@vellumai/assistant 0.8.3 → 0.8.5

package/src/cli/commands/conversations.ts

@@ -2,10 +2,15 @@ import { existsSync, readFileSync } from "node:fs";
 
 import type { Command } from "commander";
 
-import { cliIpcCall, exitFromIpcResult } from "../../ipc/cli-client.js";
+import {
+  cliIpcCall,
+  exitCodeFromIpcResult,
+  exitFromIpcResult,
+} from "../../ipc/cli-client.js";
 import { registerCommand } from "../lib/register-command.js";
 import { timeAgo } from "../lib/time-ago.js";
 import { log } from "../logger.js";
+import { tryResolveConversationId } from "../utils/conversation-id.js";
 import { registerConversationsDeferCommand } from "./conversations-defer.js";
 import { registerConversationsImportCommand } from "./conversations-import.js";
 
@@ -14,6 +19,23 @@ type ConversationSeedMessage = {
   content: string;
 };
 
+type SlackDetachCliResult = {
+  detached: boolean;
+  channelId: string;
+  threadTs: string;
+  source: "explicit" | "conversation_binding";
+  conversationId?: string;
+};
+
+function outputSlackDetachError(message: string, json?: boolean): void {
+  if (json) {
+    process.stdout.write(JSON.stringify({ ok: false, error: message }) + "\n");
+  } else {
+    log.error(`Error: ${message}`);
+  }
+  process.exitCode = 1;
+}
+
 function readSeedMessages(
   contentFile?: string,
 ): ConversationSeedMessage[] | undefined {
@@ -318,6 +340,111 @@ Examples:
           },
         );
 
+      // -------------------------------------------------------------------
+      // slack
+      // -------------------------------------------------------------------
+
+      const slack = conversations
+        .command("slack")
+        .description("Manage Slack conversation bindings");
+
+      slack
+        .command("detach [conversationId]")
+        .alias("mute")
+        .description("Detach the assistant from a Slack thread")
+        .option("--channel <id>", "Slack channel ID")
+        .option("--thread <ts>", "Slack thread timestamp")
+        .option("--json", "Output result as JSON")
+        .addHelpText(
+          "after",
+          `
+Arguments:
+  conversationId   Optional conversation ID. Defaults to the current skill or
+                   tool conversation when available.
+
+Detaches the assistant from Socket Mode listening for the Slack thread bound
+to a conversation, or for explicit --channel and --thread identifiers.
+
+Examples:
+  $ assistant conversations slack detach
+  $ assistant conversations slack detach conv-123
+  $ assistant conversations slack mute --channel C123 --thread 1700000000.000100
+  $ assistant conversations slack detach --json`,
+        )
+        .action(
+          async (
+            conversationIdArg: string | undefined,
+            opts: { channel?: string; thread?: string; json?: boolean },
+          ) => {
+            const channelId = opts.channel?.trim();
+            const threadTs = opts.thread?.trim();
+            const hasExplicitSlackTarget =
+              opts.channel !== undefined || opts.thread !== undefined;
+            const body: Record<string, string> = {};
+
+            if (hasExplicitSlackTarget) {
+              if (!channelId || !threadTs) {
+                outputSlackDetachError(
+                  "Both --channel and --thread are required when using explicit Slack identifiers.",
+                  opts.json,
+                );
+                return;
+              }
+              body.channelId = channelId;
+              body.threadTs = threadTs;
+            } else {
+              const conversationId = tryResolveConversationId({
+                explicit: conversationIdArg,
+              });
+              if (!conversationId) {
+                outputSlackDetachError(
+                  "No conversation ID available. Pass a conversation ID, provide --channel and --thread, or run this command from a skill or bash tool context.",
+                  opts.json,
+                );
+                return;
+              }
+              body.conversationId = conversationId;
+            }
+
+            const result = await cliIpcCall<SlackDetachCliResult>(
+              "conversation_slack_detach_cli",
+              { body },
+            );
+
+            if (!result.ok) {
+              if (opts.json) {
+                process.stdout.write(
+                  JSON.stringify({
+                    ok: false,
+                    error: result.error ?? "Failed to detach Slack thread",
+                  }) + "\n",
+                );
+                process.exitCode = exitCodeFromIpcResult(result);
+                return;
+              }
+              return exitFromIpcResult(result);
+            }
+
+            const detach = result.result!;
+            if (opts.json) {
+              process.stdout.write(
+                JSON.stringify({ ok: true, result: detach }) + "\n",
+              );
+              return;
+            }
+
+            if (detach.detached) {
+              log.info(
+                `Detached Slack thread ${detach.threadTs} in channel ${detach.channelId} from assistant listening.`,
+              );
+            } else {
+              log.info(
+                `Slack thread ${detach.threadTs} in channel ${detach.channelId} was already detached from assistant listening.`,
+              );
+            }
+          },
+        );
+
       // -------------------------------------------------------------------
       // clear
       // -------------------------------------------------------------------

