@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/acp/session-manager.ts

@@ -15,7 +15,15 @@ import { getDb } from "../persistence/db-connection.js";
 import { acpSessionHistory } from "../persistence/schema/index.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { getLogger } from "../util/logger.js";
+import { markAcpConnectCardRaised } from "./acp-connect-card-state.js";
 import { AcpAgentProcess } from "./agent-process.js";
+import {
+  ACP_AUTH_RECOVERY_GUIDANCE,
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  CLAUDE_ACP_COMMAND,
+  isAcpAuthRequired,
+  isClaudeAuthFailureMessage,
+} from "./auth-required.js";
 import { resolveAgentWithAutoInstall } from "./auto-install.js";
 import { VellumAcpClientHandler } from "./client-handler.js";
 import { deriveFailureError } from "./failure-error.js";
@@ -26,6 +34,30 @@ import type { AcpAgentConfig, AcpSessionState } from "./types.js";
 
 const log = getLogger("acp:session-manager");
 
+/**
+ * The `authCode` for a run that failed on its Claude credential, or undefined
+ * for any other failure. Adapter-gated first: the signals are Claude-specific,
+ * and the marker promises a repair only the Connect Claude flow can perform.
+ * Checks both auth-failure shapes (see `auth-required.ts`) against both the
+ * raw rejection and the derived failure message, since `deriveFailureError`
+ * may replace one with the other.
+ */
+function claudeAuthRequiredCode(
+  err: unknown,
+  failureMessage: string,
+  entry: { command: string },
+): string | undefined {
+  if (entry.command !== CLAUDE_ACP_COMMAND) {
+    return undefined;
+  }
+  const rawMessage = err instanceof Error ? err.message : String(err);
+  return isAcpAuthRequired(err) ||
+    isClaudeAuthFailureMessage(rawMessage) ||
+    isClaudeAuthFailureMessage(failureMessage)
+    ? ACP_CLAUDE_AUTH_REQUIRED_CODE
+    : undefined;
+}
+
 /**
  * The manager's "unknown session id" error. Thrown whenever an operation
  * references an acpSessionId with no in-memory entry (and, for resume, no
@@ -1093,6 +1125,11 @@ export class AcpSessionManager {
             err.message,
             current.process.stderrSince(stderrMark),
           );
+          const errorCode = claudeAuthRequiredCode(
+            err,
+            failureMessage,
+            current,
+          );
           if (current.state.status !== "cancelled") {
             current.state.status = "failed";
             current.state.completedAt = Date.now();
@@ -1100,14 +1137,40 @@ export class AcpSessionManager {
           }
           current.currentPrompt = null;
           log.error(
-            { acpSessionId, error: err.message, failureMessage },
+            { acpSessionId, error: err.message, failureMessage, errorCode },
             "ACP prompt failed",
           );
+          // `acp_session_error` keeps its pre-existing shape so older packaged
+          // clients still parse it; the recovery signal rides its own event
+          // below (see `api/events/acp-auth-required.ts`).
           current.sendToVellum({
             type: "acp_session_error",
             acpSessionId,
             error: failureMessage,
           });
+          // The recovery surface (event, model guidance, prompt-dedup marker)
+          // is raised as a unit, and only when a spawning tool call exists to
+          // anchor the card AND the user did not already stop the run. A
+          // cancelled run renders no card (the client guards it), so marking
+          // the never-cleared prompt-dedup registry here would suppress the
+          // secure token prompt against a card that never appears.
+          const recoveryAnchor =
+            errorCode !== undefined && current.state.status !== "cancelled"
+              ? current.parentToolUseId
+              : undefined;
+          if (errorCode !== undefined && recoveryAnchor !== undefined) {
+            current.sendToVellum({
+              type: "acp_auth_required",
+              acpSessionId,
+              authCode: errorCode,
+              agent: current.state.agentId,
+              parentToolUseId: recoveryAnchor,
+            });
+            // Same registry as the missing-token spawn path, so the
+            // credential-prompt route redirects a redundant secure prompt at
+            // the card instead of stacking a second one.
+            markAcpConnectCardRaised(current.parentConversationId);
+          }
 
