@vellumai/assistant 0.6.6 → 0.7.0

package/src/daemon/conversation-tool-setup.ts

@@ -15,22 +15,10 @@ import { isHttpAuthDisabled } from "../config/env.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
-import {
-  generateAllowlistOptions,
-  generateScopeOptions,
-  normalizeWebFetchUrl,
-} from "../permissions/checker.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
-import {
-  addRule,
-  findHighestPriorityRule,
-} from "../permissions/trust-store.js";
-import { isAllowDecision } from "../permissions/types.js";
-import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
-import { getTaskRunRules } from "../tasks/ephemeral-permissions.js";
 import { coreAppProxyTools } from "../tools/apps/definitions.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -51,7 +39,6 @@ import type {
 } from "../tools/types.js";
 import { allUiSurfaceTools } from "../tools/ui-surface/definitions.js";
 import { getLogger } from "../util/logger.js";
-import type { TrustContext } from "./conversation-runtime-assembly.js";
 import {
   projectSkillTools,
   type SkillProjectionCache,
@@ -64,6 +51,7 @@ import {
 } from "./doordash-steps.js";
 import type { ServerMessage, UiSurfaceShow } from "./message-protocol.js";
 import { runPostExecutionSideEffects } from "./tool-side-effects.js";
+import type { TrustContext } from "./trust-context.js";
 
 const log = getLogger("conversation-tool-setup");
 
@@ -99,8 +87,8 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   abortController: AbortController | null;
   /** When set, only tools in this set may execute during the current turn. */
   allowedToolNames?: Set<string>;
-  /** Conversation memory policy — used to propagate scopeId and strictSideEffects into ToolContext. */
-  memoryPolicy: { scopeId: string; strictSideEffects: boolean };
+  /** Conversation memory policy used to propagate scopeId into ToolContext. */
+  memoryPolicy: { scopeId: string };
   /** True when the conversation has no connected client (HTTP-only path). */
   hasNoClient?: boolean;
   /** When true, the conversation is executing a task run and must not become interactive. */
@@ -117,6 +105,8 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   hostBrowserProxy?: import("./host-browser-proxy.js").HostBrowserProxy;
   /** Optional proxy for delegating host_file_read/write/edit execution to a connected client. */
   hostFileProxy?: import("./host-file-proxy.js").HostFileProxy;
+  /** Optional proxy for delegating bidirectional file transfers between sandbox and host. */
+  hostTransferProxy?: import("./host-transfer-proxy.js").HostTransferProxy;
   /** CES RPC client for credential execution operations. Injected when CES tools are enabled and the CES process is available. */
   cesClient?: CesClient;
   /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
@@ -134,6 +124,14 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   ) => void;
   /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
   approvedViaPromptThisTurn?: boolean;
+  /**
+   * Per-turn snapshot of the resolved inference-profile override, set by
+   * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so
+   * tools that spawn nested invocations (e.g. `subagent_spawn`) can forward
+   * the override without round-tripping through a row read that would
+   * return `undefined` for the in-flight (background) subagent.
+   */
+  currentTurnOverrideProfile?: string;
 }
 
 // ── buildToolDefinitions ─────────────────────────────────────────────
@@ -188,15 +186,6 @@ export function createToolExecutor(
       markDoordashStepInProgress(ctx, input);
     }
 
