@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/runtime/routes/settings-routes.ts

@@ -37,7 +37,6 @@ import {
 import {
   check,
   classifyRisk,
-  generateAllowlistOptions,
   generateScopeOptions,
 } from "../../permissions/checker.js";
 import { resolveGuardianPersonaPath } from "../../prompts/persona-resolver.js";
@@ -710,19 +709,22 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
       isInteractive === false ? "headless" : "conversation";
     const policyContext = { executionTarget, executionContext } as const;
 
-    const { level: riskLevel } = await classifyRisk(
+    const classification = await classifyRisk(
       toolName,
       input,
       workingDir,
       undefined,
       manifestOverride,
     );
+    const riskLevel = classification.level;
     const result = await check(
       toolName,
       input,
       workingDir,
       policyContext,
       manifestOverride,
+      undefined,
+      classification,
     );
 
     if (isInteractive === false && result.decision === "prompt") {
@@ -743,11 +745,9 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
       | undefined;
 
     if (result.decision === "prompt") {
-      const allowlistOptions = await generateAllowlistOptions(toolName, input);
-      const scopeOptions = generateScopeOptions(workingDir, toolName);
       promptPayload = {
-        allowlistOptions,
-        scopeOptions,
+        allowlistOptions: classification.allowlistOptions ?? [],
+        scopeOptions: generateScopeOptions(workingDir, toolName),
         persistentDecisionsAllowed: true,
       };
     }

package/src/runtime/routes/surface-action-routes.ts

@@ -37,26 +37,25 @@ const log = getLogger("surface-action-routes");
 
 /**
  * Resolve trust context for the actor principal from the gateway guardian
- * binding and set it on the conversation. A vellum principal is the guardian or
- * nobody, so the mapper yields guardian or unknown. Resolution (including the
- * dev-bypass principal translation and the mutating reset-drift repair) lives
- * in the shared {@link resolveVellumActorTrustContext} so the surface content
- * route's read-only requester scoping cannot drift from it.
+ * binding, and return it for the caller to attribute this action with. A vellum
+ * principal is the guardian or nobody, so the mapper yields guardian or
+ * unknown. Resolution (including the dev-bypass principal translation and the
+ * mutating reset-drift repair) lives in the shared
+ * {@link resolveVellumActorTrustContext} so the surface content route's
+ * read-only requester scoping cannot drift from it.
+ *
+ * Resolution only: the requester travels to `handleSurfaceAction` as an
+ * argument, and the conversation's slot is stamped there, at the point the
+ * click is committed to starting a turn. Stamping here instead would repoint
+ * the actor of a turn already in flight, or of a turn that starts between this
+ * call and the dispatch.
  */
-async function applyTrustContext(
-  conversation: {
-    setTrustContext?(ctx: TrustContext): void;
-  },
+async function resolveRequesterTrustContext(
   actorPrincipalId: string | undefined,
-): Promise<void> {
-  if (!conversation.setTrustContext) {
-    return;
-  }
-  conversation.setTrustContext(
-    await resolveVellumActorTrustContext(actorPrincipalId, {
-      healResetDrift: true,
-    }),
-  );
+): Promise<TrustContext> {
+  return resolveVellumActorTrustContext(actorPrincipalId, {
+    healResetDrift: true,
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -154,7 +153,8 @@ async function handleSurfaceAction({
   }
 
   const actorPrincipalId = headers?.["x-vellum-actor-principal-id"];
-  await applyTrustContext(conversation, actorPrincipalId);
+  const requesterTrustContext =
+    await resolveRequesterTrustContext(actorPrincipalId);
 
   // Translate dev-bypass → real guardian so the surface turn's principal matches
   // the SSE host-proxy client's registered principal; otherwise CU/app-control
@@ -170,6 +170,7 @@ async function handleSurfaceAction({
       actionId,
       data,
       resolvedActorPrincipalId,
+      requesterTrustContext,
     );
     const result =
       raw && typeof raw === "object" && "accepted" in raw

package/src/runtime/routes/user-route-dispatcher.ts

@@ -37,6 +37,7 @@
 
 import { statSync } from "node:fs";
 
