@startsimpli/integrations 0.2.13 → 0.2.16

package/src/components/pages/ConnectionsPage.tsx

@@ -48,6 +48,7 @@ import type {
   ConnectionTarget,
   ConnectorAction,
   ConnectorCatalogEntry,
+  ConnectorFieldSpec,
   ConnectionsApi,
 } from './types';
 
@@ -267,7 +268,7 @@ function CatalogCard({
   onConnected: () => void;
 }) {
   const [open, setOpen] = React.useState(false);
-  const [values, setValues] = React.useState<Record<string, string>>({});
+  const [values, setValues] = React.useState<Record<string, unknown>>({});
   const [busy, setBusy] = React.useState(false);
   const [error, setError] = React.useState('');
   // Every declared capability starts ON. Not because "on" is a safe default in
@@ -296,7 +297,11 @@ function CatalogCard({
       }
       for (const spec of configFields) {
         const v = values[isSecret(spec) ? `${spec.key}__draft` : spec.key];
-        if (v) config[spec.key] = v;
+        // `if (v)` DROPPED A FALSE, which for a checkbox makes "off" and
+        // "untouched" the same request. Harmless while every config field was a
+        // string; not harmless once one of them decides whether verbatim
+        // recordings are stored.
+        if (typeof v === 'boolean' || typeof v === 'number' || v) config[spec.key] = v;
       }
       await api.connect(foundrySlug, {
         connector_key: entry.key, name: entry.name, credentials, config,
@@ -428,7 +433,7 @@ function CatalogCard({
  *     a secret never means re-typing the settings around it.
  *
  * Only the CREDENTIAL fields render. `config` is not a credential and is edited
- * through the connection's own settings; mixing them here would make a
+ * through `ConnectionSettingsForm` below; mixing them here would make a
  * rotation quietly a config change.
  */
 function ReplaceKeyForm({
@@ -441,7 +446,7 @@ function ReplaceKeyForm({
   classNames: typeof DEFAULTS;
   onDone: () => void;
 }) {
-  const [values, setValues] = React.useState<Record<string, string>>({});
+  const [values, setValues] = React.useState<Record<string, unknown>>({});
   const [busy, setBusy] = React.useState(false);
   const [error, setError] = React.useState('');
 
@@ -514,6 +519,101 @@ function ReplaceKeyForm({
 //  a connected account: discover -> wire -> confirm -> fire
 // --------------------------------------------------------------------------
 
+/**
+ * The connection's own settings — its connector's `config_schema`, for an
+ * account that already exists.
+ *
+ * WHY IT IS A SEPARATE FORM FROM THE CONNECT CARD. Connecting is "here are my
+ * credentials, does this work"; this is "change how it behaves". Rotating a key
+ * must not quietly change a setting, and changing a setting must not ask for a
+ * key. `ReplaceKeyForm` has said as much in its own docstring since it shipped,
+ * pointing at a surface that did not exist.
+ *
+ * IT SENDS ONLY WHAT CHANGED, and the API merges. Two reasons, and the second is
+ * the one that bites: resending untouched fields turns "I ticked one box" into
+ * "I reassert every setting", which silently overwrites an edit made in another
+ * tab — and it is exactly how the retention bound gets reset to whatever this
+ * form happened to be showing.
+ *
+ * A FALSE IS SENT, not omitted. The connect card drops falsy values, which for a
+ * checkbox makes "off" indistinguishable from "untouched" — and against a
+ * merging API that would make the off position literally unreachable. For
+ * `ingest_transcripts` the off position is the whole privacy posture.
+ */
+function ConnectionSettingsForm({
+  api, foundrySlug, connection, fields, classNames: cn, onDone,
+}: {
+  api: ConnectionsApi;
+  foundrySlug: string;
+  connection: Connection;
+  fields: ConnectorFieldSpec[];
+  classNames: typeof DEFAULTS;
+  onDone: () => void;
+}) {
+  const stored = React.useMemo(
+    () => (connection.config ?? {}) as Record<string, unknown>,
+    [connection.config],
+  );
+  const [edits, setEdits] = React.useState<Record<string, string | boolean>>({});
+  const [busy, setBusy] = React.useState(false);
+  const [error, setError] = React.useState('');
+
+  const values = React.useMemo(() => ({ ...stored, ...edits }), [stored, edits]);
+  const warnings = patternWarnings(fields, values);
+  const changed = Object.keys(edits);
+
+  async function save() {
+    setBusy(true);
+    setError('');
+    try {
+      // Numbers go back as numbers. A `number` input hands back a string, and a
+      // retention bound stored as "0" rather than 0 is a comparison that quietly
+      // stops being true.
+      const config: Record<string, unknown> = {};
+      for (const key of changed) {
+        const spec = fields.find((field) => field.key === key);
+        const value = edits[key];
+        config[key] =
+          spec?.type === 'number' && typeof value === 'string' && value.trim() !== ''
+            ? Number(value)
+            : value;
+      }
+      await api.updateConnection(foundrySlug, connection.id, { config });
+      onDone();
+    } catch (err) {
+      setError((err as { message?: string })?.message || 'Those settings were not saved.');
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="mt-3 space-y-3 border-t pt-3" role="group" aria-label="Connection settings">
+      <CredentialSchemaForm
+        fields={fields}
+        values={values}
+        onChange={(key, value) => setEdits((current) => ({ ...current, [key]: value }))}
+        warnings={warnings}
+        idPrefix={`settings-${connection.id}`}
+      />
+      {error ? <p className={cn.error} role="alert">{error}</p> : null}
+      <div className="flex items-center gap-2">
+        <button
+          type="button"
+          className={cn.button}
+          disabled={busy || changed.length === 0}
+          onClick={() => void save()}
+        >
+          {busy ? 'Saving…' : 'Save settings'}
+        </button>
+        {changed.length === 0 ? (
+          <span className={cn.muted}>Nothing changed yet.</span>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+
 function ConnectionCard({
   api, foundrySlug, connection, entry, canManage, classNames: cn, onChanged,
 }: {
@@ -533,6 +633,7 @@ function ConnectionCard({
   const [error, setError] = React.useState('');
   const [notice, setNotice] = React.useState('');
   const [replacing, setReplacing] = React.useState(false);
+  const [settingsOpen, setSettingsOpen] = React.useState(false);
   const [confirmingDisconnect, setConfirmingDisconnect] = React.useState(false);
 
