@vellumai/assistant 0.5.10 → 0.5.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (395) hide show
  1. package/AGENTS.md +8 -0
  2. package/ARCHITECTURE.md +43 -43
  3. package/Dockerfile +3 -0
  4. package/docs/architecture/integrations.md +37 -42
  5. package/docs/architecture/memory.md +7 -12
  6. package/docs/credential-execution-service.md +9 -9
  7. package/docs/skills.md +1 -1
  8. package/node_modules/@vellumai/ces-contracts/src/__tests__/grants.test.ts +7 -7
  9. package/node_modules/@vellumai/ces-contracts/src/handles.ts +5 -4
  10. package/node_modules/@vellumai/credential-storage/src/index.ts +3 -3
  11. package/node_modules/@vellumai/credential-storage/src/static-credentials.ts +1 -1
  12. package/openapi.yaml +7208 -0
  13. package/package.json +2 -1
  14. package/scripts/generate-openapi.ts +562 -0
  15. package/src/__tests__/acp-session.test.ts +239 -44
  16. package/src/__tests__/assistant-feature-flag-guard.test.ts +8 -8
  17. package/src/__tests__/assistant-feature-flag-guardrails.test.ts +5 -86
  18. package/src/__tests__/assistant-feature-flags-integration.test.ts +7 -14
  19. package/src/__tests__/browser-skill-endstate.test.ts +1 -1
  20. package/src/__tests__/btw-routes.test.ts +8 -0
  21. package/src/__tests__/bundled-skill-retrieval-guard.test.ts +10 -10
  22. package/src/__tests__/catalog-cache.test.ts +164 -0
  23. package/src/__tests__/catalog-search.test.ts +61 -0
  24. package/src/__tests__/channel-approvals.test.ts +7 -7
  25. package/src/__tests__/channel-readiness-service.test.ts +41 -0
  26. package/src/__tests__/cli-command-risk-guard.test.ts +181 -6
  27. package/src/__tests__/config-schema.test.ts +10 -2
  28. package/src/__tests__/context-memory-e2e.test.ts +2 -6
  29. package/src/__tests__/conversation-delete-schedule-cleanup.test.ts +396 -0
  30. package/src/__tests__/conversation-error.test.ts +3 -2
  31. package/src/__tests__/conversation-skill-tools.test.ts +1 -3
  32. package/src/__tests__/conversation-title-service.test.ts +2 -15
  33. package/src/__tests__/credential-execution-feature-gates.test.ts +4 -8
  34. package/src/__tests__/credential-execution-managed-contract.test.ts +8 -8
  35. package/src/__tests__/credential-security-e2e.test.ts +4 -4
  36. package/src/__tests__/credential-security-invariants.test.ts +12 -18
  37. package/src/__tests__/credential-vault-unit.test.ts +32 -34
  38. package/src/__tests__/credential-vault.test.ts +25 -33
  39. package/src/__tests__/credentials-cli.test.ts +3 -3
  40. package/src/__tests__/daemon-credential-client.test.ts +2 -2
  41. package/src/__tests__/dynamic-skill-workflow-prompt.test.ts +1 -1
  42. package/src/__tests__/gateway-only-guard.test.ts +3 -0
  43. package/src/__tests__/heartbeat-service.test.ts +35 -0
  44. package/src/__tests__/host-bash-proxy.test.ts +79 -0
  45. package/src/__tests__/host-cu-proxy.test.ts +90 -0
  46. package/src/__tests__/host-file-proxy.test.ts +89 -0
  47. package/src/__tests__/host-shell-tool.test.ts +1 -1
  48. package/src/__tests__/inline-skill-load-permissions.test.ts +3 -3
  49. package/src/__tests__/integration-status.test.ts +5 -5
  50. package/src/__tests__/list-messages-attachments.test.ts +171 -0
  51. package/src/__tests__/llm-request-log-turn-query.test.ts +64 -0
  52. package/src/__tests__/log-export-workspace.test.ts +1 -1
  53. package/src/__tests__/mcp-abort-signal.test.ts +205 -0
  54. package/src/__tests__/mcp-client-auth.test.ts +1 -1
  55. package/src/__tests__/memory-lifecycle-e2e.test.ts +2 -2
  56. package/src/__tests__/memory-recall-log-store.test.ts +182 -0
  57. package/src/__tests__/memory-recall-quality.test.ts +6 -8
  58. package/src/__tests__/memory-regressions.test.ts +53 -42
  59. package/src/__tests__/memory-retrieval.benchmark.test.ts +5 -9
  60. package/src/__tests__/messaging-send-tool.test.ts +5 -5
  61. package/src/__tests__/messaging-skill-split.test.ts +2 -17
  62. package/src/__tests__/notification-telegram-adapter.test.ts +125 -0
  63. package/src/__tests__/oauth-cli.test.ts +203 -649
  64. package/src/__tests__/oauth-provider-profiles.test.ts +55 -20
  65. package/src/__tests__/oauth-scope-policy.test.ts +4 -6
  66. package/src/__tests__/onboarding-template-contract.test.ts +2 -2
  67. package/src/__tests__/platform-callback-registration.test.ts +119 -0
  68. package/src/__tests__/secret-ingress-channel.test.ts +261 -0
  69. package/src/__tests__/secret-ingress-cli.test.ts +201 -0
  70. package/src/__tests__/secret-ingress-http.test.ts +312 -0
  71. package/src/__tests__/secret-ingress.test.ts +283 -0
  72. package/src/__tests__/secret-onetime-send.test.ts +4 -4
  73. package/src/__tests__/secret-routes-managed-proxy.test.ts +78 -0
  74. package/src/__tests__/secure-keys-managed-failover.test.ts +73 -0
  75. package/src/__tests__/skill-feature-flags-integration.test.ts +4 -4
