@vellumai/assistant 0.8.3 → 0.8.5

package/src/runtime/agent-wake.ts

@@ -68,9 +68,6 @@ import { getLogger } from "../util/logger.js";
 
 const log = getLogger("agent-wake");
 
-/** Number of messages injected for the wake hint (user + assistant + user). */
-const WAKE_HINT_MESSAGE_COUNT = 3;
-
 /** Static preamble user message — no dynamic content, injection-safe. */
 const WAKE_PREAMBLE =
   "[system] The following assistant message comes from an external system.";
@@ -196,6 +193,51 @@ export interface WakeOptions {
    * tune the model/profile and observability bucket independently.
    */
   callSite?: LLMCallSite;
+  /**
+   * Role to use for the injected hint message. Defaults to `"assistant"` so
+   * the hint is sandwiched between two static user bookends — the canonical
+   * anti-injection pattern for hints that may carry text from an external
+   * source. Trusted internal callers (e.g. fork-based memory retrospectives)
+   * can pass `"user"` to inject a single user-role message containing the
+   * hint directly, which reads more naturally as an instruction from the
+   * user/system rather than a self-directed assistant note.
+   */
+  hintRole?: "assistant" | "user";
+  /**
+   * Documented intent: this wake must not trigger auto-threshold compaction.
+   *
+   * Today this is automatically satisfied because the wake invokes
+   * `target.agentLoop.run()` directly, bypassing the daemon orchestrator
+   * (`conversation-agent-loop.ts`) where the compaction pipeline lives. The
+   * flag is recorded in the wake's structured log line so operators can
+   * verify the contract holds across refactors. If compaction is ever moved
+   * into `AgentLoop.run` or invoked from the wake path, callers that pass
+   * `true` here MUST be updated to suppress it; callers that pass `false`
+   * (or omit it) MUST tolerate compaction firing.
+   *
+   * Used by fork-based memory retrospectives: the wake operates on a
+   * freshly-forked conversation that may already be near (or past) the
+   * source's auto-threshold, but the goal is to operate on that exact
+   * context — running a compaction LLM call before the wake's own first
+   * call would waste tokens and defeat prompt-cache reuse.
+   */
+  suppressAutoCompaction?: boolean;
+  /**
+   * Skip injection of the hint sandwich entirely. Used when the caller has
+   * already persisted the instruction as a real message in the conversation
+   * (e.g. fork-based memory retrospectives that append a user message to the
+   * forked conversation before waking). When `true`, `hint` is ignored.
+   */
+  skipHintInjection?: boolean;
+  /**
+   * Skip injection of the "Conversation Woke" `ui_surface` card into the
+   * first assistant tail message and the corresponding live
+   * `onWakeProducedOutput` broadcast. Default false (existing behavior).
+   * Used by callers whose conversation context already makes it obvious
+   * that the agent's output came from a wake (e.g. fork-based memory
+   * retrospectives whose conversation title already says "(Retrospective)").
+   */
+  suppressWakeSurface?: boolean;
 }
 
 /**
@@ -224,13 +266,18 @@ export interface WakeResult {
  */
 export interface WakeDeps {
   /**
-   * Resolve the wake target for a conversationId.
+   * Resolve the wake target for a wake invocation.
    * Returns `null` if the conversation doesn't exist, `"archived"` if it
    * exists but is archived, or a `WakeTarget` to proceed with the wake.
+   *
+   * Receives the full {@link WakeOptions} so the default resolver can
+   * thread `trustContext` into `getOrCreateConversation`. Without that
+   * threading, the conversation hydrates with `trustContext === undefined`
+   * and `loadFromDb` fail-closes to `trustClass: "unknown"`, which filters
+   * out every guardian-provenance message — fatal for fork-based memory
+   * retrospectives.
    */
-  resolveTarget: (
-    conversationId: string,
-  ) => Promise<WakeTarget | null | "archived">;
+  resolveTarget: (opts: WakeOptions) => Promise<WakeTarget | null | "archived">;
   /** Timestamp source (for deterministic tests). */
   now?: () => number;
 }
@@ -242,8 +289,9 @@ export interface WakeDeps {
 // `getOrCreateConversation`, and `conversationToWakeTarget`.
 
