@vellumai/assistant 0.4.41 → 0.4.43

package/src/runtime/routes/approval-routes.ts

@@ -35,15 +35,25 @@ export async function handleConfirm(
   const body = (await req.json()) as {
     requestId?: string;
     decision?: string;
+    selectedPattern?: string;
+    selectedScope?: string;
   };
 
-  const { requestId, decision } = body;
+  const { requestId, decision, selectedPattern, selectedScope } = body;
 
   if (!requestId || typeof requestId !== "string") {
     return httpError("BAD_REQUEST", "requestId is required", 400);
   }
 
-  const validConfirmDecisions = ["allow", "allow_10m", "allow_thread", "deny"];
+  const validConfirmDecisions = [
+    "allow",
+    "allow_10m",
+    "allow_thread",
+    "deny",
+    "always_allow",
+    "always_deny",
+    "always_allow_high_risk",
+  ];
   if (
     typeof decision !== "string" ||
     !validConfirmDecisions.includes(decision)
@@ -55,8 +65,10 @@ export async function handleConfirm(
     );
   }
 
-  const interaction = pendingInteractions.resolve(requestId);
-  if (!interaction) {
+  // Peek first (non-destructive) so validation failures don't consume the
+  // pending interaction — the client can retry with corrected values.
+  const peeked = pendingInteractions.get(requestId);
+  if (!peeked) {
     return httpError(
       "NOT_FOUND",
       "No pending interaction found for this requestId",
@@ -64,11 +76,66 @@ export async function handleConfirm(
     );
   }
 
+  // For decisions that persist trust rules, validate that selectedPattern
+  // and selectedScope are among the options the server actually offered.
+  // This prevents a crafted request from injecting overly-broad rules.
+  const persistsRule =
+    decision === "always_allow" ||
+    decision === "always_deny" ||
+    decision === "always_allow_high_risk";
+  if (persistsRule && (selectedPattern || selectedScope)) {
+    const confirmation = peeked.confirmationDetails;
+    if (!confirmation) {
+      return httpError(
+        "CONFLICT",
+        "No confirmation details available for this request",
+        409,
+      );
+    }
+
+    if (selectedPattern) {
+      const validPatterns = (confirmation.allowlistOptions ?? []).map(
+        (o) => o.pattern,
+      );
+      if (!validPatterns.includes(selectedPattern)) {
+        return httpError(
+          "FORBIDDEN",
+          "selectedPattern does not match any server-provided allowlist option",
+          403,
+        );
+      }
+    }
+
+    if (selectedScope) {
+      const validScopes = (confirmation.scopeOptions ?? []).map(
+        (o) => o.scope,
+      );
+      if (validScopes.length === 0) {
+        if (selectedScope !== "everywhere") {
+          return httpError(
+            "FORBIDDEN",
+            'non-scoped tools only accept scope "everywhere"',
+            403,
+          );
+        }
+      } else if (!validScopes.includes(selectedScope)) {
+        return httpError(
+          "FORBIDDEN",
+          "selectedScope does not match any server-provided scope option",
+          403,
+        );
+      }
+    }
+  }
+
+  // Validation passed — consume the pending interaction.
+  const interaction = pendingInteractions.resolve(requestId)!;
+
   interaction.session.handleConfirmationResponse(
     requestId,
     decision as UserDecision,
-    undefined,
-    undefined,
+    selectedPattern,
+    selectedScope,
     undefined,
     {
       source: "button",
@@ -150,9 +217,10 @@ export async function handleTrustRule(
     pattern?: string;
     scope?: string;
     decision?: string;
+    allowHighRisk?: boolean;
   };
 
-  const { requestId, pattern, scope, decision } = body;
+  const { requestId, pattern, scope, decision, allowHighRisk } = body;
 
   if (!requestId || typeof requestId !== "string") {
     return httpError("BAD_REQUEST", "requestId is required", 400);
@@ -234,6 +302,7 @@ export async function handleTrustRule(
     const executionTarget =
       tool?.origin === "skill" ? confirmation.executionTarget : undefined;
     addRule(confirmation.toolName, pattern, scope, decision, undefined, {
+      allowHighRisk: allowHighRisk || undefined,
       executionTarget,
     });
     log.info(

