@vellumai/assistant 0.10.3-dev.202606301940.da6000c → 0.10.3-dev.202606302138.0f63073

package/openapi.yaml

@@ -20818,7 +20818,10 @@ paths:
       description:
         Return one entry per directory under `<workspaceDir>/plugins/`, sorted alphabetically. Matches the CLI's
         `assistant plugins list`. Supports `?q=<text>` for case-insensitive substring matching across plugin id, name,
-        and description.
+        and description. Each entry carries a `category` (marketplace slug from the Skills taxonomy, or `null` for
+        non-marketplace installs); the response also reports `categoryCounts` (per-category totals, computed before the
+        category filter) and `totalCount`. `?category=<slug>` filters the returned plugins by category server-side while
+        leaving the counts unfiltered. A marketplace outage degrades `category` to `null` without failing the list.
       tags:
         - plugins
       parameters:
@@ -20828,6 +20831,12 @@ paths:
           schema:
             type: string
           description: Optional substring filter applied to plugin id, name, and description.
+        - name: category
+          in: query
+          required: false
+          schema:
+            type: string
+          description: Filter installed plugins by category slug (Skills taxonomy).
       responses:
         "200":
           description: Successful response
@@ -20865,12 +20874,29 @@ paths:
                           type: array
                           items:
                             type: string
+                        category:
+                          description:
+                            Marketplace category slug (Skills taxonomy); null when origin/category is unknown, e.g. non-marketplace
+                            installs.
+                          anyOf:
+                            - type: string
+                            - type: "null"
                       required:
                         - id
                         - name
                         - description
                         - version
                       additionalProperties: false
+                  categoryCounts:
+                    description: Installed plugins per category (before the category filter is applied).
+                    type: object
+                    propertyNames:
+                      type: string
+                    additionalProperties:
+                      type: number
+                  totalCount:
+                    description: Total installed plugins matching non-category filters.
+                    type: number
                 required:
                   - plugins
                 additionalProperties: false
@@ -21731,6 +21757,11 @@ paths:
                         description:
                           description: Short description, when known (external entries only today).
                           type: string
+                        category:
+                          anyOf:
+                            - type: string
+                            - type: "null"
+                          description: Marketplace category slug (Skills taxonomy); null when the entry declares none.
                         source:
                           type: object
                           properties:
@@ -21755,6 +21786,7 @@ paths:
                       required:
                         - name
                         - path
+                        - category
                         - source
                       additionalProperties: false
                     description: Directory matches, sorted alphabetically by name.
@@ -22668,7 +22700,7 @@ paths:
     post:
       operationId: schedules_post
       summary: Create schedule
-      description: Create a new recurring schedule. Currently restricted to mode='execute'.
+      description: Create a new recurring schedule (execute, script, or workflow mode).
       tags:
         - schedules
       requestBody:
@@ -22702,12 +22734,20 @@ paths:
                   description: Whether the schedule starts active (default true)
                 mode:
                   type: string
-                  description: "'execute' (default) or 'workflow' (flag-gated)"
+                  description: "'execute' (default), 'script', or 'workflow' (flag-gated)"
                 workflowName:
                   type: string
                   description: Saved workflow to trigger (required for workflow mode)
                 workflowArgs:
                   description: Args passed to the workflow run (workflow mode)
+                script:
+                  type: string
+                  description: Shell command run on each fire (required for script mode)
+                timeoutMs:
+                  anyOf:
+                    - type: number
+                    - type: "null"
+                  description: Script execution timeout override in ms (script mode)
                 inferenceProfile:
                   anyOf:
                     - type: string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.3-dev.202606301940.da6000c",
+  "version": "0.10.3-dev.202606302138.0f63073",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/anthropic-provider.test.ts

@@ -3245,11 +3245,14 @@ describe("AnthropicProvider — deprecated sampling params (temperature / top_p
     lastStreamParams = null;
   });
 
