@vellumai/credential-executor 0.10.7 → 0.10.8-dev.202607102228.5945895

package/Dockerfile

@@ -80,4 +80,4 @@ EXPOSE 8090
 ENV CES_MODE=managed
 ENV CES_HEALTH_PORT=8090
 
-CMD ["bun", "run", "src/managed-main.ts"]
+CMD ["bun", "run", "src/main.ts"]

package/node_modules/@vellumai/service-contracts/package.json

@@ -13,9 +13,8 @@
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",
     "./handles": "./src/handles.ts",
-    "./grants": "./src/grants.ts",
     "./rpc": "./src/rpc.ts",
-    "./rendering": "./src/rendering.ts",
+    "./attachment-naming": "./src/attachment-naming.ts",
     "./error": "./src/error.ts"
   },
   "scripts": {

package/node_modules/@vellumai/service-contracts/src/__tests__/attachment-naming.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  inferMimeType,
+  resolveAttachmentFilename,
+} from "../attachment-naming.js";
+
+describe("inferMimeType", () => {
+  test("maps known extensions case-insensitively", () => {
+    expect(inferMimeType("shot.PNG")).toBe("image/png");
+    expect(inferMimeType("report.pdf")).toBe("application/pdf");
+  });
+
+  test("falls back to octet-stream for unknown or missing extensions", () => {
+    expect(inferMimeType("desktop")).toBe("application/octet-stream");
+    expect(inferMimeType("archive.xyz")).toBe("application/octet-stream");
+  });
+});
+
+describe("resolveAttachmentFilename", () => {
+  test("uses explicit filenames verbatim", () => {
+    expect(
+      resolveAttachmentFilename("custom.dat", "/tmp/shot.png", "explicit"),
+    ).toBe("custom.dat");
+  });
+
+  test("honors labels with recognized extensions", () => {
+    expect(
+      resolveAttachmentFilename("nice-name.png", "/tmp/shot.png", "label"),
+    ).toBe("nice-name.png");
+  });
+
+  test("keeps bare labels and appends the POSIX path extension", () => {
+    expect(resolveAttachmentFilename("desktop", "/tmp/shot.png", "label")).toBe(
+      "desktop.png",
+    );
+  });
+
+  test("keeps bare labels and appends the Windows path extension", () => {
+    expect(
+      resolveAttachmentFilename(
+        "desktop",
+        "C:\\Users\\user1\\Pictures\\shot.png",
+        "label",
+      ),
+    ).toBe("desktop.png");
+  });
+
+  test("bare labels to files sharing a basename resolve to unique names", () => {
+    expect(
+      resolveAttachmentFilename("first", "/workspace/a/result.png", "label"),
+    ).toBe("first.png");
+    expect(
+      resolveAttachmentFilename("second", "/workspace/b/result.png", "label"),
+    ).toBe("second.png");
+  });
+
+  test("does not duplicate an unknown extension the label already has", () => {
+    expect(
+      resolveAttachmentFilename(
+        "report.xlsx",
+        "/workspace/report.xlsx",
+        "label",
+      ),
+    ).toBe("report.xlsx");
+  });
+
+  test("matches the existing extension case-insensitively", () => {
+    expect(
+      resolveAttachmentFilename("data.YAML", "/workspace/data.yaml", "label"),
+    ).toBe("data.YAML");
+  });
+
+  test("still appends when the label ends differently", () => {
+    expect(
+      resolveAttachmentFilename(
+        "summary.v2",
+        "/workspace/data.parquet",
+        "label",
+      ),
+    ).toBe("summary.v2.parquet");
+  });
+
+  test("falls back to the basename when the path has no extension", () => {
+    expect(resolveAttachmentFilename("label", "/tmp/rawfile", "label")).toBe(
+      "rawfile",
+    );
+  });
+
+  test("uses the basename when no preferred name is given", () => {
+    expect(
+      resolveAttachmentFilename(undefined, "C:\\temp\\report.pdf", "label"),
+    ).toBe("report.pdf");
+    expect(resolveAttachmentFilename(undefined, "/tmp/report.pdf")).toBe(
+      "report.pdf",
+    );
+  });
+
+  test("ignores trailing separators", () => {
+    expect(resolveAttachmentFilename(undefined, "/tmp/dir/", "label")).toBe(
+      "dir",
+    );
+  });
+});

package/node_modules/@vellumai/service-contracts/src/__tests__/contracts.test.ts

@@ -27,9 +27,7 @@ describe("package independence", () => {
   const sourceFiles = [
     "../index.ts",
     "../handles.ts",
-    "../grants.ts",
     "../rpc.ts",
-    "../rendering.ts",
     "../transport.ts",
     "../credential-rpc.ts",
     "../trust-rules.ts",

