@vellumai/assistant 0.4.26 → 0.4.29

package/src/runtime/pending-interactions.ts

@@ -8,29 +8,36 @@
  * session from this tracker to resolve the interaction.
  */
 
-import type { Session } from '../daemon/session.js';
+import type { Session } from "../daemon/session.js";
 
 export interface ConfirmationDetails {
   toolName: string;
   input: Record<string, unknown>;
   riskLevel: string;
-  executionTarget?: 'sandbox' | 'host';
-  allowlistOptions: Array<{ label: string; description: string; pattern: string }>;
+  executionTarget?: "sandbox" | "host";
+  allowlistOptions: Array<{
+    label: string;
+    description: string;
+    pattern: string;
+  }>;
   scopeOptions: Array<{ label: string; scope: string }>;
   persistentDecisionsAllowed?: boolean;
-  temporaryOptionsAvailable?: Array<'allow_10m' | 'allow_thread'>;
+  temporaryOptionsAvailable?: Array<"allow_10m" | "allow_thread">;
 }
 
 export interface PendingInteraction {
   session: Session;
   conversationId: string;
-  kind: 'confirmation' | 'secret';
+  kind: "confirmation" | "secret";
   confirmationDetails?: ConfirmationDetails;
 }
 
 const pending = new Map<string, PendingInteraction>();
 
-export function register(requestId: string, interaction: PendingInteraction): void {
+export function register(
+  requestId: string,
+  interaction: PendingInteraction,
+): void {
   pending.set(requestId, interaction);
 }
 
@@ -58,7 +65,9 @@ export function get(requestId: string): PendingInteraction | undefined {
  * Return all pending interactions for a given conversation.
  * Needed by channel approval migration (PR 3).
  */
-export function getByConversation(conversationId: string): Array<{ requestId: string } & PendingInteraction> {
+export function getByConversation(
+  conversationId: string,
+): Array<{ requestId: string } & PendingInteraction> {
   const results: Array<{ requestId: string } & PendingInteraction> = [];
   for (const [requestId, interaction] of pending) {
     if (interaction.conversationId === conversationId) {

package/src/runtime/routes/access-request-decision.ts

@@ -8,26 +8,24 @@
 import {
   type GuardianApprovalRequest,
   resolveApprovalRequest,
-} from '../../memory/channel-guardian-store.js';
-import { getLogger } from '../../util/logger.js';
-import { createOutboundSession } from '../channel-guardian-service.js';
-import { deliverChannelReply } from '../gateway-client.js';
+} from "../../memory/channel-guardian-store.js";
+import { getLogger } from "../../util/logger.js";
+import { createOutboundSession } from "../channel-guardian-service.js";
+import { deliverChannelReply } from "../gateway-client.js";
 
-const log = getLogger('access-request-decision');
+const log = getLogger("access-request-decision");
 
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
-export type AccessRequestDecisionAction = 'approve' | 'deny';
+export type AccessRequestDecisionAction = "approve" | "deny";
 
-export type DeliveryResult =
-  | { ok: true }
-  | { ok: false; reason: string };
+export type DeliveryResult = { ok: true } | { ok: false; reason: string };
 
 export interface AccessRequestDecisionResult {
   handled: boolean;
-  type: 'approved' | 'denied' | 'stale' | 'idempotent';
+  type: "approved" | "denied" | "stale" | "idempotent";
   verificationSessionId?: string;
   verificationCode?: string;
 }
@@ -58,12 +56,16 @@ export function handleAccessRequestDecision(
   // if already resolved with the same decision, returns the existing record
   // unchanged. Returns null when already resolved with a *different* decision
   // or when the record doesn't exist.
-  const decision = action === 'approve' ? 'approved' : 'denied';
-  const resolved = resolveApprovalRequest(approval.id, decision, decidedByExternalUserId);
+  const decision = action === "approve" ? "approved" : "denied";
+  const resolved = resolveApprovalRequest(
+    approval.id,
+    decision,
+    decidedByExternalUserId,
+  );
 
   if (!resolved) {
     // Already resolved with a different decision, or does not exist
-    return { handled: true, type: 'stale' };
+    return { handled: true, type: "stale" };
   }
 
