@vellumai/assistant 0.10.3-dev.202606292229.153e9b2 → 0.10.3-dev.202606292252.adea010

package/openapi.yaml

@@ -17599,6 +17599,16 @@ paths:
                             - label
                             - status
                           additionalProperties: false
+                        acpNotification:
+                          type: object
+                          properties:
+                            acpSessionId:
+                              type: string
+                            agent:
+                              type: string
+                          required:
+                            - acpSessionId
+                          additionalProperties: false
                         slackMessage:
                           type: object
                           properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.3-dev.202606292229.153e9b2",
+  "version": "0.10.3-dev.202606292252.adea010",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/conversation-queue.test.ts

@@ -3004,4 +3004,47 @@ describe("subagent notification user_message_echo suppression", () => {
     await resolveRun(1);
     await new Promise((r) => setTimeout(r, 10));
   });
+
+  test("drained acp-notification message persists and wakes the agent but emits no user_message_echo", async () => {
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const events1: ServerMessage[] = [];
+    const eventsNotif: ServerMessage[] = [];
+
+    // Occupy the conversation so the injected notification queues.
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: (e) => events1.push(e),
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    // A daemon-injected ACP completion notification carries `acpNotification`.
+    conversation.enqueueMessage({
+      content: '[ACP agent "claude" completed]',
+      onEvent: (e) => eventsNotif.push(e),
+      requestId: "req-acp-notif",
+      metadata: {
+        acpNotification: { acpSessionId: "acp-1", agent: "claude" },
+      },
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Still persisted (so the orchestrator LLM sees it) and still wakes the
+    // agent...
+    expect(
+      capturedAddMessages.some((m) => m.content.includes("ACP agent")),
+    ).toBe(true);
+    expect(pendingRuns.length).toBe(2);
+    // ...but no user_message_echo, so the client never renders a live bubble.
+    expect(eventsNotif.some((e) => e.type === "user_message_echo")).toBe(false);
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
 });

package/src/__tests__/tool-executor-redaction.test.ts

@@ -89,6 +89,17 @@ describe("redactSensitiveFields", () => {
     expect(items[1].password).toBe(R);
   });
 
+  test("recurses into arrays nested inside arrays", () => {
+    const input = { calls: [[{ name: "a", token: "plainword" }]] };
+    const result = redactSensitiveFields(input);
+    const inner = (result.calls as unknown[][])[0][0] as Record<
+      string,
+      unknown
+    >;
+    expect(inner.name).toBe("a");
+    expect(inner.token).toBe(R);
+  });
+
   test("preserves primitive arrays", () => {
     const input = { tags: ["public", "v1"], token: "tk" };
     const result = redactSensitiveFields(input);

package/src/acp/__tests__/client-handler.test.ts

@@ -408,6 +408,175 @@ describe("VellumAcpClientHandler seq + enriched fields", () => {
     });
   });
 
