@vellumai/assistant 0.8.0 → 0.8.2

package/src/daemon/handlers/config-model.ts

@@ -1,38 +1,16 @@
+import { resolveCallSiteConfig } from "../../config/llm-resolver.js";
 import {
   getConfig,
   loadRawConfig,
   saveRawConfig,
 } from "../../config/loader.js";
-import {
-  setLlmDefaultField,
-  setServiceField,
-} from "../../config/raw-config-utils.js";
-import { VALID_INFERENCE_PROVIDERS } from "../../config/schemas/services.js";
+import { setServiceField } from "../../config/raw-config-utils.js";
 import { providerForImageModelPrefix } from "../../media/types.js";
 import type { ProviderCatalogEntry } from "../../providers/model-catalog.js";
-import {
-  isModelInCatalog,
-  PROVIDER_CATALOG,
-} from "../../providers/model-catalog.js";
-import { getProviderDefaultModel } from "../../providers/model-intents.js";
-import {
-  getConfiguredProviders,
-  isProviderAvailable,
-} from "../../providers/provider-availability.js";
-import { initializeProviders } from "../../providers/registry.js";
-import {
-  conversationEntries,
-  deleteConversation,
-} from "../conversation-store.js";
+import { getConfiguredProviders } from "../../providers/provider-availability.js";
+import { getVisibleProviderCatalog } from "../../providers/provider-catalog-visibility.js";
 import { CONFIG_RELOAD_DEBOUNCE_MS, log } from "./shared.js";
 
-/** Reverse lookup: model ID → provider, derived from PROVIDER_CATALOG. */
-const MODEL_TO_PROVIDER: Record<string, string> = Object.fromEntries(
-  PROVIDER_CATALOG.flatMap((provider) =>
-    provider.models.map(({ id }) => [id, provider.id]),
-  ),
-);
-
 // ---------------------------------------------------------------------------
 // Shared business logic (transport-agnostic)
 // ---------------------------------------------------------------------------
@@ -85,21 +63,23 @@ export function projectProviderForWire(
 /** Return current model configuration. */
 export async function getModelInfo(): Promise<ModelInfo> {
   const config = getConfig();
-  const provider = config.llm.default.provider;
+  const resolved = resolveCallSiteConfig("mainAgent", config.llm);
+  const provider = resolved.provider;
+  const visibleCatalog = getVisibleProviderCatalog(config);
 
   return {
-    model: config.llm.default.model,
+    model: resolved.model,
     provider,
     configuredProviders: await getConfiguredProviders(),
-    availableModels: PROVIDER_CATALOG.find(
-      (p) => p.id === provider,
-    )?.models?.map((m) => ({ id: m.id, displayName: m.displayName })),
-    allProviders: PROVIDER_CATALOG.map(projectProviderForWire),
+    availableModels: visibleCatalog
+      .find((p) => p.id === provider)
+      ?.models?.map((m) => ({ id: m.id, displayName: m.displayName })),
+    allProviders: visibleCatalog.map(projectProviderForWire),
   };
 }
 
 /**
- * Minimal interface for the side-effects needed by setModel / setImageGenModel.
+ * Minimal interface for the side-effects needed by setImageGenModel.
  * Keeps the business logic decoupled from transport-specific server context.
  */
 export interface ModelSetContext {
@@ -109,103 +89,6 @@ export interface ModelSetContext {
   debounceTimers: { schedule(key: string, fn: () => void, ms: number): void };
 }
 
