@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/routes/empty-state-greeting-cache.ts

@@ -20,6 +20,11 @@ import {
 const CHECKPOINT_KEY_TEXT = "empty_state:greeting:text";
 const CHECKPOINT_KEY_TIMESTAMP = "empty_state:greeting:cached_at";
 
+function scopedCheckpointKey(baseKey: string, scope?: string | null): string {
+  const normalizedScope = scope?.trim();
+  return normalizedScope ? `${baseKey}:${normalizedScope}` : baseKey;
+}
+
 function cacheTtlMs(): number {
   return getConfig().ui.emptyStateGreetingCacheTtlMs;
 }
@@ -29,17 +34,30 @@ function cacheTtlMs(): number {
  * Returns `null` when caching is disabled (TTL <= 0), the cache is empty,
  * or the entry has expired.
  */
-export function getCachedEmptyStateGreeting(): string | null {
+export function getCachedEmptyStateGreeting(
+  scope?: string | null,
+): string | null {
   const ttl = cacheTtlMs();
-  if (ttl <= 0) return null; // caching disabled — always regenerate
+  if (ttl <= 0) {
+    // Caching disabled — always regenerate.
+    return null;
+  }
 
   try {
-    const text = getMemoryCheckpoint(CHECKPOINT_KEY_TEXT);
-    const timestampStr = getMemoryCheckpoint(CHECKPOINT_KEY_TIMESTAMP);
-    if (!text || !timestampStr) return null;
+    const text = getMemoryCheckpoint(
+      scopedCheckpointKey(CHECKPOINT_KEY_TEXT, scope),
+    );
+    const timestampStr = getMemoryCheckpoint(
+      scopedCheckpointKey(CHECKPOINT_KEY_TIMESTAMP, scope),
+    );
+    if (!text || !timestampStr) {
+      return null;
+    }
 
     const cachedAt = Number(timestampStr);
-    if (Number.isNaN(cachedAt) || Date.now() - cachedAt > ttl) return null;
+    if (Number.isNaN(cachedAt) || Date.now() - cachedAt > ttl) {
+      return null;
+    }
 
     return text;
   } catch {
@@ -52,12 +70,21 @@ export function getCachedEmptyStateGreeting(): string | null {
  * No-ops when caching is disabled (TTL <= 0) so a zero-TTL workspace never
  * writes a stale entry.
  */
-export function setCachedEmptyStateGreeting(text: string): void {
-  if (cacheTtlMs() <= 0) return; // caching disabled — skip write
+export function setCachedEmptyStateGreeting(
+  text: string,
+  scope?: string | null,
+): void {
+  if (cacheTtlMs() <= 0) {
+    // Caching disabled — skip write.
+    return;
+  }
 
   try {
-    setMemoryCheckpoint(CHECKPOINT_KEY_TEXT, text);
-    setMemoryCheckpoint(CHECKPOINT_KEY_TIMESTAMP, String(Date.now()));
+    setMemoryCheckpoint(scopedCheckpointKey(CHECKPOINT_KEY_TEXT, scope), text);
+    setMemoryCheckpoint(
+      scopedCheckpointKey(CHECKPOINT_KEY_TIMESTAMP, scope),
+      String(Date.now()),
+    );
   } catch {
     // Cache write failure is non-fatal — next request will regenerate.
   }

package/src/runtime/routes/global-search-routes.ts

@@ -112,6 +112,7 @@ function searchMemoryItems(query: string, limit: number): GlobalSearchMemory[] {
   }
 
   const rows = rawAll<MemoryRow>(
+    "globalSearch:searchMemoryItems",
     `SELECT id, type, content, confidence, last_accessed
      FROM memory_graph_nodes
      WHERE content LIKE ? AND fidelity != 'gone'
@@ -223,7 +224,7 @@ async function handleGlobalSearch({
   };
 
