@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/daemon/tool-setup-types.ts

@@ -4,9 +4,6 @@
  */
 
 import type { InterfaceId } from "../channels/types.js";
-import type { LLMCallSite } from "../config/schemas/llm.js";
-import type { SurfaceConversationContext } from "./conversation-surfaces.js";
-import type { TrustContext } from "./trust-context-types.js";
 
 /**
  * How a subagent/wake tool allowlist is enforced.
@@ -24,6 +21,25 @@ import type { TrustContext } from "./trust-context-types.js";
  */
 export type SubagentToolGateMode = "wire" | "execution";
 
+/**
+ * Live tool-call counters for a subagent child, recorded by the tool executor
+ * and harvested by the SubagentManager when the run ends.
+ *
+ * This is the machine half of a subagent's result: the parent reads the child's
+ * own prose narrative, and these counts say what the child actually ran, so a
+ * claim of executed work that never touched a tool is visible rather than
+ * taken on trust. Ephemeral (in-memory only, never persisted) and only ever
+ * written for subagent conversations.
+ */
+export interface SubagentToolStats {
+  /** Tool calls dispatched, including ones that returned an error. */
+  calls: number;
+  /** Of those, the calls whose result was not an error. */
+  succeeded: number;
+  /** Distinct paths successfully passed to `file_write` / `file_edit`. */
+  filesWritten: Set<string>;
+}
+
 /**
  * Client-context inputs frozen for tool-DEFINITION resolution during a wake
  * that runs with `subagentToolGateMode: "execution"`.
@@ -64,122 +80,3 @@ export interface WakeToolContextPin {
    */
   requestOrigin?: string;
 }
-
-/**
- * Subset of Conversation state that the tool executor callback reads at
- * call time (not construction time). These are captured by the
- * returned closure, so they must be live references.
- */
-export interface ToolSetupContext extends SurfaceConversationContext {
-  readonly conversationId: string;
-  assistantId?: string;
-  currentRequestId?: string;
-  workingDir: string;
-  abortController: AbortController | null;
-  /** When set, only tools in this set may execute during the current turn. */
-  allowedToolNames?: Set<string>;
-  /** When set, the subagent/wake tool allowlist (see {@link subagentToolGateMode}). */
-  subagentAllowedTools?: Set<string>;
-  /**
-   * When true, side-effecting tools are refused for this subagent regardless of
-   * trust class (the read-only background continuation): kept off the wire tool
-   * surface and rejected in the executor gate. Independent of the allowlist.
-   */
-  subagentDenySideEffects?: boolean;
-  /**
-   * Collects tool names the subagent attempted but that
-   * {@link subagentAllowedTools} denied, for parent-visible reporting. The
-   * executor records into this Set (shared by reference with the Conversation).
-   */
-  subagentDeniedToolNames?: Set<string>;
-  /**
-   * How {@link subagentAllowedTools} is enforced. Absent or `"wire"` keeps
-   * the historical behavior (definitions filtered before the provider
-   * request); `"execution"` keeps the full tool surface on the wire and
-   * rejects non-allowlisted calls in the executor callback instead.
-   */
-  subagentToolGateMode?: SubagentToolGateMode;
-  /** Turn-scoped disk-pressure cleanup mode flag. */
-  diskPressureCleanupModeActive?: boolean;
-  /** True when the conversation has no connected client (HTTP-only path). */
-  hasNoClient?: boolean;
-  /** When true, the conversation is executing a task run and must not become interactive. */
-  headlessLock?: boolean;
-  /** When set, this conversation is executing a task run. Used to retrieve ephemeral permission rules. */
-  taskRunId?: string;
-  /** Guardian runtime context for the conversation — trustClass is propagated into ToolContext for control-plane policy enforcement. */
-  trustContext?: TrustContext;
-  /** Per-turn trust snapshot, captured at turn start. Preferred over the live
