@vellumai/assistant 0.7.2 → 0.8.0

package/src/daemon/lifecycle.ts

@@ -7,10 +7,7 @@ import { reconcileCallsOnStartup } from "../calls/call-recovery.js";
 import { setRelayBroadcast } from "../calls/relay-server.js";
 import { TwilioConversationRelayProvider } from "../calls/twilio-provider.js";
 import { setVoiceBridgeDeps } from "../calls/voice-session-bridge.js";
-import {
-  initFeatureFlagOverrides,
-  isAssistantFeatureFlagEnabled,
-} from "../config/assistant-feature-flags.js";
+import { initFeatureFlagOverrides } from "../config/assistant-feature-flags.js";
 import {
   getPlatformAssistantId,
   getRuntimeHttpHost,
@@ -54,7 +51,6 @@ import { startMemoryJobsWorker } from "../memory/jobs-worker.js";
 import { initQdrantClient, resolveQdrantUrl } from "../memory/qdrant-client.js";
 import { QdrantManager } from "../memory/qdrant-manager.js";
 import { rotateToolInvocations } from "../memory/tool-usage-store.js";
-import { deleteOldTraceEvents } from "../memory/trace-event-store.js";
 import {
   emitNotificationSignal,
   registerBroadcastFn,
@@ -62,6 +58,7 @@ import {
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
 import { loadUserPlugins } from "../plugins/user-loader.js";
+import { backfillGuardIfNeeded } from "../proactive-artifact/index.js";
 import { ensurePromptFiles } from "../prompts/system-prompt.js";
 import { resolveManagedProxyContext } from "../providers/managed-proxy/context.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
@@ -105,6 +102,11 @@ import {
   cleanupPidFileIfOwner,
   writePid,
 } from "./daemon-control.js";
+import {
+  evaluateDiskPressureNow,
+  startDiskPressureGuard,
+  stopDiskPressureGuard,
+} from "./disk-pressure-guard.js";
 import { bootstrapPlugins } from "./external-plugins-bootstrap.js";
 import {
   createGuardianActionCopyGenerator,
@@ -112,7 +114,10 @@ import {
 } from "./guardian-action-generators.js";
 import { backfillSlackInjectionTemplates } from "./handlers/config-slack-channel.js";
 import { installAssistantSymlink } from "./install-symlink.js";
-import { maybeSeedMemoryV2Skills } from "./memory-v2-startup.js";
+import {
+  maybeRebuildMemoryV2Concepts,
+  maybeSeedMemoryV2Skills,
+} from "./memory-v2-startup.js";
 import { processMessage } from "./process-message.js";
 import { runProfilerSweep } from "./profiler-run-store.js";
 import {
@@ -125,11 +130,57 @@ import { DaemonServer } from "./server.js";
 import { installShutdownHandlers } from "./shutdown-handlers.js";
 
 const log = getLogger("lifecycle");
+let diskPressureStartupSampleTimer: ReturnType<typeof setTimeout> | null = null;
 
 function loadDotEnv(): void {
   dotenvConfig({ path: getDotEnvPath(), quiet: true });
 }
 
+function runDeferredDiskPressureStartupSample(): void {
+  diskPressureStartupSampleTimer = null;
+  try {
+    const status = evaluateDiskPressureNow();
+    if (status.error) {
+      log.warn(
+        { error: status.error },
+        "Disk pressure guard sample failed during startup — continuing unlocked",
+      );
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Disk pressure guard failed during startup — continuing unlocked",
+    );
+  }
+}
+
+export function startDiskPressureGuardForLifecycle(): void {
+  try {
+    const startedStatus = startDiskPressureGuard();
+    if (!startedStatus.enabled) return;
+    if (!diskPressureStartupSampleTimer) {
+      diskPressureStartupSampleTimer = setTimeout(
+        runDeferredDiskPressureStartupSample,
+        0,
+      );
+      (diskPressureStartupSampleTimer as { unref?: () => void }).unref?.();
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Disk pressure guard failed during startup — continuing unlocked",
+    );
+  }
+}
+
+export function stopDiskPressureGuardForLifecycle(): void {
+  if (diskPressureStartupSampleTimer) {
+    clearTimeout(diskPressureStartupSampleTimer);
+    diskPressureStartupSampleTimer = null;
+  }
+  stopDiskPressureGuard();
+}
+
 export interface CesStartupResult {
   client: CesClient | undefined;
   processManager: CesProcessManager | undefined;
@@ -267,21 +318,16 @@ export async function runDaemon(): Promise<void> {
     const signingKey = resolveSigningKey();
     initAuthSigningKey(signingKey);
 
