@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/daemon/conversation-tool-setup.ts

@@ -26,6 +26,7 @@ import {
   ACTIVITY_SKIP_SET,
   injectActivityField,
 } from "../tools/schema-transforms.js";
+import { resolveSkillExecuteInput } from "../tools/skills/execute.js";
 import { resolveToolInvocationAlias } from "../tools/tool-name-aliases.js";
 import {
   isDiskPressureCleanupToolName,
@@ -61,8 +62,16 @@ import {
   buildSwitchInferenceProfileToolDef,
   SWITCH_INFERENCE_PROFILE_TOOL_NAME,
 } from "./switch-inference-profile-tool.js";
-import type { ToolSetupContext } from "./tool-setup-types.js";
-export type { ToolSetupContext } from "./tool-setup-types.js";
+import type {
+  SubagentToolGateMode,
+  ToolSetupContext,
+  WakeToolContextPin,
+} from "./tool-setup-types.js";
+export type {
+  SubagentToolGateMode,
+  ToolSetupContext,
+  WakeToolContextPin,
+} from "./tool-setup-types.js";
 
 // ── resolveConversationAttribution ───────────────────────────────────
 
@@ -128,6 +137,23 @@ export function createToolExecutor(
     ctx.sendToClient(msg),
   );
 
+  // Execution-layer allowlist gate (`subagentToolGateMode === "execution"`,
+  // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
+  // any executor dispatch, so a non-allowlisted tool's executor never runs.
+  // The error tool_result lets the model continue or finish.
+  const rejectNonAllowlistedTool = (
+    toolName: string,
+  ): ToolExecutionResult | null => {
+    if (ctx.subagentToolGateMode !== "execution") return null;
+    const allowlist = ctx.subagentAllowedTools;
+    if (!allowlist || allowlist.has(toolName)) return null;
+    const allowed = [...allowlist].sort().join(", ");
+    return {
+      content: `This background pass may only use: ${allowed}.`,
+      isError: true,
+    };
+  };
+
   return async (
     name: string,
     input: Record<string, unknown>,
@@ -137,6 +163,17 @@ export function createToolExecutor(
     const { name: executionName, input: executionInput } =
       resolveToolInvocationAlias(name, input, ctx.allowedToolNames);
 
+    // The execution-layer gate must run FIRST — before any interception or
+    // pre-execution side effect (switch_inference_profile profile switching,
+    // DoorDash step marking) — so a non-allowlisted tool can neither run nor
+    // mutate conversation state. `skill_execute` is dispatch indirection: it
+    // is gated on its resolved inner tool name inside the interception below,
+    // mirroring how wire mode gates the underlying tool, not the wrapper.
+    if (executionName !== "skill_execute") {
+      const rejection = rejectNonAllowlistedTool(executionName);
+      if (rejection) return rejection;
+    }
+
     if (isDoordashCommand(executionName, executionInput)) {
       markDoordashStepInProgress(ctx, executionInput);
     }
@@ -260,10 +297,7 @@ export function createToolExecutor(
     if (executionName === "skill_execute") {
       const rawToolName =
         typeof executionInput.tool === "string" ? executionInput.tool : "";
-      const rawToolInput =
-        executionInput.input != null && typeof executionInput.input === "object"
-          ? (executionInput.input as Record<string, unknown>)
-          : {};
+      const rawToolInput = resolveSkillExecuteInput(executionInput);
 
       // Clone to avoid mutating shared input objects
       const { name: toolName, input: toolInput } = resolveToolInvocationAlias(
@@ -280,6 +314,12 @@ export function createToolExecutor(
         };
       }
 
