@vellumai/assistant 0.11.7-staging.1 → 0.11.7

package/src/runtime/routes/inbound-message-handler.ts

@@ -64,6 +64,7 @@ import {
   type SlackMessageMetadata,
   writeSlackMetadata,
 } from "../../messaging/providers/slack/message-metadata.js";
+import { mergeProviderMessageMetadata } from "../../messaging/read-provider-metadata.js";
 import { MESSAGE_PREVIEW_MAX_LENGTH } from "../../notifications/notification-utils.js";
 import {
   attachInlineAttachmentToMessage,
@@ -94,6 +95,7 @@ import { upsertBinding } from "../../persistence/external-conversation-store.js"
 import type { ContentBlock } from "../../providers/types.js";
 import { checkIngressForSecrets } from "../../security/secret-ingress.js";
 import { canonicalizeInboundIdentity } from "../../util/canonicalize-identity.js";
+import { safeParseRecord } from "../../util/json.js";
 import { getLogger } from "../../util/logger.js";
 import { truncate } from "../../util/truncate.js";
 import {
@@ -567,43 +569,15 @@ export async function handleChannelInbound({
       return { accepted: true, deleted: false };
     }
 
-    // Merge deletedAt into the existing slackMeta sub-key. If the row has
-    // no slackMeta (legacy pre-upgrade row), skip — the renderer's flat
-    // fallback ignores deletedAt for those rows anyway, and synthesizing
-    // a partial slackMeta here would produce metadata that fails
-    // readSlackMetadata validation.
+    // Merge deletedAt into the existing slackMeta sub-key when the row has
+    // one, so the Slack transcript renderer keeps seeing its own envelope.
+    // A row without it (a legacy pre-enrichment row) stamps the neutral
+    // shape instead: readProviderMetadata serves either to every
+    // channel-agnostic reader, so no delete goes unmarked over a metadata
+    // accident.
     const row = getMessageById(original.messageId);
-    if (!row?.metadata) {
-      log.debug(
-        {
-          conversationExternalId,
-          deletedMessageTs,
-          messageId: original.messageId,
-        },
-        "Stored Slack message has no metadata; skipping delete marker",
-      );
-      return { accepted: true, deleted: false };
-    }
-
-    let parentMetadata: Record<string, unknown>;
-    try {
-      const parsed = JSON.parse(row.metadata) as unknown;
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        parentMetadata = parsed as Record<string, unknown>;
-      } else {
-        parentMetadata = {};
-      }
-    } catch {
-      log.debug(
-        {
-          conversationExternalId,
-          deletedMessageTs,
-          messageId: original.messageId,
-        },
-        "Failed to parse stored metadata; skipping delete marker",
-      );
-      return { accepted: true, deleted: false };
-    }
+    const parentMetadata: Record<string, unknown> =
+      row?.metadata != null ? safeParseRecord(row.metadata) : {};
 
     const existingSlackMeta =
       typeof parentMetadata.slackMeta === "string"
@@ -611,15 +585,28 @@ export async function handleChannelInbound({
         : null;
 
     if (!existingSlackMeta) {
-      log.debug(
+      const providerMeta = mergeProviderMessageMetadata(
+        row?.metadata ?? null,
+        {
+          source: sourceChannel,
+          conversationExternalId,
+          messageId: deletedMessageTs,
+          ...(sourceMetadata?.threadId
+            ? { threadId: sourceMetadata.threadId }
+            : {}),
+        },
+        { deletedAt: Date.now() },
+      );
+      updateMessageMetadata(original.messageId, { providerMeta });
+      log.info(
         {
           conversationExternalId,
           deletedMessageTs,
           messageId: original.messageId,
         },
-        "Stored Slack message has no slackMeta; skipping delete marker",
+        "Marked message deleted via neutral metadata",
       );
-      return { accepted: true, deleted: false };
+      return { accepted: true, deleted: true, messageId: original.messageId };
     }
 
