@vellumai/assistant 0.8.1 → 0.8.3

package/src/runtime/routes/workspace-routes.ts

@@ -18,6 +18,7 @@ import { basename, dirname, join } from "node:path";
 import { z } from "zod";
 
 import { getWorkspaceDir } from "../../util/platform.js";
+import { publishSoundsConfigUpdated } from "../sync/resource-sync-events.js";
 import {
   BadRequestError,
   ConflictError,
@@ -41,6 +42,29 @@ interface TreeEntry {
   modifiedAt: string;
 }
 
+const SOUNDS_WORKSPACE_PATH = "data/sounds";
+
+function normaliseWorkspacePathForSync(path: string): string {
+  return path
+    .split(/[\\/]+/)
+    .filter((part) => part.length > 0)
+    .join("/");
+}
+
+function isSoundsWorkspacePath(path: string): boolean {
+  const normalized = normaliseWorkspacePathForSync(path);
+  return (
+    normalized === SOUNDS_WORKSPACE_PATH ||
+    normalized.startsWith(`${SOUNDS_WORKSPACE_PATH}/`)
+  );
+}
+
+function publishSoundsConfigUpdatedForPaths(paths: string[]): void {
+  if (paths.some(isSoundsWorkspacePath)) {
+    publishSoundsConfigUpdated();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // GET /v1/workspace/tree — list directory contents
 // ---------------------------------------------------------------------------
@@ -268,6 +292,7 @@ function handleWorkspaceWrite({ body }: RouteHandlerArgs) {
 
   mkdirSync(dirname(resolved), { recursive: true });
   writeFileSync(resolved, buffer);
+  publishSoundsConfigUpdatedForPaths([path]);
 
   return { path, size: buffer.byteLength };
 }
@@ -295,6 +320,7 @@ function handleWorkspaceMkdir({ body }: RouteHandlerArgs) {
   }
 
   mkdirSync(resolved, { recursive: true });
+  publishSoundsConfigUpdatedForPaths([path]);
   return { path };
 }
 
@@ -334,6 +360,7 @@ function handleWorkspaceRename({ body }: RouteHandlerArgs) {
 
   mkdirSync(dirname(resolvedNew), { recursive: true });
   renameSync(resolvedOld, resolvedNew);
+  publishSoundsConfigUpdatedForPaths([oldPath, newPath]);
   return { oldPath, newPath };
 }
 
@@ -361,6 +388,7 @@ function handleWorkspaceDelete({ body }: RouteHandlerArgs) {
   }
 
   rmSync(resolved, { recursive: true, force: true });
+  publishSoundsConfigUpdatedForPaths([path]);
   return { success: true };
 }
 

package/src/runtime/services/conversation-serializer.ts

@@ -8,6 +8,7 @@
  */
 
 import { parseChannelId } from "../../channels/types.js";
+import { getConfig } from "../../config/loader.js";
 import { normalizeConversationType } from "../../daemon/message-types/shared.js";
 import {
   type AttentionState,
@@ -22,6 +23,7 @@ import {
 } from "../../memory/conversation-crud.js";
 import type { ExternalConversationBinding } from "../../memory/external-conversation-store.js";
 import { getBindingsForConversations } from "../../memory/external-conversation-store.js";
+import { buildSlackMessageDeepLinks } from "../../messaging/providers/slack/deep-link.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -88,6 +90,42 @@ function buildForkParent(
   };
 }
 
+function buildChannelBinding(binding: ExternalConversationBinding) {
+  const slackConfig =
+    binding.sourceChannel === "slack" && binding.externalThreadId
+      ? getConfig().slack
+      : undefined;
+  const slackThreadLink =
+    slackConfig && binding.externalThreadId
+      ? buildSlackMessageDeepLinks({
+          teamId: slackConfig.teamId,
+          teamUrl: slackConfig.teamUrl,
+          channelId: binding.externalChatId,
+          messageTs: binding.externalThreadId,
+        })
+      : undefined;
+  const slackThread =
+    binding.sourceChannel === "slack" && binding.externalThreadId
+      ? {
+          channelId: binding.externalChatId,
+          threadTs: binding.externalThreadId,
+          ...(slackThreadLink ? { link: slackThreadLink } : {}),
+        }
+      : undefined;
+
+  return {
+    sourceChannel: binding.sourceChannel,
+    externalChatId: binding.externalChatId,
+    ...(binding.externalThreadId
+      ? { externalThreadId: binding.externalThreadId }
+      : {}),
+    externalUserId: binding.externalUserId,
+    displayName: binding.displayName,
+    username: binding.username,
+    ...(slackThread ? { slackThread } : {}),
+  };
+}
+
 export function serializeConversationSummary(params: {
   conversation: ConversationRow;
   binding?: ExternalConversationBinding | null;
@@ -118,13 +156,7 @@ export function serializeConversationSummary(params: {
       : {}),
     ...(binding
       ? {
-          channelBinding: {
-            sourceChannel: binding.sourceChannel,
-            externalChatId: binding.externalChatId,
-            externalUserId: binding.externalUserId,
-            displayName: binding.displayName,
-            username: binding.username,
-          },
+          channelBinding: buildChannelBinding(binding),
         }
       : {}),
     ...(originChannel ? { conversationOriginChannel: originChannel } : {}),