+      // Gate the resolved inner tool, not the skill_execute wrapper — the
+      // wrapper is dispatch indirection, mirroring how wire mode gates the
+      // underlying tool via the executor's allowedToolNames check.
+      const innerRejection = rejectNonAllowlistedTool(toolName);
+      if (innerRejection) return innerRejection;
+
       const result = await executor.execute(toolName, toolInput, toolContext);
       if (toolContext.approvedViaPrompt) {
         ctx.approvedViaPromptThisTurn = true;
@@ -361,6 +401,18 @@ export interface SkillProjectionContext {
   readonly hasNoClient?: boolean;
   /** When set, only tools in this set are included in the resolved tool list (subagent delegation). */
   subagentAllowedTools?: Set<string>;
+  /**
+   * How {@link subagentAllowedTools} is enforced — see
+   * {@link SubagentToolGateMode}. Absent means `"wire"`.
+   */
+  subagentToolGateMode?: SubagentToolGateMode;
+  /**
+   * When set (execution-gate-mode wakes), tool-definition resolution reads
+   * `hasNoClient` / `transportInterface` / `channelCapabilities` exclusively
+   * from this pin instead of the live conversation — see
+   * {@link WakeToolContextPin}.
+   */
+  readonly toolContextPin?: WakeToolContextPin;
   /** True when the current turn is restricted to disk-pressure cleanup-safe tools. */
   diskPressureCleanupModeActive?: boolean;
   /** True when this conversation belongs to a subagent spawned by SubagentManager. */
@@ -479,10 +531,29 @@ export function isToolActiveForContext(
   name: string,
   ctx: SkillProjectionContext,
 ): boolean {
+  // Execution-gate-mode wakes pin the client-context inputs so the wire tool
+  // surface matches the SOURCE conversation's live turns rather than the
+  // fork's clientless hydration (see {@link WakeToolContextPin}). When the
+  // pin is present it replaces all three values — channel capabilities pin
+  // to `undefined` (see the pin's doc for why unset IS parity), never
+  // falling through to live state.
+  const pin = ctx.toolContextPin;
+  const hasNoClient = pin ? pin.hasNoClient : ctx.hasNoClient;
+  const channelCapabilities = pin ? undefined : ctx.channelCapabilities;
+  const transportInterface = pin
+    ? pin.transportInterface
+    : ctx.transportInterface;
+
   // When the conversation is acting as a subagent, the parent orchestrator
   // restricts the tool list. A tool that isn't on the allowlist is not
   // available for this turn, so short-circuit before any capability checks.
-  if (ctx.subagentAllowedTools && !ctx.subagentAllowedTools.has(name)) {
+  // In execution gate mode the allowlist is enforced at execution time
+  // instead — the full tool surface stays visible on the wire.
+  if (
+    ctx.subagentAllowedTools &&
+    ctx.subagentToolGateMode !== "execution" &&
+    !ctx.subagentAllowedTools.has(name)
+  ) {
     return false;
   }
   // `createResolveToolsCallback` returns an empty tool list when tools are
@@ -507,16 +578,16 @@ export function isToolActiveForContext(
   }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
     if (
-      ctx.channelCapabilities?.channel === "slack" &&
+      channelCapabilities?.channel === "slack" &&
       SLACK_TASK_PROGRESS_UI_TOOL_NAMES.has(name)
     ) {
-      return !ctx.hasNoClient;
+      return !hasNoClient;
     }
-    return ctx.channelCapabilities?.supportsDynamicUi ?? !ctx.hasNoClient;
+    return channelCapabilities?.supportsDynamicUi ?? !hasNoClient;
   }
   if (HOST_TOOL_NAMES.has(name)) {
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
-    const transport = ctx.transportInterface;
+    const transport = transportInterface;
 
     // Per-capability check is authoritative for structural support: if the
     // transport cannot service this capability, the tool is filtered out.
@@ -535,7 +606,7 @@ export function isToolActiveForContext(
         capability &&
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
         transport !== "chrome-extension" &&
-        !ctx.hasNoClient &&
+        !hasNoClient &&
         assistantEventHub.listClientsByCapability(capability).length > 0
       ) {
         return true;
@@ -555,23 +626,20 @@ export function isToolActiveForContext(
     // For transports that surface approvals over SSE (macos, backwards-compat
     // fallback), deny when no client is present so the guardian auto-approve
     // path cannot execute host commands unattended.
-    return !ctx.hasNoClient;
+    return !hasNoClient;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
-    if (
-      name === "ask_question" &&
-      ctx.channelCapabilities?.clientOS === "macos"
-    ) {
+    if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {
       // macOS has no UI handler for question_request yet; hiding the tool
       // avoids a 5-minute prompter timeout when the LLM would otherwise call it.
       return false;
     }
-    return !ctx.hasNoClient;
+    return !hasNoClient;
   }
   if (PLATFORM_TOOL_NAMES.has(name)) {
     // Check the *client's* platform, not the daemon's process.platform.
     // In Docker the daemon runs on Linux but the connected client may be macOS.
-    return ctx.channelCapabilities?.clientOS === "macos" && !ctx.hasNoClient;
+    return channelCapabilities?.clientOS === "macos" && !hasNoClient;
   }
   if (SUBAGENT_ONLY_TOOL_NAMES.has(name)) {
     return ctx.isSubagent === true;
@@ -628,9 +696,16 @@ export function createResolveToolsCallback(
     );
 
