@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/messaging/providers/discord/send.ts

@@ -5,6 +5,11 @@
  * attachments, by calling the Discord REST API directly via ./api.ts.
  */
 
+import type {
+  ApprovalUIMetadata,
+  ChannelDeliveryResult,
+} from "@vellumai/gateway-client";
+
 import { getAttachmentContent } from "../../../persistence/attachments-store.js";
 import type { RuntimeAttachmentMetadata } from "../../../runtime/http-types.js";
 import { getLogger } from "../../../util/logger.js";
@@ -42,6 +47,90 @@ const DISCORD_ALLOWED_MENTIONS = { parse: ["users"] } as const;
  */
 const DISCORD_MAX_ATTACHMENT_BYTES = 100 * 1024 * 1024;
 
+// Component wire values, from Discord's message-components table.
+const DISCORD_COMPONENT_ACTION_ROW = 1;
+const DISCORD_COMPONENT_BUTTON = 2;
+const DISCORD_BUTTON_STYLE_PRIMARY = 1;
+const DISCORD_BUTTON_STYLE_SECONDARY = 2;
+const DISCORD_BUTTON_STYLE_DANGER = 4;
+/** Discord caps a component `custom_id` at 100 characters. */
+const DISCORD_MAX_CUSTOM_ID_CHARS = 100;
+/** Discord caps a button label at 80 characters. */
+const DISCORD_MAX_BUTTON_LABEL_CHARS = 80;
+/** Discord caps an action row at five buttons. */
+const DISCORD_MAX_BUTTONS_PER_ROW = 5;
+
+interface DiscordButtonComponent {
+  type: typeof DISCORD_COMPONENT_BUTTON;
+  style: number;
+  label: string;
+  custom_id: string;
+}
+
+interface DiscordActionRow {
+  type: typeof DISCORD_COMPONENT_ACTION_ROW;
+  components: DiscordButtonComponent[];
+}
+
+/** Translate a surface-agnostic emphasis into Discord's button style value. */
+function discordStyleForEmphasis(
+  emphasis: "primary" | "secondary" | "destructive",
+): number {
+  switch (emphasis) {
+    case "primary":
+      return DISCORD_BUTTON_STYLE_PRIMARY;
+    case "destructive":
+      return DISCORD_BUTTON_STYLE_DANGER;
+    case "secondary":
+      return DISCORD_BUTTON_STYLE_SECONDARY;
+  }
+}
+
+/**
+ * Build the action rows for an approval card. Each button's `custom_id` is
+ * the shared `apr:<requestId>:<action>` callback convention, which the
+ * gateway forwards verbatim as the button event's `callbackData`. Styling
+ * mirrors the Slack card: an action's own `emphasis` wins, otherwise the
+ * first action is primary and `reject` is danger. Discord requires a style
+ * on every button, so the remainder are explicitly secondary.
+ *
+ * Throws when a `custom_id` would exceed Discord's cap: the caller falls
+ * back to the plain-text card rather than sending a button that could not
+ * round-trip its request id.
+ */
+function buildDiscordApprovalComponents(
+  approval: ApprovalUIMetadata,
+): DiscordActionRow[] {
+  const buttons = approval.actions.map((action, index) => {
+    const customId = `apr:${approval.requestId}:${action.id}`;
+    if (customId.length > DISCORD_MAX_CUSTOM_ID_CHARS) {
+      throw new Error(
+        `custom_id for action "${action.id}" is ${customId.length} characters, exceeding Discord's ${DISCORD_MAX_CUSTOM_ID_CHARS}-character limit`,
+      );
+    }
+    return {
+      type: DISCORD_COMPONENT_BUTTON,
+      style: action.emphasis
+        ? discordStyleForEmphasis(action.emphasis)
+        : action.id === "reject"
+          ? DISCORD_BUTTON_STYLE_DANGER
+          : index === 0
+            ? DISCORD_BUTTON_STYLE_PRIMARY
+            : DISCORD_BUTTON_STYLE_SECONDARY,
+      label: action.label.slice(0, DISCORD_MAX_BUTTON_LABEL_CHARS),
+      custom_id: customId,
+    } satisfies DiscordButtonComponent;
+  });
+  const rows: DiscordActionRow[] = [];
+  for (let i = 0; i < buttons.length; i += DISCORD_MAX_BUTTONS_PER_ROW) {
+    rows.push({
+      type: DISCORD_COMPONENT_ACTION_ROW,
+      components: buttons.slice(i, i + DISCORD_MAX_BUTTONS_PER_ROW),
+    });
+  }
+  return rows;
+}
+
 /** Send target for one Discord delivery. */
 export interface DiscordSendTarget {
   /**
@@ -56,6 +145,38 @@ function messagesRoute(target: DiscordSendTarget): string {
   return `/channels/${encodeURIComponent(target.channelId)}/messages`;
 }
 