-   *  `trustContext` for mid-turn trust decisions (tool approval, control-plane
-   *  policy) so a concurrent mutation cannot elevate the in-flight turn. */
-  currentTurnTrustContext?: TrustContext;
-  /** Voice/call session ID, if the conversation originates from a call. Propagated into ToolContext for scoped grant consumption. */
-  callSessionId?: string;
-  /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
-  readonly transportInterface?: InterfaceId;
-  /**
-   * Per-turn snapshot of the channel's UI capabilities, captured at turn start
-   * (mirrors {@link Conversation.currentTurnChannelCapabilities}). Read per tool
-   * call — together with the structural {@link SurfaceConversationContext.channelCapabilities}
-   * fallback — to derive `ToolContext.supportsDynamicUi`, so UI-dependent tools
-   * (e.g. `ask_question`) can degrade to text on channels that can't render
-   * dynamic surfaces.
-   */
-  readonly currentTurnChannelCapabilities?: {
-    readonly channel: string;
-    readonly supportsDynamicUi: boolean;
-  };
-  /**
-   * The conversation's per-chat plugin scope (mirrors
-   * {@link Conversation.enabledPlugins}). `null`/absent means no per-chat
-   * restriction. Read per tool call to derive the effective enabled-plugin set
-   * (via `getEffectiveEnabledPluginSet`) for the `ToolContext.enabledPluginSet`
-   * field and the `skill_execute` dispatch guard.
-   */
-  readonly enabledPlugins?: string[] | null;
-
-  /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
-  approvedViaPromptThisTurn?: boolean;
-  /**
-   * When true, side-effect tools must prompt for confirmation even if a
-   * trust/allow rule would auto-allow them. Set by callers without an
-   * interactive approval UI (e.g. non-guardian phone voice turns) to force
-   * a `confirmation_request` event that the caller's auto-deny / scoped-grant
-   * handler can intercept. Provides a second layer of defense against broad
-   * trust rules auto-executing side-effect tools in non-interactive contexts.
-   */
-  forcePromptSideEffects?: boolean;
-  /**
-   * The LLM call site driving the current turn, set by `runAgentLoopImpl`
-   * (`options.callSite ?? "mainAgent"`). Non-main turns (voice `callAgent`,
-   * `filingAgent`, …) resolve different provider/model/profile config, so
-   * tool telemetry attribution must use this rather than assuming
-   * `mainAgent`. Absent before the first turn starts.
-   */
-  currentCallSite?: LLMCallSite;
-  /**
-   * Per-turn snapshot of the resolved inference-profile override, set by
-   * `runAgentLoopImpl`. Propagated into `ToolContext.overrideProfile` so
-   * tools that spawn nested invocations (e.g. `subagent_spawn`) can forward
-   * the override without round-tripping through a row read that would
-   * return `undefined` for the in-flight (background) subagent.
-   */
-  currentTurnOverrideProfile?: string;
-  /**
-   * Whether the current turn has no human present to answer clarification
-   * prompts. Resolved once per turn by the agent loop — honoring an explicit
-   * per-run `isInteractive` option (e.g. scheduled/background turns) over the
-   * live client state — so tool execution sees turn-level interactivity rather
-   * than re-deriving it from `hasNoClient`/`headlessLock`, which would read a
-   * scheduled turn running on a client-attached conversation as interactive.
-   */
-  currentTurnIsNonInteractive?: boolean;
-  /**
-   * Origin tag of the current turn (the conversation's `TitleOrigin`, e.g.
-   * "memory_consolidation"), set by `runAgentLoop` from its `requestOrigin`
-   * option. Propagated into `ToolContext.requestOrigin` so the permission
-   * checker can scope narrow non-interactive auto-grants to a specific
-   * internal background origin. Absent for normal interactive turns.
-   */
-  currentTurnRequestOrigin?: string;
-}

package/src/daemon/tool-side-effects.ts

@@ -9,32 +9,34 @@
 
 import { isAbsolute, resolve, sep } from "node:path";
 
