@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/__tests__/schedule-routes.test.ts

@@ -98,7 +98,7 @@ import {
 import { scheduleTask } from "../tasks/task-scheduler.js";
 import { createTask } from "../tasks/task-store.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables(): void {
   const db = getDb();

package/src/__tests__/schedule-store.test.ts

@@ -40,7 +40,7 @@ import {
   updateSchedule,
 } from "../schedule/schedule-store.js";
 
-initializeDb();
+await initializeDb();
 
 /** Access the underlying bun:sqlite Database for raw parameterized queries. */
 function getRawDb(): import("bun:sqlite").Database {

package/src/__tests__/schedule-tools.test.ts

@@ -31,7 +31,7 @@ import { executeScheduleUpdate } from "../tools/schedule/update.js";
 import type { Tool, ToolContext } from "../tools/types.js";
 import { setOverridesForTesting } from "./feature-flag-test-helpers.js";
 
-initializeDb();
+await initializeDb();
 
 function getRawDb(): Database {
   return (getDb() as unknown as { $client: Database }).$client;

package/src/__tests__/scheduler-disk-pressure.test.ts

@@ -94,7 +94,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { createSchedule } from "../schedule/schedule-store.js";
 import { runScheduleOnce } from "../schedule/scheduler.js";
 
-initializeDb();
+await initializeDb();
 
 function rawDb(): import("bun:sqlite").Database {
   return (getDb() as unknown as { $client: import("bun:sqlite").Database })

package/src/__tests__/scheduler-recurrence.test.ts

@@ -60,7 +60,7 @@ import {
 import { startScheduler } from "../schedule/scheduler.js";
 import { createTask } from "../tasks/task-store.js";
 
-initializeDb();
+await initializeDb();
 
 /** Access the underlying bun:sqlite Database for raw parameterized queries. */
 function getRawDb(): import("bun:sqlite").Database {

package/src/__tests__/scheduler-reuse-conversation.test.ts

@@ -92,7 +92,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { createSchedule, getScheduleRuns } from "../schedule/schedule-store.js";
 import { startScheduler } from "../schedule/scheduler.js";
 
-initializeDb();
+await initializeDb();
 
 /** Access the underlying bun:sqlite Database for raw parameterized queries. */
 function getRawDb(): import("bun:sqlite").Database {

package/src/__tests__/scheduler-wake.test.ts

@@ -32,7 +32,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { createSchedule } from "../schedule/schedule-store.js";
 import { startScheduler } from "../schedule/scheduler.js";
 
-initializeDb();
+await initializeDb();
 
 /** Access the underlying bun:sqlite Database for raw parameterized queries. */
 function getRawDb(): import("bun:sqlite").Database {
@@ -103,6 +103,7 @@ describe("scheduler wake mode", () => {
       conversationId: "conv-xyz",
       hint: "Check back on this",
       source: "defer",
+      persistTriggerAsEvent: true,
     });
 
     // AND processMessage is never called (wake mode doesn't use it)

package/src/__tests__/scoped-approval-grants.test.ts

@@ -28,7 +28,7 @@ import {
   computeToolApprovalDigest,
 } from "../security/tool-approval-digest.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables(): void {
   const db = getDb();

package/src/__tests__/scoped-grant-security-matrix.test.ts

@@ -45,7 +45,7 @@ const { consumeScopedApprovalGrantByToolSignature, createScopedApprovalGrant } =
   _internal;
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables(): void {
   const db = getDb();
@@ -229,7 +229,7 @@ describe("security matrix: concurrent consume (CAS)", () => {
 describe("security matrix: persistence and fail-closed behavior", () => {
   beforeEach(() => clearTables());
 
-  test("grants survive DB re-initialization (simulating daemon restart)", () => {
+  test("grants survive DB re-initialization (simulating daemon restart)", async () => {
     const digest = computeToolApprovalDigest("bash", { cmd: "ls" });
 
     // Create a grant
@@ -242,7 +242,7 @@ describe("security matrix: persistence and fail-closed behavior", () => {
     expect(grant.status).toBe("active");
 
     // Re-initialize the DB (simulates daemon restart — the SQLite file persists)
-    initializeDb();
+    await initializeDb();
 
