@vellumai/assistant 0.8.9-staging.2 → 0.8.9-staging.3

package/src/daemon/conversation.ts

@@ -33,11 +33,6 @@ import {
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
-import {
-  type ContextWindowManager,
-  type ContextWindowResult,
-  createContextSummaryMessage,
-} from "../context/window-manager.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { EventBus } from "../events/bus.js";
 import type { AssistantDomainEvents } from "../events/domain-events.js";
@@ -67,8 +62,16 @@ import {
   createContextWindowManager,
   getContextWindowManager,
 } from "../plugins/defaults/compaction/manager-store.js";
+import {
+  type ContextWindowManager,
+  type ContextWindowResult,
+  createContextSummaryMessage,
+} from "../plugins/defaults/compaction/window-manager.js";
 import { repairHistory } from "../plugins/defaults/history-repair/terminal.js";
-import { buildSystemPrompt } from "../prompts/system-prompt.js";
+import {
+  applyBootstrapTemplate,
+  buildSystemPrompt,
+} from "../prompts/system-prompt.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
 import {
@@ -79,6 +82,10 @@ import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../runtime/auth/types.js";
 import type { InteractiveUiResult } from "../runtime/interactive-ui.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
+import {
+  type ActivationMomentParam,
+  isActivationMomentParam,
+} from "../telemetry/activation-funnel.js";
 import { ToolExecutor } from "../tools/executor.js";
 import { getAllToolDefinitions } from "../tools/registry.js";
 import type { ToolLifecycleEvent } from "../tools/types.js";
@@ -266,6 +273,8 @@ export class Conversation {
   /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ toolRoutedProfile?: string;
   /** @internal */ authContext?: AuthContext;
+  /** @internal */ currentTurnAuthContext?: AuthContext;
+  /** @internal */ currentTurnSourceActorPrincipalId?: string;
   /** @internal */ loadedHistoryTrustClass?: TrustClass;
   /** @internal */ loadedHistoryPersonalMemoryAllowed?: boolean;
   /** @internal */ voiceCallControlPrompt?: string;
@@ -338,6 +347,12 @@ export class Conversation {
         style?: string;
         data?: Record<string, unknown>;
       }>;
+      /**
+       * Commit-timing activation-rail tag (daemon-only). Rehydrated by
+       * `restoreSurfaceStateFromHistory` so a post-reload commit still records
+       * its funnel milestone. Never sent to the client.
+       */
+      activationMoment?: ActivationMomentParam;
     }
   >();
   /** @internal */ surfaceUndoStacks = new Map<string, string[]>();
@@ -568,6 +583,7 @@ export class Conversation {
               trustContext: this.currentTurnTrustContext,
               channelCapabilities: this.currentTurnChannelCapabilities,
               onboardingContext: this.getOnboardingContext(),
+              conversationId: this.conversationId,
             }),
       };
       if (configuredMaxTokens !== undefined) {
@@ -626,11 +642,11 @@ export class Conversation {
 
   /**
    * The conversation's {@link ContextWindowManager}, owned by the compaction
-   * module's per-conversation store. The constructor registers it there; this
-   * accessor resolves it on demand so the conversation holds no separate
-   * handle. Present for the conversation's whole in-memory lifetime (registered
-   * at construction, released on teardown), so a live conversation always
-   * resolves an instance.
+   * module's per-conversation store. The constructor builds and registers it
+   * there; this accessor resolves it on demand so the conversation holds no
+   * separate handle. Present for the conversation's whole in-memory lifetime
+   * (registered at construction, released on teardown), so a live conversation
+   * always resolves an instance.
    */
   /** @internal */ get contextWindowManager(): ContextWindowManager {
     const manager = getContextWindowManager(this.conversationId);
@@ -646,6 +662,13 @@ export class Conversation {
 
   setOnboardingContext(ctx: OnboardingContext): void {
     this.onboardingContext = ctx;
+    // Reseed BOOTSTRAP.md and mark the activation session at the earliest point
+    // the conversation knows its bootstrap selection — before the first turn's
+    // tool resolution, which `buildSystemPrompt` is too late for. See
+    // `applyBootstrapTemplate`.
+    if (ctx.bootstrapTemplate) {
+      applyBootstrapTemplate(ctx.bootstrapTemplate, this.conversationId);
+    }
   }
 
