@vellumai/assistant 0.9.0-dev.202606181735.ae6e1d8 → 0.9.0-dev.202606181858.5b26a8a

package/docs/activation-funnel-telemetry.md

@@ -50,8 +50,9 @@ Flow, end to end:
      `assistant/src/telemetry/activation-funnel.ts`;
    - emission is best-effort (wrapped in try/catch) and never blocks or alters
      the surface-action flow;
-   - `recordActivationEvent` respects the `getConfig().collectUsageData` opt-out
-     gate (returns `null` / no row when disabled).
+   - `recordActivationEvent` respects the platform `share_analytics` consent gate
+     via `getCachedShareAnalytics()` (returns `null` / no row when the platform
+     user has not consented; default-off when there is no platform session).
 2. **Reporter flushes** every ~5 min: `usage-telemetry-reporter.ts`
    (`REPORT_INTERVAL_MS = 5 * 60 * 1000`, with a one-time
    `INITIAL_FLUSH_DELAY_MS = 30_000` after startup) POSTs unreported onboarding
@@ -172,22 +173,27 @@ When the flag is ON, the web prechat context selects
 `BOOTSTRAP-ACTIVATION-RAIL.md` as the bootstrap template, and the daemon marks
 the conversation in `activation_sessions` on first build of the system prompt.
 
-### 5.2 Confirm usage-data collection is enabled — and do NOT run in dev mode
-
-Two gates must both be satisfied or no rows reach BigQuery:
-
-1. `recordActivationEvent` no-ops when `config.collectUsageData` is false, so the
-   dev build/config must have usage-data collection enabled, or no rows are
-   written to SQLite.
-2. **Dev mode disables the flush entirely.** `assistant/src/daemon/lifecycle.ts`
-   computes the effective setting as `collectUsageData = !isDevMode &&
-config.collectUsageData`, so when the daemon runs in dev mode (`VELLUM_DEV=1`)
-   the `UsageTelemetryReporter` is never started — rows accumulate in SQLite but
-   are never POSTed, and the "wait/restart for flush" steps below will never
-   reach BigQuery. For an end-to-end smoke test, run the daemon **outside dev
-   mode** (so the reporter starts), or explicitly invoke the reporter's
-   `flush()` via a dev hook. The SQLite rows can still be inspected directly in
-   dev mode, but the BigQuery verification (§6) requires a real flush.
+### 5.2 Confirm share_analytics consent is on — and pick the right daemon mode
+
+Two distinct concerns: whether record-time rows reach SQLite (consent gate), and
+whether those rows reach BigQuery (flush gate, dev-disabled).
+
+1. `recordActivationEvent` no-ops when the platform `share_analytics` consent is
+   off (it reads `getCachedShareAnalytics()`), and the consent is **default-off
+   when there is no platform session**. So the dev session must be signed in to
+   the platform with `share_analytics` consent enabled, or no rows are written to
+   SQLite. The consent cache is refreshed by `startConsentRefresh()` in
+   `assistant/src/daemon/lifecycle.ts`, which runs **regardless of dev mode** — so
+   a dev session signed in with `share_analytics` consent enabled writes
+   record-time rows to SQLite, where they can be inspected directly.
+2. **Dev mode disables the flush entirely.** When the daemon runs in dev mode
+   (`VELLUM_DEV=1`), `assistant/src/daemon/lifecycle.ts` never starts the
+   `UsageTelemetryReporter` — rows accumulate in SQLite (consent permitting) but
+   are never POSTed, and the "wait/restart for flush" steps below will never reach
+   BigQuery. For an end-to-end smoke test, run the daemon **outside dev mode** (so
+   the reporter starts), or explicitly invoke the reporter's `flush()` via a dev
+   hook. The SQLite rows can be inspected directly in dev mode, but the BigQuery
+   verification (§6) requires a real flush.
 
