@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/runtime/routes/conversation-routes.ts

@@ -22,6 +22,12 @@ import {
   type ConversationMessage,
   ConversationMessageSchema,
 } from "../../api/responses/conversation-message.js";
+import {
+  decideGuardianRequest,
+  expireGuardianRequest,
+  listGuardianRequestsOrEmpty,
+  listPendingRequestsByScopeOrEmpty,
+} from "../../channels/gateway-guardian-requests.js";
 import {
   CHANNEL_IDS,
   INTERFACE_IDS,
@@ -35,11 +41,6 @@ import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-fl
 import { getEffectiveProfiles } from "../../config/default-profile-catalog.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { getConfig } from "../../config/loader.js";
-import {
-  listCanonicalGuardianRequests,
-  listPendingRequestsByConversationScope,
-  resolveCanonicalGuardianRequest,
-} from "../../contacts/canonical-guardian-store.js";
 import {
   mergeConsecutiveAssistantMessages,
   mergeToolResultsIntoAssistantMessages,
@@ -243,13 +244,19 @@ function alignAttachments(
 
   const byId = new Map<string, number>();
   attachments.forEach((att, idx) => {
-    if (att.id) byId.set(att.id, idx);
+    if (att.id) {
+      byId.set(att.id, idx);
+    }
   });
   const consumed = new Set<number>();
   const orderedRowIdx: Array<number | null> = attachmentRefs.map((ref) => {
-    if (!ref.attachmentId) return null;
+    if (!ref.attachmentId) {
+      return null;
+    }
     const idx = byId.get(ref.attachmentId);
-    if (idx === undefined || consumed.has(idx)) return null;
+    if (idx === undefined || consumed.has(idx)) {
+      return null;
+    }
     consumed.add(idx);
     return idx;
   });
@@ -260,7 +267,9 @@ function alignAttachments(
   if (matchedRows.length > 0) {
     const orphanRows: number[] = [];
     for (let i = 0; i < attachments.length; i++) {
-      if (!consumed.has(i)) orphanRows.push(i);
+      if (!consumed.has(i)) {
+        orphanRows.push(i);
+      }
     }
     const reordered = [
       ...matchedRows.map((i) => attachments[i]),
@@ -279,7 +288,9 @@ function alignAttachments(
       contentOrder
         .map((entry) => {
           const match = entry.match(ATTACHMENT_ENTRY_RE);
-          if (!match) return entry;
+          if (!match) {
+            return entry;
+          }
           const remapped = refToNewIdx.get(Number(match[1]));
           return remapped !== undefined ? `attachment:${remapped}` : undefined;
         })
@@ -332,7 +343,9 @@ function isValidRiskThreshold(value: unknown): value is RiskThreshold {
  * leaving them in the LLM-side context.
  */
 function isHiddenMessage(metadata: string | null): boolean {
-  if (!metadata) return false;
+  if (!metadata) {
+    return false;
+  }
   try {
     return isHiddenMessageMetadata(
       JSON.parse(metadata) as Record<string, unknown>,
@@ -346,7 +359,9 @@ function buildSlackHistoryMessage(
   slackMeta: SlackMessageMetadata | null,
   opts?: { role?: string; assistantDisplayName?: string },
 ): RuntimeMessagePayload["slackMessage"] | undefined {
-  if (!slackMeta) return undefined;
+  if (!slackMeta) {
+    return undefined;
+  }
 
   const slackConfig = getConfig().slack;
   const replyThreadTs =
@@ -395,12 +410,14 @@ function buildSlackHistoryMessage(
   };
 }
 
-function collectCanonicalGuardianRequestHintIds(
+async function collectGuardianRequestHintIds(
   conversationId: string,
   sourceChannel: string,
   conversation: Conversation,
-): string[] {
-  const requests = listPendingRequestsByConversationScope(
+): Promise<string[]> {
+  // Degrades to no hints on gateway failure: the reply scope then blocks
+  // (see the caller) and the message falls through to the normal send path.
+  const requests = await listPendingRequestsByScopeOrEmpty(
     conversationId,
     sourceChannel,
   );
@@ -415,12 +432,12 @@ function collectCanonicalGuardianRequestHintIds(
 }
 
