@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/permissions/workspace-policy.ts

@@ -2,15 +2,33 @@ import { realpathSync } from "node:fs";
 import { basename, dirname, normalize, resolve } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
+import { resolveTrailingLinkTarget } from "../util/fs-symlinks.js";
+import {
+  getMonitoringDataDir,
+  getWorkspaceHooksDir,
+  getWorkspacePluginsDir,
+  getWorkspaceRoutesDir,
+  getWorkspaceSkillsDir,
+  getWorkspaceSystemPromptDir,
+  getWorkspaceToolsDir,
+  getWorkspaceWorkflowsDir,
+} from "../util/platform.js";
 
 /**
- * Resolve a path to its canonical form. When the target itself doesn't
- * exist (e.g. a new file being written), walk up to the nearest existing
- * ancestor and append the remaining segments so that symlinks in parent
- * directories (like macOS `/var` -> `/private/var`) are still resolved.
+ * Resolve a path to its canonical form. A trailing (possibly dangling)
+ * symlink chain is followed first so a link whose destination does not
+ * exist yet still canonicalizes to that destination — a write through the
+ * link creates it. When the target itself doesn't exist (e.g. a new file
+ * being written), walk up to the nearest existing ancestor and append the
+ * remaining segments so that symlinks in parent directories (like macOS
+ * `/var` -> `/private/var`) are still resolved.
  */
 function canonicalize(p: string): string {
-  const abs = resolve(p);
+  const abs = resolveTrailingLinkTarget(resolve(p));
+  return canonicalizeExisting(abs);
+}
+
+function canonicalizeExisting(abs: string): string {
   try {
     return realpathSync(abs);
   } catch {
@@ -21,10 +39,38 @@ function canonicalize(p: string): string {
       // Reached filesystem root — nothing left to resolve.
       return normalize(abs);
     }
-    return `${canonicalize(parent)}/${name}`;
+    return `${canonicalizeExisting(parent)}/${name}`;
   }
 }
 
+/**
+ * Canonicalize a path's directory chain while keeping the final segment as
+ * addressed: symlinks among the ancestors (macOS `/var` → `/private/var`, a
+ * linked parent directory) resolve, a trailing symlink does not. This is
+ * the *name* the daemon acts on — the prompt renderer and the code loaders
+ * open control-plane paths by name and follow links while reading, so when
+ * the final segment is itself a symlink, a write addressed at it changes
+ * what they read even though the bytes land at the link's destination.
+ */
+function canonicalizeAddressedName(p: string): string {
+  const abs = resolve(p);
+  return `${canonicalizeExisting(dirname(abs))}/${basename(abs)}`;
+}
+
+/**
+ * Whether a canonical path is a canonical directory or falls under it. The
+ * trailing separator keeps `/workspace-extra` from matching `/workspace`.
+ * Both arguments must already be canonicalized — comparing a canonical path
+ * against a lexical directory would re-open the symlink dodge.
+ */
+function isAtOrUnderCanonicalDir(
+  canonicalPath: string,
+  canonicalDir: string,
+): boolean {
+  const prefix = canonicalDir.endsWith("/") ? canonicalDir : `${canonicalDir}/`;
+  return canonicalPath === canonicalDir || canonicalPath.startsWith(prefix);
+}
+
 /**
  * Resolve a file path to its canonical form (resolving symlinks and
  * normalizing segments like `.` and `..`), then check whether it falls
@@ -34,19 +80,12 @@ export function isPathWithinWorkspaceRoot(
   filePath: string,
   workspaceRoot: string,
 ): boolean {
-  if (!filePath || !workspaceRoot) return false;
-
-  const canonicalPath = canonicalize(filePath);
-  const canonicalRoot = canonicalize(workspaceRoot);
-
-  // Ensure the root ends with a separator so `/workspace-extra` doesn't
-  // match `/workspace`.
-  const rootPrefix = canonicalRoot.endsWith("/")
-    ? canonicalRoot
-    : `${canonicalRoot}/`;
-
-  return (
-    canonicalPath === canonicalRoot || canonicalPath.startsWith(rootPrefix)
+  if (!filePath || !workspaceRoot) {
+    return false;
+  }
+  return isAtOrUnderCanonicalDir(
+    canonicalize(filePath),
+    canonicalize(workspaceRoot),
   );
 }
 
