@vellumai/assistant 0.8.0 → 0.8.2

package/src/security/untrusted-content.ts

@@ -15,14 +15,23 @@
 // Types
 // ---------------------------------------------------------------------------
 
-export type UntrustedContentSource =
-  | "email"
-  | "slack"
-  | "web"
-  | "calendar"
-  | "webhook"
-  | "search"
-  | "tool_result";
+const UNTRUSTED_CONTENT_SOURCES = [
+  "email",
+  "slack",
+  "web",
+  "calendar",
+  "webhook",
+  "search",
+  "tool_result",
+] as const;
+
+export type UntrustedContentSource = (typeof UNTRUSTED_CONTENT_SOURCES)[number];
+
+export interface ExternalContentEnvelope {
+  source: UntrustedContentSource;
+  origin?: string;
+  content: string;
+}
 
 export interface WrapOptions {
   /** Which external source produced this content. */
@@ -47,6 +56,14 @@ const DEFAULT_BUDGETS: Record<UntrustedContentSource, number> = {
   tool_result: 20_000,
 };
 
+const UNTRUSTED_CONTENT_SOURCE_SET = new Set<string>(UNTRUSTED_CONTENT_SOURCES);
+
+const EXTERNAL_CONTENT_ENVELOPE_PATTERN =
+  /^<external_content\s+([^\r\n<>]*)>\n([\s\S]*)\n<\/external_content>$/;
+
+const EXTERNAL_CONTENT_ATTRIBUTE_PATTERN =
+  /(?:^|\s+)(source|origin)="([^"\r\n]*)"/g;
+
 // ---------------------------------------------------------------------------
 // Core API
 // ---------------------------------------------------------------------------
@@ -70,6 +87,31 @@ export function wrapUntrustedContent(
   return `<external_content source="${options.source}"${detail}>\n${truncated}\n</external_content>`;
 }
 
+export function parseExternalContentEnvelope(
+  value: string,
+): ExternalContentEnvelope | null {
+  const match = EXTERNAL_CONTENT_ENVELOPE_PATTERN.exec(value);
+  if (!match || match[0] !== value) {
+    return null;
+  }
+
+  const attributes = parseExternalContentAttributes(match[1]);
+  if (!attributes) {
+    return null;
+  }
+
+  const content = match[2];
+  if (/<\/external_content/gi.test(content)) {
+    return null;
+  }
+
+  return { ...attributes, content };
+}
+
+export function unwrapExternalContentForDisplay(value: string): string {
+  return parseExternalContentEnvelope(value)?.content ?? value;
+}
+
 /**
  * Escape sequences that could break out of the `<external_content>` wrapper.
  * Case-insensitive to cover mixed-case evasion attempts.
@@ -90,6 +132,49 @@ function sanitizeAttr(value: string): string {
   return value.replace(/[<>"&\r\n]/g, "").slice(0, 200);
 }
 
+function parseExternalContentAttributes(
+  attributes: string,
+): Pick<ExternalContentEnvelope, "source" | "origin"> | null {
+  let source: UntrustedContentSource | undefined;
+  let origin: string | undefined;
+  let originSeen = false;
+  let cursor = 0;
+
+  EXTERNAL_CONTENT_ATTRIBUTE_PATTERN.lastIndex = 0;
+  for (const match of attributes.matchAll(EXTERNAL_CONTENT_ATTRIBUTE_PATTERN)) {
+    if (match.index !== cursor) {
+      return null;
+    }
+
+    const [, name, value] = match;
+    if (name === "source") {
+      if (source || !isUntrustedContentSource(value)) {
+        return null;
+      }
+      source = value;
+    } else {
+      if (originSeen) {
+        return null;
+      }
+      originSeen = true;
+      origin = value;
+    }
+    cursor = match.index + match[0].length;
+  }
+
+  if (cursor !== attributes.length || !source) {
+    return null;
+  }
+
+  return originSeen ? { source, origin } : { source };
+}
+
+function isUntrustedContentSource(
+  value: string,
+): value is UntrustedContentSource {
+  return UNTRUSTED_CONTENT_SOURCE_SET.has(value);
+}
+
 /** Truncate content to a character budget, appending a notice if truncated. */
 function truncateWithNotice(content: string, maxChars: number): string {
   if (content.length <= maxChars) {

package/src/sequence/engine.ts

@@ -6,10 +6,8 @@
  * sends through the messaging layer.
  */
 
-import { emitFeedEvent } from "../home/emit-feed-event.js";
-import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { getMessages } from "../memory/conversation-crud.js";
-import type { ScheduleMessageProcessor } from "../schedule/scheduler-types.js";
+import { runBackgroundJob } from "../runtime/background-job-runner.js";
 import { getLogger } from "../util/logger.js";
 import { recordEvent } from "./analytics.js";
 import { checkAllPreSend, recordSend } from "./guardrails.js";
@@ -28,14 +26,13 @@ const log = getLogger("sequence-engine");
 
 const BATCH_SIZE = 10;
 const ERROR_RETRY_DELAY_MS = 60_000;
+const STEP_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes per step
 