 /**
- * Expire orphaned canonical guardian requests for a conversation.
+ * Expire orphaned guardian requests for a conversation.
  *
  * After the in-memory auto-deny loop runs, there may still be "pending"
- * canonical requests in the DB that have no corresponding in-memory
+ * guardian requests in the gateway that have no corresponding in-memory
  * pending interaction (e.g. the prompter timed out and resolved the
- * confirmation directly without syncing canonical status). This sweep
+ * confirmation directly without syncing the request status). This sweep
  * catches those stragglers so they don't get falsely matched by the
  * guardian reply router on subsequent messages.
  *
@@ -429,13 +446,16 @@ function collectCanonicalGuardianRequestHintIds(
  * in their source conversation. Additionally skips requests that still
  * have a live in-memory pending interaction.
  *
- * Uses `listCanonicalGuardianRequests` (not `listPendingRequestsByConversationScope`)
- * so that time-expired requests (past their `expiresAt`) are also caught
- * instead of being silently filtered out.
+ * Uses the plain list (not `listPendingRequestsByScope`) so time-expired
+ * requests (past their `expiresAt`) are also caught instead of being
+ * silently filtered out. Sweep posture on gateway failure: log and skip —
+ * the next send or the periodic sweep retries.
  */
-function expireOrphanedCanonicalRequests(conversationId: string): void {
-  const sourceScoped = listCanonicalGuardianRequests({
-    conversationId,
+async function expireOrphanedGuardianRequests(
+  conversationId: string,
+): Promise<void> {
+  const sourceScoped = await listGuardianRequestsOrEmpty({
+    sourceConversationId: conversationId,
     status: "pending",
     kind: "tool_approval",
   });
@@ -443,15 +463,22 @@ function expireOrphanedCanonicalRequests(conversationId: string): void {
   for (const req of sourceScoped) {
     // Skip requests that still have a live in-memory pending interaction —
     // they are not orphaned.
-    if (pendingInteractions.get(req.id)) continue;
+    if (pendingInteractions.get(req.id)) {
+      continue;
+    }
 
-    resolveCanonicalGuardianRequest(req.id, "pending", {
-      status: "expired",
-    });
+    try {
+      await expireGuardianRequest(req.id);
+    } catch (err) {
+      log.warn(
+        { err, requestId: req.id, conversationId },
+        "Orphaned guardian request expiry skipped — gateway unreachable",
+      );
+    }
   }
 }
 
-async function tryConsumeCanonicalGuardianReply(params: {
+async function tryConsumeGuardianReply(params: {
   conversationId: string;
   sourceChannel: string;
   sourceInterface: string;
@@ -492,15 +519,15 @@ async function tryConsumeCanonicalGuardianReply(params: {
     return { consumed: false };
   }
 
-  const pendingRequestHintIds = collectCanonicalGuardianRequestHintIds(
+  const pendingRequestHintIds = await collectGuardianRequestHintIds(
     conversationId,
     sourceChannel,
     conversation,
   );
   // An empty hint set is `blocked`, not absence: the in-memory staleness
-  // filter in collectCanonicalGuardianRequestHintIds found no live requests,
-  // so the router must not fall back to identity/DB lookup (which rediscovered
-  // stale canonical requests). A non-empty set scopes resolution to it.
+  // filter in collectGuardianRequestHintIds found no live requests, so the
+  // router must not fall back to identity/DB lookup (which rediscovered
+  // stale guardian requests). A non-empty set scopes resolution to it.
   const pendingScope: GuardianPendingScope =
     pendingRequestHintIds.length > 0
       ? { mode: "scoped", requestIds: pendingRequestHintIds }
@@ -622,7 +649,9 @@ function buildQueuedMessagePayloads(
   conversationId: string,
 ): RuntimeMessagePayload[] {
   const conversation = findConversation(conversationId);
-  if (!conversation) return [];
+  if (!conversation) {
+    return [];
+  }
 
   // Hidden sends are suppressed from the transcript at every stage — echo,
   // persisted row, and here the in-memory queue window: a latest-page fetch
@@ -648,7 +677,9 @@ function buildQueuedMessagePayloads(
       );
 
       const contentBlocks: ConversationContentBlock[] = [];
-      if (text.length > 0) contentBlocks.push({ type: "text", text });
+      if (text.length > 0) {
+        contentBlocks.push({ type: "text", text });
+      }
       for (const attachment of attachments) {
         contentBlocks.push({ type: "attachment", attachment });
       }
@@ -823,12 +854,7 @@ export function handleListMessages({
   // alignment, letting renderHistoryContent inline `attachment` blocks during
   // its single content walk.
   const parsed = consolidatedMessages.map((msg) => {
-    let content: unknown;
-    try {
-      content = JSON.parse(msg.content);
-    } catch {
-      content = msg.content;
-    }
+    const content: unknown = msg.content;
 
