@vellumai/assistant 0.11.6 → 0.11.7-staging.1

package/node_modules/@vellumai/gateway-client/src/__tests__/inbound-event-kind.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The kind derivation is the single reader of the field encodings, so its
+ * matrix is the compatibility contract: every shape an unstamped replayed
+ * retry payload can carry must classify exactly as the consumers that read
+ * those fields directly would classify it.
+ */
+import { describe, expect, test } from "bun:test";
+
+import {
+  inboundEventRefersToAnotherMessage,
+  resolveInboundEventKind,
+} from "../inbound-event-kind.js";
+
+describe("resolveInboundEventKind", () => {
+  test("a stamped kind wins over every legacy field", () => {
+    expect(
+      resolveInboundEventKind({
+        eventKind: "edit",
+        callbackData: "message_deleted",
+      }),
+    ).toBe("edit");
+  });
+
+  test("an unrecognized stamp falls back to legacy derivation", () => {
+    expect(
+      resolveInboundEventKind({ eventKind: "future-kind", isEdit: true }),
+    ).toBe("edit");
+  });
+
+  test("legacy isEdit classifies as edit", () => {
+    expect(resolveInboundEventKind({ isEdit: true })).toBe("edit");
+  });
+
+  test("the delete sentinel classifies as delete", () => {
+    expect(resolveInboundEventKind({ callbackData: "message_deleted" })).toBe(
+      "delete",
+    );
+  });
+
+  test("reaction prefixes classify as reaction, both directions", () => {
+    expect(resolveInboundEventKind({ callbackData: "reaction:+1" })).toBe(
+      "reaction",
+    );
+    expect(
+      resolveInboundEventKind({ callbackData: "reaction_removed:+1" }),
+    ).toBe("reaction");
+  });
+
+  test("any other callbackData classifies as button", () => {
+    expect(
+      resolveInboundEventKind({ callbackData: "apr:req-1:approve_once" }),
+    ).toBe("button");
+    expect(resolveInboundEventKind({ callbackData: "some-action-id" })).toBe(
+      "button",
+    );
+  });
+
+  test("an empty callbackData is not a family", () => {
+    // Mirrors the old hasCallbackData predicate, which required length > 0.
+    expect(resolveInboundEventKind({ callbackData: "" })).toBe("message");
+  });
+
+  test("callbackQueryId alone classifies as button", () => {
+    expect(resolveInboundEventKind({ callbackQueryId: "cbq-1" })).toBe(
+      "button",
+    );
+  });
+
+  test("nothing stated is a plain message", () => {
+    expect(resolveInboundEventKind({})).toBe("message");
+  });
+});
+
+describe("inboundEventRefersToAnotherMessage", () => {
+  test("only a plain message stands alone", () => {
+    expect(inboundEventRefersToAnotherMessage("message")).toBe(false);
+    expect(inboundEventRefersToAnotherMessage("edit")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("delete")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("reaction")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("button")).toBe(true);
+  });
+});

package/node_modules/@vellumai/gateway-client/src/__tests__/plugin-admission-denied-contract.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  ACCESS_DENIED_NOT_APPROVED_REPLY,
+  PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PluginAdmissionDeniedNoticeSchema,
+} from "../plugin-admission-denied-contract.js";
+
+describe("plugin admission-denied contract", () => {
+  test("keeps the not-approved copy stable", () => {
+    expect(ACCESS_DENIED_NOT_APPROVED_REPLY).toBe(
+      "Sorry, you haven't been approved to message this assistant.",
+    );
+  });
+
+  test("names the internal plugin notice path", () => {
+    expect(PLUGIN_ADMISSION_DENIED_NOTICE_PATH).toBe(
+      "notices/admission-denied",
+    );
+  });
+
+  test("round-trips a floor-deny notice", () => {
+    const notice = {
+      reason: "admission_floor" as const,
+      plugin: "imessage",
+      ingressRoute: "events-linq",
+      admissionPolicy: "guardian_only" as const,
+      trustClass: "unknown" as const,
+      conversationExternalId: "chat-1",
+      actorExternalId: "+15550100",
+      externalMessageId: "msg-1",
+      replyText: ACCESS_DENIED_NOT_APPROVED_REPLY,
+    };
+
+    expect(PluginAdmissionDeniedNoticeSchema.parse(notice)).toEqual(notice);
+  });
+
+  test("rejects a notice that still carries a plugin-scoped id as the chat", () => {
+    // The send API addresses vendor chats. An empty chat id is the failure
+    // that matters; the schema only requires a non-empty string, so this
+    // asserts the required fields rather than the prefix rule.
+    expect(() =>
+      PluginAdmissionDeniedNoticeSchema.parse({
+        reason: "admission_floor",
+        plugin: "imessage",
+        ingressRoute: "events-linq",
+        admissionPolicy: "guardian_only",
+        trustClass: "unknown",
+        conversationExternalId: "",
+        actorExternalId: "+15550100",
+        externalMessageId: "msg-1",
+        replyText: ACCESS_DENIED_NOT_APPROVED_REPLY,
+      }),
+    ).toThrow();
+  });
+});