-    // Pre-populate
-    // subsequent sync isAssistantFeatureFlagEnabled() calls have data.
-    // Fired non-blocking so a slow or unreachable gateway doesn't delay
-    // daemon startup (the IPC call has a 3s connect + 5s call timeout
-    // that would otherwise stall the critical path).
-    //
-    // On resolve, retry the v2 skill seed: the synchronous gate at the
-    // skill-seed call site below evaluates the memory-v2-enabled flag
-    // before the gateway has populated overrides, so a cold-boot race
-    // can leave the v2 skill collection unseeded for the lifetime of
-    // the daemon. seedV2SkillEntries is idempotent, so re-running after
-    // overrides land is safe.
-    void initFeatureFlagOverrides()
-      .then(() => maybeSeedMemoryV2Skills(loadConfig()))
-      .catch((err) => log.warn({ err }, "Background feature flag init failed"));
+    // Pre-populate feature flag overrides so subsequent sync
+    // isAssistantFeatureFlagEnabled() calls have data. Fired non-blocking
+    // so a slow or unreachable gateway doesn't delay daemon startup (the
+    // IPC call has a 3s connect + 5s call timeout that would otherwise
+    // stall the critical path).
+    void initFeatureFlagOverrides().catch((err) =>
+      log.warn({ err }, "Background feature flag init failed"),
+    );
+
+    maybeSeedMemoryV2Skills(loadConfig());
 
     seedInterfaceFiles();
 
@@ -448,12 +494,22 @@ export async function runDaemon(): Promise<void> {
       }
     } // end if (dbReady)
 
-    // Seed managed inference profiles into the workspace config. Runs
-    // after workspace migrations (which may have created the initial
-    // profile slots) and before mergeDefaultWorkspaceConfig / loadConfig
-    // so the profiles are on disk for the first config load.
+    // Merge CLI-provided default config (from VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH)
+    // into the workspace config file before profile seeding and the first
+    // loadConfig() call so onboarding/platform preferences are visible to the
+    // seeder and persisted alongside schema defaults.
+    const defaultConfigMerge = mergeDefaultWorkspaceConfig();
+
+    // Seed managed inference profiles into the workspace config. Runs after
+    // workspace migrations and default-config merge, but before loadConfig() so
+    // fresh hatches have profiles on disk before the first config load. Any
+    // profile fields explicitly supplied by the default overlay stay
+    // authoritative for this startup.
     try {
-      seedInferenceProfiles();
+      seedInferenceProfiles({
+        preserveProfileNames: defaultConfigMerge.providedLlmProfileNames,
+        preserveActiveProfile: defaultConfigMerge.providedLlmActiveProfile,
+      });
       log.info("Inference profile seeding complete");
     } catch (err) {
       log.warn(
@@ -462,11 +518,6 @@ export async function runDaemon(): Promise<void> {
       );
     }
 
-    // Merge CLI-provided default config (from VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH)
-    // into the workspace config file before the first loadConfig() call so
-    // onboarding preferences are persisted alongside schema defaults.
-    mergeDefaultWorkspaceConfig();
-
     log.info("Daemon startup: loading config");
     const config = loadConfig();
 
@@ -625,6 +676,7 @@ export async function runDaemon(): Promise<void> {
 
     await server.start();
     log.info("Daemon startup: DaemonServer started");
+    startDiskPressureGuardForLifecycle();
 
     // Kick off the update bulletin background job AFTER `server.start()`
     // resolves. The conversation store must be initialized before wake
@@ -684,64 +736,87 @@ export async function runDaemon(): Promise<void> {
       }
 
