@vellumai/assistant 0.7.3 → 0.8.1

package/src/prompts/update-bulletin-job.ts

@@ -2,14 +2,12 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 
 import { getConfig } from "../config/loader.js";
-import { INTERNAL_GUARDIAN_TRUST_CONTEXT } from "../daemon/trust-context.js";
 import {
   getMemoryCheckpoint,
   setMemoryCheckpoint,
 } from "../memory/checkpoints.js";
-import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
-import { deleteConversation } from "../memory/conversation-crud.js";
-import { wakeAgentForOpportunity } from "../runtime/agent-wake.js";
+import { runBackgroundJob } from "../runtime/background-job-runner.js";
+import { hasReceivedUserMessage } from "../runtime/pre-first-message-gate.js";
 import { getLogger } from "../util/logger.js";
 import {
   getWorkspaceDirDisplay,
@@ -20,6 +18,12 @@ const log = getLogger("update-bulletin-job");
 
 const HASH_CHECKPOINT_KEY = "updates:last_processed_hash";
 const EMPTY_HASH = "empty";
+/**
+ * Hard timeout for the update-bulletin agent turn. The agent reads a small
+ * markdown file and (usually) deletes it; 10 minutes is generous headroom for
+ * a slow model + any tool calls (e.g. memory writes).
+ */
+const UPDATE_BULLETIN_TIMEOUT_MS = 10 * 60 * 1000;
 
 function updateBulletinHint(): string {
   const workspace = getWorkspaceDirDisplay();
@@ -47,31 +51,48 @@ function readTrimmedContent(path: string): ReadResult {
 /**
  * Fire-and-forget background processor for the release-notes bulletin.
  *
- * If `<workspace>/UPDATES.md` has new (unprocessed) content, this
- * bootstraps a background conversation and wakes the agent loop with a hint
- * pointing at the file. De-duplication uses a sha256 content hash stored in
- * the `updates:last_processed_hash` memory checkpoint — an `"empty"` sentinel
+ * If `<workspace>/UPDATES.md` has new (unprocessed) content, this drives a
+ * background conversation through `runBackgroundJob` with a hint pointing at
+ * the file. De-duplication uses a sha256 content hash stored in the
+ * `updates:last_processed_hash` memory checkpoint — an `"empty"` sentinel
  * represents a missing/blank file so the job skips the common no-op case.
  *
- * The function never throws: any error inside the bootstrap/wake flow is
- * logged at `warn` and swallowed, so callers can safely invoke it in a
- * non-awaited context.
+ * The function never throws: any error inside `runBackgroundJob` is captured
+ * in its structured result (which already emits an `activity.failed`
+ * notification) and surrounding errors are logged at `warn` and swallowed,
+ * so callers can safely invoke it in a non-awaited context.
  *
  * Checkpoint write rules (intentionally conservative — prefer retry over
  * poisoning the checkpoint when state is ambiguous):
  *   - File missing → checkpoint = `EMPTY_HASH`.
  *   - File present but unreadable → checkpoint UNCHANGED, warn logged.
- *   - Wake not invoked (e.g. resolver not yet registered) → UNCHANGED.
- *   - Wake invoked but no tool calls AND file unchanged → UNCHANGED
- *     (indistinguishable from a silent failure; safer to retry).
- *   - Wake invoked + (produced tool calls OR file deleted) → checkpoint
- *     reflects the post-wake state.
+ *   - `runBackgroundJob` returned `ok: false` → checkpoint UNCHANGED so the
+ *     next startup retries. The runner has already emitted an
+ *     `activity.failed` notification.
+ *   - Job ran successfully + file deleted/empty → checkpoint = `EMPTY_HASH`.
+ *   - Job ran successfully + file unchanged → checkpoint = current hash
+ *     (agent intentionally left the file).
  */
 export async function runUpdateBulletinJobIfNeeded(): Promise<void> {
   if (getConfig().updates.enabled === false) {
     return;
   }
 
+  // Warm-pool guard: don't process release notes before a real user has
+  // interacted with the assistant. Provider credentials are typically not
+  // registered until the user hatches the image, so this job would fail
+  // and leave a "Background job failed: update-bulletin" row in the
+  // sidebar the user inherits at hatch time. The checkpoint is left
+  // untouched on purpose — once the user sends their first message, the
+  // job runs on the next daemon start (or after the next UPDATES.md
+  // change) with normal semantics.
+  if (!hasReceivedUserMessage()) {
+    log.info(
+      "update-bulletin-job: skipped — daemon has not received a first user message yet",
+    );
+    return;
+  }
+
   try {
     const updatesPath = getWorkspacePromptPath("UPDATES.md");
     const initial = readTrimmedContent(updatesPath);
@@ -98,60 +119,39 @@ export async function runUpdateBulletinJobIfNeeded(): Promise<void> {
       return;
     }
 
