@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/notifications/copy-composer.ts

@@ -9,6 +9,10 @@
  * values from the context payload.
  */
 
+import {
+  buildAccessRequestContractText,
+  sanitizeIdentityField,
+} from "./access-request-copy.js";
 import {
   buildGuardianRequestCodeInstruction,
   resolveGuardianQuestionInstructionMode,
@@ -32,285 +36,39 @@ export function nonEmpty(value: string | undefined): string | undefined {
   return trimmed.length > 0 ? trimmed : undefined;
 }
 
-// ── Access-request copy contract ─────────────────────────────────────────────
-//
-// Deterministic helpers for building guardian-facing access-request copy.
-// These are used both by the fallback template and the decision-engine
-// post-generation enforcement to ensure required directives always appear.
-
-const IDENTITY_FIELD_MAX_LENGTH = 120;
-
 /**
- * Sanitize an untrusted identity field for inclusion in notification copy.
- *
- * - Strips control characters (U+0000–U+001F, U+007F–U+009F) and newlines.
- * - Clamps to IDENTITY_FIELD_MAX_LENGTH characters.
- * - Wraps in quotes to neutralize instruction-like payload text.
+ * Safely read a string property from an unknown-typed payload object.
+ * Returns `undefined` when the payload is falsy, not an object, or the
+ * key does not hold a string value.
  */
-export function sanitizeIdentityField(value: string): string {
-  const stripped = value.replace(/[\x00-\x1f\x7f-\x9f\r\n]+/g, " ").trim();
-  const clamped =
-    stripped.length > IDENTITY_FIELD_MAX_LENGTH
-      ? stripped.slice(0, IDENTITY_FIELD_MAX_LENGTH) + "…"
-      : stripped;
-  return clamped;
-}
-
-export function buildAccessRequestIdentityLine(
-  payload: Record<string, unknown>,
-): string {
-  const requester = sanitizeIdentityField(
-    str(payload.senderIdentifier, "Someone"),
-  );
-  const sourceChannel =
-    typeof payload.sourceChannel === "string"
-      ? payload.sourceChannel
-      : undefined;
-  const callerName = nonEmpty(
-    typeof payload.actorDisplayName === "string"
-      ? payload.actorDisplayName
-      : undefined,
-  );
-  const actorUsername = nonEmpty(
-    typeof payload.actorUsername === "string"
-      ? payload.actorUsername
-      : undefined,
-  );
-  const actorExternalId = nonEmpty(
-    typeof payload.actorExternalId === "string"
-      ? payload.actorExternalId
-      : undefined,
-  );
-
-  if (sourceChannel === "phone" && callerName) {
-    const safeName = sanitizeIdentityField(callerName);
-    const safeId = sanitizeIdentityField(
-      str(payload.actorExternalId, requester),
-    );
-    return `${safeName} (${safeId}) is calling and requesting access to the assistant.`;
-  }
-
-  // For non-voice, include extra context when available.
-  // Sanitize before comparing to avoid deduplication failures when identity
-  // fields contain control characters that are stripped from `requester`.
-  const sanitizedUsername = actorUsername
-    ? sanitizeIdentityField(actorUsername)
