@vellumai/assistant 0.8.12-dev.202606131247.4d64b75 → 0.8.12-dev.202606131450.c6f2ffd

package/openapi.yaml

@@ -10561,6 +10561,8 @@ paths:
                       - hostPattern
                       - injectionType
                     additionalProperties: false
+                conversationId:
+                  type: string
               required:
                 - service
                 - field
@@ -20904,7 +20906,6 @@ paths:
                           type: string
                       required:
                         - requestId
-                        - conversationId
                         - kind
                       additionalProperties: false
                     description: All pending interactions (returned when no filters given)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.8.12-dev.202606131247.4d64b75",
+  "version": "0.8.12-dev.202606131450.c6f2ffd",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/approval-routes-http.test.ts

@@ -8,6 +8,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { Conversation } from "../daemon/conversation.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { SecretPromptResult } from "../permissions/secret-prompter.js";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -196,6 +197,7 @@ function makeIdleSession(opts?: {
       pendingInteractions.resolve(requestId);
       opts?.onConfirmation?.(requestId, decision);
     },
+    hasPendingSecret: () => true,
     handleSecretResponse: (
       requestId: string,
       value?: string,
@@ -593,6 +595,54 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await stopServer();
     });
 
+    test("resolves a conversation-less secret request via its resolver", async () => {
+      /**
+       * The CLI `credentials prompt` command registers a conversation-less
+       * secret interaction whose resolver lives in pendingInteractions. POST
+       * /v1/secret must drive that resolver directly — with no owning
+       * conversation — so the standalone prompt completes instead of only
+       * timing out.
+       */
+      // GIVEN a running server
+      await startServer(() => makeIdleSession());
+
+      // AND a conversation-less secret interaction whose resolver is captured
+      let resolved: SecretPromptResult | undefined;
+      pendingInteractions.register("standalone-secret-1", {
+        kind: "secret",
+        rpcResolve: (value: unknown) => {
+          resolved = value as SecretPromptResult;
+        },
+      });
+
+      // WHEN the secret is submitted for that requestId
+      const res = await fetch(url("secret"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "standalone-secret-1",
+          value: "cli-secret-value",
+          delivery: "store",
+        }),
+      });
+      const body = (await res.json()) as { accepted: boolean };
+
+      // THEN the request is accepted
+      expect(res.status).toBe(200);
+      expect(body.accepted).toBe(true);
+
+      // AND the standalone resolver receives the value and delivery
+      expect(resolved).toEqual({
+        value: "cli-secret-value",
+        delivery: "store",
+      });
+
+      // AND the interaction is removed after resolution
+      expect(pendingInteractions.get("standalone-secret-1")).toBeUndefined();
+
+      await stopServer();
+    });
+
     test("returns 404 for unknown requestId", async () => {
       await startServer(() => makeIdleSession());
 
@@ -638,6 +688,47 @@ describe("standalone approval endpoints — HTTP layer", () => {
 
       await stopServer();
     });
+
+    test("rejects a non-secret requestId without consuming it", async () => {
+      /**
+       * /v1/secret only settles secret prompts. A confirmation (or any other
+       * interaction kind) posted here from stale client state must be rejected
+       * so its real approval endpoint still finds an intact pending interaction
+       * rather than one consumed and resolved with a SecretPromptResult.
+       */
+      // GIVEN a running server
+      await startServer(() => makeIdleSession());
+
+      // AND a pending confirmation interaction whose resolver would be corrupted
+      let resolverCalled = false;
+      pendingInteractions.register("confirm-not-secret", {
+        conversationId: "conv-1",
+        kind: "confirmation",
+        rpcResolve: () => {
+          resolverCalled = true;
+        },
+      });
+
+      // WHEN that confirmation's requestId is posted to /v1/secret
+      const res = await fetch(url("secret"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "confirm-not-secret",
+          value: "leaked",
+          delivery: "store",
+        }),
+      });
+
+      // THEN the request is rejected
+      expect(res.status).toBe(404);
+
+      // AND the confirmation interaction is left intact and unresolved
+      expect(pendingInteractions.get("confirm-not-secret")).toBeDefined();
+      expect(resolverCalled).toBe(false);
+
+      await stopServer();
+    });
   });
 
