@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/approvals/AGENTS.md

@@ -21,7 +21,7 @@ Conversational guardian verification control-plane invocation is guardian-only.
 
 ## Memory Provenance Invariant
 
-All memory retrieval decisions must consider actor-role provenance. Untrusted actors (non-guardian, unverified_channel) must not receive memory recall results. This invariant is enforced in `indexer.ts` (write gate) and `conversation-memory.ts` (read gate).
+All memory retrieval decisions must consider actor-role provenance. Untrusted actors (non-guardian, unverified_channel) must not receive memory recall results. This invariant is enforced in `indexer.ts` (write gate) and the memory plugin's `injectors.ts` (read gate), which admits personal-memory content only for a turn whose trust context passes `isPersonalMemoryAllowed`.
 
 ## Guardian Privilege Isolation Invariant
 

package/src/approvals/guardian-card-withdrawal.ts

@@ -22,10 +22,13 @@
  * Every surface is attempted independently; one failure never blocks the rest.
  */
 
+import { DELIVERY_STATUS } from "@vellumai/gateway-client";
+
 import {
   type GuardianRequestDeliveryWire,
   type GuardianRequestStatus,
   listGuardianRequestDeliveries,
+  updateGuardianRequestDelivery,
 } from "../channels/gateway-guardian-requests.js";
 import {
   completeSurfaceAndNotify,
@@ -35,6 +38,7 @@ import { withdrawDiscordApprovalCard } from "../messaging/providers/discord/with
 import { withdrawSlackApprovalCard } from "../messaging/providers/slack/withdraw.js";
 import { withdrawTelegramApprovalCard } from "../messaging/providers/telegram-bot/withdraw.js";
 import { approvalCardSurfaceId } from "../notifications/approval-card-data.js";
+import { writeGuardianFeedReceipt } from "../notifications/guardian-feed-projection.js";
 import {
   type ApprovalAction,
   resolveDecisionStatusWord,
@@ -66,6 +70,17 @@ export interface WithdrawGuardianCardsParams {
    * expiry sweep) to broadcast on every surface.
    */
   originChannel?: string;
+  /**
+   * Conversation the in-app decision was made from, when `originChannel` is
+   * `vellum`. A request can project a card into more than one conversation
+   * (the vellum card, plus any legacy channel rows that paired one), and
+   * only the acting conversation's client holds the optimistic completion
+   * the broadcast suppression exists to protect; every sibling projection
+   * still needs its live `ui_surface_complete`. Absent, every in-app projection is
+   * treated as the acting one: a vellum-origin decision then suppresses the
+   * broadcast on all of them and only persists their completions.
+   */
+  originConversationId?: string;
   /**
    * The action the guardian took, when the terminal status came from a decision
    * (omitted for the expiry sweep). A `denied` status can mean either a neutral
@@ -84,23 +99,52 @@ export interface WithdrawGuardianCardsParams {
    * outcome the guardian's chat gets.
    */
   hasOriginGuardianReply?: boolean;
+  /**
+   * Non-decision cause of the terminal status, for receipt copy only
+   * (e.g. "superseded" when a newer inbound message auto-denied the
+   * request). Channel card edits render the status word as before; the
+   * feed receipt surfaces the reason so the bell can say "Superseded"
+   * rather than "Rejected".
+   */
+  terminalReason?: string;
 }
 
 /**
- * Withdraw a resolved request's approval cards across all delivery surfaces.
- * Never throws.
+ * Withdraw a resolved request's approval cards across all delivery
+ * surfaces. Never throws. Each surface that durably withdraws marks its
+ * delivery row `withdrawn`; `complete` reports whether every row now
+ * carries that mark, so a caller whose own receipt depends on the cards
+ * actually being gone (the expiry sweep) can hold its receipt back and
+ * retry only what failed, while decision-path callers stay
+ * fire-and-forget. A surface with nothing a retry could ever fix (no
+ * captured message id, an unusable recorded id, a channel with no
+ * in-place edit) marks its row too, so it can never pin a request.
  */
 export async function withdrawGuardianRequestCards(
   params: WithdrawGuardianCardsParams,
-): Promise<void> {
+): Promise<{ complete: boolean }> {
   const {
     request,
     status,
     originChannel,
+    originConversationId,
     decidedAction,
     hasOriginGuardianReply,
   } = params;
 
