@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/node_modules/@vellumai/credential-storage/src/static-credentials.ts

@@ -216,6 +216,8 @@ export interface StaticCredentialPolicyInput {
  */
 export class StaticCredentialMetadataStore {
   private metadataPath: string;
+  /** When set, reads and writes stay in process and do not touch the file. */
+  private memory: MetadataFile | null = null;
 
   constructor(metadataPath: string) {
     this.metadataPath = metadataPath;
@@ -224,6 +226,17 @@ export class StaticCredentialMetadataStore {
   /** Update the metadata file path (primarily for testing). */
   setPath(path: string): void {
     this.metadataPath = path;
+    this.memory = null;
+  }
+
+  /**
+   * Switch to an in-memory backing filled with `records`.
+   */
+  useMemory(records: StaticCredentialRecord[] = []): void {
+    this.memory = {
+      version: CURRENT_VERSION,
+      credentials: records.map((record) => ({ ...record })),
+    };
   }
 
   /** Get the current metadata file path. */
@@ -231,13 +244,28 @@ export class StaticCredentialMetadataStore {
     return this.metadataPath;
   }
 
+  private load(): LoadResult {
+    if (this.memory) {
+      return this.memory;
+    }
+    return loadFile(this.metadataPath, saveFile);
+  }
+
+  private persist(data: MetadataFile): void {
+    if (this.memory) {
+      this.memory = data;
+      return;
+    }
+    saveFile(data, this.metadataPath);
+  }
+
   /**
    * Throws if the metadata file has an unrecognized version.
    * Call this before performing irreversible credential store operations
    * so the operation fails cleanly before any side effects.
    */
   assertWritable(): void {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) {
       throw new Error(
         "Credential metadata file has an unrecognized version; refusing to mutate to avoid data loss"
@@ -254,7 +282,7 @@ export class StaticCredentialMetadataStore {
     field: string,
     policy?: StaticCredentialPolicyInput
   ): StaticCredentialRecord {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) {
       throw new Error(
         "Credential metadata file has an unrecognized version; refusing to mutate to avoid data loss"
@@ -268,12 +296,15 @@ export class StaticCredentialMetadataStore {
     );
 
     if (existing) {
-      if (policy?.allowedTools !== undefined)
+      if (policy?.allowedTools !== undefined) {
         existing.allowedTools = policy.allowedTools;
-      if (policy?.allowedDomains !== undefined)
+      }
+      if (policy?.allowedDomains !== undefined) {
         existing.allowedDomains = policy.allowedDomains;
-      if (policy?.usageDescription !== undefined)
+      }
+      if (policy?.usageDescription !== undefined) {
         existing.usageDescription = policy.usageDescription;
+      }
       if (policy?.alias !== undefined) {
         if (policy.alias == null) {
           delete existing.alias;
@@ -289,7 +320,7 @@ export class StaticCredentialMetadataStore {
         }
       }
       existing.updatedAt = now;
-      saveFile(data, this.metadataPath);
+      this.persist(data);
       return existing;
     }
 
@@ -307,7 +338,7 @@ export class StaticCredentialMetadataStore {
     };
 
     data.credentials.push(record);
-    saveFile(data, this.metadataPath);
+    this.persist(data);
     return record;
   }
 
@@ -318,7 +349,7 @@ export class StaticCredentialMetadataStore {
     service: string,
     field: string
   ): StaticCredentialRecord | undefined {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) return undefined;
     return result.credentials.find(
       (c) => c.service === service && c.field === field
@@ -329,7 +360,7 @@ export class StaticCredentialMetadataStore {
    * Get metadata for a credential by its opaque ID.
    */
   getById(credentialId: string): StaticCredentialRecord | undefined {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) return undefined;
     return result.credentials.find((c) => c.credentialId === credentialId);
   }
@@ -338,7 +369,7 @@ export class StaticCredentialMetadataStore {
    * List all credential metadata records.
    */
   list(): StaticCredentialRecord[] {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) return [];
     return result.credentials;
   }
@@ -347,7 +378,7 @@ export class StaticCredentialMetadataStore {
    * Delete metadata for a credential.
    */
   delete(service: string, field: string): boolean {
-    const result = loadFile(this.metadataPath, saveFile);
+    const result = this.load();
     if (isUnknownVersion(result)) {
       throw new Error(
         "Credential metadata file has an unrecognized version; refusing to mutate to avoid data loss"
@@ -359,7 +390,7 @@ export class StaticCredentialMetadataStore {
     );
     if (idx === -1) return false;
     data.credentials.splice(idx, 1);
-    saveFile(data, this.metadataPath);
+    this.persist(data);
     return true;
   }
 }

