@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/runtime/routes/identity-routes.ts

@@ -354,6 +354,9 @@ function getDetailedHealth() {
     ces: {
       connected: cesClient?.isReady() ?? false,
     },
+    capabilities: {
+      memoryOptOut: true,
+    },
     ...(profiler ? { profiler } : {}),
   };
 }
@@ -645,6 +648,10 @@ const cesHealthSchema = z.object({
   connected: z.boolean(),
 });
 
+const healthCapabilitiesSchema = z.object({
+  memoryOptOut: z.boolean(),
+});
+
 const healthDiskSchema = z.object({
   path: z.string(),
   totalMb: z.number(),
@@ -677,6 +684,7 @@ const detailedHealthSchema = z.object({
   cpu: healthCpuSchema,
   migrations: healthMigrationsSchema,
   ces: cesHealthSchema,
+  capabilities: healthCapabilitiesSchema,
   profiler: profilerStatusSchema.optional(),
 });
 

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -23,7 +23,7 @@ import {
   findByInviteCodeHash,
   findByInviteCodeHashAnyChannel,
 } from "../../../memory/invite-store.js";
-import { MESSAGE_PREVIEW_MAX_LENGTH } from "../../../notifications/copy-composer.js";
+import { MESSAGE_PREVIEW_MAX_LENGTH } from "../../../notifications/access-request-copy.js";
 import { resolveGuardianName } from "../../../prompts/user-reference.js";
 import { getLogger } from "../../../util/logger.js";
 import { truncate } from "../../../util/truncate.js";
@@ -332,12 +332,12 @@ export async function enforceIngressAcl(
 
             return {
               resolvedMember: null,
-              earlyResponse: ({
+              earlyResponse: {
                 accepted: true,
                 denied: true,
                 reason: "verification_challenge_sent",
                 verificationSessionId: slackVerifyResult.sessionId,
-              }),
+              },
             };
           }
         }
@@ -375,12 +375,12 @@ export async function enforceIngressAcl(
 
             return {
               resolvedMember: null,
-              earlyResponse: ({
+              earlyResponse: {
                 accepted: true,
                 denied: true,
                 reason: "verification_challenge_sent",
                 verificationSessionId: emailVerifyResult.sessionId,
-              }),
+              },
             };
           }
         }
@@ -438,14 +438,14 @@ export async function enforceIngressAcl(
 
         return {
           resolvedMember: null,
-          earlyResponse: ({
+          earlyResponse: {
             accepted: true,
             denied: true,
             reason: "not_a_member",
             // Include reply text so the gateway can deliver directly when
             // callback delivery failed (e.g. signing-key mismatch → 401).
             ...(!replyDelivered && { replyText }),
-          }),
+          },
         };
       }
     }
@@ -610,12 +610,12 @@ export async function enforceIngressAcl(
 
               return {
                 resolvedMember,
-                earlyResponse: ({
+                earlyResponse: {
                   accepted: true,
                   denied: true,
                   reason: "verification_challenge_sent",
                   verificationSessionId: slackVerifyResult.sessionId,
-                }),
+                },
               };
             }
           }
@@ -682,12 +682,12 @@ export async function enforceIngressAcl(
           }
           return {
             resolvedMember,
-            earlyResponse: ({
+            earlyResponse: {
               accepted: true,
               denied: true,
               reason: `member_${channelStatusToMemberStatus(resolvedMember.channel.status)}`,
               ...(!inactiveReplyDelivered && { replyText: inactiveReplyText }),
-            }),
+            },
           };
         }
       }
@@ -722,15 +722,14 @@ export async function enforceIngressAcl(
         }
         return {
           resolvedMember,
-          earlyResponse: ({
+          earlyResponse: {
             accepted: true,
             denied: true,
             reason: "policy_deny",
             ...(!denyReplyDelivered && { replyText: denyReplyText }),
-          }),
+          },
         };
       }
-
     }
   }
 
