@vellumai/assistant 0.11.2-dev.202608070121.59f762f → 0.11.2-dev.202608070306.b97cdd6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608070121.59f762f",
+  "version": "0.11.2-dev.202608070306.b97cdd6",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/conversation-initial-prompt.test.ts

@@ -3,11 +3,12 @@
  *
  * A conversation's system prompt is built once at construction and frozen for
  * every turn (the agent loop never re-resolves it), so the persona slot must
- * resolve correctly here. With no construction-time identity the default-build
- * path must warm the gateway guardian binding BEFORE building (else a cold cache
- * pins `users/default.md`); a channel-routed conversation that already carries
- * the requester's trust context must build with it so the requester's profile
- * resolves instead of the guardian/default one.
+ * resolve correctly here. With no construction-time identity OR a
+ * guardian-class trust context (background/scheduled turns, memory
+ * consolidation, managed desktop) the guardian binding must be warmed BEFORE
+ * building (else a cold cache pins `users/default.md`); a channel-routed
+ * conversation carrying a non-guardian requester trust context must build with
+ * it directly so the requester's profile resolves via the DB contact lookup.
  *
  * Dependency seams are injected so this exercises the sequencing without mocking
  * the widely-imported guardian-delivery / system-prompt modules (those global
@@ -15,10 +16,7 @@
  */
 import { describe, expect, test } from "bun:test";
 
-import {
-  resolveInitialSystemPrompt,
-  warmGuardianBindings,
-} from "../daemon/conversation-initial-prompt.js";
+import { resolveInitialSystemPrompt } from "../daemon/conversation-initial-prompt.js";
 import type { ConversationCreateOptions } from "../daemon/handlers/shared.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 
@@ -47,18 +45,22 @@ const REQUESTER_TRUST = {
   requesterExternalUserId: "user-123",
 } as unknown as TrustContext;
 
-describe("warmGuardianBindings", () => {
-  test("warms both the vellum-channel key and the unfiltered fallback key", async () => {
-    const keys: string[] = [];
-    await warmGuardianBindings(async (input) => {
-      keys.push(input?.channelTypes?.join(",") ?? "ALL");
-      return null;
-    });
-    // Both keys the persona resolver reads — peekGuardianForChannel("vellum")
-    // and its peekAnyGuardian() fallback — must be warmed.
-    expect(keys.sort()).toEqual(["ALL", "vellum"]);
-  });
-});
+// The shape scheduler execute/reuse runs, memory consolidation, and other
+// runBackgroundJob callers pass at construction: guardian class, no
+// per-actor identity.
+const GUARDIAN_BACKGROUND_TRUST = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+} as unknown as TrustContext;
+
+// Managed desktop: guardian class WITH a requester principal id. The persona
+// resolution may still need the guardian-delivery cache (contact lookup miss
+// or null userFile falls through to the guardian file).
+const GUARDIAN_REQUESTER_TRUST = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+  requesterExternalUserId: "principal-123",
+} as unknown as TrustContext;
 
 describe("resolveInitialSystemPrompt", () => {
   test("no construction-time identity: warms the guardian binding, then builds with no trust context", async () => {
@@ -72,7 +74,7 @@ describe("resolveInitialSystemPrompt", () => {
     expect(builtWith).toEqual([undefined]);
   });
 
-  test("channel-routed: threads the requester trust context and skips the guardian warm", async () => {
+  test("non-guardian channel-routed: threads the requester trust context and skips the guardian warm", async () => {
     const { calls, builtWith, deps } = spyDeps();
     const result = await resolveInitialSystemPrompt(
       { trustContext: REQUESTER_TRUST } as ConversationCreateOptions,
@@ -86,6 +88,33 @@ describe("resolveInitialSystemPrompt", () => {
     expect(builtWith).toEqual([REQUESTER_TRUST]);
   });
 