-/**
- * Set the active model. Returns the resulting ModelInfo, or throws on failure.
- * The caller is responsible for sending the response to the client.
- *
- * When `explicitProvider` is supplied, it takes precedence over automatic
- * provider inference from the model ID. If the provider changes and the
- * current model doesn't belong to the new provider's catalog, the model
- * is auto-reset to the provider's default.
- */
-export async function setModel(
-  modelId: string,
-  ctx: ModelSetContext,
-  explicitProvider?: string,
-): Promise<ModelInfo> {
-  const validProviders = new Set<string>(VALID_INFERENCE_PROVIDERS);
-
-  // Validate explicit provider against allowlist
-  if (explicitProvider && !validProviders.has(explicitProvider)) {
-    throw new Error(
-      `Invalid provider "${explicitProvider}". Valid providers: ${[...validProviders].join(", ")}`,
-    );
-  }
-
-  // Resolve provider: explicit > MODEL_TO_PROVIDER lookup > current
-  const current = getConfig();
-  const resolvedProvider =
-    explicitProvider ??
-    MODEL_TO_PROVIDER[modelId] ??
-    current.llm.default.provider;
-
-  // Auto-reset model when provider changes and current modelId doesn't
-  // belong to the new provider's catalog.
-  if (
-    resolvedProvider !== current.llm.default.provider &&
-    !isModelInCatalog(resolvedProvider, modelId)
-  ) {
-    modelId = getProviderDefaultModel(resolvedProvider);
-  }
-
-  // No-op guard: skip expensive reinitialization when nothing changed
-  if (
-    modelId === current.llm.default.model &&
-    resolvedProvider === current.llm.default.provider
-  ) {
-    return await getModelInfo();
-  }
-
-  // Validate provider availability (secure key, env var, or managed proxy) before switching
-  if (!(await isProviderAvailable(resolvedProvider))) {
-    // Return current model_info so the client resyncs its optimistic state
-    return await getModelInfo();
-  }
-
-  // Use raw config to avoid persisting env-var API keys to disk
-  const raw = loadRawConfig();
-  setLlmDefaultField(raw, "model", modelId);
-  setLlmDefaultField(raw, "provider", resolvedProvider);
-
-  // Suppress the file watcher callback — setModel already does
-  // the full reload sequence; a redundant watcher-triggered reload
-  // would incorrectly evict sessions created after this method returns.
-  const wasSuppressed = ctx.suppressConfigReload;
-  ctx.setSuppressConfigReload(true);
-  try {
-    saveRawConfig(raw);
-  } catch (err) {
-    ctx.setSuppressConfigReload(wasSuppressed);
-    throw err;
-  }
-  ctx.debounceTimers.schedule(
-    "__suppress_reset__",
-    () => {
-      ctx.setSuppressConfigReload(false);
-    },
-    CONFIG_RELOAD_DEBOUNCE_MS,
-  );
-
-  // Re-initialize provider with the new model so LLM calls use it
-  const config = getConfig();
-  await initializeProviders(config);
-
-  // Evict idle conversations immediately; mark busy ones as stale so they
-  // get recreated with the new provider once they finish processing.
-  for (const [id, conversation] of conversationEntries()) {
-    if (!conversation.isProcessing()) {
-      conversation.dispose();
-      deleteConversation(id);
-    } else {
-      conversation.markStale();
-    }
-  }
-
-  ctx.updateConfigFingerprint();
-
-  return await getModelInfo();
-}
-
 /**
  * Set the image generation model. Throws on failure.
  */

package/src/daemon/handlers/config-slack-channel.ts

@@ -34,6 +34,7 @@ export interface SlackChannelConfigResult {
   connected: boolean;
   teamId?: string;
   teamName?: string;
+  teamUrl?: string;
   botUserId?: string;
   botUsername?: string;
   error?: string;
@@ -54,6 +55,7 @@ const SLACK_INJECTION_TEMPLATES = [
 /** Ensure the bot token credential has injection templates for the proxy. */
 function ensureBotTokenInjectionTemplates(): void {
   upsertCredentialMetadata("slack_channel", "bot_token", {
+    allowedTools: ["bash"],
     allowedDomains: ["slack.com"],
     injectionTemplates: SLACK_INJECTION_TEMPLATES,
   });
@@ -62,6 +64,7 @@ function ensureBotTokenInjectionTemplates(): void {
 /** Ensure the user token credential has injection templates for the proxy. */
 function ensureUserTokenInjectionTemplates(): void {
   upsertCredentialMetadata("slack_channel", "user_token", {
+    allowedTools: ["bash"],
     allowedDomains: ["slack.com"],
     injectionTemplates: SLACK_INJECTION_TEMPLATES,
   });
@@ -91,7 +94,8 @@ export function backfillSlackInjectionTemplates(): void {
 // -- Business logic --
 
