@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/runtime/assistant-stream-state.ts

@@ -20,10 +20,16 @@
  * - Total size: 256 KB
  * - Age: 30 seconds
  *
- * The ring is in-memory and per-daemon-process. After a daemon restart
- * the seq resets and reconnecting clients fall through to the snapshot
- * path. The ring is sized generously enough that a typical refresh
- * round-trip (~1-3s) is well within window.
+ * The ring is in-memory and per-daemon-process, but the seq counter
+ * itself survives restarts: blocks of seq values are reserved ahead of
+ * use and the reserved ceiling is persisted to the workspace
+ * (`data/stream-seq.json`), so a restarted daemon resumes stamping
+ * above every seq the previous process could have emitted. Clients
+ * therefore never observe the counter moving backwards — a restart
+ * shows up as (at most) a bounded forward gap, which the normal
+ * gap-reconcile / snapshot-resync path already handles. The ring is
+ * sized generously enough that a typical refresh round-trip (~1-3s)
+ * is well within window.
  *
  * Persisted-seq map: alongside the live counter and ring, this module
  * tracks, per conversation, the `seq` of the last event whose content is
@@ -34,12 +40,17 @@
  * persistence flush (assistant rows persist incrementally, debounced, so
  * the snapshot can lag the live counter) -- never the live counter
  * itself, which would over-claim events that have streamed but not yet
- * been written. It shares the live counter's lifetime by design: both
- * are in-memory and reset together on restart, so a stored value can
- * never dangle against a fresh counter. The map is LRU-bounded; an
+ * been written. The map is in-memory and clears on restart; because the
+ * counter resumes above the persisted reservation, a value recorded by
+ * a previous process could only ever be lower than any seq the new
+ * process assigns -- never ambiguous against it. The map is LRU-bounded; an
  * evicted conversation reports no seq and the client cold-starts.
  */
 
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { getWorkspaceDir } from "../util/platform.js";
 import type { AssistantEvent } from "./assistant-event.js";
 
 // ── Tunables ─────────────────────────────────────────────────────────
@@ -58,6 +69,15 @@ const RING_AGE_LIMIT_MS = 30_000;
  */
 const PERSISTED_SEQ_CONVERSATION_LIMIT = 1024;
 
+/**
+ * How many seq values are reserved per persisted write. The counter can
+ * hand out seqs up to the persisted ceiling without touching disk, so
+ * the file is written once per block rather than once per event. A
+ * restart skips at most one block's worth of unused seqs — a bounded
+ * forward gap that clients already treat as a missed-events signal.
+ */
+const SEQ_RESERVATION_BLOCK = 1024;
+
 // ── Types ────────────────────────────────────────────────────────────
 
 /**
@@ -97,6 +117,21 @@ interface RingEntry {
 
 interface AssistantStreamState {
   nextSeq: number;
+  /**
+   * Highest seq this process may assign without persisting a new
+   * reservation. `0` until the first stamp loads (or creates) the
+   * persisted reservation.
+   */
+  reservedSeqCeiling: number;
+  /** Whether the persisted reservation has been loaded this process. */
+  seqReservationLoaded: boolean;
+  /**
+   * Seq of the first event stamped by this process, or `0` before any
+   * stamp. Distinguishes a reservation skip (seqs below this value were
+   * never assigned by this process, so nothing is missing from the
+   * ring) from genuine ring eviction when judging replay validity.
+   */
+  firstStampedSeq: number;
   ring: RingEntry[];
   totalSizeBytes: number;
   /**
@@ -112,6 +147,9 @@ interface AssistantStreamState {
 
 const state: AssistantStreamState = {
   nextSeq: 1,
+  reservedSeqCeiling: 0,
+  seqReservationLoaded: false,
+  firstStampedSeq: 0,
   ring: [],
   totalSizeBytes: 0,
   persistedSeqByConversation: new Map(),
@@ -138,7 +176,9 @@ export function stampAndBuffer(
 ): void {
   if (event.conversationId == null) return;
 
+  reserveSeqCapacity();
   event.seq = state.nextSeq++;
+  if (state.firstStampedSeq === 0) state.firstStampedSeq = event.seq;
 
   // Approximate size by serialized JSON length. This is the same
   // bytes-on-wire we'll send, so it tracks ring memory pressure
@@ -187,8 +227,16 @@ export function getReplayWindow(
 
   if (state.ring.length === 0) return [];
 
