@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -16,11 +16,12 @@ import type {
 } from "../channels/types.js";
 import { getConfig } from "../config/loader.js";
 import { recordEstimate } from "../context/estimator-calibration.js";
+import { stripInjectionsForCompaction } from "../context/strip-injections.js";
 import { getCalibrationProviderKey } from "../context/token-estimator.js";
 import {
   recordCompactionEndBestEffort,
   recordCompactionStartBestEffort,
-} from "../memory/compaction-log-writer-clickhouse.js";
+} from "../memory/compaction-log-store-clickhouse.js";
 import { projectAssistantMessage } from "../memory/conversation-attention-store.js";
 import {
   deleteMessageById,
@@ -286,6 +287,14 @@ export interface EventHandlerState {
    * never claims content a flush has not yet written.
    */
   lastPersistedContentSeq: number | undefined;
+  /**
+   * Pre-compaction history buffered from `context_compacting` start events,
+   * keyed by `compactionId`. The paired `compaction_completed` event no
+   * longer carries the pre-compaction history, so the dispatcher re-derives
+   * the stripped durable base from the buffered start messages. Entries are
+   * consumed (deleted) when the end event dispatches.
+   */
+  readonly compactionStartMessages: Map<string, Message[]>;
 }
 
 /** Immutable context shared across event handlers within a single agent loop run. */
@@ -301,8 +310,8 @@ export interface EventHandlerDeps {
   readonly turnInterfaceContext: TurnInterfaceContext;
   /**
    * Commit a successful inline compaction to durable state. Invoked from the
-   * `compaction_completed` dispatch case (when `result.compacted`) with the
-   * loop's compaction result and the stripped pre-compaction `messages`. Supplied
+   * `compaction_completed` dispatch case (when `compacted`) with the
+   * loop's compaction result and the stripped pre-compaction history. Supplied
    * by the orchestrator because the body writes Conversation DB-record fields,
    * projects Slack provenance, and emits transport the loop is intentionally
    * blind to.
@@ -361,6 +370,7 @@ export function createEventHandlerState(): EventHandlerState {
     currentMessageContent: [],
     currentThinkingTimestamps: [],
     lastPersistedContentSeq: undefined,
+    compactionStartMessages: new Map(),
   };
 }
 
@@ -2316,6 +2326,9 @@ export async function dispatchAgentEvent(
       }
       case "context_compacting":
         recordCompactionStartBestEffort(deps.ctx.conversationId, event);
+        // Buffer the pre-compaction history so the paired end event can
+        // re-derive the stripped durable base.
+        state.compactionStartMessages.set(event.compactionId, event.messages);
         deps.ctx.emitActivityState("thinking", "context_compacting", {
           requestId: deps.reqId,
           statusText: "Compacting context",
@@ -2329,22 +2342,34 @@ export async function dispatchAgentEvent(
         // banner.
         deps.onEvent(event);
         break;
-      case "compaction_completed":
-        // Always commit the loop-stripped `messages` as the durable message base
-        // so re-injection re-applies onto the stripped history even when the
-        // pipeline ran but did not compact. When it did compact, commit the
-        // durable result (DB-record fields, Slack provenance, SSE) — which
-        // overwrites `ctx.messages` with the compacted history. This runs
-        // before the loop's `reinject` hook (the loop awaits this dispatch),
-        // so the committed history is in place in time. A failed durable
-        // commit re-throws below to abort the turn rather than re-injecting
-        // against half-applied state.
+      case "compaction_completed": {
+        // Always commit the stripped pre-compaction history as the durable
+        // message base so re-injection re-applies onto the stripped history
+        // even when the pipeline ran but did not compact. The base is
+        // re-derived from the buffered start event's messages (the end event
+        // carries only the pipeline's output). When the pipeline did compact,
+        // commit the durable result (DB-record fields, Slack provenance,
+        // SSE) — which overwrites `ctx.messages` with the compacted history.
+        // This runs before the loop's `reinject` hook (the loop awaits this
+        // dispatch), so the committed history is in place in time. A failed
+        // durable commit re-throws below to abort the turn rather than
+        // re-injecting against half-applied state.
         recordCompactionEndBestEffort(deps.ctx.conversationId, event);
-        deps.ctx.messages = event.messages;
-        if (event.result.compacted) {
-          await deps.applyCompaction(event.result, event.messages);
+        const startMessages = state.compactionStartMessages.get(
+          event.compactionId,
+        );
+        state.compactionStartMessages.delete(event.compactionId);
+        // Fall back to the pipeline's output when the start event was never
+        // buffered — on the no-compaction path it is the stripped input.
+        const strippedBase = startMessages
+          ? stripInjectionsForCompaction(startMessages)
+          : event.messages;
+        deps.ctx.messages = strippedBase;
+        if (event.compacted) {
+          await deps.applyCompaction(event, strippedBase);
         }
         break;
+      }
       case "history_stripped":
         // Record the history-stripped DB marker right after the loop strips
         // injections (before the pipeline). Best-effort: a transient marker

