@vellumai/assistant 0.6.4 → 0.6.6

package/src/memory/conversation-analyze-job.ts

@@ -3,9 +3,8 @@
 //
 // Bridges the jobs worker to the shared analyzeConversation() service. The
 // deps bundle is stashed on a module singleton during daemon startup; if it
-// isn't set yet we skip this iteration. The next batch / idle / lifecycle
-// trigger from `enqueueAutoAnalysisIfEnabled()` will produce a fresh job
-// once the daemon has fully started.
+// isn't set yet the handler throws BackendUnavailableError so the worker
+// defers with exponential backoff until deps become available.
 //
 // The service itself distinguishes manual vs. auto triggers: this handler
 // always invokes with `trigger: "auto"`, so the rolling analysis conversation
@@ -15,6 +14,7 @@
 import type { AssistantConfig } from "../config/types.js";
 import { analyzeConversation } from "../runtime/services/analyze-conversation.js";
 import { getAnalysisDeps } from "../runtime/services/analyze-deps-singleton.js";
+import { BackendUnavailableError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 import { enqueueAutoAnalysisIfEnabled } from "./auto-analysis-enqueue.js";
 import type { MemoryJob } from "./jobs-store.js";
@@ -33,19 +33,20 @@ export async function conversationAnalyzeJob(
 
   const deps = getAnalysisDeps();
   if (!deps) {
-    // Daemon hasn't finished startup. Return without throwing — a plain
-    // Error here would be classified as fatal by `classifyError()` and the
-    // worker would mark the job permanently failed. Throwing
-    // `BackendUnavailableError` would defer, but defer counters cap out and
-    // would still permanently fail in the worst case. Since
-    // `enqueueAutoAnalysisIfEnabled()` re-enqueues on the next batch / idle
-    // / lifecycle trigger, dropping this iteration is the safest choice and
-    // avoids retry storms during slow daemon startup.
+    // Daemon hasn't finished startup. Throw BackendUnavailableError so the
+    // worker defers the job with exponential backoff instead of completing
+    // it. Returning success here would permanently drop the job via
+    // completeMemoryJob — conversations with a pre-existing queued job
+    // during startup and no subsequent activity would never be analyzed.
+    // The deferral budget (50 × up to 5min backoff) is generous enough to
+    // outlast any realistic startup delay.
     log.warn(
       { jobId: job.id, conversationId },
-      "Skipping job: analysis deps not yet initialized; will retrigger",
+      "Deferring job: analysis deps not yet initialized",
+    );
+    throw new BackendUnavailableError(
+      "Analysis deps not yet initialized during daemon startup",
     );
-    return;
   }
 
   const result = await analyzeConversation(conversationId, deps, {

package/src/memory/conversation-attention-store.ts

@@ -172,11 +172,8 @@ export function seedForkedConversationAttention(params: {
   latestAssistantMessageId: string | null;
   latestAssistantMessageAt: number | null;
 }): void {
-  const {
-    conversationId,
-    latestAssistantMessageId,
-    latestAssistantMessageAt,
-  } = params;
+  const { conversationId, latestAssistantMessageId, latestAssistantMessageAt } =
+    params;
 
   if (!latestAssistantMessageId || latestAssistantMessageAt == null) {
     return;
@@ -458,9 +455,15 @@ function resolveAssistantCursor(params: {
  * This uses the existing attention projection instead of adding a separate
  * manual-unread state machine.
  */
-export function markConversationUnread(conversationId: string): void {
+/**
+ * Returns `true` when the seen cursor was actually rewound (state changed),
+ * `false` when the conversation was already unread (no-op).
+ * Throws `UserError` when there is no assistant message to mark unread.
+ */
+export function markConversationUnread(conversationId: string): boolean {
   const db = getDb();
   const now = Date.now();
+  let changed = false;
 
   db.transaction((tx) => {
     const state = tx
@@ -511,6 +514,7 @@ export function markConversationUnread(conversationId: string): void {
           updatedAt: now,
         })
         .run();
+      changed = true;
       return;
     }
 