@@ -55,6 +94,14 @@ export function isPathWithinWorkspaceRoot(
 /** File-path tools whose workspace-scoped-ness depends on the file_path input. */
 const PATH_SCOPED_TOOLS = new Set(["file_read", "file_write", "file_edit"]);
 
+/** Sandbox file tools that write. Reads never plant code. */
+const WORKSPACE_WRITE_TOOLS = new Set(["file_write", "file_edit"]);
+
+/** Whether a tool is a sandbox file tool that writes. */
+export function isWorkspaceWriteTool(toolName: string): boolean {
+  return WORKSPACE_WRITE_TOOLS.has(toolName);
+}
+
 /** Network-accessing tools — never workspace-scoped. */
 const NETWORK_TOOLS = new Set(["web_search", "web_fetch", "network_request"]);
 
@@ -76,6 +123,196 @@ const ALWAYS_SCOPED_TOOLS = new Set([
   "ui_dismiss",
 ]);
 
+// The Docker sandbox mounts the workspace at /workspace, and the model emits
+// container-scoped paths (e.g. "/workspace/tools/evil.ts") even on local
+// turns. The execution-time path policy and the gateway classifier both
+// apply this remap, so every workspace-containment decision here must too.
+const CONTAINER_WORKSPACE_PREFIX = "/workspace/";
+const CONTAINER_WORKSPACE_EXACT = "/workspace";
+
+/**
+ * Resolve a sandbox file path to its lexical base the same way the
+ * execution-time `sandboxPolicy` and the gateway classifier do: remap a
+ * container-scoped `/workspace/...` path onto `workingDir`, then resolve
+ * (relative paths resolve against `workingDir`, not process.cwd()).
+ */
+export function resolveSandboxBase(
+  rawPath: string,
+  workingDir: string,
+): string {
+  let effectivePath = rawPath;
+  if (!rawPath.startsWith(workingDir + "/") && rawPath !== workingDir) {
+    if (rawPath.startsWith(CONTAINER_WORKSPACE_PREFIX)) {
+      effectivePath = rawPath.slice(CONTAINER_WORKSPACE_PREFIX.length);
+    } else if (rawPath === CONTAINER_WORKSPACE_EXACT) {
+      effectivePath = ".";
+    }
+  }
+  return resolve(workingDir, effectivePath);
+}
+
+/**
+ * Extract a path-scoped tool's target path from its input. `path` takes
+ * priority over `file_path` — the file tools execute `input.path` and the
+ * risk classifier reads the fields in the same order, so containment
+ * decisions must be derived from the field that actually executes (an input
+ * carrying both fields is not runtime-stripped). Returns `""` when the
+ * input carries no usable path.
+ */
+function resolvePathScopedTarget(
+  toolInput: Record<string, unknown>,
+  workspaceRoot: string,
+): string {
+  const rawPath =
+    typeof toolInput.path === "string"
+      ? toolInput.path
+      : typeof toolInput.file_path === "string"
+        ? toolInput.file_path
+        : "";
+  if (rawPath === "") {
+    return "";
+  }
+  return resolveSandboxBase(rawPath, workspaceRoot);
+}
+
+/**
+ * Whether a sandbox file-tool invocation targets a path outside the
+ * workspace root. Always false in containerized mode — the execution-time
+ * boundary is hard there, so an escaping path never executes. Non-path
+ * tools are never classified by this predicate.
+ */
+export function isOutOfWorkspaceFileInvocation(