     // When the conversation is acting as a subagent, restrict core tools to
-    // only those explicitly allowed by the parent orchestrator.
-    const scopedCoreDefs = ctx.subagentAllowedTools
-      ? filteredCoreDefs.filter((d) => ctx.subagentAllowedTools!.has(d.name))
+    // only those explicitly allowed by the parent orchestrator. In
+    // `"execution"` gate mode the allowlist is NOT applied to the wire
+    // definitions (see {@link SubagentToolGateMode}) — the executor callback
+    // rejects non-allowlisted calls at execution time instead.
+    const wireAllowlist =
+      ctx.subagentToolGateMode === "execution"
+        ? undefined
+        : ctx.subagentAllowedTools;
+    const scopedCoreDefs = wireAllowlist
+      ? filteredCoreDefs.filter((d) => wireAllowlist.has(d.name))
       : filteredCoreDefs;
 
     // Re-read MCP tool definitions from the registry each turn so conversations
@@ -644,8 +719,8 @@ export function createResolveToolsCallback(
       },
       "MCP tools resolved for turn",
     );
-    const scopedMcpDefs = ctx.subagentAllowedTools
-      ? currentMcpDefs.filter((d) => ctx.subagentAllowedTools!.has(d.name))
+    const scopedMcpDefs = wireAllowlist
+      ? currentMcpDefs.filter((d) => wireAllowlist.has(d.name))
       : currentMcpDefs;
     const excluded = new Set(getConfig().tools.exclude);
     const allBaseDefs = [...scopedCoreDefs, ...scopedMcpDefs].filter(
@@ -676,8 +751,10 @@ export function createResolveToolsCallback(
     });
     const turnAllowed = new Set(allBaseDefs.map((d) => d.name));
     for (const name of projection.allowedToolNames) {
-      // When a subagent allowlist is active, exclude skill tools not on it.
-      if (ctx.subagentAllowedTools && !ctx.subagentAllowedTools.has(name)) {
+      // When a wire-gated subagent allowlist is active, exclude skill tools
+      // not on it. (Execution gate mode keeps them available here and
+      // rejects non-allowlisted calls in the executor callback instead.)
+      if (wireAllowlist && !wireAllowlist.has(name)) {
         continue;
       }
       if (excluded.has(name)) continue;

package/src/daemon/conversation-usage.ts

@@ -214,6 +214,8 @@ export function recordUsage(
     conversationId: ctx.conversationId,
     inputTokens,
     outputTokens,
+    cacheCreationInputTokens: normalizedCacheCreationInputTokens,
+    cacheReadInputTokens: normalizedCacheReadInputTokens,
     totalInputTokens: ctx.usageStats.inputTokens,
     totalOutputTokens: ctx.usageStats.outputTokens,
     estimatedCost,

package/src/daemon/conversation.ts

@@ -76,6 +76,7 @@ import { filterPrunedCardSections } from "../plugins/defaults/memory-v3-shadow/p
 import {
   applyBootstrapTemplate,
   buildSystemPrompt,
+  type SystemPromptPersonaOverride,
 } from "../prompts/system-prompt.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
@@ -146,7 +147,11 @@ import {
   handleSurfaceUndo as handleSurfaceUndoImpl,
   type SurfaceActionResult,
 } from "./conversation-surfaces.js";
-import type { ToolSetupContext } from "./conversation-tool-setup.js";
+import type {
+  SubagentToolGateMode,
+  ToolSetupContext,
+  WakeToolContextPin,
+} from "./conversation-tool-setup.js";
 import {
   createResolveToolsCallback,
   createToolExecutor,
@@ -177,6 +182,26 @@ export interface CleanResult {
   preservedMessages: number;
 }
 