 ### 5.3 Start a fresh activation conversation and capture its id
 

package/openapi.yaml

@@ -14569,6 +14569,54 @@ paths:
       responses:
         "200":
           description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  servers:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        id:
+                          type: string
+                        status:
+                          type: string
+                        transport:
+                          type: object
+                          properties:
+                            type:
+                              type: string
+                              enum:
+                                - stdio
+                                - sse
+                                - streamable-http
+                          required:
+                            - type
+                          additionalProperties: {}
+                        enabled:
+                          type: boolean
+                        defaultRiskLevel:
+                          type: string
+                        allowedTools:
+                          type: array
+                          items:
+                            type: string
+                        blockedTools:
+                          type: array
+                          items:
+                            type: string
+                      required:
+                        - id
+                        - status
+                        - transport
+                        - enabled
+                        - defaultRiskLevel
+                      additionalProperties: false
+                required:
+                  - servers
+                additionalProperties: false
   /v1/internal/mcp/reload:
     post:
       operationId: internal_mcp_reload_post
@@ -14600,6 +14648,104 @@ paths:
       responses:
         "200":
           description: Successful response
+  /v1/internal/mcp/tools-summary:
+    get:
+      operationId: internal_mcp_toolssummary_get
+      summary: Per-server MCP tool counts and token estimates
+      description:
+        Returns registered tool counts, individual tool details, and estimated token overhead for each connected
+        MCP server.
+      tags:
+        - internal
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  servers:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        serverId:
+                          type: string
+                        toolCount:
+                          type: number
+                        estimatedTokens:
+                          type: number
+                        tools:
+                          type: array
+                          items:
+                            type: object
+                            properties:
+                              name:
+                                type: string
+                              description:
+                                type: string
+                              estimatedTokens:
+                                type: number
+                            required:
+                              - name
+                              - description
+                              - estimatedTokens
+                            additionalProperties: false
+                      required:
+                        - serverId
+                        - toolCount
+                        - estimatedTokens
+                        - tools
+                      additionalProperties: false
+                  totalToolCount:
+                    type: number
+                  totalEstimatedTokens:
+                    type: number
+                required:
+                  - servers
+                  - totalToolCount
+                  - totalEstimatedTokens
+                additionalProperties: false
+  /v1/internal/mcp/update:
+    post:
+      operationId: internal_mcp_update_post
+      summary: Update an MCP server configuration
+      description: Updates fields on an existing MCP server config entry and triggers a reload.
+      tags:
+        - internal
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                enabled:
+                  type: boolean
+                defaultRiskLevel:
+                  type: string
+                maxTools:
+                  type: number
+                allowedTools:
+                  anyOf:
+                    - type: array
+                      items:
+                        type: string
+                    - type: "null"
+                blockedTools:
+                  anyOf:
+                    - type: array
+                      items:
+                        type: string
+                    - type: "null"
+              required:
+                - name
+      responses:
+        "200":
+          description: Successful response
   /v1/internal/oauth/callback:
     post:
       operationId: internal_oauth_callback_post

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.9.0-dev.202606181735.ae6e1d8",
+  "version": "0.9.0-dev.202606181858.5b26a8a",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-trust-resolver-address-fallback.test.ts

@@ -43,7 +43,6 @@ const PHONE = "+15559871234";
 function makeContact(
   role: "guardian" | "contact" = "contact",
   status: "unverified" | "active" = "unverified",
-  externalUserId: string | null = null,
 ): ContactWithChannels {
   const channelId = "ch-test";
   return {
@@ -64,7 +63,6 @@ function makeContact(
         contactId: "contact-test",
         type: "phone",
         address: PHONE,
-        externalUserId,
         externalChatId: null,
         isPrimary: true,
         status,
@@ -94,7 +92,7 @@ describe("resolveActorTrust — address fallback", () => {
 
   test("finds unverified channel via address when externalUserId is null", () => {
     // Simulate a contact registered by name-capture: address set, externalUserId null.
-    _byAddress = makeContact("contact", "unverified", null);
+    _byAddress = makeContact("contact", "unverified");
 
     const result = resolveActorTrust({
       assistantId: "asst-1",
@@ -112,7 +110,7 @@ describe("resolveActorTrust — address fallback", () => {
   });
 
   test("address lookup is the sole member resolution path", () => {
-    _byAddress = makeContact("contact", "active", null);
+    _byAddress = makeContact("contact", "active");
 
     const result = resolveActorTrust({
       assistantId: "asst-1",
@@ -142,7 +140,7 @@ describe("resolveActorTrust — address fallback", () => {
   test("address-found active channel elevates trust to trusted_contact", () => {
     // An active channel found via address (e.g. after manual verify without externalUserId set)
     // should still yield trusted_contact trust class.
-    _byAddress = makeContact("contact", "active", null);
+    _byAddress = makeContact("contact", "active");
 
     const result = resolveActorTrust({
       assistantId: "asst-1",
@@ -159,7 +157,7 @@ describe("resolveActorTrust — address fallback", () => {
   test("pending-status member is classified as unverified_contact", () => {
     // Mirrors the unverified branch but for `pending` status (e.g. a phone
     // contact registered by name-capture awaiting the DTMF challenge).
-    const contact = makeContact("contact", "unverified", PHONE);
+    const contact = makeContact("contact", "unverified");
     // Override status to "pending" — makeContact only accepts unverified/active
     contact.channels[0]!.status = "pending";
     _byAddress = contact;
@@ -178,7 +176,7 @@ describe("resolveActorTrust — address fallback", () => {
   test("blocked-status member is classified as unknown (not unverified_contact)", () => {
     // Hard-deny statuses (blocked, revoked) stay `unknown` — admission-layer
     // re-checks channel.status and emits the hard-deny reasons.
-    const contact = makeContact("contact", "unverified", PHONE);
+    const contact = makeContact("contact", "unverified");
     contact.channels[0]!.status = "blocked";
     _byAddress = contact;
 
@@ -194,7 +192,7 @@ describe("resolveActorTrust — address fallback", () => {
   });
 
   test("revoked-status member is classified as unknown", () => {
-    const contact = makeContact("contact", "unverified", PHONE);
+    const contact = makeContact("contact", "unverified");
     contact.channels[0]!.status = "revoked";
     _byAddress = contact;
 

package/src/__tests__/auth-fallback-events-store.test.ts

@@ -7,18 +7,10 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-let collectUsageData = true;
+let shareAnalytics = true;
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    ui: {},
-    model: "test",
-    provider: "test",
-    memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0 },
-    secretDetection: { enabled: false },
-    collectUsageData,
-  }),
+mock.module("../platform/consent-cache.js", () => ({
+  getCachedShareAnalytics: () => shareAnalytics,
 }));
 
 import {
@@ -53,7 +45,7 @@ const SAMPLE: AuthFallbackCount[] = [
 
 describe("auth-fallback-events-store", () => {
   beforeEach(() => {
-    collectUsageData = true;
+    shareAnalytics = true;
     resetTable();
   });
 
@@ -78,8 +70,8 @@ describe("auth-fallback-events-store", () => {
     });
   });
 
-  test("honors the collectUsageData opt-out (records nothing)", () => {
-    collectUsageData = false;
+  test("honors the share_analytics opt-out (records nothing)", () => {
+    shareAnalytics = false;
     const recorded = recordAuthFallbackCounts(1000, 2000, SAMPLE);
     expect(recorded).toBe(0);
     expect(queryUnreportedAuthFallbackEvents(0, undefined, 100).length).toBe(0);

package/src/__tests__/channel-approval-routes.test.ts

@@ -224,14 +224,12 @@ function ensureTestContact(): void {
       {
         type: "telegram",
         address: "telegram-user-default",
-        externalUserId: "telegram-user-default",
         status: "active",
         policy: "allow",
       },
       {
         type: "slack",
         address: "slack-user-default",
-        externalUserId: "slack-user-default",
         status: "active",
         policy: "allow",
       },
@@ -2054,7 +2052,6 @@ describe("requester cancel of guardian-gated pending request", () => {
         {
           type: "telegram",
           address: "requester-cancel-user",
-          externalUserId: "requester-cancel-user",
           status: "active",
           policy: "allow",
         },
@@ -2981,7 +2978,6 @@ describe("trusted-contact self-approval blocked before guardian approval row exi
         {
           type: "telegram",
           address: "tc-selfapproval-user",
-          externalUserId: "tc-selfapproval-user",
           status: "active",
           policy: "allow",
         },

package/src/__tests__/channel-inbound-disk-pressure.test.ts

@@ -97,7 +97,6 @@ function seedTrustedContact(policy: "allow" | "escalate" = "allow"): void {
       {
         type: "telegram",
         address: "telegram-user-1",
-        externalUserId: "telegram-user-1",
         status: "active",
         policy,
       },
@@ -244,7 +243,6 @@ describe("channel inbound disk pressure gate", () => {
         {
           type: "slack",
           address: "slack-user-1",
-          externalUserId: "slack-user-1",
           status: "active",
           policy: "allow",
         },

package/src/__tests__/contact-store-user-file.test.ts

@@ -75,7 +75,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "vellum",
           address: "vellum-principal-abc",
-          externalUserId: "vellum-principal-abc",
         },
       ],
     });
@@ -91,7 +90,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "slack",
           address: "u123456",
-          externalUserId: "U123456",
           externalChatId: "D987654",
         },
       ],
@@ -109,7 +107,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "slack",
           address: "ualice",
-          externalUserId: "UALICE",
           externalChatId: "DALICE",
         },
       ],
@@ -125,7 +122,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "slack",
           address: "ubob1",
-          externalUserId: "UBOB1",
           externalChatId: "DBOB1",
         },
       ],
@@ -137,7 +133,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "slack",
           address: "ubob2",
-          externalUserId: "UBOB2",
           externalChatId: "DBOB2",
         },
       ],
@@ -164,7 +159,6 @@ describe("upsertContact user_file selection", () => {
         {
           type: "phone",
           address: "+15550000",
-          externalUserId: "+15550000",
           externalChatId: "+15550000",
         },
       ],

package/src/__tests__/contacts-tools.test.ts

@@ -240,6 +240,35 @@ describe("contact_search tool", () => {
   });
 });
 
+// ── search_contacts route (HTTP/IPC compat shim) ─────────────────────
+
+describe("search_contacts route", () => {
+  beforeEach(clearContacts);
+
+  test("includes externalUserId (= address) on channels for older clients", () => {
+    const seeded = upsertFixture({
+      display_name: "Dana",
+      channels: [{ type: "slack", address: "U12345ABC" }],
+    });
+    const seededAddress = seeded.channels[0]!.address;
+
+    const searchRoute = ROUTES.find(
+      (r) => r.operationId === "search_contacts",
+    )!;
+    const contacts = searchRoute.handler({
+      body: { channelAddress: seededAddress },
+    }) as unknown as Array<{
+      channels: Array<{ address: string; externalUserId?: string }>;
+    }>;
+
+    expect(contacts.length).toBeGreaterThanOrEqual(1);
+    const channel = contacts[0]!.channels[0]!;
+    // The route re-derives the compat field from address, so SDK/macOS
+    // clients that read externalUserId keep working.
+    expect(channel.externalUserId).toBe(channel.address);
+  });
+});
+
 // ── contact_merge ───────────────────────────────────────────────────
 
 describe("contact_merge tool", () => {

package/src/__tests__/conversation-attention-telegram.test.ts

@@ -76,7 +76,6 @@ function ensureTestContact(): void {
       {
         type: "telegram",
         address: "telegram-user-default",
-        externalUserId: "telegram-user-default",
         status: "active",
         policy: "allow",
       },

package/src/__tests__/conversation-surfaces-activation-emit.test.ts

@@ -10,9 +10,11 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Usage-data collection is enabled so recordActivationEvent writes rows.
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({ collectUsageData: true }),
+// Analytics consent is granted so recordActivationEvent writes rows.
+let shareAnalytics = true;
+
+mock.module("../platform/consent-cache.js", () => ({
+  getCachedShareAnalytics: () => shareAnalytics,
 }));
 
 let broadcastedMessages: ServerMessage[] = [];
@@ -117,6 +119,7 @@ async function showTaggedChoice(
 
 describe("activation moment emission from ui_show surface commits", () => {
   beforeEach(() => {
+    shareAnalytics = true;
     broadcastedMessages = [];
     resetTables();
   });

package/src/__tests__/guardian-binding-drift-heal.test.ts

@@ -44,7 +44,7 @@ describe("healGuardianBindingDrift", () => {
     const guardian = findGuardianForChannel("vellum");
     expect(guardian).not.toBeNull();
     expect(guardian!.contact.principalId).toBe("vellum-principal-old-uuid");
-    expect(guardian!.channel.externalUserId).toBe("vellum-principal-old-uuid");
+    expect(guardian!.channel.address).toBe("vellum-principal-old-uuid");
   });
 
   test("no-op when principals already match", () => {

package/src/__tests__/guardian-routing-state.test.ts

@@ -162,7 +162,6 @@ describe("inbound-message-handler trusted-contact interactivity", () => {
         {
           type: "telegram",
           address: "telegram-user-default",
-          externalUserId: "telegram-user-default",
           status: "active",
           policy: "allow",
         },

package/src/__tests__/helpers/create-guardian-binding.ts

@@ -55,7 +55,6 @@ export function createGuardianBinding(params: {
       {
         type: params.channel,
         address: canonicalId,
-        externalUserId: canonicalId,
         externalChatId: params.guardianDeliveryChatId,
         status: "active",
         verifiedAt: Date.now(),

package/src/__tests__/internal-telemetry-routes.test.ts

@@ -7,23 +7,15 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Toggle for the collectUsageData opt-out the real store consults. The store
+// Toggle for the share_analytics opt-out the real store consults. The store
 // module is intentionally NOT mocked here — it has its own DB-backed tests, and
 // Bun's `mock.module` is process-global, so mocking it would leak into those
 // tests when files share an invocation. Exercising the real store keeps every
 // auth-fallback test order-independent.
-let collectUsageData = true;
+let shareAnalytics = true;
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    ui: {},
-    model: "test",
-    provider: "test",
-    memory: { enabled: false },
-    rateLimit: { maxRequestsPerMinute: 0 },
-    secretDetection: { enabled: false },
-    collectUsageData,
-  }),
+mock.module("../platform/consent-cache.js", () => ({
+  getCachedShareAnalytics: () => shareAnalytics,
 }));
 
 import { queryUnreportedAuthFallbackEvents } from "../memory/auth-fallback-events-store.js";
@@ -61,7 +53,7 @@ const VALID_BODY = {
 
 describe("internal-telemetry-routes: auth-fallback", () => {
   beforeEach(() => {
-    collectUsageData = true;
+    shareAnalytics = true;
     getDb().delete(authFallbackEvents).run();
   });
 
@@ -90,7 +82,7 @@ describe("internal-telemetry-routes: auth-fallback", () => {
   });
 
   test("returns skipped and persists nothing under the opt-out", () => {
-    collectUsageData = false;
+    shareAnalytics = false;
     expect(call(VALID_BODY)).toEqual({ skipped: true });
     expect(queryUnreportedAuthFallbackEvents(0, undefined, 100).length).toBe(0);
   });

package/src/__tests__/invite-redemption-service.test.ts

@@ -292,7 +292,6 @@ describe("invite-redemption-service", () => {
         {
           type: "telegram",
           address: "guardian-tg-id",
-          externalUserId: "guardian-tg-id",
           status: "revoked",
         },
       ],
@@ -346,7 +345,6 @@ describe("invite-redemption-service", () => {
         {
           type: "telegram",
           address: "guardian-own-id",
-          externalUserId: "guardian-own-id",
           status: "revoked",
         },
       ],
@@ -381,7 +379,6 @@ describe("invite-redemption-service", () => {
         {
           type: "telegram",
           address: "guardian-code-id",
-          externalUserId: "guardian-code-id",
           status: "revoked",
         },
       ],

package/src/__tests__/mcp-health-check.test.ts

@@ -75,28 +75,28 @@ describe("checkServerHealth (via internal_mcp_list route)", () => {
     mockLastError = null;
   });
 
-  test("returns Connected when server connects successfully", async () => {
+  test("returns connected when server connects successfully", async () => {
     mockConnect.mockResolvedValue(undefined);
     mockDisconnect.mockResolvedValue(undefined);
 
     const result = (await listHandler({})) as {
       servers: { status: string }[];
     };
-    expect(result.servers[0].status).toContain("Connected");
+    expect(result.servers[0].status).toBe("connected");
     expect(mockDisconnect).toHaveBeenCalled();
   });
 
-  test("returns Needs authentication when isConnected is false and no lastError", async () => {
+  test("returns needs-auth when isConnected is false and no lastError", async () => {
     mockConnect.mockResolvedValue(undefined);
     mockIsConnected = false;
 
     const result = (await listHandler({})) as {
       servers: { status: string }[];
     };
-    expect(result.servers[0].status).toContain("Needs authentication");
+    expect(result.servers[0].status).toBe("needs-auth");
   });
 
-  test("returns Error when connect fails with lastError", async () => {
+  test("returns error when connect fails with lastError", async () => {
     mockConnect.mockResolvedValue(undefined);
     mockIsConnected = false;
     mockLastError = new Error("Connection refused");
@@ -105,7 +105,6 @@ describe("checkServerHealth (via internal_mcp_list route)", () => {
     const result = (await listHandler({})) as {
       servers: { status: string }[];
     };
-    expect(result.servers[0].status).toContain("Error");
-    expect(result.servers[0].status).toContain("Connection refused");
+    expect(result.servers[0].status).toBe("error");
   });
 });

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -256,7 +256,6 @@ describe("WhatsApp channel ingress attachment resolution", () => {
         {
           type: "whatsapp",
           address: WHATSAPP_USER_ID,
-          externalUserId: WHATSAPP_USER_ID,
           status: "active",
           policy: "allow",
         },