package/node_modules/@vellumai/gateway-client/src/__tests__/trust-verdict-contract.test.ts

@@ -31,6 +31,7 @@ const fullVerdict: TrustVerdict = {
   verifiedAt: 1699999999,
   interactionCount: 12,
   memberDisplayName: "Member Name",
+  autoApproveThreshold: "high",
 };
 
 describe("TrustVerdictSchema", () => {
@@ -38,6 +39,23 @@ describe("TrustVerdictSchema", () => {
     expect(TrustVerdictSchema.parse(fullVerdict)).toEqual(fullVerdict);
   });
 
+  test("parses a verdict with a null contact auto-approve threshold", () => {
+    const verdict = {
+      ...fullVerdict,
+      autoApproveThreshold: null,
+    } satisfies TrustVerdict;
+    expect(TrustVerdictSchema.parse(verdict)).toEqual(verdict);
+  });
+
+  test("rejects an unknown contact auto-approve threshold", () => {
+    expect(() =>
+      TrustVerdictSchema.parse({
+        ...fullVerdict,
+        autoApproveThreshold: "full",
+      }),
+    ).toThrow();
+  });
+
   test("parses a minimal verdict", () => {
     const minimal = {
       trustClass: "unknown",

package/node_modules/@vellumai/gateway-client/src/admission-policy-contract.ts

@@ -3,9 +3,8 @@
  *
  * Both the gateway (channel admission policy storage + kill switch) and the
  * runtime (admission-policy stage) consume these values. Keeping the type
- * here avoids the runtime importing from `gateway/src` and avoids the
- * vocabulary drift the plan §2.1 flags for the verification-purpose
- * `trustClass` enum.
+ * here avoids the runtime importing from `gateway/src` and keeps both
+ * sides on a single shared vocabulary.
  */
 
 import { z } from "zod";
@@ -15,7 +14,7 @@ import type { TrustClass } from "./trust-verdict-contract.js";
 /**
  * Per-channel inbound admission policy — ordered from most-restrictive
  * (`no_one`, hard kill switch) to most-permissive (`strangers`, admits any
- * sender). See `unverified-contact-role-plan.md` §2.3.
+ * sender).
  */
 export const ADMISSION_POLICY_VALUES = [
   "no_one",
@@ -32,14 +31,14 @@ export const AdmissionPolicySchema = z.enum(ADMISSION_POLICY_VALUES);
 /**
  * Read-side default applied when a channel has no row in the DB. Matches
  * today's effective semantics: guardian + active contacts admitted,
- * strangers denied. See plan §2.2.
+ * strangers denied.
  */
 export const ADMISSION_POLICY_DEFAULT: AdmissionPolicy = "trusted_contacts";
 
 /**
  * Minimum trust rank required for each policy. Higher rank = more trusted.
  * `no_one` is 5 — above the maximum guardian rank (4) — so no class is ever
- * admitted. See plan §2.4 for the rank table.
+ * admitted.
  */
 export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
   no_one: 5,
@@ -82,15 +81,10 @@ export function isAdmissionPolicyExemptChannel(channelType: string): boolean {
  * `vellum` is the local desktop/web client surface; the guardian is always
  * max-rank there, so the seed default admits them regardless of the floor.
  *
- * `discord` has no ingress implementation, so there is nothing for a floor to
- * gate and nothing for the user to configure. Hiding keeps it pinned at the
- * seed default rather than offering a Channel Trust Floors row for a channel
- * that receives nothing.
  */
 export const ADMISSION_POLICY_HIDDEN_CHANNELS: ReadonlySet<string> = new Set([
   "vellum",
   "whatsapp",
-  "discord",
 ]);
 