 export async function getSlackChannelConfig(): Promise<SlackChannelConfigResult> {
-  const { teamId, teamName, botUserId, botUsername } = getConfig().slack;
+  const { teamId, teamName, teamUrl, botUserId, botUsername } =
+    getConfig().slack;
   const accountInfo = teamName
     ? `${teamName}${botUsername ? ` (@${botUsername})` : ""}`
     : undefined;
@@ -127,6 +131,7 @@ export async function getSlackChannelConfig(): Promise<SlackChannelConfigResult>
     connected,
     ...(teamId ? { teamId } : {}),
     ...(teamName ? { teamName } : {}),
+    ...(teamUrl ? { teamUrl } : {}),
     ...(botUserId ? { botUserId } : {}),
     ...(botUsername ? { botUsername } : {}),
   };
@@ -167,6 +172,7 @@ export async function setSlackChannelConfig(
   let metadata: {
     teamId?: string;
     teamName?: string;
+    teamUrl?: string;
     botUserId?: string;
     botUsername?: string;
   } = {};
@@ -185,6 +191,7 @@ export async function setSlackChannelConfig(
         error?: string;
         team_id?: string;
         team?: string;
+        url?: string;
         user_id?: string;
         user?: string;
       };
@@ -196,6 +203,7 @@ export async function setSlackChannelConfig(
       metadata = {
         teamId: data.team_id,
         teamName: data.team,
+        teamUrl: data.url,
         botUserId: data.user_id,
         botUsername: data.user,
       };
@@ -209,7 +217,9 @@ export async function setSlackChannelConfig(
       botToken,
     );
     if (!stored) {
-      return currentErrorSnapshot("Failed to store bot token in secure storage");
+      return currentErrorSnapshot(
+        "Failed to store bot token in secure storage",
+      );
     }
 
     ensureBotTokenInjectionTemplates();
@@ -217,6 +227,7 @@ export async function setSlackChannelConfig(
     const raw = loadRawConfig();
     setNestedValue(raw, "slack.teamId", metadata.teamId ?? "");
     setNestedValue(raw, "slack.teamName", metadata.teamName ?? "");
+    setNestedValue(raw, "slack.teamUrl", metadata.teamUrl ?? "");
     setNestedValue(raw, "slack.botUserId", metadata.botUserId ?? "");
     setNestedValue(raw, "slack.botUsername", metadata.botUsername ?? "");
     saveRawConfig(raw);
@@ -262,8 +273,7 @@ export async function setSlackChannelConfig(
           data.team_id !== metadata.teamId
         ) {
           shouldClear = true;
-          clearReason =
-            "User token from a different workspace was removed.";
+          clearReason = "User token from a different workspace was removed.";
         }
       } catch (err) {
         // Transient failure (DNS error, network blip, connection reset,
@@ -290,10 +300,12 @@ export async function setSlackChannelConfig(
     }
   } else {
     // Use existing metadata from config if no new bot token provided
-    const { teamId, teamName, botUserId, botUsername } = getConfig().slack;
+    const { teamId, teamName, teamUrl, botUserId, botUsername } =
+      getConfig().slack;
     metadata = {
       ...(teamId ? { teamId } : {}),
       ...(teamName ? { teamName } : {}),
+      ...(teamUrl ? { teamUrl } : {}),
       ...(botUserId ? { botUserId } : {}),
       ...(botUsername ? { botUsername } : {}),
     };
@@ -310,7 +322,9 @@ export async function setSlackChannelConfig(
       appToken,
     );
     if (!stored) {
-      return currentErrorSnapshot("Failed to store app token in secure storage");
+      return currentErrorSnapshot(
+        "Failed to store app token in secure storage",
+      );
     }
 
     upsertCredentialMetadata("slack_channel", "app_token", {});
@@ -344,9 +358,7 @@ export async function setSlackChannelConfig(
       userTeamId = data.team_id;
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      return currentErrorSnapshot(
-        `Failed to validate user token: ${message}`,
-      );
+      return currentErrorSnapshot(`Failed to validate user token: ${message}`);
     }
 
