@vellumai/assistant 0.11.4 → 0.11.5-staging.2

package/node_modules/@vellumai/gateway-client/src/http-delivery.ts

@@ -131,7 +131,6 @@ function buildManagedOutboundRequestId(
       chatId: payload.chatId,
       text: normalizedText,
       assistantId: payload.assistantId ?? null,
-      chatAction: payload.chatAction ?? null,
       hasAttachments:
         Array.isArray(payload.attachments) && payload.attachments.length > 0,
       approvalRequestId: payload.approval?.requestId ?? null,
@@ -212,7 +211,6 @@ async function deliverManagedOutboundReply(
         chatId: payload.chatId,
         text: payload.text ?? null,
         assistantId: payload.assistantId ?? null,
-        chatAction: payload.chatAction ?? null,
         hasAttachments,
         sourceUpdateId: callback.sourceUpdateId ?? null,
       },
@@ -325,7 +323,12 @@ export async function deliverChannelReply(
 ): Promise<ChannelDeliveryResult> {
   const managedCallback = parseManagedOutboundCallback(callbackUrl);
   if (managedCallback) {
-    await deliverManagedOutboundReply(managedCallback, payload, bearerToken, log);
+    await deliverManagedOutboundReply(
+      managedCallback,
+      payload,
+      bearerToken,
+      log,
+    );
     return { ok: true };
   }
 
@@ -385,17 +388,7 @@ export async function deliverChannelReply(
     // Response may not be JSON for non-Slack channels; that's fine.
   }
 
-  if (payload.chatAction) {
-    log.debug(
-      { chatId: payload.chatId, callbackUrl, chatAction: payload.chatAction },
-      "Channel action delivered",
-    );
-  } else {
-    log.info(
-      { chatId: payload.chatId, callbackUrl },
-      "Channel reply delivered",
-    );
-  }
+  log.info({ chatId: payload.chatId, callbackUrl }, "Channel reply delivered");
 
   return result;
 }

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -26,6 +26,7 @@ export {
   AttachmentMetadataSchema,
   ChannelDeliveryResultSchema,
   ChannelReplyPayloadSchema,
+  MessageAudienceSchema,
   PermissionRequestDetailsSchema,
   SlackStreamOpSchema,
   SlackStreamTaskSchema,
@@ -37,6 +38,7 @@ export type {
   AttachmentMetadata,
   ChannelDeliveryResult,
   ChannelReplyPayload,
+  MessageAudience,
   PermissionRequestDetails,
   SlackStreamOp,
   SlackStreamTask,

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -156,6 +156,26 @@ export const SlackStreamOpSchema = z
 
 export type SlackStreamOp = z.infer<typeof SlackStreamOpSchema>;
 
