@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/daemon/handlers/__tests__/config-a2a-complete.test.ts

@@ -5,14 +5,7 @@
  * `VELLUM_WORKSPACE_DIR` to a per-file temp directory.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
   invalidateConfigCache,

package/src/daemon/handlers/__tests__/config-a2a-invite.test.ts

@@ -5,14 +5,7 @@
  * `VELLUM_WORKSPACE_DIR` to a per-file temp directory.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
   invalidateConfigCache,

package/src/daemon/handlers/__tests__/config-a2a-redeem.test.ts

@@ -5,14 +5,7 @@
  * `VELLUM_WORKSPACE_DIR` to a per-file temp directory.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
   invalidateConfigCache,

package/src/daemon/handlers/__tests__/config-a2a.test.ts

@@ -5,14 +5,7 @@
  * `VELLUM_WORKSPACE_DIR` to a per-file temp directory.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
   invalidateConfigCache,

package/src/daemon/handlers/conversation-history.ts

@@ -3,6 +3,7 @@ import {
   listConversations,
   searchConversations,
 } from "../../persistence/conversation-queries.js";
+import { extractTextFromStoredMessageContent } from "../../persistence/message-content.js";
 import { renderHistoryContent } from "./shared.js";
 
 // ---------------------------------------------------------------------------
@@ -55,7 +56,9 @@ export function getMessageContent(
   conversationId?: string,
 ): MessageContentResult | null {
   const dbMessage = getMessageById(messageId, conversationId);
-  if (!dbMessage) return null;
+  if (!dbMessage) {
+    return null;
+  }
 
   let text: string | undefined;
   let toolCalls:
@@ -63,7 +66,7 @@ export function getMessageContent(
     | undefined;
 
   try {
-    const content = JSON.parse(dbMessage.content);
+    const content = dbMessage.content;
     const rendered = renderHistoryContent(content);
     text = rendered.text || undefined;
     const parsedToolCalls = rendered.toolCalls;
@@ -76,8 +79,7 @@ export function getMessageContent(
       }));
     }
   } catch {
-    // Raw text content (not JSON)
-    text = dbMessage.content || undefined;
+    text = extractTextFromStoredMessageContent(dbMessage.content) || undefined;
   }
 
   return {

package/src/daemon/handlers/conversations.ts

@@ -1,5 +1,5 @@
 import { peekAcpSessionManager } from "../../acp/index.js";
-import { resolveCanonicalGuardianRequest } from "../../contacts/canonical-guardian-store.js";
+import { decideGuardianRequest } from "../../channels/gateway-guardian-requests.js";
 import {
   clearAll,
   getConversation,
@@ -373,16 +373,17 @@ export function steerOnEnqueuedMessageIfQuestionParked(
  * is enqueued for a busy conversation. Centralized so every ingress path (the
  * HTTP send handler and the CLI signal path) gets identical handling:
  *
- *  1. Auto-deny pending confirmations — notify the client and sync the
- *     canonical guardian record *before* clearing the prompter-owned
+ *  1. Auto-deny pending confirmations — notify the client and issue the
+ *     gateway request-status sync *before* clearing the prompter-owned
  *     confirmations, so a later guardian reply can't match a stale "pending"
  *     record and fail with `pending_interaction_not_found`.
  *  2. Supersede a parked ask_question by steering to the enqueued message.
  *
  * Order matters: the steer aborts the turn, which denies the prompter's
- * confirmations as a side effect, so the canonical/notification sync must run
- * first. `removeByConversation` preserves `question` entries, so the parked
- * question is still registered for the steer even after the confirmation sweep.
+ * confirmations as a side effect, so the status/notification sync must be
+ * issued first. `removeByConversation` preserves `question` entries, so the
+ * parked question is still registered for the steer even after the
+ * confirmation sweep.
  */
 export function supersedePendingInteractionsOnEnqueue(
   conversationId: string,
@@ -403,10 +404,19 @@ export function supersedePendingInteractionsOnEnqueue(
           state: "denied" as const,
           source: "auto_deny" as const,
         });
-        // Sync the canonical guardian record so stale "pending" rows aren't
-        // matched by later guardian reply routing.
-        resolveCanonicalGuardianRequest(interaction.requestId, "pending", {
+        // Sync the gateway request so stale "pending" rows aren't matched
+        // by later guardian reply routing. Fire-and-forget from this sync
+        // path: the in-memory denial is authoritative, and a CAS miss
+        // (already decided elsewhere) is expected and harmless.
+        void decideGuardianRequest({
+          id: interaction.requestId,
+          expectedStatus: "pending",
           status: "denied",
+        }).catch((err) => {
+          log.warn(
+            { err, requestId: interaction.requestId },
+            "Auto-deny guardian request status sync failed",
+          );
         });
       }
     }