+  test("tool_call forwards rawInput/rawOutput structurally when present", async () => {
+    const { handler, sent } = makeHandler();
+
+    const rawInput = { command: "ls", args: ["-la"] };
+    const rawOutput = { stdout: "file.txt", exitCode: 0 };
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-raw",
+        title: "Run ls",
+        kind: "execute",
+        status: "completed",
+        rawInput,
+        rawOutput,
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    expect(sent[0]).toMatchObject({
+      updateType: "tool_call",
+      toolCallId: "tc-raw",
+      // Forwarded as-is, NOT stringified (unlike content).
+      rawInput: { command: "ls", args: ["-la"] },
+      rawOutput: { stdout: "file.txt", exitCode: 0 },
+    });
+  });
+
+  test("tool_call leaves rawInput/rawOutput undefined when source omits them", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-no-raw",
+        title: "Edit main.ts",
+        kind: "edit",
+        status: "pending",
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { rawInput?: unknown; rawOutput?: unknown };
+    expect(msg.rawInput).toBeUndefined();
+    expect(msg.rawOutput).toBeUndefined();
+  });
+
+  test("tool_call_update forwards rawInput/rawOutput structurally when present", async () => {
+    const { handler, sent } = makeHandler();
+
+    const rawInput = { path: "/repo/main.ts", oldText: "a", newText: "b" };
+    const rawOutput = { applied: true };
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId: "tc-raw-update",
+        status: "completed",
+        rawInput,
+        rawOutput,
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    expect(sent[0]).toMatchObject({
+      updateType: "tool_call_update",
+      toolCallId: "tc-raw-update",
+      rawInput: { path: "/repo/main.ts", oldText: "a", newText: "b" },
+      rawOutput: { applied: true },
+    });
+  });
+
+  test("tool_call forwards a small rawOutput unchanged (under the cap)", async () => {
+    const { handler, sent } = makeHandler();
+
+    const rawOutput = { ok: true };
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-small-raw",
+        title: "Run check",
+        kind: "execute",
+        status: "completed",
+        rawOutput,
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { rawOutput?: unknown };
+    // Under the 16 KiB cap — forwarded structurally, unchanged.
+    expect(msg.rawOutput).toEqual({ ok: true });
+  });
+
+  test("tool_call caps an oversize rawOutput to a marker string", async () => {
+    const { handler, sent } = makeHandler();
+
+    const huge = "x".repeat(20000);
+    const rawOutput = { stdout: huge };
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-oversize-raw",
+        title: "Run noisy command",
+        kind: "execute",
+        status: "completed",
+        rawOutput,
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { rawOutput?: unknown };
+    // Oversize payloads are replaced with a short marker so a single large
+    // rawOutput can't evict real transcript events from the session buffer.
+    expect(typeof msg.rawOutput).toBe("string");
+    expect(msg.rawOutput as string).toStartWith("[raw payload omitted:");
+    // The original large value must not survive into the forwarded event.
+    expect(JSON.stringify(sent[0])).not.toContain(huge);
+  });
+
+  test("tool_call caps an oversize rawInput to a marker string", async () => {
+    const { handler, sent } = makeHandler();
+
+    const huge = "y".repeat(20000);
+    const rawInput = { prompt: huge };
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-oversize-input",
+        title: "Run big prompt",
+        kind: "execute",
+        status: "pending",
+        rawInput,
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { rawInput?: unknown };
+    expect(typeof msg.rawInput).toBe("string");
+    expect(msg.rawInput as string).toStartWith("[raw payload omitted:");
+    expect(JSON.stringify(sent[0])).not.toContain(huge);
+  });
+
+  test("tool_call_update leaves rawInput/rawOutput undefined when source omits them", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId: "tc-no-raw-update",
+        status: "in_progress",
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { rawInput?: unknown; rawOutput?: unknown };
+    expect(msg.rawInput).toBeUndefined();
+    expect(msg.rawOutput).toBeUndefined();
+  });
+
   test("tool_call_update forwards locations: [] when null (explicit clear)", async () => {
     const { handler, sent } = makeHandler();
 
@@ -448,4 +617,168 @@ describe("VellumAcpClientHandler seq + enriched fields", () => {
     expect(msg.locations).toBeUndefined();
     expect("locations" in msg && msg.locations !== undefined).toBe(false);
   });
+
+  test("tool_call redacts secrets in rawInput/rawOutput before forwarding", async () => {
+    const { handler, sent } = makeHandler();
+
+    // AWS access key id — a high-confidence prefix-based secret pattern.
+    const secret = "AKIAIOSFODNN7REALKEY";
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-secret",
+        title: "Configure AWS",
+        kind: "execute",
+        status: "completed",
+        rawInput: { env: { AWS_ACCESS_KEY_ID: secret } },
+        rawOutput: { echoed: `key is ${secret}` },
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    // The raw secret must not survive into the forwarded event, which flows
+    // into the session buffer and the persisted event_log_json.
+    expect(JSON.stringify(sent[0])).not.toContain(secret);
+    const msg = sent[0] as { rawInput?: unknown; rawOutput?: unknown };
+    expect(JSON.stringify(msg.rawInput)).toContain("<redacted");
+    expect(JSON.stringify(msg.rawOutput)).toContain("<redacted");
+  });
+
+  test("tool_call_update redacts secrets in rawInput/rawOutput before forwarding", async () => {
+    const { handler, sent } = makeHandler();
+
+    const secret = "AKIAIOSFODNN7REALKEY";
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId: "tc-secret-update",
+        status: "completed",
+        rawInput: { token: secret },
+        rawOutput: { stdout: secret },
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    expect(JSON.stringify(sent[0])).not.toContain(secret);
+    const msg = sent[0] as { rawInput?: unknown; rawOutput?: unknown };
+    expect(JSON.stringify(msg.rawInput)).toContain("<redacted");
+    expect(JSON.stringify(msg.rawOutput)).toContain("<redacted");
+  });
+
+  test("tool_call redacts credential-named fields whose values aren't secret-shaped", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-cred",
+        title: "Configure",
+        kind: "execute",
+        status: "completed",
+        // Plain words — caught by field NAME, not by value shape.
+        rawInput: {
+          password: "correcthorsebattery",
+          nested: { api_key: "plainword" },
+        },
+        rawOutput: { token: "notasecretbutlong" },
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const serialized = JSON.stringify(sent[0]);
+    expect(serialized).not.toContain("correcthorsebattery");
+    expect(serialized).not.toContain("plainword");
+    expect(serialized).not.toContain("notasecretbutlong");
+    expect(serialized).toContain("<redacted");
+  });
+
+  test("tool_call redacts credential-named fields nested inside arrays of arrays", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-nested-array",
+        title: "Batch",
+        kind: "execute",
+        status: "completed",
+        // Credential-named field buried under array-in-array nesting; the
+        // value isn't secret-shaped, so only field-name redaction catches it.
+        rawInput: { calls: [[{ token: "plainword" }]] },
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const serialized = JSON.stringify(sent[0]);
+    expect(serialized).not.toContain("plainword");
+    expect(serialized).toContain("<redacted");
+  });
+
+  test("tool_call_update redacts credential-named fields whose values aren't secret-shaped", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId: "tc-cred-update",
+        status: "completed",
+        rawInput: { authorization: "plainwordvalue" },
+        rawOutput: { secret: "justwords" },
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const serialized = JSON.stringify(sent[0]);
+    expect(serialized).not.toContain("plainwordvalue");
+    expect(serialized).not.toContain("justwords");
+    expect(serialized).toContain("<redacted");
+  });
+
+  test("tool_call redacts a shaped secret embedded in the title", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "tc-title",
+        // Claude's shell tools put the command in the title; a literal
+        // credential inline must not reach the wire or persisted event log.
+        title: "echo AKIAQ7XK4PNZ3RJD2WTV",
+        kind: "execute",
+        status: "completed",
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { toolTitle?: string };
+    expect(msg.toolTitle).not.toContain("AKIAQ7XK4PNZ3RJD2WTV");
+    expect(msg.toolTitle).toContain("<redacted");
+  });
+
+  test("tool_call_update redacts a shaped secret embedded in the title", async () => {
+    const { handler, sent } = makeHandler();
+
+    await handler.sessionUpdate({
+      sessionId: ACP_SESSION_ID,
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId: "tc-title-update",
+        title: "echo AKIAFA01L49X7HW9DM2Y",
+        status: "completed",
+      },
+    });
+
+    expect(sent).toHaveLength(1);
+    const msg = sent[0] as { toolTitle?: string };
+    expect(msg.toolTitle).not.toContain("AKIAFA01L49X7HW9DM2Y");
+    expect(msg.toolTitle).toContain("<redacted");
+  });
 });