  76. package/src/__tests__/skill-feature-flags.test.ts +11 -19
  77. package/src/__tests__/skill-load-feature-flag.test.ts +1 -1
  78. package/src/__tests__/skill-load-inline-command.test.ts +3 -3
  79. package/src/__tests__/skill-load-inline-includes.test.ts +2 -2
  80. package/src/__tests__/skill-memory.test.ts +2 -4
  81. package/src/__tests__/skill-projection-feature-flag.test.ts +2 -4
  82. package/src/__tests__/skill-projection.benchmark.test.ts +1 -3
  83. package/src/__tests__/skills-uninstall.test.ts +2 -2
  84. package/src/__tests__/skills.test.ts +16 -2
  85. package/src/__tests__/slack-channel-config.test.ts +1 -1
  86. package/src/__tests__/slack-messaging-token-resolution.test.ts +22 -24
  87. package/src/__tests__/slack-share-routes.test.ts +5 -5
  88. package/src/__tests__/slack-skill.test.ts +5 -69
  89. package/src/__tests__/system-prompt.test.ts +39 -0
  90. package/src/__tests__/vellum-self-knowledge-inline-command.test.ts +1 -1
  91. package/src/__tests__/workspace-migration-018-rekey-compound-credential-keys.test.ts +181 -0
  92. package/src/__tests__/workspace-migration-backfill-installation-id.test.ts +5 -4
  93. package/src/acp/client-handler.ts +113 -31
  94. package/src/acp/session-manager.ts +29 -27
  95. package/src/approvals/guardian-request-resolvers.ts +1 -1
  96. package/src/cli/AGENTS.md +113 -0
  97. package/src/cli/commands/autonomy.ts +3 -5
  98. package/src/cli/commands/browser-relay.ts +2 -17
  99. package/src/cli/commands/contacts.ts +6 -4
  100. package/src/cli/commands/conversations.ts +13 -1
  101. package/src/cli/commands/credential-execution.ts +17 -3
  102. package/src/cli/commands/credentials.ts +2 -8
  103. package/src/cli/commands/memory.ts +2 -3
  104. package/src/cli/commands/oauth/__tests__/connect.test.ts +706 -0
  105. package/src/cli/commands/oauth/__tests__/disconnect.test.ts +686 -0
  106. package/src/cli/commands/oauth/__tests__/mode.test.ts +625 -0
  107. package/src/cli/commands/oauth/__tests__/ping.test.ts +631 -0
  108. package/src/cli/commands/oauth/__tests__/providers-delete.test.ts +574 -0
  109. package/src/cli/commands/oauth/__tests__/providers-update.test.ts +416 -0
  110. package/src/cli/commands/oauth/__tests__/status.test.ts +551 -0
  111. package/src/cli/commands/oauth/__tests__/token.test.ts +420 -0
  112. package/src/cli/commands/oauth/apps.ts +87 -50
  113. package/src/cli/commands/oauth/connect.ts +405 -0
  114. package/src/cli/commands/oauth/disconnect.ts +285 -0
  115. package/src/cli/commands/oauth/index.ts +62 -20
  116. package/src/cli/commands/oauth/mode.ts +251 -0
  117. package/src/cli/commands/oauth/ping.ts +196 -0
  118. package/src/cli/commands/oauth/providers.ts +589 -55
  119. package/src/cli/commands/oauth/request.ts +564 -0
  120. package/src/cli/commands/oauth/shared.ts +114 -0
  121. package/src/cli/commands/oauth/status.ts +191 -0
  122. package/src/cli/commands/oauth/token.ts +150 -0
  123. package/src/cli/commands/platform/connect.ts +104 -0
  124. package/src/cli/commands/platform/disconnect.ts +118 -0
  125. package/src/cli/commands/platform/index.ts +252 -0
  126. package/src/cli/commands/sequence.ts +5 -4
  127. package/src/cli/commands/shotgun.ts +16 -0
  128. package/src/cli/commands/skills.ts +173 -41
  129. package/src/cli/commands/usage.ts +5 -11
  130. package/src/cli/lib/daemon-credential-client.ts +22 -38
  131. package/src/cli/program.ts +1 -1
  132. package/src/cli.ts +82 -17
  133. package/src/config/assistant-feature-flags.ts +77 -18
  134. package/src/config/bundled-skills/_shared/CLI_RETRIEVAL_PATTERN.md +1 -1
  135. package/src/config/bundled-skills/app-builder/tools/app-create.ts +1 -1
  136. package/src/config/bundled-skills/contacts/tools/google-contacts.ts +1 -1
  137. package/src/config/bundled-skills/conversations/SKILL.md +20 -0
  138. package/src/config/bundled-skills/conversations/TOOLS.json +23 -0
  139. package/src/config/bundled-skills/conversations/tools/rename-conversation.ts +66 -0
  140. package/src/config/bundled-skills/gmail/SKILL.md +13 -13
  141. package/src/config/bundled-skills/gmail/tools/gmail-archive.ts +3 -3
  142. package/src/config/bundled-skills/gmail/tools/gmail-attachments.ts +2 -2
  143. package/src/config/bundled-skills/gmail/tools/gmail-draft.ts +1 -1
  144. package/src/config/bundled-skills/gmail/tools/gmail-filters.ts +1 -1
  145. package/src/config/bundled-skills/gmail/tools/gmail-follow-up.ts +1 -1
  146. package/src/config/bundled-skills/gmail/tools/gmail-forward.ts +1 -1
  147. package/src/config/bundled-skills/gmail/tools/gmail-label.ts +2 -2
  148. package/src/config/bundled-skills/gmail/tools/gmail-outreach-scan.ts +1 -1
  149. package/src/config/bundled-skills/gmail/tools/gmail-send-draft.ts +1 -1
  150. package/src/config/bundled-skills/gmail/tools/gmail-sender-digest.ts +1 -1
  151. package/src/config/bundled-skills/gmail/tools/gmail-trash.ts +1 -1
