@vellumai/assistant 0.11.2 → 0.11.3-staging.1

package/src/oauth/manual-token-connection.ts

@@ -12,6 +12,10 @@ import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyResultAsync } from "../security/secure-keys.js";
 import { getTelegramBotUsername } from "../telegram/bot-username.js";
 import { getLogger } from "../util/logger.js";
+import {
+  MANUAL_TOKEN_PROVIDERS,
+  manualTokenProvider,
+} from "./manual-token-providers.js";
 import {
   createConnection,
   deleteConnection,
@@ -135,69 +139,30 @@ export async function syncManualTokenConnection(
     resolvedAccountInfo,
   );
 
-  switch (provider) {
-    case "telegram": {
-      const botTokenResult = await getSecureKeyResultAsync(
-        credentialKey("telegram", "bot_token"),
-      );
-      const webhookSecretResult = await getSecureKeyResultAsync(
-        credentialKey("telegram", "webhook_secret"),
-      );
-      if (botTokenResult.unreachable || webhookSecretResult.unreachable) {
-        log.warn(
-          "Skipping telegram manual-token reconciliation — credential backend unreachable",
-        );
-        return;
-      }
-      if (botTokenResult.value && webhookSecretResult.value) {
-        await ensureManualTokenConnection(provider, accountInfoToStore);
-      } else {
-        removeManualTokenConnection(provider);
-      }
-      return;
-    }
-
-    case "slack_channel": {
-      const botTokenResult = await getSecureKeyResultAsync(
-        credentialKey("slack_channel", "bot_token"),
-      );
-      const appTokenResult = await getSecureKeyResultAsync(
-        credentialKey("slack_channel", "app_token"),
-      );
-      if (botTokenResult.unreachable || appTokenResult.unreachable) {
-        log.warn(
-          "Skipping slack_channel manual-token reconciliation — credential backend unreachable",
-        );
-        return;
-      }
-      if (botTokenResult.value && appTokenResult.value) {
-        await ensureManualTokenConnection(provider, accountInfoToStore);
-      } else {
-        removeManualTokenConnection(provider);
-      }
-      return;
-    }
+  const spec = manualTokenProvider(provider);
+  if (!spec) {
+    return;
+  }
 
-    case "sanity": {
-      const tokenResult = await getSecureKeyResultAsync(
-        credentialKey("sanity", "api_token"),
-      );
-      if (tokenResult.unreachable) {
-        log.warn(
-          "Skipping sanity manual-token reconciliation — credential backend unreachable",
-        );
-        return;
-      }
-      if (tokenResult.value) {
-        await ensureManualTokenConnection(provider, accountInfoToStore);
-      } else {
-        removeManualTokenConnection(provider);
-      }
-      return;
-    }
+  // Every field must be present and readable. An unreachable backend is not
+  // evidence a credential was removed, so the row is left as it stands rather
+  // than being read as a disconnection.
+  const results = await Promise.all(
+    spec.fields.map((field) =>
+      getSecureKeyResultAsync(credentialKey(provider, field)),
+    ),
+  );
+  if (results.some((r) => r.unreachable)) {
+    log.warn(
+      `Skipping ${provider} manual-token reconciliation: credential backend unreachable`,
+    );
+    return;
+  }
 
-    default:
-      return;
+  if (results.every((r) => r.value)) {
+    await ensureManualTokenConnection(provider, accountInfoToStore);
+  } else {
+    removeManualTokenConnection(provider);
   }
 }
 