@@ -786,11 +785,11 @@ async function handleInviteTokenIntercept(params: {
   );
 
   if (dedupResult.duplicate) {
-    return ({
+    return {
       accepted: true,
       duplicate: true,
       eventId: dedupResult.eventId,
-    });
+    };
   }
 
   const outcome = redeemInvite({
@@ -835,11 +834,11 @@ async function handleInviteTokenIntercept(params: {
       }
     }
     markProcessed(dedupResult.eventId);
-    return ({
+    return {
       accepted: true,
       eventId: dedupResult.eventId,
       inviteRedemption: "already_member",
-    });
+    };
   }
 
   const replyText = getInviteRedemptionReply(outcome);
@@ -861,22 +860,22 @@ async function handleInviteTokenIntercept(params: {
 
   if (outcome.ok && outcome.type === "redeemed") {
     markProcessed(dedupResult.eventId);
-    return ({
+    return {
       accepted: true,
       eventId: dedupResult.eventId,
       inviteRedemption: "redeemed",
       memberId: outcome.memberId,
-    });
+    };
   }
 
   // Failed redemption — inform the user and deny
   markProcessed(dedupResult.eventId);
-  return ({
+  return {
     accepted: true,
     eventId: dedupResult.eventId,
     denied: true,
     inviteRedemption: outcome.reason,
-  });
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -942,11 +941,11 @@ async function handleInviteCodeIntercept(params: {
       );
 
       if (dedupResult.duplicate) {
-        return ({
+        return {
           accepted: true,
           duplicate: true,
           eventId: dedupResult.eventId,
-        });
+        };
       }
 
       const mismatchReply = "This invite is not valid for this channel.";
@@ -965,12 +964,12 @@ async function handleInviteCodeIntercept(params: {
         }
       }
       markProcessed(dedupResult.eventId);
-      return ({
+      return {
         accepted: true,
         eventId: dedupResult.eventId,
         denied: true,
         inviteRedemption: "channel_mismatch",
-      });
+      };
     }
     return null;
   }
@@ -988,11 +987,11 @@ async function handleInviteCodeIntercept(params: {
   );
 
   if (dedupResult.duplicate) {
-    return ({
+    return {
       accepted: true,
       duplicate: true,
       eventId: dedupResult.eventId,
-    });
+    };
   }
 
   let outcome: ReturnType<typeof redeemInviteByCode>;
@@ -1046,11 +1045,11 @@ async function handleInviteCodeIntercept(params: {
       }
     }
     markProcessed(dedupResult.eventId);
-    return ({
+    return {
       accepted: true,
       eventId: dedupResult.eventId,
       inviteRedemption: "already_member",
-    });
+    };
   }
 
   const replyText = getInviteRedemptionReply(outcome);
@@ -1072,22 +1071,22 @@ async function handleInviteCodeIntercept(params: {
 
   if (outcome.ok && outcome.type === "redeemed") {
     markProcessed(dedupResult.eventId);
-    return ({
+    return {
       accepted: true,
       eventId: dedupResult.eventId,
       inviteRedemption: "redeemed",
       memberId: outcome.memberId,
-    });
+    };
   }
 
   // Failed redemption (expired, revoked, etc.) — inform and deny
   markProcessed(dedupResult.eventId);
-  return ({
+  return {
     accepted: true,
     eventId: dedupResult.eventId,
     denied: true,
     inviteRedemption: !outcome.ok ? outcome.reason : undefined,
-  });
+  };
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -10,7 +10,6 @@
 
 import { z } from "zod";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfigReadOnly } from "../../config/loader.js";
 import { getDb } from "../../memory/db-connection.js";
 import {
@@ -44,22 +43,6 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 // ---------------------------------------------------------------------------
 
 const providerConnectionResponseSchema = ProviderConnectionSchema;
-const OPENAI_COMPATIBLE_ENDPOINTS_FLAG = "openai-compatible-endpoints";
-
-function openAICompatibleEndpointsEnabled(): boolean {
-  return isAssistantFeatureFlagEnabled(
-    OPENAI_COMPATIBLE_ENDPOINTS_FLAG,
-    getConfigReadOnly(),
-  );
-}
-
-function rejectDisabledOpenAICompatibleProvider(provider: string): void {
-  if (provider !== "openai-compatible") return;
-  if (openAICompatibleEndpointsEnabled()) return;
-  throw new BadRequestError(
-    "OpenAI-compatible endpoints are disabled. Enable the openai-compatible-endpoints feature flag to configure this provider.",
-  );
-}
 