 async function defaultResolveTarget(
-  conversationId: string,
+  opts: WakeOptions,
 ): Promise<WakeTarget | null | "archived"> {
+  const { conversationId } = opts;
   // Lazy-import daemon modules to avoid pulling heavyweight transitive
   // deps (conversation store → config/loader → provider catalogs) at
   // module-evaluation time.  Callers that only import agent-wake for
@@ -264,7 +312,15 @@ async function defaultResolveTarget(
       );
       return "archived";
     }
-    const conversation = await getOrCreateConversation(conversationId);
+    // Thread trustContext through to getOrCreateConversation so the
+    // hydration path applies setTrustContext + ensureActorScopedHistory
+    // (conversation-store.ts:281-289) BEFORE the agent loop's per-turn
+    // snapshot reads. Without this, fork-based memory retrospectives see
+    // an empty history because loadFromDb ran with trustClass="unknown"
+    // and filtered out every guardian-provenance message.
+    const conversation = await getOrCreateConversation(conversationId, {
+      trustContext: opts.trustContext,
+    });
     return conversationToWakeTarget(conversation);
   } catch (err) {
     log.warn(
@@ -376,6 +432,7 @@ function buildWakeTurnContext(
  */
 function inspectWakeOutput(
   baselineLength: number,
+  hintMessageCount: number,
   updatedHistory: Message[],
 ): {
   tailMessages: Message[];
@@ -383,10 +440,10 @@ function inspectWakeOutput(
   toolUseNames: string[];
 } {
   // The agent loop appends messages onto the history it was given. We
-  // injected 3 hint messages (user preamble + assistant hint + user
-  // postamble), so anything at index >= baselineLength + 3 came from
-  // the run.
-  const firstAssistantIndex = baselineLength + WAKE_HINT_MESSAGE_COUNT;
+  // injected `hintMessageCount` hint messages (0, 1, or 3 depending on
+  // hint mode), so anything at index >= baselineLength + hintMessageCount
+  // came from the run.
+  const firstAssistantIndex = baselineLength + hintMessageCount;
   if (updatedHistory.length <= firstAssistantIndex) {
     return { tailMessages: [], hasVisibleText: false, toolUseNames: [] };
   }
@@ -436,7 +493,7 @@ export async function wakeAgentForOpportunity(
   const startedAt = nowFn();
 
   return runSingleFlight(conversationId, async () => {
-    const resolved = await resolveTarget(conversationId);
+    const resolved = await resolveTarget(opts);
     if (resolved === "archived") {
       log.info(
         { conversationId, source },
@@ -505,28 +562,45 @@ export async function wakeAgentForOpportunity(
     // tail-slice math would skip every message.
     const baselineLength = baseline.length;
     const wakeTurnContext = buildWakeTurnContext(opts, diskPressureDecision);
-    const hintContent = `[opportunity:${source}] ${hint}`;
-    // Sandwich the hint as an assistant message between two hardcoded
-    // user messages. The assistant role prevents prompt injection — LLMs
-    // don't follow instructions in their own prior output. The trailing
-    // user message satisfies providers that reject assistant prefill
-    // (conversation must end on a user turn). Both user messages are
-    // static strings with no dynamic content so they cannot carry
-    // injection payloads.
-    const wakeMessages: Message[] = [
-      {
-        role: "user",
-        content: [{ type: "text", text: WAKE_PREAMBLE }],
-      },
-      {
-        role: "assistant",
-        content: [{ type: "text", text: hintContent }],
-      },
-      {
-        role: "user",
-        content: [{ type: "text", text: WAKE_POSTAMBLE }],
-      },
-    ];
+    // Build the hint injection. Three modes:
+    //   - `skipHintInjection`: caller has already persisted an instruction
+    //     message into the conversation history (typical for fork-based
+    //     memory retrospectives that append a user message before waking).
+    //   - `hintRole === "user"`: single user-role message containing the
+    //     hint directly. Used by trusted internal callers where the hint
+    //     reads naturally as an instruction.
+    //   - default (`hintRole === "assistant"`): sandwich the hint as an
+    //     assistant message between two hardcoded user bookends. The
+    //     assistant role defangs prompt injection (LLMs don't follow
+    //     instructions in their own prior output) and the trailing user
+    //     message satisfies providers that reject assistant prefill.
+    const hintRole = opts.hintRole ?? "assistant";
+    const wakeMessages: Message[] = opts.skipHintInjection
+      ? []
+      : hintRole === "user"
+        ? [
+            {
+              role: "user",
+              content: [{ type: "text", text: hint }],
+            },
+          ]
+        : [
+            {
+              role: "user",
+              content: [{ type: "text", text: WAKE_PREAMBLE }],
+            },
+            {
+              role: "assistant",
+              content: [
+                { type: "text", text: `[opportunity:${source}] ${hint}` },
+              ],
+            },
+            {
+              role: "user",
+              content: [{ type: "text", text: WAKE_POSTAMBLE }],
+            },
+          ];
+    const wakeHintMessageCount = wakeMessages.length;
     const runInput: Message[] = [...baseline, ...wakeMessages];
 
