@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/persistence/migrations/__tests__/371-acp-session-history-auth-error-credential.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Migration 371 adds the nullable `auth_error_credential` column that names
+ * which Claude token a run's credential failure was refused on, and is
+ * idempotent so a repair flow can re-run it.
+ */
+
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateAcpSessionHistoryAuthErrorCredential } from "../371-acp-session-history-auth-error-credential.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec(
+    "CREATE TABLE acp_session_history (id TEXT PRIMARY KEY, status TEXT)",
+  );
+  return drizzle(sqlite, { schema });
+}
+
+function columnNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("PRAGMA table_info(acp_session_history)")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+describe("migrateAcpSessionHistoryAuthErrorCredential", () => {
+  test("adds the column when it is missing", () => {
+    const db = createTestDb();
+
+    migrateAcpSessionHistoryAuthErrorCredential(db);
+
+    expect(columnNames(db)).toContain("auth_error_credential");
+  });
+
+  test("re-running is a no-op", () => {
+    const db = createTestDb();
+
+    migrateAcpSessionHistoryAuthErrorCredential(db);
+    migrateAcpSessionHistoryAuthErrorCredential(db);
+
+    expect(columnNames(db)).toContain("auth_error_credential");
+  });
+
+  test("leaves existing rows null, which reads as a marker worth serving", () => {
+    // A row marked before this column existed names no credential. The
+    // comparison treats that as no evidence the failure was repaired and
+    // serves the marker, so an upgrade cannot silently swallow a card.
+    const db = createTestDb();
+    getSqliteFrom(db).exec(
+      "INSERT INTO acp_session_history (id, status) VALUES ('run-1', 'failed')",
+    );
+
+    migrateAcpSessionHistoryAuthErrorCredential(db);
+
+    const row = getSqliteFrom(db)
+      .prepare(
+        "SELECT auth_error_credential FROM acp_session_history WHERE id = 'run-1'",
+      )
+      .get() as { auth_error_credential: string | null };
+    expect(row.auth_error_credential).toBeNull();
+  });
+});

package/src/persistence/migrations/__tests__/372-create-acp-refused-credentials.test.ts

@@ -0,0 +1,64 @@
+/**
+ * Migration 372 creates `acp_refused_credentials`, the record of which Claude
+ * tokens Claude has refused. It is separate from the session-history marker so
+ * that clearing session history cannot change which credential a spawn picks.
+ */
+
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateCreateAcpRefusedCredentials } from "../372-create-acp-refused-credentials.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  return drizzle(sqlite, { schema });
+}
+
+function tableNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+describe("migrateCreateAcpRefusedCredentials", () => {
+  test("creates the table", () => {
+    const db = createTestDb();
+
+    migrateCreateAcpRefusedCredentials(db);
+
+    expect(tableNames(db)).toContain("acp_refused_credentials");
+  });
+
+  test("re-running is a no-op", () => {
+    const db = createTestDb();
+
+    migrateCreateAcpRefusedCredentials(db);
+    migrateCreateAcpRefusedCredentials(db);
+
+    expect(tableNames(db)).toContain("acp_refused_credentials");
+  });
+
+  test("keeps one row per digest, so a retried refusal is not an error", () => {
+    const db = createTestDb();
+    migrateCreateAcpRefusedCredentials(db);
+    const raw = getSqliteFrom(db);
+
+    raw.exec(
+      "INSERT OR IGNORE INTO acp_refused_credentials (digest, refused_at) VALUES ('abc', 1)",
+    );
+    raw.exec(
+      "INSERT OR IGNORE INTO acp_refused_credentials (digest, refused_at) VALUES ('abc', 2)",
+    );
+
+    const rows = raw
+      .prepare("SELECT digest, refused_at FROM acp_refused_credentials")
+      .all() as { digest: string; refused_at: number }[];
+    expect(rows).toEqual([{ digest: "abc", refused_at: 1 }]);
+  });
+});

