@vellumai/assistant 0.12.2-dev.202609190043.ee5ba34 → 0.12.2-dev.202609191222.757d196

package/openapi.yaml

@@ -21217,6 +21217,7 @@ paths:
                                           - firecrawl
                                           - fastcrw
                                           - searxng
+                                          - tinyfish
                                       resultCount:
                                         type: number
                                       durationMs:
@@ -21270,6 +21271,7 @@ paths:
                                           - default
                                           - firecrawl
                                           - fastcrw
+                                          - tinyfish
                                       status:
                                         type: number
                                       contentType:
@@ -21735,6 +21737,7 @@ paths:
                                                   - firecrawl
                                                   - fastcrw
                                                   - searxng
+                                                  - tinyfish
                                               resultCount:
                                                 type: number
                                               durationMs:
@@ -21788,6 +21791,7 @@ paths:
                                                   - default
                                                   - firecrawl
                                                   - fastcrw
+                                                  - tinyfish
                                               status:
                                                 type: number
                                               contentType:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609190043.ee5ba34",
+  "version": "0.12.2-dev.202609191222.757d196",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/api/events/tool-result.ts

@@ -53,6 +53,7 @@ export const WebSearchProviderIdSchema = z.enum([
   "firecrawl",
   "fastcrw",
   "searxng",
+  "tinyfish",
 ]);
 
 export type WebSearchProviderId = z.infer<typeof WebSearchProviderIdSchema>;
@@ -61,6 +62,7 @@ export const WebFetchProviderIdSchema = z.enum([
   "default",
   "firecrawl",
   "fastcrw",
+  "tinyfish",
 ]);
 
 export type WebFetchProviderId = z.infer<typeof WebFetchProviderIdSchema>;

package/src/bundler/bundle-signer.ts

@@ -115,7 +115,7 @@ export async function signBundle(
   const { signature, keyId } = await requestSignature(canonicalPayload);
 
   // 5. Build SignatureJson
-  const signatureJson: SignatureJson = {
+  return {
     algorithm: "ed25519",
     signer: {
       key_id: keyId,
@@ -124,6 +124,4 @@ export async function signBundle(
     content_hashes: contentHashes,
     signature,
   };
-
-  return signatureJson;
 }

package/src/calls/media-stream-audio-transcode.ts

@@ -68,9 +68,7 @@ function linearToMulaw(sample: number): number {
   // Determine segment
   const exponent = segmentSearch(sample);
   const mantissa = (sample >> (exponent + 3)) & 0x0f;
-  const mulawByte = ~(sign | (exponent << 4) | mantissa) & 0xff;
-
-  return mulawByte;
+  return ~(sign | (exponent << 4) | mantissa) & 0xff;
 }
 
 function segmentSearch(val: number): number {

package/src/cli/lib/publish-plugin.ts

@@ -337,8 +337,7 @@ export async function postPublishRequest(
     },
   );
 
-  const data = (await resp.json()) as PublishResult;
-  return data;
+  return (await resp.json()) as PublishResult;
 }
 
 /**

package/src/config/schemas/services.ts

@@ -83,8 +83,9 @@ const WebSearchServiceSchema = z.object({
     .enum(VALID_WEB_SEARCH_PROVIDERS)
     .default("inference-provider-native"),
   // Origin for providers that support a custom API base (e.g. fastCRW,
-  // SearXNG). Empty / omitted uses the provider's cloud default when one
-  // exists. SearXNG has no cloud default and requires a user-supplied URL.
+  // SearXNG, TinyFish). Empty / omitted uses the provider's cloud default
+  // when one exists. SearXNG has no cloud default and requires a user-supplied
+  // URL.
   apiBase: z.string().optional(),
 });
 
@@ -98,7 +99,8 @@ const WebFetchServiceSchema = z.object({
   // `firecrawl`) scrape via their hosted API and reuse the same stored key as
   // their web-search counterpart.
   provider: z.enum(VALID_WEB_FETCH_PROVIDERS).default("default"),
-  // Origin for providers that support a custom API base (e.g. fastCRW).
+  // Origin for providers that support a custom API base (e.g. fastCRW,
+  // TinyFish).
   // Empty / omitted uses the provider's cloud default.
   apiBase: z.string().optional(),
 });

package/src/daemon/message-types/web-activity.ts

@@ -13,10 +13,15 @@ export type WebSearchProviderId =
   | "keenable"
   | "firecrawl"
   | "fastcrw"
-  | "searxng";
+  | "searxng"
+  | "tinyfish";
 