+  test("guardian-class background shape: warms the guardian binding, then builds with the trust context", async () => {
+    const { calls, builtWith, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(
+      { trustContext: GUARDIAN_BACKGROUND_TRUST } as ConversationCreateOptions,
+      deps,
+    );
+
+    expect(result).toBe("BUILD");
+    // Scheduled tasks and memory consolidation construct conversations in
+    // worker processes whose guardian-delivery cache starts cold; the warm
+    // MUST precede the build or the persona slot pins users/default.md.
+    expect(calls).toEqual(["warm", "build"]);
+    expect(builtWith).toEqual([GUARDIAN_BACKGROUND_TRUST]);
+  });
+
+  test("guardian-class with requester identity (managed desktop): still warms before building", async () => {
+    const { calls, builtWith, deps } = spyDeps();
+    const result = await resolveInitialSystemPrompt(
+      { trustContext: GUARDIAN_REQUESTER_TRUST } as ConversationCreateOptions,
+      deps,
+    );
+
+    expect(result).toBe("BUILD");
+    expect(calls).toEqual(["warm", "build"]);
+    expect(builtWith).toEqual([GUARDIAN_REQUESTER_TRUST]);
+  });
+
   test("an explicit override is used verbatim and skips the warm and build", async () => {
     const { calls, deps } = spyDeps();
     const result = await resolveInitialSystemPrompt(

package/src/__tests__/conversation-origin-channel-filter.test.ts

@@ -0,0 +1,95 @@
+import type { Database } from "bun:sqlite";
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { createConversation } from "../persistence/conversation-crud.js";
+import { ensureGroupMigration } from "../persistence/conversation-group-migration.js";
+import { listConversations } from "../persistence/conversation-queries.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+
+await initializeDb();
+ensureGroupMigration();
+
+function getRawDb(): Database {
+  return (getDb() as unknown as { $client: Database }).$client;
+}
+
+/**
+ * `originChannel` is what lets each sidebar channel card fetch its own rows,
+ * and what lets the Chats card ask for the ones no channel claimed.
+ *
+ * The asymmetry under test: `origin_channel` is deliberately NULL at insert so
+ * an inbound message can claim the conversation for its channel, and migration
+ * 288 settles the unclaimed ones to 'vellum' at daemon startup. So NULL means
+ * "not yet attributed", and between one boot and the next it is what most rows
+ * carry. Reading `vellum` strictly would leave every one of them in no section
+ * at all: not native, not any channel.
+ */
+describe("listConversations originChannel filter", () => {
+  beforeEach(() => {
+    const raw = getRawDb();
+    raw.run("DELETE FROM conversations");
+  });
+
+  /** Set `origin_channel` directly; `createConversation` leaves it unset. */
+  function stamp(id: string, originChannel: string | null): void {
+    getRawDb().run("UPDATE conversations SET origin_channel = ? WHERE id = ?", [
+      originChannel,
+      id,
+    ]);
+  }
+
+  function listedIds(originChannel: string): string[] {
+    return listConversations({ originChannel } as Parameters<
+      typeof listConversations
+    >[0]).map((c) => c.id);
+  }
+
+  test("vellum matches rows that were never attributed", () => {
+    createConversation({ id: "conv-unattributed", source: "user" });
+    stamp("conv-unattributed", null);
+
+    expect(listedIds("vellum")).toEqual(["conv-unattributed"]);
+  });
+
+  test("vellum matches rows explicitly stamped vellum", () => {
+    createConversation({ id: "conv-native", source: "user" });
+    stamp("conv-native", "vellum");
+
+    expect(listedIds("vellum")).toEqual(["conv-native"]);
+  });
+
+  /* The whole point: an unattributed row and a stamped native row are the same
+     section. Asserting both are returned together, rather than each alone,
+     is what fails if the predicate goes back to a strict equality. */
+  test("vellum returns unattributed and stamped rows together", () => {
+    createConversation({ id: "conv-native", source: "user" });
+    stamp("conv-native", "vellum");
+    createConversation({ id: "conv-unattributed", source: "user" });
+    stamp("conv-unattributed", null);
+
+    expect(listedIds("vellum").sort()).toEqual([
+      "conv-native",
+      "conv-unattributed",
+    ]);
+  });
+
+  test("vellum does not claim a row belonging to a channel", () => {
+    createConversation({ id: "conv-slack", source: "user" });
+    stamp("conv-slack", "slack");
+
+    expect(listedIds("vellum")).toEqual([]);
+  });
+
+  /* Only `vellum` is tolerant. A row is claimed for a channel by that channel
+     alone, so there is no ambiguity for the others to absorb - and a tolerant
+     `slack` would pull every unattributed row into the Slack card. */
+  test("a channel matches exactly and never absorbs unattributed rows", () => {
+    createConversation({ id: "conv-slack", source: "user" });
+    stamp("conv-slack", "slack");
+    createConversation({ id: "conv-unattributed", source: "user" });
+    stamp("conv-unattributed", null);
+
+    expect(listedIds("slack")).toEqual(["conv-slack"]);
+  });
+});