package/src/daemon/handlers/shared.ts

@@ -1,3 +1,7 @@
+import {
+  neutralizeRedactedSentinels,
+  SENTINEL_REDACTION_VERSION,
+} from "@vellumai/service-contracts/redacted-credential";
 import { v4 as uuid } from "uuid";
 
 import type {
@@ -315,6 +319,10 @@ export function renderHistoryContent(
     } else {
       text = unwrapExternalContentForDisplay(String(content));
     }
+    // Raw-string rows predate the block-shaped persist path entirely, so
+    // they can never carry the `_redactionVersion` rider — always run the
+    // sentinel forgery guard (see the rider check in the block walk below).
+    text = neutralizeRedactedSentinels(text);
     return {
       text,
       toolCalls: [],
@@ -445,7 +453,22 @@ export function renderHistoryContent(
     }
 
     if (block.type === "text" && typeof block.text === "string") {
-      const displayText = unwrapExternalContentForDisplay(block.text);
+      // Forgery guard for pre-feature history: blocks persisted before the
+      // chat-credential sentinel work never had sentinel-shaped strings
+      // neutralized at write, so a forged `〔redacted:…〕` in an old row could
+      // manufacture a reveal chip on a chip-enabled client surface. Blocks
+      // written by the neutralization-aware persist path carry the
+      // `_redactionVersion` rider (internal, never shipped on the wire) and
+      // pass through verbatim — their surviving sentinels are
+      // redactor-authored. Everything else is neutralized here at the read
+      // boundary, the same belt-and-suspenders posture as the
+      // `<no_response/>` and placeholder-sentinel strips below.
+      const rawText =
+        typeof block._redactionVersion === "number" &&
+        block._redactionVersion >= SENTINEL_REDACTION_VERSION
+          ? block.text
+          : neutralizeRedactedSentinels(block.text);
+      const displayText = unwrapExternalContentForDisplay(rawText);
       // Skip empty/whitespace-only text blocks. During streaming the client
       // discards empty text deltas (guard !text.isEmpty), so including them
       // here produces a contentOrder that differs from the live streaming

