@vellumai/assistant 0.5.1 → 0.5.3

package/src/runtime/http-server.ts

@@ -36,6 +36,7 @@ import {
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import { PairingStore } from "../daemon/pairing-store.js";
 import {
+  type AttentionState,
   type Confidence,
   getAttentionStateByConversationIds,
   markConversationUnread,
@@ -43,6 +44,8 @@ import {
   type SignalType,
 } from "../memory/conversation-attention-store.js";
 import {
+  type ConversationRow,
+  forkConversation as forkConversationInStore,
   getConversation,
   getDisplayMetaForConversations,
 } from "../memory/conversation-crud.js";
@@ -51,6 +54,7 @@ import {
   countConversations,
   listConversations,
 } from "../memory/conversation-queries.js";
+import type { ExternalConversationBinding } from "../memory/external-conversation-store.js";
 import * as externalConversationStore from "../memory/external-conversation-store.js";
 import {
   consumeCallback,
@@ -122,7 +126,10 @@ import {
   contactRouteDefinitions,
 } from "./routes/contact-routes.js";
 import { conversationAttentionRouteDefinitions } from "./routes/conversation-attention-routes.js";
-import { conversationManagementRouteDefinitions } from "./routes/conversation-management-routes.js";
+import {
+  type ConversationManagementDeps,
+  conversationManagementRouteDefinitions,
+} from "./routes/conversation-management-routes.js";
 import { conversationQueryRouteDefinitions } from "./routes/conversation-query-routes.js";
 import { conversationRouteDefinitions } from "./routes/conversation-routes.js";
 import { conversationStarterRouteDefinitions } from "./routes/conversation-starter-routes.js";
@@ -147,6 +154,7 @@ import { inviteRouteDefinitions } from "./routes/invite-routes.js";
 import { logExportRouteDefinitions } from "./routes/log-export-routes.js";
 import { memoryItemRouteDefinitions } from "./routes/memory-item-routes.js";
 import { migrationRouteDefinitions } from "./routes/migration-routes.js";
+import { oauthAppsRouteDefinitions } from "./routes/oauth-apps.js";
 import type { PairingHandlerContext } from "./routes/pairing-routes.js";
 import {
   handlePairingRequest,
@@ -713,6 +721,175 @@ export class RuntimeHttpServer {
     });
   }
 