+  // The canonical "Needs attention" feed item is a projection like any
+  // delivery surface: rewrite it into its terminal receipt first, so it
+  // settles even when the gateway (and thus the delivery list) is
+  // unreachable. A failed local write gates `complete` the same way a
+  // failed surface edit does, so the expiry sweep retries it.
+  let complete = await writeGuardianFeedReceipt({
+    requestId: request.id,
+    status,
+    ...(decidedAction ? { decidedAction } : {}),
+    decidedAtMs: request.updatedAt,
+    ...(params.terminalReason ? { terminalReason: params.terminalReason } : {}),
+  });
+
   let deliveries: GuardianRequestDeliveryWire[];
   try {
     deliveries = await listGuardianRequestDeliveries(request.id);
@@ -109,35 +153,54 @@ export async function withdrawGuardianRequestCards(
       { err, requestId: request.id },
       "Failed to list deliveries for card withdrawal",
     );
-    return;
+    return { complete: false };
   }
-
   for (const delivery of deliveries) {
+    if (delivery.status === DELIVERY_STATUS.withdrawn) {
+      continue;
+    }
+    let withdrawn = false;
     try {
+      // A delivery can carry two projections of the same card: the
+      // channel-native message, and the in-app rendering of any paired
+      // conversation (`destinationConversationId`). New channel guardian
+      // deliveries pair no conversation, so only the vellum delivery and
+      // legacy channel rows carry one; where a row does, withdrawal must
+      // settle both projections, or the paired conversation keeps live
+      // Approve/Reject buttons after the decision (LUM-3489).
+      const inAppWithdrawn = completeInAppProjection(
+        request,
+        delivery,
+        status,
+        originChannel,
+        originConversationId,
+        decidedAction,
+      );
       if (delivery.destinationChannel === "vellum") {
-        withdrawVellumCard(
-          request,
-          delivery,
-          status,
-          originChannel,
-          decidedAction,
-        );
+        withdrawn = inAppWithdrawn;
       } else if (delivery.destinationChannel === "slack") {
         await withdrawSlackCard(request, delivery, status, decidedAction);
+        withdrawn = inAppWithdrawn;
       } else if (delivery.destinationChannel === "telegram") {
-        await withdrawTelegramCard(
+        const telegram = await withdrawTelegramCard(
           delivery,
           status,
           originChannel,
           decidedAction,
           hasOriginGuardianReply ?? false,
         );
+        withdrawn = telegram.complete && inAppWithdrawn;
       } else if (delivery.destinationChannel === "discord") {
         await withdrawDiscordCard(delivery, status, decidedAction);
+        withdrawn = inAppWithdrawn;
+      } else {
+        // WhatsApp direct delivery can't edit a message in place (it would
+        // post a new one), so its stale clicks are left to the existing
+        // "already resolved" reply until in-place edit support lands.
+        // Nothing a channel retry could fix, so only the in-app projection
+        // gates the row rather than letting it pin its request.
+        withdrawn = inAppWithdrawn;
       }
-      // WhatsApp direct delivery can't edit a message in place (it would
-      // post a new one), so its stale clicks are left to the existing
-      // "already resolved" reply until in-place edit support lands.
     } catch (err) {
       log.warn(
         {
@@ -148,12 +211,37 @@ export async function withdrawGuardianRequestCards(
         "Failed to withdraw guardian card on surface (non-fatal)",
       );
     }
+
+    if (!withdrawn) {
+      complete = false;
+      continue;
+    }
+    try {
+      await updateGuardianRequestDelivery(delivery.id, {
+        status: DELIVERY_STATUS.withdrawn,
+      });
+    } catch (err) {
+      // The card is gone but the receipt write failed: the retry round
+      // re-runs this surface's idempotent edit and marks it then.
+      complete = false;
+      log.warn(
+        { err, requestId: request.id, deliveryId: delivery.id },
+        "Failed to record card withdrawal on the delivery row (non-fatal)",
+      );
+    }
   }
+  return { complete };
 }
 