     // Event handling runs in two modes. While `mode === "buffering"`,
@@ -566,6 +640,7 @@ export async function wakeAgentForOpportunity(
           JSON.stringify(record.rawResponse),
           undefined,
           record.provider,
+          "mainAgent",
         );
       } catch (err) {
         log.warn(
@@ -663,26 +738,28 @@ export async function wakeAgentForOpportunity(
     const goLive = (currentHistory: Message[]): void => {
       if (mode === "live") return;
       if (!surfaceInjected) {
-        const tailStart = baselineLength + WAKE_HINT_MESSAGE_COUNT;
-        const tail = currentHistory.slice(tailStart);
-        const firstAssistant = tail.find((m) => m.role === "assistant");
-        if (firstAssistant && Array.isArray(firstAssistant.content)) {
-          firstAssistant.content.unshift({
-            type: "ui_surface",
-            surfaceId: wakeSurfaceId,
-            surfaceType: "card",
-            title: "Conversation Woke",
-            data: {
+        if (!opts.suppressWakeSurface) {
+          const tailStart = baselineLength + wakeHintMessageCount;
+          const tail = currentHistory.slice(tailStart);
+          const firstAssistant = tail.find((m) => m.role === "assistant");
+          if (firstAssistant && Array.isArray(firstAssistant.content)) {
+            firstAssistant.content.unshift({
+              type: "ui_surface",
+              surfaceId: wakeSurfaceId,
+              surfaceType: "card",
               title: "Conversation Woke",
-              body: hint,
-              metadata: [{ label: "Source", value: source }],
-            },
-            display: "inline",
-          } as never);
+              data: {
+                title: "Conversation Woke",
+                body: hint,
+                metadata: [{ label: "Source", value: source }],
+              },
+              display: "inline",
+            } as never);
+          }
         }
         surfaceInjected = true;
       }
-      if (target.onWakeProducedOutput) {
+      if (!opts.suppressWakeSurface && target.onWakeProducedOutput) {
         try {
           target.onWakeProducedOutput(source, hint, wakeSurfaceId);
         } catch (err) {
@@ -721,8 +798,7 @@ export async function wakeAgentForOpportunity(
     const flushPendingTail = async (
       currentHistory: Message[],
     ): Promise<void> => {
-      const start =
-        baselineLength + WAKE_HINT_MESSAGE_COUNT + persistedTailIndex;
+      const start = baselineLength + wakeHintMessageCount + persistedTailIndex;
       if (start >= currentHistory.length) return;
       const newMessages = currentHistory.slice(start);
       for (const msg of newMessages) {
@@ -825,7 +901,11 @@ export async function wakeAgentForOpportunity(
         tailMessages,
         hasVisibleText,
         toolUseNames: names,
-      } = inspectWakeOutput(baselineLength, updatedHistory);
+      } = inspectWakeOutput(
+        baselineLength,
+        wakeHintMessageCount,
+        updatedHistory,
+      );
       toolUseNames = names;
       producedToolCalls = names.length > 0;
       const producedOutput = producedToolCalls || hasVisibleText;
@@ -904,9 +984,19 @@ export async function wakeAgentForOpportunity(
       }
 
