@vellumai/assistant 0.6.6 → 0.7.0

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -62,7 +62,6 @@ export interface GuardianCallbackDecisionParams {
   sourceChannel: ChannelId;
   actorExternalId: string;
   replyCallbackUrl: string;
-  bearerToken?: string;
   assistantId: string;
   approvalCopyGenerator?: ApprovalCopyGenerator;
   approvalConversationGenerator?: ApprovalConversationGenerator;
@@ -95,7 +94,6 @@ export async function handleGuardianCallbackDecision(
     sourceChannel,
     actorExternalId,
     replyCallbackUrl,
-    bearerToken,
     assistantId,
     approvalCopyGenerator,
     approvalConversationGenerator,
@@ -147,7 +145,6 @@ export async function handleGuardianCallbackDecision(
         replyCallbackUrl,
         chatId: conversationExternalId,
         assistantId,
-        bearerToken,
         approvalCopyGenerator,
         logger: log,
         errorLogMessage:
@@ -202,7 +199,6 @@ export async function handleGuardianCallbackDecision(
       replyCallbackUrl,
       chatId: conversationExternalId,
       assistantId,
-      bearerToken,
       approvalCopyGenerator,
       logger: log,
       errorLogMessage: "Failed to deliver guardian identity rejection notice",
@@ -220,7 +216,6 @@ export async function handleGuardianCallbackDecision(
       sourceChannel,
       replyCallbackUrl,
       assistantId,
-      bearerToken,
       approvalCopyGenerator,
       approvalMessageTs,
     });
@@ -251,7 +246,6 @@ export async function handleGuardianCallbackDecision(
       replyCallbackUrl,
       content,
       assistantId,
-      bearerToken,
       approvalCopyGenerator,
       approvalConversationGenerator,
     });
@@ -288,7 +282,7 @@ export async function handleGuardianCallbackDecision(
         fallbackPayload.ephemeral = true;
         fallbackPayload.user = guardianFallbackEphemeral;
       }
-      await deliverChannelReply(replyCallbackUrl, fallbackPayload, bearerToken);
+      await deliverChannelReply(replyCallbackUrl, fallbackPayload);
     } catch (err) {
       log.error(
         { err, conversationExternalId },
@@ -313,7 +307,6 @@ async function handleCallbackDecision(params: {
   sourceChannel: ChannelId;
   replyCallbackUrl: string;
   assistantId: string;
-  bearerToken?: string;
   approvalCopyGenerator?: ApprovalCopyGenerator;
   approvalMessageTs?: string;
 }): Promise<ApprovalInterceptionResult> {
@@ -324,7 +317,6 @@ async function handleCallbackDecision(params: {
     sourceChannel,
     replyCallbackUrl,
     assistantId,
-    bearerToken,
     approvalCopyGenerator,
     approvalMessageTs,
   } = params;
@@ -339,15 +331,13 @@ async function handleCallbackDecision(params: {
       actorExternalId,
       replyCallbackUrl,
       assistantId,
-      bearerToken,
     );
     return accessResult;
   }
 
   // Apply the decision through the unified guardian decision primitive.
-  // The primitive handles approve_always downgrade, approval info capture,
-  // record update, and scoped grant minting.
-  const result = applyGuardianDecision({
+  // The primitive handles approval info capture, record update, and scoped grant minting.
+  const result = await applyGuardianDecision({
     approval: guardianApproval,
     decision: callbackDecision,
     actorPrincipalId: undefined, // Callback path — principal not available at this layer
@@ -357,12 +347,8 @@ async function handleCallbackDecision(params: {
 
   if (result.applied) {
     // Notify the requester's chat about the outcome with the tool name
-    const effectiveAction =
-      callbackDecision.action === "approve_always"
-        ? "approve_once"
-        : callbackDecision.action;
     const decisionOutcome: "approved" | "denied" =
-      effectiveAction === "reject" ? "denied" : "approved";
+      callbackDecision.action === "reject" ? "denied" : "approved";
     const outcomeText = await composeApprovalMessageGenerative(
       {
         scenario: "guardian_decision_outcome",
@@ -387,7 +373,7 @@ async function handleCallbackDecision(params: {
         outcomePayload.ephemeral = true;
         outcomePayload.user = requesterEphemeral;
       }
-      await deliverChannelReply(replyCallbackUrl, outcomePayload, bearerToken);
+      await deliverChannelReply(replyCallbackUrl, outcomePayload);
     } catch (err) {
       log.error(
         { err, conversationId: guardianApproval.conversationId },
@@ -405,7 +391,6 @@ async function handleCallbackDecision(params: {
         messageTs: approvalMessageTs,
         decision: decisionOutcome,
         assistantId,
-        bearerToken,
         conversationId: guardianApproval.conversationId,
       });
     }
@@ -433,7 +418,6 @@ async function handleCallbackDecision(params: {
       messageTs: approvalMessageTs,
       decision: resolvedStatus,
       assistantId,
-      bearerToken,
       conversationId: guardianApproval.conversationId,
     });
   }
@@ -441,17 +425,13 @@ async function handleCallbackDecision(params: {
   // Deliver a visible ephemeral error so the user sees feedback (JARVIS-299).
   if (sourceChannel === "slack") {
     try {
-      await deliverChannelReply(
-        replyCallbackUrl,
-        {
-          chatId: guardianApproval.guardianChatId,
-          text: "This approval request has already been resolved.",
-          assistantId,
-          ephemeral: true,
-          user: actorExternalId,
-        },
-        bearerToken,
-      );
+      await deliverChannelReply(replyCallbackUrl, {
+        chatId: guardianApproval.guardianChatId,
+        text: "This approval request has already been resolved.",
+        assistantId,
+        ephemeral: true,
+        user: actorExternalId,
+      });
     } catch (err) {
       log.error(
         { err, conversationId: guardianApproval.conversationId },
@@ -477,7 +457,6 @@ async function handleConversationalDecision(params: {
   replyCallbackUrl: string;
   content: string;
   assistantId: string;
-  bearerToken?: string;
   approvalCopyGenerator?: ApprovalCopyGenerator;
   approvalConversationGenerator: ApprovalConversationGenerator;
 }): Promise<ApprovalInterceptionResult> {
@@ -491,7 +470,6 @@ async function handleConversationalDecision(params: {
     replyCallbackUrl,
     content,
     assistantId,
-    bearerToken,
     approvalCopyGenerator,
     approvalConversationGenerator,
   } = params;
@@ -529,11 +507,7 @@ async function handleConversationalDecision(params: {
         keepPendingPayload.ephemeral = true;
         keepPendingPayload.user = guardianEphemeral;
       }
-      await deliverChannelReply(
-        replyCallbackUrl,
-        keepPendingPayload,
-        bearerToken,
-      );
+      await deliverChannelReply(replyCallbackUrl, keepPendingPayload);
     } catch (err) {
       log.error(
         { err, conversationId: guardianApproval.conversationId },
@@ -544,18 +518,7 @@ async function handleConversationalDecision(params: {
   }
 
   // Decision-bearing disposition from the engine
-  let decisionAction = engineResult.disposition as ApprovalAction;
-
-  // Belt-and-suspenders: guardians cannot use broad allow modes even if
-  // the engine returns them (the engine's allowedActions validation should
-  // already prevent this, but enforce it here too).
-  if (
-    decisionAction === "approve_always" ||
-    decisionAction === "approve_10m" ||
-    decisionAction === "approve_conversation"
-  ) {
-    decisionAction = "approve_once";
-  }
+  const decisionAction = engineResult.disposition as ApprovalAction;
 
   // Resolve the target approval: use targetRequestId from the engine if
   // provided, otherwise use the single guardian approval.
@@ -585,7 +548,6 @@ async function handleConversationalDecision(params: {
       replyCallbackUrl,
       chatId: conversationExternalId,
       assistantId,
-      bearerToken,
       approvalCopyGenerator,
       logger: log,
       errorLogMessage:
@@ -604,7 +566,6 @@ async function handleConversationalDecision(params: {
       actorExternalId,
       replyCallbackUrl,
       assistantId,
-      bearerToken,
     );
     return accessResult;
   }
@@ -618,7 +579,7 @@ async function handleConversationalDecision(params: {
   };
 
   // Apply the decision through the unified guardian decision primitive.
-  const result = applyGuardianDecision({
+  const result = await applyGuardianDecision({
     approval: targetApproval,
     decision: engineDecision,
     actorPrincipalId: undefined, // Callback path — principal not available at this layer
@@ -653,11 +614,7 @@ async function handleConversationalDecision(params: {
         requesterOutcomePayload.ephemeral = true;
         requesterOutcomePayload.user = requesterEphemeral;
       }
-      await deliverChannelReply(
-        replyCallbackUrl,
-        requesterOutcomePayload,
-        bearerToken,
-      );
+      await deliverChannelReply(replyCallbackUrl, requesterOutcomePayload);
     } catch (err) {
       log.error(
         { err, conversationId: targetApproval.conversationId },
@@ -680,11 +637,7 @@ async function handleConversationalDecision(params: {
         guardianReplyPayload.ephemeral = true;
         guardianReplyPayload.user = guardianEphemeral;
       }
-      await deliverChannelReply(
-        replyCallbackUrl,
-        guardianReplyPayload,
-        bearerToken,
-      );
+      await deliverChannelReply(replyCallbackUrl, guardianReplyPayload);
     } catch (err) {
       log.error(
         { err, conversationId: targetApproval.conversationId },
@@ -703,7 +656,6 @@ async function handleConversationalDecision(params: {
     replyCallbackUrl,
     chatId: conversationExternalId,
     assistantId,
-    bearerToken,
     approvalCopyGenerator,
     logger: log,
     errorLogMessage: "Failed to deliver stale guardian approval notice",
@@ -732,7 +684,6 @@ function editSlackApprovalMessage(params: {
   messageTs: string;
   decision: "approved" | "denied";
   assistantId: string;
-  bearerToken?: string;
   conversationId: string;
 }): void {
   const {
@@ -741,7 +692,6 @@ function editSlackApprovalMessage(params: {
     messageTs,
     decision,
     assistantId,
-    bearerToken,
     conversationId,
   } = params;
 
