@vellumai/assistant 0.11.8 → 0.11.9-staging.2

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -441,7 +441,7 @@ const NAMESPACE_IMPORT = "*";
  *  namespace import yields the {@link NAMESPACE_IMPORT} sentinel — it reaches
  *  the whole surface, so it must not slip past the anti-backslide check. */
 function symbolsImportedFrom(source: string, hostPathSuffix: string): string[] {
-  const escaped = hostPathSuffix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const escaped = RegExp.escape(hostPathSuffix);
   const from = String.raw`\s*from\s*['"]([^'"]*` + escaped + String.raw`)['"]`;
   const namedRegex = new RegExp(
     String.raw`import\s+(?:type\s+)?\{([^}]*)\}` + from,

package/src/__tests__/pricing.test.ts

@@ -224,6 +224,17 @@ describe("resolvePricing", () => {
       );
     });
 
+    test("returns priced for gemini-3.8-flash", () => {
+      const result = resolvePricing(
+        "gemini",
+        "gemini-3.8-flash",
+        1_000_000,
+        1_000_000,
+      );
+      expect(result.pricingStatus).toBe("priced");
+      expect(result.estimatedCostUsd).toBe(1.5 + 7.5);
+    });
+
     test("returns priced for gemini-3-flash-preview", () => {
       const result = resolvePricing(
         "gemini",

package/src/__tests__/process-message-display-content.test.ts

@@ -160,6 +160,7 @@ function makeTestConversation() {
     size: () => 0,
   } as unknown as MessageQueue;
   let processing = false;
+  let owner = 0;
   const messagingCtx: MessagingConversationContext = {
     conversationId: "conv-display-content",
     messages,
@@ -167,6 +168,21 @@ function makeTestConversation() {
     setProcessing: (value: boolean) => {
       processing = value;
     },
+    acquireProcessingFenced: async () => {
+      if (processing) {
+        return null;
+      }
+      processing = true;
+      owner += 1;
+      return owner;
+    },
+    releaseProcessing: (claim: number) => {
+      if (claim !== owner) {
+        return false;
+      }
+      processing = false;
+      return true;
+    },
     abortController: null,
     queue: queueStub,
     getTurnChannelContext: () => turnChannelContext,
@@ -398,20 +414,15 @@ describe("processMessage displayContent", () => {
       type: "text",
       text: modelContent,
     });
-    const inMemoryFileBlock = inMemoryMessage.content[1] as unknown as Record<
-      string,
-      unknown
-    >;
-    expect(inMemoryFileBlock._attachmentId).toBe("att-1");
-    expect(inMemoryFileBlock).toMatchObject({
+    expect(inMemoryMessage.content[1]).toEqual({
       type: "file",
       source: {
-        type: "base64",
+        type: "workspace_ref",
         media_type: "application/pdf",
-        data: Buffer.from("pdf bytes").toString("base64"),
+        attachmentId: "att-stored",
+        sizeBytes: 9,
         filename: "attachment.pdf",
       },
-      extracted_text: undefined,
     });
   });
 

package/src/__tests__/processing-acquire-fenced-guard.test.ts

@@ -0,0 +1,56 @@
+/**
+ * Every acquisition of the processing flag goes through the fenced helper.
+ *
+ * `acquireProcessing` hands back a live claim, and the marker fence that has
+ * to follow it can fail. A site that calls the two itself owns the ordering,
+ * and getting it wrong (fencing outside the try whose finally releases) leaves
+ * the conversation processing for good with every later send queued behind a
+ * dead hold. `acquireProcessingFenced` owns that ordering once, so the rule is
+ * simply that nothing else calls the primitive.
+ */
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+/** Where the primitive and its fenced wrapper legitimately live together. */
+const OWNER_FILE = join("src", "daemon", "conversation.ts");
+
+function sourceFiles(dir: string, found: string[] = []): string[] {
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) {
+      if (entry !== "node_modules" && entry !== "__tests__") {
+        sourceFiles(full, found);
+      }
+      continue;
+    }
+    if (entry.endsWith(".ts") && !entry.endsWith(".test.ts")) {
+      found.push(full);
+    }
+  }
+  return found;
+}
+
+describe("processing flag acquisition", () => {
+  test("only the fenced helper calls the raw acquire", () => {
+    const offenders = sourceFiles("src").filter(
+      (file) =>
+        file !== OWNER_FILE &&
+        /\bacquireProcessing\s*\(\s*\)/.test(readFileSync(file, "utf8")),
+    );
+
+    expect(offenders).toEqual([]);
+  });
+
+  test("only the fenced helper awaits the marker fence", () => {
+    // Same rule for the other half: a site that awaits the fence itself is a
+    // site that can await it in the wrong place.
+    const offenders = sourceFiles("src").filter(
+      (file) =>
+        file !== OWNER_FILE &&
+        /\bensureProcessingMarker\s*\(/.test(readFileSync(file, "utf8")),
+    );
+
+    expect(offenders).toEqual([]);
+  });
+});