+  // A cursor from before this process started can skip over the
+  // reservation gap: seqs below `firstStampedSeq` were never assigned
+  // by this process, so as long as the ring still holds everything
+  // this process stamped, no replayable event is missing. (Events from
+  // the previous process are unrecoverable either way — clients catch
+  // up on those via the snapshot path, triggered by the seq jump.)
   const oldest = state.ring[0]?.seq ?? Infinity;
-  if (lastSeenSeq < oldest - 1) return null;
+  const coversRestartGap =
+    lastSeenSeq < state.firstStampedSeq && oldest === state.firstStampedSeq;
+  if (lastSeenSeq < oldest - 1 && !coversRestartGap) return null;
 
   return state.ring
     .filter(
@@ -260,6 +308,26 @@ export function getPersistedSeq(conversationId: string): number | null {
  */
 export function _resetStreamStateForTesting(): void {
   state.nextSeq = 1;
+  // Mark the reservation as loaded with no ceiling so the next stamp
+  // re-reserves from 1, ignoring any reservation file a previous test
+  // wrote into the (per-process temp) workspace.
+  state.reservedSeqCeiling = 0;
+  state.seqReservationLoaded = true;
+  state.firstStampedSeq = 0;
+  state.ring = [];
+  state.totalSizeBytes = 0;
+  state.persistedSeqByConversation.clear();
+}
+
+/**
+ * Simulate a daemon restart: clear all in-memory state and force the
+ * next stamp to reload the persisted seq reservation. Test-only.
+ */
+export function _simulateRestartForTesting(): void {
+  state.nextSeq = 1;
+  state.reservedSeqCeiling = 0;
+  state.seqReservationLoaded = false;
+  state.firstStampedSeq = 0;
   state.ring = [];
   state.totalSizeBytes = 0;
   state.persistedSeqByConversation.clear();
@@ -286,6 +354,71 @@ export function _peekStreamForTesting(): {
 
 // ── Internals ────────────────────────────────────────────────────────
 
+function seqReservationPath(): string {
+  return join(getWorkspaceDir(), "data", "stream-seq.json");
+}
+
+/**
+ * Ensure `state.nextSeq` is covered by the persisted reservation,
+ * loading the reservation file on the first stamp of the process and
+ * extending it by {@link SEQ_RESERVATION_BLOCK} whenever the counter
+ * reaches the ceiling.
+ *
+ * Persistence is best-effort: if the file cannot be read or written
+ * the counter falls back to in-memory-only behavior (the ceiling is
+ * still advanced so the write is retried at most once per block, not
+ * per event), matching the daemon's degraded-mode philosophy.
+ */
+function reserveSeqCapacity(): void {
+  if (!state.seqReservationLoaded) {
+    state.seqReservationLoaded = true;
+    state.reservedSeqCeiling = readReservedCeiling();
+    if (state.reservedSeqCeiling >= state.nextSeq) {
+      state.nextSeq = state.reservedSeqCeiling + 1;
+    }
+  }
+
+  if (state.nextSeq <= state.reservedSeqCeiling) return;
+
+  const ceiling = state.nextSeq + SEQ_RESERVATION_BLOCK - 1;
+  try {
+    const path = seqReservationPath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ reservedSeqCeiling: ceiling }));
+    renameSync(tmp, path);
+  } catch {
+    // Degraded mode: keep stamping from memory.
+  }
+  state.reservedSeqCeiling = ceiling;
+}
+
+function readReservedCeiling(): number {
+  try {
+    const parsed: unknown = JSON.parse(
+      readFileSync(seqReservationPath(), "utf8"),
+    );
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      "reservedSeqCeiling" in parsed
+    ) {
+      const ceiling = (parsed as { reservedSeqCeiling: unknown })
+        .reservedSeqCeiling;
+      if (
+        typeof ceiling === "number" &&
+        Number.isFinite(ceiling) &&
+        ceiling > 0
+      ) {
+        return Math.floor(ceiling);
+      }
+    }
+  } catch {
+    // Missing or unreadable file: cold start from seq 1.
+  }
+  return 0;
+}
+
 /**
  * Mirrors the delivery logic in `AssistantEventHub.publish()`. Returns
  * `true` when `subscriber` would have received the entry during live

