@vellumai/vellum-gateway 0.10.11-dev.202607222129.31c06e5 → 0.10.11-dev.202607222325.35fc367

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.10.11-dev.202607222129.31c06e5",
+  "version": "0.10.11-dev.202607222325.35fc367",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/nonbash-trust-rule-overrides.test.ts

@@ -728,7 +728,7 @@ describe("graceful fallback when cache not initialized", () => {
 });
 
 describe("SkillLoadRiskClassifier inline command risk elevation", () => {
-  test("skill with inline expansions is classified as medium risk", async () => {
+  test("skill with inline expansions is classified as high risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
       toolName: "skill_load",
@@ -743,7 +743,7 @@ describe("SkillLoadRiskClassifier inline command risk elevation", () => {
       },
     });
 
-    expect(result.riskLevel).toBe("medium");
+    expect(result.riskLevel).toBe("high");
     expect(result.reason).toContain("inline command expansions");
   });
 

package/src/__tests__/telegram-webhook-handler.test.ts

@@ -260,6 +260,32 @@ describe("telegram webhook handler: gatewayInternalBaseUrl", () => {
       "http://127.0.0.1:7830/deliver/telegram",
     );
   });
+
+  test("topic messages append threadId to the replyCallbackUrl", async () => {
+    const config = makeConfig({
+      gatewayInternalBaseUrl: "http://gateway.internal:9000",
+      routingEntries: [
+        { type: "conversation_id", key: "12345", assistantId: "assistant-a" },
+      ],
+    });
+    installFetchMock();
+    const { handler } = createTelegramWebhookHandler(config, makeCaches());
+
+    const base = makeTelegramPayload("hello topic", 2002);
+    const payload = {
+      ...base,
+      message: { ...base.message, message_thread_id: 777 },
+    };
+    const res = await handler(makeWebhookRequest(payload));
+
+    expect(res.status).toBe(200);
+
+    const runtimeCall = fetchCalls.find((c) => c.url.includes("/inbound"));
+    expect(runtimeCall).toBeDefined();
+    expect((runtimeCall!.body as any).replyCallbackUrl).toBe(
+      "http://gateway.internal:9000/deliver/telegram?threadId=777",
+    );
+  });
 });
 
 describe("telegram webhook handler: /new rejection", () => {

package/src/http/routes/telegram-webhook.ts

@@ -293,10 +293,31 @@ export function createTelegramWebhookHandler(
         chatId: normalized.message.conversationExternalId,
         messageId: normalized.message.externalMessageId,
         updateId,
+        threadId: normalized.source.threadId,
       },
       "Webhook received",
     );
 
