@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/__tests__/conversation-retry-discard.test.ts

@@ -10,13 +10,26 @@ import {
   discardLastAssistantDisplayTurn,
   extractUserPromptText,
 } from "../daemon/conversation-history.js";
+import { registerPluginHooks } from "../hooks/registry.js";
 import { addMessage, getMessages } from "../persistence/conversation-crud.js";
-import { getDb } from "../persistence/db-connection.js";
+import { getDb, getMemorySqlite } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { conversations, messages } from "../persistence/schema/index.js";
+import memoryMessageDeleted from "../plugins/defaults/memory/hooks/message-deleted.js";
+import {
+  ensureRetrospectiveCursorColumn,
+  getRetrospectiveState,
+} from "../plugins/defaults/memory/memory-retrospective-state.js";
+import type { PluginHooks } from "../plugins/types.js";
 
 await initializeDb();
 
+// Register the memory plugin's `message-deleted` hook the way boot does, so
+// the delete primitive's dispatch reaches the cursor bookkeeping.
+registerPluginHooks("default-memory", {
+  "message-deleted": memoryMessageDeleted,
+} as PluginHooks);
+
 const CONV_ID = "conv-retry-discard-test";
 
 function seedConversation(): void {
@@ -211,3 +224,43 @@ describe("extractUserPromptText", () => {
     expect(extractUserPromptText([])).toBe("");
   });
 });
+
+describe("discardLastAssistantDisplayTurn keeps the memory-retrospective cursor placeable", () => {
+  beforeEach(() => {
+    ensureRetrospectiveCursorColumn("test");
+    getMemorySqlite()!.exec(`DELETE FROM memory_retrospective_state`);
+  });
+
+  test("a cursor stored without its timestamp gets it from the reply being discarded", async () => {
+    const [, assistantId] = await seed([
+      { role: "user", content: text("hello") },
+      { role: "assistant", content: text("first attempt") },
+    ]);
+    const replyCreatedAt = getMessages(CONV_ID).find(
+      (m) => m.id === assistantId,
+    )!.createdAt;
+    // A state row as a build without the timestamp column wrote it: the
+    // retrospective reviewed through the reply, so the cursor sits on it.
+    getMemorySqlite()!
+      .query(
+        `INSERT INTO memory_retrospective_state
+           (conversation_id, last_processed_message_id, last_run_at, remembered_log, last_processed_created_at)
+         VALUES (?, ?, 1, NULL, NULL)`,
+      )
+      .run(CONV_ID, assistantId);
+
+    discardLastAssistantDisplayTurn(CONV_ID);
+
+    expect(getMessages(CONV_ID).some((m) => m.id === assistantId)).toBe(false);
+    // The hook chain is fire-and-forget from the delete primitive, so the
+    // stamp lands shortly after the discard returns.
+    const deadline = Date.now() + 2_000;
+    let stamped =
+      getRetrospectiveState(CONV_ID)?.lastProcessedCreatedAt ?? null;
+    while (stamped === null && Date.now() < deadline) {
+      await Bun.sleep(10);
+      stamped = getRetrospectiveState(CONV_ID)?.lastProcessedCreatedAt ?? null;
+    }
+    expect(stamped).toBe(replyCreatedAt);
+  });
+});

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -119,6 +119,7 @@ import {
   applyRuntimeInjections,
   assembleSlackActiveThreadFocusBlock,
   assembleSlackChronologicalMessages,
+  buildChannelCapabilityBlock,
   buildSubagentStatusBlock,
   getSlackCompactionWatermarkForPrefix,
   getSlackWatermarkAdvanceForRowPrefix,
@@ -586,6 +587,33 @@ describe("injectChannelCapabilityContext", () => {
     expect(text).not.toContain("Do NOT use ui_show, ui_update, or app_create");
   });
 
+  test("guides non-interactive turns to persist UI for a later capable client", () => {
+    const slack: ChannelCapabilities = {
+      channel: "slack",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+    const phone: ChannelCapabilities = {
+      channel: "phone",
+      dashboardCapable: false,
+      supportsDynamicUi: false,
+      supportsVoiceInput: false,
+    };
+
+    for (const caps of [slack, phone]) {
+      const text = buildChannelCapabilityBlock(caps, undefined, true)!;
+      expect(text).toContain(
+        "ui_show, ui_update, and ui_dismiss persist conversation content",
+      );
+      expect(text).not.toContain("Only use ui_show/ui_update");
+      expect(text).not.toContain("Do NOT use ui_show, ui_update, or app_create");
+      expect(text).not.toContain(
+        "Present information as well-formatted text instead of dynamic UI.",
+      );
+    }
+  });
+
   test("keeps blanket ui_show/ui_update prohibition for other non-dynamic channels", () => {
     const caps: ChannelCapabilities = {
       channel: "phone",

package/src/__tests__/conversation-skill-tools.test.ts

@@ -545,6 +545,33 @@ describe("projectSkillTools", () => {
     expect(mockRegisteredTools.has("deploy")).toBe(true);
   });
 