+import { runInPluginContext } from "../../plugins/plugin-execution-context.js";
 import { isRouteHostEnabled } from "../../routes/control.js";
 import {
   RouteHostClient,
@@ -55,6 +56,7 @@ import {
   routeSourceRoot,
 } from "./user-route-import.js";
 import {
+  pluginNameForRoutePath,
   resolveHandlerFile,
   resolveRouteLocation,
 } from "./user-route-resolution.js";
@@ -150,11 +152,36 @@ export class UserRouteDispatcher {
       );
     }
 
+    // A plugin's own routes execute as that plugin, so the host APIs a handler
+    // reaches scope to it exactly as they do inside its hooks and tools. Both
+    // execution paths carry it: in-thread here, and the route host through the
+    // invoke params it marks its own execution with.
+    const pluginName = pluginNameForRoutePath(routePath);
+
     if (isRouteHostEnabled()) {
-      return this.dispatchViaHost(filePath, routePath, request);
+      return this.dispatchViaHost(filePath, routePath, request, pluginName);
     }
 
-    const mod = await this.loadModule(filePath, location.routesDir);
+    // The context covers module evaluation, not just the handler call. A route
+    // module can reach a scoped host API at import time (a top-level `await`),
+    // and that import happens once per mtime, so a load left outside the
+    // context would take the unscoped branch and never be re-run scoped.
+    const serve = () =>
+      this.serveInThread(filePath, location.routesDir, routePath, request);
+    return pluginName ? runInPluginContext(pluginName, serve) : serve();
+  }
+
+  /**
+   * Load the handler module and run the method's handler in this thread.
+   * Called inside the owning plugin's execution context, when the route has one.
+   */
+  private async serveInThread(
+    filePath: string,
+    routesDir: string,
+    routePath: string,
+    request: Request,
+  ): Promise<Response> {
+    const mod = await this.loadModule(filePath, routesDir);
     const method = request.method as HttpMethod;
     const handler = mod.handlers[method];
 
@@ -180,6 +207,7 @@ export class UserRouteDispatcher {
     filePath: string,
     routePath: string,
     request: Request,
+    pluginName: string | undefined,
   ): Promise<Response> {
     const mtimeMs = statSync(filePath).mtimeMs;
 
@@ -201,6 +229,7 @@ export class UserRouteDispatcher {
           method: request.method,
           url: request.url,
           headers,
+          pluginName,
         },
         body,
       );

package/src/runtime/routes/user-route-resolution.ts

@@ -66,6 +66,23 @@ export interface RouteLocation {
   subPath: string;
 }
 
+/**
+ * The manifest name of the plugin whose namespace an `/x/` route path falls in,
+ * or undefined for a workspace route.
+ *
+ * The dispatcher marks that plugin as in context for the handler's execution,
+ * so host APIs a route handler reaches (`resolveCredential`,
+ * `indexDocument`) scope to the owning plugin exactly as they do inside its
+ * hooks and tools.
+ */
+export function pluginNameForRoutePath(routePath: string): string | undefined {
+  const segments = routePath.split("/");
+  if (segments[0] !== PLUGIN_ROUTE_SEGMENT) {
+    return undefined;
+  }
+  return segments[1] || undefined;
+}
+
 /**
  * Resolve an `/x/` route path to the base directory + sub-path the handler file
  * is looked up under.
@@ -87,7 +104,7 @@ export interface RouteLocation {
 export function resolveRouteLocation(routePath: string): RouteLocation | null {
   const segments = routePath.split("/");
   if (segments[0] === PLUGIN_ROUTE_SEGMENT) {
-    const pluginName = segments[1];
+    const pluginName = pluginNameForRoutePath(routePath);
     if (!pluginName) {
       return null;
     }

package/src/runtime/slack-reply-session.test.ts

@@ -14,6 +14,22 @@ let deliverImpl: (
   ts: "stream-ts-1",
 });
 
+const sentStreamOps: Array<Record<string, unknown>> = [];
+let streamOpImpl: (op: Record<string, unknown>) => Promise<{
+  ok: boolean;
+  ts?: string;
+}> = async () => ({ ok: true, ts: "stream-ts-1" });
+mock.module("../messaging/providers/index.js", () => ({
+  sendChannelStreamOp: async (
+    _callbackUrl: string,
+    _chatId: string,
+    op: Record<string, unknown>,
+  ) => {
+    sentStreamOps.push(op);
+    return streamOpImpl(op);
+  },
+}));
+
 mock.module("./gateway-client.js", () => ({
   deliverChannelReply: async (
     callbackUrl: string,
@@ -96,10 +112,7 @@ const taskProgressUpdate = (
 const tick = (ms: number): Promise<void> =>
   new Promise((resolve) => setTimeout(resolve, ms));
 
