@vellumai/assistant 0.11.8 → 0.11.9-staging.1

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -19,6 +19,7 @@ import {
 } from "../../../contacts/guardian-delivery-reader.js";
 import { isConversationBusyError } from "../../../daemon/conversation-messaging.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
+import type { ProviderMessageMetadata } from "../../../messaging/provider-message-metadata.js";
 import {
   channelActivityRefreshMs,
   setChannelActivity,
@@ -27,6 +28,7 @@ import {
 import {
   getSiblingStreamedReplyTs,
   linkMessage,
+  storeInboundChannelMetadata,
   storeInboundSlackMetadata,
   storeReplyMessageId,
   storeStreamedReplyTs,
@@ -34,6 +36,7 @@ import {
 import {
   deferRetryUntilIdle,
   isDeduplicatedDeliveryOwnedBySibling,
+  markDeliveryDelivered,
   markProcessed,
   recordProcessingFailure,
 } from "../../../persistence/delivery-status.js";
@@ -45,6 +48,7 @@ import {
   getApprovalInfoByConversation,
   getChannelApprovalPrompt,
 } from "../../channel-approvals.js";
+import { createChannelReplySession } from "../../channel-reply-session.js";
 import { deliverChannelReply } from "../../gateway-client.js";
 import type {
   ApprovalCopyGenerator,
@@ -52,7 +56,6 @@ import type {
   SlackInboundMessageMetadata,
 } from "../../http-types.js";
 import { hasDeliverableAssistantText } from "../../no-response.js";
-import { createSlackReplySession } from "../../slack-reply-session.js";
 import { isContactTrustClass } from "../../trust-class.js";
 import { resolveRoutingState } from "../../trust-context-resolver.js";
 import { finalizeEventDelivery } from "../channel-delivery-routes.js";
@@ -110,6 +113,30 @@ export interface BackgroundProcessingParams {
    * `slackMeta` envelope for the chronological renderer.
    */
   slackInbound?: SlackInboundMessageMetadata;
+  /**
+   * Neutral per-row channel envelope for non-Slack channels, the counterpart
+   * of `slackInbound`: threaded through to `persistUserMessage` so the row
+   * is tagged with `providerMeta` and can say which external message it is.
+   * A reaction-driven wake turn rides the same lane with its reaction
+   * envelope, so the turn's own persisted row IS the reaction row.
+   */
+  channelInbound?: ProviderMessageMetadata;
+  /** See `ProcessMessageOptions.slackReactionRowMeta`. TRANSITIONAL. */
+  slackReactionRowMeta?: string;
+  /** Explicit idempotency key for this turn's persisted row. */
+  clientMessageId?: string;
+  /** Persist the triggering row without indexing it. */
+  skipUserMessageIndexing?: boolean;
+  /**
+   * Called when the turn could not run because a non-channel turn re-took
+   * the processing lock after admission. When present it REPLACES the
+   * retry-sweep deferral: that lane rebuilds a turn from its stored payload
+   * as a plain message, so a caller whose event stores nothing a turn can be
+   * rebuilt from (a reaction wake, whose payload is delivery-only) degrades
+   * through this hook instead, e.g. by persisting the passive row the turn
+   * would have created.
+   */
+  onTurnLostToBusy?: () => Promise<void>;
 }
 
 /**
@@ -141,16 +168,26 @@ export function processChannelMessageInBackground(
     clientTimezone,
     slackBotMentioned,
     slackInbound,
+    channelInbound,
+    slackReactionRowMeta,
+    clientMessageId,
+    skipUserMessageIndexing,
+    onTurnLostToBusy,
   } = params;
 
-  // Capture the Slack ingress metadata onto the stored payload up front — before
-  // the admission wait or any processing — so if the daemon dies mid-wait or
-  // mid-turn, the retry sweep replays with the SAME `slackInbound` this turn
-  // used. That keeps the derived idempotency key identical (the replay dedups
-  // against a turn this attempt already persisted) and carries full slackMeta.
+  // Capture the channel ingress metadata onto the stored payload up front,
+  // before the admission wait or any processing, so if the daemon dies
+  // mid-wait or mid-turn, the retry sweep replays with the SAME envelope this
+  // turn used. For Slack that keeps the derived idempotency key identical
+  // (the replay dedups against a turn this attempt already persisted) and
+  // carries full slackMeta; for every other channel it carries the same
+  // `providerMeta` onto the replayed row.
   if (slackInbound) {
     storeInboundSlackMetadata(eventId, slackInbound);
   }
+  if (channelInbound) {
+    storeInboundChannelMetadata(eventId, channelInbound);
+  }
 