+  test("catalog membership changes are visible on the next projection with a persistent cache", () => {
+    const cache = {};
+    mockCatalog = [];
+    mockManifests = { deploy: makeManifest(["deploy_run"]) };
+
+    const history: Message[] = [
+      ...skillLoadMessages('<loaded_skill id="deploy" />'),
+    ];
+
+    const result1 = projectSkillTools(history, {
+      previouslyActiveSkillIds: sessionState,
+      cache,
+    });
+    expect(result1.allowedToolNames.size).toBe(0);
+    expect(sessionState.has("deploy")).toBe(false);
+
+    mockCatalog = [makeSkill("deploy")];
+
+    const result2 = projectSkillTools(history, {
+      previouslyActiveSkillIds: sessionState,
+      cache,
+    });
+    expect(result2.allowedToolNames).toEqual(new Set(["deploy_run"]));
+    expect(sessionState.has("deploy")).toBe(true);
+    expect(mockRegisteredTools.has("deploy")).toBe(true);
+  });
+
   test("skill with manifest failure on turn 1 is registered when manifest is available on turn 2", () => {
     mockCatalog = [makeSkill("deploy")];
     // No manifest — will fail to load

package/src/__tests__/conversation-surfaces-app-control.test.ts

@@ -146,8 +146,10 @@ describe("surfaceProxyResolver — app-control tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("not available");
-      expect(result.content).toContain("app-control");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to control apps on your computer",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
       // No envelope dispatched.
       expect(sentMessages).toHaveLength(0);
     });
@@ -163,7 +165,10 @@ describe("surfaceProxyResolver — app-control tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("not available");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to control apps on your computer",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
       expect(sentMessages).toHaveLength(0);
 
       proxy.dispose();

package/src/__tests__/conversation-surfaces-point-at-budget.test.ts

@@ -24,6 +24,7 @@ function proxyDouble() {
       recordAction,
       request,
       reset: () => {},
+      endTask: () => {},
       stepCount: 0,
     },
   };

package/src/__tests__/conversation-surfaces-point-at-capability.test.ts

@@ -30,6 +30,7 @@ function proxyDouble() {
       recordAction: () => {},
       request,
       reset: () => {},
+      endTask: () => {},
       stepCount: 0,
     },
   };

package/src/__tests__/conversation-surfaces-task-progress.test.ts

@@ -21,6 +21,7 @@ import {
 function makeContext(
   sent: AssistantEvent[] = [],
   channelCapabilities?: { channel: string; supportsDynamicUi: boolean },
+  opts?: { hasNoClient?: boolean },
 ): Conversation {
   return asConversation({
     conversationId: "session-1",
@@ -37,6 +38,7 @@ function makeContext(
     accumulatedSurfaceState: new Map<string, Record<string, unknown>>(),
     surfaceActionRequestIds: new Set<string>(),
     currentTurnSurfaces: [],
+    hasNoClient: opts?.hasNoClient ?? false,
     isProcessing: () => false,
     enqueueMessage: () => ({ queued: false, requestId: "req-1" }),
     getQueueDepth: () => 0,
@@ -65,6 +67,71 @@ describe("task_progress surface compatibility", () => {
     expect(sent).toHaveLength(0);
   });
 