     // Extract sentAt from metadata for display timestamps. When a message
     // was queued or its persistence was delayed (long assistant generation),
@@ -849,7 +875,9 @@ export function handleListMessages({
     if (msg.metadata) {
       try {
         const meta = JSON.parse(msg.metadata);
-        if (typeof meta.sentAt === "number") sentAt = meta.sentAt;
+        if (typeof meta.sentAt === "number") {
+          sentAt = meta.sentAt;
+        }
         // Every wake persists a `<background_event source="...">` trigger row
         // (see `persistWakeTriggerMessage`) that the LLM reads. Flag any such
         // row so clients hide it from the transcript like a subagent/ACP
@@ -1040,7 +1068,9 @@ export function handleListMessages({
       contentOrder = rendered.contentOrder
         .map((entry) => {
           const tm = entry.match(/^text:(\d+)$/);
-          if (!tm) return entry;
+          if (!tm) {
+            return entry;
+          }
           const newIdx = indexMap.get(Number(tm[1]));
           return newIdx !== undefined ? `text:${newIdx}` : undefined;
         })
@@ -1681,7 +1711,9 @@ export async function handleSendMessage(
           guardianPrincipalId,
           sourceChannel,
         );
-        if (healed) trustCtx = healed;
+        if (healed) {
+          trustCtx = healed;
+        }
       }
       conversation.setTrustContext(trustCtx);
     } else {
@@ -1888,7 +1920,6 @@ export async function handleSendMessage(
             tone: body.onboarding!.tone,
             googleConnected: body.onboarding!.googleConnected,
             googleScopes: body.onboarding!.googleScopes,
-            priorAssistants: body.onboarding!.priorAssistants,
           });
         } catch (err) {
           log.warn({ err }, "Failed to record onboarding telemetry event");
@@ -1951,7 +1982,6 @@ export async function handleSendMessage(
         tone: body.onboarding!.tone,
         googleConnected: body.onboarding!.googleConnected,
         googleScopes: body.onboarding!.googleScopes,
-        priorAssistants: body.onboarding!.priorAssistants,
       });
     } catch (err) {
       log.warn({ err }, "Failed to record onboarding telemetry event");
@@ -1974,11 +2004,11 @@ export async function handleSendMessage(
   const verifiedActorPrincipalId =
     conversation.trustContext?.guardianPrincipalId ?? undefined;
 
-  // Try to consume the message as a canonical guardian approval/rejection reply.
+  // Try to consume the message as a guardian approval/rejection reply.
   // On failure, degrade to the existing queue/auto-deny path rather than
   // surfacing a 500 — mirrors the handler's catch-and-fallback.
   try {
-    const inlineReplyResult = await tryConsumeCanonicalGuardianReply({
+    const inlineReplyResult = await tryConsumeGuardianReply({
       conversationId: mapping.conversationId,
       sourceChannel,
       sourceInterface,
@@ -2066,7 +2096,7 @@ export async function handleSendMessage(
     if (body.hidden !== true) {
       try {
         // Supersede interactions left pending by the in-flight turn: auto-deny
-        // confirmations (with canonical/client sync) and steer to the enqueued
+        // confirmations (with gateway/client sync) and steer to the enqueued
         // message if an ask_question is parked. Centralized so the CLI signal
         // path (signals/user-message.ts) gets identical handling.
         supersedePendingInteractionsOnEnqueue(
@@ -2074,9 +2104,9 @@ export async function handleSendMessage(
           requestId,
         );
 