+  private buildAssistantAttention(attentionState: AttentionState | undefined):
+    | {
+        hasUnseenLatestAssistantMessage: boolean;
+        latestAssistantMessageAt?: number;
+        lastSeenAssistantMessageAt?: number;
+        lastSeenConfidence?: Confidence;
+        lastSeenSignalType?: SignalType;
+      }
+    | undefined {
+    if (!attentionState) return undefined;
+
+    return {
+      hasUnseenLatestAssistantMessage:
+        attentionState.latestAssistantMessageAt != null &&
+        (attentionState.lastSeenAssistantMessageAt == null ||
+          attentionState.lastSeenAssistantMessageAt <
+            attentionState.latestAssistantMessageAt),
+      ...(attentionState.latestAssistantMessageAt != null
+        ? {
+            latestAssistantMessageAt: attentionState.latestAssistantMessageAt,
+          }
+        : {}),
+      ...(attentionState.lastSeenAssistantMessageAt != null
+        ? {
+            lastSeenAssistantMessageAt:
+              attentionState.lastSeenAssistantMessageAt,
+          }
+        : {}),
+      ...(attentionState.lastSeenConfidence != null
+        ? { lastSeenConfidence: attentionState.lastSeenConfidence }
+        : {}),
+      ...(attentionState.lastSeenSignalType != null
+        ? { lastSeenSignalType: attentionState.lastSeenSignalType }
+        : {}),
+    };
+  }
+
+  private buildForkParent(
+    conversation: ConversationRow,
+    parentCache: Map<string, ConversationRow | null>,
+  ): { conversationId: string; messageId: string; title: string } | undefined {
+    const parentConversationId = conversation.forkParentConversationId;
+    const parentMessageId = conversation.forkParentMessageId;
+    if (!parentConversationId || !parentMessageId) return undefined;
+
+    let parentConversation: ConversationRow | null | undefined =
+      parentCache.get(parentConversationId);
+    if (parentConversation === undefined) {
+      parentConversation = getConversation(parentConversationId);
+      parentCache.set(parentConversationId, parentConversation);
+    }
+    if (
+      !parentConversation ||
+      parentConversation.conversationType === "private"
+    ) {
+      return undefined;
+    }
+
+    return {
+      conversationId: parentConversationId,
+      messageId: parentMessageId,
+      title: parentConversation.title ?? "Untitled",
+    };
+  }
+
+  private serializeConversationSummary(params: {
+    conversation: ConversationRow;
+    binding?: ExternalConversationBinding | null;
+    attentionState?: AttentionState;
+    displayMeta?: { displayOrder: number | null; isPinned: boolean };
+    parentCache: Map<string, ConversationRow | null>;
+  }) {
+    const { conversation, binding, attentionState, displayMeta, parentCache } =
+      params;
+    const originChannel = parseChannelId(conversation.originChannel);
+    const assistantAttention = this.buildAssistantAttention(attentionState);
+    const forkParent = this.buildForkParent(conversation, parentCache);
+
+    return {
+      id: conversation.id,
+      title: conversation.title ?? "Untitled",
+      createdAt: conversation.createdAt,
+      updatedAt: conversation.updatedAt,
+      conversationType:
+        conversation.conversationType === "private" ? "private" : "standard",
+      source: conversation.source ?? "user",
+      ...(conversation.scheduleJobId
+        ? { scheduleJobId: conversation.scheduleJobId }
+        : {}),
+      ...(binding
+        ? {
+            channelBinding: {
+              sourceChannel: binding.sourceChannel,
+              externalChatId: binding.externalChatId,
+              externalUserId: binding.externalUserId,
+              displayName: binding.displayName,
+              username: binding.username,
+            },
+          }
+        : {}),
+      ...(originChannel ? { conversationOriginChannel: originChannel } : {}),
+      ...(assistantAttention ? { assistantAttention } : {}),
+      ...(displayMeta?.isPinned
+        ? {
+            isPinned: true as const,
+            displayOrder: displayMeta.displayOrder,
+          }
+        : displayMeta?.displayOrder != null
+          ? {
+              displayOrder: displayMeta.displayOrder,
+            }
+          : {}),
+      ...(forkParent ? { forkParent } : {}),
+    };
+  }
+
+  private buildConversationDetailResponse(conversationId: string) {
+    const conversation = getConversation(conversationId);
+    if (!conversation) {
+      return null;
+    }
+
+    const bindings = externalConversationStore.getBindingsForConversations([
+      conversation.id,
+    ]);
+    const attentionStates = getAttentionStateByConversationIds([
+      conversation.id,
+    ]);
+    const displayMeta = getDisplayMetaForConversations([conversation.id]);
+    const parentCache = new Map<string, ConversationRow | null>();
+
+    return {
+      conversation: this.serializeConversationSummary({
+        conversation,
+        binding: bindings.get(conversation.id),
+        attentionState: attentionStates.get(conversation.id),
+        displayMeta: displayMeta.get(conversation.id),
+        parentCache,
+      }),
+    };
+  }
+
+  private getConversationManagementRouteDeps(): ConversationManagementDeps | null {
+    if (!this.conversationManagementDeps) {
+      return null;
+    }
+
+    return {
+      ...this.conversationManagementDeps,
+      forkConversation:
+        this.conversationManagementDeps.forkConversation ??
+        (async ({ conversationId, throughMessageId }) => {
+          const forkedConversation = forkConversationInStore({
+            conversationId,
+            throughMessageId,
+          });
+          const detail = this.buildConversationDetailResponse(
+            forkedConversation.id,
+          );
+          if (!detail) {
+            throw new Error(
+              `Forked conversation ${forkedConversation.id} could not be loaded`,
+            );
+          }
+          return detail.conversation;
+        }),
+    };
+  }
+
   // ---------------------------------------------------------------------------
   // Declarative route table
   // ---------------------------------------------------------------------------
@@ -728,6 +905,8 @@ export class RuntimeHttpServer {
    */
   private buildRouteTable(): RouteDefinition[] {
     const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
+    const conversationManagementDeps =
+      this.getConversationManagementRouteDeps();
 