package/src/daemon/inflight-message-content.ts

@@ -0,0 +1,228 @@
+/**
+ * In-flight message content: the agent loop's write path for streaming
+ * content, kept off the SQLite writer lock.
+ *
+ * Rows are BORN streaming: the reserve seam creates the row with `content`
+ * already holding the `{ ref }` pointer at an in-flight JSONL delta file
+ * under the conversation directory (`conversations/<dir>/inflight/…`) and
+ * `finalized = 0`. Each partial flush appends only the blocks that changed
+ * since the last flush — a pure file append, no SQLite write at all. At the
+ * message seam, {@link finalizeInflightContent} writes the folded content
+ * inline, sets `finalized = 1`, and deletes the file.
+ *
+ * A message that never partial-flushes (fast replies inside the debounce
+ * window) never creates the file — its single finalize write is the only
+ * content persistence, exactly as before.
+ *
+ * Reads of an in-flight row work transparently — the message row mapper
+ * resolves `{ ref }` by folding the delta file — so content stays readable
+ * mid-stream and after a crash. Batch readers (search, memory indexing)
+ * filter `finalized = 1` and never consume in-flight content.
+ */
+
+import { rmSync } from "node:fs";
+
+import type pino from "pino";
+import { v4 as uuid } from "uuid";
+
+import {
+  finalizeMessageContent,
+  getConversation,
+  getMessageById,
+} from "../persistence/conversation-crud.js";
+import { getConversationDirName } from "../persistence/conversation-directories.js";
+import {
+  appendContentDeltas,
+  type ContentDeltaLine,
+  resolveContentRefPath,
+} from "../persistence/message-content-file.js";
+import type { ContentBlock } from "../providers/types.js";
+import { withSqliteRetry } from "../util/sqlite-retry.js";
+
+export interface InflightContentWriter {
+  /** Row id — assigned by the reserve seam once the reservation resolves. */
+  messageId: string;
+  conversationId: string;
+  /** Workspace-relative delta-file path persisted in the row's `{ ref }`. */
+  ref: string;
+  /** Absolute delta-file path. */
+  absPath: string;
+  /**
+   * Highest stream-event `seq` stamped on an appended delta line. Flushes
+   * stamp the triggering event's seq so file lines correlate 1:1 with the
+   * event stream; this tracks the high-water mark for monotonicity.
+   */
+  lastSeq: number;
+  /** Per-index serialized form of the last flushed snapshot (diff base). */
+  lastSerialized: string[];
+}
+
+/**
+ * Create a writer for one message's in-flight content, ahead of the row's
+ * reservation — the returned `ref` is what the reserve seam persists into
+ * the newborn row's `{ ref }` content. The delta file is named by a fresh
+ * uuid (the row id does not exist yet); callers stamp `messageId` once the
+ * reservation resolves. Returns null when the conversation row can't be
+ * resolved — callers then reserve a plain inline row and fall back to
+ * direct row writes, which is always correct, just not contention-free.
+ */
+export function createInflightContentWriter(
+  conversationId: string,
+): InflightContentWriter | null {
+  const conv = getConversation(conversationId);
+  if (!conv || !Number.isFinite(conv.createdAt)) {
+    return null;
+  }
+  // POSIX join — the ref schema requires forward slashes.
+  const ref = [
+    "conversations",
+    getConversationDirName(conversationId, conv.createdAt),
+    "inflight",
+    `${uuid()}.jsonl`,
+  ].join("/");
+  const absPath = resolveContentRefPath(ref);
+  if (!absPath) {
+    return null;
+  }
+  return {
+    messageId: "",
+    conversationId,
+    ref,
+    absPath,
+    lastSeq: 0,
+    lastSerialized: [],
+  };
+}
+
+/**
+ * Persist a full content snapshot by appending only the blocks that changed
+ * since the last flush — a pure file append, no SQLite write.
+ *
+ * `eventSeq` is the stream-event seq that triggered this flush; every delta
+ * line of the flush is stamped with it so file lines correlate 1:1 with the
+ * event stream. Flushes without a stream seq (e.g. content synthesized
+ * outside the delta stream) advance the writer's high-water mark by one.
+ * The stamp is clamped monotonic so the fold's highest-seq-wins rule holds
+ * even across mixed sources.
+ *
+ * Returns whether the snapshot is durably persisted, mirroring the old
+ * row-write contract so callers can gate seq bookkeeping on it.
+ */
+export function appendInflightSnapshot(
+  writer: InflightContentWriter,
+  blocks: ContentBlock[],
+  eventSeq: number | undefined,
+  rlog: pino.Logger,
+): boolean {
+  try {
+    // The fold keeps the highest-seq line per index, so a shrinking snapshot
+    // (fewer blocks than the diff base) cannot be expressed as an append.
+    // Streaming content only grows within a row, so this is a never-path
+    // guard: reset the diff base and re-append everything.
+    if (blocks.length < writer.lastSerialized.length) {
+      rlog.warn(
+        {
+          messageId: writer.messageId,
+          from: writer.lastSerialized.length,
+          to: blocks.length,
+        },
+        "In-flight snapshot shrank; rewriting delta base",
+      );
+      rmSync(writer.absPath, { force: true });
+      writer.lastSerialized = [];
+    }
+    const stamp = Math.max(eventSeq ?? writer.lastSeq + 1, writer.lastSeq + 1);
+    const deltas: ContentDeltaLine[] = [];
+    for (let i = 0; i < blocks.length; i++) {
+      const serialized = JSON.stringify(blocks[i]);
+      if (writer.lastSerialized[i] === serialized) {
+        continue;
+      }
+      deltas.push({ i, seq: stamp, block: blocks[i] });
+      writer.lastSerialized[i] = serialized;
+    }
+    if (deltas.length > 0) {
+      writer.lastSeq = stamp;
+    }
+    appendContentDeltas(writer.absPath, deltas);
+    return true;
+  } catch (err) {
+    rlog.error(
+      { err, messageId: writer.messageId },
+      "in-flight content append failed; continuing without interrupting the turn",
+    );
+    return false;
+  }
+}
+
+/**
+ * Finalize a message's content at its terminal write seam: fold the
+ * authoritative blocks inline into the row, set `finalized = 1`, and
+ * delete the delta file. Safe for rows that never went in-flight (the
+ * common fast-reply case) — it is then exactly the single content write
+ * the seam always performed.
+ */
+export async function finalizeInflightContent(
+  writer: InflightContentWriter | undefined,
+  messageId: string,
+  contentJson: string,
+  rlog: pino.Logger,
+  metadataUpdates?: Record<string, unknown>,
+): Promise<boolean> {
+  try {
+    await withSqliteRetry(
+      () => finalizeMessageContent(messageId, contentJson, metadataUpdates),
+      { op: "finalize_message_content", context: { messageId } },
+    );
+  } catch (err) {
+    rlog.error(
+      { err, messageId },
+      "message-content finalize failed after retries; continuing without interrupting the turn",
+    );
+    return false;
+  }
+  if (writer) {
+    try {
+      rmSync(writer.absPath, { force: true });
+    } catch (err) {
+      rlog.warn(
+        { err, messageId },
+        "failed to remove in-flight delta file after finalize",
+      );
+    }
+  }
+  return true;
+}
+
+/**
+ * Fold and finalize any writers a turn left behind — cancelled or aborted
+ * turns exit without reaching a message's finalize seam. The row's current
+ * resolved content (the folded delta file, or inline content if another
+ * path already rewrote the row) becomes the finalized inline value. Runs
+ * at the turn-finalize seam so `finalized = 0` rows cannot leak from a
+ * live daemon; the startup recovery sweep covers crashes.
+ */
+export async function finalizeStrandedInflightContent(
+  writers: Map<string, InflightContentWriter>,
+  rlog: pino.Logger,
+): Promise<void> {
+  for (const writer of writers.values()) {
+    try {
+      const row = getMessageById(writer.messageId, writer.conversationId);
+      if (row && row.finalized === 0) {
+        await finalizeInflightContent(
+          writer,
+          writer.messageId,
+          JSON.stringify(row.content),
+          rlog,
+        );
+      }
+    } catch (err) {
+      rlog.warn(
+        { err, messageId: writer.messageId },
+        "failed to finalize stranded in-flight content",
+      );
+    }
+  }
+  writers.clear();
+}

