@vellumai/assistant 0.8.9-staging.2 → 0.8.9-staging.4

package/src/daemon/conversation-agent-loop.ts

@@ -9,7 +9,6 @@
 
 import { v4 as uuid } from "uuid";
 
-import { optimizeImageForTransport } from "../agent/image-optimize.js";
 import type {
   AgentEvent,
   AgentLoopExitReason,
@@ -34,7 +33,6 @@ import {
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { ContextWindowConfig } from "../config/types.js";
-import { runEmergencyCompaction } from "../context/compactor.js";
 import {
   derefToolResultReReads,
   postTurnTruncateToolResults,
@@ -43,7 +41,6 @@ import {
   estimatePromptTokens,
   getCalibrationProviderKey,
 } from "../context/token-estimator.js";
-import type { ContextWindowCompactOptions } from "../context/window-manager.js";
 import { writeRelationshipState } from "../home/relationship-state-writer.js";
 import {
   clearSentryConversationContext,
@@ -81,6 +78,7 @@ import {
   reduceContextOverflow,
   type ReducerState,
 } from "../plugins/defaults/compaction/context-overflow-reducer.js";
+import type { ContextWindowCompactOptions } from "../plugins/defaults/compaction/window-manager.js";
 import { deepRepairHistory } from "../plugins/defaults/history-repair/terminal.js";
 import userPromptSubmitMemoryRetrieval, {
   type MemoryRetrievalHookContext,
@@ -88,13 +86,11 @@ import userPromptSubmitMemoryRetrieval, {
 import { runHook } from "../plugins/pipeline.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
-import {
-  isUntrustedTrustClass,
-  resolveActorTrust,
-} from "../runtime/actor-trust-resolver.js";
+import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
+import type { ActivationMomentParam } from "../telemetry/activation-funnel.js";
 import type { UsageActor } from "../usage/actors.js";
 import { getLogger } from "../util/logger.js";
 import { timeAgo } from "../util/time.js";
@@ -122,16 +118,12 @@ import {
   isUserCancellation,
 } from "./conversation-error.js";
 import { raceWithTimeout } from "./conversation-media-retry.js";
-import type {
-  InboundActorContext,
-  InjectionMode,
-} from "./conversation-runtime-assembly.js";
+import type { InjectionMode } from "./conversation-runtime-assembly.js";
 import {
   applyRuntimeInjections,
   getSlackCompactionWatermarkForPrefix,
-  inboundActorContextFromTrust,
-  inboundActorContextFromTrustContext,
   loadSlackChronologicalContext,
+  resolveTurnInboundActorContext,
   type SlackChronologicalContext,
   stripInjectionsForCompaction,
 } from "./conversation-runtime-assembly.js";
@@ -148,8 +140,8 @@ import type {
 } from "./message-protocol.js";
 import { parseActualTokensFromError } from "./parse-actual-tokens-from-error.js";
 import {
+  oversizedImageReplacement,
   persistUnsendableImageDowngrades,
-  UNSENDABLE_IMAGE_NOTE,
 } from "./persist-unsendable-image.js";
 import { resolveTrustClass, type TrustContext } from "./trust-context.js";
 
@@ -176,6 +168,34 @@ function formatDiskPressureBlockedMessage(): string {
   return "Storage is critically low, so background processes are paused and remote messages are ignored until the guardian frees enough space. Remote senders should try again later.";
 }
 
+// ── Image-recovery helpers ───────────────────────────────────────────
+
+/**
+ * True when a message's content holds an image the provider may have rejected
+ * for being oversized — either a top-level image block (user upload) or one
+ * nested inside a tool_result's contentBlocks (e.g. a browser screenshot).
+ */
+function messageHasImageBlock(content: ContentBlock[]): boolean {
+  return content.some(
+    (b) =>
+      b.type === "image" ||
+      (b.type === "tool_result" &&
+        (b.contentBlocks?.some((cb) => cb.type === "image") ?? false)),
+  );
+}
+
+/**
+ * Replace an oversized image with its downscaled form or an unsendable note,
+ * leaving still-sendable images untouched. Delegates to the shared
+ * {@link oversizedImageReplacement} so the in-memory recovery and the durable
+ * persist pass apply the identical provider-cap gate.
+ */
+function recoverImageBlock(
+  block: Extract<ContentBlock, { type: "image" }>,
+): ContentBlock {
+  return oversizedImageReplacement(block) ?? block;
+}
+
 // ── Plugin pipeline helpers ──────────────────────────────────────────
 
