@vellumai/assistant 0.6.0 → 0.6.2

package/src/daemon/conversation-surfaces.ts

@@ -9,6 +9,10 @@ import {
   resolveAppDir,
   updateApp,
 } from "../memory/app-store.js";
+import {
+  getMessages,
+  updateMessageContent,
+} from "../memory/conversation-crud.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { isPlainObject } from "../util/object.js";
@@ -26,11 +30,69 @@ import type {
   UiSurfaceShow,
 } from "./message-protocol.js";
 import { INTERACTIVE_SURFACE_TYPES } from "./message-protocol.js";
+import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type { UserMessageAttachment } from "./message-types/shared.js";
 
 const log = getLogger("conversation-surfaces");
 
 const MAX_UNDO_DEPTH = 10;
+
+/**
+ * Mark a `ui_surface` content block as completed in the database so that
+ * history reconstruction preserves the completion state.  Also updates
+ * in-memory messages when available.
+ */
+export function markSurfaceCompleted(
+  ctx: { conversationId: string; messages?: Array<{ content: unknown }> },
+  surfaceId: string,
+  summary: string,
+): void {
+  // Update in-memory messages when available so subsequent reads within
+  // this session see the change without waiting for DB.
+  if (ctx.messages) {
+    for (let i = ctx.messages.length - 1; i >= 0; i--) {
+      const msg = ctx.messages[i];
+      if (!Array.isArray(msg.content)) continue;
+      for (const block of msg.content) {
+        const b = block as Record<string, unknown>;
+        if (b.type === "ui_surface" && b.surfaceId === surfaceId) {
+          b.completed = true;
+          b.completionSummary = summary;
+          break;
+        }
+      }
+    }
+  }
+
+  // Persist to DB.
+  const rows = getMessages(ctx.conversationId);
+  for (let r = rows.length - 1; r >= 0; r--) {
+    let parsed: unknown[];
+    try {
+      const result = JSON.parse(rows[r].content);
+      if (!Array.isArray(result)) continue;
+      parsed = result;
+    } catch {
+      // Some rows store plain text content (e.g. notification seeding) —
+      // skip them and keep scanning.
+      continue;
+    }
+    let found = false;
+    for (const pb of parsed) {
+      const rb = pb as Record<string, unknown>;
+      if (rb.type === "ui_surface" && rb.surfaceId === surfaceId) {
+        rb.completed = true;
+        rb.completionSummary = summary;
+        found = true;
+        break;
+      }
+    }
+    if (found) {
+      updateMessageContent(rows[r].id, JSON.stringify(parsed));
+      return;
+    }
+  }
+}
 const TASK_PROGRESS_TEMPLATE_FIELDS = ["title", "status", "steps"] as const;
 
 /**
@@ -226,6 +288,7 @@ export interface SurfaceConversationContext {
     metadata?: Record<string, unknown>,
     options?: { isInteractive?: boolean },
     displayContent?: string,
+    transport?: ConversationTransportMetadata,
   ): { queued: boolean; requestId: string; rejected?: boolean };
   getQueueDepth(): number;
   processMessage(
@@ -857,6 +920,7 @@ export function handleSurfaceAction(
       summary,
       submittedData: mergedData,
     });
+    markSurfaceCompleted(ctx, surfaceId, summary);
   }
 
   // Extract file attachments from action data so they are sent as proper
@@ -1442,6 +1506,7 @@ export async function surfaceProxyResolver(
         summary,
         submittedData: lastAction.data,
       });
+      markSurfaceCompleted(ctx, surfaceId, summary);
     } else {
       ctx.sendToClient({
         type: "ui_surface_dismiss",