   // ── POST /v1/trust-rules ─────────────────────────────────────────────

package/src/__tests__/pending-interactions-resolved-event.test.ts

@@ -102,6 +102,28 @@ describe("pendingInteractions.resolve emits interaction_resolved", () => {
     expect(publishedMessages).toHaveLength(0);
   });
 
+  test("no event is emitted for a conversation-less interaction", () => {
+    /**
+     * Conversation-less interactions (e.g. the CLI `credentials prompt`
+     * command) resolve through their own resolver rather than a conversation.
+     * The `interaction_resolved` envelope requires a conversationId, so the
+     * tracker skips the broadcast instead of emitting an invalid event.
+     */
+    // GIVEN a registered interaction with no owning conversation
+    pendingInteractions.register("req-detached", { kind: "secret" });
+
+    // WHEN it is resolved
+    const returned = pendingInteractions.resolve("req-detached", "answered");
+
+    // THEN the entry is still returned to its caller
+    expect(returned).toBeDefined();
+
+    // AND no interaction_resolved envelope is published
+    expect(
+      publishedMessages.filter((m) => m.type === "interaction_resolved"),
+    ).toHaveLength(0);
+  });
+
   test("a single resolve emits exactly one event", () => {
     pendingInteractions.register("req-once", {
       conversationId: "conv-e",
@@ -186,4 +208,44 @@ describe("removeByConversation emits interaction_resolved per entry", () => {
         .state,
     ).toBe("cancelled");
   });
+
+  test("settles a swept secret prompt's resolver with a cancelled result", () => {
+    /**
+     * A secret prompt blocks its caller (the CLI `credentials prompt` command
+     * or the in-conversation SecretPrompter) on `rpcResolve`. Unlike questions
+     * (abort-signal teardown) and confirmations (denyAllPendingConfirmations),
+     * nothing else settles a secret when it is superseded, so removing the
+     * entry alone would hang the caller until its IPC client times out.
+     */
+    // GIVEN a pending secret whose caller is blocked on rpcResolve
+    const resolved: unknown[] = [];
+    pendingInteractions.register("secret-sweep", {
+      conversationId: "conv-sweep",
+      kind: "secret",
+      rpcResolve: (value) => resolved.push(value),
+    });
+
+    // WHEN a new user message supersedes the conversation's interactions
+    pendingInteractions.removeByConversation("conv-sweep");
+
+    // THEN the secret resolver is settled once with a cancelled result
+    expect(resolved).toEqual([{ value: null, delivery: "store" }]);
+  });
+
+  test("does not invoke a swept confirmation's resolver with a secret result", () => {
+    // GIVEN a pending confirmation carrying an rpcResolve callback
+    const resolved: unknown[] = [];
+    pendingInteractions.register("conf-sweep", {
+      conversationId: "conv-conf",
+      kind: "confirmation",
+      rpcResolve: (value) => resolved.push(value),
+    });
+
+    // WHEN the conversation is superseded
+    pendingInteractions.removeByConversation("conv-conf");
+
+    // THEN the confirmation resolver is left untouched — only secret prompts
+    // are settled with a SecretPromptResult-shaped value here.
+    expect(resolved).toHaveLength(0);
+  });
 });

package/src/__tests__/runtime-events-sse-parity.test.ts

@@ -138,6 +138,7 @@ describe("SSE HTTP parity — streaming/delta message types", () => {
       type: "assistant_thinking_delta" as const,
       thinking: "Let me reason through this...",
       conversationId: "conv-thinking-test",
+      timestampMs: 1_700_000_000_000,
     };
     const event = await publishAndReadFrame("parity-thinking-delta", msg);
 
