@vellumai/assistant 0.8.1 → 0.8.2

package/src/__tests__/workspace-migration-remove-legacy-skills-index.test.ts

@@ -0,0 +1,309 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+
+import { removeLegacySkillsIndexMigration } from "../workspace/migrations/084-remove-legacy-skills-index.js";
+
+let workspaceDir: string;
+
+beforeEach(() => {
+  workspaceDir = mkdtempSync(join(tmpdir(), "vellum-migration-084-test-"));
+});
+
+afterEach(() => {
+  if (existsSync(workspaceDir)) {
+    rmSync(workspaceDir, { recursive: true, force: true });
+  }
+});
+
+function writeSkill(skillId: string, body = "Body."): string {
+  const skillDir = join(workspaceDir, "skills", skillId);
+  mkdirSync(skillDir, { recursive: true });
+  const skillFilePath = join(skillDir, "SKILL.md");
+  writeFileSync(
+    skillFilePath,
+    `---\nname: "${skillId}"\ndescription: "Test skill."\n---\n\n${body}\n`,
+    "utf-8",
+  );
+  return skillFilePath;
+}
+
+function writeLegacyIndex(contents = "- alpha\n"): string {
+  const skillsDir = join(workspaceDir, "skills");
+  mkdirSync(skillsDir, { recursive: true });
+  const legacyIndexPath = join(skillsDir, "SKILLS.md");
+  writeFileSync(legacyIndexPath, contents, "utf-8");
+  return legacyIndexPath;
+}
+
+function expectNestedSkillPreserved(
+  legacyIndexPath: string,
+  nestedSkillPath: string,
+): void {
+  const topLevelSkillPath = join(
+    workspaceDir,
+    "skills",
+    "my-skill",
+    "SKILL.md",
+  );
+  expect(existsSync(legacyIndexPath)).toBe(false);
+  expect(existsSync(nestedSkillPath)).toBe(true);
+  expect(readFileSync(topLevelSkillPath, "utf-8")).toContain("org/my-skill");
+}
+
+describe("084-remove-legacy-skills-index migration", () => {
+  test("has correct id and description", () => {
+    expect(removeLegacySkillsIndexMigration.id).toBe(
+      "084-remove-legacy-skills-index",
+    );
+    expect(removeLegacySkillsIndexMigration.description).toContain("SKILLS.md");
+    expect(removeLegacySkillsIndexMigration.retryFailedCheckpoint).toBe(true);
+  });
+
+  test("removes only skills/SKILLS.md when present", () => {
+    const skillsDir = join(workspaceDir, "skills");
+    const legacyIndexPath = writeLegacyIndex();
+
+    const alphaSkillPath = writeSkill("alpha");
+    const betaSkillPath = writeSkill("beta");
+    const topLevelSkillPath = join(skillsDir, "SKILL.md");
+    writeFileSync(
+      topLevelSkillPath,
+      "---\nname: Root\ndescription: Root file.\n---\n\nRoot.\n",
+      "utf-8",
+    );
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(readFileSync(alphaSkillPath, "utf-8")).toContain("alpha");
+    expect(readFileSync(betaSkillPath, "utf-8")).toContain("beta");
+    expect(readFileSync(topLevelSkillPath, "utf-8")).toContain("Root");
+  });
+
+  test("is a no-op when skills/SKILLS.md is absent", () => {
+    writeSkill("alpha");
+
+    expect(() =>
+      removeLegacySkillsIndexMigration.run(workspaceDir),
+    ).not.toThrow();
+    expect(existsSync(join(workspaceDir, "skills", "alpha", "SKILL.md"))).toBe(
+      true,
+    );
+  });
+
+  test("removing a stale SKILLS.md index preserves omitted valid skill directories", () => {
+    const legacyIndexPath = writeLegacyIndex("- indexed-skill\n");
+
+    writeSkill("indexed-skill");