package/src/daemon/conversation-error.ts

@@ -255,7 +255,7 @@ export function classifyConversationError(
     return {
       code: "PROVIDER_NOT_CONFIGURED",
       userMessage:
-        "No compatible provider connection found for this profile. Check your provider connections in Settings.",
+        "No compatible provider connection found for this profile. Check your provider connections in Settings → Models & Services.",
       retryable: true,
       debugDetails,
       errorCategory: "provider_not_configured",
@@ -334,15 +334,6 @@ function classifyCore(
       }
       return invalidApiKeyClassification(attribution);
     }
-    if (error.statusCode === 401) {
-      return {
-        code: "PROVIDER_INVALID_KEY",
-        userMessage:
-          "Your API key is invalid or expired. Update it in Settings or switch to managed mode.",
-        retryable: false,
-        errorCategory: "provider_invalid_key",
-      };
-    }
     if (error.statusCode === 402) {
       if (isManagedBalanceError(error)) {
         return managedBalanceClassification();
@@ -543,7 +534,7 @@ function providerBillingClassification(): Omit<
   return {
     code: "PROVIDER_BILLING",
     userMessage:
-      "Your API provider account or key needs credits. Add funds with the provider or update the key in Settings.",
+      "Your API provider account or key needs credits. Add funds with the provider or update the key in Settings → Models & Services.",
     retryable: false,
     errorCategory: "provider_billing",
   };
@@ -583,8 +574,8 @@ function invalidApiKeyClassification(
   return {
     code: "PROVIDER_INVALID_KEY",
     userMessage: target
-      ? `The API key${target} was rejected by the provider. Update it in Settings.`
-      : "Your API key was rejected by the provider. Update it in Settings.",
+      ? `The API key${target} was rejected by the provider. Update it in Settings → Models & Services.`
+      : "Your API key was rejected by the provider. Update it in Settings → Models & Services.",
     retryable: false,
     errorCategory: "provider_invalid_key",
     ...(attribution?.connectionName
@@ -610,8 +601,8 @@ function providerNotConfiguredClassification(
   return {
     code: "PROVIDER_NOT_CONFIGURED",
     userMessage: target
-      ? `No API key configured${target}. Add one in Settings to start chatting.`
-      : "No API key configured for inference. Add one in Settings to start chatting.",
+      ? `No API key configured${target}. Add one in Settings → Models & Services to start chatting.`
+      : "No API key configured for inference. Add one in Settings → Models & Services to start chatting.",
     retryable: true,
     errorCategory: "provider_not_configured",
     ...(attribution?.connectionName

package/src/daemon/conversation.ts

@@ -51,6 +51,7 @@ import {
   resolveOverrideProfile,
   setConversationHistoryStrippedAt,
 } from "../memory/conversation-crud.js";
+import { getResolvedConversationDirPath } from "../memory/conversation-directories.js";
 import { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
 import { unwrapMemoryBlock, wrapMemoryBlock } from "../memory/memory-marker.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
@@ -638,6 +639,14 @@ export class Conversation {
       toolExecutor: toolDefs.length > 0 ? toolExecutor : undefined,
       resolveTools,
       resolveSystemPrompt: resolveSystemPromptCallback,
+      resolveConversationDir: () => {
+        const conv = getConversation(this.conversationId);
+        if (!conv) return null;
+        return getResolvedConversationDirPath(
+          this.conversationId,
+          conv.createdAt,
+        );
+      },
     });
     createContextWindowManager({
       provider,

package/src/daemon/disk-pressure-policy.ts

@@ -54,7 +54,6 @@ const BACKGROUND_SOURCES = new Set([
   "reminder",
   "schedule",
   "task",
-  "update-bulletin",
 ]);
 const LOCAL_OWNER_INTERFACES = new Set(["macos", "web", "vellum", "cli"]);
 