 /**
@@ -223,6 +243,14 @@ export interface AssistantSurface {
   persistent?: boolean;
   /** Id of the tool call that produced this surface (the `ui_show` proxy tool). Persisted so app previews can gate on the tool result's arrival rather than whole-turn streaming state. */
   toolCallId?: string;
+  /**
+   * Commit-timing activation-rail tag (daemon-only). Persisted into the
+   * server-side `ui_surface` history block — NOT the client `ui_surface_show`
+   * message — so `restoreSurfaceStateFromHistory` can rehydrate the tag and a
+   * post-reload commit still records its funnel milestone. Show-timing moments
+   * record at render and are never stored here.
+   */
+  activationMoment?: ActivationMomentParam;
 }
 
 // ── runAgentLoop ─────────────────────────────────────────────────────
@@ -771,41 +799,16 @@ export async function runAgentLoopImpl(
       hostTimeZone,
     });
 
-    // Resolve the inbound actor context for the unified <turn_context> block.
-    // When the conversation carries enough identity info, use the unified
-    // actor trust resolver so member status/policy and guardian binding details
-    // are fresh for this turn. The conversation runtime context remains the source
-    // for policy gating; this block is model-facing grounding metadata.
-    let resolvedInboundActorContext: InboundActorContext | null = null;
-    if (ctx.trustContext) {
-      const gc = ctx.trustContext;
-      if (gc.requesterExternalUserId && gc.requesterChatId) {
-        const actorTrust = resolveActorTrust({
-          assistantId: ctx.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
-          sourceChannel: gc.sourceChannel,
-          conversationExternalId: gc.requesterChatId,
-          actorExternalId: gc.requesterExternalUserId,
-          actorDisplayName: gc.requesterSenderDisplayName,
-        });
-        resolvedInboundActorContext = inboundActorContextFromTrust(actorTrust);
-      } else {
-        resolvedInboundActorContext = inboundActorContextFromTrustContext(gc);
-      }
-    }
-
-    // Resolve the guardian flag for this turn. It derives only from the
-    // resolved actor trust class — never from retrieval — so it settles before
-    // context assembly.
-    const isGuardian =
-      resolvedInboundActorContext?.trustClass === "guardian" ||
-      !resolvedInboundActorContext;
-
-    // Unified `<turn_context>` actor input, included only for non-guardian
-    // turns. Resolved once at turn start and threaded per call site (like
-    // `modelProfile`) so post-compaction re-injection receives it as an
-    // explicit hook input rather than re-deriving it from live state that can
-    // flip mid-turn.
-    const actorContext = isGuardian ? null : resolvedInboundActorContext;
+    // Unified `<turn_context>` actor input for this turn (model-facing grounding
+    // metadata; the conversation runtime context remains the source for policy
+    // gating). Resolved once at turn start and threaded per call site (like
+    // `modelProfile`) so post-compaction re-injection receives it as an explicit
+    // hook input rather than re-deriving it from live state that can flip
+    // mid-turn.
+    const actorContext = resolveTurnInboundActorContext(
+      ctx.trustContext,
+      ctx.assistantId,
+    );
 
     // Surface long gaps between user messages so the model can acknowledge
     // the absence naturally. Gated at >12h to avoid noisy injection during
@@ -873,10 +876,9 @@ export async function runAgentLoopImpl(
     // `user-prompt-submit-temp` hook handler but invoked directly for now,
     // separate from the canonical late `user-prompt-submit` hook (history
     // repair, title) that fires just before the loop.
-    // The injection inputs (`mode`, `isNonInteractive`, `modelProfile`,
-    // `actorContext`) are resolved once at turn start and threaded in so
-    // post-compaction re-injection reuses the same snapshot rather than live
-    // state that can flip mid-turn.
+    // The injection inputs (`isNonInteractive`, `modelProfile`) are resolved
+    // once at turn start and threaded in so post-compaction re-injection reuses
+    // the same snapshot rather than live state that can flip mid-turn.
     const isTrustedActor = resolveTrustClass(ctx.trustContext) === "guardian";
     let currentInjectionMode: InjectionMode = "full";
     const memoryCtx: MemoryRetrievalHookContext = {
@@ -886,10 +888,8 @@ export async function runAgentLoopImpl(
       logger: rlog,
       latestMessages: ctx.messages,
       requestId: reqId,
-      mode: currentInjectionMode,
       isNonInteractive,
       modelProfile: modelProfileStr,
-      actorContext,
     };
     await userPromptSubmitMemoryRetrieval(memoryCtx);
 
