@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/schedule/schedule-store.ts

@@ -13,6 +13,10 @@ import {
   isValidScheduleExpression,
 } from "./recurrence-engine.js";
 import type { ScheduleSyntax } from "./recurrence-types.js";
+import {
+  expressionCarriesOwnTimezone,
+  resolveScheduleTimezone,
+} from "./schedule-timezone.js";
 
 const logger = getLogger("schedule-store");
 
@@ -154,7 +158,14 @@ export async function createSchedule(params: {
   const id = uuid();
   const now = Date.now();
   const enabled = params.enabled ?? true;
-  const timezone = params.timezone ?? null;
+  // A recurring wall-clock schedule with no zone otherwise evaluates in the host
+  // clock (UTC on managed containers). Default it to the user's configured/detected
+  // zone so it fires at the intended local hour. One-shot schedules (absolute epoch)
+  // and expressions that carry their own zone keep the caller's value verbatim.
+  const timezone =
+    isOneShot || expressionCarriesOwnTimezone(syntax, expression)
+      ? (params.timezone ?? null)
+      : resolveScheduleTimezone(params.timezone);
   const mode = params.mode ?? "execute";
   const routingIntent = params.routingIntent ?? "all_channels";
   const routingHints = params.routingHints ?? {};

package/src/schedule/schedule-timezone.ts

@@ -0,0 +1,63 @@
+/**
+ * Resolve the timezone a recurring schedule should be evaluated in.
+ *
+ * A cron/RRULE wall-clock recurrence needs a zone to disambiguate; when none is
+ * supplied the recurrence engine falls back to the daemon host clock (UTC on a
+ * managed container), firing at the wrong hour. The rest of the assistant grounds
+ * time via the user's configured/detected zone (see `resolveTurnTimezoneContext`
+ * in `daemon/date-context.ts`); this brings recurring schedules in line.
+ */
+
+import { getConfigReadOnly } from "../config/loader.js";
+import { canonicalizeTimeZone } from "../daemon/date-context.js";
+import { hasSetConstructs } from "./recurrence-engine.js";
+import type { ScheduleSyntax } from "./recurrence-types.js";
+
+/**
+ * True when the expression already determines its own evaluation zone, so the
+ * `timezone` field must not be resolved/overridden:
+ * - an RRULE with an embedded `DTSTART;TZID=…` or a Z-anchored UTC `DTSTART`; or
+ * - an RRULE set-construct (RDATE/EXDATE/multi-RRULE). `rrulestr` does not thread
+ *   a caller-supplied tzid into a constructed `RRuleSet`, so a resolved zone would
+ *   have no effect on firing — persisting one would be misleading.
+ *
+ * Cron never carries its own zone.
+ */
+export function expressionCarriesOwnTimezone(
+  syntax: ScheduleSyntax,
+  expression: string | null | undefined,
+): boolean {
+  if (syntax !== "rrule" || !expression) {
+    return false;
+  }
+  if (
+    /TZID=/i.test(expression) ||
+    /DTSTART[^:]*:\d{8}T\d{6}Z/i.test(expression)
+  ) {
+    return true;
+  }
+  return hasSetConstructs(expression);
+}
+
+/**
+ * Resolve the effective zone for a recurring schedule. An explicit caller value
+ * wins (canonicalized); otherwise the user's configured zone, then the
+ * client-detected zone. Returns null only when nothing is known — preserving
+ * host-local evaluation for local installs where the host clock is the user's.
+ *
+ * Precedence mirrors `resolveTurnTimezoneContext` (configured beats detected).
+ */
+export function resolveScheduleTimezone(
+  explicit: string | null | undefined,
+): string | null {
+  const explicitTz = canonicalizeTimeZone(explicit);
+  if (explicitTz) {
+    return explicitTz;
+  }
+  const ui = getConfigReadOnly().ui;
+  return (
+    canonicalizeTimeZone(ui.userTimezone) ??
+    canonicalizeTimeZone(ui.detectedTimezone) ??
+    null
+  );
+}

