@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/__tests__/workspace-migrations-runner.test.ts

@@ -123,6 +123,61 @@ describe("runWorkspaceMigrations", () => {
     expect(m2.run).toHaveBeenCalledTimes(1);
   });
 
+  test("logs a start line and returns applied/skipped/failed counts", async () => {
+    // One already applied, one new — exercises both applied and skipped counts.
+    mockCheckpointContents = JSON.stringify({
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "completed" },
+      },
+    });
+
+    const m1 = makeMigration("001");
+    const m2 = makeMigration("002");
+
+    const summary = await runWorkspaceMigrations(WORKSPACE_DIR, [m1, m2]);
+
+    // One info log before all migrations, naming how many are registered.
+    expect(logInfoFn).toHaveBeenCalledWith(
+      "Running workspace migrations (2 registered)",
+    );
+
+    // One info log for the new migration that actually ran.
+    expect(logInfoFn).toHaveBeenCalledWith(
+      expect.stringContaining("Running workspace migration: 002"),
+    );
+
+    // Counts are returned for the caller to fold into its own startup log —
+    // the runner no longer emits a standalone summary line.
+    expect(summary).toEqual({ applied: 1, skipped: 1, failed: 0 });
+  });
+
+  test("counts a migration that throws as failed, not applied", async () => {
+    const m1 = makeMigration("001");
+    const m2 = makeMigration("002");
+    (m2.run as ReturnType<typeof mock>).mockImplementation(() => {
+      throw new Error("boom");
+    });
+
+    const summary = await runWorkspaceMigrations(WORKSPACE_DIR, [m1, m2]);
+
+    expect(summary).toEqual({ applied: 1, skipped: 0, failed: 1 });
+  });
+
+  test("counts a pre-existing failed checkpoint as failed, not skipped", async () => {
+    mockCheckpointContents = JSON.stringify({
+      applied: {
+        "001": { appliedAt: "2025-01-01T00:00:00.000Z", status: "failed" },
+      },
+    });
+
+    const m1 = makeMigration("001");
+    const summary = await runWorkspaceMigrations(WORKSPACE_DIR, [m1]);
+
+    // Non-retryable failed checkpoint: not re-run, surfaced as failed.
+    expect(m1.run).not.toHaveBeenCalled();
+    expect(summary).toEqual({ applied: 0, skipped: 0, failed: 1 });
+  });
+
   test("writes checkpoint after each migration", async () => {
     const m1 = makeMigration("001");
     const m2 = makeMigration("002");

package/src/a2a/__tests__/e2e-a2a-channel.test.ts

@@ -68,7 +68,7 @@ import {
   updateState,
 } from "../task-store.js";
 
-initializeDb();
+await initializeDb();
 
 // ---------------------------------------------------------------------------
 // Global fetch intercept

package/src/a2a/__tests__/task-store.test.ts

@@ -21,7 +21,7 @@ import {
   updateState,
 } from "../task-store.js";
 
-initializeDb();
+await initializeDb();
 
 function makeRequestMessage(overrides?: Partial<A2AMessage>): A2AMessage {
   return {

package/src/acp/__tests__/session-manager-persistence.test.ts

@@ -28,7 +28,7 @@ import {
   insertHistoryRow,
   readHistoryRow,
 } from "./helpers/acp-history-db.js";
-initializeDb();
+await initializeDb();
 
 /**
  * Builds a manager with a fake session pre-injected and returns the handles

package/src/acp/__tests__/session-manager-resume.test.ts

@@ -177,8 +177,11 @@ mock.module("../resolve-agent.js", () => ({
 import { installExecFileStub } from "./helpers/exec-file-stub.js";
 import { installWhichStub } from "./helpers/which-stub.js";
 
-const { execScripts, execFileMock, reset: resetExecStub } =
-  installExecFileStub();
+const {
+  execScripts,
+  execFileMock,
+  reset: resetExecStub,
+} = installExecFileStub();
 const which = installWhichStub();
 /** Fixed resolved `bun` path so install script keys are predictable. */
 const BUN_BIN = "/usr/local/bin/bun";
@@ -200,9 +203,10 @@ const { AcpResumeError, AcpSessionManager, AcpSessionNotFoundError } =
   await import("../session-manager.js");
 // Imported dynamically (after the exec/which stubs above) so auto-install.js
 // binds to the mocked node:child_process, exactly like session-manager.js.
-const { _resetAdapterInstallCacheForTests } = await import("../auto-install.js");
+const { _resetAdapterInstallCacheForTests } =
+  await import("../auto-install.js");
 
