@vellumai/assistant 0.8.3 → 0.8.4

package/src/runtime/__tests__/background-job-runner.test.ts

@@ -94,6 +94,8 @@ mock.module("../pre-first-message-gate.js", () => ({
 
 // Import after mocks are in place.
 const { runBackgroundJob } = await import("../background-job-runner.js");
+const { bufferIfDeferred, resetDeferredForTest } =
+  await import("../../notifications/deferred-emit.js");
 
 // ── Shared fixtures ──────────────────────────────────────────────────
 
@@ -121,6 +123,7 @@ beforeEach(() => {
   processMessageCalls.length = 0;
   emitCalls.length = 0;
   addMessageCalls.length = 0;
+  resetDeferredForTest();
   preFirstMessageGateOpen = true;
   processMessageImpl = async () => ({ messageId: "msg-1" });
   emitImpl = async () => ({
@@ -354,4 +357,129 @@ describe("runBackgroundJob", () => {
       expect(processMessageCalls).toHaveLength(1);
     });
   });
+
+  describe("deferNotifications", () => {
+    function buildSkillNotificationParams(message: string) {
+      return {
+        sourceEventName: "assistant.share",
+        sourceChannel: "assistant_tool" as const,
+        sourceContextId: "skill-ctx",
+        contextPayload: { requestedMessage: message },
+        attentionHints: {
+          requiresAction: false,
+          urgency: "low" as const,
+          isAsyncBackground: false,
+          visibleInSourceNow: false,
+        },
+      };
+    }
+
+    test("success path commits buffered in-band notifications", async () => {
+      processMessageImpl = async () => {
+        // Stand in for the IPC route's bufferIfDeferred call when the model
+        // invokes `notifications send` mid-turn.
+        const buffered = bufferIfDeferred(
+          STUB_CONVERSATION_ID,
+          buildSkillNotificationParams("all green"),
+        );
+        expect(buffered).not.toBeNull();
+        expect(buffered!.dispatched).toBe(false);
+        return { messageId: "msg-success" };
+      };
+
+      const result = await runBackgroundJob(
+        baseOpts({ deferNotifications: true }),
+      );
+
+      expect(result.ok).toBe(true);
+      // Commit flushed the buffered notification through emitNotificationSignal.
+      const successEmits = emitCalls.filter(
+        (e) => e.sourceEventName !== "activity.failed",
+      );
+      expect(successEmits).toHaveLength(1);
+      expect(successEmits[0].sourceEventName).toBe("assistant.share");
+    });
+
+    // Regression for the PR #31216 Codex P1 finding: a heartbeat that calls
+    // the notifications skill and then times out must not leave a "success"
+    // notification standing alongside the runner's `activity.failed` emit.
+    test("timeout drops buffered in-band notifications; only activity.failed emits", async () => {
+      processMessageImpl = () => {
+        bufferIfDeferred(
+          STUB_CONVERSATION_ID,
+          buildSkillNotificationParams("premature success"),
+        );
+        return new Promise(() => {});
+      };
+
+      const result = await runBackgroundJob(
+        baseOpts({ deferNotifications: true, timeoutMs: 30 }),
+      );
+
+      expect(result.ok).toBe(false);
+      expect(result.errorKind).toBe("timeout");
+      // Only the runner's failure signal makes it out — the buffered
+      // "success" notification is discarded.
+      expect(emitCalls).toHaveLength(1);
+      expect(emitCalls[0].sourceEventName).toBe("activity.failed");
+    });
+
+    test("thrown exception also drops buffered notifications", async () => {
+      processMessageImpl = async () => {
+        bufferIfDeferred(
+          STUB_CONVERSATION_ID,
+          buildSkillNotificationParams("doomed"),
+        );
+        throw new Error("kaboom");
+      };
+
+      const result = await runBackgroundJob(
+        baseOpts({ deferNotifications: true }),
+      );
+
+      expect(result.ok).toBe(false);
+      expect(emitCalls).toHaveLength(1);
+      expect(emitCalls[0].sourceEventName).toBe("activity.failed");
+    });
+
+    // Regression: after timeout, `processMessage` keeps running and may
+    // emit a late skill call. The tombstone must swallow it instead of
+    // letting it bypass the buffer and reach the dispatch pipeline.
+    test("late skill call after timeout is swallowed by the tombstone", async () => {
+      processMessageImpl = () => new Promise(() => {});
+
+      const result = await runBackgroundJob(
+        baseOpts({ deferNotifications: true, timeoutMs: 20 }),
+      );
+      expect(result.ok).toBe(false);
+
+      const late = bufferIfDeferred(
+        STUB_CONVERSATION_ID,
+        buildSkillNotificationParams("post-timeout"),
+      );
+      expect(late).not.toBeNull();
+      expect(late!.dispatched).toBe(false);
+      expect(late!.reason).toMatch(/did not complete/);
+
+      // Only the runner's failure signal made it out.
+      expect(emitCalls).toHaveLength(1);
+      expect(emitCalls[0].sourceEventName).toBe("activity.failed");
+    });
+
+    test("without deferNotifications, bufferIfDeferred is a no-op", async () => {
+      processMessageImpl = async () => {
+        const buffered = bufferIfDeferred(
+          STUB_CONVERSATION_ID,
+          buildSkillNotificationParams("immediate"),
+        );
+        // Buffer was never armed, so the call returns null and the IPC
+        // handler would emit directly.
+        expect(buffered).toBeNull();
+        return { messageId: "msg-success" };
+      };
+
+      const result = await runBackgroundJob(baseOpts());
+      expect(result.ok).toBe(true);
+    });
+  });
 });

