@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/notifications/__tests__/schedule-result-producer.test.ts

@@ -55,6 +55,13 @@ const SCHEDULE_ID = "sched-1";
 const RUN_ID = "run-1";
 const RUN_STARTED_AT = 1700000000000;
 
+/**
+ * The synthetic user rows carrying each tool call's result. A delivery counts
+ * only when its call reported success, so a case that wants suppression has to
+ * supply the matching successful result.
+ */
+let toolResultRows: MessageRow[] = [];
+
 const realCrud = await import("../../persistence/conversation-crud.js");
 mock.module("../../persistence/conversation-crud.js", () => ({
   ...realCrud,
@@ -66,6 +73,7 @@ mock.module("../../persistence/conversation-crud.js", () => ({
     messageId === ASSISTANT_MESSAGE_ID
       ? [...turnRows.map((row) => row.id), ASSISTANT_MESSAGE_ID]
       : [messageId],
+  getMessagesAfter: () => toolResultRows,
 }));
 
 const realAttentionStore =
@@ -114,6 +122,25 @@ function makeToolCallRow(
   );
 }
 
+/** The executor's verdict on the call `makeToolCallRow(name, ...)` made. */
+function makeToolResultRow(name: string, isError = false): MessageRow {
+  return makeAssistantRow(
+    [
+      {
+        type: "tool_result",
+        tool_use_id: `tu-${name}`,
+        content: isError ? "failed" : "ok",
+        ...(isError ? { is_error: true } : {}),
+      },
+    ] as ContentBlock[],
+    {
+      id: `res-${name}`,
+      role: "user",
+      createdAt: RUN_STARTED_AT + 150,
+    },
+  );
+}
+
 function makeAttentionState(
   overrides: Partial<AttentionState> = {},
 ): AttentionState {
@@ -189,6 +216,7 @@ beforeEach(() => {
   notifiedProbeArgs.length = 0;
   alreadyNotified = false;
   turnRows = [];
+  toolResultRows = [];
   attentionState = makeAttentionState();
   assistantRow = makeAssistantRow([
     { type: "text", text: "**3 new emails** and one calendar change." },
@@ -245,7 +273,8 @@ describe("emitScheduleResultNotification", () => {
 
   test("stays silent when the run delivered by email through messaging_send", async () => {
     // The schedule skill's prescribed route for rich content. It writes no
-    // notification event, so only the tool call shows the user has the result.
+    // notification event, so the successful tool call is what shows the user
+    // has the result.
     turnRows = [
       makeToolCallRow("messaging_send", {
         platform: "gmail",
@@ -253,6 +282,7 @@ describe("emitScheduleResultNotification", () => {
         message: "Inbox digest…",
       }),
     ];
+    toolResultRows = [makeToolResultRow("messaging_send")];
     assistantRow = makeAssistantRow([
       { type: "text", text: "Sent the digest to your inbox." },
     ] as ContentBlock[]);
@@ -262,20 +292,86 @@ describe("emitScheduleResultNotification", () => {
     expect(emitCalls).toHaveLength(0);
   });
 
