@vellumai/assistant 0.12.0 → 0.12.1-staging.1

package/src/notifications/__tests__/assistant-reply-producer.test.ts

@@ -5,6 +5,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { setOverridesForTesting } from "../../__tests__/feature-flag-test-helpers.js";
+import { MESSAGE_KEYS } from "../../i18n/index.js";
 import type { AttentionState } from "../../persistence/conversation-attention-store.js";
 import type {
   ConversationRow,
@@ -589,6 +590,60 @@ describe("emitAssistantReplyNotification", () => {
     });
   });
 
+  // A conversation whose title is still being written stores the message key
+  // itself, which is a non-empty string the sanitizer has no reason to reject.
+  // Sending it would put a raw key on the lock screen, so it counts as absent.
+  test("omits requestedTitle while the title is still generating", async () => {
+    conversationRow = makeConversation({
+      title: MESSAGE_KEYS.CONVERSATION_TITLE_GENERATING,
+    });
+
+    await run();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].contextPayload).toEqual({
+      requestedMessage: "Sure, here is the plan.",
+    });
+  });
+
+  test("omits requestedTitle for the legacy generating placeholder", async () => {
+    conversationRow = makeConversation({ title: "Generating title..." });
+
+    await run();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].contextPayload).toEqual({
+      requestedMessage: "Sure, here is the plan.",
+    });
+  });
+
+  test("omits requestedTitle for the untitled placeholder key", async () => {
+    conversationRow = makeConversation({
+      title: MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED,
+    });
+
+    await run();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].contextPayload).toEqual({
+      requestedMessage: "Sure, here is the plan.",
+    });
+  });
+
+  // Only an exact key is a system constant. A title the user or the model
+  // wrote that happens to contain one is their copy and travels as written.
+  test("keeps a title that merely contains a message key", async () => {
+    conversationRow = makeConversation({
+      title: `notes on ${MESSAGE_KEYS.CONVERSATION_TITLE_GENERATING}`,
+    });
+
+    await run();
+
+    expect(emitCalls[0].contextPayload.requestedTitle).toBe(
+      "notes on conversation.title.generating",
+    );
+  });
+
   test("caps the preview at 200 chars", async () => {
     assistantRow = makeAssistantRow([
       { type: "text", text: "a".repeat(300) },

package/src/notifications/__tests__/home-feed-side-effect.test.ts

@@ -26,6 +26,15 @@ const messageRewrites: Array<{ messageId: string; content: string }> = [];
 /** messageId -> the conversation it belongs to, for the scoped lookup. */
 const messageOwners = new Map<string, string>();
 let conversationRow: { conversationType: string } | null = null;
+/**
+ * Rows for specific ids, consulted before the catch-all `conversationRow`,
+ * so a test can hand the signal's source and the delivery's paired
+ * conversation different shapes.
+ */
+const conversationRowsById = new Map<
+  string,
+  { conversationType: string; source?: string }
+>();
 let conversationLookupShouldThrow = false;
 let messageAppendShouldThrow = false;
 let messageRewriteShouldThrow = false;
@@ -71,7 +80,7 @@ mock.module("../../persistence/conversation-crud.js", () => ({
     if (conversationLookupShouldThrow) {
       throw new Error("simulated conversation lookup failure");
     }
-    return conversationRow;
+    return conversationRowsById.get(id) ?? conversationRow;
   },
   addMessage: async (
     conversationId: string,
@@ -164,6 +173,7 @@ beforeEach(() => {
   messageRewrites.length = 0;
   messageOwners.clear();
   conversationRow = null;
+  conversationRowsById.clear();
   conversationLookupShouldThrow = false;
   messageAppendShouldThrow = false;
   messageRewriteShouldThrow = false;
@@ -258,7 +268,11 @@ describe("writeHomeFeedItemForSignal", () => {
       },
     });
 