package/src/runtime/agent-wake.ts

@@ -68,9 +68,6 @@ import { getLogger } from "../util/logger.js";
 
 const log = getLogger("agent-wake");
 
-/** Number of messages injected for the wake hint (user + assistant + user). */
-const WAKE_HINT_MESSAGE_COUNT = 3;
-
 /** Static preamble user message — no dynamic content, injection-safe. */
 const WAKE_PREAMBLE =
   "[system] The following assistant message comes from an external system.";
@@ -196,6 +193,51 @@ export interface WakeOptions {
    * tune the model/profile and observability bucket independently.
    */
   callSite?: LLMCallSite;
+  /**
+   * Role to use for the injected hint message. Defaults to `"assistant"` so
+   * the hint is sandwiched between two static user bookends — the canonical
+   * anti-injection pattern for hints that may carry text from an external
+   * source. Trusted internal callers (e.g. fork-based memory retrospectives)
+   * can pass `"user"` to inject a single user-role message containing the
+   * hint directly, which reads more naturally as an instruction from the
+   * user/system rather than a self-directed assistant note.
+   */
+  hintRole?: "assistant" | "user";
+  /**
+   * Documented intent: this wake must not trigger auto-threshold compaction.
+   *
+   * Today this is automatically satisfied because the wake invokes
+   * `target.agentLoop.run()` directly, bypassing the daemon orchestrator
+   * (`conversation-agent-loop.ts`) where the compaction pipeline lives. The
+   * flag is recorded in the wake's structured log line so operators can
+   * verify the contract holds across refactors. If compaction is ever moved
+   * into `AgentLoop.run` or invoked from the wake path, callers that pass
+   * `true` here MUST be updated to suppress it; callers that pass `false`
+   * (or omit it) MUST tolerate compaction firing.
+   *
+   * Used by fork-based memory retrospectives: the wake operates on a
+   * freshly-forked conversation that may already be near (or past) the
+   * source's auto-threshold, but the goal is to operate on that exact
+   * context — running a compaction LLM call before the wake's own first
+   * call would waste tokens and defeat prompt-cache reuse.
+   */
+  suppressAutoCompaction?: boolean;
+  /**
+   * Skip injection of the hint sandwich entirely. Used when the caller has
+   * already persisted the instruction as a real message in the conversation
+   * (e.g. fork-based memory retrospectives that append a user message to the
+   * forked conversation before waking). When `true`, `hint` is ignored.
+   */
+  skipHintInjection?: boolean;
+  /**
+   * Skip injection of the "Conversation Woke" `ui_surface` card into the
+   * first assistant tail message and the corresponding live
+   * `onWakeProducedOutput` broadcast. Default false (existing behavior).
+   * Used by callers whose conversation context already makes it obvious
+   * that the agent's output came from a wake (e.g. fork-based memory
+   * retrospectives whose conversation title already says "(Retrospective)").
+   */
+  suppressWakeSurface?: boolean;
 }
 