package/src/__tests__/guardian-outbound-http.test.ts

@@ -440,7 +440,7 @@ describe("HTTP route: handleCreateVerificationSession (guardian path)", () => {
   test("creates inbound challenge when destination is absent", async () => {
     const result = (await handleCreateVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.channel).toBe("phone");
   });
@@ -448,7 +448,7 @@ describe("HTTP route: handleCreateVerificationSession (guardian path)", () => {
   test("returns success for valid voice start", async () => {
     const result = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15559999999" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.verificationSessionId).toBeDefined();
   });
@@ -471,7 +471,7 @@ describe("HTTP route: handleResendVerificationSession (guardian path)", () => {
     // Start a session first
     const startResult = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15556667777" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(startResult.success).toBe(true);
 
     // Expire the cooldown so resend is allowed
@@ -489,7 +489,7 @@ describe("HTTP route: handleResendVerificationSession (guardian path)", () => {
         channel: "phone",
         originConversationId: "conv-resend-http-origin",
       },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(resendResult.success).toBe(true);
     expect(resendResult.originConversationId).toBe("conv-resend-http-origin");
   });
@@ -505,7 +505,7 @@ describe("HTTP route: handleCancelVerificationSession (guardian path)", () => {
   test("returns success even when no active session exists", async () => {
     const result = (await handleCancelVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
   });
 
@@ -513,13 +513,13 @@ describe("HTTP route: handleCancelVerificationSession (guardian path)", () => {
     // Start a session
     const startResult = (await handleCreateVerificationSession({
       body: { channel: "phone", destination: "+15558887777" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(startResult.success).toBe(true);
 
     // Cancel it
     const cancelResult = (await handleCancelVerificationSession({
       body: { channel: "phone" },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(cancelResult.success).toBe(true);
   });
 });
@@ -575,7 +575,7 @@ describe("origin conversation linkage", () => {
         destination: "+15557776666",
         originConversationId: "conv-origin-http-test",
       },
-    })) as Record<string, unknown>;
+    })) as unknown as Record<string, unknown>;
     expect(result.success).toBe(true);
     expect(result.originConversationId).toBe("conv-origin-http-test");
   });

package/src/__tests__/persona-resolver.test.ts

@@ -63,6 +63,8 @@ function seedVellumGuardian(userFile: string | null): void {
 
 mock.module("../util/platform.js", () => ({
   getWorkspaceDir: () => mockWorkspaceDir,
+  getWorkspacePromptPath: (filename: string) =>
+    join(mockWorkspaceDir, "prompts", filename),
 }));
 
