@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/runtime/effective-capabilities.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 
 import {
   canActOnPrivilegedDocuments,
+  canSeePersonalMemory,
   isArchiveBySenderAuthorized,
 } from "./effective-capabilities.js";
 
@@ -90,3 +91,45 @@ describe("isArchiveBySenderAuthorized", () => {
     ).toBe(false);
   });
 });
+
+describe("canSeePersonalMemory", () => {
+  test("guardian keeps memory on every channel", () => {
+    for (const executionChannel of [undefined, "vellum", "slack", "phone"]) {
+      expect(
+        canSeePersonalMemory({ trustClass: "guardian", executionChannel }),
+      ).toBe(true);
+    }
+  });
+
+  test("no channel means no actor was resolved, which is a local/native turn", () => {
+    // A resolved actor always carries a channel, so absence is a signal rather
+    // than a permissive default.
+    expect(canSeePersonalMemory({ trustClass: undefined })).toBe(true);
+    expect(canSeePersonalMemory({ trustClass: "unknown" })).toBe(true);
+  });
+
+  test("a non-guardian is denied memory on remote channels", () => {
+    for (const executionChannel of ["slack", "phone", "email", "telegram"]) {
+      expect(
+        canSeePersonalMemory({
+          trustClass: "unverified_contact",
+          executionChannel,
+        }),
+      ).toBe(false);
+    }
+  });
+
+  test("a non-guardian on the first-party console currently keeps memory", () => {
+    // Pins today's channel override so a change to it is a deliberate,
+    // visible edit rather than a silent drift.
+    for (const trustClass of [
+      "trusted_contact",
+      "unverified_contact",
+      "unknown",
+    ]) {
+      expect(
+        canSeePersonalMemory({ trustClass, executionChannel: "vellum" }),
+      ).toBe(true);
+    }
+  });
+});

package/src/runtime/effective-capabilities.ts

@@ -44,6 +44,33 @@ export function canActOnPrivilegedDocuments(actor: {
   );
 }
 
+/**
+ * Channels whose actors see personal memory regardless of trust class. The
+ * `vellum` first-party console is the operator's own surface rather than an
+ * external contact channel, mirroring {@link PRIVILEGED_DOCUMENT_CHANNELS}.
+ */
+const PERSONAL_MEMORY_CHANNELS = new Set<string>(["vellum"]);
+
+/**
+ * Whether personal-memory content (memory pages, PKB, matched v3 card
+ * sections, the v2 static block) may be surfaced to an actor.
+ *
+ * True when the trust class grants it, when the request arrived on a personal
+ * memory channel, or when no channel is present at all -- a resolved actor
+ * always carries one, so its absence means no actor was resolved, which is how
+ * local/native turns arrive.
+ */
+export function canSeePersonalMemory(actor: {
+  trustClass: RawTrustClass;
+  executionChannel?: string;
+}): boolean {
+  return (
+    resolveCapabilities(actor.trustClass).canAccessMemory ||
+    actor.executionChannel == null ||
+    PERSONAL_MEMORY_CHANNELS.has(actor.executionChannel)
+  );
+}
+
 /**
  * Whether an archive-by-sender invocation is authorized. Any one of a surface
  * action, a task-batch authorization, or an explicit prompt approval suffices.

package/src/runtime/guardian-reply-router.ts

@@ -97,8 +97,12 @@ export interface GuardianReplyContext {
   channel: string;
   /** Actor identity context for the sender. */
   actor: ActorContext;
-  /** Conversation ID for this message (may be the guardian's conversation). */
-  conversationId: string;
+  /**
+   * Conversation the message arrived in (may be the guardian's own). Only the
+   * text and NL paths read it; reactions and `apr:` callbacks resolve their
+   * target by card address or embedded request id and may pass none.
+   */
+  conversationId?: string;
   /** Callback data from button presses (e.g. `apr:<requestId>:<action>`). */
   callbackData?: string;
   /**