package/src/daemon/lifecycle.ts

@@ -2,6 +2,7 @@ import { config as dotenvConfig } from "dotenv";
 
 import { reconcileCallsOnStartup } from "../calls/call-recovery.js";
 import { TwilioVoiceProvider } from "../calls/twilio-provider.js";
+import { expireInteractionBoundGuardianRequests } from "../channels/gateway-guardian-requests.js";
 import { initFeatureFlagOverrides } from "../config/assistant-feature-flags.js";
 import { setIngressPublicBaseUrl, validateEnv } from "../config/env.js";
 import {
@@ -11,7 +12,6 @@ import {
 } from "../config/loader.js";
 import { seedInferenceProfiles } from "../config/seed-inference-profiles.js";
 import { reconcileFlagGatedProfiles } from "../config/sync-gated-profiles.js";
-import { expireAllPendingCanonicalRequests } from "../contacts/canonical-guardian-store.js";
 import { startCes } from "../credential-execution/ces-runtime.js";
 import { refreshManagedConnectionCache } from "../credential-execution/managed-catalog.js";
 import { startHeartbeatService } from "../heartbeat/heartbeat-service.js";
@@ -52,10 +52,6 @@ import {
   getWorkspaceDir,
 } from "../util/platform.js";
 import { APP_VERSION } from "../version.js";
-import {
-  listWorkItems,
-  updateWorkItem,
-} from "../work-items/work-item-store.js";
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
 import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/adaptive-thinking-repair.js";
 import { ensureCompleteCustomProfiles } from "../workspace/custom-profile-ensure.js";
@@ -160,8 +156,8 @@ export async function runDaemon(): Promise<void> {
   // so a fast-reconnecting client could otherwise resolve a turn against a
   // partial profile in the window between readiness and the post-overlay
   // ensure call below. Sync, DB-free, and idempotent. Skipped when an
-  // unconsumed onboarding overlay is pending: the overlay can rewrite
-  // llm.default later this boot, and baking against the pre-overlay default
+  // unconsumed onboarding overlay is pending: the overlay can rewrite the
+  // llm config later this boot, and baking against the pre-overlay default
   // would pin the wrong baseline — on that single boot (a fresh hatch, with
   // no established clients to race the window) the post-overlay pass owns
   // materialization; the overlay file is consumed on merge, so every
@@ -363,8 +359,11 @@ export async function runDaemon(): Promise<void> {
       );
     }
 