package/src/schedule/scheduler.ts

@@ -16,7 +16,12 @@ import { runBackgroundJob } from "../runtime/background-job-runner.js";
 import { publishConversationListChanged } from "../runtime/sync/resource-sync-events.js";
 import { runSequencesOnce } from "../sequence/engine.js";
 import type { TurnFailure } from "../telemetry/turn-outcome.js";
+import { recordWatchdogEvent } from "../telemetry/watchdog-events-store.js";
 import { getLogger } from "../util/logger.js";
+import {
+  createWorkerSupervisor,
+  type WorkerSupervisor,
+} from "../util/worker-process.js";
 import { runWatchersOnce } from "../watcher/engine.js";
 import { normalizeCapabilityManifest } from "../workflows/capabilities.js";
 import { getWorkflowRunManager } from "../workflows/run-manager.js";
@@ -37,7 +42,13 @@ import {
   scheduleRetry,
   setScheduleRunConversationId,
 } from "./schedule-store.js";
-import { startScheduleWorker, stopScheduleWorker } from "./worker-control.js";
+import {
+  isScheduleWorkerAdministrativelyStopped,
+  probeScheduleWorker,
+  spawnScheduleWorkerProcess,
+  startScheduleWorker,
+  stopScheduleWorker,
+} from "./worker-control.js";
 
 const log = getLogger("scheduler");
 
@@ -227,6 +238,42 @@ async function handleExecutionFailure(params: {
 /** The running scheduler, retained so shutdown can stop it. */
 let instance: SchedulerHandle | null = null;
 
+/** The schedule worker liveness watchdog, disposed by {@link stopScheduler}. */
+let scheduleWorkerSupervisor: WorkerSupervisor | null = null;
+
+/**
+ * Notify the user once per outage when the worker cannot be respawned after
+ * repeated attempts, so schedules being paused is not silent. A stable
+ * hourly dedupe key keeps it to one notification per outage window rather than
+ * one per tick.
+ */
+function emitScheduleWorkerDownNotification(consecutiveFailures: number): void {
+  void emitNotificationSignal({
+    sourceEventName: "activity.failed",
+    sourceChannel: "scheduler",
+    sourceContextId: "schedule-worker",
+    dedupeKey: `schedule-worker-down:${Math.floor(Date.now() / 3_600_000)}`,
+    contextPayload: {
+      jobName: "Scheduled tasks",
+      errorMessage:
+        "The assistant could not restart its schedule runner, so scheduled tasks are paused. They resume automatically once it recovers.",
+      errorKind: "exception",
+      consecutiveFailures,
+    },
+    attentionHints: {
+      requiresAction: false,
+      urgency: "medium",
+      isAsyncBackground: true,
+      visibleInSourceNow: false,
+    },
+  }).catch((emitErr) => {
+    log.warn(
+      { err: emitErr },
+      "Failed to emit schedule-worker-down notification",
+    );
+  });
+}
+
 export function startScheduler(): SchedulerHandle {
   // Schedule execution is owned by the schedule worker process; spawn it now as
   // a child of the daemon so it is running immediately. Fire-and-forget — a
@@ -234,6 +281,46 @@ export function startScheduler(): SchedulerHandle {
   // watchers and sequences.
   startScheduleWorker();
 
+  // Liveness watchdog: the worker calls process.exit() on any uncaught error
+  // and nothing respawned it, so schedules could stop for days silently. Probe
+  // and respawn off the existing tick — recovery latency drops from days to
+  // ~one tick. Detects process death, not a wedged-but-alive worker.
+  scheduleWorkerSupervisor = createWorkerSupervisor({
+    label: "Schedule worker",
+    probe: probeScheduleWorker,
+    respawn: () => spawnScheduleWorkerProcess({ detached: false }),
+    isSuppressed: isScheduleWorkerAdministrativelyStopped,
+    killChild: (pid) => {
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+        // Worker already gone — nothing to kill.
+      }
+    },
+    onRespawn: (pid) => {
+      log.warn(
+        { pid },
+        "Schedule worker was not running — respawned by watchdog",
+      );
+      recordWatchdogEvent({
+        checkName: "schedule_worker_respawn",
+        detail: { pid },
+      });
+    },
+    onPersistentFailure: (consecutiveFailures, err) => {
+      log.error(
+        { err, consecutiveFailures },
+        "Schedule worker repeatedly failed to respawn — schedules are paused",
+      );
+      recordWatchdogEvent({
+        checkName: "schedule_worker_down",
+        value: consecutiveFailures,
+        detail: { consecutiveFailures },
+      });
+      emitScheduleWorkerDownNotification(consecutiveFailures);
+    },
+  });
+
   let stopped = false;
   let tickRunning = false;
 