package/src/daemon/conversation-tool-setup.ts

@@ -7,6 +7,7 @@
  */
 
 import { isHttpAuthDisabled } from "../config/env.js";
+import { getIsPlatform } from "../config/env-registry.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
 import {
@@ -88,7 +89,6 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   assistantId?: string;
   currentRequestId?: string;
   workingDir: string;
-  sandboxOverride?: boolean;
   abortController: AbortController | null;
   /** When set, only tools in this set may execute during the current turn. */
   allowedToolNames?: Set<string>;
@@ -185,13 +185,13 @@ export function createToolExecutor(
           : undefined,
       onOutput,
       signal: ctx.abortController?.signal,
-      sandboxOverride: ctx.sandboxOverride,
       allowedToolNames: ctx.allowedToolNames,
       memoryScopeId: ctx.memoryPolicy.scopeId,
       forcePromptSideEffects: ctx.memoryPolicy.strictSideEffects,
       toolUseId,
       hostBashProxy: ctx.hostBashProxy,
       hostFileProxy: ctx.hostFileProxy,
+      isPlatformHosted: getIsPlatform(),
       cesClient: ctx.cesClient,
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
@@ -320,8 +320,7 @@ export function createProxyApprovalCallback(
       input.matching_patterns = decision.matchingPatterns;
     }
 
-    const riskLevel =
-      decision.kind === "ask_missing_credential" ? "high" : "medium";
+    const riskLevel: string = "medium";
 
     // Check trust store before prompting — build candidates that mirror
     // buildCommandCandidates() in checker.ts for network_request.
@@ -342,10 +341,7 @@ export function createProxyApprovalCallback(
     );
     if (existingRule && existingRule.decision !== "ask") {
       if (existingRule.decision === "deny") return false;
-      // For high-risk proxy decisions, a plain allow rule (without allowHighRisk)
-      // must fall through to prompting — mirroring the checker's behavior.
-      if (riskLevel !== "high" || existingRule.allowHighRisk === true)
-        return true;
+      return true;
     }
 
     // Use the checker's built-in allowlist generation for network_request
@@ -373,7 +369,6 @@ export function createProxyApprovalCallback(
       allowlistOptions,
       scopeOptions,
       undefined,
-      undefined,
       ctx.conversationId,
     );
 
@@ -384,12 +379,13 @@ export function createProxyApprovalCallback(
       response.selectedPattern &&
       response.selectedScope
     ) {
+      const allowHighRisk = response.decision === "always_allow_high_risk";
       log.info(
         {
           toolName,
           pattern: response.selectedPattern,
           scope: response.selectedScope,
-          highRisk: response.decision === "always_allow_high_risk",
+          allowHighRisk,
         },
         "Persisting always-allow trust rule (proxy)",
       );
@@ -399,9 +395,7 @@ export function createProxyApprovalCallback(
         response.selectedScope,
         "allow",
         100,
-        response.decision === "always_allow_high_risk"
-          ? { allowHighRisk: true }
-          : undefined,
+        allowHighRisk ? { allowHighRisk: true } : undefined,
       );
     }
     if (
@@ -436,7 +430,7 @@ export function createProxyApprovalCallback(
  * history or explicit preactivation. Without this, their tools are
  * unavailable in fresh conversations until `skill_load` is called.
  */
-const DEFAULT_PREACTIVATED_SKILL_IDS = ["tasks", "notifications"];
+const DEFAULT_PREACTIVATED_SKILL_IDS = ["tasks", "notifications", "subagent"];
 
 /**
  * Subset of Conversation state that the resolveTools callback reads at each
@@ -454,9 +448,14 @@ export interface SkillProjectionContext {
   readonly channelCapabilities?: {
     channel: string;
     supportsDynamicUi: boolean;
+    clientOS?: string;
   };
   /** True when no client is connected (HTTP-only). */
   readonly hasNoClient?: boolean;
+  /** When set, only tools in this set are included in the resolved tool list (subagent delegation). */
+  subagentAllowedTools?: Set<string>;
+  /** True when this conversation belongs to a subagent spawned by SubagentManager. */
+  readonly isSubagent?: boolean;
 }
 