package/src/acp/__tests__/session-manager-persistence.test.ts

@@ -240,6 +240,49 @@ describe("AcpSessionManager — terminal persistence", () => {
     expect(eventBuffers.has(id)).toBe(false);
   });
 
+  test("persists tool_call rawInput/rawOutput verbatim through the event log", async () => {
+    const id = "session-raw-io-1";
+    const handles = buildSessionWithFakeProcess({
+      id,
+      agentId: "agent-raw",
+      protocolSessionId: "proto-raw",
+      parentConversationId: "conv-raw",
+    });
+
+    const rawInput = { command: "ls -la", args: ["-la"] };
+    const rawOutput = "total 0\ndrwxr-xr-x  2 user  staff  64 .";
+
+    handles.emitUpdate({
+      type: "acp_session_update",
+      acpSessionId: id,
+      updateType: "tool_call",
+      toolCallId: "tc-raw",
+      toolTitle: "Run command",
+      toolKind: "execute",
+      toolStatus: "running",
+      rawInput,
+    });
+    handles.emitUpdate({
+      type: "acp_session_update",
+      acpSessionId: id,
+      updateType: "tool_call_update",
+      toolCallId: "tc-raw",
+      toolStatus: "completed",
+      rawOutput,
+    });
+
+    handles.resolvePrompt({ stopReason: "end_turn" });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    const row = readHistoryRow(id);
+    expect(row).not.toBeNull();
+    const log = JSON.parse(row!.event_log_json) as AcpSessionUpdate[];
+    expect(log).toHaveLength(2);
+    expect(log[0]!.rawInput).toEqual(rawInput);
+    expect(log[1]!.rawOutput).toBe(rawOutput);
+  });
+
   test("persists status='failed' with the error message on prompt rejection", async () => {
     const id = "session-failed-1";
     const handles = buildSessionWithFakeProcess({

package/src/acp/client-handler.ts

@@ -33,10 +33,30 @@ import type {
 
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { AcpSessionUpdate } from "../daemon/message-types/acp.js";
+import { redactJsonStringLeaves } from "../security/redact-json.js";
+import { redactSensitiveFields } from "../security/redaction.js";
+import { redactSecrets } from "../security/secret-scanner.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("acp:client-handler");
 