   getOnboardingContext(): OnboardingContext | undefined {
@@ -687,6 +710,7 @@ export class Conversation {
           trustContext: this.currentTurnTrustContext,
           channelCapabilities: this.currentTurnChannelCapabilities,
           onboardingContext: this.getOnboardingContext(),
+          conversationId: this.conversationId,
         });
     const tools = getAllToolDefinitions();
     const provider = this.provider;
@@ -990,6 +1014,14 @@ export class Conversation {
       for (const block of msg.content) {
         const b = block as unknown as Record<string, unknown>;
         if (b.type === "ui_surface" && typeof b.surfaceId === "string") {
+          // Rehydrate the daemon-only commit-timing activation tag so a commit
+          // after reload still records its funnel milestone. Validated and
+          // dropped if malformed; this field never reaches the client.
+          const activationMoment =
+            typeof b.activationMoment === "string" &&
+            isActivationMomentParam(b.activationMoment)
+              ? b.activationMoment
+              : undefined;
           this.surfaceState.set(b.surfaceId, {
             surfaceType: (b.surfaceType ?? "dynamic_page") as SurfaceType,
             data: (b.data ?? {}) as SurfaceData,
@@ -1002,6 +1034,7 @@ export class Conversation {
                   data?: Record<string, unknown>;
                 }>)
               : undefined,
+            ...(activationMoment ? { activationMoment } : {}),
           });
         }
       }
@@ -1330,7 +1363,9 @@ export class Conversation {
 
   ensureHostProxiesForTurn(
     sourceInterface: import("../channels/types.js").InterfaceId | undefined,
-    sourceActorPrincipalId = this.trustContext?.guardianPrincipalId,
+    sourceActorPrincipalId = this.currentTurnSourceActorPrincipalId ??
+      this.currentTurnAuthContext?.actorPrincipalId ??
+      this.authContext?.actorPrincipalId,
   ): void {
     if (
       shouldAttachHostProxyForCapability(
@@ -1438,7 +1473,7 @@ export class Conversation {
     const messagesToCompact =
       slackChronologicalContext?.messages ?? this.messages;
     const result = await defaultCompact({
-      manager: this.contextWindowManager,
+      conversationId: this.conversationId,
       messages: messagesToCompact,
       signal: this.abortController?.signal ?? undefined,
       force: true,

package/src/daemon/persist-unsendable-image.ts

@@ -6,8 +6,9 @@
  * retries. That transformation is transient — the stored message row keeps the
  * full-size image block, so the rejected image is rehydrated on every later
  * turn and keeps re-entering the model's context. This module makes the
- * downgrade durable for images that can *never* be transmitted, so a rejected
- * upload cannot resurface after the user re-uploads a smaller version.
+ * downgrade durable: the oversized block is rewritten to its downscaled form,
+ * or to a text note when it cannot be shrunk on this host, so a rejected image
+ * cannot resurface and re-reject on every later turn.
  */
 
 import { optimizeImageForTransport } from "../agent/image-optimize.js";
@@ -40,19 +41,25 @@ export const UNSENDABLE_IMAGE_NOTE =
   "(An image was attached but could not be sent — its dimensions exceed the provider limit and automatic resize was not available. Please resize the image and try again.)";
 
 /**
- * True when a stored image block can never be transmitted to the provider: it
- * violates a provider hard limit (per-side pixel cap or payload size) and
- * cannot be shrunk to fit (re-optimization is a no-op).
+ * Replacement for an image that violates a provider hard limit (per-side pixel
+ * cap or payload size), or null when the image is within limits and should be
+ * left untouched. Gating on the provider hard caps is what keeps still-sendable
+ * images intact: a normally sized image is left alone rather than being noted or
+ * needlessly rewritten.
  *
- * Stored blocks are already post-optimization, so a block that is still
- * oversized here only stays oversized because resizing is unavailable on this
- * host (e.g. `sips` is absent off macOS, or the format is unsupported). A
- * downscalable image would have been reduced at upload time and would not reach
- * this predicate, so it is left untouched.
+ * An oversized image that can be shrunk is rewritten to its downscaled form; one
+ * that cannot be shrunk on this host (resize is a no-op, e.g. `sips` is absent
+ * off macOS or the format is unsupported) is replaced with a text note.
+ *
+ * Shared by the in-memory recovery transform and this durable persist pass so
+ * both apply the identical rule. Persisting the downscaled form is what lets a
+ * poisoned conversation durably self-heal — the latest tool-result media is kept
+ * in context, so without it the original oversized block rehydrates and
+ * re-rejects on every later turn.
  */
-function isImagePermanentlyUnsendable(
+export function oversizedImageReplacement(
   block: Extract<ContentBlock, { type: "image" }>,
-): boolean {
+): ContentBlock | null {
   const payloadBytes = block.source.data.length;
   const dims = parseImageDimensions(block.source.data, block.source.media_type);
   const exceedsDimensionCap =
@@ -60,24 +67,35 @@ function isImagePermanentlyUnsendable(
     (dims.width > PROVIDER_MAX_IMAGE_DIMENSION ||
       dims.height > PROVIDER_MAX_IMAGE_DIMENSION);
   const exceedsPayloadCap = payloadBytes > PROVIDER_MAX_IMAGE_PAYLOAD_BYTES;
-  if (!exceedsDimensionCap && !exceedsPayloadCap) return false;
+  if (!exceedsDimensionCap && !exceedsPayloadCap) return null;
 
