { stripHistoricalWebSearchResults } from "./web-search-history.js";
 
 const log = getLogger("conversation-agent-loop");
@@ -303,7 +307,7 @@ async function runCompactionCircuitPipeline(
  * with no outcome. Async because the pipeline runner is async, but the
  * default plugin resolves synchronously on its microtask.
  */
-export async function isCompactionCircuitOpen(ctx: {
+async function isCompactionCircuitOpen(ctx: {
   readonly conversationId: string;
   consecutiveCompactionFailures: number;
   compactionCircuitOpenUntil: number | null;
@@ -359,7 +363,7 @@ export async function trackCompactionOutcome(
  * `guardian` so a missing snapshot cannot accidentally grant elevated trust
  * to a custom plugin reading `ctx.trust`.
  */
-export const FALLBACK_TURN_TRUST: TrustContext = {
+const FALLBACK_TURN_TRUST: TrustContext = {
   sourceChannel: "vellum",
   trustClass: "unknown",
 };
@@ -388,7 +392,7 @@ export const FALLBACK_TURN_TRUST: TrustContext = {
  *   don't need it can ignore it; the default compaction plugin reads it
  *   via the typed optional field on `TurnContext`.
  */
-export function buildPluginTurnContext(
+function buildPluginTurnContext(
   ctx: AgentLoopConversationContext,
   requestId: string,
 ): PluginTurnContext {
@@ -464,6 +468,15 @@ export interface AgentLoopConversationContext {
   currentTurnTrustContext?: TrustContext;
   /** Per-turn snapshot of channelCapabilities, frozen at message-processing start. */
   currentTurnChannelCapabilities?: ChannelCapabilities;
+  /**
+   * Per-turn snapshot of the resolved inference-profile override. Read by
+   * `createToolExecutor` so `ToolContext.overrideProfile` carries the same
+   * profile the agent loop is sending to the provider. Without this, a tool
+   * that spawns nested subagents (e.g. `subagent_spawn`) cannot recover the
+   * override from a row read because the in-flight subagent's own row never
+   * had `inferenceProfile` set.
+   */
+  currentTurnOverrideProfile?: string;
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   trustContext?: TrustContext;
   /** Task-run scope for the current turn. Cleared at turn end so queued/drained turns don't inherit it. */
@@ -520,13 +533,10 @@ export interface AgentLoopConversationContext {
     statusText?: string,
   ): void;
   emitConfirmationStateChanged(
-    params: import("./message-types/messages.js").ConfirmationStateChanged extends {
+    params: ConfirmationStateChanged extends {
       type: infer _;
     }
-      ? Omit<
-          import("./message-types/messages.js").ConfirmationStateChanged,
-          "type"
-        >
+      ? Omit<ConfirmationStateChanged, "type">
       : never,
   ): void;
 
@@ -573,6 +583,16 @@ export async function runAgentLoopImpl(
      * the agent loop defaults to `'mainAgent'` for user-initiated turns.
      */
     callSite?: LLMCallSite;
+    /**
+     * Optional ad-hoc inference-profile override applied to every LLM call
+     * the loop issues. When set, the agent loop sets
+     * `SendMessageOptions.config.overrideProfile` on each provider call so
+     * the resolver layers `llm.profiles[<name>]` between the workspace's
+     * `activeProfile` and the call-site's named profile. Used by
+     * per-conversation pinned profiles (and inherited by subagents the loop
+     * spawns).
+     */
+    overrideProfile?: string;
   },
 ): Promise<void> {
   if (!ctx.abortController) {
@@ -603,6 +623,28 @@ export async function runAgentLoopImpl(
   // `llm.callSites.mainAgent` (falling back to `llm.default` when absent).
   const turnCallSite: LLMCallSite = options?.callSite ?? "mainAgent";
 