-  test("stays silent when the run posted to Slack through chat.postMessage", async () => {
+  test("stays silent when the run posted to a channel through messaging_send", async () => {
+    turnRows = [
+      makeToolCallRow("messaging_send", {
+        platform: "slack",
+        conversation_id: "C0123456789",
+        text: "the digest",
+      }),
+    ];
+    toolResultRows = [makeToolResultRow("messaging_send")];
+    assistantRow = makeAssistantRow([
+      { type: "text", text: "Posted the digest to #general." },
+    ] as ContentBlock[]);
+
+    await run();
+
+    expect(emitCalls).toHaveLength(0);
+  });
+
+  test("notifies when the channel send failed, so the run is not silent", async () => {
+    // The failure this guard exists for: the post never landed, the run said
+    // so in a conversation nobody has open, and suppressing on the attempt
+    // would cost the user the digest and the explanation both.
+    turnRows = [
+      makeToolCallRow("messaging_send", {
+        platform: "slack",
+        conversation_id: "C0123456789",
+        text: "the digest",
+      }),
+    ];
+    toolResultRows = [makeToolResultRow("messaging_send", true)];
+    assistantRow = makeAssistantRow([
+      { type: "text", text: "I could not post the digest to #general." },
+    ] as ContentBlock[]);
+
+    await run();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].contextPayload.requestedMessage).toBe(
+      "I could not post the digest to #general.",
+    );
+  });
+
+  test("notifies when a delivery call left no result at all", async () => {
+    // An interrupted turn persists the call without its verdict. Unproven is
+    // not delivered.
+    turnRows = [
+      makeToolCallRow("messaging_send", {
+        platform: "slack",
+        conversation_id: "C0123456789",
+        text: "the digest",
+      }),
+    ];
+    toolResultRows = [];
+    assistantRow = makeAssistantRow([
+      { type: "text", text: "Here is the digest." },
+    ] as ContentBlock[]);
+
+    await run();
+
+    expect(emitCalls).toHaveLength(1);
+  });
+
+  test("notifies after a Web API post, whose success cannot prove Slack accepted it", async () => {
+    // Slack refuses a call with HTTP 200 and `ok: false`, so a successful bash
+    // result is no evidence the post landed. This is the best case the route
+    // can produce, and it still gets the fallback.
     turnRows = [
       makeToolCallRow("bash", {
         command:
           'assistant oauth request --provider slack_channel /chat.postMessage --json \'{"channel":"C1","text":"digest"}\'',
       }),
     ];
+    toolResultRows = [makeToolResultRow("bash")];
     assistantRow = makeAssistantRow([
       { type: "text", text: "Posted the digest to #general." },
     ] as ContentBlock[]);
 
     await run();
 
-    expect(emitCalls).toHaveLength(0);
+    expect(emitCalls).toHaveLength(1);
   });
 
   test("still notifies when the run's tool calls were not deliveries", async () => {

package/src/notifications/adapters/macos.ts

@@ -20,6 +20,7 @@
 
 import type { AssistantEvent } from "../../api/index.js";
 import type { InterfaceId } from "../../channels/types.js";
+import { getAssistantName } from "../../daemon/identity-helpers.js";
 import { updateMessageContent } from "../../persistence/conversation-crud.js";
 import { publishConversationMessagesChanged } from "../../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../../util/logger.js";
@@ -101,12 +102,14 @@ export class VellumAdapter implements ChannelAdapter {
 
       const silent =
         payload.urgency !== "high" && payload.urgency !== "critical";
+      const assistantName = getAssistantName()?.trim() || undefined;
 
       this.broadcast({
         type: "notification_intent",
         deliveryId: payload.deliveryId,
         correlationId: payload.correlationId,
         sourceEventName: payload.sourceEventName,
+        ...(assistantName ? { assistantName } : {}),
         title: payload.copy.title,
         body: payload.copy.body,
         deepLinkMetadata: payload.deepLinkTarget,

package/src/notifications/assistant-reply-producer.ts

@@ -22,6 +22,7 @@ import {
   getMessageById,
   parseMessageMetadata,
 } from "../persistence/conversation-crud.js";
+import { isReplaceableTitle } from "../persistence/conversation-title-placeholders.js";
 import {
   isDesktopOriginatedUserMessage,
   isReplyPushIneligibleUserMessage,
@@ -247,9 +248,13 @@ export async function emitAssistantReplyNotification(params: {
     // lock screen. Absent `requestedTitle` lets the decision branch derive a
     // title from the body, which reads better than an empty or placeholder
     // conversation title.
-    const requestedTitle = sanitizeNotificationTitle(
-      flattenTitleWhitespace(conversation.title ?? ""),
-    );
+    //
+    // Placeholder titles are plausible non-empty strings and survive
+    // sanitizing. They count as absent so the body supplies the title instead.
+    const storedTitle = conversation.title?.trim() ?? "";
+    const requestedTitle = isReplaceableTitle(storedTitle)
+      ? ""
+      : sanitizeNotificationTitle(flattenTitleWhitespace(storedTitle));
 