+  test("persists a clientless choice from a non-rendering channel without waiting", async () => {
+    const sent: AssistantEvent[] = [];
+    const ctx = makeContext(
+      sent,
+      {
+        channel: "phone",
+        supportsDynamicUi: false,
+      },
+      { hasNoClient: true },
+    );
+
+    const result = await surfaceProxyResolver(ctx, "ui_show", {
+      surface_type: "choice",
+      title: "Choose a focus",
+      data: {
+        options: [
+          { id: "inbox", title: "Inbox" },
+          { id: "calendar", title: "Calendar" },
+        ],
+      },
+    });
+
+    expect(result.isError).toBe(false);
+    expect(result.yieldToUser).toBeUndefined();
+    const { surfaceId } = JSON.parse(result.content) as { surfaceId: string };
+    expect(ctx.currentTurnSurfaces.some((s) => s.surfaceId === surfaceId)).toBe(
+      true,
+    );
+    expect(ctx.pendingSurfaceActions.has(surfaceId)).toBe(false);
+    expect(sent.some((msg) => msg.type === "ui_surface_show")).toBe(true);
+  });
+
+  test("persists a clientless update in the current-turn surface snapshot", async () => {
+    const sent: AssistantEvent[] = [];
+    const ctx = makeContext(
+      sent,
+      {
+        channel: "phone",
+        supportsDynamicUi: false,
+      },
+      { hasNoClient: true },
+    );
+    const shown = await surfaceProxyResolver(ctx, "ui_show", {
+      surface_type: "card",
+      title: "Background work",
+      data: {
+        template: "task_progress",
+        templateData: { status: "in_progress", steps: [] },
+      },
+    });
+    const { surfaceId } = JSON.parse(shown.content) as { surfaceId: string };
+
+    const result = await surfaceProxyResolver(ctx, "ui_update", {
+      surface_id: surfaceId,
+      data: { templateData: { status: "completed" } },
+    });
+
+    expect(result.isError).toBe(false);
+    const data = ctx.currentTurnSurfaces.find((s) => s.surfaceId === surfaceId)
+      ?.data as CardSurfaceData;
+    expect((data.templateData as Record<string, unknown>).status).toBe(
+      "completed",
+    );
+  });
+
   test("blocks ui_update when channel lacks dynamic UI support", async () => {
     const sent: AssistantEvent[] = [];
     const ctx = makeContext(sent, {

package/src/__tests__/conversation-title-service.test.ts

@@ -104,6 +104,7 @@ mock.module("../runtime/sync/resource-sync-events.js", () => ({
   publishConversationTitleChanged: mockPublishConversationTitleChanged,
 }));
 
+import { MESSAGE_KEYS } from "../i18n/index.js";
 import {
   AUTO_TITLE_DETERMINISTIC,
   AUTO_TITLE_LLM,
@@ -309,10 +310,10 @@ describe("conversation-title-service", () => {
       userMessage: "so about that t-shirt...",
     });
 
-    expect(result.title).toBe("Untitled Conversation");
+    expect(result.title).toBe(MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED);
     expect(mockUpdateConversationTitle).toHaveBeenCalledWith(
       "conv-1",
-      "Untitled Conversation",
+      MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED,
       AUTO_TITLE_DETERMINISTIC,
     );
   });
@@ -333,7 +334,7 @@ describe("conversation-title-service", () => {
       userMessage: "something",
     });
 
-    expect(result.title).toBe("Untitled Conversation");
+    expect(result.title).toBe(MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED);
   });
 
   // The core bug this PR fixes: weak title models emit their reasoning or
@@ -361,10 +362,10 @@ describe("conversation-title-service", () => {
       userMessage: "hey baby",
     });
 
-    expect(result.title).toBe("Untitled Conversation");
+    expect(result.title).toBe(MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED);
     expect(mockUpdateConversationTitle).toHaveBeenCalledWith(
       "conv-1",
-      "Untitled Conversation",
+      MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED,
       AUTO_TITLE_DETERMINISTIC,
     );
   });
@@ -423,7 +424,7 @@ describe("conversation-title-service", () => {
       userMessage: "x",
     });
 
-    expect(result.title).toBe("Untitled Conversation");
+    expect(result.title).toBe(MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED);
   });
 
   test("regeneration skips LLM call when recent messages have no extractable text", async () => {
@@ -515,17 +516,17 @@ describe("conversation-title-service", () => {
     });
 
     expect(provider.sendMessage).not.toHaveBeenCalled();
-    expect(result).toEqual({ title: "Untitled Conversation", updated: true });
+    expect(result).toEqual({ title: MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED, updated: true });
     expect(mockUpdateConversationTitle).toHaveBeenCalledWith(
       "conv-1",
-      "Untitled Conversation",
+      MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED,
       AUTO_TITLE_DETERMINISTIC,
     );
   });
 
   test("keeps a background job's deterministic title when the model declines", async () => {
     // The model answered with prose the normalizer rejects, so there is no
-    // generated title. Settling for "Untitled Conversation" would name the
+    // generated title. Settling for the untitled fallback would name the
     // job's work less well than the bootstrap title already does.
     mockGetConversation.mockImplementation(() => ({
       title: "Memory consolidation",
@@ -584,6 +585,9 @@ describe("conversation-title-service", () => {
     expect(content).not.toContain("Generate a very short title");
     expect(content).not.toContain("do NOT respond");
     expect(options.systemPrompt).toContain("Do NOT respond");
+    expect(options.systemPrompt).toContain(
+      "same language as the conversation content",
+    );
   });
 