package/src/cli/commands/domain.ts

@@ -38,12 +38,17 @@ for email and web presence. DNS managed by the Vellum platform.
 
 Examples:
   $ assistant domain register velly
+  $ assistant domain register velly --email-username hello
   $ assistant domain register --json
-  $ assistant domain status`,
+  $ assistant domain status velly`,
       );
 
       domain
         .command("register [subdomain]")
+        .option(
+          "--email-username <username>",
+          "Also register an email address (e.g. --email-username hello → hello@<subdomain>.domain)",
+        )
         .description(
           `Register a custom subdomain on ${baseDomain} for this assistant`,
         )
@@ -54,6 +59,10 @@ Arguments:
   subdomain   The subdomain to register (e.g. "velly" → velly.${baseDomain}).
               If omitted, the platform derives it from the assistant's name.
 
+Options:
+  --email-username <username>  Also register an email address for the domain
+                               (e.g. --email-username hello → hello@velly.${baseDomain})
+
 Registers a subdomain at <subdomain>.${baseDomain}. DNS managed by the
 Vellum platform — no manual DNS changes needed.
 
@@ -61,27 +70,36 @@ Examples:
   $ assistant domain register velly
   ✓ Registered velly.${baseDomain}
 
+  $ assistant domain register velly --email-username hello
+  ✓ Registered velly.${baseDomain} (email: hello@velly.${baseDomain})
+
   $ assistant domain register
   ✓ Registered my-assistant.${baseDomain}
 
   $ assistant domain register velly --json
-  {"domain":"velly.${baseDomain}","id":"...","status":"active","verified":true}`,
+  {"domain":"velly.${baseDomain}","id":"..."}`,
         )
         .action(
-          async (subdomain: string | undefined, _opts: unknown, cmd: Command) => {
+          async (
+            subdomain: string | undefined,
+            opts: { emailUsername?: string },
+            cmd: Command,
+          ) => {
             const body: Record<string, string> = {};
             if (subdomain) {
               body.subdomain = subdomain;
             }
+            if (opts.emailUsername) {
+              body.email_username = opts.emailUsername;
+            }
 
             const r = await cliIpcCall<{
               id: string;
               subdomain?: string;
               domain?: string;
-              status?: string;
-              verified?: boolean;
               created_at?: string;
               created?: string;
+              email_error?: { detail: string; code: string };
             }>("domain_register", { body });
 
             if (!r.ok)
@@ -104,10 +122,16 @@ Examples:
             if (shouldOutputJson(cmd)) {
               writeOutput(cmd, data);
             } else {
-              log.info(`✓ Registered ${displayDomain}`);
-              if (data.verified === false) {
+              if (opts.emailUsername && !data.email_error) {
                 log.info(
-                  "  ⚠ Domain verification pending — this usually resolves within a few seconds.",
+                  `✓ Registered ${displayDomain} (email: ${opts.emailUsername}@${displayDomain})`,
+                );
+              } else {
+                log.info(`✓ Registered ${displayDomain}`);
+              }
+              if (data.email_error) {
+                log.warn(
+                  `⚠ Email registration failed: ${data.email_error.detail}`,
                 );
               }
             }
@@ -115,32 +139,35 @@ Examples:
         );
 
       domain
-        .command("status")
-        .description("Show this assistant's domain registration and health")
+        .command("status <subdomain>")
+        .description(
+          "Show registration and DNS verification status for a subdomain",
+        )
         .addHelpText(
           "after",
           `
-Shows the domain currently registered for this assistant, including
-verification status and DNS health.
+Arguments:
+  subdomain   The subdomain to check (e.g. "velly").
+
+Shows the domain's registration details and live DNS verification
+status from the email provider.
 
