@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/routes/schedule-worker-routes.ts

@@ -0,0 +1,210 @@
+/**
+ * Schedule worker control endpoints (start / stop / status).
+ *
+ * These run inside the daemon so the worker process the daemon spawns is a
+ * direct child of the daemon — which is what makes it show up in the daemon's
+ * process tree (`assistant ps`) and lets the daemon tear it down on shutdown.
+ * The `assistant schedules worker` CLI is a thin IPC client over these routes;
+ * if it spawned the worker itself, the worker would be parented to the
+ * short-lived CLI process (reparented to init) instead of the daemon.
+ */
+
+import { z } from "zod";
+
+import {
+  getConfigReadOnly,
+  loadRawConfig,
+  saveRawConfig,
+  setNestedValue,
+} from "../../config/loader.js";
+import {
+  probeScheduleWorker,
+  ScheduleWorkerSpawnError,
+  spawnScheduleWorkerProcess,
+  stopScheduleWorkerProcess,
+} from "../../schedule/worker-control.js";
+import { getLogger } from "../../util/logger.js";
+import { getScheduleWorkerPidPath } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { InternalError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
+
+const log = getLogger("schedule-worker-routes");
+
+/**
+ * Persist `schedules.worker.enabled` to the on-disk config via the shared
+ * raw-config helpers, so only this leaf changes (schema defaults are not baked
+ * into the file). The daemon's scheduler re-reads the flag on its next tick,
+ * so the change takes effect without a restart.
+ */
+function setScheduleWorkerEnabled(enabled: boolean): void {
+  const raw = loadRawConfig();
+  setNestedValue(raw, "schedules.worker.enabled", enabled);
+  saveRawConfig(raw);
+}
+
+const workerStatusSchema = z.object({
+  status: z.enum(["running", "not_running"]),
+  pid: z.number().optional(),
+});
+
+const startResponseSchema = z.object({
+  pid: z.number(),
+  alreadyRunning: z.boolean(),
+  workerEnabled: z.literal(true),
+  pidPath: z.string(),
+});
+
+const stopResponseSchema = z.object({
+  workerWasRunning: z.boolean(),
+  pid: z.number().optional(),
+  workerEnabled: z.literal(false),
+});
+
+const statusResponseSchema = z.object({
+  status: z.enum(["running", "not_running"]),
+  pid: z.number().optional(),
+  workerEnabled: z.boolean(),
+  inProcessScheduler: workerStatusSchema,
+});
+
+/**
+ * Start (or reuse) the schedule worker process as a child of the daemon, then
+ * enable `schedules.worker.enabled` so the daemon's scheduler leaves schedule
+ * execution to it. The flag is only enabled once the worker is confirmed up —
+ * on spawn failure it is left untouched so the in-process scheduler keeps
+ * running schedules rather than standing down for a worker that never came
+ * up.
+ */
+async function startScheduleWorker() {
+  let result: { pid: number; alreadyRunning: boolean };
+  try {
+    // `detached: false` parents the worker to the daemon. `terminateOnTimeout`
+    // matches the leave-the-flag-off-on-failure contract below: a worker that
+    // came up late would otherwise run schedules alongside the in-process
+    // scheduler.
+    result = await spawnScheduleWorkerProcess({
+      detached: false,
+      terminateOnTimeout: true,
+    });
+  } catch (err) {
+    const message =
+      err instanceof ScheduleWorkerSpawnError || err instanceof Error
+        ? err.message
+        : String(err);
+    log.warn({ err }, "Failed to start schedule worker process");