 // ── Conditional tool sets ────────────────────────────────────────────
@@ -471,6 +470,16 @@ const HOST_TOOL_NAMES = new Set([
 const CLIENT_CAPABILITY_TOOL_NAMES = new Set(["app_open"]);
 const PLATFORM_TOOL_NAMES = new Set(["request_system_permission"]);
 
+/**
+ * Tools that should only be visible to subagent conversations. Main (parent)
+ * conversations never see these in the LLM tool definitions. Subsequent PRs
+ * will populate this set; it starts empty so there is no behavioral change.
+ */
+export const SUBAGENT_ONLY_TOOL_NAMES = new Set<string>([
+  "file_list",
+  "notify_parent",
+]);
+
 /**
  * Determine whether a tool should be included in the LLM tool definitions
  * for the current turn based on conversation context. Tools not active for the
@@ -495,7 +504,12 @@ export function isToolActiveForContext(
     return !ctx.hasNoClient;
   }
   if (PLATFORM_TOOL_NAMES.has(name)) {
-    return process.platform === "darwin" && !ctx.hasNoClient;
+    // Check the *client's* platform, not the daemon's process.platform.
+    // In Docker the daemon runs on Linux but the connected client may be macOS.
+    return ctx.channelCapabilities?.clientOS === "macos" && !ctx.hasNoClient;
+  }
+  if (SUBAGENT_ONLY_TOOL_NAMES.has(name)) {
+    return ctx.isSubagent === true;
   }
   return true;
 }
@@ -548,18 +562,27 @@ export function createResolveToolsCallback(
       isToolActiveForContext(d.name, ctx),
     );
 
+    // When the conversation is acting as a subagent, restrict core tools to
+    // only those explicitly allowed by the parent orchestrator.
+    const scopedCoreDefs = ctx.subagentAllowedTools
+      ? filteredCoreDefs.filter((d) => ctx.subagentAllowedTools!.has(d.name))
+      : filteredCoreDefs;
+
     // Re-read MCP tool definitions from the registry each turn so conversations
     // automatically pick up tools added/removed by `vellum mcp reload`.
     const currentMcpDefs = getMcpToolDefinitions();
     log.debug(
       {
-        coreCount: filteredCoreDefs.length,
+        coreCount: scopedCoreDefs.length,
         mcpCount: currentMcpDefs.length,
         mcpTools: currentMcpDefs.map((d) => d.name),
       },
       "MCP tools resolved for turn",
     );
-    const allBaseDefs = [...filteredCoreDefs, ...currentMcpDefs];
+    const scopedMcpDefs = ctx.subagentAllowedTools
+      ? currentMcpDefs.filter((d) => ctx.subagentAllowedTools!.has(d.name))
+      : currentMcpDefs;
+    const allBaseDefs = [...scopedCoreDefs, ...scopedMcpDefs];
 
     const effectivePreactivated = [
       ...DEFAULT_PREACTIVATED_SKILL_IDS,
@@ -572,6 +595,10 @@ export function createResolveToolsCallback(
     });
     const turnAllowed = new Set(allBaseDefs.map((d) => d.name));
     for (const name of projection.allowedToolNames) {
+      // When a subagent allowlist is active, exclude skill tools not on it.
+      if (ctx.subagentAllowedTools && !ctx.subagentAllowedTools.has(name)) {
+        continue;
+      }
       turnAllowed.add(name);
     }
     ctx.allowedToolNames = turnAllowed;

package/src/daemon/conversation-workspace.ts

@@ -33,8 +33,7 @@ export function refreshWorkspaceTopLevelContextIfNeeded(
     currentConversationPath = `conversations/${resolvedDirName}/`;
   }
   ctx.workspaceTopLevelContext = renderWorkspaceTopLevelContext(snapshot, {
-    currentConversationPath,
-    currentConversationAttachmentsPath: currentConversationPath
+    conversationAttachmentsPath: currentConversationPath
       ? `${currentConversationPath}attachments/`
       : null,
   });

