@vellumai/assistant 0.4.46 → 0.4.48

package/src/config/bundled-skills/messaging/tools/messaging-sender-digest.ts

@@ -2,7 +2,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, resolveProvider, withProviderToken } from "./shared.js";
+import { err, getProviderConnection, ok, resolveProvider } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -23,47 +23,46 @@ export async function run(
       );
     }
 
-    return withProviderToken(provider, async (token) => {
-      const result = await provider.senderDigest!(token, query, {
-        maxMessages,
-        maxSenders,
-        pageToken,
-      });
-
-      if (result.senders.length === 0) {
-        return ok(
-          JSON.stringify({
-            senders: [],
-            total_scanned: result.totalScanned,
-            query_used: result.queryUsed,
-            ...(result.truncated ? { truncated: true } : {}),
-            message:
-              "No emails found matching the query. Try broadening the search (e.g. remove category filter or extend date range).",
-          }),
-        );
-      }
-
-      // Map to snake_case output format for LLM consumption
-      const senders = result.senders.map((s) => ({
-        id: s.id,
-        display_name: s.displayName,
-        email: s.email,
-        message_count: s.messageCount,
-        has_unsubscribe: s.hasUnsubscribe,
-        newest_message_id: s.newestMessageId,
-        search_query: s.searchQuery,
-      }));
+    const conn = getProviderConnection(provider);
+    const result = await provider.senderDigest!(conn, query, {
+      maxMessages,
+      maxSenders,
+      pageToken,
+    });
 
+    if (result.senders.length === 0) {
       return ok(
         JSON.stringify({
-          senders,
+          senders: [],
           total_scanned: result.totalScanned,
           query_used: result.queryUsed,
           ...(result.truncated ? { truncated: true } : {}),
-          note: `message_count reflects emails found per sender within the ${result.totalScanned} messages scanned. Use messaging_archive_by_sender with the sender's search_query to archive their messages.`,
+          message:
+            "No emails found matching the query. Try broadening the search (e.g. remove category filter or extend date range).",
         }),
       );
-    });
+    }
+
+    // Map to snake_case output format for LLM consumption
+    const senders = result.senders.map((s) => ({
+      id: s.id,
+      display_name: s.displayName,
+      email: s.email,
+      message_count: s.messageCount,
+      has_unsubscribe: s.hasUnsubscribe,
+      newest_message_id: s.newestMessageId,
+      search_query: s.searchQuery,
+    }));
+
+    return ok(
+      JSON.stringify({
+        senders,
+        total_scanned: result.totalScanned,
+        query_used: result.queryUsed,
+        ...(result.truncated ? { truncated: true } : {}),
+        note: `message_count reflects emails found per sender within the ${result.totalScanned} messages scanned. Use messaging_archive_by_sender with the sender's search_query to archive their messages.`,
+      }),
+    );
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/messaging/tools/shared.ts

@@ -8,7 +8,8 @@ import {
   getMessagingProvider,
   isPlatformEnabled,
 } from "../../../../messaging/registry.js";
-import { withValidToken } from "../../../../security/token-manager.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
+import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
 import type { ToolExecutionResult } from "../../../../tools/types.js";
 
 export function ok(content: string): ToolExecutionResult {
@@ -126,16 +127,15 @@ export function resolveProvider(platformInput?: string): MessagingProvider {
 }
 