package/src/runtime/background-job-runner.ts

@@ -67,6 +67,12 @@ export interface RunBackgroundJobOptions {
   trustContext: TrustContext;
   /** LLM call-site identifier — drives provider/model/effort/etc. resolution. */
   callSite: LLMCallSite;
+  /**
+   * Optional ad-hoc inference-profile override (`llm.profiles` key) applied
+   * to every LLM call the job's turn issues. Used by schedules with a pinned
+   * profile; omitted = the call site's default resolution.
+   */
+  overrideProfile?: string;
   /** Hard timeout for `processMessage` in milliseconds. */
   timeoutMs: number;
   /**
@@ -267,6 +273,9 @@ export async function runBackgroundJob(
     const work = processMessage(conversation.id, opts.prompt, {
       trustContext: opts.trustContext,
       callSite: opts.callSite,
+      ...(opts.overrideProfile
+        ? { overrideProfile: opts.overrideProfile }
+        : {}),
     });
     // Absorb late rejections: if the timeout wins the race, `work` keeps
     // running and may eventually reject — swallow so it doesn't surface as

package/src/runtime/channel-approval-types.ts

@@ -92,6 +92,7 @@ export type ApprovalDecisionSource =
   | "whatsapp_button"
   | "slack_button"
   | "slack_reaction"
+  | "vellum_surface"
   | "plain_text";
 
 /** The structured result of a user's approval decision. */

package/src/runtime/channel-invite-transports/telegram.ts

@@ -9,6 +9,8 @@
  * verification) tokens that use the same `/start` deep-link mechanism.
  */
 
+import type { CommandIntent, SourceMetadata } from "@vellumai/gateway-client";
+
 import type { ChannelId } from "../../channels/types.js";
 import {
   invalidateConfigCache,
@@ -130,17 +132,16 @@ export const telegramInviteAdapter: ChannelInviteAdapter = {
   },
 
   extractInboundToken(params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: SourceMetadata;
   }): string | undefined {
     // Primary path: structured command intent from the gateway.
     // The gateway normalizes `/start <payload>` into
     // `{ type: 'start', payload: '<payload>' }`.
     if (
-      params.commandIntent &&
-      params.commandIntent.type === "start" &&
-      typeof params.commandIntent.payload === "string"
+      params.commandIntent?.type === "start" &&
+      params.commandIntent.payload
     ) {
       const payload = params.commandIntent.payload;
       if (payload.startsWith(INVITE_TOKEN_PREFIX)) {

package/src/runtime/channel-invite-transports/voice.ts

@@ -40,9 +40,9 @@ export const voiceInviteAdapter: ChannelInviteAdapter = {
   },
 
   extractInboundToken(_params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: import("@vellumai/gateway-client").CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: import("@vellumai/gateway-client").SourceMetadata;
   }): string | undefined {
     // Voice invite redemption bypasses generic token extraction — it uses
     // the identity-bound voice-code flow in invite-redemption-service.ts.

package/src/runtime/channel-invite-types.ts

@@ -3,6 +3,8 @@
  * transport ↔ channel-invite-transports/* cycles (×5).
  */
 
+import type { CommandIntent, SourceMetadata } from "@vellumai/gateway-client";
+
 import type { ChannelId } from "../channels/types.js";
 
 export interface InviteShareLink {
@@ -31,9 +33,9 @@ export interface ChannelInviteAdapter {
    * channels with link-based invites.
    */
   extractInboundToken?(params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: SourceMetadata;
   }): string | undefined;
 
   /**

package/src/runtime/channel-retry-sweep.ts

@@ -35,6 +35,7 @@ import {
   deliverReplyViaCallback,
   findAssistantReplyMessageIdForTurn,
 } from "./channel-reply-delivery.js";
+import { finalizeEventDelivery } from "./finalize-event-delivery.js";
 import { deliverChannelReply } from "./gateway-client.js";
 import type { MessageProcessor } from "./http-types.js";
 import { createSlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
@@ -154,7 +155,7 @@ export async function sweepFailedEvents(
       parseInterfaceId(payload.sourceChannel) ??
       "web";
     const sourceMetadata = payload.sourceMetadata as
-      | Record<string, unknown>
+      | import("@vellumai/gateway-client").SourceMetadata
       | undefined;
     const assistantId =
       typeof payload.assistantId === "string" ? payload.assistantId : undefined;
@@ -334,46 +335,23 @@ export async function sweepFailedEvents(
       continue;
     }
 