+import { DOCUMENT_MUTATION_TOOL_NAMES } from "../api/constants/document-tools.js";
 import type { AssistantEvent } from "../api/index.js";
 import { getApp, linkAppToConversationLineage } from "../apps/app-store.js";
-import { findActiveSession } from "../channels/gateway-verification-sessions.js";
 import { getConfig } from "../config/loader.js";
 import { generateAppIcon } from "../media/app-icon-generator.js";
 import { invalidateEdgeIndex } from "../plugins/defaults/memory/substrate/edge-index.js";
 import { invalidatePageIndex } from "../plugins/defaults/memory/substrate/page-index.js";
 import { getConceptsDir } from "../plugins/defaults/memory/substrate/page-store.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
-import { publishAppsChanged } from "../runtime/sync/resource-sync-events.js";
-import { deliverVerificationSlack } from "../runtime/verification-outbound-actions.js";
+import {
+  publishAppsChanged,
+  publishDocumentsChanged,
+} from "../runtime/sync/resource-sync-events.js";
 import { updatePublishedAppDeployment } from "../services/published-app-updater.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import { ensureAppSourceWatcher } from "./app-source-watcher.js";
+import type { Conversation } from "./conversation.js";
 import { refreshSurfacesForApp } from "./conversation-surfaces.js";
 import { isDoordashCommand, updateDoordashProgress } from "./doordash-steps.js";
-import type { ToolSetupContext } from "./tool-setup-types.js";
 
 const log = getLogger("tool-side-effects");
 
 // ── Types ────────────────────────────────────────────────────────────
 
 export interface SideEffectContext {
-  ctx: ToolSetupContext;
+  ctx: Conversation;
 }
 
 export type PostExecutionHook = (
@@ -57,7 +59,7 @@ export type PostExecutionHook = (
  * and would race with the executor's own output (LUM-1153).
  */
 function notifyAppChanged(
-  ctx: ToolSetupContext,
+  ctx: Conversation,
   appId: string,
   opts?: { fileChange?: boolean; status?: string },
 ): void {
@@ -179,6 +181,15 @@ function registerAppSurfaceRefreshHook(toolName: string): void {
 registerAppSurfaceRefreshHook("app_refresh");
 registerAppSurfaceRefreshHook("app_update");
 
+// The mutating document tools carry no list-level change signal of their own,
+// so the conversation assets pill and the Library keep serving a cached list
+// after an edit, and a deleted document lingers as a ghost row. `skill_execute`
+// calls reach the runner already unwrapped to the inner tool name, so the
+// bundled document-editor skill needs no separate registration.
+registerHook([...DOCUMENT_MUTATION_TOOL_NAMES], () => {
+  publishDocumentsChanged();
+});
+
 registerHook("voice_config_update", (_name, input) => {
   const setting = input.setting as string | undefined;
   if (!setting) {
@@ -229,94 +240,6 @@ registerHook("voice_config_update", (_name, input) => {
   } as unknown as AssistantEvent);
 });
 