@@ -243,6 +330,9 @@ export function startScheduler(): SchedulerHandle {
     }
     tickRunning = true;
     try {
+      // Respawn the schedule worker if it has died (fire-and-forget; never
+      // throws). Idempotent — a live PID file short-circuits to alreadyRunning.
+      void scheduleWorkerSupervisor?.ensureAlive();
       await runScheduleOnce();
     } catch (err) {
       log.error({ err }, "Schedule tick failed");
@@ -284,12 +374,16 @@ export function startScheduler(): SchedulerHandle {
  * worker process if one is running.
  */
 export function stopScheduler(): void {
-  stopScheduleWorker();
-  if (!instance) {
-    return;
+  // Stop the tick FIRST so no tick can respawn the worker we are about to kill.
+  if (instance) {
+    instance.stop();
+    instance = null;
   }
-  instance.stop();
-  instance = null;
+  // No further respawns; a respawn already in flight kills its child on resolve.
+  scheduleWorkerSupervisor?.dispose();
+  scheduleWorkerSupervisor = null;
+  // Then SIGTERM the running worker via its PID file.
+  stopScheduleWorker();
 }
 
 /** The running scheduler, or null if one was never started. */

package/src/schedule/worker-control.ts

@@ -21,6 +21,25 @@ import {
 
 const log = getLogger("schedule-worker-control");
 
+/**
+ * True when an operator explicitly stopped the worker (via
+ * `assistant schedules worker stop`). The liveness watchdog must not respawn it
+ * while this is set, or a manual stop would be silently undone within one tick.
+ * Process-local: it resets to false on daemon restart and is cleared by the
+ * `schedules worker start` route — a restart is treated as a fresh start.
+ */
+let administrativelyStopped = false;
+
+/** Whether the schedule worker has been administratively stopped by an operator. */
+export function isScheduleWorkerAdministrativelyStopped(): boolean {
+  return administrativelyStopped;
+}
+
+/** Set/clear the administratively-stopped flag (set by stop, cleared by start). */
+export function setScheduleWorkerAdministrativelyStopped(value: boolean): void {
+  administrativelyStopped = value;
+}
+
 /**
  * Inspect the PID file to determine whether the schedule worker process is
  * alive. A stale PID file (pointing at a dead process) is cleaned up and

package/src/security/auth-fallback-events-store.ts

@@ -1,6 +1,6 @@
 import { v4 as uuid } from "uuid";
 
-import { getCachedShareAnalytics } from "../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { insertTelemetryOutboxEvents } from "../telemetry/telemetry-events-outbox.js";
 import type { AuthFallbackTelemetryEvent } from "../telemetry/types.js";
 import { APP_VERSION } from "../version.js";
@@ -19,17 +19,18 @@ export interface AuthFallbackCount {
  * flush window, each carrying its full wire event built at record time. The
  * whole batch inserts atomically, so a failure never leaves a partial batch
  * committed (the gateway retries the full batch on `recorded === 0`). Returns
- * the number of rows recorded, or 0 when usage data collection is disabled
- * (the counts are dropped to honor the opt-out, matching the rest of
- * telemetry) or the telemetry database is unavailable (degraded mode). Callers
- * that must tell those apart check `getCachedShareAnalytics()` themselves.
+ * the number of rows recorded, or 0 when `share_analytics` is a confirmed
+ * opt-out (the counts are dropped to honor it, matching the rest of
+ * telemetry — an unknown consent state records) or the telemetry database is
+ * unavailable (degraded mode). Callers that must tell those apart check
+ * `getRawShareAnalytics()` themselves.
  */
 export function recordAuthFallbackCounts(
   windowStart: number,
   windowEnd: number,
   counts: AuthFallbackCount[],
 ): number {
-  if (!getCachedShareAnalytics()) {
+  if (getRawShareAnalytics() === false) {
     return 0;
   }
   if (counts.length === 0) {

