@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/Dockerfile

@@ -22,9 +22,7 @@ ENV PATH="/root/.bun/bin:${PATH}"
 # Note that we don't need source code to resolve cross-workspace dependencies.
 COPY package.json bun.lock ./
 COPY patches ./patches
-COPY clients/docs/package.json ./clients/docs/
-COPY clients/macos/package.json ./clients/macos/
-COPY clients/web/package.json ./clients/web/
+COPY --parents clients/*/package.json ./
 COPY cli/package.json ./cli/
 COPY gateway/package.json ./gateway/
 COPY credential-executor/package.json ./credential-executor/

package/README.md

@@ -28,7 +28,7 @@ For assistant architecture deep dives, see [`ARCHITECTURE.md`](ARCHITECTURE.md)
 
 ```bash
 cd assistant
-bun install
+bun install   # installs the whole workspace
 cp .env.example .env
 # Edit .env with your API keys
 ```

package/eslint.config.mjs

@@ -49,14 +49,29 @@ const eslintConfig = defineConfig([
       "@typescript-eslint/no-explicit-any": "off",
     },
   },
-  // Managed-column profile resolution (`getEffectiveProfile(s)`) resolves
-  // default profiles against the vellum column only, ignoring
-  // `llm.defaultProvider`; on a BYO install that is not the body that
-  // dispatches. Runtime code must use `resolveDefaultProfileForProvider` /
-  // `getEffectiveProfilesForProvider` instead. The allowlist below is the
-  // full set of intentional managed-column consumers: the catalog itself,
-  // hatch-time seeding (writes managed stubs by design), and write-path
-  // validation.
+  // Two unrelated import bans share one `no-restricted-imports` entry on
+  // purpose: flat config replaces rule options rather than merging them, so a
+  // second block setting the same rule over overlapping files would silently
+  // drop the first one's patterns.
+  //
+  // 1. Managed-column profile resolution (`getEffectiveProfile(s)`) resolves
+  //    default profiles against the vellum column only, ignoring
+  //    `llm.defaultProvider`; on a BYO install that is not the body that
+  //    dispatches. Runtime code must use `resolveDefaultProfileForProvider` /
+  //    `getEffectiveProfilesForProvider` instead. The allowlist below is the
+  //    full set of intentional managed-column consumers: the catalog itself,
+  //    hatch-time seeding (writes managed stubs by design), and write-path
+  //    validation.
+  //
+  // 2. `cli/logger` is the plain-stdout writer for short-lived `assistant …`
+  //    invocations. It has no level filtering and no log-file routing, so a
+  //    daemon-side module reaching for it writes debug output straight to a
+  //    stdout the daemon may not own. Daemon code uses `getLogger()` from
+  //    `util/logger.js`. The pattern matches on the import specifier, so
+  //    CLI-internal files (which reach their logger relatively, as
+  //    `../logger.js`) are unaffected. The companion guard test
+  //    `src/__tests__/cli-logger-boundary-guard.test.ts` enforces the same
+  //    boundary by resolved path, independent of how a specifier is spelled.
   {
     files: ["src/**/*.ts"],
     ignores: [
@@ -77,6 +92,11 @@ const eslintConfig = defineConfig([
               message:
                 "Managed-column resolution ignores llm.defaultProvider. Use resolveDefaultProfileForProvider / getEffectiveProfilesForProvider with the parsed config's llm.defaultProvider ?? null.",
             },
+            {
+              group: ["**/cli/logger.js"],
+              message:
+                "cli/logger writes unfiltered plain text to stdout and is for src/cli/ only. Daemon and shared modules must use getLogger() from util/logger.js so output is level-filtered and routed to the log file. Within src/cli/, import the logger relatively (../logger.js).",
+            },
           ],
         },
       ],

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/package.json

@@ -19,6 +19,7 @@
     "./attachment-naming": "./src/attachment-naming.ts",
     "./redacted-credential": "./src/redacted-credential.ts",
     "./secret-detection": "./src/secret-detection.ts",
+    "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/stripe-currency.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  STRIPE_THREE_DECIMAL_CURRENCIES,
+  STRIPE_ZERO_DECIMAL_CURRENCIES,
+  stripeScaleDigits,
+} from "../stripe-currency.js";
+
+describe("stripeScaleDigits", () => {
+  test("zero-decimal currencies scale to 0 digits", () => {
+    expect(stripeScaleDigits("JPY")).toBe(0);
+    expect(stripeScaleDigits("KRW")).toBe(0);
+  });
+
+  test("three-decimal currencies scale to 3 digits", () => {
+    expect(stripeScaleDigits("BHD")).toBe(3);
+    expect(stripeScaleDigits("KWD")).toBe(3);
+  });
+
+  test("everything else scales to 2 digits", () => {
+    expect(stripeScaleDigits("USD")).toBe(2);
+    expect(stripeScaleDigits("EUR")).toBe(2);
+    expect(stripeScaleDigits("XYZ")).toBe(2);
+  });
+
+  test("Stripe's charge-side two-decimal special cases stay at 2 digits", () => {
+    for (const code of ["ISK", "HUF", "TWD", "UGX"]) {
+      expect(stripeScaleDigits(code)).toBe(2);
+    }
+  });
+
+  test("the currency sets do not overlap", () => {
+    for (const code of STRIPE_ZERO_DECIMAL_CURRENCIES) {
+      expect(STRIPE_THREE_DECIMAL_CURRENCIES.has(code)).toBe(false);
+    }
+  });
+});

