@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/rpc.ts

@@ -16,6 +16,13 @@
  * - `delete_credential` — Delete a credential by account name
  * - `list_credentials` — List all credential account names
  * - `bulk_set_credentials` — Store multiple credentials at once
+ *
+ * **Credential records** (non-secret identity + policy)
+ * - `get_credential_record` — Retrieve a credential record by account name
+ * - `set_credential_record` — Store or update a credential record
+ * - `delete_credential_record` — Delete a credential record by account name
+ * - `list_credential_records` — List all credential records
+ * - `bulk_set_credential_records` — Store multiple credential records at once
  */
 
 import { z } from "zod";
@@ -38,6 +45,16 @@ export const CesRpcMethod = {
   ListCredentials: "list_credentials",
   /** Bulk-import credentials (set multiple at once). */
   BulkSetCredentials: "bulk_set_credentials",
+  /** Retrieve a single credential record (identity + policy) by account name. */
+  GetCredentialRecord: "get_credential_record",
+  /** Store or update a credential record by account name. */
+  SetCredentialRecord: "set_credential_record",
+  /** Delete a credential record by account name. */
+  DeleteCredentialRecord: "delete_credential_record",
+  /** List all credential records. */
+  ListCredentialRecords: "list_credential_records",
+  /** Bulk-import credential records. */
+  BulkSetCredentialRecords: "bulk_set_credential_records",
 } as const;
 
 export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
@@ -168,6 +185,123 @@ export type BulkSetCredentialsResponse = z.infer<
   typeof BulkSetCredentialsResponseSchema
 >;
 
+// ---------------------------------------------------------------------------
+// Credential records (identity + policy, never secret values)
+// ---------------------------------------------------------------------------
+
+export const CredentialInjectionTemplateSchema = z.object({
+  hostPattern: z.string(),
+  injectionType: z.enum(["header", "query"]),
+  headerName: z.string().optional(),
+  valuePrefix: z.string().optional(),
+  queryParamName: z.string().optional(),
+  composeWith: z
+    .object({
+      service: z.string(),
+      field: z.string(),
+      separator: z.string(),
+    })
+    .optional(),
+  valueTransform: z.enum(["base64"]).optional(),
+});
+export type CredentialInjectionTemplate = z.infer<
+  typeof CredentialInjectionTemplateSchema
+>;
+
+export const CredentialRecordSchema = z.object({
+  credentialId: z.string(),
+  service: z.string(),
+  field: z.string(),
+  allowedTools: z.array(z.string()),
+  allowedDomains: z.array(z.string()),
+  usageDescription: z.string().optional(),
+  alias: z.string().optional(),
+  injectionTemplates: z.array(CredentialInjectionTemplateSchema).optional(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type CredentialRecord = z.infer<typeof CredentialRecordSchema>;
+
+export const GetCredentialRecordSchema = z.object({
+  /** The account name to look up (`credential/{service}/{field}`). */
+  account: z.string(),
+});
+export type GetCredentialRecord = z.infer<typeof GetCredentialRecordSchema>;
+
+export const GetCredentialRecordResponseSchema = z.object({
+  found: z.boolean(),
+  record: CredentialRecordSchema.optional(),
+});
+export type GetCredentialRecordResponse = z.infer<
+  typeof GetCredentialRecordResponseSchema
+>;
+
+export const SetCredentialRecordSchema = z.object({
+  account: z.string(),
+  record: CredentialRecordSchema,
+});
+export type SetCredentialRecord = z.infer<typeof SetCredentialRecordSchema>;
+
+export const SetCredentialRecordResponseSchema = z.object({
+  ok: z.boolean(),
+});
+export type SetCredentialRecordResponse = z.infer<
+  typeof SetCredentialRecordResponseSchema
+>;
+
+export const DeleteCredentialRecordSchema = z.object({
+  account: z.string(),
+});
+export type DeleteCredentialRecord = z.infer<
+  typeof DeleteCredentialRecordSchema
+>;
+
+export const DeleteCredentialRecordResponseSchema = z.object({
+  result: z.enum(["deleted", "not-found", "error"]),
+});
+export type DeleteCredentialRecordResponse = z.infer<
+  typeof DeleteCredentialRecordResponseSchema
+>;
+
+export const ListCredentialRecordsSchema = z.object({});
+export type ListCredentialRecords = z.infer<typeof ListCredentialRecordsSchema>;
+
+export const ListCredentialRecordsResponseSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type ListCredentialRecordsResponse = z.infer<
+  typeof ListCredentialRecordsResponseSchema
+>;
+
+export const BulkSetCredentialRecordsSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type BulkSetCredentialRecords = z.infer<
+  typeof BulkSetCredentialRecordsSchema
+>;
+
+export const BulkSetCredentialRecordsResponseSchema = z.object({
+  results: z.array(
+    z.object({
+      account: z.string(),
+      ok: z.boolean(),
+    }),
+  ),
+});
+export type BulkSetCredentialRecordsResponse = z.infer<
+  typeof BulkSetCredentialRecordsResponseSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Full RPC contract type map
 // ---------------------------------------------------------------------------
@@ -201,6 +335,26 @@ export interface CesRpcContract {
     request: BulkSetCredentials;
     response: BulkSetCredentialsResponse;
   };
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecord;
+    response: GetCredentialRecordResponse;
+  };
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecord;
+    response: SetCredentialRecordResponse;
+  };
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecord;
+    response: DeleteCredentialRecordResponse;
+  };
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecords;
+    response: ListCredentialRecordsResponse;
+  };
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecords;
+    response: BulkSetCredentialRecordsResponse;
+  };
 }
 