 mock.module("../contacts/contact-store.js", () => ({
@@ -96,6 +98,7 @@ mock.module("../contacts/guardian-delivery-reader.js", () => ({
 // Import AFTER mocks so the module under test binds to the stubbed
 // implementations.
 import { getGuardianDelivery } from "../contacts/guardian-delivery-reader.js";
+import { resolveUserName } from "../daemon/identity-helpers.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import {
   ensureGuardianPersonaFile,
@@ -408,3 +411,154 @@ describe("resolveUserSlug (guardian trust WITH requester identity)", () => {
     expect(resolveUserSlug(trustContext)).toBeNull();
   });
 });
+
+// ── resolveUserSlug — guardian bound on a non-vellum channel ───────
+//
+// warmGuardianBindings warms both the channel-filtered and unfiltered cache
+// keys, but a guardian may be bound only on a non-vellum channel (phone,
+// Telegram). A guardian-class turn sourced elsewhere must still resolve that
+// guardian instead of silently landing on users/default.md.
+
+describe("resolveUserSlug (guardian bound on a non-vellum channel)", () => {
+  test("falls back to the any-channel guardian when the source channel has none", () => {
+    mockGuardianDeliveries = [
+      { channelType: "telegram", address: "guardian-tg", status: "active" },
+    ];
+    mockContactsByAddress["telegram:guardian-tg"] = { userFile: "alice.md" };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    expect(resolveUserSlug(trustContext)).toBe("alice");
+  });
+
+  test("any-channel guardian with no userFile resolves the guardian.md fallback", () => {
+    mockGuardianDeliveries = [
+      { channelType: "telegram", address: "guardian-tg", status: "active" },
+    ];
+    mockContactsByAddress["telegram:guardian-tg"] = { userFile: null };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    expect(resolveUserSlug(trustContext)).toBe("guardian");
+  });
+});
+
+// ── resolveUserSlug — cold cache then construction-time warm ───────
+//
+// The exact shape scheduled tasks and memory consolidation pass through
+// resolveInitialSystemPrompt: guardian class, no requester identity, built in
+// a worker process whose guardian-delivery cache starts cold.
+
+describe("resolveUserSlug (cold cache, background shape)", () => {
+  test("misses on a cold cache, resolves the guardian after the construction-time warm", async () => {
+    pendingWarmDeliveries = [
+      { channelType: "vellum", address: "vellum:self", status: "active" },
+    ];
+    mockContactsByAddress["vellum:vellum:self"] = { userFile: "alice.md" };
+
+    const trustContext = {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    } as TrustContext;
+
+    // Cold: the sync peek finds nothing and the slug falls back to default.
+    expect(resolveUserSlug(trustContext)).toBeNull();
+
+    // resolveInitialSystemPrompt warms guardian bindings for guardian-class
+    // contexts before building; afterwards the same resolution succeeds.
+    await getGuardianDelivery({ channelTypes: ["vellum"] });
+
+    expect(resolveUserSlug(trustContext)).toBe("alice");
+  });
+});
+
+// ── resolveUserName — guardian-preferred display name ──────────────
+//
+// The sweep job and v2 router address the user by name in their prompts. The
+// name must come from the guardian's own persona file when one is resolvable,
+// falling back to users/default.md.
+
+describe("resolveUserName", () => {
+  test("prefers the Name label from the guardian's own persona file over default.md", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(join(usersDir, "alice.md"), "**Name:** Alice\n", "utf-8");
+    writeFileSync(
+      join(usersDir, "default.md"),
+      "**Name:** Default User\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Alice");
+  });
+
+  test("reads the onboarding-written Preferred name bullet", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "# User Profile\n\n## Onboarding Context\n\n- **Preferred name:** Ali\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Ali");
+  });
+
+  test("reads the scaffold's filled Preferred name/reference line", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "- Preferred name/reference: Alice\n- Pronouns: she/her\n",
+      "utf-8",
+    );
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Alice");
+  });
+
+  test("an unfilled scaffold does not swallow the next line and falls back to default.md", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    // The bare scaffold: every label present, every value unfilled.
+    ensureGuardianPersonaFile("alice.md");
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("a declined_by_user sentinel is not used as a name", () => {
+    seedVellumGuardian("alice.md");
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(
+      join(usersDir, "alice.md"),
+      "- Preferred name/reference: declined_by_user\n",
+      "utf-8",
+    );
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("falls back to default.md when no guardian resolves", () => {
+    const usersDir = join(mockWorkspaceDir, "users");
+    mkdirSync(usersDir, { recursive: true });
+    writeFileSync(join(usersDir, "default.md"), "**Name:** Bob\n", "utf-8");
+
+    expect(resolveUserName(mockWorkspaceDir)).toBe("Bob");
+  });
+
+  test("returns null when neither file yields a name", () => {
+    expect(resolveUserName(mockWorkspaceDir)).toBeNull();
+  });
+});

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -115,6 +115,12 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../config/skill-state.js",
     "../../../../config/skills.js",
     "../../../../config/types.js",
+    // Same host module the retrospective job couples to (the `../../../`
+    // entry below): the sweep job and v2 router warm the guardian-delivery
+    // cache before their sync `resolveUserName` reads so worker-process
+    // prompts address the guardian instead of the default profile. No
+    // plugin-api equivalent.
+    "../../../../contacts/guardian-delivery-reader.js",
     "../../../../context/token-estimator.js",
     "../../../../daemon/conversation-error.js",
     "../../../../daemon/conversation-notices.js",

package/src/__tests__/tool-side-effects-documents.test.ts

@@ -26,12 +26,6 @@ mock.module("../util/logger.js", () => createMockLoggerModule());
 
 // Stub the transitive imports so the module graph under test stops at
 // tool-side-effects.ts and never reaches the real sync publisher.
-mock.module("../channels/gateway-verification-sessions.js", () => ({
-  findActiveSession: mock(() => Promise.resolve(null)),
-}));
-mock.module("../runtime/verification-outbound-actions.js", () => ({
-  deliverVerificationSlack: mock(() => {}),
-}));
 mock.module("../media/app-icon-generator.js", () => ({
   generateAppIcon: mock(() => Promise.resolve()),
 }));

