@vellumai/assistant 0.11.10 → 0.11.11-staging.1

package/src/runtime/auth/same-actor.ts

@@ -103,7 +103,7 @@ export interface SameActorLiveArgs {
 export interface SameActorPersistedArgs {
   sourceActorPrincipalId: string | undefined;
   targetActorPrincipalId: string | undefined;
-  targetClientId: string;
+  targetClientId?: string;
   op: SameActorOp;
   /**
    * Fill-if-missing fallback for dev-bypass deployments: when the PERSISTED
@@ -136,12 +136,15 @@ function isLive(
 function detectRejection(
   args: SameActorLiveArgs | SameActorPersistedArgs,
 ): RejectionReason | undefined {
-  const { sourceActorPrincipalId, targetClientId, op } = args;
+  const { sourceActorPrincipalId, op } = args;
+  const targetClientId = args.targetClientId;
   const targetActorPrincipalId = isLive(args)
-    ? args.hub.getActorPrincipalIdForClient(targetClientId)
+    ? args.hub.getActorPrincipalIdForClient(args.targetClientId)
     : (args.targetActorPrincipalId ??
-      (isHttpAuthDisabled()
-        ? args.hubForMissingTarget?.getActorPrincipalIdForClient(targetClientId)
+      (isHttpAuthDisabled() && targetClientId
+        ? args.hubForMissingTarget?.getActorPrincipalIdForClient(
+            targetClientId,
+          )
         : undefined));
 
   let reason: RejectionReason | undefined;
@@ -261,6 +264,27 @@ export function pickSameUserAutoResolve(args: {
   return { kind: "ambiguous" };
 }
 
+/**
+ * Actor principal persisted on a host-proxy pending interaction.
+ *
+ * Targeted dispatch snapshots the target client's actor. Untargeted dispatch
+ * snapshots the turn's source actor so result routes can still reject a
+ * different principal even when no `targetClientId` was bound.
+ */
+export function snapshotHostProxyActorPrincipalId(args: {
+  hub: Pick<AssistantEventHub, "getActorPrincipalIdForClient">;
+  targetClientId?: string;
+  sourceActorPrincipalId?: string;
+}): string | undefined {
+  if (args.targetClientId != null) {
+    return (
+      args.hub.getActorPrincipalIdForClient(args.targetClientId) ??
+      args.sourceActorPrincipalId
+    );
+  }
+  return args.sourceActorPrincipalId;
+}
+
 /**
  * Standard error result for proxies when {@link pickSameUserAutoResolve}
  * returns `ambiguous`. Asks the caller to specify `target_client_id`.