-  // opus-4-7 / opus-4-8 (and, conservatively, fable) reject `temperature`,
-  // `top_p`, and `top_k` with a 400; the provider must strip all three.
+  // opus-4-7 / opus-4-8 / sonnet-5 (and, conservatively, fable) reject
+  // `temperature`, `top_p`, and `top_k` with a 400; the provider must strip
+  // all three. The OpenRouter `anthropic/...` form delegates here too.
   for (const model of [
     "claude-opus-4-8",
     "claude-opus-4-7",
+    "claude-sonnet-5",
+    "anthropic/claude-sonnet-5",
     "claude-fable-5",
   ]) {
     test(`strips temperature, top_p, and top_k for ${model}`, async () => {

package/src/__tests__/conversation-initial-prompt.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Tests for construction-time system-prompt resolution.
+ *
+ * A conversation's system prompt is built once at construction and frozen for
+ * every turn (the agent loop never re-resolves it), so the persona slot must
+ * resolve correctly here. With no construction-time identity the default-build
+ * path must warm the gateway guardian binding BEFORE building (else a cold cache
+ * pins `users/default.md`); a channel-routed conversation that already carries
+ * the requester's trust context must build with it so the requester's profile
+ * resolves instead of the guardian/default one.
+ *
+ * Dependency seams are injected so this exercises the sequencing without mocking
+ * the widely-imported guardian-delivery / system-prompt modules (those global
+ * module mocks leak across files in the shared-process test runner).
+ */
+import { describe, expect, test } from "bun:test";
+
+import {
+  resolveInitialSystemPrompt,
+  warmGuardianBindings,
+} from "../daemon/conversation-initial-prompt.js";
+import type { ConversationCreateOptions } from "../daemon/handlers/shared.js";
+import type { TrustContext } from "../daemon/trust-context.js";
+
+function spyDeps() {
+  const calls: string[] = [];
+  const builtWith: Array<TrustContext | undefined> = [];
+  return {
+    calls,
+    builtWith,
+    deps: {
+      warm: async () => {
+        calls.push("warm");
+      },
+      build: (trustContext: TrustContext | undefined) => {
+        calls.push("build");
+        builtWith.push(trustContext);
+        return "BUILD";
+      },
+    },
+  };
+}
+
+const REQUESTER_TRUST = {
+  sourceChannel: "slack",
+  trustClass: "trusted_contact",
+  requesterExternalUserId: "user-123",
+} as unknown as TrustContext;
+
+describe("warmGuardianBindings", () => {
+  test("warms both the vellum-channel key and the unfiltered fallback key", async () => {
+    const keys: string[] = [];
+    await warmGuardianBindings(async (input) => {
+      keys.push(input?.channelTypes?.join(",") ?? "ALL");
+      return null;
+    });
+    // Both keys the persona resolver reads — peekGuardianForChannel("vellum")
+    // and its peekAnyGuardian() fallback — must be warmed.
+    expect(keys.sort()).toEqual(["ALL", "vellum"]);
+  });
+});
+
+describe("resolveInitialSystemPrompt", () => {
+  test("no construction-time identity: warms the guardian binding, then builds with no trust context", async () => {
+    const { calls, builtWith, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(undefined, deps);
+
+    expect(result).toBe("BUILD");
+    // The warm MUST precede the build so the persona slot resolves the
+    // guardian's users/<slug>.md instead of users/default.md on a cold cache.
+    expect(calls).toEqual(["warm", "build"]);
+    expect(builtWith).toEqual([undefined]);
+  });
+
+  test("channel-routed: threads the requester trust context and skips the guardian warm", async () => {
+    const { calls, builtWith, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(
+      { trustContext: REQUESTER_TRUST } as ConversationCreateOptions,
+      deps,
+    );
+
+    expect(result).toBe("BUILD");
+    // The requester's identity resolves the persona via a DB lookup, so no
+    // guardian-cache warm is needed and the trust context must reach the build.
+    expect(calls).toEqual(["build"]);
+    expect(builtWith).toEqual([REQUESTER_TRUST]);
+  });
+
+  test("an explicit override is used verbatim and skips the warm and build", async () => {
+    const { calls, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(
+      { systemPromptOverride: "CUSTOM PROMPT" } as ConversationCreateOptions,
+      deps,
+    );
+
+    expect(result).toBe("CUSTOM PROMPT");
+    expect(calls).toEqual([]);
+  });
+
+  test("an explicit empty-string override is honored verbatim (not treated as absent)", async () => {
+    const { calls, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(
+      { systemPromptOverride: "" } as ConversationCreateOptions,
+      deps,
+    );
+
+    expect(result).toBe("");
+    expect(calls).toEqual([]);
+  });
+});