 /** Provider that backed a `web_fetch` call. `default` is the built-in fetcher. */
-export type WebFetchProviderId = "default" | "firecrawl" | "fastcrw";
+export type WebFetchProviderId =
+  | "default"
+  | "firecrawl"
+  | "fastcrw"
+  | "tinyfish";
 
 export interface WebSearchResultItem {
   rank: number; // 1-indexed

package/src/messaging/providers/outlook/client.ts

@@ -69,28 +69,22 @@ async function request<T>(
   const canRetry = isIdempotent(method);
 
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    let resp: OAuthConnectionResponse;
-    try {
-      const extraHeaders =
-        options?.headers &&
-        typeof options.headers === "object" &&
-        !Array.isArray(options.headers)
-          ? (options.headers as Record<string, string>)
-          : {};
-      resp = await connection.request({
-        method,
-        path,
-        query,
-        headers: {
-          "Content-Type": "application/json",
-          ...extraHeaders,
-        },
-        body: options?.body ? JSON.parse(options.body as string) : undefined,
-      });
-    } catch (err) {
-      // Network-level errors from connection.request() are not retryable
-      throw err;
-    }
+    const extraHeaders =
+      options?.headers &&
+      typeof options.headers === "object" &&
+      !Array.isArray(options.headers)
+        ? (options.headers as Record<string, string>)
+        : {};
+    const resp: OAuthConnectionResponse = await connection.request({
+      method,
+      path,
+      query,
+      headers: {
+        "Content-Type": "application/json",
+        ...extraHeaders,
+      },
+      body: options?.body ? JSON.parse(options.body as string) : undefined,
+    });
 
     if (resp.status < 200 || resp.status >= 300) {
       if (canRetry && isRetryable(resp.status) && attempt < MAX_RETRIES) {

package/src/oauth/connection-resolver.ts

@@ -467,12 +467,11 @@ async function fetchPlatformConnections(options: {
   }
 
   const body = (await response.json()) as unknown;
-  const connections = (
+  return (
     Array.isArray(body)
       ? body
       : ((body as Record<string, unknown>).results ?? [])
   ) as PlatformConnectionEntry[];
-  return connections;
 }
 
 /**

package/src/persistence/conversation-queries.ts

@@ -1440,9 +1440,9 @@ function buildExcerptFromText(
     text.length,
     match.index + match.length + EXCERPT_WINDOW,
   );
-  const excerpt =
+  return (
     (start > 0 ? "\u2026" : "") +
     text.slice(start, end).replace(/\s+/g, " ").trim() +
-    (end < text.length ? "\u2026" : "");
-  return excerpt;
+    (end < text.length ? "\u2026" : "")
+  );
 }

package/src/plugins/defaults/memory/src/memory-eval-routes.ts

@@ -23,7 +23,7 @@ import type { RouteDefinition } from "../../../../runtime/routes/types.js";
 import { getLogger } from "../logging.js";
 import { getWorkspaceDir } from "../paths.js";
 import { runMemoryEval } from "../v3-eval/eval-packets.js";
-import { type TallyResult, tallyVerdicts } from "../v3-eval/eval-tally.js";
+import { tallyVerdicts } from "../v3-eval/eval-tally.js";
 
 const log = getLogger("memory-eval-routes");
 
@@ -138,12 +138,11 @@ export type MemoryEvalTallyResult = z.infer<typeof MemoryEvalTallyResultSchema>;
  */
 export function handleMemoryEvalTally(body: unknown): MemoryEvalTallyResult {
   const params = MemoryEvalTallyParamsSchema.parse(body ?? {});
-  const result: TallyResult = tallyVerdicts(
+  return tallyVerdicts(
     params.verdicts,
     params.key,
     params.alpha !== undefined ? { alpha: params.alpha } : {},
   );
-  return result;
 }
 
 const WRITE_POLICY: RoutePolicy = {

package/src/providers/__tests__/search-provider-catalog.test.ts

@@ -95,4 +95,13 @@ describe("search-provider-catalog", () => {
     expect(searxng?.defaultApiBase).toBeUndefined();
     expect(searxng?.envVar).toBe("SEARXNG_API_KEY");
   });
+
+  test("TinyFish is a keyed BYOK provider with a cloud API base", () => {
+    const tinyfish = getSearchProvider("tinyfish");
+    expect(tinyfish?.kind).toBe("byok");
+    expect(tinyfish?.keyless).toBeUndefined();
+    expect(tinyfish?.supportsApiBase).toBe(true);
+    expect(tinyfish?.defaultApiBase).toBe("https://api.search.tinyfish.ai");
+    expect(tinyfish?.envVar).toBe("TINYFISH_API_KEY");
+  });
 });