package/src/runtime/background-job-runner.ts

@@ -171,17 +171,23 @@ export interface RunBackgroundJobOptions {
    */
   allowPreFirstUserMessage?: boolean;
   /**
-   * Optional prompt-injection mitigation. When set, the runner adds three
-   * messages to the conversation BEFORE invoking `processMessage`:
+   * Optional prompt-injection mitigation. When set, the runner seeds the
+   * conversation with a user/assistant/user sandwich BEFORE invoking
+   * `processMessage`:
    *
-   *   1. `user` role: `preamble`     — static, trusted instructions.
-   *   2. `assistant` role: `content` — attacker-controllable payload (the LLM
+   *   1. `user` role: `preamble`     - static, trusted instructions.
+   *   2. `assistant` role: `content` - attacker-controllable payload (the LLM
    *      treats it as its own past output, not as user instructions).
-   *   3. `user` role: `postamble`    — static, trusted action prompt.
+   *   3. `user` role: `postamble`    - static, trusted action prompt.
    *
-   * `processMessage` is then invoked with whatever `prompt` the caller set
-   * (often empty or a short kicker) since the conversation already carries
-   * the seed.
+   * An empty `prompt` is a signal that the sandwich already carries the
+   * seed. In that case the runner persists only the preamble and untrusted
+   * content, then invokes `processMessage` with the postamble.
+   * `persistUserMessage` requires content or attachments, so the kickoff
+   * cannot be empty.
+   *
+   * A non-empty `prompt` still seeds all three sandwich messages, then
+   * invokes `processMessage` with that kicker.
    *
    * Used by the watcher engine to ingest external provider events safely:
    * a malicious Linear title or Gmail subject reaches the model only in
@@ -324,28 +330,29 @@ export async function runBackgroundJob(
     // messages. The LLM treats assistant-role content as its own prior
     // output, not as user instructions, so a malicious payload (e.g. a
     // crafted Linear title) cannot override the postamble's action prompt.
-    if (opts.assistantSandwich) {
-      await addMessage(
-        conversation.id,
-        "user",
-        opts.assistantSandwich.preamble,
-        { skipIndexing: true },
-      );
-      await addMessage(
-        conversation.id,
-        "assistant",
-        opts.assistantSandwich.content,
-        { skipIndexing: true },
-      );
-      await addMessage(
-        conversation.id,
-        "user",
-        opts.assistantSandwich.postamble,
-        { skipIndexing: true },
-      );
+    const sandwich = opts.assistantSandwich;
+    let kickoffPrompt = opts.prompt;
+    let kickoffFromPostamble = false;
+    if (sandwich) {
+      await addMessage(conversation.id, "user", sandwich.preamble, {
+        skipIndexing: true,
+      });
+      await addMessage(conversation.id, "assistant", sandwich.content, {
+        skipIndexing: true,
+      });
+      if (opts.prompt.trim() === "") {
+        // persistUserMessage rejects empty content. The sandwich already
+        // carries the seed, so the trusted postamble is the kickoff.
+        kickoffFromPostamble = true;
+        kickoffPrompt = sandwich.postamble;
+      } else {
+        await addMessage(conversation.id, "user", sandwich.postamble, {
+          skipIndexing: true,
+        });
+      }
     }
 
-    const work = processMessage(conversation.id, opts.prompt, {
+    const work = processMessage(conversation.id, kickoffPrompt, {
       trustContext: opts.trustContext,
       callSite: opts.callSite,
       ...(opts.overrideProfile
@@ -355,7 +362,9 @@ export async function runBackgroundJob(
       ...(opts.cronRunId ? { cronRunId: opts.cronRunId } : {}),
       ...(opts.allowedTools ? { allowedTools: opts.allowedTools } : {}),
       ...(opts.toolGateMode ? { toolGateMode: opts.toolGateMode } : {}),
-      ...(opts.skipPromptIndexing ? { skipUserMessageIndexing: true } : {}),
+      ...(opts.skipPromptIndexing || kickoffFromPostamble
+        ? { skipUserMessageIndexing: true }
+        : {}),
     });
     // Absorb late rejections: if the timeout wins the race, `work` keeps
     // running and may eventually reject — swallow so it doesn't surface as

package/src/runtime/guardian-action-service.ts

@@ -64,6 +64,16 @@ export type ProcessGuardianDecisionResult =
       ok: true;
       applied: false;
       reason: string;
+      /**
+       * Whether the decision was recorded before the decline. Present only
+       * for the two resolver failures: `true` under `resolver_failed` (the
+       * decision committed and its follow-through failed), `false` under
+       * `decision_not_persisted` (nothing was written; the guardian can
+       * retry). A client reads this rather than the reason so an older
+       * daemon, which reports both under `resolver_failed` and omits the
+       * field, is not misread as having committed.
+       */
+      committed?: boolean;
       resolverFailureReason?: string;
       requestId?: string;
     }
@@ -138,10 +148,19 @@ export async function processGuardianDecision(
   // 4. Map the canonical result
   if (decisionResult.applied) {
     if (decisionResult.resolverFailed) {
+      // Two failures share the primitive's `resolverFailed` flag and a
+      // client has to tell them apart: a decision that committed and whose
+      // follow-through then failed is settled (another attempt can only
+      // come back already resolved), while one whose persist never landed
+      // is still pending and is the guardian's to retry. The primitive
+      // marks the difference by omitting `decidedAction` when nothing was
+      // committed (see `decisionPersistFailure`).
+      const committed = decisionResult.decidedAction !== undefined;
       return {
         ok: true,
         applied: false,
-        reason: "resolver_failed",
+        reason: committed ? "resolver_failed" : "decision_not_persisted",
+        committed,
         resolverFailureReason: decisionResult.resolverFailureReason,
         requestId: decisionResult.requestId,
       };

package/src/runtime/migrations/vbundle-validator.ts

@@ -19,6 +19,8 @@ import { gunzipSync } from "node:zlib";
 
 import { z } from "zod";
 