@@ -524,7 +528,10 @@ export function markConversationUnread(conversationId: string): void {
         eq(conversationAssistantAttentionState.conversationId, conversationId),
       )
       .run();
+    changed = true;
   });
+
+  return changed;
 }
 
 // ── getAttentionStateByConversationIds ───────────────────────────────

package/src/memory/conversation-crud.ts

@@ -10,6 +10,7 @@ import {
   gte,
   inArray,
   isNull,
+  like,
   lt,
   lte,
   sql,
@@ -23,6 +24,7 @@ import { CHANNEL_IDS, INTERFACE_IDS, isChannelId } from "../channels/types.js";
 import { getConfig } from "../config/loader.js";
 import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
 import { UserError } from "../util/errors.js";
+import { safeParseRecord } from "../util/json.js";
 import { getLogger } from "../util/logger.js";
 import { getConversationsDir } from "../util/platform.js";
 import { createRowMapper } from "../util/row-mapper.js";
@@ -102,6 +104,12 @@ export const messageMetadataSchema = z
     forkSourceMessageId: z.string().optional(),
     /** Image source paths from desktop attachments, keyed by filename. */
     imageSourcePaths: z.record(z.string(), z.string()).optional(),
+    memoryInjectedBlock: z.string().optional(),
+    turnContextBlock: z.string().optional(),
+    pkbSystemReminderBlock: z.string().optional(),
+    workspaceBlock: z.string().optional(),
+    nowScratchpadBlock: z.string().optional(),
+    pkbContextBlock: z.string().optional(),
   })
   .passthrough();
 
@@ -420,9 +428,7 @@ export function findAnalysisConversationFor(
  * not found. Tiny convenience used by the recursion guard in the
  * auto-analyze loop.
  */
-export function getConversationSource(
-  conversationId: string,
-): string | null {
+export function getConversationSource(conversationId: string): string | null {
   const db = getDb();
   const row = db
     .select({ source: conversations.source })
@@ -1044,6 +1050,63 @@ export function getMessages(conversationId: string): MessageRow[] {
     .map(parseMessage);
 }
 
+/**
+ * Return raw `metadata` strings for messages whose metadata contains the
+ * literal substring `"slackMeta"`, capped at `limit` and skipping the first
+ * `offset` matches. Pushes `LIKE` + `LIMIT`/`OFFSET` into SQL so warm Slack
+ * DM conversations don't require a full-table scan on the webhook critical
+ * path. The substring match is an indexable prefilter only — callers must
+ * parse and validate each returned string against the Slack metadata schema,
+ * because a malformed row (partial write, legacy format, unrelated key
+ * accidentally containing the literal) can still slip through the substring
+ * match. Callers that need a fixed number of *valid* rows should iterate
+ * with increasing offsets until the target is reached (capped at a
+ * reasonable maximum to bound scan cost).
+ */
+export function selectSlackMetaCandidateMetadata(
+  conversationId: string,
+  limit: number,
+  offset = 0,
+): string[] {
+  const db = getDb();
+  const rows = db
+    .select({ metadata: messages.metadata })
+    .from(messages)
+    .where(
+      and(
+        eq(messages.conversationId, conversationId),
+        like(messages.metadata, '%"slackMeta"%'),
+      ),
+    )
+    .orderBy(asc(messages.createdAt))
+    .limit(limit)
+    .offset(offset)
+    .all();
+  const out: string[] = [];
+  for (const r of rows) {
+    if (typeof r.metadata === "string" && r.metadata.length > 0) {
+      out.push(r.metadata);
+    }
+  }
+  return out;
+}
+
+/**
+ * Efficient existence check — returns true if the conversation has at least
+ * one message row. Uses `LIMIT 1` + `select({ 1 })` to avoid loading and
+ * parsing any message content.
+ */
+export function hasMessages(conversationId: string): boolean {
+  const db = getDb();
+  const row = db
+    .select({ one: sql`1` })
+    .from(messages)
+    .where(eq(messages.conversationId, conversationId))
+    .limit(1)
+    .get();
+  return row !== undefined;
+}
+
 export interface PaginatedMessagesResult {
   messages: MessageRow[];
   hasMore: boolean;
@@ -1456,6 +1519,73 @@ export function updateMessageMetadata(
     .run();
 }
 