package/src/providers/fetch-provider-catalog.ts

@@ -84,6 +84,17 @@ export const FETCH_PROVIDER_CATALOG: readonly FetchProviderCatalogEntry[] = [
     supportsApiBase: true,
     defaultApiBase: "https://api.fastcrw.com",
   },
+  {
+    id: "tinyfish",
+    displayName: "TinyFish",
+    kind: "byok",
+    apiKeyPrefix: "TinyFish API key...",
+    envVar: "TINYFISH_API_KEY",
+    secretKey: "tinyfish",
+    privacyPolicyUrl: "https://www.tinyfish.ai/privacy-policy",
+    supportsApiBase: true,
+    defaultApiBase: "https://api.fetch.tinyfish.ai",
+  },
 ];
 
 /** Provider ids accepted by the web-fetch config schema. */

package/src/providers/ratelimit.ts

@@ -62,9 +62,7 @@ export class RateLimitProvider implements Provider {
     // calls from bypassing the rate limit during the async gap.
     this.recordRequest();
 
-    const response = await this.inner.sendMessage(messages, options);
-
-    return response;
+    return this.inner.sendMessage(messages, options);
   }
 
   private enforceRequestRate(): void {

package/src/providers/search-provider-catalog.ts

@@ -175,6 +175,18 @@ export const SEARCH_PROVIDER_CATALOG: readonly SearchProviderCatalogEntry[] = [
     privacyPolicyUrl: "https://docs.searxng.org/own-instance.html",
     supportsApiBase: true,
   },
+  {
+    id: "tinyfish",
+    displayName: "TinyFish",
+    kind: "byok",
+    apiKeyPrefix: "TinyFish API key...",
+    envVar: "TINYFISH_API_KEY",
+    secretKey: "tinyfish",
+    fallbackOrder: 8,
+    privacyPolicyUrl: "https://www.tinyfish.ai/privacy-policy",
+    supportsApiBase: true,
+    defaultApiBase: "https://api.search.tinyfish.ai",
+  },
 ];
 
 /** Provider ids accepted by the web-search config schema. */

package/src/runtime/routes/credential-routes.ts

@@ -607,8 +607,7 @@ async function handleCredentialsDelete({ body }: RouteHandlerArgs) {
 }
 
 async function handleCredentialsStatus() {
-  const info = await getActiveBackendInfoAsync();
-  return info;
+  return getActiveBackendInfoAsync();
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/email-routes.ts

@@ -169,7 +169,7 @@ async function handleEmailStatus(_args: RouteHandlerArgs) {
     );
   }
 
-  const statusData = (await statusResponse.json()) as {
+  return (await statusResponse.json()) as {
     address: string;
     status: string;
     created_at: string;
@@ -181,8 +181,6 @@ async function handleEmailStatus(_args: RouteHandlerArgs) {
       received_this_month: number;
     };
   };
-
-  return statusData;
 }
 
 async function handleEmailList({ queryParams = {} }: RouteHandlerArgs) {
@@ -239,8 +237,7 @@ async function handleEmailDownload({ queryParams = {} }: RouteHandlerArgs) {
     throw new RouteError(String(detail), "DOWNLOAD_FAILED", response.status);
   }
 
-  const msg = await response.json();
-  return msg;
+  return response.json();
 }
 
 async function handleEmailSend({ body = {} }: RouteHandlerArgs) {
@@ -323,11 +320,10 @@ async function handleEmailSend({ body = {} }: RouteHandlerArgs) {
     throw new BadRequestError(String(detail));
   }
 
-  const data = (await response.json()) as {
+  return (await response.json()) as {
     delivery_id: string;
     status: string;
   };
-  return data;
 }
 
 // ── Attachment handlers ───────────────────────────────────────────────

package/src/runtime/routes/watcher-routes.ts

@@ -86,7 +86,7 @@ function handleWatcherCreate({ body = {} }: RouteHandlerArgs) {
   const credentialService =
     credentialServiceOverride ?? provider.requiredCredentialService;
 