+// Field-name redaction across object/array shapes (covers top-level arrays;
+// redactSensitiveFields handles the nested recursion within objects).
+function redactSensitivePayload(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(redactSensitivePayload);
+  if (value !== null && typeof value === "object") {
+    return redactSensitiveFields(value as Record<string, unknown>);
+  }
+  return value;
+}
+
+// The execute kind's title is the command line, which can carry a literal
+// credential — scrub shaped secrets before forwarding/persisting it.
+function redactTitle(title: string | null | undefined): string | undefined {
+  if (title == null) return undefined;
+  return redactSecrets(title);
+}
+
 interface TerminalState {
   proc: ChildProcess;
   output: string;
@@ -93,6 +113,41 @@ export class VellumAcpClientHandler implements Client {
     });
   }
 
+  /**
+   * Cap a raw tool payload so a single large one can't evict real transcript
+   * events from the bounded session buffer (and the persisted event log). Small
+   * payloads pass through unchanged; oversize ones become a short marker string.
+   */
+  private capRawPayload(value: unknown): unknown {
+    const CAP_BYTES = 16 * 1024;
+    if (value === undefined) return undefined;
+    let serialized: string;
+    try {
+      serialized = JSON.stringify(value) ?? "";
+    } catch {
+      return "[raw payload omitted: not serializable]";
+    }
+    if (serialized.length <= CAP_BYTES) return value;
+    return `[raw payload omitted: ${serialized.length} bytes exceeds ${CAP_BYTES}-byte cap]`;
+  }
+
+  /**
+   * Redact secrets, then cap size, before forwarding — so a leaked credential
+   * never reaches the SSE stream, the session buffer, or persisted
+   * `event_log_json`. Two passes: `redactSensitivePayload` blanks values under
+   * credential-named keys (value-only scanning misses these once JSON-leaf
+   * isolation drops the key↔value context), then `redactJsonStringLeaves`
+   * catches shape-based secrets anywhere in the payload. `undefined` passes
+   * straight through.
+   */
+  private prepareRawPayload(value: unknown): unknown {
+    if (value === undefined) return undefined;
+    const redacted = redactJsonStringLeaves(
+      redactSensitivePayload(value),
+    ).value;
+    return this.capRawPayload(redacted);
+  }
+
   /**
    * Begins suppressing session updates from being forwarded to Vellum.
    *
@@ -166,13 +221,19 @@ export class VellumAcpClientHandler implements Client {
         this.forwardUpdate({
           updateType: "tool_call",
           toolCallId: update.toolCallId,
-          toolTitle: update.title,
+          toolTitle: redactTitle(update.title),
           toolKind: update.kind,
           toolStatus: update.status,
           // An agent may put output/diff on the initial tool_call and never
           // follow up with an update; forward it like the update branch so the
           // chat/file-diff UI has content to render.
           content: update.content ? JSON.stringify(update.content) : undefined,
+          // rawInput/rawOutput are unknown-shaped; forward them structurally
+          // (the SSE layer serializes the message) after redacting secrets and
+          // capping size — so leaked credentials never persist and a single
+          // large payload can't evict real transcript events from the buffer.
+          rawInput: this.prepareRawPayload(update.rawInput),
+          rawOutput: this.prepareRawPayload(update.rawOutput),
           locations: mapLocations(update.locations),
         });
         break;
@@ -182,10 +243,12 @@ export class VellumAcpClientHandler implements Client {
         this.forwardUpdate({
           updateType: "tool_call_update",
           toolCallId: update.toolCallId,
-          toolTitle: update.title ?? undefined,
+          toolTitle: redactTitle(update.title),
           toolKind: update.kind ?? undefined,
           toolStatus: update.status ?? undefined,
           content: update.content ? JSON.stringify(update.content) : undefined,
+          rawInput: this.prepareRawPayload(update.rawInput),
+          rawOutput: this.prepareRawPayload(update.rawOutput),
           locations: mapLocations(update.locations),
         });
         break;

package/src/acp/session-manager.ts

@@ -1034,16 +1034,27 @@ export class AcpSessionManager {
           );
           const resumeHint = hint ? `\n\n${hint}` : "";
           const notifyMessage = `[ACP agent "${agentLabel}" completed]\n\n${responseText}${resumeHint}`;
+          // Tag the injected message so the daemon skips its user_message_echo
+          // and the client filters it from the rendered transcript — the user
+          // sees the run through its inline card, not a chat turn.
+          const acpNotification = {
+            acpSessionId: sessionId,
+            agent: agentLabel,
+          };
           const parentConversation = findConversation(
             current.parentConversationId,
           );
           if (parentConversation) {
             const enqueueResult = parentConversation.enqueueMessage({
               content: notifyMessage,
+              metadata: { acpNotification },
             });
             if (!enqueueResult.queued && !enqueueResult.rejected) {
               parentConversation
-                .persistUserMessage({ content: notifyMessage })
+                .persistUserMessage({
+                  content: notifyMessage,
+                  metadata: { acpNotification },
+                })
                 .then(({ id: messageId }) =>
                   parentConversation.runAgentLoop(notifyMessage, messageId),
                 )

package/src/api/events/acp-session-update.test.ts

@@ -42,6 +42,58 @@ describe("AcpSessionUpdateEventSchema", () => {
     ).toEqual([{ path: "src/baz.ts", line: 7 }]);
   });
 