-        // Expire any orphaned canonical requests that survived without a
+        // Expire any orphaned guardian requests that survived without a
         // matching in-memory pending interaction (e.g. prompter timeouts).
-        expireOrphanedCanonicalRequests(mapping.conversationId);
+        await expireOrphanedGuardianRequests(mapping.conversationId);
       } catch (err) {
         log.warn(
           { err, conversationId: mapping.conversationId },
@@ -2113,10 +2143,19 @@ export async function handleSendMessage(
           state: "denied" as const,
           source: "auto_deny" as const,
         });
-        // Sync canonical guardian request status so stale "pending" DB
-        // records don't get matched by later guardian reply routing.
-        resolveCanonicalGuardianRequest(interaction.requestId, "pending", {
+        // Sync the gateway request status so stale "pending" records don't
+        // get matched by later guardian reply routing. Fire-and-forget: the
+        // in-memory denial is authoritative here; a CAS miss (already
+        // decided elsewhere) or a lost sync is reaped by the orphan sweep.
+        void decideGuardianRequest({
+          id: interaction.requestId,
+          expectedStatus: "pending",
           status: "denied",
+        }).catch((err) => {
+          log.warn(
+            { err, requestId: interaction.requestId },
+            "Auto-deny guardian request status sync failed",
+          );
         });
       }
     }
@@ -2124,9 +2163,9 @@ export async function handleSendMessage(
     pendingInteractions.removeByConversation(mapping.conversationId);
   }
 
-  // Expire any orphaned canonical requests that survived without a
+  // Expire any orphaned guardian requests that survived without a
   // matching in-memory pending interaction (e.g. prompter timeouts).
-  expireOrphanedCanonicalRequests(mapping.conversationId);
+  await expireOrphanedGuardianRequests(mapping.conversationId);
 
   // Conversation is idle — persist and fire agent loop immediately
   conversation.setTurnChannelContext({
@@ -2626,10 +2665,14 @@ export async function handleGetSuggestion(
       resolvedConversationId = conversationKey;
     }
   }
-  if (!resolvedConversationId) return noSuggestion;
+  if (!resolvedConversationId) {
+    return noSuggestion;
+  }
 
   const rawMessages = getMessages(resolvedConversationId);
-  if (rawMessages.length === 0) return noSuggestion;
+  if (rawMessages.length === 0) {
+    return noSuggestion;
+  }
 
   // Staleness check: compare requested messageId against the latest
   // assistant message BEFORE filtering by text content.  This ensures
@@ -2653,17 +2696,16 @@ export async function handleGetSuggestion(
   // Walk backwards to find the last assistant message with text content
   for (let i = rawMessages.length - 1; i >= 0; i--) {
     const msg = rawMessages[i];
-    if (msg.role !== "assistant") continue;
-
-    let content: unknown;
-    try {
-      content = JSON.parse(msg.content);
-    } catch {
-      content = msg.content;
+    if (msg.role !== "assistant") {
+      continue;
     }
+
+    const content: unknown = msg.content;
     const rendered = renderHistoryContent(content);
     const text = rendered.text.trim();
-    if (!text) continue;
+    if (!text) {
+      continue;
+    }
 
     // If a messageId was requested and the first text-bearing assistant
     // message is a *different* message, the request is stale.
@@ -2682,13 +2724,10 @@ export async function handleGetSuggestion(
     // to guess which role it's generating for.
     let priorUserText: string | null = null;
     for (let j = i - 1; j >= 0; j--) {
-      if (rawMessages[j].role !== "user") continue;
-      let userContent: unknown;
-      try {
-        userContent = JSON.parse(rawMessages[j].content);
-      } catch {
-        userContent = rawMessages[j].content;
+      if (rawMessages[j].role !== "user") {
+        continue;
       }
+      const userContent: unknown = rawMessages[j].content;
       const userText = renderHistoryContent(userContent).text.trim();
       if (userText) {
         priorUserText = userText;

package/src/runtime/routes/credential-routes.ts

@@ -16,10 +16,13 @@
 
 import { z } from "zod";
 
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
+import { getConfig } from "../../config/loader.js";
 import {
   fetchManagedCatalog,
   type ManagedCredentialDescriptor,
 } from "../../credential-execution/managed-catalog.js";
+import { buildForChatSentinel } from "../../daemon/chat-credential-redaction.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import {
   disconnectOAuthProvider,
@@ -48,6 +51,8 @@ import {
 } from "../../tools/credentials/metadata-store.js";
 import type { CredentialInjectionTemplate } from "../../tools/credentials/policy-types.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { recordForChatMint } from "../for-chat-mint-registry.js";
+import { recordRevealSuccess } from "../reveal-success-registry.js";
 import { InjectionTemplateSchema } from "./credential-prompt-routes.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -296,11 +301,30 @@ async function handleCredentialsInspect({ body }: RouteHandlerArgs) {
   return output;
 }
 