-initializeDb();
+await initializeDb();
 
 function countHistoryRows(): number {
   const row = getSqlite()
@@ -400,9 +404,9 @@ describe("AcpSessionManager.resumeFromHistory", () => {
       { sessionId: "proto-old", cwd: "/tmp/proj" },
     ]);
     // The SessionEntry command is the basename (resume hints gate on it).
-    expect(
-      internals(manager).sessions.get("installed-resume-1")!.command,
-    ).toBe("claude-agent-acp");
+    expect(internals(manager).sessions.get("installed-resume-1")!.command).toBe(
+      "claude-agent-acp",
+    );
   });
 
   test("missing adapter on resume: installs via sandboxed bun, then resumes against the real binary", async () => {
@@ -481,7 +485,9 @@ describe("AcpSessionManager.resumeFromHistory", () => {
 
     // prepareAgentEnv ran AFTER resolution, on the resolved real binary, and
     // injected the token at spawn time — the sole point the token is in scope.
-    expect(prepareAgentEnvCommands).toEqual(["/usr/local/bin/claude-agent-acp"]);
+    expect(prepareAgentEnvCommands).toEqual([
+      "/usr/local/bin/claude-agent-acp",
+    ]);
     expect(fake.config.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("should-not-leak");
   });
 
@@ -498,7 +504,10 @@ describe("AcpSessionManager.resumeFromHistory", () => {
     execScripts.set(BUN_ADD_KEY, { error: new Error("network is down") });
 
     const manager = new AcpSessionManager(4);
-    const promise = manager.resumeFromHistory("resume-install-fail-1", () => {});
+    const promise = manager.resumeFromHistory(
+      "resume-install-fail-1",
+      () => {},
+    );
     await expect(promise).rejects.toThrow(/claude-agent-acp is not on PATH/);
     await expect(promise).rejects.toThrow(
       /auto-install failed: .*network is down/,
@@ -819,8 +828,10 @@ describe("AcpSessionManager.steerOrResume", () => {
 
     const manager = new AcpSessionManager(4);
     const sent: ServerMessage[] = [];
-    const first = manager.steerOrResume("sor-init-1", "first instruction", (msg) =>
-      sent.push(msg),
+    const first = manager.steerOrResume(
+      "sor-init-1",
+      "first instruction",
+      (msg) => sent.push(msg),
     );
 
     // Advance microtasks until the first call's resume has registered its

package/src/acp/__tests__/session-manager-startup.test.ts

@@ -17,7 +17,7 @@ mock.module("../../util/logger.js", () => ({
 import { AcpSessionManager } from "../../acp/session-manager.js";
 import { getSqlite } from "../../memory/db-connection.js";
 import { initializeDb } from "../../memory/db-init.js";
-initializeDb();
+await initializeDb();
 
 function clearHistory() {
   getSqlite().run("DELETE FROM acp_session_history");

package/src/acp/__tests__/session-manager.test.ts

@@ -8,6 +8,10 @@ import { describe, expect, mock, test } from "bun:test";
 
 import type { AcpSessionState } from "../types.js";
 
