@vellumai/assistant 0.11.3-staging.4 → 0.11.4-staging.1

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.1.0
 info:
   title: Vellum Assistant API
-  version: 0.11.3
+  version: 0.11.4
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821
@@ -4017,8 +4017,8 @@ paths:
       summary: Get available channels
       description:
         Return the channels this assistant can surface to clients, with display metadata (label, icon, verification
-        capability, setup copy). Today this is a fixed base list plus `email` when an inbox is registered; will become
-        plugin/skill-driven in future.
+        capability, setup copy). A fixed base list plus `email` when an inbox is registered, plus the channels installed
+        plugins bring by declaring ingress routes. Each carries a `source` saying which of those it is.
       tags:
         - channels
       responses:
@@ -4036,16 +4036,9 @@ paths:
                       properties:
                         id:
                           type: string
-                          enum:
-                            - telegram
-                            - phone
-                            - vellum
-                            - whatsapp
-                            - slack
-                            - email
-                            - platform
-                            - a2a
-                            - discord
+                        source:
+                          type: string
+                          description: "`default` for a channel the assistant ships, `plugin:<name>` for one an installed plugin brings"
                         label:
                           type: string
                         subtitle:
@@ -4067,13 +4060,16 @@ paths:
                           additionalProperties: false
                       required:
                         - id
+                        - source
                         - label
                         - subtitle
                         - icon
                         - supportsVerification
                         - setupMessages
                       additionalProperties: false
-                    description: Available channels in display order
+                    description:
+                      "Available channels in display order: the ones the assistant ships, then the ones installed plugins bring
+                      by declaring ingress routes. `source` distinguishes them."
                 required:
                   - channels
                 additionalProperties: false
@@ -4358,6 +4354,7 @@ paths:
                             - platform
                             - a2a
                             - discord
+                            - plugin
                         ready:
                           type: boolean
                         setupStatus:
@@ -4448,6 +4445,7 @@ paths:
                     - platform
                     - a2a
                     - discord
+                    - plugin
                 includeRemote:
                   description: Include remote checks (default true)
                   type: boolean
@@ -4478,6 +4476,7 @@ paths:
                             - platform
                             - a2a
                             - discord
+                            - plugin
                         ready:
                           type: boolean
                         setupStatus:
@@ -4827,6 +4826,7 @@ paths:
                     - gemini
                     - fireworks
                     - openrouter
+                    - chatgpt
                     - vellum
                     - together
                     - vercel-ai-gateway
@@ -6582,6 +6582,7 @@ paths:
               - platform
               - a2a
               - discord
+              - plugin
           description:
             Filter by origin channel. When provided, only conversations with this exact origin_channel value are
             returned. Omit to include all channels.
@@ -6593,8 +6594,8 @@ paths:
           description:
             Filter to a single group, so each sidebar section can load independently of the paginated list. Pass
             "system:all" for conversations in no group, "system:pinned" for the Pinned section, or a custom group id. A
-            group-scoped request is ordered by the user's arrangement (display order, then recency) and never has pinned
-            rows appended to it. Omit to span every group.
+            group-scoped request is recency-ordered like every list read (COALESCE(last_message_at, updated_at)
+            descending) and never has pinned rows appended to it. Omit to span every group.
       responses:
         "200":
           description: Successful response
@@ -6718,6 +6719,7 @@ paths:
                                 - platform
                                 - a2a
                                 - discord
+                                - plugin
                             - type: "null"
                         assistantAttention:
                           type: object
@@ -7081,6 +7083,7 @@ paths:
                               - platform
                               - a2a
                               - discord
+                              - plugin
                           - type: "null"
                       assistantAttention:
                         type: object
@@ -8294,6 +8297,7 @@ paths:
                               - platform
                               - a2a
                               - discord
+                              - plugin
                           - type: "null"
                       assistantAttention:
                         type: object
@@ -9379,6 +9383,107 @@ paths:
                   - query
                   - results
                 additionalProperties: false
+  /v1/conversations/sections:
+    get:
+      operationId: conversations_sections_get
+      summary: Sidebar section index
+      description:
+        "One row per renderable sidebar section (Pinned, each non-empty custom group, each origin channel with
+        unassigned conversations, Chats) with total and unread counts and no conversation rows. Lets a client know which
+        sections exist, and what their badges say, without fetching any conversation list. Totals follow the standard
+        listing visibility; unread applies the same rules as GET /v1/conversations/unread-count scoped to the section.
+        Chats is always present, even at zero: it is the leftover bucket and renders regardless."
+      tags:
+        - conversations
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  sections:
+                    type: array
+                    items:
+                      oneOf:
+                        - type: object
+                          properties:
+                            kind:
+                              type: string
+                              const: pinned
+                            total:
+                              type: number
+                            unread:
+                              type: number