+  test("accepts a tool_call event carrying object rawInput/rawOutput", () => {
+    const event = {
+      type: "acp_session_update" as const,
+      acpSessionId: "acp-1",
+      updateType: "tool_call" as const,
+      toolCallId: "tool-1",
+      rawInput: { command: "ls -la", cwd: "/tmp" },
+      rawOutput: { exitCode: 0, stdout: "file.txt" },
+    };
+
+    const result = AcpSessionUpdateEventSchema.safeParse(event);
+    expect(result.success).toBe(true);
+    expect(result.success && result.data.rawInput).toEqual({
+      command: "ls -la",
+      cwd: "/tmp",
+    });
+    expect(result.success && result.data.rawOutput).toEqual({
+      exitCode: 0,
+      stdout: "file.txt",
+    });
+  });
+
+  test("accepts a tool_call_update event carrying string rawInput/rawOutput", () => {
+    const event = {
+      type: "acp_session_update" as const,
+      acpSessionId: "acp-1",
+      updateType: "tool_call_update" as const,
+      toolCallId: "tool-1",
+      rawInput: "ls -la",
+      rawOutput: "file.txt",
+    };
+
+    const result = AcpSessionUpdateEventSchema.safeParse(event);
+    expect(result.success).toBe(true);
+    expect(result.success && result.data.rawInput).toBe("ls -la");
+    expect(result.success && result.data.rawOutput).toBe("file.txt");
+  });
+
+  test("still accepts a tool_call event omitting rawInput/rawOutput (optional)", () => {
+    const event = {
+      type: "acp_session_update" as const,
+      acpSessionId: "acp-1",
+      updateType: "tool_call" as const,
+      toolCallId: "tool-1",
+    };
+
+    const result = AcpSessionUpdateEventSchema.safeParse(event);
+    expect(result.success).toBe(true);
+    expect(result.success && result.data.rawInput).toBeUndefined();
+    expect(result.success && result.data.rawOutput).toBeUndefined();
+  });
+
   test("still accepts a normal event without locations", () => {
     const event = {
       type: "acp_session_update" as const,

package/src/api/events/acp-session-update.ts

@@ -34,6 +34,9 @@ export const AcpSessionUpdateEventSchema = z
     toolTitle: z.string().optional(),
     toolKind: z.string().optional(),
     toolStatus: z.string().optional(),
+    /** Optional raw tool input/output (ACP rawInput/rawOutput); apply to tool_call/tool_call_update. */
+    rawInput: z.unknown().optional(),
+    rawOutput: z.unknown().optional(),
     /** Files touched by this tool call (for the file-diff affordance). */
     locations: z
       .array(z.object({ path: z.string(), line: z.number().optional() }))

package/src/api/responses/conversation-message.ts

@@ -283,6 +283,19 @@ export type ConversationSubagentNotification = z.infer<
   typeof ConversationSubagentNotificationSchema
 >;
 
+// ---------------------------------------------------------------------------
+// ACP run notification
+// ---------------------------------------------------------------------------
+
+/** Daemon-injected ACP-run lifecycle notification attached to a history row. */
+export const ConversationAcpNotificationSchema = z.object({
+  acpSessionId: z.string(),
+  agent: z.string().optional(),
+});
+export type ConversationAcpNotification = z.infer<
+  typeof ConversationAcpNotificationSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Slack message envelope
 // ---------------------------------------------------------------------------
@@ -530,6 +543,7 @@ export const ConversationMessageSchema = z.object({
    */
   contentBlocks: z.array(ConversationContentBlockSchema).optional(),
   subagentNotification: ConversationSubagentNotificationSchema.optional(),
+  acpNotification: ConversationAcpNotificationSchema.optional(),
   slackMessage: ConversationSlackMessageSchema.optional(),
   /**
    * Queue state for a user message that is still waiting in the daemon's

package/src/daemon/conversation-process.ts

@@ -61,18 +61,20 @@ import { resolveVerificationSessionIntent } from "./verification-session-intent.
 const log = getLogger("conversation-process");
 