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -1,7 +1,7 @@
 /**
  * Guardian callback decision strategy: handles inbound messages from a
  * guardian sender who has pending guardian approval requests. Routes through
- * callback buttons, the conversational engine, or legacy plain-text parsing.
+ * callback buttons or the conversational engine.
  */
 import { applyGuardianDecision } from "../../../approvals/guardian-decision-primitive.js";
 import type { ChannelId } from "../../../channels/types.js";
@@ -9,13 +9,12 @@ import {
   getAllPendingApprovalsByGuardianChat,
   getPendingApprovalByRequestAndGuardianChat,
   type GuardianApprovalRequest,
-} from "../../../memory/channel-guardian-store.js";
+} from "../../../memory/guardian-approvals.js";
 import { emitNotificationSignal } from "../../../notifications/emit-signal.js";
 import type { NotificationSourceChannel } from "../../../notifications/signal.js";
 import { getLogger } from "../../../util/logger.js";
 import { runApprovalConversationTurn } from "../../approval-conversation-turn.js";
 import { composeApprovalMessageGenerative } from "../../approval-message-composer.js";
-import { parseApprovalDecision } from "../../channel-approval-parser.js";
 import type {
   ApprovalAction,
   ApprovalDecisionResult,
@@ -212,7 +211,7 @@ export async function handleGuardianCallbackDecision(
   const effectivePending =
     senderPending.length > 0 ? senderPending : allGuardianPending;
 
-  if (effectivePending.length > 0 && approvalConversationGenerator && content) {
+  if (effectivePending.length > 0 && content && approvalConversationGenerator) {
     return handleConversationalDecision({
       guardianApproval,
       allGuardianPending,
@@ -229,22 +228,43 @@ export async function handleGuardianCallbackDecision(
     });
   }
 
-  // ── Legacy fallback when no conversational engine is available ──
-  if (content && !approvalConversationGenerator) {
-    return handleLegacyDecision({
-      guardianApproval,
-      actorExternalId,
-      sourceChannel,
-      conversationExternalId,
-      replyCallbackUrl,
-      content,
-      assistantId,
-      bearerToken,
-      approvalCopyGenerator,
-    });
+  // Guardian sent a plain-text message with pending approvals but the
+  // conversational engine is unavailable. Return a handled result with a
+  // generative reply so the guardian gets feedback instead of the message being
+  // silently swallowed by the standard approval flow.
+  //
+  // Exclude callback/reaction payloads (e.g. `reaction:+1`) — these carry
+  // `callbackData` and must fall through so `handleApprovalInterception` can
+  // route them to the deterministic reaction handler.
+  if (effectivePending.length > 0 && content && !callbackData) {
+    try {
+      const text = await composeApprovalMessageGenerative(
+        {
+          scenario: "guardian_text_unavailable",
+          channel: sourceChannel,
+        },
+        {},
+        approvalCopyGenerator,
+      );
+      await deliverChannelReply(
+        replyCallbackUrl,
+        {
+          chatId: conversationExternalId,
+          text,
+          assistantId,
+        },
+        bearerToken,
+      );
+    } catch (err) {
+      log.error(
+        { err, conversationExternalId },
+        "Failed to deliver guardian fallback reply",
+      );
+    }
+    return { handled: true, type: "assistant_turn" };
   }
 
-  // No content and no engine — nothing actionable.
+  // No content — nothing actionable.
   return null;
 }
 
@@ -562,191 +582,6 @@ async function handleConversationalDecision(params: {
   return { handled: true, type: "stale_ignored" };
 }
 
