@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/persistence/conversation-types.ts

@@ -157,6 +157,45 @@ export function isSystemCardMetadata(
   return metadata?.messageKind === SYSTEM_CARD_MESSAGE_KIND;
 }
 
+/**
+ * Marker for a turn whose whole reply was the `<no_response/>` sentinel: the
+ * assistant deliberately chose silence. The row's content keeps the raw
+ * sentinel (the model reads its own convention back from history); clients
+ * switch on the marker to render a quiet standalone notice and to resolve
+ * their pending-response state, instead of showing the sentinel text or
+ * waiting forever for a reply that was never coming.
+ */
+export const NO_RESPONSE_MESSAGE_KIND = "no_response";
+
+/**
+ * Shared predicate for the deliberate-silence marker, mirroring
+ * {@link isSystemCardMetadata} so display merging, transcript rendering, and
+ * turn grouping cannot drift.
+ */
+export function isNoResponseMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): boolean {
+  return metadata?.messageKind === NO_RESPONSE_MESSAGE_KIND;
+}
+
+/**
+ * Marker for an assistant-authored reaction row: the assistant reacted with
+ * an emoji, and the row records it durably. The reaction fact itself lives
+ * in the row's `providerMeta.reaction` envelope, same as inbound reaction
+ * rows; this kind carries the display and grouping semantics, keeping the
+ * row a standalone turn (never merged into adjacent assistant speech, where
+ * consolidation would fold its sentinel text into a bubble and drop the
+ * envelope from the wire).
+ */
+export const REACTION_MESSAGE_KIND = "reaction";
+
+/** Shared predicate for the assistant-reaction marker. */
+export function isReactionMessageMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): boolean {
+  return metadata?.messageKind === REACTION_MESSAGE_KIND;
+}
+
 /**
  * True when a role-`"user"` row is internal scaffolding rather than a person's
  * prompt: a daemon-injected run lifecycle notification (subagent
@@ -227,6 +266,76 @@ export function isVoiceSessionUserMessage(
   return metadata?.voiceSessionTurn === true;
 }
 
+/**
+ * Metadata key naming which of a row's attachments arrived as ambient camera
+ * frames rather than files the user picked. Exported so the SQL prefilter that
+ * finds candidate rows and the reader below name the same key.
+ */
+export const SIGHT_FRAME_ATTACHMENT_IDS_KEY = "sightFrameAttachmentIds";
+
+/**
+ * The row's attachments that arrived as ambient camera frames, by attachment
+ * id. A user attachment carries no metadata of its own, so the marking lives on
+ * the message and refers to the attachments by id.
+ *
+ * Tolerant of any metadata shape: a row without the key, or one whose value is
+ * not an array of ids, yields nothing. Retention consumers therefore treat an
+ * untagged conversation exactly like one that predates the tag.
+ */
+export function sightFrameAttachmentIdsFromMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): string[] {
+  const ids = metadata?.[SIGHT_FRAME_ATTACHMENT_IDS_KEY];
+  if (!Array.isArray(ids)) {
+    return [];
+  }
+  return ids.filter(
+    (id): id is string => typeof id === "string" && id.length > 0,
+  );
+}
+
+/**
+ * True when a stored `messages.metadata` column belongs to a standalone
+ * ambient camera keep: a row the call's own gate sampled, which no one spoke.
+ *
+ * The raw-column counterpart to {@link sightFrameAttachmentIdsFromMetadata},
+ * for consumers holding the JSON string a row was written with rather than a
+ * parsed bag: the memory rebuild's re-embed scan and the retrospective's
+ * accounting both ask this question of rows they never otherwise decode. It
+ * lives here, beside the key and the parser, so the two cannot drift.
+ *
+ * BOTH halves are required, and the tag alone is not enough. A genuine spoken
+ * turn carries the same tag whenever a parked frame rode it (see
+ * `calls/voice-session-bridge.ts`), which in camera mode is every turn the
+ * user speaks, so keying on the tag would read real speech as machine
+ * output. `scripted` is what separates them: the standalone persist sets it
+ * (`live-voice/live-voice-photo.ts`), while a spoken turn leaves it absent
+ * and the persist stamps the `false` default durably. The pair is the
+ * signature of a keep; `scripted` on its own belongs to every auto-sent row,
+ * onboarding prompts included, which are none of this predicate's business.
+ *
+ * Absent or unparseable metadata is not a keep. Both callers use this to hold
+ * keeps BACK from work, so a row whose marking cannot be read is treated as
+ * ordinary content and still gets indexed or reviewed, which is the direction
+ * that loses nothing.
+ */
+export function messageMetadataIsAmbientSightKeep(
+  metadata: string | null,
+): boolean {
+  if (!metadata) {
+    return false;
+  }
+  try {
+    const parsed = JSON.parse(metadata) as Record<string, unknown>;
+    return (
+      parsed.scripted === true &&
+      sightFrameAttachmentIdsFromMetadata(parsed).length > 0
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * True when the row that opened the turn was sent from a desktop app, on that
  * row's own evidence.

