@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/runtime/routes/guardian-expiry-sweep.ts

@@ -1,18 +1,26 @@
 /**
  * Guardian request expiry sweep.
  *
- * Periodically asks the gateway to CAS-expire pending guardian requests
- * whose `expiresAt` timestamp has passed (`guardian_requests_sweep_expired`),
- * so stale requests are cleaned up even when no follow-up traffic arrives
- * from either the guardian or the requester.
+ * Each round reads a bounded batch of pending requests past their
+ * `expiresAt` and, per request, runs the expiry side effects (withdrawing
+ * the approval cards on every surface, notifying the requester, releasing
+ * any in-memory pending interaction), and only then confirms with the
+ * gateway's per-request expire CAS. The status flip is the receipt that the
+ * side effects ran, not the announcement that they should: a lost IPC
+ * response, a timeout, or a crash at any point leaves the row pending and
+ * past-deadline, so the next round lists it again and re-runs its fan-out.
  *
- * The gateway owns the status transition (the single source of truth); the
- * daemon fans out the side effects for each expired row it returns:
- * withdrawing the approval cards on every surface, notifying the requester
- * that their request expired, and releasing any in-memory pending
- * interaction. Requester notices are delivered straight to the requester's
- * channel — not the guardian-facing notification pipeline — and the guardian
- * stays passive, since the withdrawn card already reflects expiry.
+ * That order is safe because every decision path checks `expiresAt` before
+ * any write: a past-deadline row is undecidable while it waits for its
+ * fan-out. The cost is at-least-once side effects: a round that dies
+ * between the notice and the CAS re-notifies the requester next round,
+ * which is the correct trade against silently losing the withdrawal and the
+ * notice, since a stale card is an actionable control on every surface that
+ * renders buttons.
+ *
+ * Requester notices are delivered straight to the requester's channel, not
+ * the guardian-facing notification pipeline, and the guardian stays
+ * passive, since the withdrawn card already reflects expiry.
  *
  * Unreachable-gateway posture: log and skip the round — the next tick
  * retries, and expiry only ever moves forward.
@@ -21,9 +29,11 @@
 import { withdrawGuardianRequestCards } from "../../approvals/guardian-card-withdrawal.js";
 import { notifyExpiredGuardianRequest } from "../../approvals/guardian-expiry-notifier.js";
 import {
+  expireGuardianRequest,
   type GuardianRequestWire,
-  sweepExpiredGuardianRequests,
+  listExpiredPendingGuardianRequests,
 } from "../../channels/gateway-guardian-requests.js";
+import { reconcileGuardianFeedProjections } from "../../notifications/guardian-feed-projection.js";
 import { getLogger } from "../../util/logger.js";
 
 const log = getLogger("guardian-expiry-sweep");
@@ -31,6 +41,12 @@ const log = getLogger("guardian-expiry-sweep");
 /** Interval at which the expiry sweep runs (60 seconds). */
 const SWEEP_INTERVAL_MS = 60_000;
 
+/**
+ * Requests handled per round. Bounds every round's IPC payload and fan-out
+ * however large a backlog grows; the remainder drains on later rounds.
+ */
+const SWEEP_BATCH_LIMIT = 50;
+
 /** Timer handle for the sweep so it can be stopped in tests and shutdown. */
 let sweepTimer: ReturnType<typeof setInterval> | null = null;
 
@@ -38,15 +54,24 @@ let sweepTimer: ReturnType<typeof setInterval> | null = null;
 let sweepInProgress = false;
 