  152. package/src/config/bundled-skills/gmail/tools/gmail-unsubscribe.ts +1 -1
  153. package/src/config/bundled-skills/gmail/tools/gmail-vacation.ts +1 -1
  154. package/src/config/bundled-skills/google-calendar/SKILL.md +10 -4
  155. package/src/config/bundled-skills/google-calendar/tools/shared.ts +1 -1
  156. package/src/config/bundled-skills/messaging/SKILL.md +19 -42
  157. package/src/config/bundled-skills/messaging/TOOLS.json +9 -9
  158. package/src/config/bundled-skills/messaging/tools/messaging-analyze-style.ts +1 -1
  159. package/src/config/bundled-skills/messaging/tools/messaging-send.ts +5 -2
  160. package/src/config/bundled-skills/messaging/tools/shared.ts +5 -6
  161. package/src/config/bundled-skills/notifications/SKILL.md +1 -1
  162. package/src/config/bundled-skills/schedule/SKILL.md +2 -2
  163. package/src/config/bundled-skills/settings/SKILL.md +5 -3
  164. package/src/config/bundled-skills/settings/TOOLS.json +17 -0
  165. package/src/config/bundled-skills/settings/tools/avatar-get.ts +50 -0
  166. package/src/config/bundled-skills/settings/tools/avatar-remove.ts +7 -0
  167. package/src/config/bundled-skills/settings/tools/avatar-update.ts +6 -1
  168. package/src/config/bundled-skills/settings/tools/identity-avatar.ts +55 -0
  169. package/src/config/bundled-skills/skills-catalog/SKILL.md +3 -3
  170. package/src/config/bundled-skills/slack/SKILL.md +58 -44
  171. package/src/config/bundled-tool-registry.ts +7 -19
  172. package/src/config/env.ts +5 -1
  173. package/src/config/feature-flag-registry.json +58 -42
  174. package/src/config/loader.ts +4 -0
  175. package/src/config/schemas/platform.ts +0 -8
  176. package/src/config/schemas/security.ts +9 -1
  177. package/src/config/schemas/services.ts +1 -1
  178. package/src/config/skill-state.ts +1 -3
  179. package/src/config/skills.ts +2 -4
  180. package/src/credential-execution/client.ts +1 -1
  181. package/src/credential-execution/feature-gates.ts +9 -16
  182. package/src/credential-execution/process-manager.ts +12 -0
  183. package/src/daemon/config-watcher.ts +4 -0
  184. package/src/daemon/conversation-agent-loop-handlers.ts +10 -0
  185. package/src/daemon/conversation-agent-loop.ts +51 -2
  186. package/src/daemon/conversation-error.ts +36 -6
  187. package/src/daemon/conversation-memory.ts +0 -1
  188. package/src/daemon/conversation-messaging.ts +9 -0
  189. package/src/daemon/conversation-runtime-assembly.ts +33 -0
  190. package/src/daemon/conversation-surfaces.ts +120 -14
  191. package/src/daemon/conversation.ts +5 -0
  192. package/src/daemon/handlers/config-slack-channel.ts +43 -1
  193. package/src/daemon/handlers/conversations.ts +41 -33
  194. package/src/daemon/handlers/skills.ts +148 -3
  195. package/src/daemon/host-bash-proxy.ts +16 -0
  196. package/src/daemon/host-cu-proxy.ts +16 -0
  197. package/src/daemon/host-file-proxy.ts +16 -0
  198. package/src/daemon/lifecycle.ts +73 -3
  199. package/src/daemon/message-types/acp.ts +0 -15
  200. package/src/daemon/message-types/conversations.ts +1 -0
  201. package/src/daemon/message-types/guardian-actions.ts +2 -0
  202. package/src/daemon/message-types/host-bash.ts +6 -1
  203. package/src/daemon/message-types/host-cu.ts +6 -1
  204. package/src/daemon/message-types/host-file.ts +6 -1
  205. package/src/daemon/message-types/integrations.ts +0 -1
  206. package/src/daemon/message-types/memory.ts +0 -1
  207. package/src/daemon/message-types/messages.ts +9 -1
  208. package/src/daemon/message-types/schedules.ts +9 -0
  209. package/src/daemon/server.ts +48 -9
  210. package/src/email/feature-gate.ts +3 -3
  211. package/src/heartbeat/heartbeat-service.ts +48 -0
  212. package/src/hooks/cli.ts +74 -0
  213. package/src/inbound/platform-callback-registration.ts +68 -19
  214. package/src/mcp/client.ts +6 -1
  215. package/src/mcp/manager.ts +2 -1
  216. package/src/mcp/mcp-oauth-provider.ts +3 -3
  217. package/src/memory/app-store.ts +3 -3
  218. package/src/memory/conversation-crud.ts +213 -0
  219. package/src/memory/conversation-key-store.ts +26 -0
  220. package/src/memory/conversation-title-service.ts +7 -17
  221. package/src/memory/db-init.ts +24 -0
  222. package/src/memory/embedding-local.ts +47 -2
  223. package/src/memory/indexer.ts +13 -10
  224. package/src/memory/items-extractor.ts +12 -4
  225. package/src/memory/job-utils.ts +5 -0
  226. package/src/memory/jobs-store.ts +10 -2
  227. package/src/memory/journal-memory.ts +6 -2
  228. package/src/memory/llm-request-log-store.ts +88 -21
  229. package/src/memory/memory-recall-log-store.ts +128 -0
  230. package/src/memory/migrations/194-memory-recall-logs.ts +50 -0
  231. package/src/memory/migrations/195-oauth-providers-ping-config.ts +23 -0
  232. package/src/memory/migrations/196-messages-conversation-created-at-index.ts +9 -0