     // Read as close to the emit as possible: nothing short-circuits on it.
     // Presence only speaks for a turn the desktop itself opened, on that row's

package/src/notifications/conversation-pairing.ts

@@ -130,6 +130,7 @@ export interface PairingOptions {
  * transactional request or a system alert.
  */
 const ASSISTANT_SHARE_EVENT = "assistant.share";
+const ASSISTANT_REPLY_EVENT = "chat.assistant_reply";
 
 /**
  * Promote a background share into an assistant-initiated thread, under the
@@ -263,7 +264,25 @@ export async function pairDeliveryWithConversation(
     // notification can appear. The home feed aims its "Go to Conversation"
     // button at the same row whenever it mirrors the signal.
     //
-    // So this is deliberately not gated on home-feed eligibility: a signal the
+    // `chat.assistant_reply` already has its complete reply in that transcript.
+    // Its notification body is a lock-screen preview, so appending it would
+    // create a second, truncated assistant row. Keep the conversation target
+    // for deep links without writing the preview into the transcript.
+    if (
+      strategy === "start_new_conversation" &&
+      !signal.requiresConversation &&
+      signal.sourceEventName === ASSISTANT_REPLY_EVENT
+    ) {
+      return {
+        conversationId: resolveSourceConversationId(signal),
+        messageId: null,
+        strategy,
+        createdNewConversation: false,
+        conversationFallbackUsed: false,
+      };
+    }
+
+    // This is deliberately not gated on home-feed eligibility: a signal the
     // feed declines to mirror still reaches the user through the banner, and
     // this row is what makes that landing honest.
     if (strategy === "start_new_conversation" && !signal.requiresConversation) {
@@ -748,44 +767,45 @@ async function resolveChannelDeliveryHome(params: {
  * Indexing is skipped for parity with the other notification write paths:
  * notification copy is delivery audit, not conversational memory.
  */
-async function appendBodyToSourceConversation(
-  signal: NotificationSignal,
-  channel: NotificationChannel,
-  messageContent: string,
-): Promise<{ conversationId: string; messageId: string } | null> {
-  const sourceContextId = signal.sourceContextId;
-  if (!sourceContextId) {
+function resolveSourceConversationId(signal: NotificationSignal): string | null {
+  if (!signal.sourceContextId) {
     return null;
   }
-
-  let existing: ReturnType<typeof getConversation>;
   try {
-    existing = getConversation(sourceContextId);
+    return getConversation(signal.sourceContextId)?.id ?? null;
   } catch {
     return null;
   }
-  if (!existing) {
+}
+
+async function appendBodyToSourceConversation(
+  signal: NotificationSignal,
+  channel: NotificationChannel,
+  messageContent: string,
+): Promise<{ conversationId: string; messageId: string } | null> {
+  const conversationId = resolveSourceConversationId(signal);
+  if (!conversationId) {
     return null;
   }
 
-  const message = await addMessage(existing.id, "assistant", messageContent, {
+  const message = await addMessage(conversationId, "assistant", messageContent, {
     skipIndexing: true,
   });
   // `addMessage` projects attention metadata alone, so a client with this
   // conversation open needs the messages tag to refetch the transcript. A
   // notification the user taps through to has every chance of landing on an
   // already-open conversation.
-  publishConversationMessagesChanged(existing.id);
+  publishConversationMessagesChanged(conversationId);
 
   log.info(
     {
       signalId: signal.signalId,
       channel,
-      conversationId: existing.id,
+      conversationId,
       messageId: message.id,
     },
     "Appended notification body to producing conversation",
   );
 