package/src/security/secret-scanner.ts

@@ -274,6 +274,31 @@ export function scanText(text: string): SecretMatch[] {
  * Returns the modified text.
  */
 export function redactSecrets(text: string): string {
+  return redactSecretsWith(
+    text,
+    (match) => `<redacted type="${match.type}" />`,
+  );
+}
+
+/**
+ * Core redaction walk with a caller-supplied marker builder.
+ *
+ * `markerFor` receives the {@link SecretMatch} plus the raw matched value so
+ * a caller can vary the marker per match (e.g. the chat-persist path emits a
+ * revealable sentinel when the value byte-matches a known vault credential).
+ * The default `<redacted type="…" />` marker produced via
+ * {@link redactSecrets} is consumed by ingress blocking, tool-output
+ * scanning, and log redaction — its shape must not change (see
+ * `security/AGENTS.md`), which is why this variant exists as a separate
+ * additive entry point instead of an option on `redactSecrets`.
+ *
+ * This module stays pure: `markerFor` is a plain callback, and no credential
+ * store types leak in here.
+ */
+export function redactSecretsWith(
+  text: string,
+  markerFor: (match: SecretMatch, rawValue: string) => string,
+): string {
   const matches = scanText(text);
   if (matches.length === 0) return text;
 
@@ -289,7 +314,7 @@ export function redactSecrets(text: string): string {
       continue;
     }
     result += text.slice(lastIndex, match.startIndex);
-    result += `<redacted type="${match.type}" />`;
+    result += markerFor(match, text.slice(match.startIndex, match.endIndex));
     lastIndex = match.endIndex;
   }
   result += text.slice(lastIndex);

package/src/services/published-app-updater.ts

@@ -9,7 +9,6 @@ import { join } from "node:path";
 import {
   getApp,
   getAppDirPath,
-  isMultifileApp,
   resolveEffectiveAppHtml,
 } from "../apps/app-store.js";
 import {
@@ -30,23 +29,19 @@ export async function updatePublishedAppDeployment(
     const publishedPage = getActivePublishedPageByAppId(appId);
     if (!publishedPage) return;
 
-    // 2. Load the app and resolve its deployable HTML. For multifile apps the
-    // real content lives in dist/index.html (compiled from src/), not in
-    // htmlDefinition (which is "" for them) — using htmlDefinition directly
-    // would deploy a blank page.
+    // 2. Load the app and resolve its deployable HTML: the real content
+    // lives in dist/index.html (compiled from src/), inlined into a
+    // self-contained page.
     const app = getApp(appId);
     if (!app) {
       log.warn({ appId }, "Published app not found");
       return;
     }
 
-    // Skip rather than deploy the compile-failure fallback when a multifile
-    // app has no compiled output (e.g. a concurrent compile failed); a later
+    // Skip rather than deploy the compile-failure fallback when the app has
+    // no compiled output (e.g. a concurrent compile failed); a later
     // successful compile re-triggers this path.
-    if (
-      isMultifileApp(app) &&
-      !existsSync(join(getAppDirPath(app.id), "dist", "index.html"))
-    ) {
+    if (!existsSync(join(getAppDirPath(app.id), "dist", "index.html"))) {
       log.warn({ appId }, "Skipping auto-redeploy: compiled output missing");
       return;
     }

package/src/stt/stt-stream-session.ts

@@ -34,10 +34,12 @@ import {
   listProviderIds,
   supportsBoundary,
 } from "../providers/speech-to-text/provider-catalog.js";
+import { describeSttFailure } from "../providers/voice-error-copy.js";
 import { getLogger } from "../util/logger.js";
+import { normalizeSttError } from "./daemon-batch-transcriber.js";
 import {
   type StreamingTranscriber,
-  SttError,
+  type SttProviderId,
   type SttStreamServerEvent,
 } from "./types.js";
 
@@ -228,17 +230,17 @@ export class SttStreamSession {
         "STT stream session started",
       );
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
+      // normalizeSttError preserves an adapter-thrown SttError's category
+      // (e.g. a relay auth rejection at dial time) and classifies raw errors.
+      const sttErr = normalizeSttError(err);
       log.error(
-        { provider: this.provider, error: message },
+        { provider: this.provider, error: sttErr.message },
         "Failed to start STT stream session",
       );
       this.sendEvent({
         type: "error",
-        // Adapters reject with SttError when they know better than the
-        // generic bucket (e.g. a relay auth rejection at dial time).
-        category: err instanceof SttError ? err.category : "provider-error",
-        message: `Failed to start streaming session: ${message}`,
+        category: sttErr.category,
+        message: describeSttFailure(sttErr, this.provider as SttProviderId),
       });
       this.sendEvent({ type: "closed" });
       this.state = "closed";
@@ -254,7 +256,9 @@ export class SttStreamSession {
    * {@link handleBinaryAudio}.
    */
   handleMessage(raw: string): void {
-    if (this.state === "closed") {return;}
+    if (this.state === "closed") {
+      return;
+    }
 
     this.resetIdleTimer();
 