   if (categories.has("conversations")) {
-    const convResults = searchConversations(query, {
+    const convResults = await searchConversations(query, {
       limit,
       maxMessagesPerConversation: 1,
     });

package/src/runtime/routes/guardian-approval-interception.ts

@@ -22,6 +22,7 @@ import type {
   ApprovalConversationGenerator,
   ApprovalCopyGenerator,
 } from "../http-types.js";
+import { findLocalGuardianPrincipalId } from "../local-actor-identity.js";
 import { parseApprovalIntent } from "../nl-approval-parser.js";
 import { handleGuardianTextEngineDecision } from "./approval-strategies/guardian-text-engine-strategy.js";
 import {
@@ -174,6 +175,56 @@ export async function handleApprovalInterception(
     }
   }
 
+  // ── Guardian principal gate ──
+  // A guardian-class decision must be authorized by principal, not merely by
+  // the same-channel address match that produced the trust class: the acting
+  // principal (the channel binding's principal carried on the trust context)
+  // must be present and, when the assistant's vellum anchor resolves, equal
+  // it. This runs BEFORE any decision is applied (callback, text engine, NL
+  // parser). An unresolvable anchor read (transient gateway miss) defers to
+  // the gateway-stamped verdict — the gateway is the ACL source of truth and
+  // an absent verdict is already hard-denied at ingress. The failure copy is
+  // generic by design: no oracle about pending requests or authorization
+  // detail.
+  if (trustCtx.trustClass === "guardian") {
+    const actingPrincipalId = trustCtx.guardianPrincipalId;
+    const anchorPrincipalId = await findLocalGuardianPrincipalId();
+    const principalAuthorized =
+      !!actingPrincipalId &&
+      (!anchorPrincipalId || actingPrincipalId === anchorPrincipalId);
+    if (!principalAuthorized) {
+      log.warn(
+        {
+          conversationId,
+          sourceChannel,
+          hasActingPrincipal: !!actingPrincipalId,
+          hasAnchorPrincipal: !!anchorPrincipalId,
+        },
+        "Blocking guardian-class approval decision: acting principal missing or does not match the bound guardian principal",
+      );
+      if (replyCallbackUrl) {
+        const ephemeralUser = slackEphemeralUserId(
+          sourceChannel,
+          actorExternalId,
+        );
+        try {
+          await deliverChannelReply(replyCallbackUrl, {
+            chatId: conversationExternalId,
+            text: "Sorry, I couldn't process that. Please try again.",
+            assistantId,
+            ...(ephemeralUser ? { ephemeral: true, user: ephemeralUser } : {}),
+          });
+        } catch (err) {
+          log.error(
+            { err, conversationId },
+            "Failed to deliver principal-gate rejection reply",
+          );
+        }
+      }
+      return { handled: true, type: "stale_ignored" };
+    }
+  }
+
   // Try to extract a decision from callback data (button press) first.
   // Callback/button path remains deterministic and takes priority.
   if (callbackData) {

package/src/runtime/routes/home-feed-routes.ts

@@ -29,7 +29,11 @@ import {
   HomeFeedResponseSchema,
 } from "../../api/responses/home.js";
 import { enrichFeedItemsWithSource } from "../../home/feed-source-enrichment.js";
-import { patchFeedItemStatus, readHomeFeed } from "../../home/feed-writer.js";
+import {
+  bulkSetFeedItemStatus,
+  patchFeedItemStatus,
+  readHomeFeed,
+} from "../../home/feed-writer.js";
 import { revalidateHomeContentInBackground } from "../../home/home-content-refresh.js";
 import { getPersonalizedGreeting } from "../../home/home-greeting.js";
 import { getSuggestedPrompts } from "../../home/suggested-prompts.js";
@@ -79,6 +83,17 @@ const listHomeFeedResponseSchema = z.object({
   updatedAt: z.string(),
 });
 
