@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/daemon/conversation-initial-prompt.ts

@@ -1,43 +1,16 @@
 /**
  * Construction-time system-prompt resolution for a new conversation.
  *
- * The dependency seams (`fetchDelivery`, `deps.warm`, `deps.build`) exist so the
- * warm-then-build sequencing can be unit-tested without mocking the
- * widely-imported guardian-delivery / system-prompt modules — global module
- * mocks of those leak across test files in the shared-process runner.
+ * The dependency seams (`deps.warm`, `deps.build`) exist so the warm-then-build
+ * sequencing can be unit-tested without mocking the widely-imported
+ * guardian-delivery / system-prompt modules — global module mocks of those leak
+ * across test files in the shared-process runner.
  */
-import { getGuardianDeliveryFresh } from "../contacts/guardian-delivery-reader.js";
+import { warmGuardianBindings } from "../contacts/guardian-delivery-reader.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import type { ConversationCreateOptions } from "./handlers/shared.js";
 import type { TrustContext } from "./trust-context-types.js";
 
-type GuardianDeliveryFetch = (input?: {
-  channelTypes?: string[];
-}) => Promise<unknown>;
-
-/**
- * Warm both guardian-binding cache keys the desktop/native persona resolver
- * reads: the `"vellum"`-channel key for `peekGuardianForChannel("vellum")` and
- * the unfiltered key for its `peekAnyGuardian()` fallback. Warming only one
- * would still freeze `users/default.md` when the guardian lives on a non-vellum
- * channel (phone / Telegram).
- *
- * Uses the FRESH reader so warmup bypasses a stale/empty cached entry: a
- * gateway-side binding write (onboarding, rebind) does not invalidate the daemon
- * cache, so a non-fresh read could return an empty binding cached before the
- * guardian existed and freeze `users/default.md` until the TTL expires. The
- * fresh read repopulates the cache the sync `peek*` resolvers then read.
- * Best-effort — the reader swallows failures.
- */
-export async function warmGuardianBindings(
-  fetchDelivery: GuardianDeliveryFetch = getGuardianDeliveryFresh,
-): Promise<void> {
-  await Promise.all([
-    fetchDelivery({ channelTypes: ["vellum"] }),
-    fetchDelivery(),
-  ]);
-}
-
 /**
  * Resolve the system prompt to freeze onto a newly constructed conversation.
  *
@@ -47,11 +20,16 @@ export async function warmGuardianBindings(
  *
  * - An explicit `systemPromptOverride` (including an empty string) is used
  *   verbatim.
- * - A channel-routed conversation that already carries the requester's
- *   `trustContext` (e.g. Slack / Telegram inbound) builds with it, so the
- *   persona resolves the *requester's* `users/<slug>.md` (a DB contact lookup)
- *   rather than the guardian/default profile.
- * - Otherwise (no construction-time identity — the local vellum app sets trust
+ * - A channel-routed conversation carrying a non-guardian requester
+ *   `trustContext` (e.g. Slack / Telegram inbound) builds with it directly:
+ *   the requester's persona (`users/<slug>.md`) resolves via a DB contact
+ *   lookup that needs no guardian binding.
+ * - A guardian-class `trustContext` (background and scheduled turns, memory
+ *   consolidation, managed desktop) warms the guardian binding first: its
+ *   persona resolution reads the sync guardian-delivery cache, which is cold
+ *   in worker processes (schedule worker, memory worker) and after TTL expiry
+ *   in the daemon.
+ * - Otherwise (no construction-time identity: the local vellum app sets trust
  *   after creation) the guardian binding is warmed first so the persona slot
  *   resolves the guardian's `users/<slug>.md` instead of `users/default.md` on
  *   a cold cache.
@@ -67,7 +45,7 @@ export async function resolveInitialSystemPrompt(
     return storedOptions.systemPromptOverride;
   }
   const trustContext = storedOptions?.trustContext;
-  if (trustContext === undefined) {
+  if (trustContext === undefined || trustContext.trustClass === "guardian") {
     await (deps.warm ?? warmGuardianBindings)();
   }
   const build =

package/src/daemon/conversation-lifecycle.ts

@@ -12,6 +12,7 @@ import { getConfig } from "../config/loader.js";
 import { usesConceptPageMemory } from "../config/memory-v3-gate.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
+import { isSuppressedQueuedMessage } from "../persistence/conversation-types.js";
 import {
   enqueueMemoryJob,
   isMemoryEnabled,
@@ -23,10 +24,17 @@ import { resolveCapabilities } from "../runtime/capabilities.js";
 import { isAutoAnalysisConversation } from "../runtime/services/auto-analysis-guard.js";
 import { unregisterConversationSender } from "../tools/browser/browser-screencast.js";
 import { disposeToolProfiler } from "../tools/tool-profiler.js";
-import { type AbortReason, createAbortReason } from "../util/abort-reasons.js";
+import {
+  type AbortReason,
+  createAbortReason,
+  isUserInterruptAbort,
+} from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
 import { unregisterCallNotifiers } from "./conversation-notifiers.js";
-import type { MessageQueue } from "./conversation-queue-manager.js";
+import type {
+  MessageQueue,
+  QueueDrainReason,
+} from "./conversation-queue-manager.js";
 import { resetSkillToolProjection } from "./conversation-skill-tools.js";
 import type { SurfaceData, SurfaceType } from "./message-protocol.js";
 