   // resolveApprovalRequest returns the existing record (unchanged) when the
@@ -71,12 +73,12 @@ export function handleAccessRequestDecision(
   // the approval's status was not 'pending' before our call. We detect
   // this by checking if the original approval (passed in) was already
   // non-pending, meaning the transition happened in a prior call.
-  if (approval.status !== 'pending') {
-    return { handled: true, type: 'idempotent' };
+  if (approval.status !== "pending") {
+    return { handled: true, type: "idempotent" };
   }
 
-  if (action === 'deny') {
-    return { handled: true, type: 'denied' };
+  if (action === "deny") {
+    return { handled: true, type: "denied" };
   }
 
   // On approve: create an identity-bound outbound verification session.
@@ -88,14 +90,14 @@ export function handleAccessRequestDecision(
     channel: approval.channel,
     expectedExternalUserId: approval.requesterExternalUserId,
     expectedChatId: approval.requesterChatId,
-    identityBindingStatus: 'bound',
+    identityBindingStatus: "bound",
     destinationAddress: approval.requesterChatId,
-    verificationPurpose: 'trusted_contact',
+    verificationPurpose: "trusted_contact",
   });
 
   return {
     handled: true,
-    type: 'approved',
+    type: "approved",
     verificationSessionId: session.sessionId,
     verificationCode: session.secret,
   };
@@ -113,21 +115,26 @@ export async function deliverVerificationCodeToGuardian(params: {
   assistantId: string;
   bearerToken?: string;
 }): Promise<DeliveryResult> {
-  const text = `You approved access for ${params.requesterIdentifier}. `
-    + `Give them this verification code: ${params.verificationCode}. `
-    + `The code expires in 10 minutes.`;
+  const text =
+    `You approved access for ${params.requesterIdentifier}. ` +
+    `Give them this verification code: ${params.verificationCode}. ` +
+    `The code expires in 10 minutes.`;
 
   try {
-    await deliverChannelReply(params.replyCallbackUrl, {
-      chatId: params.guardianChatId,
-      text,
-      assistantId: params.assistantId,
-    }, params.bearerToken);
+    await deliverChannelReply(
+      params.replyCallbackUrl,
+      {
+        chatId: params.guardianChatId,
+        text,
+        assistantId: params.assistantId,
+      },
+      params.bearerToken,
+    );
     return { ok: true };
   } catch (err) {
     log.error(
       { err, guardianChatId: params.guardianChatId },
-      'Failed to deliver verification code to guardian',
+      "Failed to deliver verification code to guardian",
     );
     const reason = err instanceof Error ? err.message : String(err);
     return { ok: false, reason };
@@ -144,19 +151,24 @@ export async function notifyRequesterOfApproval(params: {
   assistantId: string;
   bearerToken?: string;
 }): Promise<void> {
-  const text = 'Your access request has been approved! '
-    + 'Please enter the 6-digit verification code you receive from the guardian.';
+  const text =
+    "Your access request has been approved! " +
+    "Please enter the 6-digit verification code you receive from the guardian.";
 
   try {
-    await deliverChannelReply(params.replyCallbackUrl, {
-      chatId: params.requesterChatId,
-      text,
-      assistantId: params.assistantId,
-    }, params.bearerToken);
+    await deliverChannelReply(
+      params.replyCallbackUrl,
+      {
+        chatId: params.requesterChatId,
+        text,
+        assistantId: params.assistantId,
+      },
+      params.bearerToken,
+    );
   } catch (err) {
     log.error(
       { err, requesterChatId: params.requesterChatId },
-      'Failed to notify requester of access request approval',
+      "Failed to notify requester of access request approval",
     );
   }
 }
@@ -172,19 +184,24 @@ export async function notifyRequesterOfDeliveryFailure(params: {
   assistantId: string;
   bearerToken?: string;
 }): Promise<void> {
-  const text = 'Your access request was approved, but we were unable to '
-    + 'deliver the verification code. Please try again later.';
+  const text =
+    "Your access request was approved, but we were unable to " +
+    "deliver the verification code. Please try again later.";
 
   try {
-    await deliverChannelReply(params.replyCallbackUrl, {
-      chatId: params.requesterChatId,
-      text,
-      assistantId: params.assistantId,
-    }, params.bearerToken);
+    await deliverChannelReply(
+      params.replyCallbackUrl,
+      {
+        chatId: params.requesterChatId,
+        text,
+        assistantId: params.assistantId,
+      },
+      params.bearerToken,
+    );
   } catch (err) {
     log.error(
       { err, requesterChatId: params.requesterChatId },
-      'Failed to notify requester of delivery failure',
+      "Failed to notify requester of delivery failure",
     );
   }
 }
@@ -198,18 +215,22 @@ export async function notifyRequesterOfDenial(params: {
   assistantId: string;
   bearerToken?: string;
 }): Promise<void> {
-  const text = 'Your access request has been denied by the guardian.';
+  const text = "Your access request has been denied by the guardian.";
 
   try {
-    await deliverChannelReply(params.replyCallbackUrl, {
-      chatId: params.requesterChatId,
-      text,
-      assistantId: params.assistantId,
-    }, params.bearerToken);
+    await deliverChannelReply(
+      params.replyCallbackUrl,
+      {
+        chatId: params.requesterChatId,
+        text,
+        assistantId: params.assistantId,
+      },
+      params.bearerToken,
+    );
   } catch (err) {
     log.error(
       { err, requesterChatId: params.requesterChatId },
-      'Failed to notify requester of access request denial',
+      "Failed to notify requester of access request denial",
     );
   }
 }

package/src/runtime/routes/app-routes.ts

@@ -1,25 +1,25 @@
 /**
  * Route handlers for shareable app pages and cloud sharing.
  */
-import { randomBytes } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 
-import JSZip from 'jszip';
+import JSZip from "jszip";
 
-import type { AppManifest } from '../../bundler/manifest.js';
-import { getApp } from '../../memory/app-store.js';
-import * as sharedAppLinksStore from '../../memory/shared-app-links-store.js';
-import { getLogger } from '../../util/logger.js';
-import { httpError } from '../http-errors.js';
+import type { AppManifest } from "../../bundler/manifest.js";
+import { getApp } from "../../memory/app-store.js";
+import * as sharedAppLinksStore from "../../memory/shared-app-links-store.js";
+import { getLogger } from "../../util/logger.js";
+import { httpError } from "../http-errors.js";
 
-const log = getLogger('runtime-http');
+const log = getLogger("runtime-http");
 
 const HTML_ESCAPE_MAP: Record<string, string> = {
-  '<': '&lt;',
-  '>': '&gt;',
-  '&': '&amp;',
-  '"': '&quot;',
+  "<": "&lt;",
+  ">": "&gt;",
+  "&": "&amp;",
+  '"': "&quot;",
 };
 
 let designSystemCssCache: string | null = null;
@@ -29,12 +29,12 @@ function loadDesignSystemCss(): string {
   try {
     const cssPath = join(
       import.meta.dirname ?? __dirname,
-      '../../../../clients/macos/vellum-assistant/Resources/vellum-design-system.css',
+      "../../../../clients/macos/vellum-assistant/Resources/vellum-design-system.css",
     );
-    designSystemCssCache = readFileSync(cssPath, 'utf-8');
+    designSystemCssCache = readFileSync(cssPath, "utf-8");
   } catch {
-    log.warn('Design system CSS not found, pages will render without styles');
-    designSystemCssCache = '';
+    log.warn("Design system CSS not found, pages will render without styles");
+    designSystemCssCache = "";
   }
   return designSystemCssCache;
 }
@@ -42,14 +42,17 @@ function loadDesignSystemCss(): string {
 export function handleServePage(appId: string): Response {
   const app = getApp(appId);
   if (!app) {
-    return httpError('NOT_FOUND', 'App not found', 404);
+    return httpError("NOT_FOUND", "App not found", 404);
   }
 
   const css = loadDesignSystemCss();
-  const escapedName = app.name.replace(/[<>&"]/g, (c) => HTML_ESCAPE_MAP[c] ?? c);
+  const escapedName = app.name.replace(
+    /[<>&"]/g,
+    (c) => HTML_ESCAPE_MAP[c] ?? c,
+  );
 
   // Per-response nonce for inline <style> and <script> tags.
-  const nonce = randomBytes(16).toString('base64');
+  const nonce = randomBytes(16).toString("base64");
 
   // Inject the nonce into any inline <script> tags from the app HTML definition
   // so they are allowed by the nonce-based CSP without 'unsafe-inline'.
@@ -85,12 +88,12 @@ ${noncedHtml}
     "base-uri 'self'",
     "form-action 'self'",
     "frame-ancestors 'self'",
-  ].join('; ');
+  ].join("; ");
 
   return new Response(html, {
     headers: {
-      'Content-Type': 'text/html; charset=utf-8',
-      'Content-Security-Policy': csp,
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Security-Policy": csp,
     },
   });
 }
@@ -101,34 +104,49 @@ const MAX_SHARE_BODY_BYTES = 50 * 1024 * 1024;
 export async function handleShareApp(req: Request): Promise<Response> {
   const rawBody = await req.arrayBuffer();
   if (rawBody.byteLength > MAX_SHARE_BODY_BYTES) {
-    return httpError('BAD_REQUEST', `Request body too large (limit: ${MAX_SHARE_BODY_BYTES} bytes)`, 413);
+    return httpError(
+      "BAD_REQUEST",
+      `Request body too large (limit: ${MAX_SHARE_BODY_BYTES} bytes)`,
+      413,
+    );
   }
 
   const bundleData = Buffer.from(rawBody);
 
   if (bundleData.length === 0) {
-    return httpError('BAD_REQUEST', 'Empty body', 400);
+    return httpError("BAD_REQUEST", "Empty body", 400);
   }
 
   // Validate it's a valid zip with a manifest.json
   let manifest: AppManifest;
   try {
     const zip = await JSZip.loadAsync(bundleData);
-    const manifestFile = zip.file('manifest.json');
+    const manifestFile = zip.file("manifest.json");
     if (!manifestFile) {
-      return httpError('BAD_REQUEST', 'Invalid bundle: missing manifest.json', 400);
+      return httpError(
+        "BAD_REQUEST",
+        "Invalid bundle: missing manifest.json",
+        400,
+      );
     }
-    const manifestText = await manifestFile.async('text');
+    const manifestText = await manifestFile.async("text");
     manifest = JSON.parse(manifestText) as AppManifest;
     if (!manifest.name || !manifest.entry) {
-      return httpError('BAD_REQUEST', 'Invalid manifest: missing required fields', 400);
+      return httpError(
+        "BAD_REQUEST",
+        "Invalid manifest: missing required fields",
+        400,
+      );
     }
   } catch (err) {
     if (err instanceof Response) throw err;
-    return httpError('BAD_REQUEST', 'Invalid zip file', 400);
+    return httpError("BAD_REQUEST", "Invalid zip file", 400);
   }
 
-  const { shareToken } = sharedAppLinksStore.createSharedAppLink(bundleData, manifest);
+  const { shareToken } = sharedAppLinksStore.createSharedAppLink(
+    bundleData,
+    manifest,
+  );
 
   return Response.json({
     shareToken,
@@ -140,15 +158,15 @@ export async function handleShareApp(req: Request): Promise<Response> {
 export function handleDownloadSharedApp(shareToken: string): Response {
   const record = sharedAppLinksStore.getSharedAppLink(shareToken);
   if (!record) {
-    return httpError('NOT_FOUND', 'Shared app not found', 404);
+    return httpError("NOT_FOUND", "Shared app not found", 404);
   }
 
   sharedAppLinksStore.incrementDownloadCount(shareToken);
 
   return new Response(new Uint8Array(record.bundleData), {
     headers: {
-      'Content-Type': 'application/zip',
-      'Content-Disposition': 'attachment; filename="app.vellumapp"',
+      "Content-Type": "application/zip",
+      "Content-Disposition": 'attachment; filename="app.vellumapp"',
     },
   });
 }
@@ -156,14 +174,14 @@ export function handleDownloadSharedApp(shareToken: string): Response {
 export function handleGetSharedAppMetadata(shareToken: string): Response {
   const record = sharedAppLinksStore.getSharedAppLink(shareToken);
   if (!record) {
-    return httpError('NOT_FOUND', 'Shared app not found', 404);
+    return httpError("NOT_FOUND", "Shared app not found", 404);
   }
 
   let manifest: AppManifest;
   try {
     manifest = JSON.parse(record.manifestJson) as AppManifest;
   } catch {
-    return httpError('INTERNAL_ERROR', 'Corrupted manifest data', 500);
+    return httpError("INTERNAL_ERROR", "Corrupted manifest data", 500);
   }
 
   return Response.json({
@@ -177,7 +195,7 @@ export function handleGetSharedAppMetadata(shareToken: string): Response {
 export function handleDeleteSharedApp(shareToken: string): Response {
   const deleted = sharedAppLinksStore.deleteSharedAppLinkByToken(shareToken);
   if (!deleted) {
-    return httpError('NOT_FOUND', 'Shared app not found', 404);
+    return httpError("NOT_FOUND", "Shared app not found", 404);
   }
   return Response.json({ success: true });
 }