 /**
- * Run one expiry sweep round: the gateway CAS-expires every pending request
- * past its `expiresAt` (a concurrent decision that wins the race is never
- * overwritten), then the daemon runs the per-request side effects. Returns
- * the count of requests transitioned to expired.
+ * Run one expiry sweep round: read a bounded batch of past-deadline pending
+ * requests, run each one's side effects, then confirm each with the
+ * gateway's per-request expire CAS (a concurrent decision that wins the
+ * race is never overwritten; the CAS requires `pending`). Returns the
+ * count of requests whose full cycle completed.
  */
 export async function runGuardianExpirySweep(): Promise<number> {
-  let expired: GuardianRequestWire[];
+  // Converge the home-feed projection against canonical state on the
+  // same cadence: backfill items for pending requests that lost (or
+  // predate) theirs, and receipt any item still actionable for a
+  // terminal request. Never blocks expiry.
+  await reconcileGuardianFeedProjections().catch((err) => {
+    log.warn({ err }, "Guardian feed reconciliation failed");
+  });
+
+  let stale: GuardianRequestWire[];
   try {
-    expired = await sweepExpiredGuardianRequests();
+    stale = await listExpiredPendingGuardianRequests(SWEEP_BATCH_LIMIT);
   } catch (err) {
     log.warn(
       { err },
@@ -55,9 +80,8 @@ export async function runGuardianExpirySweep(): Promise<number> {
     return 0;
   }
 
-  // The sweep returns the full rows, so the side-effect fan-out can never be
-  // stranded by a failed follow-up read after the status flip.
-  for (const request of expired) {
+  let expiredCount = 0;
+  for (const request of stale) {
     log.info(
       {
         event: "guardian_request_expired",
@@ -65,34 +89,68 @@ export async function runGuardianExpirySweep(): Promise<number> {
         kind: request.kind,
         expiresAt: request.expiresAt,
       },
-      "Expired guardian request via sweep",
+      "Expiring guardian request via sweep",
     );
 
     // Withdraw the now-stale approval cards on every surface. No origin
     // channel — the expiry is system-driven, so all surfaces (including
-    // in-app) are withdrawn. Best-effort and non-throwing.
-    await withdrawGuardianRequestCards({
+    // in-app) are withdrawn. Incomplete withdrawal defers the whole
+    // request: the notice has not been sent yet, so the retry next round
+    // repeats only idempotent card edits, never a delivered notice. A
+    // surface that fails persistently keeps its request in the pending set
+    // with this warning every round, so the stall is observable rather
+    // than silent.
+    const withdrawal = await withdrawGuardianRequestCards({
       request,
       status: "expired",
     });
+    if (!withdrawal.complete) {
+      log.warn(
+        { requestId: request.id },
+        "Card withdrawal incomplete; leaving the request pending for the next round",
+      );
+      continue;
+    }
 
     // Notify the requester their request expired and release any in-memory
-    // pending interaction. Best-effort and non-throwing, like the card
-    // withdrawal above.
-    await notifyExpiredGuardianRequest(request);
+    // pending interaction. A failed notice also defers the request: an
+    // unsent notice is exactly what a retry can still deliver.
+    const notice = await notifyExpiredGuardianRequest(request);
+    if (!notice.complete) {
+      log.warn(
+        { requestId: request.id },
+        "Expiry notice incomplete; leaving the request pending for the next round",
+      );
+      continue;
+    }
+
+    // The receipt: only after the side effects does the row leave the
+    // pending set. A failure here leaves it discoverable for the next
+    // round rather than silently done; the notice-then-lost-confirmation
+    // window is the one duplicate-notice case, and it is bounded to that
+    // crash or timeout.
+    try {
+      await expireGuardianRequest(request.id);
+      expiredCount += 1;
+    } catch (err) {
+      log.warn(
+        { err, requestId: request.id },
+        "Expire confirmation failed; the next round re-runs this request",
+      );
+    }
   }
 
-  if (expired.length > 0) {
+  if (expiredCount > 0) {
     log.info(
       {
         event: "guardian_expiry_sweep_complete",
-        expiredCount: expired.length,
+        expiredCount,
       },
-      `Guardian expiry sweep: expired ${expired.length} request(s)`,
+      `Guardian expiry sweep: expired ${expiredCount} request(s)`,
     );
   }
 