+import { parseUstarSizeField } from "../../archive/ustar-size.js";
+
 // ---------------------------------------------------------------------------
 // Manifest schema (v1)
 // ---------------------------------------------------------------------------
@@ -263,9 +265,7 @@ function parseTar(buffer: Uint8Array): TarEntry[] {
     // File type (byte 156)
     const typeFlag = String.fromCharCode(header[156]);
 
-    // File size in octal (bytes 124-135)
-    const sizeStr = decodeNullTerminated(header, 124, 12);
-    const size = parseInt(sizeStr, 8) || 0;
+    const size = parseUstarSizeField(header);
 
     // Calculate data blocks
     const dataBlocks = Math.ceil(size / BLOCK_SIZE);

package/src/runtime/pending-interactions.ts

@@ -110,11 +110,10 @@ export interface PendingInteraction {
   /** When set, the host_bash request should be routed to this specific client. */
   targetClientId?: string;
   /**
-   * Snapshot of `targetClientId`'s `actorPrincipalId` taken at registration
-   * time. Persisted so the result-route same-actor check compares against
-   * a stable value rather than the live hub — the target client's SSE
-   * subscription may have briefly disconnected between dispatch and result
-   * submission, which would otherwise 403 a legitimate result.
+   * Actor principal captured at registration. Targeted requests snapshot the
+   * target client's actor so a brief SSE reconnect does not 403 a legitimate
+   * result. Untargeted requests snapshot the turn's source actor so a
+   * different principal cannot forge stdout/stderr/exitCode.
    */
   targetActorPrincipalId?: string;
 

package/src/runtime/routes/__tests__/heartbeat-routes.test.ts

@@ -23,6 +23,11 @@ mock.module("../../../heartbeat/heartbeat-service.js", () => ({
   },
 }));
 
+mock.module("../../../schedule/schedule-timezone.js", () => ({
+  resolveScheduleTimezone: (explicit: string | null | undefined) =>
+    explicit ?? "America/Los_Angeles",
+}));
+
 // ─── Setup ─────────────────────────────────────────────────────────────────
 
 let workspaceDir: string;
@@ -112,3 +117,22 @@ describe("setHeartbeatConfig handler", () => {
     });
   });
 });
+
+describe("getHeartbeatConfig handler", () => {
+  test("returns the resolved timezone separately from the stored override", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify({ heartbeat: { enabled: true } }, null, 2) + "\n",
+    );
+    invalidateConfigCache();
+
+    const handler = findHandler("getHeartbeatConfig");
+    const result = (await handler({})) as {
+      timezone: string | null;
+      effectiveTimezone: string | null;
+    };
+
+    expect(result.timezone).toBeNull();
+    expect(result.effectiveTimezone).toBe("America/Los_Angeles");
+  });
+});

package/src/runtime/routes/__tests__/platform-credits-routes.test.ts

@@ -34,6 +34,8 @@ const creditsHandler = ROUTES.find(
 )!.handler;
 
 const SUMMARY_URL = "https://platform.test/v1/organizations/billing/summary/";
+const SUBSCRIPTION_URL =
+  "https://platform.test/v1/organizations/billing/subscription/";
 
 const FULL_SUMMARY = {
   settled_balance_usd: "50.00",
@@ -46,21 +48,34 @@ const FULL_SUMMARY = {
   daily_limit_snoozed: true,
   low_balance_threshold_usd: "5.00",
   low_balance_warning: true,
+  available_usage_balance: "9.10",
+  total_usage_balance: "20.00",
+  credits_expiring_soon_usd: "9.10",
+  next_credit_expiry_at: "2026-10-01T00:00:00Z",
 };
 
 const realFetch = globalThis.fetch;
 let fetchedUrls: string[] = [];
 