@@ -913,6 +913,8 @@ export async function runAgentLoopImpl(
     // `AgentLoopRunResult.newMessages`, which is what persistence consumes.
     const userPromptCtx: UserPromptSubmitContext = {
       conversationId: ctx.conversationId,
+      userMessageId,
+      requestId: reqId,
       prompt: options?.titleText ?? content,
       originalMessages: ctx.messages,
       latestMessages: runMessages,
@@ -1076,44 +1078,41 @@ export async function runAgentLoopImpl(
 
     // ── Image-dimension overflow recovery ──────────────────────────
     // When the provider rejects because an image block exceeds its pixel
-    // cap, strip every image block from ctx.messages and retry once.
-    // optimizeImageForTransport already ran at upload time; if sips was
-    // unavailable (non-macOS) it returns the same bytes unchanged.  In
-    // that case we swap the block for a text note so the model can tell
-    // the user what happened instead of hard-failing with a red banner.
+    // or payload cap, recover every oversized image in ctx.messages and
+    // retry once. recoverImageBlock downscales an oversized image, or swaps
+    // it for a text note when resize is a no-op (e.g. sips unavailable
+    // off macOS), while leaving still-sendable images untouched. This covers
+    // both top-level image blocks (user uploads) and images nested inside a
+    // tool_result's contentBlocks (e.g. a browser screenshot), which is where
+    // the rejected block usually lives.
     if (state.imageTooLargeDetected) {
       state.imageTooLargeDetected = false;
       rlog.warn(
         { phase: "image-recovery" },
-        "Image too large — stripping oversized image blocks and retrying",
+        "Image too large — recovering oversized image blocks and retrying",
       );
       ctx.messages = ctx.messages.map((msg) => {
         if (!Array.isArray(msg.content)) return msg;
-        if (!msg.content.some((b) => b.type === "image")) return msg;
+        if (!messageHasImageBlock(msg.content)) return msg;
         return {
           ...msg,
           content: msg.content.flatMap((b): ContentBlock[] => {
-            if (b.type !== "image") return [b];
-            const resized = optimizeImageForTransport(
-              b.source.data,
-              b.source.media_type,
-            );
-            if (resized.data !== b.source.data) {
-              // sips managed to downscale — use the smaller version
+            if (b.type === "image") return [recoverImageBlock(b)];
+            // Images returned by a tool (e.g. browser_screenshot) live in
+            // the tool_result's contentBlocks, not as top-level blocks.
+            // Recover them in place so the tool_use/tool_result pairing
+            // stays intact rather than dropping the whole tool_result.
+            if (b.type === "tool_result" && b.contentBlocks?.length) {
               return [
                 {
                   ...b,
-                  source: {
-                    type: "base64" as const,
-                    media_type: resized.mediaType,
-                    data: resized.data,
-                  },
+                  contentBlocks: b.contentBlocks.map((cb) =>
+                    cb.type === "image" ? recoverImageBlock(cb) : cb,
+                  ),
                 },
               ];
             }
-            // Can't resize — replace with a text annotation so the model
-            // can explain the situation rather than silently dropping context
-            return [{ type: "text" as const, text: UNSENDABLE_IMAGE_NOTE }];
+            return [b];
           }),
         };
       });
@@ -1221,22 +1220,15 @@ export async function runAgentLoopImpl(
       // compressing history. Falls through to reducer tiers on failure.
       {
         try {
-          const emergencyConfig = getConfig().compaction;
-          const emergencyResult = await runEmergencyCompaction({
-            conversationId: ctx.conversationId,
-            messages: ctx.messages,
-            provider: ctx.provider,
-            systemPrompt: ctx.systemPrompt,
-            tools: undefined,
-            compaction: emergencyConfig,
-            maxInputTokens: resolveCurrentMaxInputTokens(),
-            previousEstimatedInputTokens: estimatedTokensAtOverflow,
-            force: true,
-            signal: abortController.signal,
-            overrideProfile: resolveCurrentOverrideProfile() ?? null,
-            nonPersistedPrefixCount:
-              ctx.contextWindowManager.nonPersistedPrefixCount,
-          });
+          const emergencyResult =
+            await ctx.contextWindowManager.emergencyCompact(
+              ctx.messages,
+              {
+                previousEstimatedInputTokens: estimatedTokensAtOverflow,
+                overrideProfile: resolveCurrentOverrideProfile() ?? null,
+              },
+              abortController.signal,
+            );
           if (emergencyResult.compacted) {
             rlog.info(
               {
@@ -1302,7 +1294,7 @@ export async function runAgentLoopImpl(
           reducerState,
           (msgs, signal, opts) =>
             defaultCompact({
-              manager: ctx.contextWindowManager,
+              conversationId: ctx.conversationId,
               messages: msgs,
               signal,
               ...((opts ?? {}) as ContextWindowCompactOptions),
@@ -1399,7 +1391,7 @@ export async function runAgentLoopImpl(
             requestId: reqId,
           });
           const emergencyCompact = await defaultCompact({
-            manager: ctx.contextWindowManager,
+            conversationId: ctx.conversationId,
             messages: ctx.messages,
             signal: abortController.signal,
             force: true,