-  const watcher = createWatcher({
+  return createWatcher({
     name,
     providerId,
     actionPrompt,
@@ -94,8 +94,6 @@ function handleWatcherCreate({ body = {} }: RouteHandlerArgs) {
     pollIntervalMs,
     configJson: config ? JSON.stringify(config) : null,
   });
-
-  return watcher;
 }
 
 function handleWatcherList({ body = {} }: RouteHandlerArgs) {

package/src/tools/browser/cdp-client/cdp-inspect-client.ts

@@ -406,14 +406,7 @@ export class CdpInspectClient implements ScopedCdpClient {
     httpError: unknown,
     signal: AbortSignal,
   ): Promise<AttachedSession> {
-    let wsUrl: string;
-    try {
-      wsUrl = this.helpers.buildBrowserWsUrl(host, port);
-    } catch (err) {
-      // buildBrowserWsUrl enforces loopback — if it throws, the host
-      // is non-loopback and we should not attempt any WS connection.
-      throw err;
-    }
+    const wsUrl = this.helpers.buildBrowserWsUrl(host, port);
 
     let transport: CdpWsTransport;
     try {

package/src/tools/network/__tests__/web-fetch-tinyfish.test.ts

@@ -0,0 +1,250 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { setConfig } from "../../../__tests__/helpers/set-config.js";
+
+let mockTinyfishSecureKey: string | undefined;
+let mockResolveAddresses: string[] = [];
+
+function seedWebFetch(provider: string, apiBase?: string): void {
+  const entry: Record<string, string> = { provider };
+  if (apiBase !== undefined) {
+    entry.apiBase = apiBase;
+  }
+  setConfig("services", { "web-fetch": entry });
+}
+
+mock.module("../../../security/secure-keys.js", () => ({
+  getProviderKeyAsync: async (provider: string) =>
+    provider === "tinyfish" ? mockTinyfishSecureKey : undefined,
+}));
+
+const realLogger = await import("../../../util/logger.js");
+mock.module("../../../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+mock.module("../../../permissions/types.js", () => ({
+  RiskLevel: { Low: "low", Medium: "medium", High: "high" },
+}));
+
+const realUrlSafety = await import("../url-safety.js");
+mock.module("../url-safety.js", () => ({
+  ...realUrlSafety,
+  resolveHostAddresses: async () => mockResolveAddresses,
+}));
+
+const { executeTinyfishFetch, webFetchTool } = await import("../web-fetch.js");
+
+function fetchResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+describe("executeTinyfishFetch", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    seedWebFetch("tinyfish");
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("posts the URL and returns markdown with metadata", async () => {
+    let capturedUrl = "";
+    let capturedBody: Record<string, unknown> = {};
+    let capturedApiKey = "";
+    globalThis.fetch = (async (url: string, init?: RequestInit) => {
+      capturedUrl = url;
+      capturedBody = JSON.parse(String(init?.body));
+      capturedApiKey = new Headers(init?.headers).get("x-api-key") ?? "";
+      return fetchResponse({
+        results: [
+          {
+            url: "https://example.com/",
+            final_url: "https://www.example.com/",
+            title: "Example",
+            description: "An example page",
+            text: "# Example\n\nHello from TinyFish.",
+            format: "markdown",
+            latency_ms: 120,
+          },
+        ],
+        errors: [],
+      });
+    }) as typeof fetch;
+
+    const result = await executeTinyfishFetch(
+      { url: "https://example.com", timeout_seconds: 45 },
+      { apiKey: "tf_test" },
+    );
+
+    expect(result.isError).toBe(false);
+    expect(capturedUrl).toBe("https://api.fetch.tinyfish.ai/");
+    expect(capturedBody).toEqual({
+      urls: ["https://example.com/"],
+      format: "markdown",
+      per_url_timeout_ms: 45_000,
+    });
+    expect(capturedApiKey).toBe("tf_test");
+    expect(result.content).toContain("Hello from TinyFish.");
+    expect(result.content).toContain("Title: Example");
+    expect(result.activityMetadata?.webFetch?.provider).toBe("tinyfish");
+    expect(result.activityMetadata?.webFetch?.finalUrl).toBe(
+      "https://www.example.com/",
+    );
+  });
+
+  test("uses a custom API base and applies character windows", async () => {
+    seedWebFetch("tinyfish", "https://fetch.example.com/api/");
+    let capturedUrl = "";
+    globalThis.fetch = (async (url: string) => {
+      capturedUrl = url;