+    writeSkill("omitted-skill");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(
+      readFileSync(
+        join(workspaceDir, "skills", "omitted-skill", "SKILL.md"),
+        "utf-8",
+      ),
+    ).toContain("Body.");
+  });
+
+  test("copies nested indexed skills to top-level discovery location", () => {
+    const legacyIndexPath = writeLegacyIndex("- org/my-skill\n");
+    const nestedSkillPath = writeSkill("org/my-skill");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    const topLevelSkillPath = join(
+      workspaceDir,
+      "skills",
+      "my-skill",
+      "SKILL.md",
+    );
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(existsSync(nestedSkillPath)).toBe(true);
+    expect(readFileSync(topLevelSkillPath, "utf-8")).toContain("org/my-skill");
+
+    expect(readFileSync(topLevelSkillPath, "utf-8")).toContain("Body.");
+  });
+
+  test("copies nested indexed skills from plain entries that point to SKILL.md", () => {
+    const legacyIndexPath = writeLegacyIndex("- org/my-skill/SKILL.md\n");
+    const nestedSkillPath = writeSkill("org/my-skill");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expectNestedSkillPreserved(legacyIndexPath, nestedSkillPath);
+  });
+
+  test("copies nested indexed skills from markdown links that point to SKILL.md", () => {
+    const legacyIndexPath = writeLegacyIndex(
+      "- [My Skill](org/my-skill/skill.md)\n",
+    );
+    const nestedSkillPath = writeSkill("org/my-skill");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expectNestedSkillPreserved(legacyIndexPath, nestedSkillPath);
+  });
+
+  test("preserves nested indexed skill with alternate id when top-level basename exists", () => {
+    const legacyIndexPath = writeLegacyIndex("- org/my-skill\n");
+    const nestedSkillPath = writeSkill("org/my-skill", "Nested body.");
+    const topLevelSkillPath = writeSkill("my-skill", "Top-level body.");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    const preservedSkillPath = join(
+      workspaceDir,
+      "skills",
+      "org__my-skill",
+      "SKILL.md",
+    );
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(readFileSync(nestedSkillPath, "utf-8")).toContain("Nested body.");
+    expect(readFileSync(topLevelSkillPath, "utf-8")).toContain(
+      "Top-level body.",
+    );
+    expect(readFileSync(preservedSkillPath, "utf-8")).toContain("Nested body.");
+
+    expect(readFileSync(topLevelSkillPath, "utf-8")).toContain(
+      "Top-level body.",
+    );
+    expect(readFileSync(preservedSkillPath, "utf-8")).toContain("Nested body.");
+  });
+
+  test("preserves same-basename nested indexed skills with unique top-level ids", () => {
+    const legacyIndexPath = writeLegacyIndex(
+      "- team-a/deploy\n- team-b/deploy\n",
+    );
+    const teamASkillPath = writeSkill("team-a/deploy", "Team A body.");
+    const teamBSkillPath = writeSkill("team-b/deploy", "Team B body.");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    const primaryPreservedSkillPath = join(
+      workspaceDir,
+      "skills",
+      "deploy",
+      "SKILL.md",
+    );
+    const alternatePreservedSkillPath = join(
+      workspaceDir,
+      "skills",
+      "team-b__deploy",
+      "SKILL.md",
+    );
+