package/src/__tests__/conversation-loop-db-lock-resilience.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Regression tests for SQLite write-contention resilience in the agent loop.
+ *
+ * When another writer holds the SQLite write lock long enough that
+ * `busy_timeout` elapses, an in-loop content write throws `SQLITE_BUSY`
+ * ("database is locked"). The turn-finalizing write at `message_complete` is on
+ * `dispatchAgentEvent`'s re-throw allowlist, so before this resilience layer a
+ * single transient lock aborted the whole turn and surfaced to the user as
+ * "Processing failed: database is locked".
+ *
+ * These tests pin the two guarantees:
+ *  1. A transient `SQLITE_BUSY` is retried and the row is finalized normally.
+ *  2. A persistent `SQLITE_BUSY` is swallowed (logged) so the turn continues
+ *     instead of throwing — a later write (this turn or the next) overwrites
+ *     the dropped content.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Mock platform (must precede imports that read it) ─────────────────────────
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ memory: {} }),
+  loadConfig: () => ({}),
+}));
+
+// `updateMessageContent` throws `SQLITE_BUSY` for the first
+// `updateContentFailuresRemaining` calls, then records the content written.
+let updateContentFailuresRemaining = 0;
+const writtenContentById = new Map<string, string>();
+const updateMessageContentMock = mock((id: string, content: string) => {
+  if (updateContentFailuresRemaining > 0) {
+    updateContentFailuresRemaining -= 1;
+    throw Object.assign(new Error("database is locked"), {
+      code: "SQLITE_BUSY",
+    });
+  }
+  writtenContentById.set(id, content);
+});
+
+// Stand-in for the `conversations.seq` column, mirroring the monotonic,
+// ignore-non-positive semantics of the real `recordConversationPersistedSeq`.
+const persistedSeqByConversation = new Map<string, number>();
+
+mock.module("../persistence/conversation-crud.js", () => ({
+  setConversationProcessingStartedAt: () => {},
+  isConversationProcessing: () => false,
+  getConversation: () => null,
+  getMessageById: () => null,
+  updateMessageContent: updateMessageContentMock,
+  provenanceFromTrustContext: () => ({}),
+  reserveMessage: async (_conversationId: string, role: string) => ({
+    id: role === "user" ? "tool-result-row" : "assistant-row",
+  }),
+  recordConversationPersistedSeq: (id: string, seq: number) => {
+    if (!Number.isFinite(seq) || seq <= 0) return;
+    const prev = persistedSeqByConversation.get(id);
+    if (prev == null || prev < seq) persistedSeqByConversation.set(id, seq);
+  },
+  getConversationPersistedSeq: (id: string) =>
+    persistedSeqByConversation.get(id) ?? null,
+}));
+
+mock.module("../persistence/conversation-disk-view.js", () => ({
+  syncMessageToDisk: () => {},
+}));
+
+mock.module("../persistence/llm-request-log-store.js", () => ({
+  recordRequestLog: () => {},
+  backfillMessageIdOnLogs: () => {},
+}));
+
+mock.module("../plugins/defaults/memory/memory-recall-log-store.js", () => ({
+  backfillMemoryRecallLogMessageId: () => {},
+}));
+
+mock.module(
+  "../plugins/defaults/memory/memory-v2-activation-log-store.js",
+  () => ({
+    backfillMemoryV2ActivationMessageId: () => {},
+  }),
+);
+
+// ── Imports (after mocks) ─────────────────────────────────────────────────────
+import type { AgentEvent } from "../agent/loop.js";
+import type {
+  EventHandlerDeps,
+  EventHandlerState,
+} from "../daemon/conversation-agent-loop-handlers.js";
+import {
+  createEventHandlerState,
+  handleMessageComplete,
+} from "../daemon/conversation-agent-loop-handlers.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
+import { getConversationPersistedSeq } from "../persistence/conversation-crud.js";
+
+const CONVERSATION_ID = "test-session-id";
+
+function createMockDeps(): EventHandlerDeps {
+  return {
+    ctx: {
+      conversationId: CONVERSATION_ID,
+      provider: { name: "anthropic" },
+      traceEmitter: { emit: () => {} },
+      streamThinking: false,
+      emitActivityState: () => {},
+      markWorkspaceTopLevelDirty: () => {},
+      currentTurnSurfaces: [],
+    } as unknown as EventHandlerDeps["ctx"],
+    onEvent: (_msg: ServerMessage) => {},
+    reqId: "test-req-id",
+    isFirstMessage: false,
+    shouldGenerateTitle: false,
+    rlog: new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }) as unknown as EventHandlerDeps["rlog"],
+    turnChannelContext: {
+      userMessageChannel: "vellum",
+      assistantMessageChannel: "vellum",
+    } as EventHandlerDeps["turnChannelContext"],
+    turnInterfaceContext: {
+      userMessageInterface: "macos",
+      assistantMessageInterface: "macos",
+    } as EventHandlerDeps["turnInterfaceContext"],
+  } as EventHandlerDeps;
+}
+
+const MESSAGE_COMPLETE_EVENT = {
+  type: "message_complete",
+  message: { role: "assistant", content: [{ type: "text", text: "done" }] },
+} as Extract<AgentEvent, { type: "message_complete" }>;
+
+describe("agent loop SQLite write-contention resilience", () => {
+  let state: EventHandlerState;
+
+  beforeEach(() => {
+    state = createEventHandlerState();
+    // A row was reserved at llm_call_started; message_complete finalizes it.
+    state.lastAssistantMessageId = "assistant-row";
+    state.assistantRowAwaitingFinalization = true;
+    state.lastPersistedContentSeq = 5;
+    updateContentFailuresRemaining = 0;
+    writtenContentById.clear();
+    persistedSeqByConversation.clear();
+    updateMessageContentMock.mockClear();
+  });
+
+  test("retries a transient SQLITE_BUSY and finalizes the assistant row", async () => {
+    // GIVEN the finalize write loses the write-lock race twice before winning
+    updateContentFailuresRemaining = 2;
+
+    // WHEN message_complete drains
+    await handleMessageComplete(
+      state,
+      createMockDeps(),
+      MESSAGE_COMPLETE_EVENT,
+    );
+
+    // THEN it retried until the write committed (2 failures + 1 success) ...
+    expect(updateMessageContentMock).toHaveBeenCalledTimes(3);
+    expect(writtenContentById.get("assistant-row")).toContain("done");
+    // ... the finalization completed ...
+    expect(state.assistantRowAwaitingFinalization).toBe(false);
+    // ... and the persisted seq advanced because the content is durable.
+    expect(getConversationPersistedSeq(CONVERSATION_ID)).toBe(5);
+  });
+
+  test("swallows a persistent SQLITE_BUSY without aborting the turn", async () => {
+    // GIVEN every finalize attempt loses the race (lock held past every retry)
+    updateContentFailuresRemaining = Number.POSITIVE_INFINITY;
+
+    // WHEN message_complete drains, it must resolve rather than throw — a thrown
+    // SQLITE_BUSY here is on dispatchAgentEvent's re-throw allowlist and would
+    // kill the turn.
+    await expect(
+      handleMessageComplete(state, createMockDeps(), MESSAGE_COMPLETE_EVENT),
+    ).resolves.toBeUndefined();
+
+    // THEN the write was attempted (initial try + the retries) ...
+    expect(updateMessageContentMock.mock.calls.length).toBeGreaterThan(1);
+    // ... no content landed ...
+    expect(writtenContentById.has("assistant-row")).toBe(false);
+    // ... and the seq was NOT advanced past content that never became durable.
+    expect(getConversationPersistedSeq(CONVERSATION_ID)).toBeNull();
+  });
+});