package/src/__tests__/provider-meta-persistence.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from "bun:test";
+
+import { buildProviderMetaForPersistence } from "../daemon/conversation-messaging.js";
+import type { ProviderMessageMetadata } from "../messaging/provider-message-metadata.js";
+import { readProviderMetadata } from "../messaging/read-provider-metadata.js";
+
+const telegramInbound: ProviderMessageMetadata = {
+  source: "telegram",
+  conversationExternalId: "chat-42",
+  messageId: "msg-100",
+  threadId: "topic-7",
+  actorExternalId: "user-9",
+  displayName: "Alice",
+  eventKind: "message",
+};
+
+describe("buildProviderMetaForPersistence", () => {
+  test("a matching non-Slack turn persists an envelope the neutral reader round-trips", () => {
+    const serialized = buildProviderMetaForPersistence({
+      channelInbound: telegramInbound,
+      turnChannel: "telegram",
+    });
+    expect(serialized).not.toBeNull();
+
+    // The stored row's metadata JSON carries the envelope under the
+    // `providerMeta` key; the canonical reader must resolve it.
+    const rowMetadata = JSON.stringify({
+      userMessageChannel: "telegram",
+      providerMeta: serialized,
+    });
+    const read = readProviderMetadata(rowMetadata);
+    expect(read).toEqual(telegramInbound);
+  });
+
+  test("a Slack turn never gains a providerMeta key", () => {
+    expect(
+      buildProviderMetaForPersistence({
+        channelInbound: { ...telegramInbound, source: "slack" },
+        turnChannel: "slack",
+      }),
+    ).toBeNull();
+  });
+
+  test("a turn channel that does not match the envelope's source is refused", () => {
+    expect(
+      buildProviderMetaForPersistence({
+        channelInbound: telegramInbound,
+        turnChannel: "discord",
+      }),
+    ).toBeNull();
+    expect(
+      buildProviderMetaForPersistence({
+        channelInbound: telegramInbound,
+        turnChannel: undefined,
+      }),
+    ).toBeNull();
+  });
+
+  test("an absent envelope persists nothing", () => {
+    expect(
+      buildProviderMetaForPersistence({
+        channelInbound: undefined,
+        turnChannel: "telegram",
+      }),
+    ).toBeNull();
+  });
+});

package/src/__tests__/reaction-persistence.test.ts

@@ -20,6 +20,15 @@ mock.module("../config/env.js", () => ({
 }));
 
 const _conversationMocks = new Map<string, unknown>();
+// Wake dispatches are captured, not run: this suite pins persistence, and
+// the real background machinery would race the assertions.
+const dispatchedWakes: Array<Record<string, unknown>> = [];
+mock.module("../runtime/routes/inbound-stages/background-dispatch.js", () => ({
+  processChannelMessageInBackground: (params: Record<string, unknown>) => {
+    dispatchedWakes.push(params);
+  },
+}));
+
 mock.module("../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => _conversationMocks.get(id),
 }));
@@ -78,14 +87,12 @@ import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { linkMessage, recordInbound } from "../persistence/delivery-crud.js";
 import { messages } from "../persistence/schema/conversations.js";
-import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { isReactionEvent } from "../runtime/routes/inbound-stages/reaction-intercept.js";
 import {
   handleChannelInbound,
   seedContactChannel,
 } from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
-import { bridgeState } from "./helpers/gateway-guardian-requests-store-bridge.js";
 
 await initializeDb();
 