 export function isAdmissionPolicyHiddenChannel(channelType: string): boolean {

package/node_modules/@vellumai/gateway-client/src/channel-permission-contract.ts

@@ -10,7 +10,9 @@
  *
  * Storage lives in the gateway DB (`channel_permission_overrides`) so the
  * assistant cannot tamper with it, matching `channel_admission_policy` and
- * `auto_approve_thresholds`.
+ * `auto_approve_thresholds`. A contact-level ceiling can live on
+ * `contacts.auto_approve_threshold` and is stamped on the trust verdict;
+ * that override is not a matrix cell.
  */
 
 import { z } from "zod";

package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts

@@ -5,6 +5,8 @@
 import { CHANNEL_IDS } from "@vellumai/service-contracts/channels";
 import { z } from "zod";
 
+import { RiskThresholdSchema } from "./channel-permission-contract.js";
+
 export const GATEWAY_LOG_LEVEL_NAMES = [
   "trace",
   "debug",
@@ -275,6 +277,11 @@ export const ContactReadSchema = z.object({
   contactType: z.string().nullable().optional(),
   lastInteraction: z.number().nullable().optional(),
   interactionCount: z.number().nullable(),
+  /**
+   * Per-contact auto-approve ceiling. Null when unset (inherit cascade).
+   * Optional on the wire for version skew; gateway reads always emit it.
+   */
+  autoApproveThreshold: RiskThresholdSchema.nullable().optional(),
   createdAt: z.number(),
   updatedAt: z.number(),
   channels: z.array(ContactReadChannelSchema),
@@ -401,6 +408,8 @@ export type ClassifyRiskSkillMetadata = z.infer<
 export const ClassifyRiskIpcParamsSchema = z.object({
   tool: z.string().min(1),
   command: z.string().optional(),
+  /** Shell grammar used by host_bash on the target desktop. */
+  shell: z.enum(["bash", "powershell"]).optional(),
   url: z.string().optional(),
   path: z.string().optional(),
   /**

package/node_modules/@vellumai/gateway-client/src/inbound-contract.ts

@@ -10,6 +10,7 @@
  * it in `handleChannelInbound()`.
  */
 
+import { INBOUND_EVENT_KINDS } from "./inbound-event-kind.js";
 import { z } from "zod";
 
 import { ChannelConversationTypeSchema } from "./channel-permission-contract.js";
@@ -168,6 +169,9 @@ export const RuntimeInboundPayloadSchema = z.object({
   conversationExternalId: z.string(),
   externalMessageId: z.string(),
   content: z.string(),
+  /** The named event family; absent only on replayed retry payloads,
+   *  where resolveInboundEventKind derives it from the legacy fields. */
+  eventKind: z.enum(INBOUND_EVENT_KINDS).optional(),
   isEdit: z.boolean().optional(),
   callbackQueryId: z.string().optional(),
   callbackData: z.string().optional(),