+                          required:
+                            - kind
+                            - total
+                            - unread
+                          additionalProperties: false
+                        - type: object
+                          properties:
+                            kind:
+                              type: string
+                              const: group
+                            groupId:
+                              type: string
+                            name:
+                              type: string
+                            icon:
+                              anyOf:
+                                - type: string
+                                - type: "null"
+                            sortPosition:
+                              type: number
+                            total:
+                              type: number
+                            unread:
+                              type: number
+                          required:
+                            - kind
+                            - groupId
+                            - name
+                            - icon
+                            - sortPosition
+                            - total
+                            - unread
+                          additionalProperties: false
+                        - type: object
+                          properties:
+                            kind:
+                              type: string
+                              const: channel
+                            channelId:
+                              type: string
+                            total:
+                              type: number
+                            unread:
+                              type: number
+                          required:
+                            - kind
+                            - channelId
+                            - total
+                            - unread
+                          additionalProperties: false
+                        - type: object
+                          properties:
+                            kind:
+                              type: string
+                              const: chats
+                            total:
+                              type: number
+                            unread:
+                              type: number
+                          required:
+                            - kind
+                            - total
+                            - unread
+                          additionalProperties: false
+                      type: object
+                required:
+                  - sections
+                additionalProperties: false
   /v1/conversations/seen:
     post:
       operationId: conversations_seen_post
@@ -14832,7 +14937,7 @@ paths:
             type: string
           description:
             "Filter by provider. One of: anthropic, openai, gemini, ollama, fireworks, together, openrouter,
-            vercel-ai-gateway, litellm, openai-compatible, minimax, atlascloud, baseten, poolside, vellum"
+            vercel-ai-gateway, litellm, openai-compatible, minimax, atlascloud, baseten, poolside, vellum, chatgpt"
       responses:
         "200":
           description: Successful response
@@ -21962,6 +22067,7 @@ paths:
                     - platform
                     - a2a
                     - discord
+                    - plugin
                     - scheduler
                     - watcher
                 sourceContextId:
@@ -24335,8 +24441,9 @@ paths:
         non-conflicting edits from both sides forward and resolving conflicting hunks toward the local edit (`ours`) or
         the target (`theirs`), or writing git conflict markers into the file and reporting them in
         `conflicts`/`binaryConflicts` for the assistant to resolve (`assistant`). A merge strategy whose install-time
-        baseline cannot be reconstructed returns 409. Mirrors the CLI''s `assistant plugins upgrade <name> [--strategy
-        <s>]`.'
+        baseline cannot be reconstructed returns 409. Pass `marketplaceOnly` to refuse the untrusted direct path
+        outright (409), which is what the unattended auto-update sweep does. Mirrors the CLI''s `assistant plugins
+        upgrade <name> [--strategy <s>]`.'
       tags:
         - plugins
       parameters:
@@ -24366,6 +24473,13 @@ paths:
                     - theirs
                     - overwrite
                     - assistant
+                marketplaceOnly:
+                  description:
+                    Refuse the upgrade (409) when the marketplace does not claim this plugin, instead of advancing it to
+                    whatever its recorded GitHub ref now resolves to. Set by unattended callers such as the automatic
+                    update sweep, for which running code no curator reviewed is never an acceptable outcome. Defaults to
+                    false.
+                  type: boolean
       responses:
         "200":
           description: Successful response
@@ -24465,8 +24579,9 @@ paths:
           description: No copy of the plugin is installed, or its source resolves to nothing.
         "409":
           description:
-            The install has neither a marketplace entry nor a recorded GitHub source to advance to, or a merge strategy
-            was requested whose install-time baseline cannot be reconstructed.
+            The install has neither a marketplace entry nor a recorded GitHub source to advance to, a `marketplaceOnly`
+            upgrade was requested for an install the marketplace does not claim, or a merge strategy was requested whose
+            install-time baseline cannot be reconstructed.
         "503":
           description: The plugin source (GitHub) was temporarily unavailable; the upgrade is retryable.
   /v1/plugins/{name}/versions:
@@ -33912,23 +34027,7 @@ components:
       additionalProperties: {}
     LLMProvider:
       type: string
-      enum:
-        - anthropic
-        - openai
-        - gemini
-        - ollama
-        - fireworks
-        - openrouter
-        - vercel-ai-gateway
-        - openai-compatible
-        - minimax
-        - atlascloud
-        - together
-        - litellm
-        - baseten
-        - poolside
-        - vellum
-        - chatgpt
+      minLength: 1
     ProfilePatchEntry:
       type: object
       properties:
@@ -34309,6 +34408,7 @@ components:
         - baseten
         - poolside
         - vellum
+        - chatgpt
     Auth:
       oneOf:
         - type: object
@@ -34526,6 +34626,7 @@ components:
                     - gemini
                     - fireworks
                     - openrouter
+                    - chatgpt
                     - vellum
                     - together
                     - vercel-ai-gateway
@@ -34903,6 +35004,7 @@ components:
                 - gemini
                 - fireworks
                 - openrouter
+                - chatgpt
                 - vellum
                 - together
                 - vercel-ai-gateway

