@vellumai/assistant 0.11.4 → 0.11.5-dev.202608220019.a778cf0

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  canonicalizeWebUrl,
+  looksLikeHostPortShorthand,
+  looksLikePathOnlyInput,
+  normalizeWebUrl,
+} from "../url-normalization.js";
+
+/**
+ * These are the rules a trust rule is saved and matched under. A change here
+ * changes which saved rules still match, so each case states the target the
+ * two spellings must agree on.
+ */
+describe("normalizeWebUrl", () => {
+  test("keeps an ordinary https URL as-is", () => {
+    expect(normalizeWebUrl("https://example.com/docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("drops the fragment: it never reaches the server", () => {
+    expect(normalizeWebUrl("https://example.com/docs#section")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("drops userinfo so credentials cannot land in a saved rule", () => {
+    const credentialed = new URL("https://example.com/docs/page");
+    credentialed.username = "demo";
+    credentialed.password = ["c", "r", "e", "d", "1", "2", "3"].join("");
+
+    const normalized = normalizeWebUrl(credentialed.href);
+    expect(normalized?.href).toBe("https://example.com/docs/page");
+    expect(normalized?.username).toBe("");
+    expect(normalized?.password).toBe("");
+  });
+
+  test("strips a trailing root dot from the hostname", () => {
+    expect(normalizeWebUrl("https://example.com./docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("decodes escaped path segments so one path has one spelling", () => {
+    // Without this, a rule scoped to /private is bypassed by /%70rivate.
+    expect(normalizeWebUrl("https://example.com/%70rivate")?.href).toBe(
+      "https://example.com/private",
+    );
+  });
+
+  test("reads scheme-less input as https", () => {
+    expect(normalizeWebUrl("example.com/docs")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("reads host:port shorthand as an https origin, not a scheme", () => {
+    expect(normalizeWebUrl("example.com:8443/status")?.origin).toBe(
+      "https://example.com:8443",
+    );
+    expect(normalizeWebUrl("[2001:db8::1]:8443/status")?.origin).toBe(
+      "https://[2001:db8::1]:8443",
+    );
+  });
+
+  test("rejects path-only input rather than coercing it to a host", () => {
+    for (const input of ["/etc/passwd", "./rel", "../up", "?q=1", "#frag"]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects every non-http scheme", () => {
+    for (const input of [
+      "file:///etc/passwd",
+      "data:text/html,<script>",
+      "javascript:alert(1)",
+      "ftp://example.com/f",
+    ]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects empty and whitespace-only input", () => {
+    expect(normalizeWebUrl("")).toBeNull();
+    expect(normalizeWebUrl("   ")).toBeNull();
+  });
+
+  test("trims surrounding whitespace", () => {
+    expect(normalizeWebUrl("  https://example.com/a  ")?.href).toBe(
+      "https://example.com/a",
+    );
+  });
+
+  test("returns null rather than throwing on an unparseable authority", () => {
+    expect(normalizeWebUrl("https://")).toBeNull();
+  });
+});
+
+describe("canonicalizeWebUrl", () => {
+  test("keeps the parser's form when the path is not decodable, without throwing", () => {
+    // `%zz` and a truncated UTF-8 sequence are not valid escapes; the path
+    // must survive unchanged rather than the call throwing.
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%zz")).href).toBe(
+      "https://example.com/100%zz",
+    );
+    expect(
+      canonicalizeWebUrl(new URL("https://example.com/%E0%A4%A")).href,
+    ).toBe("https://example.com/%E0%A4%A");
+  });
+
+  test("decodes an escaped percent, so `%25` and `%` are one path", () => {
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%25")).href).toBe(
+      "https://example.com/100%",
+    );
+  });
+});
+
+describe("input shape predicates", () => {
+  test("host:port shorthand is recognized, scheme-prefixed input is not", () => {
+    expect(looksLikeHostPortShorthand("example.com:8443/x")).toBe(true);
+    expect(looksLikeHostPortShorthand("[2001:db8::1]:443")).toBe(true);
+    expect(looksLikeHostPortShorthand("https://example.com/x")).toBe(false);
+    expect(looksLikeHostPortShorthand("example.com/x")).toBe(false);
+  });
+
+  test("path-only input is recognized", () => {
+    expect(looksLikePathOnlyInput("/abs")).toBe(true);
+    expect(looksLikePathOnlyInput("./rel")).toBe(true);
+    expect(looksLikePathOnlyInput("../up")).toBe(true);
+    expect(looksLikePathOnlyInput("?q=1")).toBe(true);
+    expect(looksLikePathOnlyInput("#frag")).toBe(true);
+    expect(looksLikePathOnlyInput("example.com/x")).toBe(false);
+  });
+});

