@vellumai/assistant 0.11.4 → 0.11.5-dev.202608220019.a778cf0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (457) hide show
  1. package/AGENTS.md +6 -2
  2. package/ARCHITECTURE.md +29 -4
  3. package/README.md +1 -1
  4. package/docs/architecture/memory.md +17 -5
  5. package/docs/architecture/security.md +96 -152
  6. package/docs/guardian-request-flow.md +13 -2
  7. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/package.json +1 -0
  8. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts +118 -0
  9. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts +135 -0
  10. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/index.ts +1 -0
  11. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/ingress.ts +103 -0
  12. package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/url-normalization.ts +107 -0
  13. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/package.json +1 -0
  14. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts +118 -0
  15. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts +135 -0
  16. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/index.ts +1 -0
  17. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/ingress.ts +103 -0
  18. package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/url-normalization.ts +107 -0
  19. package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts +166 -1
  20. package/node_modules/@vellumai/gateway-client/src/http-delivery.ts +7 -14
  21. package/node_modules/@vellumai/gateway-client/src/index.ts +2 -0
  22. package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts +30 -32
  23. package/node_modules/@vellumai/service-contracts/package.json +1 -0
  24. package/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts +118 -0
  25. package/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts +135 -0
  26. package/node_modules/@vellumai/service-contracts/src/index.ts +1 -0
  27. package/node_modules/@vellumai/service-contracts/src/ingress.ts +103 -0
  28. package/node_modules/@vellumai/service-contracts/src/url-normalization.ts +107 -0
  29. package/openapi.yaml +487 -11
  30. package/package.json +1 -1
  31. package/scripts/sync-web-search-catalog.ts +6 -0
  32. package/src/__tests__/anthropic-provider.test.ts +10 -3
  33. package/src/__tests__/approval-interception-trust-gates.test.ts +40 -0
  34. package/src/__tests__/background-workers-disk-pressure.test.ts +1 -1
  35. package/src/__tests__/channel-approval-routes.test.ts +4 -0
  36. package/src/__tests__/channel-inbound-disk-pressure.test.ts +5 -6
  37. package/src/__tests__/channel-readiness-service.test.ts +126 -0
  38. package/src/__tests__/channel-reply-delivery.test.ts +30 -17
  39. package/src/__tests__/checker.test.ts +20 -314
  40. package/src/__tests__/cli-memory-v2-reembed-skills.test.ts +6 -2
  41. package/src/__tests__/client-os-metadata-persistence.test.ts +16 -0
  42. package/src/__tests__/compactor-retained-image-validation.test.ts +142 -0
  43. package/src/__tests__/config-loader-backfill.test.ts +19 -10
  44. package/src/__tests__/container-cpu-sampler.test.ts +153 -0
  45. package/src/__tests__/context-search-memory-v2-source.test.ts +0 -1
  46. package/src/__tests__/conversation-attachments.test.ts +0 -1
  47. package/src/__tests__/conversation-delete-watch-timeline.test.ts +231 -0
  48. package/src/__tests__/conversation-error.test.ts +17 -0
  49. package/src/__tests__/conversation-lifecycle.test.ts +20 -26
  50. package/src/__tests__/conversation-pairing.test.ts +186 -0
  51. package/src/__tests__/conversation-runtime-assembly.test.ts +21 -2
  52. package/src/__tests__/credential-broker-server-use.test.ts +24 -5
  53. package/src/__tests__/credential-routes.test.ts +22 -3
  54. package/src/__tests__/credential-security-invariants.test.ts +2 -1
  55. package/src/__tests__/daemon-credential-client.test.ts +88 -0
  56. package/src/__tests__/default-plugin-names-guard.test.ts +12 -1
  57. package/src/__tests__/dm-backfill.test.ts +63 -0
  58. package/src/__tests__/dynamic-skill-background-guard.test.ts +0 -2
  59. package/src/__tests__/edit-propagation.test.ts +107 -4
  60. package/src/__tests__/events-client-registration.test.ts +28 -0
  61. package/src/__tests__/file-write-tool.test.ts +4 -2
  62. package/src/__tests__/guardian-prompt-notice-privacy.test.ts +133 -0
  63. package/src/__tests__/guardian-verify-setup-skill-regression.test.ts +143 -97
  64. package/src/__tests__/helpers/gateway-classify-mock.ts +27 -6
  65. package/src/__tests__/host-proxy-interface.test.ts +11 -1
  66. package/src/__tests__/host-shell-tool.test.ts +23 -4
  67. package/src/__tests__/image-conversion.test.ts +143 -1
  68. package/src/__tests__/inline-skill-load-permissions.test.ts +47 -36
  69. package/src/__tests__/input-repairs.test.ts +207 -0
  70. package/src/__tests__/live-workspace-guard.test.ts +75 -0
  71. package/src/__tests__/managed-profile-guard.test.ts +4 -2
  72. package/src/__tests__/mcp-abort-signal.test.ts +1 -1
  73. package/src/__tests__/mcp-client-auth.test.ts +1 -1
  74. package/src/__tests__/mcp-tool-annotations-risk.test.ts +1 -1
  75. package/src/__tests__/media-resolve-image-validation.test.ts +310 -0
  76. package/src/__tests__/mtime-cache.test.ts +2 -0
  77. package/src/__tests__/notification-vellum-adapter.test.ts +124 -1
  78. package/src/__tests__/openai-provider.test.ts +40 -0
  79. package/src/__tests__/openai-responses-provider.test.ts +18 -0
  80. package/src/__tests__/personal-memory-auth-bypass.test.ts +22 -6
  81. package/src/__tests__/platform-bash-auto-approve.test.ts +0 -4
  82. package/src/__tests__/platform.test.ts +16 -1
  83. package/src/__tests__/plugin-api-resolve-credential.test.ts +22 -13
  84. package/src/__tests__/plugin-api-shim.test.ts +5 -0
  85. package/src/__tests__/plugin-api-store-credential.test.ts +268 -0
  86. package/src/__tests__/plugin-config-data-migration.test.ts +8 -1
  87. package/src/__tests__/plugin-disabled-state.test.ts +2 -0
  88. package/src/__tests__/plugin-effective-enabled-set.test.ts +55 -3
  89. package/src/__tests__/plugin-execution-context.test.ts +73 -0
  90. package/src/__tests__/plugin-import-boundary-guard.test.ts +0 -1
  91. package/src/__tests__/plugin-import-boundary-reverse-guard.test.ts +0 -1
  92. package/src/__tests__/reaction-persistence.test.ts +200 -7
  93. package/src/__tests__/require-fresh-approval.test.ts +0 -4
  94. package/src/__tests__/resource-pressure-guard.test.ts +428 -0
  95. package/src/__tests__/resource-pressure-routes.test.ts +113 -0
  96. package/src/__tests__/risk-classification-boundary-guard.test.ts +115 -0
  97. package/src/__tests__/run-conversation-turn-persistence.test.ts +27 -1
  98. package/src/__tests__/sanitize-config-for-transfer.test.ts +28 -0