-  return expired.length;
+  return expiredCount;
 }
 
 /**

package/src/runtime/routes/guardian-form-routes.ts

@@ -0,0 +1,115 @@
+/**
+ * The form-agnostic half of the guardian-form IPC surface.
+ *
+ * A form's own route carries its schema and its wire events; these two are the
+ * same for every form, so a new one gets them without adding routes of its own:
+ *
+ *   - `guardian_form_claim`   the writer takes the form before writing
+ *   - `resolve_guardian_form` the writer reports back, unblocking the command
+ *
+ * The contact forms predate these and keep their own `contact_prompt_claim` /
+ * `resolve_contact_prompt` names, because the gateway that calls them ships
+ * separately from the daemon and an older one still uses the old names. New
+ * forms should use these.
+ */
+
+import { z } from "zod";
+
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import {
+  claimGuardianForm,
+  type GuardianFormResult,
+  resolveGuardianForm,
+} from "../guardian-form-registry.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+const RequestIdParams = z.object({
+  requestId: z.string().describe("The pending form's id."),
+});
+
+const ClaimParams = RequestIdParams.extend({
+  kind: z
+    .string()
+    .optional()
+    .describe(
+      "The form the caller believes it is writing for. Rejected when it is not what the id is holding. Omitted by callers that predate the check.",
+    ),
+});
+
+/**
+ * Hand a writer's report to the call parked on the form.
+ *
+ * Everything but `requestId` and `error` is passed through untouched, so a
+ * form's result is whatever its writer chose to send. An `error` is what makes
+ * it a failure; there is no other flag.
+ */
+export function resolveFormFromCallback({ body = {} }: RouteHandlerArgs): {
+  resolved: boolean;
+} {
+  const {
+    requestId,
+    error,
+    ...rest
+  }: { requestId: string; error?: string } & Record<string, unknown> =
+    body as never;
+
+  const result: GuardianFormResult = error
+    ? { ok: false, error }
+    : { ok: true, ...rest };
+  return resolveGuardianForm(requestId, result);
+}
+
+export function claimForm({ body = {} }: RouteHandlerArgs): {
+  claimed: boolean;
+  reason?: "already_claimed" | "unknown" | "wrong_kind";
+  settleMs?: number;
+} {
+  const { requestId, kind } = ClaimParams.parse(body);
+  return claimGuardianForm(requestId, kind);
+}
+
+const CLAIM_RESPONSE = z.object({
+  claimed: z.boolean(),
+  reason: z.enum(["already_claimed", "unknown", "wrong_kind"]).optional(),
+  settleMs: z
+    .number()
+    .optional()
+    .describe(
+      "How long a granted claim has to report its write back before the waiting call gives up.",
+    ),
+});
+
+export const GUARDIAN_FORM_ROUTES: RouteDefinition[] = [
+  {
+    operationId: "guardian_form_claim",
+    endpoint: "guardian_form_claim",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: claimForm,
+    summary: "Claim a pending guardian form for one submission",
+    description:
+      "Marks a pending form as answered so a second client submitting the same form writes nothing. Returns claimed=false with reason 'already_claimed' when somebody got there first, 'unknown' when no such form is pending, or 'wrong_kind' when the id belongs to a different form than the caller named. A granted claim carries the window its write has to report back in.",
+    tags: ["guardian-forms"],
+    requestBody: ClaimParams,
+    responseBody: CLAIM_RESPONSE,
+  },
+  {
+    operationId: "resolve_guardian_form",
+    endpoint: "resolve_guardian_form",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: resolveFormFromCallback,
+    summary: "Report a guardian form's outcome back to the waiting command",
+    description:
+      "Called by the writer once it has committed (or failed). Fields other than requestId and error are passed through to the parked caller untouched; an error makes the outcome a failure.",
+    tags: ["guardian-forms"],
+    requestBody: RequestIdParams.catchall(z.unknown()),
+    responseBody: z.object({ resolved: z.boolean() }),
+  },
+];