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,3 +29,4 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
+export * from "./url-normalization.js";

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/ingress.ts

@@ -48,3 +48,106 @@ export function normalizeHttpPublicBaseUrl(value: unknown): string | undefined {
     return undefined;
   }
 }
+
+/**
+ * The same validation as `normalizeHttpPublicBaseUrl`, minus the root path it
+ * always emits (`https://x` becomes `https://x/`). Callers that append a path
+ * or persist the result want this shape, so they neither join through a double
+ * slash nor re-strip what the normalizer just added.
+ */
+export function normalizeHttpPublicBaseUrlWithoutTrailingSlash(
+  value: unknown,
+): string | undefined {
+  return normalizePublicBaseUrl(normalizeHttpPublicBaseUrl(value));
+}
+
+/**
+ * A trimmed string, or undefined when the value is not a non-blank string.
+ *
+ * Exported because the identity check in the daemon's tunnel probe compares an
+ * id recorded here against one an edge serves, and the two sides have to trim
+ * alike: a padded served id must read as a match, not as a different
+ * assistant.
+ */
+export function trimmedNonEmptyString(value: unknown): string | undefined {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+// Records `vellum tunnel` leaves in the workspace config's `ingress` section.
+// The CLI writes them and the daemon reads them, and the two are separate
+// build units that cannot import each other, so the key names, the provider
+// allowlist, and the validation all live here rather than in a copy on each
+// side.
+
+/** Key under `ingress` holding the tunnel that most recently ran. */
+export const INGRESS_LAST_TUNNEL_KEY = "lastTunnel";
+
+/**
+ * Key under `ingress` holding a tunnel published for device pairing alone.
+ *
+ * A tailnet-only tunnel started while webhook integrations are configured
+ * cannot carry their callbacks, so it leaves `publicBaseUrl` (the callback
+ * base) as it is and records itself here. Readers that answer the pairing card
+ * prefer this address over `publicBaseUrl`; teardown drops the key.
+ */
+export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
+
+/** Key under `ingress` holding the assistant id that tunnel fronted. */
+export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
+
+/**
+ * The local tunnel providers the CLI can start, in the order they are offered.
+ * `vellum tunnel`'s accepted `--provider` values and the persisted-record
+ * validation below both derive from it.
+ */
+export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+
+export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
+
+/** A recorded tunnel, kept after teardown so UIs can name the command to restart. */
+export interface TunnelRecord {
+  provider: TunnelProviderName;
+  publicBaseUrl: string;
+}
+
+function isTunnelProviderName(value: unknown): value is TunnelProviderName {
+  return (
+    typeof value === "string" &&
+    (TUNNEL_PROVIDERS as readonly string[]).includes(value)
+  );
+}
+
+/**
+ * Parse an `ingress.lastTunnel` or `ingress.pairingTunnel` value, or null when
+ * it is absent or malformed.
+ *
+ * A hand-edited config must not hand callers an unusable address or a provider
+ * name no command accepts: the provider is checked against the allowlist
+ * because readers render it into a restart command, and the URL faces the same
+ * absolute HTTP(S) constraint as every other public base URL. The URL comes
+ * back in the shape the validator produced, so readers never re-normalize it.
+ */
+export function parseTunnelRecord(value: unknown): TunnelRecord | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  const { provider, publicBaseUrl } = value as Record<string, unknown>;
+  if (!isTunnelProviderName(provider)) {
+    return null;
+  }
+  const normalized =
+    normalizeHttpPublicBaseUrlWithoutTrailingSlash(publicBaseUrl);
+  if (normalized === undefined) {
+    return null;
+  }
+  return { provider, publicBaseUrl: normalized };
+}
+
+/** Parse an `ingress.assistantId` value, or null when it is absent or blank. */
+export function parseRecordedAssistantId(value: unknown): string | null {
+  return trimmedNonEmptyString(value) ?? null;
+}