     return [
       ...pairingRouteDefinitions({
@@ -823,84 +1002,25 @@ export class RuntimeHttpServer {
             );
           const attentionStates =
             getAttentionStateByConversationIds(conversationIds);
+          const parentCache = new Map<string, ConversationRow | null>();
           return Response.json({
-            conversations: conversations.map((c) => {
-              const binding = bindings.get(c.id);
-              const originChannel = parseChannelId(c.originChannel);
-              const attn = attentionStates.get(c.id);
-              const assistantAttention = attn
-                ? {
-                    hasUnseenLatestAssistantMessage:
-                      attn.latestAssistantMessageAt != null &&
-                      (attn.lastSeenAssistantMessageAt == null ||
-                        attn.lastSeenAssistantMessageAt <
-                          attn.latestAssistantMessageAt),
-                    ...(attn.latestAssistantMessageAt != null
-                      ? {
-                          latestAssistantMessageAt:
-                            attn.latestAssistantMessageAt,
-                        }
-                      : {}),
-                    ...(attn.lastSeenAssistantMessageAt != null
-                      ? {
-                          lastSeenAssistantMessageAt:
-                            attn.lastSeenAssistantMessageAt,
-                        }
-                      : {}),
-                    ...(attn.lastSeenConfidence != null
-                      ? { lastSeenConfidence: attn.lastSeenConfidence }
-                      : {}),
-                    ...(attn.lastSeenSignalType != null
-                      ? { lastSeenSignalType: attn.lastSeenSignalType }
-                      : {}),
-                  }
-                : undefined;
-              return {
-                id: c.id,
-                title: c.title ?? "Untitled",
-                createdAt: c.createdAt,
-                updatedAt: c.updatedAt,
-                conversationType:
-                  c.conversationType === "private" ? "private" : "standard",
-                source: c.source ?? "user",
-                ...(c.scheduleJobId ? { scheduleJobId: c.scheduleJobId } : {}),
-                ...(binding
-                  ? {
-                      channelBinding: {
-                        sourceChannel: binding.sourceChannel,
-                        externalChatId: binding.externalChatId,
-                        externalUserId: binding.externalUserId,
-                        displayName: binding.displayName,
-                        username: binding.username,
-                      },
-                    }
-                  : {}),
-                ...(originChannel
-                  ? { conversationOriginChannel: originChannel }
-                  : {}),
-                ...(assistantAttention ? { assistantAttention } : {}),
-                ...(displayMeta.get(c.id)?.isPinned
-                  ? {
-                      isPinned: true,
-                      displayOrder: displayMeta.get(c.id)!.displayOrder,
-                    }
-                  : displayMeta.get(c.id)?.displayOrder != null
-                    ? {
-                        displayOrder: displayMeta.get(c.id)!.displayOrder,
-                      }
-                    : {}),
-              };
-            }),
+            conversations: conversations.map((conversation) =>
+              this.serializeConversationSummary({
+                conversation,
+                binding: bindings.get(conversation.id),
+                attentionState: attentionStates.get(conversation.id),
+                displayMeta: displayMeta.get(conversation.id),
+                parentCache,
+              }),
+            ),
             hasMore: offset + conversations.length < totalCount,
           });
         },
       },
       ...conversationAttentionRouteDefinitions(),
 
-      ...(this.conversationManagementDeps
-        ? conversationManagementRouteDefinitions(
-            this.conversationManagementDeps,
-          )
+      ...(conversationManagementDeps
+        ? conversationManagementRouteDefinitions(conversationManagementDeps)
         : []),
 
       {
@@ -990,81 +1110,15 @@ export class RuntimeHttpServer {
         endpoint: "conversations/:id",
         method: "GET",
         handler: ({ params }) => {
-          const conversation = getConversation(params.id);
-          if (!conversation) {
+          const detail = this.buildConversationDetailResponse(params.id);
+          if (!detail) {
             return httpError(
               "NOT_FOUND",
               `Conversation ${params.id} not found`,
               404,
             );
           }
-          const bindings =
-            externalConversationStore.getBindingsForConversations([
-              conversation.id,
-            ]);
-          const attentionStates = getAttentionStateByConversationIds([
-            conversation.id,
-          ]);
-          const binding = bindings.get(conversation.id);
-          const originChannel = parseChannelId(conversation.originChannel);
-          const attn = attentionStates.get(conversation.id);
-          const assistantAttention = attn
-            ? {
-                hasUnseenLatestAssistantMessage:
-                  attn.latestAssistantMessageAt != null &&
-                  (attn.lastSeenAssistantMessageAt == null ||
-                    attn.lastSeenAssistantMessageAt <
-                      attn.latestAssistantMessageAt),
-                ...(attn.latestAssistantMessageAt != null
-                  ? {
-                      latestAssistantMessageAt: attn.latestAssistantMessageAt,
-                    }
-                  : {}),
-                ...(attn.lastSeenAssistantMessageAt != null
-                  ? {
-                      lastSeenAssistantMessageAt:
-                        attn.lastSeenAssistantMessageAt,
-                    }
-                  : {}),
-                ...(attn.lastSeenConfidence != null
-                  ? { lastSeenConfidence: attn.lastSeenConfidence }
-                  : {}),
-                ...(attn.lastSeenSignalType != null
-                  ? { lastSeenSignalType: attn.lastSeenSignalType }
-                  : {}),
-              }
-            : undefined;
-          return Response.json({
-            conversation: {
-              id: conversation.id,
-              title: conversation.title ?? "Untitled",
-              createdAt: conversation.createdAt,
-              updatedAt: conversation.updatedAt,
-              conversationType:
-                conversation.conversationType === "private"
-                  ? "private"
-                  : "standard",
-              source: conversation.source ?? "user",
-              ...(conversation.scheduleJobId
-                ? { scheduleJobId: conversation.scheduleJobId }
-                : {}),
-              ...(binding
-                ? {
-                    channelBinding: {
-                      sourceChannel: binding.sourceChannel,
-                      externalChatId: binding.externalChatId,
-                      externalUserId: binding.externalUserId,
-                      displayName: binding.displayName,
-                      username: binding.username,
-                    },
-                  }
-                : {}),
-              ...(originChannel
-                ? { conversationOriginChannel: originChannel }
-                : {}),
-              ...(assistantAttention ? { assistantAttention } : {}),
-            },
-          });
+          return Response.json(detail);
         },
       },
 