   const declared = entry?.capabilities;
@@ -568,8 +669,10 @@ function ConnectionCard({
     }
   }
 
+  const configFields = schemaFields(entry?.config_schema);
+
   return (
-    <div className={cn.card}>
+    <div className={cn.card} data-connection={connection.id}>
       <div className="flex items-start justify-between gap-4">
         <div>
           <p className="font-medium text-gray-900">{connection.name}</p>
@@ -624,12 +727,35 @@ function ConnectionCard({
             >
               {busy === 'discover' ? 'Loading…' : 'Workflows'}
             </button>
+            {/* SETTINGS, which this card has never had. A connector's
+                `config_schema` ships on every catalog row and was rendered
+                exactly once — on the connect form, before the account existed.
+                After that a setting could not be changed from the product at
+                all, which for Granola means the switch deciding whether verbatim
+                recordings of people's conversations are stored was reachable
+                only by editing the database. `ReplaceKeyForm` already pointed at
+                "the connection's own settings" as if this existed. */}
+            {configFields.length ? (
+              <button
+                type="button"
+                className={cn.button}
+                disabled={Boolean(busy) || confirmingDisconnect}
+                onClick={() => {
+                  setReplacing(false);
+                  setError('');
+                  setSettingsOpen((v) => !v);
+                }}
+              >
+                {settingsOpen ? 'Close settings' : 'Settings'}
+              </button>
+            ) : null}
             <button
               type="button"
               className={cn.button}
               disabled={Boolean(busy) || confirmingDisconnect}
               onClick={() => {
                 setReplacing(false);
+                setSettingsOpen(false);
                 setError('');
                 setConfirmingDisconnect(true);
               }}
@@ -640,6 +766,17 @@ function ConnectionCard({
         ) : null}
       </div>
 
+      {settingsOpen ? (
+        <ConnectionSettingsForm
+          api={api}
+          foundrySlug={foundrySlug}
+          connection={connection}
+          fields={configFields}
+          classNames={cn}
+          onDone={() => { setSettingsOpen(false); setNotice('Settings saved.'); onChanged(); }}
+        />
+      ) : null}
+
       {replacing ? (
         <ReplaceKeyForm
           api={api}

package/src/components/pages/LibraryPage.tsx

@@ -114,11 +114,31 @@ function relative(value: string | null | undefined, now: number): string {
  * and the row is a summary, not the document.
  */
 function preview(document: SourceDocument, length = 180): string {
-  const text = stripMarkdown(document.body || document.sections[0]?.text || '');
+  const text = stripMarkdown(
+    summaryOf(document) || document.body || document.sections[0]?.text || '',
+  );
   if (!text) return '';
   return text.length > length ? `${text.slice(0, length).trim()}…` : text;
 }
 