package/src/persistence/migrations/__tests__/373-acp-auth-marker-index.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Migration 373 indexes a conversation's credential-failure markers, which is
+ * the query every snapshot refetch runs.
+ */
+
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateAcpAuthMarkerIndex } from "../373-acp-auth-marker-index.js";
+
+const MARKER_QUERY = `
+  SELECT agent_id FROM acp_session_history
+  WHERE parent_conversation_id = 'conv-1' AND auth_error_code IS NOT NULL
+  ORDER BY started_at DESC LIMIT 20
+`;
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec(
+    `CREATE TABLE acp_session_history (
+       id TEXT PRIMARY KEY,
+       agent_id TEXT,
+       parent_conversation_id TEXT,
+       started_at INTEGER,
+       auth_error_code TEXT
+     )`,
+  );
+  return drizzle(sqlite, { schema });
+}
+
+function indexNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'index'")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+function queryPlan(db: ReturnType<typeof createTestDb>): string {
+  const rows = getSqliteFrom(db)
+    .prepare(`EXPLAIN QUERY PLAN ${MARKER_QUERY}`)
+    .all() as { detail: string }[];
+  return rows.map((row) => row.detail).join(" | ");
+}
+
+describe("migrateAcpAuthMarkerIndex", () => {
+  test("creates the index", () => {
+    const db = createTestDb();
+
+    migrateAcpAuthMarkerIndex(db);
+
+    expect(indexNames(db)).toContain("idx_acp_session_history_auth_marker");
+  });
+
+  test("re-running is a no-op", () => {
+    const db = createTestDb();
+
+    migrateAcpAuthMarkerIndex(db);
+    migrateAcpAuthMarkerIndex(db);
+
+    expect(indexNames(db)).toContain("idx_acp_session_history_auth_marker");
+  });
+
+  test("the marker lookup uses it, and stops sorting to answer", () => {
+    // The point of the index, not merely its existence. Without it the planner
+    // gathers the conversation's rows and sorts them, which is work that grows
+    // with how many runs it has had rather than with the few the answer needs.
+    const db = createTestDb();
+    const before = queryPlan(db);
+
+    migrateAcpAuthMarkerIndex(db);
+
+    const after = queryPlan(db);
+    expect(before).toContain("SCAN");
+    expect(after).toContain("idx_acp_session_history_auth_marker");
+    expect(after).not.toContain("TEMP B-TREE");
+  });
+});

package/src/persistence/schema/acp.ts

@@ -33,6 +33,10 @@ export const acpSessionHistory = sqliteTable(
     // Usage metadata. Null for rows written before these columns existed.
     task: text("task"),
     parentToolUseId: text("parent_tool_use_id"),
+    /** Credential failure that ended the run, when one did. Drives the inline
+     *  Connect card on reopen; cleared when a replacement token is stored. */
+    authErrorCode: text("auth_error_code"),
+    authErrorCredential: text("auth_error_credential"),
     usedTokens: integer("used_tokens"),
     contextSize: integer("context_size"),
     costAmount: real("cost_amount"),
@@ -47,5 +51,26 @@ export const acpSessionHistory = sqliteTable(
     index("idx_acp_session_history_parent_conversation_id").on(
       table.parentConversationId,
     ),
+    // Partial in the database (see migration 373): only rows carrying a
+    // credential failure are indexed, which is what keeps the marker lookup a
+    // fixed cost rather than one that grows with a conversation's run count.
+    // Declared here without the predicate because the schema builder has no
+    // way to express one; the migration is the source of truth for its shape.
+    index("idx_acp_session_history_auth_marker").on(
+      table.parentConversationId,
+      table.startedAt,
+    ),
   ],
 );
+
+/**
+ * Claude tokens Claude has refused, by digest.
+ *
+ * Separate from the session-history marker on purpose: a marker is about
+ * showing a card for one run and is deleted with it, while this is about which
+ * credential a spawn may resolve and must survive the user clearing history.
+ */
+export const acpRefusedCredentials = sqliteTable("acp_refused_credentials", {
+  digest: text("digest").primaryKey(),
+  refusedAt: integer("refused_at").notNull(),
+});

package/src/persistence/steps.ts

@@ -477,6 +477,10 @@ import { migrateChatgptSubscriptionRowIdentity } from "./migrations/366-chatgpt-
 import { migrateCreateWatchTimelineEntries } from "./migrations/367-create-watch-timeline-entries.js";
 import { migrateWatchTimelineScreenshotBlob } from "./migrations/368-watch-timeline-screenshot-blob.js";
 import { migrateCreateAppPins } from "./migrations/369-create-app-pins.js";
+import { migrateAcpSessionHistoryAuthErrorCode } from "./migrations/370-acp-session-history-auth-error-code.js";
+import { migrateAcpSessionHistoryAuthErrorCredential } from "./migrations/371-acp-session-history-auth-error-credential.js";
+import { migrateCreateAcpRefusedCredentials } from "./migrations/372-create-acp-refused-credentials.js";
+import { migrateAcpAuthMarkerIndex } from "./migrations/373-acp-auth-marker-index.js";
 import type { MigrationStep } from "./migrations/run-migrations.js";
 