-    const item = await writeHomeFeedItemForSignal(signal, decision);
+    const item = await writeHomeFeedItemForSignal(
+      signal,
+      decision,
+      makeVellumDelivery(),
+    );
 
     expect(item).not.toBeNull();
     expect(appendCalls).toHaveLength(1);
@@ -267,7 +281,10 @@ describe("writeHomeFeedItemForSignal", () => {
       "The deployment completed successfully.",
     );
     expect(appendCalls[0]!.conversationId).toBe("conv-source-1");
-    expect(conversationLookups).toEqual(["conv-source-1"]);
+    expect(appendCalls[0]!.metadata?.notificationConversationMessageId).toBeUndefined();
+    expect(messageAppends).toEqual([]);
+    expect(messagesInvalidated).toEqual([]);
+    expect(conversationLookups).toEqual(["conv-source-1", "conv-source-1"]);
   });
 
   test("isAsyncBackground hint writes even when sourceContextId does not resolve", async () => {
@@ -402,6 +419,139 @@ describe("writeHomeFeedItemForSignal", () => {
     expect(appendCalls[0]!.conversationId).toBe("paired-delivery-conv-id");
   });
 
+  describe("assistant-initiated thread deliveries", () => {
+    // Under the assistant-initiated-threads flag, conversation pairing
+    // promotes a background assistant.share into a standard conversation
+    // stamped `assistant_initiated`, which the sidebar's assistant section
+    // renders. That thread is the share's surface; a feed item for the
+    // same signal put it in the bell a second time.
+    const assistantThreadDelivery = () =>
+      makeVellumDelivery({ conversationId: "assistant-thread-1" });
+
+    function stampAssistantThread(): void {
+      conversationRowsById.set("assistant-thread-1", {
+        conversationType: "standard",
+        source: "assistant_initiated",
+      });
+    }
+
+    function shareFromHeartbeat(): NotificationSignal {
+      return makeSignal({
+        sourceChannel: "assistant_tool",
+        sourceEventName: "assistant.share",
+        sourceContextId: "conv-source-1",
+        contextPayload: { title: "Doctor checklist built" },
+      });
+    }
+
+    const shareDecision = () =>
+      makeDecision({
+        selectedChannels: ["vellum"],
+        renderedCopy: {
+          vellum: {
+            title: "Doctor checklist built",
+            body: "Your doctor-visit one-pager is ready.",
+          },
+        },
+      });
+
+    test("a background share promoted into an assistant thread does not mirror", async () => {
+      conversationRow = { conversationType: "background" };
+      stampAssistantThread();
+
+      const item = await writeHomeFeedItemForSignal(
+        shareFromHeartbeat(),
+        shareDecision(),
+        assistantThreadDelivery(),
+      );
+
+      expect(item).toBeNull();
+      expect(appendCalls).toHaveLength(0);
+      expect(messageAppends).toHaveLength(0);
+    });
+
+    test("the async-background hint does not override the assistant-thread suppression", async () => {
+      conversationRow = null;
+      stampAssistantThread();
+      const signal = makeSignal({
+        sourceChannel: "assistant_tool",
+        sourceEventName: "assistant.share",
+        sourceContextId: "heartbeat",
+        contextPayload: { title: "Bilbao solo trip is planned" },
+        attentionHints: {
+          requiresAction: false,
+          urgency: "medium",
+          isAsyncBackground: true,
+          visibleInSourceNow: false,
+        },
+      });
+
+      const item = await writeHomeFeedItemForSignal(
+        signal,
+        shareDecision(),
+        assistantThreadDelivery(),
+      );
+
+      expect(item).toBeNull();
+      expect(appendCalls).toHaveLength(0);
+    });
+
+    test("a share paired with an ordinary notification thread still mirrors", async () => {
+      // Flag off, or any producer that did not promote: pairing writes a
+      // `notification`-sourced row, which stays in Chats and the bell.
+      conversationRow = { conversationType: "background" };
+      conversationRowsById.set("assistant-thread-1", {
+        conversationType: "standard",
+        source: "notification",
+      });
+
+      const item = await writeHomeFeedItemForSignal(
+        shareFromHeartbeat(),
+        shareDecision(),
+        assistantThreadDelivery(),
+      );
+
+      expect(item).not.toBeNull();
+      expect(appendCalls).toHaveLength(1);
+    });
+
+    test("a guardian request keeps its bell item even when paired with an assistant thread", async () => {
+      // The bell is the request's canonical home: nothing else renders the
+      // pending card, so the assistant-thread suppression must not reach it.
+      conversationRow = { conversationType: "standard" };
+      stampAssistantThread();
+      const signal = makeSignal({
+        sourceChannel: "assistant_tool",
+        sourceEventName: "guardian.question",
+        contextPayload: {
+          title: "Approve this?",
+          questionText: "May I send the email?",
+          requestId: "req-1",
+        },
+        attentionHints: {
+          requiresAction: true,
+          urgency: "medium",
+          isAsyncBackground: false,
+          visibleInSourceNow: false,
+        },
+      });
+
+      const item = await writeHomeFeedItemForSignal(
+        signal,
+        makeDecision({
+          selectedChannels: ["vellum"],
+          renderedCopy: {
+            vellum: { title: "Approve this?", body: "May I send the email?" },
+          },
+        }),
+        assistantThreadDelivery(),
+      );
+
+      expect(item).not.toBeNull();
+      expect(appendCalls).toHaveLength(1);
+    });
+  });
+
   test("source conversation id wins over the paired delivery fallback when both are available", async () => {
     // When the producer's `sourceContextId` already points at a real
     // conversation (the canonical "where the work happened"), prefer it

