@vellumai/vellum-gateway 0.11.4 → 0.11.5-staging.2

package/AGENTS.md

@@ -117,6 +117,43 @@ Organize gateway code **by concern, not by technical layer** — group by what c
 
 The `slack/` module is the worked example of this shape.
 
+## Long-Lived Channel Transports Own Their Liveness
+
+A channel that holds a persistent socket (Discord Gateway, Slack Socket Mode)
+must be able to conclude on its own that its connection is dead, and recover,
+without waiting for a close event. A half-open socket, the shape a NAT rebind
+or a vanished peer leaves behind, reports itself `OPEN` indefinitely and fires
+nothing at all: no message, no error, no close. Recovery that waits to be told
+never runs.
+
+Three things are required, and a transport missing any one of them has a
+silent multi-hour outage in it:
+
+- **A liveness signal the transport generates itself.** Inbound quiet proves
+  nothing, because a quiet workspace and a dead socket are indistinguishable.
+  Discord rides its protocol heartbeat and tracks the ACK
+  (`discord/heartbeat.ts`). Slack Socket Mode has no application-level
+  heartbeat, so it probes the transport directly with a WebSocket ping frame
+  and requires a pong (`slack/socket-liveness.ts`). Prefer a probe you send
+  over a timeout you wait out.
+- **A bound on the pre-established window.** A handshake that stalls produces
+  neither `open` nor `close`, so it falls outside any watchdog that arms on a
+  live connection. See `HELLO_DEADLINE_MS` (Discord) and
+  `CONNECT_DEADLINE_MS` (Slack).
+- **Teardown that does not wait on a close event.** Recovery closes the dead
+  socket and proceeds on a timer whether or not the close ever lands. See
+  `killAndRecover` (Discord) and `forceReconnect` (Slack).
+
+Derive every threshold from something measured, and record the derivation in
+the constant's docstring. A number chosen to feel safe against expected
+traffic will be wrong: Socket Mode connections were assumed to rotate about
+hourly, and were then observed rotating several hours apart, which is exactly
+the kind of assumption an inbound-silence threshold would have been built on.
+
+The process-wide `SleepWakeDetector` is not a substitute for any of this. It
+fires only when the whole process was suspended, so it misses every connection
+that dies while the gateway is healthy and logging normally.
+
 ## Channel Trust Classification & Admission Policy
 
 The gateway owns per-channel `AdmissionPolicy` storage (`gateway/src/db/admission-policy-store.ts`, HTTP in `gateway/src/http/routes/channel-admission-policy.ts`) and attaches the floor to every forwarded inbound via `sourceMetadata.admissionPolicy`. The runtime (`assistant/src/runtime/routes/inbound-stages/admission-policy.ts`) emits `admitted: true | false` based on `TRUST_CLASS_RANK[trustClass] >= ADMISSION_FLOOR[policy]`.

package/README.md

@@ -134,14 +134,6 @@ The `/deliver/telegram` endpoint accepts an optional `approval` field in the req
 
 **Fallback behavior:** For non-rich channels that do not support inline keyboards, the runtime substitutes the `plainTextFallback` string for the structured `promptText` before calling the delivery endpoint. The fallback includes plain-text instructions so the user can respond via text. The `supportsInlineOptions` channel capability (`channelSupportsInlineOptions()`) in the runtime determines which format to use. Free-text responses are classified by the conversational approval engine.
 