+  toolName: string,
+  toolInput: Record<string, unknown>,
+  workspaceRoot: string,
+): boolean {
+  if (getIsContainerized()) {
+    return false;
+  }
+  if (!PATH_SCOPED_TOOLS.has(toolName)) {
+    return false;
+  }
+  const filePath = resolvePathScopedTarget(toolInput, workspaceRoot);
+  return filePath !== "" && !isPathWithinWorkspaceRoot(filePath, workspaceRoot);
+}
+
+/**
+ * The workspace directories the daemon imports and executes — hooks,
+ * plugins, skills, tools, routes, workflows — plus the monitoring data
+ * directory, whose source-versions sentinel steers which plugin code the
+ * daemon imports. A write to any of them is code that runs later with the
+ * daemon's own reach. The list mirrors the file risk classifier's
+ * code-injection sinks.
+ */
+function executableSinkDirs(): string[] {
+  return [
+    getWorkspaceHooksDir(),
+    getWorkspacePluginsDir(),
+    getWorkspaceSkillsDir(),
+    getWorkspaceToolsDir(),
+    getWorkspaceRoutesDir(),
+    getWorkspaceWorkflowsDir(),
+    getMonitoringDataDir(),
+  ];
+}
+
+/**
+ * Workspace-root files and directories the prompt renderer reads into the
+ * system prompt at render time (`prompts/templates/system-sections.ts`
+ * `workspacePath` entries — a drift-guard test walks the real section list
+ * against this predicate). A write to any of them rewrites the assistant's
+ * standing instructions, per-user context, or per-channel context.
+ */
+const PROMPT_SURFACE_FILES = [
+  "IDENTITY.md",
+  "SOUL.md",
+  "VOICE.md",
+  "BOOTSTRAP.md",
+  // Read by the heartbeat service as its checklist — instructions executed
+  // unattended (`runtime/routes/heartbeat-routes.ts`).
+  "HEARTBEAT.md",
+  // The scratchpad the heartbeat checklist reads its to-dos from, injected
+  // into every full-mode guardian turn by the `now-md` injector
+  // (`plugins/defaults/workspace/injectors.ts`). Injector-fed rather than a
+  // system section, so the drift guard cannot see it — this entry is the
+  // coverage.
+  "NOW.md",
+];
+const PROMPT_SURFACE_DIRS = ["users", "channels"];
+
+// `memory/**` is deliberately data-plane, not control-plane: memory pages
+// inject into guardian sessions as past-record rather than standing
+// instructions, consolidation owns and rewrites those files, and the gated
+// write path is `remember()` (provenance-checked in the indexer). If direct
+// file writes to memory pages ever become a delegation surface, they join
+// this list.
+
+/**
+ * Whether a sandbox file-tool invocation writes a workspace control-plane
+ * target: an executable sink directory (code the daemon executes) or a
+ * prompt surface (instructions it obeys). The two categories are one
+ * delegation a layer apart — approving the write approves everything the
+ * planted code or rewritten instructions cause later.
+ *
+ * Unlike {@link isOutOfWorkspaceFileInvocation} this holds in containerized
+ * mode too: the workspace boundary is what contains an escaping *path*, and
+ * these paths do not escape — the daemon acts on them from inside.
+ *