package/src/notifications/assistant-reply-producer.ts

@@ -22,6 +22,7 @@ import {
   getMessageById,
   parseMessageMetadata,
 } from "../persistence/conversation-crud.js";
+import { isReplaceableTitle } from "../persistence/conversation-title-placeholders.js";
 import {
   isDesktopOriginatedUserMessage,
   isReplyPushIneligibleUserMessage,
@@ -247,9 +248,13 @@ export async function emitAssistantReplyNotification(params: {
     // lock screen. Absent `requestedTitle` lets the decision branch derive a
     // title from the body, which reads better than an empty or placeholder
     // conversation title.
-    const requestedTitle = sanitizeNotificationTitle(
-      flattenTitleWhitespace(conversation.title ?? ""),
-    );
+    //
+    // Placeholder titles are plausible non-empty strings and survive
+    // sanitizing. They count as absent so the body supplies the title instead.
+    const storedTitle = conversation.title?.trim() ?? "";
+    const requestedTitle = isReplaceableTitle(storedTitle)
+      ? ""
+      : sanitizeNotificationTitle(flattenTitleWhitespace(storedTitle));
 
     // Read as close to the emit as possible: nothing short-circuits on it.
     // Presence only speaks for a turn the desktop itself opened, on that row's

package/src/notifications/conversation-pairing.ts

@@ -130,6 +130,7 @@ export interface PairingOptions {
  * transactional request or a system alert.
  */
 const ASSISTANT_SHARE_EVENT = "assistant.share";
+const ASSISTANT_REPLY_EVENT = "chat.assistant_reply";
 