     // The grant should still be consumable after restart
     const result = consumeScopedApprovalGrantByToolSignature({
@@ -254,7 +254,7 @@ describe("security matrix: persistence and fail-closed behavior", () => {
     expect(result.grant!.id).toBe(grant.id);
   });
 
-  test("consumed grants remain consumed after DB re-initialization", () => {
+  test("consumed grants remain consumed after DB re-initialization", async () => {
     const digest = computeToolApprovalDigest("bash", { cmd: "ls" });
 
     createScopedApprovalGrant(
@@ -273,7 +273,7 @@ describe("security matrix: persistence and fail-closed behavior", () => {
     expect(first.ok).toBe(true);
 
     // Re-initialize the DB (simulates daemon restart)
-    initializeDb();
+    await initializeDb();
 
     // The consumed grant must NOT be consumable again after restart
     const second = consumeScopedApprovalGrantByToolSignature({

package/src/__tests__/scrub-corrupted-image-attachments.test.ts

@@ -245,14 +245,6 @@ describe("migrateScrubCorruptedImageAttachments", () => {
       .query(`SELECT COUNT(*) AS count FROM message_attachments`)
       .get() as { count: number };
     expect(linkCount.count).toBe(0);
-
-    // The checkpoint should be set to '1' (completed)
-    const checkpoint = raw
-      .query(
-        `SELECT value FROM memory_checkpoints WHERE key = 'migration_scrub_corrupted_image_attachments_v1'`,
-      )
-      .get() as { value: string } | null;
-    expect(checkpoint?.value).toBe("1");
   });
 
   test("skips non-image MIME types", () => {

package/src/__tests__/secret-routes-platform-proxy.test.ts

@@ -17,6 +17,7 @@ const MANAGED_PROVIDERS = [
   "openai",
   "gemini",
   "fireworks",
+  "together",
 ] as const;
 
 let platformBaseUrlOverride: string | undefined;

package/src/__tests__/send-endpoint-busy.test.ts

@@ -127,7 +127,7 @@ import { RuntimeHttpServer } from "../runtime/http-server.js";
 import type { ApprovalConversationGenerator } from "../runtime/http-types.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Conversation helpers

package/src/__tests__/sequence-store.test.ts

@@ -29,7 +29,7 @@ import {
 } from "../sequence/store.js";
 import type { SequenceStep } from "../sequence/types.js";
 
-initializeDb();
+await initializeDb();
 
 function clearTables() {
   const db = getDb();

package/src/__tests__/server-history-render.test.ts

@@ -17,7 +17,7 @@ import {
 import { addMessage, createConversation } from "../memory/conversation-crud.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
-initializeDb();
+await initializeDb();
 
 describe("renderHistoryContent", () => {
   test("renders text-only content unchanged", () => {
@@ -751,6 +751,45 @@ describe("renderHistoryContent", () => {
     expect(output.textSegments).toEqual([]);
     expect(output.contentOrder).toEqual([]);
   });
+
+  test("keeps a flagged surface-fallback text block in .text but out of blocks/segments", () => {
+    // The approval-card builder emits [ui_surface, text(_surfaceFallback)]. The
+    // surface renders the card for rich clients; the flagged fallback must stay
+    // in the flat `.text` body (CLI/search) but NOT appear as a text segment or
+    // content block, or the card would render twice.
+    const output = renderHistoryContent([
+      {
+        type: "ui_surface",
+        surfaceId: "tool-approval-1",
+        surfaceType: "card",
+        title: "Tool Approval",
+        data: { title: "Bob" },
+      },
+      { type: "text", text: "Bob wants to use bash", _surfaceFallback: true },
+    ]);
+
+    expect(output.text).toBe("Bob wants to use bash");
+    expect(output.textSegments).toEqual([]);
+    expect(output.surfaces).toHaveLength(1);
+    expect(output.contentOrder).toEqual(["surface:0"]);
+    expect(output.contentBlocks.map((b) => b.type)).toEqual(["surface"]);
+  });
+
+  test("renders an unflagged text block after a surface (legacy [ui_surface, text])", () => {
+    // Pre-flag rows carry no `_surfaceFallback`, so the sibling text still
+    // renders as its own block — legacy cards keep their duplicate text until
+    // re-seeded. New rows carry the flag and de-dupe.
+    const output = renderHistoryContent([
+      { type: "ui_surface", surfaceId: "s1", surfaceType: "card", data: {} },
+      { type: "text", text: "legacy fallback" },
+    ]);
+
+    expect(output.contentBlocks.map((b) => b.type)).toEqual([
+      "surface",
+      "text",
+    ]);
+    expect(output.text).toBe("legacy fallback");
+  });
 });
 