package/src/daemon/lifecycle.ts

@@ -35,7 +35,6 @@ import {
 } from "../credential-execution/startup-timeout.js";
 import { FilingService } from "../filing/filing-service.js";
 import { HeartbeatService } from "../heartbeat/heartbeat-service.js";
-import { startHomeContentRefresh } from "../home/home-content-refresh.js";
 import { backfillRelationshipStateIfMissing } from "../home/relationship-state-writer.js";
 import { closeSentry, initSentry, setSentryDeviceId } from "../instrument.js";
 import {
@@ -98,8 +97,8 @@ import {
   listWorkItems,
   updateWorkItem,
 } from "../work-items/work-item-store.js";
+import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/adaptive-thinking-repair.js";
 import { WorkspaceHeartbeatService } from "../workspace/heartbeat-service.js";
-import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/migrations/097-enable-adaptive-thinking-managed-profiles.js";
 import { WORKSPACE_MIGRATIONS } from "../workspace/migrations/registry.js";
 import { runWorkspaceMigrations } from "../workspace/migrations/runner.js";
 import {
@@ -480,10 +479,6 @@ export async function runDaemon(): Promise<void> {
         );
       });
 
-      // Pre-warm LLM-generated home page content (greeting + suggestion
-      // prompts) so the GET handler never triggers LLM calls.
-      startHomeContentRefresh();
-
       // Backfill injection templates on Slack bot token credentials so the
       // credential proxy can inject Authorization headers. Safe on every startup.
       try {
@@ -780,20 +775,6 @@ export async function runDaemon(): Promise<void> {
     startDiskPressureGuardForLifecycle();
     startOrphanReaper();
 
-    // Kick off the update bulletin background job AFTER `server.start()`
-    // resolves. The conversation store must be initialized before wake
-    // calls can resolve targets.
-    //
-    // Kept fire-and-forget (`void import(...).then(...).catch(...)`) so the
-    // daemon never blocks startup on it.
-    if (dbReady) {
-      void import("../prompts/update-bulletin-job.js")
-        .then((m) => m.runUpdateBulletinJobIfNeeded())
-        .catch((err) =>
-          log.warn({ err }, "Update bulletin job failed — continuing startup"),
-        );
-    }
-
     // Mutable refs for Qdrant and memory worker so background
     // init can assign them and the shutdown handler always sees the latest value.
     const bgRefs: {

package/src/daemon/message-types/conversations.ts

@@ -7,6 +7,7 @@ import type { ConversationListInvalidatedEvent } from "../../api/events/conversa
 import type { ConversationTitleUpdatedEvent } from "../../api/events/conversation-title-updated.js";
 import type { GenerationCancelledEvent } from "../../api/events/generation-cancelled.js";
 import type { GenerationHandoffEvent } from "../../api/events/generation-handoff.js";
+import type { UsageProgressEvent } from "../../api/events/usage-progress.js";
 import type { UsageUpdateEvent } from "../../api/events/usage-update.js";
 import type {
   ChannelId,
@@ -425,20 +426,6 @@ export interface UndoComplete {
   conversationId?: string;
 }
 
-/**
- * Emitted after each LLM call with per-call token deltas and estimated cost.
- * Clients accumulate these additively for live-updating usage metrics.
- * This is a UI-only hint — it does not persist to DB or affect billing.
- */
-export interface UsageProgress {
-  type: "usage_progress";
-  conversationId: string;
-  inputTokens: number;
-  outputTokens: number;
-  estimatedCost: number;
-  model: string;
-}
-
 export interface UsageResponse {
   type: "usage_response";
   totalInputTokens: number;
@@ -550,7 +537,7 @@ export type _ConversationsServerMessages =
   | HistoryResponse
   | UndoComplete
   | UsageUpdateEvent
-  | UsageProgress
+  | UsageProgressEvent
   | UsageResponse
   | ContextCompacted
   | CompactionCircuitOpenEvent

package/src/daemon/trust-context.ts

@@ -42,7 +42,7 @@ export interface TrustContext {
 
 /**
  * Trust context used by internal background jobs (memory consolidation,
- * update bulletin, scheduled tasks) when invoking the agent loop without
+ * scheduled tasks) when invoking the agent loop without
  * an inbound actor identity. The assistant is the guardian over its own
  * internal state, so self-maintenance flows clear the side-effect
  * approval gate. Inbound message conversations resolve trust per-actor