-    // Unwrap skill_execute dispatch so downstream context (notably
-    // batchAuthorizedByTask) is keyed on the tool that will actually run.
-    // Task rules in required_tools contain underlying tool names (e.g.
-    // "gmail_archive"), never the outer "skill_execute" dispatcher.
-    const effectiveToolName =
-      name === "skill_execute" && typeof input.tool === "string" && input.tool
-        ? input.tool
-        : name;
-
     // Build the context object shared by both the skill_execute interception
     // path and the regular executor path.
     const toolContext: ToolContext = {
@@ -211,17 +200,7 @@ export function createToolExecutor(
       triggeredBySurfaceAction:
         ctx.surfaceActionRequestIds?.has(ctx.currentRequestId ?? "") ?? false,
       approvedViaPrompt: ctx.approvedViaPromptThisTurn || undefined,
-      // A task without required_tools entries (e.g. ad-hoc tasks created with
-      // omitted/empty required_tools, or legacy rows where it was never
-      // populated) correctly gets no batch authorization — that's the
-      // intended stricter contract this check enforces, not a regression to
-      // paper over. Batch tools gate themselves via this flag; callers that
-      // never declared the tool shouldn't get blanket authorization.
-      batchAuthorizedByTask:
-        ctx.taskRunId != null &&
-        getTaskRunRules(ctx.taskRunId).some(
-          (r) => r.tool === effectiveToolName,
-        ),
+      batchAuthorizedByTask: false,
       requesterExternalUserId: ctx.trustContext?.requesterExternalUserId,
       requesterChatId: ctx.trustContext?.requesterChatId,
       requesterIdentifier: ctx.trustContext?.requesterIdentifier,
@@ -234,15 +213,16 @@ export function createToolExecutor(
       signal: ctx.abortController?.signal,
       allowedToolNames: ctx.allowedToolNames,
       memoryScopeId: ctx.memoryPolicy.scopeId,
-      forcePromptSideEffects: ctx.memoryPolicy.strictSideEffects,
       toolUseId,
       hostBashProxy: ctx.hostBashProxy,
       hostBrowserProxy: ctx.hostBrowserProxy,
       hostFileProxy: ctx.hostFileProxy,
+      hostTransferProxy: ctx.hostTransferProxy,
       isPlatformHosted: getIsPlatform(),
       cesClient: ctx.cesClient,
       transportInterface: ctx.transportInterface,
       hostBrowserRegistryRouted: !!ctx.hostBrowserSenderOverride,
+      overrideProfile: ctx.currentTurnOverrideProfile,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
         // Tool context's sendToClient uses a loose { type: string; [key: string]: unknown }
@@ -366,143 +346,13 @@ export function createToolExecutor(
  * user confirmation before proceeding.
  */
 export function createProxyApprovalCallback(
-  prompter: PermissionPrompter,
-  ctx: ToolSetupContext,
+  _prompter: PermissionPrompter,
+  _ctx: ToolSetupContext,
 ): ProxyApprovalCallback {
-  return async (request: ProxyApprovalRequest): Promise<boolean> => {
-    const { decision } = request;
-    const { hostname, port, path } = decision.target;
-
-    // Use the standard network_request tool name so trust rules align with
-    // the checker's URL-based candidate generation and allowlist options.
-    const toolName = "network_request";
-    const { scheme } = decision.target;
-    const url = `${scheme}://${hostname}${port ? ":" + port : ""}${path}`;
-
-    if (isPermissionControlsV2Enabled()) {
-      // Under v2 we suppress deterministic network approval cards entirely.
-      // Proxied asks should follow the same non-host auto-allow contract as
-      // regular network_request invocations instead of turning into hard blocks.
-      return true;
-    }
-
-    const input: Record<string, unknown> = {
-      url,
-      scheme,
-    };
-    if (request.method) {
-      input.method = request.method;
-    }
-    if (request.requestHeaders && Object.keys(request.requestHeaders).length) {