-    if (replyCallbackUrl) {
-      if (externalChatId) {
-        try {
-          if (slackDmTextDelivery) {
-            await slackDmTextDelivery.waitForPendingDeliveries();
-          }
-          // processMessage above generated a fresh assistant response, so any
-          // previously tracked final-delivery progress belongs to the old
-          // response and must not carry over. Use live Slack DM progress as
-          // the new baseline before final delivery so delivery-only retries do
-          // not duplicate text if the callback fails before reporting progress.
-          const liveDeliveryResumeOptions =
-            slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
-          const finalDeliveryStartFromSegment =
-            liveDeliveryResumeOptions?.startFromSegment ?? 0;
-          updateDeliveredSegmentCount(event.id, finalDeliveryStartFromSegment);
-          await deliverReplyViaCallback(
-            event.conversationId,
-            externalChatId,
-            replyCallbackUrl,
-            assistantId,
-            {
-              messageId: replyMessageId,
-              sinceMessageId: userMessageId,
-              startFromSegment: finalDeliveryStartFromSegment,
-              ...(liveDeliveryResumeOptions?.messageTs
-                ? { messageTs: liveDeliveryResumeOptions.messageTs }
-                : {}),
-              onSegmentDelivered: (count) =>
-                updateDeliveredSegmentCount(event.id, count),
-            },
-          );
-          markDeliveryDelivered(event.id);
-        } catch (err) {
-          log.error(
-            { err, eventId: event.id },
-            "Retry delivery failed for channel event",
-          );
-          recordDeliveryFailure(event.id, err);
-        }
+    if (replyCallbackUrl && externalChatId) {
+      try {
+        await finalizeEventDelivery({
+          eventId: event.id,
+          conversationId: event.conversationId,
+          externalChatId,
+          replyCallbackUrl,
+          assistantId,
+          replyMessageId,
+          userMessageId,
+          slackDmTextDelivery,
+        });
+      } catch (err) {
+        log.error(
+          { err, eventId: event.id },
+          "Retry delivery failed for channel event",
+        );
       }
     }
   }

package/src/runtime/finalize-event-delivery.ts

@@ -0,0 +1,72 @@
+import { updateDeliveredSegmentCount } from "../memory/delivery-channels.js";
+import {
+  markDeliveryDelivered,
+  recordDeliveryFailure,
+} from "../memory/delivery-status.js";
+import { deliverReplyViaCallback } from "./channel-reply-delivery.js";
+import type { SlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
+
+/**
+ * Owns the complete delivery-after-processing sequence for a channel
+ * inbound event: waits for in-flight live Slack DM deliveries to settle,
+ * persists the segment baseline so delivery-only retries resume correctly,
+ * delivers remaining content + attachments, and transitions the event to
+ * its terminal delivery state.
+ *
+ * Both the primary dispatch path and the processing-retry path call this
+ * function. The delivery-only retry path does NOT use this function — it
+ * reads the already-persisted segment count and calls
+ * `deliverReplyViaCallback` directly.
+ */
+export async function finalizeEventDelivery(params: {
+  eventId: string;
+  conversationId: string;
+  externalChatId: string;
+  replyCallbackUrl: string;
+  assistantId: string | undefined;
+  replyMessageId: string | undefined;
+  userMessageId: string | undefined;
+  slackDmTextDelivery: SlackDmTextDeliveryController | undefined;
+}): Promise<void> {
+  const {
+    eventId,
+    conversationId,
+    externalChatId,
+    replyCallbackUrl,
+    assistantId,
+    replyMessageId,
+    userMessageId,
+    slackDmTextDelivery,
+  } = params;
+
+  if (slackDmTextDelivery) {
+    await slackDmTextDelivery.waitForPendingDeliveries();
+  }
+
+  const resumeOptions =
+    slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
+  const startFromSegment = resumeOptions?.startFromSegment ?? 0;
+  try {
+    updateDeliveredSegmentCount(eventId, startFromSegment);
+    await deliverReplyViaCallback(
+      conversationId,
+      externalChatId,
+      replyCallbackUrl,
+      assistantId,
+      {
+        messageId: replyMessageId,
+        sinceMessageId: userMessageId,
+        startFromSegment,
+        ...(resumeOptions?.messageTs
+          ? { messageTs: resumeOptions.messageTs }
+          : {}),
+        onSegmentDelivered: (count) =>
+          updateDeliveredSegmentCount(eventId, count),
+      },
+    );
+    markDeliveryDelivered(eventId);
+  } catch (err) {
+    recordDeliveryFailure(eventId, err);
+    throw err;
+  }
+}