+/**
+ * Optional context-window sizing inputs for {@link Conversation.maybeCompact}.
+ *
+ * The auto-threshold gate sizes its window against `mainAgent` by default,
+ * but an agent wake can run under a different call site (and a forced
+ * override profile) that resolves a SMALLER effective window — sized against
+ * `mainAgent`, such a wake passes the gate un-compacted and then overflows at
+ * the provider. Wakes thread their already-resolved inputs here so the gate's
+ * threshold matches the window the wake's calls actually get. Sizing only:
+ * the compaction execution (summary call profile) is unchanged.
+ */
+export interface CompactionSizing {
+  /** Call site the upcoming run resolves its context window against. */
+  callSite: LLMCallSite;
+  /** Inference profile the run resolves under, if any. */
+  overrideProfile?: string;
+  /** Float `overrideProfile` above the call-site layers (resolver escape hatch). */
+  forceOverrideProfile?: boolean;
+}
+
 export { findLastUndoableUserMessageIndex } from "./conversation-history.js";
 export type {
   QueueDrainReason,
@@ -220,6 +245,21 @@ export class Conversation {
   /** @internal */ toolsDisabledDepth = 0;
   /** @internal */ preactivatedSkillIds?: string[];
   /** @internal */ subagentAllowedTools?: Set<string>;
+  /**
+   * How {@link subagentAllowedTools} is enforced — see
+   * {@link SubagentToolGateMode}. Set and restored alongside the allowlist
+   * by `scopeWakeAllowedTools`.
+   * @internal
+   */
+  subagentToolGateMode?: SubagentToolGateMode;
+  /**
+   * Client-context pin for execution-gate-mode wakes — see
+   * {@link WakeToolContextPin}. Set and restored alongside the allowlist by
+   * `scopeWakeAllowedTools`; read only by tool-DEFINITION resolution
+   * (`isToolActiveForContext`), never by executor or host-proxy paths.
+   * @internal
+   */
+  toolContextPin?: WakeToolContextPin;
   /** @internal */ coreToolNames: Set<string>;
   /** @internal */ readonly skillProjectionState = new Map<string, string>();
   /** @internal */ readonly skillProjectionCache: SkillProjectionCache = {};
@@ -295,6 +335,18 @@ export class Conversation {
    */
   currentTurnInboundActorContext?: InboundActorContext | null;
   /** @internal */ currentTurnChannelCapabilities?: ChannelCapabilities;
+  /**
+   * Explicit persona/channel slugs for the system-prompt build, set (and
+   * cleared) by `wakeAgentForOpportunity` around a wake's agent-loop run.
+   * Wakes bypass the orchestrator's turn-start snapshots above, so without
+   * this their prompt is built from whatever snapshot the conversation
+   * already holds (for a freshly hydrated conversation: the no-trust-context
+   * persona derivation) regardless of which actor/channel the conversation
+   * belongs to. Takes precedence over the trust-context derivation when set.
+   * Persona selection only — never read for trust/approval decisions.
+   * @internal
+   */
+  wakePersonaOverride?: SystemPromptPersonaOverride;
   /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ toolRoutedProfile?: string;
   /** @internal */ authContext?: AuthContext;
@@ -594,6 +646,7 @@ export class Conversation {
               hasNoClient: this.hasNoClient,
               trustContext: this.currentTurnTrustContext,
               channelCapabilities: this.currentTurnChannelCapabilities,
+              personaOverride: this.wakePersonaOverride,
               onboardingContext: this.getOnboardingContext(),
               conversationId: this.conversationId,
             }),
@@ -729,6 +782,7 @@ export class Conversation {
           hasNoClient: this.hasNoClient,
           trustContext: this.currentTurnTrustContext,
           channelCapabilities: this.currentTurnChannelCapabilities,
+          personaOverride: this.wakePersonaOverride,
           onboardingContext: this.getOnboardingContext(),
           conversationId: this.conversationId,
         });
@@ -1503,17 +1557,65 @@ export class Conversation {
   }
 