package/src/daemon/conversation.ts

@@ -114,6 +114,7 @@ import type {
   UsageStats,
   UserMessageAttachment,
 } from "./message-protocol.js";
+import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type {
   AssistantActivityState,
   ConfirmationStateChanged,
@@ -156,10 +157,10 @@ export class Conversation {
   /** @internal */ sendToClient: (msg: ServerMessage) => void;
   /** @internal */ eventBus = new EventBus<AssistantDomainEvents>();
   /** @internal */ workingDir: string;
-  /** @internal */ sandboxOverride?: boolean;
   /** @internal */ allowedToolNames?: Set<string>;
   /** @internal */ toolsDisabledDepth = 0;
   /** @internal */ preactivatedSkillIds?: string[];
+  /** @internal */ subagentAllowedTools?: Set<string>;
   /** @internal */ coreToolNames: Set<string>;
   /** @internal */ readonly skillProjectionState = new Map<string, string>();
   /** @internal */ readonly skillProjectionCache: SkillProjectionCache = {};
@@ -174,6 +175,7 @@ export class Conversation {
   /** @internal */ contextCompactedAt: number | null = null;
   /** @internal */ currentRequestId?: string;
   /** @internal */ hasNoClient = false;
+  /** @internal */ isSubagent = false;
   /** @internal */ headlessLock = false;
   /** @internal */ taskRunId?: string;
   /** @internal */ callSessionId?: string;
@@ -248,6 +250,8 @@ export class Conversation {
   public readonly hasSystemPromptOverride: boolean;
   public memoryPolicy: ConversationMemoryPolicy;
   /** @internal */ readonly graphMemory: ConversationGraphMemory;
+  /** @internal */ activeContextNodeIds?: string[];
+  /** @internal */ memoryScopeId?: string;
   /** @internal */ streamThinking: boolean;
   /** @internal */ turnCount = 0;
   public lastAssistantAttachments: AssistantAttachmentDraft[] = [];
@@ -277,6 +281,7 @@ export class Conversation {
     memoryPolicy?: ConversationMemoryPolicy,
     sharedCesClient?: CesClient,
     speedOverride?: Speed,
+    cacheTtl?: "5m" | "1h",
   ) {
     this.conversationId = conversationId;
     this.systemPrompt = systemPrompt;
@@ -415,6 +420,7 @@ export class Conversation {
         ...(fastModeEnabled && resolvedSpeed === "fast"
           ? { speed: resolvedSpeed }
           : {}),
+        ...(cacheTtl ? { cacheTtl } : {}),
       },
       toolDefs.length > 0 ? toolDefs : undefined,
       toolDefs.length > 0 ? toolExecutor : undefined,
@@ -439,6 +445,7 @@ export class Conversation {
   async loadFromDb(): Promise<void> {
     await loadFromDbImpl(this);
     this.restoreSurfaceStateFromHistory();
+    this.graphMemory.restoreState();
   }
 
   /**
@@ -533,8 +540,12 @@ export class Conversation {
     }
   }
 
-  setSandboxOverride(enabled: boolean | undefined): void {
-    this.sandboxOverride = enabled;
+  setSubagentAllowedTools(tools: Set<string> | undefined): void {
+    this.subagentAllowedTools = tools;
+  }
+
+  setIsSubagent(value: boolean): void {
+    this.isSubagent = value;
   }
 
   isProcessing(): boolean {
@@ -564,6 +575,9 @@ export class Conversation {
     // CES client is owned by DaemonServer — just drop the reference.
     // Do NOT close it here; the server manages the CES lifecycle.
     this.cesClient = undefined;
+    this.activeContextNodeIds = this.graphMemory.tracker.getActiveNodeIds();
+    this.memoryScopeId = this.memoryPolicy.scopeId;
+    this.graphMemory.persistState();
     disposeConversation(this);
   }
 