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.3-staging.4",
+  "version": "0.11.4-staging.1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/scripts/voice-ttft-spike.ts

@@ -8,7 +8,7 @@
  * script's `full` variants and the live session's `llmFirstDeltaMs`).
  *
  * Variants:
- *   slim-haiku    voiceFrontDecision call site (Haiku pin), slim prompt
+ *   slim-front    voiceFrontDoor call site, slim prompt
  *   slim-flash    cost-optimized profile, same slim prompt
  *   full-notools  cost-optimized, real buildSystemPrompt(), no tools
  *   full-flash    cost-optimized, real buildSystemPrompt() + full tool defs
@@ -170,8 +170,8 @@ async function main(): Promise<void> {
 
   const variants: VariantSpec[] = [
     {
-      name: "slim-haiku",
-      callSite: "voiceFrontDecision",
+      name: "slim-front",
+      callSite: "voiceFrontDoor",
       systemPrompt: () => SLIM_SYSTEM_PROMPT,
     },
     {

package/src/__tests__/app-compiler.test.ts

@@ -20,6 +20,7 @@ import {
   packageName,
   resolvePackage,
 } from "../bundler/package-resolver.js";
+import { ensureBun } from "../util/bun-runtime.js";
 
 // ---------------------------------------------------------------------------
 // Shared temp directory
@@ -56,6 +57,29 @@ async function scaffold(
   return appDir;
 }
 
+/**
+ * Download `pkg` into bun's global module cache via a throwaway install.
+ *
+ * `resolvePackage` bounds its own install at INSTALL_TIMEOUT_MS (10s), which a
+ * cold global cache can exceed for a large package on a slow network. Priming
+ * first is unbounded, so the install the test measures resolves from cache and
+ * stays well inside that bound.
+ */
+async function primeBunCache(pkg: string): Promise<void> {
+  const primeDir = join(tempDir, `prime-${pkg.replaceAll(/[^a-z0-9]/gi, "-")}`);
+  await mkdir(primeDir, { recursive: true });
+  await writeFile(
+    join(primeDir, "package.json"),
+    JSON.stringify({ name: "prime-cache", private: true }),
+  );
+  const proc = Bun.spawn([await ensureBun(), "install", "--no-save", pkg], {
+    cwd: primeDir,
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  await proc.exited;
+}
+
 const MINIMAL_HTML = `<!DOCTYPE html>
 <html>
 <head><title>Test</title></head>
@@ -466,10 +490,21 @@ describe("package-resolver", () => {
     expect(ALLOWED_PACKAGES).toContain("clsx");
   });
 
-  // `lucide` (the vanilla package) unpacks to ~29 MB, far above the resolver's
-  // size cap, so it is installed then deleted and never resolves. It also
-  // exports icon data arrays, not Preact components. Apps use inline SVG.
+  // `lucide` (the vanilla package) exports icon data arrays, not Preact
+  // components, and unpacks to ~29 MB for no benefit. Apps use inline SVG.
   test("ALLOWED_PACKAGES excludes lucide", () => {
     expect(ALLOWED_PACKAGES).not.toContain("lucide");
   });
+
+  // `chart.js` is a large allowlisted package: it must install into the shared
+  // cache and resolve so apps importing it can compile.
+  test("resolvePackage installs a large allowlisted package", async () => {
+    await primeBunCache("chart.js");
+
+    const result = await resolvePackage("chart.js");
+    expect(result).not.toBeNull();
+    expect(existsSync(join(getCacheDir(), "node_modules", "chart.js"))).toBe(
+      true,
+    );
+  }, 60_000);
 });

package/src/__tests__/attachments-store.test.ts

@@ -722,12 +722,6 @@ describe("validateAttachmentUpload", () => {
       expect(exeResult.error).toContain(".exe");
     }
 
-    const shResult = validateAttachmentUpload("script.sh", "text/plain");
-    expect(shResult.ok).toBe(false);
-    if (!shResult.ok) {
-      expect(shResult.error).toContain(".sh");
-    }
-
     const isoResult = validateAttachmentUpload(
       "disk.iso",
       "application/octet-stream",
@@ -738,6 +732,24 @@ describe("validateAttachmentUpload", () => {
     }
   });
 