  233. package/src/memory/migrations/196-strip-integration-prefix-from-provider-keys.ts +186 -0
  234. package/src/memory/migrations/197-oauth-providers-behavior-columns.ts +29 -0
  235. package/src/memory/migrations/198-drop-setup-skill-id-column.ts +11 -0
  236. package/src/memory/migrations/index.ts +6 -0
  237. package/src/memory/migrations/registry.ts +8 -0
  238. package/src/memory/retriever.test.ts +4 -5
  239. package/src/memory/schema/infrastructure.ts +31 -0
  240. package/src/memory/schema/oauth.ts +14 -0
  241. package/src/messaging/provider.ts +13 -12
  242. package/src/messaging/providers/gmail/adapter.ts +44 -35
  243. package/src/messaging/providers/slack/adapter.ts +63 -33
  244. package/src/messaging/providers/telegram-bot/adapter.ts +7 -9
  245. package/src/messaging/providers/whatsapp/adapter.ts +6 -8
  246. package/src/notifications/adapters/telegram.ts +78 -2
  247. package/src/oauth/__tests__/identity-verifier.test.ts +464 -0
  248. package/src/oauth/byo-connection.test.ts +22 -24
  249. package/src/oauth/connect-orchestrator.ts +79 -64
  250. package/src/oauth/connect-types.ts +7 -65
  251. package/src/oauth/connection-resolver.test.ts +13 -13
  252. package/src/oauth/connection-resolver.ts +3 -4
  253. package/src/oauth/identity-verifier.ts +177 -0
  254. package/src/oauth/manual-token-connection.ts +5 -5
  255. package/src/oauth/oauth-store.ts +251 -5
  256. package/src/oauth/platform-connection.test.ts +56 -6
  257. package/src/oauth/platform-connection.ts +8 -1
  258. package/src/oauth/seed-providers.ts +256 -34
  259. package/src/permissions/checker.ts +129 -3
  260. package/src/permissions/trust-client.ts +2 -2
  261. package/src/platform/client.ts +2 -2
  262. package/src/prompts/journal-context.ts +6 -1
  263. package/src/prompts/system-prompt.ts +43 -9
  264. package/src/prompts/templates/BOOTSTRAP.md +16 -5
  265. package/src/providers/anthropic/client.ts +139 -28
  266. package/src/runtime/auth/__tests__/middleware.test.ts +19 -0
  267. package/src/runtime/auth/route-policy.ts +0 -1
  268. package/src/runtime/btw-sidechain.ts +7 -1
  269. package/src/runtime/channel-approvals.ts +2 -2
  270. package/src/runtime/channel-readiness-service.ts +30 -7
  271. package/src/runtime/guardian-action-service.ts +7 -2
  272. package/src/runtime/http-router.ts +31 -0
  273. package/src/runtime/http-server.ts +26 -7
  274. package/src/runtime/http-types.ts +9 -0
  275. package/src/runtime/pending-interactions.ts +21 -3
  276. package/src/runtime/routes/acp-routes.ts +46 -28
  277. package/src/runtime/routes/app-management-routes.ts +123 -0
  278. package/src/runtime/routes/app-routes.ts +31 -0
  279. package/src/runtime/routes/approval-routes.ts +108 -3
  280. package/src/runtime/routes/attachment-routes.ts +45 -0
  281. package/src/runtime/routes/avatar-routes.ts +16 -0
  282. package/src/runtime/routes/brain-graph-routes.ts +18 -0
  283. package/src/runtime/routes/btw-routes.ts +20 -0
  284. package/src/runtime/routes/call-routes.ts +81 -0
  285. package/src/runtime/routes/channel-readiness-routes.ts +48 -7
  286. package/src/runtime/routes/channel-routes.ts +18 -0
  287. package/src/runtime/routes/channel-verification-routes.ts +49 -1
  288. package/src/runtime/routes/contact-routes.ts +77 -0
  289. package/src/runtime/routes/conversation-attention-routes.ts +37 -0
  290. package/src/runtime/routes/conversation-management-routes.ts +125 -0
  291. package/src/runtime/routes/conversation-query-routes.ts +78 -0
  292. package/src/runtime/routes/conversation-routes.ts +191 -39
  293. package/src/runtime/routes/conversation-starter-routes.ts +29 -0
  294. package/src/runtime/routes/debug-routes.ts +23 -0
  295. package/src/runtime/routes/diagnostics-routes.ts +30 -0
  296. package/src/runtime/routes/documents-routes.ts +42 -0
  297. package/src/runtime/routes/events-routes.ts +10 -0
  298. package/src/runtime/routes/global-search-routes.ts +35 -0
  299. package/src/runtime/routes/guardian-action-routes.ts +61 -3
  300. package/src/runtime/routes/guardian-approval-prompt.ts +77 -2
  301. package/src/runtime/routes/heartbeat-routes.ts +278 -0
  302. package/src/runtime/routes/host-bash-routes.ts +16 -1
  303. package/src/runtime/routes/host-cu-routes.ts +23 -1
  304. package/src/runtime/routes/host-file-routes.ts +18 -1
  305. package/src/runtime/routes/identity-routes.ts +35 -0
  306. package/src/runtime/routes/inbound-message-handler.ts +46 -25
  307. package/src/runtime/routes/inbound-stages/acl-enforcement.ts +21 -8
  308. package/src/runtime/routes/inbound-stages/secret-ingress-check.ts +30 -2
  309. package/src/runtime/routes/inbound-stages/transcribe-audio.ts +1 -2
  310. package/src/runtime/routes/integrations/slack/share.ts +1 -1
  311. package/src/runtime/routes/integrations/twilio.ts +32 -22
  312. package/src/runtime/routes/invite-routes.ts +83 -0