@@ -591,6 +605,7 @@ export class Conversation {
     metadata?: Record<string, unknown>,
     options?: { isInteractive?: boolean },
     displayContent?: string,
+    transport?: ConversationTransportMetadata,
   ): { queued: boolean; requestId: string; rejected?: boolean } {
     return enqueueMessageImpl(
       this,
@@ -603,6 +618,7 @@ export class Conversation {
       metadata,
       options,
       displayContent,
+      transport,
     );
   }
 

package/src/daemon/date-context.ts

@@ -290,31 +290,14 @@ function formatLocalDate(date: Date, timeZone: string): string {
 }
 
 /**
- * Format HH:MM and UTC offset for the given instant in the given timezone.
- */
-function formatCompactTimeAndOffset(
-  date: Date,
-  timeZone: string,
-): { time: string; offset: string } {
-  const fmt = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    hour: "2-digit",
-    minute: "2-digit",
-    hourCycle: "h23",
-    timeZoneName: "shortOffset",
-  });
-  const parts = fmt.formatToParts(date);
-  const get = (t: string) => parts.find((p) => p.type === t)?.value ?? "";
-  const hour = get("hour");
-  const minute = get("minute");
-  const offset = normalizeOffsetToken(get("timeZoneName"));
-  return { time: `${hour}:${minute}`, offset };
-}
-
-/**
- * Build a compact temporal context string for model injection.
+ * Format time as HH:MM:SS with UTC offset and timezone name.
+ *
+ * Uses the timezone resolution cascade:
+ * explicit override → configured user tz → profile user tz → host fallback.
+ *
+ * Returns format: `2026-04-02 (Thu) 01:52:33 -05:00 (America/Chicago)`
  */
-export function buildTemporalContext(
+export function formatTurnTimestamp(
   options: TemporalContextOptions = {},
 ): string {
   const now = new Date(options.nowMs ?? Date.now());
@@ -336,36 +319,26 @@ export function buildTemporalContext(
     resolvedConfiguredUserTimeZone ??
     resolvedUserTimeZone ??
     resolvedHostTimeZone;
-  const userTimeZone = resolvedConfiguredUserTimeZone ?? resolvedUserTimeZone;
-  const timeZoneSource = resolvedTimeZone
-    ? "explicit_override"
-    : resolvedConfiguredUserTimeZone
-      ? "user_settings"
-      : resolvedUserTimeZone
-        ? "user_profile_memory"
-        : "assistant_host_fallback";
-  const todayParts = localDateParts(now, timeZone);
-  const todayStr = formatLocalDate(now, timeZone);
-  const todayWeekday = WEEKDAY_SHORT[todayParts.weekday];
-  const { time, offset } = formatCompactTimeAndOffset(now, timeZone);
-
-  const tzSuffix =
-    timeZoneSource === "assistant_host_fallback" ? " (host fallback)" : "";
 
-  const lines = [
-    `<temporal_context>`,
-    `Today: ${todayStr} (${todayWeekday}) ${time} ${offset}`,
-    `TZ: ${timeZone}${tzSuffix}`,
-  ];
-
-  if (userTimeZone && userTimeZone !== timeZone) {
-    lines.push(`User TZ: ${userTimeZone}`);
-  }
-  if (resolvedHostTimeZone !== timeZone) {
-    lines.push(`Host TZ: ${resolvedHostTimeZone}`);
-  }
+  const dateStr = formatLocalDate(now, timeZone);
+  const todayParts = localDateParts(now, timeZone);
+  const dayName = WEEKDAY_SHORT[todayParts.weekday];
 
-  lines.push(`</temporal_context>`);
+  const fmt = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23",
+    timeZoneName: "shortOffset",
+  });
+  const parts = fmt.formatToParts(now);
+  const get = (t: string) => parts.find((p) => p.type === t)?.value ?? "";
+  const hour = get("hour");
+  const minute = get("minute");
+  const second = get("second");
+  const offset = normalizeOffsetToken(get("timeZoneName"));
 