-    // Expire stale pending canonical guardian requests left over from before
-    // this process started.  Two categories are cleaned up:
+    // Expire stale pending guardian requests left over from before this
+    // process started. Daemon-keyed by design: interaction-bound kinds die
+    // with THIS process's in-memory pendingInteractions map, so the daemon
+    // triggers the gateway op at its own boot — the gateway never runs it
+    // on its own restart. Two categories are cleaned up:
     //
     // 1. Interaction-bound kinds (tool_approval, pending_question) — their
     //    in-memory pending-interaction session references are gone, so they
@@ -373,31 +372,22 @@ export async function runDaemon(): Promise<void> {
     //    kinds (access_request, tool_grant_request) that expired while the
     //    daemon was stopped are transitioned so dedup logic doesn't return
     //    stale rows.
-    const expiredCount = expireAllPendingCanonicalRequests();
-    if (expiredCount > 0) {
-      log.info(
-        { event: "startup_expired_stale_requests", expiredCount },
-        `Expired ${expiredCount} stale canonical request(s) from previous process`,
-      );
-    }
-
-    // Recover orphaned work items that were left in 'running' state when the
-    // daemon previously crashed or was killed mid-task.
-    const orphanedRunning = listWorkItems({ status: "running" });
-    if (orphanedRunning.length > 0) {
-      for (const item of orphanedRunning) {
-        updateWorkItem(item.id, {
-          status: "failed",
-          lastRunStatus: "interrupted",
-        });
+    //
+    // Startup must not block on the gateway (daemon startup philosophy):
+    // on failure the periodic sweep still reaps time-expired rows, and
+    // decide paths reject interaction-bound strays via pendingInteractions.
+    try {
+      const expiredCount = await expireInteractionBoundGuardianRequests();
+      if (expiredCount > 0) {
         log.info(
-          { workItemId: item.id, title: item.title },
-          "Recovered orphaned running work item → failed (interrupted)",
+          { event: "startup_expired_stale_requests", expiredCount },
+          `Expired ${expiredCount} stale guardian request(s) from previous process`,
         );
       }
-      log.info(
-        { count: orphanedRunning.length },
-        "Recovered orphaned running work items",
+    } catch (err) {
+      log.warn(
+        { err },
+        "Startup guardian-request expiry failed — continuing in degraded mode",
       );
     }
 

package/src/daemon/message-protocol.ts

@@ -45,7 +45,6 @@ export * from "./message-types/surfaces.js";
 export * from "./message-types/sync.js";
 export * from "./message-types/upgrades.js";
 export * from "./message-types/web-activity.js";
-export * from "./message-types/work-items.js";
 export * from "./message-types/workflows.js";
 export * from "./message-types/workspace.js";
 
@@ -94,6 +93,7 @@ import type {
 import type { _HostCuServerMessages } from "./message-types/host-cu.js";
 import type { _HostFileServerMessages } from "./message-types/host-file.js";
 import type { _HostTransferServerMessages } from "./message-types/host-transfer.js";
+import type { _HostUiSnapshotServerMessages } from "./message-types/host-ui-snapshot.js";
 import type {
   _InboxClientMessages,
   _InboxServerMessages,
@@ -133,10 +133,6 @@ import type {
 } from "./message-types/surfaces.js";
 import type { _SyncInvalidationServerMessages } from "./message-types/sync.js";
 import type { _UpgradesServerMessages } from "./message-types/upgrades.js";
-import type {
-  _WorkItemsClientMessages,
-  _WorkItemsServerMessages,
-} from "./message-types/work-items.js";
 import type { _WorkflowsServerMessages } from "./message-types/workflows.js";
 import type {
   _WorkspaceClientMessages,
@@ -164,7 +160,6 @@ export type ClientMessage =
   | _IntegrationsClientMessages
   | _ComputerUseClientMessages
   | _ContactsClientMessages
-  | _WorkItemsClientMessages
   | _HostBrowserClientMessages
   | _SubagentsClientMessages
   | _DocumentsClientMessages
@@ -187,7 +182,6 @@ export type ServerMessage =
   | _IntegrationsServerMessages
   | _ComputerUseServerMessages
   | _ContactsServerMessages
-  | _WorkItemsServerMessages
   | _SubagentsServerMessages
   | _DocumentsServerMessages
   | _DocumentCommentsServerMessages
@@ -200,6 +194,7 @@ export type ServerMessage =
   | _HostCuServerMessages
   | _HostFileServerMessages
   | _HostTransferServerMessages
+  | _HostUiSnapshotServerMessages
   | _MemoryServerMessages
   | _WorkspaceServerMessages
   | _SchedulesServerMessages