 /**
- * Daemon-injected subagent lifecycle notifications carry `subagentNotification`
- * metadata. They are persisted into the parent conversation so the orchestrator
- * wakes and reads the subagent's result, but they are internal scaffolding — the
- * user sees subagent activity through the inline progress card, not a chat turn.
- * Skip the `user_message_echo` broadcast for these so they never render as a live
- * user bubble; the persisted row is filtered from the rendered transcript on the
- * client.
+ * Daemon-injected run lifecycle notifications — subagent (`subagentNotification`)
+ * and ACP run (`acpNotification`) — are persisted into the parent conversation so
+ * the orchestrator wakes and reads the run's result, but they are internal
+ * scaffolding: the user sees the run through its inline progress card, not a chat
+ * turn. Skip the `user_message_echo` broadcast for these so they never render as a
+ * live user bubble; the persisted row is filtered from the rendered transcript on
+ * the client.
  */
-function isSubagentNotificationMessage(
+function isHiddenRunNotificationMessage(
   metadata: Record<string, unknown> | undefined,
 ): boolean {
-  return metadata?.subagentNotification != null;
+  return (
+    metadata?.subagentNotification != null || metadata?.acpNotification != null
+  );
 }
 
 /** Format the result of a forced compaction into a user-facing message. */
@@ -868,7 +870,7 @@ async function drainSingleMessage(
 
   // Broadcast the user message to all hub subscribers so passive devices
   // see the user turn before the assistant reply starts streaming.
-  if (!isSubagentNotificationMessage(next.metadata)) {
+  if (!isHiddenRunNotificationMessage(next.metadata)) {
     next.onEvent({
       type: "user_message_echo",
       text: resolvedContent,
@@ -1221,7 +1223,7 @@ async function drainBatch(
 
     // Broadcast the user message to all hub subscribers so passive devices
     // see each batched user turn before the assistant reply starts streaming.
-    if (!isSubagentNotificationMessage(qm.metadata)) {
+    if (!isHiddenRunNotificationMessage(qm.metadata)) {
       qm.onEvent({
         type: "user_message_echo",
         text: qmContent,

package/src/daemon/message-types/acp.ts

@@ -28,6 +28,10 @@ export interface AcpSessionUpdate {
   toolTitle?: string;
   toolKind?: string;
   toolStatus?: string;
+  /** Optional raw input parameters sent to the tool (ACP `rawInput`); shape is tool-specific. */
+  rawInput?: unknown;
+  /** Optional raw output returned by the tool (ACP `rawOutput`); shape is tool-specific. */
+  rawOutput?: unknown;
   /** Files touched by this tool call (for the file-diff affordance). */
   locations?: { path: string; line?: number }[];
   /** Stable id for the message this chunk belongs to. */

package/src/persistence/conversation-crud.ts

@@ -143,6 +143,11 @@ const subagentNotificationSchema = z.object({
   objective: z.string().optional(),
 });
 
+const acpNotificationSchema = z.object({
+  acpSessionId: z.string(),
+  agent: z.string().optional(),
+});
+
 export const messageMetadataSchema = z
   .object({
     userMessageChannel: channelIdSchema.optional(),
@@ -160,6 +165,7 @@ export const messageMetadataSchema = z
      */
     client: z.record(z.string(), z.unknown()).optional(),
     subagentNotification: subagentNotificationSchema.optional(),
+    acpNotification: acpNotificationSchema.optional(),
     /**
      * Trust class of the actor at the time this message was persisted.
      * This is a durable snapshot -- it does NOT change if the actor's