 /**
@@ -231,4 +385,24 @@ export const CesRpcSchemas = {
     request: BulkSetCredentialsSchema,
     response: BulkSetCredentialsResponseSchema,
   },
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecordSchema,
+    response: GetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecordSchema,
+    response: SetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecordSchema,
+    response: DeleteCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecordsSchema,
+    response: ListCredentialRecordsResponseSchema,
+  },
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecordsSchema,
+    response: BulkSetCredentialRecordsResponseSchema,
+  },
 } as const;

package/node_modules/@vellumai/ces-client/src/http-credentials.ts

@@ -16,10 +16,14 @@
  * Auth: Bearer token from a caller-supplied config.
  */
 
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
+export type { CredentialRecord };
+
 /** Result of a credential get operation. */
 export interface CesCredentialGetResult {
   value: string | undefined;
@@ -111,6 +115,28 @@ export interface CesHttpCredentialClient {
 
   /** List all credential account names. */
   list(): Promise<CesCredentialListResult>;
+
+  /** Retrieve a credential record (identity + policy) by account name. */
+  getRecord(
+    account: string,
+  ): Promise<{ record: CredentialRecord | undefined; unreachable: boolean }>;
+
+  /** Store or update a credential record. */
+  setRecord(account: string, record: CredentialRecord): Promise<boolean>;
+
+  /** Delete a credential record by account name. */
+  deleteRecord(account: string): Promise<CesDeleteResult>;
+
+  /** List all credential records. */
+  listRecords(): Promise<{
+    records: Array<{ account: string; record: CredentialRecord }>;
+    unreachable: boolean;
+  }>;
+
+  /** Bulk-set credential records. */
+  bulkSetRecords(
+    records: Array<{ account: string; record: CredentialRecord }>,
+  ): Promise<Array<{ account: string; ok: boolean }>>;
 }
 