-      input.request_headers = request.requestHeaders;
-    }
-    input.reason =
-      decision.kind === "ask_missing_credential"
-        ? "A known credential template matches this host, but no credential is bound to this session. Approving will forward the request as-is — the assistant won't inject a credential, but any caller-supplied auth headers will still be sent."
-        : "This host isn't covered by any known credential template. Approving will forward the request as-is, including any caller-supplied auth headers.";
-    if (decision.kind === "ask_missing_credential") {
-      input.known_credential_patterns = decision.matchingPatterns;
-    }
-    if (!request.method) {
-      input.connection_detail_available = "no";
-    }
-
-    const riskLevel: string = "medium";
-
-    // Check trust store before prompting — build candidates that mirror
-    // buildCommandCandidates() in checker.ts for network_request.
-    const candidates: string[] = [`${toolName}:${url}`];
-    const normalized = normalizeWebFetchUrl(url);
-    if (normalized) {
-      candidates.push(`${toolName}:${normalized.href}`);
-      candidates.push(`${toolName}:${normalized.origin}/*`);
-    }
-    candidates.push(`${toolName}:*`);
-    // Deduplicate
-    const uniqueCandidates = [...new Set(candidates)];
-
-    const existingRule = findHighestPriorityRule(
-      toolName,
-      uniqueCandidates,
-      ctx.workingDir,
-    );
-    if (existingRule && existingRule.decision !== "ask") {
-      if (existingRule.decision === "deny") return false;
-      return true;
-    }
-
-    // Use the checker's built-in allowlist generation for network_request
-    const allowlistOptions = await generateAllowlistOptions("network_request", {
-      url,
-    });
-
-    const scopeOptions = generateScopeOptions(ctx.workingDir);
-
-    // Non-interactive conversations have no client to prompt — fast-deny to avoid
-    // blocking for the full permission timeout before auto-denying.
-    if (ctx.hasNoClient) {
-      return false;
-    }
-
-    // Proxied network requests require per-invocation approval and must
-    // not be auto-approved by temporary overrides (allow_10m / allow_conversation).
-    // Unlike regular tool invocations, these represent outbound network
-    // actions that should always receive explicit confirmation.
-
-    const response = await prompter.prompt(
-      toolName,
-      input,
-      riskLevel,
-      allowlistOptions,
-      scopeOptions,
-      undefined,
-      ctx.conversationId,
-    );
-
-    // Persist trust rule if the user chose "always allow" or "always deny"
-    if (
-      response.decision === "always_allow" &&
-      response.selectedPattern &&
-      response.selectedScope
-    ) {
-      log.info(
-        {
-          toolName,
-          pattern: response.selectedPattern,
-          scope: response.selectedScope,
-        },
-        "Persisting always-allow trust rule (proxy)",
-      );
-      addRule(
-        toolName,
-        response.selectedPattern,
-        response.selectedScope,
-        "allow",
-        100,
-      );
-    }
-    if (
-      response.decision === "always_deny" &&
-      response.selectedPattern &&
-      response.selectedScope
-    ) {
-      log.info(
-        {
-          toolName,
-          pattern: response.selectedPattern,
-          scope: response.selectedScope,
-        },
-        "Persisting always-deny trust rule (proxy)",
-      );
-      addRule(
-        toolName,
-        response.selectedPattern,
-        response.selectedScope,
-        "deny",
-      );
-    }
-
-    return isAllowDecision(response.decision);
+  return async (_request: ProxyApprovalRequest): Promise<boolean> => {
+    // Proxied asks follow the same non-host auto-allow contract as regular
+    // network_request invocations — suppress deterministic approval cards.
+    return true;
   };
 }
 