package/src/events/tool-audit-listener.ts

@@ -3,6 +3,7 @@ import {
   recordToolInvocation,
   type ToolInvocationRecord,
 } from "../memory/tool-usage-store.js";
+import { redactJsonStringLeaves } from "../security/redact-json.js";
 import { redactSecrets } from "../security/secret-scanner.js";
 import {
   stringifyToolInput,
@@ -43,11 +44,14 @@ function toInvocationRecord(
 ): ToolInvocationRecord | null {
   switch (event.type) {
     case "executed": {
-      const input = stringifyToolInput(event.input);
+      const rawInput = stringifyToolInput(event.input);
       return {
         conversationId: event.conversationId,
         toolName: event.toolName,
-        input,
+        // Inputs can carry secrets the model typed verbatim (e.g.
+        // `export OPENAI_API_KEY=...` in a bash command) — redact before
+        // the row reaches the audit store, like results below.
+        input: redactToolInput(event.input, rawInput),
         result: redactSecrets(event.result.content).slice(
           0,
           RESULT_PREVIEW_LIMIT,
@@ -63,18 +67,18 @@ function toInvocationRecord(
         // don't stamp.
         ...telemetryColumns(
           event,
-          input,
+          rawInput,
           event.resultBytes ?? Buffer.byteLength(event.result.content, "utf8"),
         ),
       };
     }
     case "error": {
-      const input = stringifyToolInput(event.input);
+      const rawInput = stringifyToolInput(event.input);
       const result = `error: ${event.errorMessage}`;
       return {
         conversationId: event.conversationId,
         toolName: event.toolName,
-        input,
+        input: redactToolInput(event.input, rawInput),
         result,
         decision: "error",
         riskLevel: event.riskLevel,
@@ -83,7 +87,7 @@ function toInvocationRecord(
         // The error result string is built right here and never goes
         // through sensitive-output sanitization, so sizing it directly is
         // already raw — no executor stamp exists or is needed.
-        ...telemetryColumns(event, input, Buffer.byteLength(result, "utf8")),
+        ...telemetryColumns(event, rawInput, Buffer.byteLength(result, "utf8")),
       };
     }
     case "permission_denied":
@@ -92,7 +96,7 @@ function toInvocationRecord(
       return {
         conversationId: event.conversationId,
         toolName: event.toolName,
-        input: stringifyToolInput(event.input),
+        input: redactToolInput(event.input, stringifyToolInput(event.input)),
         result: formatDeniedResult(event.reason),
         decision: "denied",
         riskLevel: event.riskLevel,
@@ -105,6 +109,33 @@ function toInvocationRecord(
   }
 }
 
+/**
+ * Redact secrets from a tool input while keeping the stored audit string
+ * parseable JSON. The redaction marker (`<redacted type="..." />`) contains
+ * double quotes, so redacting the serialized string would corrupt it —
+ * instead, walk the input's string leaves BEFORE stringification so the
+ * marker lands inside a JSON string value (with its quotes escaped).
+ *
+ * `rawInput` is the canonical pre-redaction serialization (also used for
+ * the `argBytes` telemetry fallback — byte sizes must reflect the full
+ * payload before truncation and redaction). It is returned untouched when
+ * nothing matched, keeping benign inputs byte-identical, and is redacted as
+ * plain text if the input can't be walked or re-serialized (e.g. cyclic
+ * structures).
+ */
+function redactToolInput(
+  input: Record<string, unknown>,
+  rawInput: string,
+): string {
+  try {
+    const { value, changed } = redactJsonStringLeaves(input);
+    if (!changed) return rawInput;
+    return JSON.stringify(value);
+  } catch {
+    return redactSecrets(rawInput);
+  }
+}
+
 type TelemetryColumns = Pick<ToolInvocationRecord, "argBytes" | "resultBytes"> &
   UsageAttributionColumns;
 
@@ -134,12 +165,12 @@ const NULL_TELEMETRY_COLUMNS: TelemetryColumns = {
  */
 function telemetryColumns(
   event: Extract<ToolLifecycleEvent, { type: "executed" | "error" }>,
-  input: string,
+  rawInput: string,
   resultBytes: number,
 ): TelemetryColumns {
   if (!getConfig().collectUsageData) return NULL_TELEMETRY_COLUMNS;
   return {
-    argBytes: event.inputBytes ?? Buffer.byteLength(input, "utf8"),
+    argBytes: event.inputBytes ?? Buffer.byteLength(rawInput, "utf8"),
     resultBytes,
     ...toAttributionColumns(event.attribution),
   };

package/src/heartbeat/__tests__/heartbeat-service.test.ts

@@ -114,7 +114,7 @@ mock.module("../../config/loader.js", () => ({
   getNestedValue: () => undefined,
   setNestedValue: () => {},
   API_KEY_PROVIDERS: [],
-  _appendQuarantineBulletin: () => {},
+  _writeQuarantineNotice: () => {},
 }));
 