  99. package/src/__tests__/secret-routes-platform-proxy.test.ts +7 -0
  100. package/src/__tests__/settings-routes.test.ts +85 -3
  101. package/src/__tests__/skill-tool-factory.test.ts +161 -0
  102. package/src/__tests__/tool-execution-pipeline.benchmark.test.ts +1 -1
  103. package/src/__tests__/tool-executor-lifecycle-events.test.ts +132 -5
  104. package/src/__tests__/tool-executor.test.ts +63 -38
  105. package/src/__tests__/tool-policy.test.ts +97 -1
  106. package/src/__tests__/trusted-contact-inline-approval-integration.test.ts +7 -4
  107. package/src/__tests__/user-plugin-loader.test.ts +2 -0
  108. package/src/__tests__/validate-input.test.ts +243 -7
  109. package/src/__tests__/verification-control-plane-policy.test.ts +0 -2
  110. package/src/__tests__/voice-scoped-grant-consumer.test.ts +2 -0
  111. package/src/__tests__/voice-session-bridge.test.ts +42 -0
  112. package/src/__tests__/web-search-catalog-parity.test.ts +8 -0
  113. package/src/acp/__tests__/acp-claude-oauth.test.ts +97 -29
  114. package/src/acp/__tests__/prepare-agent-env.test.ts +376 -153
  115. package/src/acp/acp-claude-oauth.ts +38 -21
  116. package/src/acp/prepare-agent-env.ts +146 -55
  117. package/src/agent/loop-tool-dedup.test.ts +161 -0
  118. package/src/agent/loop.ts +68 -22
  119. package/src/api/constants/app-tools.ts +34 -0
  120. package/src/api/constants/profile-config-validation.ts +60 -0
  121. package/src/api/events/resource-pressure-status-changed.ts +53 -0
  122. package/src/api/events/tool-result.ts +6 -1
  123. package/src/api/events/watch-retro-completed.ts +52 -0
  124. package/src/api/index.ts +30 -0
  125. package/src/api/responses/resource-pressure-status.ts +25 -0
  126. package/src/approvals/guardian-channel-delivery.ts +70 -6
  127. package/src/approvals/guardian-request-resolvers.ts +32 -66
  128. package/src/calls/__tests__/voice-session-bridge.test.ts +114 -0
  129. package/src/calls/voice-session-bridge.ts +60 -6
  130. package/src/channels/__tests__/message-audience.test.ts +49 -0
  131. package/src/channels/__tests__/types.test.ts +17 -3
  132. package/src/channels/message-audience.ts +40 -0
  133. package/src/channels/types.ts +16 -12
  134. package/src/cli/__tests__/catalog-search-help.test.ts +50 -0
  135. package/src/cli/commands/__tests__/channel-verification-sessions.test.ts +31 -0
  136. package/src/cli/commands/__tests__/conversations-search.test.ts +289 -0
  137. package/src/cli/commands/__tests__/conversations-slack.test.ts +2 -1
  138. package/src/cli/commands/__tests__/inference-profiles.test.ts +16 -4
  139. package/src/cli/commands/__tests__/inference-providers.test.ts +135 -2
  140. package/src/cli/commands/__tests__/keys.test.ts +89 -8
  141. package/src/cli/commands/__tests__/plugins.test.ts +57 -1
  142. package/src/cli/commands/channel-verification-sessions.help.ts +11 -9
  143. package/src/cli/commands/channel-verification-sessions.ts +11 -21
  144. package/src/cli/commands/conversations.help.ts +34 -0
  145. package/src/cli/commands/conversations.ts +125 -0
  146. package/src/cli/commands/inference-profiles.ts +56 -3
  147. package/src/cli/commands/inference-providers.ts +37 -6
  148. package/src/cli/commands/inference.help.ts +9 -4
  149. package/src/cli/commands/keys.help.ts +13 -1
  150. package/src/cli/commands/keys.ts +26 -15
  151. package/src/cli/commands/memory/__tests__/memory-v2.test.ts +57 -7
  152. package/src/cli/commands/memory/index.help.ts +41 -27
  153. package/src/cli/commands/memory/index.ts +2 -0
  154. package/src/cli/commands/memory/memory-v2.ts +58 -54
  155. package/src/cli/commands/memory/memory-validate.ts +18 -0
  156. package/src/cli/commands/monitoring.ts +1 -0
  157. package/src/cli/commands/oauth/request.test.ts +93 -0
  158. package/src/cli/commands/oauth/request.ts +23 -9
  159. package/src/cli/commands/plugins.help.ts +28 -31
  160. package/src/cli/commands/plugins.ts +10 -0
  161. package/src/cli/commands/skills.help.ts +13 -16
  162. package/src/cli/commands/trust.ts +3 -14
  163. package/src/cli/lib/__tests__/install-from-github.test.ts +38 -0
  164. package/src/cli/lib/__tests__/merge-plugin-tree.test.ts +34 -0
  165. package/src/cli/lib/__tests__/plugin-surfaces.test.ts +32 -1
  166. package/src/cli/lib/__tests__/toggle-plugin.test.ts +2 -1
  167. package/src/cli/lib/__tests__/upgrade-plugin.test.ts +64 -0
  168. package/src/cli/lib/bundled-marketplace.json +26 -0
  169. package/src/cli/lib/daemon-credential-client.ts +25 -3
  170. package/src/cli/lib/install-from-github.ts +35 -24
  171. package/src/cli/lib/merge-plugin-tree.ts +22 -4
  172. package/src/cli/lib/open-browser.test.ts +67 -0
  173. package/src/cli/lib/open-browser.ts +24 -5
  174. package/src/cli/lib/plugin-surfaces.ts +27 -0
  175. package/src/config/__tests__/balanced-model-experiment.test.ts +7 -7
  176. package/src/config/__tests__/default-profile-catalog.test.ts +3 -3
  177. package/src/config/__tests__/profile-materialization.test.ts +26 -0
  178. package/src/config/default-profile-catalog.ts +5 -6
  179. package/src/config/feature-flag-registry.json +36 -28
  180. package/src/config/profile-materialization.ts +29 -0
  181. package/src/config/sanitize-for-transfer.ts +16 -0
  182. package/src/config/schemas/llm.ts +7 -0
  183. package/src/config/schemas/services.ts +6 -0
  184. package/src/config/webhook-routing.ts +8 -0
  185. package/src/context/compactor.ts +31 -2
  186. package/src/context/outbound-sanitize.ts +6 -0
  187. package/src/daemon/__tests__/lifecycle-watch-timeline-sweep.test.ts +98 -0
  188. package/src/daemon/__tests__/provider-rejection-log-fields.test.ts +272 -0
  189. package/src/daemon/conversation-agent-loop-handlers.ts +4 -1
  190. package/src/daemon/conversation-error.ts +19 -2
  191. package/src/daemon/conversation-messaging.ts +22 -2
  192. package/src/daemon/conversation-process.ts +11 -0
  193. package/src/daemon/conversation-store.ts +10 -0
  194. package/src/daemon/conversation-surfaces.ts +21 -8
  195. package/src/daemon/conversation.ts +12 -10
  196. package/src/daemon/daemon-control.ts +1 -0
  197. package/src/daemon/handlers/__tests__/config-ingress-tunnel-records.test.ts +208 -0
  198. package/src/daemon/handlers/config-ingress.ts +115 -5
  199. package/src/daemon/lifecycle.ts +30 -2
  200. package/src/daemon/message-types/conversations.ts +5 -7
  201. package/src/daemon/message-types/web-activity.ts +3 -2
  202. package/src/daemon/provider-rejection-log-fields.ts +124 -0
  203. package/src/daemon/resource-pressure-guard-lifecycle.ts +66 -0
  204. package/src/daemon/resource-pressure-guard.ts +387 -0
  205. package/src/daemon/shutdown-handlers.ts +2 -0
  206. package/src/daemon/startup-error.ts +16 -0
  207. package/src/daemon/trust-context.ts +14 -10