+ * Two views of the write are checked against every baseline, because a
+ * symlink at either end dodges a single view:
+ *
+ * - The canonical destination ({@link canonicalize}): a benign-looking name
+ *   whose trailing link points at a control-plane path is a write to that
+ *   path, and a lexical check does not see it.
+ * - The addressed name ({@link canonicalizeAddressedName}): a control-plane
+ *   name that is itself a symlink to a benign path still changes what the
+ *   daemon reads under that name — the renderer and the loaders follow the
+ *   link — while the destination alone canonicalizes past the surface.
+ *
+ * The baselines are canonicalized too: a prompt surface may itself be a
+ * symlink (SOUL.md → personas/current.md), and the renderer reads through
+ * it — so a write to the link's destination must match as well.
+ */
+export function isControlPlaneWorkspaceWrite(
+  toolName: string,
+  toolInput: Record<string, unknown>,
+  workspaceRoot: string,
+): boolean {
+  if (!isWorkspaceWriteTool(toolName)) {
+    return false;
+  }
+  const filePath = resolvePathScopedTarget(toolInput, workspaceRoot);
+  if (filePath === "") {
+    return false;
+  }
+  const target = canonicalize(filePath);
+  const addressed = canonicalizeAddressedName(filePath);
+  const root = canonicalize(workspaceRoot);
+  const writesUnder = (dir: string): boolean => {
+    const canonicalDir = canonicalize(dir);
+    return (
+      isAtOrUnderCanonicalDir(target, canonicalDir) ||
+      isAtOrUnderCanonicalDir(addressed, canonicalDir)
+    );
+  };
+  return (
+    executableSinkDirs().some(writesUnder) ||
+    PROMPT_SURFACE_FILES.some((file) => {
+      const canonicalFile = canonicalize(`${root}/${file}`);
+      return target === canonicalFile || addressed === canonicalFile;
+    }) ||
+    PROMPT_SURFACE_DIRS.some((dir) => writesUnder(`${root}/${dir}`)) ||
+    // The system-section override layer: a `<section-id>.md` under
+    // `prompts/system/` replaces the bundled section of the same id — or,
+    // stripped to nothing, silences it — including the security-policy
+    // sections (credential handling, external content, the non-guardian
+    // boundary). A brand-new id adds a workspace-only section, so the whole
+    // directory is a prompt surface. The baseline is the getter the renderer
+    // itself resolves, like {@link executableSinkDirs}.
+    writesUnder(getWorkspaceSystemPromptDir())
+  );
+}
+
 /**
  * Determine whether a tool invocation only affects resources within the
  * workspace root. This is a conservative classification — unknown tools
@@ -86,22 +323,18 @@ export function isWorkspaceScopedInvocation(
   toolInput: Record<string, unknown>,
   workspaceRoot: string,
 ): boolean {
-  if (ALWAYS_SCOPED_TOOLS.has(toolName)) return true;
-  if (NETWORK_TOOLS.has(toolName)) return false;
-  if (HOST_TOOLS.has(toolName)) return false;
+  if (ALWAYS_SCOPED_TOOLS.has(toolName)) {
+    return true;
+  }
+  if (NETWORK_TOOLS.has(toolName)) {
+    return false;
+  }
+  if (HOST_TOOLS.has(toolName)) {
+    return false;
+  }
 