package/src/runtime/sync/resource-sync-events.ts

@@ -1,5 +1,10 @@
 import type { IdentityFields } from "../../daemon/handlers/identity.js";
-import { SYNC_TAGS } from "../../daemon/message-types/sync.js";
+import type { ConversationListInvalidatedReason } from "../../daemon/message-types/conversations.js";
+import {
+  conversationMessagesSyncTag,
+  conversationMetadataSyncTag,
+  SYNC_TAGS,
+} from "../../daemon/message-types/sync.js";
 import { getAvatarImagePath } from "../../util/platform.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
 import { publishSyncInvalidation } from "./sync-publisher.js";
@@ -23,3 +28,90 @@ export function publishIdentityChanged(fields: IdentityFields): void {
   });
   void publishSyncInvalidation([SYNC_TAGS.assistantIdentity]);
 }
+
+export function publishConfigChanged(): void {
+  broadcastMessage({ type: "config_changed" });
+  void publishSyncInvalidation([SYNC_TAGS.assistantConfig]);
+}
+
+export function publishSoundsConfigUpdated(): void {
+  broadcastMessage({ type: "sounds_config_updated" });
+  void publishSyncInvalidation([SYNC_TAGS.assistantSounds]);
+}
+
+export function publishSchedulesChanged(): void {
+  void publishSyncInvalidation([SYNC_TAGS.assistantSchedules]);
+}
+
+export function publishConversationListChanged(
+  reason: ConversationListInvalidatedReason,
+): void {
+  broadcastMessage({
+    type: "conversation_list_invalidated",
+    reason,
+  });
+  void publishSyncInvalidation([SYNC_TAGS.conversationsList]);
+}
+
+export function publishConversationMessagesChanged(
+  conversationId: string,
+): void {
+  void publishSyncInvalidation([conversationMessagesSyncTag(conversationId)]);
+}
+
+export function publishConversationListAndMetadataChanged(
+  reason: ConversationListInvalidatedReason,
+  conversationIds: string | string[],
+): void {
+  const ids = Array.isArray(conversationIds)
+    ? conversationIds
+    : [conversationIds];
+  broadcastMessage({
+    type: "conversation_list_invalidated",
+    reason,
+  });
+  void publishSyncInvalidation([
+    SYNC_TAGS.conversationsList,
+    ...ids.map((conversationId) => conversationMetadataSyncTag(conversationId)),
+  ]);
+}
+
+export function publishConversationTitleChanged(
+  conversationId: string,
+  title: string,
+): void {
+  broadcastMessage(
+    {
+      type: "conversation_title_updated",
+      conversationId,
+      title,
+    },
+    conversationId,
+  );
+  void publishSyncInvalidation([
+    SYNC_TAGS.conversationsList,
+    conversationMetadataSyncTag(conversationId),
+  ]);
+}
+
+export function publishConversationInferenceProfileChanged(params: {
+  conversationId: string;
+  profile: string | null;
+  sessionId?: string | null;
+  expiresAt?: number | null;
+}): void {
+  broadcastMessage(
+    {
+      type: "conversation_inference_profile_updated",
+      conversationId: params.conversationId,
+      profile: params.profile,
+      sessionId: params.sessionId,
+      expiresAt: params.expiresAt,
+    },
+    params.conversationId,
+  );
+  void publishSyncInvalidation([
+    SYNC_TAGS.conversationsList,
+    conversationMetadataSyncTag(params.conversationId),
+  ]);
+}

package/src/schedule/schedule-store.ts

@@ -5,6 +5,7 @@ import { v4 as uuid } from "uuid";
 import { getDb } from "../memory/db-connection.js";
 import { rawChanges } from "../memory/raw-query.js";
 import { scheduleJobs, scheduleRuns } from "../memory/schema.js";
+import { publishSchedulesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
 import {
   computeNextRunAt as computeNextRunAtEngine,
@@ -14,6 +15,10 @@ import type { ScheduleSyntax } from "./recurrence-types.js";
 
 const logger = getLogger("schedule-store");
 