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(existsSync(teamASkillPath)).toBe(true);
+    expect(existsSync(teamBSkillPath)).toBe(true);
+    expect(readFileSync(primaryPreservedSkillPath, "utf-8")).toContain(
+      "Team A body.",
+    );
+    expect(readFileSync(alternatePreservedSkillPath, "utf-8")).toContain(
+      "Team B body.",
+    );
+
+    expect(readFileSync(primaryPreservedSkillPath, "utf-8")).toContain(
+      "Team A body.",
+    );
+    expect(readFileSync(alternatePreservedSkillPath, "utf-8")).toContain(
+      "Team B body.",
+    );
+  });
+
+  test("does not follow legacy index entries outside the skills root", () => {
+    const legacyIndexPath = writeLegacyIndex("- ../outside/my-skill\n");
+    const outsideSkillDir = join(workspaceDir, "outside", "my-skill");
+    mkdirSync(outsideSkillDir, { recursive: true });
+    writeFileSync(
+      join(outsideSkillDir, "SKILL.md"),
+      "---\nname: Outside\ndescription: Outside skill.\n---\n\nOutside.\n",
+      "utf-8",
+    );
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expect(existsSync(legacyIndexPath)).toBe(false);
+    expect(existsSync(join(workspaceDir, "skills", "my-skill"))).toBe(false);
+  });
+
+  test("is safe to re-run", () => {
+    const legacyIndexPath = writeLegacyIndex();
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+    expect(() =>
+      removeLegacySkillsIndexMigration.run(workspaceDir),
+    ).not.toThrow();
+    expect(existsSync(legacyIndexPath)).toBe(false);
+  });
+
+  test("does not recursively delete a directory named SKILLS.md", () => {
+    const legacyIndexDir = join(workspaceDir, "skills", "SKILLS.md");
+    mkdirSync(legacyIndexDir, { recursive: true });
+    writeFileSync(join(legacyIndexDir, "nested.txt"), "keep\n", "utf-8");
+
+    removeLegacySkillsIndexMigration.run(workspaceDir);
+
+    expect(readFileSync(join(legacyIndexDir, "nested.txt"), "utf-8")).toBe(
+      "keep\n",
+    );
+  });
+
+  test("rethrows unexpected lstat failures", () => {
+    const legacyIndexPath = writeLegacyIndex();
+
+    const lstatError = Object.assign(new Error("simulated lstat failure"), {
+      code: "EACCES",
+    });
+    const lstatSpy = spyOn(fs, "lstatSync").mockImplementation(() => {
+      throw lstatError;
+    });
+
+    try {
+      expect(() => removeLegacySkillsIndexMigration.run(workspaceDir)).toThrow(
+        lstatError,
+      );
+      expect(existsSync(legacyIndexPath)).toBe(true);
+    } finally {
+      lstatSpy.mockRestore();
+    }
+  });
+
+  test("rethrows unexpected unlink failures and leaves SKILLS.md for retry", () => {
+    const legacyIndexPath = writeLegacyIndex();
+
+    const unlinkError = Object.assign(new Error("simulated unlink failure"), {
+      code: "EACCES",
+    });
+    const unlinkSpy = spyOn(fs, "unlinkSync").mockImplementation(() => {
+      throw unlinkError;
+    });
+
+    try {
+      expect(() => removeLegacySkillsIndexMigration.run(workspaceDir)).toThrow(
+        unlinkError,
+      );
+      expect(existsSync(legacyIndexPath)).toBe(true);
+    } finally {
+      unlinkSpy.mockRestore();
+    }
+  });
+
+  test("down() is a no-op", () => {
+    expect(() =>
+      removeLegacySkillsIndexMigration.down(workspaceDir),
+    ).not.toThrow();
+  });
+});