       const durationMs = nowFn() - startedAt;
+      const suppressAutoCompaction = opts.suppressAutoCompaction === true;
+      const suppressWakeSurface = opts.suppressWakeSurface === true;
       if (runError) {
         log.error(
-          { conversationId, source, durationMs, err: runError },
+          {
+            conversationId,
+            source,
+            durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
+            err: runError,
+          },
           "agent-wake: agent loop threw; treating as no-op",
         );
       } else if (tailMessageCount === 0) {
@@ -915,6 +1005,9 @@ export async function wakeAgentForOpportunity(
             source,
             conversationId,
             durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
             producedToolCalls: false,
             toolNamesCalled: [],
           },
@@ -926,6 +1019,9 @@ export async function wakeAgentForOpportunity(
             source,
             conversationId,
             durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
             producedToolCalls,
             toolNamesCalled: toolUseNames,
             tailMessageCount,

package/src/runtime/assistant-event-hub.ts

@@ -247,6 +247,10 @@ export class AssistantEventHub {
    * Publish an event to all matching subscribers.
    *
    * Matching rules:
+   * - if `excludeClientId` is set, the subscriber with that clientId is
+   *   skipped regardless of every other rule (self-echo suppression — the
+   *   client that originated the mutation does not receive its own
+   *   invalidation back through the hub).
    * - if `targetClientId` is set, deliver only to the subscriber with that
    *   clientId, bypassing the conversation-id filter entirely (the web-origin
    *   event's conversationId differs from the macOS client's subscribed
@@ -255,6 +259,11 @@ export class AssistantEventHub {
    *   `event.conversationId` must equal it
    * - if `targetCapability` is set, only subscribers whose capabilities include
    *   it receive the event; untargeted events go to all
+   * - if `targetInterfaceId` is set, only client subscribers whose
+   *   `interfaceId` matches receive the event; process subscribers and
+   *   non-matching clients are skipped. Used to narrow legacy
+   *   broadcasts (e.g. `conversation_list_invalidated`) to a specific
+   *   client surface during a migration window.
    *
    * Fanout is isolated: a throwing or rejecting subscriber does not abort
    * delivery to remaining subscribers.
@@ -264,6 +273,15 @@ export class AssistantEventHub {
     options?: {
       targetCapability?: HostProxyCapability;
       targetClientId?: string;
+      targetInterfaceId?: InterfaceId;
+      /**
+       * Skip the subscriber with this `clientId`. Used for self-echo
+       * suppression on `sync_changed`: the route handler echoes the
+       * originating tab's `X-Vellum-Client-Id` back on the event, and the
+       * hub uses it here to avoid re-delivering the invalidation to the
+       * tab that already mutated its own optimistic state.
+       */
+      excludeClientId?: string;
     },
   ): Promise<void> {
     if (event.conversationId) {
@@ -276,12 +294,33 @@ export class AssistantEventHub {
 
     const targetCapability = options?.targetCapability;
     const targetClientId = options?.targetClientId;
+    const targetInterfaceId = options?.targetInterfaceId;
+    const excludeClientId = options?.excludeClientId;
     const snapshot = Array.from(this.subscribers);
     const errors: unknown[] = [];
 
     for (const entry of snapshot) {
       if (!entry.active) continue;
 