 Examples:
-  $ assistant domain status
-  Domain:   velly.${baseDomain}
-  Status:   active
-  Verified: yes
-  Created:  2026-04-15
-
-  $ assistant domain status --json
-  {"domain":"velly.${baseDomain}","status":"active","verified":true,...}`,
+  $ assistant domain status velly
+  Domain:       velly.${baseDomain}
+  Verification: verified
+                DNS records have been verified. Your domain is ready to send and receive email.
+  Created:      2026-04-15
+
+  $ assistant domain status velly --json
+  {"domain":{"subdomain":"velly","id":"..."},"verification":{"status":"verified","message":"..."}}`,
         )
-        .action(async (_opts: unknown, cmd: Command) => {
+        .action(async (subdomain: string, _opts: unknown, cmd: Command) => {
           const r = await cliIpcCall<{
             results: {
               id: string;
               subdomain?: string;
               domain?: string;
-              status?: string;
-              verified?: boolean;
               created_at?: string;
               created?: string;
             }[];
@@ -154,28 +181,51 @@ Examples:
 
           const data = r.result!;
           const domains = data.results ?? [];
+          const d = domains.find(
+            (entry) => entry.subdomain === subdomain,
+          );
+
+          if (!d) {
+            if (shouldOutputJson(cmd)) {
+              writeOutput(cmd, { error: `Domain "${subdomain}" not found` });
+              process.exitCode = 1;
+            } else {
+              log.error(
+                `Domain "${subdomain}" is not registered for this assistant.`,
+              );
+              process.exitCode = 1;
+            }
+            return;
+          }
+
+          // Fetch live verification status
+          const v = await cliIpcCall<{
+            domain: string;
+            status: string;
+            message: string;
+          }>("domain_verification_status", {
+            body: { domain_id: d.id },
+          });
+
+          const verification = v.ok ? v.result : undefined;
 
           if (shouldOutputJson(cmd)) {
-            writeOutput(cmd, data);
-          } else if (domains.length === 0) {
-            log.info(
-              "No domain registered for this assistant. Run: assistant domain register [subdomain]",
-            );
+            writeOutput(cmd, { domain: d, verification: verification ?? null });
           } else {
-            for (const d of domains) {
-              const displayDomain =
-                d.domain ??
-                (d.subdomain ? `${d.subdomain}.${apexDomain}` : "unknown");
-              const createdRaw = d.created_at ?? d.created;
-              const createdDate = createdRaw
-                ? createdRaw.split("T")[0]
-                : "unknown";
-              log.info(`Domain:   ${displayDomain}`);
-              if (d.status != null) log.info(`Status:   ${d.status}`);
-              if (d.verified != null)
-                log.info(`Verified: ${d.verified ? "yes" : "no"}`);
-              log.info(`Created:  ${createdDate}`);
+            const displayDomain =
+              d.domain ??
+              (d.subdomain ? `${d.subdomain}.${apexDomain}` : "unknown");
+            const createdRaw = d.created_at ?? d.created;
+            const createdDate = createdRaw
+              ? createdRaw.split("T")[0]
+              : "unknown";
+            log.info(`Domain:       ${displayDomain}`);
+            const vStatus = verification?.status ?? "unknown";
+            log.info(`Verification: ${vStatus}`);
+            if (verification?.message) {
+              log.info(`              ${verification.message}`);
             }
+            log.info(`Created:      ${createdDate}`);
           }
         });
     },

package/src/cli/commands/inference-providers.ts

@@ -16,7 +16,12 @@
 
 import type { Command } from "commander";
 
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
+import { getConfig } from "../../config/loader.js";
 import { cliIpcCall } from "../../ipc/cli-client.js";
+import type { OAuth2Config } from "../../security/oauth2.js";
+import { startOAuth2Flow } from "../../security/oauth2.js";
+import { setSecureKeyAsync } from "../../security/secure-keys.js";
 import { log } from "../logger.js";
 
 // ---------------------------------------------------------------------------
@@ -165,7 +170,11 @@ function buildAuthInput(
     if (credential) return "--credential is not accepted with --auth none";
     return { type: "none" };
   }
-  return `Unknown auth type "${authType}". Use: api_key, platform, none`;
+  if (authType === "oauth_subscription") {
+    if (!credential) return "--credential is required when --auth oauth_subscription";
+    return { type: "oauth_subscription", credential };
+  }
+  return `Unknown auth type "${authType}". Use: api_key, platform, none, oauth_subscription`;
 }
 
 function writeCliError(msg: string, json?: boolean): void {
@@ -311,6 +320,141 @@ function attachDeleteSubcommand(connections: Command): void {
     });
 }
 
+// ---------------------------------------------------------------------------
+// OpenAI Codex OAuth config (PKCE, no client secret)
+// ---------------------------------------------------------------------------
+
+const OPENAI_CODEX_OAUTH_CONFIG: OAuth2Config = {
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenExchangeUrl: "https://auth.openai.com/oauth/token",
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  scopeSeparator: " ",
+  authorizeParams: { id_token_add_organizations: "true" },
+};
+
+// ---------------------------------------------------------------------------
+// Subcommand: login-chatgpt
+// ---------------------------------------------------------------------------
+
+function attachLoginChatgptSubcommand(providers: Command): void {
+  providers
+    .command("login-chatgpt")
+    .description("Authenticate with ChatGPT via browser OAuth flow")
+    .option("--json", "Output as JSON")
+    .action(async (opts: { json?: boolean }) => {
+      const config = getConfig();
+      if (!isAssistantFeatureFlagEnabled("chatgpt-subscription-auth", config)) {
+        writeCliError("This feature is not yet available", opts.json);
+        return;
+      }
+
+      try {
+        // Step 1: Run browser-based PKCE OAuth flow
+        process.stdout.write("Opening browser for ChatGPT authentication...\n");
+        const result = await startOAuth2Flow(
+          OPENAI_CODEX_OAUTH_CONFIG,
+          {
+            openUrl: (url) => {
+              Bun.spawn(["open", url]);
+            },
+          },
+          {
+            callbackTransport: "loopback",
+            loopbackPort: 1455,
+            loopbackCallbackPath: "/auth/callback",
+          },
+        );
+        const tokens = result.tokens;
+
+        // Step 2: Store tokens in CES
+        const accessStored = await setSecureKeyAsync(
+          "credential/chatgpt/access_token",
+          tokens.accessToken,
+        );
+        if (!accessStored) {
+          writeCliError("Failed to store access token", opts.json);
+          return;
+        }
+
+        if (tokens.refreshToken) {
+          const refreshStored = await setSecureKeyAsync(
+            "credential/chatgpt/refresh_token",
+            tokens.refreshToken,
+          );
+          if (!refreshStored) {
+            writeCliError("Failed to store refresh token", opts.json);
+            return;
+          }
+        }
+
+        if (tokens.expiresIn) {
+          const expiresAt = Math.floor(Date.now() / 1000 + tokens.expiresIn);
+          await setSecureKeyAsync(
+            "credential/chatgpt/expires_at",
+            String(expiresAt),
+          );
+        }
+
+        // Step 3: Create (or update) provider connection via IPC
+        const connectionName = "chatgpt-subscription";
+        const authInput = {
+          type: "oauth_subscription",
+          credential: "credential/chatgpt/access_token",
+        };
+
+        // Try to update first; if the connection doesn't exist, create it.
+        const updateResult = await cliIpcCall<ProviderConnection>(
+          "inference_provider_connections_update",
+          {
+            pathParams: { name: connectionName },
+            body: { auth: authInput },
+          },
+        );
+
+        if (!updateResult.ok) {
+          // Connection doesn't exist yet — create it
+          const createResult = await cliIpcCall<ProviderConnection>(
+            "inference_provider_connections_create",
+            {
+              body: {
+                name: connectionName,
+                provider: "openai",
+                auth: authInput,
+              },
+            },
+          );
+
+          if (!createResult.ok) {
+            writeCliError(
+              createResult.error ?? "Failed to create provider connection",
+              opts.json,
+            );
+            return;
+          }
+        }
+
+        if (opts.json) {
+          process.stdout.write(
+            JSON.stringify({
+              ok: true,
+              connection: connectionName,
+              message: "ChatGPT subscription auth configured successfully",
+            }) + "\n",
+          );
+        } else {
+          process.stdout.write(
+            `ChatGPT subscription auth configured successfully.\n` +
+              `Connection "${connectionName}" is ready (provider=openai, auth=oauth_subscription).\n`,
+          );
+        }
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        writeCliError(message, opts.json);
+      }
+    });
+}
+
 // ---------------------------------------------------------------------------
 // Registration
 // ---------------------------------------------------------------------------
@@ -349,4 +493,6 @@ Examples:
   attachCreateSubcommand(connections);
   attachUpdateSubcommand(connections);
   attachDeleteSubcommand(connections);
+
+  attachLoginChatgptSubcommand(providers);
 }