@@ -145,6 +146,7 @@ describe("SSE HTTP parity — streaming/delta message types", () => {
     const m = event.message as typeof msg;
     expect(m.thinking).toBe("Let me reason through this...");
     expect(m.conversationId).toBe("conv-thinking-test");
+    expect(m.timestampMs).toBe(1_700_000_000_000);
   });
 
   // ── tool_input_delta ─────────────────────────────────────────────────────

package/src/api/events/assistant-thinking-delta.ts

@@ -12,6 +12,13 @@
  * Absent on streams produced by older daemons that pre-date the anchor
  * protocol.
  *
+ * `timestampMs` is the daemon's wall-clock emission time for the delta. The
+ * transport envelope (`AssistantEvent.emittedAt`) carries the same instant,
+ * but it is dropped once the inner message is unwrapped for persistence,
+ * debug buffers, and backend storage — so the timestamp is carried on the
+ * payload itself to make per-delta timing observable wherever the message
+ * travels.
+ *
  * Only emitted when thinking streaming is enabled for the turn; turns that
  * suppress reasoning output produce none.
  *
@@ -26,6 +33,9 @@ export const AssistantThinkingDeltaEventSchema = z.object({
   thinking: z.string(),
   messageId: z.string().optional(),
   conversationId: z.string().optional(),
+  /** Epoch milliseconds (`Date.now()`) at which the daemon emitted this
+   *  delta. Absent on streams produced by daemons that pre-date this field. */
+  timestampMs: z.number().optional(),
 });
 
 export type AssistantThinkingDeltaEvent = z.infer<

package/src/cli/commands/credentials.ts

@@ -5,6 +5,7 @@ import type { CredentialPromptResult } from "../../runtime/routes/credential-pro
 import { registerCommand } from "../lib/register-command.js";
 import { log } from "../logger.js";
 import { shouldOutputJson, writeOutput } from "../output.js";
+import { tryResolveConversationId } from "../utils/conversation-id.js";
 
 // ---------------------------------------------------------------------------
 // Format-aware error output
@@ -114,8 +115,7 @@ export function registerCredentialsCommand(program: Command): void {
     description:
       "Manage credentials in the encrypted vault (API keys, tokens, passwords)",
     build: (credential) => {
-      credential
-        .option("--json", "Machine-readable compact JSON output");
+      credential.option("--json", "Machine-readable compact JSON output");
 
       credential.addHelpText(
         "after",
@@ -224,9 +224,7 @@ Examples:
 
       credential
         .command("status")
-        .description(
-          "Show the active credential backend and its configuration",
-        )
+        .description("Show the active credential backend and its configuration")
         .addHelpText(
           "after",
           `
@@ -248,9 +246,8 @@ Examples:
   $ assistant credentials status --json`,
         )
         .action(async (_opts: Record<string, unknown>, cmd: Command) => {
-          const r = await cliIpcCall<CredentialsStatusResponse>(
-            "credentials_status",
-          );
+          const r =
+            await cliIpcCall<CredentialsStatusResponse>("credentials_status");
           if (!r.ok) {
             return exitFromIpcResult(
               r as { ok: false; error?: string; statusCode?: number },
@@ -286,7 +283,10 @@ Examples:
       credential
         .command("set <value>")
         .description("Store a secret and create or update its metadata")
-        .requiredOption("--service <service>", "Service namespace (e.g. google)")
+        .requiredOption(
+          "--service <service>",
+          "Service namespace (e.g. google)",
+        )
         .requiredOption("--field <field>", "Field name (e.g. client_secret)")
         .option("--label <label>", 'Human-friendly label (e.g. "prod", "work")')
         .option(
@@ -345,7 +345,8 @@ Examples:
             if (!r.ok) {
               writeError(
                 cmd,
-                r.error ?? `Failed to store credential ${opts.service}:${opts.field}`,
+                r.error ??
+                  `Failed to store credential ${opts.service}:${opts.field}`,
               );
               process.exitCode = 1;
               return;
@@ -397,7 +398,8 @@ Examples:
             if (!r.ok) {
               writeError(
                 cmd,
-                r.error ?? `Failed to delete credential ${opts.service}:${opts.field}`,
+                r.error ??
+                  `Failed to delete credential ${opts.service}:${opts.field}`,
               );
               process.exitCode = 1;
               return;
@@ -410,9 +412,7 @@ Examples:
                 field: opts.field,
               });
             } else {
-              log.info(
-                `Deleted credential ${opts.service}:${opts.field}`,
-              );
+              log.info(`Deleted credential ${opts.service}:${opts.field}`);
             }
           },
         );
@@ -666,6 +666,7 @@ Examples:
                   allowedDomains,
                   allowedTools,
                   injectionTemplates,
+                  conversationId: tryResolveConversationId(),
                 },
               },
               { timeoutMs: PROMPT_TIMEOUT_MS },
@@ -681,10 +682,7 @@ Examples:
             }
 