   if (PATH_SCOPED_TOOLS.has(toolName)) {
-    const rawPath =
-      typeof toolInput.file_path === "string"
-        ? toolInput.file_path
-        : typeof toolInput.path === "string"
-          ? toolInput.path
-          : "";
-    // Resolve relative paths against workspaceRoot (not process.cwd())
-    const filePath =
-      rawPath !== "" && !rawPath.startsWith("/")
-        ? resolve(workspaceRoot, rawPath)
-        : rawPath;
+    const filePath = resolvePathScopedTarget(toolInput, workspaceRoot);
     return (
       filePath !== "" && isPathWithinWorkspaceRoot(filePath, workspaceRoot)
     );
@@ -112,7 +345,9 @@ export function isWorkspaceScopedInvocation(
   // bash is NOT workspace-scoped here — path resolution for allowlisted commands is
   // handled upstream in the checker's hasSandboxAutoApprove computation, which validates
   // all path arguments against the workspace root for non-containerized environments.
-  if (toolName === "bash") return getIsContainerized();
+  if (toolName === "bash") {
+    return getIsContainerized();
+  }
 
   // Unknown tool — conservative default.
   return false;

package/src/persistence/__tests__/lifecycle-quiesce.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The quiesce lease is the safety-critical piece of `vellum sleep --wait`:
+ * a stuck or misread lease would silently pause heartbeats, schedules, and
+ * memory jobs. These tests pin the fail-open contract (missing, malformed,
+ * or expired lease reads as "not quiesced") and the TTL clamps.
+ */
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { setMemoryCheckpoint } from "../checkpoints.js";
+import { initializeDb } from "../db-init.js";
+import {
+  clearLifecycleQuiesce,
+  DEFAULT_QUIESCE_TTL_MS,
+  getLifecycleQuiesceUntil,
+  isLifecycleQuiesced,
+  MAX_QUIESCE_TTL_MS,
+  MIN_QUIESCE_TTL_MS,
+  setLifecycleQuiesce,
+} from "../lifecycle-quiesce.js";
+import { resetTestTables } from "../raw-query.js";
+
+const QUIESCE_KEY = "lifecycle:quiesce_until";
+
+await initializeDb();
+
+beforeEach(() => {
+  resetTestTables("memory_checkpoints");
+});
+
+describe("lifecycle-quiesce", () => {
+  test("no lease reads as not quiesced (fail-open default)", () => {
+    expect(isLifecycleQuiesced()).toBe(false);
+    expect(getLifecycleQuiesceUntil()).toBeNull();
+  });
+
+  test("setLifecycleQuiesce arms the lease for the requested TTL", () => {
+    const before = Date.now();
+    const until = setLifecycleQuiesce(DEFAULT_QUIESCE_TTL_MS);
+    expect(until).toBeGreaterThanOrEqual(before + DEFAULT_QUIESCE_TTL_MS);
+    expect(until).toBeLessThanOrEqual(Date.now() + DEFAULT_QUIESCE_TTL_MS);
+    expect(isLifecycleQuiesced()).toBe(true);
+    expect(getLifecycleQuiesceUntil()).toBe(until);
+  });
+
+  test("TTL is clamped to the sane range", () => {
+    const beforeMin = Date.now();
+    const untilMin = setLifecycleQuiesce(1);
+    expect(untilMin).toBeGreaterThanOrEqual(beforeMin + MIN_QUIESCE_TTL_MS);
+
+    const beforeMax = Date.now();
+    const untilMax = setLifecycleQuiesce(Number.MAX_SAFE_INTEGER);
+    expect(untilMax).toBeLessThanOrEqual(
+      Date.now() + MAX_QUIESCE_TTL_MS + 1_000,
+    );
+    expect(untilMax).toBeGreaterThanOrEqual(beforeMax + MAX_QUIESCE_TTL_MS);
+  });
+
+  test("re-arming extends the lease (refresh semantics)", () => {
+    const first = setLifecycleQuiesce(MIN_QUIESCE_TTL_MS);
+    const second = setLifecycleQuiesce(MAX_QUIESCE_TTL_MS);
+    expect(second).toBeGreaterThan(first);
+    expect(getLifecycleQuiesceUntil()).toBe(second);
+  });
+
+  test("an expired lease reads as not quiesced", () => {
+    setMemoryCheckpoint(QUIESCE_KEY, String(Date.now() - 1));
+    expect(isLifecycleQuiesced()).toBe(false);
+    expect(getLifecycleQuiesceUntil()).toBeNull();
+  });
+
+  test("a malformed lease value reads as not quiesced (fail-open)", () => {
+    setMemoryCheckpoint(QUIESCE_KEY, "not-a-number");
+    expect(isLifecycleQuiesced()).toBe(false);
+  });
+
+  test("clearLifecycleQuiesce releases an active lease", () => {
+    setLifecycleQuiesce(DEFAULT_QUIESCE_TTL_MS);
+    expect(isLifecycleQuiesced()).toBe(true);
+    clearLifecycleQuiesce();
+    expect(isLifecycleQuiesced()).toBe(false);
+  });
+});

package/src/persistence/__tests__/message-content-file.test.ts

@@ -9,6 +9,7 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
+import { contentBlockArraySchema } from "../../providers/content-block-schema.js";
 import type { ContentBlock } from "../../providers/types.js";
 import { getWorkspaceDir } from "../../util/platform.js";
 import {
@@ -170,11 +171,10 @@ describe("resolveMessageContentBlocks", () => {
   });
 