-// Dispatch pending Slack DM delivery when a CLI verification command
-// completes.  The CLI subprocess is sandboxed and cannot reach the
-// gateway, so it includes a `_pendingSlackDm` field in its JSON output.
-// This hook runs in the unsandboxed daemon process and delivers the DM.
-registerHook("bash", async (_name, input, result) => {
-  const command = (input.command ?? "") as string;
-  if (!command.includes("channel-verification-sessions")) {
-    return;
-  }
-  if (!result.content.includes("_pendingSlackDm")) {
-    return;
-  }
-
-  type PendingDm = { userId: string; text: string; assistantId: string };
-  type Parsed = { _pendingSlackDm?: PendingDm };
-
-  // Returns "delivered" when DM was sent, "rejected" when _pendingSlackDm
-  // was found but failed validation, or null when the field was absent.
-  const dispatch = async (
-    parsed: Parsed,
-  ): Promise<"delivered" | "rejected" | null> => {
-    if (parsed._pendingSlackDm) {
-      const { userId, text, assistantId } = parsed._pendingSlackDm;
-
-      // Validate that an active Slack verification session exists and
-      // that the destination matches the userId in the parsed payload.
-      // Fail closed: an unverifiable DM (gateway unreachable) is not sent.
-      let session;
-      try {
-        session = await findActiveSession("slack");
-      } catch (err) {
-        log.warn(
-          { err, userId, assistantId },
-          "Bash hook: gateway session lookup failed — ignoring _pendingSlackDm",
-        );
-        return "rejected";
-      }
-      if (!session) {
-        log.warn(
-          { userId, assistantId },
-          "Bash hook: no active Slack verification session — ignoring _pendingSlackDm",
-        );
-        return "rejected";
-      }
-      if (session.destinationAddress !== userId) {
-        log.warn(
-          { userId, expected: session.destinationAddress, assistantId },
-          "Bash hook: Slack DM userId does not match active session destination — ignoring",
-        );
-        return "rejected";
-      }
-
-      deliverVerificationSlack(userId, text, assistantId);
-      return "delivered";
-    }
-    return null;
-  };
-
-  // Try full content first (handles pretty-printed single-object JSON)
-  let singleObject: Parsed | undefined;
-  try {
-    singleObject = JSON.parse(result.content.trim()) as Parsed;
-  } catch {
-    // Not a single JSON object — fall back to line-by-line for
-    // multi-object output (e.g. cancel + create chained with &&).
-  }
-  if (singleObject !== undefined) {
-    if ((await dispatch(singleObject)) !== null) {
-      return;
-    }
-  }
-  for (const line of result.content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed.startsWith("{")) {
-      continue;
-    }
-    let parsed: Parsed;
-    try {
-      parsed = JSON.parse(trimmed) as Parsed;
-    } catch {
-      continue;
-    }
-    if ((await dispatch(parsed)) === "delivered") {
-      return;
-    }
-  }
-});
-
 // Invalidate the in-memory v2 edge index and page index when the LLM writes
 // or edits a file under `memory/concepts/`. The page-store invalidates on
 // programmatic writes; this hook covers consolidation, where the LLM edits

package/src/daemon/trust-context-types.ts

@@ -67,3 +67,42 @@ export interface TrustContext {
    */
   requesterInteractionCount?: number;
 }
+
+/**
+ * Whether two trust contexts describe the same acting identity at the same
+ * privilege, for callers that may only run work under one of them (batched
+ * turns being the case that matters).
+ *
+ * Compares the privilege (`trustClass`), the channel a grant is scoped to
+ * (`sourceChannel`), and every field that can carry who the actor is. The
+ * identity fields are covered exhaustively rather than by picking the usual
+ * ones: an ingress that populates only `requesterIdentifier` or
+ * `requesterContactId` would otherwise leave two distinct senders comparing
+ * equal on a pair of undefineds, which is the exact case this guards.
+ *
+ * Deliberately conservative: an absent field never matches a present one, so
+ * unknown identities are treated as distinct. Answering "different" when they
+ * match only costs a batching opportunity; answering "same" when they differ
+ * runs one actor's work under another's privileges.
+ */
+export function sameTrustIdentity(
+  a: TrustContext | undefined,
+  b: TrustContext | undefined,
+): boolean {
+  if (a === b) {
+    return true;
+  }
+  if (!a || !b) {
+    return false;
+  }
+  return (
+    a.trustClass === b.trustClass &&
+    a.sourceChannel === b.sourceChannel &&
+    a.requesterExternalUserId === b.requesterExternalUserId &&
+    a.requesterChatId === b.requesterChatId &&
+    a.requesterIdentifier === b.requesterIdentifier &&
+    a.requesterContactId === b.requesterContactId &&
+    a.guardianExternalUserId === b.guardianExternalUserId &&
+    a.guardianPrincipalId === b.guardianPrincipalId
+  );
+}