 // Stub prompt helpers.

package/src/home/__tests__/home-content-refresh.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, mock, test } from "bun:test";
+
+// ─── Mocks ─────────────────────────────────────────────────────────────
+
+let greetingRefreshed = false;
+let promptsRefreshed = false;
+let greetingCalls = 0;
+let promptsCalls = 0;
+let greetingGate: Promise<void> = Promise.resolve();
+
+mock.module("../home-greeting.js", () => ({
+  refreshPersonalizedGreeting: async () => {
+    greetingCalls++;
+    await greetingGate;
+    return greetingRefreshed;
+  },
+}));
+
+mock.module("../suggested-prompts.js", () => ({
+  refreshAssistantSuggestedPrompts: async () => {
+    promptsCalls++;
+    return promptsRefreshed;
+  },
+}));
+
+const publishSpy = mock<(event: unknown) => Promise<void>>(async () => {});
+mock.module("../../runtime/assistant-event-hub.js", () => ({
+  assistantEventHub: { publish: publishSpy },
+}));
+
+mock.module("../../runtime/assistant-event.js", () => ({
+  buildAssistantEvent: (e: unknown) => e,
+}));
+
+mock.module("../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+const { revalidateHomeContentInBackground } =
+  await import("../home-content-refresh.js");
+
+async function settle(): Promise<void> {
+  // Let the fire-and-forget revalidation chain run to completion.
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  await new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────
+
+describe("revalidateHomeContentInBackground", () => {
+  test("publishes home_feed_updated when content was refreshed", async () => {
+    publishSpy.mockClear();
+    greetingRefreshed = true;
+    promptsRefreshed = false;
+
+    revalidateHomeContentInBackground();
+    await settle();
+
+    expect(publishSpy).toHaveBeenCalledTimes(1);
+    expect(publishSpy.mock.calls[0]?.[0]).toMatchObject({
+      type: "home_feed_updated",
+    });
+  });
+
+  test("does not publish when both caches were fresh", async () => {
+    publishSpy.mockClear();
+    greetingRefreshed = false;
+    promptsRefreshed = false;
+
+    revalidateHomeContentInBackground();
+    await settle();
+
+    expect(publishSpy).not.toHaveBeenCalled();
+  });
+
+  test("concurrent calls share a single in-flight revalidation", async () => {
+    greetingCalls = 0;
+    promptsCalls = 0;
+    greetingRefreshed = false;
+    promptsRefreshed = false;
+
+    let release!: () => void;
+    greetingGate = new Promise((resolve) => {
+      release = resolve;
+    });
+
+    revalidateHomeContentInBackground();
+    revalidateHomeContentInBackground();
+    revalidateHomeContentInBackground();
+
+    release();
+    greetingGate = Promise.resolve();
+    await settle();
+
+    expect(greetingCalls).toBe(1);
+    expect(promptsCalls).toBe(1);
+  });
+
+  test("a completed run allows a later revalidation", async () => {
+    greetingCalls = 0;
+    greetingRefreshed = false;
+    promptsRefreshed = false;
+
+    revalidateHomeContentInBackground();
+    await settle();
+    revalidateHomeContentInBackground();
+    await settle();
+
+    expect(greetingCalls).toBe(2);
+  });
+});

package/src/home/__tests__/suggested-prompts.test.ts

@@ -4,6 +4,25 @@ import { afterEach, describe, expect, mock, test } from "bun:test";
 
 const mockIntegrationSummary = "Gmail ✓ | Slack ✓ | Twilio ✗ | Telegram ✗";
 let mockSidechainText = "";
+let sidechainCalls = 0;
+
+// In-memory stand-in for the memory_checkpoints table so the cache
+// round-trips without a real database.
+const checkpointStore = new Map<string, string>();
+let checkpointWritesShouldThrow = false;
+
+mock.module("../../memory/checkpoints.js", () => ({
+  getMemoryCheckpoint: (key: string) => checkpointStore.get(key) ?? null,
+  setMemoryCheckpoint: (key: string, value: string) => {
+    if (checkpointWritesShouldThrow) {
+      throw new Error("synthetic checkpoint write failure");
+    }
+    checkpointStore.set(key, value);
+  },
+  deleteMemoryCheckpoint: (key: string) => {
+    checkpointStore.delete(key);
+  },
+}));
 