package/node_modules/@vellumai/environments/package.json

@@ -7,7 +7,8 @@
   "exports": {
     ".": "./src/index.ts",
     "./seeds": "./src/seeds.ts",
-    "./shell": "./src/shell.ts"
+    "./shell": "./src/shell.ts",
+    "./test-path-guard": "./src/test-path-guard.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/environments/src/__tests__/test-path-guard.test.ts

@@ -0,0 +1,89 @@
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import {
+  assertTestPathIsEphemeral,
+  canonicalizePathThroughExistingParent,
+  isBunTestProcess,
+} from "../test-path-guard.js";
+
+const OPTIONS = {
+  allowEnvVar: "TEST_PATH_GUARD_ALLOW",
+  runHint: "Run tests from the package root.",
+};
+
+describe("isBunTestProcess", () => {
+  test("detects this bun test run", () => {
+    expect(isBunTestProcess()).toBe(true);
+  });
+});
+
+describe("canonicalizePathThroughExistingParent", () => {
+  test("resolves symlinks on the deepest existing ancestor", () => {
+    const root = mkdtempSync(join(tmpdir(), "test-path-guard-"));
+    try {
+      const target = join(root, "target");
+      mkdirSync(target);
+      const link = join(root, "link");
+      symlinkSync(target, link, "dir");
+      expect(
+        canonicalizePathThroughExistingParent(join(link, "missing", "leaf")),
+      ).toBe(
+        join(canonicalizePathThroughExistingParent(target), "missing", "leaf"),
+      );
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("returns the input path when no ancestor exists", () => {
+    expect(canonicalizePathThroughExistingParent("/nonexistent-root-x/y")).toBe(
+      "/nonexistent-root-x/y",
+    );
+  });
+});
+
+describe("assertTestPathIsEphemeral", () => {
+  test("allows paths under tmpdir, existing or not", () => {
+    expect(() =>
+      assertTestPathIsEphemeral(join(tmpdir(), "guard-missing", "x"), OPTIONS),
+    ).not.toThrow();
+  });
+
+  test("refuses paths outside tmpdir, naming the escape hatch and hint", () => {
+    delete process.env[OPTIONS.allowEnvVar];
+    const dir = join(homedir(), "test-path-guard-live");
+    expect(() => assertTestPathIsEphemeral(dir, OPTIONS)).toThrow(
+      /Refusing to use[\s\S]*package root[\s\S]*TEST_PATH_GUARD_ALLOW/,
+    );
+  });
+
+  test("refuses a tmpdir symlink that resolves outside tmpdir", () => {
+    delete process.env[OPTIONS.allowEnvVar];
+    const link = join(tmpdir(), `test-path-guard-escape-${process.pid}`);
+    rmSync(link, { force: true });
+    symlinkSync(homedir(), link);
+    try {
+      expect(() => assertTestPathIsEphemeral(link, OPTIONS)).toThrow(
+        /Refusing to use/,
+      );
+    } finally {
+      rmSync(link, { force: true });
+    }
+  });
+
+  test("the allow env var bypasses the guard, per call", () => {
+    const dir = join(homedir(), "test-path-guard-optout");
+    process.env[OPTIONS.allowEnvVar] = "1";
+    try {
+      expect(() => assertTestPathIsEphemeral(dir, OPTIONS)).not.toThrow();
+    } finally {
+      delete process.env[OPTIONS.allowEnvVar];
+    }
+    expect(() => assertTestPathIsEphemeral(dir, OPTIONS)).toThrow(
+      /Refusing to use/,
+    );
+  });
+});