-  return { conversationId: existing.id, messageId: message.id };
+  return { conversationId, messageId: message.id };
 }

package/src/notifications/delivered-post-record.ts

@@ -39,6 +39,12 @@ export interface DeliveredChannelPost {
   text: string;
   /** The message id the channel assigned when it acknowledged the post. */
   providerMessageId: string;
+  /**
+   * The ids of the further posts the same text became when the channel
+   * split it, in send order. Each is reconciled onto the row like the first,
+   * so a reaction, edit, or delete naming any chunk resolves to this row.
+   */
+  additionalProviderMessageIds?: readonly string[];
   /**
    * The conversation whose turn made the post, when a different one from
    * the home it is recorded in (the messaging tool sending from a scheduled
@@ -75,7 +81,11 @@ export async function recordDeliveredChannelPost(
         : {}),
     },
   });
-  await makeSentMessageIdReconciler(row.id)(post.providerMessageId);
+  const reconcile = makeSentMessageIdReconciler(row.id);
+  await reconcile(post.providerMessageId);
+  for (const id of post.additionalProviderMessageIds ?? []) {
+    await reconcile(id);
+  }
   // A resident conversation reloads its history on the next turn so the
   // post is in context; the client refetches the transcript.
   findConversation(post.conversationId)?.markHistoryStale();

package/src/notifications/guardian-feed-projection.ts

@@ -31,6 +31,10 @@ import {
   patchFeedItemContent,
   readHomeFeed,
 } from "../home/feed-writer.js";
+import {
+  getMemoryCheckpoint,
+  setMemoryCheckpoint,
+} from "../persistence/checkpoints.js";
 import { getLogger } from "../util/logger.js";
 import {
   buildToolApprovalSourceView,
@@ -166,11 +170,17 @@ export interface GuardianFeedReceiptParams {
  *
  * The item keeps its title and summary; `guardianRequest` flips to the
  * terminal status (which is what removes the client's action buttons),
- * and urgency drops to `medium` so the item leaves the protected
- * "Needs attention" treatment and becomes an ordinary clearable
- * notification. Returns false only when the write itself failed, so the
- * withdrawal fan-out can hold its per-request receipt back and retry
- * (same contract as the other surfaces it settles). A request with no
+ * urgency drops to `medium` so the item leaves the protected "Needs
+ * attention" treatment and becomes an ordinary clearable notification,
+ * and an item still marked `new` is marked `seen`: a request settled on
+ * any surface is no longer something the user has to review, and leaving
+ * it unread is a false attention signal. That clear happens only on the
+ * edge into terminal, so a status the user set later (including marking
+ * the receipt unread again) survives a caller that receipts twice.
+ *
+ * Returns false only when the write itself failed, so the withdrawal
+ * fan-out can hold its per-request receipt back and retry (same
+ * contract as the other surfaces it settles). A request with no
  * projection item resolves true: the pending writer converges the
  * write-vs-resolve race by re-checking canonical status after its
  * append, so there is nothing here for a retry to fix.
@@ -197,6 +207,15 @@ export async function writeGuardianFeedReceipt(
     }
     const updated = await patchFeedItemContent(itemId, {
       urgency: "medium",
+      // Only on the pending-to-terminal edge. A later receipt for the
+      // same request (the fan-out retries per surface, reconciliation
+      // heals drift) must not undo a user who marked the receipt unread
+      // again; from `new` specifically, because a pending item the user
+      // dismissed outright stays dismissed.
+      status: (existing) =>
+        existing.status === "new" && isPendingGuardianFeedItem(existing)
+          ? "seen"
+          : existing.status,
       guardianRequest: (existing) => ({
         ...existing,
         status: params.status,
@@ -268,6 +287,103 @@ export async function receiptGuardianFeedItemIfRequestTerminal(
  */
 const RECONCILE_BACKFILL_LIMIT = 50;
 