             if (!ipc.result?.ok) {
-              writeError(
-                cmd,
-                ipc.result?.error ?? "Credential prompt failed",
-              );
+              writeError(cmd, ipc.result?.error ?? "Credential prompt failed");
               process.exitCode = 1;
               return;
             }

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -867,6 +867,7 @@ function handleThinkingDelta(
     thinking: event.thinking,
     conversationId: deps.ctx.conversationId,
     messageId: state.lastAssistantMessageId,
+    timestampMs: Date.now(),
   });
   // Mirror thinking into the same running view as text so the debounced
   // partial flush persists it mid-turn -- long reasoning streams survive a

package/src/daemon/handlers/shared.ts

@@ -13,6 +13,7 @@ import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
 import { isPlaceholderSentinelText } from "../../providers/placeholder-sentinels.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
+import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { unwrapExternalContentForDisplay } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
@@ -28,15 +29,6 @@ export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
 
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
-// Module-level map for non-conversation secret prompts (e.g. publish_page)
-const pendingStandaloneSecrets = new Map<
-  string,
-  {
-    resolve: (result: SecretPromptResult) => void;
-    timer: ReturnType<typeof setTimeout>;
-  }
->();
-
 /**
  * A single tool call rendered into a history row. Alias of the canonical
  * wire-contract type so `renderHistoryContent` (the producer) cannot drift
@@ -704,9 +696,15 @@ export function renderHistoryContent(
 }
 
 /**
- * Send a `secret_request` to the client and wait for the response,
- * outside of a conversation context (e.g. from IPC routes like
- * credentials/prompt).
+ * Send a `secret_request` to the client and wait for the response, outside of a
+ * conversation context (e.g. from IPC routes like credentials/prompt).
+ *
+ * Lifecycle state (resolver, timer) is registered in pendingInteractions — the
+ * same tracker the in-conversation SecretPrompter uses — so `POST /v1/secret`
+ * resolves the prompt generically. When a `conversationId` is supplied (the CLI
+ * `credentials prompt` command forwards `__CONVERSATION_ID`), the broadcast is
+ * scoped to that conversation so clients deliver it; otherwise it is
+ * conversation-less.
  */
 export function requestSecretStandalone(params: {
   service: string;
@@ -717,15 +715,21 @@ export function requestSecretStandalone(params: {
   purpose?: string;
   allowedTools?: string[];
   allowedDomains?: string[];
+  conversationId?: string;
 }): Promise<SecretPromptResult> {
   const requestId = uuid();
   const config = getConfig();
   return new Promise((resolve) => {
     const timer = setTimeout(() => {
-      pendingStandaloneSecrets.delete(requestId);
+      pendingInteractions.resolve(requestId, "cancelled");
       resolve({ value: null, delivery: "store" });
     }, config.timeouts.permissionTimeoutSec * 1000);
-    pendingStandaloneSecrets.set(requestId, { resolve, timer });
+    pendingInteractions.register(requestId, {
+      conversationId: params.conversationId,
+      kind: "secret",
+      rpcResolve: resolve as (value: unknown) => void,
+      timer,
+    });
     broadcastMessage({
       type: "secret_request",
       requestId,
@@ -734,6 +738,7 @@ export function requestSecretStandalone(params: {
       label: params.label,
       description: params.description,
       placeholder: params.placeholder,
+      conversationId: params.conversationId,
       purpose: params.purpose,
       allowedTools: params.allowedTools,
       allowedDomains: params.allowedDomains,