  208. package/src/daemon/unsendable-image-notice.ts +76 -0
  209. package/src/hooks/registry.ts +65 -51
  210. package/src/inbound/__tests__/tunnel-probe.test.ts +448 -0
  211. package/src/inbound/tunnel-probe.ts +261 -0
  212. package/src/ipc/__tests__/socket-path.test.ts +15 -7
  213. package/src/ipc/gateway-client.test.ts +1 -1
  214. package/src/ipc/gateway-client.ts +14 -21
  215. package/src/ipc/socket-cleanup.ts +2 -11
  216. package/src/mcp/__tests__/mcp-auth-orchestrator.test.ts +1 -1
  217. package/src/messaging/provider-message-metadata.ts +128 -0
  218. package/src/messaging/providers/__tests__/transport-dispatch.test.ts +138 -73
  219. package/src/messaging/providers/channel-transport.ts +100 -16
  220. package/src/messaging/providers/discord/send.ts +16 -0
  221. package/src/messaging/providers/discord/transport.ts +23 -1
  222. package/src/messaging/providers/index.ts +84 -16
  223. package/src/messaging/providers/slack/message-metadata.ts +45 -0
  224. package/src/messaging/providers/slack/render-transcript.ts +1 -4
  225. package/src/messaging/providers/slack/send.test.ts +88 -34
  226. package/src/messaging/providers/slack/send.ts +99 -50
  227. package/src/messaging/providers/slack/transport.ts +35 -37
  228. package/src/messaging/providers/telegram-bot/send.test.ts +88 -18
  229. package/src/messaging/providers/telegram-bot/send.ts +36 -0
  230. package/src/messaging/providers/telegram-bot/transport.ts +22 -8
  231. package/src/messaging/read-provider-metadata.test.ts +157 -0
  232. package/src/messaging/read-provider-metadata.ts +51 -0
  233. package/src/notifications/__tests__/assistant-reply-producer.test.ts +94 -0
  234. package/src/notifications/__tests__/edit-notification.test.ts +174 -2
  235. package/src/notifications/__tests__/home-feed-side-effect.test.ts +536 -4
  236. package/src/notifications/adapters/macos.ts +55 -0
  237. package/src/notifications/adapters/slack.ts +10 -5
  238. package/src/notifications/assistant-reply-producer.ts +37 -4
  239. package/src/notifications/conversation-pairing.ts +111 -21
  240. package/src/notifications/edit-notification.ts +38 -8
  241. package/src/notifications/emit-signal.ts +12 -14
  242. package/src/notifications/home-feed-side-effect.ts +218 -15
  243. package/src/notifications/types.ts +5 -0
  244. package/src/permissions/AGENTS.md +16 -0
  245. package/src/permissions/checker.test.ts +75 -122
  246. package/src/permissions/checker.ts +44 -560
  247. package/src/permissions/confirmation-guardian-request.test.ts +28 -3
  248. package/src/permissions/confirmation-guardian-request.ts +5 -1
  249. package/src/persistence/conversation-crud.ts +69 -20
  250. package/src/persistence/conversation-queries.ts +14 -1
  251. package/src/persistence/conversation-types.ts +22 -0
  252. package/src/persistence/db-async-query.ts +2 -1
  253. package/src/persistence/db-maintenance.ts +15 -0
  254. package/src/persistence/delivery-crud.ts +122 -15
  255. package/src/persistence/embeddings/qdrant-manager.ts +1 -0
  256. package/src/persistence/migrations/367-create-watch-timeline-entries.ts +46 -0
  257. package/src/persistence/migrations/368-watch-timeline-screenshot-blob.ts +33 -0
  258. package/src/persistence/migrations/__tests__/367-create-watch-timeline-entries.test.ts +98 -0
  259. package/src/persistence/migrations/__tests__/368-watch-timeline-screenshot-blob.test.ts +98 -0
  260. package/src/persistence/schema/index.ts +1 -0
  261. package/src/persistence/schema/watch.ts +29 -0
  262. package/src/persistence/steps.ts +4 -0
  263. package/src/plugin-api/__tests__/import-graph-partial-mock.test.ts +67 -0
  264. package/src/plugin-api/conversation-turn.ts +27 -0
  265. package/src/plugin-api/credential-scope.test.ts +15 -0
  266. package/src/plugin-api/credential-scope.ts +14 -0
  267. package/src/plugin-api/index.ts +19 -1
  268. package/src/plugin-api/resolve-credential.ts +15 -10
  269. package/src/plugin-api/store-credential.ts +148 -0
  270. package/src/plugin-api/system-card.ts +36 -0
  271. package/src/plugin-api/vision-support.test.ts +82 -0
  272. package/src/plugin-api/vision-support.ts +14 -2
  273. package/src/plugins/defaults/image-fallback/__tests__/image-fallback.test.ts +361 -110
  274. package/src/plugins/defaults/image-fallback/__tests__/vision-recovery.test.ts +4 -0
  275. package/src/plugins/defaults/image-fallback/hooks/user-prompt-submit.ts +58 -0
  276. package/src/plugins/defaults/image-fallback/src/caption-blocks.ts +64 -23
  277. package/src/plugins/defaults/image-recovery/detect.ts +24 -1
  278. package/src/plugins/defaults/main.ts +15 -0
  279. package/src/plugins/defaults/memory/AGENTS.md +11 -3
  280. package/src/plugins/defaults/memory/__tests__/memory-tier-boundary-guard.test.ts +0 -1
  281. package/src/plugins/defaults/memory/graph-topology/pending-buffer.ts +9 -12
  282. package/src/plugins/defaults/memory/memory-retrospective-prompt.ts +1 -1
  283. package/src/plugins/defaults/memory/src/memory-v2-routes.ts +12 -10
  284. package/src/plugins/defaults/memory/substrate/__tests__/consolidation-job.test.ts +114 -0
  285. package/src/plugins/defaults/memory/substrate/__tests__/consolidation-prompt-flag-gating-guard.test.ts +8 -0
  286. package/src/plugins/defaults/memory/substrate/__tests__/edge-index.test.ts +0 -30
  287. package/src/plugins/defaults/memory/substrate/__tests__/ingest.test.ts +73 -1
  288. package/src/plugins/defaults/memory/substrate/__tests__/page-index.test.ts +37 -0
  289. package/src/plugins/defaults/memory/substrate/__tests__/page-links.test.ts +208 -0
  290. package/src/plugins/defaults/memory/substrate/__tests__/prompts-consolidation.test.ts +158 -1
  291. package/src/plugins/defaults/memory/substrate/__tests__/static-context.test.ts +1 -61
  292. package/src/plugins/defaults/memory/substrate/consolidation-job.ts +68 -6
  293. package/src/plugins/defaults/memory/substrate/edge-index.ts +0 -31
  294. package/src/plugins/defaults/memory/substrate/ingest.ts +59 -0
  295. package/src/plugins/defaults/memory/substrate/page-index.ts +35 -8
  296. package/src/plugins/defaults/memory/substrate/page-links.ts +133 -0
  297. package/src/plugins/defaults/memory/substrate/page-store.ts +10 -0
  298. package/src/plugins/defaults/memory/substrate/prompts/consolidation.ts +124 -34
  299. package/src/plugins/defaults/memory/substrate/static-context.ts +0 -29
  300. package/src/plugins/defaults/memory/v3/__tests__/shadow-plugin.test.ts +3 -1
  301. package/src/plugins/defaults/memory/v3/card.ts +9 -9
  302. package/src/plugins/defaults/memory/v3/core-set.test.ts +7 -0
  303. package/src/plugins/defaults/memory/v3/core-set.ts +5 -1
  304. package/src/plugins/defaults/memory/v3/edge.ts +13 -57