@@ -214,7 +179,7 @@ export async function syncManualTokenConnection(
  * connection row.
  */
 export async function backfillManualTokenConnections(): Promise<void> {
-  await syncManualTokenConnection("telegram");
-  await syncManualTokenConnection("slack_channel");
-  await syncManualTokenConnection("sanity");
+  for (const provider of Object.keys(MANUAL_TOKEN_PROVIDERS)) {
+    await syncManualTokenConnection(provider);
+  }
 }

package/src/oauth/manual-token-providers.ts

@@ -0,0 +1,62 @@
+/**
+ * Providers whose credentials are pasted in rather than granted through a
+ * browser flow, and what each one stores.
+ *
+ * Two questions are answered together because they are the same fact seen from
+ * two sides, and answering them in separate tables lets them drift: which
+ * fields must be present for the provider to count as configured
+ * (reconciliation), and which single field an API request authenticates with
+ * (token resolution). Slack stores an app token and Telegram a webhook secret,
+ * and neither authenticates a request.
+ *
+ * `accessField` is named rather than taken as the first of `fields`, so
+ * reordering that list cannot silently change which secret gets sent.
+ *
+ * Channel bots are keyed off the shared channel contract, so adding a channel
+ * does not mean remembering this file exists. `sanity` is not in that contract
+ * because it is a user's own API token: manual to enter, but not a bot and not
+ * a channel.
+ *
+ * The gateway declares the same field sets for its own reading of these
+ * credentials (`gateway/src/credential-reader.ts`). One declaration serving
+ * both is worth doing and needs the specs hoisted into a shared package.
+ */
+
+import { CHANNEL_BOT_PROVIDER } from "@vellumai/service-contracts/channels";
+
+export interface ManualTokenProviderSpec {
+  /** Every field that must be present for the provider to count as connected. */
+  fields: readonly string[];
+  /** The one field an API request authenticates with. */
+  accessField: string;
+}
+
+export const MANUAL_TOKEN_PROVIDERS: Record<string, ManualTokenProviderSpec> = {
+  [CHANNEL_BOT_PROVIDER.slack]: {
+    fields: ["bot_token", "app_token"],
+    accessField: "bot_token",
+  },
+  [CHANNEL_BOT_PROVIDER.discord]: {
+    fields: ["bot_token"],
+    accessField: "bot_token",
+  },
+  [CHANNEL_BOT_PROVIDER.telegram]: {
+    fields: ["bot_token", "webhook_secret"],
+    accessField: "bot_token",
+  },
+  sanity: { fields: ["api_token"], accessField: "api_token" },
+};
+
+/**
+ * The spec for a provider, or undefined when it is not a manual-token one.
+ *
+ * Own-property lookup so an inherited key (`constructor`, `__proto__`) reads
+ * as absent rather than returning a function.
+ */
+export function manualTokenProvider(
+  provider: string,
+): ManualTokenProviderSpec | undefined {
+  return Object.prototype.hasOwnProperty.call(MANUAL_TOKEN_PROVIDERS, provider)
+    ? MANUAL_TOKEN_PROVIDERS[provider]
+    : undefined;
+}

package/src/oauth/provider-serializer.ts

@@ -18,6 +18,8 @@ import type { OAuthProviderRow } from "./oauth-store.js";
 export type SerializedProvider = ReturnType<typeof serializeProvider> &
   Record<string, unknown>;
 
+import { isChannelBotProvider } from "@vellumai/service-contracts/channels";
+
 /**
  * Lightweight summary projection of an OAuth provider, suitable for API
  * list responses where full detail is not needed. All keys are snake_case
@@ -34,6 +36,16 @@ export interface SerializedProviderSummary {
   supports_managed_mode: boolean;
   managed_service_is_paid: boolean;
   feature_flag: string | null;
+  /**
+   * Which sense of "connected" this provider represents: `assistant` for a bot
+   * credential people reach the assistant through, `user` for a grant letting
+   * it act as the person who authorized it.
+   *
+   * Derived rather than stored, because the provider key does not say: `slack`
+   * and `discord` name the user integration while their bots take a `_channel`
+   * suffix, yet `telegram` is the bot.
+   */
+  acts_as: "user" | "assistant";
 }
 