@@ -267,7 +271,9 @@ export class SttStreamSession {
       return;
     }
 
-    if (!parsed || typeof parsed !== "object") {return;}
+    if (!parsed || typeof parsed !== "object") {
+      return;
+    }
 
     const event = parsed as {
       type?: string;
@@ -312,7 +318,9 @@ export class SttStreamSession {
    * frames rather than base64-encoded JSON.
    */
   handleBinaryAudio(data: Buffer | ArrayBuffer | Uint8Array): void {
-    if (this.state !== "active") {return;}
+    if (this.state !== "active") {
+      return;
+    }
 
     this.resetIdleTimer();
 
@@ -328,7 +336,9 @@ export class SttStreamSession {
    * Tears down the provider session and cleans up resources.
    */
   handleClose(code: number, reason?: string): void {
-    if (this.state === "closed") {return;}
+    if (this.state === "closed") {
+      return;
+    }
 
     log.info(
       { provider: this.provider, code, reason },
@@ -343,7 +353,9 @@ export class SttStreamSession {
    * ensure deterministic cleanup of all active sessions.
    */
   destroy(): void {
-    if (this.state === "closed") {return;}
+    if (this.state === "closed") {
+      return;
+    }
 
     log.info({ provider: this.provider }, "STT stream session destroyed");
     this.teardown();
@@ -395,7 +407,9 @@ export class SttStreamSession {
    * Handle events emitted by the streaming transcriber.
    */
   private handleTranscriberEvent(event: SttStreamServerEvent): void {
-    if (this.state === "closed") {return;}
+    if (this.state === "closed") {
+      return;
+    }
 
     this.sendEvent(event);
 
@@ -436,10 +450,14 @@ export class SttStreamSession {
   private resetIdleTimer(): void {
     this.clearIdleTimer();
 
-    if (this.state === "closed" || this.state === "stopping") {return;}
+    if (this.state === "closed" || this.state === "stopping") {
+      return;
+    }
 
     this.idleTimer = setTimeout(() => {
-      if (this.state === "closed") {return;}
+      if (this.state === "closed") {
+        return;
+      }
 
       log.warn({ provider: this.provider }, "STT stream session idle timeout");
       this.sendEvent({
@@ -469,7 +487,9 @@ export class SttStreamSession {
    * Idempotent — safe to call multiple times.
    */
   private teardown(): void {
-    if (this.state === "closed") {return;}
+    if (this.state === "closed") {
+      return;
+    }
     this.state = "closed";
 
     this.clearIdleTimer();

package/src/subagent/manager.ts

@@ -107,7 +107,7 @@ function extractDeltaText(msg: ServerMessage): string | null {
 
 // ── Default subagent system prompt ──────────────────────────────────────
 
-function buildSubagentSystemPrompt(
+export function buildSubagentSystemPrompt(
   config: SubagentConfig,
   role: SubagentRole,
 ): string {
@@ -126,7 +126,8 @@ function buildSubagentSystemPrompt(
     "## Constraints",
     `- Role: ${role}`,
     "- You cannot spawn nested subagents.",
-    "- Use notify_parent to report important findings or if you are blocked.",
+    "- Use notify_parent to report important findings, or if you are blocked.",
+    '- If the objective needs a capability your role\'s tools do not provide (for example, writing or editing a file, or running a command, with a read-only role), do NOT fabricate a completed result — call notify_parent with urgency "blocked", name the capability you lack (e.g. file_write), and stop.',
   );
   return sections.join("\n");
 }
@@ -152,6 +153,8 @@ export function buildSubagentTerminalMessage(opts: {
   error?: string;
   /** A follow-up turn is still queued, so the current synthesis is a snapshot. */
   deferred?: boolean;
+  /** Tools the subagent attempted but that its role allowlist denied. */
+  deniedTools?: string[];
 }): string {
   const {
     label,
@@ -162,9 +165,19 @@ export function buildSubagentTerminalMessage(opts: {
     finalText,
     error,
     deferred,
+    deniedTools,
   } = opts;
   const prefix = isFork ? "Fork" : "Subagent";
 