@@ -286,6 +293,8 @@ describe("Slack reaction event persistence", () => {
     expect(slackMeta!.actorExternalUserId).toBe(SLACK_USER_ID);
     expect(slackMeta!.reaction).toEqual({
       emoji: "thumbsup",
+      emojiKind: "shortcode",
+      emojiName: "thumbsup",
       actorDisplayName: SLACK_DISPLAY_NAME,
       targetChannelTs: "1700000000.111111",
       op: "added",
@@ -490,13 +499,21 @@ describe("Slack reaction event persistence", () => {
       TEST_BEARER_TOKEN,
     );
     expect(resp.status).toBe(200);
-
+    const body = (await resp.json()) as Record<string, unknown>;
+
+    // An admitted actor adding a reaction to the assistant's own post wakes
+    // a discretion turn instead of writing the passive row here: the turn's
+    // own persisted user row is the reaction row.
+    expect(body.reaction).toBe("wake_dispatched");
+    expect(dispatchedWakes).toHaveLength(1);
+    expect(dispatchedWakes[0].conversationId).toBe(conversationId);
+    expect(typeof dispatchedWakes[0].slackReactionRowMeta).toBe("string");
     const reactionRow = db.$client
       .prepare(
         "SELECT conversation_id AS conversationId FROM messages WHERE content = '[reaction]'",
       )
       .get() as { conversationId: string } | null;
-    expect(reactionRow?.conversationId).toBe(conversationId);
+    expect(reactionRow).toBeNull();
   });
 