 /**
  * Promote a background share into an assistant-initiated thread, under the
@@ -263,7 +264,25 @@ export async function pairDeliveryWithConversation(
     // notification can appear. The home feed aims its "Go to Conversation"
     // button at the same row whenever it mirrors the signal.
     //
-    // So this is deliberately not gated on home-feed eligibility: a signal the
+    // `chat.assistant_reply` already has its complete reply in that transcript.
+    // Its notification body is a lock-screen preview, so appending it would
+    // create a second, truncated assistant row. Keep the conversation target
+    // for deep links without writing the preview into the transcript.
+    if (
+      strategy === "start_new_conversation" &&
+      !signal.requiresConversation &&
+      signal.sourceEventName === ASSISTANT_REPLY_EVENT
+    ) {
+      return {
+        conversationId: resolveSourceConversationId(signal),
+        messageId: null,
+        strategy,
+        createdNewConversation: false,
+        conversationFallbackUsed: false,
+      };
+    }
+
+    // This is deliberately not gated on home-feed eligibility: a signal the
     // feed declines to mirror still reaches the user through the banner, and
     // this row is what makes that landing honest.
     if (strategy === "start_new_conversation" && !signal.requiresConversation) {
@@ -748,44 +767,45 @@ async function resolveChannelDeliveryHome(params: {
  * Indexing is skipped for parity with the other notification write paths:
  * notification copy is delivery audit, not conversational memory.
  */
-async function appendBodyToSourceConversation(
-  signal: NotificationSignal,
-  channel: NotificationChannel,
-  messageContent: string,
-): Promise<{ conversationId: string; messageId: string } | null> {
-  const sourceContextId = signal.sourceContextId;
-  if (!sourceContextId) {
+function resolveSourceConversationId(signal: NotificationSignal): string | null {
+  if (!signal.sourceContextId) {
     return null;
   }
-
-  let existing: ReturnType<typeof getConversation>;
   try {
-    existing = getConversation(sourceContextId);
+    return getConversation(signal.sourceContextId)?.id ?? null;
   } catch {
     return null;
   }
-  if (!existing) {
+}
+
+async function appendBodyToSourceConversation(
+  signal: NotificationSignal,
+  channel: NotificationChannel,
+  messageContent: string,
+): Promise<{ conversationId: string; messageId: string } | null> {
+  const conversationId = resolveSourceConversationId(signal);
+  if (!conversationId) {
     return null;
   }
 
-  const message = await addMessage(existing.id, "assistant", messageContent, {
+  const message = await addMessage(conversationId, "assistant", messageContent, {
     skipIndexing: true,
   });
   // `addMessage` projects attention metadata alone, so a client with this
   // conversation open needs the messages tag to refetch the transcript. A
   // notification the user taps through to has every chance of landing on an
   // already-open conversation.
-  publishConversationMessagesChanged(existing.id);
+  publishConversationMessagesChanged(conversationId);
 
   log.info(
     {
       signalId: signal.signalId,
       channel,
-      conversationId: existing.id,
+      conversationId,
       messageId: message.id,
     },
     "Appended notification body to producing conversation",
   );
 
-  return { conversationId: existing.id, messageId: message.id };
+  return { conversationId, messageId: message.id };
 }

package/src/notifications/delivered-post-record.ts

@@ -39,6 +39,12 @@ export interface DeliveredChannelPost {
   text: string;
   /** The message id the channel assigned when it acknowledged the post. */
   providerMessageId: string;
+  /**
+   * The ids of the further posts the same text became when the channel
+   * split it, in send order. Each is reconciled onto the row like the first,
+   * so a reaction, edit, or delete naming any chunk resolves to this row.
+   */
+  additionalProviderMessageIds?: readonly string[];
   /**
    * The conversation whose turn made the post, when a different one from
    * the home it is recorded in (the messaging tool sending from a scheduled
@@ -75,7 +81,11 @@ export async function recordDeliveredChannelPost(
         : {}),
     },
   });
-  await makeSentMessageIdReconciler(row.id)(post.providerMessageId);
+  const reconcile = makeSentMessageIdReconciler(row.id);
+  await reconcile(post.providerMessageId);
+  for (const id of post.additionalProviderMessageIds ?? []) {
+    await reconcile(id);
+  }
   // A resident conversation reloads its history on the next turn so the
   // post is in context; the client refetches the transcript.
   findConversation(post.conversationId)?.markHistoryStale();