 export const migrationSteps: MigrationStep[] = [
@@ -1588,4 +1592,8 @@ export const migrationSteps: MigrationStep[] = [
   migrateCreateWatchTimelineEntries,
   migrateWatchTimelineScreenshotBlob,
   migrateCreateAppPins,
+  migrateAcpSessionHistoryAuthErrorCode,
+  migrateAcpSessionHistoryAuthErrorCredential,
+  migrateCreateAcpRefusedCredentials,
+  migrateAcpAuthMarkerIndex,
 ];

package/src/platform/platform-patch-queue.test.ts

@@ -3,6 +3,7 @@ import {
   beforeEach,
   describe,
   expect,
+  jest,
   mock,
   setSystemTime,
   test,
@@ -66,14 +67,30 @@ function makeQueue(
   return queue;
 }
 
+const FROZEN_NOW = new Date("2026-01-01T00:00:00.000Z").getTime();
+
+/**
+ * Flush already-queued microtasks. Fake timers stop the clock but not the
+ * promise chain `enqueue` appends onto, so the PATCH work a timer kicks off
+ * lands here.
+ */
 async function settle(): Promise<void> {
-  for (let i = 0; i < 10; i++) {
-    await new Promise((r) => setTimeout(r, 5));
+  for (let i = 0; i < 20; i += 1) {
+    await Promise.resolve();
   }
 }
 
+/** Advance `Date.now()` and the queue's `setTimeout` handles together. */
+async function elapse(ms: number): Promise<void> {
+  setSystemTime(new Date(Date.now() + ms));
+  jest.advanceTimersByTime(ms);
+  await settle();
+}
+
 describe("createPlatformPatchQueue", () => {
   beforeEach(() => {
+    jest.useFakeTimers();
+    setSystemTime(new Date(FROZEN_NOW));
     patches = [];
     builds = 0;
     respond = () => new Response("{}", { status: 200 });
@@ -85,6 +102,8 @@ describe("createPlatformPatchQueue", () => {
     for (const queue of queues) {
       queue.dispose();
     }
+    jest.useRealTimers();
+    setSystemTime();
   });
 
   test("PATCHes once and dedups an unchanged key", async () => {
@@ -203,21 +222,16 @@ describe("createPlatformPatchQueue", () => {
       saveSyncedKey: (synced) => saved.push(synced),
     });
     const start = Date.now();
-    setSystemTime(new Date(start));
-    try {
-      queue.enqueue("a");
-      await settle();
-      setSystemTime(new Date(start + 999));
-      queue.enqueue("a");
-      await settle();
-      setSystemTime(new Date(start + 1000));
-      queue.enqueue("a");
-      await settle();
-      queue.enqueue("a");
-      await settle();
-    } finally {
-      setSystemTime();
-    }
+    queue.enqueue("a");
+    await settle();
+    setSystemTime(new Date(start + 999));
+    queue.enqueue("a");
+    await settle();
+    setSystemTime(new Date(start + 1000));
+    queue.enqueue("a");
+    await settle();
+    queue.enqueue("a");
+    await settle();
 
     expect(patches).toHaveLength(2);
     expect(saved.map((s) => s.syncedAt)).toEqual([start, start + 1000]);
@@ -243,14 +257,12 @@ describe("createPlatformPatchQueue", () => {
     await settle();
     expect(patches).toHaveLength(1);
 
-    await new Promise((r) => setTimeout(r, 300));
-    await settle();
+    await elapse(300);
     expect(patches).toHaveLength(2);
     expect(builds).toBe(2);
 
     queue.dispose();
-    await new Promise((r) => setTimeout(r, 300));
-    await settle();
+    await elapse(300);
     expect(patches).toHaveLength(2);
   });
 
@@ -266,8 +278,7 @@ describe("createPlatformPatchQueue", () => {
     await settle();
     expect(patches).toHaveLength(0);
 
-    await new Promise((r) => setTimeout(r, 300));
-    await settle();
+    await elapse(300);
     expect(patches).toHaveLength(1);
   });
 
@@ -279,12 +290,10 @@ describe("createPlatformPatchQueue", () => {
     expect(patches).toHaveLength(1);
 
     respond = () => new Response("{}", { status: 200 });
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
     expect(patches).toHaveLength(2);
 