     const updatedSlackMeta = mergeSlackMetadata(existingSlackMeta, {

package/src/runtime/routes/inbound-stages/edit-intercept.ts

@@ -20,10 +20,10 @@ import {
   mergeSlackMetadata,
   readSlackMetadata,
 } from "../../../messaging/providers/slack/message-metadata.js";
+import { mergeProviderMessageMetadata } from "../../../messaging/read-provider-metadata.js";
 import type { MessageRow } from "../../../persistence/conversation-crud.js";
 import {
   getMessageById,
-  updateMessageContent,
   updateMessageContentAndMetadata,
 } from "../../../persistence/conversation-crud.js";
 import {
@@ -31,6 +31,7 @@ import {
   findMessageBySourceId,
   recordInbound,
 } from "../../../persistence/delivery-crud.js";
+import { markProcessed } from "../../../persistence/delivery-status.js";
 import { enqueueLexicalIndexForMessage } from "../../../persistence/job-handlers/message-lexical.js";
 import { stringifyMessageContent } from "../../../persistence/message-content.js";
 import { safeParseRecord } from "../../../util/json.js";
@@ -182,6 +183,7 @@ export async function handleEditIntercept(
       },
       "Edit text unchanged; skipping update",
     );
+    markProcessed(editResult.eventId);
     return {
       accepted: true,
       duplicate: false,
@@ -203,13 +205,29 @@ export async function handleEditIntercept(
       newContent,
     });
   } else {
-    updateMessageContent(original.messageId, newContent);
+    // Every channel marks its edits. Slack's envelope carries the extra
+    // fields its own renderer needs; the rest stamp the neutral shape that
+    // readProviderMetadata serves to every channel-agnostic reader.
+    const providerMeta = mergeProviderMessageMetadata(
+      existingRow?.metadata ?? null,
+      {
+        source: sourceChannel,
+        conversationExternalId,
+        messageId: sourceMessageId,
+        ...(sourceThreadId ? { threadId: sourceThreadId } : {}),
+      },
+      { editedAt: Date.now() },
+    );
+    updateMessageContentAndMetadata(original.messageId, newContent, {
+      providerMeta,
+    });
   }
   // The edit changed searchable text (the no-op guard above already returned
   // for identical content) and this path bypasses the `addMessage` persist
   // path, so reindex the message into the lexical index — the idempotent
   // upsert replaces the stale Qdrant point with the edited content.
   enqueueLexicalIndexForMessage(original.messageId);
+  markProcessed(editResult.eventId);
   log.info(
     { assistantId, sourceMessageId, messageId: original.messageId },
     "Updated message content from edited_message",

package/src/runtime/routes/migration-routes.ts

@@ -44,6 +44,7 @@ import {
 } from "../../security/secure-keys.js";
 import {
   getCredentialMetadata,
+  persistCredentialMetadata,
   upsertCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import { getLogger } from "../../util/logger.js";
@@ -156,7 +157,8 @@ export async function reconcileVellumMetadataFromCes(warningSink: {
       if (getCredentialMetadata("vellum", field)) {
         continue;
       }
-      upsertCredentialMetadata("vellum", field, {});
+      const metadata = upsertCredentialMetadata("vellum", field, {});
+      await persistCredentialMetadata(metadata);
       log.info(
         { field },
         "Reconciled vellum:* metadata entry from CES after import",