package/src/persistence/db-connection.ts

@@ -1,8 +1,9 @@
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { join, sep } from "node:path";
 import { Database } from "bun:sqlite";
 
+import { canonicalizePathThroughExistingParent } from "@vellumai/environments/test-path-guard";
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
 import { getLogsDbPath } from "../util/logs-db-path.js";
@@ -15,25 +16,6 @@ import { wrapSqliteForSlowQueryLogging } from "./slow-query-log.js";
 
 export type DrizzleDb = ReturnType<typeof drizzle<typeof schema>>;
 
-function canonicalizePathThroughExistingParent(path: string): string {
-  const resolvedPath = resolve(path);
-  const pendingSegments: string[] = [];
-  let currentPath = resolvedPath;
-
-  while (true) {
-    try {
-      return resolve(realpathSync(currentPath), ...pendingSegments.reverse());
-    } catch {
-      const parentPath = dirname(currentPath);
-      if (parentPath === currentPath) {
-        return resolvedPath;
-      }
-      pendingSegments.push(basename(currentPath));
-      currentPath = parentPath;
-    }
-  }
-}
-
 /**
  * Guard against opening a real workspace database during tests. Shared by
  * every connection opener (main, logs, memory) so a misconfigured test run

package/src/persistence/delivery-crud.ts

@@ -51,12 +51,12 @@ const SLACK_LEGACY_THREAD_EVIDENCE_BATCH_SIZE = 50;
 const SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN = 500;
 
 /**
- * Rows examined when locating a Slack message the assistant itself posted.
+ * Rows examined when locating a channel message the assistant itself posted.
  * Bounded on purpose: the scan runs on the inbound path while the gateway
  * waits for its ack, and reactions land on recent messages, so a cap costs
  * almost no recall and keeps the cost flat as the database grows.
  */
-const SLACK_OUTBOUND_TS_MAX_SCAN = 400;
+const OUTBOUND_MESSAGE_ID_MAX_SCAN = 400;
 
 /**
  * Channels where an inbound thread id scopes the conversation: a Slack thread
@@ -295,8 +295,8 @@ export function findInboundEvent(
 }
 
 /**
- * The conversation holding the message with this provider id, found by reading
- * the metadata the assistant's own posts carry.
+ * The conversation holding the message with this provider id, found by
+ * reading the metadata the assistant's own posts carry, on any channel.
  *
  * Reads through `readProviderMetadata`, so it matches any channel that
  * describes its rows in the neutral shape as well as Slack's own envelope.
@@ -305,16 +305,18 @@ export function findInboundEvent(
  * event. It cannot see what the assistant posted, because an outbound reply
  * opens no inbound event, so a reaction on the assistant's own message needs
  * this. The search is confined to conversations already bound to the same
- * Slack channel and to the most recent {@link SLACK_OUTBOUND_TS_MAX_SCAN}
- * rows among them; beyond that it gives up and the caller drops the
- * annotation, which is the same outcome as never finding it at all.
+ * channel address and to the most recent
+ * {@link OUTBOUND_MESSAGE_ID_MAX_SCAN} rows among them; beyond that it gives
+ * up and the caller drops the annotation, which is the same outcome as never
+ * finding it at all.
  */
-export function findSlackConversationByMessageTs(
+export function findConversationByProviderMessageId(
+  sourceChannel: string,
   externalChatId: string,
-  channelTs: string,
+  providerMessageId: string,
 ): string | null {
   const db = getDb();
-  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:slack:${externalChatId}`;
+  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:${sourceChannel}:${externalChatId}`;
   const rows = db
     .select({
       conversationId: messages.conversationId,
@@ -338,14 +340,15 @@ export function findSlackConversationByMessageTs(
       ),
     )
     .orderBy(desc(messages.createdAt))
-    .limit(SLACK_OUTBOUND_TS_MAX_SCAN)
+    .limit(OUTBOUND_MESSAGE_ID_MAX_SCAN)
     .all();
 
   for (const row of rows) {
     const meta = readProviderMetadata(row.metadata, { allowFlatLegacy: true });
     if (
       meta?.conversationExternalId === externalChatId &&
-      meta.messageId === channelTs
+      (meta.messageId === providerMessageId ||
+        meta.additionalMessageIds?.includes(providerMessageId))
     ) {
       return row.conversationId;
     }
@@ -480,6 +483,33 @@ export function findMessageBySourceId(
   return { messageId: row.messageId, conversationId: row.conversationId };
 }
 