+/**
+ * The short form, when the source wrote one.
+ *
+ * `body` falls back to the summary on a corpus that has never delivered a full
+ * text, so on today's tenant these are the same string and this returns it. When
+ * both exist they are different, and only this one belongs under the heading
+ * "Summary".
+ */
+function summaryOf(document: SourceDocument): string {
+  return document.summary || (document.body ?? '');
+}
+
+/** The verbatim text, when it is genuinely different from the summary. */
+function fullTextOf(document: SourceDocument): string {
+  const body = document.body ?? '';
+  return body && body !== summaryOf(document) ? body : '';
+}
+
 // ---------------------------------------------------------------------------
 
 export function LibraryPage({
@@ -589,15 +609,48 @@ function DocumentDetail({
         </div>
       ) : null}
 
-      {document.body ? (
+      {/* THE SUMMARY, UNDER THE WORD SUMMARY. This used to render `document.body`
+          here — which was the summary only for as long as nothing had ever
+          delivered a full text. The moment `ingest_transcripts` lands, `body` is
+          forty minutes of verbatim speech, and it would have appeared on this
+          screen labelled "Summary" while the actual summary appeared nowhere. */}
+      {summaryOf(document) ? (
         <div className="mt-3">
           <p className="text-sm font-medium text-gray-900">Summary</p>
           {/* Sources write Markdown — a literal "## Decisions" on the screen
               reads as a broken product, not as the source's punctuation. */}
-          <Markdown text={document.body} className="mt-1 text-sm text-gray-700" />
+          <Markdown text={summaryOf(document)} className="mt-1 text-sm text-gray-700" />
         </div>
       ) : null}
 
+      {/* The FULL text, collapsed, next to the source's other long-form. Behind
+          a disclosure and not open by default, for the same reason a transcript
+          is opt-in at all: verbatim speech is a different data class from a
+          summary, and a screen that puts it in front of whoever opened the
+          record has quietly decided that on the reader's behalf. */}
+      {fullTextOf(document) ? (
+        <details className="mt-3">
+          <summary className="cursor-pointer text-sm font-medium text-gray-900">
+            Full text
+          </summary>
+          <pre className="mt-2 max-h-96 overflow-auto whitespace-pre-wrap rounded bg-gray-50 p-2 text-xs text-gray-700">
+            {fullTextOf(document)}
+          </pre>
+        </details>
+      ) : null}
+
+      {/* WITHHELD IS NOT EMPTY (bd startsim-768w.38.33). The tenant's per-field
+          read gate strips a restricted attribute and names it in
+          `redacted_fields`; without this line the reader sees a meeting with no
+          transcript and concludes there wasn't one. Named rather than counted,
+          because "the transcript" and "the salary" are different absences. */}
+      {document.withheldFields?.length ? (
+        <p className={`mt-3 ${cn.warning}`} role="status">
+          Part of this record is not shared with you:{' '}
+          {document.withheldFields.join(', ')}. Ask an admin if you need it.
+        </p>
+      ) : null}
+
       {/* Long-form under the SOURCE's own name for it — "Transcript" for a
           meeting, "Extracted text" for a PDF. This component does not know
           which is which, and must not. */}

package/src/components/pages/TrackerPage.tsx

@@ -407,6 +407,23 @@ function RunSummary({
         out of the notes by {result.provider.live ? `${result.provider.provider} · ${result.provider.model}` : 'no live model'}.
       </p>
 
+      {/* WHAT THE CHECK THREW AWAY, on the screen.
+          Measured over the sixteen real meetings: the model proposes about
+          ninety items and roughly two thirds of them do not survive. That is not
+          a bug to hide — it is the number that keeps the list believable, and
+          hiding it would leave "the model read 30 out of the notes" looking like
+          the model is simply better than it is. If `verified` is ever false the
+          run says so rather than implying a check that did not happen. */}
+      {result.fromModel || result.ungrounded || result.unconfirmed ? (
+        <p className={cn.muted}>
+          {result.verified
+            ? `Checked against the meetings themselves: ${result.unconfirmed + result.ungrounded} more were proposed and dropped — ` +
+              `${result.ungrounded} quoted something the record does not say, ` +
+              `${result.unconfirmed} could not be confirmed as something anyone actually took on.`
+            : 'These were NOT checked against the meetings — the verification step did not run, so treat them as suggestions.'}
+        </p>
+      ) : null}
+
       {result.needsReview.length ? (
         // Weak resolution matches are shown, never applied. A to-do list that
         // quietly empties itself is the one failure with no symptom.