+    // Private-chat topic scoping: when the inbound message belongs to a topic,
+    // the reply callback URL carries the thread id (the Telegram analog of
+    // Slack's `?threadTs=`) so the runtime's transport echoes it on outbound
+    // sends, and the gateway's own direct replies target the same topic.
+    // Messages outside a topic keep the bare URL and thread-less sends.
+    const topicThreadId = normalized.source.threadId;
+    const threadOpts = topicThreadId
+      ? { messageThreadId: topicThreadId }
+      : undefined;
+    // Every gateway direct reply in this handler targets the same topic (or
+    // main chat) as the inbound message — one decision, made once.
+    const replyOpts = {
+      credentials: caches?.credentials,
+      configFile: caches?.configFile,
+      ...threadOpts,
+    };
+    const replyCallbackUrl = topicThreadId
+      ? `${config.gatewayInternalBaseUrl}/deliver/telegram?${new URLSearchParams({ threadId: topicThreadId })}`
+      : `${config.gatewayInternalBaseUrl}/deliver/telegram`;
+
     // Handle /start command — forward to runtime as a channel command intent
     const startCmd = parseTelegramStartCommand(normalized.message.content);
     if (startCmd !== null) {
@@ -322,10 +343,7 @@ export function createTelegramWebhookHandler(
             normalized.message.conversationExternalId,
             "\u26a0\ufe0f This bot is not fully set up yet. Please check the gateway configuration.",
             undefined,
-            {
-              credentials: caches?.credentials,
-              configFile: caches?.configFile,
-            },
+            replyOpts,
           ).catch((err) => {
             tlog.error(
               { err, chatId: normalized.message.conversationExternalId },
@@ -350,7 +368,7 @@ export function createTelegramWebhookHandler(
           normalized.message.conversationExternalId,
           START_COMMAND_ACK_TEXT,
           undefined,
-          { credentials: caches?.credentials },
+          replyOpts,
         ).catch((err) => {
           tlog.error(
             { err, chatId: normalized.message.conversationExternalId },
@@ -362,7 +380,7 @@ export function createTelegramWebhookHandler(
       try {
         const result = await handleInbound(config, normalized, {
           transportMetadata: buildTelegramTransportMetadata(),
-          replyCallbackUrl: `${config.gatewayInternalBaseUrl}/deliver/telegram`,
+          replyCallbackUrl,
           traceId,
           sourceMetadata: {
             commandIntent: {
@@ -391,10 +409,7 @@ export function createTelegramWebhookHandler(
               normalized.message.conversationExternalId,
               "\u26a0\ufe0f This bot is not fully set up yet. Please check the gateway configuration.",
               undefined,
-              {
-                credentials: caches?.credentials,
-                configFile: caches?.configFile,
-              },
+              replyOpts,
             ).catch((err) => {
               tlog.error(
                 { err, chatId: normalized.message.conversationExternalId },
@@ -414,10 +429,7 @@ export function createTelegramWebhookHandler(
             normalized.message.conversationExternalId,
             "Welcome! I'm having a brief setup hiccup. Please try again in a moment.",
             undefined,
-            {
-              credentials: caches?.credentials,
-              configFile: caches?.configFile,
-            },
+            replyOpts,
           ).catch((err) => {
             tlog.error({ err }, "Failed to send /start fallback reply");
           });
@@ -437,10 +449,7 @@ export function createTelegramWebhookHandler(
                 normalized.message.conversationExternalId,
                 startRuntimeResp.replyText,
                 undefined,
-                {
-                  credentials: caches?.credentials,
-                  configFile: caches?.configFile,
-                },
+                replyOpts,
               ).catch((err) => {
                 tlog.error(
                   { err, chatId: normalized.message.conversationExternalId },
@@ -479,7 +488,7 @@ export function createTelegramWebhookHandler(
           normalized.message.conversationExternalId,
           "Welcome! I'm having a brief setup hiccup. Please try again in a moment.",
           undefined,
-          { credentials: caches?.credentials },
+          replyOpts,
         ).catch((replyErr) => {
           tlog.error({ err: replyErr }, "Failed to send /start error fallback");
         });
@@ -516,10 +525,7 @@ export function createTelegramWebhookHandler(
             normalized.message.conversationExternalId,
             `\u26a0\ufe0f ${ROUTING_REJECTION_NOTICE}`,
             undefined,
-            {
-              credentials: caches?.credentials,
-              configFile: caches?.configFile,
-            },
+            replyOpts,
           ).catch((err) => {
             tlog.error(
               { err, chatId: normalized.message.conversationExternalId },
@@ -538,13 +544,11 @@ export function createTelegramWebhookHandler(
               normalized.message.conversationExternalId,
               text,
               undefined,
-              {
-                credentials: caches?.credentials,
-                configFile: caches?.configFile,
-              },
+              replyOpts,
             );
           },
           tlog,
+          topicThreadId,
         );
       }
 
@@ -689,7 +693,7 @@ export function createTelegramWebhookHandler(
       const result = await handleInbound(config, normalized, {
         attachmentIds,
         transportMetadata: buildTelegramTransportMetadata(),
-        replyCallbackUrl: `${config.gatewayInternalBaseUrl}/deliver/telegram`,
+        replyCallbackUrl,
         traceId,
       });
 