+/**
+ * Bulk-remove the metadata fields that back the blocks stripped by
+ * `stripInjectionsForCompaction` — currently `pkbSystemReminderBlock`
+ * (`<system_reminder>`), `nowScratchpadBlock` (`<NOW.md …>`), and
+ * `pkbContextBlock` (`<knowledge_base>`). Called from compaction-strip
+ * sites so post-restart rehydration stays consistent with the in-memory
+ * state produced by `stripInjectionsForCompaction` (which removes those
+ * tags from live messages but cannot touch the DB). Fields backing
+ * blocks that are intentionally NOT stripped (`turnContextBlock`,
+ * `workspaceBlock`, `memoryInjectedBlock`) are preserved.
+ */
+export function clearStrippedInjectionMetadataForConversation(
+  conversationId: string,
+): void {
+  rawRun(
+    `UPDATE messages
+        SET metadata = json_remove(
+          metadata,
+          '$.pkbSystemReminderBlock',
+          '$.nowScratchpadBlock',
+          '$.pkbContextBlock'
+        )
+      WHERE conversation_id = ?
+        AND role = 'user'
+        AND metadata IS NOT NULL
+        AND (
+          json_extract(metadata, '$.pkbSystemReminderBlock') IS NOT NULL
+          OR json_extract(metadata, '$.nowScratchpadBlock') IS NOT NULL
+          OR json_extract(metadata, '$.pkbContextBlock') IS NOT NULL
+        )`,
+    conversationId,
+  );
+}
+
+/**
+ * Atomically update both `content` and (shallow-merged) `metadata` for a
+ * message. Used by edit-propagation paths that need to update the message
+ * body and stamp metadata (e.g. `slackMeta.editedAt`) in a single
+ * transaction so a partial write cannot leak.
+ *
+ * `metadataUpdates` is shallow-merged into the existing top-level metadata
+ * object. To merge into a nested sub-key (e.g. `slackMeta`), the caller
+ * must compute the merged sub-value first and pass `{ slackMeta: merged }`.
+ */
+export function updateMessageContentAndMetadata(
+  messageId: string,
+  newContent: string,
+  metadataUpdates: Record<string, unknown>,
+): void {
+  const db = getDb();
+  db.transaction((tx) => {
+    const row = tx
+      .select({ metadata: messages.metadata })
+      .from(messages)
+      .where(eq(messages.id, messageId))
+      .get();
+    const existing = row?.metadata ? safeParseRecord(row.metadata) : {};
+    tx.update(messages)
+      .set({
+        content: newContent,
+        metadata: JSON.stringify({ ...existing, ...metadataUpdates }),
+      })
+      .where(eq(messages.id, messageId))
+      .run();
+  });
+}
+
 /**
  * Re-link all attachments from a set of source messages to a target message.
  * Used during message consolidation so that attachments linked to deleted

package/src/memory/conversation-group-migration.ts

@@ -58,10 +58,6 @@ export function ensureGroupMigration(): void {
   }
 
   // 3. Seed system groups.
-  //
-  // `system:reflections` is a legacy group kept for backward compatibility
-  // with existing installations. New auto-analysis conversations are assigned
-  // to `system:background`; the migration in step 6 moves existing ones.
   const now = Math.floor(Date.now() / 1000);
   rawExec(`
     INSERT OR IGNORE INTO conversation_groups (id, name, sort_position, is_system_group, created_at, updated_at)
@@ -69,8 +65,7 @@ export function ensureGroupMigration(): void {
       ('system:pinned', 'Pinned', 0, TRUE, ${now}, ${now}),
       ('system:scheduled', 'Scheduled', 1, TRUE, ${now}, ${now}),
       ('system:background', 'Background', 2, TRUE, ${now}, ${now}),
-      ('system:all', 'Recents', 3, TRUE, ${now}, ${now}),
-      ('system:reflections', 'Reflections', 100, TRUE, ${now}, ${now})
+      ('system:all', 'Recents', 3, TRUE, ${now}, ${now})
   `);
 