+// ---------------------------------------------------------------------------
+// Audience
+// ---------------------------------------------------------------------------
+
+/**
+ * Restricts a message to a single reader in a room that has more.
+ *
+ * A single object rather than a flag beside an id, because the two are only
+ * meaningful together: a channel cannot address one reader without knowing
+ * which. Slack reads this as `chat.postEphemeral`; a channel whose rooms hold
+ * one reader already has nothing to do.
+ */
+export const MessageAudienceSchema = z.object({
+  kind: z.literal("oneReader"),
+  /** The reader, in the channel's own id space. */
+  userId: z.string(),
+});
+
+export type MessageAudience = z.infer<typeof MessageAudienceSchema>;
+
 // ---------------------------------------------------------------------------
 // Channel reply payload — the full outbound wire format
 // ---------------------------------------------------------------------------
@@ -163,43 +183,21 @@ export type SlackStreamOp = z.infer<typeof SlackStreamOpSchema>;
 export const ChannelReplyPayloadSchema = z.object({
   chatId: z.string(),
   text: z.string().optional(),
-  /** Pre-formatted Block Kit blocks for Slack delivery. */
-  blocks: z.array(z.custom<KnownBlock>()).optional(),
   assistantId: z.string().optional(),
   attachments: z.array(AttachmentMetadataSchema).optional(),
   approval: ApprovalUIMetadataSchema.optional(),
-  chatAction: z.literal("typing").optional(),
   /**
-   * When true, deliver via `chat.postEphemeral` so only the target `user`
-   * sees the message.
+   * Who may see this message. Absent means everyone in the room, which is the
+   * only safe reading of an absent value: a message meant for one reader that
+   * loses its audience must not become a public one.
+   */
+  audience: MessageAudienceSchema.optional(),
+  /**
+   * Asks the channel to render the text richly rather than as plain text.
+   * Each channel decides what that means, and one that cannot ignores it.
+   * Slack is the only channel acting on it today, where it becomes Block Kit.
    */
-  ephemeral: z.boolean().optional(),
-  /** Slack user ID — required when `ephemeral` is true. */
-  user: z.string().optional(),
-  /** When provided, update an existing message instead of posting a new one. */
-  messageTs: z.string().optional(),
-  /** When true, the daemon generates Block Kit blocks from the text before delivery. */
   useBlocks: z.boolean().optional(),
-  /** When provided, add or remove an emoji reaction on a message. */
-  reaction: z
-    .object({
-      action: z.enum(["add", "remove"]),
-      name: z.string(),
-      messageTs: z.string(),
-    })
-    .optional(),
-  /** When provided, set or clear the Slack Assistants API thread status. */
-  assistantThreadStatus: z
-    .object({
-      channel: z.string(),
-      threadTs: z.string(),
-      status: z.string(),
-      /** Serialized to Slack as `loading_messages`. */
-      loadingMessages: z.array(z.string()).optional(),
-    })
-    .optional(),
-  /** When provided, perform one Slack streaming operation (start/append/stop). */
-  slackStream: SlackStreamOpSchema.optional(),
 });
 
 export type ChannelReplyPayload = z.infer<typeof ChannelReplyPayloadSchema>;

package/node_modules/@vellumai/service-contracts/package.json

@@ -14,6 +14,7 @@
     "./remote-web-pairing": "./src/remote-web-pairing.ts",
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",
+    "./url-normalization": "./src/url-normalization.ts",
     "./handles": "./src/handles.ts",
     "./rpc": "./src/rpc.ts",
     "./attachment-naming": "./src/attachment-naming.ts",

