@vellumai/assistant 0.9.0-staging.1 → 0.9.0

package/src/config/bundled-skills/app-builder/tools/app-update.ts

@@ -2,6 +2,10 @@ import { setAppCommitMessage } from "../../../../memory/app-git-service.js";
 import * as appStore from "../../../../memory/app-store.js";
 import type { AppUpdateInput } from "../../../../tools/apps/executors.js";
 import { executeAppUpdate } from "../../../../tools/apps/executors.js";
+import {
+  missingAppIdError,
+  resolveAppId,
+} from "../../../../tools/apps/resolve-app-id.js";
 import type {
   ToolContext,
   ToolExecutionResult,
@@ -14,5 +18,10 @@ export async function run(
   if (typeof input.change_summary === "string" && input.change_summary.trim()) {
     setAppCommitMessage(context.conversationId, input.change_summary.trim());
   }
-  return executeAppUpdate(input as unknown as AppUpdateInput, appStore);
+  const appId = resolveAppId(input, context.conversationId);
+  if (!appId) return missingAppIdError();
+  return executeAppUpdate(
+    { ...input, app_id: appId } as unknown as AppUpdateInput,
+    appStore,
+  );
 }

package/src/daemon/conversation-surfaces.ts

@@ -7,6 +7,7 @@ import {
   getAppDirPath,
   getAppPreview,
   isMultifileApp,
+  listAppsByConversation,
   resolveAppDir,
   resolveEffectiveAppHtml,
   updateApp,
@@ -179,6 +180,18 @@ export function flushSurfaceDataPersist(surfaceId: string): void {
   persistSurfaceData(pending.conversationId, surfaceId, pending.data);
 }
 
+/**
+ * Discard (without writing) any pending debounced persist for `surfaceId`.
+ * Called on dismissal so an in-flight `ui_update` snapshot cannot land after
+ * the surface block has been removed.
+ */
+export function cancelSurfaceDataPersist(surfaceId: string): void {
+  const pending = pendingSurfacePersists.get(surfaceId);
+  if (!pending) return;
+  clearTimeout(pending.timer);
+  pendingSurfacePersists.delete(surfaceId);
+}
+
 /**
  * Cancel all pending debounced persists. Called on conversation
  * teardown to avoid timers firing against torn-down state.
@@ -277,6 +290,60 @@ export function markSurfaceCompleted(
     log.warn({ err, surfaceId }, "Failed to persist surface completion to DB");
   }
 }
+
+/**
+ * Remove a `ui_surface` content block from history so a passively dismissed
+ * surface does not survive a reload. The live client drops a dismissed surface
+ * entirely; this converges persisted state with that behaviour. Cancels any
+ * pending debounced data persist first so a late `ui_update` snapshot cannot
+ * re-add the block, then strips the block from in-memory messages and the DB.
+ */
+export function removeSurfaceBlock(
+  ctx: { conversationId: string; messages?: Array<{ content: unknown }> },
+  surfaceId: string,
+): void {
+  cancelSurfaceDataPersist(surfaceId);
+
+  if (ctx.messages) {
+    for (let i = ctx.messages.length - 1; i >= 0; i--) {
+      const msg = ctx.messages[i];
+      if (!Array.isArray(msg.content)) continue;
+      const idx = msg.content.findIndex((block) => {
+        const b = block as Record<string, unknown>;
+        return b.type === "ui_surface" && b.surfaceId === surfaceId;
+      });
+      if (idx !== -1) {
+        msg.content.splice(idx, 1);
+        break;
+      }
+    }
+  }
+
+  try {
+    const rows = getMessages(ctx.conversationId);
+    for (let r = rows.length - 1; r >= 0; r--) {
+      let parsed: unknown[];
+      try {
+        const result = JSON.parse(rows[r].content);
+        if (!Array.isArray(result)) continue;
+        parsed = result;
+      } catch {
+        continue;
+      }
+      const idx = parsed.findIndex((pb) => {
+        const rb = pb as Record<string, unknown>;
+        return rb.type === "ui_surface" && rb.surfaceId === surfaceId;
+      });
+      if (idx !== -1) {
+        parsed.splice(idx, 1);
+        updateMessageContent(rows[r].id, JSON.stringify(parsed));
+        return;
+      }
+    }
+  } catch (err) {
+    log.warn({ err, surfaceId }, "Failed to remove dismissed surface from DB");
+  }
+}
 const TASK_PROGRESS_TEMPLATE_FIELDS = ["title", "status", "steps"] as const;
 