   const optimized = optimizeImageForTransport(
     block.source.data,
     block.source.media_type,
   );
-  return optimized.data === block.source.data;
+  if (optimized.data !== block.source.data) {
+    return {
+      type: "image",
+      source: {
+        type: "base64",
+        media_type: optimized.mediaType,
+        data: optimized.data,
+      },
+    };
+  }
+  return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
 }
 
 /**
- * Rewrite every stored message in a conversation that holds a permanently
- * unsendable image, replacing those image blocks with {@link
- * UNSENDABLE_IMAGE_NOTE}. Reads stored content directly (not the in-memory,
- * injection-enriched copy) so injected prefixes and hydrated source paths are
- * never written back.
+ * Rewrite every stored message in a conversation that holds an oversized image
+ * the provider rejects — whether a top-level block or one nested in a
+ * tool_result's contentBlocks — replacing it with its downscaled form, or with
+ * {@link UNSENDABLE_IMAGE_NOTE} when it cannot be shrunk on this host. Reads
+ * stored content directly (not the in-memory, injection-enriched copy) so
+ * injected prefixes and hydrated source paths are never written back.
  *
- * Idempotent: once an image is replaced by the note there is no image block
- * left to match, so re-running is a no-op. Returns the number of rewritten
+ * Idempotent: a downscaled image is within limits and a note is no longer an
+ * image, so neither matches on a second run. Returns the number of rewritten
  * messages.
  */
 export function persistUnsendableImageDowngrades(
@@ -99,10 +117,29 @@ export function persistUnsendableImageDowngrades(
 
     let changed = false;
     const next = (parsed as ContentBlock[]).map((block): ContentBlock => {
-      if (block.type !== "image") return block;
-      if (!isImagePermanentlyUnsendable(block)) return block;
-      changed = true;
-      return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
+      if (block.type === "image") {
+        const replacement = oversizedImageReplacement(block);
+        if (!replacement) return block;
+        changed = true;
+        return replacement;
+      }
+      // Images returned by a tool (e.g. browser_screenshot) live inside the
+      // tool_result's contentBlocks, not as top-level blocks. Downgrade them
+      // in place so the tool_use/tool_result pairing stays intact.
+      if (block.type === "tool_result" && block.contentBlocks?.length) {
+        let nestedChanged = false;
+        const contentBlocks = block.contentBlocks.map((cb): ContentBlock => {
+          if (cb.type !== "image") return cb;
+          const replacement = oversizedImageReplacement(cb);
+          if (!replacement) return cb;
+          nestedChanged = true;
+          return replacement;
+        });
+        if (!nestedChanged) return block;
+        changed = true;
+        return { ...block, contentBlocks };
+      }
+      return block;
     });
     if (!changed) continue;
 

package/src/daemon/process-message.ts

@@ -195,7 +195,7 @@ async function prepareConversationForMessage(
         "wiring in conversation-routes.ts into a shared helper.",
     );
   }
-  const sourceActorPrincipalId = conversation.trustContext?.guardianPrincipalId;
+  const sourceActorPrincipalId = conversation.authContext?.actorPrincipalId;
   // CU is per-conversation (owns step count, AX tree history, loop detection).
   if (
     shouldAttachHostProxyForCapability(