+      // Self-echo suppression: the originating client never receives the
+      // event back. Checked before every other rule so it composes with
+      // both targeted and untargeted broadcasts.
+      if (
+        excludeClientId != null &&
+        entry.type === "client" &&
+        entry.clientId === excludeClientId
+      ) {
+        continue;
+      }
+
+      // Interface targeting: skip any subscriber that is not a client of
+      // the requested interface. Composes with `targetClientId` and
+      // `targetCapability` below.
+      if (targetInterfaceId != null) {
+        if (entry.type !== "client" || entry.interfaceId !== targetInterfaceId)
+          continue;
+      }
+
       if (targetClientId != null) {
         // Targeted: bypass conversation filter, deliver only to the named client.
         if (entry.type !== "client" || entry.clientId !== targetClientId)
@@ -519,10 +558,11 @@ let _hubChain = Promise.resolve();
 export function broadcastMessage(
   msg: ServerMessage,
   conversationId?: string,
-  options?: { targetClientId?: string },
+  options?: { targetClientId?: string; targetInterfaceId?: InterfaceId },
 ): void {
   const resolvedConversationId = conversationId ?? extractConversationId(msg);
   const targetClientId = options?.targetClientId;
+  const targetInterfaceId = options?.targetInterfaceId;
 
   // Confirmation-request side effects: canonical guardian request creation.
   // The home-feed `activity.failed` notification side-effect lives in the
@@ -539,16 +579,45 @@ export function broadcastMessage(
       : resolvedConversationId;
   const event = buildAssistantEvent(msg, scopedConversationId);
   const targetCapability = capabilityForMessageType(msg.type);
+  // Self-echo suppression: a `sync_changed` carrying an `originClientId`
+  // means a specific client just mutated the resource. The hub must not
+  // re-deliver the invalidation to that client — it already updated its
+  // optimistic state locally and a redundant invalidation would clobber it
+  // with a flash of stale-then-fresh data. Assistant-internal emits (agent
+  // loop, FS watcher, cron) leave `originClientId` unset and the event
+  // fans out to every subscriber as before.
+  const excludeClientId =
+    msg.type === "sync_changed" &&
+    typeof msg.originClientId === "string" &&
+    msg.originClientId.length > 0
+      ? msg.originClientId
+      : undefined;
   const publishOptions =
-    targetCapability != null || targetClientId != null
-      ? { targetCapability, targetClientId }
+    targetCapability != null ||
+    targetClientId != null ||
+    targetInterfaceId != null ||
+    excludeClientId != null
+      ? {
+          targetCapability,
+          targetClientId,
+          targetInterfaceId,
+          excludeClientId,
+        }
       : undefined;
   _hubChain = _hubChain
     .then(() => assistantEventHub.publish(event, publishOptions))
     .then(() => {
-      // When a conversation title changes, also broadcast an unscoped
-      // `conversation_list_invalidated` so every connected client's sidebar
-      // refreshes — not just the client viewing this conversation.
+      // When a conversation title changes, also publish a
+      // `conversation_list_invalidated` so the macOS sidebar refreshes
+      // its row ordering for the renamed conversation. Web consumes the
+      // paired `sync_changed` with `conversation:<id>:metadata` tag
+      // emitted by `publishConversationTitleChanged` and patches the
+      // single row in place, so the broadcast is scoped to macOS only.
+      //
+      // TODO(electron-cutover): remove this emission once macOS migrates
+      // to the Electron client and consumes `sync_changed` directly. At
+      // that point `conversation_list_invalidated` has no remaining
+      // consumers and the message type can be retired.
       if (msg.type === "conversation_title_updated") {
         return assistantEventHub
           .publish(
@@ -556,6 +625,7 @@ export function broadcastMessage(
               type: "conversation_list_invalidated",
               reason: "renamed",
             }),
+            { targetInterfaceId: "macos" },
           )
           .catch((err: unknown) => {
             log.warn(

package/src/runtime/auth/route-policy.ts

@@ -153,6 +153,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "conversations/undo", scopes: ["chat.write"] },
   { endpoint: "conversations/regenerate", scopes: ["chat.write"] },
   { endpoint: "conversations/attention", scopes: ["chat.read"] },
+  { endpoint: "conversations/slack-channel/resolve", scopes: ["chat.read"] },
   { endpoint: "conversations/seen", scopes: ["chat.write"] },
   { endpoint: "conversations/unread", scopes: ["chat.write"] },
   { endpoint: "conversations/import", scopes: ["chat.write"] },
@@ -416,6 +417,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
 