package/src/runtime/pre-first-message-gate.ts

@@ -55,9 +55,13 @@ export function hasReceivedUserMessage(): boolean {
   try {
     const row = rawGet<{ one: number }>(
       "preFirstMsg:hasReceivedUserMessage",
+      // Finalized user-role rows only: the grouped tool-result row is a
+      // user-role row reserved unfinalized mid-turn, and this gate must not
+      // read tool plumbing as "the user has messaged this assistant".
       `SELECT 1 AS one FROM messages m
        JOIN conversations c ON m.conversation_id = c.id
        WHERE m.role = 'user'
+         AND m.finalized = 1
          AND c.conversation_type = 'standard'
        LIMIT 1`,
     );

package/src/runtime/routes/__tests__/acp-claude-auth-routes.test.ts

@@ -47,7 +47,7 @@ mock.module("../../../security/oauth2.js", () => ({
 }));
 
 const actualClaudeOauth = await import("../../../acp/acp-claude-oauth.js");
-const { CLAUDE_MANUAL_REDIRECT_URI } = actualClaudeOauth;
+const { CLAUDE_MANUAL_REDIRECT_URI, CLAUDE_OAUTH_CONFIG } = actualClaudeOauth;
 const storeAcpClaudeTokenMock = mock(async (_token: string) => {});
 // The connect-status route reads token presence; mock it so the route test
 // doesn't reach real secure storage.
@@ -125,7 +125,7 @@ function deferredFlow(state: string): {
     reject = rej;
   });
   prepareOAuth2FlowMock.mockImplementationOnce(async () => ({
-    authorizeUrl: `https://claude.ai/oauth/authorize?state=${state}`,
+    authorizeUrl: `${CLAUDE_OAUTH_CONFIG.authorizeUrl}?state=${state}`,
     state,
     completion,
   }));
@@ -153,7 +153,7 @@ describe("acp_claude_auth_start", () => {
 
     const url = new URL(result.authorize_url);
     expect(`${url.origin}${url.pathname}`).toBe(
-      "https://claude.ai/oauth/authorize",
+      CLAUDE_OAUTH_CONFIG.authorizeUrl,
     );
     expect(url.searchParams.get("client_id")).toBe(CLAUDE_CLIENT_ID);
     expect(url.searchParams.get("code_challenge_method")).toBe("S256");
@@ -161,6 +161,11 @@ describe("acp_claude_auth_start", () => {
     const redirectUri = url.searchParams.get("redirect_uri") ?? "";
     expect(redirectUri).toMatch(/^http:\/\/localhost:\d+\/callback$/);
 
+    // The loopback flow performs a REAL redirect to the localhost callback;
+    // `code=true` (render the code on the page) belongs to the manual flow
+    // only and must not leak into this URL.
+    expect(url.searchParams.get("code")).toBeNull();
+
     expect(result.state).toBeTruthy();
     expect(url.searchParams.get("state")).toBe(result.state);
 
@@ -284,7 +289,7 @@ describe("acp_claude_auth_start (cloud/manual)", () => {
     expect(result.mode).toBe("manual");
     const url = new URL(result.authorize_url);
     expect(`${url.origin}${url.pathname}`).toBe(
-      "https://claude.ai/oauth/authorize",
+      CLAUDE_OAUTH_CONFIG.authorizeUrl,
     );
     expect(url.searchParams.get("redirect_uri")).toBe(
       CLAUDE_MANUAL_REDIRECT_URI,
@@ -292,6 +297,9 @@ describe("acp_claude_auth_start (cloud/manual)", () => {
     expect(url.searchParams.get("client_id")).toBe(CLAUDE_CLIENT_ID);
     expect(url.searchParams.get("code_challenge_method")).toBe("S256");
     expect(url.searchParams.get("state")).toBe(result.state);
+    // Manual flow requires `code=true` so the callback page renders the
+    // `code#state` string to paste back.
+    expect(url.searchParams.get("code")).toBe("true");
 
     // The manual path must not bind a loopback.
     expect(prepareOAuth2FlowMock).not.toHaveBeenCalled();