     // Cross-check: if a bot token has already been configured, the user token
@@ -465,7 +477,8 @@ export async function clearSlackUserToken(): Promise<SlackChannelConfigResult> {
     credentialKey("slack_channel", "app_token"),
   ));
   const conn = getConnectionByProvider("slack_channel");
-  const { teamId, teamName, botUserId, botUsername } = getConfig().slack;
+  const { teamId, teamName, teamUrl, botUserId, botUsername } =
+    getConfig().slack;
 
   return {
     success: true,
@@ -476,6 +489,7 @@ export async function clearSlackUserToken(): Promise<SlackChannelConfigResult> {
       !!(conn && conn.status === "active") && hasBotToken && hasAppToken,
     ...(teamId ? { teamId } : {}),
     ...(teamName ? { teamName } : {}),
+    ...(teamUrl ? { teamUrl } : {}),
     ...(botUserId ? { botUserId } : {}),
     ...(botUsername ? { botUsername } : {}),
   };
@@ -525,6 +539,7 @@ export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResul
   const raw = loadRawConfig();
   setNestedValue(raw, "slack.teamId", "");
   setNestedValue(raw, "slack.teamName", "");
+  setNestedValue(raw, "slack.teamUrl", "");
   setNestedValue(raw, "slack.botUserId", "");
   setNestedValue(raw, "slack.botUsername", "");
   saveRawConfig(raw);

package/src/daemon/handlers/config-vercel.ts

@@ -59,7 +59,9 @@ export async function setVercelConfig(
   }
 
   upsertCredentialMetadata("vercel", "api_token", {
-    allowedTools: ["deploy", "publish_page"],
+    allowedTools: ["publish_page", "unpublish_page"],
+    allowedDomains: [],
+    injectionTemplates: null,
   });
 
   log.info("Vercel API token stored successfully");

package/src/daemon/handlers/shared.ts

@@ -6,6 +6,7 @@ import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
 import { isPlaceholderSentinelText } from "../../providers/anthropic/client.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
+import { unwrapExternalContentForDisplay } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
 import type { ConversationTransportMetadata } from "../message-protocol.js";
@@ -120,6 +121,8 @@ export interface SlackInboundMessageMetadata {
   threadTs?: string;
   /** Resolved sender label (display name preferred, username fallback). */
   displayName?: string;
+  /** Canonical Slack external user id for the sender, when available. */
+  actorExternalUserId?: string;
 }
 
 /**
@@ -143,6 +146,11 @@ export interface ConversationCreateOptions {
   isInteractive?: boolean;
   /** Slack-only non-persisted notice injected into the active model turn. */
   slackRuntimeContextNotice?: string;
+  /**
+   * Persisted user-facing content. When present, storage/UI use this value
+   * while the model-facing turn continues to use `content`.
+   */
+  displayContent?: string;
   /** Channel command intent metadata (e.g. Telegram /start). */
   commandIntent?: { type: string; payload?: string; languageCode?: string };
 
@@ -219,7 +227,7 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
     } else if (typeof content === "object") {
       text = JSON.stringify(content);
     } else {
-      text = String(content);
+      text = unwrapExternalContentForDisplay(String(content));
     }
     return {
       text,
@@ -324,20 +332,21 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
     }
 
     if (block.type === "text" && typeof block.text === "string") {
+      const displayText = unwrapExternalContentForDisplay(block.text);
       // Skip empty/whitespace-only text blocks. During streaming the client
       // discards empty text deltas (guard !text.isEmpty), so including them
       // here produces a contentOrder that differs from the live streaming
       // path — e.g. empty segments between consecutive tool_use blocks that
       // break tool-call grouping in the UI.
-      if (block.text.trim().length === 0) continue;
+      if (displayText.trim().length === 0) continue;
       // Drop Anthropic provider placeholder sentinels. These are injected
       // into outbound API requests to preserve role alternation and must
       // never be rendered to users. Belt-and-suspenders with the persist-
       // time filter in cleanAssistantContent and migration 222.
-      if (isPlaceholderSentinelText(block.text)) continue;
-      textParts.push(block.text);
+      if (isPlaceholderSentinelText(displayText)) continue;
+      textParts.push(displayText);
       ensureSegment();
-      currentSegmentParts.push(block.text);
+      currentSegmentParts.push(displayText);
       seenText = true;
       continue;
     }