package/src/notifications/home-feed-side-effect.ts

@@ -23,7 +23,10 @@ import {
   getMessageById,
   updateMessageContent,
 } from "../persistence/conversation-crud.js";
-import { isBackgroundConversationType } from "../persistence/conversation-types.js";
+import {
+  ASSISTANT_INITIATED_SOURCE,
+  isBackgroundConversationType,
+} from "../persistence/conversation-types.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
 import { normalizeTitle, stripMarkdown } from "../util/short-title.js";
@@ -272,6 +275,11 @@ async function resolveOwnedConversationMessageId(
   sourceConversationId: string | undefined,
   summary: string,
 ): Promise<string | undefined> {
+  // The completed reply is already the source conversation's canonical row.
+  // This signal's body is a compact push preview, not conversation content.
+  if (signal.sourceEventName === "chat.assistant_reply") {
+    return undefined;
+  }
   if (vellumDelivery?.conversationId) {
     return vellumDelivery.conversationId === sourceConversationId
       ? vellumDelivery.messageId
@@ -495,6 +503,18 @@ function deriveDetailPanelKind(
  * `isAsyncBackground` hint. `chat.assistant_reply` also mirrors: it is the
  * durable in-app record for the push sent after a user leaves a chat, while
  * retaining the normal interactive conversation as its navigation target.
+ *
+ * A delivery that materialized an assistant-initiated thread never mirrors.
+ * Under the `assistant-initiated-threads` flag, `conversation-pairing.ts`
+ * promotes a background `assistant.share` into a standard conversation
+ * stamped {@link ASSISTANT_INITIATED_SOURCE}, and that thread's row in the
+ * sidebar's assistant section is the share's one surface. Mirroring it here
+ * as well put the same share in the bell a second time, labeled by its
+ * source channel ("Heartbeat"). The check reads the paired conversation's
+ * `source` rather than re-deriving the promotion rule, so it holds however
+ * that rule narrows or widens. Guardian requests are checked first on
+ * purpose: the bell is their canonical home whatever conversation they pair
+ * with.
  */
 function resolveHomeFeedMirror(
   signal: NotificationSignal,
@@ -525,6 +545,15 @@ function resolveHomeFeedMirror(
     : fallbackConversationId;
   const sourceScheduleJobId = sourceRow?.scheduleJobId ?? undefined;
 
+  // Guardian requests always project into the feed: the "Needs
+  // attention" item is the request's canonical home, and the request
+  // blocks on the guardian whatever kind of conversation raised it.
+  if (isGuardianRequestSignalEvent(signal.sourceEventName)) {
+    return { mirror: true, sourceConversationId, sourceScheduleJobId };
+  }
+  if (isAssistantInitiatedThreadDelivery(fallbackConversationId)) {
+    return { mirror: false };
+  }
   if (
     signal.sourceChannel === "assistant_tool" ||
     signal.sourceEventName === "chat.assistant_reply"
@@ -534,18 +563,37 @@ function resolveHomeFeedMirror(
   if (signal.attentionHints.isAsyncBackground) {
     return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
-  // Guardian requests always project into the feed: the "Needs
-  // attention" item is the request's canonical home, and the request
-  // blocks on the guardian whatever kind of conversation raised it.
-  if (isGuardianRequestSignalEvent(signal.sourceEventName)) {
-    return { mirror: true, sourceConversationId, sourceScheduleJobId };
-  }
   if (isBackgroundConversationType(sourceRow?.conversationType)) {
     return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
   return { mirror: false };
 }
 
+/**
+ * Whether the vellum delivery this signal produced landed in a thread the
+ * sidebar's assistant section already shows.
+ *
+ * Best-effort like the source lookup above: a missing id, a missing row, or
+ * a lookup failure all read as "not an assistant thread", so a storage
+ * hiccup degrades to the pre-existing behavior (a bell row) rather than
+ * dropping the notification everywhere.
+ */
+function isAssistantInitiatedThreadDelivery(
+  deliveryConversationId: string | undefined,
+): boolean {
+  if (!deliveryConversationId) {
+    return false;
+  }
+  try {
+    return (
+      getConversation(deliveryConversationId)?.source ===
+      ASSISTANT_INITIATED_SOURCE
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Routing-intent enforcement can prune `selectedChannels` without also
  * pruning `renderedCopy`, so iterating `renderedCopy` directly risks