 /**
- * Execute a callback with a valid OAuth token for the given provider.
- * Providers that manage their own auth (e.g. Telegram with a bot token)
- * expose isConnected() and don't need an OAuth access_token lookup.
+ * Resolve an OAuthConnection (or empty string for non-OAuth providers)
+ * for the given messaging provider.
+ *
+ * Non-OAuth providers (e.g. Telegram) use isConnected() and don't need
+ * tokens — they receive an empty string which the string overload handles.
  */
-export async function withProviderToken<T>(
+export function getProviderConnection(
   provider: MessagingProvider,
-  fn: (token: string) => Promise<T>,
-): Promise<T> {
-  if (provider.isConnected?.()) {
-    return fn("");
-  }
-  return withValidToken(provider.credentialService, fn);
+): OAuthConnection | string {
+  if (provider.isConnected?.()) return "";
+  return resolveOAuthConnection(provider.credentialService);
 }

package/src/config/bundled-skills/slack/tools/shared.ts

@@ -2,8 +2,8 @@
  * Shared utilities for slack skill tools.
  */
 
-import { getMessagingProvider } from "../../../../messaging/registry.js";
-import { withValidToken } from "../../../../security/token-manager.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
+import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
 import type { ToolExecutionResult } from "../../../../tools/types.js";
 
 export function ok(content: string): ToolExecutionResult {
@@ -14,12 +14,6 @@ export function err(message: string): ToolExecutionResult {
   return { content: message, isError: true };
 }
 
-/**
- * Execute a callback with a valid Slack OAuth token.
- */
-export async function withSlackToken<T>(
-  fn: (token: string) => Promise<T>,
-): Promise<T> {
-  const provider = getMessagingProvider("slack");
-  return withValidToken(provider.credentialService, fn);
+export function getSlackConnection(): OAuthConnection {
+  return resolveOAuthConnection("integration:slack");
 }

package/src/config/bundled-skills/slack/tools/slack-add-reaction.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -18,10 +18,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await addReaction(token, channel, timestamp, emoji);
-      return ok(`Added :${emoji}: reaction.`);
-    });
+    const connection = getSlackConnection();
+    await addReaction(connection, channel, timestamp, emoji);
+    return ok(`Added :${emoji}: reaction.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-channel-details.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -16,23 +16,22 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      const resp = await slack.conversationInfo(token, channelId);
-      const conv = resp.channel;
+    const connection = getSlackConnection();
+    const resp = await slack.conversationInfo(connection, channelId);
+    const conv = resp.channel;
 
-      const result = {
-        channelId: conv.id,
-        name: conv.name ?? conv.id,
-        topic: conv.topic?.value || null,
-        purpose: conv.purpose?.value || null,
-        isPrivate: conv.is_private ?? conv.is_group ?? false,
-        isArchived: conv.is_archived ?? false,
-        memberCount: conv.num_members ?? null,
-        latestActivityTs: conv.latest?.ts ?? null,
-      };
+    const result = {
+      channelId: conv.id,
+      name: conv.name ?? conv.id,
+      topic: conv.topic?.value || null,
+      purpose: conv.purpose?.value || null,
+      isPrivate: conv.is_private ?? conv.is_group ?? false,
+      isArchived: conv.is_archived ?? false,
+      memberCount: conv.num_members ?? null,
+      latestActivityTs: conv.latest?.ts ?? null,
+    };
 
-      return ok(JSON.stringify(result, null, 2));
-    });
+    return ok(JSON.stringify(result, null, 2));
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-delete-message.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -17,10 +17,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await deleteMessage(token, channel, timestamp);
-      return ok(`Message deleted.`);
-    });
+    const connection = getSlackConnection();
+    await deleteMessage(connection, channel, timestamp);
+    return ok(`Message deleted.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-edit-message.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -18,10 +18,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await updateMessage(token, channel, timestamp, text);
-      return ok(`Message updated.`);
-    });
+    const connection = getSlackConnection();
+    await updateMessage(connection, channel, timestamp, text);
+    return ok(`Message updated.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-leave-channel.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -16,10 +16,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await leaveConversation(token, channel);
-      return ok("Left channel.");
-    });
+    const connection = getSlackConnection();
+    await leaveConversation(connection, channel);
+    return ok("Left channel.");
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts

@@ -1,11 +1,12 @@
 import { getConfig } from "../../../../config/loader.js";
 import * as slack from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
 import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 interface ThreadSummary {
   threadTs: string;
@@ -26,13 +27,16 @@ interface ChannelDigest {
 
 const userNameCache = new Map<string, string>();
 