           // Persist the terminal row before teardown clears the buffer.
           this.persistTerminal(acpSessionId, current);
@@ -1123,7 +1186,10 @@ export class AcpSessionManager {
           if (current.state.status !== "cancelled") {
             this.notifyParent(
               current,
-              `[ACP agent "${current.state.agentId}" failed]\n\n${failureMessage}`,
+              `[ACP agent "${current.state.agentId}" failed]\n\n${failureMessage}` +
+                (recoveryAnchor !== undefined
+                  ? `\n\n${ACP_AUTH_RECOVERY_GUIDANCE}`
+                  : ""),
             );
           }
         }
@@ -1158,9 +1224,14 @@ export class AcpSessionManager {
       );
       return;
     }
+    // The notification turn streams to whoever is watching (the parent's sink is
+    // its client hub), but it is machine-injected with no human asserted to be
+    // present, so it runs non-interactive: a tool that would need approval is
+    // denied rather than left waiting on a prompt nobody may answer.
     const enqueueResult = parentConversation.enqueueMessage({
       content: message,
       metadata: { acpNotification },
+      isInteractive: false,
     });
     if (enqueueResult.queued || enqueueResult.rejected) {
       return;
@@ -1168,7 +1239,9 @@ export class AcpSessionManager {
     parentConversation
       .persistUserMessage({ content: message, metadata: { acpNotification } })
       .then(({ id: messageId }) =>
-        parentConversation.runAgentLoop(message, messageId),
+        parentConversation.runAgentLoop(message, messageId, {
+          isInteractive: false,
+        }),
       )
       .catch((err) => {
         log.error(

package/src/api/events/acp-auth-required.ts

@@ -0,0 +1,55 @@
+/**
+ * `acp_auth_required` SSE event.
+ *
+ * Server to client notification that an ACP run failed because the agent
+ * rejected its stored credential and the client can offer a re-authentication
+ * affordance. Always emitted immediately AFTER the `acp_session_error` that
+ * carries the human-readable failure.
+ *
+ * It is a separate event rather than a field on `acp_session_error` because
+ * every event schema here is `.strict()` and clients fall back to an inert
+ * `unknown` event when parsing fails: a new FIELD makes an older packaged
+ * client (iOS/macOS bundle the web app) reject the whole error event and
+ * render the run as still active, while an unknown event TYPE is simply
+ * ignored. Additive signals on existing events need their own event type for
+ * the same reason.
+ *
+ * Canonical wire-contract source. Re-exported to external consumers via
+ * `@vellumai/assistant-api` (the `api/index.ts` barrel).
+ */
+
+import { z } from "zod";
+
+/**
+ * The code for a `claude-agent-acp` run whose Claude credential needs to be
+ * reconnected: the `authCode` on this event for post-spawn failures, and the
+ * `errorCode` on the failed `acp_spawn` tool result for pre-spawn ones.
+ * Single source for both sides of the wire: the daemon re-exports it via
+ * `acp/auth-required.ts`, the web client via
+ * `domains/chat/utils/acp-connect.ts`.
+ */
+export const ACP_CLAUDE_AUTH_REQUIRED_CODE = "acp_claude_auth_required";
+
+export const AcpAuthRequiredEventSchema = z
+  .object({
+    type: z.literal("acp_auth_required"),
+    acpSessionId: z.string(),
+    /**
+     * Machine-readable classification of what kind of re-authentication is
+     * needed, so clients branch on a stable value rather than on the failure
+     * text (which varies by adapter and failure mode). Currently only
+     * {@link ACP_CLAUDE_AUTH_REQUIRED_CODE}.
+     */
+    authCode: z.string(),
+    /** Agent id the run was spawned with, for display. */
+    agent: z.string(),
+    /**
+     * Tool-use id of the `acp_spawn` call that started this run, so the
+     * client anchors the inline affordance to the right transcript row.
+     * Absent when the run was not started by a tool call.
+     */
+    parentToolUseId: z.string().optional(),
+  })
+  .strict();
+
+export type AcpAuthRequiredEvent = z.infer<typeof AcpAuthRequiredEventSchema>;

