@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/__tests__/conversation-load-history-repair.test.ts

@@ -713,3 +713,212 @@ describe("loadFromDb tool-result truncation", () => {
     ).toBe(preStubbed);
   });
 });
+
+/**
+ * A guardian card is written into the conversation the request came from by
+ * the notification pairing layer, straight to the DB, while that
+ * conversation's turn is parked awaiting the approval. On the next load it
+ * lands between the parked turn's `tool_use` and its `tool_result`.
+ *
+ * The card is recognized by its own `ui_surface` id rather than a stored
+ * marker, so rows written before this rule existed are dropped on the same
+ * terms as new ones.
+ */
+describe("guardian card rows are not replayed as conversation history", () => {
+  const baseConversation = {
+    id: "conv-1",
+    contextSummary: null,
+    contextCompactedMessageCount: 0,
+    totalInputTokens: 0,
+    totalOutputTokens: 0,
+    totalEstimatedCost: 0,
+  };
+
+  /** The parked turn: an approval-gated `tool_use` and the result it got. */
+  const toolUseRow = {
+    id: "m-use",
+    role: "assistant",
+    content: [
+      { type: "text", text: "Running that now." },
+      { type: "tool_use", id: "tu_1", name: "bash", input: { cmd: "ls" } },
+    ],
+  };
+  const toolResultRow = {
+    id: "m-result",
+    role: "user",
+    content: [
+      { type: "tool_result", tool_use_id: "tu_1", content: "REAL RESULT" },
+    ],
+  };
+
+  /** What `buildApprovalCardBlocks` persists: the surface, then its text. */
+  function cardRow(surfaceId: string) {
+    return {
+      id: "m-card",
+      role: "assistant",
+      content: [
+        {
+          type: "ui_surface",
+          surfaceId,
+          surfaceType: "card",
+          title: "Tool Approval",
+          data: {},
+          display: "inline",
+        },
+        { type: "text", text: "Tool Approval\nbash - requested by Alice" },
+      ],
+    };
+  }
+
+  function allBlocks(messages: Message[]) {
+    return messages.flatMap((m) => m.content);
+  }
+
+  function toolResultsFor(messages: Message[], toolUseId: string) {
+    return allBlocks(messages).filter(
+      (b) => b.type === "tool_result" && b.tool_use_id === toolUseId,
+    );
+  }
+
+  function serialized(value: unknown): string {
+    return JSON.stringify(value);
+  }
+
+  beforeEach(() => {
+    nextMockMessageId = 1;
+    mockConversation = { ...baseConversation };
+  });
+
+  // Sensitivity check for the drop below: an ordinary assistant turn in the
+  // same position still corrupts the pair. If the rule ever widened past
+  // guardian cards, this test fails first and says so.
+  test("an ordinary assistant turn between a tool_use and its result still corrupts it", async () => {
+    mockDbMessages = [
+      toolUseRow,
+      {
+        id: "m-card",
+        role: "assistant",
+        content: [{ type: "text", text: "Still working on it." }],
+      },
+      toolResultRow,
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const messages = conversation.getMessages();
+
+    expect(serialized(messages)).toContain("tool result missing from history");
+    expect(serialized(messages)).toContain("[orphaned tool_result for tu_1]");
+    expect(serialized(toolResultsFor(messages, "tu_1"))).not.toContain(
+      "REAL RESULT",
+    );
+  });
+
+  test("a guardian card is dropped and the real tool_result survives", async () => {
+    mockDbMessages = [
+      toolUseRow,
+      cardRow("tool-approval-req-1"),
+      toolResultRow,
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const messages = conversation.getMessages();
+
+    // The pair is adjacent and intact: no stub, no downgrade, and exactly one
+    // tool_result for tu_1 carrying the tool's own output.
+    expect(serialized(messages)).not.toContain(
+      "tool result missing from history",
+    );
+    expect(serialized(messages)).not.toContain("[orphaned tool_result");
+    const results = toolResultsFor(messages, "tu_1");
+    expect(results).toHaveLength(1);
+    expect(results[0].type === "tool_result" && results[0].content).toBe(
+      "REAL RESULT",
+    );
+    expect(serialized(messages)).not.toContain("Tool Approval");
+    expect(messages).toHaveLength(2);
+  });
+
+  test("an access-request card is dropped on the same terms", async () => {
+    mockDbMessages = [
+      toolUseRow,
+      cardRow("access-request-req-9"),
+      toolResultRow,
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const messages = conversation.getMessages();
+
+    expect(serialized(messages)).not.toContain("[orphaned tool_result");
+    expect(messages).toHaveLength(2);
+  });
+
+  test("a card as the tail row leaves history ending on a user message", async () => {
+    // The prefill shape: the approval was delivered and the turn never
+    // resumed, so the card is the last row. Replayed, it makes the history
+    // end on an assistant turn, which extended-thinking models reject with
+    // "does not support assistant message prefill".
+    mockDbMessages = [toolUseRow, cardRow("tool-approval-req-1")];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+    const messages = conversation.getMessages();
+
+    expect(messages[messages.length - 1].role).toBe("user");
+    // The tail is repair's fill for the still-unanswered tool_use, which is
+    // correct here: the tool genuinely never ran.
+    expect(toolResultsFor(messages, "tu_1")).toHaveLength(1);
+  });
+
+  test("a dropped card still restores its ui_surface for action routing", async () => {
+    // Surface lifecycle and model context are different questions. The card is
+    // absent from history, but its Approve/Reject buttons must keep routing
+    // after a restart, which `findConversationBySurfaceId` resolves through
+    // surfaceState rebuilt at load.
+    mockDbMessages = [toolUseRow, cardRow("tool-approval-req-1")];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    expect(serialized(conversation.getMessages())).not.toContain(
+      "tool-approval-req-1",
+    );
+    expect(
+      (
+        conversation as unknown as { surfaceState: Map<string, unknown> }
+      ).surfaceState.has("tool-approval-req-1"),
+    ).toBe(true);
+  });
+
+  test("an assistant turn carrying a non-approval surface stays in history", async () => {
+    // A wake card is unshifted onto a real turn's own content. Its surface id
+    // uses a different prefix, and dropping that row would discard speech.
+    mockDbMessages = [
+      { id: "m-ask", role: "user", content: [{ type: "text", text: "hi" }] },
+      {
+        id: "m-wake",
+        role: "assistant",
+        content: [
+          {
+            type: "ui_surface",
+            surfaceId: "wake-conv-1-1700000000",
+            surfaceType: "card",
+            title: "Conversation Woke",
+            data: {},
+            display: "inline",
+          },
+          { type: "text", text: "Picking this back up." },
+        ],
+      },
+    ];
+
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    expect(serialized(conversation.getMessages())).toContain(
+      "Picking this back up.",
+    );
+  });
+});