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/stripe-currency.ts

@@ -0,0 +1,55 @@
+/**
+ * Stripe amount scaling rules for charges and invoices.
+ *
+ * These sets follow Stripe's amount scaling rules
+ * (https://docs.stripe.com/currencies), not ISO 4217 metadata: divide the
+ * minor-unit integer by 100 for most currencies, by 1 for the zero-decimal
+ * set (e.g. JPY, KRW), and by 1000 for the three-decimal set (e.g. BHD).
+ * ISK, HUF, TWD, and UGX are deliberately absent from the zero-decimal set:
+ * Stripe charges and invoices them as two-decimal amounts and treats them
+ * as zero-decimal only for payouts, per Stripe's currency docs.
+ *
+ * Only the scaling data and digit selection live here; presentation (locale,
+ * symbol vs code display, fallbacks for unknown codes) belongs to each
+ * consumer.
+ */
+export const STRIPE_ZERO_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF",
+]);
+
+export const STRIPE_THREE_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BHD",
+  "JOD",
+  "KWD",
+  "OMR",
+  "TND",
+]);
+
+/**
+ * Fraction digits Stripe uses when charging or invoicing in the given
+ * currency. Expects an uppercase ISO 4217 code; unknown codes get the
+ * two-decimal default.
+ */
+export function stripeScaleDigits(currencyCode: string): number {
+  if (STRIPE_ZERO_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 0;
+  }
+  if (STRIPE_THREE_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 3;
+  }
+  return 2;
+}

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/package.json

@@ -19,6 +19,7 @@
     "./attachment-naming": "./src/attachment-naming.ts",
     "./redacted-credential": "./src/redacted-credential.ts",
     "./secret-detection": "./src/secret-detection.ts",
+    "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/stripe-currency.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  STRIPE_THREE_DECIMAL_CURRENCIES,
+  STRIPE_ZERO_DECIMAL_CURRENCIES,
+  stripeScaleDigits,
+} from "../stripe-currency.js";
+
+describe("stripeScaleDigits", () => {
+  test("zero-decimal currencies scale to 0 digits", () => {
+    expect(stripeScaleDigits("JPY")).toBe(0);
+    expect(stripeScaleDigits("KRW")).toBe(0);
+  });
+
+  test("three-decimal currencies scale to 3 digits", () => {
+    expect(stripeScaleDigits("BHD")).toBe(3);
+    expect(stripeScaleDigits("KWD")).toBe(3);
+  });
+
+  test("everything else scales to 2 digits", () => {
+    expect(stripeScaleDigits("USD")).toBe(2);
+    expect(stripeScaleDigits("EUR")).toBe(2);
+    expect(stripeScaleDigits("XYZ")).toBe(2);
+  });
+
+  test("Stripe's charge-side two-decimal special cases stay at 2 digits", () => {
+    for (const code of ["ISK", "HUF", "TWD", "UGX"]) {
+      expect(stripeScaleDigits(code)).toBe(2);
+    }
+  });
+
+  test("the currency sets do not overlap", () => {
+    for (const code of STRIPE_ZERO_DECIMAL_CURRENCIES) {
+      expect(STRIPE_THREE_DECIMAL_CURRENCIES.has(code)).toBe(false);
+    }
+  });
+});

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/stripe-currency.ts

@@ -0,0 +1,55 @@
+/**
+ * Stripe amount scaling rules for charges and invoices.
+ *
+ * These sets follow Stripe's amount scaling rules
+ * (https://docs.stripe.com/currencies), not ISO 4217 metadata: divide the
+ * minor-unit integer by 100 for most currencies, by 1 for the zero-decimal
+ * set (e.g. JPY, KRW), and by 1000 for the three-decimal set (e.g. BHD).
+ * ISK, HUF, TWD, and UGX are deliberately absent from the zero-decimal set:
+ * Stripe charges and invoices them as two-decimal amounts and treats them
+ * as zero-decimal only for payouts, per Stripe's currency docs.
+ *
+ * Only the scaling data and digit selection live here; presentation (locale,
+ * symbol vs code display, fallbacks for unknown codes) belongs to each
+ * consumer.
+ */
+export const STRIPE_ZERO_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF",
+]);
+
+export const STRIPE_THREE_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BHD",
+  "JOD",
+  "KWD",
+  "OMR",
+  "TND",
+]);
+
+/**
+ * Fraction digits Stripe uses when charging or invoicing in the given
+ * currency. Expects an uppercase ISO 4217 code; unknown codes get the
+ * two-decimal default.
+ */
+export function stripeScaleDigits(currencyCode: string): number {
+  if (STRIPE_ZERO_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 0;
+  }
+  if (STRIPE_THREE_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 3;
+  }
+  return 2;
+}