package/src/__tests__/tool-side-effects-hook-failures.test.ts

@@ -0,0 +1,129 @@
+/**
+ * Tool post-execution side effects: failures in a hook must not surface to the
+ * caller.
+ *
+ * `runPostExecutionSideEffects` runs observation-and-notification work after a
+ * tool executor returns, so a hook that throws must be swallowed and logged
+ * rather than turning a successful tool call into a failed one.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks: must be set up before importing the module under test
+// ---------------------------------------------------------------------------
+
+// Stub out transitive dependencies to prevent import errors
+mock.module("../bundler/app-compiler.js", () => ({
+  compileApp: mock(() => Promise.resolve({ ok: true })),
+}));
+mock.module("../media/app-icon-generator.js", () => ({
+  generateAppIcon: mock(() => Promise.resolve()),
+}));
+mock.module("../apps/app-store.js", () => ({
+  getApp: mock(() => null),
+  getAppDirPath: mock(() => ""),
+  getAppsDir: mock(() => ""),
+  resolveAppIdFromPath: mock(() => null),
+  resolveAppIdByDirName: mock(() => null),
+  resolveAppDir: mock(() => ({ dirName: "", dirPath: "" })),
+  slugify: mock((s: string) => s),
+  validateDirName: mock(() => {}),
+  generateAppDirName: mock(() => ""),
+  listApps: mock(() => []),
+  createApp: mock(() => ({})),
+  updateApp: mock(() => {}),
+  deleteApp: mock(() => {}),
+  getAppPreview: mock(() => null),
+  createAppRecord: mock(() => ({})),
+  getAppRecord: mock(() => null),
+  queryAppRecords: mock(() => []),
+  updateAppRecord: mock(() => {}),
+  deleteAppRecord: mock(() => {}),
+  listAppFiles: mock(() => []),
+  appFileExists: mock(() => false),
+  readAppFile: mock(() => ""),
+  writeAppFile: mock(() => {}),
+  editAppFile: mock(() => ({})),
+  inlineDistAssets: mock((_, html: string) => html),
+  addAppConversationId: mock(() => false),
+  linkAppToConversationLineage: mock(() => {}),
+}));
+mock.module("../services/published-app-updater.js", () => ({
+  updatePublishedAppDeployment: mock(() => Promise.resolve()),
+}));
+mock.module("../daemon/conversation-surfaces.js", () => ({
+  refreshSurfacesForApp: mock(() => {}),
+}));
+const mockIsDoordashCommand = mock(() => false);
+const mockUpdateDoordashProgress = mock(() => {});
+mock.module("../daemon/doordash-steps.js", () => ({
+  isDoordashCommand: mockIsDoordashCommand,
+  updateDoordashProgress: mockUpdateDoordashProgress,
+}));
+
+const mockLogWarn = mock((_obj: unknown, _msg: string) => {});
+const mockLogInfo = mock((_obj: unknown, _msg: string) => {});
+const mockLogError = mock((_obj: unknown, _msg: string) => {});
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    warn: mockLogWarn,
+    info: mockLogInfo,
+    error: mockLogError,
+    debug: () => {},
+    trace: () => {},
+  }),
+}));
+
+// ---------------------------------------------------------------------------
+// Import after mocks: dynamic import ensures mock.module() calls above
+// are registered before tool-side-effects.ts evaluates its top-level
+// `const log = getLogger(...)`.
+// ---------------------------------------------------------------------------
+
+import type { SideEffectContext } from "../daemon/tool-side-effects.js";
+
+const { runPostExecutionSideEffects } =
+  await import("../daemon/tool-side-effects.js");
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const dummySideEffectCtx = {
+  ctx: {} as SideEffectContext["ctx"],
+} satisfies SideEffectContext;
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("doordash progress side effect", () => {
+  beforeEach(() => {
+    mockIsDoordashCommand.mockReset();
+    mockUpdateDoordashProgress.mockReset();
+    mockLogError.mockReset();
+  });
+
+  test("throwing updateDoordashProgress is swallowed and logged", async () => {
+    mockIsDoordashCommand.mockReturnValue(true);
+    mockUpdateDoordashProgress.mockImplementation(() => {
+      throw new Error("doordash boom");
+    });
+
+    await expect(
+      runPostExecutionSideEffects(
+        "bash",
+        { command: "order food" },
+        { content: "{}", isError: false },
+        dummySideEffectCtx,
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(mockUpdateDoordashProgress).toHaveBeenCalledTimes(1);
+    expect(mockLogError).toHaveBeenCalledWith(
+      expect.objectContaining({ toolName: "bash" }),
+      expect.stringContaining("DoorDash progress update failed"),
+    );
+  });
+});