package/src/api/events/host-file.ts

@@ -21,8 +21,8 @@ const HostFileReadRequestSchema = z.object({
   targetClientId: z.string().optional(),
   operation: z.literal("read"),
   path: z.string(),
-  offset: z.number().optional(),
-  limit: z.number().optional(),
+  startIndex: z.number().optional(),
+  maxChars: z.number().optional(),
 });
 
 const HostFileWriteRequestSchema = z.object({

package/src/api/index.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { AcpAuthRequiredEventSchema } from "./events/acp-auth-required.js";
 import { AcpSessionCompletedEventSchema } from "./events/acp-session-completed.js";
 import { AcpSessionErrorEventSchema } from "./events/acp-session-error.js";
 import { AcpSessionSpawnedEventSchema } from "./events/acp-session-spawned.js";
@@ -149,6 +150,11 @@ export {
   SSE_REPLAY_RING_COUNT_LIMIT,
 } from "./constants/sse-replay.js";
 export { DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC } from "./constants/tool-execution.js";
+export {
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  type AcpAuthRequiredEvent,
+  AcpAuthRequiredEventSchema,
+} from "./events/acp-auth-required.js";
 export {
   type AcpSessionCompletedEvent,
   AcpSessionCompletedEventSchema,
@@ -895,6 +901,7 @@ export {
  * migration recipe.
  */
 export const AssistantEventSchema = z.discriminatedUnion("type", [
+  AcpAuthRequiredEventSchema,
   AcpSessionCompletedEventSchema,
   AcpSessionErrorEventSchema,
   AcpSessionSpawnedEventSchema,

package/src/api/surfaces.ts

@@ -488,6 +488,11 @@ export const WorkResultItemSchema = z.object({
   status: tolerantString(),
   tone: WorkResultToneSchema.optional().catch(undefined),
   metadata: recordArray(WorkResultMetadataSchema).optional().catch(undefined),
+  /**
+   * Makes the item row a link. Clients follow an in-app path
+   * (`/assistant/skills/<skillId>?tab=history`) in place and open an http(s)
+   * URL externally; anything else renders as an unlinked row.
+   */
   href: tolerantString(),
 });
 export type WorkResultItem = z.infer<typeof WorkResultItemSchema>;
@@ -591,6 +596,7 @@ export const SURFACE_TYPES = [
   "skill_card",
   "call_summary",
   "visual",
+  "voice_picker",
 ] as const;
 
 export const SurfaceTypeSchema = z.enum(SURFACE_TYPES);
@@ -662,9 +668,10 @@ export type SurfaceData =
  * and serves verbatim but whose shape it does not model, which is why they
  * are absent from the renderable `SurfaceData` union: `channel_setup` (a
  * side-effect command forwarded to the setup panel), `task_preferences` (a
- * fixed grid that reads no data), and `skill_card` / `call_summary` (cards
- * the daemon appends to history directly — the memory retrospective and a
- * call summary — and whose data shape is owned by their client renderers).
+ * fixed grid that reads no data), `voice_picker` (a settings card that reads
+ * its own config), and `skill_card` / `call_summary` (cards the daemon appends
+ * to history directly, the memory retrospective and a call summary, whose
+ * data shape is owned by their client renderers).
  */
 export interface SurfaceDataByType {
   card: CardSurfaceData;
@@ -684,6 +691,7 @@ export interface SurfaceDataByType {
   skill_card: Record<string, unknown>;
   call_summary: Record<string, unknown>;
   visual: VisualSurfaceData;
+  voice_picker: Record<string, unknown>;
 }
 