+  // Read the conversation row once for both the override-profile derivation
+  // below and the title-replaceability check at turn start. Later reads in
+  // this function (post-turn truncation, disk sync, home-feed emission)
+  // intentionally re-read because state can change during the turn.
+  const turnStartConversation = getConversation(ctx.conversationId);
+
+  // Optional per-turn inference-profile override. Plumbed through to every
+  // LLM call the loop emits and inherited by any subagents spawned during
+  // this turn. Caller-supplied `options.overrideProfile` (e.g.
+  // SubagentManager forwarding the parent's pinned profile into the
+  // spawned subagent's background conversation) wins over the row read
+  // so the agent loop's own background-skip rule doesn't zero out an
+  // explicitly inherited override.
+  const turnOverrideProfile =
+    options?.overrideProfile ??
+    getConversationOverrideProfileFromRow(turnStartConversation);
+
+  // Snapshot for `createToolExecutor` to read into `ToolContext.overrideProfile`
+  // — see field doc on `AgentLoopConversationContext` for why the tool needs
+  // it (nested subagent spawns can't recover the override from a row read).
+  ctx.currentTurnOverrideProfile = turnOverrideProfile;
+
   // Capture the turn channel context *before* any awaits so a second
   // message from a different channel can't overwrite it mid-flight.
   // When context is unavailable (e.g. regenerate after daemon restart),
@@ -633,8 +675,8 @@ export async function runAgentLoopImpl(
         assistantMessageInterface: origin,
       };
     return {
-      userMessageInterface: "vellum" as InterfaceId,
-      assistantMessageInterface: "vellum" as InterfaceId,
+      userMessageInterface: "web" as InterfaceId,
+      assistantMessageInterface: "web" as InterfaceId,
     };
   })();
 