package/src/daemon/conversation-error.ts

@@ -150,11 +150,25 @@ const STREAMING_ERROR_PATTERNS = [
 ];
 
 // User-initiated cancellation patterns — these should NOT produce conversation_error
-// Image-input validation patterns — Anthropic 400s with this message when an image
-// block exceeds the per-side pixel cap. Distinct classification matters because
-// retrying with the same oversized image is futile; the user needs to resize.
+// Image-input validation patterns — Anthropic 400s with one of these messages
+// when an image block violates a hard limit. The first matches the per-side
+// pixel cap ("image dimensions exceed max allowed size"); the second matches the
+// base64 payload cap ("image exceeds 5 MB maximum: 7465044 bytes > 5242880
+// bytes"). Distinct classification matters because retrying with the same
+// oversized image is futile — the recovery path must strip or downscale it.
 const IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS = [
   /image dimensions? exceeds? max allowed size/i,
+  /image exceeds \d+\s*MB maximum/i,
+];
+
+const VISION_NOT_SUPPORTED_PATTERNS = [
+  /no endpoints found that support image input/i,
+  /does not support image/i,
+  /doesn't support image input/i,
+  /image input is not supported/i,
+  /this model does not support vision/i,
+  /vision is not supported/i,
+  /multi-?modal.*not.*support/i,
 ];
 
 const CANCEL_PATTERNS = [/abort/i, /cancel/i];
@@ -447,11 +461,20 @@ function classifyCore(
         return {
           code: "IMAGE_TOO_LARGE",
           userMessage:
-            "An attached image is too large for the AI provider — image dimensions must be under 8000 pixels per side. Resize the image and try again.",
+            "An image in this conversation was too large for the AI provider and was automatically reduced. Send your message again to continue.",
           retryable: false,
           errorCategory: "image_dimensions_too_large",
         };
       }
+      if (isVisionNotSupported(message)) {
+        return {
+          code: "PROVIDER_API",
+          userMessage:
+            "This model doesn't support image input. Remove the image or switch to a vision-capable model.",
+          retryable: false,
+          errorCategory: "vision_not_supported",
+        };
+      }
       // Extract the provider detail after "API error (NNN): " prefix
       const detailMatch = message.match(/API error \(\d+\):\s*(.+)/i);
       const detail = detailMatch?.[1];
@@ -481,6 +504,10 @@ function isImageDimensionsTooLarge(message: string): boolean {
   return IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS.some((p) => p.test(message));
 }
 
+function isVisionNotSupported(message: string): boolean {
+  return VISION_NOT_SUPPORTED_PATTERNS.some((p) => p.test(message));
+}
+
 /** Check whether an error message indicates a web-search-specific ordering failure. */
 function isWebSearchOrderingError(message: string): boolean {
   return WEB_SEARCH_ORDERING_PATTERNS.some((p) => p.test(message));

package/src/daemon/conversation-history.ts

@@ -1,6 +1,5 @@
 import { v4 as uuid } from "uuid";
 
-import { getSummaryFromContextMessage } from "../context/window-manager.js";
 import {
   deleteLastExchange,
   deleteMessageById,
@@ -13,6 +12,7 @@ import { enqueueMemoryJob } from "../memory/jobs-store.js";
 import { relinkLlmRequestLogs } from "../memory/llm-request-log-store.js";
 import { withQdrantBreaker } from "../memory/qdrant-circuit-breaker.js";
 import { getQdrantClient } from "../memory/qdrant-client.js";
+import { getSummaryFromContextMessage } from "../plugins/defaults/compaction/window-manager.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
 import { truncate } from "../util/truncate.js";