   // One-time migration: move system:all to sortPosition 3 (from 999999).
@@ -245,5 +240,42 @@ export function ensureGroupMigration(): void {
     }
   }
 
+  // 7. One-time cleanup: delete the orphaned system:reflections group row.
+  //
+  // Reflections render as a sub-group under Background via the client's
+  // sub-group label provider; the standalone system:reflections group is no
+  // longer referenced by any conversation after step 6. Leaving the row in
+  // place causes the macOS sidebar to render an empty duplicate "Reflections"
+  // entry with a fallback folder icon alongside the Background sub-group.
+  const reflectionsGroupDeleted = rawGet<{ id: string }>(
+    "SELECT id FROM conversation_groups WHERE id = '_reflections_group_deleted_complete'",
+  );
+
+  if (!reflectionsGroupDeleted) {
+    try {
+      rawExec("BEGIN");
+
+      // Belt-and-suspenders: re-run the conversation move in case a straggler
+      // crept in between step 6's sentinel being set and this step shipping.
+      rawExec(`
+        UPDATE conversations SET group_id = 'system:background'
+        WHERE group_id = 'system:reflections'
+      `);
+
+      rawExec(`DELETE FROM conversation_groups WHERE id = 'system:reflections'`);
+
+      rawExec(`
+        INSERT OR IGNORE INTO conversation_groups (id, name, sort_position, is_system_group)
+        VALUES ('_reflections_group_deleted_complete', '_reflections_group_deleted_complete', -1, TRUE)
+      `);
+
+      rawExec("COMMIT");
+    } catch (err) {
+      rawExec("ROLLBACK");
+      log.error({ err }, "reflections-group deletion failed, rolled back");
+      throw err;
+    }
+  }
+
   migrated = true;
 }

package/src/memory/conversation-queries.ts

@@ -88,6 +88,59 @@ export function listPinnedConversations(): ConversationRow[] {
   return query.all().map(parseConversation);
 }
 
+/**
+ * Row shape returned by {@link listConversationsByTitlePrefix}.
+ *
+ * Kept deliberately narrow (no full `ConversationRow`) since the only caller
+ * today is the playground's seeded-conversation listing endpoint, which only
+ * needs display metadata plus a message count to show in a list.
+ */
+export interface ConversationTitlePrefixRow {
+  id: string;
+  title: string;
+  messageCount: number;
+  createdAt: number;
+}
+
+/**
+ * List non-archived conversations whose `title` begins with `prefix`.
+ *
+ * Uses raw SQL with a subquery for `messageCount` so a single round-trip
+ * returns everything the caller needs. The `LIKE ? || '%'` pattern does a
+ * prefix match; SQLite optimizes this with an index when one exists on
+ * `title`, otherwise it degrades to a table scan — acceptable for the
+ * playground-seeded set, which is small by construction.
+ *
+ * Escaping is unnecessary here because the prefix is a build-time constant
+ * (`PLAYGROUND_TITLE_PREFIX`) rather than user input. If callers ever pass
+ * dynamic prefixes, switch to `ESCAPE '\\'` and pre-escape `%` / `_` / `\`.
+ */
+export function listConversationsByTitlePrefix(
+  prefix: string,
+): ConversationTitlePrefixRow[] {
+  interface Row {
+    id: string;
+    title: string;
+    message_count: number;
+    created_at: number;
+  }
+  const rows = rawAll<Row>(
+    `SELECT c.id, c.title,
+            (SELECT COUNT(*) FROM messages WHERE conversation_id = c.id) AS message_count,
+            c.created_at
+     FROM conversations c
+     WHERE c.title LIKE ? || '%' AND c.archived_at IS NULL
+     ORDER BY c.created_at DESC`,
+    prefix,
+  );
+  return rows.map((r) => ({
+    id: r.id,
+    title: r.title,
+    messageCount: r.message_count,
+    createdAt: r.created_at,
+  }));
+}
+
 export function countConversations(backgroundOnly = false): number {
   const db = getDb();
   const where = backgroundOnly
@@ -257,10 +310,10 @@ export function searchConversations(
     .from(conversations)
     .where(
       and(
-          sql`${conversations.conversationType} NOT IN ('background', 'private', 'scheduled')`,
-          sql`${conversations.title} LIKE ${titlePattern} ESCAPE '\\'`,
-          sql`${conversations.archivedAt} IS NULL`,
-        ),
+        sql`${conversations.conversationType} NOT IN ('background', 'private', 'scheduled')`,
+        sql`${conversations.title} LIKE ${titlePattern} ESCAPE '\\'`,
+        sql`${conversations.archivedAt} IS NULL`,
+      ),
     )
     .all();
   for (const row of titleMatchConvs) ftsConvIds.add(row.id);