-async function resolveUserName(token: string, userId: string): Promise<string> {
+async function resolveUserName(
+  connection: OAuthConnection,
+  userId: string,
+): Promise<string> {
   if (!userId) return "unknown";
   const cached = userNameCache.get(userId);
   if (cached) return cached;
 
   try {
-    const resp = await slack.userInfo(token, userId);
+    const resp = await slack.userInfo(connection, userId);
     const name =
       resp.user.profile?.display_name ||
       resp.user.profile?.real_name ||
@@ -46,7 +50,7 @@ async function resolveUserName(token: string, userId: string): Promise<string> {
 }
 
 async function scanChannel(
-  token: string,
+  connection: OAuthConnection,
   conv: SlackConversation,
   oldestTs: string,
   includeThreads: boolean,
@@ -57,7 +61,7 @@ async function scanChannel(
 
   try {
     const history = await slack.conversationHistory(
-      token,
+      connection,
       channelId,
       100,
       undefined,
@@ -71,7 +75,7 @@ async function scanChannel(
     }
 
     const keyParticipants = await Promise.all(
-      [...participantIds].map((uid) => resolveUserName(token, uid)),
+      [...participantIds].map((uid) => resolveUserName(connection, uid)),
     );
 
     const threadMessages = messages
@@ -86,7 +90,7 @@ async function scanChannel(
         if (includeThreads) {
           try {
             const replies = await slack.conversationReplies(
-              token,
+              connection,
               channelId,
               msg.ts,
               10,
@@ -97,11 +101,11 @@ async function scanChannel(
             }
             participants = await Promise.all(
               [...threadParticipantIds].map((uid) =>
-                resolveUserName(token, uid),
+                resolveUserName(connection, uid),
               ),
             );
           } catch {
-            participants = [await resolveUserName(token, msg.user ?? "")];
+            participants = [await resolveUserName(connection, msg.user ?? "")];
           }
         }
 
@@ -260,15 +264,34 @@ export async function run(
   const format = (input.format as string) ?? "text";
 
   try {
-    return await withSlackToken(async (token) => {
-      const oldestTs = String((Date.now() - hoursBack * 60 * 60 * 1000) / 1000);
+    const connection = getSlackConnection();
+    const oldestTs = String((Date.now() - hoursBack * 60 * 60 * 1000) / 1000);
 
-      let channelsToScan: SlackConversation[];
-      let failedLookups = 0;
+    let channelsToScan: SlackConversation[];
+    let failedLookups = 0;
 