  305. package/src/plugins/mtime-cache.ts +1 -1
  306. package/src/plugins/pipeline.ts +14 -7
  307. package/src/plugins/plugin-execution-context.ts +35 -11
  308. package/src/plugins/plugin-tree-walk.ts +63 -4
  309. package/src/providers/__tests__/retry-network-error.test.ts +84 -0
  310. package/src/providers/anthropic/__tests__/pause-turn-continuation.test.ts +170 -0
  311. package/src/providers/anthropic/client.ts +332 -241
  312. package/src/providers/connection-resolution.ts +25 -2
  313. package/src/providers/content-blocks.ts +22 -0
  314. package/src/providers/fetch-provider-catalog.ts +19 -0
  315. package/src/providers/gemini/client.ts +5 -2
  316. package/src/providers/inference/__tests__/adapter-factory-litellm.test.ts +47 -1
  317. package/src/providers/inference/__tests__/adapter-factory-ollama.test.ts +83 -0
  318. package/src/providers/inference/__tests__/adapter-factory-openai-compatible.test.ts +98 -1
  319. package/src/providers/inference/__tests__/base-url-route-validation.test.ts +38 -0
  320. package/src/providers/inference/__tests__/base-url-security.test.ts +10 -0
  321. package/src/providers/inference/__tests__/connections-ollama.test.ts +90 -0
  322. package/src/providers/inference/__tests__/endpoint-probe.test.ts +92 -0
  323. package/src/providers/inference/__tests__/missing-credential-guard.test.ts +117 -0
  324. package/src/providers/inference/__tests__/profile-config-validation.test.ts +39 -0
  325. package/src/providers/inference/__tests__/profile-probe-classify.test.ts +66 -0
  326. package/src/providers/inference/adapter-factory.ts +33 -2
  327. package/src/providers/inference/auth.ts +13 -2
  328. package/src/providers/inference/credential-usage.ts +37 -0
  329. package/src/providers/inference/endpoint-probe.ts +115 -0
  330. package/src/providers/inference/missing-credential-guard.ts +110 -0
  331. package/src/providers/inference/profile-probe.ts +256 -0
  332. package/src/providers/inference/resolve-auth.ts +7 -7
  333. package/src/providers/media-resolve.ts +176 -15
  334. package/src/providers/model-catalog.ts +10 -0
  335. package/src/providers/openai/__tests__/api-error-normalization.test.ts +17 -1
  336. package/src/providers/openai/__tests__/chat-completions-provider-reasoning.test.ts +576 -46
  337. package/src/providers/openai/__tests__/connection-error-wrap.test.ts +44 -0
  338. package/src/providers/openai/__tests__/tool-choice-mapping.test.ts +125 -2
  339. package/src/providers/openai/api-error-normalization.ts +16 -2
  340. package/src/providers/openai/chat-completions-provider.ts +326 -44
  341. package/src/providers/openai/responses-provider.ts +5 -2
  342. package/src/providers/provider-send-message.ts +11 -0
  343. package/src/providers/retry.ts +6 -0
  344. package/src/providers/search-provider-catalog.ts +20 -0
  345. package/src/routes/route-host-protocol.ts +7 -0
  346. package/src/routes/worker.ts +31 -10
  347. package/src/runtime/AGENTS.md +36 -0
  348. package/src/runtime/__tests__/host-observe.test.ts +302 -0
  349. package/src/runtime/__tests__/runtime-http-port-collision.test.ts +131 -0
  350. package/src/runtime/__tests__/web-presence.test.ts +234 -0
  351. package/src/runtime/assistant-event-hub.ts +38 -0
  352. package/src/runtime/channel-readiness-service.ts +39 -13
  353. package/src/runtime/channel-readiness-types.ts +49 -2
  354. package/src/runtime/channel-reply-delivery.ts +55 -32
  355. package/src/runtime/channel-retry-sweep.ts +6 -4
  356. package/src/runtime/effective-capabilities.test.ts +19 -0
  357. package/src/runtime/effective-capabilities.ts +25 -0
  358. package/src/runtime/guardian-reply-router.ts +6 -2
  359. package/src/runtime/host-observe.ts +246 -0
  360. package/src/runtime/http-errors.ts +1 -0
  361. package/src/runtime/http-server.ts +185 -6
  362. package/src/runtime/routes/__tests__/client-routes.test.ts +150 -0
  363. package/src/runtime/routes/__tests__/conversation-list-routes.test.ts +133 -0
  364. package/src/runtime/routes/__tests__/conversation-query-routes.test.ts +80 -0
  365. package/src/runtime/routes/__tests__/credential-delete-in-use.test.ts +155 -0
  366. package/src/runtime/routes/__tests__/inference-profiles-routes.test.ts +118 -0
  367. package/src/runtime/routes/__tests__/inference-provider-connection-routes.test.ts +72 -1
  368. package/src/runtime/routes/__tests__/ingress-status-routes.test.ts +508 -0
  369. package/src/runtime/routes/__tests__/monitoring-routes.test.ts +1 -0
  370. package/src/runtime/routes/__tests__/pending-interactions-route.test.ts +175 -0
  371. package/src/runtime/routes/__tests__/plugins-routes.test.ts +103 -71
  372. package/src/runtime/routes/__tests__/surface-action-routes.test.ts +55 -6
  373. package/src/runtime/routes/__tests__/system-card-turn-termination.test.ts +107 -0
  374. package/src/runtime/routes/__tests__/user-route-dispatcher-host.test.ts +52 -1
  375. package/src/runtime/routes/__tests__/user-route-dispatcher.test.ts +75 -4
  376. package/src/runtime/routes/__tests__/watch-routes-guardian-cache.test.ts +139 -0
  377. package/src/runtime/routes/__tests__/watch-routes.test.ts +598 -0
  378. package/src/runtime/routes/approval-routes.ts +37 -4
  379. package/src/runtime/routes/approval-strategies/guardian-text-engine-strategy.ts +16 -22
  380. package/src/runtime/routes/canned-message-complete.ts +68 -29
  381. package/src/runtime/routes/channel-readiness-routes.ts +14 -2
  382. package/src/runtime/routes/client-routes.ts +113 -0
  383. package/src/runtime/routes/conversation-list-routes.ts +22 -7
  384. package/src/runtime/routes/conversation-management-routes.ts +15 -9
  385. package/src/runtime/routes/conversation-query-routes.ts +10 -0
  386. package/src/runtime/routes/conversation-routes.ts +36 -22
  387. package/src/runtime/routes/credential-in-use.ts +85 -0
  388. package/src/runtime/routes/credential-routes.ts +55 -85
  389. package/src/runtime/routes/guardian-approval-interception.ts +44 -53
  390. package/src/runtime/routes/guardian-approval-reply-helpers.ts +14 -12
  391. package/src/runtime/routes/host-cu-routes.ts +18 -0
  392. package/src/runtime/routes/identity-routes.ts +5 -121
  393. package/src/runtime/routes/inbound-message-handler.ts +74 -30
  394. package/src/runtime/routes/inbound-stages/acl-enforcement.ts +16 -17
  395. package/src/runtime/routes/inbound-stages/background-dispatch.test.ts +182 -297
  396. package/src/runtime/routes/inbound-stages/background-dispatch.ts +173 -386
  397. package/src/runtime/routes/inbound-stages/edit-intercept.ts +101 -77
  398. package/src/runtime/routes/inbound-stages/guardian-reply-intercept.ts +17 -8
  399. package/src/runtime/routes/inbound-stages/reaction-intercept.test.ts +91 -7