-## Telegram Typing Indicator
-
-The `/deliver/telegram` endpoint also accepts an optional `chatAction` field for ephemeral Telegram chat actions. Current supported value:
-
-- `typing` — triggers Telegram `sendChatAction` with `action: "typing"` for the target `chatId`.
-
-This can be sent as an action-only payload (without `text` or `attachments`) when the runtime wants to show a typing indicator while an assistant response is still in progress.
-
 ## Public Ingress Routes
 
 The gateway serves as the single public ingress point for all external callbacks. The following routes are handled directly by the gateway before any proxy forwarding:

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/package.json

@@ -14,6 +14,7 @@
     "./remote-web-pairing": "./src/remote-web-pairing.ts",
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",
+    "./url-normalization": "./src/url-normalization.ts",
     "./handles": "./src/handles.ts",
     "./rpc": "./src/rpc.ts",
     "./attachment-naming": "./src/attachment-naming.ts",

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  canonicalizeWebUrl,
+  looksLikeHostPortShorthand,
+  looksLikePathOnlyInput,
+  normalizeWebUrl,
+} from "../url-normalization.js";
+
+/**
+ * These are the rules a trust rule is saved and matched under. A change here
+ * changes which saved rules still match, so each case states the target the
+ * two spellings must agree on.
+ */
+describe("normalizeWebUrl", () => {
+  test("keeps an ordinary https URL as-is", () => {
+    expect(normalizeWebUrl("https://example.com/docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("drops the fragment: it never reaches the server", () => {
+    expect(normalizeWebUrl("https://example.com/docs#section")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("drops userinfo so credentials cannot land in a saved rule", () => {
+    const credentialed = new URL("https://example.com/docs/page");
+    credentialed.username = "demo";
+    credentialed.password = ["c", "r", "e", "d", "1", "2", "3"].join("");
+
+    const normalized = normalizeWebUrl(credentialed.href);
+    expect(normalized?.href).toBe("https://example.com/docs/page");
+    expect(normalized?.username).toBe("");
+    expect(normalized?.password).toBe("");
+  });
+
+  test("strips a trailing root dot from the hostname", () => {
+    expect(normalizeWebUrl("https://example.com./docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("decodes escaped path segments so one path has one spelling", () => {
+    // Without this, a rule scoped to /private is bypassed by /%70rivate.
+    expect(normalizeWebUrl("https://example.com/%70rivate")?.href).toBe(
+      "https://example.com/private",
+    );
+  });
+
+  test("reads scheme-less input as https", () => {
+    expect(normalizeWebUrl("example.com/docs")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("reads host:port shorthand as an https origin, not a scheme", () => {
+    expect(normalizeWebUrl("example.com:8443/status")?.origin).toBe(
+      "https://example.com:8443",
+    );
+    expect(normalizeWebUrl("[2001:db8::1]:8443/status")?.origin).toBe(
+      "https://[2001:db8::1]:8443",
+    );
+  });
+
+  test("rejects path-only input rather than coercing it to a host", () => {
+    for (const input of ["/etc/passwd", "./rel", "../up", "?q=1", "#frag"]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects every non-http scheme", () => {
+    for (const input of [
+      "file:///etc/passwd",
+      "data:text/html,<script>",
+      "javascript:alert(1)",
+      "ftp://example.com/f",
+    ]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects empty and whitespace-only input", () => {
+    expect(normalizeWebUrl("")).toBeNull();
+    expect(normalizeWebUrl("   ")).toBeNull();
+  });
+
+  test("trims surrounding whitespace", () => {
+    expect(normalizeWebUrl("  https://example.com/a  ")?.href).toBe(
+      "https://example.com/a",
+    );
+  });
+
+  test("returns null rather than throwing on an unparseable authority", () => {
+    expect(normalizeWebUrl("https://")).toBeNull();
+  });
+});
+
+describe("canonicalizeWebUrl", () => {
+  test("keeps the parser's form when the path is not decodable, without throwing", () => {
+    // `%zz` and a truncated UTF-8 sequence are not valid escapes; the path
+    // must survive unchanged rather than the call throwing.
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%zz")).href).toBe(
+      "https://example.com/100%zz",
+    );
+    expect(
+      canonicalizeWebUrl(new URL("https://example.com/%E0%A4%A")).href,
+    ).toBe("https://example.com/%E0%A4%A");
+  });
+
+  test("decodes an escaped percent, so `%25` and `%` are one path", () => {
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%25")).href).toBe(
+      "https://example.com/100%",
+    );
+  });
+});
+
+describe("input shape predicates", () => {
+  test("host:port shorthand is recognized, scheme-prefixed input is not", () => {
+    expect(looksLikeHostPortShorthand("example.com:8443/x")).toBe(true);
+    expect(looksLikeHostPortShorthand("[2001:db8::1]:443")).toBe(true);
+    expect(looksLikeHostPortShorthand("https://example.com/x")).toBe(false);
+    expect(looksLikeHostPortShorthand("example.com/x")).toBe(false);
+  });
+
+  test("path-only input is recognized", () => {
+    expect(looksLikePathOnlyInput("/abs")).toBe(true);
+    expect(looksLikePathOnlyInput("./rel")).toBe(true);
+    expect(looksLikePathOnlyInput("../up")).toBe(true);
+    expect(looksLikePathOnlyInput("?q=1")).toBe(true);
+    expect(looksLikePathOnlyInput("#frag")).toBe(true);
+    expect(looksLikePathOnlyInput("example.com/x")).toBe(false);
+  });
+});