-async function handleCredentialsReveal({ body }: RouteHandlerArgs) {
+async function handleCredentialsReveal({ body, headers }: RouteHandlerArgs) {
   if (!body || typeof body !== "object") {
     throw new BadRequestError("Request body is required");
   }
 
+  const forChat = (body as { forChat?: unknown }).forChat === true;
+  if (
+    forChat &&
+    !isAssistantFeatureFlagEnabled("chat-credential-reveal", getConfig())
+  ) {
+    throw new BadRequestError(
+      "--for-chat requires the chat-credential-reveal feature flag",
+    );
+  }
+
+  // Conversation-bound reveal nonce (see reveal-nonce.ts), forwarded by
+  // the CLI from the tool-shell env. Required for RECORDING any
+  // reveal-derived chat authority below; the reveal itself works without
+  // it (Settings rows, direct terminal use) — those calls just create no
+  // authority for any conversation's transcript.
+  const rawNonce = (body as { revealNonce?: unknown }).revealNonce;
+  const revealNonce =
+    typeof rawNonce === "string" && rawNonce.length > 0 ? rawNonce : undefined;
+
   const lookup = resolveCredentialLookup(body);
   const { value: secret, unreachable } = await getSecureKeyResultAsync(
     lookup.storageKey,
@@ -315,6 +339,79 @@ async function handleCredentialsReveal({ body }: RouteHandlerArgs) {
     throw new BadRequestError("Credential not found");
   }
 
+  // Recording gate shared by both registries below: only a DIRECT tool-shell
+  // CLI invocation may create authority. The `local` principal is the
+  // identity a CLI invocation arrives with over the unix-socket IPC
+  // (verified by the adapters, never caller-supplied), but the principal
+  // check alone is not enough: in local mode the gateway derives `local`
+  // from the verified JWT sub and forwards it for web calls too, stamping
+  // `x-vellum-proxy-server: ipc` — a header a direct CLI never sends — so
+  // proxied Settings-row/chat-chip reveals are excluded.
+  const directLocalInvocation =
+    headers?.["x-vellum-principal-type"] === "local" &&
+    headers?.["x-vellum-proxy-server"] !== "ipc";
+
+  if (forChat) {
+    // Both lookup forms resolve service+field (or throw); the narrow check
+    // keeps the sentinel's vault coordinates provably non-empty.
+    if (!lookup.service || !lookup.field) {
+      throw new BadRequestError(
+        "Credential identity could not be resolved for --for-chat",
+      );
+    }
+    // Chat-safe reveal: return the enriched redaction sentinel instead of
+    // the plaintext. The caller (the model, echoing a tool result) can
+    // paste this into its reply to render a click-to-reveal chip without
+    // the secret ever entering model context or the conversation stream.
+    // The persist-path forgery guard re-mints it on identity match — see
+    // guardForChatSentinels in chat-credential-redaction.ts. No plaintext
+    // reaches the tool, so no reveal-success proof is recorded: that
+    // registry authorizes plaintext-echo swaps, and retaining the secret
+    // for a path that never emits it would widen retention for nothing.
+    const sentinel = buildForChatSentinel({
+      service: lookup.service,
+      field: lookup.field,
+      value: secret,
+    });
+    // Record the mint AFTER the reveal provably succeeded. This registry —
+    // not any parse of the requested shell command — is what authorizes the
+    // persist guard to re-mint a sentinel with this identity: a command
+    // that merely quotes or comments out a reveal invocation never reaches
+    // this route, so it never allowlists anything. Like the plaintext proof
+    // below, the mint records only for a direct tool-shell invocation, and
+    // only with the conversation-bound nonce that scopes it to the
+    // conversation whose tool shell made this call (see the registry
+    // module doc — no predictable identifier can do this job).
+    if (directLocalInvocation && revealNonce !== undefined) {
+      recordForChatMint({
+        service: lookup.service,
+        field: lookup.field,
+        sentinel,
+        nonce: revealNonce,
+      });
+    }
+    return { value: sentinel };
+  }
+
+  // Ground truth for the chat-credential-reveal persist seams: this route
+  // is the only place a reveal legitimately reads plaintext, so a success
+  // recorded here is the proof the agent loop requires before promoting
+  // staged reveal candidates (a shell command can "succeed" without ever
+  // reaching this handler — `… || true`, or an echo of the command text).
+  // Recording a proxied UI reveal would let a click promote a staged ref
+  // in a concurrent turn whose command merely echoed (or was denied) the
+  // invocation. An unproven ref degrades to a plain sentinel — the safe
+  // direction. Both lookup branches populate service/field; the guard only
+  // satisfies the loose `CredentialLookup` type.
+  if (
+    directLocalInvocation &&
+    revealNonce !== undefined &&
+    lookup.service !== undefined &&
+    lookup.field !== undefined
+  ) {
+    recordRevealSuccess(lookup.service, lookup.field, secret, revealNonce);
+  }
+
   return { value: secret };
 }
 