   test("passes typed blocks outside the union through untouched", () => {
-    // Persisted kinds like ui_surface live outside the provider union;
-    // their renderers own their shape, so repair must not rewrite them.
+    // A persisted kind the union does not model still passes through: its
+    // renderer owns the shape, so repair must not rewrite it.
     const historical = [
       textBlock("kept as-is"),
-      { type: "ui_surface", surfaceType: "call_summary", data: { x: 1 } },
       { type: "some_retired_block_kind", payload: 1 },
     ];
     expect(resolveMessageContentBlocks(JSON.stringify(historical))).toEqual(
@@ -182,6 +182,61 @@ describe("resolveMessageContentBlocks", () => {
     );
   });
 
+  test("validates ui_surface blocks without entering the repair path", () => {
+    // ui_surface is a first-class union member (LUM-2869). Before it was
+    // modelled, every read of a row holding a card failed schema validation
+    // and paid a per-block repair that changed nothing — the read-path noise
+    // that spiked with voice GA. Asserting schema success (not just a clean
+    // round trip) is what proves the repair path can no longer fire, since
+    // repair passes these blocks through unchanged either way.
+    const surfaceRow = [
+      {
+        type: "ui_surface",
+        surfaceId: "call-1",
+        surfaceType: "call_summary",
+        completed: true,
+        display: "inline",
+        data: { summaryText: "**Call completed** (42s).", events: [] },
+      },
+      {
+        type: "text",
+        text: "**Call completed** (42s).",
+        _surfaceFallback: true,
+      },
+    ];
+    expect(contentBlockArraySchema.safeParse(surfaceRow).success).toBe(true);
+    // `data` stays opaque and internal riders survive the round trip.
+    expect(resolveMessageContentBlocks(JSON.stringify(surfaceRow))).toEqual(
+      surfaceRow as unknown as ContentBlock[],
+    );
+  });
+
+  test("validates an LLM-emitted surface with an arbitrary display value", () => {
+    // Surfaces written by the `ui_show` tool carry whatever the model chose:
+    // `CurrentTurnSurface.display` is a bare string, NOT the inline/panel enum
+    // of the `ui_surface_show` wire event. Narrowing it here would send every
+    // LLM surface back through the per-block repair — the read-path noise this
+    // variant exists to stop. Daemon-only riders must survive too.
+    const llmSurfaceRow = [
+      {
+        type: "ui_surface",
+        surfaceId: "surface-1",
+        surfaceType: "card",
+        title: "Pick one",
+        data: { title: "Pick one", options: ["a", "b"] },
+        actions: [{ id: "a", label: "A" }],
+        display: "modal",
+        persistent: true,
+        toolCallId: "tu-1",
+        activationMoment: "commit",
+      },
+    ];
+    expect(contentBlockArraySchema.safeParse(llmSurfaceRow).success).toBe(true);
+    expect(resolveMessageContentBlocks(JSON.stringify(llmSurfaceRow))).toEqual(
+      llmSurfaceRow as unknown as ContentBlock[],
+    );
+  });
+
   test("wraps type-less values in a text block carrying the payload", () => {
     const historical = [{ payload: 1 }, "bare string"];
     expect(resolveMessageContentBlocks(JSON.stringify(historical))).toEqual([

