@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/conversation-process-app-control-preactivation.test.ts

@@ -86,6 +86,7 @@ import {
   MessageQueue,
   type QueuedMessage,
 } from "../daemon/conversation-queue-manager.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 // ---------------------------------------------------------------------------
 // Fake context — captures preactivation calls, satisfies the bare minimum
@@ -172,6 +173,7 @@ function makeQueuedMessage(opts: {
   content?: string;
   turnInterfaceContext?: TurnInterfaceContext;
   sourceActorPrincipalId?: string;
+  trustContext?: TrustContext;
 }): QueuedMessage {
   return {
     content: opts.content ?? "follow up",
@@ -185,6 +187,7 @@ function makeQueuedMessage(opts: {
     authContext: opts.sourceActorPrincipalId
       ? ({ actorPrincipalId: opts.sourceActorPrincipalId } as never)
       : undefined,
+    trustContext: opts.trustContext,
   };
 }
 
@@ -371,6 +374,126 @@ describe("drainQueue preactivation re-add for host-proxy interfaces", () => {
     expect(ctx.currentTurnSourceActorPrincipalId).toBe("trusted-contact-user");
   });
 
+  test("drainSingleMessage runs the turn under the queued sender's trust, not the live slot", async () => {
+    // The conversation-level slot holds whichever actor sent most recently.
+    // A message that waited while someone else sent must still run as its own
+    // sender: trust decides `trustClass`, `executionChannel`, and
+    // `requesterExternalUserId`, so reading the slot hands the whole
+    // tool-approval path the wrong identity in both directions -- a contact
+    // inheriting guardian self-approval, or a guardian's own call escalating
+    // back to her as a contact's grant request.
+    const contactTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact",
+        trustContext: contactTrust,
+      }),
+    );
+    const ctx = makeFakeContext({ queue });
+    // Someone else sent after this message was queued, moving the slot.
+    ctx.trustContext = {
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    };
+
+    await drainQueue(ctx);
+
+    expect(ctx.currentTurnTrustContext?.trustClass).toBe("trusted_contact");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+    expect(ctx.currentTurnTrustContext?.sourceChannel).toBe("slack");
+    // The slot itself is left alone; only the turn's view is corrected.
+    expect(ctx.trustContext?.trustClass).toBe("guardian");
+  });
+
+  test("buildPassthroughBatch refuses to coalesce two channel senders", async () => {
+    // Channel senders carry no principal, so the `sourceActorPrincipalId`
+    // boundary sees `undefined === undefined` and would batch two different
+    // Slack contacts into one turn running under the head's trust. The batch
+    // must split on the sender's trust identity instead.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-a",
+        content: "from A",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-alex",
+        },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-b",
+        content: "from B",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-blake",
+        },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    // B stays queued: it gets its own turn under its own trust.
+    expect(queue.length).toBe(1);
+    expect(queue.peek(0)?.requestId).toBe("req-contact-b");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe("U-alex");
+  });
+
+  test("buildPassthroughBatch still coalesces two messages from the same sender", async () => {
+    // Sensitivity check on the split above: identical trust must still batch,
+    // otherwise the boundary would be splitting on something incidental and
+    // the test above would pass for the wrong reason.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const sameTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-alex",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a1",
+        content: "first",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a2",
+        content: "second",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    expect(queue.length).toBe(0);
+  });
+
   test("drainSingleMessage does NOT re-add 'app-control' for web-sourced message when no capable client is connected", async () => {
     // mockCapabilityClients remains [] (reset by afterEach from prior test)
     const queue = new MessageQueue();

package/src/__tests__/conversation-queue.test.ts

@@ -12,6 +12,7 @@ import type {
 import type { AssistantEvent } from "../api/index.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
 import { stampAndBuffer } from "../runtime/assistant-stream-state.js";
+import { createAbortReason } from "../util/abort-reasons.js";
 import { setConfig } from "./helpers/set-config.js";
 