@@ -1110,6 +1164,7 @@ export class RuntimeHttpServer {
       ...slackShareRouteDefinitions(),
       ...twilioRouteDefinitions(),
       ...channelReadinessRouteDefinitions(),
+      ...oauthAppsRouteDefinitions(),
       ...attachmentRouteDefinitions(),
 
       ...(this.getWatchDeps

package/src/runtime/http-types.ts

@@ -157,6 +157,7 @@ export interface SendMessageDeps {
     filename: string;
     mimeType: string;
     data: string;
+    filePath?: string;
   }>;
 }
 

package/src/runtime/migrations/vbundle-builder.ts

@@ -447,7 +447,11 @@ export function buildExportVBundle(
 
   // Walk the entire workspace directory, including binary files (DB,
   // attachments) but skipping large/regenerable subdirectories.
-  if (workspaceDir && existsSync(workspaceDir) && lstatSync(workspaceDir).isDirectory()) {
+  if (
+    workspaceDir &&
+    existsSync(workspaceDir) &&
+    lstatSync(workspaceDir).isDirectory()
+  ) {
     files.push(
       ...walkDirectory(workspaceDir, "workspace", {
         includeBinary: true,

package/src/runtime/routes/access-request-decision.ts

@@ -174,6 +174,47 @@ function resolveRequesterTarget(params: {
   };
 }
 
+/**
+ * Deliver the verification code directly to the requester's DM on Slack,
+ * removing the need for the guardian to manually share it.
+ */
+export async function deliverVerificationCodeToRequester(params: {
+  replyCallbackUrl: string;
+  requesterChatId: string;
+  verificationCode: string;
+  assistantId: string;
+  bearerToken?: string;
+  channel?: string;
+  requesterExternalUserId?: string;
+}): Promise<DeliveryResult> {
+  const text =
+    `Great news — your access request was approved! ` +
+    `Your verification code is: ${params.verificationCode}. ` +
+    `Reply with it here to complete verification. The code expires in 10 minutes.`;
+
+  const target = resolveRequesterTarget(params);
+
+  try {
+    await deliverChannelReply(
+      target.callbackUrl,
+      {
+        chatId: target.chatId,
+        text,
+        assistantId: params.assistantId,
+      },
+      params.bearerToken,
+    );
+    return { ok: true };
+  } catch (err) {
+    log.error(
+      { err, requesterChatId: params.requesterChatId },
+      "Failed to deliver verification code to requester",
+    );
+    const reason = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason };
+  }
+}
+
 /**
  * Notify the requester that the guardian has approved their access request
  * and they should enter the verification code they receive from the guardian.

package/src/runtime/routes/app-management-routes.ts

@@ -34,11 +34,12 @@ import {
   deleteApp,
   deleteAppRecord,
   getApp,
+  getAppDirPath,
   getAppPreview,
-  getAppsDir,
   isMultifileApp,
   listApps,
   queryAppRecords,
+  resolveAppDir,
   updateApp,
   updateAppRecord,
 } from "../../memory/app-store.js";
@@ -289,7 +290,7 @@ async function installGalleryApp(
   });
 
   if (galleryApp.formatVersion === 2 && galleryApp.sourceFiles) {
-    const appDir = join(getAppsDir(), app.id);
+    const appDir = getAppDirPath(app.id);
     for (const [relPath, content] of Object.entries(galleryApp.sourceFiles)) {
       const fullPath = join(appDir, relPath);
       mkdirSync(dirname(fullPath), { recursive: true });
@@ -671,7 +672,7 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
           let html = app.htmlDefinition;
 
           if (isMultifileApp(app)) {
-            const appDir = join(getAppsDir(), appId);
+            const appDir = getAppDirPath(appId);
             const distIndex = join(appDir, "dist", "index.html");
             if (!existsSync(distIndex)) {
               const result = await compileApp(appDir);
@@ -689,8 +690,10 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
             }
           }
 