   test("queueGenerateConversationTitle serializes concurrent calls", async () => {
@@ -661,7 +665,7 @@ describe("conversation-title-service", () => {
     ).find((c) => c[0] === "conv-1");
     expect(firstUpdate).toEqual([
       "conv-1",
-      "Untitled Conversation",
+      MESSAGE_KEYS.CONVERSATION_TITLE_UNTITLED,
       AUTO_TITLE_DETERMINISTIC,
     ]);
     const secondUpdate = (

package/src/__tests__/conversation-tool-setup-app-refresh.test.ts

@@ -7,8 +7,8 @@
  * app_id from the executor's typed `resolvedAppId` side channel — and that
  * non-hooked tools (app_file_edit, app_file_write) do not trigger side effects.
  *
- * File-change detection for file_write/file_edit is handled by
- * AppSourceWatcher (see app-source-watcher.test.ts).
+ * File-change detection for file_write/file_edit is not hooked: compile with
+ * `app_refresh` or `assistant apps refresh` after a batch of edits.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -50,9 +50,7 @@ mock.module("../tools/browser/browser-screencast.js", () => ({
   registerConversationSender: mock(() => {}),
 }));
 
-// Stub app-store functions used by other modules (e.g. app-source-watcher,
-// conversation-surfaces) so tool-side-effects' hooks can run without touching
-// the real app store during tests.
+// Stub app-store functions used by other modules (e.g. conversation-surfaces)
 mock.module("../apps/app-store.js", () => ({
   getApp: mock(() => null),
   getAppDirPath: mock(() => "/tmp/test-apps/dummy"),

package/src/__tests__/conversation-tool-setup-attribution.test.ts

@@ -354,6 +354,57 @@ describe("createToolExecutor isInteractive threading", () => {
   });
 });
 
+describe("createToolExecutor unattended host-tool gate", () => {
+  test("rejects a direct host tool in a background turn before dispatch", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({ currentTurnIsNonInteractive: true, transportInterface: "web" }),
+    );
+
+    const result = await toolFn("host_bash", { command: "pwd" });
+
+    expect(result).toMatchObject({ isError: true });
+    expect(result.content).toContain("requires an interactive user turn");
+    expect(calls).toHaveLength(0);
+  });
+
+  test("rejects a skill-dispatched host tool in a background turn before dispatch", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({ currentTurnIsNonInteractive: true, transportInterface: "web" }),
+    );
+
+    const result = await toolFn("skill_execute", {
+      tool: "host_file_read",
+      input: { path: "/tmp/a" },
+      activity: "testing",
+    });
+
+    expect(result).toMatchObject({ isError: true });
+    expect(result.content).toContain("requires an interactive user turn");
+    expect(calls).toHaveLength(0);
+  });
+
+  test("dispatches a host tool during an interactive turn", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({
+        currentTurnIsNonInteractive: false,
+        transportInterface: "web",
+      }),
+    );
+
+    const result = await toolFn("host_bash", { command: "pwd" });
+
+    expect(result).toMatchObject({ content: "ok", isError: false });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].name).toBe("host_bash");
+  });
+});
+
 describe("createToolExecutor channel-permission coordinate threading", () => {
   beforeEach(() => {
     mockBindingExternalChatId = null;

package/src/__tests__/credential-record-retire.test.ts

@@ -8,8 +8,10 @@ import type { CredentialRecord } from "@vellumai/service-contracts/credential-rp
 import type { CredentialRecordBackend } from "../security/ces-rpc-record-backend.js";
 import {
   _ensureCesRecordsLoaded,
+  _setHttpRecordBackendForTests,
   _setMetadataPath,
   getCredentialMetadata,
+  listCredentialRecordsLive,
   setCredentialRecordBackend,
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
@@ -35,7 +37,9 @@ function leftoverContents(): string {
   return readFileSync(leftoverPath(), "utf-8");
 }
 
-function makeBackend(): CredentialRecordBackend & {
+function makeBackend(
+  name?: string,
+): CredentialRecordBackend & {
   store: Map<string, CredentialRecord>;
   bulkSetCalls: number;
   listCalls: number;
@@ -46,6 +50,7 @@ function makeBackend(): CredentialRecordBackend & {
     bulkSetCalls: number;
     listCalls: number;
   } = {
+    name,
     store,
     bulkSetCalls: 0,
     listCalls: 0,
@@ -83,6 +88,7 @@ function makeBackend(): CredentialRecordBackend & {
 describe("CES credential record cache", () => {
   beforeEach(() => {
     setCredentialRecordBackend(undefined);
+    _setHttpRecordBackendForTests(null);
     _setMetadataPath(null);
     const leftover = leftoverPath();
     if (existsSync(leftover)) {
@@ -92,6 +98,7 @@ describe("CES credential record cache", () => {
 
   afterEach(() => {
     setCredentialRecordBackend(undefined);
+    _setHttpRecordBackendForTests(null);
     _setMetadataPath(null);
     const leftover = leftoverPath();
     if (existsSync(leftover)) {
@@ -218,6 +225,169 @@ describe("CES credential record cache", () => {
     await _ensureCesRecordsLoaded();
   });
 