  313. package/src/runtime/routes/log-export-routes.ts +14 -0
  314. package/src/runtime/routes/memory-item-routes.ts +99 -1
  315. package/src/runtime/routes/migration-rollback-routes.ts +25 -0
  316. package/src/runtime/routes/migration-routes.ts +40 -0
  317. package/src/runtime/routes/notification-routes.ts +20 -0
  318. package/src/runtime/routes/oauth-apps.ts +13 -4
  319. package/src/runtime/routes/pairing-routes.ts +15 -0
  320. package/src/runtime/routes/recording-routes.ts +72 -0
  321. package/src/runtime/routes/schedule-routes.ts +77 -5
  322. package/src/runtime/routes/secret-routes.ts +99 -14
  323. package/src/runtime/routes/settings-routes.ts +102 -19
  324. package/src/runtime/routes/skills-routes.ts +141 -18
  325. package/src/runtime/routes/subagents-routes.ts +38 -3
  326. package/src/runtime/routes/surface-action-routes.ts +66 -24
  327. package/src/runtime/routes/surface-content-routes.ts +20 -0
  328. package/src/runtime/routes/telemetry-routes.ts +12 -0
  329. package/src/runtime/routes/trace-event-routes.ts +25 -0
  330. package/src/runtime/routes/trust-rules-routes.ts +46 -0
  331. package/src/runtime/routes/tts-routes.ts +15 -4
  332. package/src/runtime/routes/upgrade-broadcast-routes.ts +38 -0
  333. package/src/runtime/routes/usage-routes.ts +59 -0
  334. package/src/runtime/routes/watch-routes.ts +28 -0
  335. package/src/runtime/routes/work-items-routes.ts +59 -0
  336. package/src/runtime/routes/workspace-commit-routes.ts +12 -0
  337. package/src/runtime/routes/workspace-routes.ts +102 -0
  338. package/src/schedule/integration-status.ts +2 -2
  339. package/src/schedule/scheduler.ts +7 -1
  340. package/src/security/AGENTS.md +7 -0
  341. package/src/security/ces-rpc-credential-backend.ts +19 -16
  342. package/src/security/credential-backend.ts +1 -1
  343. package/src/security/encrypted-store.ts +3 -3
  344. package/src/security/oauth-completion-page.ts +153 -0
  345. package/src/security/oauth2.ts +58 -17
  346. package/src/security/secret-ingress.ts +174 -0
  347. package/src/security/secret-patterns.ts +133 -0
  348. package/src/security/secret-scanner.ts +28 -117
  349. package/src/security/secure-keys.ts +207 -7
  350. package/src/security/token-manager.ts +3 -6
  351. package/src/signals/bash.ts +6 -1
  352. package/src/signals/confirm.ts +12 -8
  353. package/src/signals/user-message.ts +18 -3
  354. package/src/skills/catalog-cache.ts +44 -0
  355. package/src/skills/catalog-search.ts +18 -0
  356. package/src/skills/skill-memory.ts +1 -2
  357. package/src/tasks/task-runner.ts +7 -1
  358. package/src/tools/credentials/broker.ts +1 -1
  359. package/src/tools/credentials/metadata-store.ts +1 -1
  360. package/src/tools/credentials/post-connect-hooks.ts +1 -1
  361. package/src/tools/credentials/vault.ts +36 -48
  362. package/src/tools/host-terminal/host-shell.ts +16 -3
  363. package/src/tools/mcp/mcp-tool-factory.ts +2 -1
  364. package/src/tools/memory/definitions.ts +1 -1
  365. package/src/tools/memory/handlers.test.ts +2 -4
  366. package/src/tools/skills/load.ts +1 -1
  367. package/src/tools/skills/sandbox-runner.ts +16 -3
  368. package/src/tools/terminal/safe-env.ts +7 -0
  369. package/src/tools/terminal/shell.ts +16 -3
  370. package/src/tools/tool-manifest.ts +1 -1
  371. package/src/util/log-redact.ts +9 -34
  372. package/src/util/logger.ts +11 -1
  373. package/src/util/sentry-log-stream.ts +51 -0
  374. package/src/watcher/providers/github.ts +2 -2
  375. package/src/watcher/providers/gmail.ts +1 -1
  376. package/src/watcher/providers/google-calendar.ts +1 -1
  377. package/src/watcher/providers/linear.ts +2 -2
  378. package/src/workspace/migrations/011-backfill-installation-id.ts +5 -3
  379. package/src/workspace/migrations/020-rename-oauth-skill-dirs.ts +119 -0
  380. package/src/workspace/migrations/registry.ts +2 -0
  381. package/docs/architecture/keychain-broker.md +0 -68
  382. package/src/cli/commands/oauth/connections.ts +0 -734
  383. package/src/cli/commands/oauth/platform.ts +0 -525
  384. package/src/cli/commands/platform.ts +0 -176
  385. package/src/config/bundled-skills/slack/TOOLS.json +0 -272
  386. package/src/config/bundled-skills/slack/tools/shared.ts +0 -34
  387. package/src/config/bundled-skills/slack/tools/slack-add-reaction.ts +0 -27
  388. package/src/config/bundled-skills/slack/tools/slack-channel-details.ts +0 -38
  389. package/src/config/bundled-skills/slack/tools/slack-channel-permissions.ts +0 -146
  390. package/src/config/bundled-skills/slack/tools/slack-configure-channels.ts +0 -105
  391. package/src/config/bundled-skills/slack/tools/slack-delete-message.ts +0 -26
  392. package/src/config/bundled-skills/slack/tools/slack-edit-message.ts +0 -27
  393. package/src/config/bundled-skills/slack/tools/slack-leave-channel.ts +0 -25