package/src/memory/conversation-title-service.ts

@@ -37,6 +37,7 @@ export type TitleOrigin =
   | "filing"
   | "local"
   | "task_submit"
+  | "updates_bulletin"
   | "misc";
 
 export interface TitleContext {
@@ -118,7 +119,8 @@ export async function generateAndPersistConversationTitle(
     return { title: conversation.title!, updated: false };
   }
 
-  const provider = params.provider ?? (await getConfiguredProvider());
+  const provider =
+    params.provider ?? (await getConfiguredProvider("conversationTitle"));
   if (!provider) {
     // No provider available — fall back to context-derived title or untitled
     const fallback = deriveFallbackTitle(context) ?? UNTITLED_FALLBACK;
@@ -133,7 +135,7 @@ export async function generateAndPersistConversationTitle(
     provider,
     systemPrompt: buildTitleSystemPrompt(),
     tools: [],
-    modelIntent: "quality-optimized",
+    callSite: "conversationTitle",
     signal,
     timeoutMs: 10_000,
   });
@@ -219,7 +221,8 @@ export async function regenerateConversationTitle(
     return { title: conversation?.title ?? UNTITLED_FALLBACK, updated: false };
   }
 
-  const provider = params.provider ?? (await getConfiguredProvider());
+  const provider =
+    params.provider ?? (await getConfiguredProvider("conversationTitle"));
   if (!provider) {
     return { title: conversation.title ?? UNTITLED_FALLBACK, updated: false };
   }
@@ -231,12 +234,18 @@ export async function regenerateConversationTitle(
   }
 
   const prompt = buildRegenerationPrompt(recentMessages);
+  // Skip the LLM call if no messages yielded extractable text — the prompt
+  // would be just the "Recent messages:" header, and the model tends to
+  // fabricate a meta-title about the emptiness rather than decline.
+  if (!/\n(?:User|Assistant): /.test(prompt)) {
+    return { title: conversation.title ?? UNTITLED_FALLBACK, updated: false };
+  }
   const result = await runBtwSidechain({
     content: prompt,
     provider,
     systemPrompt: buildTitleSystemPrompt(),
     tools: [],
-    modelIntent: "quality-optimized",
+    callSite: "conversationTitle",
     signal,
     timeoutMs: 10_000,
   });
@@ -293,6 +302,7 @@ function buildTitleSystemPrompt(): string {
     "- Do NOT echo back what the user asked you to do",
     "- Do NOT respond to the conversation content",
     "- Do NOT assess feasibility or comment on capabilities",
+    "- If input is sparse or references external context, extract a topic from the words that ARE present (e.g. 'so about that t-shirt...' → 'T-Shirt Discussion'). Never describe the absence, emptiness, or insufficiency of context — titles like 'Missing Context', 'Unclear Request', 'No Topic' are forbidden",
   ].join("\n");
 }
 