package/src/__tests__/conversation-notifiers-provenance.test.ts

@@ -0,0 +1,59 @@
+/**
+ * The live-call question notifier persists its row after the voice turn has
+ * settled. The per-turn trust field is not cleared at release, so at that
+ * moment it can still hold the finished turn's actor while voice cleanup has
+ * restored the conversation's resting trust. The row must carry the owner,
+ * not the stale turn actor.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const added: Array<{ metadata?: Record<string, unknown> }> = [];
+mock.module("../persistence/conversation-crud.js", () => ({
+  addMessage: async (
+    _conversationId: string,
+    _role: string,
+    _content: string,
+    options?: { metadata?: Record<string, unknown> },
+  ) => {
+    added.push({ metadata: options?.metadata });
+    return { id: "msg-1", deduplicated: false };
+  },
+  provenanceFromTrustContext: (ctx?: { trustClass?: string }) =>
+    ctx ? { provenanceTrustClass: ctx.trustClass } : {},
+}));
+mock.module("../calls/call-store.js", () => ({
+  getCallSession: () => ({ toNumber: "+15550100" }),
+}));
+
+import { fireCallQuestionNotifier } from "../calls/call-state.js";
+import { registerConversationNotifiers } from "../daemon/conversation-notifiers.js";
+
+describe("live-call question provenance", () => {
+  beforeEach(() => {
+    added.length = 0;
+  });
+
+  test("a row persisted after the turn settled carries the owner, not the stale turn actor", async () => {
+    registerConversationNotifiers("conv-n1", {
+      emit: () => {},
+      messages: [],
+      // Voice cleanup restored the owner; the per-turn field still holds the
+      // finished voice turn's contact.
+      trustContext: {
+        trustClass: "guardian",
+        sourceChannel: "vellum",
+      },
+      currentTurnTrustContext: {
+        trustClass: "trusted_contact",
+        sourceChannel: "phone",
+        requesterExternalUserId: "caller-1",
+      },
+    } as never);
+
+    fireCallQuestionNotifier("conv-n1", "sess-1", "Which slot works?");
+    await new Promise((resolve) => setTimeout(resolve, 10));
+
+    expect(added.length).toBe(1);
+    expect(added[0]?.metadata?.provenanceTrustClass).toBe("guardian");
+  });
+});