@@ -704,10 +708,7 @@ export function createTelegramWebhookHandler(
             chatId,
             `\u26a0\ufe0f ${ROUTING_REJECTION_NOTICE}`,
             undefined,
-            {
-              credentials: caches?.credentials,
-              configFile: caches?.configFile,
-            },
+            replyOpts,
           ).catch((err) => {
             tlog.error(
               { err, chatId },
@@ -750,10 +751,13 @@ export function createTelegramWebhookHandler(
       if (runtimeResp?.denied && runtimeResp.replyText) {
         const msgSender = normalized.actor.actorExternalId ?? chatId;
         if (recordDenialReplyIfAllowed("telegram", msgSender)) {
-          sendTelegramReply(config, chatId, runtimeResp.replyText, undefined, {
-            credentials: caches?.credentials,
-            configFile: caches?.configFile,
-          }).catch((err) => {
+          sendTelegramReply(
+            config,
+            chatId,
+            runtimeResp.replyText,
+            undefined,
+            replyOpts,
+          ).catch((err) => {
             tlog.error(
               { err, chatId },
               "Failed to send ACL denial fallback reply",

package/src/risk/skill-risk-classifier.test.ts

@@ -145,6 +145,10 @@ describe("allowlistOptions", () => {
       skillSelector: "dynamic-skill",
       resolvedMetadata: metadata,
     });
+    expect(result.riskLevel).toBe("high");
+    expect(result.reason).toBe(
+      "Skill load with inline command expansions (executes shell commands at load time)",
+    );
     expect(result.allowlistOptions).toEqual([
       {
         label: "dynamic-skill@trans789",

package/src/risk/skill-risk-classifier.ts

@@ -178,13 +178,15 @@ export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierIn
     switch (toolName) {
       case "skill_load": {
         // Skills with inline command expansions execute shell commands at load
-        // time via child_process.spawn, bypassing the normal bash-tool
-        // permission pipeline. Elevate to medium so the default auto-approve
-        // threshold (low) requires an explicit prompt instead of silently
-        // running embedded commands.
+        // time via child_process.spawn, outside the normal bash-tool permission
+        // pipeline. Classify as high so the standard auto-approve threshold
+        // governs them like any other high-risk action: they auto-approve only
+        // at Full access (autoApproveUpTo "high") and prompt at every level
+        // below it. A user trust rule that covers the load lowers this
+        // downstream (arriving as matchType "user_rule").
         const hasExpansions = resolvedMetadata?.hasInlineExpansions === true;
         assessment = {
-          riskLevel: hasExpansions ? "medium" : "low",
+          riskLevel: hasExpansions ? "high" : "low",
           reason: hasExpansions
             ? "Skill load with inline command expansions (executes shell commands at load time)"
             : "Skill load (default)",

package/src/telegram/normalize.test.ts

@@ -25,6 +25,74 @@ function makeCallbackQueryPayload(overrides?: {
   };
 }
 
+describe("normalizeTelegramUpdate — private-chat topics", () => {
+  it("maps message_thread_id to source.threadId", () => {
+    const result = normalizeTelegramUpdate({
+      update_id: 500,
+      message: {
+        message_id: 50,
+        message_thread_id: 777,
+        text: "hello topic",
+        chat: { id: 42, type: "private" },
+        from: { id: 42, first_name: "Alice" },
+      },
+    });
+
+    expect(result).not.toBeNull();
+    expect(result!.source.threadId).toBe("777");
+    expect(result!.message.content).toBe("hello topic");
+  });
+
+  it("leaves source.threadId undefined for messages outside a topic", () => {
+    const result = normalizeTelegramUpdate({
+      update_id: 501,
+      message: {
+        message_id: 51,
+        text: "plain dm",
+        chat: { id: 42, type: "private" },
+        from: { id: 42, first_name: "Alice" },
+      },
+    });
+
+    expect(result).not.toBeNull();
+    expect(result!.source.threadId).toBeUndefined();
+  });
+
+  it("maps callback_query message_thread_id to source.threadId", () => {
+    const result = normalizeTelegramUpdate({
+      update_id: 502,
+      callback_query: {
+        id: "cbq-topic",
+        from: { id: 42, first_name: "Alice" },
+        message: {
+          message_id: 52,
+          message_thread_id: 777,
+          chat: { id: 42, type: "private" },
+        },
+        data: "apr:run1:approve",
+      },
+    });
+
+    expect(result).not.toBeNull();
+    expect(result!.source.threadId).toBe("777");
+  });
+
+  it("still rejects group messages even when they carry message_thread_id", () => {
+    const result = normalizeTelegramUpdate({
+      update_id: 503,
+      message: {
+        message_id: 53,
+        message_thread_id: 777,
+        text: "forum topic message",
+        chat: { id: -100123, type: "supergroup" },
+        from: { id: 42, first_name: "Alice" },
+      },
+    });
+
+    expect(result).toBeNull();
+  });
+});
+
 describe("normalizeTelegramUpdate — callback_query DM-only guard", () => {
   it("accepts callback_query from private chat", () => {
     const result = normalizeTelegramUpdate(