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/url-normalization.ts

@@ -0,0 +1,107 @@
+/**
+ * Canonical URL normalization for web tool inputs, shared by the gateway's
+ * risk classifiers and the daemon's URL safety checks.
+ *
+ * A URL a model passes to `web_fetch` / `network_request` reaches more than
+ * one consumer, and they must agree on what counts as the same target: the
+ * gateway builds the trust-rule ladder from it, and anything that later
+ * compares a URL to a saved rule has to fold the same spellings together. Two
+ * normalizations would mean two answers, so it lives here rather than in
+ * either process.
+ *
+ * Data-only in spirit: no imports, no config, no I/O.
+ */
+
+/** Whether a bare `host:port` (or `[v6]:port`) shorthand was written. */
+export function looksLikeHostPortShorthand(value: string): boolean {
+  if (/^\[[0-9a-fA-F:.%]+\]:\d+(?:[/?#]|$)/.test(value)) {
+    return true;
+  }
+  return /^[^/?#@\s:]+:\d+(?:[/?#]|$)/.test(value);
+}
+
+/** Whether the input is a path, query, or fragment rather than a URL. */
+export function looksLikePathOnlyInput(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("?") ||
+    value.startsWith("#")
+  );
+}
+
+/**
+ * Strip the parts of a URL that must not affect a trust decision, and fold
+ * the encodings that would otherwise let one URL wear two spellings.
+ *
+ * Percent-escaped path segments are decoded (`/%70rivate` and `/private` are
+ * one path, so a path-scoped rule cannot be bypassed by escaping), a trailing
+ * root dot is dropped from the hostname, and fragment and userinfo are
+ * removed: the fragment never reaches the server, and credentials in the
+ * authority must never end up in a saved rule.
+ */
+export function canonicalizeWebUrl(parsed: URL): URL {
+  parsed.hash = "";
+  parsed.username = "";
+  parsed.password = "";
+
+  try {
+    parsed.pathname = decodeURI(parsed.pathname);
+  } catch {
+    // Keep the URL parser's canonical form when decoding fails.
+  }
+
+  if (parsed.hostname.endsWith(".")) {
+    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
+  }
+
+  return parsed;
+}
+
+/**
+ * Parse and canonicalize a web tool's `url` input, or `null` when it is not a
+ * URL this system will fetch.
+ *
+ * Accepts `https://host/path`, `http://…`, bare `host/path`, and `host:port`
+ * shorthand. Rejects path-only input and any other scheme (`file:`, `data:`,
+ * `javascript:`), so a non-http target can never acquire a web trust rule.
+ */
+export function normalizeWebUrl(rawUrl: string): URL | null {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (looksLikeHostPortShorthand(trimmed)) {
+    try {
+      return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return canonicalizeWebUrl(parsed);
+    }
+    return null;
+  } catch {
+    // Not an absolute URL; fall through to the shorthand forms.
+  }
+
+  if (looksLikePathOnlyInput(trimmed)) {
+    return null;
+  }
+
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+
+  try {
+    return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+  } catch {
+    return null;
+  }
+}

package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts

@@ -63,11 +63,16 @@ export type TrustRulesListIpcParams = z.infer<
   typeof TrustRulesListIpcParamsSchema
 >;
 