-/** Stub globalThis.fetch to answer every call with `body`, recording URLs. */
-function stubFetch(body: unknown, status = 200): void {
+/**
+ * Stub globalThis.fetch: the summary URL answers with `summary`, the
+ * subscription URL with `subscription` (a plan, or a 500 when "error").
+ */
+function stubFetch(
+  summary: unknown,
+  subscription: { plan_id: "base" | "pro" } | "error" = { plan_id: "pro" },
+): void {
   globalThis.fetch = (async (input: string | URL | Request) => {
-    fetchedUrls.push(
+    const url =
       typeof input === "string"
         ? input
         : input instanceof URL
           ? input.toString()
-          : input.url,
-    );
+          : input.url;
+    fetchedUrls.push(url);
+    const isSubscription = url === SUBSCRIPTION_URL;
+    const status = isSubscription && subscription === "error" ? 500 : 200;
+    const body = isSubscription ? subscription : summary;
     return new Response(JSON.stringify(body), {
       status,
       headers: { "Content-Type": "application/json" },
@@ -97,6 +112,78 @@ describe("platform_credits", () => {
       daily_limit_snoozed: true,
       low_balance_threshold: 5,
       low_balance_warning: true,
+      plan_credit_remaining: 9.1,
+      plan_credit_total: 20,
+      plan_credit_used_fraction: 0.545,
+      plan_credits_spent: false,
+      extra_credit_remaining: 33.07,
+      credits_expiring_soon: 9.1,
+      next_credit_expiry_at: "2026-10-01T00:00:00Z",
+    });
+  });
+
+  test("marks plan credit spent once the grants are used up", async () => {
+    stubFetch({ ...FULL_SUMMARY, available_usage_balance: "0.00" });
+
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_used_fraction: 1,
+      plan_credits_spent: true,
+      extra_credit_remaining: 42.17,
+    });
+  });
+
+  test("treats a Pro plan whose grants total nothing as fully spent", async () => {
+    stubFetch(
+      {
+        ...FULL_SUMMARY,
+        available_usage_balance: "0.00",
+        total_usage_balance: "0.00",
+      },
+      { plan_id: "pro" },
+    );
+
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_total: 0,
+      plan_credit_used_fraction: 1,
+      plan_credits_spent: true,
+      extra_credit_remaining: 42.17,
+    });
+    expect(fetchedUrls).toEqual([SUMMARY_URL, SUBSCRIPTION_URL]);
+  });
+
+  test("gives a base plan with no grants no reading, and clamps a refund overshoot", async () => {
+    stubFetch(
+      {
+        ...FULL_SUMMARY,
+        available_usage_balance: "0.00",
+        total_usage_balance: "0.00",
+      },
+      { plan_id: "base" },
+    );
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_used_fraction: null,
+      plan_credits_spent: null,
+    });
+
+    stubFetch({ ...FULL_SUMMARY, available_usage_balance: "25.00" });
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_used_fraction: 0,
+      plan_credits_spent: false,
+      extra_credit_remaining: 17.17,
+    });
+  });
+
+  test("still reads the ratio when the subscription fetch fails, but not the zero-grant case", async () => {
+    stubFetch(FULL_SUMMARY, "error");
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_used_fraction: 0.545,
+      plan_credits_spent: false,
+    });
+
+    stubFetch({ ...FULL_SUMMARY, total_usage_balance: "0.00" }, "error");
+    expect(await creditsHandler({})).toMatchObject({
+      plan_credit_used_fraction: null,
+      plan_credits_spent: null,
     });
   });
 