package/node_modules/@vellumai/gateway-client/src/inbound-event-kind.ts

@@ -0,0 +1,75 @@
+/**
+ * The inbound event families, named.
+ *
+ * Every inbound event is one of these, and the kind decides which pipeline
+ * stages apply: only user-authored text (message, edit) can carry a
+ * verification code or an invite, only a message starts an agent turn, and
+ * edit/delete/reaction/button all refer to another message rather than
+ * standing alone. A payload can also encode its family in the field that
+ * carries it: `isEdit`, the sentinel string `"message_deleted"`, the
+ * `"reaction:"` prefix, the presence of `callbackData` at all. Replayed
+ * retry payloads arrive with only those encodings, so
+ * {@link resolveInboundEventKind} derives the kind from them exactly once;
+ * nothing else may sniff them.
+ */
+
+export const INBOUND_EVENT_KINDS = [
+  "message",
+  "edit",
+  "delete",
+  "reaction",
+  "button",
+] as const;
+
+export type InboundEventKind = (typeof INBOUND_EVENT_KINDS)[number];
+
+export function isInboundEventKind(value: string): value is InboundEventKind {
+  return (INBOUND_EVENT_KINDS as readonly string[]).includes(value);
+}
+
+/**
+ * The one place the field encodings are read. A payload stamped with a
+ * kind wins outright; an unstamped one (a replayed retry payload) is
+ * classified by the fields that carry its family. The fallback order is
+ * specific-before-generic: reaction prefixes and the delete sentinel are
+ * particular `callbackData` values, so they are tested before the generic
+ * button reading.
+ */
+export function resolveInboundEventKind(fields: {
+  eventKind?: string;
+  isEdit?: boolean;
+  callbackData?: string;
+  callbackQueryId?: string;
+}): InboundEventKind {
+  if (fields.eventKind !== undefined && isInboundEventKind(fields.eventKind)) {
+    return fields.eventKind;
+  }
+  if (fields.isEdit === true) {
+    return "edit";
+  }
+  const cb = fields.callbackData;
+  if (cb !== undefined && cb.length > 0) {
+    if (cb === "message_deleted") {
+      return "delete";
+    }
+    if (cb.startsWith("reaction:") || cb.startsWith("reaction_removed:")) {
+      return "reaction";
+    }
+    return "button";
+  }
+  if (fields.callbackQueryId !== undefined) {
+    return "button";
+  }
+  return "message";
+}
+
+/**
+ * Whether an event of this kind refers to another message rather than
+ * standing alone as new content. Referring events never mint a
+ * conversation of their own and never carry ingestable attachments.
+ */
+export function inboundEventRefersToAnotherMessage(
+  kind: InboundEventKind,
+): boolean {
+  return kind !== "message";
+}

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -83,6 +83,23 @@ export {
 
 export type { AdmissionPolicy } from "./admission-policy-contract.js";
 
+export {
+  INBOUND_EVENT_KINDS,
+  inboundEventRefersToAnotherMessage,
+  isInboundEventKind,
+  resolveInboundEventKind,
+} from "./inbound-event-kind.js";
+export type { InboundEventKind } from "./inbound-event-kind.js";
+
+// Plugin admission-denied notice (gateway → plugin) — canned deny copy + envelope
+export {
+  ACCESS_DENIED_NOT_APPROVED_REPLY,
+  PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PluginAdmissionDeniedNoticeSchema,
+} from "./plugin-admission-denied-contract.js";
+
+export type { PluginAdmissionDeniedNotice } from "./plugin-admission-denied-contract.js";
+
 // Trust verdict contract (gateway → daemon) — Zod schemas + derived types
 export {
   isTrustClass,

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -61,6 +61,14 @@ export const ApprovalUIMetadataSchema = z.object({
   actions: z.array(ApprovalActionOptionSchema),
   plainTextFallback: z.string(),
   permissionDetails: PermissionRequestDetailsSchema.optional(),
+  /**
+   * What the recipient is being asked to do, so a renderer can head the card
+   * with the right verb. Resolved once by the producer; a renderer that reads
+   * the actions to work it out would be parsing a payload it is meant only to
+   * draw. Absent means an approval, which is what every existing producer
+   * sends and what a renderer without this field already assumes.
+   */
+  intent: z.enum(["approval", "question"]).optional(),
 });
 
 export type ApprovalUIMetadata = z.infer<typeof ApprovalUIMetadataSchema>;

package/node_modules/@vellumai/gateway-client/src/plugin-admission-denied-contract.ts