package/src/daemon/host-cu-proxy.ts

@@ -473,19 +473,22 @@ export class HostCuProxy {
     for (const requestId of this._ownedRequests) {
       const entry = pendingInteractions.resolve(requestId, "cancelled");
       if (!entry) continue;
+      const { conversationId } = entry;
       try {
-        broadcastMessage(
-          {
-            type: "host_cu_cancel",
-            requestId,
-            conversationId: entry.conversationId,
-            ...(entry.targetClientId != null
-              ? { targetClientId: entry.targetClientId }
-              : {}),
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId as string | undefined },
-        );
+        if (conversationId !== undefined) {
+          broadcastMessage(
+            {
+              type: "host_cu_cancel",
+              requestId,
+              conversationId,
+              ...(entry.targetClientId != null
+                ? { targetClientId: entry.targetClientId }
+                : {}),
+            },
+            conversationId,
+            { targetClientId: entry.targetClientId as string | undefined },
+          );
+        }
       } catch {
         // Best-effort cancel notification
       }

package/src/daemon/host-file-proxy.ts

@@ -277,19 +277,22 @@ export class HostFileProxy {
   dispose(): void {
     for (const entry of pendingInteractions.getByKind("host_file")) {
       pendingInteractions.resolve(entry.requestId, "cancelled");
+      const { conversationId } = entry;
       try {
-        broadcastMessage(
-          {
-            type: "host_file_cancel",
-            requestId: entry.requestId,
-            conversationId: entry.conversationId,
-            ...(entry.targetClientId != null
-              ? { targetClientId: entry.targetClientId }
-              : {}),
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId as string | undefined },
-        );
+        if (conversationId !== undefined) {
+          broadcastMessage(
+            {
+              type: "host_file_cancel",
+              requestId: entry.requestId,
+              conversationId,
+              ...(entry.targetClientId != null
+                ? { targetClientId: entry.targetClientId }
+                : {}),
+            },
+            conversationId,
+            { targetClientId: entry.targetClientId as string | undefined },
+          );
+        }
       } catch {
         // Best-effort cancel notification
       }

package/src/daemon/host-transfer-proxy.ts

@@ -663,19 +663,22 @@ export class HostTransferProxy {
     const transferId = interaction.metadata?.transferId as string | undefined;
     if (transferId) this.transfers.delete(transferId);
     pendingInteractions.resolve(requestId, "cancelled");
+    const { conversationId } = interaction;
     try {
-      broadcastMessage(
-        {
-          type: "host_transfer_cancel",
-          requestId,
-          conversationId: interaction.conversationId,
-          ...(interaction.targetClientId != null
-            ? { targetClientId: interaction.targetClientId }
-            : {}),
-        },
-        interaction.conversationId,
-        { targetClientId: interaction.targetClientId },
-      );
+      if (conversationId !== undefined) {
+        broadcastMessage(
+          {
+            type: "host_transfer_cancel",
+            requestId,
+            conversationId,
+            ...(interaction.targetClientId != null
+              ? { targetClientId: interaction.targetClientId }
+              : {}),
+          },
+          conversationId,
+          { targetClientId: interaction.targetClientId },
+        );
+      }
     } catch {
       // Best-effort cancel notification
     }
@@ -719,19 +722,22 @@ export class HostTransferProxy {
       const transferId = entry.metadata?.transferId as string | undefined;
       if (transferId) this.transfers.delete(transferId);
       pendingInteractions.resolve(entry.requestId, "cancelled");
+      const { conversationId } = entry;
       try {
-        broadcastMessage(
-          {
-            type: "host_transfer_cancel",
-            requestId: entry.requestId,
-            conversationId: entry.conversationId,
-            ...(entry.targetClientId != null
-              ? { targetClientId: entry.targetClientId }
-              : {}),
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId },
-        );
+        if (conversationId !== undefined) {
+          broadcastMessage(
+            {
+              type: "host_transfer_cancel",
+              requestId: entry.requestId,
+              conversationId,
+              ...(entry.targetClientId != null
+                ? { targetClientId: entry.targetClientId }
+                : {}),
+            },
+            conversationId,
+            { targetClientId: entry.targetClientId },
+          );
+        }
       } catch {
         // Best-effort cancel notification
       }