package/src/daemon/trust-context.ts

@@ -87,12 +87,16 @@ export function isPersonalMemoryAllowed(
 
 /**
  * Map a channel-native chat type (Telegram `private`/`group`/`supergroup`,
- * Slack `im`/`mpim`/`channel`) onto the permission-matrix conversation-type
- * axis. Slack's gateway normalizer forwards every non-DM as `"channel"`
- * without distinguishing public from private, so `"channel"` maps to
- * undefined — a permissive public-channel cell must not silently govern
- * private channels. The channel-type tier starts matching for Slack non-DMs
- * once the gateway forwards the distinct type.
+ * Slack `im`/`mpim`/`channel`, Discord `dm`/`channel`) onto the
+ * permission-matrix conversation-type axis. Slack and Discord both forward
+ * every non-DM as `"channel"` without distinguishing public from private, so
+ * `"channel"` maps to undefined: a permissive public-channel cell must not
+ * silently govern private channels. The channel-type tier starts matching for
+ * their non-DMs once the gateway forwards the distinct type.
+ *
+ * Every DM-capable channel must have an arm here. A missing one is silent:
+ * the cell stays settable, because the adapter validates, and simply never
+ * matches, so the guardian sets a rule for DMs and it does nothing.
  */
 export function mapChatTypeToConversationType(
   chatType?: string,
@@ -100,6 +104,10 @@ export function mapChatTypeToConversationType(
   switch (chatType) {
     case "im": // Slack DM
     case "private": // Telegram DM
+    // Discord has no string vocabulary for this: its API distinguishes a DM by
+    // a numeric channel type, and the absence of a guild. The normalizer names
+    // it for the axis rather than inventing a native-looking word.
+    case "dm":
       return "dm";
     // "mpim" is Slack's multi-party DM. The gateway normalizer currently
     // collapses mpim into "channel", so this arm matches nothing from Slack

package/src/daemon/turn-tail-chain.ts

@@ -0,0 +1,73 @@
+/**
+ * Per-conversation serialization for the detached end-of-turn tails the agent
+ * loop schedules after releasing the processing lock.
+ *
+ * The chain is keyed by conversation id and held at module scope rather than
+ * on the `Conversation` instance. A tail runs while the conversation reads
+ * idle, which is exactly the window in which `evictConversationsForReload` and
+ * the stale-instance rebuild in `conversation-store.ts` drop the live instance:
+ * an instance-scoped chain would let the rebuilt instance start an empty chain
+ * whose tail overlaps the previous instance's still-running one. The state
+ * those tails advance (memory segments, the conversation attention cursor) is
+ * per conversation, not per instance, so the serialization has to be too.
+ */
+
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("turn-tail-chain");
+
+/** Tail promise per conversation id. Entries exist only while a tail is live. */
+const chains = new Map<string, Promise<void>>();
+
+/**
+ * Queue `tail` behind any tail already running for this conversation.
+ *
+ * Returns immediately: the tail is detached by design, so its failure is
+ * logged rather than surfaced. The chain is `.catch`-terminated at every link,
+ * so a rejected tail can neither become an unhandled rejection nor poison the
+ * tails queued after it.
+ */
+export function chainTurnTail(
+  conversationId: string,
+  tail: () => Promise<void>,
+): void {
+  const previous = chains.get(conversationId) ?? Promise.resolve();
+  const next: Promise<void> = previous
+    .then(tail)
+    .catch((err: unknown) => {
+      log.warn(
+        { err, conversationId },
+        "Deferred turn tail failed (non-fatal)",
+      );
+    })
+    .then(() => {
+      // Drop the entry only when nothing chained onto this link while it ran,
+      // so the map holds an entry per conversation with a live tail rather
+      // than one per conversation the daemon has ever served.
+      if (chains.get(conversationId) === next) {
+        chains.delete(conversationId);
+      }
+    });
+  chains.set(conversationId, next);
+}
+
+/**
+ * Resolve once every tail currently queued for this conversation has settled.
+ *
+ * Tests use this to await work the agent loop deliberately detached. Callers
+ * that chain a new tail after awaiting get a fresh promise, so this is a
+ * point-in-time barrier, not a permanent quiesce.
+ */
+export function settleTurnTail(conversationId: string): Promise<void> {
+  return chains.get(conversationId) ?? Promise.resolve();
+}
+
+/**
+ * Number of conversations with a live tail. Lets tests assert the map is
+ * released rather than growing per conversation.
+ *
+ * @internal
+ */
+export function __turnTailChainSizeForTests(): number {
+  return chains.size;
+}