       if (qdrantStarted) {
-        try {
-          const embeddingSelection = await selectEmbeddingBackend(config);
-          // Sentinel only encodes the dense provider+model identity; sparse
-          // encoder changes never require collection recreation, so they
-          // intentionally do not contribute to the v1 collection identity.
-          const embeddingModel = embeddingSelection.backend
-            ? `${embeddingSelection.backend.provider}:${embeddingSelection.backend.model}`
-            : undefined;
-          const qdrantClient = initQdrantClient({
-            url: qdrantUrl,
-            collection: config.memory.qdrant.collection,
-            vectorSize: config.memory.qdrant.vectorSize,
-            onDisk: config.memory.qdrant.onDisk,
-            quantization: config.memory.qdrant.quantization,
-            embeddingModel,
-          });
+        // Skip the v1 Qdrant collection lifecycle when memory v2 is active —
+        // the v1 collection has no writers (handleRemember returns early) or
+        // readers (graph search is bypassed) under v2, so ensuring/migrating
+        // it just maintains a dead-on-arrival collection. Existing on-disk
+        // collections are left intact so flipping v2 off restores v1 cleanly.
+        if (!config.memory.v2.enabled) {
+          try {
+            const embeddingSelection = await selectEmbeddingBackend(config);
+            // Sentinel only encodes the dense provider+model identity; sparse
+            // encoder changes never require collection recreation, so they
+            // intentionally do not contribute to the v1 collection identity.
+            const embeddingModel = embeddingSelection.backend
+              ? `${embeddingSelection.backend.provider}:${embeddingSelection.backend.model}`
+              : undefined;
+            const qdrantClient = initQdrantClient({
+              url: qdrantUrl,
+              collection: config.memory.qdrant.collection,
+              vectorSize: config.memory.qdrant.vectorSize,
+              onDisk: config.memory.qdrant.onDisk,
+              quantization: config.memory.qdrant.quantization,
+              embeddingModel,
+            });
+
+            // Eagerly ensure the collection exists so we detect migrations
+            // (unnamed→named vectors, dimension/model changes) at startup.
+            // If a destructive migration occurred, enqueue a rebuild_index job
+            // to re-embed all memory items from the SQLite cache.
+            const { migrated } = await qdrantClient.ensureCollection();
+            if (migrated) {
+              enqueueMemoryJob("rebuild_index", {});
+              log.info(
+                "Qdrant collection was migrated — enqueued rebuild_index job",
+              );
+            }
 
-          // Eagerly ensure the collection exists so we detect migrations
-          // (unnamed→named vectors, dimension/model changes) at startup.
-          // If a destructive migration occurred, enqueue a rebuild_index job
-          // to re-embed all memory items from the SQLite cache.
-          const { migrated } = await qdrantClient.ensureCollection();
-          if (migrated) {
-            enqueueMemoryJob("rebuild_index", {});
-            log.info(
-              "Qdrant collection was migrated — enqueued rebuild_index job",
+            log.info("Qdrant vector store initialized");
+          } catch (err) {
+            log.warn(
+              { err },
+              "Qdrant client initialization failed — memory features will be degraded",
             );
           }
+        }
 
-          log.info("Qdrant vector store initialized");
+        // Detect schema drift on the v2 concept-page collection (e.g.
+        // pre-#29823 collections lacking summary_dense / summary_sparse) and
+        // recreate + enqueue a reembed when needed. Awaited inline so the
+        // reembed enqueue happens before the memory worker drains its first
+        // batch; the call's own try/catch keeps any v2-side failure from
+        // blocking the v1 PKB reconcile or BM25 build below.
+        try {
+          await maybeRebuildMemoryV2Concepts(config);
         } catch (err) {
           log.warn(
             { err },
-            "Qdrant client initialization failed — memory features will be degraded",
+            "Memory v2 collection schema check threw — continuing startup",
           );
         }
 
-        // Reconcile the PKB Qdrant index against the on-disk tree. Kept
-        // inside the `qdrantStarted` guard so we don't call
-        // `getQdrantClient()` (which throws "not initialized") on every
-        // startup when Qdrant is unavailable. Fire-and-forget so enqueued
-        // re-index jobs drain in the background and first-turn latency
-        // stays unaffected.
-        void (async () => {
-          try {
-            const { reconcilePkbIndex } =
-              await import("../memory/pkb/pkb-reconcile.js");
-            const { PKB_WORKSPACE_SCOPE } =
-              await import("../memory/pkb/types.js");
-            const pkbRoot = join(getWorkspaceDir(), "pkb");
-            await reconcilePkbIndex(pkbRoot, PKB_WORKSPACE_SCOPE);
-          } catch (err) {
-            log.warn(
-              { err },
-              "PKB index reconciliation failed — continuing startup",
-            );
-          }
-        })();
+        // Reconcile the PKB Qdrant index against the on-disk tree. Gated on
+        // !v2 because PKB is the v1 storage layer; under v2 the v1 collection
+        // is not initialized, so calling `getQdrantClient()` here would throw.
+        // Fire-and-forget so enqueued re-index jobs drain in the background
+        // and first-turn latency stays unaffected.
+        if (!config.memory.v2.enabled) {
+          void (async () => {
+            try {
+              const { reconcilePkbIndex } =
+                await import("../memory/pkb/pkb-reconcile.js");
+              const { PKB_WORKSPACE_SCOPE } =
+                await import("../memory/pkb/types.js");
+              const pkbRoot = join(getWorkspaceDir(), "pkb");
+              await reconcilePkbIndex(pkbRoot, PKB_WORKSPACE_SCOPE);
+            } catch (err) {
+              log.warn(
+                { err },
+                "PKB index reconciliation failed — continuing startup",
+              );
+            }
+          })();
+        }
 