+/** Ceiling on rows healed per round, mirroring the backfill bound. */
+const LEGACY_UNREAD_HEAL_LIMIT = 50;
+
+/**
+ * Completion sentinel for the one-time heal below, in the daemon's
+ * checkpoint ledger (the same shape as the lexical backfill's
+ * `lexical:messages:backfill_complete`). It is the only thing that
+ * separates the two kinds of terminal receipt stored at `status: "new"`:
+ * one that never passed the pending-to-terminal edge, and one the user
+ * marked unread after it did. The rows are byte-identical (terminal
+ * projection, urgency `medium`), so the boundary is recorded rather
+ * than inferred.
+ */
+const LEGACY_UNREAD_HEAL_COMPLETE_KEY =
+  "guardian_feed:receipt_unread_heal_complete";
+
+/**
+ * Clear unread on terminal guardian receipts that never passed the
+ * pending-to-terminal edge in `writeGuardianFeedReceipt`.
+ *
+ * Nothing else reaches those rows: the edge runs only while a
+ * projection still reads pending, reconciliation skips items whose
+ * projection is already terminal, and guardian items carry no
+ * `expiresAt`. Without this pass they read unread indefinitely.
+ *
+ * Runs once per assistant, not once per boot. A recurring pass would
+ * take back a deliberate "mark unread" every minute, and a per-boot pass
+ * would take it back on the next restart; the sentinel is what makes a
+ * later `new` unambiguously the user's, so it is never touched.
+ *
+ * Same user-choice semantics as the edge, enforced the same way: the
+ * transition is re-evaluated inside the writer's coalescing queue, moves
+ * only `new`, and leaves `seen`, `acted_on` and `dismissed` alone.
+ * Bounded per round, and the sentinel is written only once a round drains
+ * with nothing left and nothing failed, so an interrupted pass resumes.
+ */
+export async function healLegacyGuardianReceiptUnread(): Promise<void> {
+  try {
+    if (getMemoryCheckpoint(LEGACY_UNREAD_HEAL_COMPLETE_KEY) === "1") {
+      return;
+    }
+  } catch (err) {
+    // A DB that cannot answer skips the round rather than risk re-healing
+    // a row the user has since marked unread.
+    log.warn({ err }, "Guardian receipt unread heal: checkpoint unreadable");
+    return;
+  }
+
+  const stale = readHomeFeed().items.filter(
+    (item) =>
+      item.guardianRequest !== undefined &&
+      !isPendingGuardianFeedItem(item) &&
+      item.status === "new",
+  );
+
+  const batch = stale.slice(0, LEGACY_UNREAD_HEAL_LIMIT);
+  let failed = 0;
+  for (const item of batch) {
+    // Re-tested at write time rather than trusted from the read above,
+    // so a row the edge transition or the user changed in between keeps
+    // whatever it was given.
+    const updated = await patchFeedItemContent(item.id, {
+      status: (existing) =>
+        existing.status === "new" && !isPendingGuardianFeedItem(existing)
+          ? "seen"
+          : existing.status,
+    });
+    if (!updated) {
+      failed++;
+    }
+  }
+
+  if (batch.length > 0) {
+    log.info(
+      {
+        healed: batch.length - failed,
+        failed,
+        remaining: stale.length - batch.length,
+      },
+      "Cleared unread on terminal guardian receipts that never passed the edge",
+    );
+  }
+
+  if (failed > 0 || stale.length > batch.length) {
+    // Not finished: leave the sentinel unset so the next round resumes.
+    return;
+  }
+
+  try {
+    setMemoryCheckpoint(LEGACY_UNREAD_HEAL_COMPLETE_KEY, "1");
+  } catch (err) {
+    // The heal itself landed; only the sentinel is missing, so the next
+    // round repeats a pass that now has nothing to do.
+    log.warn({ err }, "Guardian receipt unread heal: checkpoint not persisted");
+  }
+}
+
 /**
  * Converge the feed against canonical guardian state. Run from the
  * guardian expiry sweep, so drift heals on the same cadence expiry does:
@@ -285,6 +401,10 @@ const RECONCILE_BACKFILL_LIMIT = 50;
  * not be mistaken for "everything resolved".
  */
 export async function reconcileGuardianFeedProjections(): Promise<void> {
+  // Ahead of the gateway read: the heal heads off stored rows alone and
+  // must not be held up by an unreachable gateway.
+  await healLegacyGuardianReceiptUnread();
+
   let pending: GuardianRequestWire[];
   try {
     pending = await listGuardianRequests({ status: "pending" });