+function notifySchedulesChanged(): void {
+  publishSchedulesChanged();
+}
+
 export type ScheduleMode = "notify" | "execute" | "script" | "wake";
 export type RoutingIntent = "single_channel" | "multi_channel" | "all_channels";
 export type ScheduleStatus = "active" | "firing" | "fired" | "cancelled";
@@ -160,6 +165,7 @@ export function createSchedule(params: {
   };
 
   db.insert(scheduleJobs).values(row).run();
+  notifySchedulesChanged();
   return parseJobRow(row);
 }
 
@@ -328,6 +334,7 @@ export function updateSchedule(
   }
 
   db.update(scheduleJobs).set(set).where(eq(scheduleJobs.id, id)).run();
+  notifySchedulesChanged();
 
   return getSchedule(id);
 }
@@ -335,7 +342,9 @@ export function updateSchedule(
 export function deleteSchedule(id: string): boolean {
   const db = getDb();
   db.delete(scheduleJobs).where(eq(scheduleJobs.id, id)).run();
-  return rawChanges() > 0;
+  const deleted = rawChanges() > 0;
+  if (deleted) notifySchedulesChanged();
+  return deleted;
 }
 
 /**
@@ -466,6 +475,7 @@ export function claimDueSchedules(now: number): ScheduleJob[] {
     );
   }
 
+  if (claimed.length > 0) notifySchedulesChanged();
   return claimed;
 }
 
@@ -484,6 +494,7 @@ export function completeOneShot(id: string): void {
     })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "firing")))
     .run();
+  if (rawChanges() > 0) notifySchedulesChanged();
 }
 
 /**
@@ -500,6 +511,7 @@ export function failOneShot(id: string): void {
     })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "firing")))
     .run();
+  if (rawChanges() > 0) notifySchedulesChanged();
 }
 
 /**
@@ -510,6 +522,7 @@ export function failOneShot(id: string): void {
 export function retryOneShot(id: string): void {
   const db = getDb();
   const now = Date.now();
+  let changed = false;
   db.update(scheduleJobs)
     .set({
       status: "active",
@@ -518,6 +531,8 @@ export function retryOneShot(id: string): void {
     })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "firing")))
     .run();
+  changed = rawChanges() > 0;
+  if (changed) notifySchedulesChanged();
 }
 
 /**
@@ -537,6 +552,7 @@ export function failOneShotPermanently(id: string): void {
     })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "firing")))
     .run();
+  if (rawChanges() > 0) notifySchedulesChanged();
 }
 
 /**
@@ -554,7 +570,9 @@ export function cancelSchedule(id: string): boolean {
     })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "active")))
     .run();
-  return rawChanges() > 0;
+  const cancelled = rawChanges() > 0;
+  if (cancelled) notifySchedulesChanged();
+  return cancelled;
 }
 
 export function createScheduleRun(
@@ -625,12 +643,14 @@ export function completeScheduleRun(
         })
         .where(eq(scheduleJobs.id, run.jobId))
         .run();
+      if (rawChanges() > 0) notifySchedulesChanged();
     }
   } else {
     db.update(scheduleJobs)
       .set({ lastStatus: "ok", retryCount: 0, updatedAt: now })
       .where(eq(scheduleJobs.id, run.jobId))
       .run();
+    if (rawChanges() > 0) notifySchedulesChanged();
   }
 }
 
@@ -839,16 +859,20 @@ export function describeCronExpression(expr: string | null): string {
 export function scheduleRetry(id: string, nextRetryAt: number): void {
   const db = getDb();
   const now = Date.now();
+  let changed = false;
   db.update(scheduleJobs)
     .set({ nextRunAt: nextRetryAt, updatedAt: now })
     .where(eq(scheduleJobs.id, id))
     .run();
+  changed = rawChanges() > 0;
   // Revert one-shot status from "firing" to "active" so the scheduler
   // will claim it again when nextRetryAt arrives. No-op for recurring.
   db.update(scheduleJobs)
     .set({ status: "active", updatedAt: now })
     .where(and(eq(scheduleJobs.id, id), eq(scheduleJobs.status, "firing")))
     .run();
+  changed = rawChanges() > 0 || changed;
+  if (changed) notifySchedulesChanged();
 }
 