 const TASK_PROGRESS_CARD_STATUSES = new Set([
@@ -2858,6 +2925,15 @@ export async function surfaceProxyResolver(
         conversationId: ctx.conversationId,
         surfaceId,
       });
+      // The live client drops a dismissed surface entirely. Mirror that in
+      // persisted state: pull it from the pending turn snapshot (appended to
+      // the message at turn completion) and strip any already-persisted block,
+      // so a reload does not resurrect a half-finished progress card.
+      const turnIdx = ctx.currentTurnSurfaces.findIndex(
+        (s) => s.surfaceId === surfaceId,
+      );
+      if (turnIdx !== -1) ctx.currentTurnSurfaces.splice(turnIdx, 1);
+      removeSurfaceBlock(ctx, surfaceId);
     }
     ctx.pendingSurfaceActions.delete(surfaceId);
     ctx.surfaceState.delete(surfaceId);
@@ -2871,11 +2947,24 @@ export async function surfaceProxyResolver(
   }
 
   if (toolName === "app_open") {
-    const appId = input.app_id as string;
+    // Weaker models routinely omit app_id even though the active app is in
+    // context. Fall back to the conversation's most-recently-updated app
+    // rather than failing with "Invalid ID: undefined".
+    let appId = input.app_id as string;
+    if (typeof appId !== "string" || appId.trim().length === 0) {
+      appId = listAppsByConversation(ctx.conversationId)[0]?.id ?? "";
+    }
     const preview = input.preview as DynamicPageSurfaceData["preview"];
     const openMode = input.open_mode as string | undefined;
-    const app = getApp(appId);
-    if (!app) return { content: `App not found: ${appId}`, isError: true };
+    const app = appId ? getApp(appId) : null;
+    if (!app) {
+      return {
+        content: appId
+          ? `App not found: ${appId}`
+          : "app_id is required and no active app exists in this conversation. Call app_create first, or pass app_id explicitly.",
+        isError: true,
+      };
+    }
 
     // Track conversation association (best-effort — failures must not break open flow).
     try {

package/src/notifications/home-feed-side-effect.ts

@@ -58,10 +58,8 @@ export async function writeHomeFeedItemForSignal(
   decision: NotificationDecision,
   fallbackConversationId?: string,
 ): Promise<FeedItem | null> {
-  const { mirror, sourceConversationId } = resolveHomeFeedMirror(
-    signal,
-    fallbackConversationId,
-  );
+  const { mirror, sourceConversationId, sourceScheduleJobId } =
+    resolveHomeFeedMirror(signal, fallbackConversationId);
   if (!mirror) return null;
 
   const renderedCopy =
@@ -106,13 +104,28 @@ export async function writeHomeFeedItemForSignal(
 
   const category = deriveCategory(signal);
   const panelKind = deriveDetailPanelKind(signal);
-  const metadata =
+
+  const baseMetadata =
     signal.contextPayload &&
     typeof signal.contextPayload === "object" &&
     !Array.isArray(signal.contextPayload)
-      ? (signal.contextPayload as Record<string, unknown>)
+      ? { ...(signal.contextPayload as Record<string, unknown>) }
       : undefined;
 
+  // Link scheduled-run notifications back to their schedule. `notify`-mode
+  // jobs put `scheduleId` directly in the context payload; `execute`-mode (and
+  // other agent-backed) jobs only tag their conversation, so fall back to the
+  // source conversation's `scheduleJobId`.
+  const scheduleId =
+    readPayloadString(signal.contextPayload, "scheduleId") ??
+    sourceScheduleJobId ??
+    undefined;
+
+  const metadata =
+    scheduleId !== undefined
+      ? { ...(baseMetadata ?? {}), scheduleId }
+      : baseMetadata;
+
   const item: FeedItem = {
     id: `notif:${signal.signalId}`,
     type: "notification",
@@ -202,8 +215,11 @@ function resolveHomeFeedMirror(
 ): {
   mirror: boolean;
   sourceConversationId?: string;
+  sourceScheduleJobId?: string;
 } {
-  let sourceRow: { conversationType?: string } | null = null;
+  let sourceRow:
+    | { conversationType?: string; scheduleJobId?: string | null }
+    | null = null;
   if (signal.sourceContextId) {
     try {
       sourceRow = getConversation(signal.sourceContextId) ?? null;
@@ -219,15 +235,16 @@ function resolveHomeFeedMirror(
   const sourceConversationId = sourceRow
     ? signal.sourceContextId
     : fallbackConversationId;
+  const sourceScheduleJobId = sourceRow?.scheduleJobId ?? undefined;
 