-    : undefined;
-  const sanitizedExternalId = actorExternalId
-    ? sanitizeIdentityField(actorExternalId)
-    : undefined;
-  // When the requester is a raw Slack user ID (e.g. the fallback path in
-  // access-request-helper sets senderIdentifier to the raw actorExternalId),
-  // format it as a Slack mention so it renders as a clickable display name.
-  const formattedRequester =
-    sourceChannel === "slack" && /^U[A-Z0-9]+$/i.test(requester)
-      ? `<@${requester}>`
-      : requester;
-  const parts = [formattedRequester];
-  if (sanitizedUsername && sanitizedUsername !== requester) {
-    parts.push(`@${sanitizedUsername}`);
-  }
-  if (
-    sanitizedExternalId &&
-    sanitizedExternalId !== requester &&
-    sanitizedExternalId !== sanitizedUsername
-  ) {
-    // For Slack, use the <@U...> mention format so Slack auto-renders
-    // the user ID as a clickable display name.
-    const formattedId =
-      sourceChannel === "slack" && /^U[A-Z0-9]+$/i.test(sanitizedExternalId)
-        ? `<@${sanitizedExternalId}>`
-        : `[${sanitizedExternalId}]`;
-    parts.push(formattedId);
-  }
-  if (sourceChannel) {
-    parts.push(`via ${sourceChannel}`);
-  }
-
-  return `${parts.join(" ")} is requesting access to the assistant.`;
-}
-
-export const MESSAGE_PREVIEW_MAX_LENGTH = 200;
-
-/**
- * Sanitize an untrusted message preview for inclusion in notification copy.
- *
- * Like {@link sanitizeIdentityField} but uses the higher
- * MESSAGE_PREVIEW_MAX_LENGTH limit (200 chars) instead of the identity
- * field limit (120 chars).
- */
-export function sanitizeMessagePreview(value: string): string {
-  const stripped = value.replace(/[\x00-\x1f\x7f-\x9f\r\n]+/g, " ").trim();
-  const clamped =
-    stripped.length > MESSAGE_PREVIEW_MAX_LENGTH
-      ? stripped.slice(0, MESSAGE_PREVIEW_MAX_LENGTH) + "…"
-      : stripped;
-  return clamped;
-}
-
-/**
- * Build a quoted preview of the requester's original message for inclusion
- * in guardian-facing access-request copy. Sanitizes and truncates to keep
- * the notification concise.
- *
- * Returns `undefined` when no usable preview is available.
- */
-function buildAccessRequestMessagePreview(
-  payload: Record<string, unknown>,
+export function readPayloadString(
+  payload: unknown,
+  key: string,
 ): string | undefined {
-  const raw =
-    typeof payload.messagePreview === "string"
-      ? payload.messagePreview
-      : undefined;
-  if (!raw) return undefined;
-
-  const sanitized = sanitizeMessagePreview(raw);
-  if (sanitized.length === 0) return undefined;
-
-  return `> Their message: "${sanitized}"`;
-}
-
-export function buildAccessRequestInviteDirective(): string {
-  return 'Reply "open invite flow" to start Trusted Contacts invite flow.';
+  if (!payload || typeof payload !== "object") return undefined;
+  const value = (payload as Record<string, unknown>)[key];
+  return typeof value === "string" ? value : undefined;
 }
 