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,3 +29,4 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
+export * from "./url-normalization.js";

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/url-normalization.ts

@@ -0,0 +1,107 @@
+/**
+ * Canonical URL normalization for web tool inputs, shared by the gateway's
+ * risk classifiers and the daemon's URL safety checks.
+ *
+ * A URL a model passes to `web_fetch` / `network_request` reaches more than
+ * one consumer, and they must agree on what counts as the same target: the
+ * gateway builds the trust-rule ladder from it, and anything that later
+ * compares a URL to a saved rule has to fold the same spellings together. Two
+ * normalizations would mean two answers, so it lives here rather than in
+ * either process.
+ *
+ * Data-only in spirit: no imports, no config, no I/O.
+ */
+
+/** Whether a bare `host:port` (or `[v6]:port`) shorthand was written. */
+export function looksLikeHostPortShorthand(value: string): boolean {
+  if (/^\[[0-9a-fA-F:.%]+\]:\d+(?:[/?#]|$)/.test(value)) {
+    return true;
+  }
+  return /^[^/?#@\s:]+:\d+(?:[/?#]|$)/.test(value);
+}
+
+/** Whether the input is a path, query, or fragment rather than a URL. */
+export function looksLikePathOnlyInput(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("?") ||
+    value.startsWith("#")
+  );
+}
+
+/**
+ * Strip the parts of a URL that must not affect a trust decision, and fold
+ * the encodings that would otherwise let one URL wear two spellings.
+ *
+ * Percent-escaped path segments are decoded (`/%70rivate` and `/private` are
+ * one path, so a path-scoped rule cannot be bypassed by escaping), a trailing
+ * root dot is dropped from the hostname, and fragment and userinfo are
+ * removed: the fragment never reaches the server, and credentials in the
+ * authority must never end up in a saved rule.
+ */
+export function canonicalizeWebUrl(parsed: URL): URL {
+  parsed.hash = "";
+  parsed.username = "";
+  parsed.password = "";
+
+  try {
+    parsed.pathname = decodeURI(parsed.pathname);
+  } catch {
+    // Keep the URL parser's canonical form when decoding fails.
+  }
+
+  if (parsed.hostname.endsWith(".")) {
+    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
+  }
+
+  return parsed;
+}
+
+/**
+ * Parse and canonicalize a web tool's `url` input, or `null` when it is not a
+ * URL this system will fetch.
+ *
+ * Accepts `https://host/path`, `http://…`, bare `host/path`, and `host:port`
+ * shorthand. Rejects path-only input and any other scheme (`file:`, `data:`,
+ * `javascript:`), so a non-http target can never acquire a web trust rule.
+ */
+export function normalizeWebUrl(rawUrl: string): URL | null {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (looksLikeHostPortShorthand(trimmed)) {
+    try {
+      return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return canonicalizeWebUrl(parsed);
+    }
+    return null;
+  } catch {
+    // Not an absolute URL; fall through to the shorthand forms.
+  }
+
+  if (looksLikePathOnlyInput(trimmed)) {
+    return null;
+  }
+
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+
+  try {
+    return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+  } catch {
+    return null;
+  }
+}