package/src/runtime/guardian-action-message-composer.ts

@@ -8,10 +8,8 @@
  *
  * Follows the same pattern as approval-message-composer.ts.
  */
-import { getLogger } from "../util/logger.js";
 import type {
   ComposeGuardianActionMessageOptions,
-  GuardianActionCopyGenerator,
   GuardianActionMessageContext,
 } from "./message-composer-types.js";
 
@@ -21,21 +19,6 @@ export type {
   GuardianActionMessageScenario,
 } from "./message-composer-types.js";
 
-const log = getLogger("guardian-action-message-composer");
-
-// ---------------------------------------------------------------------------
-// Constants (exported for the daemon-injected generator implementation)
-// ---------------------------------------------------------------------------
-
-export const GUARDIAN_ACTION_COPY_TIMEOUT_MS = 4_000;
-export const GUARDIAN_ACTION_COPY_MAX_TOKENS = 200;
-export const GUARDIAN_ACTION_COPY_SYSTEM_PROMPT =
-  "You are an assistant writing one user-facing message about a guardian action in a voice call scenario. " +
-  "Keep it concise, natural, and conversational. Preserve factual details exactly. " +
-  "These messages are spoken aloud, so use a warm, human tone. " +
-  "Do not mention internal systems, scenario IDs, or technical details. " +
-  "Return plain text only.";
-
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -51,7 +34,6 @@ export const GUARDIAN_ACTION_COPY_SYSTEM_PROMPT =
 export async function composeGuardianActionMessageGenerative(
   context: GuardianActionMessageContext,
   options: ComposeGuardianActionMessageOptions = {},
-  generator?: GuardianActionCopyGenerator,
 ): Promise<string> {
   const fallbackText =
     options.fallbackText?.trim() || getGuardianActionFallbackMessage(context);
@@ -60,45 +42,9 @@ export async function composeGuardianActionMessageGenerative(
     return fallbackText;
   }
 
-  if (generator) {
-    try {
-      const generated = await generator(context, options);
-      if (generated) return generated;
-    } catch (err) {
-      log.warn(
-        { err, scenario: context.scenario },
-        "Failed to generate guardian action copy, using fallback",
-      );
-    }
-  }
-
   return fallbackText;
 }
 
-/** @internal Exported for use by the daemon-injected generator implementation. */
-export function buildGuardianActionGenerationPrompt(
-  context: GuardianActionMessageContext,
-  fallbackText: string,
-  requiredKeywords: string[] | undefined,
-): string {
-  const keywordClause =
-    requiredKeywords && requiredKeywords.length > 0
-      ? `Required words to include (as standalone words): ${requiredKeywords.join(
-          ", ",
-        )}.\n`
-      : "";
-  return [
-    "Rewrite the following guardian action message as a natural, conversational reply.",
-    "These messages are for voice call scenarios and may be spoken aloud.",
-    "Keep the same concrete facts and next-step guidance.",
-    keywordClause,
-    `Context JSON: ${JSON.stringify(context)}`,
-    `Fallback message: ${fallbackText}`,
-  ]
-    .filter(Boolean)
-    .join("\n\n");
-}
-
 /** @internal Exported for use by the daemon-injected generator implementation. */
 export function includesRequiredKeywords(
   text: string,

package/src/runtime/http-server.ts

@@ -7,10 +7,6 @@
 
 import type { ServerWebSocket } from "bun";
 