 /**
@@ -224,13 +266,18 @@ export interface WakeResult {
  */
 export interface WakeDeps {
   /**
-   * Resolve the wake target for a conversationId.
+   * Resolve the wake target for a wake invocation.
    * Returns `null` if the conversation doesn't exist, `"archived"` if it
    * exists but is archived, or a `WakeTarget` to proceed with the wake.
+   *
+   * Receives the full {@link WakeOptions} so the default resolver can
+   * thread `trustContext` into `getOrCreateConversation`. Without that
+   * threading, the conversation hydrates with `trustContext === undefined`
+   * and `loadFromDb` fail-closes to `trustClass: "unknown"`, which filters
+   * out every guardian-provenance message — fatal for fork-based memory
+   * retrospectives.
    */
-  resolveTarget: (
-    conversationId: string,
-  ) => Promise<WakeTarget | null | "archived">;
+  resolveTarget: (opts: WakeOptions) => Promise<WakeTarget | null | "archived">;
   /** Timestamp source (for deterministic tests). */
   now?: () => number;
 }
@@ -242,8 +289,9 @@ export interface WakeDeps {
 // `getOrCreateConversation`, and `conversationToWakeTarget`.
 
 async function defaultResolveTarget(
-  conversationId: string,
+  opts: WakeOptions,
 ): Promise<WakeTarget | null | "archived"> {
+  const { conversationId } = opts;
   // Lazy-import daemon modules to avoid pulling heavyweight transitive
   // deps (conversation store → config/loader → provider catalogs) at
   // module-evaluation time.  Callers that only import agent-wake for
@@ -264,7 +312,15 @@ async function defaultResolveTarget(
       );
       return "archived";
     }
-    const conversation = await getOrCreateConversation(conversationId);
+    // Thread trustContext through to getOrCreateConversation so the
+    // hydration path applies setTrustContext + ensureActorScopedHistory
+    // (conversation-store.ts:281-289) BEFORE the agent loop's per-turn
+    // snapshot reads. Without this, fork-based memory retrospectives see
+    // an empty history because loadFromDb ran with trustClass="unknown"
+    // and filtered out every guardian-provenance message.
+    const conversation = await getOrCreateConversation(conversationId, {
+      trustContext: opts.trustContext,
+    });
     return conversationToWakeTarget(conversation);
   } catch (err) {
     log.warn(
@@ -376,6 +432,7 @@ function buildWakeTurnContext(
  */
 function inspectWakeOutput(
   baselineLength: number,
+  hintMessageCount: number,
   updatedHistory: Message[],
 ): {
   tailMessages: Message[];
@@ -383,10 +440,10 @@ function inspectWakeOutput(
   toolUseNames: string[];
 } {
   // The agent loop appends messages onto the history it was given. We
-  // injected 3 hint messages (user preamble + assistant hint + user
-  // postamble), so anything at index >= baselineLength + 3 came from
-  // the run.
-  const firstAssistantIndex = baselineLength + WAKE_HINT_MESSAGE_COUNT;
+  // injected `hintMessageCount` hint messages (0, 1, or 3 depending on
+  // hint mode), so anything at index >= baselineLength + hintMessageCount
+  // came from the run.
+  const firstAssistantIndex = baselineLength + hintMessageCount;
   if (updatedHistory.length <= firstAssistantIndex) {
     return { tailMessages: [], hasVisibleText: false, toolUseNames: [] };
   }
@@ -436,7 +493,7 @@ export async function wakeAgentForOpportunity(
   const startedAt = nowFn();
 