package/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  canonicalizeWebUrl,
+  looksLikeHostPortShorthand,
+  looksLikePathOnlyInput,
+  normalizeWebUrl,
+} from "../url-normalization.js";
+
+/**
+ * These are the rules a trust rule is saved and matched under. A change here
+ * changes which saved rules still match, so each case states the target the
+ * two spellings must agree on.
+ */
+describe("normalizeWebUrl", () => {
+  test("keeps an ordinary https URL as-is", () => {
+    expect(normalizeWebUrl("https://example.com/docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("drops the fragment: it never reaches the server", () => {
+    expect(normalizeWebUrl("https://example.com/docs#section")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("drops userinfo so credentials cannot land in a saved rule", () => {
+    const credentialed = new URL("https://example.com/docs/page");
+    credentialed.username = "demo";
+    credentialed.password = ["c", "r", "e", "d", "1", "2", "3"].join("");
+
+    const normalized = normalizeWebUrl(credentialed.href);
+    expect(normalized?.href).toBe("https://example.com/docs/page");
+    expect(normalized?.username).toBe("");
+    expect(normalized?.password).toBe("");
+  });
+
+  test("strips a trailing root dot from the hostname", () => {
+    expect(normalizeWebUrl("https://example.com./docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("decodes escaped path segments so one path has one spelling", () => {
+    // Without this, a rule scoped to /private is bypassed by /%70rivate.
+    expect(normalizeWebUrl("https://example.com/%70rivate")?.href).toBe(
+      "https://example.com/private",
+    );
+  });
+
+  test("reads scheme-less input as https", () => {
+    expect(normalizeWebUrl("example.com/docs")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("reads host:port shorthand as an https origin, not a scheme", () => {
+    expect(normalizeWebUrl("example.com:8443/status")?.origin).toBe(
+      "https://example.com:8443",
+    );
+    expect(normalizeWebUrl("[2001:db8::1]:8443/status")?.origin).toBe(
+      "https://[2001:db8::1]:8443",
+    );
+  });
+
+  test("rejects path-only input rather than coercing it to a host", () => {
+    for (const input of ["/etc/passwd", "./rel", "../up", "?q=1", "#frag"]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects every non-http scheme", () => {
+    for (const input of [
+      "file:///etc/passwd",
+      "data:text/html,<script>",
+      "javascript:alert(1)",
+      "ftp://example.com/f",
+    ]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects empty and whitespace-only input", () => {
+    expect(normalizeWebUrl("")).toBeNull();
+    expect(normalizeWebUrl("   ")).toBeNull();
+  });
+
+  test("trims surrounding whitespace", () => {
+    expect(normalizeWebUrl("  https://example.com/a  ")?.href).toBe(
+      "https://example.com/a",
+    );
+  });
+
+  test("returns null rather than throwing on an unparseable authority", () => {
+    expect(normalizeWebUrl("https://")).toBeNull();
+  });
+});
+
+describe("canonicalizeWebUrl", () => {
+  test("keeps the parser's form when the path is not decodable, without throwing", () => {
+    // `%zz` and a truncated UTF-8 sequence are not valid escapes; the path
+    // must survive unchanged rather than the call throwing.
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%zz")).href).toBe(
+      "https://example.com/100%zz",
+    );
+    expect(
+      canonicalizeWebUrl(new URL("https://example.com/%E0%A4%A")).href,
+    ).toBe("https://example.com/%E0%A4%A");
+  });
+
+  test("decodes an escaped percent, so `%25` and `%` are one path", () => {
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%25")).href).toBe(
+      "https://example.com/100%",
+    );
+  });
+});
+
+describe("input shape predicates", () => {
+  test("host:port shorthand is recognized, scheme-prefixed input is not", () => {