+    throw new InternalError(message);
+  }
+
+  setScheduleWorkerEnabled(true);
+
+  return {
+    pid: result.pid,
+    alreadyRunning: result.alreadyRunning,
+    workerEnabled: true as const,
+    pidPath: getScheduleWorkerPidPath(),
+  };
+}
+
+/**
+ * Disable `schedules.worker.enabled` (handing schedule execution back to the
+ * in-process scheduler) and SIGTERM the worker process if it is running. A
+ * worker that is not running is not an error — flipping the flag alone
+ * restores in-process execution.
+ */
+function stopScheduleWorker() {
+  setScheduleWorkerEnabled(false);
+
+  let before: ReturnType<typeof stopScheduleWorkerProcess>;
+  try {
+    before = stopScheduleWorkerProcess();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.warn({ err }, "Failed to signal schedule worker process");
+    throw new InternalError(message);
+  }
+
+  return {
+    workerWasRunning: before.status === "running",
+    ...(before.pid != null ? { pid: before.pid } : {}),
+    workerEnabled: false as const,
+  };
+}
+
+/**
+ * Report the worker process state, the `schedules.worker.enabled` config
+ * value, and whether the daemon's own scheduler is currently executing
+ * schedules.
+ *
+ * The in-process scheduler executes schedules exactly when the flag is off
+ * (it stands down from claiming while the flag is on). This handler runs
+ * inside the daemon — the very process that is (or isn't) the in-process
+ * scheduler — so its state is derived directly from config, with the
+ * daemon's own PID, rather than read back from a marker file.
+ */
+function scheduleWorkerStatus() {
+  const worker = probeScheduleWorker();
+  const workerEnabled = getConfigReadOnly().schedules.worker.enabled;
+
+  const inProcessScheduler: {
+    status: "running" | "not_running";
+    pid?: number;
+  } = workerEnabled
+    ? { status: "not_running" }
+    : { status: "running", pid: process.pid };
+
+  return {
+    status: worker.status,
+    ...(worker.pid != null ? { pid: worker.pid } : {}),
+    workerEnabled,
+    inProcessScheduler,
+  };
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "schedules_worker_start",
+    endpoint: "schedules/worker/start",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: startScheduleWorker,
+    summary: "Start the schedule worker",
+    description:
+      "Spawns (or reuses) the schedule worker process as a child of the daemon and enables schedules.worker.enabled, so scheduled jobs run out of process.",
+    tags: ["system"],
+    responseBody: startResponseSchema,
+  },
+  {
+    operationId: "schedules_worker_stop",
+    endpoint: "schedules/worker/stop",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: stopScheduleWorker,
+    summary: "Stop the schedule worker",
+    description:
+      "Disables schedules.worker.enabled (handing schedule execution back to the in-process scheduler) and SIGTERMs the schedule worker process if it is running.",
+    tags: ["system"],
+    responseBody: stopResponseSchema,
+  },
+  {
+    operationId: "schedules_worker_status",
+    endpoint: "schedules/worker/status",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: scheduleWorkerStatus,
+    summary: "Schedule worker status",
+    description:
+      "Reports the schedule worker process state, schedules.worker.enabled, and whether the daemon's in-process scheduler is currently executing schedules.",
+    tags: ["system"],
+    responseBody: statusResponseSchema,
+  },
+];