+/** The three risk levels a trust rule can set and a registry default can carry. */
+export const RISK_LEVEL_VALUES = ["low", "medium", "high"] as const;
+export type RiskLevelValue = (typeof RISK_LEVEL_VALUES)[number];
+export const RiskLevelValueSchema = z.enum(RISK_LEVEL_VALUES);
+
 export const TrustRuleSchema = z.object({
   id: z.string(),
   tool: z.string(),
   pattern: z.string(),
-  risk: z.enum(["low", "medium", "high"]),
+  risk: RiskLevelValueSchema,
   description: z.string(),
   origin: z.enum(["default", "user_defined"]),
   userModified: z.boolean(),
@@ -341,3 +346,163 @@ export const GetGuardianContactIpcResponseSchema = z.object({
 export type GetGuardianContactIpcResponse = z.infer<
   typeof GetGuardianContactIpcResponseSchema
 >;
+
+// ── classify_risk ────────────────────────────────────────────────────────────
+// Risk classification is gateway-owned; the assistant sends one request per
+// tool invocation and reads the whole answer back. The gateway validates the
+// request against `ClassifyRiskIpcParamsSchema`; the assistant validates the
+// response against `ClassifyRiskIpcResponseSchema` and fails closed on a
+// mismatch.
+
+/** A classified risk; `unknown` is the classifier's own "not in registry". */
+export const ClassifiedRiskSchema = z.enum([...RISK_LEVEL_VALUES, "unknown"]);
+export type ClassifiedRisk = z.infer<typeof ClassifiedRiskSchema>;
+
+/** How a risk was determined: a user trust rule, the registry, or neither. */
+export const RiskMatchTypeSchema = z.enum(["user_rule", "registry", "unknown"]);
+export type RiskMatchType = z.infer<typeof RiskMatchTypeSchema>;
+
+/**
+ * File classifier context the assistant pre-resolves (it owns the workspace
+ * filesystem) so the gateway can classify file tools without assistant path
+ * helpers. Directories are canonicalized (symlinks resolved) by the sender.
+ */
+export const ClassifyRiskFileContextSchema = z.object({
+  protectedDir: z.string(),
+  deprecatedDir: z.string(),
+  hooksDir: z.string(),
+  pluginsDir: z.string().optional(),
+  toolsDir: z.string().optional(),
+  routesDir: z.string().optional(),
+  workflowsDir: z.string().optional(),
+  /** Monitoring data dir: the sentinel lives here, writes are code-injection risk. */
+  monitoringDir: z.string().optional(),
+  actorTokenSigningKeyPath: z.string(),
+  skillSourceDirs: z.array(z.string()),
+});
+export type ClassifyRiskFileContext = z.infer<
+  typeof ClassifyRiskFileContextSchema
+>;
+
+/** Skill metadata the assistant pre-resolves for skill-load classification. */
+export const ClassifyRiskSkillMetadataSchema = z.object({
+  skillId: z.string(),
+  selector: z.string(),
+  versionHash: z.string(),
+  transitiveHash: z.string().optional(),
+  hasInlineExpansions: z.boolean(),
+  isDynamic: z.boolean(),
+});
+export type ClassifyRiskSkillMetadata = z.infer<
+  typeof ClassifyRiskSkillMetadataSchema
+>;
+
+export const ClassifyRiskIpcParamsSchema = z.object({
+  tool: z.string().min(1),
+  command: z.string().optional(),
+  url: z.string().optional(),
+  path: z.string().optional(),
+  /**
+   * The file tool's target path with symlinks resolved by the assistant. The
+   * gateway's security escalation prefix checks use it so a symlink cannot
+   * mask a write into a protected directory; falls back to lexical resolution
+   * of `path` when absent.
+   */
+  resolvedPath: z.string().optional(),
+  /**
+   * The sandbox file tool's working directory with symlinks resolved. Paired
+   * with `resolvedPath` for the workspace-boundary check so a symlinked
+   * workspace prefix (macOS `/var` → `/private/var`) does not read as an
+   * escape. Absent for host tools.
+   */
+  resolvedWorkingDir: z.string().optional(),
+  skill: z.string().optional(),
+  mode: z.string().optional(),
+  script: z.string().optional(),
+  workingDir: z.string().optional(),
+  allowPrivateNetwork: z.boolean().optional(),
+  networkMode: z.string().optional(),
+  isContainerized: z.boolean().optional(),
+  workspaceRoot: z.string().optional(),
+  fileContext: ClassifyRiskFileContextSchema.optional(),
+  skillMetadata: ClassifyRiskSkillMetadataSchema.optional(),
+  /**
+   * The tool's registry default risk, for tools with no dedicated classifier.
+   * The gateway answers with it (`matchType: "registry"`); absent, the tool is
+   * unknown and answers `medium`.
+   */
+  registryDefaultRisk: RiskLevelValueSchema.optional(),
+  /** Number of credential references attached to this tool invocation. */
+  credentialRefCount: z.number().int().nonnegative().optional(),
+  /**
+   * For `host_file_transfer` to_sandbox: the workspace-side destination path
+   * and the sandbox working directory it resolves against, so a transfer that
+   * lands an executable file in a code-injection sink (tools, routes, hooks,
+   * plugins, skills) escalates even though `path` carries the host-side source.
+   */
+  transferSandboxDestPath: z.string().optional(),
+  transferSandboxWorkingDir: z.string().optional(),
+  /** `transferSandboxDestPath` with symlinks resolved by the assistant. */
+  resolvedTransferDestPath: z.string().optional(),
+});
+export type ClassifyRiskIpcParams = z.infer<typeof ClassifyRiskIpcParamsSchema>;
+
+/** Regex ladder shown when the user saves a classification (display only). */
+export const RiskPatternScopeOptionSchema = z.object({
+  pattern: z.string(),
+  label: z.string(),
+});
+export type RiskPatternScopeOption = z.infer<
+  typeof RiskPatternScopeOptionSchema
+>;
+
+/** Minimatch ladder for the "always allow" prompt option (what a rule matches). */
+export const RiskAllowlistOptionSchema = z.object({
+  label: z.string(),
+  description: z.string(),
+  pattern: z.string(),
+});
+export type RiskAllowlistOption = z.infer<typeof RiskAllowlistOptionSchema>;
+
+/** Directory ladder for filesystem operations; `scope` is a path glob or `everywhere`. */
+export const RiskDirectoryScopeOptionSchema = z.object({
+  scope: z.string(),
+  label: z.string(),
+});
+export type RiskDirectoryScopeOption = z.infer<
+  typeof RiskDirectoryScopeOptionSchema
+>;
+
+export const RiskDangerousPatternSchema = z.object({
+  type: z.string(),
+  description: z.string(),
+  text: z.string(),
+});
+export type RiskDangerousPattern = z.infer<typeof RiskDangerousPatternSchema>;
+
+export const ClassifyRiskIpcResponseSchema = z.object({
+  risk: ClassifiedRiskSchema,
+  reason: z.string(),
+  matchType: RiskMatchTypeSchema,
+  scopeOptions: z.array(RiskPatternScopeOptionSchema),
+  allowlistOptions: z.array(RiskAllowlistOptionSchema).optional(),
+  actionKeys: z.array(z.string()).optional(),
+  commandCandidates: z.array(z.string()).optional(),
+  dangerousPatterns: z.array(RiskDangerousPatternSchema).optional(),
+  opaqueConstructs: z.boolean().optional(),
+  isComplexSyntax: z.boolean().optional(),
+  sandboxAutoApprove: z.boolean().optional(),
+  /**
+   * Lexically-resolved path arguments from sandbox-auto-approve-eligible bash
+   * segments. The gateway has no filesystem access; the assistant resolves
+   * these through symlinks and revokes `sandboxAutoApprove` if any escapes
+   * the workspace.
+   */
+  sandboxPathArgs: z.array(z.string()).optional(),
+  directoryScopeOptions: z.array(RiskDirectoryScopeOptionSchema).optional(),
+  /** Fully resolved filesystem path arguments, for directory-scoped rule matching. */
+  resolvedPaths: z.array(z.string()).optional(),
+});
+export type ClassifyRiskIpcResponse = z.infer<
+  typeof ClassifyRiskIpcResponseSchema
+>;