 /**
@@ -860,6 +884,7 @@ export function resetRetryCount(id: string): void {
     .set({ retryCount: 0, updatedAt: Date.now() })
     .where(eq(scheduleJobs.id, id))
     .run();
+  if (rawChanges() > 0) notifySchedulesChanged();
 }
 
 /**

package/src/schedule/scheduler.ts

@@ -549,7 +549,15 @@ export async function runScheduleOnce(
           });
         },
       });
-      conversationId = result.conversationId;
+      // Bootstrap-failure path returns `{ ok: false, conversationId: "" }`.
+      // Substitute a sentinel only for failures so the schedule-run DB row
+      // carries a recognizable marker. Successful skips (e.g.
+      // `pre_first_user_message`) also return `conversationId: ""` but with
+      // `ok: true` — keep the empty ID to preserve their skip contract.
+      conversationId =
+        !result.ok && result.conversationId === ""
+          ? `bootstrap-error:${job.id}`
+          : result.conversationId;
       ok = result.ok;
       errorMsg = result.error?.message;
     }

package/src/security/__tests__/untrusted-content.test.ts

@@ -2,6 +2,8 @@ import { describe, expect, test } from "bun:test";
 
 import {
   escapeContentBoundaries,
+  parseExternalContentEnvelope,
+  unwrapExternalContentForDisplay,
   wrapUntrustedContent,
 } from "../untrusted-content.js";
 
@@ -107,3 +109,87 @@ describe("escapeContentBoundaries", () => {
     expect(escapeContentBoundaries(safe)).toBe(safe);
   });
 });
+
+describe("parseExternalContentEnvelope", () => {
+  test("parses a complete envelope with source and content", () => {
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="slack">\nhello world\n</external_content>',
+      ),
+    ).toEqual({
+      source: "slack",
+      content: "hello world",
+    });
+  });
+
+  test("parses optional origin and multiline content from wrapped output", () => {
+    const wrapped = wrapUntrustedContent("line one\nline two", {
+      source: "slack",
+      sourceDetail: "channel-123",
+    });
+
+    expect(parseExternalContentEnvelope(wrapped)).toEqual({
+      source: "slack",
+      origin: "channel-123",
+      content: "line one\nline two",
+    });
+  });
+
+  test("returns null for malformed wrappers", () => {
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="slack">body\n</external_content>',
+      ),
+    ).toBeNull();
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="slack">\nbody</external_content>',
+      ),
+    ).toBeNull();
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="slack" extra="ignored">\nbody\n</external_content>',
+      ),
+    ).toBeNull();
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="slack">\nbody\n</external_content>\n</external_content>',
+      ),
+    ).toBeNull();
+  });
+
+  test("returns null for mixed prefix or suffix content", () => {
+    const envelope =
+      '<external_content source="email">\nbody\n</external_content>';
+
+    expect(parseExternalContentEnvelope(`prefix ${envelope}`)).toBeNull();
+    expect(parseExternalContentEnvelope(`${envelope} suffix`)).toBeNull();
+  });
+
+  test("returns null for unknown sources", () => {
+    expect(
+      parseExternalContentEnvelope(
+        '<external_content source="chat">\nbody\n</external_content>',
+      ),
+    ).toBeNull();
+  });
+});
+
+describe("unwrapExternalContentForDisplay", () => {
+  test("returns only the inner body for a complete envelope", () => {
+    expect(
+      unwrapExternalContentForDisplay(
+        '<external_content source="slack">\nvisible text\n</external_content>',
+      ),
+    ).toBe("visible text");
+  });
+
+  test("leaves partial or malformed external content unchanged", () => {
+    const partial = '<external_content source="slack">\nvisible text';
+    const malformed =
+      '<external_content source="slack">visible text</external_content>';
+
+    expect(unwrapExternalContentForDisplay(partial)).toBe(partial);
+    expect(unwrapExternalContentForDisplay(malformed)).toBe(malformed);
+  });
+});

package/src/security/untrusted-content.ts

@@ -15,14 +15,23 @@
 // Types
 // ---------------------------------------------------------------------------
 