+const bulkStatusRequestSchema = z.object({
+  from: z.array(z.enum(["new", "seen", "acted_on", "dismissed"])).min(1),
+  to: z.enum(["new", "seen", "acted_on", "dismissed"]),
+  ids: z.array(z.string()).optional(),
+});
+
+const bulkStatusResponseSchema = z.object({
+  updatedCount: z.number().int().min(0),
+  updatedAt: z.string(),
+});
+
 // ---------------------------------------------------------------------------
 // Pure helpers (exported for direct testing)
 // ---------------------------------------------------------------------------
@@ -304,6 +319,31 @@ export function handleListHomeFeed({
   };
 }
 
+export async function handleBulkSetFeedItemStatus({
+  body,
+}: RouteHandlerArgs): Promise<Record<string, unknown>> {
+  const parsed = bulkStatusRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new BadRequestError(
+      `Invalid request body: ${parsed.error.issues
+        .map((i) => `${i.path.join(".")} ${i.message}`)
+        .join("; ")}`,
+    );
+  }
+
+  const { from, to, ids } = parsed.data;
+  const updatedCount = await bulkSetFeedItemStatus(from, to, ids);
+  if (updatedCount === -1) {
+    throw new InternalError("Failed to persist bulk feed item status update");
+  }
+
+  const { updatedAt } = readHomeFeed();
+
+  log.info({ from, to, updatedCount }, "POST /v1/home/feed/mark-all");
+
+  return { updatedCount, updatedAt };
+}
+
 export async function handlePostFeedAction({
   pathParams = {},
 }: RouteHandlerArgs): Promise<Record<string, unknown>> {
@@ -410,6 +450,25 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: listHomeFeedRequestSchema,
     responseBody: listHomeFeedResponseSchema,
   },
+  {
+    operationId: "mark_all_home_feed",
+    endpoint: "home/feed/mark-all",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    handler: handleBulkSetFeedItemStatus,
+    summary: "Bulk update home feed item statuses",
+    description:
+      "Flip every home feed item currently at one of the `from` statuses to the single `to` status. Returns the count of items whose status actually changed (items already at `to`, or outside `from`, are left untouched). Used to implement 'Mark all as read' (from=['new'], to='seen') and 'Clear all' (from=['new','seen','acted_on'], to='dismissed').",
+    tags: ["home"],
+    requestBody: bulkStatusRequestSchema,
+    responseBody: bulkStatusResponseSchema,
+    additionalResponses: {
+      "500": { description: "Failed to persist bulk status update" },
+    },
+  },
   {
     operationId: "trigger_home_feed_action",
     endpoint: "home/feed/:id/actions/:actionId",

package/src/runtime/routes/identity-routes.ts

@@ -15,9 +15,10 @@ import { getMaxRollbackVersion } from "../../persistence/migrations/run-migratio
 import { migrationSteps } from "../../persistence/steps.js";
 import { getCesClient } from "../../security/secure-keys.js";
 import {
-  getDiskUsageInfo,
-  parseK8sMemoryBytes,
-} from "../../util/disk-usage.js";
+  getContainerMemoryLimitBytes,
+  getContainerMemoryUsageBytes,
+} from "../../util/cgroup-memory.js";
+import { getDiskUsageInfo } from "../../util/disk-usage.js";
 import { getWorkspacePromptPath } from "../../util/platform.js";
 import { APP_VERSION } from "../../version.js";
 import { resolveHatchedAtReadOnly } from "../../workspace/hatched-date.js";
@@ -32,90 +33,6 @@ interface MemoryInfo {
   maxMb: number;
 }
 