+/**
+ * A multi-chunk send that failed after at least one chunk was posted. The
+ * already-delivered chunks cannot be unsent, so a caller with a fallback
+ * must not replay the whole text; the undelivered remainder is what is
+ * still owed to the reader.
+ */
+export class DiscordPartialSendError extends Error {
+  readonly chunksSent: number;
+  readonly remainingText: string;
+  readonly lastMessageId?: string;
+
+  constructor(
+    cause: unknown,
+    chunksSent: number,
+    remainingText: string,
+    lastMessageId?: string,
+  ) {
+    super(
+      `Discord send failed after ${chunksSent} chunk(s): ${
+        cause instanceof Error ? cause.message : String(cause)
+      }`,
+      { cause },
+    );
+    this.name = "DiscordPartialSendError";
+    this.chunksSent = chunksSent;
+    this.remainingText = remainingText;
+    if (lastMessageId !== undefined) {
+      this.lastMessageId = lastMessageId;
+    }
+  }
+}
+
 /** Outcome of a Discord reply send. */
 export interface DiscordSendResult {
   /**
@@ -108,6 +229,11 @@ export async function editDiscordMessage(
     {
       content: options?.emphasis === "muted" ? mutedText(text) : text,
       allowed_mentions: DISCORD_ALLOWED_MENTIONS,
+      // A PATCH that omits `components` keeps whatever the message carries,
+      // and every edit through this path states a final text: a card that
+      // has been answered or withdrawn must not keep live buttons. Always
+      // stripping makes that an invariant rather than a caller's chore.
+      components: [],
     },
   );
   log.debug(
@@ -123,23 +249,46 @@ export async function editDiscordMessage(
 export async function sendDiscordReply(
   target: DiscordSendTarget,
   text: string,
+  approval?: ApprovalUIMetadata,
 ): Promise<DiscordSendResult> {
   const chunks = renderDiscordMessages(text);
   if (chunks.length === 0) {
     return {};
   }
 
+  // Buttons ride the final chunk: its id is the one recorded on the delivery
+  // row, so the message a press arrives on is the message the row can find.
+  const components = approval ? buildDiscordApprovalComponents(approval) : [];
+
   let lastMessageId: string | undefined;
-  for (const chunk of chunks) {
-    const sent = await callDiscordApi<DiscordMessage>(
-      "POST",
-      messagesRoute(target),
-      {
-        content: chunk,
-        allowed_mentions: DISCORD_ALLOWED_MENTIONS,
-      },
-    );
-    lastMessageId = typeof sent?.id === "string" ? sent.id : undefined;
+  for (const [index, chunk] of chunks.entries()) {
+    try {
+      const sent = await callDiscordApi<DiscordMessage>(
+        "POST",
+        messagesRoute(target),
+        {
+          content: chunk,
+          allowed_mentions: DISCORD_ALLOWED_MENTIONS,
+          ...(components.length > 0 && index === chunks.length - 1
+            ? { components }
+            : {}),
+        },
+      );
+      lastMessageId = typeof sent?.id === "string" ? sent.id : undefined;
+    } catch (err) {
+      // Nothing posted yet propagates plainly; a caller may retry or fall
+      // back with the full text. Past the first chunk the delivered prefix
+      // cannot be unsent, so the error names what is still owed.
+      if (index === 0) {
+        throw err;
+      }
+      throw new DiscordPartialSendError(
+        err,
+        index,
+        chunks.slice(index).join("\n"),
+        lastMessageId,
+      );
+    }
   }
 