+  // When the subagent reached for tools its role does not permit, tell the
+  // parent so it re-spawns with a capable role instead of blindly retrying (a
+  // read-only role produces nothing). Only attached to completed outcomes.
+  const many = (deniedTools?.length ?? 0) > 1;
+  const deniedNote =
+    deniedTools && deniedTools.length > 0
+      ? `\n\nNote: this ${prefix.toLowerCase()} attempted ${deniedTools.join(", ")} but its role does not permit ${many ? "them" : "it"}. If the objective requires ${many ? "those" : "that"}, re-spawn with a role that includes ${many ? "them" : "it"} (e.g. \`coder\`).`
+      : "";
+
   if (outcome === "failed") {
     return (
       `[${prefix} "${label}" failed]\n\n` +
@@ -180,7 +193,8 @@ export function buildSubagentTerminalMessage(opts: {
       `${trimmed}\n\n` +
       (silent
         ? `(Use these findings internally; do not relay the raw ${prefix.toLowerCase()} output to the user.)`
-        : `(Incorporate this into your reply to the user as appropriate.)`)
+        : `(Incorporate this into your reply to the user as appropriate.)`) +
+      deniedNote
     );
   }
 
@@ -194,7 +208,8 @@ export function buildSubagentTerminalMessage(opts: {
   return (
     `[${prefix} "${label}" completed]\n\n` +
     `${reason}. Use subagent_read with subagent_id "${subagentId}"${lastN} for the latest output.` +
-    (silent ? ` Keep the result internal.` : ``)
+    (silent ? ` Keep the result internal.` : ``) +
+    deniedNote
   );
 }
 
@@ -367,8 +382,9 @@ export class SubagentManager {
     // ── Build conversation dependencies ─────────────────────────────
     const appConfig = getConfig();
     // Connection-aware default-provider resolution. Throws
-    // `ConnectionResolutionError` if `llm.default.provider_connection` is
-    // unset or the connection row is missing/mismatched (config bugs).
+    // `ConnectionResolutionError` if the resolved default config carries no
+    // provider_connection or the connection row is missing/mismatched
+    // (config bugs).
     // Returns null on soft credential failures (missing credential,
     // platform auth unavailable).
     const baseProvider = await resolveDefaultProvider(appConfig);
@@ -376,7 +392,7 @@ export class SubagentManager {
       throw await mainAgentResolutionError(appConfig.llm, listProviders());
     }
     // Per-call `options.config.callSite` (e.g. `subagentSpawn`) can resolve
-    // to a profile that differs from `llm.default`. The shared wrapper
+    // to a profile that differs from the default's. The shared wrapper
     // threads `appConfig` through so per-call alternate-profile routing is
     // also connection-aware (matches the canonical dispatch path).
     let provider = wrapWithCallSiteRouting(baseProvider, appConfig);
@@ -771,6 +787,9 @@ export class SubagentManager {
       // Capture the trailing assistant text before any release nulls the
       // conversation reference. The fire-and-forget caller ignores the return.
       finalText = extractFinalAssistantText(conversation.messages);
+      // Capture any tools the subagent reached for but its role denied, before a
+      // release nulls the conversation reference, so we can tell the parent.
+      const deniedTools = [...conversation.subagentDeniedToolNames];
       // Copy usage stats from the conversation before sending status (which includes usage).
       managed.state.usage = { ...conversation.usageStats };
       // Only update state + notify if still non-terminal (guards against abort race).
@@ -785,7 +804,12 @@ export class SubagentManager {
         // round-trip. Skipped on the synchronous path — the awaiting caller
         // receives the final text directly.
         if (!managed.synchronous) {
-          this.notifyParentTerminal(managed, "completed", finalText);
+          this.notifyParentTerminal(
+            managed,
+            "completed",
+            finalText,
+            deniedTools,
+          );
         }
       }
     } catch (err) {
@@ -1396,6 +1420,7 @@ export class SubagentManager {
     managed: ManagedSubagent,
     outcome: "completed" | "failed",
     finalText?: string,
+    deniedTools?: string[],
   ): void {
     const { config } = managed.state;
     const isFork = managed.state.isFork;
@@ -1416,6 +1441,7 @@ export class SubagentManager {
       // A queued follow-up turn means the snapshot we hold is stale; defer to a
       // read pointer so the parent picks up the queued turn's output instead.
       deferred: managed.hadEnqueuedMessages === true,
+      deniedTools,
     });
 
     const notification: SubagentNotificationInfo = {

package/src/telemetry/AGENTS.md

@@ -12,4 +12,33 @@ Pre-flush validation (`telemetry-wire-validation.ts`) checks outgoing events aga
 
 The ingest endpoint silently skips events whose type has no registered serializer (the batch still 2xxes and the daemon acks away its outbox rows), so an emitter shipped before its platform serializer loses every event it records — pre-flush validation logs the drop but does not prevent it.
 
