@vellumai/assistant 0.5.1 → 0.5.2

package/src/providers/openai/client.ts

@@ -2,6 +2,7 @@ import OpenAI from "openai";
 
 import { SYSTEM_PROMPT_CACHE_BOUNDARY } from "../../prompts/cache-boundary.js";
 import { ProviderError } from "../../util/errors.js";
+import { getLogger } from "../../util/logger.js";
 import { extractRetryAfterMs } from "../../util/retry.js";
 import { escapeXmlAttr } from "../../util/xml.js";
 import { createStreamTimeout } from "../stream-timeout.js";
@@ -14,6 +15,54 @@ import type {
   ToolDefinition,
 } from "../types.js";
 
+const log = getLogger("openai-client");
+
+/** Validation-specific timeout (10s) so a stalled network doesn't block key submission. */
+const VALIDATION_TIMEOUT_MS = 10_000;
+
+/**
+ * Validate an OpenAI API key by making a lightweight GET /v1/models call.
+ * Returns `{ valid: true }` on success or `{ valid: false, reason: string }` on failure.
+ */
+export async function validateOpenAIApiKey(
+  apiKey: string,
+): Promise<{ valid: true } | { valid: false; reason: string }> {
+  try {
+    const client = new OpenAI({
+      apiKey,
+      timeout: VALIDATION_TIMEOUT_MS,
+      maxRetries: 0,
+    });
+    await client.models.list();
+    return { valid: true };
+  } catch (error) {
+    if (error instanceof OpenAI.APIError) {
+      if (error.status === 401) {
+        return { valid: false, reason: "API key is invalid or expired." };
+      }
+      if (error.status === 403) {
+        return {
+          valid: false,
+          reason: `OpenAI API error (${error.status}): ${error.message}`,
+        };
+      }
+      // Transient errors (429, 5xx, etc.) — validation is inconclusive,
+      // allow the key to be stored rather than blocking the user.
+      log.warn(
+        { status: error.status },
+        "OpenAI API returned a transient error during key validation — allowing key storage",
+      );
+      return { valid: true };
+    }
+    // Network errors — validation is inconclusive, allow key storage.
+    log.warn(
+      { error: error instanceof Error ? error.message : String(error) },
+      "Network error during OpenAI key validation — allowing key storage",
+    );
+    return { valid: true };
+  }
+}
+
 export interface OpenAICompatibleProviderOptions {
   baseURL?: string;
   providerName?: string;

package/src/providers/types.ts

@@ -93,6 +93,8 @@ export type ModelIntent =
 export interface ProviderResponse {
   content: ContentBlock[];
   model: string;
+  /** Provider that actually produced this response, which may differ from a wrapper provider name. */
+  actualProvider?: string;
   usage: {
     /** Total input tokens (input_tokens + cache_creation + cache_read). */
     inputTokens: number;

package/src/runtime/access-request-helper.ts

@@ -21,7 +21,10 @@ import {
   updateCanonicalGuardianDelivery,
 } from "../memory/canonical-guardian-store.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
-import type { NotificationSourceChannel } from "../notifications/signal.js";
+import type {
+  GuardianResolutionSource,
+  NotificationSourceChannel,
+} from "../notifications/signal.js";
 import type { NotificationDeliveryResult } from "../notifications/types.js";
 import { getLogger } from "../util/logger.js";
 import { ensureVellumGuardianBinding } from "./guardian-vellum-migration.js";
@@ -100,10 +103,7 @@ export function notifyGuardianOfAccessRequest(
   let guardianExternalUserId: string | null = null;
   let guardianPrincipalId: string | null = null;
   let guardianBindingChannel: string | null = null;
-  let guardianResolutionSource:
-    | "source-channel-contact"
-    | "vellum-anchor"
-    | "none" = "none";
+  let guardianResolutionSource: GuardianResolutionSource = "none";
 
   const assistantGuardianPrincipalId =
     ensureVellumGuardianBinding(canonicalAssistantId);
@@ -207,11 +207,19 @@ export function notifyGuardianOfAccessRequest(
   // because the desktop path lacks the channel delivery context needed
   // to deliver the verification code. Phone is excluded because it is
   // not a deliverable notification channel.
+  // When the guardian was resolved via a verified same-channel contact,
+  // route only to that channel — delivering on desktop as well is noisy
+  // and the desktop path lacks the channel delivery context for approval.
+  // When the guardian was NOT verified on the source channel (e.g. resolved
+  // via vellum anchor), route to all channels so the guardian can see
+  // the request on desktop/other channels where they ARE verified.
   const TEXT_CHANNELS_WITH_DELIVERY: ReadonlySet<string> = new Set([
     "slack",
     "telegram",
   ]);
-  const sameChannelOnly = TEXT_CHANNELS_WITH_DELIVERY.has(sourceChannel);
+  const sameChannelOnly =
+    TEXT_CHANNELS_WITH_DELIVERY.has(sourceChannel) &&
+    guardianResolutionSource === "source-channel-contact";
 