 // ---------------------------------------------------------------------------
@@ -292,5 +318,140 @@ export function createCesHttpCredentialClient(
         return { accounts: [], unreachable: true };
       }
     },
+
+    async getRecord(account: string) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "GET",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+        );
+        if (!res) {
+          return { record: undefined, unreachable: true };
+        }
+        if (res.status === 404) {
+          return { record: undefined, unreachable: false };
+        }
+        if (!res.ok) {
+          logger.warn(
+            { account, status: res.status },
+            "CES credential record get returned non-OK status",
+          );
+          return { record: undefined, unreachable: true };
+        }
+        const data = (await res.json()) as { record?: CredentialRecord };
+        return { record: data.record, unreachable: false };
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record get threw unexpectedly",
+        );
+        return { record: undefined, unreachable: true };
+      }
+    },
+
+    async setRecord(account: string, record: CredentialRecord) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "PUT",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+          { record },
+        );
+        return !!res?.ok;
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record set threw unexpectedly",
+        );
+        return false;
+      }
+    },
+
+    async deleteRecord(account: string) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "DELETE",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+        );
+        if (!res) {
+          return "error";
+        }
+        if (res.status === 404) {
+          return "not-found";
+        }
+        if (!res.ok) {
+          return "error";
+        }
+        return "deleted";
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record delete threw unexpectedly",
+        );
+        return "error";
+      }
+    },
+
+    async listRecords() {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "GET",
+          "/v1/metadata",
+        );
+        if (!res) {
+          return { records: [], unreachable: true };
+        }
+        if (!res.ok) {
+          return { records: [], unreachable: true };
+        }
+        const data = (await res.json()) as {
+          records?: Array<{ account: string; record: CredentialRecord }>;
+        };
+        return { records: data.records ?? [], unreachable: false };
+      } catch (err) {
+        logger.warn(
+          { err } as Record<string, unknown>,
+          "CES credential record list threw unexpectedly",
+        );
+        return { records: [], unreachable: true };
+      }
+    },
+
+    async bulkSetRecords(
+      records: Array<{ account: string; record: CredentialRecord }>,
+    ) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "POST",
+          "/v1/metadata/bulk",
+          { records },
+        );
+        if (!res?.ok) {
+          return records.map((entry) => ({
+            account: entry.account,
+            ok: false,
+          }));
+        }
+        const data = (await res.json()) as {
+          results: Array<{ account: string; ok: boolean }>;
+        };
+        return data.results;
+      } catch (err) {
+        logger.warn(
+          { err } as Record<string, unknown>,
+          "CES credential record bulk set threw unexpectedly",
+        );
+        return records.map((entry) => ({ account: entry.account, ok: false }));
+      }
+    },
   };
 }

package/node_modules/@vellumai/ces-client/src/index.ts

@@ -18,6 +18,7 @@ export {
   type CesCredentialGetResult,
   type CesCredentialListResult,
   type CesDeleteResult,
+  type CredentialRecord,
 } from "./http-credentials.js";
 
 export {

package/node_modules/@vellumai/environments/package.json

@@ -6,7 +6,8 @@
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
-    "./seeds": "./src/seeds.ts"
+    "./seeds": "./src/seeds.ts",
+    "./shell": "./src/shell.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/environments/src/shell.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  buildShellInvocation,
+  pathListDelimiter,
+  prependUniquePathEntries,
+} from "./shell.js";
+
+describe("buildShellInvocation", () => {
+  test("uses Bash on POSIX hosts", () => {
+    expect(buildShellInvocation("printf hello", "linux")).toEqual({
+      command: "bash",
+      args: ["-c", "--", "printf hello"],
+    });
+  });
+
+  test("uses encoded non-interactive PowerShell on Windows", () => {
+    const invocation = buildShellInvocation(
+      "Write-Output 'hello 世界'",
+      "win32",
+    );
+
+    expect(invocation.command).toBe("powershell.exe");
+    expect(invocation.args.slice(0, -1)).toEqual([
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+    ]);
+    const encoded = invocation.args.at(-1)!;
+    const decoded = Buffer.from(encoded, "base64").toString("utf16le");
+    expect(decoded).toContain("[Console]::OutputEncoding");
+    expect(decoded).toContain("$global:LASTEXITCODE = 0");
+    expect(decoded).toContain("Write-Output 'hello 世界'");
+    expect(decoded).toContain("exit $__vellumNativeExitCode");
+    expect(decoded).toEndWith("exit 0");
+  });
+});
+
+describe("path list handling", () => {
+  test("uses the platform delimiter", () => {
+    expect(pathListDelimiter("win32")).toBe(";");
+    expect(pathListDelimiter("linux")).toBe(":");
+  });
+
+  test("prepends Windows paths without splitting drive letters", () => {
+    expect(
+      prependUniquePathEntries(
+        "C:\\Windows\\System32;C:\\Tools",
+        ["C:\\Tools", "C:\\Users\\Alice\\.bun\\bin"],
+        "win32",
+      ),
+    ).toBe("C:\\Users\\Alice\\.bun\\bin;C:\\Windows\\System32;C:\\Tools");
+  });
+});