package/src/persistence/migrations/309-drop-redundant-indexes.ts

@@ -0,0 +1,60 @@
+import type { DrizzleDb } from "../db-connection.js";
+
+/**
+ * Drop nine redundant single-/narrow-column indexes whose columns are a
+ * leading prefix of a wider, non-partial index already present on the same
+ * table. SQLite uses the wider index to serve the narrower lookup (a prefix of
+ * its key), so the narrow index adds nothing on reads while still costing a
+ * B-tree write on every insert/update to the table. Dropping them trims
+ * write-amplification on hot tables (`messages`, `trace_events`,
+ * `notification_deliveries`) and frees space on the rest.
+ *
+ * Each drop and the index that subsumes it (verified non-partial, so it covers
+ * all rows the narrow index did):
+ *
+ *   messages
+ *     idx_messages_conversation_id [conversation_id]
+ *       ⊂ idx_messages_conversation_created_at [conversation_id, created_at]
+ *   trace_events
+ *     idx_trace_events_conversation_id [conversation_id]
+ *       ⊂ idx_trace_events_conversation_timestamp [conversation_id, timestamp_ms]
+ *   notification_deliveries
+ *     idx_notification_deliveries_decision_id [notification_decision_id]
+ *       ⊂ idx_notification_deliveries_unique
+ *           [notification_decision_id, channel, destination, attempt]
+ *   external_conversation_bindings
+ *     idx_ext_conv_bindings_channel [source_channel]
+ *     idx_ext_conv_bindings_channel_chat [source_channel, external_chat_id]
+ *       both ⊂ idx_ext_conv_bindings_channel_chat_thread
+ *           [source_channel, external_chat_id, external_thread_id]
+ *   followups
+ *     idx_followups_channel [channel] ⊂ idx_followups_channel_thread
+ *           [channel, conversation_id]
+ *     idx_followups_status [status] ⊂ idx_followups_status_expected
+ *           [status, expected_response_by]
+ *   guardian_action_requests
+ *     idx_guardian_action_requests_call_session [call_session_id]
+ *       ⊂ idx_guardian_action_requests_session_status_created
+ *           [call_session_id, status, created_at]
+ *   media_keyframes
+ *     idx_media_keyframes_asset_id [asset_id]
+ *       ⊂ idx_media_keyframes_asset_timestamp [asset_id, timestamp]
+ *
+ * `IF EXISTS` keeps this idempotent and tolerant of databases where an index
+ * was never created.
+ */
+export function migrateDropRedundantIndexes(database: DrizzleDb): void {
+  for (const name of [
+    "idx_messages_conversation_id",
+    "idx_trace_events_conversation_id",
+    "idx_notification_deliveries_decision_id",
+    "idx_ext_conv_bindings_channel",
+    "idx_ext_conv_bindings_channel_chat",
+    "idx_followups_channel",
+    "idx_followups_status",
+    "idx_guardian_action_requests_call_session",
+    "idx_media_keyframes_asset_id",
+  ]) {
+    database.run(/*sql*/ `DROP INDEX IF EXISTS ${name}`);
+  }
+}

package/src/persistence/schema/conversations.ts

@@ -99,7 +99,6 @@ export const messages = sqliteTable(
     clientMessageId: text("client_message_id"),
   },
   (table) => [
-    index("idx_messages_conversation_id").on(table.conversationId),
     uniqueIndex("idx_messages_conv_client_msg_id")
       .on(table.conversationId, table.clientMessageId)
       .where(sql`client_message_id IS NOT NULL`),

package/src/persistence/schema/infrastructure.ts

@@ -373,7 +373,6 @@ export const traceEvents = sqliteTable(
     createdAt: integer("created_at").notNull(),
   },
   (table) => [
-    index("idx_trace_events_conversation_id").on(table.conversationId),
     index("idx_trace_events_conversation_timestamp").on(
       table.conversationId,
       table.timestampMs,

package/src/persistence/steps.ts

@@ -416,6 +416,7 @@ import { migrateDropContactAclColumns } from "./migrations/305-drop-contact-acl-
 import { migrateRewriteFrontierProfilePins } from "./migrations/306-rewrite-frontier-profile-pins.js";
 import { migrateAcpSessionHistoryUsageColumns } from "./migrations/307-acp-session-history-usage-columns.js";
 import { migrateAcpSessionHistoryTokenColumns } from "./migrations/308-acp-session-history-token-columns.js";
+import { migrateDropRedundantIndexes } from "./migrations/309-drop-redundant-indexes.js";
 import type { MigrationStep } from "./migrations/run-migrations.js";
 
 export const migrationSteps: MigrationStep[] = [
@@ -1303,4 +1304,5 @@ export const migrationSteps: MigrationStep[] = [
   migrateRewriteFrontierProfilePins,
   migrateAcpSessionHistoryUsageColumns,
   migrateAcpSessionHistoryTokenColumns,
+  migrateDropRedundantIndexes,
 ];

package/src/runtime/routes/acp-routes-event-log.test.ts

@@ -155,6 +155,57 @@ describe("GET /v1/acp/sessions — eventLog", () => {
     expect(eventLog[0]?.content).toBe("persisted");
   });
 