package/src/daemon/conversation-media-retry.ts

@@ -7,7 +7,7 @@
  */
 
 import { estimateContentBlockTokens } from "../context/token-estimator.js";
-import { getSummaryFromContextMessage } from "../context/window-manager.js";
+import { getSummaryFromContextMessage } from "../plugins/defaults/compaction/window-manager.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 
 export interface StripMediaOptions {
@@ -173,15 +173,28 @@ export function estimateUnconditionalStubTokens(
     const msg = messages[msgIndex];
     for (const block of msg.content) {
       if (block.type === "image" && msgIndex !== latestUserIndex) {
-        stubTokens += estimateContentBlockTokens(imageBlockToStub(block), options);
+        stubTokens += estimateContentBlockTokens(
+          imageBlockToStub(block),
+          options,
+        );
       } else if (block.type === "file" && msgIndex !== latestUserIndex) {
-        stubTokens += estimateContentBlockTokens(fileBlockToStub(block), options);
-      } else if (block.type === "tool_result" && block.contentBlocks) { // guard:allow-tool-result-only — web_search_tool_result has no contentBlocks
+        stubTokens += estimateContentBlockTokens(
+          fileBlockToStub(block),
+          options,
+        );
+      } else if (block.type === "tool_result" && block.contentBlocks) {
+        // guard:allow-tool-result-only — web_search_tool_result has no contentBlocks
         for (const cb of block.contentBlocks) {
           if (cb.type === "image") {
-            stubTokens += estimateContentBlockTokens(imageBlockToStub(cb), options);
+            stubTokens += estimateContentBlockTokens(
+              imageBlockToStub(cb),
+              options,
+            );
           } else if (cb.type === "file") {
-            stubTokens += estimateContentBlockTokens(fileBlockToStub(cb), options);
+            stubTokens += estimateContentBlockTokens(
+              fileBlockToStub(cb),
+              options,
+            );
           }
         }
       }

package/src/daemon/conversation-messaging.ts

@@ -43,6 +43,7 @@ import {
 } from "../messaging/providers/slack/message-metadata.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { Message } from "../providers/types.js";
+import type { AuthContext } from "../runtime/auth/types.js";
 import { getLogger } from "../util/logger.js";
 import type { MessageQueue } from "./conversation-queue-manager.js";
 import type { SlackInboundMessageMetadata } from "./handlers/shared.js";
@@ -193,6 +194,9 @@ export interface MessagingConversationContext {
   currentRequestId?: string;
   readonly queue: MessageQueue;
   trustContext?: TrustContext;
+  authContext?: AuthContext;
+  currentTurnAuthContext?: AuthContext;
+  currentTurnSourceActorPrincipalId?: string;
   getTurnChannelContext(): TurnChannelContext | null;
   getTurnInterfaceContext(): TurnInterfaceContext | null;
 }
@@ -302,6 +306,10 @@ export interface EnqueueMessageOptions {
   displayContent?: string;
   transport?: ConversationTransportMetadata;
   clientMessageId?: string;
+  /** JWT-verified requester principal captured for queued host-proxy routing. */
+  sourceActorPrincipalId?: string;
+  /** Auth context snapshot captured for queued turn-scoped authorization. */
+  authContext?: AuthContext;
 }
 
 // ── enqueueMessage ───────────────────────────────────────────────────
@@ -322,7 +330,14 @@ export function enqueueMessage(
     displayContent,
     transport,
     clientMessageId,
+    authContext,
   } = options;
+  const queuedAuthContext =
+    authContext ?? ctx.currentTurnAuthContext ?? ctx.authContext;
+  const sourceActorPrincipalId =
+    options.sourceActorPrincipalId ??
+    ctx.currentTurnSourceActorPrincipalId ??
+    queuedAuthContext?.actorPrincipalId;
 
   if (!ctx.isProcessing()) {
     return { queued: false, requestId };
@@ -347,6 +362,8 @@ export function enqueueMessage(
     turnChannelContext,
     turnInterfaceContext,
     isInteractive,
+    sourceActorPrincipalId,
+    authContext: queuedAuthContext,
     transport,
     displayContent,
     sentAt: Date.now(),

package/src/daemon/conversation-process.ts

@@ -18,7 +18,6 @@ import {
   type TurnInterfaceContext,
 } from "../channels/types.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
-import type { ContextWindowResult } from "../context/window-manager.js";
 import { listPendingRequestsByConversationScope } from "../memory/canonical-guardian-store.js";
 import {
   addMessage,
@@ -28,6 +27,7 @@ import {
 } from "../memory/conversation-crud.js";
 import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
+import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
 import { routeGuardianReply } from "../runtime/guardian-reply-router.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
@@ -222,6 +222,8 @@ async function buildPassthroughBatch(
     // otherwise diverge.
     if (candIf?.userMessageInterface !== headInterface?.userMessageInterface)
       break;
+    if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId)
+      break;
     if (classifySlash(candidate.content) !== "passthrough") break;
     if (
       resolveVerificationSessionIntent(candidate.content).kind ===
@@ -422,6 +424,9 @@ async function drainSingleMessage(
     conversation.applyClientTimezoneFromTransport(next.transport);
   }
 