-      if (channelIds?.length) {
+    if (channelIds?.length) {
+      const results = await Promise.allSettled(
+        channelIds.map((id) => slack.conversationInfo(connection, id)),
+      );
+      channelsToScan = results
+        .filter(
+          (
+            r,
+          ): r is PromiseFulfilledResult<
+            Awaited<ReturnType<typeof slack.conversationInfo>>
+          > => r.status === "fulfilled",
+        )
+        .map((r) => r.value.channel);
+      failedLookups = results.filter((r) => r.status === "rejected").length;
+    } else {
+      const config = getConfig();
+      const preferredIds = config.skills?.entries?.slack?.config
+        ?.preferredChannels as string[] | undefined;
+
+      if (preferredIds?.length) {
         const results = await Promise.allSettled(
-          channelIds.map((id) => slack.conversationInfo(token, id)),
+          preferredIds.map((id) => slack.conversationInfo(connection, id)),
         );
         channelsToScan = results
           .filter(
@@ -281,89 +304,69 @@ export async function run(
           .map((r) => r.value.channel);
         failedLookups = results.filter((r) => r.status === "rejected").length;
       } else {
-        const config = getConfig();
-        const preferredIds = config.skills?.entries?.slack?.config
-          ?.preferredChannels as string[] | undefined;
-
-        if (preferredIds?.length) {
-          const results = await Promise.allSettled(
-            preferredIds.map((id) => slack.conversationInfo(token, id)),
+        const allChannels: SlackConversation[] = [];
+        let cursor: string | undefined;
+        do {
+          const resp = await slack.listConversations(
+            connection,
+            "public_channel,private_channel",
+            true,
+            200,
+            cursor,
           );
-          channelsToScan = results
-            .filter(
-              (
-                r,
-              ): r is PromiseFulfilledResult<
-                Awaited<ReturnType<typeof slack.conversationInfo>>
-              > => r.status === "fulfilled",
-            )
-            .map((r) => r.value.channel);
-          failedLookups = results.filter((r) => r.status === "rejected").length;
-        } else {
-          const allChannels: SlackConversation[] = [];
-          let cursor: string | undefined;
-          do {
-            const resp = await slack.listConversations(
-              token,
-              "public_channel,private_channel",
-              true,
-              200,
-              cursor,
-            );
-            allChannels.push(...resp.channels);
-            cursor = resp.response_metadata?.next_cursor || undefined;
-          } while (cursor);
-
-          channelsToScan = allChannels
-            .filter((c) => c.is_member)
-            .sort((a, b) => {
-              const aTs = a.latest?.ts ? parseFloat(a.latest.ts) : 0;
-              const bTs = b.latest?.ts ? parseFloat(b.latest.ts) : 0;
-              return bTs - aTs;
-            })
-            .slice(0, maxChannels);
-        }
+          allChannels.push(...resp.channels);
+          cursor = resp.response_metadata?.next_cursor || undefined;
+        } while (cursor);
+
+        channelsToScan = allChannels
+          .filter((c) => c.is_member)
+          .sort((a, b) => {
+            const aTs = a.latest?.ts ? parseFloat(a.latest.ts) : 0;
+            const bTs = b.latest?.ts ? parseFloat(b.latest.ts) : 0;
+            return bTs - aTs;
+          })
+          .slice(0, maxChannels);
       }
+    }
 
-      const scanResults = await Promise.allSettled(
-        channelsToScan.map((conv) =>
-          scanChannel(token, conv, oldestTs, includeThreads),
-        ),
-      );
-
-      const digests: ChannelDigest[] = scanResults
-        .filter(
-          (r): r is PromiseFulfilledResult<ChannelDigest> =>
-            r.status === "fulfilled",
-        )
-        .map((r) => r.value)
-        .filter((d) => d.messageCount > 0 || d.error);
-
-      const skippedCount = scanResults.filter(
-        (r) => r.status === "rejected",
-      ).length;
-
-      if (format === "blocks") {
-        const blocks = buildBlockKitOutput(
-          digests,
-          hoursBack,
-          channelsToScan.length,
-          skippedCount,
-        );
-        return ok(JSON.stringify({ blocks }, null, 2));
-      }
+    const scanResults = await Promise.allSettled(
+      channelsToScan.map((conv) =>
+        scanChannel(connection, conv, oldestTs, includeThreads),
+      ),
+    );
 
-      const result = {
-        scannedChannels: digests.length,
-        totalChannelsAttempted: channelsToScan.length,
-        skippedDueToErrors: skippedCount,
-        failedLookups,
+    const digests: ChannelDigest[] = scanResults
+      .filter(
+        (r): r is PromiseFulfilledResult<ChannelDigest> =>
+          r.status === "fulfilled",
+      )
+      .map((r) => r.value)
+      .filter((d) => d.messageCount > 0 || d.error);
+
+    const skippedCount = scanResults.filter(
+      (r) => r.status === "rejected",
+    ).length;
+
+    if (format === "blocks") {
+      const blocks = buildBlockKitOutput(
+        digests,
         hoursBack,
-        channels: digests,
-      };
+        channelsToScan.length,
+        skippedCount,
+      );
+      return ok(JSON.stringify({ blocks }, null, 2));
+    }
 