  400. package/src/runtime/routes/inbound-stages/reaction-intercept.ts +72 -70
  401. package/src/runtime/routes/index.ts +4 -0
  402. package/src/runtime/routes/inference-profiles-routes.ts +232 -31
  403. package/src/runtime/routes/inference-provider-connection-routes.ts +33 -11
  404. package/src/runtime/routes/ingress-status-routes.ts +180 -0
  405. package/src/runtime/routes/monitoring-routes.ts +9 -1
  406. package/src/runtime/routes/oauth-commands-routes.ts +1 -1
  407. package/src/runtime/routes/plugins-routes.ts +28 -32
  408. package/src/runtime/routes/resource-pressure-routes.ts +22 -0
  409. package/src/runtime/routes/secret-routes.ts +39 -8
  410. package/src/runtime/routes/settings-routes.ts +15 -12
  411. package/src/runtime/routes/surface-action-routes.ts +20 -19
  412. package/src/runtime/routes/user-route-dispatcher.ts +31 -2
  413. package/src/runtime/routes/user-route-resolution.ts +18 -1
  414. package/src/runtime/routes/watch-routes.ts +807 -0
  415. package/src/runtime/slack-reply-session.test.ts +23 -13
  416. package/src/runtime/slack-reply-session.ts +38 -55
  417. package/src/runtime/web-presence.ts +90 -0
  418. package/src/security/__tests__/untrusted-content.test.ts +42 -0
  419. package/src/security/untrusted-content.ts +28 -9
  420. package/src/skills/validate-input.ts +177 -40
  421. package/src/subagent/__tests__/consult-context-gating.test.ts +6 -10
  422. package/src/subagent/consult-context.ts +7 -23
  423. package/src/tools/credentials/broker.ts +24 -79
  424. package/src/tools/credentials/ref-parse.ts +35 -0
  425. package/src/tools/credentials/resolve.ts +4 -10
  426. package/src/tools/credentials/store.ts +168 -0
  427. package/src/tools/credentials/tool-policy.ts +67 -0
  428. package/src/tools/executor.ts +53 -15
  429. package/src/tools/network/__tests__/firecrawl-compat.test.ts +77 -0
  430. package/src/tools/network/__tests__/web-fetch-fastcrw.test.ts +169 -0
  431. package/src/tools/network/__tests__/web-search.test.ts +138 -3
  432. package/src/tools/network/firecrawl-compat.ts +90 -0
  433. package/src/tools/network/url-safety.ts +9 -16
  434. package/src/tools/network/web-fetch.ts +142 -62
  435. package/src/tools/network/web-search.ts +162 -58
  436. package/src/tools/permission-checker.ts +43 -52
  437. package/src/tools/schema-transforms.ts +40 -5
  438. package/src/tools/shared/input-repairs.ts +160 -0
  439. package/src/tools/skills/skill-tool-factory.ts +18 -4
  440. package/src/tools/subagent/spawn.ts +0 -1
  441. package/src/tools/tool-approval-handler.ts +16 -10
  442. package/src/tools/tool-types.ts +26 -13
  443. package/src/tools/types.ts +6 -6
  444. package/src/util/__tests__/cgroup-memory.test.ts +3 -0
  445. package/src/util/cgroup-memory.ts +3 -0
  446. package/src/util/container-cpu-sampler.ts +250 -0
  447. package/src/util/image-conversion.ts +178 -14
  448. package/src/util/platform.ts +93 -10
  449. package/src/util/worker-process.ts +1 -0
  450. package/src/watch/__tests__/watch-retro.test.ts +665 -0
  451. package/src/watch/__tests__/watch-session-manager.test.ts +566 -0
  452. package/src/watch/__tests__/watch-timeline.test.ts +670 -0
  453. package/src/watch/watch-retro.ts +480 -0
  454. package/src/watch/watch-session-manager.ts +575 -0
  455. package/src/watch/watch-timeline.ts +848 -0
  456. package/src/permissions/ipc-risk-types.ts +0 -143
  457. package/src/permissions/risk-types.ts +0 -76
package/openapi.yaml CHANGED
@@ -3,7 +3,7 @@
3
3
  openapi: 3.1.0
4
4
  info:
5
5
  title: Vellum Assistant API
6
- version: 0.11.4
6
+ version: 0.11.5
7
7
  description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
8
8
  servers:
9
9
  - url: http://127.0.0.1:7821
@@ -4360,7 +4360,17 @@ paths:
4360
4360
  setupStatus:
4361
4361
  anyOf:
4362
4362
  - type: string
4363
+ enum:
4364
+ - not_configured
4365
+ - incomplete
4366
+ - ready
4363
4367
  - type: "null"
4368
+ health:
4369
+ type: string
4370
+ enum:
4371
+ - ok
4372
+ - failing
4373
+ - unknown
4364
4374
  checkedAt:
4365
4375
  anyOf:
4366
4376
  - type: number
@@ -4370,7 +4380,16 @@ paths:
4370
4380
  reasons:
4371
4381
  type: array
4372
4382
  items:
4373
- type: string
4383
+ type: object
4384
+ properties:
4385
+ code:
4386
+ type: string
4387
+ text:
4388
+ type: string
4389
+ required:
4390
+ - code
4391
+ - text
4392
+ additionalProperties: false
4374
4393
  localChecks:
4375
4394
  type: array
4376
4395
  items:
@@ -4384,6 +4403,13 @@ paths:
4384
4403
  anyOf:
4385
4404
  - type: string
4386
4405
  - type: "null"
4406
+ indeterminate:
4407
+ type: boolean
4408
+ kind:
4409
+ type: string
4410
+ enum:
4411
+ - configuration
4412
+ - operational
4387
4413
  required:
4388
4414
  - name
4389
4415
  - passed
@@ -4401,6 +4427,13 @@ paths:
4401
4427
  anyOf:
4402
4428
  - type: string
4403
4429
  - type: "null"
4430
+ indeterminate:
4431
+ type: boolean
4432
+ kind:
4433
+ type: string
4434
+ enum:
4435
+ - configuration
4436
+ - operational
4404
4437
  required:
4405
4438
  - name
4406
4439
  - passed
@@ -4482,7 +4515,17 @@ paths:
4482
4515
  setupStatus:
4483
4516
  anyOf:
4484
4517
  - type: string
4518
+ enum:
4519
+ - not_configured
4520
+ - incomplete
4521
+ - ready
4485
4522
  - type: "null"
4523
+ health:
4524
+ type: string
4525
+ enum:
4526
+ - ok
4527
+ - failing
4528
+ - unknown
4486
4529
  checkedAt:
4487
4530
  anyOf:
4488
4531
  - type: number
@@ -4492,7 +4535,16 @@ paths:
4492
4535
  reasons:
4493
4536
  type: array
4494
4537
  items:
4495
- type: string
4538
+ type: object
4539
+ properties:
4540
+ code:
4541
+ type: string
4542
+ text:
4543
+ type: string
4544
+ required:
4545
+ - code
4546
+ - text
4547
+ additionalProperties: false
4496
4548
  localChecks:
4497
4549
  type: array
4498
4550
  items:
@@ -4506,6 +4558,13 @@ paths:
4506
4558
  anyOf:
4507
4559
  - type: string
4508
4560
  - type: "null"
4561
+ indeterminate:
4562
+ type: boolean
4563
+ kind:
4564
+ type: string
4565
+ enum:
4566
+ - configuration
4567
+ - operational
4509
4568
  required:
4510
4569
  - name
4511
4570
  - passed
@@ -4523,6 +4582,13 @@ paths:
4523
4582
  anyOf:
4524
4583
  - type: string
4525
4584
  - type: "null"
4585
+ indeterminate:
4586
+ type: boolean
4587
+ kind:
4588
+ type: string
4589
+ enum:
4590
+ - configuration
4591
+ - operational
4526
4592
  required:
4527
4593
  - name
4528
4594
  - passed
@@ -4651,6 +4717,47 @@ paths:
4651
4717
  required:
4652
4718
  - recorded
4653
4719
  additionalProperties: false
4720
+ /v1/clients/web-presence:
4721
+ post:
4722
+ operationId: clients_webpresence_post
4723
+ summary: Report web tab visibility and focused conversation
4724
+ description:
4725
+ Record the visibility and focused conversation reported by the web client identified by the
4726
+ X-Vellum-Client-Id header.