package/src/__tests__/conversation-queue.test.ts

@@ -79,10 +79,12 @@ mock.module("../persistence/conversation-crud.js", () => ({
   setConversationOriginInterfaceIfUnset: () => {},
   updateConversationContextWindow: () => {},
   deleteMessageById: () => {},
-  provenanceFromTrustContext: () => ({
-    source: "user",
-    trustContext: undefined,
-  }),
+  // Mirrors the real mapping so provenance assertions observe what production
+  // would stamp, rather than a placeholder.
+  provenanceFromTrustContext: (ctx?: { trustClass?: string }) =>
+    ctx
+      ? { provenanceTrustClass: ctx.trustClass }
+      : { provenanceTrustClass: "unknown" },
   getConversationOriginInterface: () => null,
   getConversationOriginChannel: () => null,
   getMessages: () => [],
@@ -597,6 +599,55 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("a drained slash exchange is stamped with its sender's provenance, not the slot's", async () => {
+    // Provenance gates memory extraction and untrusted-content wrapping, so
+    // the stamped class must be the actor whose message this is. The unknown-
+    // slash drain branch persists an exchange for the queued sender; if the
+    // guardian wrote the conversation slot while that message waited, the
+    // rows must still carry the sender's class.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "/definitely-not-a-command",
+      requestId: "req-slash",
+    });
+
+    // The guardian moves the slot while the contact's message waits.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    capturedAddMessages.length = 0;
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 20));
+
+    const exchange = capturedAddMessages.filter((m) =>
+      m.content.includes("definitely-not-a-command"),
+    );
+    expect(exchange.length).toBeGreaterThan(0);
+    for (const row of exchange) {
+      expect(row.metadata?.provenanceTrustClass).toBe("trusted_contact");
+    }
+  });
+
   test("a drained turn keeps its sender's trust once the agent loop is running", async () => {
     // Exercises the real drain -> runAgentLoop ordering against a live
     // Conversation. The loop re-initializes the per-turn trust snapshot on
@@ -2937,6 +2988,9 @@ describe("Conversation host attachment directives", () => {
         attachments: [],
         onEvent: (e) => events.push(e),
         requestId: "req-1",
+        // A host attachment read prompts only when a human is present to
+        // answer; presence is declared per turn.
+        isInteractive: true,
       });
       await waitForPendingRun(1);
 
@@ -3007,6 +3061,9 @@ describe("Conversation host attachment directives", () => {
         attachments: [],
         onEvent: (e) => events.push(e),
         requestId: "req-1",
+        // A host attachment read prompts only when a human is present to
+        // answer; presence is declared per turn.
+        isInteractive: true,
       });
       await waitForPendingRun(1);
 