-  return lines.join("\n");
+  return `${dateStr} (${dayName}) ${hour}:${minute}:${second} ${offset} (${timeZone})`;
 }
+

package/src/daemon/first-greeting.ts

@@ -8,7 +8,7 @@ import { getWorkspacePromptPath } from "../util/platform.js";
  * time," "I'm ready to be useful," and "you're in control."
  */
 export const CANNED_FIRST_GREETING =
-  "Hey. I'm brand new, no name, no memories, nothing yet. The more we work together, the more context and memory I build, and the better I get. But let's not wait around. Throw a question at me, give me a task, or ask what I can do.";
+  "Hey, I'm brand new. No name, no memories, nothing yet. Think of me like a new colleague on their first day: I'll get better the more we work together. First things first, let's figure out how we work best. What should I call you?";
 
 /**
  * Returns `true` when all of the following are true:

package/src/daemon/handlers/conversations.ts

@@ -4,6 +4,7 @@ import {
   type InterfaceId,
   parseChannelId,
   parseInterfaceId,
+  supportsHostProxy,
 } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
 import {
@@ -103,13 +104,10 @@ export function makeEventSender(params: {
             guardianPrincipalId: trustContext?.guardianPrincipalId ?? undefined,
             toolName: event.toolName,
             commandPreview:
-              redactSecrets(
-                summarizeToolInput(event.toolName, inputRecord),
-              ) || undefined,
+              redactSecrets(summarizeToolInput(event.toolName, inputRecord)) ||
+              undefined,
             riskLevel: event.riskLevel,
-            activityText: activityRaw
-              ? redactSecrets(activityRaw)
-              : undefined,
+            activityText: activityRaw ? redactSecrets(activityRaw) : undefined,
             executionTarget: event.executionTarget,
             status: "pending",
             requestCode: generateCanonicalRequestCode(),
@@ -304,7 +302,7 @@ export async function handleConversationCreate(
     // Only create the host bash proxy for desktop client interfaces that can
     // execute commands on the user's machine. Set before updateClient so
     // updateClient's call to hostBashProxy.updateSender targets the new proxy.
-    if (transportInterface === "macos" || transportInterface === "ios") {
+    if (supportsHostProxy(transportInterface)) {
       const proxy = new HostBashProxy(sendEvent, (requestId) => {
         pendingInteractions.resolve(requestId);
       });