         // Build the BM25 corpus stats (per-token document frequencies and
         // average document length) used by the v2 sparse channel. Without
@@ -1198,22 +1273,6 @@ export async function runDaemon(): Promise<void> {
       }
     }
 
-    // Prune trace events older than 7 days to keep the database lean.
-    // Deferred so synchronous cleanup doesn't block the startup path.
-    setTimeout(() => {
-      try {
-        const deletedTraceEvents = deleteOldTraceEvents(7);
-        if (deletedTraceEvents > 0) {
-          log.debug(
-            { deletedTraceEvents },
-            `Pruned ${deletedTraceEvents} trace event(s) older than 7 days`,
-          );
-        }
-      } catch (err) {
-        log.warn({ err }, "Trace event cleanup failed");
-      }
-    }, 0);
-
     const workspaceHeartbeat = new WorkspaceHeartbeatService();
     workspaceHeartbeat.start();
 
@@ -1236,14 +1295,17 @@ export async function runDaemon(): Promise<void> {
       "Heartbeat service configured",
     );
 
-    // Filing yields to the memory v2 consolidation job when the flag is on —
+    try {
+      backfillGuardIfNeeded();
+    } catch (err) {
+      log.warn({ err }, "Proactive artifact backfill failed");
+    }
+
+    // Filing yields to the memory v2 consolidation job when v2 is enabled —
     // both serve the same role (periodic background memory processing) and
     // running both is redundant. The consolidation job runs through the
     // memory jobs worker (see `maybeEnqueueGraphMaintenanceJobs`).
-    const memoryV2Enabled = isAssistantFeatureFlagEnabled(
-      "memory-v2-enabled",
-      config,
-    );
+    const memoryV2Enabled = config.memory.v2.enabled;
     let filing: FilingService | null = null;
     if (!memoryV2Enabled) {
       const filingConfig = config.filing;
@@ -1281,10 +1343,14 @@ export async function runDaemon(): Promise<void> {
       getQdrantManager: () => bgRefs.qdrantManager,
       mcpManager,
       telemetryReporter,
-      cleanupPidFile,
+      cleanupPidFile: () => {
+        stopDiskPressureGuardForLifecycle();
+        cleanupPidFile();
+      },
     });
   } catch (err) {
     log.error({ err }, "Daemon startup failed — cleaning up");
+    stopDiskPressureGuardForLifecycle();
     cleanupPidFileIfOwner(process.pid);
     throw err;
   }

package/src/daemon/meet-host-supervisor.ts

@@ -72,7 +72,7 @@ import { getLogger } from "../util/logger.js";
  * keeps the supervisor free of path assumptions and simplifies
  * tests.
  */
-export interface MeetHostManifest {
+interface MeetHostManifest {
   /** SHA-256 of the shipped skill source tree. */
   sourceHash: string;
 }
@@ -84,7 +84,7 @@ export interface MeetHostManifest {
  * protocol version) can be threaded through later without a
  * signature break.
  */
-export interface MeetHostHandshakePayload {
+interface MeetHostHandshakePayload {
   sourceHash: string;
 }
 
@@ -97,7 +97,7 @@ export interface MeetHostHandshakePayload {
  * supervisor unaware of the rest of the IPC server's surface and avoids a
  * circular import in tests that already stub `skill-server.js`.
  */
-export interface SkillRequestSender {
+interface SkillRequestSender {
   sendRequest(
     connection: SkillIpcConnection,
     method: string,
@@ -111,7 +111,7 @@ export interface SkillRequestSender {
  * child. All are optional on construction — production callers
  * rely on the defaults and tests override one or two at a time.
  */
-export interface MeetHostSupervisorDeps {
+interface MeetHostSupervisorDeps {
   /** Absolute path to the shipped `meet-join` skill dir, containing `register.ts`. */
   skillRuntimePath: string;
   /** Absolute path to a standalone bun binary, or `"bun"` for PATH lookup. */

package/src/daemon/meet-manifest-loader.ts

@@ -109,7 +109,6 @@ const SERIALIZABLE_TOOL_CONTEXT_KEYS = [
   "callSessionId",
   "principal",
   "toolUseId",
-  "memoryScopeId",
   "requesterExternalUserId",
   "requesterChatId",
   "requesterIdentifier",

package/src/daemon/memory-v2-startup.ts

@@ -6,30 +6,81 @@
 // startup work invoked from `lifecycle.ts`. Lives in its own file so the unit
 // test for the gate does not have to mount the entire lifecycle import graph.
 