 /**
- * Withdraw the in-app approval card so it stops offering live actions while
- * keeping its content.
+ * Complete a delivery's in-app card projection so it stops offering live
+ * actions while keeping its content. Applies to any delivery whose row
+ * records a paired conversation: the vellum card, and legacy channel rows
+ * written before channel deliveries stopped pairing, whose paired
+ * conversation renders the same actionable card in-app (the channel edit
+ * alone would leave that projection clickable). No-ops (successfully) when
+ * the delivery recorded no conversation, which is every new channel
+ * delivery.
  *
  * The completion is always persisted onto the card's `ui_surface` block. The
  * acting client's optimistic completion is in-memory only, so without this write
@@ -163,32 +251,41 @@ export async function withdrawGuardianRequestCards(
  * The `ui_surface_complete` broadcast is the only origin-sensitive half: when the
  * decision came from in-app, the acting client is already showing the resolver's
  * guardian-facing reply, and broadcasting the canonical status label back would
- * replace that richer summary mid-session.
+ * replace that richer summary mid-session. When the acting conversation is
+ * known (`originConversationId`), only that conversation's broadcast is
+ * suppressed; sibling projections still need theirs to converge live.
  */
-function withdrawVellumCard(
+function completeInAppProjection(
   request: WithdrawableGuardianRequest,
   delivery: GuardianRequestDeliveryWire,
   status: GuardianRequestStatus,
   originChannel: string | undefined,
+  originConversationId: string | undefined,
   decidedAction: ApprovalAction | undefined,
-): void {
+): boolean {
   if (!delivery.destinationConversationId) {
-    return;
+    return true;
   }
   const surfaceId = approvalCardSurfaceId(request.kind, request.id);
   if (!surfaceId) {
-    return;
+    return true;
   }
   const summary = resolveDecisionStatusWord(status, decidedAction);
-  if (originChannel === "vellum") {
-    markSurfaceCompleted(
+  // A false here is a failed durable write: after a reload the persisted
+  // block would revert to a pending, clickable card, so it must hold the
+  // expiry sweep's receipt back and be retried.
+  if (
+    originChannel === "vellum" &&
+    (!originConversationId ||
+      delivery.destinationConversationId === originConversationId)
+  ) {
+    return markSurfaceCompleted(
       { conversationId: delivery.destinationConversationId },
       surfaceId,
       summary,
     );
-    return;
   }
-  completeSurfaceAndNotify(
+  return completeSurfaceAndNotify(
     delivery.destinationConversationId,
     surfaceId,
     summary,
@@ -259,11 +356,11 @@ async function withdrawTelegramCard(
   originChannel: string | undefined,
   decidedAction: ApprovalAction | undefined,
   hasOriginGuardianReply: boolean,
-): Promise<void> {
+): Promise<{ complete: boolean }> {
   if (!delivery.destinationChatId || !delivery.destinationMessageId) {
-    return;
+    return { complete: true };
   }
-  await withdrawTelegramApprovalCard({
+  return withdrawTelegramApprovalCard({
     chatId: delivery.destinationChatId,
     messageId: delivery.destinationMessageId,
     status,

package/src/approvals/guardian-decision-primitive.ts

@@ -155,6 +155,13 @@ export interface ApplyGuardianDecisionParams {
   action: ApprovalAction;
   /** Actor context for the entity making the decision. */
   actorContext: ActorContext;
+  /**
+   * Conversation an in-app (vellum) decision was made from, when known.
+   * Threaded to card withdrawal so only the acting conversation's completion
+   * broadcast is suppressed; the request's sibling in-app projections still
+   * receive theirs.
+   */
+  originConversationId?: string;
   /** Optional user-supplied text (e.g. answer text for pending questions). */
   userText?: string;
   /** Optional channel delivery context — present when the decision arrived via a channel message. */
@@ -227,6 +234,7 @@ export async function applyGuardianDecision(
     requestId,
     action,
     actorContext,
+    originConversationId,
     userText,
     channelDeliveryContext,
     emissionContext,
@@ -531,6 +539,7 @@ export async function applyGuardianDecision(
     request: resolved,
     status: targetStatus,
     originChannel: actorContext.channel,
+    ...(originConversationId ? { originConversationId } : {}),
     decidedAction: cardAction,
     // Tells the Telegram projection whether the origin chat is about to get
     // the resolver's own guardian-facing reply (delivered by our caller), so

package/src/approvals/guardian-expiry-notifier.ts

@@ -17,9 +17,12 @@
  * withdrawn card already reflects the expired state, so a fresh ping would be
  * noise.
  *
- * Best-effort by contract: the request is already resolved (CAS committed)
- * before this runs, so a failed notice or interaction release must never
- * surface as a sweep failure. Nothing here throws.
+ * Never throws; `complete` reports whether the side effects actually ran,
+ * because the sweep confirms a request's expiry (the status CAS) only after
+ * they did: a failed notice left the requester untold, so it must keep the
+ * row pending and retryable rather than vanish into a log line. A request
+ * with no deliverable route or no requester chat reports complete: there is
+ * nothing a retry could ever deliver.
  */
 
 import type { GuardianRequestWire } from "../channels/gateway-guardian-requests.js";
@@ -36,49 +39,48 @@ import {
 const log = getLogger("guardian-expiry-notifier");
 