package/src/security/ces-rpc-record-backend.ts

@@ -0,0 +1,123 @@
+/**
+ * CES RPC backend for non-secret credential records (identity + policy).
+ */
+
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
+import { CesRpcMethod } from "@vellumai/service-contracts/credential-rpc";
+
+import type { CesClient } from "../credential-execution/client.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("ces-rpc-record-backend");
+
+export interface CredentialRecordBackend {
+  isAvailable(): boolean;
+  get(account: string): Promise<CredentialRecord | undefined>;
+  set(account: string, record: CredentialRecord): Promise<boolean>;
+  delete(account: string): Promise<"deleted" | "not-found" | "error">;
+  /**
+   * List all records. Returns `null` when CES cannot be reached so callers
+   * can distinguish an outage from an empty catalog.
+   */
+  list(): Promise<Array<{
+    account: string;
+    record: CredentialRecord;
+  }> | null>;
+  bulkSet(
+    records: Array<{ account: string; record: CredentialRecord }>,
+  ): Promise<Array<{ account: string; ok: boolean }>>;
+}
+
+export class CesRpcRecordBackend implements CredentialRecordBackend {
+  constructor(private readonly client: CesClient) {}
+
+  isAvailable(): boolean {
+    return this.client.isReady();
+  }
+
+  async get(account: string): Promise<CredentialRecord | undefined> {
+    if (!this.isAvailable()) {
+      return undefined;
+    }
+    try {
+      const result = await this.client.call(CesRpcMethod.GetCredentialRecord, {
+        account,
+      });
+      return result.found ? result.record : undefined;
+    } catch (err) {
+      log.warn({ err, account }, "CES RPC credential record get failed");
+      return undefined;
+    }
+  }
+
+  async set(account: string, record: CredentialRecord): Promise<boolean> {
+    if (!this.isAvailable()) {
+      return false;
+    }
+    try {
+      const result = await this.client.call(CesRpcMethod.SetCredentialRecord, {
+        account,
+        record,
+      });
+      return result.ok;
+    } catch (err) {
+      log.warn({ err, account }, "CES RPC credential record set failed");
+      return false;
+    }
+  }
+
+  async delete(
+    account: string,
+  ): Promise<"deleted" | "not-found" | "error"> {
+    if (!this.isAvailable()) {
+      return "error";
+    }
+    try {
+      const result = await this.client.call(
+        CesRpcMethod.DeleteCredentialRecord,
+        { account },
+      );
+      return result.result;
+    } catch (err) {
+      log.warn({ err, account }, "CES RPC credential record delete failed");
+      return "error";
+    }
+  }
+
+  async list(): Promise<Array<{
+    account: string;
+    record: CredentialRecord;
+  }> | null> {
+    if (!this.isAvailable()) {
+      return null;
+    }
+    try {
+      const result = await this.client.call(
+        CesRpcMethod.ListCredentialRecords,
+        {},
+      );
+      return result.records ?? [];
+    } catch (err) {
+      log.warn({ err }, "CES RPC credential record list failed");
+      return null;
+    }
+  }
+
+  async bulkSet(
+    records: Array<{ account: string; record: CredentialRecord }>,
+  ): Promise<Array<{ account: string; ok: boolean }>> {
+    if (!this.isAvailable()) {
+      return records.map((entry) => ({ account: entry.account, ok: false }));
+    }
+    try {
+      const result = await this.client.call(
+        CesRpcMethod.BulkSetCredentialRecords,
+        { records },
+      );
+      return result.results;
+    } catch (err) {
+      log.warn({ err }, "CES RPC credential record bulk set failed");
+      return records.map((entry) => ({ account: entry.account, ok: false }));
+    }
+  }
+}

package/src/security/secure-keys.ts

@@ -156,6 +156,21 @@ export function setCesClient(client: CesClient | undefined): void {
     "CES client updated; resetting resolved credential backend cache",
   );
   _cesClientListener?.(client);
+  void attachCredentialRecordBackend(client);
+}
+
+async function attachCredentialRecordBackend(
+  client: CesClient | undefined,
+): Promise<void> {
+  const { CesRpcRecordBackend } = await import("./ces-rpc-record-backend.js");
+  const { setCredentialRecordBackend } = await import(
+    "../tools/credentials/metadata-store.js"
+  );
+  if (!client) {
+    setCredentialRecordBackend(undefined);
+    return;
+  }
+  setCredentialRecordBackend(new CesRpcRecordBackend(client));
 }
 
 /**

package/src/tools/credentials/metadata-store.ts

@@ -1,24 +1,29 @@
 /**
  * Credential metadata store.
  *
- * Thin wrapper around the portable StaticCredentialMetadataStore from
- * @vellumai/credential-storage. Wires in the platform-specific data
- * directory and preserves the existing module-level API so that call
- * sites throughout the assistant daemon do not need to change.
+ * Reads stay on the workspace `metadata.json` file (sync). When a CES
+ * record backend is injected, upserts and deletes also write-through to
+ * CES so the CES catalog stays current.
  *
- * OAuth-specific fields (expiresAt, grantedScopes, oauth2TokenUrl,
- * oauth2ClientId, oauth2TokenEndpointAuthMethod, hasRefreshToken) are now
- * exclusively managed by the SQLite oauth-store and have been removed
- * from this interface as of v5.
+ * Tests: `_setMetadataPath` keeps the file-backed store and skips CES
+ * write-through.
  */
 
 import { join } from "node:path";
 