   // Defer the whole turn + delivery until the conversation's processing lock is
   // free, serialized per conversation so same-conversation replies stay ordered.
@@ -210,9 +247,7 @@ export function processChannelMessageInBackground(
             }
           : undefined;
       let replyMessageId: string | undefined;
-      const slackReplySession = createSlackReplySession({
-        sourceChannel,
-        chatType,
+      const replySession = createChannelReplySession({
         replyCallbackUrl,
         chatId: externalChatId,
         recipientUserId: slackInbound?.actorExternalUserId,
@@ -230,7 +265,7 @@ export function processChannelMessageInBackground(
         ) {
           replyMessageId = msg.messageId;
         }
-        slackReplySession?.observeEvent(msg);
+        replySession?.observeEvent(msg);
         channelActivity?.observeEvent(msg);
       };
 
@@ -252,6 +287,10 @@ export function processChannelMessageInBackground(
           ...(displayContent !== undefined ? { displayContent } : {}),
           ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
           ...(slackInbound ? { slackInbound } : {}),
+          ...(channelInbound ? { channelInbound } : {}),
+          ...(slackReactionRowMeta ? { slackReactionRowMeta } : {}),
+          ...(clientMessageId ? { clientMessageId } : {}),
+          ...(skipUserMessageIndexing ? { skipUserMessageIndexing } : {}),
           onEvent: observeAgentEvent,
           sourceChannel,
           sourceInterface,
@@ -259,22 +298,40 @@ export function processChannelMessageInBackground(
         userMessageId = result.messageId;
         deduplicatedIngress = result.deduplicated === true;
         linkMessage(eventId, userMessageId);
-        markProcessed(eventId);
+        // Record the reply row BEFORE marking the event processed. Stranded
+        // delivery recovery treats `processed` as the point an event becomes
+        // eligible and reads the reply id from the stored payload, so an
+        // event that becomes eligible first would be skipped by that step
+        // and never deliver. Crashing between these two leaves the row
+        // `pending` instead, which the orphan step already recovers.
         replyMessageId ??= result.assistantMessageId;
         if (replyMessageId) {
           storeReplyMessageId(eventId, replyMessageId);
         }
+        markProcessed(eventId);
       } catch (err) {
         // Stop any live Slack stream cleanly. Its `ts` is already durably
         // recorded via `onStreamOpen`, so the retry sweep can reconcile
         // against that message rather than posting a duplicate.
-        await slackReplySession?.finish();
+        await replySession?.finish();
         if (isConversationBusyError(err)) {
+          if (onTurnLostToBusy) {
+            // The sweep's processing lane cannot rebuild this turn (see the
+            // hook's doc), so the caller degrades in its own way instead.
+            // Nothing was persisted: the busy error is thrown before the
+            // row insert.
+            log.info(
+              { conversationId, eventId },
+              "Channel turn lost the processing lock after admission; degrading via caller fallback",
+            );
+            await onTurnLostToBusy();
+            return;
+          }
           // Admission observed the conversation idle, but a non-channel turn
           // (web / wake / voice) re-took the processing lock before this turn
           // could. Re-schedule for the retry sweep without burning a retry
           // attempt (`deferRetryUntilIdle`) so it reprocesses and delivers from
-          // the stored payload once the lock frees — a plain processing-failure
+          // the stored payload once the lock frees: a plain processing-failure
           // record would classify the busy message as fatal and dead-letter it
           // (a silent drop), and even a retryable one could exhaust the budget
           // under sustained contention.
@@ -289,6 +346,13 @@ export function processChannelMessageInBackground(
           { err, conversationId },
           "Background channel message processing failed",
         );
+        if (onTurnLostToBusy) {
+          // A caller that opted out of sweep replay has no retry lane at
+          // all: its event is already marked processed, so a failure record
+          // would only feed the sweep an event it cannot rebuild. The
+          // best-effort turn is simply lost.
+          return;
+        }
         recordProcessingFailure(eventId, err);
         return;
       }
@@ -330,6 +394,10 @@ export function processChannelMessageInBackground(
           { conversationId, eventId },
           "Skipping channel reply delivery for deduplicated ingress event; a prior attempt owns delivery",
         );
+        // The sibling owns delivery, so settle this row rather than leaving it
+        // `pending`, which stranded-delivery recovery reads as delivery still
+        // owed and would act on after a restart.
+        markDeliveryDelivered(eventId);
       } else if (replyCallbackUrl) {
         try {
           await finalizeEventDelivery({
@@ -340,7 +408,7 @@ export function processChannelMessageInBackground(
             assistantId,
             replyMessageId,
             userMessageId,
-            slackReplySession,
+            replySession,
             ...(recoveredStreamMessageTs
               ? { priorStreamMessageTs: recoveredStreamMessageTs }
               : {}),