   return runSingleFlight(conversationId, async () => {
-    const resolved = await resolveTarget(conversationId);
+    const resolved = await resolveTarget(opts);
     if (resolved === "archived") {
       log.info(
         { conversationId, source },
@@ -505,28 +562,45 @@ export async function wakeAgentForOpportunity(
     // tail-slice math would skip every message.
     const baselineLength = baseline.length;
     const wakeTurnContext = buildWakeTurnContext(opts, diskPressureDecision);
-    const hintContent = `[opportunity:${source}] ${hint}`;
-    // Sandwich the hint as an assistant message between two hardcoded
-    // user messages. The assistant role prevents prompt injection — LLMs
-    // don't follow instructions in their own prior output. The trailing
-    // user message satisfies providers that reject assistant prefill
-    // (conversation must end on a user turn). Both user messages are
-    // static strings with no dynamic content so they cannot carry
-    // injection payloads.
-    const wakeMessages: Message[] = [
-      {
-        role: "user",
-        content: [{ type: "text", text: WAKE_PREAMBLE }],
-      },
-      {
-        role: "assistant",
-        content: [{ type: "text", text: hintContent }],
-      },
-      {
-        role: "user",
-        content: [{ type: "text", text: WAKE_POSTAMBLE }],
-      },
-    ];
+    // Build the hint injection. Three modes:
+    //   - `skipHintInjection`: caller has already persisted an instruction
+    //     message into the conversation history (typical for fork-based
+    //     memory retrospectives that append a user message before waking).
+    //   - `hintRole === "user"`: single user-role message containing the
+    //     hint directly. Used by trusted internal callers where the hint
+    //     reads naturally as an instruction.
+    //   - default (`hintRole === "assistant"`): sandwich the hint as an
+    //     assistant message between two hardcoded user bookends. The
+    //     assistant role defangs prompt injection (LLMs don't follow
+    //     instructions in their own prior output) and the trailing user
+    //     message satisfies providers that reject assistant prefill.
+    const hintRole = opts.hintRole ?? "assistant";
+    const wakeMessages: Message[] = opts.skipHintInjection
+      ? []
+      : hintRole === "user"
+        ? [
+            {
+              role: "user",
+              content: [{ type: "text", text: hint }],
+            },
+          ]
+        : [
+            {
+              role: "user",
+              content: [{ type: "text", text: WAKE_PREAMBLE }],
+            },
+            {
+              role: "assistant",
+              content: [
+                { type: "text", text: `[opportunity:${source}] ${hint}` },
+              ],
+            },
+            {
+              role: "user",
+              content: [{ type: "text", text: WAKE_POSTAMBLE }],
+            },
+          ];
+    const wakeHintMessageCount = wakeMessages.length;
     const runInput: Message[] = [...baseline, ...wakeMessages];
 