 // ---------------------------------------------------------------------------
@@ -555,6 +556,174 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("enqueueMessage captures the sender's trust, immune to a later slot change", async () => {
+    // Trust must ride with the queued message. The conversation-level slot is
+    // rewritten by whoever sends next, so a message that reads it at drain time
+    // would run as the wrong actor. Capturing at enqueue is what makes the
+    // drain's identity independent of who sent afterwards.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // A different actor sends while the message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    const queued = conversation.queue.peek(0);
+    expect(queued?.requestId).toBe("req-2");
+    expect(queued?.trustContext?.trustClass).toBe("trusted_contact");
+    expect(queued?.trustContext?.requesterExternalUserId).toBe("U-contact");
+
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a drained turn keeps its sender's trust once the agent loop is running", async () => {
+    // Exercises the real drain -> runAgentLoop ordering against a live
+    // Conversation. The loop re-initializes the per-turn trust snapshot on
+    // entry, so a drain that only stamped the field before calling it would
+    // have that stamp silently undone and the turn would execute as whoever
+    // sent most recently. Asserting inside the run is the point: checking
+    // before the loop starts passes either way.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // The guardian sends while the contact's message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    // Finish the first turn so the queue drains into a second run.
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Read while run 2 is in flight: this is what tool setup and the
+    // guardian-request producers resolve against.
+    expect(conversation.currentTurnTrustContext?.trustClass).toBe(
+      "trusted_contact",
+    );
+    expect(conversation.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a processMessage turn keeps its turn-start trust when the slot moves before the loop opens", async () => {
+    // processMessage is the third turn entry point, and the one a web turn
+    // takes on an idle conversation (the route only enqueues while
+    // isProcessing). It captures trust at turn start, then awaits several
+    // times before the agent loop opens. The conversation slot is writable
+    // throughout that window by paths that do not own this turn: live-voice
+    // hydration stamp-and-restore, pointer elevation, the voice bridge.
+    //
+    // Driving a real Conversation with only AgentLoop.run mocked is what makes
+    // this observable. A double that stubs runAgentLoop itself would skip the
+    // re-read entirely and pass either way.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    // Land another actor's slot write inside the window, after the turn-start
+    // capture and before the loop opens. persistUserMessage is awaited there.
+    const originalPersist = conversation.persistUserMessage.bind(conversation);
+    let slotMoved = false;
+    (
+      conversation as unknown as {
+        persistUserMessage: typeof conversation.persistUserMessage;
+      }
+    ).persistUserMessage = async (opts) => {
+      const result = await originalPersist(opts);
+      conversation.setTrustContext({
+        trustClass: "guardian",
+        sourceChannel: "vellum",
+        requesterExternalUserId: "guardian-principal",
+      });
+      // Also move the per-turn field, which is writable out-of-band: a wake
+      // that settles inside this window restores its prior value there
+      // (agent-wake stamps at :1470 and restores in a `finally` at :1554).
+      // Covers both writers, so a fix that reads either one back at the agent
+      // loop call still fails this test.
+      conversation.currentTurnTrustContext = {
+        trustClass: "guardian",
+        sourceChannel: "vellum",
+        requesterExternalUserId: "guardian-principal",
+      };
+      slotMoved = true;
+      return result;
+    };
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    // Guard the test itself: if the injection stopped running, the assertions
+    // below would pass for the wrong reason.
+    expect(slotMoved).toBe(true);
+    expect(conversation.trustContext?.trustClass).toBe("guardian");
+
+    // Read mid-run: this is what tool setup and the guardian-request producers
+    // resolve against while the turn executes.
+    expect(conversation.currentTurnTrustContext?.trustClass).toBe(
+      "trusted_contact",
+    );
+    expect(conversation.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("[experimental] queued passthrough siblings drain as a single batched run", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
@@ -675,6 +844,62 @@ describe("Conversation message queue", () => {
     expect(pendingRuns.length).toBe(3);
   });
 