-/**
- * Read the memory limit from the VELLUM_MEMORY_LIMIT env var (K8s resource format),
- * then fall back to cgroups, then to os.totalmem().
- *
- * In platform mode the container runs under gVisor where cgroup files may report
- * the node's memory rather than the container limit. VELLUM_MEMORY_LIMIT is set
- * by the StatefulSet template to the exact K8s memory limit (e.g. "3Gi").
- */
-function getContainerMemoryLimitBytes(): number | null {
-  // 1. Prefer the explicit env var set by the platform StatefulSet template.
-  try {
-    const envLimit = process.env.VELLUM_MEMORY_LIMIT;
-    if (envLimit) {
-      const parsed = parseK8sMemoryBytes(envLimit);
-      if (parsed !== null) return parsed;
-    }
-  } catch {
-    /* env var parsing failed – fall through to cgroups */
-  }
-
-  // 2. Try cgroups v2.
-  try {
-    const v2 = readFileSync("/sys/fs/cgroup/memory.max", "utf-8").trim();
-    if (v2 !== "max") {
-      const bytes = parseInt(v2, 10);
-      if (!isNaN(bytes) && bytes > 0) return bytes;
-    }
-  } catch {
-    /* not available */
-  }
-
-  // 3. Try cgroups v1.
-  try {
-    const v1 = readFileSync(
-      "/sys/fs/cgroup/memory/memory.limit_in_bytes",
-      "utf-8",
-    ).trim();
-    const bytes = parseInt(v1, 10);
-    // cgroups v1 uses a near-INT64_MAX sentinel when no limit is set
-    if (!isNaN(bytes) && bytes > 0 && bytes < totalmem() * 1.5) return bytes;
-  } catch {
-    /* not available */
-  }
-  return null;
-}
-
-/**
- * Read the container's current memory usage from cgroup files.
- *
- * Tries cgroups v2 (`memory.current`) first, then cgroups v1
- * (`memory/memory.usage_in_bytes`), mirroring the v2-then-v1 fallback used by
- * `getContainerMemoryLimitBytes`. Returns null if neither file is available
- * or readable.
- *
- * Unlike the limit lookup, no env-var override is needed: the gVisor issue
- * that motivates VELLUM_MEMORY_LIMIT is specifically about the *limit* files
- * exposing the host node's memory instead of the sandbox limit. The *usage*
- * files (memory.current / memory.usage_in_bytes) reflect the sandbox's own
- * accounting and are accurate under gVisor.
- */
-function getContainerMemoryUsageBytes(): number | null {
-  // 1. Try cgroups v2.
-  try {
-    const v2 = readFileSync("/sys/fs/cgroup/memory.current", "utf-8").trim();
-    const bytes = parseInt(v2, 10);
-    if (!isNaN(bytes) && bytes > 0) return bytes;
-  } catch {
-    /* not available */
-  }
-
-  // 2. Try cgroups v1.
-  try {
-    const v1 = readFileSync(
-      "/sys/fs/cgroup/memory/memory.usage_in_bytes",
-      "utf-8",
-    ).trim();
-    const bytes = parseInt(v1, 10);
-    if (!isNaN(bytes) && bytes > 0) return bytes;
-  } catch {
-    /* not available */
-  }
-  return null;
-}
-
 function getMemoryInfo(): MemoryInfo {
   const bytesToMb = (b: number) => Math.round((b / (1024 * 1024)) * 100) / 100;
   // In platform-managed mode the daemon shares its Node process with whatever