package/node_modules/@vellumai/environments/src/test-path-guard.ts

@@ -0,0 +1,113 @@
+/**
+ * Live-path guard for test processes, shared by every service that resolves
+ * install-layout paths (the assistant daemon's workspace/root, the gateway's
+ * workspace and security dirs).
+ *
+ * A test process must never resolve one of those paths to a real, non-temp
+ * directory: production code exercised by a test would then read and
+ * destructively write live state. The tmpdir redirection normally comes from
+ * each package's bunfig.toml test preload, but bun only loads bunfig from
+ * the cwd, so `bun test` run from any other directory skips the preload and
+ * inherits the ambient env (or a ~/.vellum fallback). The containment
+ * assertion therefore lives in production code, where it fires no matter how
+ * the test process was launched.
+ *
+ * assistant/src/__tests__/assert-not-live-db.ts keeps its own containment
+ * check: test machinery must not import production dependencies.
+ */
+
+import { realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, resolve, sep } from "node:path";
+
+/**
+ * Resolve symlinks in the deepest existing ancestor of `path`, then
+ * re-append the not-yet-created tail. This keeps containment checks honest
+ * both for paths under a symlinked temp root (macOS /var/folders) and for
+ * symlinks that point outside it, whether or not the leaf exists yet.
+ */
+export function canonicalizePathThroughExistingParent(path: string): string {
+  const resolvedPath = resolve(path);
+  const pendingSegments: string[] = [];
+  let currentPath = resolvedPath;
+
+  while (true) {
+    try {
+      return resolve(realpathSync(currentPath), ...pendingSegments.reverse());
+    } catch {
+      const parentPath = dirname(currentPath);
+      if (parentPath === currentPath) {
+        return resolvedPath;
+      }
+      pendingSegments.push(basename(currentPath));
+      currentPath = parentPath;
+    }
+  }
+}
+
+/** Lazily computed: is this process a `bun test` run? */
+let isTestProcess: boolean | undefined;
+
+/**
+ * True when this process is a `bun test` run. Computed once and cached for
+ * the process lifetime, so a runtime flip of NODE_ENV or BUN_TEST does not
+ * change the answer. Test-mode behavior toggles that must observe such
+ * flips read the env directly instead of calling this.
+ */
+export function isBunTestProcess(): boolean {
+  isTestProcess ??=
+    process.env.NODE_ENV === "test" ||
+    process.env.BUN_TEST === "1" ||
+    // `bun test` sets NODE_ENV=test only when unset; Bun.main being the test
+    // file itself is the backstop signal that survives a preset NODE_ENV.
+    (typeof Bun !== "undefined" &&
+      /\.(test|spec)\.[cm]?[jt]sx?$/.test(Bun.main));
+  return isTestProcess;
+}
+
+export interface EphemeralTestPathOptions {
+  /**
+   * Escape hatch for the rare intentional run against real state: setting
+   * this env var to "1" bypasses the guard. Callers reuse the variable their
+   * DB-open guard already honors. Deliberately not forwarded into
+   * agent-spawned shells (assistant/src/tools/terminal/safe-env.ts), so a
+   * daemon-level opt-out cannot disarm the guard for tests run from there.
+   */
+  allowEnvVar: string;
+  /** Package-specific line telling the reader where to run tests from. */
+  runHint: string;
+}
+
+/**
+ * Throws when called in a bun-test process and `dir` does not resolve under
+ * `os.tmpdir()`. Inert outside test processes. Canonicalizes on every call
+ * (no memo): a previously validated path could later be replaced by a
+ * symlink, and the guard only runs in test processes anyway.
+ */
+export function assertTestPathIsEphemeral(
+  dir: string,
+  options: EphemeralTestPathOptions,
+): void {
+  if (!isBunTestProcess()) {
+    return;
+  }
+  if (process.env[options.allowEnvVar] === "1") {
+    return;
+  }
+  const tmpRoot = canonicalizePathThroughExistingParent(tmpdir());
+  const resolved = canonicalizePathThroughExistingParent(dir);
+  if (resolved !== tmpRoot && !resolved.startsWith(tmpRoot + sep)) {
+    throw new Error(
+      [
+        `Refusing to use ${dir} (resolves to ${resolved}) in a test process: it is not under the temp directory (${tmpRoot}).`,
+        "",
+        "Tests must only touch ephemeral state; a real directory would expose",
+        "live install state to destructive test fixtures. This usually means",
+        "`bun test` ran from a cwd without the package's bunfig.toml, so the",
+        "test preload that redirects paths to a tmpdir never loaded.",
+        options.runHint,
+        `Set ${options.allowEnvVar}=1 to bypass deliberately.`,
+      ].join("\n"),
+    );
+  }
+}