package/src/memory/__tests__/activation-session-store.test.ts

@@ -0,0 +1,41 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import {
+  isActivationSession,
+  markActivationSession,
+} from "../activation-session-store.js";
+import { getDb } from "../db-connection.js";
+import { initializeDb } from "../db-init.js";
+import { activationSessions } from "../schema.js";
+
+initializeDb();
+
+describe("activation-session-store", () => {
+  beforeEach(() => {
+    getDb().delete(activationSessions).run();
+  });
+
+  test("marks a conversation and reports it as an activation session", () => {
+    markActivationSession("c1");
+    expect(isActivationSession("c1")).toBe(true);
+  });
+
+  test("unmarked conversations are not activation sessions", () => {
+    expect(isActivationSession("nope")).toBe(false);
+  });
+
+  test("marking the same conversation twice is idempotent", () => {
+    markActivationSession("c1");
+    markActivationSession("c1");
+    expect(isActivationSession("c1")).toBe(true);
+    const rows = getDb().select().from(activationSessions).all();
+    expect(rows.length).toBe(1);
+  });
+});

package/src/memory/__tests__/onboarding-events-store.test.ts

@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Silence the logger.
+mock.module("../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Mutable usage-data gate, flipped per-test.
+let collectUsageData = true;
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({ collectUsageData }),
+}));
+
+import { getDb } from "../db-connection.js";
+import { initializeDb } from "../db-init.js";
+import {
+  queryUnreportedOnboardingEvents,
+  recordActivationEvent,
+} from "../onboarding-events-store.js";
+import { onboardingEvents } from "../schema.js";
+
+initializeDb();
+
+function resetTable(): void {
+  getDb().delete(onboardingEvents).run();
+}
+
+describe("onboarding-events-store: recordActivationEvent", () => {
+  beforeEach(() => {
+    collectUsageData = true;
+    resetTable();
+  });
+
+  test("persists an activation funnel event that round-trips through the query", () => {
+    const event = recordActivationEvent({
+      stepName: "activation_moment_1_complete",
+      sessionId: "conv-1",
+    });
+    expect(event).not.toBeNull();
+
+    const rows = queryUnreportedOnboardingEvents(0, undefined, 10);
+    expect(rows).toHaveLength(1);
+    const row = rows[0]!;
+    expect(row.stepName).toBe("activation_moment_1_complete");
+    expect(row.stepIndex).toBe(1);
+    expect(row.funnelVersion).toBe("activation_v1_2026_06");
+    expect(row.screen).toBe("activation_moment_1_complete");
+    expect(row.abVariant).toBe("variant-a");
+    expect(row.sessionId).toBe("conv-1");
+    expect(row.completedAt).toBe(new Date(row.createdAt).toISOString());
+  });
+
+  test("honors an explicit abVariant override", () => {
+    recordActivationEvent({
+      stepName: "activation_moment_2_complete",
+      sessionId: "conv-2",
+      abVariant: "variant-b",
+    });
+
+    const rows = queryUnreportedOnboardingEvents(0, undefined, 10);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!.abVariant).toBe("variant-b");
+    expect(rows[0]!.stepIndex).toBe(2);
+  });
+
+  test("returns null and writes no row when collectUsageData is disabled", () => {
+    collectUsageData = false;
+    const event = recordActivationEvent({
+      stepName: "activation_moment_1_complete",
+      sessionId: "conv-3",
+    });
+    expect(event).toBeNull();
+
+    const rows = queryUnreportedOnboardingEvents(0, undefined, 10);
+    expect(rows).toHaveLength(0);
+  });
+});

package/src/memory/activation-session-store.ts

@@ -0,0 +1,43 @@
+import { eq } from "drizzle-orm";
+
+import { getLogger } from "../util/logger.js";
+import { getDb } from "./db-connection.js";
+import { activationSessions } from "./schema.js";
+
+const log = getLogger("activation-session-store");
+
+/**
+ * Mark a conversation as an activation-rail session. Idempotent (the row's
+ * primary key is the conversation id) and best-effort: a write failure is
+ * logged and swallowed so it never blocks the turn that triggered it.
+ */
+export function markActivationSession(conversationId: string): void {
+  try {
+    getDb()
+      .insert(activationSessions)
+      .values({ conversationId, createdAt: Date.now() })
+      .onConflictDoNothing()
+      .run();
+  } catch (err) {
+    log.warn({ err, conversationId }, "Failed to mark activation session");
+  }
+}
+
+/**
+ * Whether the given conversation was started on the activation rail. Best-effort:
+ * a read failure is logged and treated as "not an activation session".
+ */
+export function isActivationSession(conversationId: string): boolean {
+  try {
+    const row = getDb()
+      .select({ conversationId: activationSessions.conversationId })
+      .from(activationSessions)
+      .where(eq(activationSessions.conversationId, conversationId))
+      .limit(1)
+      .get();
+    return row !== undefined;
+  } catch (err) {
+    log.warn({ err, conversationId }, "Failed to read activation session");
+    return false;
+  }
+}