+  // `Conversation.clientOs` is a live field that only a transport-carrying
+  // message refreshes, so a transport-less drain (a surface action, a signal)
+  // persists the OS of an earlier send. Both rows keep that OS for telemetry;
+  // only the row that reported it claims the surface, which is what stops an
+  // attended Mac from suppressing the push for a button tapped on the phone.
+  test("[experimental] only a queued send that reported its own OS claims that surface", async () => {
+    capturedAddMessages.length = 0;
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "from-the-mac",
+      onEvent: () => {},
+      requestId: "req-mac",
+      transport: { channelId: "vellum", interfaceId: "web", clientOs: "macos" },
+    });
+    // A surface action: no transport, so the drain leaves the conversation's
+    // `clientOs` on the macOS value the send above applied.
+    conversation.enqueueMessage({
+      content: "[User action on card surface: submit]",
+      onEvent: () => {},
+      requestId: "req-surface-action",
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+    await resolveRun(1);
+    await waitForPendingRun(3);
+
+    const macRow = capturedAddMessages.find(
+      (m) => m.role === "user" && m.content.includes("from-the-mac"),
+    );
+    expect(macRow).toBeDefined();
+    expect(macRow!.metadata?.client).toEqual({ os: "macos" });
+    expect(macRow!.metadata?.clientOsFromRequest).toBe(true);
+
+    const surfaceActionRow = capturedAddMessages.find(
+      (m) => m.role === "user" && m.content.includes("User action on card"),
+    );
+    expect(surfaceActionRow).toBeDefined();
+    expect(surfaceActionRow!.metadata?.client).toEqual({ os: "macos" });
+    expect(surfaceActionRow!.metadata?.clientOsFromRequest).toBeUndefined();
+
+    await resolveRun(2);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("[experimental] queued passthrough siblings viewing different apps do NOT batch", async () => {
     // A batched turn applies only the head's `visibleAppId`, which drives the
     // `visible_app:` context line. Coalescing messages sent while different
@@ -826,7 +1051,87 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
-  test("abort() clears the queue and sends generation_cancelled for each queued message", async () => {
+  test("subagent notifications are never acked with message_queued and don't shift visible positions", async () => {
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const notificationEvents: AssistantEvent[] = [];
+    const visibleEvents: AssistantEvent[] = [];
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    // A subagent's completion summary injected into a busy parent is daemon
+    // scaffolding: the user follows that run through its inline card, so the
+    // row gets no queued ack and no queue-drawer bubble.
+    const notification = conversation.enqueueMessage({
+      content: '[Subagent "hermes-local-review" — important] review finished',
+      onEvent: (e) => notificationEvents.push(e),
+      requestId: "req-subagent",
+      metadata: {
+        subagentNotification: {
+          subagentId: "sub-1",
+          label: "hermes-local-review",
+          status: "completed",
+          conversationId: "conv-sub-1",
+          objective: "review the diff",
+        },
+      },
+    });
+    expect(notification.queued).toBe(true);
+    expect(
+      notificationEvents.filter((e) => e.type === "message_queued"),
+    ).toEqual([]);
+
+    // The user's own send queued behind it is position 1: the notification
+    // does not consume a visible slot, matching the cold-load snapshot.
+    const visible = conversation.enqueueMessage({
+      content: "visible-msg",
+      onEvent: (e) => visibleEvents.push(e),
+      requestId: "req-visible",
+    });
+    expect(visible.queued).toBe(true);
+    expect(conversation.getQueueDepth()).toBe(2);
+    expect(
+      visibleEvents.find((e) => e.type === "message_queued"),
+    ).toMatchObject({
+      requestId: "req-visible",
+      position: 1,
+    });
+
+    // Suppressing the ack changes only what clients are told: the row is
+    // still queued, still drains, and still wakes the parent on the notification
+    // text (delivery is asserted end-to-end in "drained subagent-notification
+    // message persists and wakes the agent but emits no user_message_echo").
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+    await waitForCondition(() => conversation.getQueueDepth() === 0);
+    expect(
+      capturedAddMessages.some((m) =>
+        m.content.includes("hermes-local-review"),
+      ),
+    ).toBe(true);
+
+    for (let i = 1; i < pendingRuns.length; i++) {
+      await resolveRun(i);
+    }
+    await new Promise((r) => setTimeout(r, 10));
+
+    // Queue events stay paired: an enqueue that was never acked is never
+    // dequeued either, so the client counter can't retire an entry it never
+    // took. The visible send keeps both halves.
+    expect(
+      notificationEvents.filter((e) => e.type === "message_dequeued"),
+    ).toEqual([]);
+    expect(visibleEvents.some((e) => e.type === "message_dequeued")).toBe(true);
+  });
+
+  test("abort() clears the queue and closes out each queued message", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
@@ -873,6 +1178,17 @@ describe("Conversation message queue", () => {
       conversationId: "conv-1",
     });
 