@@ -694,9 +736,7 @@ export async function runAgentLoopImpl(
     // cancels the response, since the user message is already persisted.
     // Deferred via setTimeout so the main agent loop LLM call enqueues
     // first, avoiding rate-limit slot contention on strict configs.
-    if (
-      isReplaceableTitle(getConversation(ctx.conversationId)?.title ?? null)
-    ) {
+    if (isReplaceableTitle(turnStartConversation?.title ?? null)) {
       // TurnContext routed through the canonical builder so the pipeline's
       // log record reports the same `conversationId`/`turnIndex` shape as
       // every other slot in this turn. Title generation does not depend on
@@ -898,9 +938,7 @@ export async function runAgentLoopImpl(
     const defaultGraphPayload: GraphMemoryPayload | null =
       asDefaultGraphPayload(memoryResult.memoryGraphBlocks);
     let pkbQueryVector: number[] | undefined;
-    let pkbSparseVector:
-      | import("../memory/qdrant-client.js").QdrantSparseVector
-      | undefined;
+    let pkbSparseVector: QdrantSparseVector | undefined;
     if (defaultGraphPayload) {
       const graphResult = defaultGraphPayload.result;
       runMessages = graphResult.runMessages;
@@ -1380,30 +1418,66 @@ export async function runAgentLoopImpl(
         toolTokenBudget,
         maxAttempts: overflowRecovery.maxAttempts,
         abortSignal: abortController.signal,
-        compactFn: async (msgs, signal, opts) =>
+        compactFn: async (msgs, signal, opts) => {
           // Route the reducer's forced-compaction tier through the
           // `compaction` pipeline so registered plugins observe these
           // invocations. Without this, custom compaction middleware only
           // sees the three orchestrator-owned call sites and misses the
           // reducer-initiated forced compactions entirely.
-          (await runPipeline<CompactionArgs, CompactionResult>(
-            "compaction",
-            getMiddlewaresFor("compaction"),
-            (args) =>
-              defaultCompactionTerminal(
-                args,
-                buildPluginTurnContext(ctx, reqId),
-              ),
-            {
-              messages: msgs,
-              signal,
-              options: opts,
-            },
-            buildPluginTurnContext(ctx, reqId),
-            DEFAULT_TIMEOUTS.compaction,
-          )) as Awaited<
-            ReturnType<typeof ctx.contextWindowManager.maybeCompact>
-          >,
+          //
+          // Pipeline timeouts must be caught locally — a `PluginTimeoutError`
+          // bubbling out of here would abort the overflow-reducer tier loop
+          // entirely, skipping fallback tiers (tool-result truncation, media
+          // stubbing, injection downgrade) and bypassing circuit-breaker
+          // bookkeeping. On timeout, record the failure and return a
+          // `compacted: false` result so the reducer falls through to the
+          // next tier.
+          try {
+            return (await runPipeline<CompactionArgs, CompactionResult>(
+              "compaction",
+              getMiddlewaresFor("compaction"),
+              (args) =>
+                defaultCompactionTerminal(
+                  args,
+                  buildPluginTurnContext(ctx, reqId),
+                ),
+              {
+                messages: msgs,
+                signal,
+                options: opts,
+              },
+              buildPluginTurnContext(ctx, reqId),
+              DEFAULT_TIMEOUTS.compaction,
+            )) as Awaited<
+              ReturnType<typeof ctx.contextWindowManager.maybeCompact>
+            >;
+          } catch (err) {
+            if (err instanceof PluginTimeoutError) {
+              rlog.warn(
+                { err, phase: "overflow-reducer-forced-compaction" },
+                "Compaction pipeline timed out — falling through to next reducer tier",
+              );
+              await trackCompactionOutcome(ctx, true, onEvent);
+              return {
+                messages: msgs,
+                compacted: false,
+                previousEstimatedInputTokens: 0,
+                estimatedInputTokens: 0,
+                maxInputTokens: 0,
+                thresholdTokens: 0,
+                compactedMessages: 0,
+                compactedPersistedMessages: 0,
+                summaryCalls: 0,
+                summaryInputTokens: 0,
+                summaryOutputTokens: 0,
+                summaryModel: "",
+                summaryText: "",
+                reason: "compaction pipeline timed out",
+              };
+            }
+            throw err;
+          }
+        },
         emitActivityState: () => {
           ctx.emitActivityState(
             "thinking",
@@ -1449,8 +1523,8 @@ export async function runAgentLoopImpl(
           // When THIS iteration compacted, it stripped existing NOW.md /
           // PKB blocks — so we re-inject current content. A later iteration
           // that only truncates or downgrades must NOT re-force PKB/NOW,
-          // or each round would grow the token count. Matches the
-          // pre-PR-23 per-iteration `step.compactionResult?.compacted` gate.
+          // or each round would grow the token count.
+          // Gate: only the iteration that actually compacted re-injects.
           const injection = await applyRuntimeInjections(reducedMessages, {
             ...injectionOpts,
             ...(stepCompacted && { pkbContext: currentPkbContent }),
@@ -1546,18 +1620,24 @@ export async function runAgentLoopImpl(
         throw err;
       }
     }
-    if (
-      preRunRepair !== null &&
-      (preRunRepair.stats.assistantToolResultsMigrated > 0 ||
+    if (preRunRepair !== null) {
+      // Always adopt the pipeline's output history — a user `historyRepair`
+      // middleware may rewrite `messages` (e.g. provider-specific
+      // normalization) without incrementing any of the built-in repair
+      // counters. Gating the assignment on `stats` would silently discard
+      // those edits and send the un-rewritten history to the provider.
+      runMessages = preRunRepair.messages;
+      if (
+        preRunRepair.stats.assistantToolResultsMigrated > 0 ||
         preRunRepair.stats.missingToolResultsInserted > 0 ||
         preRunRepair.stats.orphanToolResultsDowngraded > 0 ||
-        preRunRepair.stats.consecutiveSameRoleMerged > 0)
-    ) {
-      rlog.warn(
-        { phase: "pre_run", ...preRunRepair.stats },
-        "Repaired runtime history before provider call",
-      );
-      runMessages = preRunRepair.messages;
+        preRunRepair.stats.consecutiveSameRoleMerged > 0
+      ) {
+        rlog.warn(
+          { phase: "pre_run", ...preRunRepair.stats },
+          "Repaired runtime history before provider call",
+        );
+      }
     }
 