@@ -326,9 +336,27 @@ function buildTitlePrompt(
   return parts.join("\n");
 }
 
+const META_FAILURE_TITLES = new Set([
+  "missing context",
+  "no context",
+  "insufficient context",
+  "unclear context",
+  "empty context",
+  "no topic",
+  "unclear topic",
+  "unclear request",
+  "unclear message",
+  "empty conversation",
+  "empty message",
+  "no content",
+]);
+
 function normalizeTitle(raw: string): string {
   let title = raw.trim().replace(/^["']|["']$/g, "");
   title = stripMarkdown(title);
+  if (META_FAILURE_TITLES.has(title.toLowerCase())) {
+    return "";
+  }
   return title;
 }
 

package/src/memory/db-init.ts

@@ -17,6 +17,7 @@ import {
   addCoreColumns,
   createActorRefreshTokenRecordsTable,
   createActorTokenRecordsTable,
+  createApprovalPromptTsTrackerTable,
   createAssistantInboxTables,
   createCallSessionsTables,
   createCanonicalGuardianTables,
@@ -110,11 +111,13 @@ import {
   migrateNormalizeUserFileByPrincipal,
   migrateNotificationDeliveryThreadDecision,
   migrateOAuthAppsClientSecretPath,
+  migrateOAuthProvidersAvailableScopes,
   migrateOAuthProvidersBehaviorColumns,
   migrateOAuthProvidersDisplayMetadata,
   migrateOAuthProvidersFeatureFlag,
   migrateOAuthProvidersLogoUrl,
   migrateOAuthProvidersManagedServiceConfigKey,
+  migrateOAuthProvidersManagedServiceIsPaid,
   migrateOAuthProvidersPingConfig,
   migrateOAuthProvidersPingUrl,
   migrateOAuthProvidersRefreshUrl,
@@ -143,9 +146,11 @@ import {
   migrateScheduleOneShotRouting,
   migrateScheduleQuietFlag,
   migrateScheduleReuseConversation,
+  migrateScheduleScriptColumn,
   migrateSchemaIndexesAndColumns,
   migrateScrubCorruptedImageAttachments,
   migrateStripIntegrationPrefixFromProviderKeys,
+  migrateStripPlaceholderSentinelsFromMessages,
   migrateStripThinkingFromConsolidated,
   migrateUsageDashboardIndexes,
   migrateUsageLlmCallCount,
@@ -266,6 +271,7 @@ export function initializeDb(): void {
     migrateInviteCodeHashColumn,
     createActorTokenRecordsTable,
     createActorRefreshTokenRecordsTable,
+    createApprovalPromptTsTrackerTable,
     migrateGuardianPrincipalIdColumns,
     migrateBackfillGuardianPrincipalId,
     migrateGuardianPrincipalIdNotNull,
@@ -359,6 +365,7 @@ export function initializeDb(): void {
     migrateConversationsLastMessageAt,
     migrateStripThinkingFromConsolidated,
     migrateScheduleReuseConversation,
+    migrateScheduleScriptColumn,
     migrateMemoryRecallLogsQueryContext,
     migrateLlmRequestLogsCreatedAtIndex,
     migrateOAuthProvidersScopeSeparator,
@@ -370,6 +377,9 @@ export function initializeDb(): void {
     migrateOAuthProvidersTokenExchangeBodyFormat,
     migrateNormalizeUserFileByPrincipal,
     migrateConversationsArchivedAt,
+    migrateStripPlaceholderSentinelsFromMessages,
+    migrateOAuthProvidersManagedServiceIsPaid,
+    migrateOAuthProvidersAvailableScopes,
   ];
 