package/src/persistence/conversation-crud.ts

@@ -677,6 +677,58 @@ interface InsertMessageCoreParams {
  * WAL contention. The timestamp is recomputed each attempt so a late
  * retry doesn't persist a stale `updatedAt`.
  */
+/**
+ * Guard: a message whose blocks are ALL `ui_surface` cards is invisible to
+ * the model — every provider drops cards when serializing history, and the
+ * contract (see `notifications/approval-card-builder.ts`) is that the
+ * producer pairs a card with a model-readable sibling block (for cards whose
+ * meaning the model needs, a `_surfaceFallback` text block; surfaces appended
+ * to a normal turn ride alongside its text/tool blocks and need nothing).
+ *
+ * Voice call summaries shipped without the sibling and the model silently
+ * lost those turns (LUM-2869) — nothing enforced the contract. In tests this
+ * throws, so a producer that forgets the pairing fails its own suite before
+ * merge; in production it only warns, per the daemon's never-block posture —
+ * a degraded card row beats a dropped guardian notification.
+ */
+function warnOnModelInvisibleContent(
+  content: string,
+  conversationId: string,
+): void {
+  // Fast path: the overwhelmingly common non-surface message never parses.
+  if (!content.includes('"ui_surface"')) {
+    return;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return; // legacy plain-string content — not this guard's concern
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) {
+    return;
+  }
+  const allCards = parsed.every(
+    (block) =>
+      typeof block === "object" &&
+      block !== null &&
+      (block as { type?: unknown }).type === "ui_surface",
+  );
+  if (!allCards) {
+    return;
+  }
+  const surfaceTypes = parsed
+    .map((block) => (block as { surfaceType?: unknown }).surfaceType)
+    .filter((t): t is string => typeof t === "string");
+  const message =
+    "Persisting a message whose only content is ui_surface blocks — the model cannot see it. " +
+    "Pair the card with a model-readable sibling (e.g. a _surfaceFallback text block).";
+  if (process.env.NODE_ENV === "test") {
+    throw new Error(`${message} (surfaceTypes: ${surfaceTypes.join(", ")})`);
+  }
+  log.warn({ conversationId, surfaceTypes }, message);
+}
+
 async function insertMessageCore(
   params: InsertMessageCoreParams,
 ): Promise<InsertedMessage> {
@@ -689,6 +741,7 @@ async function insertMessageCore(
     clientMessageId,
     id,
   } = params;
+  warnOnModelInvisibleContent(content, conversationId);
   const db = getDb();
   // Time-ordered UUIDv7 so server-generated message ids append to the tail of
   // the WITHOUT ROWID `messages` primary key instead of scattering (v4).
@@ -2721,6 +2774,42 @@ export function isConversationProcessing(id: string): boolean {
   return row?.processing_started_at != null;
 }
 
+/**
+ * Conversations currently mid-turn, longest-running first. Throws on a read
+ * failure — drain callers must distinguish "nothing processing" from "could
+ * not read", so this does not degrade to an empty list.
+ */
+export function listProcessingConversations(limit = 20): Array<{
+  conversationId: string;
+  title: string | null;
+  originChannel: string | null;
+  originInterface: string | null;
+  processingStartedAt: number;
+}> {
+  const rows = rawAll<{
+    id: string;
+    title: string | null;
+    origin_channel: string | null;
+    origin_interface: string | null;
+    processing_started_at: number;
+  }>(
+    "conversation:listProcessing",
+    `SELECT id, title, origin_channel, origin_interface, processing_started_at
+     FROM conversations
+     WHERE processing_started_at IS NOT NULL
+     ORDER BY processing_started_at ASC
+     LIMIT ?`,
+    limit,
+  );
+  return rows.map((row) => ({
+    conversationId: row.id,
+    title: row.title,
+    originChannel: row.origin_channel,
+    originInterface: row.origin_interface,
+    processingStartedAt: row.processing_started_at,
+  }));
+}
+
 /**
  * Highest stream `seq` whose content is durably persisted to this
  * conversation's message rows, read from the `conversations.seq` column. This
@@ -3161,6 +3250,10 @@ export async function clearAll(): Promise<{
   await runOrThrow("DELETE FROM tool_invocations");
   await runOrThrow("DELETE FROM messages");
   await runOrThrow("DELETE FROM conversations");
+  // Subagent lifecycle records reference conversations by id without an FK
+  // cascade; wipe them explicitly so labels/objectives don't survive (or
+  // rehydrate after) a clear-all.
+  await runOrThrow("DELETE FROM subagents");
 
   // The memory feature's relocated conversation-keyed tables lost their main-DB
   // cascade. Signal the wipe through the hook rather than reaching into the