package/src/runtime/routes/inbound-message-handler.ts

@@ -1,8 +1,9 @@
 /**
  * Channel inbound message handler: validates, records, and routes inbound
  * messages from all channels. Handles ingress ACL, edits, guardian
- * verification, guardian action answers, approval interception, and
- * invite token redemption.
+ * verification, guardian action answers, and approval interception.
+ * Invite token/code redemption is intercepted at gateway ingress before
+ * messages reach this handler.
  */
 import type { SourceMetadata } from "@vellumai/gateway-client";
 import {
@@ -90,14 +91,20 @@ import { wrapUntrustedContent } from "../../security/untrusted-content.js";
 import { canonicalizeInboundIdentity } from "../../util/canonicalize-identity.js";
 import { getLogger } from "../../util/logger.js";
 import { truncate } from "../../util/truncate.js";
-import { notifyGuardianOfAccessRequest } from "../access-request-helper.js";
+import {
+  isApprovalHandshakeInProgress,
+  notifyGuardianOfAccessRequest,
+} from "../access-request-helper.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { deliverChannelReply } from "../gateway-client.js";
 import { trustContextFromVerdict } from "../trust-verdict-consumer.js";
 import { canonicalChannelAssistantId } from "./channel-route-shared.js";
 import { BadRequestError } from "./errors.js";
 import { handleApprovalInterception } from "./guardian-approval-interception.js";
-import { enforceIngressAcl } from "./inbound-stages/acl-enforcement.js";
+import {
+  composeAccessDenialReply,
+  enforceIngressAcl,
+} from "./inbound-stages/acl-enforcement.js";
 import { enforceAdmissionPolicy } from "./inbound-stages/admission-policy.js";
 import { processChannelMessageInBackground } from "./inbound-stages/background-dispatch.js";
 import { handleBootstrapIntercept } from "./inbound-stages/bootstrap-intercept.js";
@@ -454,6 +461,13 @@ export async function handleChannelInbound({
     ? admissionPolicyFromGateway
     : undefined;
 
+  // Callback payloads (button presses, delete sentinels) are decision
+  // attempts / lifecycle events, not access attempts: the ACL stage must not
+  // respond to one by minting a verification challenge or creating an access
+  // request (LUM-2673). Reaction callbacks never reach this point — the
+  // intercept above returns for them.
+  const isCallbackInteraction = hasCallbackData;
+
   // ── Ingress ACL enforcement ──
   const aclResult = await enforceIngressAcl({
     canonicalSenderId,
@@ -468,8 +482,8 @@ export async function handleChannelInbound({
     actorUsername: body.actorUsername,
     replyCallbackUrl: body.replyCallbackUrl,
     assistantId,
-    externalMessageId,
     effectiveAdmissionPolicy: effectiveAdmissionPolicyForAcl,
+    isCallbackInteraction,
   });
   if (aclResult.earlyResponse) return aclResult.earlyResponse;
   const { resolvedMember } = aclResult;
@@ -798,48 +812,67 @@ export async function handleChannelInbound({
     // `acl-enforcement.ts:267-449` for `not_a_member`, so denials are
     // visible in the same UI. previousMemberStatus is only meaningful when
     // a member record exists; we pass it through when available so the
-    // guardian sees "previously pending" etc.
+    // guardian sees "previously pending" etc. Callback interactions never
+    // create an access request (LUM-2673); the handshake window is still
+    // probed for reply copy.
     let guardianNotified = false;
-    try {
-      const accessResult = await notifyGuardianOfAccessRequest({
-        canonicalAssistantId,
-        sourceChannel,
-        conversationExternalId,
-        actorExternalId: canonicalSenderId ?? rawSenderId,
-        actorDisplayName: body.actorDisplayName,
-        actorUsername: body.actorUsername,
-        ...(resolvedMember
-          ? {
-              previousMemberStatus: channelStatusToMemberStatus(
-                resolvedMember.status,
-              ),
-            }
-          : {}),
-        messagePreview: truncate(trimmedContent, MESSAGE_PREVIEW_MAX_LENGTH),
-        ...(typeof sourceMetadata?.isStranger === "boolean"
-          ? { isStranger: sourceMetadata.isStranger }
-          : {}),
-        ...(typeof sourceMetadata?.isRestricted === "boolean"
-          ? { isRestricted: sourceMetadata.isRestricted }
-          : {}),
-        ...(typeof sourceMetadata?.messageId === "string"
-          ? { messageTs: sourceMetadata.messageId }
-          : {}),
-      });
-      guardianNotified = accessResult.notified;
-    } catch (err) {
-      log.error(
-        { err, sourceChannel, conversationExternalId },
-        "Failed to notify guardian of access request (admission policy)",
-      );
+    let handshakeInProgress = false;
+    const floorSenderId = canonicalSenderId ?? rawSenderId;
+    if (isCallbackInteraction) {
+      if (floorSenderId) {
+        handshakeInProgress = isApprovalHandshakeInProgress({
+          canonicalAssistantId,
+          sourceChannel,
+          actorExternalId: floorSenderId,
+        });
+      }
+    } else {
+      try {
+        const accessResult = await notifyGuardianOfAccessRequest({
+          canonicalAssistantId,
+          sourceChannel,
+          conversationExternalId,
+          actorExternalId: floorSenderId,
+          actorDisplayName: body.actorDisplayName,
+          actorUsername: body.actorUsername,
+          ...(resolvedMember
+            ? {
+                previousMemberStatus: channelStatusToMemberStatus(
+                  resolvedMember.status,
+                ),
+              }
+            : {}),
+          messagePreview: truncate(trimmedContent, MESSAGE_PREVIEW_MAX_LENGTH),
+          ...(typeof sourceMetadata?.isStranger === "boolean"
+            ? { isStranger: sourceMetadata.isStranger }
+            : {}),
+          ...(typeof sourceMetadata?.isRestricted === "boolean"
+            ? { isRestricted: sourceMetadata.isRestricted }
+            : {}),
+          ...(typeof sourceMetadata?.messageId === "string"
+            ? { messageTs: sourceMetadata.messageId }
+            : {}),
+        });
+        guardianNotified = accessResult.notified;
+        handshakeInProgress =
+          !accessResult.notified &&
+          accessResult.reason === "approval_pending_verification";
+      } catch (err) {
+        log.error(
+          { err, sourceChannel, conversationExternalId },
+          "Failed to notify guardian of access request (admission policy)",
+        );
+      }
     }
 