   // Run each migration step, catching and logging individual failures so one

package/src/memory/embedding-backend.ts

@@ -795,7 +795,7 @@ export async function selectedBackendSupportsMultimodal(
 
 async function isOllamaConfigured(config: AssistantConfig): Promise<boolean> {
   return (
-    config.services.inference.provider === "ollama" ||
+    config.llm.default.provider === "ollama" ||
     Boolean(await getProviderKeyAsync("ollama")) ||
     Boolean(getOllamaBaseUrlEnv())
   );

package/src/memory/embedding-gemini.test.ts

@@ -35,7 +35,7 @@ describe("GeminiEmbeddingBackend", () => {
       expect(url).toContain("key=test-key");
 
       const body = JSON.parse(init.body as string);
-      expect(body.model).toBe("models/test-model");
+      expect(body.model).toBeUndefined();
       expect(body.content).toEqual({ parts: [{ text: "hello world" }] });
     });
 
@@ -181,7 +181,7 @@ describe("GeminiEmbeddingBackend", () => {
       const body = JSON.parse(init.body as string);
       expect(body.taskType).toBeUndefined();
       expect(body.outputDimensionality).toBeUndefined();
-      expect(Object.keys(body)).toEqual(["model", "content"]);
+      expect(Object.keys(body)).toEqual(["content"]);
     });
   });
 
@@ -276,6 +276,45 @@ describe("GeminiEmbeddingBackend", () => {
       // Should have Bearer auth header
       const headers = init.headers as Record<string, string>;
       expect(headers["Authorization"]).toBe("Bearer ast-managed-key");
+      // Managed path must NOT include `model` in the body — Gemini models it
+      // as a protobuf oneof populated from the URL path (internally `_model`)
+      // and rejects the duplicate with "oneof field '_model' is already set".
+      // See the comment in embedSingle() for the full invariant.
+      const body = JSON.parse(init.body as string);
+      expect(body.model).toBeUndefined();
+      expect(body._model).toBeUndefined();
+    });
+
+    test("never sets `model` or `_model` in the request body (oneof invariant)", async () => {
+      // Regression for JARVIS-587: every embed_segment job was failing with
+      // `Invalid value (oneof), oneof field '_model' is already set. Cannot
+      // set 'model'`. Ensure neither field is ever present on the wire,
+      // regardless of transport.
+      const managedBackend = new GeminiEmbeddingBackend(
+        "ast-managed-key",
+        "gemini-embedding-2-preview",
+        {
+          managedBaseUrl:
+            "https://platform.example.com/v1/runtime-proxy/gemini",
+          taskType: "RETRIEVAL_DOCUMENT",
+          dimensions: 3072,
+        },
+      );
+      await managedBackend.embed(["hello"]);
+
+      const directBackend = new GeminiEmbeddingBackend(
+        "direct-key",
+        "test-model",
+      );
+      await directBackend.embed(["hello"]);
+
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+      for (const call of mockFetch.mock.calls) {
+        const [, init] = call as [string, RequestInit];
+        const body = JSON.parse(init.body as string);
+        expect(body.model).toBeUndefined();
+        expect(body._model).toBeUndefined();
+      }
     });
 
     test("uses direct Google API URL when managedBaseUrl is not set", async () => {

package/src/memory/embedding-gemini.ts

@@ -58,9 +58,14 @@ export class GeminiEmbeddingBackend implements EmbeddingBackend {
     const parts = this.buildParts(normalized);
 
     const body: Record<string, unknown> = {
-      model: `models/${this.model}`,
       content: { parts },
     };
+    // Do NOT set `model` in the body. Gemini's embedContent API models `model`
+    // as a protobuf oneof populated from the URL path (internally `_model`),
+    // so adding it to the body triggers a 400: "oneof field '_model' is
+    // already set. Cannot set 'model'". This holds for both the direct API
+    // and the managed proxy, which forwards the body unchanged; the platform
+    // billing layer parses the model from the URL path instead.
     if (this.taskType) body.taskType = this.taskType;
     if (this.dimensions) body.outputDimensionality = this.dimensions;