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/package.json

@@ -14,6 +14,7 @@
     "./remote-web-pairing": "./src/remote-web-pairing.ts",
     "./twilio-ingress": "./src/twilio-ingress.ts",
     "./trust-rules": "./src/trust-rules.ts",
+    "./url-normalization": "./src/url-normalization.ts",
     "./handles": "./src/handles.ts",
     "./rpc": "./src/rpc.ts",
     "./attachment-naming": "./src/attachment-naming.ts",

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  canonicalizeWebUrl,
+  looksLikeHostPortShorthand,
+  looksLikePathOnlyInput,
+  normalizeWebUrl,
+} from "../url-normalization.js";
+
+/**
+ * These are the rules a trust rule is saved and matched under. A change here
+ * changes which saved rules still match, so each case states the target the
+ * two spellings must agree on.
+ */
+describe("normalizeWebUrl", () => {
+  test("keeps an ordinary https URL as-is", () => {
+    expect(normalizeWebUrl("https://example.com/docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("drops the fragment: it never reaches the server", () => {
+    expect(normalizeWebUrl("https://example.com/docs#section")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("drops userinfo so credentials cannot land in a saved rule", () => {
+    const credentialed = new URL("https://example.com/docs/page");
+    credentialed.username = "demo";
+    credentialed.password = ["c", "r", "e", "d", "1", "2", "3"].join("");
+
+    const normalized = normalizeWebUrl(credentialed.href);
+    expect(normalized?.href).toBe("https://example.com/docs/page");
+    expect(normalized?.username).toBe("");
+    expect(normalized?.password).toBe("");
+  });
+
+  test("strips a trailing root dot from the hostname", () => {
+    expect(normalizeWebUrl("https://example.com./docs/page")?.href).toBe(
+      "https://example.com/docs/page",
+    );
+  });
+
+  test("decodes escaped path segments so one path has one spelling", () => {
+    // Without this, a rule scoped to /private is bypassed by /%70rivate.
+    expect(normalizeWebUrl("https://example.com/%70rivate")?.href).toBe(
+      "https://example.com/private",
+    );
+  });
+
+  test("reads scheme-less input as https", () => {
+    expect(normalizeWebUrl("example.com/docs")?.href).toBe(
+      "https://example.com/docs",
+    );
+  });
+
+  test("reads host:port shorthand as an https origin, not a scheme", () => {
+    expect(normalizeWebUrl("example.com:8443/status")?.origin).toBe(
+      "https://example.com:8443",
+    );
+    expect(normalizeWebUrl("[2001:db8::1]:8443/status")?.origin).toBe(
+      "https://[2001:db8::1]:8443",
+    );
+  });
+
+  test("rejects path-only input rather than coercing it to a host", () => {
+    for (const input of ["/etc/passwd", "./rel", "../up", "?q=1", "#frag"]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects every non-http scheme", () => {
+    for (const input of [
+      "file:///etc/passwd",
+      "data:text/html,<script>",
+      "javascript:alert(1)",
+      "ftp://example.com/f",
+    ]) {
+      expect(normalizeWebUrl(input)).toBeNull();
+    }
+  });
+
+  test("rejects empty and whitespace-only input", () => {
+    expect(normalizeWebUrl("")).toBeNull();
+    expect(normalizeWebUrl("   ")).toBeNull();
+  });
+
+  test("trims surrounding whitespace", () => {
+    expect(normalizeWebUrl("  https://example.com/a  ")?.href).toBe(
+      "https://example.com/a",
+    );
+  });
+
+  test("returns null rather than throwing on an unparseable authority", () => {
+    expect(normalizeWebUrl("https://")).toBeNull();
+  });
+});
+
+describe("canonicalizeWebUrl", () => {
+  test("keeps the parser's form when the path is not decodable, without throwing", () => {
+    // `%zz` and a truncated UTF-8 sequence are not valid escapes; the path
+    // must survive unchanged rather than the call throwing.
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%zz")).href).toBe(
+      "https://example.com/100%zz",
+    );
+    expect(
+      canonicalizeWebUrl(new URL("https://example.com/%E0%A4%A")).href,
+    ).toBe("https://example.com/%E0%A4%A");
+  });
+
+  test("decodes an escaped percent, so `%25` and `%` are one path", () => {
+    expect(canonicalizeWebUrl(new URL("https://example.com/100%25")).href).toBe(
+      "https://example.com/100%",
+    );
+  });
+});
+
+describe("input shape predicates", () => {
+  test("host:port shorthand is recognized, scheme-prefixed input is not", () => {
+    expect(looksLikeHostPortShorthand("example.com:8443/x")).toBe(true);
+    expect(looksLikeHostPortShorthand("[2001:db8::1]:443")).toBe(true);
+    expect(looksLikeHostPortShorthand("https://example.com/x")).toBe(false);
+    expect(looksLikeHostPortShorthand("example.com/x")).toBe(false);
+  });
+
+  test("path-only input is recognized", () => {
+    expect(looksLikePathOnlyInput("/abs")).toBe(true);
+    expect(looksLikePathOnlyInput("./rel")).toBe(true);
+    expect(looksLikePathOnlyInput("../up")).toBe(true);
+    expect(looksLikePathOnlyInput("?q=1")).toBe(true);
+    expect(looksLikePathOnlyInput("#frag")).toBe(true);
+    expect(looksLikePathOnlyInput("example.com/x")).toBe(false);
+  });
+});