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/package.json

@@ -11,6 +11,7 @@
     "./client-metadata": "./src/client-metadata.ts",
     "./credential-rpc": "./src/credential-rpc.ts",
     "./ingress": "./src/ingress.ts",
+    "./no-response": "./src/no-response.ts",
     "./remote-web-pairing": "./src/remote-web-pairing.ts",
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/channels.ts

@@ -66,6 +66,13 @@ export function isChannelId(value: unknown): value is ChannelId {
  * That irregularity is why this is stated rather than derived from the key,
  * and it is stated here because this file already owns what a channel is.
  *
+ * Both senses can hold a user token, which is the sharpest edge. The `slack`
+ * integration's persisted token *is* the installer's user token, held on its
+ * OAuth connection. `slack_channel` holds an optional `user_token` in the
+ * credential store, beside its bot and app tokens. Same words, different
+ * homes, and only the second is a credential-store key: a pasted token is
+ * always the channel's, because the integration's never leaves the exchange.
+ *
  * Deliberately only the key. What fields each credential requires is declared
  * once already, per service, in the gateway's credential specs; restating it
  * here would be a second copy of a different fact.

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -27,6 +27,7 @@ export * from "./handles.js";
 export * from "./rpc.js";
 export * from "./trust-rules.js";
 export * from "./ingress.js";
+export * from "./no-response.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/no-response.ts

@@ -0,0 +1,84 @@
+/**
+ * The `<no_response/>` sentinel: the cross-service convention for a turn
+ * that deliberately produces no user-visible reply.
+ *
+ * The model emits it, the daemon stamps and strips it, channel delivery
+ * suppresses it, and clients hold live-streamed prefixes of it back from
+ * display. One definition here keeps every consumer's parsing identical;
+ * a hand-rolled copy in any one of them is how the case-sensitivity of a
+ * regex drifts.
+ */
+
+/** Matches a message whose entire content is the sentinel. */
+const NO_RESPONSE_ONLY_RE = /^\s*<no_response\s*\/?>\s*$/i;
+
+/**
+ * Whether `text` is nothing but the sentinel: the whole reply is a
+ * deliberate non-response, as opposed to real content with an inline
+ * sentinel mixed in.
+ */
+export function isNoResponseOnlyText(text: string): boolean {
+  return NO_RESPONSE_ONLY_RE.test(text);
+}
+
+/** Matches every sentinel occurrence for stripping it out of mixed content. */
+export const NO_RESPONSE_INLINE_RE = /<no_response\s*\/?>/gi;
+
+/**
+ * Detection variant without the `g` flag: a `g`-flagged regex is stateful
+ * under `.test()` (it resumes from `lastIndex`), so reusing
+ * {@link NO_RESPONSE_INLINE_RE} for detection would alternate between
+ * matches and misses across calls.
+ */
+const NO_RESPONSE_MARKER_RE = new RegExp(NO_RESPONSE_INLINE_RE.source, "i");
+
+/** Whether `text` contains the sentinel anywhere. */
+export function containsNoResponseMarker(text: string): boolean {
+  return NO_RESPONSE_MARKER_RE.test(text);
+}
+
+/** Removes every sentinel occurrence, trimming the leftover whitespace. */
+export function stripNoResponseMarkers(text: string): string {
+  return text.replace(NO_RESPONSE_INLINE_RE, "").trim();
+}
+
+const NO_RESPONSE_SENTINEL_FORMS = [
+  "<no_response/>",
+  "<no_response />",
+  "<no_response>",
+] as const;
+
+/**
+ * Whether `text` could still grow into the sentinel, i.e. it is a leading
+ * substring of one of its forms. Holding on these keeps a slowly-streamed
+ * `<no_response/>` from surfacing as visible partial content.
+ */
+export function isPotentialNoResponsePrefix(text: string): boolean {
+  const lower = text.trim().toLowerCase();
+  if (lower.length === 0) {
+    return false;
+  }
+  return NO_RESPONSE_SENTINEL_FORMS.some((sentinel) =>
+    sentinel.startsWith(lower),
+  );
+}
+
+/**
+ * Whether `text` carries user-visible content worth acting on now. Returns
+ * `false` for empty text, the standalone sentinel, and any prefix that could
+ * still complete into one; returns `true` once real content remains after
+ * stripping inline sentinels.
+ */
+export function hasDeliverableAssistantText(text: string): boolean {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) {
+    return false;
+  }
+  if (NO_RESPONSE_ONLY_RE.test(trimmed)) {
+    return false;
+  }
+  if (isPotentialNoResponsePrefix(trimmed)) {
+    return false;
+  }
+  return stripNoResponseMarkers(trimmed).length > 0;
+}