 /**
- * Run the expiry side effects for a single guardian request that the sweep
- * just transitioned to `expired`. Dispatches by kind; never throws.
+ * Run the expiry side effects for a single guardian request the sweep is
+ * expiring. Dispatches by kind; never throws.
  */
 export async function notifyExpiredGuardianRequest(
   request: GuardianRequestWire,
-): Promise<void> {
+): Promise<{ complete: boolean }> {
   try {
     switch (request.kind) {
       case "tool_approval":
         releaseExpiredInteraction(request);
-        return;
+        return { complete: true };
       case "access_request":
         // Admitted-mode nudges expire silently for the requester — the
         // sender made no request and keeps whatever access the floor grants.
         if (!introductionMode(request.requestTrigger).notifyRequesterOnExpiry) {
-          break;
+          return { complete: true };
         }
-        await notifyRequesterOfExpiry(
+        return notifyRequesterOfExpiry(
           request,
           "Your access request expired before it was reviewed. " +
             "Send a new message if you still need access.",
         );
-        return;
       case "tool_grant_request":
-        await notifyRequesterOfExpiry(
+        return notifyRequesterOfExpiry(
           request,
           `Your request to use "${request.toolName ?? "a tool"}" expired ` +
             "before it was reviewed. Ask again if you still need it.",
         );
-        return;
       case "pending_question":
         // Voice call sessions own their own lifecycle and timeout. By the time
         // the request TTL lapses the call is long over and there is no
         // durable requester channel to notify, so there is nothing to do.
-        return;
+        return { complete: true };
       default:
-        return;
+        return { complete: true };
     }
   } catch (err) {
     log.warn(
       { err, requestId: request.id, kind: request.kind },
       "Expiry side effects failed for guardian request (non-fatal)",
     );
+    return { complete: false };
   }
 }
 
@@ -121,15 +123,17 @@ function releaseExpiredInteraction(request: GuardianRequestWire): void {
 async function notifyRequesterOfExpiry(
   request: GuardianRequestWire,
   text: string,
-): Promise<void> {
+): Promise<{ complete: boolean }> {
   const channel = request.sourceChannel ?? "";
   const deliverUrl = resolveDeliverCallbackUrlForChannel(channel);
   const requesterChatId =
     request.requesterChatId ?? request.requesterExternalUserId ?? "";
   const requesterExternalUserId = request.requesterExternalUserId ?? "";
 
+  // No deliverable route or no requester chat: nothing a retry could ever
+  // deliver, so this counts as complete rather than pinning the request.
   if (!deliverUrl || !requesterChatId) {
-    return;
+    return { complete: true };
   }
 
   const targetChatId = resolveRequesterDeliveryTarget({
@@ -148,10 +152,12 @@ async function notifyRequesterOfExpiry(
       { requestId: request.id, kind: request.kind, channel },
       "Notified requester that guardian request expired",
     );
+    return { complete: true };
   } catch (err) {
     log.warn(
       { err, requestId: request.id, channel },
       "Failed to notify requester of guardian request expiry (non-fatal)",
     );
+    return { complete: false };
   }
 }