   void emitNotificationSignal({
     sourceEventName: "ingress.access_request",
@@ -226,7 +234,7 @@ export function notifyGuardianOfAccessRequest(
     },
     contextPayload: {
       requestId,
-      requestCode: canonicalRequest.requestCode,
+      requestCode: canonicalRequest.requestCode ?? "",
       sourceChannel,
       conversationExternalId,
       actorExternalId,
@@ -234,6 +242,7 @@ export function notifyGuardianOfAccessRequest(
       actorUsername: actorUsername ?? null,
       senderIdentifier,
       guardianBindingChannel,
+      guardianResolutionSource,
       previousMemberStatus: previousMemberStatus ?? null,
     },
     dedupeKey: `access-request:${canonicalRequest.id}`,

package/src/runtime/auth/credential-service.ts

@@ -31,6 +31,7 @@ import {
   createActorTokenRecord,
   revokeByDeviceBinding as revokeActorTokensByDevice,
 } from "../actor-token-store.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { getExternalAssistantId } from "./external-assistant-id.js";
 import { CURRENT_POLICY_EPOCH } from "./policy.js";
 import { hashToken, mintToken } from "./token-service.js";
@@ -107,7 +108,8 @@ function mintAccessToken(guardianPrincipalId: string): {
   expiresAt: number;
   issuedAt: number;
 } {
-  const externalAssistantId = getExternalAssistantId() ?? "self";
+  const externalAssistantId =
+    getExternalAssistantId() ?? DAEMON_INTERNAL_ASSISTANT_ID;
   const sub = `actor:${externalAssistantId}:${guardianPrincipalId}`;
 
   const token = mintToken({

package/src/runtime/auth/route-policy.ts

@@ -129,6 +129,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "btw", scopes: ["chat.write"] },
   { endpoint: "conversations", scopes: ["chat.read"] },
   { endpoint: "conversations:DELETE", scopes: ["chat.write"] },
+  { endpoint: "conversations/fork", scopes: ["chat.write"] },
   { endpoint: "conversations/switch", scopes: ["chat.write"] },
   { endpoint: "conversations/name", scopes: ["chat.write"] },
   { endpoint: "conversations/cancel", scopes: ["chat.write"] },
@@ -342,6 +343,10 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "model:PUT", scopes: ["settings.write"] },
   { endpoint: "model/image-gen", scopes: ["settings.write"] },
 
+  // Embedding config
+  { endpoint: "config/embeddings:GET", scopes: ["settings.read"] },
+  { endpoint: "config/embeddings:PUT", scopes: ["settings.write"] },
+
   // Conversation management
   { endpoint: "conversations/wipe", scopes: ["chat.write"] },
   { endpoint: "conversations/reorder", scopes: ["chat.write"] },
@@ -351,6 +356,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
 
   // Message content
   { endpoint: "messages/content", scopes: ["chat.read"] },
+  { endpoint: "messages/llm-context", scopes: ["chat.read"] },
 
   // Queued message deletion
   { endpoint: "messages/queued", scopes: ["chat.write"] },
@@ -435,7 +441,14 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "dictation", scopes: ["chat.write"] },
 
   // OAuth / integrations
-  { endpoint: "integrations/oauth/start", scopes: ["settings.write"] },
+  { endpoint: "oauth/start", scopes: ["settings.write"] },
+  { endpoint: "integrations/oauth/start", scopes: ["settings.write"] }, // legacy alias
+  { endpoint: "oauth/apps", scopes: ["settings.read"] },
+  { endpoint: "oauth/apps.create", scopes: ["settings.write"] },
+  { endpoint: "oauth/apps.delete", scopes: ["settings.write"] },
+  { endpoint: "oauth/apps/connections", scopes: ["settings.read"] },
+  { endpoint: "oauth/apps/connect", scopes: ["settings.write"] },
+  { endpoint: "oauth/connections", scopes: ["settings.write"] },
 
   // Ingress config
   { endpoint: "integrations/ingress/config:GET", scopes: ["settings.read"] },