package/src/daemon/message-types/messages.ts

@@ -2,6 +2,7 @@
 
 import type { AssistantActivityStateEvent } from "../../api/events/assistant-activity-state.js";
 import type { AssistantTextDeltaEvent } from "../../api/events/assistant-text-delta.js";
+import type { AssistantThinkingDeltaEvent } from "../../api/events/assistant-thinking-delta.js";
 import type { AssistantTurnStartEvent } from "../../api/events/assistant-turn-start.js";
 import type { ConfirmationRequestEvent } from "../../api/events/confirmation-request.js";
 import type { ErrorEvent } from "../../api/events/error.js";
@@ -76,15 +77,6 @@ export interface SuggestionRequest {
 
 // === Server → Client ===
 
-export interface AssistantThinkingDelta {
-  type: "assistant_thinking_delta";
-  thinking: string;
-  conversationId?: string;
-  /** Database ID of the assistant message this thinking delta belongs to.
-   *  Same semantics as `AssistantTextDeltaEvent.messageId`. */
-  messageId?: string;
-}
-
 export interface ToolInputDelta {
   type: "tool_input_delta";
   toolName: string;
@@ -160,7 +152,7 @@ export type _MessagesServerMessages =
   | UserMessageEchoEvent
   | AssistantTurnStartEvent
   | AssistantTextDeltaEvent
-  | AssistantThinkingDelta
+  | AssistantThinkingDeltaEvent
   | ToolUseStartEvent
   | ToolUsePreviewStartEvent
   | ToolOutputChunkEvent

package/src/runtime/pending-interactions.ts

@@ -51,7 +51,12 @@ export interface ConfirmationDetails {
 }
 
 export interface PendingInteraction {
-  conversationId: string;
+  /**
+   * Owning conversation, when the interaction was raised inside one. Absent
+   * for interactions raised outside any conversation (e.g. the CLI
+   * `credentials prompt` command), which resolve via {@link rpcResolve}.
+   */
+  conversationId?: string;
   kind:
     | "confirmation"
     | "secret"
@@ -140,6 +145,10 @@ function emitResolved(
     },
     "Pending interaction resolved",
   );
+  // interaction_resolved is conversation-scoped on the wire; a conversation-less
+  // interaction has no conversation for clients to route the event to, so skip
+  // the broadcast.
+  if (interaction.conversationId === undefined) return;
   broadcastMessage({
     type: "interaction_resolved",
     requestId,
@@ -204,6 +213,16 @@ export function removeByConversation(
     ) {
       // resolve() clears the stored timer and detaches abort listeners.
       resolve(requestId, state);
+      // Secret prompts have no abort-signal teardown (unlike questions) and
+      // are not pre-settled by denyAllPendingConfirmations (unlike
+      // confirmations), so removing the entry alone would leave the caller's
+      // Promise — the CLI `credentials prompt` command or the in-conversation
+      // SecretPrompter — hanging until its IPC client times out. Settle it
+      // with a cancelled result, matching the prompt timeout path. rpcResolve
+      // is idempotent, so any later resolveSecret/dispose call is a no-op.
+      if (interaction.kind === "secret") {
+        interaction.rpcResolve?.({ value: null, delivery: "store" });
+      }
     }
   }
 }