   async forceCompact(): Promise<ContextWindowResult> {
+    return this.runCompaction(true);
+  }
+
+  /**
+   * Auto-threshold compaction gate. Runs the same durable compaction
+   * pipeline as {@link forceCompact} (summary call, circuit-breaker
+   * accounting, Slack provenance, in-memory + DB commit) but honors the
+   * `compaction.autoThreshold` check — an under-threshold history is a
+   * cheap no-op — and the compaction circuit breaker, returning `null`
+   * without estimating anything while the breaker is open. Used by the
+   * agent-wake path (`runtime/agent-wake.ts`), which bypasses the daemon
+   * orchestrator's in-loop budget gate and needs an equivalent turn-start
+   * compaction before snapshotting its run input.
+   *
+   * `sizing` lets a wake thread its own call-site/profile resolution into
+   * the gate's context-window sizing — see {@link CompactionSizing}. Absent,
+   * the gate sizes against `mainAgent` (the live-turn behavior).
+   */
+  async maybeCompact(
+    sizing?: CompactionSizing,
+  ): Promise<ContextWindowResult | null> {
+    if (await this.agentLoop.compactionCircuit.isOpen()) {
+      return null;
+    }
+    return this.runCompaction(false, sizing);
+  }
+
+  /**
+   * Shared compaction pipeline behind {@link forceCompact} and
+   * {@link maybeCompact}. `force` skips the auto-threshold check inside the
+   * context-window manager (user-initiated `/compact`); without it the
+   * manager no-ops below the threshold.
+   */
+  private async runCompaction(
+    force: boolean,
+    sizing?: CompactionSizing,
+  ): Promise<ContextWindowResult> {
     const overrideProfile = resolveOverrideProfile(this) ?? null;
     const config = getConfig();
+    // Threshold/window sizing. The default (`mainAgent` + the conversation's
+    // own pinned profile) matches live turns; caller-supplied `sizing` makes
+    // the gate's threshold reflect the window the caller's run will actually
+    // resolve. Sizing only — the summary call below still runs under the
+    // conversation's own profile.
+    const sizingCallSite = sizing?.callSite ?? "mainAgent";
+    const sizingOverrideProfile = sizing
+      ? sizing.overrideProfile
+      : (overrideProfile ?? undefined);
     const effectiveContextWindow = resolveEffectiveContextWindow({
       llm: config.llm,
-      callSite: "mainAgent",
-      overrideProfile: overrideProfile ?? undefined,
+      callSite: sizingCallSite,
+      overrideProfile: sizingOverrideProfile,
+      forceOverrideProfile: sizing?.forceOverrideProfile,
     });
     this.contextWindowManager.updateConfig(
       contextWindowConfigFromEffective(
-        resolveCallSiteConfig("mainAgent", config.llm, {
-          overrideProfile: overrideProfile ?? undefined,
+        resolveCallSiteConfig(sizingCallSite, config.llm, {
+          overrideProfile: sizingOverrideProfile,
+          forceOverrideProfile: sizing?.forceOverrideProfile,
         }).contextWindow,
         effectiveContextWindow,
       ),
@@ -1538,15 +1640,17 @@ export class Conversation {
       conversationId: this.conversationId,
       messages: messagesToCompact,
       signal: this.abortController?.signal ?? undefined,
-      force: true,
+      force,
       overrideProfile,
       actorTrustClass: this.trustContext?.trustClass,
     });
-    // Track circuit-breaker state for user-initiated `/compact` and other
-    // forced paths so a successful forced compaction clears a stuck counter
-    // and a run of forced failures still trips the breaker. `summaryFailed`
-    // is `undefined` on early-return paths (no eligible messages, disabled,
-    // etc.) — skip those so they don't silently reset the counter.
+    // Track circuit-breaker state for every compaction that ran a summary
+    // call — user-initiated `/compact`, other forced paths, and the wake's
+    // auto gate — so a success clears a stuck counter and a run of failures
+    // still trips the breaker. `summaryFailed` is `undefined` on
+    // early-return paths (no eligible messages, disabled, below the auto
+    // threshold, etc.) — skip those so they don't silently reset the
+    // counter.
     if (result.summaryFailed !== undefined) {
       await this.agentLoop.compactionCircuit.recordOutcome(
         result.summaryFailed,

package/src/daemon/handlers/shared.ts

@@ -13,6 +13,7 @@ import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
 import { isPlaceholderSentinelText } from "../../providers/placeholder-sentinels.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
+import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { unwrapExternalContentForDisplay } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
@@ -28,15 +29,6 @@ export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
 
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
-// Module-level map for non-conversation secret prompts (e.g. publish_page)
-const pendingStandaloneSecrets = new Map<
-  string,
-  {
-    resolve: (result: SecretPromptResult) => void;
-    timer: ReturnType<typeof setTimeout>;
-  }
->();
-
 /**
  * A single tool call rendered into a history row. Alias of the canonical
  * wire-contract type so `renderHistoryContent` (the producer) cannot drift
@@ -166,6 +158,13 @@ export interface ConversationCreateOptions {
    * `resolveCallSiteConfig` instead of the global default.
    */
   callSite?: LLMCallSite;
+  /**
+   * Optional ad-hoc inference-profile override (`llm.profiles` key) applied
+   * to every LLM call the turn issues. Background callers with a pinned
+   * profile (e.g. schedules) pass it here so the agent loop layers the
+   * profile via `SendMessageOptions.config.overrideProfile`.
+   */
+  overrideProfile?: string;
   /**
    * Slack inbound metadata captured at the channel ingress boundary. When
    * present (and the turn channel resolves to Slack), persistence writes a
@@ -697,9 +696,15 @@ export function renderHistoryContent(
 }
 