@@ -112,6 +120,12 @@ export interface AbortContext {
   >;
   accumulatedSurfaceState: Map<string, Record<string, unknown>>;
   readonly queue: MessageQueue;
+  /** Armed when an interrupt leaves queued messages behind, so the drain
+   *  repairs tool_use blocks the killed turn abandoned. */
+  pendingInterruptRepair: boolean;
+  /** Never rejects. Called only when an interrupt preserves the queue but no
+   *  live turn is left to reach its `finally` and drain it. */
+  kickDrainQueue(reason?: QueueDrainReason, origin?: string): Promise<void>;
 }
 
 export interface DisposeContext extends AbortContext {
@@ -129,18 +143,133 @@ export interface DisposeContext extends AbortContext {
 
 // ── abort ─────────────────────────────────────────────────────────────
 
+/** The conversation surface {@link forceClearStaleProcessing} needs. */
+export interface StaleProcessingContext {
+  readonly conversationId: string;
+  setProcessing(value: boolean): void;
+}
+
+/**
+ * Release a processing flag that no live turn owns.
+ *
+ * Callers reach this when `isProcessing()` is true but `abortController` is
+ * null: the turn that owned the flag already tore its controller down (the
+ * agent loop nulls `abortController` before clearing the flag) or died without
+ * ever installing one. Either way no agent-loop release is going to run to
+ * clear it, so signalling the controller would be a silent no-op (`?.abort()`
+ * on null does nothing) and the conversation would stay wedged: every later
+ * submit is rejected with "already processing" and Stop appears dead.
+ * `setProcessing(false)` also nulls the persisted column and emits the metadata
+ * invalidation that drives clients to idle.
+ *
+ * `origin` names the calling site for log correlation.
+ */
+export function forceClearStaleProcessing(
+  ctx: StaleProcessingContext,
+  origin: string,
+): void {
+  log.warn(
+    { conversationId: ctx.conversationId, origin },
+    "Processing latched with no live abort controller; force-clearing the stale processing flag",
+  );
+  ctx.setProcessing(false);
+}
+
+/**
+ * Keep the queue intact across a user interrupt so the messages queued behind
+ * the stopped turn still run.
+ *
+ * A user interrupt ends the turn in flight and nothing else: the aborted turn
+ * unwinds to the agent loop's `finally`, which calls `kickDrainQueue`, so the
+ * queued messages become the next turn. This is the same drain-after-abort
+ * sequence `steerToMessage` relies on.
+ *
+ * An interrupt can land mid-tool, leaving `tool_use` blocks with no results, so
+ * arm the same repair a steer arms: the drained turn then opens with synthetic
+ * results instead of a dangling call.
+ *
+ * `hasLiveTurn` is false when the processing flag was force-cleared because no
+ * controller was left to signal. No agent-loop `finally` runs in that case, so
+ * the drain is kicked here instead; otherwise the preserved messages wait for
+ * an unrelated later turn to finish.
+ */
+function preserveQueueAcrossInterrupt(
+  ctx: AbortContext,
+  { hasLiveTurn }: { hasLiveTurn: boolean },
+): void {
+  if (ctx.queue.isEmpty) {
+    return;
+  }
+  ctx.pendingInterruptRepair = true;
+  log.info(
+    {
+      conversationId: ctx.conversationId,
+      queueDepth: ctx.queue.length,
+      hasLiveTurn,
+    },
+    "User interrupt: preserving queued messages for the interrupted turn's drain",
+  );
+  if (!hasLiveTurn) {
+    void ctx.kickDrainQueue("loop_complete", "abortConversation:no_live_turn");
+  }
+}
+
+/**
+ * Discard the queue when the conversation itself is going away (dispose,
+ * eviction, voice supersession, subagent teardown): there is no turn left for
+ * a queued message to run on.
+ *
+ * This runs whether or not the in-memory flag reads processing. A turn that
+ * cleared the flag can still be unwinding through its awaited turn-boundary
+ * commit with a `kickDrainQueue` ahead of it, and a queue left populated there
+ * drains onto a conversation whose state (and possibly whose durable row) is
+ * already gone.
+ *
+ * Each sender gets two events, both load-bearing. `generation_cancelled`
+ * closes out the turn the message was waiting on; `message_queued_deleted` is
+ * the terminal event for the queued row itself, the same one a user-issued
+ * DELETE emits (`deleteQueuedMessage`). Without the second, a client holds the