4727
+ tags:
4728
+ - clients
4729
+ requestBody:
4730
+ required: true
4731
+ content:
4732
+ application/json:
4733
+ schema:
4734
+ type: object
4735
+ properties:
4736
+ visible:
4737
+ type: boolean
4738
+ description: Whether the reporting tab is currently visible.
4739
+ focusedConversationId:
4740
+ anyOf:
4741
+ - type: string
4742
+ - type: "null"
4743
+ description: The conversation currently focused (chat composer on screen) in the tab, or null.
4744
+ required:
4745
+ - visible
4746
+ - focusedConversationId
4747
+ responses:
4748
+ "200":
4749
+ description: Successful response
4750
+ content:
4751
+ application/json:
4752
+ schema:
4753
+ type: object
4754
+ properties:
4755
+ recorded:
4756
+ type: boolean
4757
+ description: Whether a connected client matched the reporting clientId.
4758
+ required:
4759
+ - recorded
4760
+ additionalProperties: false
4654
4761
  /v1/config:
4655
4762
  get:
4656
4763
  operationId: config_get
@@ -5026,6 +5133,8 @@ paths:
5026
5133
  provider_connection:
5027
5134
  type: string
5028
5135
  minLength: 1
5136
+ allowUnlisted:
5137
+ type: boolean
5029
5138
  status:
5030
5139
  anyOf:
5031
5140
  - $ref: "#/components/schemas/ProfileStatus"
@@ -6608,6 +6717,20 @@ paths:
6608
6717
  predicate behind the unread count and the section index, so a client that keeps no complete conversation
6609
6718
  list can ask for exactly the rows its attention surfaces need. Composes with every other filter. Any value
6610
6719
  other than "true" is rejected. Omit to span every conversation.'
6720
+ - name: foregroundOnly
6721
+ in: query
6722
+ required: false
6723
+ schema:
6724
+ type: string
6725
+ enum:
6726
+ - "true"
6727
+ description:
6728
+ Pass "true" to return only user-facing foreground conversations, dropping the automated background and
6729
+ scheduled runs the standard listing admits when they are filed in a custom group (a surfaced run stays).
6730
+ This is the same predicate the unread count and the section index apply, so a client can ask for the newest
6731
+ conversation a user can open in one row instead of paging past runs it would skip. Composes with every other
6732
+ filter; a foreground-only first page never has pinned rows appended to it. Any value other than "true" is
6733
+ rejected. Omit to keep every visible row.
6611
6734
  responses:
6612
6735
  "200":
6613
6736
  description: Successful response
@@ -9831,7 +9954,10 @@ paths:
9831
9954
  post:
9832
9955
  operationId: credentials_delete_post
9833
9956
  summary: Delete a credential
9834
- description: Remove a secret, its metadata, and any associated OAuth connection from the vault.
9957
+ description:
9958
+ Remove a secret, its metadata, and any associated OAuth connection from the vault. Refused with
9959
+ CREDENTIAL_IN_USE while an LLM provider connection resolves its auth through the credential, unless `force` is
9960
+ set.
9835
9961
  tags:
9836
9962
  - credentials
9837
9963
  requestBody:
@@ -9847,6 +9973,9 @@ paths:
9847
9973
  field:
9848
9974
  type: string
9849
9975
  description: Field name
9976
+ force:
9977
+ description: Delete even when provider connections depend on the credential
9978
+ type: boolean
9850
9979
  required:
9851
9980
  - service
9852
9981
  - field
@@ -9862,9 +9991,15 @@ paths:
9862
9991
  type: string
9863
9992
  field:
9864
9993
  type: string
9994
+ affectedConnections:
9995
+ type: array
9996
+ items:
9997
+ type: string
9998
+ description: Provider connections that depended on the deleted credential
9865
9999
  required:
9866
10000
  - service
9867
10001
  - field
10002
+ - affectedConnections
9868
10003
  additionalProperties: false
9869
10004
  /v1/credentials/inspect:
9870
10005
  post:
@@ -14862,6 +14997,38 @@ paths:
14862
14997
  description: Invalid fields, a profile that cannot serve requests, or attempt to edit a managed profile
14863
14998
  "404":
14864
14999
  description: Profile not found
15000
+ /v1/inference/profiles/{name}/validate:
15001
+ post:
15002
+ operationId: inference_profiles_by_name_validate_post
15003
+ summary: Probe a saved profile with one minimal request
15004
+ description:
15005
+ "Dispatch one minimal test request through the named profile's resolved model and connection, and classify
15006
+ any failure by which object the user should fix (the profile vs its provider connection). Advisory: the probe
15007
+ never mutates the profile. Returns a null check when there is no verdict to give (missing, disabled, managed, or
15008
+ routing-identity profiles, or a probe timeout). The probe spends one tiny request on the profile's own key."
15009
+ tags:
15010
+ - inference
15011
+ parameters:
15012
+ - name: name
15013
+ in: path
15014
+ required: true
15015
+ schema:
15016
+ type: string
15017
+ responses:
15018
+ "200":
15019
+ description: Successful response
15020
+ content:
15021
+ application/json:
15022
+ schema:
15023
+ type: object
15024
+ properties:
15025
+ check:
15026
+ anyOf:
15027
+ - $ref: "#/components/schemas/InferenceProfileCheck"
15028
+ - type: "null"
15029
+ required:
15030
+ - check
15031
+ additionalProperties: false
14865
15032
  /v1/inference/provider-connections:
14866
15033
  get:
14867
15034
  operationId: inference_providerconnections_get
@@ -14943,7 +15110,7 @@ paths:
14943
15110
  content:
14944
15111
  application/json:
14945
15112
  schema:
14946
- $ref: "#/components/schemas/ProviderConnection"
15113
+ $ref: "#/components/schemas/SavedProviderConnection"
14947
15114
  "400":
14948
15115
  description: Invalid provider or auth schema
14949
15116
  "409":
@@ -15054,7 +15221,7 @@ paths:
15054
15221
  content:
15055
15222
  application/json:
15056
15223
  schema:
15057
- $ref: "#/components/schemas/ProviderConnection"
15224
+ $ref: "#/components/schemas/SavedProviderConnection"
15058
15225
  "400":
15059
15226
  description: Invalid auth schema, or attempt to change auth on a managed connection
15060
15227
  "404":
@@ -15401,6 +15568,67 @@ paths:
15401
15568
  - localGatewayTarget
15402
15569
  - success
15403
15570
  additionalProperties: false
15571
+ /v1/integrations/ingress/status:
15572
+ get:
15573
+ operationId: integrations_ingress_status_get
15574
+ summary: Get ingress tunnel status
15575
+ description:
15576
+ Probe the configured public ingress URL and report whether a tunnel is serving this assistant.