+  test("accepts shell scripts as text attachments", () => {
+    expect(validateAttachmentUpload("script.sh", "text/plain").ok).toBe(true);
+    expect(validateAttachmentUpload("script.SH", "text/plain").ok).toBe(true);
+    expect(
+      validateAttachmentUpload("setup.sh", "application/x-sh").ok,
+    ).toBe(true);
+    expect(
+      validateAttachmentUpload("run.sh", "application/x-shellscript").ok,
+    ).toBe(true);
+    expect(validateAttachmentUpload("run.sh", "text/x-sh").ok).toBe(true);
+    expect(validateAttachmentUpload("run.sh", "text/x-shellscript").ok).toBe(
+      true,
+    );
+    expect(
+      validateAttachmentUpload("run.sh", "application/octet-stream").ok,
+    ).toBe(true);
+  });
+
   test("rejects dangerous extensions regardless of claimed MIME type", () => {
     // .exe disguised as image/png
     const result = validateAttachmentUpload("payload.exe", "image/png");
@@ -748,7 +760,9 @@ describe("validateAttachmentUpload", () => {
     expect(
       validateAttachmentUpload("PROGRAM.EXE", "application/octet-stream").ok,
     ).toBe(false);
-    expect(validateAttachmentUpload("script.SH", "text/plain").ok).toBe(false);
+    expect(validateAttachmentUpload("INSTALL.DMG", "application/octet-stream").ok).toBe(
+      false,
+    );
   });
 
   test("rejects unsupported MIME types", () => {
@@ -815,11 +829,6 @@ describe("validateAttachmentUpload", () => {
         trustedSource: true,
       }).ok,
     ).toBe(true);
-    expect(
-      validateAttachmentUpload("build.sh", "text/plain", {
-        trustedSource: true,
-      }).ok,
-    ).toBe(true);
   });
 
   test("trustedSource: false keeps strict validation", () => {

package/src/__tests__/byok-default-profile-ensure.test.ts

@@ -278,6 +278,8 @@ describe("ensureByokDefaultProfiles", () => {
     ["openrouter", "quality-optimized", "anthropic/claude-opus-4.8"],
     ["gemini", "cost-optimized", "gemini-3.1-flash-lite-preview"],
     ["openai", "cost-optimized", "gpt-5.4-nano"],
+    ["openai", "balanced", "gpt-5.4-mini"],
+    ["openai", "quality-optimized", "gpt-5.4"],
     ["fireworks", "balanced", "accounts/fireworks/models/kimi-k2p5"],
     ["fireworks", "balanced", "accounts/fireworks/models/kimi-k2p6"],
     [

package/src/__tests__/call-setup-flow-name-capture.test.ts

@@ -360,7 +360,6 @@ describe("CallSetupFlow name capture", () => {
     ).toEqual({ from: PHONE_NUMBER, callerName: CALLER_NAME });
     expect(f.notifyCalls).toEqual([
       {
-        canonicalAssistantId: "self",
         sourceChannel: "phone",
         conversationExternalId: PHONE_NUMBER,
         actorExternalId: PHONE_NUMBER,

package/src/__tests__/call-site-routing-provider.test.ts

@@ -67,7 +67,7 @@ function makeConnectionHook(
   byConnection: Record<string, Provider>,
 ): (
   connectionName: string,
-  expectedProvider: string,
+  expectedProvider: string | undefined,
 ) => Promise<Provider | null> {
   return async (connectionName, _expectedProvider) =>
     byConnection[connectionName] ?? null;

package/src/__tests__/channel-availability-routes.test.ts

@@ -57,6 +57,8 @@ const handler = ROUTES[0]!.handler;
 
 interface ChannelEntry {
   id: string;
+  /** `default` here, `plugin:<name>` for a channel a plugin brings. */
+  source: string;
   label: string;
   subtitle: string;
   icon: string;
@@ -173,10 +175,21 @@ describe("channels/available", () => {
     for (const channel of result.channels) {
       const expected = (CHANNEL_METADATA as any)[channel.id];
       expect(expected).toBeDefined();
-      expect(channel).toEqual(expected);
+      // Plus `source`, which the metadata does not carry: it says who
+      // contributes the row, and every row here comes from the assistant.
+      expect(channel).toEqual({ ...expected, source: "default" });
     }
   });
 
+  test("marks every channel the assistant ships as its own", async () => {
+    // The base list is what a client compares a plugin-contributed row
+    // against, so the marker has to be present rather than implied by an
+    // absent field.
+    const result = (await handler({})) as HandlerResult;
+
+    expect(result.channels.every((c) => c.source === "default")).toBe(true);
+  });
+
   test("email metadata: not verification-capable, mail icon", async () => {
     mockEmailAddressesResponse = {
       ok: true,