package/src/memory/db-init.ts

@@ -16,6 +16,7 @@ import { getDb, getSqlite } from "./db-connection.js";
 import { migrateToolCreatedItems } from "./graph/bootstrap.js";
 import {
   addCoreColumns,
+  createActivationSessionsTable,
   createApprovalPromptTsTrackerTable,
   createAssistantInboxTables,
   createAuthFallbackEventsTable,
@@ -161,6 +162,7 @@ import {
   migrateOAuthProvidersScopeSeparator,
   migrateOAuthProvidersTokenAuthMethodDefault,
   migrateOAuthProvidersTokenExchangeBodyFormat,
+  migrateOnboardingEventsFunnelColumns,
   migrateOnboardingEventsPriorAssistants,
   migrateProviderConnectionBaseUrlAndModels,
   migrateProviderConnectionStatusLabel,
@@ -480,6 +482,8 @@ export function initializeDb(): void {
     migrateMessagesRoleCreatedAtIndex,
     createAuthFallbackEventsTable,
     migrateAcpSessionHistoryCwd,
+    migrateOnboardingEventsFunnelColumns,
+    createActivationSessionsTable,
   ];
 
   // Run each migration step, catching and logging individual failures so one

package/src/memory/migrations/273-onboarding-events-funnel-columns.ts

@@ -0,0 +1,46 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+const TABLE = "onboarding_events";
+const COLUMNS: Array<{ name: string; type: string }> = [
+  { name: "session_id", type: "TEXT" },
+  { name: "step_name", type: "TEXT" },
+  { name: "step_index", type: "INTEGER" },
+  { name: "completed_at", type: "TEXT" },
+  { name: "funnel_version", type: "TEXT" },
+];
+
+/**
+ * Add nullable funnel-tracking columns to `onboarding_events`.
+ *
+ * The original table (#30733) recorded one row per onboarding screen but had
+ * no way to stitch those rows into an ordered, per-attempt funnel: there was
+ * no session correlator, no step ordering, and no completion timestamp. These
+ * columns let the activation-funnel reporting attribute each event to a single
+ * onboarding attempt (`session_id`), order steps within it (`step_name` /
+ * `step_index`), record when a step finished (`completed_at`), and version the
+ * funnel shape so changes to the step set don't silently corrupt historical
+ * conversion math (`funnel_version`).
+ *
+ * All columns are nullable — `NULL` for rows persisted before this migration
+ * ran.
+ *
+ * Idempotent — re-running is a no-op once the columns exist. Pure DDL with a
+ * PRAGMA guard, no registry entry needed (matches the 252 / 261 / 264 / 265 /
+ * 267 pattern).
+ */
+export function migrateOnboardingEventsFunnelColumns(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  const columns = raw.query(`PRAGMA table_info(${TABLE})`).all() as Array<{
+    name: string;
+  }>;
+  const columnNames = new Set(columns.map((c) => c.name));
+
+  for (const { name, type } of COLUMNS) {
+    if (!columnNames.has(name)) {
+      raw.exec(`ALTER TABLE ${TABLE} ADD COLUMN ${name} ${type}`);
+    }
+  }
+}

package/src/memory/migrations/274-create-activation-sessions.ts

@@ -0,0 +1,15 @@
+import type { DrizzleDb } from "../db-connection.js";
+
+/**
+ * Create the activation_sessions table. One row per conversation that was
+ * started on the activation-rail bootstrap template, used by the activation
+ * funnel telemetry to scope events to activation conversations.
+ */
+export function createActivationSessionsTable(database: DrizzleDb): void {
+  database.run(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS activation_sessions (
+      conversation_id TEXT PRIMARY KEY,
+      created_at INTEGER NOT NULL
+    )
+  `);
+}

package/src/memory/migrations/index.ts

@@ -260,6 +260,8 @@ export { migrateMessagesRoleCreatedAtIndex } from "./270-messages-role-created-a
 export { migrateScheduleSourceConversation } from "./270-schedule-source-conversation.js";
 export { createAuthFallbackEventsTable } from "./271-create-auth-fallback-events.js";
 export { migrateAcpSessionHistoryCwd } from "./272-acp-session-history-cwd.js";
+export { migrateOnboardingEventsFunnelColumns } from "./273-onboarding-events-funnel-columns.js";
+export { createActivationSessionsTable } from "./274-create-activation-sessions.js";
 export {
   MIGRATION_REGISTRY,
   type MigrationRegistryEntry,