15577
+ `unconfigured` means no tunnel has ever been recorded (or the ingress is managed for this assistant, as it is
15578
+ when platform-hosted or fronted by a Velay tunnel), `stopped` means a tunnel ran before and is not running now
15579
+ (callback ingress is explicitly switched off, or its URL is gone), `healthy` means the URL answers and fronts
15580
+ this assistant's web app, `unpairable` means it answers but does not serve that app, so a pairing link minted
15581
+ against it would not open, `unreachable` means it does not answer, and `foreign` means it answers for a
15582
+ different assistant. `lastTunnel` names the tunnel to restart, on the states where a recorded one applies to the
15583
+ configured URL.
15584
+ tags:
15585
+ - config
15586
+ responses:
15587
+ "200":
15588
+ description: Successful response
15589
+ content:
15590
+ application/json:
15591
+ schema:
15592
+ type: object
15593
+ properties:
15594
+ state:
15595
+ type: string
15596
+ enum:
15597
+ - unconfigured
15598
+ - stopped
15599
+ - healthy
15600
+ - unpairable
15601
+ - unreachable
15602
+ - foreign
15603
+ publicBaseUrl:
15604
+ description: The probed URL. Set for healthy, unpairable, unreachable, and foreign.
15605
+ type: string
15606
+ lastTunnel:
15607
+ description:
15608
+ The tunnel to restart. Set on stopped whenever one is recorded, and on unpairable, unreachable and foreign
15609
+ when the recorded tunnel fronted the configured URL.
15610
+ type: object
15611
+ properties:
15612
+ provider:
15613
+ type: string
15614
+ publicBaseUrl:
15615
+ type: string
15616
+ required:
15617
+ - provider
15618
+ - publicBaseUrl
15619
+ additionalProperties: false
15620
+ servingAssistantName:
15621
+ description: Name the edge serves under. Set for foreign when it reports one.
15622
+ type: string
15623
+ detail:
15624
+ description: Short failure reason, free of the URL. Set for unreachable, and for unpairable when the edge gave one.
15625
+ type: string
15626
+ checkedAt:
15627
+ description: ISO-8601 instant the probe finished. Set whenever one ran.
15628
+ type: string
15629
+ required:
15630
+ - state
15631
+ additionalProperties: false
15404
15632
  /v1/integrations/oauth/start:
15405
15633
  post:
15406
15634
  operationId: integrations_oauth_start_post
@@ -18987,6 +19215,7 @@ paths:
18987
19215
  - tavily
18988
19216
  - keenable
18989
19217
  - firecrawl
19218
+ - fastcrw
18990
19219
  resultCount:
18991
19220
  type: number
18992
19221
  durationMs:
@@ -19039,6 +19268,7 @@ paths:
19039
19268
  enum:
19040
19269
  - default
19041
19270
  - firecrawl
19271
+ - fastcrw
19042
19272
  status:
19043
19273
  type: number
19044
19274
  contentType:
@@ -19496,6 +19726,7 @@ paths:
19496
19726
  - tavily
19497
19727
  - keenable
19498
19728
  - firecrawl
19729
+ - fastcrw
19499
19730
  resultCount:
19500
19731
  type: number
19501
19732
  durationMs:
@@ -19548,6 +19779,7 @@ paths:
19548
19779
  enum:
19549
19780
  - default
19550
19781
  - firecrawl
19782
+ - fastcrw
19551
19783
  status:
19552
19784
  type: number
19553
19785
  contentType:
@@ -21445,6 +21677,10 @@ paths:
21445
21677
  anyOf:
21446
21678
  - type: number
21447
21679
  - type: "null"
21680
+ inactiveFileBytes:
21681
+ anyOf:
21682
+ - type: number
21683
+ - type: "null"
21448
21684
  kernelBytes:
21449
21685
  anyOf:
21450
21686
  - type: number
@@ -21468,6 +21704,7 @@ paths:
21468
21704
  required:
21469
21705
  - anonBytes
21470
21706
  - fileBytes
21707
+ - inactiveFileBytes
21471
21708
  - kernelBytes
21472
21709
  - slabReclaimableBytes
21473
21710
  - slabUnreclaimableBytes
@@ -23021,6 +23258,51 @@ paths:
23021
23258
  additionalProperties: {}
23022
23259
  - type: "null"
23023
23260
  description: Pending secret request or null
23261
+ pendingQuestion:
23262
+ anyOf:
23263
+ - type: object
23264
+ properties:
23265
+ requestId:
23266
+ type: string
23267
+ entries:
23268
+ type: array
23269
+ items:
23270
+ type: object
23271
+ properties:
23272
+ id:
23273
+ type: string
23274
+ question:
23275
+ type: string
23276
+ description:
23277
+ type: string
23278
+ options:
23279
+ type: array
23280
+ items:
23281
+ type: object
23282
+ properties:
23283
+ id:
23284
+ type: string
23285
+ label:
23286
+ type: string
23287
+ description:
23288
+ type: string
23289
+ required:
23290
+ - id
23291
+ - label
23292
+ additionalProperties: false
23293
+ freeTextPlaceholder:
23294
+ type: string
23295
+ required:
23296
+ - id
23297
+ - question
23298
+ - options
23299
+ additionalProperties: false
23300
+ required:
23301
+ - requestId
23302
+ - entries
23303
+ additionalProperties: false
23304
+ - type: "null"
23305
+ description: Outstanding ask_question prompt or null
23024
23306
  interactions:
23025
23307
  type: array
23026
23308
  items:
@@ -23980,10 +24262,11 @@ paths:
23980
24262
  summary: Disable a plugin
23981
24263
  description:
23982
24264
  Disable a plugin in this workspace by dropping a `.disabled` sentinel, mirroring the CLI's `assistant
23983
- plugins disable <name>`. The change is honored live at read time by every tool / injector / hook gate — no
23984
- restart required. Broadcasts a `sync_changed` invalidation carrying the `plugins:list` tag so other clients
23985
- refetch `GET /v1/plugins`. An already-disabled plugin returns 409; a user plugin with no directory returns 404
23986
- (default plugins are stubbed on demand via the `default-` prefix); a malformed name returns 400.
24265
+ plugins disable <name>`. Awaits the same source reconcile enable uses so the plugin's shutdown hook runs. Tools,
24266
+ injectors, and hook gates also honor the sentinel at read time. Broadcasts a `sync_changed` invalidation
24267
+ carrying the `plugins:list` tag so other clients refetch `GET /v1/plugins`. An already-disabled plugin returns
24268
+ 409; a user plugin with no directory returns 404 (default plugins are stubbed on demand via the `default-`
24269
+ prefix); a malformed name returns 400.
23987
24270
  tags:
23988
24271
  - plugins
23989
24272
  parameters:
@@ -25286,6 +25569,74 @@ paths:
25286
25569
  responses:
25287
25570
  "200":
25288
25571
  description: Successful response
25572
+ /v1/resource-pressure/status:
25573
+ get:
25574
+ operationId: resourcepressure_status_get
25575
+ summary: Get resource pressure status
25576
+ description:
25577
+ Return the current resource pressure status snapshot. Off-platform the guard does not run, so a disabled
25578
+ status is returned.