-const slackStreamOps = (): Array<Record<string, unknown>> =>
-  deliverCalls
-    .map((call) => call.payload.slackStream as Record<string, unknown>)
-    .filter(Boolean);
+const slackStreamOps = (): Array<Record<string, unknown>> => sentStreamOps;
 
 const streamedMarkdown = (): string =>
   slackStreamOps()
@@ -108,6 +121,8 @@ const streamedMarkdown = (): string =>
 
 beforeEach(() => {
   deliverCalls.length = 0;
+  sentStreamOps.length = 0;
+  streamOpImpl = async () => ({ ok: true, ts: "stream-ts-1" });
   deliverImpl = async () => ({ ok: true, ts: "stream-ts-1" });
 });
 
@@ -314,7 +329,7 @@ describe("createSlackReplySession", () => {
   });
 
   test("falls back when startStream returns no stream ts", async () => {
-    deliverImpl = async () => ({ ok: false });
+    streamOpImpl = async () => ({ ok: false });
     const session = createSlackReplySession({
       sourceChannel: "slack",
       chatType: "im",
@@ -331,7 +346,7 @@ describe("createSlackReplySession", () => {
   });
 
   test("falls back when startStream throws", async () => {
-    deliverImpl = async () => {
+    streamOpImpl = async () => {
       throw new Error("rate limited");
     };
     const session = createSlackReplySession({
@@ -349,8 +364,7 @@ describe("createSlackReplySession", () => {
   });
 
   test("falls back when stopStream throws after streaming text", async () => {
-    deliverImpl = async (_url, payload) => {
-      const op = payload.slackStream as { action: string };
+    streamOpImpl = async (op) => {
       if (op.action === "stop") {
         throw new Error("stop failed");
       }
@@ -482,11 +496,7 @@ describe("createSlackReplySession", () => {
   });
 
   test("leaves progress to stop when the task-only append fails", async () => {
-    deliverImpl = async (_url, payload) => {
-      const op = payload.slackStream as {
-        action: string;
-        markdownText?: string;
-      };
+    streamOpImpl = async (op) => {
       if (op.action === "append" && op.markdownText === undefined) {
         throw new Error("chunks-only append rejected");
       }

package/src/runtime/slack-reply-session.ts

@@ -1,4 +1,4 @@
-import type { SlackStreamTask } from "@vellumai/gateway-client";
+import type { SlackStreamOp, SlackStreamTask } from "@vellumai/gateway-client";
 
 import type { AssistantEvent } from "../api/index.js";
 import {
@@ -10,11 +10,11 @@ import {
   incompleteVellumLinkSuffixLength,
   stripVellumLinks,
 } from "../daemon/assistant-attachments.js";
+import { sendChannelStreamOp } from "../messaging/providers/index.js";
 import { SLACK_STREAM_MARKDOWN_LIMIT } from "../messaging/providers/slack/api.js";
 import { renderSlackBlocks } from "../messaging/providers/slack/render.js";
 import { getLogger } from "../util/logger.js";
 import { needsBoundarySpace } from "../util/text-spacing.js";
-import { deliverChannelReply } from "./gateway-client.js";
 import {
   hasDeliverableAssistantText,
   NO_RESPONSE_INLINE_RE,
@@ -113,7 +113,6 @@ export function createSlackReplySession(params: {
   chatType?: string;
   replyCallbackUrl?: string;
   chatId: string;
-  assistantId?: string;
   /** Slack user ID of the reader; required to stream into a channel. */
   recipientUserId?: string;
   /** Slack team ID of the reader; required to stream into a channel. */
@@ -132,7 +131,7 @@ export function createSlackReplySession(params: {
   if (!shouldStreamSlackReply(params) || !params.replyCallbackUrl) {
     return undefined;
   }
-  const { chatId, assistantId, recipientUserId, recipientTeamId } = params;
+  const { chatId, recipientUserId, recipientTeamId } = params;
   const coalesceMs = params.coalesceMs ?? STREAM_COALESCE_MS;
   const replyCallbackUrl = params.replyCallbackUrl;
   const threadTs = extractThreadTsFromCallbackUrl(replyCallbackUrl);
@@ -197,11 +196,11 @@ export function createSlackReplySession(params: {
   ): string | undefined =>
     tasks ? JSON.stringify({ title, tasks }) : undefined;
 