-    const conv = bootstrapConversation({
-      conversationType: "background",
-      source: "updates_bulletin",
+    const result = await runBackgroundJob({
+      jobName: "update-bulletin",
+      source: "update-bulletin",
       origin: "updates_bulletin",
-      systemHint: "Processing release updates",
-      groupId: "system:background",
-    });
-    const wakeResult = await wakeAgentForOpportunity({
-      conversationId: conv.id,
-      hint: updateBulletinHint(),
-      source: "updates_bulletin",
-      trustContext: INTERNAL_GUARDIAN_TRUST_CONTEXT,
+      prompt: updateBulletinHint(),
+      trustContext: {
+        sourceChannel: "vellum",
+        trustClass: "guardian",
+      },
+      callSite: "mainAgent",
+      timeoutMs: UPDATE_BULLETIN_TIMEOUT_MS,
     });
 
-    if (!wakeResult.invoked) {
+    if (!result.ok) {
       log.warn(
-        { conversationId: conv.id, reason: wakeResult.reason },
-        "Update bulletin wake silently no-op'd (invoked=false); cleaning up orphan background conversation and leaving checkpoint unchanged so next startup retries",
+        {
+          conversationId: result.conversationId,
+          errorKind: result.errorKind,
+          err: result.error?.message,
+        },
+        "update-bulletin-job: runBackgroundJob returned ok=false; leaving checkpoint unchanged so next startup retries (failure notification already emitted by runner)",
       );
-      // Belt-and-suspenders cleanup: `wakeAgentForOpportunity()` can return
-      // `{invoked: false}` for reasons unrelated to the wake-resolver
-      // registration order (resolver returns null because the conversation
-      // cannot be hydrated, etc.). Without this cleanup each such occurrence
-      // leaks a conversation DB row.
-      //
-      // Wrapped in its own try/catch so a cleanup failure never propagates
-      // out of this fire-and-forget task.
-      //
-      // TODO: the `queueGenerateConversationTitle()` call that
-      // `bootstrapConversation()` fires is already in flight by the time we
-      // reach here. The title service checks `isReplaceableTitle()` before
-      // writing, but the LLM sidechain call itself still runs against the
-      // now-deleted conversation id. Adding a cancellation/existence hook
-      // in `conversation-title-service.ts` would plug this one-call waste,
-      // but this code path is rare, so we accept the one-time cost.
-      try {
-        deleteConversation(conv.id);
-      } catch (err) {
-        log.warn(
-          { err, conversationId: conv.id },
-          "update-bulletin-job: failed to delete orphan background conversation; continuing",
-        );
-      }
       return;
     }
 
-    // Re-read after the wake. We need to know whether the file was deleted
-    // or modified to decide whether to advance the checkpoint.
+    // Re-read after the job completed. We need to know whether the file was
+    // deleted or modified to decide whether to advance the checkpoint.
     const after = readTrimmedContent(updatesPath);
 
     if (after.kind === "error") {
       log.warn(
         { err: after.err, path: updatesPath },
-        "update-bulletin-job: failed to re-read UPDATES.md after wake; leaving checkpoint unchanged so next startup retries",
+        "update-bulletin-job: failed to re-read UPDATES.md after job; leaving checkpoint unchanged so next startup retries",
       );
       return;
     }
@@ -166,26 +166,14 @@ export async function runUpdateBulletinJobIfNeeded(): Promise<void> {
       return;
     }
 
-    if (!wakeResult.producedToolCalls) {
-      // Wake returned cleanly but the agent did nothing observable AND the
-      // file is still here. We can't distinguish "agent processed and chose
-      // to no-op" from "silent failure", so leave the checkpoint alone and
-      // let the next startup retry.
-      log.warn(
-        { conversationId: conv.id },
-        "update-bulletin-job: wake produced no tool calls and file is unchanged; leaving checkpoint unchanged so next startup retries",
-      );
-      return;
-    }
-
-    // Wake produced tool calls and the file is still present — the agent
-    // intentionally left it (or modified it). Record the current hash so we
-    // don't re-wake on the same content.
+    // Job succeeded and the file is still present — the agent intentionally
+    // left it (or modified it). Record the current hash so we don't re-process
+    // the same content on next startup.
     setMemoryCheckpoint(HASH_CHECKPOINT_KEY, computeHash(after.content));
   } catch (err) {
     log.warn(
       { err },
-      "update-bulletin-job: wake flow threw; swallowing so callers can fire-and-forget",
+      "update-bulletin-job: outer flow threw; swallowing so callers can fire-and-forget",
     );
     return;
   }