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import type { AssistantConfig } from "../config/schema.js";
 import { getLogger } from "../util/logger.js";
+import { getWorkspaceDir } from "../util/platform.js";
 
 const log = getLogger("memory-v2-startup");
 
 /**
- * Fire-and-forget seed of the v2 parallel skill embedding collection. Gated
- * on both the `memory-v2-enabled` feature flag and the workspace-level
- * `config.memory.v2.enabled` switch so v2 modules stay out of the v1 startup
- * path when v2 is off.
- *
- * Uses a dynamic import so v2 code does not load unless the gate passes.
- * Never awaits — startup must not block on this (see `assistant/CLAUDE.md`
- * daemon startup philosophy).
+ * Fire-and-forget seed of the v2 skill entries (now indexed alongside concept
+ * pages in `memory_v2_concept_pages` under the `skills/<id>` slug prefix), and
+ * a one-shot best-effort cleanup of the legacy `memory_v2_skills` Qdrant
+ * collection. Uses a dynamic import so v2 code does not load unless the gate
+ * passes. Never awaits — startup must not block on this (see
+ * `assistant/CLAUDE.md` daemon startup philosophy).
  */
 export function maybeSeedMemoryV2Skills(config: AssistantConfig): void {
-  if (
-    !isAssistantFeatureFlagEnabled("memory-v2-enabled", config) ||
-    !config.memory.v2.enabled
-  ) {
-    return;
-  }
+  if (!config.memory.v2.enabled) return;
   void import("../memory/v2/skill-store.js")
     .then(({ seedV2SkillEntries }) => seedV2SkillEntries())
     .catch((err) => log.warn({ err }, "Failed to seed v2 skill entries"));
+  void import("../memory/v2/qdrant.js")
+    .then(({ dropLegacySkillsCollection }) => dropLegacySkillsCollection())
+    .catch((err) =>
+      log.warn(
+        { err },
+        "Failed to drop legacy memory_v2_skills collection — non-fatal",
+      ),
+    );
+}
+
+/**
+ * Reconcile the v2 concept-page Qdrant collection with the expected schema
+ * and enqueue `memory_v2_reembed` when the collection is missing data.
+ * Triggers reembed in two cases:
+ *  - Drift: `ensureConceptPageCollection` returned `{ migrated: true }`
+ *    after destructively recreating the collection (e.g. pre-#29823
+ *    schemas lacking `summary_*` named vectors).
+ *  - Empty-after-create: the collection has zero points but pages exist on
+ *    disk — covers crash-mid-rebuild and external Qdrant wipes.
+ *
+ * Awaited inline by `lifecycle.ts` so the enqueue happens before the memory
+ * worker drains its first batch; the body is wrapped in try/catch so a v2
+ * failure never blocks startup.
+ */
+export async function maybeRebuildMemoryV2Concepts(
+  config: AssistantConfig,
+): Promise<void> {
+  if (!config.memory.v2.enabled) return;
+
+  try {
+    const { ensureConceptPageCollection, countConceptPagePoints } =
+      await import("../memory/v2/qdrant.js");
+    const { hasConceptPages } = await import("../memory/v2/page-store.js");
+    const { enqueueMemoryJob } = await import("../memory/jobs-store.js");
+
+    const { migrated } = await ensureConceptPageCollection();
+
+    let shouldReembed = migrated;
+    if (!shouldReembed) {
+      const points = await countConceptPagePoints();
+      if (points === 0 && (await hasConceptPages(getWorkspaceDir()))) {
+        shouldReembed = true;
+      }
+    }
+
+    if (shouldReembed) {
+      const jobId = enqueueMemoryJob("memory_v2_reembed", {});
+      log.info(
+        { jobId, collectionMigrated: migrated },
+        "Memory v2 collection rebuild required — enqueued reembed job",
+      );
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Memory v2 collection schema check failed — continuing startup; v2 retrieval may be degraded",
+    );
+  }
 }