   log.debug(
@@ -268,6 +417,44 @@ export async function sendDiscordAttachments(
  * Discord expires it after about ten seconds, so a caller that wants it to
  * persist re-sends on a timer rather than clearing it; there is no stop route.
  */
+/**
+ * The REST path spelling of a reaction emoji: a custom emoji arrives in its
+ * mention form (`<:name:id>` / `<a:name:id>`, the shape inbound forwards)
+ * and the route wants the bare `name:id`; a unicode emoji rides URL-encoded
+ * as itself.
+ */
+function discordReactionPathEmoji(emoji: string): string {
+  const custom = /^<a?:([^:>]+):(\d+)>$/.exec(emoji);
+  return encodeURIComponent(custom ? `${custom[1]}:${custom[2]}` : emoji);
+}
+
+/**
+ * Add or remove the bot's own emoji reaction on a message.
+ *
+ * `PUT`/`DELETE .../reactions/{emoji}/@me` are idempotent (204 either way
+ * when the end state already holds), so no already-reacted special case
+ * exists. Guild channels need the `Add Reactions` permission for `PUT`;
+ * a rejection reports `ok: false` rather than throwing.
+ */
+export async function sendDiscordReaction(
+  chatId: string,
+  emoji: string,
+  messageId: string,
+  action: "add" | "remove",
+): Promise<ChannelDeliveryResult> {
+  const route = `/channels/${chatId}/messages/${messageId}/reactions/${discordReactionPathEmoji(emoji)}/@me`;
+  try {
+    await callDiscordApi(action === "add" ? "PUT" : "DELETE", route);
+    return { ok: true };
+  } catch (err) {
+    log.warn(
+      { err, chatId, messageId, action },
+      "Failed to deliver Discord reaction",
+    );
+    return { ok: false };
+  }
+}
+
 export async function sendDiscordTypingIndicator(
   target: DiscordSendTarget,
 ): Promise<void> {

package/src/messaging/providers/discord/transport.ts

@@ -11,6 +11,7 @@ import type { DiscordSendTarget } from "./send.js";
 import {
   editDiscordMessage,
   sendDiscordAttachments,
+  sendDiscordReaction,
   sendDiscordReply,
   sendDiscordTypingIndicator,
 } from "./send.js";
@@ -76,6 +77,15 @@ export const discordTransport: ChannelTransport = {
     return { ok: true };
   },
 
+  async react(target) {
+    return sendDiscordReaction(
+      target.threadId ?? target.chatId,
+      target.emoji,
+      target.messageId,
+      target.action,
+    );
+  },
+
   async deliver(ctx, payload) {
     const { chatId, text, attachments, approval } = payload;
     const target = await sendTarget(ctx, chatId);

package/src/messaging/providers/index.ts

@@ -22,6 +22,7 @@ import type {
   CallbackContext,
   ChannelTransport,
   EditTarget,
+  ReactionTarget,
 } from "./channel-transport.js";
 import { discordTransport } from "./discord/transport.js";
 import { slackTransport } from "./slack/transport.js";
@@ -51,6 +52,47 @@ export function getTransportForCallback(
   return channel ? TRANSPORTS[channel] : undefined;
 }
 
+/**
+ * Resolve a channel's transport by its id, or `undefined` for a channel with
+ * no direct transport. A plugin channel resolves to `undefined` until plugin
+ * outbound exists, so capability probes over this read as "not yet" rather
+ * than throwing on an unknown id.
+ */
+export function getTransportForChannel(
+  channel: string | undefined,
+): ChannelTransport | undefined {
+  return channel && channel in TRANSPORTS
+    ? TRANSPORTS[channel as DirectDeliveryChannel]
+    : undefined;
+}
+
+/**
+ * Whether this channel can add or remove the assistant's own emoji
+ * reactions. Asks the transport rather than the channel id, so a channel
+ * that gains the method starts being offered without a caller being told.
+ */
+export function supportsChannelReaction(channel: string | undefined): boolean {
+  return getTransportForChannel(channel)?.react !== undefined;
+}
+
+/**
+ * Add or remove one of the assistant's own emoji reactions on a message.
+ *
+ * Resolves to nothing when the channel cannot react; the tool surface gates
+ * on `supportsChannelReaction`, so reaching this without the capability is a
+ * caller that skipped the gate, not a user-visible failure.
+ */
+export async function sendChannelReaction(
+  channel: string,
+  target: ReactionTarget,
+): Promise<ChannelDeliveryResult> {
+  const transport = getTransportForChannel(channel);
+  if (!transport?.react) {
+    return { ok: true };
+  }
+  return transport.react(target);
+}
+
 /**
  * Whether the channel this callback addresses can show how busy the assistant
  * is.

package/src/messaging/providers/slack/__tests__/adapter-mention-rendering.test.ts

@@ -17,7 +17,14 @@ mock.module("../../../../oauth/connection-resolver.js", () => ({
     throw new Error("OAuth fallback was not expected");
   },
 }));
+// Spread rather than list: a partial factory silently drops whatever the
+// module under test imports next, and `resolveSlackAuth` reaching
+// `getConnectionByProvider` is what surfaced that here as a real query
+// against a database this suite never built.
+const actualOauthStore = await import("../../../../oauth/oauth-store.js");
 mock.module("../../../../oauth/oauth-store.js", () => ({
+  ...actualOauthStore,
+  getConnectionByProvider: () => undefined,
   isProviderConnected: async () => false,
 }));
 
@@ -38,6 +45,7 @@ import {
 const originalFetch = globalThis.fetch;
 let userInfoCalls: string[] = [];
 let channelInfoCalls: string[] = [];
+let botsInfoCalls: string[] = [];
 
 function installFetchStub() {
   globalThis.fetch = (async (
@@ -158,6 +166,29 @@ function fakeSlackResponse(url: string): Record<string, unknown> {
       };
     }
 
+    if (parsed.searchParams.get("channel") === "C_FLAKY_BOT_HISTORY") {
+      return {
+        ok: true,
+        has_more: false,
+        messages: [
+          {
+            type: "message",
+            subtype: "bot_message",
+            ts: "1700000004.000100",
+            bot_id: "B_FLAKY",
+            text: "first alert",
+          },
+          {
+            type: "message",
+            subtype: "bot_message",
+            ts: "1700000004.000200",
+            bot_id: "B_FLAKY",
+            text: "second alert",
+          },
+        ],
+      };
+    }
+
     if (parsed.searchParams.get("channel") === "C_BOT_HISTORY") {
       return {
         ok: true,
@@ -168,6 +199,39 @@ function fakeSlackResponse(url: string): Record<string, unknown> {
             subtype: "bot_message",
             ts: "1700000003.000400",
             bot_id: "B_ASSISTANT",
+            text: "",
+            attachments: [
+              {
+                fallback: "notify-web failure",
+                pretext: "notify-web failure by <@ULEO>",
+                title: "CI Main Web",
+                title_link: "https://example.com/actions/runs/1",
+              },
+            ],
+          },
+          {
+            type: "message",
+            subtype: "bot_message",
+            ts: "1700000003.000500",
+            bot_id: "B_WEBHOOK",
+            username: "Deploy Webhook",
+            text: "",
+            blocks: [
+              {
+                type: "section",
+                text: { type: "mrkdwn", text: "Deploy finished" },
+              },
+              {
+                type: "context",
+                elements: [{ type: "mrkdwn", text: "took 42s" }],
+              },
+            ],
+          },
+          {
+            type: "message",
+            subtype: "bot_message",
+            ts: "1700000003.000600",
+            bot_id: "B_ASSISTANT",
             text: "Bot-authored history",
           },
         ],
@@ -236,6 +300,20 @@ function fakeSlackResponse(url: string): Record<string, unknown> {
     return fakeUserInfoResponse(userId);
   }
 
+  if (method === "bots.info") {
+    const botId = parsed.searchParams.get("bot") ?? "";
+    botsInfoCalls.push(botId);
+    if (botId === "B_ASSISTANT") {
+      return { ok: true, bot: { id: "B_ASSISTANT", name: "CI Notifier" } };
+    }
+    // An unmapped transient failure: thrown immediately (no in-transport
+    // retry, unlike rate limits) and evicted from the cross-batch cache.
+    if (botId === "B_FLAKY") {
+      return { ok: false, error: "fatal_error" };
+    }
+    return { ok: false, error: "bot_not_found" };
+  }
+
   return { ok: true };
 }
 
@@ -364,6 +442,7 @@ describe("Slack adapter mention rendering", () => {
     __resetSlackMentionCachesForTests();
     userInfoCalls = [];
     channelInfoCalls = [];
+    botsInfoCalls = [];
     getSecureKeyAsyncMock.mockReset();
     getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
       if (key === credentialKey("slack_channel", "bot_token")) {
@@ -392,15 +471,62 @@ describe("Slack adapter mention rendering", () => {
     expect(messages[0].reactions).toEqual([{ name: "eyes", count: 1 }]);
   });
 
-  test("getHistory preserves bot ids for bot-authored Slack messages", async () => {
+  test("getHistory resolves bot sender names and attachment/block content for bot-authored Slack messages", async () => {
     const messages = await slackProvider.getHistory(undefined, "C_BOT_HISTORY");
 