+// Records every `cancel(protocolSessionId)` the manager dispatches to a fake
+// process, so tests can assert which sessions were cancelled.
+const cancelCalls: string[] = [];
+
 // Stub the agent-process module so spawn() does not actually launch a child
 // process. Each fake instance records the cwd it was spawned in and resolves
 // every protocol method synchronously. The mock is process-global (Bun's
@@ -30,7 +34,9 @@ mock.module("../agent-process.js", () => ({
       // the duration of the test so cleanup logic doesn't tear it down.
       return new Promise(() => {});
     }
-    async cancel(): Promise<void> {}
+    async cancel(sessionId: string): Promise<void> {
+      cancelCalls.push(sessionId);
+    }
     kill(): void {}
   },
 }));
@@ -81,3 +87,68 @@ describe("AcpSessionManager — parentConversationId population", () => {
     expect(parents).toEqual(["conv-parent-1", "conv-parent-2"]);
   });
 });
+
+describe("AcpSessionManager — cancelForParent", () => {
+  const noopSend = () => {};
+
+  test("cancels only the sessions spawned by the given parent", async () => {
+    cancelCalls.length = 0;
+    const manager = new AcpSessionManager(5);
+
+    const a1 = await manager.spawn(
+      "agent-a1",
+      { command: "echo", args: ["hi"] },
+      "task",
+      "/tmp",
+      "parent-A",
+      noopSend,
+    );
+    const a2 = await manager.spawn(
+      "agent-a2",
+      { command: "echo", args: ["hi"] },
+      "task",
+      "/tmp",
+      "parent-A",
+      noopSend,
+    );
+    const b1 = await manager.spawn(
+      "agent-b1",
+      { command: "echo", args: ["hi"] },
+      "task",
+      "/tmp",
+      "parent-B",
+      noopSend,
+    );
+
+    // WHEN parent-A is cancelled
+    const count = manager.cancelForParent("parent-A");
+
+    // THEN it reports the two parent-A sessions and leaves parent-B alone
+    expect(count).toBe(2);
+
+    // Let the detached per-session cancels settle (each awaits a protocol
+    // notification before flipping status).
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect((manager.getStatus(a1.acpSessionId) as AcpSessionState).status).toBe(
+      "cancelled",
+    );
+    expect((manager.getStatus(a2.acpSessionId) as AcpSessionState).status).toBe(
+      "cancelled",
+    );
+    expect((manager.getStatus(b1.acpSessionId) as AcpSessionState).status).toBe(
+      "running",
+    );
+
+    // AND the cancel reached each parent-A agent process exactly once.
+    expect(cancelCalls.sort()).toEqual(["proto-agent-a1", "proto-agent-a2"]);
+  });
+
+  test("returns 0 and dispatches nothing when the parent has no sessions", () => {
+    cancelCalls.length = 0;
+    const manager = new AcpSessionManager(5);
+
+    expect(manager.cancelForParent("parent-with-nothing")).toBe(0);
+    expect(cancelCalls).toEqual([]);
+  });
+});

package/src/acp/index.ts

@@ -18,6 +18,16 @@ export function getAcpSessionManager(): AcpSessionManager {
   return manager;
 }
 
+/**
+ * Returns the existing AcpSessionManager singleton, or null when none has been
+ * created yet. Use this on cleanup hot paths (e.g. cancelling a conversation)
+ * that must not spin up a manager just to discover there are no sessions to
+ * act on.
+ */
+export function peekAcpSessionManager(): AcpSessionManager | null {
+  return manager;
+}
+
 /**
  * Disposes the singleton AcpSessionManager and nulls the reference.
  */

package/src/acp/session-manager.ts

@@ -691,6 +691,41 @@ export class AcpSessionManager {
     }
   }
 
+  /**
+   * Cancels every in-flight session spawned by `parentConversationId`.
+   *
+   * Mirrors the subagent manager's `abortAllForParent`: when the user cancels
+   * a turn, the ACP agents it launched should stop rather than keep running in
+   * the background — holding a child process — and then, on completion, enqueue
+   * a follow-up message into the conversation the user just stopped. Cancelling
+   * settles each in-flight prompt down its `"cancelled"` path, which sends a
+   * client event but does NOT notify the parent, so no model activity follows
+   * the stop.
+   *
+   * Each session's `cancel()` runs detached (it awaits a protocol notification
+   * to the child) so callers on the cancel hot path never block on an
+   * unresponsive agent; failures are logged. Session ids are snapshotted before
+   * dispatch so concurrent teardown can't disturb the iteration. Returns the
+   * number of sessions a cancel was kicked off for.
+   */
+  cancelForParent(parentConversationId: string): number {
+    const ids: string[] = [];
+    for (const [acpSessionId, entry] of this.sessions) {
+      if (entry.parentConversationId === parentConversationId) {
+        ids.push(acpSessionId);
+      }
+    }
+    for (const acpSessionId of ids) {
+      void this.cancel(acpSessionId).catch((err) => {
+        log.warn(
+          { acpSessionId, parentConversationId, err },
+          "Failed to cancel ACP session on parent cancel",
+        );
+      });
+    }
+    return ids.length;
+  }
+
   /**
    * Kills the agent process and removes the session from tracking.
    *

package/src/agent/loop.ts

@@ -391,6 +391,17 @@ export type AgentEvent =
        */
       type: "agent_loop_exit";
       reason: AgentLoopExitReason;
+    }
+  | {
+      /**
+       * Emitted when the `pre-model-call` hook chain mutates the system
+       * prompt for the current call — i.e. `finalPreModelCtx.systemPrompt`
+       * differs from the value the loop handed the hook. Carries the
+       * post-hook string so consumers can observe exactly what the provider
+       * received.
+       */
+      type: "system_prompt_changed";
+      systemPrompt: string;
     };
 
 const DEFAULT_CONFIG: AgentLoopConfig = {
@@ -482,12 +493,6 @@ export function shouldCaptureAgentLoopError(err: Error): boolean {
   return true;
 }
 