package/src/__tests__/workspace-migrations-runner.test.ts

@@ -137,9 +137,10 @@ describe("runWorkspaceMigrations", () => {
     expect(m1.run).toHaveBeenCalledTimes(1);
     expect(m2.run).toHaveBeenCalledTimes(1);
 
-    // Checkpoints saved: started m1, completed m1, started m2, failed m2 = 4 writes
-    expect(writeFileSyncFn).toHaveBeenCalledTimes(4);
-    expect(renameSyncFn).toHaveBeenCalledTimes(4);
+    // Checkpoints saved: started m1, completed m1, started m2, failed m2,
+    // then the post-loop flip clearing isNewWorkspace = 5 writes.
+    expect(writeFileSyncFn).toHaveBeenCalledTimes(5);
+    expect(renameSyncFn).toHaveBeenCalledTimes(5);
 
     // Verify the completed checkpoint contains m1
     // The second write is the "completed" marker for m1
@@ -246,6 +247,33 @@ describe("runWorkspaceMigrations", () => {
     expect(m1.run).not.toHaveBeenCalled();
   });
 
+  test("skips failed migrations by default", async () => {
+    mockCheckpointContents = JSON.stringify({
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "failed" },
+      },
+    });
+
+    const m1 = makeMigration("001");
+    await runWorkspaceMigrations(WORKSPACE_DIR, [m1]);
+
+    expect(m1.run).not.toHaveBeenCalled();
+  });
+
+  test("retries failed migrations that opt in", async () => {
+    mockCheckpointContents = JSON.stringify({
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "failed" },
+      },
+    });
+
+    const m1 = makeMigration("001");
+    m1.retryFailedCheckpoint = true;
+    await runWorkspaceMigrations(WORKSPACE_DIR, [m1]);
+
+    expect(m1.run).toHaveBeenCalledTimes(1);
+  });
+
   test("supports async migrations", async () => {
     const asyncMigration: WorkspaceMigration = {
       id: "001",
@@ -278,6 +306,86 @@ describe("runWorkspaceMigrations", () => {
     expect(m1.run).not.toHaveBeenCalled();
   });
 
+  test("persists isNewWorkspace=true on first creation, then flips to false after sweep", async () => {
+    // No checkpoint file → fresh workspace.
+    const m1 = makeMigration("001");
+    let observed: boolean | undefined;
+    (m1.run as ReturnType<typeof mock>).mockImplementation(
+      (_dir: string, ctx?: { isNewWorkspace: boolean }) => {
+        observed = ctx?.isNewWorkspace;
+      },
+    );
+
+    await runWorkspaceMigrations(WORKSPACE_DIR, [m1]);
+
+    // The migration saw the new-workspace flag.
+    expect(observed).toBe(true);
+
+    // The first persisted checkpoint (m1's "started" save) carries the flag.
+    const firstSave = JSON.parse(
+      (writeFileSyncFn.mock.calls[0] as unknown[])[1] as string,
+    );
+    expect(firstSave.isNewWorkspace).toBe(true);
+
+    // The final persisted checkpoint clears the flag so subsequent boots
+    // treat this workspace as an upgrade.
+    const finalSave = JSON.parse(
+      (writeFileSyncFn.mock.calls.at(-1) as unknown[])[1] as string,
+    );
+    expect(finalSave.isNewWorkspace).toBe(false);
+  });
+
+  test("preserves isNewWorkspace=true across a crash before seeding migrations run", async () => {
+    // Simulate a crash mid-first-boot: an earlier migration recorded its
+    // "started" marker (writing the checkpoint file) and the daemon then
+    // died before reaching the seeding migration. The persisted flag must
+    // survive the reboot so the seeding migration still observes the
+    // brand-new workspace.
+    mockCheckpointContents = JSON.stringify({
+      isNewWorkspace: true,
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "started" },
+      },
+    });
+
+    const seedingMigration = makeMigration("seed");
+    let observed: boolean | undefined;
+    (seedingMigration.run as ReturnType<typeof mock>).mockImplementation(
+      (_dir: string, ctx?: { isNewWorkspace: boolean }) => {
+        observed = ctx?.isNewWorkspace;
+      },
+    );
+
+    const m1 = makeMigration("001");
+    await runWorkspaceMigrations(WORKSPACE_DIR, [m1, seedingMigration]);
+
+    expect(m1.run).toHaveBeenCalledTimes(1);
+    expect(seedingMigration.run).toHaveBeenCalledTimes(1);
+    expect(observed).toBe(true);
+  });
+
+  test("treats pre-existing checkpoint without isNewWorkspace field as upgrade", async () => {
+    // Workspaces created before this field was introduced have a checkpoint
+    // file with only `applied`. They must not be re-seeded.
+    mockCheckpointContents = JSON.stringify({
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "completed" },
+      },
+    });
+
+    const seedingMigration = makeMigration("seed");
+    let observed: boolean | undefined;
+    (seedingMigration.run as ReturnType<typeof mock>).mockImplementation(
+      (_dir: string, ctx?: { isNewWorkspace: boolean }) => {
+        observed = ctx?.isNewWorkspace;
+      },
+    );
+
+    await runWorkspaceMigrations(WORKSPACE_DIR, [seedingMigration]);
+
+    expect(observed).toBe(false);
+  });
+
   test("warns on malformed checkpoint file", async () => {
     mockCheckpointContents = "not valid json";
 

package/src/acp/resolve-agent.ts

@@ -73,7 +73,7 @@ function installHintFor(command: string): string {
  */
 function findAgentBinary(agent: AcpAgentConfig): string | null {
   const PATH = agent.env?.PATH ?? process.env.PATH;
-  return Bun.which(agent.command, PATH ? { PATH } : undefined);
+  return Bun.which(agent.command, PATH != null ? { PATH } : undefined);
 }
 