package/src/runtime/routes/inbound-message-handler.ts

@@ -6,7 +6,10 @@
  * messages reach this handler.
  */
 import type { SourceMetadata } from "@vellumai/gateway-client";
-import { resolveInboundEventKind } from "@vellumai/gateway-client";
+import {
+  resolveInboundEventKind,
+  resolveInboundReactionPayload,
+} from "@vellumai/gateway-client";
 import {
   ADMISSION_POLICY_DEFAULT,
   type AdmissionPolicy,
@@ -18,6 +21,7 @@ import {
   attachmentsToContentBlocks,
   type MessageAttachmentInput,
 } from "../../agent/attachments.js";
+import { listGuardianRequestDeliveriesByChat } from "../../channels/gateway-guardian-requests.js";
 import { audienceForReader } from "../../channels/message-audience.js";
 import {
   CHANNEL_IDS,
@@ -88,6 +92,7 @@ import { applyDeterministicTitleIfReplaceable } from "../../persistence/conversa
 import {
   clearPayload,
   findMessageBySourceId,
+  hasInboundEventForSource,
   recordInbound,
 } from "../../persistence/delivery-crud.js";
 import { markProcessed } from "../../persistence/delivery-status.js";
@@ -120,8 +125,8 @@ import { handleGuardianActivationIntercept } from "./inbound-stages/guardian-act
 import { handleGuardianReplyIntercept } from "./inbound-stages/guardian-reply-intercept.js";
 import { prepareChannelInboundContent } from "./inbound-stages/inbound-content-prep.js";
 import {
-  handleSlackReactionIntercept,
-  isSlackReactionEvent,
+  handleReactionIntercept,
+  isReactionEvent,
 } from "./inbound-stages/reaction-intercept.js";
 import { runSecretIngressCheck } from "./inbound-stages/secret-ingress-check.js";
 import { tryTranscribeAudioAttachments } from "./inbound-stages/transcribe-audio.js";
@@ -372,11 +377,13 @@ export async function handleChannelInbound({
   const hasCallbackData =
     typeof body.callbackData === "string" && body.callbackData.length > 0;
 
+  // Only a plain message must carry a body: every other family refers to
+  // another message and legitimately arrives empty (a delete has no
+  // content at all).
   if (
     trimmedContent.length === 0 &&
     !hasAttachments &&
-    !isEdit &&
-    !hasCallbackData
+    eventKind === "message"
   ) {
     throw new BadRequestError("content or attachmentIds is required");
   }
@@ -421,7 +428,7 @@ export async function handleChannelInbound({
     return guardianActivationResponse;
   }
 
-  // ── Slack reaction handling ──
+  // ── Reaction handling ──
   // Reactions are passive channel signals — not messages, and not access
   // attempts. Dispatch them to a dedicated interceptor BEFORE the message
   // pipeline (ACL, admission floor, disk-pressure, conversation binding) so a
@@ -431,10 +438,20 @@ export async function handleChannelInbound({
   // transcript signals in the conversation of the reacted message, and routes
   // a guardian's reaction on an approval card through the guardian decision
   // pipeline. Reactions never mint a conversation and never drive an agent
-  // turn.
-  if (isSlackReactionEvent(body)) {
-    return handleSlackReactionIntercept({
-      callbackData: body.callbackData!,
+  // turn. A family member whose payload does not resolve (no emoji or no
+  // target message id) is dropped as noise here: the kind names the family,
+  // so it must never fall through and be read as a message.
+  if (isReactionEvent(body)) {
+    const reaction = resolveInboundReactionPayload(body);
+    if (!reaction) {
+      log.debug(
+        { sourceChannel, conversationExternalId },
+        "Dropping reaction with unresolvable payload",
+      );
+      return { accepted: true, reaction: "dropped_unresolvable_payload" };
+    }
+    return handleReactionIntercept({
+      reaction,
       sourceChannel,
       sourceInterface,
       conversationExternalId,
@@ -476,7 +493,10 @@ export async function handleChannelInbound({
   // respond to one by minting a verification challenge or creating an access
   // request (LUM-2673). Reaction callbacks never reach this point — the
   // intercept above returns for them.
-  const isCallbackInteraction = hasCallbackData;
+  const isCallbackInteraction =
+    eventKind === "button" ||
+    eventKind === "reaction" ||
+    eventKind === "delete";
 