@@ -577,6 +427,7 @@ export const HOST_TOOL_TO_CAPABILITY = new Map<string, HostProxyCapability>([
   ["host_file_read", "host_file"],
   ["host_file_write", "host_file"],
   ["host_file_edit", "host_file"],
+  ["host_file_transfer", "host_file"],
   ["host_browser", "host_browser"],
 ]);
 // Derived from HOST_TOOL_TO_CAPABILITY so the invariant "every host tool has

package/src/daemon/conversation.ts

@@ -44,30 +44,20 @@ import {
 } from "../events/tool-profiling-listener.js";
 import { registerToolTraceListener } from "../events/tool-trace-listener.js";
 import { resolveCanonicalGuardianRequest } from "../memory/canonical-guardian-store.js";
-import {
-  getConversationOriginChannel,
-  updateConversationHostAccess,
-} from "../memory/conversation-crud.js";
+import { getConversationOriginChannel } from "../memory/conversation-crud.js";
 import { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { SecretPrompter } from "../permissions/secret-prompter.js";
-import { patternMatchesCandidate } from "../permissions/trust-store.js";
 import type { UserDecision } from "../permissions/types.js";
-import {
-  isConversationHostAccessDecision,
-  isConversationHostAccessEnabled,
-  isConversationHostAccessEnablePrompt,
-} from "../permissions/v2-consent-policy.js";
 import { resolvePersonaContext } from "../prompts/persona-resolver.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import type { Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 import type { AuthContext } from "../runtime/auth/types.js";
-import * as approvalOverrides from "../runtime/conversation-approval-overrides.js";
 import type { InteractiveUiResult } from "../runtime/interactive-ui.js";
-import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { ToolExecutor } from "../tools/executor.js";
+import type { ToolLifecycleEvent } from "../tools/types.js";
 import type { OnboardingContext } from "../types/onboarding-context.js";
 import type { AbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
@@ -102,10 +92,7 @@ import {
 } from "./conversation-process.js";
 import type { QueueDrainReason } from "./conversation-queue-manager.js";
 import { MessageQueue } from "./conversation-queue-manager.js";
-import type {
-  ChannelCapabilities,
-  TrustContext,
-} from "./conversation-runtime-assembly.js";
+import type { ChannelCapabilities } from "./conversation-runtime-assembly.js";
 import type { SkillProjectionCache } from "./conversation-skill-tools.js";
 import {
   createSurfaceMutex,
@@ -125,6 +112,7 @@ import { HostBrowserProxy } from "./host-browser-proxy.js";
 import type { CuObservationResult } from "./host-cu-proxy.js";
 import { HostCuProxy } from "./host-cu-proxy.js";
 import { HostFileProxy } from "./host-file-proxy.js";
+import { HostTransferProxy } from "./host-transfer-proxy.js";
 import type {
   ServerMessage,
   SurfaceData,
@@ -145,14 +133,12 @@ const log = getLogger("conversation");
 export interface ConversationMemoryPolicy {
   scopeId: string;
   includeDefaultFallback: boolean;
-  strictSideEffects: boolean;
 }
 
 export const DEFAULT_MEMORY_POLICY: Readonly<ConversationMemoryPolicy> =
   Object.freeze({
     scopeId: "default",
     includeDefaultFallback: false,
-    strictSideEffects: false,
   });
 
 export { findLastUndoableUserMessageIndex } from "./conversation-history.js";
@@ -160,6 +146,7 @@ export type {
   QueueDrainReason,
   QueuePolicy,
 } from "./conversation-queue-manager.js";
+import type { TrustContext } from "./trust-context.js";
 
 export class Conversation {
   public readonly conversationId: string;
@@ -215,6 +202,7 @@ export class Conversation {
   /** @internal */ hostBrowserProxy?: HostBrowserProxy;
   /** @internal */ hostCuProxy?: HostCuProxy;
   /** @internal */ hostFileProxy?: HostFileProxy;
+  /** @internal */ hostTransferProxy?: HostTransferProxy;
   /**
    * Optional override sender used by `restoreBrowserProxyAvailability` so
    * registry-routed transports can preserve their sender across drain queue
@@ -242,6 +230,7 @@ export class Conversation {
    */
   /** @internal */ currentTurnTrustContext?: TrustContext;
   /** @internal */ currentTurnChannelCapabilities?: ChannelCapabilities;
+  /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ authContext?: AuthContext;
   /** @internal */ loadedHistoryTrustClass?: TrustClass;
   /** @internal */ voiceCallControlPrompt?: string;
@@ -446,9 +435,7 @@ export class Conversation {
     const publishToolDomainEvent = createToolDomainEventPublisher(
       this.eventBus,
     );
-    const handleToolLifecycleEvent = (
-      event: import("../tools/types.js").ToolLifecycleEvent,
-    ) => {
+    const handleToolLifecycleEvent = (event: ToolLifecycleEvent) => {
       auditToolLifecycleEvent(event);
       return publishToolDomainEvent(event);
     };
@@ -488,7 +475,7 @@ export class Conversation {
     const resolvedModel: string | undefined = modelOverride;
 