package/node_modules/@vellumai/service-contracts/package.json

@@ -19,6 +19,7 @@
     "./attachment-naming": "./src/attachment-naming.ts",
     "./redacted-credential": "./src/redacted-credential.ts",
     "./secret-detection": "./src/secret-detection.ts",
+    "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/service-contracts/src/__tests__/stripe-currency.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  STRIPE_THREE_DECIMAL_CURRENCIES,
+  STRIPE_ZERO_DECIMAL_CURRENCIES,
+  stripeScaleDigits,
+} from "../stripe-currency.js";
+
+describe("stripeScaleDigits", () => {
+  test("zero-decimal currencies scale to 0 digits", () => {
+    expect(stripeScaleDigits("JPY")).toBe(0);
+    expect(stripeScaleDigits("KRW")).toBe(0);
+  });
+
+  test("three-decimal currencies scale to 3 digits", () => {
+    expect(stripeScaleDigits("BHD")).toBe(3);
+    expect(stripeScaleDigits("KWD")).toBe(3);
+  });
+
+  test("everything else scales to 2 digits", () => {
+    expect(stripeScaleDigits("USD")).toBe(2);
+    expect(stripeScaleDigits("EUR")).toBe(2);
+    expect(stripeScaleDigits("XYZ")).toBe(2);
+  });
+
+  test("Stripe's charge-side two-decimal special cases stay at 2 digits", () => {
+    for (const code of ["ISK", "HUF", "TWD", "UGX"]) {
+      expect(stripeScaleDigits(code)).toBe(2);
+    }
+  });
+
+  test("the currency sets do not overlap", () => {
+    for (const code of STRIPE_ZERO_DECIMAL_CURRENCIES) {
+      expect(STRIPE_THREE_DECIMAL_CURRENCIES.has(code)).toBe(false);
+    }
+  });
+});

package/node_modules/@vellumai/service-contracts/src/stripe-currency.ts

@@ -0,0 +1,55 @@
+/**
+ * Stripe amount scaling rules for charges and invoices.
+ *
+ * These sets follow Stripe's amount scaling rules
+ * (https://docs.stripe.com/currencies), not ISO 4217 metadata: divide the
+ * minor-unit integer by 100 for most currencies, by 1 for the zero-decimal
+ * set (e.g. JPY, KRW), and by 1000 for the three-decimal set (e.g. BHD).
+ * ISK, HUF, TWD, and UGX are deliberately absent from the zero-decimal set:
+ * Stripe charges and invoices them as two-decimal amounts and treats them
+ * as zero-decimal only for payouts, per Stripe's currency docs.
+ *
+ * Only the scaling data and digit selection live here; presentation (locale,
+ * symbol vs code display, fallbacks for unknown codes) belongs to each
+ * consumer.
+ */
+export const STRIPE_ZERO_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF",
+]);
+
+export const STRIPE_THREE_DECIMAL_CURRENCIES: ReadonlySet<string> = new Set([
+  "BHD",
+  "JOD",
+  "KWD",
+  "OMR",
+  "TND",
+]);
+
+/**
+ * Fraction digits Stripe uses when charging or invoicing in the given
+ * currency. Expects an uppercase ISO 4217 code; unknown codes get the
+ * two-decimal default.
+ */
+export function stripeScaleDigits(currencyCode: string): number {
+  if (STRIPE_ZERO_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 0;
+  }
+  if (STRIPE_THREE_DECIMAL_CURRENCIES.has(currencyCode)) {
+    return 3;
+  }
+  return 2;
+}