 /** Any surface `data` payload, including the opaque (non-renderable) types. */
@@ -717,6 +725,7 @@ export const SURFACE_DATA_SCHEMAS: {
   skill_card: z.record(z.string(), z.unknown()),
   call_summary: z.record(z.string(), z.unknown()),
   visual: VisualSurfaceDataSchema,
+  voice_picker: z.record(z.string(), z.unknown()),
 };
 
 /**

package/src/apps/app-store.ts

@@ -1422,6 +1422,9 @@ export function backfillAppConversationIds(): void {
   }
 
   try {
+    // Unfinalized rows cannot match: their content is a { ref } pointer,
+    // never inline surface JSON, so this scan sees finalized content only by
+    // shape. No completeness predicate needed.
     const rows = rawAll<{ conversation_id: string; content: string }>(
       "apps:backfillConversationIds",
       `SELECT conversation_id, content FROM messages WHERE content LIKE '%"type":"ui_surface"%'`,

package/src/bundler/package-resolver.ts

@@ -6,7 +6,7 @@
  */
 
 import { existsSync } from "node:fs";
-import { mkdir, stat } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 
 import { ensureBun } from "../util/bun-runtime.js";
@@ -24,8 +24,8 @@ export const ALLOWED_PACKAGES: readonly string[] = [
   "clsx",
 ] as const;
 
+/** Bounds a runaway install; the allowlist above bounds what may be installed. */
 const INSTALL_TIMEOUT_MS = 10_000;
-const MAX_PACKAGE_SIZE_BYTES = 5 * 1024 * 1024; // 5 MB
 
 /** In-flight install promises keyed by package name, to deduplicate concurrent requests. */
 const inflight = new Map<string, Promise<string | null>>();
@@ -148,37 +148,9 @@ async function installPackage(
       return null;
     }
 
-    // Enforce max size
-    if (existsSync(pkgDir)) {
-      const size = await dirSize(pkgDir);
-      if (size > MAX_PACKAGE_SIZE_BYTES) {
-        log.warn({ pkg, size }, "Package exceeds size limit, removing");
-        const { rm } = await import("node:fs/promises");
-        await rm(pkgDir, { recursive: true, force: true });
-        return null;
-      }
-    }
-
     return existsSync(pkgDir) ? nodeModulesDir : null;
   } catch (err) {
     log.warn({ pkg, err }, "Package resolution failed");
     return null;
   }
 }
-
-/** Recursively sum file sizes under a directory. */
-async function dirSize(dir: string): Promise<number> {
-  const { readdir } = await import("node:fs/promises");
-  const entries = await readdir(dir, { withFileTypes: true });
-  let total = 0;
-  for (const entry of entries) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      total += await dirSize(full);
-    } else {
-      const s = await stat(full);
-      total += s.size;
-    }
-  }
-  return total;
-}

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -72,8 +72,13 @@ mock.module("../../persistence/conversation-crud.js", () => ({
 
