@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -9,7 +9,9 @@
  *     or an access-request notification (LUM-2489),
  *   - a stranger's reaction creates no conversation, binding, or transcript
  *     row — it is dropped as channel noise,
- *   - a known contact's reaction is recorded as an inline transcript signal,
+ *   - a known contact's reaction is recorded as an inline transcript signal in
+ *     the conversation of the message it was attached to, whether that message
+ *     arrived from the channel or the assistant posted it,
  *   - a guardian's reaction on an approval card is routed through the guardian
  *     decision pipeline (the same path as buttons and text replies).
  *
@@ -28,14 +30,14 @@ import {
 } from "../../../messaging/providers/slack/message-metadata.js";
 import { addMessage } from "../../../persistence/conversation-crud.js";
 import {
-  clearPayload,
+  findInboundEvent,
+  findMessageBySourceId,
+  findSlackConversationByMessageTs,
   linkMessage,
   recordInbound,
 } from "../../../persistence/delivery-crud.js";
 import { markProcessed } from "../../../persistence/delivery-status.js";
-import { upsertBinding } from "../../../persistence/external-conversation-store.js";
 import { getLogger } from "../../../util/logger.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../../assistant-scope.js";
 import type { ApprovalConversationGenerator } from "../../http-types.js";
 import {
   actorTrustContextFromVerdict,
@@ -100,15 +102,12 @@ export interface ReactionInterceptParams {
   sourceInterface: InterfaceId | undefined;
   conversationExternalId: string;
   externalMessageId: string;
-  canonicalAssistantId: string;
   rawSenderId: string | undefined;
   canonicalSenderId: string | null;
   actorDisplayName: string | undefined;
   actorUsername: string | undefined;
   replyCallbackUrl: string | undefined;
   sourceMetadata: SourceMetadata | undefined;
-  /** Slack channel display name, for the conversation binding. */
-  slackChannelName: string | null;
   approvalConversationGenerator: ApprovalConversationGenerator | undefined;
 }
 
@@ -126,14 +125,12 @@ export async function handleSlackReactionIntercept(
     sourceInterface,
     conversationExternalId,
     externalMessageId,
-    canonicalAssistantId,
     rawSenderId,
     canonicalSenderId,
     actorDisplayName,
     actorUsername,
     replyCallbackUrl,
     sourceMetadata,
-    slackChannelName,
     approvalConversationGenerator,
   } = params;
 
@@ -168,28 +165,11 @@ export async function handleSlackReactionIntercept(
     typeof sourceMetadata?.messageId === "string"
       ? sourceMetadata.messageId
       : undefined;
-  const threadTs =
-    typeof sourceMetadata?.threadId === "string" &&
-    sourceMetadata.threadId.trim().length > 0
-      ? sourceMetadata.threadId.trim()
-      : undefined;
-
-  // Record for dedup + conversation resolution (known contacts only — strangers
-  // were dropped above).
-  const result = recordInbound(
-    sourceChannel,
-    conversationExternalId,
-    externalMessageId,
-    {
-      sourceMessageId: reactedMessageTs,
-      assistantId: canonicalAssistantId,
-      sourceThreadId: threadTs,
-    },
-  );
-
   // Respect disk-pressure cleanup so reactions don't bypass storage
   // protection. Guardians resolve to `allow-cleanup-mode` (not `block`), so a
-  // guardian's approval-by-reaction still flows.
+  // guardian's approval-by-reaction still flows. Blocked silently and before
+  // any write: a reaction is a passive signal, so the message pipeline's
+  // "storage is low, try again" notice is meaningless for an emoji.
   const diskPressure = classifyDiskPressureTurnPolicy(getDiskPressureStatus(), {
     sourceChannel,
     sourceInterface,
@@ -199,86 +179,97 @@ export async function handleSlackReactionIntercept(
     },
   });
   if (diskPressure.action === "block") {
-    // Block silently: a reaction is a passive signal, so the message
-    // pipeline's "storage is low, try again" notice is meaningless for an
-    // emoji — there is nothing to retry. Mark the event processed and stop
-    // before binding/persistence.
-    if (!result.duplicate) {
-      clearPayload(result.eventId);
-      markProcessed(result.eventId);
-    }
     return {
       accepted: true,
-      duplicate: result.duplicate,
-      eventId: result.eventId,
+      reaction: "dropped_disk_pressure",
       diskPressure: "blocked",
       reason: diskPressure.reason,
     };
   }
 