   if (signal.sourceChannel === "assistant_tool") {
-    return { mirror: true, sourceConversationId };
+    return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
   if (signal.attentionHints.isAsyncBackground) {
-    return { mirror: true, sourceConversationId };
+    return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
   if (isBackgroundConversationType(sourceRow?.conversationType)) {
-    return { mirror: true, sourceConversationId };
+    return { mirror: true, sourceConversationId, sourceScheduleJobId };
   }
   return { mirror: false };
 }

package/src/runtime/channel-invite-transports/telegram.ts

@@ -9,6 +9,8 @@
  * verification) tokens that use the same `/start` deep-link mechanism.
  */
 
+import type { CommandIntent, SourceMetadata } from "@vellumai/gateway-client";
+
 import type { ChannelId } from "../../channels/types.js";
 import {
   invalidateConfigCache,
@@ -130,17 +132,16 @@ export const telegramInviteAdapter: ChannelInviteAdapter = {
   },
 
   extractInboundToken(params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: SourceMetadata;
   }): string | undefined {
     // Primary path: structured command intent from the gateway.
     // The gateway normalizes `/start <payload>` into
     // `{ type: 'start', payload: '<payload>' }`.
     if (
-      params.commandIntent &&
-      params.commandIntent.type === "start" &&
-      typeof params.commandIntent.payload === "string"
+      params.commandIntent?.type === "start" &&
+      params.commandIntent.payload
     ) {
       const payload = params.commandIntent.payload;
       if (payload.startsWith(INVITE_TOKEN_PREFIX)) {

package/src/runtime/channel-invite-transports/voice.ts

@@ -40,9 +40,9 @@ export const voiceInviteAdapter: ChannelInviteAdapter = {
   },
 
   extractInboundToken(_params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: import("@vellumai/gateway-client").CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: import("@vellumai/gateway-client").SourceMetadata;
   }): string | undefined {
     // Voice invite redemption bypasses generic token extraction — it uses
     // the identity-bound voice-code flow in invite-redemption-service.ts.

package/src/runtime/channel-invite-types.ts

@@ -3,6 +3,8 @@
  * transport ↔ channel-invite-transports/* cycles (×5).
  */
 
+import type { CommandIntent, SourceMetadata } from "@vellumai/gateway-client";
+
 import type { ChannelId } from "../channels/types.js";
 
 export interface InviteShareLink {
@@ -31,9 +33,9 @@ export interface ChannelInviteAdapter {
    * channels with link-based invites.
    */
   extractInboundToken?(params: {
-    commandIntent?: Record<string, unknown>;
+    commandIntent?: CommandIntent;
     content: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: SourceMetadata;
   }): string | undefined;
 
   /**

package/src/runtime/channel-retry-sweep.ts

@@ -35,6 +35,7 @@ import {
   deliverReplyViaCallback,
   findAssistantReplyMessageIdForTurn,
 } from "./channel-reply-delivery.js";
+import { finalizeEventDelivery } from "./finalize-event-delivery.js";
 import { deliverChannelReply } from "./gateway-client.js";
 import type { MessageProcessor } from "./http-types.js";
 import { createSlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
@@ -154,7 +155,7 @@ export async function sweepFailedEvents(
       parseInterfaceId(payload.sourceChannel) ??
       "web";
     const sourceMetadata = payload.sourceMetadata as
-      | Record<string, unknown>
+      | import("@vellumai/gateway-client").SourceMetadata
       | undefined;
     const assistantId =
       typeof payload.assistantId === "string" ? payload.assistantId : undefined;
@@ -334,46 +335,23 @@ export async function sweepFailedEvents(
       continue;
     }
 
-    if (replyCallbackUrl) {
-      if (externalChatId) {
-        try {
-          if (slackDmTextDelivery) {
-            await slackDmTextDelivery.waitForPendingDeliveries();
-          }
-          // processMessage above generated a fresh assistant response, so any
-          // previously tracked final-delivery progress belongs to the old
-          // response and must not carry over. Use live Slack DM progress as
-          // the new baseline before final delivery so delivery-only retries do
-          // not duplicate text if the callback fails before reporting progress.
-          const liveDeliveryResumeOptions =
-            slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
-          const finalDeliveryStartFromSegment =
-            liveDeliveryResumeOptions?.startFromSegment ?? 0;
-          updateDeliveredSegmentCount(event.id, finalDeliveryStartFromSegment);
-          await deliverReplyViaCallback(
-            event.conversationId,
-            externalChatId,
-            replyCallbackUrl,
-            assistantId,
-            {
-              messageId: replyMessageId,
-              sinceMessageId: userMessageId,
-              startFromSegment: finalDeliveryStartFromSegment,
-              ...(liveDeliveryResumeOptions?.messageTs
-                ? { messageTs: liveDeliveryResumeOptions.messageTs }
-                : {}),
-              onSegmentDelivered: (count) =>
-                updateDeliveredSegmentCount(event.id, count),
-            },
-          );
-          markDeliveryDelivered(event.id);
-        } catch (err) {
-          log.error(
-            { err, eventId: event.id },
-            "Retry delivery failed for channel event",
-          );
-          recordDeliveryFailure(event.id, err);
-        }
+    if (replyCallbackUrl && externalChatId) {
+      try {
+        await finalizeEventDelivery({
+          eventId: event.id,
+          conversationId: event.conversationId,
+          externalChatId,
+          replyCallbackUrl,
+          assistantId,
+          replyMessageId,
+          userMessageId,
+          slackDmTextDelivery,
+        });
+      } catch (err) {
+        log.error(
+          { err, eventId: event.id },
+          "Retry delivery failed for channel event",
+        );
       }
     }
   }

package/src/runtime/finalize-event-delivery.ts

@@ -0,0 +1,72 @@
+import { updateDeliveredSegmentCount } from "../memory/delivery-channels.js";
+import {
+  markDeliveryDelivered,
+  recordDeliveryFailure,
+} from "../memory/delivery-status.js";
+import { deliverReplyViaCallback } from "./channel-reply-delivery.js";
+import type { SlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
+
+/**
+ * Owns the complete delivery-after-processing sequence for a channel
+ * inbound event: waits for in-flight live Slack DM deliveries to settle,
+ * persists the segment baseline so delivery-only retries resume correctly,
+ * delivers remaining content + attachments, and transitions the event to
+ * its terminal delivery state.
+ *
+ * Both the primary dispatch path and the processing-retry path call this
+ * function. The delivery-only retry path does NOT use this function — it
+ * reads the already-persisted segment count and calls
+ * `deliverReplyViaCallback` directly.
+ */
+export async function finalizeEventDelivery(params: {
+  eventId: string;
+  conversationId: string;
+  externalChatId: string;
+  replyCallbackUrl: string;
+  assistantId: string | undefined;
+  replyMessageId: string | undefined;
+  userMessageId: string | undefined;
+  slackDmTextDelivery: SlackDmTextDeliveryController | undefined;
+}): Promise<void> {
+  const {
+    eventId,
+    conversationId,
+    externalChatId,
+    replyCallbackUrl,
+    assistantId,
+    replyMessageId,
+    userMessageId,
+    slackDmTextDelivery,
+  } = params;
+
+  if (slackDmTextDelivery) {
+    await slackDmTextDelivery.waitForPendingDeliveries();
+  }
+
+  const resumeOptions =
+    slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
+  const startFromSegment = resumeOptions?.startFromSegment ?? 0;
+  try {
+    updateDeliveredSegmentCount(eventId, startFromSegment);
+    await deliverReplyViaCallback(
+      conversationId,
+      externalChatId,
+      replyCallbackUrl,
+      assistantId,
+      {
+        messageId: replyMessageId,
+        sinceMessageId: userMessageId,
+        startFromSegment,
+        ...(resumeOptions?.messageTs
+          ? { messageTs: resumeOptions.messageTs }
+          : {}),
+        onSegmentDelivered: (count) =>
+          updateDeliveredSegmentCount(eventId, count),
+      },
+    );
+    markDeliveryDelivered(eventId);
+  } catch (err) {
+    recordDeliveryFailure(eventId, err);
+    throw err;
+  }
+}

package/src/runtime/routes/channel-delivery-routes.ts

@@ -2,7 +2,11 @@
  * Channel delivery routes: delivery ack, dead letters, reply delivery,
  * and post-decision delivery scheduling.
  */
-import { acknowledgeDelivery, getDeadLetterEvents, replayDeadLetters } from "../../memory/delivery-status.js";
+import {
+  acknowledgeDelivery,
+  getDeadLetterEvents,
+  replayDeadLetters,
+} from "../../memory/delivery-status.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteHandlerArgs } from "./types.js";
 
@@ -10,6 +14,7 @@ export {
   type DeliverReplyOptions,
   deliverReplyViaCallback,
 } from "../channel-reply-delivery.js";
+export { finalizeEventDelivery } from "../finalize-event-delivery.js";
 
 // ---------------------------------------------------------------------------
 // Dead letter management
@@ -36,12 +41,11 @@ export function handleReplayDeadLetters({ body = {} }: RouteHandlerArgs) {
 // ---------------------------------------------------------------------------
 
 export function handleChannelDeliveryAck({ body = {} }: RouteHandlerArgs) {
-  const { sourceChannel, conversationExternalId, externalMessageId } =
-    body as {
-      sourceChannel?: string;
-      conversationExternalId?: string;
-      externalMessageId?: string;
-    };
+  const { sourceChannel, conversationExternalId, externalMessageId } = body as {
+    sourceChannel?: string;
+    conversationExternalId?: string;
+    externalMessageId?: string;
+  };
 
   if (!sourceChannel || typeof sourceChannel !== "string") {
     throw new BadRequestError("sourceChannel is required");

package/src/runtime/routes/channel-route-definitions.ts

@@ -1,6 +1,8 @@
 /**
  * Static ROUTES array for channel endpoints.
  */
+import { RuntimeInboundPayloadSchema } from "@vellumai/gateway-client";
+
 import { ACTOR_PRINCIPALS, GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import {
   handleChannelDeliveryAck,
@@ -38,6 +40,7 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     summary: "Process inbound channel message",
     description: "Receive an inbound message from a channel integration.",
     tags: ["channels"],
+    requestBody: RuntimeInboundPayloadSchema,
     handler: handleChannelInbound,
   },
   {

package/src/runtime/routes/inbound-message-handler.ts

@@ -4,6 +4,8 @@
  * verification, guardian action answers, approval interception, and
  * invite token redemption.
  */
+import type { SourceMetadata } from "@vellumai/gateway-client";
+
 import {
   attachmentsToContentBlocks,
   type MessageAttachmentInput,
@@ -127,16 +129,16 @@ function trimMetadataString(
 
 function parseSlackActorTimezoneMetadata(
   sourceChannel: string,
-  metadata: Record<string, unknown> | undefined,
+  metadata: SourceMetadata | undefined,
 ): SlackActorTimezoneMetadata | undefined {
   if (sourceChannel !== "slack") return undefined;
 
-  const timezone = trimMetadataString(metadata, "timezone");
-  const timezoneLabel = trimMetadataString(metadata, "timezoneLabel");
-  const rawOffset = metadata?.timezoneOffsetSeconds;
+  const timezone = metadata?.timezone?.trim() || undefined;
+  const timezoneLabel = metadata?.timezoneLabel?.trim() || undefined;
   const timezoneOffsetSeconds =
-    typeof rawOffset === "number" && Number.isFinite(rawOffset)
-      ? rawOffset
+    metadata?.timezoneOffsetSeconds != null &&
+    Number.isFinite(metadata.timezoneOffsetSeconds)
+      ? metadata.timezoneOffsetSeconds
       : undefined;
 
   if (
@@ -193,17 +195,16 @@ function resolveSlackTranscriptTimestampTimezone(
 
 function resolveInboundClientTimezone(params: {
   bodyClientTimezone?: unknown;
-  sourceMetadata?: Record<string, unknown>;
+  sourceMetadata?: SourceMetadata;
   conversationId: string;
 }): string | undefined {
   const bodyClientTimezone =
     typeof params.bodyClientTimezone === "string"
       ? canonicalizeTimeZone(params.bodyClientTimezone)
       : undefined;
-  const metadataClientTimezone =
-    typeof params.sourceMetadata?.clientTimezone === "string"
-      ? canonicalizeTimeZone(params.sourceMetadata.clientTimezone)
-      : undefined;
+  const metadataClientTimezone = params.sourceMetadata?.clientTimezone
+    ? canonicalizeTimeZone(params.sourceMetadata.clientTimezone)
+    : undefined;
   return (
     bodyClientTimezone ??
     metadataClientTimezone ??
@@ -248,7 +249,7 @@ export async function handleChannelInbound({
     attachmentIds?: string[];
     actorExternalId?: string;
     actorUsername?: string;
-    sourceMetadata?: Record<string, unknown>;
+    sourceMetadata?: SourceMetadata;
     replyCallbackUrl?: string;
     callbackQueryId?: string;
     callbackData?: string;

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -2,10 +2,9 @@
  * Ingress ACL enforcement stage: resolves the inbound actor to a member
  * record, enforces allow/deny/escalate policies, handles invite token
  * intercepts, and notifies the guardian of denied access requests.
- *
- * Extracted from inbound-message-handler.ts to keep the top-level handler
- * focused on orchestration.
  */
+import type { SourceMetadata } from "@vellumai/gateway-client";
+
 import { isInviteCodeRedemptionEnabled } from "../../../channels/config.js";
 import type { ChannelId } from "../../../channels/types.js";
 import {
@@ -85,7 +84,7 @@ export interface AclEnforcementParams {
   conversationExternalId: string;
   canonicalAssistantId: string;
   trimmedContent: string;
-  sourceMetadata: Record<string, unknown> | undefined;
+  sourceMetadata: SourceMetadata | undefined;
   actorDisplayName: string | undefined;
   actorUsername: string | undefined;
   replyCallbackUrl: string | undefined;
@@ -138,40 +137,21 @@ export async function enforceIngressAcl(
   } = params;
 
   // Trust signals from Slack users.info, forwarded via sourceMetadata.
-  const isStranger = sourceMetadata?.isStranger === true ? true : undefined;
-  const isRestricted = sourceMetadata?.isRestricted === true ? true : undefined;
+  const isStranger = sourceMetadata?.isStranger ?? undefined;
+  const isRestricted = sourceMetadata?.isRestricted ?? undefined;
 
   // Slack message timestamp for permalink construction.
-  const messageTs =
-    typeof sourceMetadata?.messageId === "string"
-      ? sourceMetadata.messageId
-      : undefined;
+  const messageTs = sourceMetadata?.messageId ?? undefined;
 
   let resolvedMember: ResolvedMember | null = null;
 
   // /start gv_<token> bootstrap commands must also bypass ACL — the user
   // hasn't been verified yet and needs to complete the bootstrap handshake.
-  const rawCommandIntentForAcl = sourceMetadata?.commandIntent;
+  const commandIntentForAcl = sourceMetadata?.commandIntent;
   const isBootstrapCommand =
-    rawCommandIntentForAcl &&
-    typeof rawCommandIntentForAcl === "object" &&
-    !Array.isArray(rawCommandIntentForAcl) &&
-    (rawCommandIntentForAcl as Record<string, unknown>).type === "start" &&
-    typeof (rawCommandIntentForAcl as Record<string, unknown>).payload ===
-      "string" &&
-    (
-      (rawCommandIntentForAcl as Record<string, unknown>).payload as string
-    ).startsWith("gv_");
-
-  // Parse invite token from /start payloads using the channel transport
-  // adapter. The token is extracted once here so both the ACL bypass and
-  // the intercept handler can reference it without re-parsing.
-  const commandIntentForAcl =
-    rawCommandIntentForAcl &&
-    typeof rawCommandIntentForAcl === "object" &&
-    !Array.isArray(rawCommandIntentForAcl)
-      ? (rawCommandIntentForAcl as Record<string, unknown>)
-      : undefined;
+    commandIntentForAcl?.type === "start" &&
+    typeof commandIntentForAcl.payload === "string" &&
+    commandIntentForAcl.payload.startsWith("gv_");
   const inviteAdapter = getInviteAdapterRegistry().get(sourceChannel);
   const inviteToken = inviteAdapter?.extractInboundToken?.({
     commandIntent: commandIntentForAcl,
@@ -205,9 +185,7 @@ export async function enforceIngressAcl(
       // any `/start gv_<garbage>` would bypass the not_a_member gate and
       // fall through to normal /start processing.
       if (isBootstrapCommand) {
-        const bootstrapPayload = (
-          rawCommandIntentForAcl as Record<string, unknown>
-        ).payload as string;
+        const bootstrapPayload = commandIntentForAcl!.payload!;
         const bootstrapTokenForAcl = bootstrapPayload.slice(3); // strip 'gv_' prefix
         const bootstrapSessionForAcl = resolveBootstrapToken(
           sourceChannel,
@@ -476,9 +454,7 @@ export async function enforceIngressAcl(
         // (pending/revoked), but never for blocked members.
         let denyInactiveMember = true;
         if (!isBlockedMember && isBootstrapCommand) {
-          const bootstrapPayload = (
-            rawCommandIntentForAcl as Record<string, unknown>
-          ).payload as string;
+          const bootstrapPayload = commandIntentForAcl!.payload!;
           const bootstrapTokenForAcl = bootstrapPayload.slice(3);
           const bootstrapSessionForAcl = resolveBootstrapToken(
             sourceChannel,