+    expect(looksLikeHostPortShorthand("example.com:8443/x")).toBe(true);
+    expect(looksLikeHostPortShorthand("[2001:db8::1]:443")).toBe(true);
+    expect(looksLikeHostPortShorthand("https://example.com/x")).toBe(false);
+    expect(looksLikeHostPortShorthand("example.com/x")).toBe(false);
+  });
+
+  test("path-only input is recognized", () => {
+    expect(looksLikePathOnlyInput("/abs")).toBe(true);
+    expect(looksLikePathOnlyInput("./rel")).toBe(true);
+    expect(looksLikePathOnlyInput("../up")).toBe(true);
+    expect(looksLikePathOnlyInput("?q=1")).toBe(true);
+    expect(looksLikePathOnlyInput("#frag")).toBe(true);
+    expect(looksLikePathOnlyInput("example.com/x")).toBe(false);
+  });
+});

package/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,3 +29,4 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
+export * from "./url-normalization.js";

package/node_modules/@vellumai/service-contracts/src/url-normalization.ts

@@ -0,0 +1,107 @@
+/**
+ * Canonical URL normalization for web tool inputs, shared by the gateway's
+ * risk classifiers and the daemon's URL safety checks.
+ *
+ * A URL a model passes to `web_fetch` / `network_request` reaches more than
+ * one consumer, and they must agree on what counts as the same target: the
+ * gateway builds the trust-rule ladder from it, and anything that later
+ * compares a URL to a saved rule has to fold the same spellings together. Two
+ * normalizations would mean two answers, so it lives here rather than in
+ * either process.
+ *
+ * Data-only in spirit: no imports, no config, no I/O.
+ */
+
+/** Whether a bare `host:port` (or `[v6]:port`) shorthand was written. */
+export function looksLikeHostPortShorthand(value: string): boolean {
+  if (/^\[[0-9a-fA-F:.%]+\]:\d+(?:[/?#]|$)/.test(value)) {
+    return true;
+  }
+  return /^[^/?#@\s:]+:\d+(?:[/?#]|$)/.test(value);
+}
+
+/** Whether the input is a path, query, or fragment rather than a URL. */
+export function looksLikePathOnlyInput(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("?") ||
+    value.startsWith("#")
+  );
+}
+
+/**
+ * Strip the parts of a URL that must not affect a trust decision, and fold
+ * the encodings that would otherwise let one URL wear two spellings.
+ *
+ * Percent-escaped path segments are decoded (`/%70rivate` and `/private` are
+ * one path, so a path-scoped rule cannot be bypassed by escaping), a trailing
+ * root dot is dropped from the hostname, and fragment and userinfo are
+ * removed: the fragment never reaches the server, and credentials in the
+ * authority must never end up in a saved rule.
+ */
+export function canonicalizeWebUrl(parsed: URL): URL {
+  parsed.hash = "";
+  parsed.username = "";
+  parsed.password = "";
+
+  try {
+    parsed.pathname = decodeURI(parsed.pathname);
+  } catch {
+    // Keep the URL parser's canonical form when decoding fails.
+  }
+
+  if (parsed.hostname.endsWith(".")) {
+    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
+  }
+
+  return parsed;
+}
+
+/**
+ * Parse and canonicalize a web tool's `url` input, or `null` when it is not a
+ * URL this system will fetch.
+ *
+ * Accepts `https://host/path`, `http://…`, bare `host/path`, and `host:port`
+ * shorthand. Rejects path-only input and any other scheme (`file:`, `data:`,
+ * `javascript:`), so a non-http target can never acquire a web trust rule.
+ */
+export function normalizeWebUrl(rawUrl: string): URL | null {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (looksLikeHostPortShorthand(trimmed)) {
+    try {
+      return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return canonicalizeWebUrl(parsed);
+    }
+    return null;
+  } catch {
+    // Not an absolute URL; fall through to the shorthand forms.
+  }
+
+  if (looksLikePathOnlyInput(trimmed)) {
+    return null;
+  }
+
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+
+  try {
+    return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+  } catch {
+    return null;
+  }
+}