package/src/providers/__tests__/dispatch-connection-routing.test.ts

@@ -0,0 +1,279 @@
+/**
+ * Dispatcher gate test — proves that `resolveConfiguredProvider` routes
+ * through `resolveProviderFromConnection` for every dispatch when a profile
+ * names a `provider_connection`, AND that misconfigurations now fail loudly
+ * rather than silently rerouting to a legacy registry.
+ *
+ * Hard config errors (missing connection name, unknown connection,
+ * provider mismatch) throw `ConnectionResolutionError`. Soft credential
+ * failures (resolver returns null) still return null so callers can
+ * degrade gracefully.
+ *
+ * Hard gates:
+ *   1. Two profiles, same provider, different `provider_connection` →
+ *      resolver called twice with the right connection each time, with
+ *      auth bundles distinguishable per profile (mix-and-match goal #2
+ *      of the design).
+ *   2. Profile WITHOUT `provider_connection` → throws
+ *      `ConnectionResolutionError` (configuration bug; backfill should
+ *      have populated it).
+ *   3. `provider_connection` set but unknown → throws (loud config error).
+ *   4. `provider_connection` set, found, but resolver returns null →
+ *      returns null (soft credential failure; satellite caller decides
+ *      what to do).
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Module mocks (must be declared before the import-under-test).
+// ---------------------------------------------------------------------------
+
+mock.module("../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+// Test fixtures for the mocked config loader.
+let mockLlmConfig: Record<string, unknown> = {};
+
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({
+    llm: mockLlmConfig,
+    services: { inference: { mode: "your-own" } },
+  }),
+}));
+
+// Mock the DB getter — we never actually hit SQLite since `getConnection` is
+// also mocked. Returning a sentinel keeps the call signature satisfied.
+const mockDbSentinel = { __mock: "db" };
+mock.module("../../memory/db-connection.js", () => ({
+  getDb: () => mockDbSentinel,
+}));
+
+// Spy storage for the resolver — each test inspects what was passed in.
+type Connection = {
+  name: string;
+  provider: string;
+  auth: { type: string; credential?: string };
+};
+
+const resolveProviderCalls: Connection[] = [];
+
+// Each connection name maps to a distinct fake Provider instance. Returning
+// distinguishable instances lets the test assert that two profiles with
+// different connections route to different providers.
+const fakeProviders = new Map<string, { name: string; tag: string }>();
+
+// Connection registry the mocked `getConnection` reads from.
+const fakeConnections = new Map<string, Connection>();
+
+mock.module("../inference/connections.js", () => ({
+  getConnection: (_db: unknown, name: string) =>
+    fakeConnections.get(name) ?? null,
+}));
+
+mock.module("../registry.js", () => ({
+  // The dispatch path does not import getProvider.
+  // Kept here only because other test files share this mock module shape.
+  getProvider: (name: string) => {
+    throw new Error(`legacy getProvider should not be called: ${name}`);
+  },
+  initializeProviders: async () => {},
+  listProviders: () => Array.from(fakeProviders.values()),
+  // The function under test — wraps the dispatcher's connection-aware path.
+  resolveProviderFromConnection: async (connection: Connection) => {
+    resolveProviderCalls.push(connection);
+    return fakeProviders.get(`conn:${connection.name}`) ?? null;
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Imports (after mocks).
+// ---------------------------------------------------------------------------
+
+import { ConnectionResolutionError } from "../connection-resolution.js";
+import { getConfiguredProvider } from "../provider-send-message.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function setLlmConfig(c: Record<string, unknown>): void {
+  mockLlmConfig = c;
+}
+
+function registerConnection(
+  c: Connection,
+  providerStub: { name: string; tag: string },
+): void {
+  fakeConnections.set(c.name, c);
+  fakeProviders.set(`conn:${c.name}`, providerStub);
+}
+
+function reset(): void {
+  resolveProviderCalls.length = 0;
+  fakeConnections.clear();
+  fakeProviders.clear();
+  mockLlmConfig = {};
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("dispatch routes through provider_connection (Phase 1: connection-only)", () => {
+  beforeEach(reset);
+
+  test("two profiles, same provider, different connections → resolver called twice with the right connection each time", async () => {
+    // Same underlying provider impl, two distinguishable connection-bound
+    // Provider stubs.
+    registerConnection(
+      {
+        name: "anthropic-managed",
+        provider: "anthropic",
+        auth: { type: "platform" },
+      },
+      { name: "anthropic", tag: "managed-stub" },