package/src/__tests__/openai-provider.test.ts

@@ -400,6 +400,39 @@ describe("OpenAIProvider", () => {
     expect(events[1]).toEqual({ type: "text_delta", text: ", world!" });
   });
 
+  test("fires tool preview and argument progress events while tool calls stream", async () => {
+    fakeChunks = [
+      ...toolCallChunks([
+        {
+          id: "call_write",
+          name: "app_create",
+          args: '{"source_files":[{"path":"src/App.tsx","content":"hello"}]}',
+        },
+      ]),
+      usageChunk(10, 15),
+    ];
+
+    const events: ProviderEvent[] = [];
+    await provider.sendMessage([userMsg("Create an app")], {
+      onEvent: (e) => events.push(e),
+    });
+
+    expect(events.slice(0, 2)).toEqual([
+      {
+        type: "tool_use_preview_start",
+        toolUseId: "call_write",
+        toolName: "app_create",
+      },
+      {
+        type: "input_json_delta",
+        toolUseId: "call_write",
+        toolName: "app_create",
+        accumulatedJson:
+          '{"source_files":[{"path":"src/App.tsx","content":"hello"}]}',
+      },
+    ]);
+  });
+
   // -----------------------------------------------------------------------
   // Reasoning content (MiniMax / DeepSeek extension)
   // -----------------------------------------------------------------------

package/src/__tests__/openai-responses-provider.test.ts

@@ -89,6 +89,10 @@ function textDeltaEvent(delta: string): FakeStreamEvent {
   return { type: "response.output_text.delta", delta };
 }
 