     // Replace historical web_search_tool_result blocks with text summaries.
@@ -1644,6 +1724,7 @@ export async function runAgentLoopImpl(
       onCheckpoint,
       turnCallSite,
       loopTurnCtx,
+      turnOverrideProfile,
     );
 
     rlog.info(
@@ -1793,6 +1874,7 @@ export async function runAgentLoopImpl(
         onCheckpoint,
         turnCallSite,
         loopTurnCtx,
+        turnOverrideProfile,
       );
     }
 
@@ -1848,6 +1930,7 @@ export async function runAgentLoopImpl(
         onCheckpoint,
         turnCallSite,
         loopTurnCtx,
+        turnOverrideProfile,
       );
 
       if (state.orderingErrorDetected) {
@@ -2034,6 +2117,7 @@ export async function runAgentLoopImpl(
           onCheckpoint,
           turnCallSite,
           loopTurnCtx,
+          turnOverrideProfile,
         );
 
         // If the rerun still yields at checkpoint, the turn is still
@@ -2191,6 +2275,7 @@ export async function runAgentLoopImpl(
             onCheckpoint,
             turnCallSite,
             loopTurnCtx,
+            turnOverrideProfile,
           );
         }
         // action === "fail_gracefully" falls through to the final error below
@@ -2530,17 +2615,44 @@ export async function runAgentLoopImpl(
             } else {
               summary = conv.title ?? "Background task completed.";
             }
+            const feedTitle =
+              conv.title && !isReplaceableTitle(conv.title)
+                ? conv.title
+                : "Background task";
+            const dedupKey = `bg-conv:${ctx.conversationId}`;
             void emitFeedEvent({
               source: "assistant",
-              title: conv.title ?? "Background Task",
+              title: feedTitle,
               summary,
-              dedupKey: `bg-conv:${ctx.conversationId}`,
+              dedupKey,
+              conversationId: ctx.conversationId,
             }).catch((err) => {
               log.warn(
                 { err, conversationId: ctx.conversationId },
                 "Failed to emit background conversation feed event",
               );
             });
+
+            if (isReplaceableTitle(conv.title ?? null)) {
+              void rewriteFeedTitle(feedTitle)
+                .then((prose) => {
+                  if (prose && prose !== feedTitle) {
+                    return emitFeedEvent({
+                      source: "assistant",
+                      title: prose,
+                      summary,
+                      dedupKey,
+                      conversationId: ctx.conversationId,
+                    });
+                  }
+                })
+                .catch((err) => {
+                  log.warn(
+                    { err, conversationId: ctx.conversationId },
+                    "Failed to update feed event with prose title rewrite",
+                  );
+                });
+            }
           }
         } catch (feedErr) {
           log.warn(
@@ -2656,6 +2768,7 @@ export async function runAgentLoopImpl(
     ctx.currentActiveSurfaceId = undefined;
     ctx.allowedToolNames = undefined;
     ctx.preactivatedSkillIds = undefined;
+    ctx.currentTurnOverrideProfile = undefined;
     // Channel command intents (e.g. Telegram /start) are single-turn metadata.
     // Clear at turn end so they never leak into subsequent unrelated messages.
     ctx.commandIntent = undefined;
@@ -2814,9 +2927,7 @@ export function applyCompactionResult(
   );
 }
 
-export function collapseRawResponses(
-  rawResponses?: unknown[],
-): unknown | undefined {
+function collapseRawResponses(rawResponses?: unknown[]): unknown | undefined {
   if (!rawResponses || rawResponses.length === 0) return undefined;
   return rawResponses.length === 1 ? rawResponses[0] : rawResponses;
 }