-  // Maintain the conversation binding, matching the message pipeline. Scoped to
-  // the daemon's own assistant so assistant-scoped legacy routes don't clobber
-  // each other's binding metadata.
-  if (canonicalAssistantId === DAEMON_INTERNAL_ASSISTANT_ID) {
-    upsertBinding({
-      conversationId: result.conversationId,
-      sourceChannel,
-      externalChatId: conversationExternalId,
-      externalChatName: slackChannelName,
-      externalThreadId: threadTs ?? null,
-      externalUserId: canonicalSenderId ?? rawSenderId ?? null,
-      displayName: actorDisplayName ?? null,
-      username: actorUsername ?? null,
-    });
+  // A redelivery is answered before anything acts on it. Recording the event
+  // is what dedups a reaction, and that happens after the guardian rail, so
+  // without this probe the same emoji could drive a decision twice.
+  const alreadyRecorded = findInboundEvent(
+    sourceChannel,
+    conversationExternalId,
+    externalMessageId,
+  );
+  if (alreadyRecorded) {
+    return {
+      accepted: true,
+      duplicate: true,
+      eventId: alreadyRecorded.eventId,
+    };
   }
 
-  // Guardian approval-by-reaction → guardian decision pipeline, exactly like
-  // buttons and text replies. Only `reaction:` (added) expresses intent;
+  // Guardian approval-by-reaction runs before the reacted message is resolved:
+  // an approval card is addressed by its own message id and is not always a
+  // stored message. Only `reaction:` (added) expresses intent;
   // `reaction_removed:` never does. `handleGuardianReplyIntercept` self-gates
-  // on `trustClass === "guardian"`, so a contact's reaction returns no response
-  // and falls through to persistence.
-  const isReactionAdded = callbackData.startsWith("reaction:");
-  if (isReactionAdded && replyCallbackUrl && !result.duplicate) {
+  // on `trustClass === "guardian"`, so a contact's reaction returns no
+  // response and falls through to persistence.
+  if (callbackData.startsWith("reaction:") && replyCallbackUrl) {
     const reactionIntercept = await handleGuardianReplyIntercept({
-      isDuplicate: result.duplicate,
+      isDuplicate: false,
       trimmedContent: "",
       hasCallbackData: true,
       callbackData,
       reactedMessageTs,
       rawSenderId,
       canonicalSenderId,
-      canonicalAssistantId,
       sourceChannel,
       conversationExternalId,
-      conversationId: result.conversationId,
-      eventId: result.eventId,
       replyCallbackUrl,
       trustClass: trustCtx.trustClass,
       guardianPrincipalId: trustCtx.guardianPrincipalId,
       approvalConversationGenerator,
     });
-    // Consumed as a guardian decision (applied, or a surfaced failure delivered
-    // as an ephemeral reply). Short-circuit so we do not also persist a
-    // transcript row.
     if (reactionIntercept.response) {
       return reactionIntercept.response;
     }
   }
 
-  // Record the reaction as an inline transcript signal. Requires the reacted
-  // message ts to anchor the rendering.
-  if (!reactedMessageTs) {
+  // The reaction belongs to the conversation of the message it was attached
+  // to. Slack sends no `thread_ts` on a reaction, so resolving a conversation
+  // from the reaction's own address keys one on the reacted message instead of
+  // finding the one that message lives in, minting an orphan per reaction.
+  // A message the assistant never stored has nothing to annotate, so the
+  // reaction is dropped rather than given a conversation of its own.
+  // Inbound messages carry their provider id on the event that delivered
+  // them. The assistant's own posts open no inbound event, so a reaction on
+  // one is resolved through the `slackMeta` those rows carry.
+  const targetConversationId = reactedMessageTs
+    ? (findMessageBySourceId(
+        sourceChannel,
+        conversationExternalId,
+        reactedMessageTs,
+      )?.conversationId ??
+      findSlackConversationByMessageTs(
+        conversationExternalId,
+        reactedMessageTs,
+      ))
+    : null;
+  if (!targetConversationId || !reactedMessageTs) {
     log.debug(
-      { conversationId: result.conversationId, eventId: result.eventId },
-      "Skipping reaction persistence: missing sourceMetadata.messageId",
+      { sourceChannel, conversationExternalId, reactedMessageTs },
+      "Dropping reaction: reacted message is not stored",
     );
-    return {
-      accepted: result.accepted,
-      duplicate: result.duplicate,
-      eventId: result.eventId,
-    };
+    return { accepted: true, reaction: "dropped_unknown_target" };
   }
 