-    expect(messages).toHaveLength(1);
-    expect(messages[0].sender).toEqual({ id: "B_ASSISTANT", name: "unknown" });
+    expect(messages).toHaveLength(3);
+
+    // bot_id-only row: name via bots.info, content from the attachment
+    // (mention tokens inside it render like ordinary message text).
+    expect(messages[0].sender).toEqual({
+      id: "B_ASSISTANT",
+      name: "CI Notifier",
+    });
+    expect(messages[0].text).toBe(
+      "notify-web failure by @Leo\nCI Main Web (https://example.com/actions/runs/1)",
+    );
     expect(messages[0].metadata).toEqual({
       isBot: true,
       slackBotId: "B_ASSISTANT",
     });
+
+    // username-bearing row: named without a bots.info round trip, content
+    // from Block Kit blocks.
+    expect(messages[1].sender).toEqual({
+      id: "B_WEBHOOK",
+      name: "Deploy Webhook",
+    });
+    expect(messages[1].text).toBe("Deploy finished\ntook 42s");
+    expect(botsInfoCalls).not.toContain("B_WEBHOOK");
+
+    // Plain text row from the same bot: bots.info was resolved once, cached.
+    expect(messages[2].sender).toEqual({
+      id: "B_ASSISTANT",
+      name: "CI Notifier",
+    });
+    expect(messages[2].text).toBe("Bot-authored history");
+    expect(
+      botsInfoCalls.filter((botId) => botId === "B_ASSISTANT"),
+    ).toHaveLength(1);
+  });
+
+  test("a transient bots.info failure is attempted once per batch and falls back to the bot id", async () => {
+    const messages = await slackProvider.getHistory(
+      undefined,
+      "C_FLAKY_BOT_HISTORY",
+    );
+
+    expect(messages).toHaveLength(2);
+    expect(messages.map((message) => message.sender)).toEqual([
+      { id: "B_FLAKY", name: "B_FLAKY" },
+      { id: "B_FLAKY", name: "B_FLAKY" },
+    ]);
+    // The transient failure is evicted from the cross-batch cache (so a later
+    // page retries), but within one page the batch memo pins the first
+    // attempt: two rows from the same bot cost one bots.info call.
+    expect(botsInfoCalls.filter((botId) => botId === "B_FLAKY")).toHaveLength(
+      1,
+    );
   });
 
   test("getHistory caches Slack user info and maps timezone metadata", async () => {

package/src/messaging/providers/slack/__tests__/auth.test.ts

@@ -55,6 +55,41 @@ describe("resolveSlackAuth", () => {
   test("user intent falls back to the bot token without a user token", async () => {
     secureKeys.set(BOT_KEY, "xoxb-bot");
     expect(await resolveSlackAuth("user")).toBe("xoxb-bot");
+    // No connection row, so the OAuth rung is skipped rather than probed.
+    expect(resolveOAuthCalls).toEqual([]);
+  });
+
+  test("user intent takes the OAuth connection over the bot token", async () => {
+    // Both are the installer's own token. Degrading to the bot here would
+    // drop `search.messages`, which a bot token cannot call, while a usable
+    // user token sat in the connection.
+    secureKeys.set(BOT_KEY, "xoxb-bot");
+    connectionByProvider["slack"] = { id: "conn-1" };
+    oauthConnection = { accessToken: "xoxp-oauth" };
+
+    expect((await resolveSlackAuth("user")) as unknown).toBe(oauthConnection);
+  });
+
+  test("the pasted user token still wins over an OAuth connection", async () => {
+    secureKeys.set(BOT_KEY, "xoxb-bot");
+    secureKeys.set(USER_KEY, "xoxp-user");
+    connectionByProvider["slack"] = { id: "conn-1" };
+    oauthConnection = { accessToken: "xoxp-oauth" };
+
+    expect(await resolveSlackAuth("user")).toBe("xoxp-user");
+    // Resolved from the credential store, so the connection is never touched.
+    expect(resolveOAuthCalls).toEqual([]);
+  });
+
+  test("an unresolvable OAuth connection degrades to the bot token", async () => {
+    // A revoked or unrefreshable connection must not take messaging down: the
+    // bot token still serves every read it can.
+    secureKeys.set(BOT_KEY, "xoxb-bot");
+    connectionByProvider["slack"] = { id: "conn-1" };
+    oauthConnection = null; // the mock throws for this
+
+    expect(await resolveSlackAuth("user")).toBe("xoxb-bot");
+    expect(resolveOAuthCalls).toHaveLength(1);
   });
 
   test("resolves the refreshing OAuth connection for legacy installs", async () => {