+  test("active and terminal sessions both surface tool_call rawInput/rawOutput in eventLog", async () => {
+    const rawInput = { command: "grep -rn foo", pattern: "foo" };
+    const rawOutput = "src/a.ts:1: foo\nsrc/b.ts:9: foo";
+
+    const activeToolCall: AcpSessionUpdate = {
+      type: "acp_session_update",
+      acpSessionId: "active",
+      updateType: "tool_call",
+      toolCallId: "tc-active",
+      toolKind: "search",
+      toolStatus: "completed",
+      rawInput,
+      rawOutput,
+      seq: 1,
+    };
+    inMemoryStates.set("active", makeInMemoryState("active", "conv-1"));
+    bufferedUpdates.set("active", [activeToolCall]);
+
+    insertHistoryRow({
+      id: "terminal",
+      parentConversationId: "conv-1",
+      eventLogJson: JSON.stringify([
+        {
+          type: "acp_session_update",
+          acpSessionId: "terminal",
+          updateType: "tool_call",
+          toolCallId: "tc-terminal",
+          toolKind: "search",
+          toolStatus: "completed",
+          rawInput,
+          rawOutput,
+          seq: 1,
+        } satisfies AcpSessionUpdate,
+      ]),
+    });
+
+    const handler = getListHandler();
+    const result = (await handler({
+      queryParams: { conversationId: "conv-1" },
+    })) as { sessions: Array<Record<string, unknown>> };
+
+    for (const id of ["active", "terminal"]) {
+      const session = result.sessions.find((s) => s.id === id);
+      expect(session).toBeDefined();
+      const eventLog = session?.eventLog as AcpSessionUpdate[];
+      expect(eventLog).toHaveLength(1);
+      expect(eventLog[0]?.rawInput).toEqual(rawInput);
+      expect(eventLog[0]?.rawOutput).toBe(rawOutput);
+    }
+  });
+
   test("active in-memory session surfaces latestUsage as the usage fields", async () => {
     inMemoryStates.set(
       "active",

package/src/runtime/routes/conversation-routes.ts

@@ -837,6 +837,7 @@ export function handleListMessages({
           conversationId?: string;
         }
       | undefined;
+    let acpNotification: { acpSessionId: string; agent?: string } | undefined;
     if (msg.metadata) {
       try {
         const meta = JSON.parse(msg.metadata);
@@ -858,6 +859,15 @@ export function handleListMessages({
             };
           }
         }
+        if (meta.acpNotification) {
+          const n = meta.acpNotification;
+          if (typeof n.acpSessionId === "string") {
+            acpNotification = {
+              acpSessionId: n.acpSessionId,
+              ...(typeof n.agent === "string" ? { agent: n.agent } : {}),
+            };
+          }
+        }
       } catch {
         // Ignore malformed metadata
       }
@@ -883,6 +893,7 @@ export function handleListMessages({
       createdAt: msg.createdAt,
       sentAt,
       subagentNotification,
+      acpNotification,
       slackMessage,
       clientMessageId: msg.clientMessageId ?? undefined,
     };
@@ -1066,6 +1077,7 @@ export function handleListMessages({
       ...(m.subagentNotification
         ? { subagentNotification: m.subagentNotification }
         : {}),
+      ...(m.acpNotification ? { acpNotification: m.acpNotification } : {}),
       ...(m.slackMessage ? { slackMessage: m.slackMessage } : {}),
     };
   });

package/src/security/redaction.ts

@@ -57,11 +57,24 @@ function isSensitiveKey(key: string): boolean {
   return SENSITIVE_STEMS.has(normalizeKey(key));
 }
 
+/**
+ * Recurse a value of any shape, redacting sensitive fields within. Walks
+ * arrays at every depth (including arrays nested in arrays) so a sensitive
+ * key buried under array nesting can't bypass field-name redaction.
+ */
+function redactValue(val: unknown): unknown {
+  if (Array.isArray(val)) return val.map(redactValue);
+  if (val != null && typeof val === "object") {
+    return redactSensitiveFields(val as Record<string, unknown>);
+  }
+  return val;
+}
+
 /**
  * Recursively redact sensitive fields from an object.
  *
  * - Replaces values of sensitive keys with `<redacted />` regardless of type
- * - Recurses into nested objects and arrays
+ * - Recurses into nested objects and arrays at any depth
  * - Returns a shallow copy — never mutates the original
  */
 export function redactSensitiveFields(
@@ -70,19 +83,10 @@ export function redactSensitiveFields(
   const result: Record<string, unknown> = {};
 
   for (const [key, val] of Object.entries(obj)) {
-    if (isSensitiveKey(key) && val != null) {
-      result[key] = REDACTION_PLACEHOLDER;
-    } else if (Array.isArray(val)) {
-      result[key] = val.map((item) =>
-        item != null && typeof item === "object" && !Array.isArray(item)
-          ? redactSensitiveFields(item as Record<string, unknown>)
-          : item,
-      );
-    } else if (val != null && typeof val === "object") {
-      result[key] = redactSensitiveFields(val as Record<string, unknown>);
-    } else {
-      result[key] = val;
-    }
+    result[key] =
+      isSensitiveKey(key) && val != null
+        ? REDACTION_PLACEHOLDER
+        : redactValue(val);
   }
 
   return result;