   test("a reaction leaves the reacted message resolvable by its own id", async () => {
@@ -606,200 +623,6 @@ describe("Slack reaction event persistence", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Guardian approval-by-reaction integration test
-// ---------------------------------------------------------------------------
-//
-// Verifies that approval interception runs before reaction persistence so a
-// guardian's `reaction:` event on a pending approval prompt applies the
-// decision and no transcript-line row is written for the reaction itself.
-
-const GUARDIAN_USER_ID = "U_GUARDIAN_REACT";
-const GUARDIAN_DISPLAY_NAME = "Guardian Reactor";
-const GUARDIAN_REACTION_TOOL = "execute_shell";
-const GUARDIAN_REACTION_INPUT = { command: "rm -rf /tmp/test" };
-
-function seedGuardianForChannel(): void {
-  seedGatewayGuardian({
-    channelType: "slack",
-    address: GUARDIAN_USER_ID,
-    principalId: GUARDIAN_USER_ID,
-    externalChatId: SLACK_CHANNEL_ID,
-  });
-  createGuardianBinding({
-    channel: "slack",
-    guardianExternalUserId: GUARDIAN_USER_ID,
-    guardianDeliveryChatId: SLACK_CHANNEL_ID,
-    guardianPrincipalId: GUARDIAN_USER_ID,
-  });
-}
-
-function seedPendingGuardianApprovalForReaction(
-  requestId: string,
-  conversationId: string,
-  reactedTs: string,
-): void {
-  // Canonical tool_approval request keyed by the confirmation requestId — the
-  // same record assistant-event-hub creates for every confirmation.
-  bridgeState.seedRequest({
-    id: requestId,
-    kind: "tool_approval",
-    sourceType: "channel",
-    sourceChannel: "slack",
-    sourceConversationId: conversationId,
-    requesterExternalUserId: "requester-user-1",
-    requesterChatId: SLACK_CHANNEL_ID,
-    guardianExternalUserId: GUARDIAN_USER_ID,
-    guardianPrincipalId: GUARDIAN_USER_ID,
-    toolName: GUARDIAN_REACTION_TOOL,
-    status: "pending",
-    expiresAt: Date.now() + 300_000,
-  });
-
-  // The delivered approval card → request mapping the reaction resolves
-  // against (destination message id = the reacted Slack ts).
-  bridgeState.seedDelivery({
-    requestId,
-    destinationChannel: "slack",
-    destinationChatId: SLACK_CHANNEL_ID,
-    destinationMessageId: reactedTs,
-  });
-
-  // Register a pending interaction so the tool_approval resolver finds the
-  // requester-side hook to drive `allow`.
-  const handleConfirmationResponse = mock(() => {});
-  const _mockSession = {
-    handleConfirmationResponse,
-    ensureActorScopedHistory: async () => {},
-  } as unknown as Conversation;
-  _conversationMocks.set(conversationId, _mockSession);
-  pendingInteractions.register(requestId, {
-    conversationId,
-    kind: "confirmation",
-    confirmationDetails: {
-      toolName: GUARDIAN_REACTION_TOOL,
-      input: GUARDIAN_REACTION_INPUT,
-      riskLevel: "high",
-      allowlistOptions: [
-        { label: "test", description: "test", pattern: "test" },
-      ],
-      scopeOptions: [{ label: "everywhere", scope: "everywhere" }],
-    },
-  });
-}
-
-describe("guardian approval-by-reaction integration via handleChannelInbound", () => {
-  beforeEach(() => {
-    const db = getDb();
-    db.run("DELETE FROM messages");
-    db.run("DELETE FROM channel_inbound_events");
-    db.run("DELETE FROM conversations");
-    db.run("DELETE FROM contact_channels");
-    db.run("DELETE FROM contacts");
-    bridgeState.reset();
-    gatewayGuardians = [];
-    pendingInteractions.clear();
-    msgCounter = 0;
-  });
-
-  test("guardian reaction on pending approval applies decision and persists no transcript row", async () => {
-    seedGuardianForChannel();
-    const requestId = "req-guardian-react-1";
-    // Back the guardian request and its pending interaction with a real
-    // conversation row, inserted directly via the DB layer.
-    const db = getDb();
-    const conversationId = "conv-react-test-1";
-    const now = Date.now();
-    db.$client
-      .prepare(
-        `INSERT INTO conversations (
-          id, title, created_at, updated_at, total_input_tokens, total_output_tokens,
-          total_estimated_cost, context_compacted_message_count, conversation_type,
-          source, memory_scope_id, host_access, is_auto_title
-        ) VALUES (?, NULL, ?, ?, 0, 0, 0, 0, 'standard', 'user', 'default', 0, 1)`,
-      )
-      .run(conversationId, now, now);
-
-    const reactedTs = "1700000099.000001";
-    // The approval card was delivered on this ts; its canonical delivery row
-    // is how the guardian reaction is scoped to a known approval message.
-    seedPendingGuardianApprovalForReaction(
-      requestId,
-      conversationId,
-      reactedTs,
-    );
-
-    const body = {
-      sourceChannel: "slack",
-      interface: "slack",
-      conversationExternalId: SLACK_CHANNEL_ID,
-      externalMessageId: `${SLACK_CHANNEL_ID}:${reactedTs}:guardian-react`,
-      content: "reaction:white_check_mark",
-      callbackData: "reaction:white_check_mark",
-      actorExternalId: GUARDIAN_USER_ID,
-      actorDisplayName: GUARDIAN_DISPLAY_NAME,
-      replyCallbackUrl: "http://localhost:7830/deliver/slack",
-      sourceMetadata: {
-        messageId: reactedTs,
-        chatType: "channel",
-      },
-    };
-    const req = new Request("http://localhost:8080/channels/inbound", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Gateway-Origin": TEST_BEARER_TOKEN,
-      },
-      body: JSON.stringify(body),
-    });
-
-    // Wire a non-undefined `approvalConversationGenerator` to mirror the
-    // production configuration. The deterministic reaction handler must
-    // short-circuit before the generator is consulted — if it runs, it
-    // returns `keep_pending` so the assertions below would fail loudly.
-    const approvalConversationGenerator = mock(async () => ({
-      disposition: "keep_pending" as const,
-      replyText: "mock conversational turn should not be invoked for reactions",
-    }));
-
-    const resp = await handleChannelInbound(
-      req,
-      undefined,
-      TEST_BEARER_TOKEN,
-      undefined,
-      approvalConversationGenerator,
-    );
-    const json = (await resp.json()) as Record<string, unknown>;
-
-    expect(resp.status).toBe(200);
-    expect(json.accepted).toBe(true);
-    expect(json.canonicalRouter).toBe("canonical_decision_applied");
-    expect(approvalConversationGenerator).not.toHaveBeenCalled();
-
-    // The guardian request is resolved (no longer pending).
-    expect(bridgeState.getRequest(requestId)?.status).toBe("approved");
-
-    // No transcript row was written for the reaction itself — resolved
-    // guardian approval reactions have no transcript representation.
-    const reactionRows = readPersistedMessages().filter((row) => {
-      if (!row.metadata) {
-        return false;
-      }
-      try {
-        const env = JSON.parse(row.metadata) as Record<string, unknown>;
-        if (typeof env.slackMeta !== "string") {
-          return false;
-        }
-        const meta = readSlackMetadata(env.slackMeta);
-        return meta?.eventKind === "reaction";
-      } catch {
-        return false;
-      }
-    });
-    expect(reactionRows.length).toBe(0);
-  });
-});
-
 // ---------------------------------------------------------------------------
 // Reaction access-control regression (LUM-2489)
 // ---------------------------------------------------------------------------
@@ -813,6 +636,7 @@ describe("guardian approval-by-reaction integration via handleChannelInbound", (
 describe("reaction access control (no verification handshake)", () => {
   const STRANGER_USER_ID = "U_REACTION_STRANGER";
   const CONTACT_USER_ID = "U_REACTION_CONTACT";
+  const GUARDIAN_USER_ID = "U_GUARDIAN_REACT";
   // Guardian's approval channel is a DM, distinct from the public channel the
   // reaction lands in (mirroring production). Reusing the public channel id
   // would let a reactor match the guardian's channel via findContactChannel's