+    // Each discarded row also gets its own terminal event. `generation_cancelled`
+    // closes out the turn they were waiting on; only `message_queued_deleted`
+    // closes out the queued rows themselves, and without it clients keep the
+    // pending indicator up forever, since no `message_dequeued` is coming.
+    expect(
+      events2.find((e) => e.type === "message_queued_deleted"),
+    ).toMatchObject({ conversationId: "conv-1", requestId: "req-2" });
+    expect(
+      events3.find((e) => e.type === "message_queued_deleted"),
+    ).toMatchObject({ conversationId: "conv-1", requestId: "req-3" });
+
     // abort() must NOT emit conversation_error or generic error for queued discards.
     const err2 = events2.find((e) => e.type === "error");
     expect(err2).toBeUndefined();
@@ -897,6 +1213,122 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("a user interrupt keeps the queue and the stopped turn's drain sends it", async () => {
+    // GIVEN a turn in flight with a message queued behind it
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const events2: AssistantEvent[] = [];
+    conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "msg-2",
+      onEvent: (e) => events2.push(e),
+      requestId: "req-2",
+    });
+    expect(conversation.getQueueDepth()).toBe(1);
+
+    // WHEN the user hits Stop
+    conversation.abort(
+      createAbortReason("user_cancel", "conversation-queue.test", "conv-1"),
+    );
+
+    // THEN the queued message survives the abort. Stop ends the turn the user
+    // is watching, not the message they queued behind it, and a discard here
+    // reaches no client: it emits no per-row terminal event.
+    expect(conversation.getQueueDepth()).toBe(1);
+    expect(
+      events2.find((e) => e.type === "generation_cancelled"),
+    ).toBeUndefined();
+    expect(
+      events2.find((e) => e.type === "message_queued_deleted"),
+    ).toBeUndefined();
+
+    // AND once the stopped turn unwinds, its `finally` drains the queue, so the
+    // message is sent instead of needing to be retyped.
+    await resolveRun(0);
+    await waitForPendingRun(2);
+    expect(events2.find((e) => e.type === "message_dequeued")).toMatchObject({
+      conversationId: "conv-1",
+      requestId: "req-2",
+    });
+    expect(conversation.getQueueDepth()).toBe(0);
+    expect(
+      JSON.stringify(
+        pendingRuns[1].messages[pendingRuns[1].messages.length - 1],
+      ),
+    ).toContain("msg-2");
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a user interrupt mid-tool repairs the abandoned tool_use before the queued message runs", async () => {
+    // GIVEN a turn whose history ends with an unanswered tool_use, the shape a
+    // Stop mid-tool-call leaves behind and which providers reject outright
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const events2: AssistantEvent[] = [];
+    conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "msg-2",
+      onEvent: (e) => events2.push(e),
+      requestId: "req-2",
+    });
+
+    // WHEN the user interrupts and the stopped turn unwinds with the tool call
+    // still unanswered, then drains the queue
+    conversation.abort(
+      createAbortReason("user_cancel", "conversation-queue.test", "conv-1"),
+    );
+    const interrupted = pendingRuns[0];
+    await interrupted.onEvent({ type: "llm_call_started" });
+    interrupted.resolve([
+      ...interrupted.messages,
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "tool_use",
+            id: "toolu-interrupted",
+            name: "bash",
+            input: {},
+          },
+        ],
+      },
+    ]);
+    await waitForPendingRun(2);
+
+    // THEN the drained turn opens with a synthetic result for the abandoned
+    // call rather than a dangling tool_use.
+    const repaired = pendingRuns[1].messages.find(
+      (m) =>
+        m.role === "user" &&
+        m.content.some(
+          (block) =>
+            block.type === "tool_result" &&
+            block.tool_use_id === "toolu-interrupted",
+        ),
+    );
+    expect(repaired).toBeDefined();
+    expect(conversation.pendingInterruptRepair).toBe(false);
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("conversation-scoped errors emit both conversation_error and generic error", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();

package/src/__tests__/conversation-retry-route.test.ts

@@ -24,6 +24,7 @@ import { z } from "zod";
 import {
   isBackgroundEventMetadata,
   isEchoSuppressedUserMessage,
+  isHiddenMessageMetadata,
 } from "../persistence/conversation-types.js";
 
 mock.module("../config/env.js", () => ({
@@ -73,7 +74,7 @@ const getConversationMock = mock((id: string) =>
 mock.module("../persistence/conversation-crud.js", () => ({
   addMessage: async () => ({ id: "unused", deduplicated: false }),
   archiveConversation: () => true,
-  batchSetDisplayOrders: () => {},
+  batchSetConversationPlacement: () => {},
   countConversationsByScheduleJobId: () => 0,
   deleteConversation: () => ({ segmentIds: [], deletedSummaryIds: [] }),
   extractImageSourcePaths: () => undefined,
@@ -81,6 +82,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   getConversation: getConversationMock,
   isBackgroundEventMetadata,
   isEchoSuppressedUserMessage,
+  isHiddenMessageMetadata,
   provenanceFromTrustContext: () => ({ provenanceTrustClass: "unknown" }),
   setConversationSurfaced: () => null,
   unarchiveConversation: () => true,