-The full cross-repo checklist lives with the serializer registry it governs, in `vellum-assistant-platform` at `django/app/assistant/self_hosted_local/AGENTS.md` ("Adding a new telemetry ingest event type"). The daemon emitter is the **last** step — added only after the platform serializer has merged and the wire sync PR has landed here. A new emitter is an outbox store plus registration in `telemetry-event-sources.ts` (or a watermark source for high-volume tables); if the type previously existed daemon-only, also move it out of `Extensions` in `types.ts`.
+The full cross-repo checklist lives with the serializer registry it governs, in `vellum-assistant-platform` at `django/app/assistant/self_hosted_local/AGENTS.md` ("Adding a new telemetry ingest event type"). The daemon emitter is the **last** step — added only after the platform serializer has merged and the wire sync PR has landed here.
+
+### Emitting an outbox-backed event
+
+For a normal (outbox-backed) event, the sync PR is all the daemon needs — **no manual edits in this directory**. `OUTBOX_TELEMETRY_EVENT_NAMES` (in `types.ts`) and its flush source (in `telemetry-event-sources.ts`) are both **derived from the wire contract**, so a newly-synced type is outbox-backed and flushed automatically. Just call the generic, fully-typed recorder from your feature code:
+
+```ts
+import { recordTelemetryEvent } from "./telemetry-events-outbox.js";
+
+recordTelemetryEvent(
+  "my_new_event",
+  { some_field: value, conversation_id: conversationId ?? null },
+  { conversationId },
+);
+```
+
+`recordTelemetryEvent` stamps the base fields (`type`, `daemon_event_id`, `recorded_at`, `assistant_version`) and gates on consent — dropping only on a confirmed `share_analytics` opt-out; an unknown consent state (cold cache) records, because consent is enforced again at flush time and a record-time drop would destroy the event permanently. Unknown-state buffering is bounded: the reporter prunes outbox rows older than `OUTBOX_MAX_ROW_AGE_MS` (30 days) at the start of every flush cycle, in every consent state, so a permanently-unknown state cannot grow the outbox forever. The `fields` argument is typed as everything except the base fields.
+
+Manual edits in this directory are needed **only** to override a default:
+
+- **Watermark-flushed** (the type has its own high-volume table, not the outbox): add it to `WATERMARK_TELEMETRY_EVENT_NAMES` in `types.ts` and add its source to `WATERMARK_TELEMETRY_EVENT_SOURCES`.
+- **Custom flush behavior** (a non-default per-type source — e.g. re-checking consent at flush time): map the type to a custom source factory in `OUTBOX_SOURCE_FACTORY` in `telemetry-event-sources.ts`. (No type currently needs one — every outbox event, `onboarding_research` included, flushes through the default `outboxSource` under `share_analytics`.)
+- **Daemon-partition flush** (needs live in-process state, like `turn`): add its source to `DAEMON_TELEMETRY_EVENT_SOURCES`.
+- **Richer daemon type** than the wire: add an `Overrides` entry in `types.ts` with the drift guards (see the wire-contract section above).
+
+If the type previously existed daemon-only, also move it out of `Extensions` in `types.ts`.
+
+**For a new event type, prefer calling `recordTelemetryEvent` directly** rather than adding a `record<Thing>Event` store wrapper. A wrapper that only renames camelCase fields to the snake-case wire shape is gratuitous indirection now that `recordTelemetryEvent`'s `fields` argument is fully typed from the wire. Add a store module only when it earns its keep: clamp values to server bounds (`config-setting-events-store.ts`), stamp a custom deterministic `daemon_event_id` via `recordTelemetryOutboxEvent` (`onboarding-research-events-store.ts`), aggregate multiple events (`auth-fallback-events-store.ts`), centralize a non-trivial mapping reused across many call sites (`watchdog-events-store.ts`), or provide a stable, mockable seam for tests (`skill-loaded-events-store.ts`).
+
+The generic outbox also self-heals: rows for a type the platform later removes or renames are drained by the synthetic orphan-drain source (`orphanOutboxDrainSource` in `telemetry-event-sources.ts`), so a retired type needs no cleanup step here.