 /**

package/src/agent/image-optimize.ts

@@ -21,6 +21,11 @@ const MAX_DIMENSION = 1568;
 // Threshold below which we skip optimization — small images don't need it.
 const OPTIMIZE_THRESHOLD_BYTES = 300 * 1024; // 300 KB
 
+// Anthropic rejects any single image whose source payload exceeds 5 MB,
+// regardless of pixel dimensions. Cap at ~3.5 MB raw so the base64-encoded
+// form (raw * 4/3) stays comfortably under 5 MB even after re-encoding.
+const MAX_TRANSPORT_BYTES = Math.floor(3.5 * 1024 * 1024); // ~3.5 MB raw
+
 const JPEG_QUALITY = 80;
 
 // Content-addressed disk cache to avoid re-running sips on the same image.
@@ -130,10 +135,13 @@ function runSips(inputBytes: Buffer): Buffer | null {
 /**
  * Decide whether an image needs to be rescaled before sending.
  *
- * Anthropic rejects many-image requests when any image exceeds 2000 px on a
- * side, so dimensions — not file size — are the authoritative gate. A sparse
- * screenshot can be under 300 KB while still being 3000+ px wide, which the
- * byte-size heuristic alone would let slip through.
+ * Two independent gates apply:
+ *   1. Pixel dimensions — Anthropic rejects many-image requests when any
+ *      image exceeds 2000 px on a side. A sparse screenshot can be under
+ *      300 KB while still being 3000+ px wide.
+ *   2. Byte size — Anthropic rejects any image whose source payload
+ *      exceeds 5 MB. A 1500×1500 high-color screenshot can produce a >5 MB
+ *      payload while staying well under the dimension cap.
  *
  * Exported for unit testing.
  */
@@ -141,8 +149,8 @@ export function shouldRescaleImage(
   dims: { width: number; height: number } | null,
   byteLength: number,
 ): boolean {
+  if (byteLength > MAX_TRANSPORT_BYTES) return true;
   if (dims) {
-    // Dimensions known — they are the authoritative check.
     return dims.width > MAX_DIMENSION || dims.height > MAX_DIMENSION;
   }
   // Dimensions unparseable — fall back to file size as a rough proxy.

package/src/calls/voice-session-bridge.ts

@@ -318,8 +318,9 @@ export async function startVoiceTurn(
 
   // Phone voice has no interactive permission/secret UI, so apply explicit
   // per-role policies by default. Local live voice opts into the normal
-  // client approval path instead. Side-effect double-defense is wired
-  // below at the conversation-configure point.
+  // client approval path instead. Side-effect double-defense
+  // (forcePromptSideEffects) is wired inside the agent-loop IIFE so it
+  // is always paired with cleanup() in the IIFE's finally.
   const trustClass = opts.trustContext?.trustClass;
   const isGuardian = trustClass === "guardian";
   const approvalMode = opts.approvalMode ?? "phone-call";
@@ -391,34 +392,57 @@ export async function startVoiceTurn(
     }
   }
 