package/src/corpus/ask.ts

@@ -20,6 +20,7 @@
  */
 import { moneyEventAsDocument } from './entities';
 import { retrieveForQuestion } from './retrieval';
+import { documentText } from './text';
 import type {
   AnswerRequest,
   AskRequest,
@@ -74,6 +75,7 @@ function systemPrompt(mode: AskRequest['mode']): string {
     'You answer questions about a company using only that company\'s own records.',
     ...shared,
     'Be specific and short. Prefer naming the record and the date over hedging.',
+    'A document may list "withheld_from_this_reader". Those parts were deliberately not shown to you: never claim something was not said or did not happen on the basis of a document that lists them — say the record is partly withheld instead.',
   ].join('\n');
 }
 
@@ -93,6 +95,7 @@ export function buildAnswerRequest(
     occurredAt: document.occurredAt,
     participants: document.participants.map((party) => party.name),
     text: documentText(document, maxChars),
+    ...(document.withheldFields?.length ? { withheldFields: document.withheldFields } : {}),
   }));
   return {
     question: request.question,
@@ -103,15 +106,18 @@ export function buildAnswerRequest(
 }
 
 /**
- * A document's text for the prompt: body first, then each named section, cut at
- * a budget. Sections are labelled with the source's own words, so the model sees
- * "Transcript" or "Extracted text" without this package knowing what either is.
+ * A document's text for the prompt: the summary first, then the full text, then
+ * each named section, cut at a budget. Sections are labelled with the source's
+ * own words, so the model sees "Transcript" or "Extracted text" without this
+ * package knowing what either is.
+ *
+ * ONE IMPLEMENTATION, in `./text`, shared with extraction. It used to be two
+ * near-identical private copies with different budgets, which is how the Ask
+ * surface came within one config flag of spending its entire 6,000-character
+ * per-document budget on the opening minutes of a transcript and never showing
+ * the model the summary at all.
  */
-export function documentText(document: SourceDocument, maxChars: number): string {
-  const parts = [document.body, ...document.sections.map((s) => `## ${s.label}\n${s.text}`)];
-  const joined = parts.filter(Boolean).join('\n\n');
-  return joined.length > maxChars ? `${joined.slice(0, maxChars)}\n…[truncated]` : joined;
-}
+export { documentText };
 
 /** Render the batched request as the single user message. */
 export function renderAnswerPrompt(input: AnswerRequest): string {
@@ -122,6 +128,13 @@ export function renderAnswerPrompt(input: AnswerRequest): string {
       `source: ${document.source}`,
       `occurred_at: ${document.occurredAt ?? 'unknown'}`,
       document.participants.length ? `participants: ${document.participants.join(', ')}` : '',
+      // The model is told what it was NOT given. Otherwise a summary-only view of
+      // a meeting whose transcript was withheld is indistinguishable from a
+      // meeting where the thing was never said, and the answer comes back as a
+      // confident negative about text nobody was allowed to show it.
+      document.withheldFields?.length
+        ? `withheld_from_this_reader: ${document.withheldFields.join(', ')}`
+        : '',
       '',
       document.text,
       '</document>',
@@ -275,6 +288,8 @@ export async function askCorpus(
     };
   }
 
+  const withheldFields = collectWithheld(retrieved);
+
   const draft = await llm.answer(
     buildAnswerRequest(request, retrieved, maxCharsPerDocument),
   );
@@ -290,11 +305,21 @@ export async function askCorpus(
     considered: retrieved,
     unresolvedCitations: unresolved,
     droppedOutOfScope,
+    ...(withheldFields.length ? { withheldFields } : {}),
     provider: llm.describe(),
     freshness,
   };
 }
 
+/** Every field withheld on any record that reached the prompt, deduped. */
+function collectWithheld(retrieved: RetrievedDocument[]): string[] {
+  const names = new Set<string>();
+  for (const item of retrieved) {
+    for (const name of item.document.withheldFields ?? []) names.add(name);
+  }
+  return [...names].sort();
+}
+
 /**
  * `uncited` is a real outcome, not a failure to report. The model produced text
  * and nothing traceable; the surface renders that as a warning over the text

package/src/corpus/entities.ts

@@ -85,6 +85,14 @@ export interface TenantEntity {
   orgId?: string;
   owner_sub?: string;
   ownerSub?: string;
+  /**
+   * Attribute names the tenant's per-field read gate withheld from this caller
+   * (bd startsim-768w.38.33). The server has ALREADY removed them from `data`;
+   * this names them so the absence is legible rather than mistaken for a record
+   * that never had them.
+   */
+  redacted_fields?: string[];
+  redactedFields?: string[];
 }
 