+  conversation.currentTurnAuthContext = next.authContext;
+  conversation.currentTurnSourceActorPrincipalId = next.sourceActorPrincipalId;
+
   // Re-attach and re-preactivate host-proxy skills for interactive turns.
   // The dequeue path reset `preactivatedSkillIds` above; without these
   // re-adds the relevant skill tools won't be projected to the LLM for
@@ -433,8 +438,7 @@ async function drainSingleMessage(
     const interfaceCtx =
       queuedInterfaceCtx ?? conversation.getTurnInterfaceContext();
     const sourceInterface = interfaceCtx?.userMessageInterface;
-    const sourceActorPrincipalId =
-      conversation.trustContext?.guardianPrincipalId;
+    const sourceActorPrincipalId = next.sourceActorPrincipalId;
     conversation.ensureHostProxiesForTurn(
       sourceInterface,
       sourceActorPrincipalId,
@@ -979,14 +983,16 @@ async function drainBatch(
     conversation.applyClientTimezoneFromTransport(head.transport);
   }
 
+  conversation.currentTurnAuthContext = head.authContext;
+  conversation.currentTurnSourceActorPrincipalId = head.sourceActorPrincipalId;
+
   // Re-attach and re-preactivate host-proxy skills for interactive turns.
   // Mirrors the single-message path exactly — sourced from `head`.
   if (head.isInteractive !== false) {
     const interfaceCtx =
       queuedInterfaceCtx ?? conversation.getTurnInterfaceContext();
     const sourceInterface = interfaceCtx?.userMessageInterface;
-    const sourceActorPrincipalId =
-      conversation.trustContext?.guardianPrincipalId;
+    const sourceActorPrincipalId = head.sourceActorPrincipalId;
     conversation.ensureHostProxiesForTurn(
       sourceInterface,
       sourceActorPrincipalId,
@@ -1380,6 +1386,9 @@ export async function processMessage(
   // Snapshot persona context at turn start so later tool turns can't pick up
   // a different actor's context if a concurrent request mutates the live fields.
   conversation.currentTurnTrustContext = conversation.trustContext;
+  conversation.currentTurnAuthContext = conversation.authContext;
+  conversation.currentTurnSourceActorPrincipalId =
+    conversation.authContext?.actorPrincipalId;
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
   conversation.currentActiveSurfaceId = activeSurfaceId;

package/src/daemon/conversation-queue-manager.ts

@@ -9,6 +9,7 @@ import type {
   TurnChannelContext,
   TurnInterfaceContext,
 } from "../channels/types.js";
+import type { AuthContext } from "../runtime/auth/types.js";
 import { getLogger } from "../util/logger.js";
 import type {
   ServerMessage,
@@ -30,6 +31,10 @@ export interface QueuedMessage {
   turnInterfaceContext?: TurnInterfaceContext;
   /** When false, the turn has no interactive user and should skip clarification prompts. */
   isInteractive?: boolean;
+  /** Requester identity captured from the verified auth context at enqueue time. */
+  sourceActorPrincipalId?: string;
+  /** Full auth snapshot captured at enqueue time for turn-scoped authorization decisions. */
+  authContext?: AuthContext;
   /** Transport metadata snapshot captured at enqueue time, applied when this message becomes active. */
   transport?: ConversationTransportMetadata;
   /** Original user message text to persist to DB when recording intent stripping produced a different `content`. */
@@ -204,6 +209,9 @@ function estimateItemBytes(item: QueuedMessage): number {
   if (item.transport) {
     bytes += JSON.stringify(item.transport).length * 2;
   }
+  if (item.sourceActorPrincipalId) {
+    bytes += item.sourceActorPrincipalId.length * 2;
+  }
   // Small fixed overhead for metadata, pointers, etc. (not worth
   // measuring precisely — the content/attachment data dominates).
   bytes += 512;