  394. package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts +0 -372
  395. package/src/oauth/provider-behaviors.ts +0 -634
@@ -0,0 +1,416 @@
1
+ import { beforeEach, describe, expect, mock, test } from "bun:test";
2
+
3
+ import { Command } from "commander";
4
+
5
+ // ---------------------------------------------------------------------------
6
+ // Mock state
7
+ // ---------------------------------------------------------------------------
8
+
9
+ let mockGetProvider: (
10
+ key: string,
11
+ ) => Record<string, unknown> | undefined = () => undefined;
12
+
13
+ let mockUpdateProvider: (
14
+ key: string,
15
+ params: Record<string, unknown>,
16
+ ) => Record<string, unknown> | undefined = () => undefined;
17
+
18
+ let mockUpdateProviderCalls: Array<{
19
+ key: string;
20
+ params: Record<string, unknown>;
21
+ }> = [];
22
+
23
+ let mockSeededProviderKeys = new Set<string>(["google", "slack", "github"]);
24
+
25
+ // ---------------------------------------------------------------------------
26
+ // Mocks
27
+ // ---------------------------------------------------------------------------
28
+
29
+ mock.module("../../../../config/loader.js", () => ({
30
+ getConfig: () => ({ services: {} }),
31
+ loadConfig: () => ({ services: {} }),
32
+ API_KEY_PROVIDERS: [],
33
+ }));
34
+
35
+ mock.module("../../../../oauth/oauth-store.js", () => ({
36
+ getProvider: (key: string) => mockGetProvider(key),
37
+ updateProvider: (key: string, params: Record<string, unknown>) => {
38
+ mockUpdateProviderCalls.push({ key, params });
39
+ return mockUpdateProvider(key, params);
40
+ },
41
+ listProviders: () => [],
42
+ registerProvider: () => ({}),
43
+ seedProviders: () => {},
44
+ getConnection: () => undefined,
45
+ getConnectionByProvider: () => undefined,
46
+ getActiveConnection: () => undefined,
47
+ listActiveConnectionsByProvider: () => [],
48
+ isProviderConnected: () => false,
49
+ createConnection: () => ({}),
50
+ updateConnection: () => ({}),
51
+ deleteConnection: () => false,
52
+ upsertApp: async () => ({}),
53
+ getApp: () => undefined,
54
+ getAppByProviderAndClientId: () => undefined,
55
+ getMostRecentAppByProvider: () => undefined,
56
+ listApps: () => [],
57
+ deleteApp: async () => false,
58
+ listConnections: () => [],
59
+ }));
60
+
61
+ mock.module("../../../../oauth/seed-providers.js", () => ({
62
+ SEEDED_PROVIDER_KEYS: mockSeededProviderKeys,
63
+ PROVIDER_SEED_DATA: {},
64
+ seedAllProviders: () => {},
65
+ }));
66
+
67
+ mock.module("../../../../inbound/public-ingress-urls.js", () => ({
68
+ getOAuthCallbackUrl: () => null,
69
+ }));
70
+
71
+ mock.module("../../../../util/logger.js", () => ({
72
+ getLogger: () => ({
73
+ info: () => {},
74
+ warn: () => {},
75
+ error: () => {},
76
+ debug: () => {},
77
+ }),
78
+ getCliLogger: () => ({
79
+ info: () => {},
80
+ warn: () => {},
81
+ error: () => {},
82
+ debug: () => {},
83
+ }),
84
+ }));
85
+
86
+ // ---------------------------------------------------------------------------
87
+ // Import module under test (after mocks are registered)
88
+ // ---------------------------------------------------------------------------
89
+
90
+ const { registerProviderCommands } = await import("../providers.js");
91
+
92
+ // ---------------------------------------------------------------------------
93
+ // Test helper
94
+ // ---------------------------------------------------------------------------
95
+
96
+ async function runCommand(
97
+ args: string[],
98
+ ): Promise<{ stdout: string; exitCode: number }> {
99
+ const originalStdoutWrite = process.stdout.write.bind(process.stdout);
100
+ const originalStderrWrite = process.stderr.write.bind(process.stderr);
101
+ const stdoutChunks: string[] = [];
102
+
103
+ process.stdout.write = ((chunk: unknown) => {
104
+ stdoutChunks.push(typeof chunk === "string" ? chunk : String(chunk));
105
+ return true;
106
+ }) as typeof process.stdout.write;
107
+
108
+ process.stderr.write = (() => true) as typeof process.stderr.write;
109
+
110
+ process.exitCode = 0;
111
+
112
+ try {
113
+ const program = new Command();
114
+ program.exitOverride();
115
+ program.option("--json", "JSON output");
116
+ program.configureOutput({
117
+ writeErr: () => {},
118
+ writeOut: (str: string) => stdoutChunks.push(str),
119
+ });
120
+ registerProviderCommands(program);
121
+ await program.parseAsync(["node", "assistant", ...args]);
122
+ } catch {
123
+ if (process.exitCode === 0) process.exitCode = 1;
124
+ } finally {
125
+ process.stdout.write = originalStdoutWrite;
126
+ process.stderr.write = originalStderrWrite;
127
+ }
128
+
129
+ const exitCode = process.exitCode ?? 0;
130
+ process.exitCode = 0;
131
+
132
+ return { exitCode, stdout: stdoutChunks.join("") };
133
+ }
134
+
135
+ // ---------------------------------------------------------------------------
136
+ // Sample provider row