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.ts

@@ -9,7 +9,6 @@
  * Extracted from inbound-message-handler.ts to keep the top-level handler
  * focused on orchestration.
  */
-import type { InboundReactionPayload } from "@vellumai/gateway-client";
 
 import {
   listGuardianRequestsOrEmpty,
@@ -37,22 +36,11 @@ export interface GuardianReplyInterceptParams {
   trimmedContent: string;
   hasCallbackData: boolean;
   callbackData: string | undefined;
-  reaction?: InboundReactionPayload;
-  /**
-   * For emoji-reaction decisions: the channel-native id (Slack `ts`) of the
-   * message the reaction was attached to. Threaded to the router so it can
-   * recover the target request from the reacted card's delivery record.
-   */
-  reactedMessageTs?: string;
   rawSenderId: string | undefined;
   canonicalSenderId: string | null;
   sourceChannel: ChannelId;
   conversationExternalId: string;
-  /**
-   * Conversation the message arrived in. Reactions resolve their target by the
-   * reacted card's own address and are routed before any conversation is
-   * known, so they pass none.
-   */
+  /** Conversation the message arrived in. */
   conversationId?: string;
   /** Inbound event id, echoed on the consumed response when the caller has one. */
   eventId?: string;
@@ -84,8 +72,6 @@ export async function handleGuardianReplyIntercept(
     trimmedContent,
     hasCallbackData,
     callbackData,
-    reaction,
-    reactedMessageTs,
     rawSenderId,
     canonicalSenderId,
     sourceChannel,
@@ -137,43 +123,34 @@ export async function handleGuardianReplyIntercept(
   // guardian can reply before the row is persisted. Cross-chat
   // contamination is unlikely there because each chat is a distinct
   // conversation with no thread concept.
-  // Reactions address one specific request by the reacted card's message id,
-  // so they bypass the pending-request list scoping that the text/NL paths
-  // need — the router's reaction branch resolves the target directly.
-  const isReaction = reaction !== undefined;
   let pendingScope: GuardianPendingScope | undefined;
-  if (!isReaction) {
-    // Hint reads degrade to empty on gateway failure: Slack then blocks the
-    // identity fallback (safe), other channels keep it (unchanged posture).
-    const deliveryScopedPendingRequests =
-      await listPendingRequestsByDestinationOrEmpty({
-        channel: sourceChannel,
-        chatId: conversationExternalId,
-      });
-    if (deliveryScopedPendingRequests.length > 0) {
-      const deliveryIds = new Set(
-        deliveryScopedPendingRequests.map((r) => r.id),
-      );
-      // Also include identity-based pending requests so we don't hide them
-      const identityId = canonicalSenderId ?? rawSenderId!;
-      const identityPending = await listGuardianRequestsOrEmpty({
-        status: "pending",
-        guardianExternalUserId: identityId,
-      });
-      for (const r of identityPending) {
-        deliveryIds.add(r.id);
-      }
-      pendingScope = { mode: "scoped", requestIds: [...deliveryIds] };
-    } else if (sourceChannel === "slack") {
-      // Block identity-based fallback on Slack to prevent cross-chat
-      // NL/free-text interception. See comment above for rationale.
-      pendingScope = { mode: "blocked" };
+  // Hint reads degrade to empty on gateway failure: Slack then blocks the
+  // identity fallback (safe), other channels keep it (unchanged posture).
+  const deliveryScopedPendingRequests =
+    await listPendingRequestsByDestinationOrEmpty({
+      channel: sourceChannel,
+      chatId: conversationExternalId,
+    });
+  if (deliveryScopedPendingRequests.length > 0) {
+    const deliveryIds = new Set(deliveryScopedPendingRequests.map((r) => r.id));
+    // Also include identity-based pending requests so we don't hide them
+    const identityId = canonicalSenderId ?? rawSenderId!;
+    const identityPending = await listGuardianRequestsOrEmpty({
+      status: "pending",
+      guardianExternalUserId: identityId,
+    });
+    for (const r of identityPending) {
+      deliveryIds.add(r.id);
     }
+    pendingScope = { mode: "scoped", requestIds: [...deliveryIds] };
+  } else if (sourceChannel === "slack") {
+    // Block identity-based fallback on Slack to prevent cross-chat
+    // NL/free-text interception. See comment above for rationale.
+    pendingScope = { mode: "blocked" };
   }
 
   const routerResult = await routeGuardianReply({
     messageText: trimmedContent,
-    channel: sourceChannel,
     actor: {
       actorPrincipalId: guardianPrincipalId ?? undefined,
       actorExternalUserId: canonicalSenderId ?? rawSenderId!,
@@ -182,8 +159,6 @@ export async function handleGuardianReplyIntercept(
     },
     conversationId,
     callbackData,
-    ...(reaction ? { reaction } : {}),
-    reactedMessageTs,
     pendingScope,
     approvalConversationGenerator,
     channelDeliveryContext: {