package/node_modules/@vellumai/gateway-client/src/__tests__/guardian-request-contract.test.ts

@@ -31,8 +31,7 @@ import {
   ListGuardianRequestsIpcParamsSchema,
   ListPendingGuardianRequestsByDestinationIpcParamsSchema,
   ListPendingGuardianRequestsByScopeIpcParamsSchema,
-  SweepExpiredGuardianRequestsIpcParamsSchema,
-  SweepExpiredGuardianRequestsIpcResponseSchema,
+  ListExpiredPendingGuardianRequestsIpcParamsSchema,
   UpdateGuardianRequestIpcParamsSchema,
   type GuardianRequestWire,
 } from "../guardian-request-contract.js";
@@ -439,29 +438,20 @@ describe("decide IPC schemas", () => {
 });
 
 describe("expiry IPC schemas", () => {
-  test("expire and sweep round-trip", () => {
+  test("expire and expired-pending list round-trip", () => {
     expect(ExpireGuardianRequestIpcParamsSchema.parse({ id: "req-1" })).toEqual(
       { id: "req-1" },
     );
 
     expect(
-      SweepExpiredGuardianRequestsIpcParamsSchema.parse({
+      ListExpiredPendingGuardianRequestsIpcParamsSchema.parse({
         now: 1_700_000_000_000,
+        limit: 50,
       }),
-    ).toEqual({ now: 1_700_000_000_000 });
-    expect(SweepExpiredGuardianRequestsIpcParamsSchema.parse({})).toEqual({});
-    // The sweep returns full rows so the daemon fan-out never re-reads.
-    const expiredRow = { ...accessRequest, status: "expired" as const };
-    expect(
-      SweepExpiredGuardianRequestsIpcResponseSchema.parse({
-        expired: [expiredRow],
-      }),
-    ).toEqual({ expired: [expiredRow] });
-    expect(() =>
-      SweepExpiredGuardianRequestsIpcResponseSchema.parse({
-        expired: ["req-1"],
-      }),
-    ).toThrow();
+    ).toEqual({ now: 1_700_000_000_000, limit: 50 });
+    expect(ListExpiredPendingGuardianRequestsIpcParamsSchema.parse({})).toEqual(
+      {},
+    );
 
     expect(
       ExpireInteractionBoundIpcResponseSchema.parse({ expired: 3 }),

package/node_modules/@vellumai/gateway-client/src/__tests__/inbound-event-kind.test.ts