 /**
- * Normalize text before running directive-matching regexes.
- *
- * - Replaces smart/curly apostrophes (\u2018, \u2019, \u201B) with ASCII `'`
- *   so contractions like "Don\u2019t" are matched by the `n't` lookbehind.
- * - Collapses runs of whitespace into a single space so "Do not   reply"
- *   is matched by the single-space negative lookbehind.
- * - Trims leading/trailing whitespace.
+ * Derive a short notification title from a message body. Trims to the
+ * first sentence terminator when present, then caps the result at
+ * 60 characters with an ellipsis.
  */
-export function normalizeForDirectiveMatching(text: string): string {
-  return text
-    .replace(/[\u2018\u2019\u201B]/g, "'")
-    .replace(/\s+/g, " ")
-    .trim();
-}
-
-/**
- * Check whether a text contains the required access-request instruction elements:
- * 1. Approve directive: Reply "CODE approve"
- * 2. Reject directive: Reply "CODE reject"
- * 3. Invite directive: Reply "open invite flow"
- *
- * Each directive is matched independently using negative lookbehind to reject
- * matches preceded by negation words ("not", "n't", "never"). This prevents
- * contradictory copy like `Do not reply "CODE reject"` from satisfying the
- * check even when a positive approve directive exists nearby.
- *
- * The text is normalized before matching to handle smart apostrophes and
- * multiple whitespace characters that would otherwise bypass negation detection.
- */
-export function hasAccessRequestInstructions(
-  text: string | undefined,
-  requestCode: string,
-): boolean {
-  if (typeof text !== "string") return false;
-  const normalized = normalizeForDirectiveMatching(text);
-  const escapedCode = requestCode.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  // Each directive must follow "reply" without a preceding negation word.
-  // Negative lookbehinds reject "do not reply", "don't reply", "never reply".
-  const approveRe = new RegExp(
-    `(?<!not\\s)(?<!n't\\s)(?<!never\\s)reply\\b[^.!?\\n]*?"${escapedCode}\\s+approve"`,
-    "i",
-  );
-  const rejectRe = new RegExp(
-    `(?<!not\\s)(?<!n't\\s)(?<!never\\s)reply\\b[^.!?\\n]*?"${escapedCode}\\s+reject"`,
-    "i",
-  );
-  const inviteRe =
-    /(?<!not\s)(?<!n't\s)(?<!never\s)reply\b[^.!?\n]*?"open invite flow"/i;
-
-  return (
-    approveRe.test(normalized) &&
-    rejectRe.test(normalized) &&
-    inviteRe.test(normalized)
-  );
-}
-
-/**
- * Check whether text contains the invite-flow directive ("open invite flow")
- * using the same normalized negative-lookbehind pattern as the full check.
- * This is used for enforcement when requestCode is absent but the invite
- * directive should still be present.
- */
-export function hasInviteFlowDirective(text: string | undefined): boolean {
-  if (typeof text !== "string") return false;
-  const normalized = normalizeForDirectiveMatching(text);
-  const inviteRe =
-    /(?<!not\s)(?<!n't\s)(?<!never\s)reply\b[^.!?\n]*?"open invite flow"/i;
-  return inviteRe.test(normalized);
-}
-
-/**
- * Build the deterministic access-request contract text from payload fields.
- * This is the canonical baseline that enforcement can append when generated
- * copy is missing required elements.
- *
- * Channel-agnostic by design: this function reads from the generic
- * `contextPayload` and works identically regardless of which channel
- * (Slack, Telegram, desktop, etc.) the notification is delivered to.
- * When `guardianResolutionSource` is present and not `"source-channel-contact"`,
- * the guardian was resolved via fallback (e.g. vellum anchor) rather than
- * a verified same-channel contact — downstream copy or routing can use
- * this to append verification CTAs like "Was this you?".
- */
-export function buildAccessRequestContractText(
-  payload: Record<string, unknown>,
-): string {
-  const requestCode = nonEmpty(
-    typeof payload.requestCode === "string" ? payload.requestCode : undefined,
-  );
-  const previousMemberStatus =
-    typeof payload.previousMemberStatus === "string"
-      ? payload.previousMemberStatus
-      : undefined;
-
-  const guardianResolutionSource =
-    typeof payload.guardianResolutionSource === "string"
-      ? payload.guardianResolutionSource
-      : undefined;
-  const sourceChannel =
-    typeof payload.sourceChannel === "string"
-      ? payload.sourceChannel
-      : undefined;
-
-  const lines: string[] = [];
-  lines.push(buildAccessRequestIdentityLine(payload));
-  const preview = buildAccessRequestMessagePreview(payload);
-  if (preview) {
-    lines.push(preview);
-  }
-  if (previousMemberStatus === "revoked") {
-    lines.push("Note: this user was previously revoked.");
-  }
-  if (requestCode) {
-    const code = requestCode.toUpperCase();
-    lines.push(
-      `Reply "${code} approve" to grant access or "${code} reject" to deny.`,
-    );
-  }
-  lines.push(buildAccessRequestInviteDirective());
-  if (
-    (guardianResolutionSource === "vellum-anchor" ||
-      guardianResolutionSource === "none") &&
-    sourceChannel
-  ) {
-    lines.push(
-      `Note: You haven't verified your identity on ${sourceChannel} yet. If this was you trying to message your assistant, say "help me verify as guardian on ${sourceChannel}" to set up direct access.`,
-    );
-  }
-  return lines.join("\n");
+export function deriveTitle(body: string): string {
+  const firstSentenceEnd = body.search(/[.!?](\s|$)/);
+  const candidate =
+    firstSentenceEnd > 0 ? body.slice(0, firstSentenceEnd + 1) : body;
+  return candidate.length > 60
+    ? candidate.slice(0, 60).trim() + "\u2026"
+    : candidate.trim();
 }
 
 // Templates keyed by dot-separated sourceEventName strings matching producers.
 const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
   "schedule.notify": (payload) => ({
-    title: "Reminder",
-    body: str(payload.message, str(payload.label, "A reminder has fired")),
+    title: str(payload.label, "Reminder"),
+    body: str(payload.message, "A reminder has fired"),
   }),
 
   "guardian.question": (payload) => {
@@ -553,6 +311,30 @@ export function composeFallbackCopy(
   signal: NotificationSignal,
   channels: NotificationChannel[],
 ): Partial<Record<NotificationChannel, RenderedChannelCopy>> {
+  // Honor user-supplied content when present. The assistant_tool
+  // pass-through handles the happy path (sourceChannel === "assistant_tool");
+  // this catches the same payload fields when the LLM fallback fires for
+  // any source channel.
+  const msg = nonEmpty(
+    readPayloadString(signal.contextPayload, "requestedMessage"),
+  );
+  if (msg) {
+    const title =
+      nonEmpty(readPayloadString(signal.contextPayload, "requestedTitle")) ??
+      deriveTitle(msg);
+    const baseCopy: RenderedChannelCopy = {
+      title,
+      body: msg,
+      conversationSeedMessage: msg,
+    };
+    const result: Partial<Record<NotificationChannel, RenderedChannelCopy>> =
+      {};
+    for (const ch of channels) {
+      result[ch] = applyChannelDefaults(ch, baseCopy);
+    }
+    return result;
+  }
+
   const template =
     TEMPLATES[signal.sourceEventName as NotificationSourceEventName];
 

package/src/notifications/decision-engine.ts

@@ -23,17 +23,22 @@ import {
 import type { Provider } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
 import { truncate } from "../util/truncate.js";
+import {
+  buildAccessRequestContractText,
+  buildAccessRequestInviteDirective,
+  hasAccessRequestInstructions,
+  hasInviteFlowDirective,
+} from "./access-request-copy.js";
 import {
   buildConversationCandidates,
   type ConversationCandidateSet,
   serializeCandidatesForPrompt,
 } from "./conversation-candidates.js";
 import {
-  buildAccessRequestContractText,
-  buildAccessRequestInviteDirective,
   composeFallbackCopy,
-  hasAccessRequestInstructions,
-  hasInviteFlowDirective,
+  deriveTitle,
+  nonEmpty,
+  readPayloadString,
 } from "./copy-composer.js";
 import { createDecision } from "./decisions-store.js";
 import {
@@ -56,21 +61,6 @@ const log = getLogger("notification-decision-engine");
 const DECISION_TIMEOUT_MS = 15_000;
 const PROMPT_VERSION = "v4";
 