+/**
+ * Whether any inbound-event row exists for this source message, linked or
+ * not. Discriminates "never ingested" from "ingested, link still landing":
+ * only the second justifies waiting out the link race, so a delete or edit
+ * for a message the daemon never saw can return immediately instead of
+ * holding its conversation's serialized lane through the retry window.
+ */
+export function hasInboundEventForSource(
+  sourceChannel: string,
+  externalChatId: string,
+  sourceMessageId: string,
+): boolean {
+  const db = getDb();
+  const row = db
+    .select({ id: channelInboundEvents.id })
+    .from(channelInboundEvents)
+    .where(
+      and(
+        eq(channelInboundEvents.sourceChannel, sourceChannel),
+        eq(channelInboundEvents.externalChatId, externalChatId),
+        eq(channelInboundEvents.sourceMessageId, sourceMessageId),
+      ),
+    )
+    .get();
+  return row !== undefined;
+}
+
 /**
  * Reference to the most recent inbound channel event for a conversation:
  * the external chat plus the channel-native message identifiers needed to

package/src/persistence/embeddings/__tests__/embedding-local-lifecycle.test.ts

@@ -18,8 +18,10 @@ import { getEmbedWorkerPidPath } from "../../../util/platform.js";
 import {
   classifyWorkerOwnership,
   listWorkerProcesses,
-  LocalEmbeddingBackend,
-} from "../embedding-local.js";
+} from "../../../util/worker-ownership.js";
+import { ORPHAN_STOP_TIMEOUT_MS } from "../../../util/worker-process.js";
+import { EMBEDDING_SHUTDOWN_BUDGET_MS } from "../embedding-backend.js";
+import { LocalEmbeddingBackend } from "../embedding-local.js";
 
 /** Reach past `private`, which is compile-time only, so tests drive real state. */
 type Internals = any;
@@ -753,3 +755,14 @@ describe("model matching", () => {
     ).toEqual([proc.pid]);
   });
 });
+
+// The daemon's orphan reclaim SIGTERMs a stale memory worker and waits
+// ORPHAN_STOP_TIMEOUT_MS before SIGKILL. That worker's shutdown reaps the ONNX
+// subprocess it owns, bounded at EMBEDDING_SHUTDOWN_BUDGET_MS + 1s. If the
+// reclaim ceiling does not outlast the reap, reclaiming kills the worker
+// mid-reap and strands the subprocess, which is the JARVIS-1125 failure.
+test("orphan reclaim outlasts the embedding reap it must not truncate", () => {
+  expect(ORPHAN_STOP_TIMEOUT_MS).toBeGreaterThan(
+    EMBEDDING_SHUTDOWN_BUDGET_MS + 1_000,
+  );
+});

package/src/persistence/embeddings/embedding-local.ts

@@ -13,13 +13,15 @@ import {
   getEmbeddingModelsDir,
   getEmbedWorkerPidPath,
 } from "../../util/platform.js";
-import {
-  listProcessTable,
-  readRawProcessCommand,
-} from "../../util/process-table.js";
+import { isProcessAlive } from "../../util/process-liveness.js";
 import { PromiseGuard } from "../../util/promise-guard.js";
 import { workerComputeEnv } from "../../util/worker-compute.js";
 import { workerMemoryEnv } from "../../util/worker-memory.js";
+import {
+  classifyWorkerOwnership,
+  listWorkerProcesses,
+  pid1OwnsWorkers,
+} from "../../util/worker-ownership.js";
 import { EmbeddingRuntimeManager } from "./embedding-runtime-manager.js";
 import {
   type EmbeddingBackend,
@@ -87,113 +89,6 @@ async function didSettle(
   return result !== timeout;
 }
 