package/src/approvals/guardian-request-status-sync.ts

@@ -0,0 +1,98 @@
+/**
+ * Terminal status sync for guardian requests resolved outside the decision
+ * primitive.
+ *
+ * Some flows resolve a pending tool confirmation in-memory first and treat
+ * that as authoritative: the in-app confirm route and the legacy channel
+ * approval rail (`Conversation.handleConfirmationResponse`), and the
+ * auto-deny sweeps that supersede confirmations when a new message arrives.
+ * Those flows still have to move the gateway's `guardian_requests` row to the
+ * matching terminal status so stale "pending" rows can't be matched by later
+ * guardian reply routing.
+ *
+ * A status CAS alone is not enough: the request's approval cards are
+ * projected onto every surface it was delivered to (the in-app card, channel
+ * messages, and each channel card's paired conversation), and a row that goes
+ * terminal without card withdrawal leaves every projection offering live
+ * Approve/Reject actions for a decision that already happened (LUM-3489). So
+ * the sync runs the same cross-surface withdrawal the decision primitive
+ * runs, whenever its CAS is the one that actually landed.
+ *
+ * First-writer-wins: when the primitive already resolved the request (e.g.
+ * the channel approval path decided it and ran withdrawal itself), this CAS
+ * misses and no second withdrawal runs.
+ *
+ * Fire-and-forget by contract: the caller's in-memory resolution is
+ * authoritative and often synchronous, so failures are logged, never thrown,
+ * and lost syncs are reaped by the orphan sweep.
+ *
+ * Transitional: this exists for the flows that resolve confirmations
+ * in-memory first (the legacy rail). New decision paths must route through
+ * `applyGuardianDecision`, which owns the CAS, resolver dispatch, grant
+ * minting, and withdrawal together; do not add callers here for anything the
+ * pipeline can serve.
+ */
+
+import { decideGuardianRequest } from "../channels/gateway-guardian-requests.js";
+import type { ApprovalAction } from "../runtime/channel-approval-types.js";
+import { getLogger } from "../util/logger.js";
+import { withdrawGuardianRequestCards } from "./guardian-card-withdrawal.js";
+
+const log = getLogger("guardian-request-status-sync");
+
+export interface SyncTerminalGuardianRequestStatusParams {
+  requestId: string;
+  status: "approved" | "denied";
+  /** Log line context naming the flow that resolved the confirmation. */
+  syncContext: string;
+  /**
+   * Non-decision cause of the terminal status, threaded through to the
+   * feed receipt so an auto-deny reads as what it was (e.g.
+   * "superseded") rather than as a rejection the guardian chose.
+   */
+  terminalReason?: string;
+}
+
+/**
+ * CAS the gateway request to its terminal status and, when this write is the
+ * one that landed, project the outcome onto every delivered approval card.
+ *
+ * No origin channel is passed to withdrawal: the confirmation flows act on
+ * the conversation's confirmation prompt (or on no client at all, for the
+ * auto-deny sweeps), never on the approval card itself, so every card
+ * projection needs its completion broadcast.
+ */
+export async function syncTerminalGuardianRequestStatus(
+  params: SyncTerminalGuardianRequestStatusParams,
+): Promise<void> {
+  const { requestId, status, syncContext } = params;
+  // The confirmation flows only ever approve or reject, so the resolved
+  // cards' action is the plain decision pair derived from the status.
+  const decidedAction: ApprovalAction =
+    status === "approved" ? "approve_once" : "reject";
+  try {
+    const decided = await decideGuardianRequest({
+      id: requestId,
+      expectedStatus: "pending",
+      status,
+    });
+    if (!decided.applied) {
+      // The decision primitive (or a concurrent sync) resolved it first and
+      // owns the card withdrawal.
+      return;
+    }
+    await withdrawGuardianRequestCards({
+      request: decided.request,
+      status,
+      decidedAction,
+      ...(params.terminalReason
+        ? { terminalReason: params.terminalReason }
+        : {}),
+    });
+  } catch (err) {
+    log.warn(
+      { err, requestId, syncContext },
+      "Guardian request terminal status sync failed",
+    );
+  }
+}

package/src/avatar/svg-compositor.ts

@@ -1,4 +1,4 @@
-import { getCharacterComponents } from "./character-components.js";
+import { getCharacterComponents } from "@vellumai/avatar-catalog";
 
 /**
  * Compose a complete SVG document from a body shape, eye style, and color.

package/src/avatar/traits-png-sync.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { getCharacterComponents } from "@vellumai/avatar-catalog";
 import {
   AVATAR_IMAGE_FILENAME,
   AVATAR_TRAITS_FILENAME,
@@ -11,7 +12,6 @@ import {
 import { getLogger } from "../util/logger.js";
 import { getAvatarDir } from "../util/platform.js";
 import { renderCharacterAscii } from "./ascii-renderer.js";
-import { getCharacterComponents } from "./character-components.js";
 import { renderCharacterPng } from "./png-renderer.js";
 import { isResvgAvailable } from "./resvg-lazy.js";
 

package/src/bundler/app-compiler.ts

@@ -497,6 +497,7 @@ export async function runCompile(
     stdout: "pipe",
     stderr: "pipe",
     env: { ...process.env, NODE_PATH: nodePath },
+    windowsHide: true,
   });
 
   await proc.exited;

package/src/bundler/compiler-tools.ts

@@ -170,6 +170,7 @@ async function downloadAndExtract(
       cmd: ["tar", "xzf", tmpTar, "-C", targetDir, "--strip-components=1"],
       stdout: "ignore",
       stderr: "pipe",
+      windowsHide: true,
     });
     await proc.exited;
     if (proc.exitCode !== 0) {

package/src/bundler/package-resolver.ts

@@ -124,6 +124,7 @@ async function installPackage(
       cwd: cacheDir,
       stdout: "pipe",
       stderr: "pipe",
+      windowsHide: true,
     });
 
     // Race against timeout