package/src/outbound-proxy/certs.ts

@@ -2,6 +2,8 @@ import { X509Certificate } from "node:crypto";
 import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
+import { writeCombinedCABundle } from "../util/ca-bundle.js";
+
 const CA_CERT_FILENAME = "ca.pem";
 const CA_KEY_FILENAME = "ca-key.pem";
 const COMBINED_CA_FILENAME = "combined-ca-bundle.pem";
@@ -263,11 +265,7 @@ export async function ensureCombinedCABundle(
   }
 
   try {
-    const [systemCAs, proxyCACert] = await Promise.all([
-      readFile(systemBundlePath, "utf-8"),
-      readFile(caCertPath, "utf-8"),
-    ]);
-    await writeFile(combinedPath, systemCAs + "\n" + proxyCACert);
+    await writeCombinedCABundle(systemBundlePath, caCertPath, combinedPath);
     return combinedPath;
   } catch {
     return null;

package/src/permissions/checker.test.ts

@@ -15,13 +15,16 @@ mock.module("../config/assistant-feature-flags.js", () => ({
 }));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
-// proc-to-skills gate via `isV3TierActive`. Drive it through this slot so a
-// test can put the production threading path in the active / inactive state.
+// retrospective skill-improvement gate. Keep the v3 tier active while the
+// dedicated gate changes so the production threading test covers the new
+// opt-out rather than the old v3 condition.
 let mockV3TierActive = true;
+let mockSkillImprovementActive = true;
 mock.module("../config/memory-v3-gate.js", () => ({
   isMemoryEnabled: (config?: { memory?: { enabled?: boolean } }) =>
     config?.memory?.enabled !== false,
   isV3TierActive: () => mockV3TierActive,
+  isSkillImprovementActive: () => mockSkillImprovementActive,
   isMemoryV3Live: () => mockV3TierActive,
   usesConceptPageMemory: (memory?: {
     enabled?: boolean;
@@ -219,6 +222,7 @@ describe("Permission Checker (gateway IPC)", () => {
     mockCachedThreshold = "low";
     mockRefreshedThreshold = null;
     mockV3TierActive = true;
+    mockSkillImprovementActive = true;
     thresholdCallLog.length = 0;
     mockSkillCatalog = [];
     mockResolvedSkill = null;
@@ -1173,10 +1177,11 @@ describe("Permission Checker (gateway IPC)", () => {
     });
 
     test("grant does NOT fire when proc-to-skills is inactive, even for the retrospective turn", async () => {
-      // Same retrospective ToolContext, but the feature is inactive (flag off
-      // or v3 not live). buildPolicyContext stamps `procToSkillsActive: false`,
-      // so the grant is dead and the high-risk scaffold prompts.
-      mockV3TierActive = false;
+      // The retrospective keeps its live v3 tier, but this independent flag is
+      // off. buildPolicyContext stamps `procToSkillsActive: false`, so the
+      // grant is dead and the high-risk scaffold prompts.
+      mockV3TierActive = true;
+      mockSkillImprovementActive = false;
       mockIpcClassifyRiskResult = {
         risk: "high",
         reason: "Skill scaffold",

package/src/persistence/compaction-log-store-clickhouse.ts

@@ -26,6 +26,7 @@
  */
 import type { AgentEvent } from "../agent/loop.js";
 import { getConfig } from "../config/loader.js";
+import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { CompactionLogsClickHouseConfig } from "../config/schemas/compaction-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -136,7 +137,7 @@ export interface ClickHouseCompactionLogStoreDeps {
   resolveUrl?: () => Promise<string | null>;
   /** Override the credential read for `clickhouse:password`. */
   resolvePassword?: () => Promise<string | null>;
-  /** Override the credential read for `vellum:platform_assistant_id`. */
+  /** Override the platform assistant id (in-memory identity, then vault). */
   resolveAssistantId?: () => Promise<string | null>;
   /** Override fetch for testing. */
   fetchImpl?: CompactionLogFetch;
@@ -163,8 +164,7 @@ export class ClickHouseCompactionLogStore {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ??
-      (() => readCredentialOrNull("vellum", "platform_assistant_id"));
+      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
     this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }