@vellumai/assistant 0.5.10 → 0.5.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (395) hide show
  1. package/AGENTS.md +8 -0
  2. package/ARCHITECTURE.md +43 -43
  3. package/Dockerfile +3 -0
  4. package/docs/architecture/integrations.md +37 -42
  5. package/docs/architecture/memory.md +7 -12
  6. package/docs/credential-execution-service.md +9 -9
  7. package/docs/skills.md +1 -1
  8. package/node_modules/@vellumai/ces-contracts/src/__tests__/grants.test.ts +7 -7
  9. package/node_modules/@vellumai/ces-contracts/src/handles.ts +5 -4
  10. package/node_modules/@vellumai/credential-storage/src/index.ts +3 -3
  11. package/node_modules/@vellumai/credential-storage/src/static-credentials.ts +1 -1
  12. package/openapi.yaml +7208 -0
  13. package/package.json +2 -1
  14. package/scripts/generate-openapi.ts +562 -0
  15. package/src/__tests__/acp-session.test.ts +239 -44
  16. package/src/__tests__/assistant-feature-flag-guard.test.ts +8 -8
  17. package/src/__tests__/assistant-feature-flag-guardrails.test.ts +5 -86
  18. package/src/__tests__/assistant-feature-flags-integration.test.ts +7 -14
  19. package/src/__tests__/browser-skill-endstate.test.ts +1 -1
  20. package/src/__tests__/btw-routes.test.ts +8 -0
  21. package/src/__tests__/bundled-skill-retrieval-guard.test.ts +10 -10
  22. package/src/__tests__/catalog-cache.test.ts +164 -0
  23. package/src/__tests__/catalog-search.test.ts +61 -0
  24. package/src/__tests__/channel-approvals.test.ts +7 -7
  25. package/src/__tests__/channel-readiness-service.test.ts +41 -0
  26. package/src/__tests__/cli-command-risk-guard.test.ts +181 -6
  27. package/src/__tests__/config-schema.test.ts +10 -2
  28. package/src/__tests__/context-memory-e2e.test.ts +2 -6
  29. package/src/__tests__/conversation-delete-schedule-cleanup.test.ts +396 -0
  30. package/src/__tests__/conversation-error.test.ts +3 -2
  31. package/src/__tests__/conversation-skill-tools.test.ts +1 -3
  32. package/src/__tests__/conversation-title-service.test.ts +2 -15
  33. package/src/__tests__/credential-execution-feature-gates.test.ts +4 -8
  34. package/src/__tests__/credential-execution-managed-contract.test.ts +8 -8
  35. package/src/__tests__/credential-security-e2e.test.ts +4 -4
  36. package/src/__tests__/credential-security-invariants.test.ts +12 -18
  37. package/src/__tests__/credential-vault-unit.test.ts +32 -34
  38. package/src/__tests__/credential-vault.test.ts +25 -33
  39. package/src/__tests__/credentials-cli.test.ts +3 -3
  40. package/src/__tests__/daemon-credential-client.test.ts +2 -2
  41. package/src/__tests__/dynamic-skill-workflow-prompt.test.ts +1 -1
  42. package/src/__tests__/gateway-only-guard.test.ts +3 -0
  43. package/src/__tests__/heartbeat-service.test.ts +35 -0
  44. package/src/__tests__/host-bash-proxy.test.ts +79 -0
  45. package/src/__tests__/host-cu-proxy.test.ts +90 -0
  46. package/src/__tests__/host-file-proxy.test.ts +89 -0
  47. package/src/__tests__/host-shell-tool.test.ts +1 -1
  48. package/src/__tests__/inline-skill-load-permissions.test.ts +3 -3
  49. package/src/__tests__/integration-status.test.ts +5 -5
  50. package/src/__tests__/list-messages-attachments.test.ts +171 -0
  51. package/src/__tests__/llm-request-log-turn-query.test.ts +64 -0
  52. package/src/__tests__/log-export-workspace.test.ts +1 -1
  53. package/src/__tests__/mcp-abort-signal.test.ts +205 -0
  54. package/src/__tests__/mcp-client-auth.test.ts +1 -1
  55. package/src/__tests__/memory-lifecycle-e2e.test.ts +2 -2
  56. package/src/__tests__/memory-recall-log-store.test.ts +182 -0
  57. package/src/__tests__/memory-recall-quality.test.ts +6 -8
  58. package/src/__tests__/memory-regressions.test.ts +53 -42
  59. package/src/__tests__/memory-retrieval.benchmark.test.ts +5 -9
  60. package/src/__tests__/messaging-send-tool.test.ts +5 -5
  61. package/src/__tests__/messaging-skill-split.test.ts +2 -17
  62. package/src/__tests__/notification-telegram-adapter.test.ts +125 -0
  63. package/src/__tests__/oauth-cli.test.ts +203 -649
  64. package/src/__tests__/oauth-provider-profiles.test.ts +55 -20
  65. package/src/__tests__/oauth-scope-policy.test.ts +4 -6
  66. package/src/__tests__/onboarding-template-contract.test.ts +2 -2
  67. package/src/__tests__/platform-callback-registration.test.ts +119 -0
  68. package/src/__tests__/secret-ingress-channel.test.ts +261 -0
  69. package/src/__tests__/secret-ingress-cli.test.ts +201 -0
  70. package/src/__tests__/secret-ingress-http.test.ts +312 -0
  71. package/src/__tests__/secret-ingress.test.ts +283 -0
  72. package/src/__tests__/secret-onetime-send.test.ts +4 -4
  73. package/src/__tests__/secret-routes-managed-proxy.test.ts +78 -0
  74. package/src/__tests__/secure-keys-managed-failover.test.ts +73 -0
  75. package/src/__tests__/skill-feature-flags-integration.test.ts +4 -4
  76. package/src/__tests__/skill-feature-flags.test.ts +11 -19
  77. package/src/__tests__/skill-load-feature-flag.test.ts +1 -1
  78. package/src/__tests__/skill-load-inline-command.test.ts +3 -3
  79. package/src/__tests__/skill-load-inline-includes.test.ts +2 -2
  80. package/src/__tests__/skill-memory.test.ts +2 -4
  81. package/src/__tests__/skill-projection-feature-flag.test.ts +2 -4
  82. package/src/__tests__/skill-projection.benchmark.test.ts +1 -3
  83. package/src/__tests__/skills-uninstall.test.ts +2 -2
  84. package/src/__tests__/skills.test.ts +16 -2
  85. package/src/__tests__/slack-channel-config.test.ts +1 -1
  86. package/src/__tests__/slack-messaging-token-resolution.test.ts +22 -24
  87. package/src/__tests__/slack-share-routes.test.ts +5 -5
  88. package/src/__tests__/slack-skill.test.ts +5 -69
  89. package/src/__tests__/system-prompt.test.ts +39 -0
  90. package/src/__tests__/vellum-self-knowledge-inline-command.test.ts +1 -1
  91. package/src/__tests__/workspace-migration-018-rekey-compound-credential-keys.test.ts +181 -0
  92. package/src/__tests__/workspace-migration-backfill-installation-id.test.ts +5 -4
  93. package/src/acp/client-handler.ts +113 -31
  94. package/src/acp/session-manager.ts +29 -27
  95. package/src/approvals/guardian-request-resolvers.ts +1 -1
  96. package/src/cli/AGENTS.md +113 -0
  97. package/src/cli/commands/autonomy.ts +3 -5
  98. package/src/cli/commands/browser-relay.ts +2 -17
  99. package/src/cli/commands/contacts.ts +6 -4
  100. package/src/cli/commands/conversations.ts +13 -1
  101. package/src/cli/commands/credential-execution.ts +17 -3
  102. package/src/cli/commands/credentials.ts +2 -8
  103. package/src/cli/commands/memory.ts +2 -3
  104. package/src/cli/commands/oauth/__tests__/connect.test.ts +706 -0
  105. package/src/cli/commands/oauth/__tests__/disconnect.test.ts +686 -0
  106. package/src/cli/commands/oauth/__tests__/mode.test.ts +625 -0
  107. package/src/cli/commands/oauth/__tests__/ping.test.ts +631 -0
  108. package/src/cli/commands/oauth/__tests__/providers-delete.test.ts +574 -0
  109. package/src/cli/commands/oauth/__tests__/providers-update.test.ts +416 -0
  110. package/src/cli/commands/oauth/__tests__/status.test.ts +551 -0
  111. package/src/cli/commands/oauth/__tests__/token.test.ts +420 -0
  112. package/src/cli/commands/oauth/apps.ts +87 -50
  113. package/src/cli/commands/oauth/connect.ts +405 -0
  114. package/src/cli/commands/oauth/disconnect.ts +285 -0
  115. package/src/cli/commands/oauth/index.ts +62 -20
  116. package/src/cli/commands/oauth/mode.ts +251 -0
  117. package/src/cli/commands/oauth/ping.ts +196 -0
  118. package/src/cli/commands/oauth/providers.ts +589 -55
  119. package/src/cli/commands/oauth/request.ts +564 -0
  120. package/src/cli/commands/oauth/shared.ts +114 -0
  121. package/src/cli/commands/oauth/status.ts +191 -0
  122. package/src/cli/commands/oauth/token.ts +150 -0
  123. package/src/cli/commands/platform/connect.ts +104 -0
  124. package/src/cli/commands/platform/disconnect.ts +118 -0
  125. package/src/cli/commands/platform/index.ts +252 -0
  126. package/src/cli/commands/sequence.ts +5 -4
  127. package/src/cli/commands/shotgun.ts +16 -0
  128. package/src/cli/commands/skills.ts +173 -41
  129. package/src/cli/commands/usage.ts +5 -11
  130. package/src/cli/lib/daemon-credential-client.ts +22 -38
  131. package/src/cli/program.ts +1 -1
  132. package/src/cli.ts +82 -17
  133. package/src/config/assistant-feature-flags.ts +77 -18
  134. package/src/config/bundled-skills/_shared/CLI_RETRIEVAL_PATTERN.md +1 -1
  135. package/src/config/bundled-skills/app-builder/tools/app-create.ts +1 -1
  136. package/src/config/bundled-skills/contacts/tools/google-contacts.ts +1 -1
  137. package/src/config/bundled-skills/conversations/SKILL.md +20 -0
  138. package/src/config/bundled-skills/conversations/TOOLS.json +23 -0
  139. package/src/config/bundled-skills/conversations/tools/rename-conversation.ts +66 -0
  140. package/src/config/bundled-skills/gmail/SKILL.md +13 -13
  141. package/src/config/bundled-skills/gmail/tools/gmail-archive.ts +3 -3
  142. package/src/config/bundled-skills/gmail/tools/gmail-attachments.ts +2 -2
  143. package/src/config/bundled-skills/gmail/tools/gmail-draft.ts +1 -1
  144. package/src/config/bundled-skills/gmail/tools/gmail-filters.ts +1 -1
  145. package/src/config/bundled-skills/gmail/tools/gmail-follow-up.ts +1 -1
  146. package/src/config/bundled-skills/gmail/tools/gmail-forward.ts +1 -1
  147. package/src/config/bundled-skills/gmail/tools/gmail-label.ts +2 -2
  148. package/src/config/bundled-skills/gmail/tools/gmail-outreach-scan.ts +1 -1
  149. package/src/config/bundled-skills/gmail/tools/gmail-send-draft.ts +1 -1
  150. package/src/config/bundled-skills/gmail/tools/gmail-sender-digest.ts +1 -1
  151. package/src/config/bundled-skills/gmail/tools/gmail-trash.ts +1 -1
  152. package/src/config/bundled-skills/gmail/tools/gmail-unsubscribe.ts +1 -1
  153. package/src/config/bundled-skills/gmail/tools/gmail-vacation.ts +1 -1
  154. package/src/config/bundled-skills/google-calendar/SKILL.md +10 -4
  155. package/src/config/bundled-skills/google-calendar/tools/shared.ts +1 -1
  156. package/src/config/bundled-skills/messaging/SKILL.md +19 -42
  157. package/src/config/bundled-skills/messaging/TOOLS.json +9 -9
  158. package/src/config/bundled-skills/messaging/tools/messaging-analyze-style.ts +1 -1
  159. package/src/config/bundled-skills/messaging/tools/messaging-send.ts +5 -2
  160. package/src/config/bundled-skills/messaging/tools/shared.ts +5 -6
  161. package/src/config/bundled-skills/notifications/SKILL.md +1 -1
  162. package/src/config/bundled-skills/schedule/SKILL.md +2 -2
  163. package/src/config/bundled-skills/settings/SKILL.md +5 -3
  164. package/src/config/bundled-skills/settings/TOOLS.json +17 -0
  165. package/src/config/bundled-skills/settings/tools/avatar-get.ts +50 -0
  166. package/src/config/bundled-skills/settings/tools/avatar-remove.ts +7 -0
  167. package/src/config/bundled-skills/settings/tools/avatar-update.ts +6 -1
  168. package/src/config/bundled-skills/settings/tools/identity-avatar.ts +55 -0
  169. package/src/config/bundled-skills/skills-catalog/SKILL.md +3 -3
  170. package/src/config/bundled-skills/slack/SKILL.md +58 -44
  171. package/src/config/bundled-tool-registry.ts +7 -19
  172. package/src/config/env.ts +5 -1
  173. package/src/config/feature-flag-registry.json +58 -42
  174. package/src/config/loader.ts +4 -0
  175. package/src/config/schemas/platform.ts +0 -8
  176. package/src/config/schemas/security.ts +9 -1
  177. package/src/config/schemas/services.ts +1 -1
  178. package/src/config/skill-state.ts +1 -3
  179. package/src/config/skills.ts +2 -4
  180. package/src/credential-execution/client.ts +1 -1
  181. package/src/credential-execution/feature-gates.ts +9 -16
  182. package/src/credential-execution/process-manager.ts +12 -0
  183. package/src/daemon/config-watcher.ts +4 -0
  184. package/src/daemon/conversation-agent-loop-handlers.ts +10 -0
  185. package/src/daemon/conversation-agent-loop.ts +51 -2
  186. package/src/daemon/conversation-error.ts +36 -6
  187. package/src/daemon/conversation-memory.ts +0 -1
  188. package/src/daemon/conversation-messaging.ts +9 -0
  189. package/src/daemon/conversation-runtime-assembly.ts +33 -0
  190. package/src/daemon/conversation-surfaces.ts +120 -14
  191. package/src/daemon/conversation.ts +5 -0
  192. package/src/daemon/handlers/config-slack-channel.ts +43 -1
  193. package/src/daemon/handlers/conversations.ts +41 -33
  194. package/src/daemon/handlers/skills.ts +148 -3
  195. package/src/daemon/host-bash-proxy.ts +16 -0
  196. package/src/daemon/host-cu-proxy.ts +16 -0
  197. package/src/daemon/host-file-proxy.ts +16 -0
  198. package/src/daemon/lifecycle.ts +73 -3
  199. package/src/daemon/message-types/acp.ts +0 -15
  200. package/src/daemon/message-types/conversations.ts +1 -0
  201. package/src/daemon/message-types/guardian-actions.ts +2 -0
  202. package/src/daemon/message-types/host-bash.ts +6 -1
  203. package/src/daemon/message-types/host-cu.ts +6 -1
  204. package/src/daemon/message-types/host-file.ts +6 -1
  205. package/src/daemon/message-types/integrations.ts +0 -1
  206. package/src/daemon/message-types/memory.ts +0 -1
  207. package/src/daemon/message-types/messages.ts +9 -1
  208. package/src/daemon/message-types/schedules.ts +9 -0
  209. package/src/daemon/server.ts +48 -9
  210. package/src/email/feature-gate.ts +3 -3
  211. package/src/heartbeat/heartbeat-service.ts +48 -0
  212. package/src/hooks/cli.ts +74 -0
  213. package/src/inbound/platform-callback-registration.ts +68 -19
  214. package/src/mcp/client.ts +6 -1
  215. package/src/mcp/manager.ts +2 -1
  216. package/src/mcp/mcp-oauth-provider.ts +3 -3
  217. package/src/memory/app-store.ts +3 -3
  218. package/src/memory/conversation-crud.ts +213 -0
  219. package/src/memory/conversation-key-store.ts +26 -0
  220. package/src/memory/conversation-title-service.ts +7 -17
  221. package/src/memory/db-init.ts +24 -0
  222. package/src/memory/embedding-local.ts +47 -2
  223. package/src/memory/indexer.ts +13 -10
  224. package/src/memory/items-extractor.ts +12 -4
  225. package/src/memory/job-utils.ts +5 -0
  226. package/src/memory/jobs-store.ts +10 -2
  227. package/src/memory/journal-memory.ts +6 -2
  228. package/src/memory/llm-request-log-store.ts +88 -21
  229. package/src/memory/memory-recall-log-store.ts +128 -0
  230. package/src/memory/migrations/194-memory-recall-logs.ts +50 -0
  231. package/src/memory/migrations/195-oauth-providers-ping-config.ts +23 -0
  232. package/src/memory/migrations/196-messages-conversation-created-at-index.ts +9 -0
  233. package/src/memory/migrations/196-strip-integration-prefix-from-provider-keys.ts +186 -0
  234. package/src/memory/migrations/197-oauth-providers-behavior-columns.ts +29 -0
  235. package/src/memory/migrations/198-drop-setup-skill-id-column.ts +11 -0
  236. package/src/memory/migrations/index.ts +6 -0
  237. package/src/memory/migrations/registry.ts +8 -0
  238. package/src/memory/retriever.test.ts +4 -5
  239. package/src/memory/schema/infrastructure.ts +31 -0
  240. package/src/memory/schema/oauth.ts +14 -0
  241. package/src/messaging/provider.ts +13 -12
  242. package/src/messaging/providers/gmail/adapter.ts +44 -35
  243. package/src/messaging/providers/slack/adapter.ts +63 -33
  244. package/src/messaging/providers/telegram-bot/adapter.ts +7 -9
  245. package/src/messaging/providers/whatsapp/adapter.ts +6 -8
  246. package/src/notifications/adapters/telegram.ts +78 -2
  247. package/src/oauth/__tests__/identity-verifier.test.ts +464 -0
  248. package/src/oauth/byo-connection.test.ts +22 -24
  249. package/src/oauth/connect-orchestrator.ts +79 -64
  250. package/src/oauth/connect-types.ts +7 -65
  251. package/src/oauth/connection-resolver.test.ts +13 -13
  252. package/src/oauth/connection-resolver.ts +3 -4
  253. package/src/oauth/identity-verifier.ts +177 -0
  254. package/src/oauth/manual-token-connection.ts +5 -5
  255. package/src/oauth/oauth-store.ts +251 -5
  256. package/src/oauth/platform-connection.test.ts +56 -6
  257. package/src/oauth/platform-connection.ts +8 -1
  258. package/src/oauth/seed-providers.ts +256 -34
  259. package/src/permissions/checker.ts +129 -3
  260. package/src/permissions/trust-client.ts +2 -2
  261. package/src/platform/client.ts +2 -2
  262. package/src/prompts/journal-context.ts +6 -1
  263. package/src/prompts/system-prompt.ts +43 -9
  264. package/src/prompts/templates/BOOTSTRAP.md +16 -5
  265. package/src/providers/anthropic/client.ts +139 -28
  266. package/src/runtime/auth/__tests__/middleware.test.ts +19 -0
  267. package/src/runtime/auth/route-policy.ts +0 -1
  268. package/src/runtime/btw-sidechain.ts +7 -1
  269. package/src/runtime/channel-approvals.ts +2 -2
  270. package/src/runtime/channel-readiness-service.ts +30 -7
  271. package/src/runtime/guardian-action-service.ts +7 -2
  272. package/src/runtime/http-router.ts +31 -0
  273. package/src/runtime/http-server.ts +26 -7
  274. package/src/runtime/http-types.ts +9 -0
  275. package/src/runtime/pending-interactions.ts +21 -3
  276. package/src/runtime/routes/acp-routes.ts +46 -28
  277. package/src/runtime/routes/app-management-routes.ts +123 -0
  278. package/src/runtime/routes/app-routes.ts +31 -0
  279. package/src/runtime/routes/approval-routes.ts +108 -3
  280. package/src/runtime/routes/attachment-routes.ts +45 -0
  281. package/src/runtime/routes/avatar-routes.ts +16 -0
  282. package/src/runtime/routes/brain-graph-routes.ts +18 -0
  283. package/src/runtime/routes/btw-routes.ts +20 -0
  284. package/src/runtime/routes/call-routes.ts +81 -0
  285. package/src/runtime/routes/channel-readiness-routes.ts +48 -7
  286. package/src/runtime/routes/channel-routes.ts +18 -0
  287. package/src/runtime/routes/channel-verification-routes.ts +49 -1
  288. package/src/runtime/routes/contact-routes.ts +77 -0
  289. package/src/runtime/routes/conversation-attention-routes.ts +37 -0
  290. package/src/runtime/routes/conversation-management-routes.ts +125 -0
  291. package/src/runtime/routes/conversation-query-routes.ts +78 -0
  292. package/src/runtime/routes/conversation-routes.ts +191 -39
  293. package/src/runtime/routes/conversation-starter-routes.ts +29 -0
  294. package/src/runtime/routes/debug-routes.ts +23 -0
  295. package/src/runtime/routes/diagnostics-routes.ts +30 -0
  296. package/src/runtime/routes/documents-routes.ts +42 -0
  297. package/src/runtime/routes/events-routes.ts +10 -0
  298. package/src/runtime/routes/global-search-routes.ts +35 -0
  299. package/src/runtime/routes/guardian-action-routes.ts +61 -3
  300. package/src/runtime/routes/guardian-approval-prompt.ts +77 -2
  301. package/src/runtime/routes/heartbeat-routes.ts +278 -0
  302. package/src/runtime/routes/host-bash-routes.ts +16 -1
  303. package/src/runtime/routes/host-cu-routes.ts +23 -1
  304. package/src/runtime/routes/host-file-routes.ts +18 -1
  305. package/src/runtime/routes/identity-routes.ts +35 -0
  306. package/src/runtime/routes/inbound-message-handler.ts +46 -25
  307. package/src/runtime/routes/inbound-stages/acl-enforcement.ts +21 -8
  308. package/src/runtime/routes/inbound-stages/secret-ingress-check.ts +30 -2
  309. package/src/runtime/routes/inbound-stages/transcribe-audio.ts +1 -2
  310. package/src/runtime/routes/integrations/slack/share.ts +1 -1
  311. package/src/runtime/routes/integrations/twilio.ts +32 -22
  312. package/src/runtime/routes/invite-routes.ts +83 -0
  313. package/src/runtime/routes/log-export-routes.ts +14 -0
  314. package/src/runtime/routes/memory-item-routes.ts +99 -1
  315. package/src/runtime/routes/migration-rollback-routes.ts +25 -0
  316. package/src/runtime/routes/migration-routes.ts +40 -0
  317. package/src/runtime/routes/notification-routes.ts +20 -0
  318. package/src/runtime/routes/oauth-apps.ts +13 -4
  319. package/src/runtime/routes/pairing-routes.ts +15 -0
  320. package/src/runtime/routes/recording-routes.ts +72 -0
  321. package/src/runtime/routes/schedule-routes.ts +77 -5
  322. package/src/runtime/routes/secret-routes.ts +99 -14
  323. package/src/runtime/routes/settings-routes.ts +102 -19
  324. package/src/runtime/routes/skills-routes.ts +141 -18
  325. package/src/runtime/routes/subagents-routes.ts +38 -3
  326. package/src/runtime/routes/surface-action-routes.ts +66 -24
  327. package/src/runtime/routes/surface-content-routes.ts +20 -0
  328. package/src/runtime/routes/telemetry-routes.ts +12 -0
  329. package/src/runtime/routes/trace-event-routes.ts +25 -0
  330. package/src/runtime/routes/trust-rules-routes.ts +46 -0
  331. package/src/runtime/routes/tts-routes.ts +15 -4
  332. package/src/runtime/routes/upgrade-broadcast-routes.ts +38 -0
  333. package/src/runtime/routes/usage-routes.ts +59 -0
  334. package/src/runtime/routes/watch-routes.ts +28 -0
  335. package/src/runtime/routes/work-items-routes.ts +59 -0
  336. package/src/runtime/routes/workspace-commit-routes.ts +12 -0
  337. package/src/runtime/routes/workspace-routes.ts +102 -0
  338. package/src/schedule/integration-status.ts +2 -2
  339. package/src/schedule/scheduler.ts +7 -1
  340. package/src/security/AGENTS.md +7 -0
  341. package/src/security/ces-rpc-credential-backend.ts +19 -16
  342. package/src/security/credential-backend.ts +1 -1
  343. package/src/security/encrypted-store.ts +3 -3
  344. package/src/security/oauth-completion-page.ts +153 -0
  345. package/src/security/oauth2.ts +58 -17
  346. package/src/security/secret-ingress.ts +174 -0
  347. package/src/security/secret-patterns.ts +133 -0
  348. package/src/security/secret-scanner.ts +28 -117
  349. package/src/security/secure-keys.ts +207 -7
  350. package/src/security/token-manager.ts +3 -6
  351. package/src/signals/bash.ts +6 -1
  352. package/src/signals/confirm.ts +12 -8
  353. package/src/signals/user-message.ts +18 -3
  354. package/src/skills/catalog-cache.ts +44 -0
  355. package/src/skills/catalog-search.ts +18 -0
  356. package/src/skills/skill-memory.ts +1 -2
  357. package/src/tasks/task-runner.ts +7 -1
  358. package/src/tools/credentials/broker.ts +1 -1
  359. package/src/tools/credentials/metadata-store.ts +1 -1
  360. package/src/tools/credentials/post-connect-hooks.ts +1 -1
  361. package/src/tools/credentials/vault.ts +36 -48
  362. package/src/tools/host-terminal/host-shell.ts +16 -3
  363. package/src/tools/mcp/mcp-tool-factory.ts +2 -1
  364. package/src/tools/memory/definitions.ts +1 -1
  365. package/src/tools/memory/handlers.test.ts +2 -4
  366. package/src/tools/skills/load.ts +1 -1
  367. package/src/tools/skills/sandbox-runner.ts +16 -3
  368. package/src/tools/terminal/safe-env.ts +7 -0
  369. package/src/tools/terminal/shell.ts +16 -3
  370. package/src/tools/tool-manifest.ts +1 -1
  371. package/src/util/log-redact.ts +9 -34
  372. package/src/util/logger.ts +11 -1
  373. package/src/util/sentry-log-stream.ts +51 -0
  374. package/src/watcher/providers/github.ts +2 -2
  375. package/src/watcher/providers/gmail.ts +1 -1
  376. package/src/watcher/providers/google-calendar.ts +1 -1
  377. package/src/watcher/providers/linear.ts +2 -2
  378. package/src/workspace/migrations/011-backfill-installation-id.ts +5 -3
  379. package/src/workspace/migrations/020-rename-oauth-skill-dirs.ts +119 -0
  380. package/src/workspace/migrations/registry.ts +2 -0
  381. package/docs/architecture/keychain-broker.md +0 -68
  382. package/src/cli/commands/oauth/connections.ts +0 -734
  383. package/src/cli/commands/oauth/platform.ts +0 -525
  384. package/src/cli/commands/platform.ts +0 -176
  385. package/src/config/bundled-skills/slack/TOOLS.json +0 -272
  386. package/src/config/bundled-skills/slack/tools/shared.ts +0 -34
  387. package/src/config/bundled-skills/slack/tools/slack-add-reaction.ts +0 -27
  388. package/src/config/bundled-skills/slack/tools/slack-channel-details.ts +0 -38
  389. package/src/config/bundled-skills/slack/tools/slack-channel-permissions.ts +0 -146
  390. package/src/config/bundled-skills/slack/tools/slack-configure-channels.ts +0 -105
  391. package/src/config/bundled-skills/slack/tools/slack-delete-message.ts +0 -26
  392. package/src/config/bundled-skills/slack/tools/slack-edit-message.ts +0 -27
  393. package/src/config/bundled-skills/slack/tools/slack-leave-channel.ts +0 -25
  394. package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts +0 -372
  395. package/src/oauth/provider-behaviors.ts +0 -634
@@ -1,25 +0,0 @@
1
- import { leaveConversation } from "../../../../messaging/providers/slack/client.js";
2
- import type {
3
- ToolContext,
4
- ToolExecutionResult,
5
- } from "../../../../tools/types.js";
6
- import { err, getSlackConnection, ok } from "./shared.js";
7
-
8
- export async function run(
9
- input: Record<string, unknown>,
10
- _context: ToolContext,
11
- ): Promise<ToolExecutionResult> {
12
- const channel = input.channel as string;
13
-
14
- if (!channel) {
15
- return err("channel is required.");
16
- }
17
-
18
- try {
19
- const connection = await getSlackConnection();
20
- await leaveConversation(connection, channel);
21
- return ok("Left channel.");
22
- } catch (e) {
23
- return err(e instanceof Error ? e.message : String(e));
24
- }
25
- }
@@ -1,372 +0,0 @@
1
- import { getConfig } from "../../../../config/loader.js";
2
- import * as slack from "../../../../messaging/providers/slack/client.js";
3
- import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
4
- import type {
5
- ToolContext,
6
- ToolExecutionResult,
7
- } from "../../../../tools/types.js";
8
- import { err, getSlackConnection, ok } from "./shared.js";
9
-
10
- interface ThreadSummary {
11
- threadTs: string;
12
- previewText: string;
13
- replyCount: number;
14
- participants: string[];
15
- }
16
-
17
- interface ChannelDigest {
18
- channelId: string;
19
- channelName: string;
20
- isPrivate: boolean;
21
- messageCount: number;
22
- topThreads: ThreadSummary[];
23
- keyParticipants: string[];
24
- error?: string;
25
- }
26
-
27
- const userNameCache = new Map<string, string>();
28
-
29
- async function resolveUserName(
30
- connection: string,
31
- userId: string,
32
- ): Promise<string> {
33
- if (!userId) return "unknown";
34
- const cached = userNameCache.get(userId);
35
- if (cached) return cached;
36
-
37
- try {
38
- const resp = await slack.userInfo(connection, userId);
39
- const name =
40
- resp.user.profile?.display_name ||
41
- resp.user.profile?.real_name ||
42
- resp.user.real_name ||
43
- resp.user.name;
44
- userNameCache.set(userId, name);
45
- return name;
46
- } catch {
47
- return userId;
48
- }
49
- }
50
-
51
- async function scanChannel(
52
- connection: string,
53
- conv: SlackConversation,
54
- oldestTs: string,
55
- includeThreads: boolean,
56
- ): Promise<ChannelDigest> {
57
- const channelId = conv.id;
58
- const channelName = conv.name ?? channelId;
59
- const isPrivate = conv.is_private ?? conv.is_group ?? false;
60
-
61
- try {
62
- const history = await slack.conversationHistory(
63
- connection,
64
- channelId,
65
- 100,
66
- undefined,
67
- oldestTs,
68
- );
69
- const messages = history.messages;
70
-
71
- const participantIds = new Set<string>();
72
- for (const msg of messages) {
73
- if (msg.user) participantIds.add(msg.user);
74
- }
75
-
76
- const keyParticipants = await Promise.all(
77
- [...participantIds].map((uid) => resolveUserName(connection, uid)),
78
- );
79
-
80
- const threadMessages = messages
81
- .filter((m) => (m.reply_count ?? 0) > 0)
82
- .sort((a, b) => (b.reply_count ?? 0) - (a.reply_count ?? 0))
83
- .slice(0, 3);
84
-
85
- const topThreads: ThreadSummary[] = await Promise.all(
86
- threadMessages.map(async (msg) => {
87
- let participants: string[] = [];
88
-
89
- if (includeThreads) {
90
- try {
91
- const replies = await slack.conversationReplies(
92
- connection,
93
- channelId,
94
- msg.ts,
95
- 10,
96
- );
97
- const threadParticipantIds = new Set<string>();
98
- for (const reply of replies.messages) {
99
- if (reply.user) threadParticipantIds.add(reply.user);
100
- }
101
- participants = await Promise.all(
102
- [...threadParticipantIds].map((uid) =>
103
- resolveUserName(connection, uid),
104
- ),
105
- );
106
- } catch {
107
- participants = [await resolveUserName(connection, msg.user ?? "")];
108
- }
109
- }
110
-
111
- return {
112
- threadTs: msg.ts,
113
- previewText: truncate(msg.text, 150),
114
- replyCount: msg.reply_count ?? 0,
115
- participants,
116
- };
117
- }),
118
- );
119
-
120
- return {
121
- channelId,
122
- channelName,
123
- isPrivate,
124
- messageCount: messages.length,
125
- topThreads,
126
- keyParticipants,
127
- };
128
- } catch (e) {
129
- return {
130
- channelId,
131
- channelName,
132
- isPrivate,
133
- messageCount: 0,
134
- topThreads: [],
135
- keyParticipants: [],
136
- error: e instanceof Error ? e.message : String(e),
137
- };
138
- }
139
- }
140
-
141
- function truncate(text: string, maxLen: number): string {
142
- if (text.length <= maxLen) return text;
143
- return text.slice(0, maxLen - 3) + "...";
144
- }
145
-
146
- // eslint-disable-next-line @typescript-eslint/no-explicit-any
147
- type BlockKitBlock = Record<string, any>;
148
-
149
- /**
150
- * Build Slack Block Kit blocks from digest results.
151
- * Produces a structured Block Kit payload with header, per-channel sections,
152
- * thread context blocks, and dividers.
153
- */
154
- function buildBlockKitOutput(
155
- digests: ChannelDigest[],
156
- hoursBack: number,
157
- totalAttempted: number,
158
- skippedCount: number,
159
- ): BlockKitBlock[] {
160
- const blocks: BlockKitBlock[] = [];
161
-
162
- // Header block with scan summary
163
- blocks.push({
164
- type: "header",
165
- text: {
166
- type: "plain_text",
167
- text: `Slack Digest - ${digests.length} channel${digests.length !== 1 ? "s" : ""} scanned`,
168
- },
169
- });
170
-
171
- blocks.push({
172
- type: "section",
173
- text: {
174
- type: "mrkdwn",
175
- text: `*Time range:* Last ${hoursBack} hour${hoursBack !== 1 ? "s" : ""} | *Channels attempted:* ${totalAttempted} | *Skipped:* ${skippedCount}`,
176
- },
177
- });
178
-
179
- blocks.push({ type: "divider" });
180
-
181
- for (const digest of digests) {
182
- if (digest.error) {
183
- blocks.push({
184
- type: "section",
185
- text: {
186
- type: "mrkdwn",
187
- text: `${digest.isPrivate ? "\ud83d\udd12 " : ""}*#${digest.channelName}* - _Error: ${digest.error}_`,
188
- },
189
- });
190
- blocks.push({ type: "divider" });
191
- continue;
192
- }
193
-
194
- // Channel section with name, message count, privacy indicator
195
- const privacyIcon = digest.isPrivate ? "\ud83d\udd12 " : "";
196
- blocks.push({
197
- type: "section",
198
- text: {
199
- type: "mrkdwn",
200
- text: `${privacyIcon}*#${digest.channelName}* - ${digest.messageCount} message${digest.messageCount !== 1 ? "s" : ""}`,
201
- },
202
- });
203
-
204
- // Key participants as context
205
- if (digest.keyParticipants.length > 0) {
206
- blocks.push({
207
- type: "context",
208
- elements: [
209
- {
210
- type: "mrkdwn",
211
- text: `*Active:* ${digest.keyParticipants.join(", ")}`,
212
- },
213
- ],
214
- });
215
- }
216
-
217
- // Thread previews as context blocks
218
- for (const thread of digest.topThreads) {
219
- const participantText =
220
- thread.participants.length > 0
221
- ? thread.participants.join(", ")
222
- : "unknown";
223
- blocks.push({
224
- type: "context",
225
- elements: [
226
- {
227
- type: "mrkdwn",
228
- text: `\ud83e\uddf5 *${thread.replyCount} replies* (${participantText}): ${thread.previewText}`,
229
- },
230
- ],
231
- });
232
- }
233
-
234
- blocks.push({ type: "divider" });
235
- }
236
-
237
- // Slack Block Kit enforces a 50-block maximum per message.