package/node_modules/@vellumai/gateway-client/src/http-delivery.ts

@@ -131,7 +131,6 @@ function buildManagedOutboundRequestId(
       chatId: payload.chatId,
       text: normalizedText,
       assistantId: payload.assistantId ?? null,
-      chatAction: payload.chatAction ?? null,
       hasAttachments:
         Array.isArray(payload.attachments) && payload.attachments.length > 0,
       approvalRequestId: payload.approval?.requestId ?? null,
@@ -212,7 +211,6 @@ async function deliverManagedOutboundReply(
         chatId: payload.chatId,
         text: payload.text ?? null,
         assistantId: payload.assistantId ?? null,
-        chatAction: payload.chatAction ?? null,
         hasAttachments,
         sourceUpdateId: callback.sourceUpdateId ?? null,
       },
@@ -325,7 +323,12 @@ export async function deliverChannelReply(
 ): Promise<ChannelDeliveryResult> {
   const managedCallback = parseManagedOutboundCallback(callbackUrl);
   if (managedCallback) {
-    await deliverManagedOutboundReply(managedCallback, payload, bearerToken, log);
+    await deliverManagedOutboundReply(
+      managedCallback,
+      payload,
+      bearerToken,
+      log,
+    );
     return { ok: true };
   }
 
@@ -385,17 +388,7 @@ export async function deliverChannelReply(
     // Response may not be JSON for non-Slack channels; that's fine.
   }
 