@@ -116,6 +203,13 @@ describe("platform_credits", () => {
       daily_limit_snoozed: false,
       low_balance_threshold: null,
       low_balance_warning: false,
+      plan_credit_remaining: null,
+      plan_credit_total: null,
+      plan_credit_used_fraction: null,
+      plan_credits_spent: null,
+      extra_credit_remaining: null,
+      credits_expiring_soon: null,
+      next_credit_expiry_at: null,
     });
   });
 

package/src/runtime/routes/conversation-query-routes.ts

@@ -6,7 +6,7 @@
  * GET    /v1/model                      — current model info
  * PUT    /v1/model/image-gen            — set image-gen model
  * GET    /v1/config/embeddings          — current embedding config
- * PUT    /v1/config/embeddings          — set embedding provider/model
+ * PUT    /v1/config/embeddings          - set embedding provider/model/baseUrl
  * GET    /v1/config                     — full raw workspace config
  * PATCH  /v1/config                     — deep-merge partial config
  * PUT    /v1/config/llm/profiles/:name  — replace an inference profile
@@ -29,6 +29,12 @@ import {
   LatencyBreakdownSchema,
   LLMRequestLogEntrySchema,
 } from "../../api/responses/llm-request-log-entry.js";
+import {
+  catalogEntryFor,
+  type InputModalities,
+  modalitiesOf,
+  resolveModalityOverride,
+} from "../../config/input-modalities.js";
 import {
   deepMergeOverwrite,
   fillContextDefaultsForMissingKeys,
@@ -85,6 +91,7 @@ import {
   CONFIG_RELOAD_DEBOUNCE_MS,
   log,
 } from "../../daemon/handlers/shared.js";
+import { rescheduleHeartbeatIfTimezoneChanged } from "../../heartbeat/heartbeat-service.js";
 import {
   getAssistantMessageIdsInTurn,
   getConversation,
@@ -97,6 +104,7 @@ import {
 } from "../../persistence/conversation-types.js";
 import { getDb } from "../../persistence/db-connection.js";
 import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embedding-backend.js";
+import { resolveOpenAICompatibleBaseUrl } from "../../persistence/embeddings/embedding-openai.js";
 import { getLlmRequestLogSource } from "../../persistence/llm-request-log-source.js";
 import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
@@ -112,7 +120,6 @@ import {
   listConnections,
   VELLUM_MANAGED_CONNECTION_NAME,
 } from "../../providers/inference/connections.js";
-import { PROVIDER_CATALOG } from "../../providers/model-catalog.js";
 import { initializeProviders } from "../../providers/registry.js";
 import { MANAGED_ROUTABLE_PROVIDERS } from "../../providers/vellum-model-routing.js";
 import { credentialKey } from "../../security/credential-key.js";
@@ -457,9 +464,11 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
   if (!body || typeof body !== "object") {
     throw new BadRequestError("Request body is required");
   }
-  const { provider, model } = body as {
+  const { provider, model, baseUrl, dimensions } = body as {
     provider?: string;
     model?: string;
+    baseUrl?: string;
+    dimensions?: number | null;
   };
   if (!provider || typeof provider !== "string") {
     throw new BadRequestError("Missing required field: provider");
@@ -472,8 +481,32 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
   if (model !== undefined && typeof model !== "string") {
     throw new BadRequestError("Field 'model' must be a string");
   }
+  if (baseUrl !== undefined && typeof baseUrl !== "string") {
+    throw new BadRequestError("Field 'baseUrl' must be a string");
+  }
+  if (
+    typeof baseUrl === "string" &&
+    baseUrl !== "" &&
+    !resolveOpenAICompatibleBaseUrl(baseUrl)
+  ) {
+    throw new BadRequestError("Field 'baseUrl' must be an http(s) URL");
+  }
+  if (
+    dimensions !== undefined &&
+    dimensions !== null &&
+    (typeof dimensions !== "number" ||
+      !Number.isInteger(dimensions) ||
+      dimensions <= 0)
+  ) {
+    throw new BadRequestError(
+      "Field 'dimensions' must be a positive integer or null",
+    );
+  }
   try {
-    return await setEmbeddingConfig(provider, model, getModelSetContext());
+    return await setEmbeddingConfig(provider, model, getModelSetContext(), {
+      baseUrl,
+      dimensions,
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     throw new InternalError(`Failed to set embedding config: ${message}`);
@@ -1064,9 +1097,10 @@ export function normalizeManagedProfileWrites(patch: unknown): void {
  * Annotate each profile in `config.llm.profiles` with wire-only flags
  * (`WIRE_ONLY_PROFILE_KEYS`) — never persisted to disk:
  *
- * - `supportsVision`: resolved from the model catalog. Unknown (provider,
- *   model) pairs default to `true` (fail-open) so image upload remains
- *   available for custom / unlisted models.
+ * - `supportsVision`: resolved from the model catalog, with a profile
+ *   `inputModalities.image` override winning when set. Unknown (provider,
+ *   model) pairs with no override default to `true` (fail-open) so image
+ *   upload remains available for custom / unlisted models.
  * - `invariant`: `true` for managed-source entries of the managed profile
  *   names (`INVARIANT_PROFILE_NAMES`); absent otherwise. Source-gated to
  *   match `assertInvariantProfilesPreserved` — a user-owned profile sharing
@@ -1101,9 +1135,13 @@ function enrichProfilesForWire(config: unknown): void {
       continue;
     }
 
