@vellumai/assistant 0.10.5-staging.1 → 0.10.5-staging.2

package/src/runtime/routes/inbound-stages/acl-enforcement.test.ts

@@ -205,13 +205,13 @@ describe("enforceIngressAcl — verdict-sourced member resolution", () => {
     expect(findContactChannelCalls.length).toBe(0);
   });
 
-  test("member-less guardian verdict is admitted and never fires an access request", async () => {
-    // A guardian classified by principal reaches this channel with NO
-    // per-channel member row: trustClass is "guardian" but the verdict
-    // carries no contactId/channelId/status/policy. The guardian
-    // short-circuit must admit them instead of routing them into the
-    // stranger branch, which fires notifyGuardianOfAccessRequest at the
-    // guardian themselves.
+  test("member-less guardian verdict fails safe: denied with no stranger-lane side effects", async () => {
+    // ATL-958 regression: the gateway proves guardian identity via a
+    // same-channel member row, so every guardian verdict carries one. A
+    // guardian verdict with NO member row is contradictory (e.g. a forged
+    // cross-channel classification) and must not be admitted — but it must
+    // not be routed through the stranger lane either, which would fire an
+    // access request carrying the claimed guardian identity.
     const result = await enforceIngressAcl(
       makeParams({
         sourceMetadata: withVerdict({
@@ -222,10 +222,15 @@ describe("enforceIngressAcl — verdict-sourced member resolution", () => {
       }),
     );
 
-    expect(result.earlyResponse).toBeUndefined();
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "not_a_member",
+    });
     expect(result.resolvedMember).toBeNull();
     expect(accessRequestCalls.length).toBe(0);
     expect(deliverReplyCalls.length).toBe(0);
+    expect(createOutboundSessionCalls.length).toBe(0);
   });
 
   test("guardian verdict with an inactive (pending) member row is still admitted", async () => {

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -257,20 +257,35 @@ export async function enforceIngressAcl(
   }
 
   // ── Guardian short-circuit ──
-  // A verdict classified `guardian` is admitted even when it carries no
-  // per-channel member row (`resolvedMember` null) or an inactive one. The
-  // gateway classifies guardians by principal, so a guardian speaking on a
-  // channel where they hold no same-channel binding must not fall through the
-  // member-vs-stranger gates below — those would misroute the guardian into
-  // the stranger lane and fire an access request at the guardian themselves.
+  // A verdict classified `guardian` is admitted even when its same-channel
+  // member row is inactive (e.g. pending): the gateway classifies guardians
+  // by principal, so a guardian speaking on a channel where they hold no
+  // active guardian binding must not fall through the member-vs-stranger
+  // gates below — those would misroute the guardian into the stranger lane
+  // and fire an access request at the guardian themselves.
   if (verdict.trustClass === "guardian") {
+    // The gateway proves guardian identity via a same-channel member row
+    // (the active binding address, or a row belonging to the guardian
+    // contact), so every guardian verdict carries a resolvable member row.
+    // A guardian verdict WITHOUT one is contradictory — cross-channel
+    // address collisions are not identity proofs and must never confer
+    // guardian capabilities. Fail safe: soft-deny with no stranger-lane
+    // side effects.
+    if (!resolvedMember) {
+      log.warn(
+        { sourceChannel, externalUserId: canonicalSenderId },
+        "Ingress ACL: guardian verdict without a member row, denying fail-safe",
+      );
+      return failClosedDeny();
+    }
+
     // The gateway never classifies a blocked/revoked same-channel row as
     // guardian (explicit per-channel governance wins over the principal
     // check), so a verdict claiming both is contradictory. Fail safe:
     // soft-deny with no stranger-lane side effects.
     if (
-      resolvedMember?.status === "blocked" ||
-      resolvedMember?.status === "revoked"
+      resolvedMember.status === "blocked" ||
+      resolvedMember.status === "revoked"
     ) {
       log.warn(
         {
@@ -288,7 +303,7 @@ export async function enforceIngressAcl(
     // classification. Deny with the accurate policy_deny reason but none of
     // the stranger-lane side effects — the canned "ask the guardian" reply
     // would be addressed at the guardian themselves.
-    if (resolvedMember?.policy === "deny") {
+    if (resolvedMember.policy === "deny") {
       log.info(
         { sourceChannel, externalUserId: canonicalSenderId },
         "Ingress ACL: guardian member row carries policy deny, denying",

package/src/runtime/services/__tests__/conversation-serializer.test.ts

@@ -140,3 +140,22 @@ describe("serializeConversationSummary · surfaced groupId normalization", () =>
     );
   });
 });
+
+describe("serializeConversationSummary · enabledPlugins", () => {
+  test("serializes a non-empty plugin scope", () => {
+    const summary = serialize(
+      makeConversationRow({ enabledPlugins: ["plugin-a", "plugin-b"] }),
+    );
+    expect(summary.enabledPlugins).toEqual(["plugin-a", "plugin-b"]);
+  });
+
+  test("preserves an explicit empty scope (user cleared all optional plugins)", () => {
+    const summary = serialize(makeConversationRow({ enabledPlugins: [] }));
+    expect(summary.enabledPlugins).toEqual([]);
+  });
+
+  test("omits the field when there is no per-chat restriction (null)", () => {
+    const summary = serialize(makeConversationRow({ enabledPlugins: null }));
+    expect("enabledPlugins" in summary).toBe(false);
+  });
+});

package/src/runtime/services/conversation-serializer.ts

@@ -215,6 +215,11 @@ export function serializeConversationSummary(params: {
     ...(conversation.inferenceProfile != null
       ? { inferenceProfile: conversation.inferenceProfile }
       : {}),
+    // Include when non-null so an explicit `[]` (user cleared all plugins) is
+    // preserved; `null`/default is omitted.
+    ...(conversation.enabledPlugins != null
+      ? { enabledPlugins: conversation.enabledPlugins }
+      : {}),
     isProcessing,
   };
 }

package/src/runtime/sync/resource-sync-events.ts

@@ -175,6 +175,16 @@ export function publishConversationTitleChanged(
   );
 }
 
+export function publishConversationEnabledPluginsChanged(
+  conversationId: string,
+  originClientId?: string,
+): void {
+  void publishSyncInvalidation(
+    [SYNC_TAGS.conversationsList, conversationMetadataSyncTag(conversationId)],
+    originClientId,
+  );
+}
+
 export function publishConversationInferenceProfileChanged(
   params: {
     conversationId: string;