package/src/runtime/routes/secret-routes.ts

@@ -24,10 +24,10 @@ import {
 import { getCesClient } from "../../credential-execution/ces-runtime.js";
 import type { CesClient } from "../../credential-execution/client.js";
 import { evictConversationsForReload } from "../../daemon/conversation-store.js";
-import { maybeReseedCapabilitiesAfterManagedCredential } from "../../daemon/memory-v2-startup.js";
 import { setSentryOrganizationId, setSentryUserId } from "../../instrument.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embedding-backend.js";
+import { maybeReseedCapabilitiesAfterManagedCredential } from "../../plugins/defaults/memory/v2/memory-v2-startup.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
 import { validateAtlasCloudApiKey } from "../../providers/atlascloud/client.js";
 import { validateGeminiApiKey } from "../../providers/gemini/client.js";

package/src/runtime/routes/surface-conversation-resolver.ts

@@ -53,6 +53,7 @@ export async function resolveSurfaceConversation(
   // unrelated rows.
   const escaped = surfaceId.replace(/[\\%_]/g, "\\$&");
   const row = rawGet<{ conversation_id: string }>(
+    "surfaceResolver:resolveConversation",
     `SELECT conversation_id FROM messages
      WHERE content LIKE ? ESCAPE '\\'
      ORDER BY created_at DESC

package/src/runtime/services/__tests__/analyze-conversation.test.ts

@@ -29,7 +29,18 @@ const mockGetMessages = mock(
 const mockCreateConversation = mock((_opts?: Record<string, unknown>) => ({
   id: "analysis-new",
 }));
-const mockAddMessage = mock(async () => ({ id: "msg-1" }));
+// Echo back the caller-supplied row id (the request id, under the
+// requestId-as-row-id invariant) so tests can assert the persisted message
+// row id matches the turn's request id. Falls back to "msg-1" when no id is
+// passed.
+const mockAddMessage = mock(
+  async (
+    _conversationId: string,
+    _role: string,
+    _content: string,
+    opts?: { id?: string },
+  ) => ({ id: opts?.id ?? "msg-1" }),
+);
 const mockFindAnalysisConversationFor = mock(
   (_parent: string) => null as { id: string } | null,
 );
@@ -106,7 +117,14 @@ beforeEach(() => {
   mockCreateConversation.mockReset();
   mockCreateConversation.mockImplementation(() => ({ id: "analysis-new" }));
   mockAddMessage.mockReset();
-  mockAddMessage.mockImplementation(async () => ({ id: "msg-1" }));
+  mockAddMessage.mockImplementation(
+    async (
+      _conversationId: string,
+      _role: string,
+      _content: string,
+      opts?: { id?: string },
+    ) => ({ id: opts?.id ?? "msg-1" }),
+  );
   mockFindAnalysisConversationFor.mockReset();
   mockFindAnalysisConversationFor.mockImplementation(() => null);
   mockGetConversationSource.mockReset();
@@ -168,12 +186,13 @@ describe("analyzeConversation", () => {
     if ("error" in result) throw new Error("expected success");
     expect(result.analysisConversationId).toBe("analysis-new");
 
-    // Persists the prompt as a user message with unknown trust.
+    // Persists the prompt as a user message with unknown trust, under a
+    // caller-minted row id (the turn's request id).
     expect(mockAddMessage).toHaveBeenCalledWith(
       "analysis-new",
       "user",
       expect.any(String),
-      { metadata: { provenanceTrustClass: "unknown" } },
+      { id: expect.any(String), metadata: { provenanceTrustClass: "unknown" } },
     );
 
     // Sets trust context to unknown.
@@ -193,11 +212,23 @@ describe("analyzeConversation", () => {
     expect(allowedTools).toBeInstanceOf(Set);
     expect(allowedTools?.size).toBe(0);
 
+    // requestId === userMessageId invariant: the id the prompt row was
+    // persisted under, the turn's currentRequestId, and the userMessageId
+    // handed to the agent loop are all the same value.
+    const persistedId = (
+      mockAddMessage.mock.calls as unknown as Array<
+        [string, string, string, { id?: string } | undefined]
+      >
+    )[0]?.[3]?.id;
+    expect(typeof persistedId).toBe("string");
+    expect(currentConversation.currentRequestId).toBe(persistedId ?? null);
+
     // Fires the agent loop with the analyzeConversation call-site so the
-    // per-call provider config flows through `resolveCallSiteConfig`.
+    // per-call provider config flows through `resolveCallSiteConfig`, keying
+    // the loop off the same id as userMessageId.
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
-      "msg-1",
+      persistedId,
       expect.objectContaining({
         isInteractive: false,
         isUserMessage: true,
@@ -287,12 +318,16 @@ describe("analyzeConversation", () => {
     // No new conversation row is created on reuse.
     expect(mockCreateConversation).not.toHaveBeenCalled();
 