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
     queue.enqueue("a");
     await settle();
     expect(patches).toHaveLength(2);
@@ -301,8 +310,7 @@ describe("createPlatformPatchQueue", () => {
     queue.enqueue("a");
     await settle();
     mockClient = makeClient();
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
 
     expect(patches).toHaveLength(1);
   });
@@ -312,14 +320,11 @@ describe("createPlatformPatchQueue", () => {
     respond = () => new Response("nope", { status: 500 });
     queue.enqueue("a");
     await settle();
-    await new Promise((r) => setTimeout(r, 50));
-    await settle();
-    await new Promise((r) => setTimeout(r, 50));
-    await settle();
+    await elapse(50);
+    await elapse(50);
     expect(patches).toHaveLength(3);
 
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
     expect(patches).toHaveLength(3);
   });
 
@@ -332,12 +337,10 @@ describe("createPlatformPatchQueue", () => {
     await settle();
     expect(patches.map((p) => p.body.value)).toEqual(["a", "b"]);
 
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
     expect(patches.map((p) => p.body.value)).toEqual(["a", "b", "b"]);
 
-    await new Promise((r) => setTimeout(r, 100));
-    await settle();
+    await elapse(100);
     expect(patches).toHaveLength(3);
   });
 
@@ -347,8 +350,7 @@ describe("createPlatformPatchQueue", () => {
     queue.enqueue("a");
     await settle();
     queue.dispose();
-    await new Promise((r) => setTimeout(r, 300));
-    await settle();
+    await elapse(300);
 
     expect(patches).toHaveLength(1);
   });

package/src/plugin-api/index.ts

@@ -223,6 +223,18 @@ export { getConfiguredProvider } from "../providers/provider-send-message.js";
 // an image, embedding it, re-encoding it — use this instead of reaching into
 // the host attachment store, so they stay agnostic to how media is persisted.
 export { resolveMediaSourceData } from "../providers/media-resolve.js";
+// Build the `_attachmentId` property of a media block as a spreadable fragment,
+// omitting it when there is no usable id. A plugin that rebuilds a media block
+// (resizing an image, re-encoding a file) uses this to carry the block's link
+// to its attachment row across the rebuild, so host consumers that correlate a
+// block back to its attachment still can.
+export { attachmentIdFragment } from "../providers/types.js";
+// Read the attachment row a media block came from, whichever shape it is in: a
+// reference names it on `source.attachmentId`, an inline block on
+// `_attachmentId`. A plugin that rebuilds a block into inline bytes derives the
+// id through this before stamping it, since the reference shape's id would
+// otherwise be lost with the source it replaced.
+export { mediaBlockAttachmentId } from "../providers/types.js";
 // Classify a provider stop reason: whether the turn was truncated at the
 // output token cap (vs. a natural stop or a tool call). A `post-model-call`
 // hook reads it off `PostModelCallContext.stopReason` to decide whether to

package/src/plugins/defaults/compaction/window-manager.ts

@@ -83,6 +83,8 @@ export interface ContextWindowResult {
   summaryOutputTokens: number;
   summaryModel: string;
   summaryCallSite?: LLMCallSite;
+  /** See {@link CompactionRunResult.summaryResolutionCallSite}. */
+  summaryResolutionCallSite?: LLMCallSite;
   summaryOverrideProfile?: string | null;
   /** See {@link CompactionRunResult.summaryActualProvider}. */
   summaryActualProvider?: string;

package/src/plugins/defaults/image-recovery/recover.ts

@@ -15,7 +15,9 @@
  */
 
 import {
+  attachmentIdFragment,
   type ContentBlock,
+  mediaBlockAttachmentId,
   type Message,
   resolveMediaSourceData,
 } from "@vellumai/plugin-api";
@@ -105,10 +107,13 @@ export async function unsendableImageReplacement(
     if (mediaTypeMismatch) {
       // Only the label is wrong, so keep the source shape: a workspace_ref
       // stays a reference (inlining it would bake the full payload into the
-      // stored message row) and only media_type is corrected.
+      // stored message row) and only media_type is corrected. Because the
+      // source survives, a reference still names its own attachment through
+      // it, and only an inline block's top-level id needs carrying.
       return {
         type: "image",
         source: { ...block.source, media_type: effectiveMediaType },
+        ...attachmentIdFragment(block._attachmentId),
       };
     }
     return null;
@@ -128,6 +133,12 @@ export async function unsendableImageReplacement(
         media_type: optimized.mediaType,
         data: optimized.data,
       },
+      // The resized block is inline bytes whatever the input was, so a
+      // reference's `source.attachmentId` is about to be replaced along with
+      // the source that held it. Derive the id from either shape before
+      // stamping, or a reference-backed image loses its attachment here and
+      // the durable rewrite makes that permanent.
+      ...attachmentIdFragment(mediaBlockAttachmentId(block)),
     };
   }
   return { type: "text", text: UNSENDABLE_IMAGE_NOTE };