     // Event handling runs in two modes. While `mode === "buffering"`,
@@ -663,26 +737,28 @@ export async function wakeAgentForOpportunity(
     const goLive = (currentHistory: Message[]): void => {
       if (mode === "live") return;
       if (!surfaceInjected) {
-        const tailStart = baselineLength + WAKE_HINT_MESSAGE_COUNT;
-        const tail = currentHistory.slice(tailStart);
-        const firstAssistant = tail.find((m) => m.role === "assistant");
-        if (firstAssistant && Array.isArray(firstAssistant.content)) {
-          firstAssistant.content.unshift({
-            type: "ui_surface",
-            surfaceId: wakeSurfaceId,
-            surfaceType: "card",
-            title: "Conversation Woke",
-            data: {
+        if (!opts.suppressWakeSurface) {
+          const tailStart = baselineLength + wakeHintMessageCount;
+          const tail = currentHistory.slice(tailStart);
+          const firstAssistant = tail.find((m) => m.role === "assistant");
+          if (firstAssistant && Array.isArray(firstAssistant.content)) {
+            firstAssistant.content.unshift({
+              type: "ui_surface",
+              surfaceId: wakeSurfaceId,
+              surfaceType: "card",
               title: "Conversation Woke",
-              body: hint,
-              metadata: [{ label: "Source", value: source }],
-            },
-            display: "inline",
-          } as never);
+              data: {
+                title: "Conversation Woke",
+                body: hint,
+                metadata: [{ label: "Source", value: source }],
+              },
+              display: "inline",
+            } as never);
+          }
         }
         surfaceInjected = true;
       }
-      if (target.onWakeProducedOutput) {
+      if (!opts.suppressWakeSurface && target.onWakeProducedOutput) {
         try {
           target.onWakeProducedOutput(source, hint, wakeSurfaceId);
         } catch (err) {
@@ -721,8 +797,7 @@ export async function wakeAgentForOpportunity(
     const flushPendingTail = async (
       currentHistory: Message[],
     ): Promise<void> => {
-      const start =
-        baselineLength + WAKE_HINT_MESSAGE_COUNT + persistedTailIndex;
+      const start = baselineLength + wakeHintMessageCount + persistedTailIndex;
       if (start >= currentHistory.length) return;
       const newMessages = currentHistory.slice(start);
       for (const msg of newMessages) {
@@ -825,7 +900,11 @@ export async function wakeAgentForOpportunity(
         tailMessages,
         hasVisibleText,
         toolUseNames: names,
-      } = inspectWakeOutput(baselineLength, updatedHistory);
+      } = inspectWakeOutput(
+        baselineLength,
+        wakeHintMessageCount,
+        updatedHistory,
+      );
       toolUseNames = names;
       producedToolCalls = names.length > 0;
       const producedOutput = producedToolCalls || hasVisibleText;
@@ -904,9 +983,19 @@ export async function wakeAgentForOpportunity(
       }
 
       const durationMs = nowFn() - startedAt;
+      const suppressAutoCompaction = opts.suppressAutoCompaction === true;
+      const suppressWakeSurface = opts.suppressWakeSurface === true;
       if (runError) {
         log.error(
-          { conversationId, source, durationMs, err: runError },
+          {
+            conversationId,
+            source,
+            durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
+            err: runError,
+          },
           "agent-wake: agent loop threw; treating as no-op",
         );
       } else if (tailMessageCount === 0) {
@@ -915,6 +1004,9 @@ export async function wakeAgentForOpportunity(
             source,
             conversationId,
             durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
             producedToolCalls: false,
             toolNamesCalled: [],
           },
@@ -926,6 +1018,9 @@ export async function wakeAgentForOpportunity(
             source,
             conversationId,
             durationMs,
+            suppressAutoCompaction,
+            suppressWakeSurface,
+            hintRole,
             producedToolCalls,
             toolNamesCalled: toolUseNames,
             tailMessageCount,

package/src/runtime/auth/route-policy.ts

@@ -153,6 +153,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "conversations/undo", scopes: ["chat.write"] },
   { endpoint: "conversations/regenerate", scopes: ["chat.write"] },
   { endpoint: "conversations/attention", scopes: ["chat.read"] },
+  { endpoint: "conversations/slack-channel/resolve", scopes: ["chat.read"] },
   { endpoint: "conversations/seen", scopes: ["chat.write"] },
   { endpoint: "conversations/unread", scopes: ["chat.write"] },
   { endpoint: "conversations/import", scopes: ["chat.write"] },
@@ -451,9 +452,6 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "bookmarks:POST", scopes: ["chat.write"] },
   { endpoint: "bookmarks/by-message:DELETE", scopes: ["chat.write"] },
 