 describe("renderHistoryContent contentBlocks", () => {

package/src/__tests__/settings-routes.test.ts

@@ -24,7 +24,7 @@ import { ROUTES } from "../runtime/routes/settings-routes.js";
 import type { RouteHandlerArgs } from "../runtime/routes/types.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
-initializeDb();
+await initializeDb();
 
 const testWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR!;
 
@@ -146,23 +146,24 @@ describe("GET /workspace-files/read", () => {
       "utf-8",
     );
 
-    const result = (await handler(
-      makeArgs({ path: "users/alice.md" }),
-    )) as { path: string; content: string };
+    const result = (await handler(makeArgs({ path: "users/alice.md" }))) as {
+      path: string;
+      content: string;
+    };
     expect(result.path).toBe("users/alice.md");
     expect(result.content).toBe(readFileSync(personaPath, "utf-8"));
     expect(result.content).toContain("Preferred name/reference: Alice");
   });
 
   test("rejects path traversal attempts via users/", async () => {
-    expect(() =>
-      handler(makeArgs({ path: "users/../../etc/passwd" })),
-    ).toThrow(BadRequestError);
+    expect(() => handler(makeArgs({ path: "users/../../etc/passwd" }))).toThrow(
+      BadRequestError,
+    );
   });
 
   test("returns 404 for a non-existent users/<slug>.md", async () => {
-    expect(() =>
-      handler(makeArgs({ path: "users/nobody.md" })),
-    ).toThrow(NotFoundError);
+    expect(() => handler(makeArgs({ path: "users/nobody.md" }))).toThrow(
+      NotFoundError,
+    );
   });
 });

package/src/__tests__/skill-load-tool.test.ts

@@ -100,6 +100,21 @@ async function executeSkillLoad(
   return { content: result.content, isError: result.isError };
 }
 
+async function executeSkillLoadCleanup(
+  input: Record<string, unknown>,
+): Promise<{ content: string; isError: boolean }> {
+  const tool = getTool("skill_load");
+  if (!tool) throw new Error("skill_load tool was not registered");
+
+  const result = await tool.execute(input, {
+    workingDir: "/tmp",
+    conversationId: "conversation-1",
+    trustClass: "guardian",
+    diskPressureCleanupModeActive: true,
+  });
+  return { content: result.content, isError: result.isError };
+}
+
 describe("skill_load tool", () => {
   beforeEach(() => {
     mkdirSync(join(TEST_DIR, "skills"), { recursive: true });
@@ -911,4 +926,61 @@ describe("skill_load tool", () => {
     expect(result.content).toContain("Suggested Included Skills (not loaded):");
     expect(installCount).toBeLessThanOrEqual(5);
   });
+
+  // During disk-pressure cleanup mode, skill_load is allowed but must not
+  // produce side effects: no catalog auto-install (workspace writes / bun
+  // install) and no inline command execution. Instructions are still returned.
+  test("does not auto-install a missing catalog skill during cleanup mode", async () => {
+    mockAutoInstall.mockImplementation((skillId: string) => {
+      writeSkill(skillId, "Should Not Install", "nope", "body");
+      return Promise.resolve(true);
+    });
+
+    const result = await executeSkillLoadCleanup({ skill: "absent-skill" });
+
+    expect(mockAutoInstall).not.toHaveBeenCalled();
+    expect(result.isError).toBe(true);
+  });
+
+  test("does not auto-install missing includes during cleanup mode", async () => {
+    writeSkillWithIncludes(
+      "cleanup-parent",
+      "Cleanup Parent",
+      "Has a missing include",
+      "Parent body",
+      ["cleanup-dep"],
+    );
+    mockAutoInstall.mockImplementation((skillId: string) => {
+      writeSkill(skillId, "Cleanup Dep", "should not install", "Dep body");
+      return Promise.resolve(true);
+    });
+
+    const result = await executeSkillLoadCleanup({ skill: "cleanup-parent" });
+
+    expect(mockAutoInstall).not.toHaveBeenCalled();
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Cleanup Parent");
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
+    expect(result.content).toContain("cleanup-dep");
+  });
+
+  test("strips inline command tokens instead of executing them during cleanup mode", async () => {
+    writeSkill(
+      "cleanup-inline",
+      "Cleanup Inline",
+      "Has an inline command",
+      "Before !`echo SENTINEL_OUTPUT` after",
+    );
+
+    const result = await executeSkillLoadCleanup({ skill: "cleanup-inline" });
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain(
+      "[inline command skipped: storage cleanup mode]",
+    );
+    expect(result.content).not.toContain("SENTINEL_OUTPUT");
+    expect(result.content).not.toContain("!`echo SENTINEL_OUTPUT`");
+    expect(result.content).toContain("Before");
+    expect(result.content).toContain("after");
+  });
 });