238
- // Truncate and append a summary block when we exceed the limit.
239
- const SLACK_BLOCK_LIMIT = 50;
240
- if (blocks.length > SLACK_BLOCK_LIMIT) {
241
- const overflow = blocks.length - (SLACK_BLOCK_LIMIT - 1);
242
- blocks.length = SLACK_BLOCK_LIMIT - 1;
243
- blocks.push({
244
- type: "section",
245
- text: {
246
- type: "mrkdwn",
247
- text: `_... and ${overflow} more block${overflow !== 1 ? "s" : ""} truncated (some channels omitted). Use \`channel_ids\` to drill into specific channels._`,
248
- },
249
- });
250
- }
251
-
252
- return blocks;
253
- }
254
-
255
- export async function run(
256
- input: Record<string, unknown>,
257
- _context: ToolContext,
258
- ): Promise<ToolExecutionResult> {
259
- const channelIds = input.channel_ids as string[] | undefined;
260
- const hoursBack = (input.hours_back as number) ?? 24;
261
- const includeThreads = (input.include_threads as boolean) ?? true;
262
- const maxChannels = (input.max_channels as number) ?? 20;
263
- const format = (input.format as string) ?? "text";
264
-
265
- try {
266
- const connection = await getSlackConnection();
267
- const oldestTs = String((Date.now() - hoursBack * 60 * 60 * 1000) / 1000);
268
-
269
- let channelsToScan: SlackConversation[];
270
- let failedLookups = 0;
271
-
272
- if (channelIds?.length) {
273
- const results = await Promise.allSettled(
274
- channelIds.map((id) => slack.conversationInfo(connection, id)),
275
- );
276
- channelsToScan = results
277
- .filter(
278
- (
279
- r,
280
- ): r is PromiseFulfilledResult<
281
- Awaited<ReturnType<typeof slack.conversationInfo>>
282
- > => r.status === "fulfilled",
283
- )
284
- .map((r) => r.value.channel);
285
- failedLookups = results.filter((r) => r.status === "rejected").length;
286
- } else {
287
- const config = getConfig();
288
- const preferredIds = config.skills?.entries?.slack?.config
289
- ?.preferredChannels as string[] | undefined;
290
-
291
- if (preferredIds?.length) {
292
- const results = await Promise.allSettled(
293
- preferredIds.map((id) => slack.conversationInfo(connection, id)),
294
- );
295
- channelsToScan = results
296
- .filter(
297
- (
298
- r,
299
- ): r is PromiseFulfilledResult<
300
- Awaited<ReturnType<typeof slack.conversationInfo>>
301
- > => r.status === "fulfilled",
302
- )
303
- .map((r) => r.value.channel);
304
- failedLookups = results.filter((r) => r.status === "rejected").length;
305
- } else {
306
- const allChannels: SlackConversation[] = [];
307
- let cursor: string | undefined;
308
- do {
309
- const resp = await slack.listConversations(
310
- connection,
311
- "public_channel,private_channel",
312
- true,
313
- 200,
314
- cursor,
315
- );
316
- allChannels.push(...resp.channels);
317
- cursor = resp.response_metadata?.next_cursor || undefined;
318
- } while (cursor);
319
-
320
- channelsToScan = allChannels
321
- .filter((c) => c.is_member)
322
- .sort((a, b) => {
323
- const aTs = a.latest?.ts ? parseFloat(a.latest.ts) : 0;
324
- const bTs = b.latest?.ts ? parseFloat(b.latest.ts) : 0;
325
- return bTs - aTs;
326
- })
327
- .slice(0, maxChannels);
328
- }
329
- }
330
-
331
- const scanResults = await Promise.allSettled(
332
- channelsToScan.map((conv) =>
333
- scanChannel(connection, conv, oldestTs, includeThreads),
334
- ),
335
- );
336
-
337
- const digests: ChannelDigest[] = scanResults
338
- .filter(
339
- (r): r is PromiseFulfilledResult<ChannelDigest> =>
340
- r.status === "fulfilled",
341
- )
342
- .map((r) => r.value)
343
- .filter((d) => d.messageCount > 0 || d.error);
344
-
345
- const skippedCount = scanResults.filter(
346
- (r) => r.status === "rejected",
347
- ).length;
348
-
349
- if (format === "blocks") {
350
- const blocks = buildBlockKitOutput(
351
- digests,
352
- hoursBack,
353
- channelsToScan.length,
354
- skippedCount,
355
- );
356
- return ok(JSON.stringify({ blocks }, null, 2));
357
- }
358
-
359
- const result = {
360
- scannedChannels: digests.length,
361
- totalChannelsAttempted: channelsToScan.length,
362
- skippedDueToErrors: skippedCount,
363
- failedLookups,
364
- hoursBack,
365
- channels: digests,
366
- };
367
-
368
- return ok(JSON.stringify(result, null, 2));
369
- } catch (e) {
370
- return err(e instanceof Error ? e.message : String(e));
371
- }
372
- }