package/src/daemon/handlers/shared.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, test } from "bun:test";
+
+import { compareSemver } from "./shared.js";
+
+describe("compareSemver", () => {
+  // ── Basic numeric comparison ──────────────────────────────────────
+  test("equal versions return 0", () => {
+    expect(compareSemver("1.2.3", "1.2.3")).toBe(0);
+  });
+
+  test("higher major returns positive", () => {
+    expect(compareSemver("2.0.0", "1.0.0")).toBeGreaterThan(0);
+  });
+
+  test("lower major returns negative", () => {
+    expect(compareSemver("1.0.0", "2.0.0")).toBeLessThan(0);
+  });
+
+  test("higher minor returns positive", () => {
+    expect(compareSemver("1.3.0", "1.2.0")).toBeGreaterThan(0);
+  });
+
+  test("higher patch returns positive", () => {
+    expect(compareSemver("1.2.4", "1.2.3")).toBeGreaterThan(0);
+  });
+
+  // ── v/V prefix handling ───────────────────────────────────────────
+  test("strips v prefix", () => {
+    expect(compareSemver("v1.2.3", "1.2.3")).toBe(0);
+  });
+
+  test("strips V prefix", () => {
+    expect(compareSemver("V1.2.3", "1.2.3")).toBe(0);
+  });
+
+  test("compares with mixed v prefix", () => {
+    expect(compareSemver("v2.0.0", "1.0.0")).toBeGreaterThan(0);
+  });
+
+  // ── Pre-release vs release ────────────────────────────────────────
+  test("pre-release sorts lower than release", () => {
+    expect(compareSemver("0.6.0-staging.1", "0.6.0")).toBeLessThan(0);
+  });
+
+  test("release sorts higher than pre-release", () => {
+    expect(compareSemver("0.6.0", "0.6.0-staging.1")).toBeGreaterThan(0);
+  });
+
+  test("both without pre-release and same version return 0", () => {
+    expect(compareSemver("0.6.0", "0.6.0")).toBe(0);
+  });
+
+  // ── Pre-release numeric comparison ────────────────────────────────
+  test("staging.1 < staging.2", () => {
+    expect(compareSemver("0.6.0-staging.1", "0.6.0-staging.2")).toBeLessThan(0);
+  });
+
+  test("staging.10 > staging.2 (numeric, not lexical)", () => {
+    expect(
+      compareSemver("0.6.0-staging.10", "0.6.0-staging.2"),
+    ).toBeGreaterThan(0);
+  });
+
+  test("equal pre-release returns 0", () => {
+    expect(compareSemver("0.6.0-staging.5", "0.6.0-staging.5")).toBe(0);
+  });
+
+  // ── Pre-release lexical comparison ────────────────────────────────
+  test("alpha < beta (lexical)", () => {
+    expect(compareSemver("1.0.0-alpha", "1.0.0-beta")).toBeLessThan(0);
+  });
+
+  test("rc < staging (lexical)", () => {
+    expect(compareSemver("1.0.0-rc", "1.0.0-staging")).toBeLessThan(0);
+  });
+
+  // ── Pre-release fewer identifiers sorts earlier ───────────────────
+  test("fewer pre-release identifiers sorts earlier", () => {
+    expect(compareSemver("1.0.0-alpha", "1.0.0-alpha.1")).toBeLessThan(0);
+  });
+
+  // ── Mixed numeric vs non-numeric per §11.4.4 ─────────────────────
+  test("numeric identifier sorts lower than non-numeric", () => {
+    expect(compareSemver("1.0.0-1", "1.0.0-alpha")).toBeLessThan(0);
+  });
+
+  test("non-numeric identifier sorts higher than numeric", () => {
+    expect(compareSemver("1.0.0-alpha", "1.0.0-1")).toBeGreaterThan(0);
+  });
+
+  // ── Multi-segment pre-release ─────────────────────────────────────
+  test("multi-segment pre-release comparison", () => {
+    expect(
+      compareSemver("1.0.0-alpha.beta.1", "1.0.0-alpha.beta.2"),
+    ).toBeLessThan(0);
+  });
+
+  // ── Hyphenated pre-release identifiers ────────────────────────────
+  test("pre-release with multiple hyphens", () => {
+    expect(
+      compareSemver("1.0.0-pre-release-1", "1.0.0-pre-release-2"),
+    ).toBeLessThan(0);
+  });
+
+  // ── Different major.minor.patch trumps pre-release ────────────────
+  test("higher patch wins regardless of pre-release", () => {
+    expect(compareSemver("0.6.1", "0.6.0-staging.99")).toBeGreaterThan(0);
+  });
+
+  test("lower patch loses regardless of pre-release absence", () => {
+    expect(compareSemver("0.5.9", "0.6.0-staging.1")).toBeLessThan(0);
+  });
+
+  // ── Edge cases ────────────────────────────────────────────────────
+  test("missing segments default to 0", () => {
+    expect(compareSemver("1", "1.0.0")).toBe(0);
+  });
+
+  test("two-segment version", () => {
+    expect(compareSemver("1.2", "1.2.0")).toBe(0);
+  });
+
+  // ── Sort integration ──────────────────────────────────────────────
+  test("Array.sort produces correct semver order", () => {
+    const versions = [
+      "0.6.0",
+      "0.6.0-staging.2",
+      "0.5.9",
+      "0.6.0-staging.10",
+      "v0.6.0-staging.1",
+      "0.6.1",
+    ];
+    const sorted = [...versions].sort(compareSemver);
+    expect(sorted).toEqual([
+      "0.5.9",
+      "v0.6.0-staging.1",
+      "0.6.0-staging.2",
+      "0.6.0-staging.10",
+      "0.6.0",
+      "0.6.1",
+    ]);
+  });
+});