 import { setConfig } from "../../__tests__/helpers/set-config.js";
 import { ABORT_WATCHDOG_MS } from "../../daemon/abort-watchdog.js";
+import { VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND } from "../../plugin-api/constants.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { CALL_OPENING_MARKER } from "../voice-control-protocol.js";
+import {
+  CALL_OPENING_MARKER,
+  ESCALATE_VERDICT_TOKEN,
+  HOLD_VERDICT_TOKEN,
+} from "../voice-control-protocol.js";
 import {
   cutFrontDoorContentAtVerdict,
   preSpeechLanguageRuleFragment,
@@ -121,7 +126,7 @@ interface FakeConversation {
     metadata?: Record<string, unknown>;
   }) => Promise<{ id: string }>;
   workingDir: string;
-  updateClient: (cb: unknown, reset?: boolean) => void;
+  addEventObserver: (observer: unknown) => () => void;
   handleConfirmationResponse: (
     requestId: string,
     decision: string,
@@ -187,13 +192,15 @@ function makeFakeConversation(opts: {
       opts.onPersist?.(persistCount);
       return { id: `msg-${persistCount}` };
     },
-    // The install (reset falsy) / reset (reset true) pair marks a turn
-    // taking ownership of the conversation vs a turn's cleanup releasing it.
-    updateClient: (cb, reset) => {
-      opts.events?.push(reset ? "client:reset" : "client:install");
-      if (reset !== true) {
-        clientCallback = cb as (msg: unknown) => Promise<void>;
-      }
+    // The install / reset pair marks a turn taking ownership of the
+    // conversation (observer registered) vs a turn's cleanup releasing it
+    // (the returned disposer invoked).
+    addEventObserver: (observer) => {
+      opts.events?.push("client:install");
+      clientCallback = observer as (msg: unknown) => Promise<void>;
+      return () => {
+        opts.events?.push("client:reset");
+      };
     },
     handleConfirmationResponse: (requestId, decision) => {
       confirmationDecisions.push({ requestId, decision });
@@ -209,7 +216,7 @@ function makeFakeConversation(opts: {
     conversation,
     waitForIdleCalls,
     confirmationDecisions,
-    /** Deliver an event the way the conversation would, to the installed handler. */
+    /** Deliver an event the way the conversation would, to the installed observer. */
     emitToClient: async (msg: unknown) => {
       await clientCallback?.(msg);
     },
@@ -356,6 +363,10 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
     // not merely echo-suppressed live.
     const fake = makeFakeConversation({ processing: false });
     fakeConversation = fake.conversation;
+    let runOptions: Record<string, unknown> | undefined;
+    fake.conversation.runAgentLoop = async (...args: unknown[]) => {
+      runOptions = args[2] as Record<string, unknown>;
+    };
 
     await startVoiceTurn({
       ...makeTurnOptions(),
@@ -368,7 +379,11 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
     expect(fake.lastPersistOpts()?.metadata).toEqual({
       voiceSessionTurn: true,
       hidden: true,
+      messageKind: VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND,
     });
+    expect(runOptions?.messageKind).toBe(
+      VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND,
+    );
   });
 
   test("the opener prompt is persisted un-hidden (unchanged)", async () => {
@@ -963,7 +978,7 @@ describe("startVoiceTurn prior-turn teardown barrier", () => {
     expect(events).toEqual(["persist", "client:install"]);
 
     // Turn 2 arrives during the teardown window: it must not persist or
-    // install its client callback until turn 1's cleanup has run.
+    // install its event observer until turn 1's cleanup has run.
     const turn2 = startVoiceTurn(
       makeTurnOptions(undefined, "conv-teardown-order"),
     );
@@ -1701,6 +1716,174 @@ describe("cutFrontDoorContentAtVerdict", () => {
   });
 });
 