@@ -3872,3 +3929,96 @@ describe("subagent notification user_message_echo suppression", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 });
+
+describe("drained turns deliver through the conversation sink", () => {
+  beforeEach(() => {
+    pendingRuns = [];
+  });
+
+  test("a confirmation prompt raised in a drained interactive turn reaches the sink", async () => {
+    // The sink is fixed for the conversation's life, so an interactive turn
+    // drained from the queue delivers exactly like a live one: no per-turn
+    // rebinding, nothing for the previous turn's cleanup to clobber. This is
+    // the invariant behind the acp_spawn permission-prompt timeouts (a queued
+    // interactive turn's confirmation_request used to be emitted into a
+    // reset no-op sender and hang until the permission timeout).
+    const sink: AssistantEvent[] = [];
+    const conversation = makeConversation((msg) => sink.push(msg));
+    await conversation.loadFromDb();
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      onEvent: () => {},
+      isInteractive: true,
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // The drained turn is in flight and interactive: presence reads a human.
+    expect(conversation.hasNoClient).toBe(false);
+
+    // A prompt raised now, mid-drained-turn, must land on the sink.
+    void conversation.prompter.prompt(
+      "acp_spawn",
+      { agent: "claude", task: "t" },
+      "high",
+      [],
+      [],
+      undefined,
+      conversation.conversationId,
+      "host",
+      false,
+      undefined,
+      "tool-use-1",
+    );
+    const prompt = sink.find((e) => e.type === "confirmation_request");
+    expect(prompt).toBeDefined();
+    expect((prompt as { toolName: string }).toolName).toBe("acp_spawn");
+    // Settle it so the prompt's timer does not outlive the test.
+    conversation.prompter.denyAllPending();
+
+    await resolveRun(1);
+    // Turn over: nothing is in flight, so no human is asserted present.
+    await waitForCondition(() => conversation.hasNoClient);
+  });
+
+  test("a drained non-interactive turn asserts no human present", async () => {
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({
+      content: "msg-2",
+      requestId: "req-2",
+      onEvent: () => {},
+      isInteractive: false,
+    });
+
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    expect(conversation.hasNoClient).toBe(true);
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+});

package/src/__tests__/conversation-routes-disk-view.test.ts

@@ -149,7 +149,7 @@ function createFakeConversation(conversationId: string): Conversation {
       return this.turnInterfaceContext;
     },
     ensureActorScopedHistory: async () => {},
-    updateClient: () => {},
+    replayActivityState: () => {},
 
     setHostCuProxy(this: { hostCuProxy: unknown }, proxy: unknown) {
       this.hostCuProxy = proxy;

package/src/__tests__/conversation-routes-enabled-plugins.test.ts

@@ -158,7 +158,7 @@ function makeConversation() {
     currentRequestId: undefined,
     queue: { length: 0 },
     setTrustContext: () => {},
-    updateClient: () => {},
+    replayActivityState: () => {},
     emitConfirmationStateChanged: () => {},
     emitActivityState: () => {},
     setTurnChannelContext: () => {},

package/src/__tests__/conversation-routes-guardian-reply.test.ts

@@ -163,7 +163,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -253,7 +253,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -331,7 +331,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -419,7 +419,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -507,7 +507,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -590,7 +590,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -667,7 +667,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -746,7 +746,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},
@@ -826,7 +826,7 @@ describe("handleSendMessage guardian reply interception", () => {
     const runAgentLoop = mock(async () => undefined);
     const session = {
       setTrustContext: () => {},
-      updateClient: () => {},
+      replayActivityState: () => {},
       emitConfirmationStateChanged: () => {},
       emitActivityState: () => {},
       setTurnChannelContext: () => {},

package/src/__tests__/conversation-routes-hidden-queue.test.ts

@@ -169,7 +169,7 @@ function makeConversationWithPendingConfirmation(
     setTrustContext(this: { trustContext: unknown }, ctx: unknown) {
       this.trustContext = ctx;
     },
-    updateClient: () => {},
+    replayActivityState: () => {},
     emitConfirmationStateChanged: () => {},
     emitActivityState: () => {},
     setTurnChannelContext: () => {},

package/src/__tests__/conversation-routes-slash-commands.test.ts

@@ -233,7 +233,7 @@ function makeConversation() {
     currentRequestId: undefined,
     queue: { length: 0 },
     setTrustContext: () => {},
-    updateClient: (_fn: unknown, _b: boolean) => {},
+    replayActivityState: () => {},
     emitConfirmationStateChanged: () => {},
     emitActivityState: () => {},
     setTurnChannelContext: () => {},