137
+ // ---------------------------------------------------------------------------
138
+
139
+ const sampleProviderRow = {
140
+ providerKey: "custom-api",
141
+ authUrl: "https://custom-api.example.com/oauth/authorize",
142
+ tokenUrl: "https://custom-api.example.com/oauth/token",
143
+ tokenEndpointAuthMethod: null,
144
+ userinfoUrl: null,
145
+ baseUrl: null,
146
+ defaultScopes: "[]",
147
+ scopePolicy: "{}",
148
+ extraParams: null,
149
+ callbackTransport: null,
150
+ managedServiceConfigKey: null,
151
+ pingUrl: null,
152
+ pingMethod: null,
153
+ pingHeaders: null,
154
+ pingBody: null,
155
+ displayName: null,
156
+ description: null,
157
+ dashboardUrl: null,
158
+ clientIdPlaceholder: null,
159
+ requiresClientSecret: 1,
160
+ loopbackPort: null,
161
+ injectionTemplates: null,
162
+ appType: null,
163
+ setupNotes: null,
164
+ identityUrl: null,
165
+ identityMethod: null,
166
+ identityHeaders: null,
167
+ identityBody: null,
168
+ identityResponsePaths: null,
169
+ identityFormat: null,
170
+ identityOkField: null,
171
+ createdAt: Date.now(),
172
+ updatedAt: Date.now(),
173
+ };
174
+
175
+ // ---------------------------------------------------------------------------
176
+ // Tests
177
+ // ---------------------------------------------------------------------------
178
+
179
+ describe("assistant oauth providers update", () => {
180
+ beforeEach(() => {
181
+ mockGetProvider = () => undefined;
182
+ mockUpdateProvider = () => undefined;
183
+ mockUpdateProviderCalls = [];
184
+ mockSeededProviderKeys = new Set(["google", "slack", "github"]);
185
+ process.exitCode = 0;
186
+ });
187
+
188
+ // -------------------------------------------------------------------------
189
+ // Provider not found
190
+ // -------------------------------------------------------------------------
191
+
192
+ test("provider not found returns error with hint", async () => {
193
+ mockGetProvider = () => undefined;
194
+
195
+ const { exitCode, stdout } = await runCommand([
196
+ "providers",
197
+ "update",
198
+ "nonexistent",
199
+ "--display-name",
200
+ "Foo",
201
+ "--json",
202
+ ]);
203
+ expect(exitCode).toBe(1);
204
+ const parsed = JSON.parse(stdout);
205
+ expect(parsed.ok).toBe(false);
206
+ expect(parsed.error).toContain("not found");
207
+ expect(parsed.error).toContain("providers list");
208
+ });
209
+
210
+ // -------------------------------------------------------------------------
211
+ // Built-in provider
212
+ // -------------------------------------------------------------------------
213
+
214
+ test("built-in provider returns error suggesting register", async () => {
215
+ mockGetProvider = () => ({
216
+ ...sampleProviderRow,
217
+ providerKey: "google",
218
+ });
219
+
220
+ const { exitCode, stdout } = await runCommand([
221
+ "providers",
222
+ "update",
223
+ "google",
224
+ "--display-name",
225
+ "Foo",
226
+ "--json",
227
+ ]);
228
+ expect(exitCode).toBe(1);
229
+ const parsed = JSON.parse(stdout);
230
+ expect(parsed.ok).toBe(false);
231
+ expect(parsed.error).toContain("Cannot update built-in");
232
+ expect(parsed.error).toContain("providers register");
233
+ });
234
+
235
+ // -------------------------------------------------------------------------
236
+ // No options provided
237
+ // -------------------------------------------------------------------------
238
+
239
+ test("no options provided returns error", async () => {
240
+ mockGetProvider = () => ({ ...sampleProviderRow });
241
+
242
+ const { exitCode, stdout } = await runCommand([
243
+ "providers",
244
+ "update",
245
+ "custom-api",
246
+ "--json",
247
+ ]);
248
+ expect(exitCode).toBe(1);
249
+ const parsed = JSON.parse(stdout);
250
+ expect(parsed.ok).toBe(false);
251
+ expect(parsed.error).toContain("Nothing to update");
252
+ });
253
+
254
+ // -------------------------------------------------------------------------
255
+ // Successful update with --display-name
256
+ // -------------------------------------------------------------------------
257
+
258
+ test("successful update with --display-name returns updated provider row", async () => {
259
+ mockGetProvider = () => ({ ...sampleProviderRow });
260
+ mockUpdateProvider = (_key, _params) => ({
261
+ ...sampleProviderRow,
262
+ displayName: "New Name",
263
+ updatedAt: Date.now(),
264
+ });
265
+
266
+ const { exitCode, stdout } = await runCommand([
267
+ "providers",
268
+ "update",
269
+ "custom-api",
270
+ "--display-name",
271
+ "New Name",
272
+ "--json",
273
+ ]);
274
+ expect(exitCode).toBe(0);
275
+ const parsed = JSON.parse(stdout);
276
+ expect(parsed.providerKey).toBe("custom-api");
277
+ expect(parsed.displayName).toBe("New Name");
278
+ });
279
+
280
+ // -------------------------------------------------------------------------
281
+ // Successful update with multiple options
282
+ // -------------------------------------------------------------------------
283
+
284
+ test("successful update with multiple options passes all fields to updateProvider", async () => {
285
+ mockGetProvider = () => ({ ...sampleProviderRow });
286
+ mockUpdateProvider = (_key, _params) => ({
287
+ ...sampleProviderRow,
288
+ displayName: "My API",
289
+ defaultScopes: '["read","write"]',
290
+ authUrl: "https://new.example.com/auth",
291
+ updatedAt: Date.now(),
292
+ });
293
+
294
+ const { exitCode, stdout } = await runCommand([
295
+ "providers",
296
+ "update",
297
+ "custom-api",
298
+ "--display-name",
299
+ "My API",
300
+ "--scopes",
301
+ "read,write",
302
+ "--auth-url",
303
+ "https://new.example.com/auth",
304
+ "--json",
305
+ ]);
306
+ expect(exitCode).toBe(0);
307
+ const parsed = JSON.parse(stdout);
308
+ expect(parsed.providerKey).toBe("custom-api");
309
+
310
+ // Verify updateProvider was called with the correct params
311
+ expect(mockUpdateProviderCalls).toHaveLength(1);
312
+ expect(mockUpdateProviderCalls[0].key).toBe("custom-api");
313
+ expect(mockUpdateProviderCalls[0].params).toEqual({
314
+ displayName: "My API",
315
+ defaultScopes: ["read", "write"],
316
+ authUrl: "https://new.example.com/auth",
317
+ });
318
+ });
319
+
320
+ // -------------------------------------------------------------------------
321
+ // Successful update with injection templates, identity config, and setup metadata
322
+ // -------------------------------------------------------------------------
323
+
324
+ test("successful update with injection templates and identity config passes new fields to updateProvider", async () => {
325
+ const injectionTemplates = [
326
+ {
327
+ hostPattern: "api.example.com",
328
+ injectionType: "header",
329
+ headerName: "Authorization",
330
+ valuePrefix: "Bearer ",
331
+ },
332
+ ];
333
+ const identityHeaders = { "X-Custom": "value" };
334
+ const identityBody = { query: "{ viewer { email } }" };
335
+ const setupNotes = ["Enable the API", "Add test users"];
336
+
337
+ mockGetProvider = () => ({ ...sampleProviderRow });
338
+ mockUpdateProvider = (_key, _params) => ({
339
+ ...sampleProviderRow,
340
+ loopbackPort: 17400,
341
+ injectionTemplates: JSON.stringify(injectionTemplates),
342
+ appType: "OAuth App",
343
+ setupNotes: JSON.stringify(setupNotes),
344
+ identityUrl: "https://api.example.com/me",
345
+ identityMethod: "POST",
346
+ identityHeaders: JSON.stringify(identityHeaders),
347
+ identityBody: JSON.stringify(identityBody),
348
+ identityResponsePaths: JSON.stringify(["email", "name"]),
349
+ identityFormat: "@${email}",
350
+ identityOkField: "ok",
351
+ updatedAt: Date.now(),
352
+ });
353
+
354
+ const { exitCode, stdout } = await runCommand([
355
+ "providers",
356
+ "update",
357
+ "custom-api",
358
+ "--loopback-port",
359
+ "17400",
360
+ "--injection-templates",
361
+ JSON.stringify(injectionTemplates),
362
+ "--app-type",
363
+ "OAuth App",
364
+ "--setup-notes",
365
+ JSON.stringify(setupNotes),
366
+ "--identity-url",
367
+ "https://api.example.com/me",
368
+ "--identity-method",
369
+ "POST",
370
+ "--identity-headers",
371
+ JSON.stringify(identityHeaders),
372
+ "--identity-body",
373
+ JSON.stringify(identityBody),
374
+ "--identity-response-paths",
375
+ "email,name",
376
+ "--identity-format",
377
+ "@${email}",
378
+ "--identity-ok-field",
379
+ "ok",
380
+ "--json",
381
+ ]);
382
+ expect(exitCode).toBe(0);
383
+ const parsed = JSON.parse(stdout);
384
+ expect(parsed.providerKey).toBe("custom-api");
385
+
386
+ // Verify the new fields are present in the output (parsed from JSON strings)
387
+ expect(parsed.loopbackPort).toBe(17400);
388
+ expect(parsed.injectionTemplates).toEqual(injectionTemplates);
389
+ expect(parsed.appType).toBe("OAuth App");
390
+ expect(parsed.setupNotes).toEqual(setupNotes);
391
+ expect(parsed.identityUrl).toBe("https://api.example.com/me");
392
+ expect(parsed.identityMethod).toBe("POST");
393
+ expect(parsed.identityHeaders).toEqual(identityHeaders);
394
+ expect(parsed.identityBody).toEqual(identityBody);
395
+ expect(parsed.identityResponsePaths).toEqual(["email", "name"]);
396
+ expect(parsed.identityFormat).toBe("@${email}");
397
+ expect(parsed.identityOkField).toBe("ok");
398
+
399
+ // Verify updateProvider was called with the correct params
400
+ expect(mockUpdateProviderCalls).toHaveLength(1);
401
+ expect(mockUpdateProviderCalls[0].key).toBe("custom-api");
402
+ expect(mockUpdateProviderCalls[0].params).toEqual({
403
+ loopbackPort: 17400,
404
+ injectionTemplates,
405
+ appType: "OAuth App",
406
+ setupNotes,
407
+ identityUrl: "https://api.example.com/me",
408
+ identityMethod: "POST",
409
+ identityHeaders,
410
+ identityBody,
411
+ identityResponsePaths: ["email", "name"],
412
+ identityFormat: "@${email}",
413
+ identityOkField: "ok",
414
+ });
415
+ });
416
+ });