 // ---------------------------------------------------------------------------
 // Custom provider field parsing (openai-compatible base_url + models)
@@ -170,18 +153,10 @@ async function parseCustomProviderFields(
 
 function handleListConnections({ queryParams = {} }: RouteHandlerArgs) {
   const provider = queryParams.provider;
-  if (provider) rejectDisabledOpenAICompatibleProvider(provider);
   const connections = listConnections(
     getDb(),
     provider ? { provider } : undefined,
   );
-  if (!openAICompatibleEndpointsEnabled()) {
-    return {
-      connections: connections.filter(
-        (conn) => conn.provider !== "openai-compatible",
-      ),
-    };
-  }
   return { connections };
 }
 
@@ -191,12 +166,6 @@ function handleGetConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   const conn = getConnection(getDb(), name);
   if (!conn) throw new NotFoundError(`Connection "${name}" not found.`);
-  if (
-    conn.provider === "openai-compatible" &&
-    !openAICompatibleEndpointsEnabled()
-  ) {
-    throw new NotFoundError(`Connection "${name}" not found.`);
-  }
 
   return conn;
 }
@@ -216,8 +185,6 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
-  rejectDisabledOpenAICompatibleProvider(providerResult.data);
-
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
@@ -280,12 +247,6 @@ async function handleUpdateConnection({
 
   const existing = getConnection(getDb(), name);
   if (!existing) throw new NotFoundError(`Connection "${name}" not found.`);
-  if (
-    existing.provider === "openai-compatible" &&
-    !openAICompatibleEndpointsEnabled()
-  ) {
-    throw new NotFoundError(`Connection "${name}" not found.`);
-  }
 
   const auth = body.auth;
   const authResult = AuthSchema.safeParse(auth);
@@ -355,12 +316,6 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   if (!existing) {
     throw new NotFoundError(`Connection "${name}" not found.`);
   }
-  if (
-    existing.provider === "openai-compatible" &&
-    !openAICompatibleEndpointsEnabled()
-  ) {
-    throw new NotFoundError(`Connection "${name}" not found.`);
-  }
 
   // Managed connections are write-protected: `seedCanonicalConnections` would
   // re-upsert them on the next daemon boot anyway, so a successful delete here

package/src/runtime/routes/plugins-routes.ts

@@ -99,27 +99,20 @@ const pluginsListResponseSchema = z.object({
 });
 
 const pluginMatchSourceSchema = z
-  .discriminatedUnion("kind", [
-    z.object({
-      kind: z.literal("first-party"),
-    }),
-    z.object({
-      kind: z.literal("github"),
-      repo: z
-        .string()
-        .describe("`owner/repo` of the external plugin repository."),
-      path: z
-        .string()
-        .optional()
-        .describe(
-          "Directory within the repo, when the plugin is not at the root.",
-        ),
-      ref: z.string().describe("Pinned git ref the plugin is fetched from."),
-    }),
-  ])
-  .describe(
-    "Origin of the match: a first-party in-repo plugin or a whitelisted external one.",
-  );
+  .object({
+    kind: z.literal("github"),
+    repo: z
+      .string()
+      .describe("`owner/repo` of the external plugin repository."),
+    path: z
+      .string()
+      .optional()
+      .describe(
+        "Directory within the repo, when the plugin is not at the root.",
+      ),
+    ref: z.string().describe("Pinned git ref the plugin is fetched from."),
+  })
+  .describe("Origin of the match: a whitelisted external plugin repository.");
 
 const pluginSearchMatchSchema = z.object({
   name: z
@@ -128,7 +121,7 @@ const pluginSearchMatchSchema = z.object({
   path: z
     .string()
     .describe(
-      "Human-readable origin: a repo-relative path (`experimental/plugins/<name>`) for first-party plugins or a `github:owner/repo@ref` locator for external ones.",
+      "Human-readable origin: a `github:owner/repo@ref` locator for the external plugin.",
     ),
   description: z
     .string()
@@ -186,7 +179,11 @@ const pluginDetailsResponseSchema = z.object({
     .describe(
       "Resolved version (installed copy first, then repo `package.json`).",
     ),
-  source: pluginMatchSourceSchema,
+  source: pluginMatchSourceSchema
+    .nullable()
+    .describe(
+      "Pinned origin from the marketplace entry, or null when an installed copy has no catalog entry.",
+    ),
   readme: z
     .string()
     .nullable()
@@ -199,9 +196,7 @@ const pluginDetailsResponseSchema = z.object({
 const pluginInstallRequestSchema = z.object({
   name: z
     .string()
-    .describe(
-      "Install name to resolve against the catalog (first-party directory or marketplace entry).",
-    ),
+    .describe("Install name to resolve against the marketplace catalog."),
   force: z
     .boolean()
     .optional()
@@ -255,9 +250,7 @@ interface PluginMatchView {
   name: string;
   path: string;
   description?: string;
-  source:
-    | { kind: "first-party" }
-    | { kind: "github"; repo: string; path?: string; ref: string };
+  source: { kind: "github"; repo: string; path?: string; ref: string };
 }
 
 /**
@@ -269,15 +262,12 @@ function projectMatch(m: PluginSearchMatch): PluginMatchView {
   const view: PluginMatchView = {
     name: m.name,
     path: m.path,
-    source:
-      m.source.kind === "github"
-        ? {
-            kind: "github",
-            repo: m.source.repo,
-            ref: m.source.ref,
-            ...(m.source.path !== undefined ? { path: m.source.path } : {}),
-          }
-        : { kind: "first-party" },
+    source: {
+      kind: "github",
+      repo: m.source.repo,
+      ref: m.source.ref,
+      ...(m.source.path !== undefined ? { path: m.source.path } : {}),
+    },
   };
   if (m.description !== undefined) {
     view.description = m.description;
@@ -441,11 +431,10 @@ async function handleInstallPlugin({ body = {} }: RouteHandlerArgs) {
   // The ref is pinned to the curated `DEFAULT_PLUGIN_REF` rather than taken
   // from the request: a caller-supplied ref would let any `settings.write`
   // principal install from an unreviewed revision (a PR branch, fork ref,
-  // ...) whose marketplace manifest or first-party plugin directory could
-  // carry attacker code that the loader then dynamically imports. Installs
-  // over HTTP therefore only ever resolve against the reviewed catalog on
-  // the default ref. Operators who need another ref use the local CLI's
-  // `assistant plugins install --ref`.
+  // ...) whose marketplace manifest could carry attacker code that the loader
+  // then dynamically imports. Installs over HTTP therefore only ever resolve
+  // against the reviewed catalog on the default ref. Operators who need
+  // another ref use the local CLI's `assistant plugins install --ref`.
   try {
     const result = await installPlugin(
       { name, ref: DEFAULT_PLUGIN_REF, force },
@@ -517,7 +506,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Search the plugin catalog",
     description:
-      "List installable plugins from the canonical `vellum-ai/vellum-assistant` catalog at `experimental/plugins/`. The query is an ECMAScript regex matched case-insensitively against the directory name (e.g. `memory`, `^simple`). Empty query returns every entry. Mirrors the CLI's `assistant plugins search`.",
+      "List installable plugins from the curated `plugins/marketplace.json` catalog. The query is an ECMAScript regex matched case-insensitively against the plugin name (e.g. `memory`, `^simple`). Empty query returns every entry. Mirrors the CLI's `assistant plugins search`.",
     tags: ["plugins"],
     queryParams: [
       {
@@ -546,7 +535,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Install a plugin",
     description:
-      "Install a plugin by name from the canonical source — a whitelisted `experimental/plugins/marketplace.json` entry, else the first-party `experimental/plugins/<name>/` convention. Always resolves against the curated default git ref (no caller-supplied ref): installing from an unreviewed revision would bypass the marketplace/first-party curation boundary and let attacker-controlled code be loaded. Materializes the plugin under `<workspaceDir>/plugins/<name>/`; the assistant must be restarted to load it. Mirrors the CLI's `assistant plugins install <name>`. An already-installed name without `force` returns 409; a name that resolves to nothing returns 404. Sibling to `POST /v1/skills/install`.",
+      "Install a plugin by name from the canonical source — a whitelisted `plugins/marketplace.json` entry. Always resolves against the curated default git ref (no caller-supplied ref): installing from an unreviewed revision would bypass the marketplace curation boundary and let attacker-controlled code be loaded. Materializes the plugin under `<workspaceDir>/plugins/<name>/`; the assistant must be restarted to load it. Mirrors the CLI's `assistant plugins install <name>`. An already-installed name without `force` returns 409; a name that resolves to nothing returns 404. Sibling to `POST /v1/skills/install`.",
     tags: ["plugins"],
     requestBody: pluginInstallRequestSchema,
     responseBody: pluginInstallResponseSchema,

package/src/runtime/routes/schedule-routes.ts

@@ -28,6 +28,7 @@ import {
   getSchedule,
   getScheduleRuns,
   listSchedules,
+  type ScheduleJob,
   setScheduleRunConversationId,
   updateSchedule,
 } from "../../schedule/schedule-store.js";
@@ -64,7 +65,8 @@ const scheduleSchema = z.object({
   createdFromConversationId: z.string().nullable(),
   createdFromConversationExists: z.boolean(),
   createdFromConversationArchivedAt: z.number().nullable(),
-  description: z.string().nullable(),
+  description: z.string(),
+  cadenceDescription: z.string(),
   mode: z.enum(["notify", "execute", "script", "wake"]),
   status: z.enum(["active", "firing", "fired", "cancelled"]),
   routingIntent: z.enum(["single_channel", "multi_channel", "all_channels"]),
@@ -125,6 +127,18 @@ function getCreatedFromConversationState(
   return state;
 }
 
+function getCadenceDescription(
+  job: Pick<ScheduleJob, "syntax" | "cronExpression" | "expression">,
+): string {
+  if (job.cronExpression === null) {
+    return describeCronExpression(job.cronExpression);
+  }
+  if (job.syntax === "cron") {
+    return describeCronExpression(job.cronExpression);
+  }
+  return job.expression ?? "";
+}
+
 function handleListSchedules(queryParams: Record<string, string>) {
   const includeAll = queryParams.include_all === "true";
   const jobs = listSchedules();
@@ -161,10 +175,8 @@ function handleListSchedules(queryParams: Record<string, string>) {
         createdFromConversationId: j.createdFromConversationId,
         createdFromConversationExists: sourceConversation.exists,
         createdFromConversationArchivedAt: sourceConversation.archivedAt,
-        description:
-          j.syntax === "cron"
-            ? describeCronExpression(j.cronExpression)
-            : j.expression,
+        description: j.description,
+        cadenceDescription: getCadenceDescription(j),
         mode: j.mode,
         status: j.status,
         routingIntent: j.routingIntent,
@@ -180,6 +192,12 @@ function handleCreateSchedule(body: Record<string, unknown>) {
   const name = typeof body.name === "string" ? body.name.trim() : "";
   const expression =
     typeof body.expression === "string" ? body.expression.trim() : "";
+  const description =
+    body.description === undefined
+      ? undefined
+      : typeof body.description === "string"
+        ? body.description.trim()
+        : "";
   const message = typeof body.message === "string" ? body.message : "";
   const timezoneRaw =
     typeof body.timezone === "string" ? body.timezone.trim() : "";
@@ -190,6 +208,9 @@ function handleCreateSchedule(body: Record<string, unknown>) {
   if (!name) throw new BadRequestError("name is required");
   if (!expression) throw new BadRequestError("expression is required");
   if (!message) throw new BadRequestError("message is required");
+  if (description === "") {
+    throw new BadRequestError("description is required");
+  }
 
   // The settings UI only exposes execute mode for now. Other modes
   // remain reachable via the schedule_create LLM tool.
@@ -209,6 +230,7 @@ function handleCreateSchedule(body: Record<string, unknown>) {
   try {
     const job = createSchedule({
       name,
+      description,
       message,
       mode: "execute",
       enabled,
@@ -304,6 +326,15 @@ function handleUpdateSchedule(id: string, body: Record<string, unknown>) {
     }
   }
 
+  if ("description" in body) {
+    const description =
+      typeof body.description === "string" ? body.description.trim() : "";
+    if (!description) {
+      throw new BadRequestError("description is required");
+    }
+    updates.description = description;
+  }
+
   if (updates.timeoutMs != null) {
     if (typeof updates.timeoutMs !== "number") {
       throw new BadRequestError("timeoutMs must be a number or null");
@@ -460,6 +491,12 @@ export const ROUTES: RouteDefinition[] = [
     tags: ["schedules"],
     requestBody: z.object({
       name: z.string().describe("Display name"),
+      description: z
+        .string()
+        .describe(
+          "Authored schedule description. Defaults to the schedule name when omitted for backward compatibility.",
+        )
+        .optional(),
       expression: z.string().describe("Cron or RRULE expression"),
       message: z.string().describe("Message body to execute on each fire"),
       timezone: z
@@ -552,6 +589,7 @@ export const ROUTES: RouteDefinition[] = [
     tags: ["schedules"],
     requestBody: z.object({
       name: z.string().optional(),
+      description: z.string().optional(),
       expression: z.string().optional(),
       timezone: z.string().optional(),
       message: z.string().optional(),