package/node_modules/@vellumai/slack-text/src/index.test.ts

@@ -14,6 +14,36 @@ describe("extractSlackUserMentionIds", () => {
       extractSlackUserMentionIds("<@U123> hi <@W456> and <@U123> again"),
     ).toEqual(["U123", "W456"]);
   });
+
+  test("includes pipe-form user mention IDs", () => {
+    expect(extractSlackUserMentionIds("<@U123|jane> and <@W456|>")).toEqual([
+      "U123",
+      "W456",
+    ]);
+  });
+});
+
+describe("buildSlackUserLabelMap", () => {
+  test("skips pipe-form mentions with usable embedded labels, queues the rest", async () => {
+    const requested: string[] = [];
+    const labels = await buildSlackUserLabelMap(
+      ["<@U123|jane> <@U456|> <@U789|U789> <@U999>"],
+      async (id) => {
+        requested.push(id);
+        return `name-${id}`;
+      },
+    );
+
+    // Usable embedded label: rendered from the token, no lookup.
+    expect(requested).not.toContain("U123");
+    // Empty or ID-shaped embedded labels still need resolution.
+    expect(requested.sort()).toEqual(["U456", "U789", "U999"]);
+    expect(labels).toEqual({
+      U456: "name-U456",
+      U789: "name-U789",
+      U999: "name-U999",
+    });
+  });
 });
 
 describe("extractSlackChannelReferenceIds", () => {
@@ -52,6 +82,24 @@ describe("renderSlackTextForModel", () => {
     ).toBe("hello @unknown-user");
   });
 
+  test("prefers embedded pipe-form user labels over lookups", () => {
+    expect(renderSlackTextForModel("hi <@U123|jane>")).toBe("hi @jane");
+    expect(
+      renderSlackTextForModel("hi <@U123|jane>", {
+        userLabels: { U123: "Jane Doe" },
+      }),
+    ).toBe("hi @jane");
+  });
+
+  test("falls back past ID-shaped embedded user labels to resolved ones", () => {
+    expect(
+      renderSlackTextForModel("hi <@U123|U123>", {
+        userLabels: { U123: "Jane Doe" },
+      }),
+    ).toBe("hi @Jane Doe");
+    expect(renderSlackTextForModel("hi <@U123|U123>")).toBe("hi @unknown-user");
+  });
+
   test("renders channel references with labels and fallbacks", () => {
     expect(
       renderSlackTextForModel("<#C123|general> <#C456>", {

package/node_modules/@vellumai/slack-text/src/index.ts

@@ -5,7 +5,7 @@ export interface RenderSlackTextOptions {
   channelFallbackLabel?: string;
 }
 
-const SLACK_USER_MENTION_RE = /<@([UW][A-Z0-9]+)>/g;
+const SLACK_USER_MENTION_RE = /<@([UW][A-Z0-9]+)(?:\|[^>]*)?>/g;
 const SLACK_CHANNEL_REFERENCE_RE = /<#([CDG][A-Z0-9]+)(?:\|[^>]*)?>/g;
 
 export function extractSlackUserMentionIds(text: string): string[] {
@@ -107,7 +107,14 @@ export async function buildSlackUserLabelMap(
 
   for (const text of texts) {
     if (!text) continue;
-    for (const id of extractSlackUserMentionIds(text)) {
+    for (const match of text.matchAll(SLACK_USER_MENTION_RE)) {
+      const id = match[1];
+      // A pipe-form mention carrying a usable embedded label renders from
+      // that label directly; only queue a lookup when the label is missing,
+      // empty, or ID-shaped. Mirrors the channel builder below.
+      const [, embeddedLabel] = splitSlackLabel(match[0].slice(1, -1));
+      const sanitizedEmbeddedLabel = sanitizeOptionalLabel(embeddedLabel);
+      if (sanitizedEmbeddedLabel && sanitizedEmbeddedLabel !== id) continue;
       if (seen.has(id)) continue;
       seen.add(id);
       ids.push(id);
@@ -175,17 +182,29 @@ function renderUserMention(
   content: string,
   options: RenderSlackTextOptions,
 ): string {
-  const id = content.slice(1);
+  const [idWithPrefix, label] = splitSlackLabel(content);
+  const id = idWithPrefix.slice(1);
   if (!isSlackUserId(id)) {
     return `<${content}>`;
   }
 
+  // Slack's legacy pipe form (`<@U123|username>`) carries its own label:
+  // prefer it over a lookup, mirroring renderChannelReference. The embedded
+  // label is Slack-sourced (part of the token), so entities decode before
+  // sanitization; the caller-resolved label below is not.
+  const embeddedLabel = sanitizeOptionalLabel(
+    label === undefined ? undefined : decodeSlackHtmlEntities(label),
+  );
+  if (embeddedLabel && embeddedLabel !== id) {
+    return `@${embeddedLabel}`;
+  }
+
   const fallback = sanitizeLabel(options.userFallbackLabel, "unknown-user");
-  const label = sanitizeLabel(options.userLabels?.[id], fallback);
-  if (label === id) {
+  const resolvedLabel = sanitizeLabel(options.userLabels?.[id], fallback);
+  if (resolvedLabel === id) {
     return `@${fallback}`;
   }
-  return `@${label}`;
+  return `@${resolvedLabel}`;
 }
 
 function renderChannelReference(