package/src/daemon/web-search-history.ts

@@ -20,18 +20,27 @@ export interface StripResult {
 /**
  * Replaces every `web_search_tool_result` block in the message list with a
  * plain `text` summary of its results, and drops the paired `server_tool_use`
- * that produced it.
+ * that produced it, wherever that use lives. The pair usually shares one
+ * assistant message, but a deferred execution (the API runs the search on the
+ * request after a mixed server/client parallel tool group) places the result
+ * at the head of the following assistant message, so pairing is resolved
+ * across the whole list. Dropping both sides together keeps the history free
+ * of unpaired server-tool blocks, which the provider layer would otherwise
+ * repair with a synthetic error result.
+ *
+ * A `server_tool_use` with no result anywhere in the list is left untouched:
+ * either the search is still pending (deferred tail, executed by the provider
+ * on this request) or it is a genuine orphan the provider layer repairs.
  *
  * Anthropic's `encrypted_content` tokens attached to each `web_search_result`
  * are opaque server tokens with bounded validity (they expire and/or are
  * route-scoped). Replaying a stale token produces
  * `messages.N.content.M: Invalid encrypted_content in search_result block`.
  * For historical turns the model does not need the opaque token to re-read
- * the body — a title+url summary is sufficient to preserve context.
+ * the body: a title+url summary is sufficient to preserve context.
  *
- * Intended to run on `runMessages` immediately before the agent loop starts a
- * new turn, at which point every `web_search_tool_result` in the list is by
- * definition from a prior turn.
+ * Runs on the outbound message list before each model call; every executed
+ * search in the list is summarized regardless of which turn produced it.
  */
 export function stripHistoricalWebSearchResults(
   messages: Message[],
@@ -42,42 +51,45 @@ export function stripHistoricalWebSearchResults(
     messagesModified: 0,
   };
 
-  const next: Message[] = messages.map((msg) => {
-    const droppedServerToolUseIds = new Set<string>();
-    const transformed: ContentBlock[] = [];
-
+  const strippedToolUseIds = new Set<string>();
+  for (const msg of messages) {
     for (const block of msg.content) {
-      if (block.type !== "web_search_tool_result") {
-        continue;
+      if (block.type === "web_search_tool_result") {
+        strippedToolUseIds.add(
+          (block as WebSearchToolResultContent).tool_use_id,
+        );
       }
-      const wsr = block as WebSearchToolResultContent;
-      const query = findQueryForToolUseId(msg.content, wsr.tool_use_id);
-      transformed.push(formatAsText(wsr, query));
-      droppedServerToolUseIds.add(wsr.tool_use_id);
-      stats.blocksStripped++;
-    }
-
-    if (droppedServerToolUseIds.size === 0) {
-      return msg;
     }
+  }
 
+  const next: Message[] = messages.map((msg) => {
+    let modified = false;
     const rewritten: ContentBlock[] = [];
-    let wsrIndex = 0;
+
     for (const block of msg.content) {
       if (block.type === "server_tool_use") {
         const stu = block as ServerToolUseContent;
-        if (droppedServerToolUseIds.has(stu.id)) {
+        if (strippedToolUseIds.has(stu.id)) {
           stats.serverToolUsesDropped++;
+          modified = true;
           continue;
         }
         rewritten.push(block);
       } else if (block.type === "web_search_tool_result") {
-        rewritten.push(transformed[wsrIndex++]);
+        const wsr = block as WebSearchToolResultContent;
+        rewritten.push(
+          formatAsText(wsr, findQueryForToolUseId(messages, wsr.tool_use_id)),
+        );
+        stats.blocksStripped++;
+        modified = true;
       } else {
         rewritten.push(block);
       }
     }
 