-      return ok(JSON.stringify(result, null, 2));
-    });
+    const result = {
+      scannedChannels: digests.length,
+      totalChannelsAttempted: channelsToScan.length,
+      skippedDueToErrors: skippedCount,
+      failedLookups,
+      hoursBack,
+      channels: digests,
+    };
+
+    return ok(JSON.stringify(result, null, 2));
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/loader.ts

@@ -333,6 +333,12 @@ export function loadConfig(): AssistantConfig {
     }
 
     // Environment variables override everything
+    if (process.env.VELLUM_CONFIG_SANDBOX_ENABLED === "false") {
+      config.sandbox.enabled = false;
+    } else if (process.env.VELLUM_CONFIG_SANDBOX_ENABLED === "true") {
+      config.sandbox.enabled = true;
+    }
+
     if (process.env.ANTHROPIC_API_KEY) {
       config.apiKeys.anthropic = process.env.ANTHROPIC_API_KEY;
     }

package/src/daemon/computer-use-session.ts

@@ -23,6 +23,10 @@ import type {
 import { allComputerUseTools } from "../tools/computer-use/definitions.js";
 import { ToolExecutor } from "../tools/executor.js";
 import { getTool, registerSkillTools } from "../tools/registry.js";
+import {
+  injectReasonField,
+  REASON_SKIP_SET,
+} from "../tools/schema-transforms.js";
 import type { Tool, ToolExecutionResult } from "../tools/types.js";
 import { allUiSurfaceTools } from "../tools/ui-surface/definitions.js";
 import { getLogger } from "../util/logger.js";
@@ -581,6 +585,8 @@ export class ComputerUseSession {
       },
     };
 
+    const toolDefsWithReason = injectReasonField(toolDefs, REASON_SKIP_SET);
+
     const cuConfig = getConfig();
     const agentLoop = new AgentLoop(
       compactingProvider,
@@ -590,7 +596,7 @@ export class ComputerUseSession {
         maxInputTokens: cuConfig.contextWindow.maxInputTokens,
         toolChoice: { type: "any" },
       },
-      toolDefs,
+      toolDefsWithReason,
       toolExecutor,
     );
 

package/src/daemon/guardian-action-generators.ts

@@ -83,8 +83,8 @@ const FOLLOWUP_CONVERSATION_MAX_TOKENS = 300;
 const FOLLOWUP_CONVERSATION_SYSTEM_PROMPT =
   "You are an assistant helping route a guardian's reply to a post-timeout follow-up message. " +
   "A voice caller asked a question, but the call timed out before the guardian could answer. " +
-  "The guardian has now replied late, and was asked whether they want to call the caller back, " +
-  "send them a text message, or skip it. " +
+  "The guardian has now replied late, and was asked whether they want to call the caller back " +
+  "or skip it. " +
   "Analyze the guardian's latest reply to determine their intent. " +
   "When uncertain, default to keep_pending and ask a clarifying question. " +
   "Always provide a natural, helpful reply along with your decision.";
@@ -101,10 +101,10 @@ const FOLLOWUP_CONVERSATION_TOOL_SCHEMA = {
     properties: {
       disposition: {
         type: "string",
-        enum: ["call_back", "message_back", "decline", "keep_pending"],
+        enum: ["call_back", "decline", "keep_pending"],
         description:
           "The guardian's intent: call_back to call the original caller, " +
-          "message_back to send a text message, decline to skip the follow-up, " +
+          "decline to skip the follow-up, " +
           "keep_pending if the intent is unclear (ask for clarification).",
       },
       replyText: {
@@ -118,7 +118,6 @@ const FOLLOWUP_CONVERSATION_TOOL_SCHEMA = {
 
 const VALID_FOLLOWUP_DISPOSITIONS: ReadonlySet<string> = new Set([
   "call_back",
-  "message_back",
   "decline",
   "keep_pending",
 ]);