-export type UntrustedContentSource =
-  | "email"
-  | "slack"
-  | "web"
-  | "calendar"
-  | "webhook"
-  | "search"
-  | "tool_result";
+const UNTRUSTED_CONTENT_SOURCES = [
+  "email",
+  "slack",
+  "web",
+  "calendar",
+  "webhook",
+  "search",
+  "tool_result",
+] as const;
+
+export type UntrustedContentSource = (typeof UNTRUSTED_CONTENT_SOURCES)[number];
+
+export interface ExternalContentEnvelope {
+  source: UntrustedContentSource;
+  origin?: string;
+  content: string;
+}
 
 export interface WrapOptions {
   /** Which external source produced this content. */
@@ -47,6 +56,14 @@ const DEFAULT_BUDGETS: Record<UntrustedContentSource, number> = {
   tool_result: 20_000,
 };
 
+const UNTRUSTED_CONTENT_SOURCE_SET = new Set<string>(UNTRUSTED_CONTENT_SOURCES);
+
+const EXTERNAL_CONTENT_ENVELOPE_PATTERN =
+  /^<external_content\s+([^\r\n<>]*)>\n([\s\S]*)\n<\/external_content>$/;
+
+const EXTERNAL_CONTENT_ATTRIBUTE_PATTERN =
+  /(?:^|\s+)(source|origin)="([^"\r\n]*)"/g;
+
 // ---------------------------------------------------------------------------
 // Core API
 // ---------------------------------------------------------------------------
@@ -70,6 +87,31 @@ export function wrapUntrustedContent(
   return `<external_content source="${options.source}"${detail}>\n${truncated}\n</external_content>`;
 }
 
+export function parseExternalContentEnvelope(
+  value: string,
+): ExternalContentEnvelope | null {
+  const match = EXTERNAL_CONTENT_ENVELOPE_PATTERN.exec(value);
+  if (!match || match[0] !== value) {
+    return null;
+  }
+
+  const attributes = parseExternalContentAttributes(match[1]);
+  if (!attributes) {
+    return null;
+  }
+
+  const content = match[2];
+  if (/<\/external_content/gi.test(content)) {
+    return null;
+  }
+
+  return { ...attributes, content };
+}
+
+export function unwrapExternalContentForDisplay(value: string): string {
+  return parseExternalContentEnvelope(value)?.content ?? value;
+}
+
 /**
  * Escape sequences that could break out of the `<external_content>` wrapper.
  * Case-insensitive to cover mixed-case evasion attempts.
@@ -90,6 +132,49 @@ function sanitizeAttr(value: string): string {
   return value.replace(/[<>"&\r\n]/g, "").slice(0, 200);
 }
 
+function parseExternalContentAttributes(
+  attributes: string,
+): Pick<ExternalContentEnvelope, "source" | "origin"> | null {
+  let source: UntrustedContentSource | undefined;
+  let origin: string | undefined;
+  let originSeen = false;
+  let cursor = 0;
+
+  EXTERNAL_CONTENT_ATTRIBUTE_PATTERN.lastIndex = 0;
+  for (const match of attributes.matchAll(EXTERNAL_CONTENT_ATTRIBUTE_PATTERN)) {
+    if (match.index !== cursor) {
+      return null;
+    }
+
+    const [, name, value] = match;
+    if (name === "source") {
+      if (source || !isUntrustedContentSource(value)) {
+        return null;
+      }
+      source = value;
+    } else {
+      if (originSeen) {
+        return null;
+      }
+      originSeen = true;
+      origin = value;
+    }
+    cursor = match.index + match[0].length;
+  }
+
+  if (cursor !== attributes.length || !source) {
+    return null;
+  }
+
+  return originSeen ? { source, origin } : { source };
+}
+
+function isUntrustedContentSource(
+  value: string,
+): value is UntrustedContentSource {
+  return UNTRUSTED_CONTENT_SOURCE_SET.has(value);
+}
+
 /** Truncate content to a character budget, appending a notice if truncated. */
 function truncateWithNotice(content: string, maxChars: number): string {
   if (content.length <= maxChars) {

package/src/skills/catalog-files.ts

@@ -501,7 +501,7 @@ export function catalogSkillToSlim(cs: CatalogSkill): SlimSkillResponse {
     id: cs.id,
     name: cs.metadata?.vellum?.["display-name"] ?? cs.name,
     description: cs.description,
-    emoji: cs.emoji,
+    emoji: cs.emoji ?? cs.metadata?.emoji,
     kind: "catalog",
     origin: "vellum",
     status: "available",