@vellumai/assistant 0.5.16 → 0.6.0

package/src/messaging/providers/outlook/types.ts

@@ -28,6 +28,12 @@ export interface OutlookItemBody {
   content: string;
 }
 
+/** Internet message header (e.g. List-Unsubscribe, X-Mailer) */
+export interface OutlookInternetMessageHeader {
+  name: string;
+  value: string;
+}
+
 /** Full Outlook message from Microsoft Graph */
 export interface OutlookMessage {
   id: string;
@@ -46,6 +52,7 @@ export interface OutlookMessage {
   flag: {
     flagStatus: "notFlagged" | "flagged" | "complete";
   };
+  internetMessageHeaders?: OutlookInternetMessageHeader[];
 }
 
 /** Outlook mail folder */
@@ -75,9 +82,120 @@ export interface OutlookSendMessagePayload {
   saveToSentItems?: boolean;
 }
 
+/** Draft message for creating in Drafts folder */
+export interface OutlookDraftMessage {
+  subject: string;
+  body: OutlookItemBody;
+  toRecipients?: OutlookRecipient[];
+  ccRecipients?: OutlookRecipient[];
+  bccRecipients?: OutlookRecipient[];
+}
+
+/** Forward message payload (Graph API's /createForward returns a draft) */
+export interface OutlookForwardMessage {
+  toRecipients: OutlookRecipient[];
+  comment?: string;
+}
+
 /** Microsoft Graph user profile */
 export interface OutlookUserProfile {
   displayName: string;
   mail: string;
   userPrincipalName: string;
 }
+
+/** Outlook attachment metadata */
+export interface OutlookAttachment {
+  id: string;
+  name: string;
+  contentType: string;
+  size: number;
+  isInline: boolean;
+  "@odata.type"?: string;
+}
+
+/** Outlook file attachment with base64-encoded content */
+export interface OutlookFileAttachment extends OutlookAttachment {
+  contentBytes: string;
+}
+
+/** Outlook attachment list response (paginated) */
+export interface OutlookAttachmentListResponse {
+  value?: OutlookAttachment[];
+  "@odata.nextLink"?: string;
+}
+
+/** Outlook message flag with optional due/start dates */
+export interface OutlookMessageFlag {
+  flagStatus: "notFlagged" | "flagged" | "complete";
+  dueDateTime?: { dateTime: string; timeZone: string };
+  startDateTime?: { dateTime: string; timeZone: string };
+}
+
+/** Outlook master category */
+export interface OutlookMasterCategory {
+  displayName: string;
+  color: string;
+}
+
+/** Outlook master category list response */
+export interface OutlookMasterCategoryListResponse {
+  value?: OutlookMasterCategory[];
+}
+
+/** Predicates for matching messages in a mail rule */
+export interface OutlookMessageRulePredicates {
+  senderContains?: string[];
+  subjectContains?: string[];
+  bodyContains?: string[];
+  fromAddresses?: OutlookRecipient[];
+  hasAttachments?: boolean;
+  importance?: "low" | "normal" | "high";
+}
+
+/** Actions to take when a mail rule matches */
+export interface OutlookMessageRuleActions {
+  moveToFolder?: string;
+  delete?: boolean;
+  stopProcessingRules?: boolean;
+  markAsRead?: boolean;
+  forwardTo?: OutlookRecipient[];
+  markImportance?: "low" | "normal" | "high";
+}
+
+/** A mail rule for inbox message processing */
+export interface OutlookMessageRule {
+  id?: string;
+  displayName: string;
+  sequence: number;
+  isEnabled: boolean;
+  conditions?: OutlookMessageRulePredicates;
+  actions?: OutlookMessageRuleActions;
+}
+
+/** Response from listing mail rules */
+export interface OutlookMessageRuleListResponse {
+  value?: OutlookMessageRule[];
+}
+
+/** Automatic reply (out-of-office) settings */
+export interface OutlookAutoReplySettings {
+  status: "disabled" | "alwaysEnabled" | "scheduled";
+  externalAudience: "none" | "contactsOnly" | "all";
+  internalReplyMessage?: string;
+  externalReplyMessage?: string;
+  scheduledStartDateTime?: { dateTime: string; timeZone: string };
+  scheduledEndDateTime?: { dateTime: string; timeZone: string };
+}
+
+/** Mailbox settings containing automatic replies configuration */
+export interface OutlookMailboxSettings {
+  automaticRepliesSetting?: OutlookAutoReplySettings;
+}
+
+/** Delta query response with pagination support */
+export interface OutlookDeltaResponse<T> {
+  value?: T[];
+  "@odata.deltaLink"?: string;
+  "@odata.nextLink"?: string;
+}

package/src/notifications/adapters/macos.ts

@@ -37,6 +37,7 @@ const GUARDIAN_SENSITIVE_EVENT_PREFIXES = [
   "guardian.question",
   "ingress.escalation",
   "ingress.access_request",
+  "guardian.channel_activation",
 ] as const;
 
 export function isGuardianSensitiveEvent(sourceEventName: string): boolean {

package/src/notifications/copy-composer.ts

@@ -353,6 +353,15 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     };
   },
 
+  "guardian.channel_activation": (payload) => {
+    const code = str(payload.verificationCode, "------");
+    const channel = str(payload.sourceChannel, "a channel");
+    return {
+      title: "Guardian Verification Code",
+      body: `Your ${channel} verification code is: ${code}\n\nEnter this code in your ${channel} chat to verify your identity as guardian.`,
+    };
+  },
+
   "ingress.access_request": (payload) => ({
     title: "Access Request",
     body: buildAccessRequestContractText(payload),

package/src/notifications/signal.ts

@@ -46,6 +46,11 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     id: "guardian.question",
     description: "Guardian approval question requiring response",
   },
+  {
+    id: "guardian.channel_activation",
+    description:
+      "Guardian channel activation code delivered for /start verification",
+  },
   { id: "ingress.access_request", description: "Non-member requesting access" },
   {
     id: "ingress.access_request.callback_handoff",
@@ -155,9 +160,20 @@ export interface AccessRequestContextPayload {
   messagePreview: string | null;
 }
 
+export interface GuardianChannelActivationPayload {
+  verificationCode: string;
+  sourceChannel: string;
+  actorExternalId: string;
+  actorDisplayName: string | null;
+  actorUsername: string | null;
+  sessionId: string;
+  expiresAt: number;
+}
+
 export interface NotificationEventContextPayloadMap {
   "guardian.question": GuardianQuestionPayload;
   "ingress.access_request": AccessRequestContextPayload;
+  "guardian.channel_activation": GuardianChannelActivationPayload;
 }
 
 export type NotificationContextPayload<TEventName extends string = string> =

package/src/oauth/seed-providers.ts

@@ -90,6 +90,7 @@ const PROVIDER_SEED_DATA: Record<
       forbiddenScopes: [],
     },
     extraParams: { access_type: "offline", prompt: "consent" },
+    loopbackPort: 17321,
     managedServiceConfigKey: "google-oauth",
     injectionTemplates: [
       {
@@ -619,6 +620,7 @@ const PROVIDER_SEED_DATA: Record<
       "Mail.Send",
       "Calendars.Read",
       "Calendars.ReadWrite",
+      "MailboxSettings.ReadWrite",
     ],
     scopePolicy: {
       allowAdditionalScopes: true,
@@ -640,7 +642,6 @@ const PROVIDER_SEED_DATA: Record<
     appType: "App registration",
     identityUrl: "https://graph.microsoft.com/v1.0/me",
     identityResponsePaths: ["mail", "userPrincipalName"],
-    featureFlag: "outlook-oauth-integration",
   },
 
   // Manual-token providers: these don't use OAuth2 flows but need provider

package/src/permissions/checker.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { dirname, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 
 import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
@@ -19,7 +19,7 @@ import {
   looksLikePathOnlyInput,
 } from "../tools/network/url-safety.js";
 import { getTool } from "../tools/registry.js";
-import { getWorkspaceHooksDir } from "../util/platform.js";
+import { getDeprecatedDir, getWorkspaceHooksDir } from "../util/platform.js";
 import {
   buildShellAllowlistOptions,
   buildShellCommandCandidates,
@@ -703,7 +703,13 @@ async function classifyRiskUncached(
   preParsed?: ParsedCommand,
   manifestOverride?: ManifestOverride,
 ): Promise<RiskLevel> {
-  if (toolName === "file_read") return RiskLevel.Low;
+  if (toolName === "file_read") {
+    const filePath = getStringField(input, "path", "file_path");
+    if (isActorTokenSigningKeyPath(filePath, workingDir)) {
+      return RiskLevel.High;
+    }
+    return RiskLevel.Low;
+  }
   if (toolName === "file_write" || toolName === "file_edit") {
     const filePath = getStringField(input, "path", "file_path");
     if (
@@ -937,6 +943,21 @@ async function classifyRiskUncached(
   return RiskLevel.Medium;
 }
 
+function isActorTokenSigningKeyPath(
+  filePath: string | undefined,
+  workingDir?: string,
+): boolean {
+  if (!filePath) return false;
+  const cwd = workingDir ?? process.cwd();
+  const resolvedPath = resolve(cwd, filePath);
+  const signingKeyPaths = [
+    join(homedir(), ".vellum", "protected", "actor-token-signing-key"),
+    join(getDeprecatedDir(), "actor-token-signing-key"),
+    resolve(cwd, "deprecated", "actor-token-signing-key"),
+  ];
+  return signingKeyPaths.includes(resolvedPath);
+}
+
 export async function check(
   toolName: string,
   input: Record<string, unknown>,

package/src/permissions/defaults.ts

@@ -287,11 +287,11 @@ export function getDefaultRuleTemplates(): DefaultRuleTemplate[] {
     }),
   );
 
-  // memory_recall is a read-only tool — always allow without prompting.
+  // recall is a read-only tool — always allow without prompting.
   const memoryRecallRule: DefaultRuleTemplate = {
-    id: "default:allow-memory_recall-global",
-    tool: "memory_recall",
-    pattern: "memory_recall:*",
+    id: "default:allow-recall-global",
+    tool: "recall",
+    pattern: "recall:*",
     scope: "everywhere",
     decision: "allow",
     priority: 100,

package/src/permissions/workspace-policy.ts

@@ -79,7 +79,7 @@ const HOST_TOOLS = new Set([
 /** Safe local-only tools that are always workspace-scoped. */
 const ALWAYS_SCOPED_TOOLS = new Set([
   "skill_load",
-  "memory_recall",
+  "recall",
   "ui_update",
   "ui_dismiss",
 ]);

package/src/playbooks/playbook-compiler.ts

@@ -1,20 +1,20 @@
 /**
- * Compile all active playbook memory items into a triage context block
+ * Compile all active playbook graph nodes into a triage context block
  * that can be injected into the system prompt alongside the contact
  * graph.
  */
 
-import { and, desc, eq, isNull } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 
 import { getDb } from "../memory/db.js";
-import { memoryItems } from "../memory/schema.js";
+import { memoryGraphNodes } from "../memory/schema.js";
 import type { Playbook } from "./types.js";
 import { parsePlaybookStatement } from "./types.js";
 
 export interface CompiledPlaybooks {
   /** Formatted text block ready for system prompt injection. */
   text: string;
-  /** Total number of active playbook items found. */
+  /** Total number of active playbook nodes found. */
   totalCount: number;
   /** Number of playbooks successfully parsed and included. */
   includedCount: number;
@@ -26,8 +26,7 @@ export interface CompilePlaybooksOptions {
 
 interface PlaybookRow {
   id: string;
-  subject: string;
-  statement: string;
+  content: string;
 }
 
 export function compilePlaybooks(
@@ -38,31 +37,33 @@ export function compilePlaybooks(
 
   const rows: PlaybookRow[] = db
     .select({
-      id: memoryItems.id,
-      subject: memoryItems.subject,
-      statement: memoryItems.statement,
+      id: memoryGraphNodes.id,
+      content: memoryGraphNodes.content,
     })
-    .from(memoryItems)
+    .from(memoryGraphNodes)
     .where(
       and(
-        eq(memoryItems.kind, "playbook"),
-        eq(memoryItems.status, "active"),
-        eq(memoryItems.scopeId, scopeId),
-        isNull(memoryItems.invalidAt),
+        eq(memoryGraphNodes.scopeId, scopeId),
+        sql`${memoryGraphNodes.sourceConversations} LIKE '%playbook:%'`,
+        sql`${memoryGraphNodes.fidelity} != 'gone'`,
       ),
     )
-    .orderBy(desc(memoryItems.importance))
+    .orderBy(sql`${memoryGraphNodes.significance} DESC`)
     .all();
 
   if (rows.length === 0) {
     return { text: "", totalCount: 0, includedCount: 0 };
   }
 
-  const parsed: Array<{ id: string; subject: string; playbook: Playbook }> = [];
+  const parsed: Array<{ id: string; playbook: Playbook }> = [];
   for (const row of rows) {
-    const playbook = parsePlaybookStatement(row.statement);
+    // Content format: "Playbook: <trigger>\n<json statement>"
+    const newlineIdx = row.content.indexOf("\n");
+    if (newlineIdx === -1) continue;
+    const statement = row.content.slice(newlineIdx + 1);
+    const playbook = parsePlaybookStatement(statement);
     if (playbook) {
-      parsed.push({ id: row.id, subject: row.subject, playbook });
+      parsed.push({ id: row.id, playbook });
     }
   }
 

package/src/playbooks/types.ts

@@ -2,9 +2,10 @@
  * Action Playbook — a structured trigger→action rule that tells the
  * triage engine how to handle incoming messages matching a pattern.
  *
- * Playbooks are stored as memory items with kind='playbook'. The
- * structured fields below are serialized into the statement column as
- * JSON, while the subject column holds a human-readable label.
+ * Playbooks are stored as memory_graph_nodes with
+ * sourceConversations containing a "playbook:{nodeId}" entry. The
+ * content column holds "Playbook: <trigger>\n<json>" where the JSON
+ * encodes the structured fields below.
  */
 
 export interface Playbook {

package/src/prompts/system-prompt.ts

@@ -9,7 +9,6 @@ import {
 import { join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
-import { getConfig } from "../config/loader.js";
 import { listConnections } from "../oauth/oauth-store.js";
 import { resolveBundledDir } from "../util/bundled-asset.js";
 import { getLogger } from "../util/logger.js";
@@ -21,7 +20,6 @@ import {
 } from "../util/platform.js";
 import { stripCommentLines } from "../util/strip-comment-lines.js";
 import { SYSTEM_PROMPT_CACHE_BOUNDARY } from "./cache-boundary.js";
-import { buildJournalContext } from "./journal-context.js";
 
 export { SYSTEM_PROMPT_CACHE_BOUNDARY };
 
@@ -130,27 +128,7 @@ export function ensurePromptFiles(): void {
     }
   }
 
-  // Seed NOW.md scratchpad — always created if missing, regardless of whether
-  // this is a fresh install or not.  Kept out of PROMPT_FILES because NOW.md is
-  // ephemeral state, not identity context.
-  const nowDest = getWorkspacePromptPath("NOW.md");
-  if (!existsSync(nowDest)) {
-    const nowSrc = join(templatesDir, "NOW.md");
-    try {
-      if (existsSync(nowSrc)) {
-        copyFileSync(nowSrc, nowDest);
-        log.info(
-          { file: "NOW.md", dest: nowDest },
-          "Created NOW.md scratchpad from template",
-        );
-      }
-    } catch (err) {
-      log.warn(
-        { err, file: "NOW.md" },
-        "Failed to create NOW.md from template",
-      );
-    }
-  }
+  // The `remember` tool handles scratchpad-style memory writes directly to the graph.
 
   // Seed users/default.md persona template
   try {
@@ -296,11 +274,8 @@ export function buildSystemPrompt(options?: BuildSystemPromptOptions): string {
   const integrationSection = buildIntegrationSection();
   if (integrationSection) dynamicParts.push(integrationSection);
 
-  const journalContext = buildJournalContext(
-    getConfig().journal?.contextWindowSize ?? 10,
-    options?.userSlug,
-  );
-  if (journalContext) dynamicParts.push(journalContext);
+  // Journal entries are extracted into graph nodes by the memory pipeline.
+  // Journal files remain writable on disk.
 
   const dynamic = dynamicParts.join("\n\n");
 
@@ -489,4 +464,3 @@ export function buildCoreIdentityContext(opts?: {
   if (opts?.userPersona) parts.push(opts.userPersona);
   return parts.length > 0 ? parts.join("\n\n") : null;
 }
-

package/src/providers/anthropic/client.ts

@@ -101,6 +101,14 @@ export const PLACEHOLDER_EMPTY_TURN =
 export const PLACEHOLDER_BLOCKS_OMITTED =
   "\x00__PLACEHOLDER__[internal blocks omitted]";
 
+/**
+ * Synthetic placeholder injected as user-message content when Anthropic API
+ * alternation requires a user turn but no real user content exists. Uses the
+ * `__injected` XML tag convention so the LLM treats it as system metadata
+ * rather than user speech.
+ */
+const SYNTHETIC_CONTINUATION_TEXT = "<synthetic_continuation __injected />";
+
 /** Type-guard for tool_use blocks in Anthropic-formatted content. */
 function isToolUseBlock(block: unknown): block is Anthropic.ToolUseBlockParam {
   return (
@@ -310,14 +318,24 @@ function expandCollapsedAssistantTurns(
     if (nextIsUser) {
       const remainingResults = Array.from(toolResultMap.values());
       const rebuiltUserContent = [...remainingResults, ...nonToolResultContent];
-      // Replace the original user message with the rebuilt one
-      result.push({
-        role: "user" as const,
-        content:
-          rebuiltUserContent.length > 0
-            ? rebuiltUserContent
-            : [{ type: "text" as const, text: "(continue)" }],
-      });
+      // Replace the original user message with the rebuilt one. When all
+      // tool_results were distributed to intermediate segments (empty rebuilt
+      // content), skip the synthetic placeholder if the next message is already
+      // a user turn — ensureToolPairing will pair the last assistant segment
+      // with that next user message naturally.
+      if (rebuiltUserContent.length > 0) {
+        result.push({ role: "user" as const, content: rebuiltUserContent });
+      } else {
+        const nextAfterUser = messages[mi + 2];
+        if (!nextAfterUser || nextAfterUser.role !== "user") {
+          result.push({
+            role: "user" as const,
+            content: [
+              { type: "text" as const, text: SYNTHETIC_CONTINUATION_TEXT },
+            ],
+          });
+        }
+      }
       mi++; // skip the original user message
     }
   }
@@ -574,16 +592,26 @@ function ensureToolPairing(
           role: "assistant" as const,
           content: carryoverContent,
         });
-        // Always emit a trailing user message to maintain alternation, even if the
-        // original user turn had only tool_result blocks. Use a synthetic placeholder
-        // when remainingContent is empty.
-        result.push({
-          role: "user" as const,
-          content:
-            normalized.remainingContent.length > 0
-              ? normalized.remainingContent
-              : [{ type: "text" as const, text: "(continue)" }],
-        });
+        // Emit a trailing user message when there is remaining content, or when
+        // alternation requires it (next message is assistant or end of array).
+        // Skip the synthetic placeholder if the next message is already a user
+        // turn — it will naturally maintain alternation.
+        if (normalized.remainingContent.length > 0) {
+          result.push({
+            role: "user" as const,
+            content: normalized.remainingContent,
+          });
+        } else {
+          const nextAfterPair = messages[i + 2];
+          if (!nextAfterPair || nextAfterPair.role !== "user") {
+            result.push({
+              role: "user" as const,
+              content: [
+                { type: "text" as const, text: SYNTHETIC_CONTINUATION_TEXT },
+              ],
+            });
+          }
+        }
       } else {
         // No carryover assistant text to restore, so preserve existing behavior
         // and keep additional user blocks in the same message.
@@ -678,7 +706,7 @@ export class AnthropicProvider implements Provider {
     this.client = new Anthropic({ apiKey, baseURL: options.baseURL });
     this.model = model;
     this.useNativeWebSearch = options.useNativeWebSearch ?? false;
-    this.streamTimeoutMs = options.streamTimeoutMs ?? 300_000;
+    this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
   }
 
   async sendMessage(

package/src/providers/gemini/client.ts

@@ -89,7 +89,7 @@ export class GeminiProvider implements Provider {
         })
       : new GoogleGenAI({ apiKey });
     this.model = model;
-    this.streamTimeoutMs = options.streamTimeoutMs ?? 300_000;
+    this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
   }
 
   async sendMessage(

package/src/providers/openai/client.ts

@@ -112,7 +112,7 @@ export class OpenAIProvider implements Provider {
       baseURL: options.baseURL,
     });
     this.model = model;
-    this.streamTimeoutMs = options.streamTimeoutMs ?? 300_000;
+    this.streamTimeoutMs = options.streamTimeoutMs ?? 1_800_000;
     this.extraCreateParams = options.extraCreateParams ?? {};
   }
 

package/src/providers/registry.ts

@@ -140,7 +140,7 @@ export async function initializeProviders(
   routingSources.clear();
 
   const streamTimeoutMs =
-    (config.timeouts?.providerStreamTimeoutSec ?? 300) * 1000;
+    (config.timeouts?.providerStreamTimeoutSec ?? 1800) * 1000;
   const inferenceMode = config.services.inference.mode;
   const useNativeWebSearch =
     config.services["web-search"].provider === "inference-provider-native";

package/src/providers/retry.ts

@@ -34,16 +34,30 @@ const RETRYABLE_STREAM_PATTERNS = [
   "stream has ended, this shouldn't happen",
 ];
 
+/**
+ * Patterns that indicate a transient provider error even when no HTTP status
+ * code is available (e.g. overloaded errors delivered as SSE events mid-stream
+ * where the initial HTTP response was 200).
+ */
+const RETRYABLE_PROVIDER_MESSAGE_PATTERNS = [/overloaded/i];
+
 function isRetryableStreamError(error: unknown): boolean {
   if (!(error instanceof ProviderError)) return false;
   if (error.statusCode !== undefined) return false; // has a real HTTP status — not a stream error
   return RETRYABLE_STREAM_PATTERNS.some((p) => error.message.includes(p));
 }
 
+function isRetryableProviderMessage(error: unknown): boolean {
+  if (!(error instanceof ProviderError)) return false;
+  if (error.statusCode !== undefined) return false; // has a real HTTP status — handled by status check
+  return RETRYABLE_PROVIDER_MESSAGE_PATTERNS.some((p) => p.test(error.message));
+}
+
 function isRetryableError(error: unknown): boolean {
   if (error instanceof ProviderError && error.statusCode !== undefined) {
     if (error.statusCode === 429 || error.statusCode >= 500) return true;
   }
+  if (isRetryableProviderMessage(error)) return true;
   if (isRetryableStreamError(error)) return true;
   return isRetryableNetworkError(error);
 }
@@ -161,9 +175,11 @@ export class RetryProvider implements Provider {
                   error.statusCode !== undefined &&
                   error.statusCode >= 500
                 ? `server_error_${error.statusCode}`
-                : isRetryableStreamError(error)
-                  ? "stream_corruption"
-                  : "network_error";
+                : isRetryableProviderMessage(error)
+                  ? "provider_overloaded"
+                  : isRetryableStreamError(error)
+                    ? "stream_corruption"
+                    : "network_error";
           log.warn(
             {
               attempt: attempt + 1,

package/src/runtime/actor-trust-resolver.ts

@@ -48,7 +48,11 @@ export type TrustClass = "guardian" | "trusted_contact" | "unknown";
 export function isUntrustedTrustClass(
   trustClass: TrustClass | undefined,
 ): boolean {
-  return trustClass === "trusted_contact" || trustClass === "unknown";
+  return (
+    trustClass === "trusted_contact" ||
+    trustClass === "unknown" ||
+    trustClass === undefined
+  );
 }
 
 /**

package/src/runtime/auth/route-policy.ts

@@ -358,6 +358,13 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "conversations/wipe", scopes: ["chat.write"] },
   { endpoint: "conversations/reorder", scopes: ["chat.write"] },
 
+  // Conversation groups
+  { endpoint: "groups:GET", scopes: ["chat.read"] },
+  { endpoint: "groups:POST", scopes: ["chat.write"] },
+  { endpoint: "groups:PATCH", scopes: ["chat.write"] },
+  { endpoint: "groups:DELETE", scopes: ["chat.write"] },
+  { endpoint: "groups/reorder", scopes: ["chat.write"] },
+
   // Conversation search
   { endpoint: "conversations/search", scopes: ["chat.read"] },