-/** Whether a PID names a live process. */
-function isProcessAlive(pid: number): boolean {
-  try {
-    // Signal 0 probes for liveness without delivering a signal.
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-interface WorkerProcess {
-  pid: number;
-  ppid: number;
-}
-
-/**
- * What this process may do with an embed worker it found in the process table.
- *
- * - `reclaim`: parented to us, a worker we started and lost track of. Reaping
- *   it is what enforces one live worker per owning process.
- * - `orphan`: reparented to init, or its owner is gone. Nobody else will ever
- *   clean it up.
- * - `foreign`: owned by another live process. The memory-worker process runs
- *   its own backend against this same workspace and is entitled to its own
- *   worker; signalling it is what made the two replace each other in a loop.
- *
- * A parent of PID 1 is ambiguous, and resolving it wrongly in either direction
- * costs something real. `docker-entrypoint.sh` execs the daemon, so PID 1 can
- * BE the daemon and its child a healthy sibling's worker. Under `docker run
- * --init`, and on any host, PID 1 is an init process instead, so the same
- * parentage means the owner died and the worker needs reclaiming. Callers
- * therefore pass what PID 1 actually is rather than inferring it from whether
- * the deployment is containerized, which is true in both container shapes.
- */
-export type WorkerOwnership = "reclaim" | "orphan" | "foreign";
-
-export function classifyWorkerOwnership(
-  worker: WorkerProcess,
-  selfPid: number,
-  isOwnerAlive: (pid: number) => boolean,
-  pid1OwnsWorkers: boolean,
-): WorkerOwnership {
-  if (worker.ppid === selfPid) {
-    return "reclaim";
-  }
-  if (worker.ppid <= 1) {
-    return pid1OwnsWorkers ? "foreign" : "orphan";
-  }
-  if (!isOwnerAlive(worker.ppid)) {
-    return "orphan";
-  }
-  return "foreign";
-}
-
-/** Entrypoint the daemon is exec'd with, including inside a container. */
-const DAEMON_ENTRYPOINT_MARKER = "daemon/main";
-
-/**
- * Whether PID 1 is an assistant daemon rather than an init process.
- *
- * True only where the daemon was exec'd as PID 1 (`docker-entrypoint.sh`),
- * which is what makes a worker parented to 1 a live sibling's rather than an
- * orphan. Under `docker run --init` PID 1 is docker-init and under launchd or
- * systemd it is the system init, so both answer false and PID-1 orphans stay
- * reclaimable. Unreadable means false, which keeps the reclaiming behaviour.
- */
-function pid1OwnsEmbedWorkers(): boolean {
-  if (process.pid === 1) {
-    return true;
-  }
-  return readRawProcessCommand(1)?.includes(DAEMON_ENTRYPOINT_MARKER) ?? false;
-}
-
-/**
- * Live embed-worker processes for this workspace, as `(pid, ppid)` pairs.
- *
- * Ownership of an embed worker is recorded by the OS process tree, not by the
- * PID file: a worker's parent IS its owner. The process table is therefore the
- * authoritative answer to "whose worker is this", and unlike the PID file it
- * survives a crash and cannot be overwritten by a second owner. That matters
- * because the daemon and the memory-worker process legitimately run one worker
- * each against the same workspace.
- *
- * Matches on the absolute worker script path, which lives under THIS
- * workspace's embedding-models directory and is therefore unique per assistant
- * instance, so a sibling instance's workers never match. Raw command lines are
- * read for matching only, never stored or logged: process arguments can carry
- * secrets (see the redaction note in `util/process-tree.ts`).
- */
-export function listWorkerProcesses(
-  workerPath: string,
-  model?: string,
-): WorkerProcess[] {
-  try {
-    return listProcessTable()
-      .filter(
-        (row) =>
-          row.command.includes(workerPath) &&
-          (!model || row.command.split(/\s+/).includes(model)),
-      )
-      .map(({ pid, ppid }) => ({ pid, ppid }));
-  } catch {
-    return [];
-  }
-}
-
 /**
  * Local embedding backend using @huggingface/transformers (ONNX Runtime).
  * Runs BAAI/bge-small-en-v1.5 locally — no API calls, no network required.
@@ -874,7 +769,7 @@ export class LocalEmbeddingBackend implements EmbeddingBackend {
         worker,
         process.pid,
         isProcessAlive,
-        pid1OwnsEmbedWorkers(),
+        pid1OwnsWorkers(),
       );
       if (ownership === "foreign") {
         continue;