+/**
+ * The front-door leg's raw stream is a control plane: its leading tokens are
+ * the routing verdict, not speech. The hub broadcast (web / passive devices)
+ * must never carry those tokens, and must still carry every word of real
+ * assistant content: an over-broad filter would leave the shared transcript
+ * silent or truncated, which is worse than the leak it fixes.
+ */
+describe("front-door hub stream gate", () => {
+  beforeEach(resetCrudLog);
+
+  /**
+   * Conversation whose scripted agent loop announces a reserved row, streams
+   * `deltas` in order, then ends the leg with `finalEvent`.
+   */
+  function makeStreamingConversation(
+    deltas: string[],
+    finalEvent:
+      | "message_complete"
+      | "generation_cancelled" = "message_complete",
+  ): void {
+    const fake = makeFakeConversation({ processing: false });
+    fake.conversation.runAgentLoop = async (...args: unknown[]) => {
+      const { onEvent } = args[2] as { onEvent: (msg: unknown) => void };
+      onEvent({
+        type: "assistant_turn_start",
+        messageId: "assistant-row-1",
+        conversationId: "conv-voice-bridge-test",
+      });
+      for (const text of deltas) {
+        onEvent({
+          type: "assistant_text_delta",
+          text,
+          messageId: "assistant-row-1",
+          conversationId: "conv-voice-bridge-test",
+        });
+      }
+      onEvent({
+        type: finalEvent,
+        ...(finalEvent === "message_complete"
+          ? { messageId: "assistant-row-1" }
+          : {}),
+        conversationId: "conv-voice-bridge-test",
+      });
+    };
+    fakeConversation = fake.conversation;
+  }
+
+  /** The text of every `assistant_text_delta` `turn` publishes to the hub. */
+  async function collectBroadcastText(
+    turn: () => Promise<unknown>,
+  ): Promise<string[]> {
+    const texts: string[] = [];
+    const subscription = assistantEventHub.subscribe({
+      type: "process",
+      filter: { conversationId: "conv-voice-bridge-test" },
+      callback: (event) => {
+        const msg = event.message as { type: string; text?: string };
+        if (msg.type === "assistant_text_delta") {
+          texts.push(msg.text ?? "");
+        }
+      },
+    });
+    try {
+      await turn();
+      // The hub publishes off a promise chain, so every broadcast costs a
+      // few microtask hops before it reaches a subscriber.
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      await flushMicrotasks();
+    } finally {
+      subscription.dispose();
+    }
+    return texts;
+  }
+
+  test("an escalating leg broadcasts only the capped bridge, never the verdict token", async () => {
+    makeStreamingConversation([
+      "[1]",
+      " Let me check your calendar.",
+      " weak answer past the cap",
+    ]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual(["Let me check your calendar."]);
+    expect(texts.join("")).not.toContain(ESCALATE_VERDICT_TOKEN);
+  });
+
+  test("a front-door answer reaches the hub in full", async () => {
+    makeStreamingConversation(["It is ", "Tuesday", ", and it is sunny."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts.join("")).toBe("It is Tuesday, and it is sunny.");
+  });
+
+  test("an answer that merely opens with a bracket is released in full", async () => {
+    // "[" alone could still become the escalate token, so the gate holds it;
+    // the next delta disproves the token and the whole prefix must come out.
+    makeStreamingConversation(["[", "A] is the option to pick."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts.join("")).toBe("[A] is the option to pick.");
+  });
+
+  test("a hold verdict broadcasts nothing", async () => {
+    makeStreamingConversation([HOLD_VERDICT_TOKEN]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({
+        ...makeTurnOptions(),
+        routingLeg: "front-door",
+        unifiedVerdict: true,
+      }),
+    );
+
+    expect(texts).toEqual([]);
+  });
+
+  test("a leg that completes mid-bridge broadcasts what it handed off with", async () => {
+    makeStreamingConversation(["[1] Let me check"]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual(["Let me check"]);
+  });
+
+  test("a leg cancelled mid-bridge never hands off, so it broadcasts nothing", async () => {
+    makeStreamingConversation(["[1] Let me check"], "generation_cancelled");
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "front-door" }),
+    );
+
+    expect(texts).toEqual([]);
+  });
+
+  test("the escalated continuation streams to the hub untouched", async () => {
+    // The leg that produces the real answer is never gated: its deltas are
+    // assistant speech from the first token.
+    makeStreamingConversation(["Your next meeting ", "is at four."]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn({ ...makeTurnOptions(), routingLeg: "escalated" }),
+    );
+
+    expect(texts).toEqual(["Your next meeting ", "is at four."]);
+  });
+
+  test("an un-routed voice leg streams to the hub untouched", async () => {
+    makeStreamingConversation(["[1] not a verdict here"]);
+
+    const texts = await collectBroadcastText(() =>
+      startVoiceTurn(makeTurnOptions()),
+    );
+
+    expect(texts).toEqual(["[1] not a verdict here"]);
+  });
+});
+
 describe("transcript hygiene (teardown pass)", () => {
   beforeEach(resetCrudLog);