package/node_modules/@vellumai/service-contracts/src/attachment-naming.ts

@@ -0,0 +1,118 @@
+/**
+ * Attachment filename contract shared by the daemon (which materializes
+ * `vellum://` links and `<vellum-attachment>` directives into stored
+ * attachments) and the web client (which resolves clicked links back to
+ * those attachments). Both sides must agree on the stored filename, so the
+ * naming rule lives here once.
+ */
+
+const EXTENSION_MIME_MAP: Record<string, string> = {
+  // Images
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  ico: "image/x-icon",
+  bmp: "image/bmp",
+  heic: "image/heic",
+  heif: "image/heif",
+
+  // Documents
+  pdf: "application/pdf",
+  json: "application/json",
+  xml: "application/xml",
+  csv: "text/csv",
+  txt: "text/plain",
+  md: "text/markdown",
+  html: "text/html",
+  css: "text/css",
+  js: "text/javascript",
+  ts: "text/typescript",
+
+  // Audio
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  flac: "audio/flac",
+  aac: "audio/aac",
+  m4a: "audio/x-m4a",
+  opus: "audio/opus",
+
+  // Video
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  mpeg: "video/mpeg",
+
+  // Archives
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+};
+
+/**
+ * Infer a MIME type from a filename extension.
+ * Returns `application/octet-stream` when the extension is unrecognised.
+ */
+export function inferMimeType(filename: string): string {
+  const dot = filename.lastIndexOf(".");
+  if (dot === -1) {
+    return "application/octet-stream";
+  }
+  const ext = filename.slice(dot + 1).toLowerCase();
+  return EXTENSION_MIME_MAP[ext] ?? "application/octet-stream";
+}
+
+/**
+ * Pick the stored attachment filename for a materialized file directive.
+ *
+ * Explicit filenames (`<vellum-attachment filename="..." />` attributes)
+ * are an authoring contract and always used verbatim. Link display text
+ * (`[label](vellum://...)`) is cosmetic: it is only honored as the filename
+ * when it carries a recognized extension. A bare label
+ * (e.g. `[desktop](vellum://.../shot.png)`) would otherwise produce an
+ * extensionless download with an `application/octet-stream` MIME type,
+ * which macOS opens as raw text. In that case the label keeps the path's
+ * extension (`desktop.png`), staying unique per link even when several
+ * links share a basename; the raw basename is the last resort.
+ *
+ * The basename fallback splits on both `/` and `\\` so it handles POSIX
+ * sandbox paths, `vellum://` URL paths, and Windows host paths alike.
+ * Splitting on both separators regardless of the runtime platform also
+ * covers Windows host paths resolved by a non-Windows daemon, which
+ * platform-selected `node:path` semantics cannot.
+ */
+export function resolveAttachmentFilename(
+  preferred: string | undefined,
+  resolvedPath: string,
+  filenameSource: "explicit" | "label" = "explicit",
+): string {
+  const fallback =
+    resolvedPath.split(/[\\/]/).filter(Boolean).pop() ?? resolvedPath;
+  if (!preferred) {
+    return fallback;
+  }
+  if (filenameSource === "explicit") {
+    return preferred;
+  }
+  if (inferMimeType(preferred) !== "application/octet-stream") {
+    return preferred;
+  }
+  // Bare label: keep the label as a per-link disambiguator (two links to
+  // different files sharing a basename must not collide, because the
+  // transcript resolves clicks by filename) and append the path's
+  // extension so the stored name carries the correct type. Skip the
+  // append when the label already ends with that extension (a label like
+  // `report.xlsx` for `report.xlsx` must not become `report.xlsx.xlsx`).
+  const dot = fallback.lastIndexOf(".");
+  if (dot > 0 && dot < fallback.length - 1) {
+    const ext = fallback.slice(dot + 1);
+    if (preferred.toLowerCase().endsWith(`.${ext.toLowerCase()}`)) {
+      return preferred;
+    }
+    return `${preferred}.${ext}`;
+  }
+  return fallback;
+}

package/node_modules/@vellumai/service-contracts/src/credential-rpc.ts

@@ -2,13 +2,13 @@
  * @vellumai/service-contracts/credential-rpc
  *
  * Domain entrypoint for the CES (Credential Execution Service) transport and
- * RPC surface. Re-exports the transport/RPC/handles/grants/rendering/error
- * contracts without the trust-rule helpers.
+ * RPC surface. Re-exports the transport/RPC/handles/error contracts without
+ * the trust-rule helpers.
  *
  * Prefer this subpath over the root `.` import when you only need the
  * credential RPC surface:
  *
- *   import { CesRpcMethod, MakeAuthenticatedRequestSchema } from "@vellumai/service-contracts/credential-rpc";
+ *   import { CesRpcMethod, GetCredentialSchema } from "@vellumai/service-contracts/credential-rpc";
  *
  * For trust-rule types use the dedicated subpath:
  *
@@ -18,6 +18,4 @@
 export * from "./transport.js";
 export * from "./error.js";
 export * from "./handles.js";
-export * from "./grants.js";
-export * from "./rendering.js";
 export * from "./rpc.js";

package/node_modules/@vellumai/service-contracts/src/index.ts

@@ -4,13 +4,13 @@
  * This is a compatibility aggregate that re-exports everything from all
  * submodules. Prefer the explicit domain subpaths for new code:
  *
- *   - `@vellumai/service-contracts/credential-rpc`  — transport, RPC, handles, grants, rendering, error
+ *   - `@vellumai/service-contracts/credential-rpc`  — transport, RPC, handles, error
  *   - `@vellumai/service-contracts/trust-rules`     — trust-rule types and parsing helpers
  *   - `@vellumai/service-contracts/twilio-ingress`  — shared Twilio ingress config constants
  *   - `@vellumai/service-contracts/ingress`         — shared public ingress URL helpers
  *
  * Fine-grained subpaths are also available for low-friction migration:
- *   `./rpc`, `./handles`, `./grants`, `./rendering`, `./error`, `./trust-rules`, `./ingress`, `./twilio-ingress`
+ *   `./rpc`, `./handles`, `./error`, `./trust-rules`, `./ingress`, `./twilio-ingress`
  *
  * Neutral wire-protocol contracts for communication between the assistant
  * daemon and the Credential Execution Service (CES). This package is
@@ -23,9 +23,7 @@ export * from "./client-metadata.js";
 export * from "./transport.js";
 export * from "./error.js";
 export * from "./handles.js";
-export * from "./grants.js";
 export * from "./rpc.js";
-export * from "./rendering.js";
 export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./twilio-ingress.js";