-// ---------------------------------------------------------------------------
-// Legacy fallback decision handler
-// ---------------------------------------------------------------------------
-
-async function handleLegacyDecision(params: {
-  guardianApproval: GuardianApprovalRequest;
-  actorExternalId: string;
-  sourceChannel: ChannelId;
-  conversationExternalId: string;
-  replyCallbackUrl: string;
-  content: string;
-  assistantId: string;
-  bearerToken?: string;
-  approvalCopyGenerator?: ApprovalCopyGenerator;
-}): Promise<ApprovalInterceptionResult | null> {
-  const {
-    guardianApproval,
-    actorExternalId,
-    sourceChannel,
-    conversationExternalId,
-    replyCallbackUrl,
-    content,
-    assistantId,
-    bearerToken,
-    approvalCopyGenerator,
-  } = params;
-
-  const legacyGuardianDecision = parseApprovalDecision(content);
-  if (legacyGuardianDecision) {
-    // Guardians cannot approve_always — downgrade to approve_once.
-    if (legacyGuardianDecision.action === "approve_always") {
-      legacyGuardianDecision.action = "approve_once";
-    }
-
-    // Resolve the target approval: when a [ref:<requestId>] tag is
-    // present, look up the specific pending approval by that requestId
-    // so the decision applies to the correct conversation even when
-    // multiple guardian approvals are pending.
-    let targetLegacyApproval = guardianApproval;
-    if (legacyGuardianDecision.requestId) {
-      const resolvedByRequest = getPendingApprovalByRequestAndGuardianChat(
-        legacyGuardianDecision.requestId,
-        sourceChannel,
-        conversationExternalId,
-      );
-      if (!resolvedByRequest) {
-        // The referenced request doesn't match any pending guardian
-        // approval — it may have expired or already been resolved.
-        await deliverStaleApprovalReply({
-          scenario: "guardian_disambiguation",
-          sourceChannel,
-          replyCallbackUrl,
-          chatId: conversationExternalId,
-          assistantId,
-          bearerToken,
-          approvalCopyGenerator,
-          logger: log,
-          errorLogMessage:
-            "Failed to deliver stale approval notice (legacy path)",
-          errorLogContext: { conversationExternalId },
-        });
-        return { handled: true, type: "stale_ignored" };
-      }
-      targetLegacyApproval = resolvedByRequest;
-    }
-
-    // Re-validate guardian identity against the resolved target.
-    // The default guardianApproval was already checked, but a
-    // requestId-resolved approval may belong to a different guardian.
-    if (actorExternalId !== targetLegacyApproval.guardianExternalUserId) {
-      log.warn(
-        {
-          conversationExternalId,
-          actorExternalId,
-          expectedGuardian: targetLegacyApproval.guardianExternalUserId,
-          requestId: legacyGuardianDecision.requestId,
-        },
-        "Guardian identity mismatch on legacy ref-resolved target approval",
-      );
-      await deliverIdentityMismatchReply({
-        sourceChannel,
-        replyCallbackUrl,
-        chatId: conversationExternalId,
-        assistantId,
-        bearerToken,
-        approvalCopyGenerator,
-        logger: log,
-        errorLogMessage:
-          "Failed to deliver guardian identity mismatch notice (legacy path)",
-        errorLogContext: { conversationExternalId },
-      });
-      return { handled: true, type: "guardian_decision_applied" };
-    }
-
-    // Access request approvals need a separate decision path.
-    if (targetLegacyApproval.toolName === "ingress_access_request") {
-      const accessResult = await handleAccessRequestApproval(
-        targetLegacyApproval,
-        legacyGuardianDecision.action === "reject" ? "deny" : "approve",
-        actorExternalId,
-        replyCallbackUrl,
-        assistantId,
-        bearerToken,
-      );
-      return accessResult;
-    }
-
-    // Apply the decision through the unified guardian decision primitive.
-    const result = applyGuardianDecision({
-      approval: targetLegacyApproval,
-      decision: legacyGuardianDecision,
-      actorPrincipalId: undefined, // Callback path — principal not available at this layer
-      actorExternalUserId: actorExternalId, // Channel-native ID (Telegram user ID, phone, etc.)
-      actorChannel: sourceChannel,
-    });
-
-    if (result.applied) {
-      // Notify the requester's chat about the outcome
-      const outcomeText = await composeApprovalMessageGenerative(
-        {
-          scenario: "guardian_decision_outcome",
-          decision:
-            legacyGuardianDecision.action === "reject" ? "denied" : "approved",
-          toolName: targetLegacyApproval.toolName,
-          channel: sourceChannel,
-        },
-        {},
-        approvalCopyGenerator,
-      );
-      try {
-        await deliverChannelReply(
-          replyCallbackUrl,
-          {
-            chatId: targetLegacyApproval.requesterChatId,
-            text: outcomeText,
-            assistantId,
-          },
-          bearerToken,
-        );
-      } catch (err) {
-        log.error(
-          { err, conversationId: targetLegacyApproval.conversationId },
-          "Failed to notify requester of guardian decision (legacy path)",
-        );
-      }
-
-      return { handled: true, type: "guardian_decision_applied" };
-    }
-
-    // Race condition: request was already resolved. Deliver stale notice.
-    await deliverStaleApprovalReply({
-      scenario: "approval_already_resolved",
-      sourceChannel,
-      replyCallbackUrl,
-      chatId: conversationExternalId,
-      assistantId,
-      bearerToken,
-      approvalCopyGenerator,
-      logger: log,
-      errorLogMessage:
-        "Failed to deliver stale guardian legacy fallback notice",
-      errorLogContext: {
-        conversationId: targetLegacyApproval.conversationId,
-      },
-    });
-    return { handled: true, type: "stale_ignored" };
-  }
-
-  // No decision could be parsed — send a generic reminder to the guardian
-  await deliverStaleApprovalReply({
-    scenario: "reminder_prompt",
-    sourceChannel,
-    replyCallbackUrl,
-    chatId: conversationExternalId,
-    assistantId,
-    bearerToken,
-    approvalCopyGenerator,
-    logger: log,
-    errorLogMessage: "Failed to deliver guardian reminder (legacy path)",
-    extraContext: { toolName: guardianApproval.toolName },
-    errorLogContext: { conversationId: guardianApproval.conversationId },
-  });
-  return { handled: true, type: "assistant_turn" };
-}
-
 // ---------------------------------------------------------------------------
 // Access request decision helper
 // ---------------------------------------------------------------------------