+  // Typed from the stream operation these are passed to, so the element type
+  // follows that contract rather than drifting from it.
   const imageBlocks = (
     text: string,
-  ):
-    | NonNullable<Parameters<typeof deliverChannelReply>[1]["blocks"]>
-    | undefined => {
+  ): Extract<SlackStreamOp, { action: "stop" }>["blocks"] => {
     const blocks = renderSlackBlocks(text)?.filter(
       (block) => block.type === "image",
     );
@@ -222,24 +221,20 @@ export function createSlackReplySession(params: {
       const title = activeProgress?.title;
       const tasks = planTasks();
       try {
-        const result = await deliverChannelReply(replyCallbackUrl, {
-          chatId,
-          assistantId,
-          slackStream: {
-            action: "start",
-            threadTs,
-            markdownText: firstChunk,
-            // The task display mode is fixed for the stream's lifetime at
-            // start, while a `task_progress` surface usually appears only
-            // after the first text flush has opened the stream. Plan mode
-            // only affects how task chunks render, so a stream that never
-            // carries tasks still reads as a plain message.
-            taskDisplayMode: "plan" as const,
-            ...(title ? { planTitle: title } : {}),
-            ...(tasks ? { tasks } : {}),
-            ...(recipientUserId ? { recipientUserId } : {}),
-            ...(recipientTeamId ? { recipientTeamId } : {}),
-          },
+        const result = await sendChannelStreamOp(replyCallbackUrl, chatId, {
+          action: "start",
+          threadTs,
+          markdownText: firstChunk,
+          // The task display mode is fixed for the stream's lifetime at
+          // start, while a `task_progress` surface usually appears only
+          // after the first text flush has opened the stream. Plan mode
+          // only affects how task chunks render, so a stream that never
+          // carries tasks still reads as a plain message.
+          taskDisplayMode: "plan" as const,
+          ...(title ? { planTitle: title } : {}),
+          ...(tasks ? { tasks } : {}),
+          ...(recipientUserId ? { recipientUserId } : {}),
+          ...(recipientTeamId ? { recipientTeamId } : {}),
         });
         if (result.ok && result.ts) {
           streamTs = result.ts;
@@ -287,16 +282,12 @@ export function createSlackReplySession(params: {
           confirmedLength + SLACK_STREAM_MARKDOWN_LIMIT,
         );
         try {
-          await deliverChannelReply(replyCallbackUrl, {
-            chatId,
-            assistantId,
-            slackStream: {
-              action: "append",
-              streamTs,
-              markdownText: chunk,
-              ...(title ? { planTitle: title } : {}),
-              ...(tasks ? { tasks } : {}),
-            },
+          await sendChannelStreamOp(replyCallbackUrl, chatId, {
+            action: "append",
+            streamTs,
+            markdownText: chunk,
+            ...(title ? { planTitle: title } : {}),
+            ...(tasks ? { tasks } : {}),
           });
           confirmedLength += chunk.length;
           deliveredProgressKey = key ?? deliveredProgressKey;
@@ -316,15 +307,11 @@ export function createSlackReplySession(params: {
       // next text append and `stopStream` carries the final state.
       if (!taskOnlyAppendsDisabled && tasks && key !== deliveredProgressKey) {
         try {
-          await deliverChannelReply(replyCallbackUrl, {
-            chatId,
-            assistantId,
-            slackStream: {
-              action: "append",
-              streamTs,
-              ...(title ? { planTitle: title } : {}),
-              tasks,
-            },
+          await sendChannelStreamOp(replyCallbackUrl, chatId, {
+            action: "append",
+            streamTs,
+            ...(title ? { planTitle: title } : {}),
+            tasks,
           });
           deliveredProgressKey = key;
         } catch (err) {
@@ -450,17 +437,13 @@ export function createSlackReplySession(params: {
         const title = activeProgress?.title;
         const tasks = planTasks();
         try {
-          await deliverChannelReply(replyCallbackUrl, {
-            chatId,
-            assistantId,
-            slackStream: {
-              action: "stop",
-              streamTs,
-              ...(remaining.length > 0 ? { markdownText: remaining } : {}),
-              ...(blocks ? { blocks } : {}),
-              ...(title ? { planTitle: title } : {}),
-              ...(tasks ? { tasks } : {}),
-            },
+          await sendChannelStreamOp(replyCallbackUrl, chatId, {
+            action: "stop",
+            streamTs,
+            ...(remaining.length > 0 ? { markdownText: remaining } : {}),
+            ...(blocks ? { blocks } : {}),
+            ...(title ? { planTitle: title } : {}),
+            ...(tasks ? { tasks } : {}),
           });
           confirmedLength = clean.length;
         } catch (err) {