-export interface ResolvedSystemPrompt {
-  systemPrompt: string;
-  maxTokens?: number;
-  model?: string;
-}
-
 export interface AgentLoopRunOptions {
   /** Input history the run starts from; the loop appends its output onto a copy. */
   messages: Message[];
@@ -495,6 +500,12 @@ export interface AgentLoopRunOptions {
   onEvent: (event: AgentEvent) => void | Promise<void>;
   signal?: AbortSignal;
   requestId: string;
+  /**
+   * Explicit model override (provider/model string) for every LLM call in
+   * this run. When omitted, the model is resolved through the normal
+   * call-site / profile resolution path.
+   */
+  model?: string;
   onCheckpoint?: (
     checkpoint: CheckpointInfo,
   ) => CheckpointDecision | Promise<CheckpointDecision>;
@@ -623,7 +634,6 @@ export interface AgentLoopConstructorOptions {
   tools?: ToolDefinition[];
   toolExecutor?: LoopToolExecutor;
   resolveTools?: (history: Message[]) => ToolDefinition[];
-  resolveSystemPrompt?: (history: Message[]) => ResolvedSystemPrompt;
   /**
    * Conversation this loop drives. Scopes the loop-held compaction circuit
    * breaker and is the source of truth the loop's pipeline contexts and
@@ -648,9 +658,6 @@ export class AgentLoop {
   private config: AgentLoopConfig;
   private tools: ToolDefinition[];
   private resolveTools: ((history: Message[]) => ToolDefinition[]) | null;
-  private resolveSystemPrompt:
-    | ((history: Message[]) => ResolvedSystemPrompt)
-    | null;
   private toolExecutor: LoopToolExecutor | null;
 
   /**
@@ -681,7 +688,6 @@ export class AgentLoop {
       tools,
       toolExecutor,
       resolveTools,
-      resolveSystemPrompt,
       conversationId,
       resolveConversationDir,
     } = options;
@@ -690,7 +696,6 @@ export class AgentLoop {
     this.config = { ...DEFAULT_CONFIG, ...config };
     this.tools = tools ?? [];
     this.resolveTools = resolveTools ?? null;
-    this.resolveSystemPrompt = resolveSystemPrompt ?? null;
     this.toolExecutor = toolExecutor ?? null;
     this.conversationId = conversationId;
     this.resolveConversationDir = resolveConversationDir ?? null;
@@ -899,7 +904,14 @@ export class AgentLoop {
       compactInPlace = false,
       isNonInteractive = false,
       modelProfileKey = null,
+      model: runModel,
     } = options;
+    // Snapshot the system prompt once per run. The instance field is mutable
+    // (the conversation may update it between turns), but a single run must
+    // use one consistent prompt — an aborted run left detached after the
+    // watchdog rejects must not pick up a later turn's prompt on its next
+    // provider call.
+    const runSystemPrompt = this.systemPrompt;
     let history = [...messages];
     // Index into `history` where this run's appended output begins. It starts
     // after the input and resets to the new base whenever the loop rewrites the
@@ -1207,15 +1219,8 @@ export class AgentLoop {
           ? this.resolveTools(history)
           : this.tools;
 
-        // Resolve system prompt, per-turn maxTokens, and model
-        const resolved = this.resolveSystemPrompt
-          ? this.resolveSystemPrompt(history)
-          : null;
-        const turnSystemPrompt = resolved?.systemPrompt ?? this.systemPrompt;
-        const turnModel = resolved?.model;
-
         // Field precedence (highest wins):
-        //   1. Per-turn explicit (`resolved.maxTokens` / `resolved.model`)
+        //   1. Per-run explicit (`runModel`)
         //   2. Call-site resolved values (filled by
         //      `RetryProvider.normalizeSendMessageOptions` from
         //      `resolveCallSiteConfig(callSite, llm)`)
@@ -1233,14 +1238,12 @@ export class AgentLoop {
         // they always come from `this.config` regardless of `callSite`.
         const providerConfig: Record<string, unknown> = {};
 
-        if (resolved?.maxTokens !== undefined) {
-          providerConfig.max_tokens = resolved.maxTokens;
-        } else if (!callSite) {
+        if (!callSite) {
           providerConfig.max_tokens = this.config.maxTokens;
         }
 