-/**
- * Derive a short notification title from a message body. Used when an
- * assistant_tool-sourced signal supplies `requestedMessage` without an
- * explicit `requestedTitle`: trims to the first sentence terminator when
- * present, then caps the result at 60 characters with an ellipsis.
- */
-function deriveTitle(body: string): string {
-  const firstSentenceEnd = body.search(/[.!?](\s|$)/);
-  const candidate =
-    firstSentenceEnd > 0 ? body.slice(0, firstSentenceEnd + 1) : body;
-  return candidate.length > 60
-    ? candidate.slice(0, 60).trim() + "…"
-    : candidate.trim();
-}
-
 /**
  * Maximum character budget for identity context injected into the notification
  * decision prompt. We truncate to prevent oversized prompts when SOUL.md /
@@ -768,24 +758,15 @@ export async function evaluateSignal(
   // classifier entirely. The producer has already done the routing and
   // copy decisions — we just enforce the standard post-decision guards
   // and persist the result.
-  if (
-    signal.sourceChannel === "assistant_tool" &&
-    typeof signal.contextPayload === "object" &&
-    signal.contextPayload != null &&
-    typeof (signal.contextPayload as Record<string, unknown>)
-      .requestedMessage === "string" &&
-    (
-      (signal.contextPayload as Record<string, unknown>)
-        .requestedMessage as string
-    ).trim().length > 0
-  ) {
+  const requestedBody = nonEmpty(
+    readPayloadString(signal.contextPayload, "requestedMessage"),
+  );
+  if (signal.sourceChannel === "assistant_tool" && requestedBody) {
     const payload = signal.contextPayload as Record<string, unknown>;
-    const body = (payload.requestedMessage as string).trim();
+    const body = requestedBody;
     const title =
-      typeof payload.requestedTitle === "string" &&
-      payload.requestedTitle.trim().length > 0
-        ? (payload.requestedTitle as string).trim()
-        : deriveTitle(body);
+      nonEmpty(readPayloadString(signal.contextPayload, "requestedTitle")) ??
+      deriveTitle(body);
     const isUrgent =
       signal.attentionHints.urgency === "critical" ||
       signal.attentionHints.urgency === "high";

package/src/notifications/home-feed-side-effect.ts

@@ -22,6 +22,7 @@ import { getConversation } from "../memory/conversation-crud.js";
 import { isBackgroundConversationType } from "../memory/conversation-types.js";
 import { getLogger } from "../util/logger.js";
 import { isConversationSeedSane } from "./conversation-seed-composer.js";
+import { readPayloadString } from "./copy-composer.js";
 import type { NotificationSignal } from "./signal.js";
 import type { NotificationDecision, RenderedChannelCopy } from "./types.js";
 
@@ -231,12 +232,6 @@ function resolveHomeFeedMirror(
   return { mirror: false };
 }
 
-function readPayloadString(payload: unknown, key: string): string | undefined {
-  if (!payload || typeof payload !== "object") return undefined;
-  const value = (payload as Record<string, unknown>)[key];
-  return typeof value === "string" ? value : undefined;
-}
-
 /**
  * Routing-intent enforcement can prune `selectedChannels` without also
  * pruning `renderedCopy`, so iterating `renderedCopy` directly risks

package/src/oauth/oauth-store.ts

@@ -856,15 +856,6 @@ export function getConnectionByProvider(
   return getActiveConnection(provider, { clientId });
 }
 
-/** @deprecated Use {@link getActiveConnection} instead. */
-export function getConnectionByProviderAndAccount(
-  provider: string,
-  accountInfo?: string,
-  clientId?: string,
-): OAuthConnectionRow | undefined {
-  return getActiveConnection(provider, { clientId, account: accountInfo });
-}
-
 /**
  * Get ALL active connections for a provider (supports multi-account).
  */

package/src/permissions/checker.test.ts

@@ -76,8 +76,13 @@ mock.module("../util/platform.js", () => ({
 }));
 
 // Mock gateway threshold reader — return "low" by default (conversation context default).
+// `mockRefreshedThreshold` simulates the cache-bypassing refresh performed
+// before a prompt is surfaced; `null` means "refresh failed, keep decision".
+let mockCachedThreshold = "low";
+let mockRefreshedThreshold: string | null = null;
 mock.module("./gateway-threshold-reader.js", () => ({
-  getAutoApproveThreshold: async () => "low",
+  getAutoApproveThreshold: async () => mockCachedThreshold,
+  refreshAutoApproveThreshold: async () => mockRefreshedThreshold,
   _clearGlobalCacheForTesting: () => {},
 }));
 
@@ -136,6 +141,8 @@ describe("Permission Checker (gateway IPC)", () => {
     testConfig.skills = { load: { extraDirs: [] } };
     mockIsContainerized = false;
     mockIpcClassifyRiskResult = undefined;
+    mockCachedThreshold = "low";
+    mockRefreshedThreshold = null;
   });
 
   // ── classifyRisk ──────────────────────────────────────────────────────────
@@ -473,6 +480,81 @@ describe("Permission Checker (gateway IPC)", () => {
         ),
       ).rejects.toThrow(/Gateway IPC classify_risk failed/);
     });
+
+    // ── Stale-threshold refresh before prompting ────────────────────────────
+    // The threshold reader caches values (5s conversation / 30s global TTL)
+    // and no write path invalidates them, so a user who just switched to
+    // Full access could still be prompted from the stale snapshot. check()
+    // must re-read the threshold fresh before surfacing a prompt.
+
+    test("re-evaluates with refreshed threshold instead of prompting (stale cache after Full access)", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "high",
+        reason: "Recursive force delete",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      mockCachedThreshold = "low"; // stale cached value
+      mockRefreshedThreshold = "high"; // user just selected Full access
+      const result = await check(
+        "bash",
+        { command: "rm -rf /tmp/stale-cache-test" },
+        "/home/user/project",
+      );
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("keeps the prompt when the threshold refresh fails", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "high",
+        reason: "Recursive force delete",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      mockCachedThreshold = "low";
+      mockRefreshedThreshold = null; // gateway unreachable during refresh
+      const result = await check(
+        "bash",
+        { command: "rm -rf /tmp/refresh-failed-test" },
+        "/home/user/project",
+      );
+      expect(result.decision).toBe("prompt");
+    });
+
+    test("keeps the prompt when the refreshed threshold matches the cached one", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "high",
+        reason: "Recursive force delete",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      mockCachedThreshold = "low";
+      mockRefreshedThreshold = "low"; // no change — still below the risk
+      const result = await check(
+        "bash",
+        { command: "rm -rf /tmp/refresh-unchanged-test" },
+        "/home/user/project",
+      );
+      expect(result.decision).toBe("prompt");
+    });
+
+    test("keeps the prompt when the refreshed threshold is stricter", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "Network request (default)",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      mockCachedThreshold = "low";
+      mockRefreshedThreshold = "none"; // user tightened to Strict mid-flight
+      const result = await check(
+        "network_request",
+        { url: "https://api.example.com/refresh-stricter-test" },
+        "/home/user/project",
+      );
+      expect(result.decision).toBe("prompt");
+    });
   });
 
   // ── generateAllowlistOptions ──────────────────────────────────────────────

package/src/permissions/checker.ts

@@ -28,7 +28,10 @@ import {
   type ApprovalContext,
   DefaultApprovalPolicy,
 } from "./approval-policy.js";
-import { getAutoApproveThreshold } from "./gateway-threshold-reader.js";
+import {
+  getAutoApproveThreshold,
+  refreshAutoApproveThreshold,
+} from "./gateway-threshold-reader.js";
 import type { RiskAssessment } from "./risk-types.js";
 import {
   type AllowlistOption,
@@ -555,7 +558,27 @@ export async function check(
   };
 
   // Delegate the allow/prompt/deny decision to the approval policy
-  const approvalDecision = defaultApprovalPolicy.evaluate(approvalContext);
+  let approvalDecision = defaultApprovalPolicy.evaluate(approvalContext);
+
+  // A "prompt" computed from a cached threshold may contradict a setting
+  // the user just changed: the reader caches thresholds (5s conversation /
+  // 30s global TTL) and no threshold write path invalidates this process's
+  // caches. Re-read the threshold fresh before interrupting the user; when
+  // the current value differs, re-evaluate so e.g. Full access never
+  // prompts. A failed refresh returns null and keeps the prompt — fail
+  // toward asking, never toward silent approval.
+  if (approvalDecision.decision === "prompt") {
+    const freshThreshold = await refreshAutoApproveThreshold(
+      policyContext?.conversationId,
+      policyContext?.executionContext,
+    );
+    if (freshThreshold !== null && freshThreshold !== threshold) {
+      approvalDecision = defaultApprovalPolicy.evaluate({
+        ...approvalContext,
+        autoApproveUpTo: freshThreshold,
+      });
+    }
+  }
 
   // Enrich the reason with the classifier's explanation when available.
   // For risk-based fallback decisions (prompt/deny from High/Medium risk),