   // ── Ingress ACL enforcement ──
   const aclResult = await enforceIngressAcl({
@@ -493,26 +513,25 @@ export async function handleChannelInbound({
     assistantId,
     effectiveAdmissionPolicy: effectiveAdmissionPolicyForAcl,
     isCallbackInteraction,
+    // Scoped to deletes: the one family whose wire can name no actor. Any
+    // other kind carrying the flag still faces the full ACL.
+    actorUnattributed:
+      eventKind === "delete" && sourceMetadata?.actorUnattributed === true,
   });
   if (aclResult.earlyResponse) {
     return aclResult.earlyResponse;
   }
   const { resolvedMember } = aclResult;
 
-  // ── Slack delete propagation ──
-  // Slack message_deleted events are forwarded by the gateway with the
-  // sentinel `callbackData = "message_deleted"` and `sourceMetadata.messageId`
-  // set to the original (deleted) message's ts. Short-circuit the rest of
-  // the pipeline: the agent loop should not run for delete notifications,
-  // and routing the event through approval / agent paths would be incorrect.
-  // We mark the stored row as deleted in slackMeta but leave `content`
-  // untouched for audit purposes — rendering elides based on the deletedAt
-  // marker. Gated behind ingress ACL so non-members cannot drive deletes
-  // (matches the edit-intercept policy).
-  // The Slack gate mirrors the reaction intercept's: deletes are ingested
-  // from Slack alone today, and each further channel arrives as its own
-  // decision with its own wire shape.
-  if (sourceChannel === "slack" && eventKind === "delete") {
+  // ── Delete propagation ──
+  // A delete names the original via `sourceMetadata.messageId` and
+  // short-circuits the rest of the pipeline: no agent loop, no approval
+  // routing. The stored row keeps its content for audit; rendering elides on
+  // the deletedAt marker. An attributed delete (the wire names the deleted
+  // message's author, as Slack's does) passed the ingress ACL above; an
+  // unattributed one bypassed it under the ACL's stated contract and applies
+  // only to a row this daemon ingested.
+  if (eventKind === "delete") {
     const deletedMessageTs =
       typeof sourceMetadata?.messageId === "string"
         ? sourceMetadata.messageId
@@ -521,7 +540,7 @@ export async function handleChannelInbound({
     if (!deletedMessageTs) {
       log.debug(
         { conversationExternalId },
-        "Slack message_deleted event missing sourceMetadata.messageId; ignoring",
+        "Delete event missing sourceMetadata.messageId; ignoring",
       );
       return { accepted: true, deleted: false };
     }
@@ -545,6 +564,20 @@ export async function handleChannelInbound({
       if (original) {
         break;
       }
+      // The retry window exists for one race: the original's inbound-event
+      // row is written before its message link lands. A source with no row
+      // at all was never ingested, so nothing can appear by waiting, and
+      // waiting would hold this conversation's serialized lane through the
+      // full miss window for every unrelated delete a busy room produces.
+      if (
+        !hasInboundEventForSource(
+          sourceChannel,
+          conversationExternalId,
+          deletedMessageTs,
+        )
+      ) {
+        break;
+      }
       if (attempt < deleteLookupRetries) {
         log.info(
           {
@@ -564,7 +597,7 @@ export async function handleChannelInbound({
     if (!original) {
       log.debug(
         { conversationExternalId, deletedMessageTs },
-        "No stored message found for Slack delete after retries; ignoring",
+        "No stored message found for delete after retries; ignoring",
       );
       return { accepted: true, deleted: false };
     }
@@ -598,6 +631,9 @@ export async function handleChannelInbound({
         { deletedAt: Date.now() },
       );
       updateMessageMetadata(original.messageId, { providerMeta });
+      // The stamp lands in the store only; stale-marking makes a resident
+      // conversation's next turn reload and see the row as deleted.
+      findConversation(original.conversationId)?.markHistoryStale();
       log.info(
         {
           conversationExternalId,
@@ -618,6 +654,7 @@ export async function handleChannelInbound({
     // (channel, interface, provenance, etc.) untouched. Content column
     // is intentionally not updated.
     updateMessageMetadata(original.messageId, { slackMeta: updatedSlackMeta });
+    findConversation(original.conversationId)?.markHistoryStale();
 