-  // Interfaces
-  { endpoint: "interfaces", scopes: ["settings.read"] },
-
   // Skills
   { endpoint: "skills:GET", scopes: ["settings.read"] },
   { endpoint: "skills:POST", scopes: ["settings.write"] },
@@ -471,6 +469,8 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "memory/v2/list-concept-pages:POST", scopes: ["settings.read"] },
   { endpoint: "memory/v2/reembed-skills:POST", scopes: ["settings.write"] },
   { endpoint: "memory/v2/concept-frequency:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v2/ema-scores:POST", scopes: ["settings.read"] },
+  { endpoint: "memory/v2/simulate-router:POST", scopes: ["settings.read"] },
 
   // Trust rule listing
   { endpoint: "trust-rules/manage:GET", scopes: ["settings.read"] },
@@ -992,6 +992,10 @@ registerPolicy("conversations/cli/export", {
   requiredScopes: ["settings.read"],
   allowedPrincipalTypes: ["local"],
 });
+registerPolicy("conversations/cli/slack/detach", {
+  requiredScopes: ["settings.write"],
+  allowedPrincipalTypes: ["local"],
+});
 // `conversations/cli/clear` wipes every conversation + message + vector
 // collection. Elevated to settings.write and locked to local callers,
 // mirroring the `conversations/clear-all` and `conversations/wipe` gates.

package/src/runtime/background-job-runner.ts

@@ -24,6 +24,11 @@ import type { TrustContext } from "../daemon/trust-context.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { addMessage } from "../memory/conversation-crud.js";
 import type { TitleOrigin } from "../memory/conversation-title-service.js";
+import {
+  commitDeferredConversation,
+  discardDeferredConversation,
+  registerDeferredConversation,
+} from "../notifications/deferred-emit.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import type { AttentionHints } from "../notifications/signal.js";
 import { getLogger } from "../util/logger.js";
@@ -121,6 +126,11 @@ export interface RunBackgroundJobOptions {
    * the `assistant` role and cannot override the action prompt.
    */
   assistantSandwich?: { preamble: string; content: string; postamble: string };
+  /**
+   * Buffer in-band `notifications send` calls and only flush them after the
+   * run completes successfully. See `notifications/deferred-emit.ts`.
+   */
+  deferNotifications?: boolean;
 }
 
 export interface RunBackgroundJobResult {
@@ -205,6 +215,10 @@ export async function runBackgroundJob(
       ...(opts.scheduleJobId ? { scheduleJobId: opts.scheduleJobId } : {}),
     });
 
+    if (opts.deferNotifications) {
+      registerDeferredConversation(conversation.id);
+    }
+
     // Fire the sidebar-creation callback synchronously after bootstrap so
     // connected clients (macOS sidebar, etc.) see the conversation appear
     // immediately rather than after `processMessage` returns. Wrapped so a
@@ -273,6 +287,14 @@ export async function runBackgroundJob(
     });
 
     await Promise.race([work, timeout]);
+    // Symmetric with the `work.catch` above: once `work` has won the race,
+    // the orphan timeout promise can still reject during the await below
+    // (commitDeferredConversation). Swallow so it doesn't surface as an
+    // unhandled rejection that Bun can use to terminate the process.
+    timeout.catch(() => {});
+    if (opts.deferNotifications) {
+      await commitDeferredConversation(conversation.id);
+    }
     return { conversationId: conversation.id, ok: true };
   } catch (err) {
     const errorKind = classifyError(err);
@@ -281,6 +303,10 @@ export async function runBackgroundJob(
     // so the structured failure result still flows to the caller.
     const conversationId = conversation?.id ?? "";
 
+    if (opts.deferNotifications && conversationId) {
+      discardDeferredConversation(conversationId);
+    }
+
     log.error(
       {
         err: error.message,