 /**
@@ -152,5 +164,6 @@ export function serializeProviderSummary(
     supports_managed_mode: !!row.managedServiceConfigKey,
     managed_service_is_paid: !!row.managedServiceIsPaid,
     feature_flag: row.featureFlag ?? null,
+    acts_as: isChannelBotProvider(row.provider) ? "assistant" : "user",
   };
 }

package/src/oauth/seed-providers.ts

@@ -137,6 +137,18 @@ export const PROVIDER_SEED_DATA: Record<
         headerName: "Authorization",
         valuePrefix: "Bearer ",
       },
+      {
+        hostPattern: "tasks.googleapis.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bearer ",
+      },
+      {
+        hostPattern: "calendar.googleapis.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bearer ",
+      },
     ],
     revokeUrl: "https://oauth2.googleapis.com/revoke",
     revokeBodyTemplate: { token: "{access_token}" },
@@ -442,16 +454,15 @@ export const PROVIDER_SEED_DATA: Record<
     pingUrl: "https://discord.com/api/v10/users/@me",
     baseUrl: "https://discord.com/api/v10",
     displayLabel: "Discord",
-    description: "Servers and messages",
+    // Your servers, not their contents. These scopes reach the guild list and
+    // your membership in one; reading messages is not among them. Discord
+    // documents `messages.read` as local RPC only, so requesting it would put
+    // a permission on the consent screen that grants nothing here.
+    description: "Your servers and profile",
     dashboardUrl: "https://discord.com/developers/applications",
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/discord",
-    defaultScopes: [
-      "identify",
-      "guilds",
-      "guilds.members.read",
-      "messages.read",
-    ],
+    defaultScopes: ["identify", "guilds", "guilds.members.read"],
     availableScopes:
       "https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes",
     loopbackPort: 17326,
@@ -714,7 +725,15 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     availableScopes:
       "https://learn.microsoft.com/en-us/graph/permissions-reference",
-    authorizeParams: { prompt: "consent" },
+    // `select_account`, not `consent`: the Microsoft identity platform accepts
+    // a single prompt value, and `consent` honours an existing session cookie —
+    // it re-asks for consent but never for *which* account, so a user who
+    // already signed in cannot connect a second mailbox. `select_account`
+    // always shows the account picker with its "Use another account" option.
+    // Consent is still collected for an account that has not granted it, and
+    // refresh tokens come from the `offline_access` scope above, so nothing is
+    // lost by dropping `consent`.
+    authorizeParams: { prompt: "select_account" },
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17334,
     managedServiceConfigKey: "outlook-oauth",
@@ -757,6 +776,35 @@ export const PROVIDER_SEED_DATA: Record<
     ],
   },
 
+  // The bot that sits in a server and talks to people there, which is a
+  // different thing from the `discord` integration above and starts at the
+  // same Discord authorize URL. Both are reasonably called "connecting
+  // Discord", so each has to be nameable on its own. The bot token is already
+  // stored under this key by `skills/discord-app-setup`; seeding the provider
+  // is what lets the product tell the two apart.
+  discord_channel: {
+    provider: "discord_channel",
+    authorizeUrl: "urn:manual-token",
+    tokenExchangeUrl: "urn:manual-token",
+    pingUrl: "https://discord.com/api/v10/users/@me",
+    baseUrl: "https://discord.com/api/v10",
+    displayLabel: "Discord Server",
+    description: "A bot in your server",
+    dashboardUrl: "https://discord.com/developers/applications",
+    clientIdPlaceholder: null,
+    requiresClientSecret: false,
+    logoUrl: "https://cdn.simpleicons.org/discord",
+    defaultScopes: [],
+    injectionTemplates: [
+      {
+        hostPattern: "discord.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bot ",
+      },
+    ],
+  },
+
   telegram: {
     provider: "telegram",
     authorizeUrl: "urn:manual-token",

package/src/onboarding/onboarding-events-store.ts

@@ -5,10 +5,19 @@ import {
   type ActivationStepName,
   buildActivationDaemonEventId,
 } from "../telemetry/activation-funnel.js";
+import {
+  LIVE_VOICE_FUNNEL_VERSION,
+  LIVE_VOICE_STEPS,
+  type LiveVoiceSessionOutcome,
+  type LiveVoiceStepName,
+} from "../telemetry/live-voice-funnel.js";
 import { recordTelemetryOutboxEvent } from "../telemetry/telemetry-events-outbox.js";
 import type { OnboardingTelemetryEvent } from "../telemetry/types.js";
+import { getLogger } from "../util/logger.js";
 import { APP_VERSION } from "../version.js";
 