package/src/runtime/routes/approval-routes.ts

@@ -11,6 +11,10 @@ import { z } from "zod";
 
 import { findConversation } from "../../daemon/conversation-registry.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
+import type {
+  SecretDelivery,
+  SecretPromptResult,
+} from "../../permissions/secret-prompter.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
@@ -127,24 +131,47 @@ function handleSecret({ body }: RouteHandlerArgs) {
     throw new BadRequestError('delivery must be "store" or "transient_send"');
   }
 
-  // Use get() — SecretPrompter.resolveSecret() owns deregistration.
   const interaction = pendingInteractions.get(requestId);
   if (!interaction) {
     throw new NotFoundError("No pending interaction found for this requestId");
   }
 
-  const conversation = findConversation(interaction.conversationId);
-  if (!conversation) {
+  // /v1/secret only settles secret prompts. A requestId belonging to another
+  // interaction kind (a confirmation or host-proxy request posted here from
+  // stale or mismatched client state) must not be consumed or resolved with a
+  // SecretPromptResult, which would strand its real approval/result endpoint.
+  if (interaction.kind !== "secret") {
     throw new NotFoundError(
-      "Conversation not found for this pending secret request",
+      "No pending secret request found for this requestId",
     );
   }
 
-  conversation.handleSecretResponse(
+  // When a live conversation owns the request, route through it so the
+  // SecretPrompter's ownership tracking and dispose path stay consistent (this
+  // also drives the voice auto-resolve path). The prompter owns deregistration.
+  const conversation = interaction.conversationId
+    ? findConversation(interaction.conversationId)
+    : undefined;
+  if (conversation?.hasPendingSecret(requestId)) {
+    conversation.handleSecretResponse(
+      requestId,
+      value,
+      delivery as "store" | "transient_send" | undefined,
+    );
+    return { accepted: true };
+  }
+
+  // Conversation-less requests (e.g. the CLI `credentials prompt` command) and
+  // any request no live conversation owns resolve generically via the resolver
+  // stored on the interaction, with no Conversation in the loop.
+  const resolved = pendingInteractions.resolve(
     requestId,
-    value,
-    delivery as "store" | "transient_send" | undefined,
+    value === undefined ? "cancelled" : "answered",
   );
+  (resolved?.rpcResolve as ((r: SecretPromptResult) => void) | undefined)?.({
+    value: value ?? null,
+    delivery: (delivery as SecretDelivery) ?? "store",
+  });
   return { accepted: true };
 }
 
@@ -321,7 +348,7 @@ export const ROUTES: RouteDefinition[] = [
         .array(
           z.object({
             requestId: z.string(),
-            conversationId: z.string(),
+            conversationId: z.string().optional(),
             kind: z.string(),
             toolName: z.string().optional(),
             riskLevel: z.string().optional(),

package/src/runtime/routes/credential-prompt-routes.ts

@@ -40,6 +40,7 @@ const CredentialPromptParams = z.object({
   allowedDomains: z.array(z.string()).optional(),
   allowedTools: z.array(z.string()).optional(),
   injectionTemplates: z.array(InjectionTemplateSchema).optional(),
+  conversationId: z.string().optional(),
 });
 
 // ---------------------------------------------------------------------------
@@ -70,6 +71,7 @@ async function handleCredentialPrompt({ body = {} }: RouteHandlerArgs) {
     placeholder: validated.placeholder,
     allowedTools: validated.allowedTools,
     allowedDomains: validated.allowedDomains,
+    conversationId: validated.conversationId,
   });
 
   if (!result.value) {