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.1.0
 info:
   title: Vellum Assistant API
-  version: 0.11.4
+  version: 0.11.5
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821
@@ -4651,6 +4651,47 @@ paths:
                 required:
                   - recorded
                 additionalProperties: false
+  /v1/clients/web-presence:
+    post:
+      operationId: clients_webpresence_post
+      summary: Report web tab visibility and focused conversation
+      description:
+        Record the visibility and focused conversation reported by the web client identified by the
+        X-Vellum-Client-Id header.
+      tags:
+        - clients
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                visible:
+                  type: boolean
+                  description: Whether the reporting tab is currently visible.
+                focusedConversationId:
+                  anyOf:
+                    - type: string
+                    - type: "null"
+                  description: The conversation currently focused (chat composer on screen) in the tab, or null.
+              required:
+                - visible
+                - focusedConversationId
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  recorded:
+                    type: boolean
+                    description: Whether a connected client matched the reporting clientId.
+                required:
+                  - recorded
+                additionalProperties: false
   /v1/config:
     get:
       operationId: config_get
@@ -6608,6 +6649,20 @@ paths:
             predicate behind the unread count and the section index, so a client that keeps no complete conversation
             list can ask for exactly the rows its attention surfaces need. Composes with every other filter. Any value
             other than "true" is rejected. Omit to span every conversation.'
+        - name: foregroundOnly
+          in: query
+          required: false
+          schema:
+            type: string
+            enum:
+              - "true"
+          description:
+            Pass "true" to return only user-facing foreground conversations, dropping the automated background and
+            scheduled runs the standard listing admits when they are filed in a custom group (a surfaced run stays).
+            This is the same predicate the unread count and the section index apply, so a client can ask for the newest
+            conversation a user can open in one row instead of paging past runs it would skip. Composes with every other
+            filter; a foreground-only first page never has pinned rows appended to it. Any value other than "true" is
+            rejected. Omit to keep every visible row.
       responses:
         "200":
           description: Successful response
@@ -9831,7 +9886,10 @@ paths:
     post:
       operationId: credentials_delete_post
       summary: Delete a credential
-      description: Remove a secret, its metadata, and any associated OAuth connection from the vault.
+      description:
+        Remove a secret, its metadata, and any associated OAuth connection from the vault. Refused with
+        CREDENTIAL_IN_USE while an LLM provider connection resolves its auth through the credential, unless `force` is
+        set.
       tags:
         - credentials
       requestBody:
@@ -9847,6 +9905,9 @@ paths:
                 field:
                   type: string
                   description: Field name
+                force:
+                  description: Delete even when provider connections depend on the credential
+                  type: boolean
               required:
                 - service
                 - field
@@ -9862,9 +9923,15 @@ paths:
                     type: string
                   field:
                     type: string
+                  affectedConnections:
+                    type: array
+                    items:
+                      type: string
+                    description: Provider connections that depended on the deleted credential
                 required:
                   - service
                   - field
+                  - affectedConnections
                 additionalProperties: false
   /v1/credentials/inspect:
     post:
@@ -21445,6 +21512,10 @@ paths:
                                     anyOf:
                                       - type: number
                                       - type: "null"
+                                  inactiveFileBytes:
+                                    anyOf:
+                                      - type: number
+                                      - type: "null"
                                   kernelBytes:
                                     anyOf:
                                       - type: number
@@ -21468,6 +21539,7 @@ paths:
                                 required:
                                   - anonBytes
                                   - fileBytes
+                                  - inactiveFileBytes
                                   - kernelBytes
                                   - slabReclaimableBytes
                                   - slabUnreclaimableBytes
@@ -23021,6 +23093,51 @@ paths:
                         additionalProperties: {}
                       - type: "null"
                     description: Pending secret request or null
+                  pendingQuestion:
+                    anyOf:
+                      - type: object
+                        properties:
+                          requestId:
+                            type: string
+                          entries:
+                            type: array
+                            items:
+                              type: object
+                              properties:
+                                id:
+                                  type: string
+                                question:
+                                  type: string
+                                description:
+                                  type: string
+                                options:
+                                  type: array
+                                  items:
+                                    type: object
+                                    properties:
+                                      id:
+                                        type: string
+                                      label:
+                                        type: string
+                                      description:
+                                        type: string
+                                    required:
+                                      - id
+                                      - label
+                                    additionalProperties: false
+                                freeTextPlaceholder:
+                                  type: string
+                              required:
+                                - id
+                                - question
+                                - options
+                              additionalProperties: false
+                        required:
+                          - requestId
+                          - entries
+                        additionalProperties: false
+                      - type: "null"
+                    description: Outstanding ask_question prompt or null
                   interactions:
                     type: array
                     items:
@@ -25286,6 +25403,74 @@ paths:
       responses:
         "200":
           description: Successful response
+  /v1/resource-pressure/status:
+    get:
+      operationId: resourcepressure_status_get
+      summary: Get resource pressure status
+      description:
+        Return the current resource pressure status snapshot. Off-platform the guard does not run, so a disabled
+        status is returned.
+      tags:
+        - resource-pressure
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: object
+                    properties:
+                      enabled:
+                        type: boolean
+                      state:
+                        type: string
+                        enum:
+                          - disabled
+                          - ok
+                          - elevated
+                          - unknown
+                      cpuPercent:
+                        anyOf:
+                          - type: number
+                          - type: "null"
+                      memoryPercent:
+                        anyOf:
+                          - type: number
+                          - type: "null"
+                      cpuElevated:
+                        type: boolean
+                      memoryElevated:
+                        type: boolean
+                      cpuThresholdPercent:
+                        type: number
+                      memoryThresholdPercent:
+                        type: number
+                      lastCheckedAt:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                      error:
+                        anyOf:
+                          - type: string
+                          - type: "null"
+                    required:
+                      - enabled
+                      - state
+                      - cpuPercent
+                      - memoryPercent
+                      - cpuElevated
+                      - memoryElevated
+                      - cpuThresholdPercent
+                      - memoryThresholdPercent
+                      - lastCheckedAt
+                      - error
+                    additionalProperties: false
+                required:
+                  - status
+                additionalProperties: false
   /v1/retrospective/config:
     get:
       operationId: retrospective_config_get
@@ -27818,7 +28003,9 @@ paths:
     delete:
       operationId: secrets_delete
       summary: Delete a secret
-      description: Remove a secret from the credential vault by name.
+      description:
+        Remove a secret from the credential vault by name. Refused with CREDENTIAL_IN_USE while an LLM provider
+        connection resolves its auth through the credential, unless `force` is set.
       tags:
         - secrets
       requestBody:
@@ -27834,6 +28021,9 @@ paths:
                 name:
                   type: string
                   description: Name of the secret to delete
+                force:
+                  description: Delete even when provider connections depend on the credential
+                  type: boolean
               required:
                 - type
                 - name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.4",
+  "version": "0.11.5-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {