@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/runtime/routes/acp-routes.ts

@@ -6,12 +6,19 @@
  */
 import { randomUUID } from "node:crypto";
 
-import { and, desc, eq, inArray, notInArray } from "drizzle-orm";
+import { and, desc, eq, inArray, isNotNull, notInArray } from "drizzle-orm";
 import { z } from "zod";
 
+import {
+  acpAuthMarkerStillCurrent,
+  MARKER_SCAN_LIMIT,
+} from "../../acp/acp-auth-marker-store.js";
 import { resolveAgentWithAutoInstall } from "../../acp/auto-install.js";
 import { getAcpSessionManager } from "../../acp/index.js";
-import { prepareAgentEnv } from "../../acp/prepare-agent-env.js";
+import {
+  prepareAgentEnv,
+  resolvedClaudeCredentialDigest,
+} from "../../acp/prepare-agent-env.js";
 import { formatResolveFailure } from "../../acp/resolve-agent.js";
 import {
   AcpResumeError,
@@ -58,6 +65,9 @@ const sessionEntrySchema = z.object({
   stopReason: z.string().nullable().optional(),
   task: z.string().optional(),
   parentToolUseId: z.string().optional(),
+  /** Credential failure that ended the run, when one did. Drives the inline
+   *  Connect card on reopen; cleared when a replacement token is stored. */
+  authErrorCode: z.string().optional(),
   usedTokens: z.number().optional(),
   contextSize: z.number().optional(),
   costAmount: z.number().optional(),
@@ -69,6 +79,24 @@ const sessionEntrySchema = z.object({
 
 type SessionEntry = z.infer<typeof sessionEntrySchema>;
 
+/**
+ * A merged session before its marker has been judged.
+ *
+ * `authErrorCredential` names the credential the failure was refused on. It is
+ * what the comparison needs and is dropped before the response goes out: a
+ * client has no use for it and no way to resolve the other side of the
+ * comparison, so serving it would only widen what leaves the daemon.
+ */
+type MergedSession = SessionEntry & { authErrorCredential?: string };
+
+/** Drop the comparison's own input before the session goes out on the wire. */
+function stripMarkerCredential({
+  authErrorCredential: _dropped,
+  ...session
+}: MergedSession): SessionEntry {
+  return session;
+}
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -424,11 +452,102 @@ function closeSession({ pathParams }: RouteHandlerArgs) {
   return { acpSessionId: id, closed: true };
 }
 
-function listSessions({ queryParams }: RouteHandlerArgs) {
+async function listSessions({ queryParams }: RouteHandlerArgs) {
   const limit = parseLimit(queryParams?.limit);
   const conversationId = queryParams?.conversationId;
-  const sessions = listMergedSessions({ limit, conversationId });
-  return { sessions };
+  // Resolved per agent, because precedence is per agent: one alias can carry a
+  // configured token while another falls through to the vault. Memoised across
+  // the request, since each resolution costs a vault read and a conversation's
+  // marked runs are nearly always one agent.
+  const resolvedByAgent = new Map<string, string | undefined>();
+  const resolvedFor = async (agentId: string) => {
+    if (!resolvedByAgent.has(agentId)) {
+      resolvedByAgent.set(
+        agentId,
+        await resolvedClaudeCredentialDigest(agentId),
+      );
+    }
+    return resolvedByAgent.get(agentId);
+  };
+
+  const { sessions: merged, sawEveryHistoryRow } = listMergedSessions({
+    limit,
+    conversationId,
+  });
+  // Judged before paging, never after. A stale marker that escaped the page
+  // first would stay in the response as an ordinary row once its code was
+  // struck, so the retained markers would pile up past the limit.
+  const judged = await withCurrentMarkersOnly(merged, resolvedFor);
+  const page = judged.slice(0, limit);
+  if (!conversationId || page.some((s) => s.authErrorCode !== undefined)) {
+    return { sessions: page };
+  }
+  // Rows the page cut that are already in hand. In-memory sessions merge in on
+  // top of the history read, so the merged list can overflow the page even
+  // when the query reached the end of the table, and the marker the client
+  // needs can be sitting in that overflow. Newest-first, so the first match is
+  // the one to surface.
+  const overflowMarker = judged
+    .slice(limit)
+    .find((s) => s.authErrorCode !== undefined);
+  if (overflowMarker) {
+    return { sessions: [...page, overflowMarker] };
+  }
+  if (sawEveryHistoryRow) {
+    // Every row this conversation has has now been looked at, page and
+    // overflow alike, so a marker elsewhere is not a thing that exists. Most
+    // conversations have never had a credential failure, and this is what
+    // keeps the lookup off their path rather than asking the database to
+    // confirm the absence every time.
+    return { sessions: page };
+  }
+  // The page holds no live marker, so the row a client restores the card from
+  // is either outside it or absent. One row, fetched only now, rather than
+  // every marked row loaded on the chance one of them is needed.
+  const marker = await findRecoveryMarker(conversationId, resolvedFor);
+  if (!marker || page.some((s) => s.id === marker.id)) {
+    return { sessions: page };
+  }
+  return { sessions: [...page, stripMarkerCredential(marker)] };
+}
+
+/**
+ * Blank the failure code on any session whose marker no longer describes the
+ * credential its agent would resolve.
+ *
+ * This comparison is what retires a Connect card: not a sweep that has to run
+ * at the right moment, but the marker no longer describing the credential in
+ * use. Applied after merging rather than inside the query, so live sessions
+ * and history rows are judged by exactly the same rule.
+ *
+ * Resolved per agent, because precedence is per agent: one alias can carry a
+ * configured token while another falls through to the vault. Memoised across
+ * the request, since a conversation's marked runs are nearly always one agent
+ * and each resolution costs a vault read.
+ */
+async function withCurrentMarkersOnly(
+  sessions: MergedSession[],
+  resolvedFor: (agentId: string) => Promise<string | undefined>,
+): Promise<SessionEntry[]> {
+  const strip = stripMarkerCredential;
+  if (!sessions.some((s) => s.authErrorCode !== undefined)) {
+    return sessions.map(strip);
+  }
+  const judged: SessionEntry[] = [];
+  for (const session of sessions) {
+    if (session.authErrorCode === undefined) {
+      judged.push(strip(session));
+      continue;
+    }
+    const current = acpAuthMarkerStillCurrent(
+      session.authErrorCredential,
+      await resolvedFor(session.agentId),
+    );
+    judged.push(
+      strip(current ? session : { ...session, authErrorCode: undefined }),
+    );
+  }
+  return judged;
 }
 
 function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
@@ -701,14 +820,20 @@ function parseLimit(raw: string | null | undefined): number {
   return Math.min(Math.floor(n), MAX_SESSION_LIMIT);
 }
 
-function listMergedSessions(opts: {
-  limit: number;
-  conversationId?: string;
-}): SessionEntry[] {
+function listMergedSessions(opts: { limit: number; conversationId?: string }): {
+  sessions: MergedSession[];
+  /**
+   * Whether the history query reached the end of this conversation's rows.
+   *
+   * A short read means there is nothing beyond what was returned, which is the
+   * proof that no marker is hiding outside the page.
+   */
+  sawEveryHistoryRow: boolean;
+} {
   const manager = getAcpSessionManager();
   const inMemory = manager.getStatus() as AcpSessionState[];
 
-  const merged = new Map<string, SessionEntry>();
+  const merged = new Map<string, MergedSession>();
   for (const s of inMemory) {
     if (opts.conversationId && s.parentConversationId !== opts.conversationId) {
       continue;
@@ -725,6 +850,8 @@ function listMergedSessions(opts: {
       stopReason: s.stopReason ?? null,
       task: s.task,
       parentToolUseId: s.parentToolUseId,
+      authErrorCode: s.authErrorCode,
+      authErrorCredential: s.authErrorCredential,
       usedTokens: s.latestUsage?.usedTokens,
       contextSize: s.latestUsage?.contextSize,
       costAmount: s.latestUsage?.costAmount,
@@ -748,52 +875,131 @@ function listMergedSessions(opts: {
   // guarantee we still surface `limit` distinct rows even when every
   // in-memory session shadows a DB row — without over-fetching when many
   // unrelated sessions are in memory.
+  const historyLimit = opts.limit + merged.size;
   const historyRows = filtered
     .orderBy(desc(acpSessionHistory.startedAt))
-    .limit(opts.limit + merged.size)
+    .limit(historyLimit)
     .all();
 
   for (const row of historyRows) {
     if (merged.has(row.id)) {
       continue;
     }
-    let eventLog: unknown[] = [];
-    try {
-      const parsed = JSON.parse(row.eventLogJson) as unknown;
-      if (Array.isArray(parsed)) {
-        eventLog = parsed;
-      }
-    } catch (err) {
-      log.warn(
-        { id: row.id, err },
-        "Failed to parse event_log_json for ACP session history row",
-      );
+    merged.set(row.id, toMergedSession(row));
+  }
+
+  return {
+    sessions: Array.from(merged.values()).sort(
+      (a, b) => b.startedAt - a.startedAt,
+    ),
+    sawEveryHistoryRow: historyRows.length < historyLimit,
+  };
+}
+
+/** Shape a history row for the response, parsing its stored event log. */
+function toMergedSession(
+  row: typeof acpSessionHistory.$inferSelect,
+): MergedSession {
+  let eventLog: unknown[] = [];
+  try {
+    const parsed = JSON.parse(row.eventLogJson) as unknown;
+    if (Array.isArray(parsed)) {
+      eventLog = parsed;
     }
-    // Rows predating the usage migration carry NULLs for these columns and
-    // degrade to undefined.
-    merged.set(row.id, {
-      id: row.id,
-      agentId: row.agentId,
-      acpSessionId: row.acpSessionId,
-      parentConversationId: row.parentConversationId,
-      status: row.status,
-      startedAt: row.startedAt,
-      completedAt: row.completedAt,
-      error: row.error,
-      stopReason: row.stopReason,
-      task: row.task ?? undefined,
-      parentToolUseId: row.parentToolUseId ?? undefined,
-      usedTokens: row.usedTokens ?? undefined,
-      contextSize: row.contextSize ?? undefined,
-      costAmount: row.costAmount ?? undefined,
-      costCurrency: row.costCurrency ?? undefined,
-      inputTokens: row.inputTokens ?? undefined,
-      outputTokens: row.outputTokens ?? undefined,
-      eventLog,
-    });
+  } catch (err) {
+    log.warn(
+      { id: row.id, err },
+      "Failed to parse event_log_json for ACP session history row",
+    );
   }
+  // Rows predating the usage migration carry NULLs for these columns and
+  // degrade to undefined.
+  return {
+    id: row.id,
+    agentId: row.agentId,
+    acpSessionId: row.acpSessionId,
+    parentConversationId: row.parentConversationId,
+    status: row.status,
+    startedAt: row.startedAt,
+    completedAt: row.completedAt,
+    error: row.error,
+    stopReason: row.stopReason,
+    task: row.task ?? undefined,
+    parentToolUseId: row.parentToolUseId ?? undefined,
+    authErrorCode: row.authErrorCode ?? undefined,
+    authErrorCredential: row.authErrorCredential ?? undefined,
+    usedTokens: row.usedTokens ?? undefined,
+    contextSize: row.contextSize ?? undefined,
+    costAmount: row.costAmount ?? undefined,
+    costCurrency: row.costCurrency ?? undefined,
+    inputTokens: row.inputTokens ?? undefined,
+    outputTokens: row.outputTokens ?? undefined,
+    eventLog,
+  };
+}
+
+/**
+ * Reach past the page for the one marked run a client would restore the card
+ * from, when the page itself holds none.
+ *
+ * Paging it out is the difference between a user having a way back to auth and
+ * not: a conversation with more recent runs than the page holds would
+ * otherwise hide the one row that matters.
+ *
+ * Asks the database for that row rather than filtering one that was loaded.
+ * Nothing clears a marker, so repeated failures against a credential that is
+ * still current accumulate them, and loading every marked row would pull a
+ * full event log apiece into memory to parse and then discard. This reads the
+ * credential of each marked row (a column, no event log), resolves what its
+ * agent would use now, and only then loads the single row that wins.
+ *
+ * Bounded by the number of distinct agents a conversation has failed under,
+ * which is one in practice, rather than by how often it has failed.
+ */
+async function findRecoveryMarker(
+  conversationId: string,
+  resolvedFor: (agentId: string) => Promise<string | undefined>,
+): Promise<MergedSession | undefined> {
+  const db = getDb();
+  // One ordered read of the newest markers, then the answer is decided in
+  // memory. Filtering by agent and credential in SQL meant the planner could
+  // only seek to the conversation and then walk its marked history looking for
+  // a match, so a run of failures against a replaced credential put that walk
+  // back on every snapshot. This shape is the one the index serves: seek,
+  // read in order, stop.
+  const markers = db
+    .select({
+      id: acpSessionHistory.id,
+      agentId: acpSessionHistory.agentId,
+      credential: acpSessionHistory.authErrorCredential,
+    })
+    .from(acpSessionHistory)
+    .where(
+      and(
+        eq(acpSessionHistory.parentConversationId, conversationId),
+        isNotNull(acpSessionHistory.authErrorCode),
+      ),
+    )
+    .orderBy(desc(acpSessionHistory.startedAt))
+    .limit(MARKER_SCAN_LIMIT)
+    .all();
 
-  return Array.from(merged.values())
-    .sort((a, b) => b.startedAt - a.startedAt)
-    .slice(0, opts.limit);
+  for (const marker of markers) {
+    if (
+      acpAuthMarkerStillCurrent(
+        marker.credential,
+        await resolvedFor(marker.agentId),
+      )
+    ) {
+      // Newest-first, so the first match is the one a client would restore
+      // from. Only now is the full row worth loading, by primary key.
+      const row = db
+        .select()
+        .from(acpSessionHistory)
+        .where(eq(acpSessionHistory.id, marker.id))
+        .get();
+      return row ? toMergedSession(row) : undefined;
+    }
+  }
+  return undefined;
 }

package/src/runtime/routes/app-management-routes.ts

@@ -54,6 +54,7 @@ import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
+import { getUserAppDataDir } from "../../util/platform.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   getOriginClientId,
@@ -73,14 +74,26 @@ const log = getLogger("app-management-routes");
 // Helpers
 // ---------------------------------------------------------------------------
 
-function getSharedAppsDir(): string {
-  return join(
+function getSharedAppsDirs(): string[] {
+  const canonical = join(
+    getUserAppDataDir(),
+    "vellum-assistant",
+    "shared-apps",
+  );
+  const legacy = join(
     homedir(),
     "Library",
     "Application Support",
     "vellum-assistant",
     "shared-apps",
   );
+  return legacy === canonical ? [canonical] : [canonical, legacy];
+}
+
+function resolveSharedAppDir(appUuid: string, dirs: string[]): string | null {
+  return (
+    dirs.find((dir) => existsSync(join(dir, `${appUuid}-meta.json`))) ?? null
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -218,13 +231,9 @@ function getAppDataResult(
   }
 }
 
-function listSharedApps(): Array<Record<string, unknown>> {
-  const dir = getSharedAppsDir();
-  if (!existsSync(dir)) {
-    return [];
-  }
-
-  const files = readdirSync(dir).filter((f) => f.endsWith("-meta.json"));
+function listSharedApps(
+  dirs = getSharedAppsDirs(),
+): Array<Record<string, unknown>> {
   const apps: Array<{
     uuid: string;
     name: string;
@@ -240,43 +249,54 @@ function listSharedApps(): Array<Record<string, unknown>> {
     contentId?: string;
     forked?: boolean;
   }> = [];
+  const seen = new Set<string>();
 
-  for (const file of files) {
-    try {
-      const raw = readFileSync(join(dir, file), "utf-8");
-      const meta = JSON.parse(raw);
-
-      let version: string | undefined;
-      let contentId: string | undefined;
-      const manifestPath = join(dir, meta.uuid, "manifest.json");
-      if (existsSync(manifestPath)) {
-        try {
-          const manifestRaw = readFileSync(manifestPath, "utf-8");
-          const manifest = JSON.parse(manifestRaw);
-          version = manifest.version;
-          contentId = manifest.content_id;
-        } catch {
-          // ignore malformed manifest
+  for (const dir of dirs) {
+    if (!existsSync(dir)) {
+      continue;
+    }
+    const files = readdirSync(dir).filter((f) => f.endsWith("-meta.json"));
+    for (const file of files) {
+      try {
+        const raw = readFileSync(join(dir, file), "utf-8");
+        const meta = JSON.parse(raw);
+        if (seen.has(meta.uuid)) {
+          continue;
         }
-      }
 
-      apps.push({
-        uuid: meta.uuid,
-        name: meta.name,
-        description: meta.description,
-        icon: meta.icon,
-        preview: meta.preview,
-        entry: meta.entry,
-        trustTier: meta.trustTier,
-        signerDisplayName: meta.signerDisplayName,
-        bundleSizeBytes: meta.bundleSizeBytes ?? 0,
-        installedAt: meta.installedAt,
-        version,
-        contentId,
-        forked: meta.forked,
-      });
-    } catch {
-      log.warn({ file }, "Failed to read shared app metadata file");
+        let version: string | undefined;
+        let contentId: string | undefined;
+        const manifestPath = join(dir, meta.uuid, "manifest.json");
+        if (existsSync(manifestPath)) {
+          try {
+            const manifestRaw = readFileSync(manifestPath, "utf-8");
+            const manifest = JSON.parse(manifestRaw);
+            version = manifest.version;
+            contentId = manifest.content_id;
+          } catch {
+            // ignore malformed manifest
+          }
+        }
+
+        apps.push({
+          uuid: meta.uuid,
+          name: meta.name,
+          description: meta.description,
+          icon: meta.icon,
+          preview: meta.preview,
+          entry: meta.entry,
+          trustTier: meta.trustTier,
+          signerDisplayName: meta.signerDisplayName,
+          bundleSizeBytes: meta.bundleSizeBytes ?? 0,
+          installedAt: meta.installedAt,
+          version,
+          contentId,
+          forked: meta.forked,
+        });
+        seen.add(meta.uuid);
+      } catch {
+        log.warn({ file }, "Failed to read shared app metadata file");
+      }
     }
   }
 
@@ -314,6 +334,7 @@ function listSharedApps(): Array<Record<string, unknown>> {
 
 function forkSharedApp(
   appUuid: string,
+  dirs = getSharedAppsDirs(),
 ):
   | { success: true; appId: string; name: string }
   | { success: false; error: string } {
@@ -326,12 +347,11 @@ function forkSharedApp(
     return { success: false, error: "Invalid UUID" };
   }
 
-  const dir = getSharedAppsDir();
-  const metaFile = join(dir, `${appUuid}-meta.json`);
-
-  if (!existsSync(metaFile)) {
+  const dir = resolveSharedAppDir(appUuid, dirs);
+  if (!dir) {
     return { success: false, error: "Shared app not found" };
   }
+  const metaFile = join(dir, `${appUuid}-meta.json`);
 
   const metaRaw = readFileSync(metaFile, "utf-8");
   const meta = JSON.parse(metaRaw);
@@ -392,6 +412,19 @@ function forkSharedApp(
   return { success: true, appId: newApp.id, name: newApp.name };
 }
 
+export function _listSharedAppsForTests(
+  dirs: string[],
+): Array<Record<string, unknown>> {
+  return listSharedApps(dirs);
+}
+
+export function _resolveSharedAppDirForTests(
+  appUuid: string,
+  dirs: string[],
+): string | null {
+  return resolveSharedAppDir(appUuid, dirs);
+}
+
 async function openBundle(filePath: string): Promise<Record<string, unknown>> {
   const fileStat = await stat(filePath);
   const bundleSizeBytes = fileStat.size;

package/src/runtime/routes/approval-routes.ts

@@ -10,6 +10,7 @@
 import { z } from "zod";
 
 import { PendingToolQuestionSchema } from "../../api/responses/conversation-message.js";
+import { syncTerminalGuardianRequestStatus } from "../../approvals/guardian-request-status-sync.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
 import type {
   SecretDelivery,
@@ -91,6 +92,14 @@ function handleConfirm({ body }: RouteHandlerArgs) {
       effectiveDecision === "allow" ? "approved" : "rejected",
     );
     interaction.directResolve(effectiveDecision as UserDecision);
+    // When a guardian request was promoted for this confirmation, bring its
+    // row to the matching terminal status and withdraw its cards; with no
+    // such row the CAS misses and this is a no-op.
+    void syncTerminalGuardianRequestStatus({
+      requestId,
+      status: effectiveDecision === "allow" ? "approved" : "denied",
+      syncContext: "confirm-direct-resolve",
+    });
     return { accepted: true };
   }
 