+  test("live catalog list returns CES records without the in-process cache", async () => {
+    const backend = makeBackend();
+    const record: CredentialRecord = {
+      credentialId: "cred-live",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    backend.store.set(credentialKey("github", "token"), record);
+    setCredentialRecordBackend(backend);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(false);
+    expect(live.records).toHaveLength(1);
+    expect(live.records[0]?.credentialId).toBe("cred-live");
+    expect(getCredentialMetadata("github", "token")).toBeUndefined();
+  });
+
+  test("live catalog list reports unreachable when CES list fails", async () => {
+    const backend = makeBackend();
+    backend.list = async () => null;
+    setCredentialRecordBackend(backend);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(true);
+    expect(live.records).toEqual([]);
+  });
+
+  test("live catalog list reports unreachable when no record backend is attached", async () => {
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(true);
+    expect(live.records).toEqual([]);
+  });
+
+  test("live catalog list fails over to CES HTTP when CES RPC list fails", async () => {
+    const rpc = makeBackend("ces-rpc");
+    rpc.list = async () => null;
+    setCredentialRecordBackend(rpc);
+
+    const http = makeBackend("ces-http");
+    const record: CredentialRecord = {
+      credentialId: "cred-http",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    http.store.set(credentialKey("github", "token"), record);
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(false);
+    expect(live.records).toHaveLength(1);
+    expect(live.records[0]?.credentialId).toBe("cred-http");
+    expect(http.listCalls).toBe(1);
+  });
+
+  test("live catalog list fails over to CES HTTP when CES RPC is unavailable", async () => {
+    const rpc = makeBackend("ces-rpc");
+    rpc.isAvailable = () => false;
+    setCredentialRecordBackend(rpc);
+
+    const http = makeBackend("ces-http");
+    const record: CredentialRecord = {
+      credentialId: "cred-http-down-rpc",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    http.store.set(credentialKey("github", "token"), record);
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(false);
+    expect(live.records[0]?.credentialId).toBe("cred-http-down-rpc");
+  });
+
+  test("live catalog list uses CES HTTP when no record backend is attached", async () => {
+    const http = makeBackend("ces-http");
+    const record: CredentialRecord = {
+      credentialId: "cred-http-only",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    };
+    http.store.set(credentialKey("github", "token"), record);
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(false);
+    expect(live.records[0]?.credentialId).toBe("cred-http-only");
+  });
+
+  test("live catalog list does not fail over when CES RPC returns an empty catalog", async () => {
+    const rpc = makeBackend("ces-rpc");
+    setCredentialRecordBackend(rpc);
+
+    const http = makeBackend("ces-http");
+    http.store.set(credentialKey("github", "token"), {
+      credentialId: "cred-http-ignored",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    });
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(false);
+    expect(live.records).toEqual([]);
+    expect(http.listCalls).toBe(0);
+  });
+
+  test("live catalog list does not fail over for a non-RPC record backend", async () => {
+    const backend = makeBackend();
+    backend.list = async () => null;
+    setCredentialRecordBackend(backend);
+
+    const http = makeBackend("ces-http");
+    http.store.set(credentialKey("github", "token"), {
+      credentialId: "cred-http-ignored",
+      service: "github",
+      field: "token",
+      allowedTools: ["bash"],
+      allowedDomains: [],
+      createdAt: 1,
+      updatedAt: 2,
+    });
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(true);
+    expect(live.records).toEqual([]);
+    expect(http.listCalls).toBe(0);
+  });
+
+  test("live catalog list reports unreachable when CES RPC and HTTP both fail", async () => {
+    const rpc = makeBackend("ces-rpc");
+    rpc.list = async () => null;
+    setCredentialRecordBackend(rpc);
+
+    const http = makeBackend("ces-http");
+    http.list = async () => null;
+    _setHttpRecordBackendForTests(http);
+
+    const live = await listCredentialRecordsLive();
+    expect(live.unreachable).toBe(true);
+    expect(live.records).toEqual([]);
+  });
+
   test("upsert write-throughs to CES without updating leftover metadata.json", async () => {
     const leftoverRecord: CredentialRecord = {
       credentialId: "cred-leftover",