-    // The new user message is appended to the existing analysis conversation.
+    // The new user message is appended to the existing analysis conversation,
+    // persisted under the turn's request id.
     expect(mockAddMessage).toHaveBeenCalledWith(
       "analysis-existing",
       "user",
       expect.any(String),
-      { metadata: { provenanceTrustClass: "guardian" } },
+      {
+        id: expect.any(String),
+        metadata: { provenanceTrustClass: "guardian" },
+      },
     );
   });
 
@@ -406,9 +441,19 @@ describe("analyzeConversation", () => {
   test("auto: routes the agent loop through callSite: 'analyzeConversation'", async () => {
     await analyzeConversation("conv-1", { trigger: "auto" });
 
+    // Same requestId === userMessageId invariant on the auto path: the row
+    // id the prompt was persisted under, currentRequestId, and the loop's
+    // userMessageId are the same value.
+    const persistedId = (
+      mockAddMessage.mock.calls as unknown as Array<
+        [string, string, string, { id?: string } | undefined]
+      >
+    )[0]?.[3]?.id;
+    expect(typeof persistedId).toBe("string");
+    expect(currentConversation.currentRequestId).toBe(persistedId ?? null);
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
-      "msg-1",
+      persistedId,
       expect.objectContaining({ callSite: "analyzeConversation" }),
     );
   });

package/src/runtime/services/__tests__/auto-analysis-enqueue.test.ts

@@ -1,4 +1,12 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
 
 mock.module("../../../util/logger.js", () => ({
   getLogger: () =>
@@ -42,11 +50,6 @@ mock.module("../../../config/assistant-feature-flags.js", () => ({
     flagEnabled,
 }));
 
-mock.module("../auto-analysis-guard.js", () => ({
-  AUTO_ANALYSIS_SOURCE: "auto-analysis",
-  isAutoAnalysisConversation: (_conversationId: string) => isAuto,
-}));
-
 mock.module(
   "../../../plugins/defaults/memory/memory-retrospective-enqueue.js",
   () => ({
@@ -79,6 +82,27 @@ mock.module("../../../persistence/jobs-store.js", () => ({
   },
 }));
 
+// Scope the sibling `auto-analysis-guard` stub to this suite so it does not
+// leak into auto-analysis-guard.test.ts, which exercises the real
+// `isAutoAnalysisConversation` in the same Bun process. Bun's `mock.module` is
+// process-global and not undone by `mock.restore()`; the capture spreads into a
+// plain object to freeze the real export by value (a namespace reference is a
+// live view that `mock.module` mutates in place).
+const actualAutoAnalysisGuard = {
+  ...(await import("../auto-analysis-guard.js")),
+};
+
+beforeAll(() => {
+  mock.module("../auto-analysis-guard.js", () => ({
+    AUTO_ANALYSIS_SOURCE: "auto-analysis",
+    isAutoAnalysisConversation: (_conversationId: string) => isAuto,
+  }));
+});
+
+afterAll(() => {
+  mock.module("../auto-analysis-guard.js", () => actualAutoAnalysisGuard);
+});
+
 import {
   enqueueAutoAnalysisIfEnabled,
   enqueueAutoAnalysisOnCompaction,

package/src/runtime/services/__tests__/conversation-analyze-job.test.ts

@@ -6,7 +6,15 @@
  * wiring.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
 
 mock.module("../../../util/logger.js", () => ({
   getLogger: () =>
@@ -34,10 +42,6 @@ const mockAnalyzeConversation = mock(
   },
 );
 
-mock.module("../analyze-conversation.js", () => ({
-  analyzeConversation: mockAnalyzeConversation,
-}));
-
 // Mock auto-analysis-enqueue — track calls so we can verify requeue behavior.
 type EnqueueArgs = {
   conversationId: string;
@@ -48,9 +52,40 @@ const mockEnqueueAutoAnalysisIfEnabled = mock((args: EnqueueArgs) => {
   enqueueCalls.push(args);
 });
 
-mock.module("../auto-analysis-enqueue.js", () => ({
-  enqueueAutoAnalysisIfEnabled: mockEnqueueAutoAnalysisIfEnabled,
-}));
+// Scope the sibling-module stubs to this suite's lifecycle. Bun's `mock.module`
+// is process-global and is NOT undone by `mock.restore()`, so registering these
+// at the top level leaks the stubs into sibling suites that import the real
+// modules in the same Bun process (analyze-conversation.test.ts,
+// auto-analysis-enqueue.test.ts). Register the stubs in `beforeAll` and
+// re-register the real modules in `afterAll`.
+//
+// The captures spread into a plain object (`{ ...(await import()) }`) to freeze
+// the real exports by value. A module-namespace reference is a live view:
+// `mock.module` mutates it in place, so a bare `await import` would itself
+// return the stub once the stub is registered, and `afterAll` would "restore"
+// the stub instead of the real module.
+const actualAnalyzeConversation = {
+  ...(await import("../analyze-conversation.js")),
+};
+const actualAutoAnalysisEnqueue = {
+  ...(await import("../auto-analysis-enqueue.js")),
+};
+
+beforeAll(() => {
+  mock.module("../analyze-conversation.js", () => ({
+    ...actualAnalyzeConversation,
+    analyzeConversation: mockAnalyzeConversation,
+  }));
+  mock.module("../auto-analysis-enqueue.js", () => ({
+    ...actualAutoAnalysisEnqueue,
+    enqueueAutoAnalysisIfEnabled: mockEnqueueAutoAnalysisIfEnabled,
+  }));
+});
+
+afterAll(() => {
+  mock.module("../analyze-conversation.js", () => actualAnalyzeConversation);
+  mock.module("../auto-analysis-enqueue.js", () => actualAutoAnalysisEnqueue);
+});
 
 import { DEFAULT_CONFIG } from "../../../config/defaults.js";
 import type { AssistantConfig } from "../../../config/types.js";

package/src/runtime/services/__tests__/conversation-serializer.test.ts

@@ -45,6 +45,7 @@ function makeConversationRow(
     archivedAt: null,
     surfacedAt: null,
     inferenceProfile: null,
+    enabledPlugins: null,
     inferenceProfileSessionId: null,
     inferenceProfileExpiresAt: null,
     lastNotifiedInferenceProfile: null,
@@ -139,3 +140,22 @@ describe("serializeConversationSummary · surfaced groupId normalization", () =>
     );
   });
 });
+
+describe("serializeConversationSummary · enabledPlugins", () => {
+  test("serializes a non-empty plugin scope", () => {
+    const summary = serialize(
+      makeConversationRow({ enabledPlugins: ["plugin-a", "plugin-b"] }),
+    );
+    expect(summary.enabledPlugins).toEqual(["plugin-a", "plugin-b"]);
+  });
+
+  test("preserves an explicit empty scope (user cleared all optional plugins)", () => {
+    const summary = serialize(makeConversationRow({ enabledPlugins: [] }));
+    expect(summary.enabledPlugins).toEqual([]);
+  });
+
+  test("omits the field when there is no per-chat restriction (null)", () => {
+    const summary = serialize(makeConversationRow({ enabledPlugins: null }));
+    expect("enabledPlugins" in summary).toBe(false);
+  });
+});

package/src/runtime/services/analyze-conversation.ts

@@ -232,12 +232,19 @@ export async function analyzeConversation(
   }
 
   // i. Persist the user message (with provenance snapshot matching the
-  // trust context we will run under).
+  // trust context we will run under). Mint the request ID up front and
+  // persist the row under it so the analysis prompt's row id and the
+  // turn's `currentRequestId` are the same value: the same
+  // requestId-as-row-id invariant the standard submit path holds. Without
+  // this, `addMessage` would auto-assign a fresh row id while step (k)
+  // minted an unrelated `currentRequestId`, leaving `userMessageId` and
+  // `requestId` divergent for the analysis turn.
+  const requestId = crypto.randomUUID();
   const message = await addMessage(
     analysisConversationId,
     "user",
     JSON.stringify([{ type: "text", text: prompt }]),
-    { metadata: { provenanceTrustClass: trustClass } },
+    { id: requestId, metadata: { provenanceTrustClass: trustClass } },
   );
   const messageId = message.id;
 
@@ -268,10 +275,13 @@ export async function analyzeConversation(
   // j. Wire broadcastMessage as the event publisher
   analysisConversation.updateClient(broadcastMessage, !hasLiveSubscriber);
 
-  // k. Set up processing state (required by runAgentLoop guard)
+  // k. Set up processing state (required by runAgentLoop guard). Reuse the
+  // request ID the prompt row was persisted under (step i) so
+  // `currentRequestId` equals the user message's row id, keeping
+  // `requestId === userMessageId` for the analysis turn.
   analysisConversation.setProcessing(true);
   analysisConversation.abortController = new AbortController();
-  analysisConversation.currentRequestId = crypto.randomUUID();
+  analysisConversation.currentRequestId = requestId;
 
   // l. Fire-and-forget the agent loop. `callSite: 'analyzeConversation'`
   // routes the per-call provider config through `resolveCallSiteConfig`

package/src/runtime/services/conversation-serializer.ts

@@ -215,6 +215,11 @@ export function serializeConversationSummary(params: {
     ...(conversation.inferenceProfile != null
       ? { inferenceProfile: conversation.inferenceProfile }
       : {}),
+    // Include when non-null so an explicit `[]` (user cleared all plugins) is
+    // preserved; `null`/default is omitted.
+    ...(conversation.enabledPlugins != null
+      ? { enabledPlugins: conversation.enabledPlugins }
+      : {}),
     isProcessing,
   };
 }

package/src/runtime/slack-no-response.ts

@@ -0,0 +1,47 @@
+/**
+ * The assistant emits a `<no_response/>` sentinel to signal that a turn should
+ * produce no user-visible reply. Slack surfaces that begin work on the first
+ * deliverable text (the thinking-status indicator and native reply streaming)
+ * must not act on a partially-arrived sentinel: a slow stream can surface just
+ * `<` or `<no_resp` before the rest lands, and starting on that leaks a stray
+ * message that later resolves to empty.
+ */
+
+/** Matches a message whose entire content is the sentinel. */
+const NO_RESPONSE_ONLY_RE = /^\s*<no_response\s*\/?>\s*$/i;
+
+/** Matches every sentinel occurrence for stripping it out of mixed content. */
+export const NO_RESPONSE_INLINE_RE = /<no_response\s*\/?>/gi;
+
+const NO_RESPONSE_SENTINEL_FORMS = [
+  "<no_response/>",
+  "<no_response />",
+  "<no_response>",
+] as const;
+
+/**
+ * Whether `text` could still grow into the sentinel — i.e. it is a leading
+ * substring of one of its forms. Holding on these keeps a slowly-streamed
+ * `<no_response/>` from surfacing as visible partial content.
+ */
+function isPotentialNoResponsePrefix(text: string): boolean {
+  const lower = text.trim().toLowerCase();
+  if (lower.length === 0) return false;
+  return NO_RESPONSE_SENTINEL_FORMS.some((sentinel) =>
+    sentinel.startsWith(lower),
+  );
+}
+
+/**
+ * Whether `text` carries user-visible content worth acting on now. Returns
+ * `false` for empty text, the standalone sentinel, and any prefix that could
+ * still complete into one; returns `true` once real content remains after
+ * stripping inline sentinels.
+ */
+export function hasDeliverableAssistantText(text: string): boolean {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) return false;
+  if (NO_RESPONSE_ONLY_RE.test(trimmed)) return false;
+  if (isPotentialNoResponsePrefix(trimmed)) return false;
+  return trimmed.replace(NO_RESPONSE_INLINE_RE, "").trim().length > 0;
+}