-        if (turnModel) {
-          providerConfig.model = turnModel;
+        if (runModel) {
+          providerConfig.model = runModel;
         }
 
         if (!callSite) {
@@ -1334,7 +1337,7 @@ export class AgentLoop {
           currentTools.length > 0 ? estimateToolsTokens(currentTools) : 0;
         const preSendEstimatedTokens = estimatePromptTokensRaw(
           history,
-          turnSystemPrompt,
+          runSystemPrompt,
           {
             providerName: getCalibrationProviderKey(this.provider),
             toolTokenBudget,
@@ -1366,7 +1369,7 @@ export class AgentLoop {
         // type through unchanged.
         const providerOptions: SendMessageOptions = {
           tools: currentTools.length > 0 ? currentTools : undefined,
-          systemPrompt: turnSystemPrompt,
+          systemPrompt: runSystemPrompt,
           config: providerConfig,
           onEvent: (event) => {
             if (event.type === "text_delta") {
@@ -1447,6 +1450,21 @@ export class AgentLoop {
             HOOKS.PRE_MODEL_CALL,
             preModelCtx,
           );
+          // Emit a changed event when the hook mutated the prompt. Compare
+          // against the pre-hook value from providerOptions, not
+          // preModelCtx — the hook may mutate the context object in place,
+          // which would make preModelCtx.systemPrompt already reflect the
+          // change and hide the diff.
+          const preHookSystemPrompt = providerOptions.systemPrompt ?? null;
+          if (
+            typeof finalPreModelCtx.systemPrompt === "string" &&
+            finalPreModelCtx.systemPrompt !== preHookSystemPrompt
+          ) {
+            await onEvent({
+              type: "system_prompt_changed",
+              systemPrompt: finalPreModelCtx.systemPrompt,
+            });
+          }
           providerOptions.systemPrompt =
             finalPreModelCtx.systemPrompt ?? undefined;
           // Route this call to the hook's chosen inference profile. The

package/src/api/index.ts

@@ -44,7 +44,6 @@ import { ToolResultEventSchema } from "./events/tool-result.js";
 import { ToolUsePreviewStartEventSchema } from "./events/tool-use-preview-start.js";
 import { ToolUseStartEventSchema } from "./events/tool-use-start.js";
 import { TraceEventSchema } from "./events/trace-event.js";
-import { TurnProfileAutoRoutedEventSchema } from "./events/turn-profile-auto-routed.js";
 import { UISurfaceCompleteEventSchema } from "./events/ui-surface-complete.js";
 import { UISurfaceDismissEventSchema } from "./events/ui-surface-dismiss.js";
 import { UISurfaceShowEventSchema } from "./events/ui-surface-show.js";
@@ -297,10 +296,6 @@ export {
   type TraceEventStatus,
   TraceEventStatusSchema,
 } from "./events/trace-event.js";
-export {
-  type TurnProfileAutoRoutedEvent,
-  TurnProfileAutoRoutedEventSchema,
-} from "./events/turn-profile-auto-routed.js";
 export {
   type UISurfaceCompleteEvent,
   UISurfaceCompleteEventSchema,
@@ -535,7 +530,6 @@ export const AssistantEventSchema = z.discriminatedUnion("type", [
   ToolUsePreviewStartEventSchema,
   ToolUseStartEventSchema,
   TraceEventSchema,
-  TurnProfileAutoRoutedEventSchema,
   UISurfaceCompleteEventSchema,
   UISurfaceDismissEventSchema,
   UISurfaceShowEventSchema,

package/src/approvals/AGENTS.md

@@ -5,8 +5,7 @@
 - **Rich delivery failures must degrade gracefully.** If delivering a rich approval prompt (e.g., Telegram inline buttons) fails, fall back to plain text with instructions (e.g., `Reply "yes" to approve`) — never auto-deny.
 - **Non-rich channels** (http-api) receive plain-text approval prompts. The conversational approval engine handles free-text responses.
 - **Race conditions:** Always check whether a decision has already been resolved before delivering the engine's optimistic reply. If `handleChannelDecision` returns `applied: false`, deliver an "already resolved" notice and return `stale_ignored`.
-- **Requester self-cancel:** A requester with a pending guardian approval must be able to cancel their own request (but not self-approve).
-- **Unified guardian decision primitive:** All guardian decision paths (callback buttons, conversational engine, requester self-cancel) must route through `applyGuardianDecision()` in `assistant/src/approvals/guardian-decision-primitive.ts`. Do not inline decision logic (approval record updates, grant minting) at individual callsites.
+- **Unified guardian decision primitive:** All guardian decision paths (callback buttons, conversational engine, channel reactions and text) must route through `applyCanonicalGuardianDecision()` in `assistant/src/approvals/guardian-decision-primitive.ts`. Do not inline decision logic (CAS resolution, resolver dispatch, grant minting) at individual callsites.
 
 ## Single-Guardian Invariant