 /**
- * Send a `secret_request` to the client and wait for the response,
- * outside of a conversation context (e.g. from IPC routes like
- * credentials/prompt).
+ * Send a `secret_request` to the client and wait for the response, outside of a
+ * conversation context (e.g. from IPC routes like credentials/prompt).
+ *
+ * Lifecycle state (resolver, timer) is registered in pendingInteractions — the
+ * same tracker the in-conversation SecretPrompter uses — so `POST /v1/secret`
+ * resolves the prompt generically. When a `conversationId` is supplied (the CLI
+ * `credentials prompt` command forwards `__CONVERSATION_ID`), the broadcast is
+ * scoped to that conversation so clients deliver it; otherwise it is
+ * conversation-less.
  */
 export function requestSecretStandalone(params: {
   service: string;
@@ -710,15 +715,21 @@ export function requestSecretStandalone(params: {
   purpose?: string;
   allowedTools?: string[];
   allowedDomains?: string[];
+  conversationId?: string;
 }): Promise<SecretPromptResult> {
   const requestId = uuid();
   const config = getConfig();
   return new Promise((resolve) => {
     const timer = setTimeout(() => {
-      pendingStandaloneSecrets.delete(requestId);
+      pendingInteractions.resolve(requestId, "cancelled");
       resolve({ value: null, delivery: "store" });
     }, config.timeouts.permissionTimeoutSec * 1000);
-    pendingStandaloneSecrets.set(requestId, { resolve, timer });
+    pendingInteractions.register(requestId, {
+      conversationId: params.conversationId,
+      kind: "secret",
+      rpcResolve: resolve as (value: unknown) => void,
+      timer,
+    });
     broadcastMessage({
       type: "secret_request",
       requestId,
@@ -727,6 +738,7 @@ export function requestSecretStandalone(params: {
       label: params.label,
       description: params.description,
       placeholder: params.placeholder,
+      conversationId: params.conversationId,
       purpose: params.purpose,
       allowedTools: params.allowedTools,
       allowedDomains: params.allowedDomains,

package/src/daemon/host-cu-proxy.ts

@@ -473,19 +473,22 @@ export class HostCuProxy {
     for (const requestId of this._ownedRequests) {
       const entry = pendingInteractions.resolve(requestId, "cancelled");
       if (!entry) continue;
+      const { conversationId } = entry;
       try {
-        broadcastMessage(
-          {
-            type: "host_cu_cancel",
-            requestId,
-            conversationId: entry.conversationId,
-            ...(entry.targetClientId != null
-              ? { targetClientId: entry.targetClientId }
-              : {}),
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId as string | undefined },
-        );
+        if (conversationId !== undefined) {
+          broadcastMessage(
+            {
+              type: "host_cu_cancel",
+              requestId,
+              conversationId,
+              ...(entry.targetClientId != null
+                ? { targetClientId: entry.targetClientId }
+                : {}),
+            },
+            conversationId,
+            { targetClientId: entry.targetClientId as string | undefined },
+          );
+        }
       } catch {
         // Best-effort cancel notification
       }

package/src/daemon/host-file-proxy.ts

@@ -277,19 +277,22 @@ export class HostFileProxy {
   dispose(): void {
     for (const entry of pendingInteractions.getByKind("host_file")) {
       pendingInteractions.resolve(entry.requestId, "cancelled");
+      const { conversationId } = entry;
       try {
-        broadcastMessage(
-          {
-            type: "host_file_cancel",
-            requestId: entry.requestId,
-            conversationId: entry.conversationId,
-            ...(entry.targetClientId != null
-              ? { targetClientId: entry.targetClientId }
-              : {}),
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId as string | undefined },
-        );
+        if (conversationId !== undefined) {
+          broadcastMessage(
+            {
+              type: "host_file_cancel",
+              requestId: entry.requestId,
+              conversationId,
+              ...(entry.targetClientId != null
+                ? { targetClientId: entry.targetClientId }
+                : {}),
+            },
+            conversationId,
+            { targetClientId: entry.targetClientId as string | undefined },
+          );
+        }
       } catch {
         // Best-effort cancel notification
       }