     const resolveSystemPromptCallback = (
-      _history: import("../providers/types.js").Message[],
+      _history: Message[],
     ): ResolvedSystemPrompt => {
       const resolved: ResolvedSystemPrompt = {
         systemPrompt: this.hasSystemPromptOverride
@@ -673,6 +660,7 @@ export class Conversation {
       this.hostBrowserProxy?.updateSender(sendToClient, !hasNoClient);
       this.hostCuProxy?.updateSender(sendToClient, !hasNoClient);
       this.hostFileProxy?.updateSender(sendToClient, !hasNoClient);
+      this.hostTransferProxy?.updateSender(sendToClient, !hasNoClient);
     }
 
     // Replay last activity state so a reconnecting client sees the current phase
@@ -700,6 +688,7 @@ export class Conversation {
     this.hostBrowserProxy?.updateSender(this.sendToClient, false);
     this.hostCuProxy?.updateSender(this.sendToClient, false);
     this.hostFileProxy?.updateSender(this.sendToClient, false);
+    this.hostTransferProxy?.updateSender(this.sendToClient, false);
   }
 
   /**
@@ -716,6 +705,7 @@ export class Conversation {
       }
       this.hostCuProxy?.updateSender(this.sendToClient, true);
       this.hostFileProxy?.updateSender(this.sendToClient, true);
+      this.hostTransferProxy?.updateSender(this.sendToClient, true);
     }
   }
 
@@ -817,7 +807,6 @@ export class Conversation {
   }
 
   dispose(): void {
-    approvalOverrides.clearMode(this.conversationId);
     // Cancel all pending standalone surfaces so callers get a clean
     // cancellation instead of hanging forever. Emit dismiss notifications
     // to the client so surfaces don't remain visually active if the client
@@ -851,6 +840,7 @@ export class Conversation {
     this.hostBrowserProxy?.dispose();
     this.hostCuProxy?.dispose();
     this.hostFileProxy?.dispose();
+    this.hostTransferProxy?.dispose();
     // CES client is owned by DaemonServer — just drop the reference.
     // Do NOT close it here; the server manages the CES lifecycle.
     this.cesClient = undefined;
@@ -953,28 +943,7 @@ export class Conversation {
       return;
     }
 
-    const hostAccessEnablePrompt =
-      this.prompter.isHostAccessEnablePrompt(requestId) ||
-      isConversationHostAccessEnablePrompt(
-        pendingInteractions.get(requestId)?.confirmationDetails,
-      );
-    const effectiveDecision =
-      hostAccessEnablePrompt && !isConversationHostAccessDecision(decision)
-        ? "deny"
-        : decision;
-
-    if (
-      hostAccessEnablePrompt &&
-      effectiveDecision === "allow" &&
-      !isConversationHostAccessEnabled(this.conversationId)
-    ) {
-      updateConversationHostAccess(this.conversationId, true);
-      this.sendToClient({
-        type: "conversation_host_access_updated",
-        conversationId: this.conversationId,
-        hostAccess: true,
-      });
-    }
+    const effectiveDecision = decision;
 
     // Capture toolUseId before resolving (resolution deletes the pending entry)
     const toolUseId = this.prompter.getToolUseId(requestId);
@@ -987,15 +956,11 @@ export class Conversation {
       decisionContext,
     );
 