-import { StaticCredentialMetadataStore } from "@vellumai/credential-storage";
+import {
+  credentialKey,
+  StaticCredentialMetadataStore,
+} from "@vellumai/credential-storage";
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
 
+import type { CredentialRecordBackend } from "../../security/ces-rpc-record-backend.js";
+import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
 
+const log = getLogger("credential-metadata-store");
+
 /**
  * CredentialMetadata extends the shared StaticCredentialRecord with
  * assistant-specific injection template fields (composeWith, valueTransform).
@@ -43,12 +48,9 @@ export interface CredentialMetadata {
 // Singleton store instance
 // ---------------------------------------------------------------------------
 
-/**
- * Lazily initialised store instance. The path is determined on first access
- * (or overridden via `_setMetadataPath` for tests).
- */
 let _store: StaticCredentialMetadataStore | undefined;
 let _overridePath: string | null = null;
+let _recordBackend: CredentialRecordBackend | undefined;
 
 function getStore(): StaticCredentialMetadataStore {
   if (!_store) {
@@ -59,6 +61,48 @@ function getStore(): StaticCredentialMetadataStore {
   return _store;
 }
 
+function toRecord(metadata: CredentialMetadata): CredentialRecord {
+  return {
+    credentialId: metadata.credentialId,
+    service: metadata.service,
+    field: metadata.field,
+    allowedTools: metadata.allowedTools,
+    allowedDomains: metadata.allowedDomains,
+    usageDescription: metadata.usageDescription,
+    alias: metadata.alias,
+    injectionTemplates: metadata.injectionTemplates,
+    createdAt: metadata.createdAt,
+    updatedAt: metadata.updatedAt,
+  };
+}
+
+async function persistRecord(metadata: CredentialMetadata): Promise<void> {
+  if (!_recordBackend || _overridePath) {
+    return;
+  }
+  const account = credentialKey(metadata.service, metadata.field);
+  const ok = await _recordBackend.set(account, toRecord(metadata));
+  if (!ok) {
+    log.warn(
+      { service: metadata.service, field: metadata.field },
+      "Failed to persist credential record to CES",
+    );
+  }
+}
+
+/** Await CES write-through for a record already in the local file store. */
+export async function persistCredentialMetadata(
+  metadata: CredentialMetadata,
+): Promise<void> {
+  await persistRecord(metadata);
+}
+
+export function setCredentialRecordBackend(
+  backend: CredentialRecordBackend | undefined,
+): void {
+  _recordBackend = backend;
+}
+
 // ---------------------------------------------------------------------------
 // Public API - unchanged signatures, delegates to shared store
 // ---------------------------------------------------------------------------
@@ -89,7 +133,9 @@ export function upsertCredentialMetadata(
     injectionTemplates?: CredentialInjectionTemplate[] | null;
   },
 ): CredentialMetadata {
-  return getStore().upsert(service, field, policy) as CredentialMetadata;
+  const record = getStore().upsert(service, field, policy) as CredentialMetadata;
+  void persistRecord(record);
+  return record;
 }
 
 /**
@@ -127,13 +173,16 @@ export function deleteCredentialMetadata(
   service: string,
   field: string,
 ): boolean {
-  return getStore().delete(service, field);
+  const deleted = getStore().delete(service, field);
+  if (deleted && _recordBackend && !_overridePath) {
+    void _recordBackend.delete(credentialKey(service, field));
+  }
+  return deleted;
 }
 
 /** @internal Test-only: override the metadata file path. */
 export function _setMetadataPath(path: string | null): void {
   _overridePath = path;
-  // Reset the store so it picks up the new path
   if (_store) {
     if (path) {
       _store.setPath(path);

package/src/tools/credentials/store.ts

@@ -37,6 +37,7 @@ import {
 import { getLogger } from "../../util/logger.js";
 import {
   assertMetadataWritable,
+  persistCredentialMetadata,
   upsertCredentialMetadata,
 } from "./metadata-store.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
@@ -161,6 +162,7 @@ export async function storeCredentialValue(
     allowedDomains: input.allowedDomains,
     injectionTemplates: input.injectionTemplates,
   });
+  await persistCredentialMetadata(metadata);
   const { syncManualTokenConnection } =
     await import("../../oauth/manual-token-connection.js");
   await syncManualTokenConnection(service);

package/src/watch/__tests__/watch-retro.test.ts

@@ -247,6 +247,51 @@ describe("watch retrospective", () => {
     );
   });
 