package/src/runtime/routes/archive-utils.ts

@@ -25,7 +25,12 @@ export async function createTarGz(
     const { stdout } = await execFileAsync(
       "tar",
       ["czf", "-", "-C", staging, "."],
-      { maxBuffer: maxBytes, timeout: 30_000, encoding: "buffer" },
+      {
+        maxBuffer: maxBytes,
+        timeout: 30_000,
+        encoding: "buffer",
+        windowsHide: true,
+      },
     );
     const buf = Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
     return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);

package/src/runtime/routes/avatar-routes.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
+import { getCharacterComponents } from "@vellumai/avatar-catalog";
 import { AVATAR_TRAITS_FILENAME } from "@vellumai/avatar-manifest";
 import { z } from "zod";
 
@@ -16,7 +17,6 @@ import {
   setCharacter,
   setImage,
 } from "../../avatar/avatar-store.js";
-import { getCharacterComponents } from "../../avatar/character-components.js";
 import {
   ensureAvatarRaster,
   ensureAvatarRasterPath,

package/src/runtime/routes/channel-route-shared.ts

@@ -52,24 +52,22 @@ export function parseCallbackData(
     return null;
   }
   const source =
-    sourceChannel === "whatsapp"
-      ? ("whatsapp_button" as const)
-      : sourceChannel === "slack"
-        ? ("slack_button" as const)
-        : sourceChannel === "vellum"
-          ? ("vellum_surface" as const)
-          : ("telegram_button" as const);
+    sourceChannel === "vellum"
+      ? ("vellum_surface" as const)
+      : ("button" as const);
   return { action, source, requestId };
 }
 
 // ---------------------------------------------------------------------------
-// Reaction callback data parser — format: "reaction:<emoji_name>"
+// Reaction decision vocabulary
 // ---------------------------------------------------------------------------
 
 /**
- * Map of Slack emoji names to approval actions. Multiple emoji names can
- * map to the same action to handle Slack's aliasing (e.g. `+1` and `thumbsup`
- * both represent the thumbs-up emoji).
+ * Map of reaction emoji to approval actions, in each channel's own
+ * vocabulary: Slack reactions carry colon names (with aliasing, e.g. `+1`
+ * and `thumbsup` are both the thumbs-up emoji), Telegram and Discord carry
+ * the unicode character itself. Telegram's fixed reaction set offers the
+ * thumbs but not the check mark or alarm clock; Discord offers all four.
  */
 const REACTION_EMOJI_MAP: ReadonlyMap<string, ApprovalAction> = new Map([
   ["+1", "approve_once"],
@@ -78,24 +76,24 @@ const REACTION_EMOJI_MAP: ReadonlyMap<string, ApprovalAction> = new Map([
   ["alarm_clock", "approve_once"],
   ["-1", "reject"],
   ["thumbsdown", "reject"],
+  ["\u{1F44D}", "approve_once"], // thumbs up
+  ["\u2705", "approve_once"], // check mark button
+  ["\u23F0", "approve_once"], // alarm clock
+  ["\u{1F44E}", "reject"], // thumbs down
 ]);
 
 /**
- * Parse a `reaction:<emoji_name>` callback data string into an approval
- * decision. Returns null if the emoji is not mapped to any action.
+ * Map a reaction emoji, in the source channel's own vocabulary, to an
+ * approval decision. Returns null if the emoji is not mapped to any action.
  */
-export function parseReactionCallbackData(
-  data: string,
+export function reactionDecisionForEmoji(
+  emoji: string,
 ): ApprovalDecisionResult | null {
-  if (!data.startsWith("reaction:")) {
-    return null;
-  }
-  const emoji = data.slice("reaction:".length);
   const action = REACTION_EMOJI_MAP.get(emoji);
   if (!action) {
     return null;
   }
-  return { action, source: "slack_reaction" };
+  return { action, source: "reaction" };
 }
 
 // ---------------------------------------------------------------------------