-  // Non-guardian phone voice forces side-effect tools to prompt so the
-  // auto-deny handler below reliably sees a confirmation_request. Without
-  // this, a broad allow trust rule (e.g. wildcard bash) would let
-  // side-effect tools execute without ever emitting an event for the
-  // auto-deny / scoped-grant handler to intercept.
-  conversation.forcePromptSideEffects =
-    !isGuardian && !usesLocalInteractiveApprovals;
-  conversation.setAssistantId(opts.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID);
-  conversation.callSessionId = voiceSessionId;
-  conversation.setTrustContext(opts.trustContext ?? null);
-  conversation.setCommandIntent(null);
-  conversation.setTurnChannelContext(turnChannelContext);
-  conversation.setTurnInterfaceContext?.(turnInterfaceContext);
-  conversation.setChannelCapabilities(
-    resolveChannelCapabilities(
-      turnChannelContext.userMessageChannel,
-      turnInterfaceContext.userMessageInterface,
-    ),
-  );
-  conversation.setVoiceCallControlPrompt(voiceCallControlPrompt);
+  // Hoisted so the catch below can clear partially-applied turn state
+  // when a setter or `persistUserMessage` throws — otherwise `trustContext`,
+  // `callSessionId`, etc. leak into subsequent non-voice turns on the same
+  // conversation. The client callback is only reset when this turn actually
+  // installed it (tracked via `clientCallbackInstalled`); otherwise cleanup
+  // would detach an active sender installed by a prior turn.
+  let clientCallbackInstalled = false;
+  const cleanup = () => {
+    conversation.setChannelCapabilities(null);
+    conversation.setTrustContext(null);
+    conversation.setCommandIntent(null);
+    conversation.setAssistantId("self");
+    conversation.setVoiceCallControlPrompt(null);
+    conversation.callSessionId = undefined;
+    conversation.forcePromptSideEffects = false;
+    if (clientCallbackInstalled) {
+      // Reset the client callback to a no-op so the stale closure doesn't
+      // intercept events from future turns on the same conversation.
+      conversation.updateClient(() => {}, true);
+    }
+  };
 
   const requestId = crypto.randomUUID();
   const turnId = crypto.randomUUID();
-  const messageId = await conversation.persistUserMessage(
-    persistedContent,
-    [],
-    requestId,
-  );
+  let messageId: string;
+  try {
+    conversation.setAssistantId(
+      opts.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
+    );
+    conversation.callSessionId = voiceSessionId;
+    conversation.setTrustContext(opts.trustContext ?? null);
+    conversation.setCommandIntent(null);
+    conversation.setTurnChannelContext(turnChannelContext);
+    conversation.setTurnInterfaceContext?.(turnInterfaceContext);
+    conversation.setChannelCapabilities(
+      resolveChannelCapabilities(
+        turnChannelContext.userMessageChannel,
+        turnInterfaceContext.userMessageInterface,
+      ),
+    );
+    conversation.setVoiceCallControlPrompt(voiceCallControlPrompt);
+
+    messageId = await conversation.persistUserMessage(
+      persistedContent,
+      [],
+      requestId,
+    );
+  } catch (err) {
+    cleanup();
+    throw err;
+  }
   try {
     opts.callbacks?.persisted_user_message_id?.(messageId);
   } catch (err) {
@@ -556,25 +580,20 @@ export async function startVoiceTurn(
     }
     broadcastMessage(msg);
   });
+  clientCallbackInstalled = true;
 
   // Fire-and-forget the agent loop
-  const cleanup = () => {
-    // Reset channel capabilities so a subsequent desktop session on the
-    // same conversation is not incorrectly treated as a voice client.
-    conversation.setChannelCapabilities(null);
-    conversation.setTrustContext(null);
-    conversation.setCommandIntent(null);
-    conversation.setAssistantId("self");
-    conversation.setVoiceCallControlPrompt(null);
-    conversation.callSessionId = undefined;
-    conversation.forcePromptSideEffects = false;
-    // Reset the conversation's client callback to a no-op so the stale
-    // closure doesn't intercept events from future turns on the same conversation.
-    conversation.updateClient(() => {}, true);
-  };
-
   void (async () => {
     try {
+      // Non-guardian phone voice forces side-effect tools to prompt so the
+      // auto-deny handler above reliably sees a confirmation_request. Without
+      // this, a broad allow trust rule (e.g. wildcard bash) would let
+      // side-effect tools execute without ever emitting an event for the
+      // auto-deny / scoped-grant handler to intercept. Set inside the
+      // try/finally so a failed setup before this point cannot leak the
+      // flag into subsequent non-voice turns on the same conversation.
+      conversation.forcePromptSideEffects =
+        !isGuardian && !usesLocalInteractiveApprovals;
       await conversation.runAgentLoop(
         persistedContent,
         messageId,