+ * pending indicator forever, since no `message_dequeued` is coming. Rows with
+ * no client-visible queued counterpart ({@link isSuppressedQueuedMessage} —
+ * hidden sends and daemon-injected subagent/ACP/wake notifications) are
+ * suppressed for the same reason they get no queued ack: they have no client
+ * row to close.
+ */
+function discardQueueOnAbort(ctx: AbortContext): void {
+  for (const queued of ctx.queue) {
+    queued.onEvent({
+      type: "generation_cancelled",
+      conversationId: ctx.conversationId,
+    });
+    if (isSuppressedQueuedMessage(queued.metadata)) {
+      continue;
+    }
+    queued.onEvent({
+      type: "message_queued_deleted",
+      conversationId: ctx.conversationId,
+      requestId: queued.requestId,
+      ...(queued.clientMessageId
+        ? { clientMessageId: queued.clientMessageId }
+        : {}),
+    });
+  }
+  ctx.queue.clear();
+}
+
 export function abortConversation(
   ctx: AbortContext,
   reason?: AbortReason,
 ): void {
-  if (ctx.isProcessing()) {
-    const effectiveReason =
-      reason ??
-      createAbortReason(
-        "preempted_by_new_message",
-        "abortConversation:default",
-        ctx.conversationId,
-      );
+  const effectiveReason =
+    reason ??
+    createAbortReason(
+      "preempted_by_new_message",
+      "abortConversation:default",
+      ctx.conversationId,
+    );
+  const hasLiveTurn = ctx.abortController !== null;
+  const wasProcessing = ctx.isProcessing();
+  if (wasProcessing) {
     log.info(
       { conversationId: ctx.conversationId, abortReason: effectiveReason },
       "Aborting in-flight processing",
@@ -153,21 +282,7 @@ export function abortConversation(
       // clear it here and risk clobbering a client's optimistic state.
       ctx.abortController.abort(effectiveReason);
     } else {
-      // The flag is set but there is no live controller to signal: the turn
-      // that owned it already tore its controller down (the agent-loop
-      // `finally` nulls `abortController` before clearing the flag) or died
-      // without ever installing one. Either way no agent-loop `finally` is
-      // going to run to clear the flag. Without this branch the abort is a
-      // silent no-op — `?.abort()` does nothing — and the conversation stays
-      // wedged: every later submit is rejected with "already processing" and
-      // Stop appears dead. Force-clear the flag directly so the conversation
-      // frees up. `setProcessing(false)` also nulls the persisted column and
-      // emits the metadata invalidation that drives clients to idle.
-      log.warn(
-        { conversationId: ctx.conversationId },
-        "Abort requested while processing but no live abort controller — force-clearing stale processing flag",
-      );
-      ctx.setProcessing(false);
+      forceClearStaleProcessing(ctx, "abortConversation");
     }
     ctx.prompter.dispose();
     ctx.secretPrompter.dispose();
@@ -175,13 +290,6 @@ export function abortConversation(
     ctx.surfaceActionRequestIds.clear();
     ctx.surfaceState.clear();
     ctx.accumulatedSurfaceState.clear();
-    for (const queued of ctx.queue) {
-      queued.onEvent({
-        type: "generation_cancelled",
-        conversationId: ctx.conversationId,
-      });
-    }
-    ctx.queue.clear();
   } else {
     // The in-memory flag reads idle, but a cancel must still clear a persisted
     // `processing_started_at` that outlived the turn that set it. This is the
@@ -201,6 +309,20 @@ export function abortConversation(
     // reports idle in-memory to clients, so no refetch needs to be pushed.
     ctx.setProcessing(false);
   }
+
+  // The queue decision is independent of the processing flag: an interrupt
+  // hands its queue to the drain, and every other abort kind is a teardown
+  // that must take the queue with it even when the flag already reads idle.
+  if (isUserInterruptAbort(effectiveReason)) {
+    // An idle conversation counts as having a live turn for drain purposes:
+    // either a turn is unwinding toward its own `kickDrainQueue`, or the queue
+    // is empty. Kicking a second drain here would race the first.
+    preserveQueueAcrossInterrupt(ctx, {
+      hasLiveTurn: hasLiveTurn || !wasProcessing,
+    });
+  } else {
+    discardQueueOnAbort(ctx);
+  }
 }
 
 // ── dispose ──────────────────────────────────────────────────────────