-    // Mode activation (setTimedMode / setConversationMode) is intentionally NOT
-    // done here. It is handled in permission-checker.ts where the
-    // guardian trust-class and conversation context are available.
-
     // Emit authoritative confirmation state and activity transition centrally
     // so ALL callers (HTTP handlers, /v1/confirm, channel bridges) get
     // consistent events without duplicating emission logic.
     const resolvedState =
-      effectiveDecision === "deny" || effectiveDecision === "always_deny"
+      effectiveDecision === "deny"
         ? ("denied" as const)
         : ("approved" as const);
     this.emitConfirmationStateChanged({
@@ -1038,138 +1003,6 @@ export class Conversation {
       // Canonical request tracking should not break the primary approval flow.
     }
 
-    // Cascade to other pending confirmations that match this decision
-    this.cascadePendingApprovals(
-      requestId,
-      effectiveDecision,
-      selectedPattern,
-      hostAccessEnablePrompt,
-    );
-  }
-
-  /**
-   * After resolving one confirmation, auto-resolve other pending
-   * confirmations in the same conversation that match the decision.
-   *
-   * - allow_10m / allow_conversation → approve ALL pending in conversation
-   * - always_allow → approve pattern-matching pending
-   * - always_deny → deny pattern-matching pending
-   * - allow / deny (one-time) → no cascading
-   */
-  private cascadePendingApprovals(
-    primaryRequestId: string,
-    decision: UserDecision,
-    selectedPattern?: string,
-    hostAccessEnablePrompt = false,
-  ): void {
-    // Single-action decisions don't cascade
-    if (decision === "allow" || decision === "deny") {
-      if (!hostAccessEnablePrompt || decision !== "allow") {
-        return;
-      }
-    }
-
-    const pendingRequestIds = this.prompter.getPendingRequestIds();
-    if (pendingRequestIds.length === 0) return;
-
-    for (const candidateId of pendingRequestIds) {
-      if (candidateId === primaryRequestId) continue;
-
-      const interaction = pendingInteractions.get(candidateId);
-      if (!interaction) continue;
-      if (interaction.conversationId !== this.conversationId) continue;
-      if (interaction.kind !== "confirmation") continue;
-
-      if (
-        hostAccessEnablePrompt &&
-        (this.prompter.isHostAccessEnablePrompt(candidateId) ||
-          isConversationHostAccessEnablePrompt(interaction.confirmationDetails))
-      ) {
-        // Enabling computer access is conversation-scoped, so sibling host
-        // prompts should resolve immediately once the first approval lands.
-        pendingInteractions.resolve(candidateId);
-        this.handleConfirmationResponse(
-          candidateId,
-          "allow",
-          undefined,
-          undefined,
-          undefined,
-          {
-            source: "system",
-            causedByRequestId: primaryRequestId,
-          },
-        );
-        continue;
-      }
-
-      const cascadeResult = this.shouldCascade(
-        decision,
-        selectedPattern,
-        interaction.confirmationDetails,
-      );
-      if (!cascadeResult) continue;
-
-      // Consume from pending-interactions tracker
-      pendingInteractions.resolve(candidateId);
-
-      // Resolve via handleConfirmationResponse which emits events and
-      // syncs canonical status. Use simple "allow"/"deny" so the
-      // permission-checker won't save duplicate rules or re-activate
-      // temporary modes. Recursion terminates because allow/deny exit
-      // cascadePendingApprovals early.
-      this.handleConfirmationResponse(
-        candidateId,
-        cascadeResult.allow ? "allow" : "deny",
-        undefined,
-        undefined,
-        undefined,
-        {
-          source: "system",
-          causedByRequestId: primaryRequestId,
-        },
-      );
-    }
-  }
-
-  /**
-   * Determine whether a pending confirmation should be auto-resolved
-   * based on the cascading decision and pattern.
-   */
-  private shouldCascade(
-    decision: UserDecision,
-    selectedPattern: string | undefined,
-    details?: import("../runtime/pending-interactions.js").ConfirmationDetails,
-  ): { allow: boolean } | null {
-    // Temporary overrides apply to the entire conversation
-    if (decision === "allow_10m" || decision === "allow_conversation") {
-      return { allow: true };
-    }
-
-    // Persistent allow: cascade if the pattern matches any allowlist candidate.
-    // "always_allow" must NOT cascade to high-risk pending confirmations.
-    if (decision === "always_allow" && selectedPattern && details) {
-      if (details.riskLevel === "high") {
-        return null;
-      }
-      for (const option of details.allowlistOptions) {
-        if (patternMatchesCandidate(selectedPattern, option.pattern)) {
-          return { allow: true };
-        }
-      }
-      return null;
-    }
-
-    // Persistent deny: cascade denial if the pattern matches
-    if (decision === "always_deny" && selectedPattern && details) {
-      for (const option of details.allowlistOptions) {
-        if (patternMatchesCandidate(selectedPattern, option.pattern)) {
-          return { allow: false };
-        }
-      }
-      return null;
-    }
-
-    return null;
   }
 