+const log = getLogger("onboarding-events-store");
+
 /** Identity of a recorded outbox row; the full payload lives in the outbox. */
 export interface OnboardingEvent {
   id: string;
@@ -28,6 +37,7 @@ export interface RecordOnboardingEventParams {
   stepIndex?: number | null;
   completedAt?: string | null;
   funnelVersion?: string | null;
+  outcome?: string | null;
 }
 
 /**
@@ -52,7 +62,7 @@ function buildOnboardingTelemetryEvent(
       params.sessionId && params.stepName && params.funnelVersion
         ? buildActivationDaemonEventId(
             params.sessionId,
-            params.stepName as ActivationStepName,
+            params.stepName,
             params.funnelVersion,
           )
         : id,
@@ -72,6 +82,7 @@ function buildOnboardingTelemetryEvent(
     ...(params.stepIndex != null ? { step_index: params.stepIndex } : {}),
     ...(params.completedAt ? { completed_at: params.completedAt } : {}),
     ...(params.funnelVersion ? { funnel_version: params.funnelVersion } : {}),
+    ...(params.outcome ? { outcome: params.outcome } : {}),
     assistant_version: APP_VERSION,
   };
 }
@@ -111,3 +122,82 @@ export function recordActivationEvent(params: {
     }),
   );
 }
+
+/**
+ * Record a live-voice session milestone (started / ended). Reuses the same
+ * onboarding telemetry substrate as {@link recordActivationEvent}, keyed by the
+ * live-voice session id so the two events pair up downstream. See
+ * `telemetry/live-voice-funnel.ts` for why duration and turn count are derived
+ * from that pairing rather than carried as fields.
+ *
+ * `screen` carries the end reason on the ended event (the started event has no
+ * dimension beyond the step itself). Returns null when usage data collection is
+ * disabled or the telemetry database is unavailable.
+ *
+ * **Never throws.** These fire from `LiveVoiceSession.start()` and `.close()`,
+ * which are the user's call itself: the outbox insert raises on a telemetry DB
+ * that is missing, locked, or mid-migration, and an uncaught raise there would
+ * fail the session rather than the measurement. A dropped row costs a gap in a
+ * chart; a raised one costs the user their conversation.
+ */
+function recordLiveVoiceEventSafely(
+  record: () => OnboardingEvent | null,
+): OnboardingEvent | null {
+  try {
+    return record();
+  } catch (err) {
+    log.warn(
+      { err },
+      "Failed to record live-voice session telemetry; continuing",
+    );
+    return null;
+  }
+}
+
+export function recordLiveVoiceSessionEvent(params: {
+  stepName: LiveVoiceStepName;
+  stepIndex: number;
+  sessionId: string;
+  screen?: string;
+  outcome?: LiveVoiceSessionOutcome;
+}): OnboardingEvent | null {
+  return recordLiveVoiceEventSafely(() =>
+    recordTelemetryOutboxEvent("onboarding", (id, createdAt) =>
+      buildOnboardingTelemetryEvent(id, createdAt, {
+        screen: params.screen ?? params.stepName,
+        sessionId: params.sessionId,
+        stepName: params.stepName,
+        stepIndex: params.stepIndex,
+        completedAt: new Date(createdAt).toISOString(),
+        funnelVersion: LIVE_VOICE_FUNNEL_VERSION,
+        ...(params.outcome ? { outcome: params.outcome } : {}),
+      }),
+    ),
+  );
+}
+
+/** Record the "a live-voice session was attempted" milestone. */
+export function recordLiveVoiceSessionStarted(
+  sessionId: string,
+): OnboardingEvent | null {
+  return recordLiveVoiceSessionEvent({
+    stepName: LIVE_VOICE_STEPS.sessionStarted.stepName,
+    stepIndex: LIVE_VOICE_STEPS.sessionStarted.stepIndex,
+    sessionId,
+  });
+}
+
+/** Record the "a live-voice session ended" milestone, with how it ended. */
+export function recordLiveVoiceSessionEnded(params: {
+  sessionId: string;
+  screen: string;
+  outcome: LiveVoiceSessionOutcome;
+}): OnboardingEvent | null {
+  return recordLiveVoiceSessionEvent({
+    stepName: LIVE_VOICE_STEPS.sessionEnded.stepName,
+    stepIndex: LIVE_VOICE_STEPS.sessionEnded.stepIndex,
+    sessionId: params.sessionId,
+    screen: params.screen,
+    outcome: params.outcome,
+  });
+}