package/src/daemon/message-provenance.ts

@@ -35,15 +35,24 @@ export function parseProvenanceTrustClass(
   return undefined;
 }
 
+/**
+ * Per-row form of {@link filterMessagesForUntrustedActor}: whether a single
+ * persisted row's provenance is visible to an untrusted (non-guardian)
+ * actor view. Exported so consumers that scan raw rows outside a full
+ * history load (e.g. the persisted-surface fallback in the surface routes)
+ * apply the identical predicate instead of duplicating the allowlist.
+ */
+export function isRowVisibleToUntrustedActor(metadata: string | null): boolean {
+  const provenanceTrustClass = parseProvenanceTrustClass(metadata);
+  return (
+    provenanceTrustClass === "trusted_contact" ||
+    provenanceTrustClass === "unverified_contact" ||
+    provenanceTrustClass === "unknown"
+  );
+}
+
 export function filterMessagesForUntrustedActor(
   messages: MessageRow[],
 ): MessageRow[] {
-  return messages.filter((m) => {
-    const provenanceTrustClass = parseProvenanceTrustClass(m.metadata);
-    return (
-      provenanceTrustClass === "trusted_contact" ||
-      provenanceTrustClass === "unverified_contact" ||
-      provenanceTrustClass === "unknown"
-    );
-  });
+  return messages.filter((m) => isRowVisibleToUntrustedActor(m.metadata));
 }

package/src/daemon/message-types/conversations.ts

@@ -8,6 +8,7 @@ import type { ConversationNoticeEvent } from "../../api/events/conversation-noti
 import type { ConversationTitleUpdatedEvent } from "../../api/events/conversation-title-updated.js";
 import type { GenerationCancelledEvent } from "../../api/events/generation-cancelled.js";
 import type { GenerationHandoffEvent } from "../../api/events/generation-handoff.js";
+import type { OpenConversationEvent } from "../../api/events/open-conversation.js";
 import type { UsageProgressEvent } from "../../api/events/usage-progress.js";
 import type { UsageUpdateEvent } from "../../api/events/usage-update.js";
 import type {
@@ -505,22 +506,10 @@ export interface ScheduleConversationCreated {
   title: string;
 }
 
-/**
- * Server push — instructs the client to open and focus a conversation. If
- * the conversation isn't already present in the client's sidebar list (e.g.
- * it was just created via `POST /v1/conversations`), the client should stub
- * a sidebar entry using the provided `title` before navigating.
- */
-export interface OpenConversation {
-  type: "open_conversation";
-  conversationId: string;
-  /** Optional conversation title; supplied when the client may not yet have the conversation in its list. */
-  title?: string;
-  /** Optional message ID to scroll to after focus. */
-  anchorMessageId?: string;
-  /** When `false`, the client should register the conversation in its sidebar (so it's visible and navigable) but must NOT switch focus to it. Omitting the field defaults to `true` for backward compatibility with existing single-target 'jump to conversation' callers. */
-  focus?: boolean;
-}
+// `open_conversation` is a migrated event: its canonical wire contract lives
+// in `../../api/events/open-conversation.ts` (imported as
+// `OpenConversationEvent`). Instructs the client to open and, by default,
+// focus a conversation — see that file for the full field docs.
 
 // --- Domain-level union aliases (consumed by the barrel file) ---
 
@@ -565,4 +554,4 @@ export type _ConversationsServerMessages =
   | MessageContentResponse
   | ConversationListInvalidatedEvent
   | ScheduleConversationCreated
-  | OpenConversation;
+  | OpenConversationEvent;