 /**
@@ -111,9 +119,35 @@ export const DEFAULT_TYPE_KEYS: CorpusTypeKeys = {
 //  tolerant accessors
 // ---------------------------------------------------------------------------
 
+/**
+ * Field names the server says it withheld from this caller
+ * (bd startsim-768w.38.33). Both spellings, for the same reason every other
+ * accessor here takes both: the `@startsimpli/api` client transforms
+ * snake_case↔camelCase and either client can fetch a row.
+ */
+export function withheldFieldsOf(entity: TenantEntity): string[] {
+  const raw = entity.redacted_fields ?? entity.redactedFields;
+  return Array.isArray(raw) ? raw.map((name) => String(name)).filter(Boolean) : [];
+}
+
 function bag(entity: TenantEntity): Record<string, unknown> {
   const data = entity.data;
-  return data && typeof data === 'object' ? (data as Record<string, unknown>) : {};
+  const payload = data && typeof data === 'object' ? (data as Record<string, unknown>) : {};
+  // BELT AND BRACES, ON PURPOSE. The gate is enforced server-side and `data`
+  // arrives already stripped — so in the normal case this loop removes nothing.
+  // It runs anyway because `redacted_fields` is the server telling us what it
+  // meant to withhold, and a build where the two disagree (a half-rolled deploy,
+  // a response cached from an admin's session, a serializer edited without its
+  // gate) is exactly the case where a client that trusts `data` alone quotes a
+  // transcript into an answer. Honouring the server's own declaration costs one
+  // pass over a small object and turns that class of bug into a no-op.
+  const withheld = withheldFieldsOf(entity);
+  if (!withheld.length) return payload;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (!withheld.includes(key)) out[key] = value;
+  }
+  return out;
 }
 
 /**
@@ -391,6 +425,17 @@ export function toSourceDocument(
   const data = bag(entity);
   const source = asText(pick(data, 'source', 'source_key', 'sourceKey')) || 'unknown';
 
+  // TWO TEXT FIELDS, NOT ONE, because the canonical schema declares two and says
+  // why: "Collapsing them means the transcript clobbers the summary the first
+  // time both arrive". This mapper collapsed them anyway —
+  // `pick(data,'body',…,'summary')` returns the first present key — so a
+  // document carrying both would have surfaced ONLY the transcript, and the
+  // `## Next Steps` block that the entire deterministic rules pass reads lives
+  // in the summary. Switching `ingest_transcripts` on would have taken a
+  // 95.8%-precision, 100%-owner-accuracy pass to zero, silently, on deploy.
+  const summary = asText(pick(data, 'summary', 'description'));
+  const fullText = asText(pick(data, 'body', 'text', 'content'));
+
   const sections = toSections(pick(data, 'sections'));
   // A source that stored its long-form under a bare attribute rather than in
   // `sections` still contributes one. Listed keys are storage spellings, not
@@ -407,7 +452,13 @@ export function toSourceDocument(
       asText(pick(data, 'title', 'subject', 'headline')) ||
       entity.name ||
       `Untitled ${source} record`,
-    body: asText(pick(data, 'body', 'text', 'summary', 'description', 'content')),
+    // `body` still ANSWERS for the summary when the source has never delivered a
+    // full text, which is every row on the live tenant today. Every existing
+    // consumer of `.body` — retrieval, the Ask prompt, the Library preview —
+    // keeps working unchanged on a corpus of summaries; only a corpus that has
+    // both sees a difference, and that is the corpus this distinction is for.
+    body: fullText || summary,
+    ...(summary ? { summary } : {}),
     sections,
     occurredAt: asIso(pick(data, 'occurred_at', 'occurredAt', 'happened_at', 'date')),
     source,
@@ -432,6 +483,9 @@ export function toSourceDocument(
     ),
     scope: scopeOf(entity, fallbackScope),
     ingestedAt: asIso(entity.created_at ?? entity.createdAt),
+    ...(withheldFieldsOf(entity).length
+      ? { withheldFields: withheldFieldsOf(entity) }
+      : {}),
   };
 }