@@ -9,6 +9,7 @@ import { describe, expect, test } from "bun:test";
 import {
   inboundEventRefersToAnotherMessage,
   resolveInboundEventKind,
+  resolveInboundReactionPayload,
 } from "../inbound-event-kind.js";
 
 describe("resolveInboundEventKind", () => {
@@ -80,3 +81,48 @@ describe("inboundEventRefersToAnotherMessage", () => {
     expect(inboundEventRefersToAnotherMessage("button")).toBe(true);
   });
 });
+
+describe("resolveInboundReactionPayload", () => {
+  test("a structured payload wins outright", () => {
+    expect(
+      resolveInboundReactionPayload({
+        eventKind: "reaction",
+        reaction: { op: "removed", emoji: "+1", targetMessageId: "11.22" },
+        callbackData: "reaction:eyes",
+      }),
+    ).toEqual({ op: "removed", emoji: "+1", targetMessageId: "11.22" });
+  });
+
+  test("a replayed payload parses its sentinel and wire target", () => {
+    expect(
+      resolveInboundReactionPayload({
+        callbackData: "reaction:thumbsup",
+        sourceMetadata: { messageId: "33.44" },
+      }),
+    ).toEqual({ op: "added", emoji: "thumbsup", targetMessageId: "33.44" });
+    expect(
+      resolveInboundReactionPayload({
+        callbackData: "reaction_removed:thumbsup",
+        sourceMetadata: { messageId: "33.44" },
+      }),
+    ).toEqual({ op: "removed", emoji: "thumbsup", targetMessageId: "33.44" });
+  });
+
+  test("no emoji or no target is not a reaction payload", () => {
+    expect(
+      resolveInboundReactionPayload({
+        callbackData: "reaction:",
+        sourceMetadata: { messageId: "33.44" },
+      }),
+    ).toBeNull();
+    expect(
+      resolveInboundReactionPayload({ callbackData: "reaction:thumbsup" }),
+    ).toBeNull();
+    expect(
+      resolveInboundReactionPayload({
+        callbackData: "apr:req-1:approve_once",
+        sourceMetadata: { messageId: "33.44" },
+      }),
+    ).toBeNull();
+  });
+});

package/node_modules/@vellumai/gateway-client/src/__tests__/invite-contract.test.ts

@@ -94,6 +94,7 @@ describe("isValidE164", () => {
 describe("invite-code channel gating", () => {
   test("allows exactly the redemption-enabled channels", () => {
     expect([...INVITE_CODE_REDEMPTION_CHANNELS].sort()).toEqual([
+      "discord",
       "email",
       "slack",
       "telegram",

package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts

@@ -355,6 +355,52 @@ export type GetGuardianContactIpcResponse = z.infer<
   typeof GetGuardianContactIpcResponseSchema
 >;
 
+// ── contacts_identity_snapshot ───────────────────────────────────────────────
+// Lean identity projection of every gateway contact + channel, for the
+// daemon's mirror reconciler: enough to converge the assistant identity
+// mirror onto gateway truth (ids, ownership, addresses), nothing more. No
+// ACL columns (the mirror never carries them) and no assistant-info join
+// (the daemon IS the assistant), so the read is uncapped and cheap.
+
+export const ContactsIdentitySnapshotIpcParamsSchema = z
+  .object({})
+  .strict()
+  .default({});
+
+export type ContactsIdentitySnapshotIpcParams = z.infer<
+  typeof ContactsIdentitySnapshotIpcParamsSchema
+>;
+
+export const ContactIdentityChannelSchema = z.object({
+  id: z.string(),
+  contactId: z.string(),
+  type: z.string(),
+  address: z.string(),
+  externalChatId: z.string().nullable(),
+  isPrimary: z.boolean(),
+});
+
+export type ContactIdentityChannel = z.infer<
+  typeof ContactIdentityChannelSchema
+>;
+
+export const ContactIdentitySchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  channels: z.array(ContactIdentityChannelSchema),
+});
+
+export type ContactIdentity = z.infer<typeof ContactIdentitySchema>;
+
+export const ContactsIdentitySnapshotIpcResponseSchema = z.object({
+  ok: z.boolean(),
+  contacts: z.array(ContactIdentitySchema),
+});
+
+export type ContactsIdentitySnapshotIpcResponse = z.infer<
+  typeof ContactsIdentitySnapshotIpcResponseSchema
+>;
+
 // ── classify_risk ────────────────────────────────────────────────────────────
 // Risk classification is gateway-owned; the assistant sends one request per
 // tool invocation and reads the whole answer back. The gateway validates the