package/src/runtime/btw-sidechain.ts

@@ -0,0 +1,101 @@
+import { buildToolDefinitions } from "../daemon/conversation-tool-setup.js";
+import { buildSystemPrompt } from "../prompts/system-prompt.js";
+import {
+  createTimeout,
+  extractAllText,
+  userMessage,
+} from "../providers/provider-send-message.js";
+import type {
+  Message,
+  ModelIntent,
+  Provider,
+  ProviderEvent,
+  ProviderResponse,
+  ToolDefinition,
+} from "../providers/types.js";
+
+export interface BtwSidechainConversationLike {
+  provider: Provider;
+  systemPrompt: string;
+  hasSystemPromptOverride?: boolean;
+  getMessages(): Message[];
+}
+
+export interface RunBtwSidechainParams {
+  content: string;
+  conversation?: BtwSidechainConversationLike;
+  provider?: Provider;
+  messages?: Message[];
+  systemPrompt?: string;
+  tools?: ToolDefinition[];
+  maxTokens?: number;
+  modelIntent?: ModelIntent;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  onEvent?: (event: ProviderEvent) => void;
+}
+
+export interface RunBtwSidechainResult {
+  text: string;
+  hadTextDeltas: boolean;
+  response: ProviderResponse;
+}
+
+/**
+ * Run an ephemeral BTW-style side-chain LLM call.
+ *
+ * This mirrors the /v1/btw route behavior: no message persistence, tool_choice
+ * forced to none, latency-optimized by default, and the standard system prompt
+ * with BOOTSTRAP.md excluded unless an explicit system prompt override exists.
+ */
+export async function runBtwSidechain(
+  params: RunBtwSidechainParams,
+): Promise<RunBtwSidechainResult> {
+  const trimmedContent = params.content.trim();
+  const provider = params.provider ?? params.conversation?.provider;
+  if (!provider) {
+    throw new Error("BTW side-chain requires a provider");
+  }
+
+  const tools = params.tools ?? buildToolDefinitions();
+  const history = params.messages ?? params.conversation?.getMessages() ?? [];
+  const messages = [...history, userMessage(trimmedContent)];
+  const systemPrompt =
+    params.systemPrompt ??
+    (params.conversation?.hasSystemPromptOverride
+      ? params.conversation.systemPrompt
+      : buildSystemPrompt({ excludeBootstrap: true }));
+
+  const { signal: timeoutSignal, cleanup } = createTimeout(
+    params.timeoutMs ?? 30_000,
+  );
+  const combinedSignal = params.signal
+    ? AbortSignal.any([params.signal, timeoutSignal])
+    : timeoutSignal;
+
+  let collectedText = "";
+  let hadTextDeltas = false;
+
+  try {
+    const response = await provider.sendMessage(messages, tools, systemPrompt, {
+      config: {
+        max_tokens: params.maxTokens ?? 1024,
+        tool_choice: { type: "none" },
+        modelIntent: params.modelIntent ?? "latency-optimized",
+      },
+      onEvent: (event) => {
+        if (event.type === "text_delta") {
+          hadTextDeltas = true;
+          collectedText += event.text;
+        }
+        params.onEvent?.(event);
+      },
+      signal: combinedSignal,
+    });
+
+    const text = collectedText.trim() || extractAllText(response).trim();
+    return { text, hadTextDeltas, response };
+  } finally {
+    cleanup();
+  }
+}

package/src/runtime/channel-reply-delivery.ts

@@ -45,14 +45,24 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+const NO_RESPONSE_RE = /^\s*<no_response\s*\/?>\s*$/;
+
+/** Returns true when any segment is a `<no_response/>` sentinel. */
+function hasNoResponseMarker(textSegments: string[]): boolean {
+  return textSegments.some((s) => NO_RESPONSE_RE.test(s));
+}
+
 function toDeliverableTextSegments(
   textSegments: string[],
   fallbackText?: string,
 ): string[] {
   const nonEmptySegments = textSegments.filter(
-    (segment) => segment.trim().length > 0,
+    (segment) => segment.trim().length > 0 && !NO_RESPONSE_RE.test(segment),
   );
   if (nonEmptySegments.length > 0) return nonEmptySegments;
+  // If the only text was <no_response/>, treat as intentional silence —
+  // do not fall back to fallbackText.
+  if (hasNoResponseMarker(textSegments)) return [];
   if (typeof fallbackText === "string" && fallbackText.trim().length > 0) {
     return [fallbackText];
   }
@@ -86,6 +96,12 @@ export async function deliverRenderedReplyViaCallback(
   const replyAttachments =
     attachments && attachments.length > 0 ? attachments : undefined;
 
+  // If the model output <no_response/> and no other deliverable text remains,
+  // suppress all delivery — including attachments — so nothing is posted.
+  if (deliverableSegments.length === 0 && hasNoResponseMarker(textSegments)) {
+    return;
+  }
+
   if (deliverableSegments.length === 0) {
     if (replyAttachments) {
       const result: ChannelDeliveryResult = await deliverChannelReply(

package/src/runtime/http-router.ts

@@ -88,7 +88,9 @@ export class HttpRouter {
   ): Promise<Response | null> {
     // Normalize trailing slashes so "/integrations/twilio/config/" matches
     // a route defined as "integrations/twilio/config".
-    const normalized = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+    const normalized = endpoint.endsWith("/")
+      ? endpoint.slice(0, -1)
+      : endpoint;
 
     for (const compiled of this.compiledRoutes) {
       if (compiled.def.method !== req.method) continue;