package/src/telegram/normalize.ts

@@ -37,6 +37,7 @@ interface TelegramAudio {
 
 interface TelegramMessage {
   message_id?: number;
+  message_thread_id?: number;
   text?: string;
   caption?: string;
   chat?: { id?: number; type?: string };
@@ -54,6 +55,17 @@ interface TelegramMessage {
   audio?: TelegramAudio;
 }
 
+/**
+ * Topic thread id of a private-chat message, as a string, or undefined for
+ * messages outside a topic. Callers run after the DM-only guard, so a thread
+ * id here always identifies a private-chat topic.
+ */
+function threadIdFromMessage(message: TelegramMessage): string | undefined {
+  return message.message_thread_id != null
+    ? String(message.message_thread_id)
+    : undefined;
+}
+
 interface TelegramCallbackQuery {
   id: string;
   from: {
@@ -114,6 +126,7 @@ export function normalizeTelegramUpdate(
     }
 
     const actorExternalId = String(cbq.from.id);
+    const callbackThreadId = threadIdFromMessage(cbq.message);
 
     const displayName = [cbq.from?.first_name, cbq.from?.last_name]
       .filter(Boolean)
@@ -147,6 +160,7 @@ export function normalizeTelegramUpdate(
             ? String(cbq.message.message_id)
             : undefined,
         chatType: cbq.message.chat.type,
+        ...(callbackThreadId ? { threadId: callbackThreadId } : {}),
       },
       raw: payload,
     };
@@ -183,6 +197,8 @@ export function normalizeTelegramUpdate(
     .join(" ")
     .trim();
 
+  const topicThreadId = threadIdFromMessage(message);
+
   const content = message.text || message.caption || "";
 
   const attachments: {
@@ -253,6 +269,7 @@ export function normalizeTelegramUpdate(
       messageId:
         message.message_id != null ? String(message.message_id) : undefined,
       chatType: message.chat.type,
+      ...(topicThreadId ? { threadId: topicThreadId } : {}),
     },
     raw: payload,
   };

package/src/telegram/send.ts

@@ -50,9 +50,15 @@ export async function sendTelegramReply(
   chatId: string,
   text: string,
   approval?: ApprovalUIMetadata,
-  opts?: { credentials?: CredentialCache; configFile?: ConfigFileCache },
+  opts?: {
+    credentials?: CredentialCache;
+    configFile?: ConfigFileCache;
+    /** Private-chat topic to send into; omitted → main chat. */
+    messageThreadId?: string;
+  },
 ): Promise<void> {
   const chunks = splitText(text, TELEGRAM_MAX_MESSAGE_LEN);
+  const messageThreadId = opts?.messageThreadId?.trim();
 
   for (let i = 0; i < chunks.length; i++) {
     const payload: Record<string, unknown> = {
@@ -60,6 +66,13 @@ export async function sendTelegramReply(
       text: chunks[i],
     };
 
+    // message_thread_id is the Bot API topic field for both forum supergroups
+    // and private chats of bots with topic ("threaded") mode enabled.
+    // (direct_messages_topic_id is a different surface — channel monoforums.)
+    if (messageThreadId) {
+      payload.message_thread_id = Number(messageThreadId);
+    }
+
     // Attach inline keyboard only to the last chunk so buttons appear after
     // the full message text.
     if (approval && i === chunks.length - 1) {