+  const result = recordInbound(
+    sourceChannel,
+    conversationExternalId,
+    externalMessageId,
+    // No `sourceMessageId`: that column names the provider id of the event's
+    // own message, and a reaction is not one. Claiming the reacted message's
+    // id here would put two linked rows on that id, leaving a later edit or
+    // delete of it free to resolve to the reaction instead.
+    { conversationId: targetConversationId },
+  );
+
+  // Record the reaction as an inline transcript signal.
   try {
     await persistSlackReactionAsMessage({
       conversationId: result.conversationId,
@@ -286,7 +277,6 @@ export async function handleSlackReactionIntercept(
       eventId: result.eventId,
       callbackData,
       actorDisplayName,
-      threadTs,
       reactedMessageTs,
       duplicate: result.duplicate,
     });
@@ -320,7 +310,6 @@ async function persistSlackReactionAsMessage(params: {
   eventId: string;
   callbackData: string;
   actorDisplayName?: string;
-  threadTs?: string;
   reactedMessageTs: string;
   duplicate: boolean;
 }): Promise<void> {
@@ -345,7 +334,11 @@ async function persistSlackReactionAsMessage(params: {
     channelId: params.conversationExternalId,
     channelTs: params.reactedMessageTs,
     eventKind: "reaction",
-    ...(params.threadTs ? { threadTs: params.threadTs } : {}),
+    // No `threadTs`: Slack sends none on a reaction, so the gateway's thread
+    // id here is the reacted message's own ts. It equals `channelTs`, which
+    // every reader treats as "not in a thread" anyway, and storing it makes
+    // the row false evidence that a thread belongs to this conversation
+    // (`legacySlackConversationHasThreadEvidence`).
     ...(params.actorDisplayName
       ? { displayName: params.actorDisplayName }
       : {}),

package/src/runtime/routes/inbound-stages/secret-ingress-check.ts

@@ -14,6 +14,7 @@ import {
 } from "../../../persistence/delivery-crud.js";
 import { checkIngressForSecrets } from "../../../security/secret-ingress.js";
 import { getLogger } from "../../../util/logger.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../../assistant-scope.js";
 
 const log = getLogger("runtime-http");
 
@@ -36,7 +37,6 @@ export interface SecretIngressCheckParams {
   actorUsername: string | undefined;
   trustCtx: TrustContext;
   replyCallbackUrl: string | undefined;
-  canonicalAssistantId: string;
 }
 
 export interface SecretIngressCheckResult {
@@ -69,7 +69,6 @@ export function runSecretIngressCheck(
     actorUsername,
     trustCtx,
     replyCallbackUrl,
-    canonicalAssistantId,
   } = params;
 
   // Persist the raw payload so dead-lettered events can always be replayed.
@@ -85,7 +84,7 @@ export function runSecretIngressCheck(
     senderUsername: actorUsername,
     trustCtx,
     replyCallbackUrl,
-    assistantId: canonicalAssistantId,
+    assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
   });
 
   // ── Secret ingress scan ──

package/src/runtime/routes/inference-profiles-routes.ts

@@ -29,11 +29,14 @@ import {
   loadRawConfig,
 } from "../../config/loader.js";
 import {
-  LLMProvider,
   ProfileEntry,
   routingIdentityModelIssue,
 } from "../../config/schemas/llm.js";
 import { getDb } from "../../persistence/db-connection.js";
+import {
+  resolveEntryProviderKind,
+  writableProfileProviderIssue,
+} from "../../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import type { ConnectionAvailability } from "../../providers/inference/connection-availability.js";
 import {
@@ -150,10 +153,9 @@ const updateRequestSchema = z.object({
 // ---------------------------------------------------------------------------
 
 function assertValidProvider(provider: string): void {
-  if (!LLMProvider.safeParse(provider).success) {
-    throw new BadRequestError(
-      `Invalid provider "${provider}". Valid providers: ${LLMProvider.options.join(", ")}.`,
-    );
+  const issue = writableProfileProviderIssue(provider);
+  if (issue) {
+    throw new BadRequestError(issue);
   }
 }
 