     // Canned reply mirrors the not_a_member surface. §8.2: no upgrade
     // challenge text for `trusted_contacts` / `guardian_only` denials —
     // sender gets the standard "ask the guardian" copy.
-    const replyText = guardianNotified
-      ? "Hmm looks like you don't have access to talk to me. I'll let your guardian know you tried."
-      : "Sorry, you haven't been approved to message this assistant.";
+    const replyText = await composeAccessDenialReply({
+      sourceChannel,
+      guardianNotified,
+      handshakeInProgress,
+    });
     let replyDelivered = false;
     if (replyCallbackUrl) {
       const replyPayload: Parameters<typeof deliverChannelReply>[1] = {
@@ -1251,6 +1284,12 @@ export async function handleChannelInbound({
         sourceChannel === "slack"
           ? resolveSlackTranscriptTimestampTimezone(inboundClientTimezone)
           : undefined;
+      const slackActorTeamId =
+        sourceChannel === "slack" &&
+        typeof sourceMetadata?.actorTeamId === "string" &&
+        sourceMetadata.actorTeamId.length > 0
+          ? sourceMetadata.actorTeamId
+          : undefined;
       const slackInbound =
         sourceChannel === "slack"
           ? {
@@ -1266,6 +1305,7 @@ export async function handleChannelInbound({
               ...(trustCtx.requesterExternalUserId
                 ? { actorExternalUserId: trustCtx.requesterExternalUserId }
                 : {}),
+              ...(slackActorTeamId ? { actorTeamId: slackActorTeamId } : {}),
               ...buildSlackTimezoneMetadata({
                 actorTimezone: slackActorTimezone?.timezone,
                 actorTimezoneLabel: slackActorTimezone?.timezoneLabel,
@@ -1683,6 +1723,7 @@ async function persistBackfilledSlackMessage(params: {
             downloaded.filename,
             downloaded.mimeType,
             downloaded.data,
+            { normalizeImage: true },
           );
           attachments.push({
             filename: downloaded.filename,