+  test("puts the report last in the turn, after the skill it hands off to", async () => {
+    const summary = recordSession(["renaming the export"]);
+    const { calls, dispatch } = recordingDispatch();
+
+    await runWatchRetro(summary, { dispatch });
+
+    const { prompt } = calls[0]!;
+    // The report is what the user is shown when a session ends, so it has to
+    // be the turn's last prose. A client renders the final text block as the
+    // response and folds everything before it into collapsed intermediate
+    // work, so a `skill_load` issued after the report demotes the report to
+    // an "Earlier activity" row the user has to unfold to read.
+    expect(prompt).toContain("Load the `skill-management` skill first");
+    expect(
+      prompt.indexOf("Load the `skill-management` skill first"),
+    ).toBeLessThan(prompt.indexOf("What I need from you"));
+    expect(prompt).toContain("That report is the last thing you do this turn");
+    // A sign-off is another text block after the report, which puts the report
+    // back on the wrong side of the same rule, so it is refused by name.
+    expect(prompt).toContain("no sign-off");
+    expect(prompt).toContain("no further tool call");
+  });
+
+  test("writes the report even when the skill it hands off to will not load", async () => {
+    const summary = recordSession(["filing the receipt"]);
+    const { calls, dispatch } = recordingDispatch();
+
+    await runWatchRetro(summary, { dispatch });
+
+    const { prompt } = calls[0]!;
+    // `skill-management` is a selector, and a managed or workspace skill of the
+    // same id replaces the bundled one in the catalog. Putting the load ahead
+    // of the report is what lets a shadow, or the refusal a clientless wake
+    // gives an inline-command load, land before the user has been told
+    // anything. Neither may become the retro: the session is recorded and the
+    // account of it is what the user is owed.
+    expect(prompt).toContain(
+      "Write the report below whether or not that load succeeds",
+    );
+    expect(prompt).toContain("do not report on the load and do not retry it");
+    // The failure is still named, so a missing handoff does not read as a
+    // report that simply chose not to ask about authoring.
+    expect(prompt).toContain("could not open the skill-authoring flow");
+  });
+
   test("authors nothing until the user has confirmed", async () => {
     const summary = recordSession(["exporting the sheet"]);
     const { calls, dispatch } = recordingDispatch();
@@ -605,7 +650,9 @@ describe("watch retrospective", () => {
     expect(payload).toBeGreaterThan(opened);
     expect(payload).toBeLessThan(closed);
     // The retrospective's own instructions sit outside it.
-    expect(prompt.indexOf("Write back to the user")).toBeGreaterThan(closed);
+    expect(
+      prompt.indexOf("Load the `skill-management` skill first"),
+    ).toBeGreaterThan(closed);
 
     // One real envelope, so nothing in the recording can pass for a second.
     expect(prompt.match(/<external_content/g)).toHaveLength(1);