@@ -182,31 +184,38 @@ function validateModel(
     }
     return [];
   }
-  if (isModelInCatalog(provider, model)) {
+  // An entry-name provider validates against its row's dispatchable kind,
+  // the same translation dispatch uses; the entry itself also serves as the
+  // model-list connection for custom endpoints below.
+  const entryKind = resolveEntryProviderKind(provider, model);
+  const catalogProvider = entryKind ?? provider;
+  if (isModelInCatalog(catalogProvider, model)) {
     return [];
   }
   // The named connection's advertised model list is authoritative for models
   // the code-owned catalog doesn't know — a custom (openai-compatible)
   // endpoint declares its own models at connection-create time.
-  if (connectionName) {
-    const connection = getConnection(getDb(), connectionName);
+  const modelListConnection =
+    connectionName ?? (entryKind !== null ? provider : undefined);
+  if (modelListConnection) {
+    const connection = getConnection(getDb(), modelListConnection);
     if (connection?.models?.some((m) => m.id === model)) {
       return [];
     }
   }
   if (!allowUnlisted) {
     const remedy =
-      provider === "openai-compatible"
+      catalogProvider === "openai-compatible"
         ? `Pass allowUnlisted to create it anyway, or declare the model on the connection ` +
           `("assistant inference providers update <name> --model ${model}").`
         : `Pass allowUnlisted to create it anyway, or run ` +
           `"assistant inference models list --provider ${provider}" to see valid ids.`;
     throw new BadRequestError(
-      `Model "${model}" is not in the catalog for provider "${provider}". ${remedy}`,
+      `Model "${model}" is not in the catalog for provider "${catalogProvider}". ${remedy}`,
     );
   }
   return [
-    `Model "${model}" is not in the catalog for provider "${provider}" — created anyway (allowUnlisted).`,
+    `Model "${model}" is not in the catalog for provider "${catalogProvider}"; created anyway (allowUnlisted).`,
   ];
 }
 

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -21,6 +21,7 @@ import { getDb } from "../../persistence/db-connection.js";
 import {
   type Auth,
   AuthSchema,
+  CHATGPT_SUBSCRIPTION_CONNECTION_NAME,
   type ConnectionModel,
   ConnectionModelSchema,
   ConnectionProviderSchema,
@@ -205,14 +206,26 @@ function deriveConnectionAuth(provider: string, credential: unknown): Auth {
 function assertAuthMatchesProvider(provider: string, auth: Auth): void {
   const managedAuth = auth.type === "platform";
   const managedProvider = provider === VELLUM_MANAGED_PROVIDER;
-  if (managedAuth === managedProvider) {
-    return;
+  if (managedAuth !== managedProvider) {
+    throw new BadRequestError(
+      managedAuth
+        ? `Auth type "platform" is only valid for provider "${VELLUM_MANAGED_PROVIDER}", not "${provider}". Vellum-managed routing is selected by the provider, so omit "auth" to derive it.`
+        : `Provider "${VELLUM_MANAGED_PROVIDER}" is always platform-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
+    );
+  }
+  // Same rule for the subscription identity: provider "chatgpt" and
+  // oauth_subscription auth record one fact and must pair, or a key-auth
+  // row under the identity would dispatch against the API while the user
+  // believes they are on subscription billing.
+  const subscriptionAuth = auth.type === "oauth_subscription";
+  const subscriptionProvider = provider === "chatgpt";
+  if (subscriptionAuth !== subscriptionProvider) {
+    throw new BadRequestError(
+      subscriptionAuth
+        ? `Auth type "oauth_subscription" is only valid for provider "chatgpt", not "${provider}". Run the ChatGPT sign-in flow to connect a subscription.`
+        : `Provider "chatgpt" is always subscription-authenticated; "${auth.type}" auth is not valid for it. Run the ChatGPT sign-in flow, or name a real provider for key-based auth.`,
+    );
   }
-  throw new BadRequestError(
-    managedAuth
-      ? `Auth type "platform" is only valid for provider "${VELLUM_MANAGED_PROVIDER}", not "${provider}". Vellum-managed routing is selected by the provider, so omit "auth" to derive it.`
-      : `Provider "${VELLUM_MANAGED_PROVIDER}" is always platform-authenticated; "${auth.type}" auth is not valid for it. Omit "auth" to derive it, or name a real provider for key-based auth.`,
-  );
 }
 