package/src/runtime/web-presence.ts

@@ -0,0 +1,90 @@
+/**
+ * Web presence policy.
+ *
+ * Answers exactly one question for notification producers: is the user
+ * demonstrably looking at this specific conversation in a web browser tab
+ * right now? Producers use the answer to skip an APNs push the user would
+ * see on screen anyway.
+ *
+ * Fails open by design, the same posture as desktop presence
+ * (`runtime/desktop-presence.ts`): presence is in-memory, best-effort, and
+ * reported by a client that can drop off (crash, network loss, backgrounded
+ * tab killed by the OS) without telling the daemon, so anything short of a
+ * fresh, visible, matching-conversation report answers `false` and the push
+ * goes out. A missed notification is strictly worse than a redundant one.
+ *
+ * Deliberately separate from desktop presence: a web report is scoped to one
+ * conversation (the tab's focused thread), not the whole app. The Electron
+ * desktop renderer detects its own host OS and tags its turns
+ * `macos`/`windows` (`detectClientOs()` in the web client), so an Electron
+ * turn is already covered by `isDesktopAttended()` and never reaches this
+ * gate. Do not fold this into `setClientPresence` / the `macos`-scoped
+ * desktop-attendance path.
+ */
+
+import { getLogger } from "../util/logger.js";
+import { assistantEventHub } from "./assistant-event-hub.js";
+
+const log = getLogger("web-presence");
+
+/**
+ * Shared semantic + transport freshness bound. The semantic report says what
+ * the tab was showing; `lastActiveAt` says the owning SSE connection is still
+ * alive. Both must be fresh so a live-but-hidden stream cannot preserve an old
+ * visible report, and a fresh report cannot suppress after its transport dies.
+ */
+export const WEB_PRESENCE_STALE_AFTER_MS = 180_000;
+
+export interface WebPresenceOptions {
+  /**
+   * Only count web clients whose verified actor principal matches this id.
+   * A client that connected without a principal (legacy or service token)
+   * never matches a supplied id.
+   */
+  actorPrincipalId?: string;
+  /** Clock used for the staleness comparison. */
+  now?: Date;
+}
+
+/**
+ * Whether some web client has reported, recently enough to trust, that the
+ * given conversation is visible and focused. Stale, absent, hidden,
+ * unfocused, non-web, and error reads all answer `false`.
+ *
+ * Callers whose notification targets one recipient must pass that
+ * recipient's `actorPrincipalId`, or another user's focused tab suppresses
+ * the push. Omitting it treats any matching web client as focus, which only
+ * suits notifications with no single recipient.
+ */
+export function isWebConversationFocused(
+  conversationId: string,
+  options: WebPresenceOptions = {},
+): boolean {
+  const { actorPrincipalId, now = new Date() } = options;
+  try {
+    return assistantEventHub.listClientsByInterface("web").some((client) => {
+      if (
+        actorPrincipalId !== undefined &&
+        client.actorPrincipalId !== actorPrincipalId
+      ) {
+        return false;
+      }
+      const report = client.webPresence;
+      if (!report) {
+        return false;
+      }
+      const nowMs = now.getTime();
+      if (
+        nowMs - report.reportedAt.getTime() > WEB_PRESENCE_STALE_AFTER_MS ||
+        nowMs - client.lastActiveAt.getTime() > WEB_PRESENCE_STALE_AFTER_MS
+      ) {
+        return false;
+      }
+      return report.visible && report.focusedConversationId === conversationId;
+    });
+  } catch (err) {
+    // Returning false sends the push, which is the safe direction.
+    log.warn({ err }, "web presence read failed; treating as unfocused");
+    return false;
+  }
+}