     log.info(
       {
@@ -1168,11 +1205,11 @@ export async function handleChannelInbound({
     // so checking for empty content alone would miss stale callbacks.
     //
     // Reaction events (`reaction:` / `reaction_removed:`) are persisted by
-    // the earlier `isSlackReactionEvent` branch and never reach here; guard
+    // the earlier `isReactionEvent` branch and never reach here; guard
     // explicitly so a future refactor can't let a reaction ts drive a
     // "This approval request has been resolved." edit that would clobber
     // the user's reacted-to message.
-    if (hasCallbackData && !isSlackReactionEvent(body)) {
+    if (hasCallbackData && !isReactionEvent(body)) {
       // Record seen signal even for stale callbacks — the user still interacted
       if (sourceChannel === "telegram" || sourceChannel === "slack") {
         try {
@@ -2106,6 +2143,19 @@ async function runBackfillSlackDmIfCold(params: {
       return;
     }
 
+    // Guardian approval cards posted to this chat are delivery
+    // projections of canonical requests, never conversation content, so
+    // their message ts must not be imported as transcript rows. The
+    // gateway delivery registry is the authority on which messages
+    // those are (it covers cards from every daemon build). An
+    // unreachable gateway aborts the backfill rather than importing a
+    // card: the DM stays cold, so the next inbound message retries.
+    const guardianCardTs = new Set(
+      (await listGuardianRequestDeliveriesByChat("slack", params.channelId))
+        .map((delivery) => delivery.destinationMessageId)
+        .filter((ts): ts is string => typeof ts === "string" && ts.length > 0),
+    );
+
     const seen = readStoredSlackChannelTs(params.conversationId);
     let written = 0;
     // Slack's conversation.history returns most-recent first. Reverse so
@@ -2117,6 +2167,9 @@ async function runBackfillSlackDmIfCold(params: {
       if (seen.has(message.id)) {
         continue;
       }
+      if (guardianCardTs.has(message.id)) {
+        continue;
+      }
       if (await isSlackAssistantThreadPlaceholder(message, params.account)) {
         continue;
       }

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -116,9 +116,9 @@ export interface AclEnforcementParams {
    */
   effectiveAdmissionPolicy?: AdmissionPolicy;
   /**
-   * True when the inbound event is an interaction callback (e.g. a Slack
-   * Block Kit button press or a message_deleted sentinel) rather than a
-   * message the sender composed. Callbacks are decision attempts / lifecycle
+   * True when the inbound event is an interaction callback (a button
+   * press, a reaction, a delete: any kind that is not a composed message
+   * or an edit of one). Callbacks are decision attempts / lifecycle
    * events, not access attempts: a denied callback must never mint a
    * verification challenge or create an access request — a stale button
    * press from an unrecognized sender would otherwise spawn a fresh
@@ -127,6 +127,15 @@ export interface AclEnforcementParams {
    * caller makes the classification explicitly.
    */
   isCallbackInteraction: boolean;
+  /**
+   * The platform named no actor for this event (the id is a channel's
+   * synthetic system identity). There is no identity claim to enforce, so
+   * the ACL neither resolves a member nor denies: the family stage that
+   * consumes such an event applies it only to rows whose author cleared
+   * this ACL when the original message arrived. Callers set this ONLY for
+   * event kinds that cannot start an agent turn.
+   */
+  actorUnattributed?: boolean;
 }
 
 /**
@@ -206,6 +215,10 @@ export async function enforceIngressAcl(
     isCallbackInteraction,
   } = params;
 
+  if (params.actorUnattributed) {
+    return { resolvedMember: null };
+  }
+
   let validatedBootstrapSession: VerificationSessionWire | undefined;
 
   // Identity signals forwarded via sourceMetadata: bot flag (Slack users.info

package/src/runtime/routes/inbound-stages/edit-intercept.ts

@@ -16,6 +16,7 @@
  * resolvable target is dropped.
  */
 import type { ChannelId } from "../../../channels/types.js";
+import { findConversation } from "../../../daemon/conversation-registry.js";
 import {
   mergeSlackMetadata,
   readSlackMetadata,
@@ -227,6 +228,11 @@ export async function handleEditIntercept(
   // path, so reindex the message into the lexical index — the idempotent
   // upsert replaces the stale Qdrant point with the edited content.
   enqueueLexicalIndexForMessage(original.messageId);
+  // The rewrite lands in the store only; a resident conversation keeps the
+  // pre-edit text in memory until it reloads, so the next turn would answer
+  // a revision the sender already replaced. Stale-marking makes that turn's
+  // history reload pick up the edit.
+  findConversation(original.conversationId)?.markHistoryStale();
   markProcessed(editResult.eventId);
   log.info(
     { assistantId, sourceMessageId, messageId: original.messageId },

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.test.ts

@@ -9,7 +9,13 @@ let mockIdentityRequests: { id: string }[] = [];
 let routeGuardianReplyCalls: unknown[] = [];
 let deliverChannelReplyCalls: unknown[][] = [];
 
+// Spread the actual module so transitive importers of names this
+// factory does not stub keep resolving (a partial factory breaks at
+// import time when the graph gains a new named import).
+const actualGatewayGuardianRequests =
+  await import("../../../channels/gateway-guardian-requests.js");
 mock.module("../../../channels/gateway-guardian-requests.js", () => ({
+  ...actualGatewayGuardianRequests,
   listPendingRequestsByDestinationOrEmpty: async () =>
     mockDeliveryScopedRequests,
   listGuardianRequestsOrEmpty: async () => mockIdentityRequests,

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.ts

@@ -9,6 +9,8 @@
  * Extracted from inbound-message-handler.ts to keep the top-level handler
  * focused on orchestration.
  */
+import type { InboundReactionPayload } from "@vellumai/gateway-client";
+
 import {
   listGuardianRequestsOrEmpty,
   listPendingRequestsByDestinationOrEmpty,
@@ -35,6 +37,7 @@ export interface GuardianReplyInterceptParams {
   trimmedContent: string;
   hasCallbackData: boolean;
   callbackData: string | undefined;
+  reaction?: InboundReactionPayload;
   /**
    * For emoji-reaction decisions: the channel-native id (Slack `ts`) of the
    * message the reaction was attached to. Threaded to the router so it can
@@ -81,6 +84,7 @@ export async function handleGuardianReplyIntercept(
     trimmedContent,
     hasCallbackData,
     callbackData,
+    reaction,
     reactedMessageTs,
     rawSenderId,
     canonicalSenderId,
@@ -136,7 +140,7 @@ export async function handleGuardianReplyIntercept(
   // Reactions address one specific request by the reacted card's message id,
   // so they bypass the pending-request list scoping that the text/NL paths
   // need — the router's reaction branch resolves the target directly.
-  const isReaction = callbackData?.startsWith("reaction:") === true;
+  const isReaction = reaction !== undefined;
   let pendingScope: GuardianPendingScope | undefined;
   if (!isReaction) {
     // Hint reads degrade to empty on gateway failure: Slack then blocks the
@@ -178,6 +182,7 @@ export async function handleGuardianReplyIntercept(
     },
     conversationId,
     callbackData,
+    ...(reaction ? { reaction } : {}),
     reactedMessageTs,
     pendingScope,
     approvalConversationGenerator,