+    if (!modified) {
+      return msg;
+    }
     stats.messagesModified++;
     return { ...msg, content: rewritten };
   });
@@ -86,19 +98,21 @@ export function stripHistoricalWebSearchResults(
 }
 
 function findQueryForToolUseId(
-  blocks: ContentBlock[],
+  messages: Message[],
   toolUseId: string,
 ): string | null {
-  for (const b of blocks) {
-    if (b.type !== "server_tool_use") {
-      continue;
-    }
-    const stu = b as ServerToolUseContent;
-    if (stu.id !== toolUseId) {
-      continue;
+  for (const msg of messages) {
+    for (const b of msg.content) {
+      if (b.type !== "server_tool_use") {
+        continue;
+      }
+      const stu = b as ServerToolUseContent;
+      if (stu.id !== toolUseId) {
+        continue;
+      }
+      const q = stu.input?.query;
+      return typeof q === "string" ? q : null;
     }
-    const q = stu.input?.query;
-    return typeof q === "string" ? q : null;
   }
   return null;
 }

package/src/heartbeat/heartbeat-service.ts

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import type { HeartbeatAlertEvent } from "../api/events/heartbeat-alert.js";
 import { getConfig } from "../config/loader.js";
 import type { HeartbeatConfig } from "../config/schemas/heartbeat.js";
-import { getGuardianDelivery } from "../contacts/guardian-delivery-reader.js";
+import { warmGuardianBindings } from "../contacts/guardian-delivery-reader.js";
 import {
   checkDiskPressureBackgroundGate,
   diskPressureBackgroundSkipLogFields,
@@ -815,10 +815,11 @@ export class HeartbeatService {
 
     const checklist = this.readChecklist();
     const completedRunCount = countCompletedHeartbeatRuns();
-    // Warm the vellum guardian-delivery cache so buildPrompt's sync guardian
-    // persona read (isShallowProfile → resolveGuardianPersona) hits a fresh key
-    // instead of falling back to default.md on a cold/TTL-expired cache.
-    await getGuardianDelivery({ channelTypes: ["vellum"] });
+    // Warm both guardian-delivery cache keys (vellum + unfiltered) so
+    // buildPrompt's sync guardian persona read (isShallowProfile →
+    // resolveGuardianPersona), including its any-channel fallback, hits fresh
+    // keys instead of falling back to default.md on a cold/TTL-expired cache.
+    await warmGuardianBindings();
     const { prompt, includedReengagement } = this.buildPrompt(
       checklist,
       unhealthyProviders,
@@ -848,7 +849,6 @@ export class HeartbeatService {
       callSite: "heartbeatAgent",
       timeoutMs: getConfig().timeouts.backgroundTurnTimeoutSec * 1000,
       origin: "heartbeat",
-      deferNotifications: true,
       onConversationCreated: (newConversationId) => {
         conversationId = newConversationId;
         broadcastMessage({

package/src/ipc/__tests__/socket-path.test.ts

@@ -1,6 +1,8 @@
+import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
+import { ensureSocketPathFree } from "../socket-cleanup.js";
 import { resolveIpcSocketPath } from "../socket-path.js";
 
 let savedWorkspaceDir: string | undefined;
@@ -77,4 +79,23 @@ describe("resolveIpcSocketPath", () => {
 
     delete process.env.EXAMPLE_SERVICE_IPC_SOCKET_DIR;
   });
+
+  test.skipIf(process.platform !== "win32")(
+    "rejects an occupied named pipe",
+    async () => {
+      const pipe = `\\\\.\\pipe\\vellum-ipc-test-${process.pid}`;
+      const server = createServer();
+      await new Promise<void>((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(pipe, resolve);
+      });
+      try {
+        await expect(ensureSocketPathFree(pipe)).rejects.toMatchObject({
+          code: "EADDRINUSE",
+        });
+      } finally {
+        server.close();
+      }
+    },
+  );
 });