-  if (payload.chatAction) {
-    log.debug(
-      { chatId: payload.chatId, callbackUrl, chatAction: payload.chatAction },
-      "Channel action delivered",
-    );
-  } else {
-    log.info(
-      { chatId: payload.chatId, callbackUrl },
-      "Channel reply delivered",
-    );
-  }
+  log.info({ chatId: payload.chatId, callbackUrl }, "Channel reply delivered");
 
   return result;
 }

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -26,6 +26,7 @@ export {
   AttachmentMetadataSchema,
   ChannelDeliveryResultSchema,
   ChannelReplyPayloadSchema,
+  MessageAudienceSchema,
   PermissionRequestDetailsSchema,
   SlackStreamOpSchema,
   SlackStreamTaskSchema,
@@ -37,6 +38,7 @@ export type {
   AttachmentMetadata,
   ChannelDeliveryResult,
   ChannelReplyPayload,
+  MessageAudience,
   PermissionRequestDetails,
   SlackStreamOp,
   SlackStreamTask,

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -156,6 +156,26 @@ export const SlackStreamOpSchema = z
 
 export type SlackStreamOp = z.infer<typeof SlackStreamOpSchema>;
 
+// ---------------------------------------------------------------------------
+// Audience
+// ---------------------------------------------------------------------------
+
+/**
+ * Restricts a message to a single reader in a room that has more.
+ *
+ * A single object rather than a flag beside an id, because the two are only
+ * meaningful together: a channel cannot address one reader without knowing
+ * which. Slack reads this as `chat.postEphemeral`; a channel whose rooms hold
+ * one reader already has nothing to do.
+ */
+export const MessageAudienceSchema = z.object({
+  kind: z.literal("oneReader"),
+  /** The reader, in the channel's own id space. */
+  userId: z.string(),
+});
+
+export type MessageAudience = z.infer<typeof MessageAudienceSchema>;
+
 // ---------------------------------------------------------------------------
 // Channel reply payload — the full outbound wire format
 // ---------------------------------------------------------------------------
@@ -163,43 +183,21 @@ export type SlackStreamOp = z.infer<typeof SlackStreamOpSchema>;
 export const ChannelReplyPayloadSchema = z.object({
   chatId: z.string(),
   text: z.string().optional(),
-  /** Pre-formatted Block Kit blocks for Slack delivery. */
-  blocks: z.array(z.custom<KnownBlock>()).optional(),
   assistantId: z.string().optional(),
   attachments: z.array(AttachmentMetadataSchema).optional(),
   approval: ApprovalUIMetadataSchema.optional(),
-  chatAction: z.literal("typing").optional(),
   /**
-   * When true, deliver via `chat.postEphemeral` so only the target `user`
-   * sees the message.
+   * Who may see this message. Absent means everyone in the room, which is the
+   * only safe reading of an absent value: a message meant for one reader that
+   * loses its audience must not become a public one.
    */
-  ephemeral: z.boolean().optional(),
-  /** Slack user ID — required when `ephemeral` is true. */
-  user: z.string().optional(),
-  /** When provided, update an existing message instead of posting a new one. */
-  messageTs: z.string().optional(),
-  /** When true, the daemon generates Block Kit blocks from the text before delivery. */
-  useBlocks: z.boolean().optional(),
-  /** When provided, add or remove an emoji reaction on a message. */
-  reaction: z
-    .object({
-      action: z.enum(["add", "remove"]),
-      name: z.string(),
-      messageTs: z.string(),
-    })
-    .optional(),
-  /** When provided, set or clear the Slack Assistants API thread status. */
-  assistantThreadStatus: z
-    .object({
-      channel: z.string(),
-      threadTs: z.string(),
-      status: z.string(),
-      /** Serialized to Slack as `loading_messages`. */
-      loadingMessages: z.array(z.string()).optional(),
-    })
-    .optional(),
-  /** When provided, perform one Slack streaming operation (start/append/stop). */
-  slackStream: SlackStreamOpSchema.optional(),
+  audience: MessageAudienceSchema.optional(),
+  /**
+   * Asks the channel to render the text richly rather than as plain text.
+   * Each channel decides what that means, and one that cannot ignores it.
+   * Slack is the only channel acting on it today, where it becomes Block Kit.
+   */
+  renderRichly: z.boolean().optional(),
 });
 
 export type ChannelReplyPayload = z.infer<typeof ChannelReplyPayloadSchema>;