package/src/daemon/message-protocol.ts

@@ -20,6 +20,7 @@ export * from "./message-types/computer-use.js";
 export * from "./message-types/contacts.js";
 export * from "./message-types/conversations.js";
 export * from "./message-types/diagnostics.js";
+export * from "./message-types/disk-pressure.js";
 export * from "./message-types/documents.js";
 export * from "./message-types/guardian-actions.js";
 export * from "./message-types/home.js";
@@ -71,6 +72,7 @@ import type {
   _DiagnosticsClientMessages,
   _DiagnosticsServerMessages,
 } from "./message-types/diagnostics.js";
+import type { _DiskPressureServerMessages } from "./message-types/disk-pressure.js";
 import type {
   _DocumentsClientMessages,
   _DocumentsServerMessages,
@@ -203,6 +205,7 @@ export type ServerMessage =
   | _NotificationsServerMessages
   | _UpgradesServerMessages
   | _AcpServerMessages
+  | _DiskPressureServerMessages
   | SubagentEvent;
 
 // === Contract schema ===

package/src/daemon/message-types/conversations.ts

@@ -29,6 +29,8 @@ interface BaseTransportMetadata {
   uxBrief?: string;
   /** Chat type from the gateway (e.g. "private", "group", "supergroup", "channel"). */
   chatType?: string;
+  /** IANA timezone reported by the active client for the current turn. */
+  clientTimezone?: string;
 }
 
 /**
@@ -522,6 +524,7 @@ export interface CompactionCircuitClosed {
 export type ConversationErrorCode =
   | "PROVIDER_NETWORK"
   | "PROVIDER_RATE_LIMIT"
+  | "MANAGED_USAGE_LIMIT"
   | "PROVIDER_OVERLOADED"
   | "PROVIDER_API"
   | "PROVIDER_BILLING"
@@ -532,6 +535,7 @@ export type ConversationErrorCode =
   | "CONTEXT_TOO_LARGE"
   | "CONVERSATION_ABORTED"
   | "CONVERSATION_PROCESSING_FAILED"
+  | "DISK_SPACE_CRITICAL"
   | "REGENERATE_FAILED"
   | "UNKNOWN";
 

package/src/daemon/message-types/disk-pressure.ts

@@ -0,0 +1,9 @@
+import type { DiskPressureStatus } from "../disk-pressure-guard.js";
+
+/** Server push when the disk pressure status snapshot changes. */
+export interface DiskPressureStatusChanged {
+  type: "disk_pressure_status_changed";
+  status: DiskPressureStatus;
+}
+
+export type _DiskPressureServerMessages = DiskPressureStatusChanged;

package/src/daemon/message-types/messages.ts

@@ -147,8 +147,26 @@ export interface ToolResult {
   matchedTrustRuleId?: string;
   /** Whether the daemon is running in a containerized (Docker) environment. */
   isContainerized?: boolean;
-  /** Scope options ladder for the rule editor modal (narrowest to broadest). */
+  /**
+   * Display-only ladder of scope option labels for the rule editor
+   * (narrowest to broadest). The `pattern` here is regex-style and is
+   * NOT a valid trust rule pattern. Clients must use
+   * `riskAllowlistOptions` for the pattern that gets saved.
+   */
   riskScopeOptions?: Array<{ pattern: string; label: string }>;
+  /**
+   * Allowlist options for the rule editor save path (narrowest to
+   * broadest). Each `pattern` is a Minimatch-glob compatible string —
+   * what the gateway actually matches against. Mirrors the
+   * `allowlistOptions` field on `ConfirmationRequest`. May be absent
+   * for tools whose classifier does not produce an allowlist (e.g.
+   * web-risk classifier, MCP tools without classifier coverage).
+   */
+  riskAllowlistOptions?: Array<{
+    label: string;
+    description: string;
+    pattern: string;
+  }>;
   /** Directory scope ladder for the rule editor modal (narrowest to broadest). */
   riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
   /** How the approval decision was reached: prompted, auto, blocked, or unknown (legacy). */
@@ -236,10 +254,13 @@ export interface MessageComplete {
 export interface ErrorMessage {
   type: "error";
   conversationId?: string;
+  requestId?: string;
   code?: string;
   message: string;
   /** Categorizes the error so the client can offer contextual actions (e.g. "Send Anyway" for secret_blocked). */
   category?: string;
+  /** Machine-readable conversation error category for clients that need source-aware recovery UI. */
+  errorCategory?: string;
 }
 
 export interface MessageQueued {