@@ -764,17 +714,13 @@ function editSlackApprovalMessage(params: {
     },
   ];
 
-  deliverChannelReply(
-    replyCallbackUrl,
-    {
-      chatId,
-      text: statusText,
-      blocks,
-      messageTs,
-      assistantId,
-    },
-    bearerToken,
-  ).catch((err) => {
+  deliverChannelReply(replyCallbackUrl, {
+    chatId,
+    text: statusText,
+    blocks,
+    messageTs,
+    assistantId,
+  }).catch((err) => {
     log.error(
       { err, conversationId, messageTs },
       "Failed to edit Slack approval message after resolution",
@@ -802,7 +748,6 @@ async function handleAccessRequestApproval(
   decidedByExternalUserId: string,
   replyCallbackUrl: string,
   assistantId: string,
-  bearerToken?: string,
 ): Promise<ApprovalInterceptionResult> {
   const decisionResult = handleAccessRequestDecision(
     approval,
@@ -838,7 +783,6 @@ async function handleAccessRequestApproval(
       replyCallbackUrl,
       requesterChatId: approval.requesterChatId,
       assistantId,
-      bearerToken,
       channel: approval.channel,
       requesterExternalUserId: approval.requesterExternalUserId,
     });
@@ -898,7 +842,6 @@ async function handleAccessRequestApproval(
         requesterIdentifier,
         verificationCode: decisionResult.verificationCode,
         assistantId,
-        bearerToken,
       });
     if (!deliveryResult.ok) {
       log.error(
@@ -923,7 +866,6 @@ async function handleAccessRequestApproval(
       requesterChatId: approval.requesterChatId,
       verificationCode: decisionResult.verificationCode,
       assistantId,
-      bearerToken,
       channel: approval.channel,
       requesterExternalUserId: approval.requesterExternalUserId,
     });
@@ -945,7 +887,6 @@ async function handleAccessRequestApproval(
       replyCallbackUrl,
       requesterChatId: approval.requesterChatId,
       assistantId,
-      bearerToken,
       channel: approval.channel,
       requesterExternalUserId: approval.requesterExternalUserId,
     });
@@ -955,7 +896,6 @@ async function handleAccessRequestApproval(
       replyCallbackUrl,
       requesterChatId: approval.requesterChatId,
       assistantId,
-      bearerToken,
       channel: approval.channel,
       requesterExternalUserId: approval.requesterExternalUserId,
     });

package/src/runtime/routes/approval-strategies/guardian-text-engine-strategy.ts

@@ -40,7 +40,6 @@ export interface TextEngineDecisionParams {
   replyCallbackUrl: string;
   content: string;
   assistantId: string;
-  bearerToken?: string;
   approvalCopyGenerator?: ApprovalCopyGenerator;
   approvalConversationGenerator: ApprovalConversationGenerator;
   /** Pending approval info for this conversation. */
@@ -66,7 +65,6 @@ export async function handleGuardianTextEngineDecision(
     replyCallbackUrl,
     content,
     assistantId,
-    bearerToken,
     approvalCopyGenerator,
     approvalConversationGenerator,
     pending,
@@ -103,11 +101,7 @@ export async function handleGuardianTextEngineDecision(
         keepPendingPayload.ephemeral = true;
         keepPendingPayload.user = ephemeral;
       }
-      await deliverChannelReply(
-        replyCallbackUrl,
-        keepPendingPayload,
-        bearerToken,
-      );
+      await deliverChannelReply(replyCallbackUrl, keepPendingPayload);
     } catch (err) {
       log.error(
         { err, conversationId },
@@ -127,7 +121,7 @@ export async function handleGuardianTextEngineDecision(
       : {}),
   };
 
-  const result = handleChannelDecision(conversationId, engineDecision);
+  const result = await handleChannelDecision(conversationId, engineDecision);
 
   if (result.applied) {
     // Deliver the engine's reply text to the user
@@ -142,7 +136,7 @@ export async function handleGuardianTextEngineDecision(
         decisionPayload.ephemeral = true;
         decisionPayload.user = ephemeral;
       }
-      await deliverChannelReply(replyCallbackUrl, decisionPayload, bearerToken);
+      await deliverChannelReply(replyCallbackUrl, decisionPayload);
     } catch (err) {
       log.error(
         { err, conversationId },
@@ -162,7 +156,6 @@ export async function handleGuardianTextEngineDecision(
     replyCallbackUrl,
     chatId: conversationExternalId,
     assistantId,
-    bearerToken,
     approvalCopyGenerator,
     logger: log,
     errorLogMessage: "Failed to deliver stale approval notice",