+function userMsg(text: string): Message {
+  return { role: "user", content: [{ type: "text", text }] };
+}
+
 function functionCallAddedEvent(
   callId: string,
   name: string,
@@ -395,6 +399,42 @@ describe("OpenAIResponsesProvider", () => {
     });
   });
 
+  test("fires tool preview and argument progress events while tool calls stream", async () => {
+    fakeStreamEvents = [
+      functionCallAddedEvent("call_write", "app_create"),
+      functionCallArgsDeltaEvent(
+        '{"source_files":[{"path":"src/App.tsx","content":"hello"}]}',
+        "call_write",
+      ),
+      functionCallArgsDoneEvent(
+        "call_write",
+        "app_create",
+        '{"source_files":[{"path":"src/App.tsx","content":"hello"}]}',
+      ),
+      completedEvent(10, 15),
+    ];
+
+    const events: ProviderEvent[] = [];
+    await provider.sendMessage([userMsg("Create an app")], {
+      onEvent: (e) => events.push(e),
+    });
+
+    expect(events.slice(0, 2)).toEqual([
+      {
+        type: "tool_use_preview_start",
+        toolUseId: "call_write",
+        toolName: "app_create",
+      },
+      {
+        type: "input_json_delta",
+        toolUseId: "call_write",
+        toolName: "app_create",
+        accumulatedJson:
+          '{"source_files":[{"path":"src/App.tsx","content":"hello"}]}',
+      },
+    ]);
+  });
+
   // -----------------------------------------------------------------------
   // Mixed text + tool calls
   // -----------------------------------------------------------------------

package/src/__tests__/schedule-routes.test.ts

@@ -1241,7 +1241,7 @@ describe("POST /schedules — create", () => {
     expect(job.description).toBe("Description fallback");
   });
 
-  test("rejects modes other than execute/workflow", async () => {
+  test("rejects modes other than execute/workflow/script", async () => {
     await expect(
       postCreate({
         name: "x",
@@ -1250,7 +1250,9 @@ describe("POST /schedules — create", () => {
         message: "hi",
         mode: "notify",
       }),
-    ).rejects.toThrow("Only 'execute' and 'workflow' modes are supported");
+    ).rejects.toThrow(
+      "Only 'execute', 'script', and 'workflow' modes are supported",
+    );
   });
 
   test("rejects an unparseable expression", async () => {

package/src/cli/commands/__tests__/schedules.test.ts

@@ -748,6 +748,58 @@ describe("schedules create", () => {
     expect(exitFromIpcResultCalls).toEqual([mockIpcResult]);
     expect(errorLines).toEqual([]);
   });
+
+  test("creates a script-mode schedule with --mode script --script", async () => {
+    mockIpcResult = { ok: true, result: { schedules: [] } };
+
+    const { exitCode } = await runCommand([
+      "schedules",
+      "create",
+      "GitHub watcher",
+      "--mode",
+      "script",
+      "--script",
+      'cd "$VELLUM_WORKSPACE_DIR/schedules/$__SCHEDULE_ID" && bun poll.ts',
+      "--expression",
+      "*/15 * * * *",
+      "--description",
+      "Polls GitHub notifications",
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(ipcCalls).toEqual([
+      {
+        method: "createSchedule",
+        params: {
+          body: {
+            name: "GitHub watcher",
+            expression: "*/15 * * * *",
+            description: "Polls GitHub notifications",
+            enabled: true,
+            mode: "script",
+            script:
+              'cd "$VELLUM_WORKSPACE_DIR/schedules/$__SCHEDULE_ID" && bun poll.ts',
+          },
+        },
+      },
+    ]);
+  });
+
+  test("exits 1 when --mode script is missing --script", async () => {
+    const { exitCode } = await runCommand([
+      "schedules",
+      "create",
+      "Broken",
+      "--mode",
+      "script",
+      "--expression",
+      "*/15 * * * *",
+      "--description",
+      "no script",
+    ]);
+
+    expect(exitCode).toBe(1);
+  });
 });
 
 describe("schedules update", () => {