-    const catalogProvider = PROVIDER_CATALOG.find((p) => p.id === provider);
-    const catalogModel = catalogProvider?.models.find((m) => m.id === model);
-    entry.supportsVision = catalogModel?.supportsVision ?? true;
+    const catalogModel = catalogEntryFor(provider, model);
+    const catalogVision = catalogModel?.supportsVision;
+    const imageOverride = modalitiesOf({
+      inputModalities: entry.inputModalities as InputModalities | null,
+    })?.image;
+    entry.supportsVision =
+      resolveModalityOverride(imageOverride, catalogVision) ?? true;
   }
 }
 
@@ -1471,6 +1509,7 @@ export async function commitConfigWrite(
 
   clearEmbeddingBackendCache();
   invalidateConfigCache();
+  rescheduleHeartbeatIfTimezoneChanged(preWrite, raw);
   // Reinitialize providers so the live registry reflects the new config.
   // Suppress disk writes inside loadConfig() — we just wrote the raw config
   // and the first-launch seed path would overwrite it with full defaults.
@@ -2344,11 +2383,14 @@ export const ROUTES: RouteDefinition[] = [
       allowedPrincipalTypes: ACTOR_PRINCIPALS,
     },
     summary: "Set embedding config",
-    description: "Change the embedding provider and optionally model.",
+    description:
+      "Change the embedding provider, model, and optional custom endpoint.",
     tags: ["config"],
     requestBody: z.object({
       provider: z.string(),
       model: z.string().optional(),
+      baseUrl: z.string().optional(),
+      dimensions: z.number().int().positive().nullable().optional(),
     }),
     handler: handleSetEmbeddingConfig,
   },

package/src/runtime/routes/document-comments-routes.ts

@@ -208,7 +208,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateDocumentComment",
     endpoint: "documents/:id/comments/:commentId",
     method: "PATCH",
-    policy: null,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update a document comment",
     description: "Update the status or content of a comment.",
     tags: ["documents"],
@@ -273,7 +276,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "deleteDocumentComment",
     endpoint: "documents/:id/comments/:commentId",
     method: "DELETE",
-    policy: null,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a document comment",
     description: "Permanently delete a comment.",
     tags: ["documents"],

package/src/runtime/routes/guardian-action-routes.ts

@@ -116,6 +116,7 @@ async function handleGuardianActionDecision({
   return {
     applied: false,
     reason: result.reason,
+    ...(result.committed !== undefined ? { committed: result.committed } : {}),
     ...(result.resolverFailureReason
       ? { resolverFailureReason: result.resolverFailureReason }
       : {}),
@@ -271,6 +272,12 @@ export const ROUTES: RouteDefinition[] = [
         .string()
         .optional()
         .describe("Decline reason (present only when applied is false)"),
+      committed: z
+        .boolean()
+        .optional()
+        .describe(
+          "Whether the decision was recorded before the decline. Present only for a resolver failure: true under resolver_failed (the decision committed and its follow-through failed), false under decision_not_persisted (nothing was written; retry is safe). Absent on daemons that report both under resolver_failed.",
+        ),
       replyText: z
         .string()
         .optional()