@@ -523,15 +620,31 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Reveal a credential's plaintext value",
     description:
-      "Return the raw plaintext value of a stored credential. Blocked in untrusted shell mode.",
+      "Return the raw plaintext value of a stored credential. Blocked in untrusted shell mode. With forChat, returns a chat-safe redaction sentinel instead of the plaintext.",
     tags: ["credentials"],
     requestBody: z.object({
       service: z.string().optional().describe("Service namespace"),
       field: z.string().optional().describe("Field name"),
       id: z.string().optional().describe("Credential UUID for lookup by ID"),
+      forChat: z
+        .boolean()
+        .optional()
+        .describe(
+          "Return the credential's redaction sentinel (renders as a click-to-reveal chip in chat) instead of the plaintext. Requires the chat-credential-reveal feature flag.",
+        ),
+      revealNonce: z
+        .string()
+        .optional()
+        .describe(
+          "Conversation-bound reveal nonce from the tool-shell environment. Scopes any recorded chat-redaction authority (plaintext proof or forChat mint) to the conversation whose tool executed this reveal; without it the reveal succeeds but records no authority.",
+        ),
     }),
     responseBody: z.object({
-      value: z.string().describe("The plaintext credential value"),
+      value: z
+        .string()
+        .describe(
+          "The plaintext credential value (or its redaction sentinel when forChat is set)",
+        ),
     }),
     handler: handleCredentialsReveal,
   },

package/src/runtime/routes/email-routes.ts

@@ -240,13 +240,18 @@ async function handleEmailDownload({ queryParams = {} }: RouteHandlerArgs) {
 }
 
 async function handleEmailSend({ body = {} }: RouteHandlerArgs) {
-  const { to, text, subject, html, cc, bcc, reply_to } = body as {
+  const { to, text, subject, html, cc, bcc, attachments, reply_to } = body as {
     to: string[];
     text: string;
     subject?: string;
     html?: string;
     cc?: string[];
     bcc?: string[];
+    attachments?: {
+      filename: string;
+      content_type: string;
+      content: string;
+    }[];
     reply_to?: string;
   };
 
@@ -293,6 +298,7 @@ async function handleEmailSend({ body = {} }: RouteHandlerArgs) {
   if (resolvedHtml) payload.html = resolvedHtml;
   if (cc && cc.length > 0) payload.cc = cc;
   if (bcc && bcc.length > 0) payload.bcc = bcc;
+  if (attachments && attachments.length > 0) payload.attachments = attachments;
   if (reply_to) payload.reply_to = reply_to;
 
   const response = await client.fetch("/v1/runtime-proxy/email/send/", {
@@ -567,6 +573,16 @@ export const ROUTES: RouteDefinition[] = [
         .describe("HTML body (auto-generated from text if omitted)"),
       cc: z.array(z.string()).optional().describe("CC recipients"),
       bcc: z.array(z.string()).optional().describe("BCC recipients"),
+      attachments: z
+        .array(
+          z.object({
+            filename: z.string(),
+            content_type: z.string(),
+            content: z.string().describe("Base64-encoded file content"),
+          }),
+        )
+        .optional()
+        .describe("File attachments"),
       reply_to: z.string().optional().describe("Reply-to email ID"),
     }),
     responseBody: z.object({

package/src/runtime/routes/events-routes.ts

@@ -58,6 +58,7 @@ const ALL_CAPABILITIES: HostProxyCapability[] = [
   "host_cu",
   "host_app_control",
   "host_browser",
+  "host_ui_snapshot",
 ];
 
 /**