package/src/persistence/embeddings/qdrant-manager.ts

@@ -51,7 +51,9 @@ export function resolveQdrantReleaseAsset(
     target = "x86_64-unknown-linux-musl";
   } else if (os === "linux" && cpu === "arm64") {
     target = "aarch64-unknown-linux-musl";
-  } else if (os === "win32" && cpu === "x64") {
+  } else if (os === "win32" && (cpu === "x64" || cpu === "arm64")) {
+    // Qdrant ships no arm64 Windows build; Windows 11 on ARM runs the x64
+    // binary via transparent emulation.
     return {
       binaryName: "qdrant.exe",
       filename: "qdrant-x86_64-pc-windows-msvc.zip",
@@ -286,6 +288,7 @@ export class QdrantManager {
           cmd: ["tar", "xzf", tmpTar, "-C", binDir, release.binaryName],
           stdout: "ignore",
           stderr: "pipe",
+          windowsHide: true,
         });
         await proc.exited;
         if (proc.exitCode !== 0) {

package/src/persistence/llm-request-log-store.ts

@@ -346,7 +346,7 @@ export function recordRequestLog(
     // plumb call sites through one site at a time.
     callSite: callSite ?? null,
     // JSON first-token latency waterfall, supplied by `handleUsage` for
-    // main-agent calls. NULL for failed/non-instrumented call paths.
+    // instrumented calls. NULL for failed/non-instrumented call paths.
     latencyBreakdown: latencyBreakdown ?? null,
   });
   return id;

package/src/persistence/migrations/370-acp-session-history-auth-error-code.ts

@@ -0,0 +1,36 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const TABLE = "acp_session_history";
+const COLUMN = "auth_error_code";
+
+/**
+ * Add a nullable `auth_error_code TEXT` column to `acp_session_history`.
+ *
+ * Names the credential failure that ended a run, so a client that reopens the
+ * conversation can re-raise the inline "Connect Claude Code" card for it. The
+ * row is the right home for that: it already carries the parent conversation
+ * and the spawning tool call the card anchors to, nothing rewrites it the way
+ * a turn's finalize rewrites message content, and it outlives the daemon
+ * process, so retirement does not depend on anything held in memory.
+ *
+ * `NULL` for rows persisted before this migration ran, and for every run that
+ * ended for any other reason.
+ *
+ * Idempotent: the PRAGMA guard makes re-running a no-op once the column
+ * exists.
+ */
+export function migrateAcpSessionHistoryAuthErrorCode(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  const columns = raw.query(`PRAGMA table_info(${TABLE})`).all() as Array<{
+    name: string;
+  }>;
+  const columnNames = new Set(columns.map((c) => c.name));
+
+  if (!columnNames.has(COLUMN)) {
+    raw.exec(`ALTER TABLE ${TABLE} ADD COLUMN ${COLUMN} TEXT`);
+  }
+}

package/src/persistence/migrations/371-acp-session-history-auth-error-credential.ts

@@ -0,0 +1,40 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const TABLE = "acp_session_history";
+const COLUMN = "auth_error_credential";
+
+/**
+ * Add a nullable `auth_error_credential TEXT` column to `acp_session_history`.
+ *
+ * Holds a digest of the Claude token the run was using when Claude refused it,
+ * beside the `auth_error_code` that names the refusal. Together they let a
+ * marker answer for itself whether it is still worth showing: a client asks
+ * whether the credential named here is still the one a spawn would resolve,
+ * rather than relying on a sweep having run at the right moment to clear it.
+ *
+ * A digest, never the token. It only ever has to be compared for equality, and
+ * this outlives the run that produced it.
+ *
+ * `NULL` for rows written before this migration ran, and for every run that
+ * ended for any other reason. A marker with no credential named is served
+ * rather than hidden, since an unknown credential is no evidence the failure
+ * was repaired.
+ *
+ * Idempotent: the PRAGMA guard makes re-running a no-op once the column
+ * exists.
+ */
+export function migrateAcpSessionHistoryAuthErrorCredential(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  const columns = raw.query(`PRAGMA table_info(${TABLE})`).all() as Array<{
+    name: string;
+  }>;
+  const columnNames = new Set(columns.map((c) => c.name));
+
+  if (!columnNames.has(COLUMN)) {
+    raw.exec(`ALTER TABLE ${TABLE} ADD COLUMN ${COLUMN} TEXT`);
+  }
+}