package/node_modules/@vellumai/environments/src/shell.ts

@@ -0,0 +1,65 @@
+import { delimiter } from "node:path";
+
+export interface ShellInvocation {
+  command: string;
+  args: string[];
+}
+
+const WINDOWS_UTF8_PREAMBLE =
+  "try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}; " +
+  "$OutputEncoding = [System.Text.Encoding]::UTF8; " +
+  "$global:LASTEXITCODE = 0;";
+
+const WINDOWS_EXIT_STATUS_SUFFIX = `
+$__vellumCommandSucceeded = $?
+$__vellumNativeExitCode = $LASTEXITCODE
+if (-not $__vellumCommandSucceeded) {
+  if ($__vellumNativeExitCode -ne 0) { exit $__vellumNativeExitCode }
+  exit 1
+}
+exit 0`;
+
+export function buildShellInvocation(
+  command: string,
+  hostPlatform: NodeJS.Platform = process.platform,
+  windowsExecutable = "powershell.exe",
+): ShellInvocation {
+  if (hostPlatform === "win32") {
+    return {
+      command: windowsExecutable,
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-EncodedCommand",
+        Buffer.from(
+          `${WINDOWS_UTF8_PREAMBLE}\n${command}${WINDOWS_EXIT_STATUS_SUFFIX}`,
+          "utf16le",
+        ).toString("base64"),
+      ],
+    };
+  }
+  return { command: "bash", args: ["-c", "--", command] };
+}
+
+export function pathListDelimiter(
+  hostPlatform: NodeJS.Platform = process.platform,
+): string {
+  return hostPlatform === process.platform
+    ? delimiter
+    : hostPlatform === "win32"
+      ? ";"
+      : ":";
+}
+
+export function prependUniquePathEntries(
+  value: string | undefined,
+  entries: readonly string[],
+  hostPlatform: NodeJS.Platform = process.platform,
+): string {
+  const separator = pathListDelimiter(hostPlatform);
+  const current = value?.split(separator).filter(Boolean) ?? [];
+  const missing = entries.filter((entry) => !current.includes(entry));
+  return [...missing, ...current].join(separator);
+}

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts

@@ -6,8 +6,10 @@ import {
   normalizePublicBaseUrl,
   parseRecordedAssistantId,
   parseTunnelRecord,
+  selectRestartTunnelRecord,
   trimmedNonEmptyString,
   TUNNEL_PROVIDERS,
+  type TunnelRecord,
   velayHostForPlatformHost,
 } from "../ingress.js";
 import {
@@ -221,6 +223,41 @@ describe("parseTunnelRecord", () => {
   });
 });
 
+describe("selectRestartTunnelRecord", () => {
+  const PAIRING: TunnelRecord = {
+    provider: "tailscale",
+    publicBaseUrl: "https://assistant-1.example.ts.net",
+  };
+  const LAST: TunnelRecord = {
+    provider: "ngrok",
+    publicBaseUrl: "https://assistant-1.ngrok.app",
+  };
+
+  test("prefers the pairing tunnel over the last one that ran", () => {
+    // The pairing tunnel deliberately left the older public record beside it,
+    // so naming that one would point at an ingress nobody is using.
+    expect(
+      selectRestartTunnelRecord({ lastTunnel: LAST, pairingTunnel: PAIRING }),
+    ).toEqual(PAIRING);
+  });
+
+  test("falls back to the last tunnel and to null", () => {
+    expect(selectRestartTunnelRecord({ lastTunnel: LAST })).toEqual(LAST);
+    for (const ingress of [undefined, null, {}, "nonsense", 42]) {
+      expect(selectRestartTunnelRecord(ingress)).toBeNull();
+    }
+  });
+
+  test("skips a malformed pairing record for a usable last one", () => {
+    expect(
+      selectRestartTunnelRecord({
+        lastTunnel: LAST,
+        pairingTunnel: { provider: "wireguard", publicBaseUrl: "nope" },
+      }),
+    ).toEqual(LAST);
+  });
+});
+
 describe("trimmedNonEmptyString", () => {
   test("trims and rejects blank or non-string values", () => {
     expect(trimmedNonEmptyString(" assistant-1 ")).toBe("assistant-1");