package/src/runtime/routes/channel-delivery-routes.ts

@@ -2,9 +2,10 @@
  * Channel delivery routes: delivery ack, dead letters, reply delivery,
  * and post-decision delivery scheduling.
  */
-import * as channelDeliveryStore from "../../memory/channel-delivery-store.js";
+import * as deliveryStatus from "../../memory/delivery-status.js";
 import { httpError } from "../http-errors.js";
 export {
+  deliverAttachmentsOnly,
   type DeliverReplyOptions,
   deliverReplyViaCallback,
 } from "../channel-reply-delivery.js";
@@ -14,7 +15,7 @@ export {
 // ---------------------------------------------------------------------------
 
 export function handleListDeadLetters(): Response {
-  const events = channelDeliveryStore.getDeadLetterEvents();
+  const events = deliveryStatus.getDeadLetterEvents();
   return Response.json({ events });
 }
 
@@ -26,7 +27,7 @@ export async function handleReplayDeadLetters(req: Request): Promise<Response> {
     return httpError("BAD_REQUEST", "eventIds array is required", 400);
   }
 
-  const replayed = channelDeliveryStore.replayDeadLetters(eventIds);
+  const replayed = deliveryStatus.replayDeadLetters(eventIds);
   return Response.json({ replayed });
 }
 
@@ -55,7 +56,7 @@ export async function handleChannelDeliveryAck(
     return httpError("BAD_REQUEST", "externalMessageId is required", 400);
   }
 
-  const acked = channelDeliveryStore.acknowledgeDelivery(
+  const acked = deliveryStatus.acknowledgeDelivery(
     sourceChannel,
     conversationExternalId,
     externalMessageId,

package/src/runtime/routes/channel-route-shared.ts

@@ -8,8 +8,6 @@ import type {
   ApprovalDecisionResult,
   ApprovalUIMetadata,
 } from "../channel-approval-types.js";
-import type { DenialReason } from "../trust-context-resolver.js";
-export type { DenialReason } from "../trust-context-resolver.js";
 
 /** Canonicalize assistantId for channel ingress paths. */
 export function canonicalChannelAssistantId(_assistantId: string): string {
@@ -113,7 +111,7 @@ export function parseReactionCallbackData(
  */
 export function buildGuardianDenyContext(
   toolName: string,
-  denialReason: DenialReason,
+  denialReason: "no_binding" | "no_identity",
   _sourceChannel: ChannelId,
 ): string {
   if (denialReason === "no_identity") {

package/src/runtime/routes/channel-routes.ts

@@ -40,10 +40,7 @@ export {
   handleChannelInbound,
   handleDeleteConversation,
 } from "./channel-inbound-routes.js";
-export {
-  _setTestPollMaxWait,
-  type DenialReason,
-} from "./channel-route-shared.js";
+export { _setTestPollMaxWait } from "./channel-route-shared.js";
 
 // ---------------------------------------------------------------------------
 // Route definitions