package/src/notifications/home-feed-side-effect.ts

@@ -23,7 +23,10 @@ import {
   getMessageById,
   updateMessageContent,
 } from "../persistence/conversation-crud.js";
-import { isBackgroundConversationType } from "../persistence/conversation-types.js";
+import {
+  ASSISTANT_INITIATED_SOURCE,
+  isBackgroundConversationType,
+} from "../persistence/conversation-types.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
 import { normalizeTitle, stripMarkdown } from "../util/short-title.js";
@@ -272,6 +275,11 @@ async function resolveOwnedConversationMessageId(
   sourceConversationId: string | undefined,
   summary: string,
 ): Promise<string | undefined> {
+  // The completed reply is already the source conversation's canonical row.
+  // This signal's body is a compact push preview, not conversation content.
+  if (signal.sourceEventName === "chat.assistant_reply") {
+    return undefined;
+  }
   if (vellumDelivery?.conversationId) {
     return vellumDelivery.conversationId === sourceConversationId
       ? vellumDelivery.messageId
@@ -495,6 +503,18 @@ function deriveDetailPanelKind(
  * `isAsyncBackground` hint. `chat.assistant_reply` also mirrors: it is the
  * durable in-app record for the push sent after a user leaves a chat, while
  * retaining the normal interactive conversation as its navigation target.
+ *
+ * A delivery that materialized an assistant-initiated thread never mirrors.
+ * Under the `assistant-initiated-threads` flag, `conversation-pairing.ts`
+ * promotes a background `assistant.share` into a standard conversation
+ * stamped {@link ASSISTANT_INITIATED_SOURCE}, and that thread's row in the
+ * sidebar's assistant section is the share's one surface. Mirroring it here
+ * as well put the same share in the bell a second time, labeled by its
+ * source channel ("Heartbeat"). The check reads the paired conversation's
+ * `source` rather than re-deriving the promotion rule, so it holds however
+ * that rule narrows or widens. Guardian requests are checked first on
+ * purpose: the bell is their canonical home whatever conversation they pair
+ * with.
  */
 function resolveHomeFeedMirror(
   signal: NotificationSignal,
@@ -525,6 +545,15 @@ function resolveHomeFeedMirror(
     : fallbackConversationId;
   const sourceScheduleJobId = sourceRow?.scheduleJobId ?? undefined;
 
+  // Guardian requests always project into the feed: the "Needs
+  // attention" item is the request's canonical home, and the request
+  // blocks on the guardian whatever kind of conversation raised it.
+  if (isGuardianRequestSignalEvent(signal.sourceEventName)) {
+    return { mirror: true, sourceConversationId, sourceScheduleJobId };
+  }
+  if (isAssistantInitiatedThreadDelivery(fallbackConversationId)) {
+    return { mirror: false };
+  }
   if (
     signal.sourceChannel === "assistant_tool" ||
     signal.sourceEventName === "chat.assistant_reply"
@@ -534,18 +563,37 @@ function resolveHomeFeedMirror(
   if (signal.attentionHints.isAsyncBackground) {
     return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
-  // Guardian requests always project into the feed: the "Needs
-  // attention" item is the request's canonical home, and the request
-  // blocks on the guardian whatever kind of conversation raised it.
-  if (isGuardianRequestSignalEvent(signal.sourceEventName)) {
-    return { mirror: true, sourceConversationId, sourceScheduleJobId };
-  }
   if (isBackgroundConversationType(sourceRow?.conversationType)) {
     return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
   return { mirror: false };
 }
 
+/**
+ * Whether the vellum delivery this signal produced landed in a thread the
+ * sidebar's assistant section already shows.
+ *
+ * Best-effort like the source lookup above: a missing id, a missing row, or
+ * a lookup failure all read as "not an assistant thread", so a storage
+ * hiccup degrades to the pre-existing behavior (a bell row) rather than
+ * dropping the notification everywhere.
+ */
+function isAssistantInitiatedThreadDelivery(
+  deliveryConversationId: string | undefined,
+): boolean {
+  if (!deliveryConversationId) {
+    return false;
+  }
+  try {
+    return (
+      getConversation(deliveryConversationId)?.source ===
+      ASSISTANT_INITIATED_SOURCE
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Routing-intent enforcement can prune `selectedChannels` without also
  * pruning `renderedCopy`, so iterating `renderedCopy` directly risks