+          const { dirName } = resolveAppDir(app.id);
           return Response.json({
             appId: app.id,
+            dirName,
             name: app.name,
             html,
           });

package/src/runtime/routes/app-routes.ts

@@ -8,7 +8,11 @@ import { extname, join } from "node:path";
 import JSZip from "jszip";
 
 import type { AppManifest } from "../../bundler/manifest.js";
-import { getApp, getAppsDir, isMultifileApp } from "../../memory/app-store.js";
+import {
+  getApp,
+  getAppDirPath,
+  isMultifileApp,
+} from "../../memory/app-store.js";
 import * as sharedAppLinksStore from "../../memory/shared-app-links-store.js";
 import { getLogger } from "../../util/logger.js";
 import { httpError } from "../http-errors.js";
@@ -109,7 +113,7 @@ ${noncedHtml}
  * Falls back to a "not compiled yet" message if dist/index.html is missing.
  */
 function serveMultifileApp(appId: string, appName: string): Response {
-  const distDir = join(getAppsDir(), appId, "dist");
+  const distDir = join(getAppDirPath(appId), "dist");
   const indexPath = join(distDir, "index.html");
 
   if (!existsSync(indexPath)) {
@@ -203,7 +207,7 @@ export function handleServeDistFile(appId: string, filename: string): Response {
     return httpError("BAD_REQUEST", "Invalid filename", 400);
   }
 
-  const filePath = join(getAppsDir(), appId, "dist", filename);
+  const filePath = join(getAppDirPath(appId), "dist", filename);
   if (!existsSync(filePath)) {
     return httpError("NOT_FOUND", "File not found", 404);
   }

package/src/runtime/routes/approval-routes.ts

@@ -139,6 +139,7 @@ export async function handleConfirm(
       source: "button",
     },
   );
+
   return Response.json({ accepted: true });
 }
 

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -27,6 +27,7 @@ import type {
 } from "../../http-types.js";
 import {
   deliverVerificationCodeToGuardian,
+  deliverVerificationCodeToRequester,
   type DeliveryResult,
   handleAccessRequestDecision,
   notifyRequesterOfApproval,
@@ -688,7 +689,38 @@ async function handleAccessRequestApproval(
     }
   }
 
-  if (codeDelivered) {
+  // On Slack, auto-deliver the verification code directly to the requester's
+  // DM so the guardian doesn't have to manually share it. The identity binding
+  // still protects against abuse — only the bound user can consume the code.
+  let requesterCodeDelivered = false;
+  if (
+    codeDelivered &&
+    approval.channel === "slack" &&
+    decisionResult.verificationCode
+  ) {
+    const requesterCodeResult = await deliverVerificationCodeToRequester({
+      replyCallbackUrl,
+      requesterChatId: approval.requesterChatId,
+      verificationCode: decisionResult.verificationCode,
+      assistantId,
+      bearerToken,
+      channel: approval.channel,
+      requesterExternalUserId: approval.requesterExternalUserId,
+    });
+    if (requesterCodeResult.ok) {
+      requesterCodeDelivered = true;
+    } else {
+      log.error(
+        { reason: requesterCodeResult.reason, approvalId: approval.id },
+        "Failed to auto-deliver verification code to requester on Slack",
+      );
+    }
+  }
+
+  // Skip the separate approval notification when the requester already
+  // received the verification code directly (on Slack both messages go
+  // to the same DM, so sending both is redundant).
+  if (codeDelivered && !requesterCodeDelivered) {
     await notifyRequesterOfApproval({
       replyCallbackUrl,
       requesterChatId: approval.requesterChatId,
@@ -697,7 +729,7 @@ async function handleAccessRequestApproval(
       channel: approval.channel,
       requesterExternalUserId: approval.requesterExternalUserId,
     });
-  } else {
+  } else if (!codeDelivered) {
     // Let the requester know something went wrong without revealing details
     await notifyRequesterOfDeliveryFailure({
       replyCallbackUrl,