+      return fetchResponse({
+        results: [
+          {
+            url: "https://example.com/",
+            final_url: "https://example.com/",
+            text: "0123456789",
+            format: "markdown",
+          },
+        ],
+        errors: [],
+      });
+    }) as typeof fetch;
+
+    const result = await executeTinyfishFetch(
+      { url: "https://example.com", start_index: 2, max_chars: 4 },
+      { apiKey: "tf_test" },
+    );
+
+    expect(capturedUrl).toBe("https://fetch.example.com/api/");
+    expect(result.content).toContain("Character Window: 2-6 of 10");
+    expect(result.content).toContain("2345");
+    expect(result.activityMetadata?.webFetch?.truncated).toBe(true);
+  });
+
+  test("surfaces per-URL errors from a successful HTTP response", async () => {
+    globalThis.fetch = (async () =>
+      fetchResponse({
+        results: [],
+        errors: [
+          {
+            url: "https://example.com/",
+            error: "bot_blocked",
+            status: 403,
+          },
+        ],
+      })) as unknown as typeof fetch;
+
+    const result = await executeTinyfishFetch(
+      { url: "https://example.com" },
+      { apiKey: "tf_test" },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("bot_blocked");
+    expect(result.content).toContain("HTTP 403");
+    expect(result.activityMetadata?.webFetch?.provider).toBe("tinyfish");
+    expect(result.activityMetadata?.webFetch?.status).toBe(403);
+  });
+
+  test("rejects URL-embedded credentials before calling TinyFish", async () => {
+    let fetchCalls = 0;
+    globalThis.fetch = (async () => {
+      fetchCalls += 1;
+      return fetchResponse({ results: [], errors: [] });
+    }) as unknown as typeof fetch;
+
+    const result = await executeTinyfishFetch(
+      { url: "https://user:pass@example.com/private" },
+      { apiKey: "tf_test" },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("embedded credentials");
+    expect(fetchCalls).toBe(0);
+  });
+});
+
+describe("webFetchTool TinyFish dispatch", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  const execute = (input: Record<string, unknown>, context: any = {}) =>
+    webFetchTool.execute(input, context);
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    seedWebFetch("tinyfish");
+    mockTinyfishSecureKey = "tf_test";
+    mockResolveAddresses = ["93.184.216.34"];
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("routes public URLs to TinyFish when a key is stored", async () => {
+    let tinyfishHit = false;
+    globalThis.fetch = (async (url: string) => {
+      if (String(url).includes("api.fetch.tinyfish.ai")) {
+        tinyfishHit = true;
+      }
+      return fetchResponse({
+        results: [
+          {
+            url: "https://example.com/",
+            final_url: "https://example.com/",
+            text: "routed",
+            format: "markdown",
+          },
+        ],
+        errors: [],
+      });
+    }) as typeof fetch;
+
+    const result = await execute({ url: "https://example.com" });
+
+    expect(tinyfishHit).toBe(true);
+    expect(result.activityMetadata?.webFetch?.provider).toBe("tinyfish");
+  });
+
+  test("does not send private targets to TinyFish", async () => {
+    let tinyfishHit = false;
+    globalThis.fetch = (async (url: string) => {
+      if (String(url).includes("api.fetch.tinyfish.ai")) {
+        tinyfishHit = true;
+      }
+      return new Response("", { status: 200 });
+    }) as typeof fetch;
+
+    const result = await execute({ url: "http://localhost:8080/admin" });
+
+    expect(tinyfishHit).toBe(false);
+    expect(result.isError).toBe(true);
+    expect(result.activityMetadata?.webFetch?.provider).toBe("default");
+  });
+
+  test("falls back to the built-in fetcher when no TinyFish key is stored", async () => {
+    mockTinyfishSecureKey = undefined;
+    mockResolveAddresses = [];
+    let tinyfishHit = false;
+    globalThis.fetch = (async (url: string) => {
+      if (String(url).includes("api.fetch.tinyfish.ai")) {
+        tinyfishHit = true;
+      }
+      return new Response("", { status: 200 });
+    }) as typeof fetch;
+
+    const result = await execute({ url: "https://example.com" });
+
+    expect(tinyfishHit).toBe(false);
+    expect(result.activityMetadata?.webFetch?.provider).toBe("default");
+  });
+});