 mock.module("../../schedule/integration-status.js", () => ({
   formatIntegrationSummary: async () => mockIntegrationSummary,
@@ -41,7 +60,10 @@ mock.module("../../prompts/system-prompt.js", () => ({
 }));
 
 mock.module("../../runtime/btw-sidechain.js", () => ({
-  runBtwSidechain: async () => ({ text: mockSidechainText }),
+  runBtwSidechain: async () => {
+    sidechainCalls++;
+    return { text: mockSidechainText };
+  },
 }));
 
 mock.module("../../runtime/assistant-event.js", () => ({
@@ -62,8 +84,10 @@ const {
 
 describe("getSuggestedPrompts", () => {
   afterEach(() => {
+    checkpointWritesShouldThrow = false;
     invalidateAssistantSuggestedPromptsCache();
     mockSidechainText = "";
+    sidechainCalls = 0;
   });
 
   test("returns empty array before cache is populated", async () => {
@@ -98,12 +122,17 @@ describe("getSuggestedPrompts", () => {
     expect(await getSuggestedPrompts()).toEqual([]);
   });
 
-  test("handles empty LLM response gracefully", async () => {
+  test("handles empty LLM response gracefully and caches the empty result", async () => {
     mockSidechainText = "";
 
-    await refreshAssistantSuggestedPrompts();
-    const prompts = await getSuggestedPrompts();
-    expect(prompts).toEqual([]);
+    expect(await refreshAssistantSuggestedPrompts()).toBe(false);
+    expect(await getSuggestedPrompts()).toEqual([]);
+
+    // The empty result is cached: the next refresh within the TTL must
+    // not hit the LLM again (prevents a generation loop on every Home
+    // feed GET while the model returns nothing usable).
+    expect(await refreshAssistantSuggestedPrompts()).toBe(false);
+    expect(sidechainCalls).toBe(1);
   });
 
   test("handles malformed LLM response gracefully", async () => {
@@ -113,4 +142,56 @@ describe("getSuggestedPrompts", () => {
     const prompts = await getSuggestedPrompts();
     expect(prompts).toEqual([]);
   });
+
+  test("refresh reports whether new content was generated", async () => {
+    mockSidechainText = JSON.stringify([
+      { label: "Do stuff", prompt: "Do stuff for me" },
+    ]);
+
+    expect(await refreshAssistantSuggestedPrompts()).toBe(true);
+    // Cache is fresh — second refresh must not hit the LLM again.
+    expect(await refreshAssistantSuggestedPrompts()).toBe(false);
+    expect(sidechainCalls).toBe(1);
+  });
+
+  test("refresh reports false when the cache write fails", async () => {
+    mockSidechainText = JSON.stringify([
+      { label: "Do stuff", prompt: "Do stuff for me" },
+    ]);
+    checkpointWritesShouldThrow = true;
+
+    // The generation succeeded but nothing was cached, so the caller must
+    // not announce fresh content (clients would refetch into a cache miss
+    // and re-trigger generation on every Home load).
+    expect(await refreshAssistantSuggestedPrompts()).toBe(false);
+    expect(await getSuggestedPrompts()).toEqual([]);
+  });
+
+  test("refresh regenerates after invalidation", async () => {
+    mockSidechainText = JSON.stringify([
+      { label: "Do stuff", prompt: "Do stuff for me" },
+    ]);
+
+    await refreshAssistantSuggestedPrompts();
+    invalidateAssistantSuggestedPromptsCache();
+
+    expect(await refreshAssistantSuggestedPrompts()).toBe(true);
+    expect(sidechainCalls).toBe(2);
+  });
+
+  test("cache survives across module state (checkpoint-backed)", async () => {
+    mockSidechainText = JSON.stringify([
+      { label: "Persisted", prompt: "I came from the checkpoint store" },
+    ]);
+
+    await refreshAssistantSuggestedPrompts();
+    // Simulate the read path a fresh daemon would take: the prompts come
+    // back from the checkpoint store, not module-local memory.
+    expect(checkpointStore.get("home:suggested_prompts:json")).toContain(
+      "Persisted",
+    );
+    const prompts = await getSuggestedPrompts();
+    expect(prompts).toHaveLength(1);
+    expect(prompts[0]!.label).toBe("Persisted");
+  });
 });