package/src/persistence/migrations/372-create-acp-refused-credentials.ts

@@ -0,0 +1,34 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const TABLE = "acp_refused_credentials";
+
+/**
+ * Create `acp_refused_credentials`: which Claude tokens Claude has refused.
+ *
+ * Its own table rather than a column on `acp_session_history`, because the two
+ * answer different questions with different lifetimes. A marker says "show a
+ * card for this run" and is fair game for the user to delete along with the
+ * run. This says "do not resolve this token again", and clearing session
+ * history must not change which credential a spawn selects: a configured
+ * `CLAUDE_CODE_OAUTH_TOKEN` lives in config, so forgetting that Claude refused
+ * it lets it win over the vault replacement again and reopen the Connect loop.
+ *
+ * Digests, never tokens. Equality is the only operation, and these records
+ * deliberately outlive the runs that produced them.
+ *
+ * Retained rather than consumed: a revoked value the user never removes from
+ * config is resolved by every later spawn too, so a one-shot only spares the
+ * first. Keeping them is safe because a value the user actually fixes hashes
+ * differently and was never recorded.
+ *
+ * Idempotent via IF NOT EXISTS.
+ */
+export function migrateCreateAcpRefusedCredentials(database: DrizzleDb): void {
+  getSqliteFrom(database).exec(
+    `CREATE TABLE IF NOT EXISTS ${TABLE} (
+       digest TEXT PRIMARY KEY,
+       refused_at INTEGER NOT NULL
+     )`,
+  );
+}

package/src/persistence/migrations/373-acp-auth-marker-index.ts

@@ -0,0 +1,27 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const INDEX = "idx_acp_session_history_auth_marker";
+
+/**
+ * Index the credential-failure markers a conversation carries.
+ *
+ * Every snapshot refetch asks the same question: the newest marked runs in one
+ * conversation. The existing indexes cover the parent and the timestamp
+ * separately, so that question meant gathering a conversation's rows through
+ * one and then sorting them, work that grows with how many runs it has had
+ * rather than with the handful the answer needs.
+ *
+ * Partial, on the marker predicate, so the index holds only rows that carry a
+ * failure. Conversations that have never had one contribute nothing to it, and
+ * the ordered columns let the scan stop as soon as it has enough.
+ *
+ * Idempotent via IF NOT EXISTS.
+ */
+export function migrateAcpAuthMarkerIndex(database: DrizzleDb): void {
+  getSqliteFrom(database).exec(
+    `CREATE INDEX IF NOT EXISTS ${INDEX}
+       ON acp_session_history (parent_conversation_id, started_at DESC)
+       WHERE auth_error_code IS NOT NULL`,
+  );
+}

package/src/persistence/migrations/__tests__/370-acp-session-history-auth-error-code.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Migration 370 adds the nullable `auth_error_code` column that carries a
+ * run's credential failure across a reload, and is idempotent so a repair flow
+ * can re-run it.
+ */
+
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateAcpSessionHistoryAuthErrorCode } from "../370-acp-session-history-auth-error-code.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec(
+    "CREATE TABLE acp_session_history (id TEXT PRIMARY KEY, status TEXT)",
+  );
+  return drizzle(sqlite, { schema });
+}
+
+function columnNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("PRAGMA table_info(acp_session_history)")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+describe("migrateAcpSessionHistoryAuthErrorCode", () => {
+  test("adds the column when it is missing", () => {
+    const db = createTestDb();
+
+    migrateAcpSessionHistoryAuthErrorCode(db);
+
+    expect(columnNames(db)).toContain("auth_error_code");
+  });
+
+  test("re-running is a no-op", () => {
+    const db = createTestDb();
+
+    migrateAcpSessionHistoryAuthErrorCode(db);
+    migrateAcpSessionHistoryAuthErrorCode(db);
+
+    expect(columnNames(db)).toContain("auth_error_code");
+  });
+
+  test("leaves existing rows null rather than inventing a failure", () => {
+    const db = createTestDb();
+    getSqliteFrom(db).exec(
+      "INSERT INTO acp_session_history (id, status) VALUES ('run-1', 'completed')",
+    );
+
+    migrateAcpSessionHistoryAuthErrorCode(db);
+
+    const row = getSqliteFrom(db)
+      .prepare(
+        "SELECT auth_error_code FROM acp_session_history WHERE id = 'run-1'",
+      )
+      .get() as { auth_error_code: string | null };
+    expect(row.auth_error_code).toBeNull();
+  });
+});