package/src/permissions/question-prompter.test.ts

@@ -200,6 +200,8 @@ describe("QuestionPrompter", () => {
 
     const result = await promise;
     expect(result).toEqual({
+      requestId: req.requestId,
+      questions: req.questions,
       entries: [{ questionId: "q1", decision: "option", optionId: "a" }],
       overall: "completed",
     });
@@ -255,6 +257,8 @@ describe("QuestionPrompter", () => {
 
     const result = await promise;
     expect(result).toEqual({
+      requestId: req.requestId,
+      questions: req.questions,
       entries: [{ questionId: "q1", decision: "free_text", text: "Cherry" }],
       overall: "completed",
     });

package/src/permissions/question-prompter.ts

@@ -1,6 +1,7 @@
 import { v4 as uuid } from "uuid";
 
 import type {
+  QuestionEntry,
   QuestionOption,
   QuestionRequestEvent,
 } from "../api/events/question-request.js";
@@ -59,6 +60,18 @@ export interface QuestionPromptResult {
   overall: "completed" | "closed" | "timed_out" | "aborted";
 }
 
+/**
+ * What {@link QuestionPrompter.prompt} returns: the resolution plus the
+ * identity of the prompt that produced it. `requestId` and `questions` are
+ * known only to the prompter (it mints the id and assigns the per-question
+ * ids), and the `ask_question` executor needs both to record the durable
+ * answered-question payload against the questions as they were asked.
+ */
+export interface QuestionPromptOutcome extends QuestionPromptResult {
+  requestId: string;
+  questions: QuestionEntry[];
+}
+
 export interface QuestionPromptParamsEntry {
   question: string;
   description?: string;
@@ -170,7 +183,7 @@ export interface QuestionBatchMetadata {
  * fires when a prompt is left open with no response and no follow-up message.
  */
 export class QuestionPrompter {
-  async prompt(params: QuestionPromptParams): Promise<QuestionPromptResult> {
+  async prompt(params: QuestionPromptParams): Promise<QuestionPromptOutcome> {
     const { conversationId, questions, toolUseId, signal } = params;
 
     if (questions.length === 0) {
@@ -195,8 +208,12 @@ export class QuestionPrompter {
       optionsById[e.id] = e.options.map((o) => o.id);
     }
 
+    const requestId = uuid();
+
     if (signal?.aborted) {
       return {
+        requestId,
+        questions: entries,
         entries: orderedIds.map((id) => ({
           questionId: id,
           decision: "aborted",
@@ -205,9 +222,7 @@ export class QuestionPrompter {
       };
     }
 
-    const requestId = uuid();
-
-    return new Promise<QuestionPromptResult>((resolve, reject) => {
+    const settled = new Promise<QuestionPromptResult>((resolve, reject) => {
       const timeoutMs = getConfig().timeouts.questionResponseTimeoutSec * 1000;
 
       // Closure-scoped idempotency guard. Every resolution path (timeout,
@@ -318,5 +333,7 @@ export class QuestionPrompter {
       // single-question batch) lives in the promotion module.
       void createGuardianRequestForQuestion(msg, conversationId);
     });
+
+    return { ...(await settled), requestId, questions: entries };
   }
 }