package/src/__tests__/run-conversation-turn-persistence.test.ts

@@ -196,8 +196,11 @@ describe("runConversationTurn persistence", () => {
     // send-message route.
     expect(listInvalidations()).toEqual([creationTags(result.conversationId)]);
     expect(
-      broadcasts.filter((msg) => msg.type === "conversation_list_invalidated"),
-    ).toEqual([{ type: "conversation_list_invalidated", reason: "created" }]);
+      broadcasts.filter(
+        (msg) =>
+          (msg as { type: string }).type === "conversation_list_invalidated",
+      ),
+    ).toEqual([]);
   });
 
   test("adopts a caller-supplied conversation id verbatim when no row exists", async () => {

package/src/__tests__/scripted-turn-metadata-persistence.test.ts

@@ -89,6 +89,7 @@ function createContext(): MessagingConversationContext {
     size: () => 0,
   } as unknown as MessageQueue;
   let processing = false;
+  let owner = 0;
   return {
     conversationId: "conv-scripted-test",
     messages: [],
@@ -96,6 +97,21 @@ function createContext(): MessagingConversationContext {
     setProcessing: (value: boolean) => {
       processing = value;
     },
+    acquireProcessingFenced: async () => {
+      if (processing) {
+        return null;
+      }
+      processing = true;
+      owner += 1;
+      return owner;
+    },
+    releaseProcessing: (claim: number) => {
+      if (claim !== owner) {
+        return false;
+      }
+      processing = false;
+      return true;
+    },
     abortController: null,
     queue: queueStub,
     clientOs: undefined,

package/src/__tests__/skill-load-tool.test.ts

@@ -127,6 +127,20 @@ describe("skill_load tool", () => {
     );
   });
 
+  test("description routes Claude Code and Codex mentions to acp", () => {
+    // skill_load is always in the tool list. Naming the agents here is what
+    // makes a mention load ACP instead of treating Claude Code as a competitor.
+    expect(skillLoadTool.description).toContain("Claude Code");
+    expect(skillLoadTool.description).toContain("Codex");
+    expect(skillLoadTool.description).toContain('skill: "acp"');
+  });
+
+  test("routes recurring monitoring and reminders to the schedule skill", () => {
+    const description = skillLoadTool.description;
+    expect(description).toContain('skill: "schedule"');
+    expect(description.toLowerCase()).toContain("recurring monitoring");
+  });
+
   test("loads a skill by exact id", async () => {
     writeSkill(
       "release-checklist",
@@ -393,6 +407,19 @@ describe("skill_load tool", () => {
     expect(result.content).toContain('<loaded_skill id="app-builder"');
   });
 
+  test("bundled acp skill offers a one-time connect when the user names an agent", async () => {
+    const result = await executeSkillLoad({ skill: "acp" });
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: ACP");
+    expect(result.content).toContain(
+      "When the user names Claude Code or Codex",
+    );
+    expect(result.content).toContain("offer once, in one short sentence");
+    expect(result.content).toContain("Do not spawn unless they accept");
+    expect(result.content).toContain('<loaded_skill id="acp"');
+  });
+
   test("bundled phone-calls loads when setup includes are unavailable", async () => {
     const result = await executeSkillLoad({ skill: "phone-calls" });
 

package/src/__tests__/skills.test.ts

@@ -869,16 +869,49 @@ describe("always-candidate frontmatter parsing", () => {
     expect(card).toContain("Avoid when:");
   });
 