   // LLM call site catalog
   { endpoint: "config/llm/call-sites:GET", scopes: ["settings.read"] },
+  { endpoint: "config/llm/profiles:GET", scopes: ["settings.read"] },
 
   // Conversation management
   { endpoint: "conversations:DELETE", scopes: ["chat.write"] },
@@ -439,6 +441,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   // Message content
   { endpoint: "messages/content", scopes: ["chat.read"] },
   { endpoint: "messages/llm-context", scopes: ["chat.read"] },
+  { endpoint: "conversations/llm-context", scopes: ["chat.read"] },
   { endpoint: "llm-request-logs/payload", scopes: ["chat.read"] },
   { endpoint: "messages/tts", scopes: ["chat.read"] },
   { endpoint: "tts/synthesize", scopes: ["chat.read"] },
@@ -451,15 +454,17 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "bookmarks:POST", scopes: ["chat.write"] },
   { endpoint: "bookmarks/by-message:DELETE", scopes: ["chat.write"] },
 
-  // Interfaces
-  { endpoint: "interfaces", scopes: ["settings.read"] },
-
   // Skills
   { endpoint: "skills:GET", scopes: ["settings.read"] },
   { endpoint: "skills:POST", scopes: ["settings.write"] },
   { endpoint: "skills:DELETE", scopes: ["settings.write"] },
   { endpoint: "skills:PATCH", scopes: ["settings.write"] },
 
+  // Plugins (read-only for now — install / uninstall stay CLI-side)
+  { endpoint: "plugins:GET", scopes: ["settings.read"] },
+  { endpoint: "plugins/search:GET", scopes: ["settings.read"] },
+  { endpoint: "plugins:DELETE", scopes: ["settings.write"] },
+
   // Memory items
   { endpoint: "memory-items:GET", scopes: ["settings.read"] },
   { endpoint: "memory-items:POST", scopes: ["settings.write"] },
@@ -471,6 +476,20 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "memory/v2/list-concept-pages:POST", scopes: ["settings.read"] },
   { endpoint: "memory/v2/reembed-skills:POST", scopes: ["settings.write"] },
   { endpoint: "memory/v2/concept-frequency:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v2/ema-scores:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v2/simulate-router:POST", scopes: ["settings.read"] },
+  {
+    endpoint: "memory/v2/compare-retrievers:POST",
+    scopes: ["settings.read"],
+  },
+  {
+    endpoint: "memory/v2/router-prompt-template:GET",
+    scopes: ["settings.read"],
+  },
+  { endpoint: "memory/v2/now-text:GET", scopes: ["settings.read"] },
+  { endpoint: "memory/v3/validate:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v3/tree:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v3/simulate:POST", scopes: ["settings.read"] },
 
   // Trust rule listing
   { endpoint: "trust-rules/manage:GET", scopes: ["settings.read"] },
@@ -665,6 +684,12 @@ registerPolicy("channels/inbound", {
   allowedPrincipalTypes: ["svc_gateway"],
 });
 
+// Background wake control-plane calls from the platform.
+registerPolicy("background-wake", {
+  requiredScopes: ["internal.write"],
+  allowedPrincipalTypes: ["svc_gateway"],
+});
+
 // Internal forwarding endpoints: gateway-only
 const INTERNAL_ENDPOINTS = [
   "internal/twilio/voice-webhook",
@@ -887,6 +912,12 @@ registerPolicy("browser/execute", {
   allowedPrincipalTypes: ["local"],
 });
 
+// Browser tabs operations (list/select/new/close): local-only (CLI / IPC callers)
+registerPolicy("browser/tabs", {
+  requiredScopes: ["settings.write"],
+  allowedPrincipalTypes: ["local"],
+});
+
 // Background tools: local-only (CLI / IPC callers)
 registerPolicy("background-tools", {
   requiredScopes: ["settings.read"],
@@ -922,6 +953,11 @@ registerPolicy("domain/status", {
   allowedPrincipalTypes: ["local"],
 });
 