25579
+ tags:
25580
+ - resource-pressure
25581
+ responses:
25582
+ "200":
25583
+ description: Successful response
25584
+ content:
25585
+ application/json:
25586
+ schema:
25587
+ type: object
25588
+ properties:
25589
+ status:
25590
+ type: object
25591
+ properties:
25592
+ enabled:
25593
+ type: boolean
25594
+ state:
25595
+ type: string
25596
+ enum:
25597
+ - disabled
25598
+ - ok
25599
+ - elevated
25600
+ - unknown
25601
+ cpuPercent:
25602
+ anyOf:
25603
+ - type: number
25604
+ - type: "null"
25605
+ memoryPercent:
25606
+ anyOf:
25607
+ - type: number
25608
+ - type: "null"
25609
+ cpuElevated:
25610
+ type: boolean
25611
+ memoryElevated:
25612
+ type: boolean
25613
+ cpuThresholdPercent:
25614
+ type: number
25615
+ memoryThresholdPercent:
25616
+ type: number
25617
+ lastCheckedAt:
25618
+ anyOf:
25619
+ - type: string
25620
+ - type: "null"
25621
+ error:
25622
+ anyOf:
25623
+ - type: string
25624
+ - type: "null"
25625
+ required:
25626
+ - enabled
25627
+ - state
25628
+ - cpuPercent
25629
+ - memoryPercent
25630
+ - cpuElevated
25631
+ - memoryElevated
25632
+ - cpuThresholdPercent
25633
+ - memoryThresholdPercent
25634
+ - lastCheckedAt
25635
+ - error
25636
+ additionalProperties: false
25637
+ required:
25638
+ - status
25639
+ additionalProperties: false
25289
25640
  /v1/retrospective/config:
25290
25641
  get:
25291
25642
  operationId: retrospective_config_get
@@ -27818,7 +28169,9 @@ paths:
27818
28169
  delete:
27819
28170
  operationId: secrets_delete
27820
28171
  summary: Delete a secret
27821
- description: Remove a secret from the credential vault by name.
28172
+ description:
28173
+ Remove a secret from the credential vault by name. Refused with CREDENTIAL_IN_USE while an LLM provider
28174
+ connection resolves its auth through the credential, unless `force` is set.
27822
28175
  tags:
27823
28176
  - secrets
27824
28177
  requestBody:
@@ -27834,6 +28187,9 @@ paths:
27834
28187
  name:
27835
28188
  type: string
27836
28189
  description: Name of the secret to delete
28190
+ force:
28191
+ description: Delete even when provider connections depend on the credential
28192
+ type: boolean
27837
28193
  required:
27838
28194
  - type
27839
28195
  - name
@@ -34255,6 +34611,10 @@ components:
34255
34611
  - type: string
34256
34612
  minLength: 1
34257
34613
  - type: "null"
34614
+ allowUnlisted:
34615
+ anyOf:
34616
+ - type: boolean
34617
+ - type: "null"
34258
34618
  status:
34259
34619
  anyOf:
34260
34620
  - anyOf:
@@ -35027,6 +35387,8 @@ components:
35027
35387
  provider_connection:
35028
35388
  type: string
35029
35389
  minLength: 1
35390
+ allowUnlisted:
35391
+ type: boolean
35030
35392
  status:
35031
35393
  anyOf:
35032
35394
  - $ref: "#/components/schemas/ProfileStatus"
@@ -35303,6 +35665,8 @@ components:
35303
35665
  anyOf:
35304
35666
  - $ref: "#/components/schemas/ProfileConnectionAvailability"
35305
35667
  - type: "null"
35668
+ config_issue:
35669
+ $ref: "#/components/schemas/InferenceProfileConfigIssue"
35306
35670
  required:
35307
35671
  - name
35308
35672
  - label
@@ -35331,6 +35695,21 @@ components:
35331
35695
  required:
35332
35696
  - status
35333
35697
  additionalProperties: false
35698
+ InferenceProfileConfigIssue:
35699
+ type: object
35700
+ properties:
35701
+ code:
35702
+ type: string
35703
+ enum:
35704
+ - model_unknown
35705
+ - over_output_cap
35706
+ - no_input_room
35707
+ message:
35708
+ type: string
35709
+ required:
35710
+ - code
35711
+ - message
35712
+ additionalProperties: false
35334
35713
  InferenceProfileWriteResult:
35335
35714
  type: object
35336
35715
  properties:
@@ -35371,11 +35750,36 @@ components:
35371
35750
  anyOf:
35372
35751
  - $ref: "#/components/schemas/ProfileConnectionAvailability"
35373
35752
  - type: "null"
35753
+ config_issue:
35754
+ $ref: "#/components/schemas/InferenceProfileConfigIssue"
35374
35755
  required:
35375
35756
  - name
35376
35757
  - entry
35377
35758
  - availability
35378
35759
  additionalProperties: false
35760
+ InferenceProfileCheck:
35761
+ type: object
35762
+ properties:
35763
+ ok:
35764
+ type: boolean
35765
+ blame:
35766
+ type: string
35767
+ enum:
35768
+ - profile
35769
+ - provider
35770
+ - transient
35771
+ - unknown
35772
+ reason:
35773
+ type: string
35774
+ detail:
35775
+ type: string
35776
+ connection:
35777
+ type: string
35778
+ message:
35779
+ type: string
35780
+ required:
35781
+ - ok
35782
+ additionalProperties: false
35379
35783
  ProviderConnection:
35380
35784
  type: object
35381
35785
  properties:
@@ -35423,6 +35827,78 @@ components:
35423
35827
  - updatedAt
35424
35828
  - isManaged
35425
35829
  additionalProperties: false
35830
+ SavedProviderConnection:
35831
+ type: object
35832
+ properties:
35833
+ name:
35834
+ type: string
35835
+ minLength: 1
35836
+ provider:
35837
+ $ref: "#/components/schemas/ConnectionProvider"
35838
+ auth:
35839
+ $ref: "#/components/schemas/AuthOutput"
35840
+ label:
35841
+ anyOf:
35842
+ - type: string
35843
+ minLength: 1
35844
+ - type: "null"
35845
+ baseUrl:
35846
+ anyOf:
35847
+ - type: string
35848
+ format: uri
35849
+ - type: "null"
35850
+ models:
35851
+ anyOf:
35852
+ - type: array
35853
+ items:
35854
+ $ref: "#/components/schemas/ConnectionModelOutput"
35855
+ - type: "null"
35856
+ createdAt:
35857
+ type: integer
35858
+ minimum: -9007199254740991
35859
+ maximum: 9007199254740991
35860
+ updatedAt:
35861
+ type: integer
35862
+ minimum: -9007199254740991
35863
+ maximum: 9007199254740991
35864
+ isManaged:
35865
+ type: boolean
35866
+ endpoint_check:
35867
+ $ref: "#/components/schemas/EndpointCheck"
35868
+ required:
35869
+ - name
35870
+ - provider
35871
+ - auth
35872
+ - label
35873
+ - baseUrl
35874
+ - models
35875
+ - createdAt
35876
+ - updatedAt
35877
+ - isManaged
35878
+ additionalProperties: false
35879
+ EndpointCheck:
35880
+ type: object
35881
+ properties:
35882
+ ok:
35883
+ type: boolean
35884
+ status:
35885
+ type: integer
35886
+ minimum: -9007199254740991
35887
+ maximum: 9007199254740991
35888
+ resolved_url:
35889
+ type: string
35890
+ error_class:
35891
+ type: string
35892
+ enum:
35893
+ - http_error
35894
+ - timeout
35895
+ - network
35896
+ hint:
35897
+ type: string
35898
+ required:
35899
+ - ok
35900
+ - resolved_url
35901
+ additionalProperties: false
35426
35902
  ProcessEntry:
35427
35903
  type: object
35428
35904
  properties: