npm - @vellumai/assistant - Versions diffs - 0.4.37 → 0.4.41 - Mend

@vellumai/assistant 0.4.37 → 0.4.41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (169) hide show

package/ARCHITECTURE.md +3 -3
package/README.md +13 -13
package/bun.lock +80 -24
package/docs/architecture/integrations.md +126 -128
package/docs/runbook-trusted-contacts.md +1 -1
package/docs/trusted-contact-access.md +12 -12
package/package.json +3 -1
package/src/__tests__/__snapshots__/ipc-snapshot.test.ts.snap +0 -14
package/src/__tests__/app-bundler.test.ts +209 -0
package/src/__tests__/app-compiler.test.ts +279 -0
package/src/__tests__/app-executors.test.ts +293 -483
package/src/__tests__/app-migration.test.ts +148 -0
package/src/__tests__/app-routes-csp.test.ts +202 -0
package/src/__tests__/avatar-e2e.test.ts +452 -0
package/src/__tests__/avatar-generator.test.ts +193 -0
package/src/__tests__/avatar-router.test.ts +186 -0
package/src/__tests__/browser-download-timeout.test.ts +28 -0
package/src/__tests__/bundled-skill-retrieval-guard.test.ts +9 -9
package/src/__tests__/call-domain.test.ts +3 -7
package/src/__tests__/credential-security-e2e.test.ts +19 -12
package/src/__tests__/credentials-cli.test.ts +30 -4
package/src/__tests__/guardian-verify-setup-skill-regression.test.ts +1 -1
package/src/__tests__/handlers-slack-config.test.ts +0 -72
package/src/__tests__/handlers-telegram-config.test.ts +19 -12
package/src/__tests__/handlers-twitter-config.test.ts +105 -48
package/src/__tests__/inbound-invite-redemption.test.ts +4 -4
package/src/__tests__/integration-status.test.ts +15 -5
package/src/__tests__/integrations-cli.test.ts +1 -1
package/src/__tests__/invite-redemption-service.test.ts +62 -7
package/src/__tests__/ipc-snapshot.test.ts +0 -8
package/src/__tests__/managed-avatar-client.test.ts +280 -0
package/src/__tests__/mcp-cli.test.ts +3 -3
package/src/__tests__/oauth-cli.test.ts +203 -0
package/src/__tests__/relay-server.test.ts +3 -3
package/src/__tests__/secret-onetime-send.test.ts +19 -12
package/src/__tests__/secure-keys.test.ts +78 -0
package/src/__tests__/session-messaging-secret-redirect.test.ts +3 -0
package/src/__tests__/slack-channel-config.test.ts +23 -16
package/src/__tests__/slack-share-routes.test.ts +263 -0
package/src/__tests__/sms-messaging-provider.test.ts +3 -1
package/src/__tests__/trusted-contact-lifecycle-notifications.test.ts +7 -7
package/src/__tests__/trusted-contact-multichannel.test.ts +3 -3
package/src/__tests__/trusted-contact-verification.test.ts +10 -10
package/src/__tests__/twilio-config.test.ts +15 -36
package/src/__tests__/twilio-provider.test.ts +4 -0
package/src/__tests__/twitter-auth-handler.test.ts +27 -14
package/src/__tests__/twitter-cli-error-shaping.test.ts +1 -1
package/src/__tests__/twitter-cli-routing.test.ts +38 -53
package/src/__tests__/twitter-oauth-client.test.ts +18 -47
package/src/__tests__/voice-invite-redemption.test.ts +27 -3
package/src/amazon/cart.ts +1 -1
package/src/amazon/client.ts +89 -7
package/src/approvals/guardian-request-resolvers.ts +2 -2
package/src/bundler/app-bundler.ts +77 -32
package/src/bundler/app-compiler.ts +195 -0
package/src/bundler/manifest.ts +1 -1
package/src/bundler/package-resolver.ts +185 -0
package/src/calls/call-domain.ts +4 -14
package/src/calls/relay-server.ts +2 -2
package/src/calls/twilio-config.ts +5 -24
package/src/calls/twilio-rest.ts +19 -5
package/src/cli/amazon.ts +74 -249
package/src/cli/audit.ts +2 -2
package/src/cli/autonomy.ts +9 -9
package/src/cli/channels.ts +5 -5
package/src/cli/completions.ts +27 -27
package/src/cli/config.ts +14 -14
package/src/cli/contacts.ts +27 -27
package/src/cli/credentials.ts +28 -28
package/src/cli/dev.ts +2 -2
package/src/cli/doctor.ts +2 -2
package/src/cli/email.ts +82 -82
package/src/cli/influencer.ts +13 -13
package/src/cli/integrations.ts +19 -144
package/src/cli/keys.ts +10 -10
package/src/cli/map.ts +4 -4
package/src/cli/mcp.ts +17 -17
package/src/cli/memory.ts +18 -18
package/src/cli/notifications.ts +13 -13
package/src/cli/oauth.ts +77 -0
package/src/cli/program.ts +2 -0
package/src/cli/sequence.ts +27 -27
package/src/cli/sessions.ts +12 -12
package/src/cli/trust.ts +8 -8
package/src/cli/twitter.ts +124 -70
package/src/config/bundled-skills/_shared/CLI_RETRIEVAL_PATTERN.md +1 -1
package/src/config/bundled-skills/agentmail/SKILL.md +34 -34
package/src/config/bundled-skills/amazon/SKILL.md +54 -54
package/src/config/bundled-skills/app-builder/SKILL.md +137 -3
package/src/config/bundled-skills/app-builder/tools/app-create.ts +10 -4
package/src/config/bundled-skills/configure-settings/SKILL.md +18 -18
package/src/config/bundled-skills/contacts/SKILL.md +12 -12
package/src/config/bundled-skills/doordash/lib/client.ts +7 -9
package/src/config/bundled-skills/email-setup/SKILL.md +4 -4
package/src/config/bundled-skills/frontend-design/icon.svg +16 -0
package/src/config/bundled-skills/google-oauth-setup/SKILL.md +143 -162
package/src/config/bundled-skills/guardian-verify-setup/SKILL.md +4 -4
package/src/config/bundled-skills/influencer/SKILL.md +13 -13
package/src/config/bundled-skills/mcp-setup/SKILL.md +11 -11
package/src/config/bundled-skills/phone-calls/SKILL.md +48 -54
package/src/config/bundled-skills/public-ingress/SKILL.md +6 -6
package/src/config/bundled-skills/slack-app-setup/SKILL.md +1 -1
package/src/config/bundled-skills/sms-setup/SKILL.md +3 -3
package/src/config/bundled-skills/telegram-setup/SKILL.md +2 -2
package/src/config/bundled-skills/twilio-setup/SKILL.md +136 -225
package/src/config/bundled-skills/twitter/SKILL.md +68 -44
package/src/config/bundled-skills/voice-setup/SKILL.md +2 -2
package/src/config/core-schema.ts +26 -0
package/src/config/env.ts +4 -0
package/src/config/feature-flag-registry.json +9 -1
package/src/config/schema.ts +8 -0
package/src/config/system-prompt.ts +6 -3
package/src/config/templates/BOOTSTRAP.md +7 -5
package/src/contacts/contacts-write.ts +5 -1
package/src/daemon/handlers/apps.ts +31 -4
package/src/daemon/handlers/config-ingress.ts +3 -3
package/src/daemon/handlers/config-integrations.ts +120 -49
package/src/daemon/handlers/config-slack-channel.ts +26 -7
package/src/daemon/handlers/config-slack.ts +1 -54
package/src/daemon/handlers/config-telegram.ts +28 -10
package/src/daemon/handlers/config.ts +1 -4
package/src/daemon/handlers/twitter-auth.ts +11 -4
package/src/daemon/ipc-contract/apps.ts +0 -13
package/src/daemon/ipc-contract-inventory.json +0 -2
package/src/daemon/lifecycle.ts +8 -1
package/src/daemon/session-messaging.ts +2 -2
package/src/daemon/tool-side-effects.ts +30 -0
package/src/email/providers/agentmail.ts +1 -1
package/src/email/providers/index.ts +1 -1
package/src/email/service.ts +1 -1
package/src/gallery/default-gallery.ts +538 -0
package/src/gallery/gallery-manifest.ts +5 -1
package/src/influencer/client.ts +8 -6
package/src/mcp/client.ts +1 -1
package/src/media/avatar-router.ts +99 -0
package/src/media/avatar-types.ts +60 -0
package/src/media/managed-avatar-client.ts +189 -0
package/src/memory/app-migration.ts +114 -0
package/src/memory/app-store.ts +11 -0
package/src/memory/qdrant-client.ts +1 -1
package/src/messaging/providers/slack/client.ts +12 -2
package/src/messaging/providers/sms/adapter.ts +6 -10
package/src/migrations/data-layout.ts +8 -1
package/src/oauth/token-persistence.ts +9 -6
package/src/runtime/assistant-scope.ts +5 -0
package/src/runtime/auth/route-policy.ts +4 -0
package/src/runtime/channel-readiness-service.ts +9 -4
package/src/runtime/gateway-internal-client.ts +11 -3
package/src/runtime/http-server.ts +2 -0
package/src/runtime/invite-redemption-service.ts +23 -13
package/src/runtime/middleware/twilio-validation.ts +2 -2
package/src/runtime/routes/app-routes.ts +131 -3
package/src/runtime/routes/inbound-stages/verification-intercept.ts +3 -3
package/src/runtime/routes/integration-routes.ts +2 -2
package/src/runtime/routes/slack-share-routes.ts +235 -0
package/src/runtime/routes/twilio-routes.ts +47 -34
package/src/schedule/integration-status.ts +2 -3
package/src/security/token-manager.ts +11 -3
package/src/tools/apps/executors.ts +116 -8
package/src/tools/browser/browser-manager.ts +30 -2
package/src/tools/browser/chrome-cdp.ts +31 -3
package/src/tools/credentials/vault.ts +9 -7
package/src/tools/executor.ts +4 -0
package/src/tools/system/avatar-generator.ts +55 -34
package/src/twitter/client.ts +1 -1
package/src/twitter/oauth-client.ts +31 -43
package/src/twitter/router.ts +25 -23
package/src/util/platform.ts +5 -0
package/src/slack/slack-webhook.ts +0 -66

package/src/__tests__/app-migration.test.ts ADDED Viewed

@@ -0,0 +1,148 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { migrateAppToMultifile } from "../memory/app-migration.js";
+import { createApp, getApp, getAppsDir } from "../memory/app-store.js";
+// Redirect app storage to a temp directory for test isolation
+const tmpDir = join(import.meta.dir, ".tmp-app-migration-test");
+mock.module("../util/platform.js", () => ({
+  getDataDir: () => tmpDir,
+  isContainerized: () => false,
+}));
+describe("migrateAppToMultifile", () => {
+  beforeEach(() => {
+    mkdirSync(tmpDir, { recursive: true });
+  });
+  afterEach(() => {
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+  test("migrates a simple HTML app to src/ layout", () => {
+    const app = createApp({
+      name: "Test App",
+      schemaJson: "{}",
+      htmlDefinition: "<html><body>Hello</body></html>",
+    });
+    const result = migrateAppToMultifile(app.id);
+    expect(result.ok).toBe(true);
+    expect(result.error).toBeUndefined();
+    const appDir = join(getAppsDir(), app.id);
+    // Root index.html is preserved
+    expect(existsSync(join(appDir, "index.html"))).toBe(true);
+    expect(readFileSync(join(appDir, "index.html"), "utf-8")).toBe(
+      "<html><body>Hello</body></html>",
+    );
+    // src/index.html created
+    expect(existsSync(join(appDir, "src", "index.html"))).toBe(true);
+    // src/main.tsx created
+    const mainTsx = readFileSync(join(appDir, "src", "main.tsx"), "utf-8");
+    expect(mainTsx).toContain("Entry point");
+    // No inline styles in source HTML → no styles.css import
+    expect(mainTsx).not.toContain("import './styles.css'");
+  });
+  test("sets formatVersion to 2 after migration", () => {
+    const app = createApp({
+      name: "Version Test",
+      schemaJson: "{}",
+      htmlDefinition: "<html><body>Hi</body></html>",
+    });
+    expect(app.formatVersion).toBeUndefined();
+    migrateAppToMultifile(app.id);
+    const updated = getApp(app.id);
+    expect(updated).not.toBeNull();
+    expect(updated!.formatVersion).toBe(2);
+  });
+  test("extracts inline styles to CSS file", () => {
+    const htmlWithStyle = `<html>
+<head><style>body { color: red; }</style></head>
+<body>Styled</body>
+</html>`;
+    const app = createApp({
+      name: "Styled App",
+      schemaJson: "{}",
+      htmlDefinition: htmlWithStyle,
+    });
+    const result = migrateAppToMultifile(app.id);
+    expect(result.ok).toBe(true);
+    const appDir = join(getAppsDir(), app.id);
+    // styles.css should contain the extracted CSS
+    const css = readFileSync(join(appDir, "src", "styles.css"), "utf-8");
+    expect(css).toContain("body { color: red; }");
+    // src/index.html should have a <link> tag instead of <style>
+    const srcHtml = readFileSync(join(appDir, "src", "index.html"), "utf-8");
+    expect(srcHtml).toContain('<link rel="stylesheet" href="styles.css">');
+    expect(srcHtml).not.toContain("<style>");
+  });
+  test("extracts multiple inline style blocks", () => {
+    const html = `<html>
+<head><style>.a { margin: 0; }</style></head>
+<body><style>.b { padding: 0; }</style></body>
+</html>`;
+    const app = createApp({
+      name: "Multi Style",
+      schemaJson: "{}",
+      htmlDefinition: html,
+    });
+    migrateAppToMultifile(app.id);
+    const appDir = join(getAppsDir(), app.id);
+    const css = readFileSync(join(appDir, "src", "styles.css"), "utf-8");
+    expect(css).toContain(".a { margin: 0; }");
+    expect(css).toContain(".b { padding: 0; }");
+  });
+  test("migration of already-migrated app is a no-op", () => {
+    const app = createApp({
+      name: "Already Migrated",
+      schemaJson: "{}",
+      htmlDefinition: "<html><body>Done</body></html>",
+    });
+    const first = migrateAppToMultifile(app.id);
+    expect(first.ok).toBe(true);
+    // Grab the updatedAt after first migration
+    const afterFirst = getApp(app.id);
+    const firstUpdatedAt = afterFirst!.updatedAt;
+    // Small delay so updatedAt would differ if re-written
+    const second = migrateAppToMultifile(app.id);
+    expect(second.ok).toBe(true);
+    // formatVersion should still be 2
+    const afterSecond = getApp(app.id);
+    expect(afterSecond!.formatVersion).toBe(2);
+    // updatedAt should NOT have changed (no-op)
+    expect(afterSecond!.updatedAt).toBe(firstUpdatedAt);
+  });
+  test("returns error when app not found", () => {
+    const result = migrateAppToMultifile("nonexistent-id-12345");
+    expect(result.ok).toBe(false);
+    expect(result.error).toContain("App not found");
+  });
+});

package/src/__tests__/app-routes-csp.test.ts ADDED Viewed

@@ -0,0 +1,202 @@
+import { describe, expect, mock, test } from "bun:test";
+// Mock the logger before importing the module under test
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+// Fake app records keyed by ID
+const legacyApp = {
+  id: "legacy-1",
+  name: "Legacy App",
+  htmlDefinition: "<div>Hello</div>",
+  schemaJson: "{}",
+  createdAt: 0,
+  updatedAt: 0,
+  // No formatVersion → legacy
+};
+const multifileApp = {
+  id: "multi-1",
+  name: "Multifile App",
+  htmlDefinition: "",
+  schemaJson: "{}",
+  createdAt: 0,
+  updatedAt: 0,
+  formatVersion: 2,
+};
+const apps = new Map<string, typeof legacyApp | typeof multifileApp>([
+  ["legacy-1", legacyApp],
+  ["multi-1", multifileApp],
+]);
+mock.module("../memory/app-store.js", () => ({
+  getApp: (id: string) => apps.get(id) ?? null,
+  getAppsDir: () => "/fake/apps",
+  isMultifileApp: (app: Record<string, unknown>) => app.formatVersion === 2,
+}));
+// Mock shared-app-links-store (imported by app-routes but unused here)
+mock.module("../memory/shared-app-links-store.js", () => ({
+  createSharedAppLink: () => ({ shareToken: "tok" }),
+  getSharedAppLink: () => null,
+  incrementDownloadCount: () => {},
+  deleteSharedAppLinkByToken: () => false,
+}));
+// Stub fs so the multifile path finds a fake dist/index.html
+mock.module("node:fs", () => ({
+  existsSync: (p: string) => p === "/fake/apps/multi-1/dist/index.html",
+  readFileSync: (p: string, _enc?: string) => {
+    if (p === "/fake/apps/multi-1/dist/index.html") {
+      return '<!DOCTYPE html><html><head></head><body><script src="main.js"></script></body></html>';
+    }
+    // Design system CSS — return empty string
+    return "";
+  },
+}));
+import {
+  handleServeDistFile,
+  handleServePage,
+} from "../runtime/routes/app-routes.js";
+/** Parse CSP header into a directive map. */
+function parseCsp(header: string): Record<string, string> {
+  const directives: Record<string, string> = {};
+  for (const part of header.split(";")) {
+    const trimmed = part.trim();
+    const spaceIdx = trimmed.indexOf(" ");
+    if (spaceIdx === -1) continue;
+    directives[trimmed.slice(0, spaceIdx)] = trimmed.slice(spaceIdx + 1);
+  }
+  return directives;
+}
+describe("app-routes CSP headers", () => {
+  describe("legacy apps", () => {
+    test("includes 'unsafe-inline' in script-src", () => {
+      const res = handleServePage("legacy-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["script-src"]).toContain("'unsafe-inline'");
+    });
+    test("includes 'unsafe-inline' in style-src", () => {
+      const res = handleServePage("legacy-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["style-src"]).toContain("'unsafe-inline'");
+    });
+    test("has img-src with self, data, and https", () => {
+      const res = handleServePage("legacy-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["img-src"]).toContain("'self'");
+      expect(directives["img-src"]).toContain("data:");
+      expect(directives["img-src"]).toContain("https:");
+    });
+  });
+  describe("multifile apps", () => {
+    test("does NOT include 'unsafe-inline' in script-src", () => {
+      const res = handleServePage("multi-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["script-src"]).not.toContain("'unsafe-inline'");
+    });
+    test("includes 'self' in script-src for external main.js", () => {
+      const res = handleServePage("multi-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["script-src"]).toContain("'self'");
+    });
+    test("includes 'unsafe-inline' in style-src", () => {
+      const res = handleServePage("multi-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["style-src"]).toContain("'unsafe-inline'");
+    });
+    test("has img-src with self, data, and https", () => {
+      const res = handleServePage("multi-1");
+      const csp = res.headers.get("Content-Security-Policy")!;
+      const directives = parseCsp(csp);
+      expect(directives["img-src"]).toContain("'self'");
+      expect(directives["img-src"]).toContain("data:");
+      expect(directives["img-src"]).toContain("https:");
+    });
+  });
+  describe("handleServeDistFile appId validation", () => {
+    test("rejects appId with encoded path traversal (..)", () => {
+      const res = handleServeDistFile("..", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects appId with forward slash", () => {
+      const res = handleServeDistFile("../../etc", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects appId with backslash", () => {
+      const res = handleServeDistFile("foo\\bar", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects empty appId", () => {
+      const res = handleServeDistFile("", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects appId with leading whitespace", () => {
+      const res = handleServeDistFile(" multi-1", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects appId with trailing whitespace", () => {
+      const res = handleServeDistFile("multi-1 ", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("rejects appId containing .. in the middle", () => {
+      const res = handleServeDistFile("foo..bar", "main.js");
+      expect(res.status).toBe(400);
+    });
+    test("allows valid appId and filename (file not found is 404)", () => {
+      const res = handleServeDistFile("multi-1", "main.js");
+      // File doesn't exist in our mock fs, so 404
+      expect(res.status).toBe(404);
+    });
+  });
+  describe("consistent directives across formats", () => {
+    test("both formats share the same style-src policy", () => {
+      const legacy = handleServePage("legacy-1");
+      const multi = handleServePage("multi-1");
+      const legacyCsp = parseCsp(
+        legacy.headers.get("Content-Security-Policy")!,
+      );
+      const multiCsp = parseCsp(multi.headers.get("Content-Security-Policy")!);
+      expect(legacyCsp["style-src"]).toBe(multiCsp["style-src"]);
+    });
+    test("both formats share the same img-src policy", () => {
+      const legacy = handleServePage("legacy-1");
+      const multi = handleServePage("multi-1");
+      const legacyCsp = parseCsp(
+        legacy.headers.get("Content-Security-Policy")!,
+      );
+      const multiCsp = parseCsp(multi.headers.get("Content-Security-Policy")!);
+      expect(legacyCsp["img-src"]).toBe(multiCsp["img-src"]);
+    });
+  });
+});