-import {
-  startGuardianActionSweep,
-  stopGuardianActionSweep,
-} from "../calls/guardian-action-sweep.js";
 import {
   activeMediaStreamSessions,
   MediaStreamCallSession,
@@ -29,7 +25,6 @@ import { isHttpAuthDisabled } from "../config/env.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
 import { createApprovalCopyGenerator } from "../daemon/approval-generators.js";
-import { createGuardianActionCopyGenerator } from "../daemon/guardian-action-generators.js";
 import { processMessage } from "../daemon/process-message.js";
 import { createLiveVoiceSession } from "../live-voice/live-voice-session.js";
 import { LiveVoiceSessionManager } from "../live-voice/live-voice-session-manager.js";
@@ -61,11 +56,11 @@ import {
 } from "./middleware/auth.js";
 import { withErrorHandling } from "./middleware/error-handler.js";
 import {
-  apiRateLimiter,
   extractClientIp,
   ipRateLimiter,
   rateLimitHeaders,
   rateLimitResponse,
+  selectAuthenticatedRateLimiter,
 } from "./middleware/rate-limiter.js";
 import { withRequestLogging } from "./middleware/request-logger.js";
 import {
@@ -99,7 +94,6 @@ export { isPrivateAddress } from "./middleware/auth.js";
 
 import type {
   ApprovalCopyGenerator,
-  GuardianActionCopyGenerator,
   RuntimeHttpServerOptions,
 } from "./http-types.js";
 
@@ -162,7 +156,6 @@ export class RuntimeHttpServer {
   private hostname: string;
 
   private readonly approvalCopyGenerator: ApprovalCopyGenerator;
-  private readonly guardianActionCopyGenerator: GuardianActionCopyGenerator;
   private retrySweepTimer: ReturnType<typeof setInterval> | null = null;
   private sweepInProgress = false;
 
@@ -174,7 +167,6 @@ export class RuntimeHttpServer {
     this.hostname = options.hostname ?? DEFAULT_HOSTNAME;
 
     this.approvalCopyGenerator = createApprovalCopyGenerator();
-    this.guardianActionCopyGenerator = createGuardianActionCopyGenerator();
     this.liveVoiceSessionManager = new LiveVoiceSessionManager({
       createSession: (context) => createLiveVoiceSession(context),
     });
@@ -486,9 +478,6 @@ export class RuntimeHttpServer {
     startGuardianExpirySweep(this.approvalCopyGenerator);
     log.info("Guardian approval expiry sweep started");
 
-    startGuardianActionSweep(this.guardianActionCopyGenerator);
-    log.info("Guardian action expiry sweep started");
-
     startCanonicalGuardianExpirySweep();
     log.info("Canonical guardian request expiry sweep started");
 
@@ -498,7 +487,6 @@ export class RuntimeHttpServer {
 
   async stop(): Promise<void> {
     stopGuardianExpirySweep();
-    stopGuardianActionSweep();
     stopCanonicalGuardianExpirySweep();
     stopInferenceProfileSessionReaper();
     if (this.retrySweepTimer) {
@@ -702,7 +690,11 @@ export class RuntimeHttpServer {
     if (!isHttpAuthDisabled()) {
       const clientIp = extractClientIp(req, server);
       const token = extractBearerToken(req);
-      const limiter = token ? apiRateLimiter : ipRateLimiter;
+      // Authenticated loopback clients (desktop app, CLI — anything on the
+      // daemon's own host) get a higher budget than remote clients.
+      const limiter = token
+        ? selectAuthenticatedRateLimiter(clientIp)
+        : ipRateLimiter;
       const limiterKind = token ? "authenticated" : "unauthenticated";
       const result = limiter.check(clientIp, path);
       if (!result.allowed) {

package/src/runtime/http-types.ts

@@ -22,7 +22,6 @@ import type { AssistantEventHub } from "./assistant-event-hub.js";
 export type {
   ApprovalCopyGenerator,
   ComposeApprovalMessageGenerativeOptions,
-  GuardianActionCopyGenerator,
 } from "./message-composer-types.js";
 import type { TrustContext } from "../daemon/trust-context.js";
 

package/src/runtime/message-composer-types.ts

@@ -123,12 +123,3 @@ export interface ComposeGuardianActionMessageOptions {
   maxTokens?: number;
   timeoutMs?: number;
 }
-
-/**
- * Daemon-injected function that generates guardian action copy using a provider.
- * Returns generated text or `null` on failure (caller falls back to deterministic text).
- */
-export type GuardianActionCopyGenerator = (
-  context: GuardianActionMessageContext,
-  options?: ComposeGuardianActionMessageOptions,
-) => Promise<string | null>;