+    );
+    registerConnection(
+      {
+        name: "anthropic-personal",
+        provider: "anthropic",
+        auth: {
+          type: "api_key",
+          credential: "credential/test/anthropic",
+        },
+      },
+      { name: "anthropic", tag: "personal-stub" },
+    );
+
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        "anthropic-managed-profile": {
+          provider: "anthropic",
+          provider_connection: "anthropic-managed",
+        },
+        "anthropic-personal-profile": {
+          provider: "anthropic",
+          provider_connection: "anthropic-personal",
+        },
+      },
+    });
+
+    const managedResult = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "anthropic-managed-profile",
+    });
+    const personalResult = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "anthropic-personal-profile",
+    });
+
+    // Hard gate #1: the resolver was called — at all.
+    expect(resolveProviderCalls.length).toBe(2);
+
+    // Hard gate #2: each call received the right connection by name.
+    expect(resolveProviderCalls[0].name).toBe("anthropic-managed");
+    expect(resolveProviderCalls[1].name).toBe("anthropic-personal");
+
+    // Hard gate #3: the auth bundle on the connection matches what we'd
+    // expect at adapter-call time. Different auth types per profile = mix-
+    // and-match works.
+    expect(resolveProviderCalls[0].auth.type).toBe("platform");
+    expect(resolveProviderCalls[1].auth.type).toBe("api_key");
+    expect(resolveProviderCalls[1].auth.credential).toBe(
+      "credential/test/anthropic",
+    );
+
+    // Sanity: dispatch returned non-null for both.
+    expect(managedResult).not.toBeNull();
+    expect(personalResult).not.toBeNull();
+  });
+
+  test("profile WITHOUT provider_connection returns null (graceful fallback)", async () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        "legacy-profile": {
+          provider: "anthropic",
+          // no provider_connection — boot-time backfill is expected to
+          // populate this in production. When unset, the per-callsite
+          // resolver returns null so callsites with deterministic
+          // fallbacks (invite instructions, telegram resolution, etc.)
+          // keep working. Hard config errors (lookup failed, mismatch)
+          // still throw via tryResolveProviderForConnectionName.
+        },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "legacy-profile",
+    });
+
+    expect(result).toBeNull();
+    // Resolver must NOT have been called — short-circuited before reaching it.
+    expect(resolveProviderCalls.length).toBe(0);
+  });
+
+  test("provider_connection set but unknown → throws ConnectionResolutionError(not_found)", async () => {
+    // No connection registered — the dispatcher should throw with reason
+    // 'not_found' rather than falling through to a legacy lookup.
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        broken: {
+          provider: "anthropic",
+          provider_connection: "does-not-exist",
+        },
+      },
+    });
+
+    let caught: unknown;
+    try {
+      await getConfiguredProvider("mainAgent", { overrideProfile: "broken" });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(ConnectionResolutionError);
+    expect((caught as ConnectionResolutionError).reason).toBe("not_found");
+    expect((caught as ConnectionResolutionError).connectionName).toBe(
+      "does-not-exist",
+    );
+    // Resolver was NOT called (lookup failed before reaching it).
+    expect(resolveProviderCalls.length).toBe(0);
+  });
+
+  test("provider_connection set, connection found, but resolver returns null → returns null (soft credential failure)", async () => {
+    // Connection exists but resolver returns null (e.g., missing credential).
+    fakeConnections.set("anthropic-broken-personal", {
+      name: "anthropic-broken-personal",
+      provider: "anthropic",
+      auth: { type: "api_key", credential: "credential/missing" },
+    });
+    // Intentionally do NOT register a fakeProviders entry for
+    // `conn:anthropic-broken-personal` — resolver returns null.
+
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        "broken-creds": {
+          provider: "anthropic",
+          provider_connection: "anthropic-broken-personal",
+        },
+      },
+    });
+
+    const result = await getConfiguredProvider("mainAgent", {
+      overrideProfile: "broken-creds",
+    });
+
+    // Resolver WAS called — but returned null. No legacy fallback.
+    expect(resolveProviderCalls.length).toBe(1);
+    expect(resolveProviderCalls[0].name).toBe("anthropic-broken-personal");
+    // Soft credential failure → null result. Satellite callers handle null
+    // however they want (rollup producer skips, others throw a domain-
+    // specific error).
+    expect(result).toBeNull();
+  });
+});