package/src/__tests__/slack-inbound-verification.test.ts

@@ -61,7 +61,7 @@ import { findActiveSession } from "../runtime/channel-verification-service.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -71,7 +71,6 @@ const TEST_BEARER_TOKEN = "test-token";
 
 function resetState(): void {
   const db = getDb();
-  db.run("DELETE FROM channel_guardian_approval_requests");
   db.run("DELETE FROM channel_verification_sessions");
   db.run("DELETE FROM channel_guardian_rate_limits");
   db.run("DELETE FROM channel_inbound_events");
@@ -256,5 +255,4 @@ describe("Slack inbound trusted contact verification", () => {
 
     // No Slack DM was sent
   });
-
 });

package/src/__tests__/slack-messaging-token-resolution.test.ts

@@ -50,8 +50,11 @@ mock.module("../runtime/auth/token-service.js", () => ({}));
 // Slack client stubs (not exercised in these tests, but required on import)
 mock.module("../messaging/providers/slack/client.js", () => ({}));
 
-// Gmail client stubs
-mock.module("../messaging/providers/gmail/client.js", () => ({}));
+// Gmail client stubs. Re-export GMAIL_REQUIRED_SCOPES so the adapter's
+// `requiredScopes` is populated (and the forwarding assertion below is real).
+mock.module("../messaging/providers/gmail/client.js", () => ({
+  GMAIL_REQUIRED_SCOPES: ["https://www.googleapis.com/auth/gmail.readonly"],
+}));
 mock.module("../messaging/providers/gmail/people-client.js", () => ({}));
 
 // Telegram client stubs
@@ -244,8 +247,16 @@ describe("Slack messaging token resolution", () => {
 
       const result = await getProviderConnection(gmailMessagingProvider);
       expect(result).toBe(oauthConn);
+      // Gmail forwards its requiredScopes so a narrowly-scoped (e.g.
+      // Calendar-only) Google connection is rejected at resolution time
+      // instead of 403-ing on the first Gmail API call. Asserted as a concrete
+      // value (not the provider property) so removing the forwarding fails.
+      expect(gmailMessagingProvider.requiredScopes).toEqual([
+        "https://www.googleapis.com/auth/gmail.readonly",
+      ]);
       expect(resolveOAuthConnectionMock).toHaveBeenCalledWith("google", {
         account: undefined,
+        requiredScopes: ["https://www.googleapis.com/auth/gmail.readonly"],
       });
     });
   });

package/src/__tests__/slack-reaction-canonical-approval.test.ts

@@ -37,7 +37,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { routeGuardianReply } from "../runtime/guardian-reply-router.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Constants & helpers

package/src/__tests__/subagent-tool-gate-mode.test.ts

@@ -12,10 +12,7 @@
  *   non-allowlisted tool returns an error tool_result WITHOUT invoking the
  *   tool's executor (safety invariant), while allowlisted calls execute
  *   normally. The gate also covers the `skill_execute` indirection by
- *   gating the resolved inner tool name, and runs BEFORE every in-executor
- *   interception — including `switch_inference_profile`, which must not be
- *   able to switch `ctx.toolRoutedProfile` mid-wake (allowlist bypass +
- *   per-model prompt-cache parity break).
+ *   gating the resolved inner tool name.
  */
 