package/src/watch/watch-retro.ts

@@ -76,16 +76,58 @@ const WATCH_RETRO_WAKE_SOURCE = "watch-retro";
  * gap between those two is the whole risk of turning a demonstration into a
  * skill. `skill-management` will not scaffold until that step is settled
  * either, so an unasked one stalls the flow it was meant to feed.
+ *
+ * **The skill loads before the report is written, and nothing follows the
+ * report.** This is about where the report lands on screen, not about the
+ * order the work happens in. A client renders an assistant turn as its final
+ * prose plus the intermediate work that led there, and the web transcript
+ * collapses that intermediate half into an "Earlier activity" disclosure that
+ * a settled turn shows closed (`finalResponseGroupIndex` in
+ * `transcript-message-body.tsx`). Everything before the turn's last non-empty
+ * text block is intermediate by that rule, including prose. Writing the report
+ * first and loading the skill after it puts a `skill_load` and whatever the
+ * model says once the skill is in hand *after* the report, which demotes the
+ * report to intermediate work and hides it behind a collapsed row next to the
+ * reasoning rows. The user presses stop on a session and is shown a folded-up
+ * link where the account of it should be.
+ *
+ * So the load comes first and the report is last. `skill-management` opens on
+ * "Ask before doing anything", so a turn that loads it and then asks is
+ * following it rather than jumping the flow, and the report is the alignment
+ * its first step calls for. The instruction that nothing follows the report is
+ * as load-bearing as the ordering: one trailing line of sign-off is another
+ * text block after it, and the report is intermediate again.
+ *
+ * **The report does not depend on the load succeeding.** `skill-management` is
+ * a selector, not a fixed definition: `loadSkillCatalog` lets a managed or
+ * workspace skill of the same id replace the bundled one, and
+ * `resolveSkillSelector` hands back whichever entry won. So the load can come
+ * back as someone else's skill, or as a refusal, and putting it ahead of the
+ * report is what makes either one land before the user has been told anything.
+ * A refusal is the likelier of the two here: this wake is `clientless`, and an
+ * inline-command load with no human present is denied outright
+ * (`permissions/checker.ts`, `isDynamicSkillLoadInvocation`). The bundled skill
+ * carries no such expansions, so the ordinary path is unaffected, but a shadow
+ * that carries them is denied on arrival.
+ *
+ * Neither outcome is allowed to become the retro. The session was recorded, the
+ * timeline is already in this prompt, and the account of it is the one thing the
+ * user is owed for having pressed stop; a permission error where that account
+ * should be is the same empty thread the `surfaceConversation` guard exists to
+ * prevent, just with prose in it. So the instructions write the report either
+ * way and say the handoff did not happen, rather than reporting on the load.
  */
-const RETRO_INSTRUCTIONS = `Write back to the user in two sections, in this order, both as level-2 headings.
+const RETRO_INSTRUCTIONS = `Load the \`skill-management\` skill first, before you write anything, and follow it. Do not author or scaffold a skill until the four points that step names are settled: the report below is the alignment its first step calls for.
+
+Write the report below whether or not that load succeeds. If it fails, is refused, or comes back as something other than the skill-management flow, do not report on the load and do not retry it: write the report, and end it with one line saying you could not open the skill-authoring flow, so the user knows the handoff is the part that did not happen.
+
+Then write back to the user in two sections, in this order, both as level-2 headings. That report is the last thing you do this turn, and nothing follows it: no sign-off, no note about what you loaded, no further tool call. Their answers come back as an ordinary reply and the flow picks up from there.
 
 First, "What I need from you". The questions you cannot answer from the recording, numbered, most consequential first. Each one concrete enough to answer in a sentence, and each one about something you are genuinely guessing at: a value you could not read, a choice whose rule you could not infer, a step you only saw the result of. Always ask what they would say to start this task, in their own words, because the recording cannot tell you that. Ask about the done condition if it is unclear. Always confirm any destructive or irreversible step, even one the recording showed plainly: watching someone do a thing once is not agreement to have it done again unattended, and this is the one place the rule below does not apply. Otherwise do not ask them to confirm something the recording already showed you.
 
 Second, "What I saw". Open with one sentence naming the task and what it is for, on its own and not as a list item. Then the steps in order beneath it, one line each and concrete enough to follow, carrying no purpose of their own. This is the record your questions sit on top of, so state it rather than asking about it.
 
-Open on the first heading. No preamble, no announcing what you are about to do, no narrating which skills you are loading.
-
-Then load the \`skill-management\` skill and follow it, treating the answers to your questions as the alignment its first step calls for. Do not author or scaffold a skill until the four points that step names are settled. Correct your reading against whatever they tell you. If they decide this is not worth keeping, say so and stop.`;
+Open on the first heading. No preamble, no announcing what you are about to do, no narrating which skills you are loading. Correct your reading against whatever they tell you. If they decide this is not worth keeping, say so and stop.`;
 
 /**
  * Told to the model whenever the render was bounded, naming the bound that