@@ -0,0 +1,47 @@
+/**
+ * Canned access-denial copy and the plugin notice the gateway posts when a
+ * plugin inbound delivery clears verification but fails the admission floor.
+ *
+ * Built-in channels send this reply through the runtime's channel transport.
+ * A plugin channel has no such transport: the gateway does not hold the
+ * vendor send credentials, so the notice is how the plugin learns it must
+ * send the same line itself, without running a turn.
+ */
+
+import { z } from "zod";
+
+import { AdmissionPolicySchema } from "./admission-policy-contract.js";
+import { TrustClassSchema } from "./trust-verdict-contract.js";
+
+/**
+ * Requester-facing reply when access is denied and there is no handshake
+ * and no guardian notification. Single source for this line: the runtime
+ * ACL composer and the plugin admission-denied notice both send it.
+ */
+export const ACCESS_DENIED_NOT_APPROVED_REPLY =
+  "Sorry, you haven't been approved to message this assistant.";
+
+/**
+ * Plugin route the gateway posts the notice to, under
+ * `/v1/x/plugins/<plugin>/`. Not a public ingress path.
+ */
+export const PLUGIN_ADMISSION_DENIED_NOTICE_PATH = "notices/admission-denied";
+
+export const PluginAdmissionDeniedNoticeSchema = z.object({
+  reason: z.literal("admission_floor"),
+  plugin: z.string().min(1),
+  ingressRoute: z.string().min(1),
+  admissionPolicy: AdmissionPolicySchema,
+  trustClass: TrustClassSchema,
+  /** Vendor chat id, without the plugin prefix the gate stores. */
+  conversationExternalId: z.string().min(1),
+  /** Vendor sender id, without the plugin prefix the gate stores. */
+  actorExternalId: z.string().min(1),
+  /** Vendor message id, without the plugin prefix the gate stores. */
+  externalMessageId: z.string().min(1),
+  replyText: z.string().min(1),
+});
+
+export type PluginAdmissionDeniedNotice = z.infer<
+  typeof PluginAdmissionDeniedNoticeSchema
+>;

package/node_modules/@vellumai/gateway-client/src/trust-verdict-contract.ts

@@ -78,6 +78,17 @@ export const TrustVerdictSchema = z.object({
   policy: z.string().optional(),
   verifiedAt: z.number().nullable().optional(),
   memberDisplayName: z.string().optional(),
+  /**
+   * Contact-level auto-approve ceiling from the gateway `contacts` row.
+   * Present when a member channel resolves. Null means the contact has no
+   * explicit override (inherit the room / trust-class cascade).
+   * Same vocabulary as `RiskThreshold` (`none` | `low` | `medium` | `high`).
+   * Inlined here so this leaf contract does not import the permission matrix.
+   */
+  autoApproveThreshold: z
+    .enum(["none", "low", "medium", "high"])
+    .nullable()
+    .optional(),
 
   // Gateway-owned interaction telemetry (a trust signal, not an info field per
   // the 2×2) — carried straight off the member `contact_channels` row.

package/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts

@@ -6,8 +6,10 @@ import {
   normalizePublicBaseUrl,
   parseRecordedAssistantId,
   parseTunnelRecord,
+  selectRestartTunnelRecord,
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
+  type TunnelRecord,
   velayHostForPlatformHost,
 } from "../ingress.js";
 import {
@@ -221,6 +223,41 @@ describe("parseTunnelRecord", () => {
   });
 });
 
+describe("selectRestartTunnelRecord", () => {
+  const PAIRING: TunnelRecord = {
+    provider: "tailscale",
+    publicBaseUrl: "https://assistant-1.example.ts.net",
+  };
+  const LAST: TunnelRecord = {
+    provider: "ngrok",
+    publicBaseUrl: "https://assistant-1.ngrok.app",
+  };
+
+  test("prefers the pairing tunnel over the last one that ran", () => {
+    // The pairing tunnel deliberately left the older public record beside it,
+    // so naming that one would point at an ingress nobody is using.
+    expect(
+      selectRestartTunnelRecord({ lastTunnel: LAST, pairingTunnel: PAIRING }),
+    ).toEqual(PAIRING);
+  });
+
+  test("falls back to the last tunnel and to null", () => {
+    expect(selectRestartTunnelRecord({ lastTunnel: LAST })).toEqual(LAST);
+    for (const ingress of [undefined, null, {}, "nonsense", 42]) {
+      expect(selectRestartTunnelRecord(ingress)).toBeNull();
+    }
+  });
+
+  test("skips a malformed pairing record for a usable last one", () => {
+    expect(
+      selectRestartTunnelRecord({
+        lastTunnel: LAST,
+        pairingTunnel: { provider: "wireguard", publicBaseUrl: "nope" },
+      }),
+    ).toEqual(LAST);
+  });
+});
+
 describe("trimmedNonEmptyString", () => {
   test("trims and rejects blank or non-string values", () => {
     expect(trimmedNonEmptyString(" assistant-1 ")).toBe("assistant-1");