 /**
  * Process due sequence enrollments. Called by the scheduler on each tick.
  * Returns the number of enrollments processed.
  */
-export async function runSequencesOnce(
-  processMessage: ScheduleMessageProcessor,
-): Promise<number> {
+export async function runSequencesOnce(): Promise<number> {
   const now = Date.now();
   const claimed = claimDueEnrollments(now, BATCH_SIZE);
   if (claimed.length === 0) return 0;
@@ -43,7 +40,7 @@ export async function runSequencesOnce(
   let processed = 0;
   for (const enrollment of claimed) {
     try {
-      await processEnrollment(enrollment, processMessage);
+      await processEnrollment(enrollment);
       processed += 1;
     } catch (err) {
       log.error(
@@ -83,7 +80,6 @@ export async function runSequencesOnce(
 
 async function processEnrollment(
   enrollment: SequenceEnrollment,
-  processMessage: ScheduleMessageProcessor,
 ): Promise<void> {
   const sequence = getSequence(enrollment.sequenceId);
   if (!sequence) {
@@ -146,30 +142,54 @@ async function processEnrollment(
   // Build the prompt for the assistant to generate and send the email
   const prompt = buildStepPrompt(enrollment, sequence, step);
 
-  // Create a conversation for this step execution
-  const conversation = bootstrapConversation({
-    source: "sequence",
-    origin: "sequence",
-    systemHint: `Sequence: ${sequence.name} — Step ${step.index + 1}`,
-  });
-
   log.info(
     {
       enrollmentId: enrollment.id,
       sequenceId: sequence.id,
       step: step.index,
       contactEmail: enrollment.contactEmail,
-      conversationId: conversation.id,
     },
     "Processing sequence step",
   );
 
-  await processMessage(conversation.id, prompt);
+  const result = await runBackgroundJob({
+    jobName: "sequence-step",
+    source: "sequence",
+    prompt,
+    systemHint: `Sequence: ${sequence.name} — Step ${step.index + 1}`,
+    trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
+    callSite: "mainAgent",
+    timeoutMs: STEP_TIMEOUT_MS,
+    origin: "sequence",
+  });
+
+  if (!result.ok) {
+    // Timeouts do not cancel the in-flight `processMessage`, so retrying
+    // could double-send. Exit the enrollment instead of rescheduling.
+    if (result.errorKind === "timeout") {
+      log.error(
+        {
+          enrollmentId: enrollment.id,
+          sequenceId: sequence.id,
+          step: step.index,
+        },
+        "Sequence step timed out — exiting enrollment to prevent duplicate outreach",
+      );
+      recordEvent(sequence.id, enrollment.id, "fail", step.index, {
+        reason: "step_timeout",
+      });
+      exitEnrollment(enrollment.id, "failed");
+      return;
+    }
+    throw (
+      result.error ?? new Error(`Background job failed: ${result.errorKind}`)
+    );
+  }
 
   // Try to extract the email thread ID from conversation tool results so
   // subsequent steps can reply in the same conversation.
   const extractedConversationId =
-    extractThreadIdFromConversation(conversation.id) ?? undefined;
+    extractThreadIdFromConversation(result.conversationId) ?? undefined;
   if (extractedConversationId) {
     log.info(
       { enrollmentId: enrollment.id, conversationId: extractedConversationId },
@@ -201,28 +221,6 @@ async function processEnrollment(
   recordSend(sequence.id);
   recordEvent(sequence.id, enrollment.id, "send", step.index);
 
-  // Fire-and-forget home-feed activity log entry. Each (enrollment,
-  // step) pair is a distinct real signal (an email actually went
-  // out), so the dedupKey embeds both — repeat emits for the same
-  // step are impossible because the enrollment advances after this
-  // line, but if they did occur they'd land on the same entry.
-  void emitFeedEvent({
-    source: "assistant",
-    title: sequence.name,
-    summary: `Sent step ${step.index + 1} of ${sequence.steps.length} to ${enrollment.contactEmail}.`,
-    dedupKey: `sequence-step:${enrollment.id}:${step.index}`,
-  }).catch((err) => {
-    log.warn(
-      {
-        err,
-        sequenceId: sequence.id,
-        enrollmentId: enrollment.id,
-        step: step.index,
-      },
-      "Failed to emit sequence step feed event",
-    );
-  });
-
   // Advance to the next step
   const nextStepIndex = enrollment.currentStep + 1;
   if (nextStepIndex >= sequence.steps.length) {

package/src/skills/catalog-files.ts

@@ -501,7 +501,7 @@ export function catalogSkillToSlim(cs: CatalogSkill): SlimSkillResponse {
     id: cs.id,
     name: cs.metadata?.vellum?.["display-name"] ?? cs.name,
     description: cs.description,
-    emoji: cs.emoji,
+    emoji: cs.emoji ?? cs.metadata?.emoji,
     kind: "catalog",
     origin: "vellum",
     status: "available",