+registerPolicy("domain/verification-status", {
+  requiredScopes: ["settings.read"],
+  allowedPrincipalTypes: ["local"],
+});
+
 // Email management (IPC-local)
 registerPolicy("email/register", {
   requiredScopes: ["settings.write"],
@@ -992,6 +1028,10 @@ registerPolicy("conversations/cli/export", {
   requiredScopes: ["settings.read"],
   allowedPrincipalTypes: ["local"],
 });
+registerPolicy("conversations/cli/slack/detach", {
+  requiredScopes: ["settings.write"],
+  allowedPrincipalTypes: ["local"],
+});
 // `conversations/cli/clear` wipes every conversation + message + vector
 // collection. Elevated to settings.write and locked to local callers,
 // mirroring the `conversations/clear-all` and `conversations/wipe` gates.

package/src/runtime/background-job-runner.ts

@@ -24,6 +24,11 @@ import type { TrustContext } from "../daemon/trust-context.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { addMessage } from "../memory/conversation-crud.js";
 import type { TitleOrigin } from "../memory/conversation-title-service.js";
+import {
+  commitDeferredConversation,
+  discardDeferredConversation,
+  registerDeferredConversation,
+} from "../notifications/deferred-emit.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import type { AttentionHints } from "../notifications/signal.js";
 import { getLogger } from "../util/logger.js";
@@ -121,6 +126,11 @@ export interface RunBackgroundJobOptions {
    * the `assistant` role and cannot override the action prompt.
    */
   assistantSandwich?: { preamble: string; content: string; postamble: string };
+  /**
+   * Buffer in-band `notifications send` calls and only flush them after the
+   * run completes successfully. See `notifications/deferred-emit.ts`.
+   */
+  deferNotifications?: boolean;
 }
 
 export interface RunBackgroundJobResult {
@@ -205,6 +215,10 @@ export async function runBackgroundJob(
       ...(opts.scheduleJobId ? { scheduleJobId: opts.scheduleJobId } : {}),
     });
 
+    if (opts.deferNotifications) {
+      registerDeferredConversation(conversation.id);
+    }
+
     // Fire the sidebar-creation callback synchronously after bootstrap so
     // connected clients (macOS sidebar, etc.) see the conversation appear
     // immediately rather than after `processMessage` returns. Wrapped so a
@@ -273,6 +287,14 @@ export async function runBackgroundJob(
     });
 
     await Promise.race([work, timeout]);
+    // Symmetric with the `work.catch` above: once `work` has won the race,
+    // the orphan timeout promise can still reject during the await below
+    // (commitDeferredConversation). Swallow so it doesn't surface as an
+    // unhandled rejection that Bun can use to terminate the process.
+    timeout.catch(() => {});
+    if (opts.deferNotifications) {
+      await commitDeferredConversation(conversation.id);
+    }
     return { conversationId: conversation.id, ok: true };
   } catch (err) {
     const errorKind = classifyError(err);
@@ -281,6 +303,10 @@ export async function runBackgroundJob(
     // so the structured failure result still flows to the caller.
     const conversationId = conversation?.id ?? "";
 
+    if (opts.deferNotifications && conversationId) {
+      discardDeferredConversation(conversationId);
+    }
+
     log.error(
       {
         err: error.message,

package/src/runtime/btw-sidechain.ts

@@ -40,9 +40,6 @@ export interface RunBtwSidechainParams {
   signal?: AbortSignal;
   timeoutMs?: number;
   onEvent?: (event: ProviderEvent) => void;
-  userPersona?: string | null;
-  channelPersona?: string | null;
-  userSlug?: string | null;
 }
 
 export interface RunBtwSidechainResult {
@@ -79,9 +76,6 @@ export async function runBtwSidechain(
       : buildSystemPrompt({
           excludeBootstrap: true,
           excludeCustomPrefix: true,
-          userPersona: params.userPersona,
-          channelPersona: params.channelPersona,
-          userSlug: params.userSlug,
         }));
 
   const { signal: timeoutSignal, cleanup } = createTimeout(