 import { describe, expect, mock, test } from "bun:test";
@@ -46,6 +43,7 @@ const baseConfig = {
 
 mock.module("../config/loader.js", () => ({
   getConfig: () => baseConfig,
+  getConfigReadOnly: () => baseConfig,
   loadConfig: () => baseConfig,
   invalidateConfigCache: () => {},
   loadRawConfig: () => ({}),
@@ -442,75 +440,6 @@ describe("createToolExecutor — execution-layer allowlist gate", () => {
     expect(calls).toHaveLength(0);
   });
 
-  test("execution mode: switch_inference_profile is rejected BEFORE its interception runs", async () => {
-    const { executor, calls } = makeCapturingExecutor();
-    const ctx = makeSetupCtx({
-      subagentAllowedTools: new Set(["remember"]),
-      subagentToolGateMode: "execution",
-    });
-    const toolFn = makeToolFn(executor, ctx);
-
-    const result = await toolFn("switch_inference_profile", {
-      profile: "speedy",
-    });
-
-    // The gate must fire before the interception: the rejection tool_result
-    // comes back (NOT the interception's "Switched to ..." / "not found"
-    // responses) and the routed profile is untouched — switching it mid-wake
-    // would bypass the allowlist and break per-model prompt-cache parity.
-    expect(result).toEqual({
-      content: "This background pass may only use: remember.",
-      isError: true,
-    });
-    expect(ctx.toolRoutedProfile).toBeUndefined();
-    expect(calls).toHaveLength(0);
-  });
-
-  test("switch_inference_profile interception still works when the gate is inert (regression)", async () => {
-    // No execution-mode allowlist (wire mode) — the interception must keep
-    // its historical behavior: switch the routed profile without ever
-    // touching the tool executor pipeline.
-    const { executor, calls } = makeCapturingExecutor();
-    const ctx = makeSetupCtx({
-      subagentAllowedTools: new Set(["remember"]),
-      subagentToolGateMode: "wire",
-    });
-    const toolFn = makeToolFn(executor, ctx);
-
-    const result = await toolFn("switch_inference_profile", {
-      profile: "speedy",
-    });
-
-    expect(result).toEqual({
-      content: "Switched to Speedy profile. Continue with your response.",
-      isError: false,
-    });
-    expect(ctx.toolRoutedProfile).toBe("speedy");
-    expect(calls).toHaveLength(0);
-  });
-
-  test("execution mode: allowlisted switch_inference_profile still reaches the interception", async () => {
-    // When the orchestrator explicitly allowlists the routing tool, the gate
-    // passes and the interception behaves normally.
-    const { executor, calls } = makeCapturingExecutor();
-    const ctx = makeSetupCtx({
-      subagentAllowedTools: new Set(["remember", "switch_inference_profile"]),
-      subagentToolGateMode: "execution",
-    });
-    const toolFn = makeToolFn(executor, ctx);
-
-    const result = await toolFn("switch_inference_profile", {
-      profile: "speedy",
-    });
-
-    expect(result).toEqual({
-      content: "Switched to Speedy profile. Continue with your response.",
-      isError: false,
-    });
-    expect(ctx.toolRoutedProfile).toBe("speedy");
-    expect(calls).toHaveLength(0);
-  });
-
   test("wire mode (and absent mode) leaves the executor path unchanged (regression)", async () => {
     // In wire mode the allowlist is enforced by filtering the wire defs (and
     // by the executor pipeline's own allowedToolNames gate) — the new

package/src/__tests__/subagent-tools.test.ts

@@ -556,7 +556,7 @@ describe("Subagent spawn success and failure", () => {
       );
 
       expect(result.isError).toBe(false);
-      // The live per-turn override (per-conversation or tool-routed) wins over
+      // The live per-turn override wins over
       // the call-site default, and is forwarded non-forced.
       expect(capturedConfig!.overrideProfile).toBe("quality-optimized");
       expect(capturedConfig!.forceOverrideProfile).toBeUndefined();
@@ -565,36 +565,6 @@ describe("Subagent spawn success and failure", () => {
     }
   });
 
