@vellumai/vellum-gateway 0.10.9-staging.1 → 0.10.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.10.9-staging.1",
+  "version": "0.10.9",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/speech-relay-websocket.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, mock } from "bun:test";
+import { afterAll, beforeAll, describe, test, expect, mock } from "bun:test";
 import type { GatewayConfig } from "../config.js";
 import { initSigningKey, mintToken } from "../auth/token-service.js";
 import { CURRENT_POLICY_EPOCH } from "../auth/policy.js";
@@ -6,6 +6,7 @@ import type { CredentialCache } from "../credential-cache.js";
 import {
   createSpeechRelayUpgradeHandler,
   getSpeechRelayWebsocketHandlers,
+  velayOriginForPlatformHost,
   type SpeechRelaySocketData,
 } from "../http/routes/speech-relay-websocket.js";
 import { VELAY_FORWARDED_HEADER } from "../velay/bridge-utils.js";
@@ -81,6 +82,126 @@ async function bodyOf(
 
 const TOKEN = mintDaemonServiceToken();
 
+function makeKeyedCredentials(
+  values: Record<string, string | undefined>,
+): CredentialCache {
+  return {
+    get: mock(async (key: string) => values[key]),
+  } as unknown as CredentialCache;
+}
+
+describe("velay origin derivation", () => {
+  // getPlatformBaseUrl falls back to this env var; pin it absent so the
+  // missing-credential cases below are deterministic on dev machines.
+  const savedPlatformUrl = process.env.VELLUM_PLATFORM_URL;
+  beforeAll(() => {
+    delete process.env.VELLUM_PLATFORM_URL;
+  });
+  afterAll(() => {
+    if (savedPlatformUrl !== undefined) {
+      process.env.VELLUM_PLATFORM_URL = savedPlatformUrl;
+    }
+  });
+
+  test("velayOriginForPlatformHost follows the deployment naming convention", () => {
+    expect(velayOriginForPlatformHost("platform.vellum.ai")).toBe(
+      "https://velay.vellum.ai",
+    );
+    expect(velayOriginForPlatformHost("staging-platform.vellum.ai")).toBe(
+      "https://velay-staging.vellum.ai",
+    );
+    expect(velayOriginForPlatformHost("dev-platform.vellum.ai")).toBe(
+      "https://velay-dev.vellum.ai",
+    );
+    expect(velayOriginForPlatformHost("localhost")).toBeNull();
+    expect(velayOriginForPlatformHost("example.com")).toBeNull();
+    expect(
+      velayOriginForPlatformHost("staging-platform.vellum.ai.evil.com"),
+    ).toBeNull();
+  });
+
+  test("derives the velay origin from the stored platform base URL when VELAY_BASE_URL is unset", async () => {
+    const server = makeFakeServer();
+    const handler = createSpeechRelayUpgradeHandler(
+      makeConfig({ velayBaseUrl: undefined }),
+      "stt",
+      {
+        credentials: makeKeyedCredentials({
+          "credential/vellum/assistant_api_key": "vk-1",
+          "credential/vellum/platform_base_url":
+            "https://staging-platform.vellum.ai",
+        }),
+      },
+    );
+    const req = new Request(
+      `http://127.0.0.1:7830/v1/speech/stt/stream?key=${TOKEN}`,
+      { headers: { upgrade: "websocket" } },
+    );
+
+    expect(await handler(req, server)).toBeUndefined();
+    const data = (server.upgrade as unknown as { mock: { calls: unknown[][] } })
+      .mock.calls[0]![1] as { data: SpeechRelaySocketData };
+    expect(new URL(data.data.upstreamWsUrl).origin).toBe(
+      "wss://velay-staging.vellum.ai",
+    );
+    expect(new URL(data.data.upstreamHttpUrl).origin).toBe(
+      "https://velay-staging.vellum.ai",
+    );
+  });
+
+  test("falls back to prod velay for an off-convention or missing platform base URL", async () => {
+    for (const platformBaseUrl of [
+      "http://localhost:8000",
+      "not a url",
+      undefined,
+    ]) {
+      const server = makeFakeServer();
+      const handler = createSpeechRelayUpgradeHandler(
+        makeConfig({ velayBaseUrl: undefined }),
+        "stt",
+        {
+          credentials: makeKeyedCredentials({
+            "credential/vellum/assistant_api_key": "vk-1",
+            "credential/vellum/platform_base_url": platformBaseUrl,
+          }),
+        },
+      );
+      const req = new Request(
+        `http://127.0.0.1:7830/v1/speech/stt/stream?key=${TOKEN}`,
+        { headers: { upgrade: "websocket" } },
+      );
+
+      expect(await handler(req, server)).toBeUndefined();
+      const data = (
+        server.upgrade as unknown as { mock: { calls: unknown[][] } }
+      ).mock.calls[0]![1] as { data: SpeechRelaySocketData };
+      expect(new URL(data.data.upstreamWsUrl).origin).toBe(
+        "wss://velay.vellum.ai",
+      );
+    }
+  });
+
+  test("an explicit VELAY_BASE_URL wins over the stored platform base URL", async () => {
+    const server = makeFakeServer();
+    const handler = createSpeechRelayUpgradeHandler(makeConfig(), "stt", {
+      credentials: makeKeyedCredentials({
+        "credential/vellum/assistant_api_key": "vk-1",
+        "credential/vellum/platform_base_url":
+          "https://staging-platform.vellum.ai",
+      }),
+    });
+    const req = new Request(
+      `http://127.0.0.1:7830/v1/speech/stt/stream?key=${TOKEN}`,
+      { headers: { upgrade: "websocket" } },
+    );
+
+    expect(await handler(req, server)).toBeUndefined();
+    const data = (server.upgrade as unknown as { mock: { calls: unknown[][] } })
+      .mock.calls[0]![1] as { data: SpeechRelaySocketData };
+    expect(new URL(data.data.upstreamWsUrl).origin).toBe("wss://velay.test");
+  });
+});
+
 describe("createSpeechRelayUpgradeHandler — gate", () => {
   test("upgrades a daemon service connection and strips the key param", async () => {
     const server = makeFakeServer();