   handleSecretResponse(
@@ -1227,6 +1060,28 @@ export class Conversation {
     this.hostFileProxy = proxy;
   }
 
+  resolveHostTransfer(
+    requestId: string,
+    result: {
+      isError: boolean;
+      bytesWritten?: number;
+      errorMessage?: string;
+    },
+  ): void {
+    this.hostTransferProxy?.resolveTransferResult(requestId, result);
+  }
+
+  setHostTransferProxy(proxy: HostTransferProxy | undefined): void {
+    if (this.hostTransferProxy && this.hostTransferProxy !== proxy) {
+      this.hostTransferProxy.dispose();
+    }
+    this.hostTransferProxy = proxy;
+  }
+
+  getHostTransferProxy(): HostTransferProxy | undefined {
+    return this.hostTransferProxy;
+  }
+
   resolveHostCu(requestId: string, observation: CuObservationResult): void {
     this.hostCuProxy?.resolve(requestId, observation);
   }
@@ -1464,6 +1319,15 @@ export class Conversation {
       isUserMessage?: boolean;
       titleText?: string;
       callSite?: LLMCallSite;
+      /**
+       * Optional ad-hoc inference-profile override applied to every LLM call
+       * the loop issues for this turn. Forwarded into
+       * {@link runAgentLoopImpl} and threaded through to
+       * {@link AgentLoop.run} so each provider call carries
+       * `config.overrideProfile`. Subagents spawned during the turn inherit
+       * this value via {@link SubagentManager.spawn}.
+       */
+      overrideProfile?: string;
     },
   ): Promise<void> {
     return runAgentLoopImpl(this, content, userMessageId, onEvent, options);

package/src/daemon/daemon-control.ts

@@ -138,7 +138,7 @@ function isVellumDaemonProcess(pid: number): boolean {
  *  Wildcard addresses (0.0.0.0, ::) bind all interfaces but aren't
  *  connectable on all platforms — substitute loopback. IPv6 literals
  *  need brackets in URLs. */
-export function healthCheckHost(host: string): string {
+function healthCheckHost(host: string): string {
   if (host === "0.0.0.0") return "127.0.0.1";
   if (host === "::") return "[::1]";
   if (host.includes(":")) return `[${host}]`;
@@ -148,7 +148,7 @@ export function healthCheckHost(host: string): string {
 /** Hit the daemon's HTTP /healthz endpoint. Returns true if it responds
  *  with HTTP 200 within the timeout — false on connection refused, timeout,
  *  or any other error. */
-export async function isHttpHealthy(): Promise<boolean> {
+async function isHttpHealthy(): Promise<boolean> {
   const host = healthCheckHost(getRuntimeHttpHost());
   const port = getRuntimeHttpPort();
   try {
@@ -339,7 +339,7 @@ export async function startDaemon(): Promise<{
   }
 }
 
-async function startDaemonLocked(): Promise<{
+export async function startDaemonLocked(): Promise<{
   pid: number;
   alreadyRunning: boolean;
 }> {