+  test("the bundled schedule skill's card fits the default budget", async () => {
+    // Recurring-monitoring turns only reach this skill if the card still
+    // carries that vocabulary after the default-budget truncation. An overrun
+    // drops trailing hints and the whole avoid-when list.
+    const { DEFAULT_CARD_CHARS, buildSkillContent } =
+      await import("../plugins/defaults/memory/substrate/skill-content.js");
+    const schedule = loadSkillCatalog().find((skill) => skill.id === "schedule");
+    expect(schedule).toBeDefined();
+
+    const card = buildSkillContent(schedule!);
+    expect(card.length).toBeLessThan(DEFAULT_CARD_CHARS);
+    expect(card).toContain("Avoid when:");
+  });
+
+  test("the bundled schedule card carries its monitoring vocabulary", async () => {
+    const { buildSkillContent } =
+      await import("../plugins/defaults/memory/substrate/skill-content.js");
+    const schedule = loadSkillCatalog().find((skill) => skill.id === "schedule");
+    const card = buildSkillContent(schedule!).toLowerCase();
+
+    for (const term of ["monitor", "page", "dashboard", "status", "alert"]) {
+      expect(card).toContain(term);
+    }
+  });
+
   test("the bundled acp card carries its setup and sign-in vocabulary", async () => {
     // A "configure Claude Code" or "let's do the auth" turn only reaches this
     // skill if the card actually says it covers setup and authentication;
     // delegation-only wording routes those turns to a terminal skill instead.
+    // "names" keeps a mention ("claude code will do it") from falling through
+    // as a competitor reference.
     const { buildSkillContent } =
       await import("../plugins/defaults/memory/substrate/skill-content.js");
     const acp = loadSkillCatalog().find((skill) => skill.id === "acp");
     const card = buildSkillContent(acp!).toLowerCase();
 
-    for (const term of ["set up", "install", "authenticate", "connect"]) {
+    for (const term of [
+      "names",
+      "set up",
+      "install",
+      "authenticate",
+      "connect",
+    ]) {
       expect(card).toContain(term);
     }
   });

package/src/__tests__/strip-memory-injections.test.ts

@@ -220,10 +220,9 @@ describe("stripExistingMemoryInjections", () => {
 });
 
 // ---------------------------------------------------------------------------
-// stripSpotlightInjections — the memory-v3 ephemeral spotlight is the ONLY
-// block strip-and-replaced across every user message each turn. Frozen
-// `<memory>` card blocks must never be touched by it (the cache contract);
-// the old whole-layer stripAllMemoryInjections replace is gone.
+// stripSpotlightInjections: leftover memory-v3 spotlight blocks are removed
+// from every user message (compaction leftover cleanup). Frozen `<memory>`
+// card blocks must never be touched (the cache contract).
 // ---------------------------------------------------------------------------
 
 const spotlightBlock = (inner: string): ContentBlock => ({

package/src/__tests__/terminal-tools.test.ts

@@ -146,6 +146,15 @@ describe("buildSanitizedEnv", () => {
     expect(env.VELLUM_APT_DATA_ROOT).toBe("/data/system");
     expect(env.PATH.split(":")).toContain("/data/system/usr/bin");
     expect(env.PATH.split(":")).toContain("/data/system/usr/local/bin");
+    // Shims must shadow the chroot bin dirs so a shim beats a wrapper script
+    // whose hardcoded absolute path only resolves inside the chroot.
+    const kataPathParts = env.PATH.split(":");
+    expect(
+      kataPathParts.indexOf("/data/system/.host-shims"),
+    ).toBeGreaterThanOrEqual(0);
+    expect(kataPathParts.indexOf("/data/system/.host-shims")).toBeLessThan(
+      kataPathParts.indexOf("/data/system/bin"),
+    );
     expect(env.LD_LIBRARY_PATH.split(":")).toContain("/data/system/usr/lib");
     expect(env.LD_LIBRARY_PATH.split(":")).toContain(
       "/data/system/usr/local/lib",

package/src/__tests__/thread-backfill.test.ts

@@ -104,6 +104,7 @@ import * as slackBackfill from "../messaging/providers/slack/backfill.js";
 import {
   buildSlackTimezoneMetadata,
   readSlackMetadata,
+  readSlackMetadataFromMessageMetadata,
   writeSlackMetadata,
 } from "../messaging/providers/slack/message-metadata.js";
 import type { MessageRow } from "../persistence/conversation-crud.js";
@@ -360,12 +361,13 @@ function readPersistedSlackRows(conversationId: string): PersistedRow[] {
       out.push(blank);
       continue;
     }
-    const slackMetaRaw = envelope.slackMeta;
-    if (typeof slackMetaRaw !== "string") {
+    // Either envelope: a person's row still writes `slackMeta`, a
+    // bot-authored row the neutral envelope with Slack's fields riding it.
+    const slackMeta = readSlackMetadataFromMessageMetadata(row.metadata);
+    if (slackMeta === null) {
       out.push(blank);
       continue;
     }
-    const slackMeta = readSlackMetadata(slackMetaRaw);
     out.push({
       role: row.role,
       content: unwrapExternalContent(row.content),