package/src/feature-flag-registry.json

@@ -178,14 +178,6 @@
       "description": "Show a live HUD in the top-right of the conversation with scroll geometry, velocity, update rate, and anchor-preserver activity. Developer diagnostic for investigating scroll jank.",
       "defaultEnabled": false
     },
-    {
-      "id": "coding-agents-panel",
-      "scope": "client",
-      "key": "coding-agents-panel",
-      "label": "Coding Agents Panel",
-      "description": "Gate native macOS Coding Agents panel entry points and inline ACP session deep links.",
-      "defaultEnabled": false
-    },
     {
       "id": "compaction-playground",
       "scope": "assistant",
@@ -311,7 +303,7 @@
       "scope": "assistant",
       "key": "memory-concept-graph",
       "label": "Memory concept graph",
-      "description": "Gates the Obsidian-style memory concept graph on the assistant identity page and the backend-agnostic /memory-graph + /memory-graph-node routes that feed it. When off, the identity page shows the skills constellation instead. Only produces a graph on memory-v3 backends. Default off.",
+      "description": "Gates the Obsidian-style memory concept graph on its own Memory tab (/assistant/memory) and the backend-agnostic /memory-graph + /memory-graph-node routes that feed it. When off, the Memory tab is hidden; the identity page keeps the skills constellation. Only produces a graph on memory-v3 backends. Default off.",
       "defaultEnabled": false
     },
     {

package/src/http/routes/speech-relay-websocket.ts

@@ -27,6 +27,7 @@ import type { GatewayConfig } from "../../config.js";
 import type { CredentialCache } from "../../credential-cache.js";
 import { credentialKey } from "../../credential-key.js";
 import { getLogger } from "../../logger.js";
+import { getPlatformBaseUrl } from "../../platform-url.js";
 import { VELAY_FORWARDED_HEADER } from "../../velay/bridge-utils.js";
 import { requestHasVelayBridgeAuth } from "../../velay/bridge-auth.js";
 
@@ -108,17 +109,58 @@ function jsonError(status: number, code: string, detail: string): Response {
   });
 }
 
-function velaySpeechUrls(
+/**
+ * Map a Vellum platform host onto its environment's velay origin, following
+ * the deployment naming convention (`platform.vellum.ai` → `velay.vellum.ai`,
+ * `{env}-platform.vellum.ai` → `velay-{env}.vellum.ai`). Returns null for
+ * hosts outside that convention (localhost, custom domains).
+ */
+export function velayOriginForPlatformHost(host: string): string | null {
+  if (host === "platform.vellum.ai") {
+    return "https://velay.vellum.ai";
+  }
+  const match = /^([a-z0-9-]+)-platform\.vellum\.ai$/.exec(host);
+  return match ? `https://velay-${match[1]}.vellum.ai` : null;
+}
+
+/**
+ * Resolve the velay origin for this dial. An explicit VELAY_BASE_URL always
+ * wins; otherwise derive it from the stored platform base URL so a non-prod
+ * assistant's key is presented to its own environment's velay rather than
+ * prod (which would reject it with `invalid_key`).
+ */
+async function resolveVelayBaseUrl(
   config: GatewayConfig,
+  deps: SpeechRelayDeps,
+): Promise<string> {
+  if (config.velayBaseUrl) {
+    return config.velayBaseUrl;
+  }
+  const platformBaseUrl = await getPlatformBaseUrl(deps.credentials);
+  if (platformBaseUrl) {
+    try {
+      const derived = velayOriginForPlatformHost(
+        new URL(platformBaseUrl).hostname,
+      );
+      if (derived) {
+        return derived;
+      }
+    } catch {
+      // Unparseable platform URL — fall through to the prod default.
+    }
+  }
+  return DEFAULT_VELAY_BASE_URL;
+}
+
+function velaySpeechUrls(
+  velayBaseUrl: string,
   operation: SpeechRelayOperation,
   params: URLSearchParams,
 ): { wsUrl: string; httpUrl: string } {
   // The velay tunnel client accepts ws(s):// bases too — normalize to the
   // http(s) twin first so the probe URL is always fetchable, then derive
   // the ws(s) dial URL from that.
-  const httpBase = (config.velayBaseUrl ?? DEFAULT_VELAY_BASE_URL)
-    .replace(/\/+$/, "")
-    .replace(/^ws/, "http");
+  const httpBase = velayBaseUrl.replace(/\/+$/, "").replace(/^ws/, "http");
   const query = params.toString();
   const path = `/v1/speech/${operation}/stream${query ? `?${query}` : ""}`;
   return {
@@ -221,7 +263,11 @@ export function createSpeechRelayUpgradeHandler(
         );
       }
     }
-    const { wsUrl, httpUrl } = velaySpeechUrls(config, operation, params);
+    const { wsUrl, httpUrl } = velaySpeechUrls(
+      await resolveVelayBaseUrl(config, deps),
+      operation,
+      params,
+    );
 
     // Non-upgrade request: this is the daemon's dial-failure probe.
     // Replay the gate and hand back velay's own rejection.

package/src/risk/command-registry/commands/assistant.ts

@@ -123,6 +123,7 @@ const ASSISTANT_SUPPORTED_COMMAND_PATHS = [
   "db status",
   "db repair",
   "gateway",
+  "gateway status",
   "gateway logs",
   "gateway logs tail",
   "image-generation",