 /**
@@ -323,6 +336,15 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Connection name "${name}" is reserved for the Vellum-managed connection. Pick another name.`,
     );
   }
+  // Provider ids and routing identities are labels in profile config, so an
+  // entry under one of those names could never be referenced by name (the
+  // label reads as the vendor), and a future catalog addition must never
+  // capture an existing user name. Reserve the whole vocabulary.
+  if (VALID_CONNECTION_PROVIDERS.includes(name)) {
+    throw new BadRequestError(
+      `Connection name "${name}" is reserved as a provider id. Pick another name.`,
+    );
+  }
 
   const providerResult = ConnectionProviderSchema.safeParse(provider);
   if (!providerResult.success) {
@@ -330,15 +352,27 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
+  // The chatgpt identity lives on its canonical row: routing resolves the
+  // subscription by that name, so an identity row under any other name can
+  // never dispatch.
+  if (
+    providerResult.data === "chatgpt" &&
+    name !== CHATGPT_SUBSCRIPTION_CONNECTION_NAME
+  ) {
+    throw new BadRequestError(
+      `Provider "chatgpt" is reserved for the "${CHATGPT_SUBSCRIPTION_CONNECTION_NAME}" connection. Run the ChatGPT sign-in flow to connect a subscription.`,
+    );
+  }
   const authResult = AuthSchema.safeParse(
     auth ?? deriveConnectionAuth(providerResult.data, body.credential),
   );
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
-  if (auth !== undefined) {
-    assertAuthMatchesProvider(providerResult.data, authResult.data);
-  }
+  // Asserted on derived auth as well: derivation pairs every provider
+  // correctly except the chatgpt identity, whose fallthrough would mint
+  // api_key auth from a bare credential.
+  assertAuthMatchesProvider(providerResult.data, authResult.data);
 
   const labelRaw = body.label;
   if (
@@ -434,15 +468,31 @@ async function handleUpdateConnection({
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
+  // The canonical subscription row owns the "chatgpt" identity: writing
+  // subscription auth to it stamps the provider with the auth, mirroring
+  // the daemon's own sign-in exchange route. The CLI's login-chatgpt PATCHes
+  // auth through this route, and without the stamp a row the identity
+  // migration deliberately skipped (a claiming row with key auth) would end
+  // up as provider "openai" with subscription auth. Provider stays
+  // immutable for every other row.
+  const chatgptIdentityStamp =
+    name === CHATGPT_SUBSCRIPTION_CONNECTION_NAME &&
+    authResult.data.type === "oauth_subscription" &&
+    existing.provider !== "chatgpt";
+
   // The pairing is enforced on an actual auth change, not on the field being
   // present: the web editor and the CLI both resend the stored auth on every
   // edit, so a row whose columns already disagree stays relabelable and
-  // re-pointable.
+  // re-pointable. Judged against the stamped provider when the stamp
+  // applies, since that is the pair being written.
   if (
     body.auth !== undefined &&
     authFingerprint(authResult.data) !== authFingerprint(existing.auth)
   ) {
-    assertAuthMatchesProvider(existing.provider, authResult.data);
+    assertAuthMatchesProvider(
+      chatgptIdentityStamp ? "chatgpt" : existing.provider,
+      authResult.data,
+    );
   }
 
   const labelRaw = body.label;
@@ -473,6 +523,7 @@ async function handleUpdateConnection({
 
   const result = updateConnection(getDb(), name, {
     auth: authResult.data,
+    ...(chatgptIdentityStamp ? { provider: "chatgpt" } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
     ...customFields,
   });
@@ -574,10 +625,21 @@ async function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   // above; this keeps the scan a faithful backstop rather than one that
   // silently skips the defaults.
   const profiles = getEffectiveProfilesForProvider(config.llm?.profiles, dp);
+  // A binding lives in `provider` (the entry name) under the entries model,
+  // or in the legacy `provider_connection` field; both count, or deleting a
+  // bound entry would dangle the profile behind selection's silent healing.
+  // Provider values count only for non-vendor names: a profile saying
+  // "vellum" references the routing identity, never a row that happens to
+  // claim that name, and the claiming-row delete is the recovery path.
+  const nameIsEntryName = !VALID_CONNECTION_PROVIDERS.includes(name);
   const referencingProfiles = Object.entries(profiles)
-    .filter(
-      ([, p]) => (p as Record<string, unknown>).provider_connection === name,
-    )
+    .filter(([, p]) => {
+      const entry = p as Record<string, unknown>;
+      return (
+        entry.provider_connection === name ||
+        (nameIsEntryName && entry.provider === name)
+      );
+    })
     .map(([profileName]) => profileName);
 
   const result = deleteConnection(getDb(), name, {

package/src/runtime/routes/log-export-routes.ts

@@ -143,6 +143,9 @@ async function handleExport({
         ? [eq(messages.conversationId, conversationId)]
         : [];
 
+      // Any-state export, deliberately: this is a diagnostic surface, and an
+      // in-flight row (finalized = 0, content a { ref } into the turn's delta
+      // file) is often exactly what a bug report needs to show.
       const messageRows = capRows(
         db
           .select()