-  test("spawn skips the auto profile so the child keeps its own default", async () => {
-    const manager = getSubagentManager();
-    const originalSpawn = manager.spawn.bind(manager);
-    let capturedConfig: Record<string, unknown> | undefined;
-
-    manager.spawn = async (config: Record<string, unknown>) => {
-      capturedConfig = config;
-      return "inherit-auto-id";
-    };
-
-    try {
-      const result = await executeSubagentSpawn(
-        { label: "Auto child", objective: "Do it" },
-        makeContext("sess-inherit-auto", {
-          sendToClient: () => {},
-          invokingCallSite: "mainAgent",
-          // "auto" is metadata-only; forwarding it would collapse the child to
-          // llm.default, so the inherited path drops it and the child keeps its
-          // own subagentSpawn default.
-          overrideProfile: "auto",
-        }),
-      );
-
-      expect(result.isError).toBe(false);
-      expect(capturedConfig!.overrideProfile).toBeUndefined();
-    } finally {
-      manager.spawn = originalSpawn;
-    }
-  });
-
   test("spawn still forces an explicit inference_profile over the invoker default", async () => {
     const manager = getSubagentManager();
     const originalSpawn = manager.spawn.bind(manager);

package/src/__tests__/system-prompt.test.ts

@@ -1296,7 +1296,7 @@ describe("buildSystemPrompt", () => {
         mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
         const result = buildSystemPrompt();
         expect(result).toContain("## Sending Files to the User");
-        expect(result).toContain("<vellum-attachment");
+        expect(result).toContain("vellum://");
       });
     });
 

package/src/__tests__/system-storage-cleanup-skill.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import { loadSkillBySelector, loadSkillCatalog } from "../config/skills.js";
+
+describe("system-storage-cleanup bundled skill", () => {
+  test("is bundled without tools or inline command expansions", () => {
+    const catalog = loadSkillCatalog();
+    const skill = catalog.find(
+      (candidate) => candidate.id === "system-storage-cleanup",
+    );
+
+    expect(skill).toBeDefined();
+    expect(skill!.source).toBe("bundled");
+    expect(skill!.bundled).toBe(true);
+    expect(skill!.toolManifest).toBeUndefined();
+    expect(skill!.inlineCommandExpansions).toBeUndefined();
+  });
+
+  test("loads by id with the cleanup safety contract", () => {
+    const result = loadSkillBySelector("system-storage-cleanup");
+
+    expect(result.error).toBeUndefined();
+    expect(result.skill).toBeDefined();
+    expect(result.skill!.id).toBe("system-storage-cleanup");
+    expect(result.skill!.source).toBe("bundled");
+
+    const body = result.skill!.body.toLowerCase();
+
+    expect(body).toContain("normal work is suspended");
+    expect(body).toContain("stay scoped to freeing storage");
+    expect(body).toContain("prefer foreground inspection");
+    expect(body).toContain("before any mutation");
+    expect(body).toContain("ask for explicit approval before deleting");
+    expect(body).toContain("target volume");
+    expect(body).toContain("workspace path");
+    expect(body).toContain("read-only `sqlite3` access");
+    expect(body).toContain("never run ad hoc `delete`");
+    expect(body).toContain("`vacuum`");
+    expect(body).toContain("mutating sqlite command");
+
+    for (const protectedText of [
+      "credentials",
+      "security material",
+      "workspace database files",
+      "config files",
+      "backups",
+      "backup keys",
+      "memory graph nodes or segments",
+      "`journal/`",
+      "`data/reflections/`",
+      "pkb files",
+    ]) {
+      expect(body).toContain(protectedText);
+    }
+  });
+});

package/src/__tests__/task-compiler.test.ts

@@ -30,7 +30,7 @@ import {
 import { renderTemplate } from "../tasks/task-runner.js";
 import { getTask } from "../tasks/task-store.js";
 
-initializeDb();
+await initializeDb();
 
 // ── Helpers ──────────────────────────────────────────────────────────
 

package/src/__tests__/task-management-tools.test.ts

@@ -57,7 +57,7 @@ import {
   updateWorkItem,
 } from "../work-items/work-item-store.js";
 
-initializeDb();
+await initializeDb();
 
 const ctx: ToolContext = {
   workingDir: "/tmp",