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,3 +29,4 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
+export * from "./url-normalization.js";

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/url-normalization.ts

@@ -0,0 +1,107 @@
+/**
+ * Canonical URL normalization for web tool inputs, shared by the gateway's
+ * risk classifiers and the daemon's URL safety checks.
+ *
+ * A URL a model passes to `web_fetch` / `network_request` reaches more than
+ * one consumer, and they must agree on what counts as the same target: the
+ * gateway builds the trust-rule ladder from it, and anything that later
+ * compares a URL to a saved rule has to fold the same spellings together. Two
+ * normalizations would mean two answers, so it lives here rather than in
+ * either process.
+ *
+ * Data-only in spirit: no imports, no config, no I/O.
+ */
+
+/** Whether a bare `host:port` (or `[v6]:port`) shorthand was written. */
+export function looksLikeHostPortShorthand(value: string): boolean {
+  if (/^\[[0-9a-fA-F:.%]+\]:\d+(?:[/?#]|$)/.test(value)) {
+    return true;
+  }
+  return /^[^/?#@\s:]+:\d+(?:[/?#]|$)/.test(value);
+}
+
+/** Whether the input is a path, query, or fragment rather than a URL. */
+export function looksLikePathOnlyInput(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("?") ||
+    value.startsWith("#")
+  );
+}
+
+/**
+ * Strip the parts of a URL that must not affect a trust decision, and fold
+ * the encodings that would otherwise let one URL wear two spellings.
+ *
+ * Percent-escaped path segments are decoded (`/%70rivate` and `/private` are
+ * one path, so a path-scoped rule cannot be bypassed by escaping), a trailing
+ * root dot is dropped from the hostname, and fragment and userinfo are
+ * removed: the fragment never reaches the server, and credentials in the
+ * authority must never end up in a saved rule.
+ */
+export function canonicalizeWebUrl(parsed: URL): URL {
+  parsed.hash = "";
+  parsed.username = "";
+  parsed.password = "";
+
+  try {
+    parsed.pathname = decodeURI(parsed.pathname);
+  } catch {
+    // Keep the URL parser's canonical form when decoding fails.
+  }
+
+  if (parsed.hostname.endsWith(".")) {
+    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
+  }
+
+  return parsed;
+}
+
+/**
+ * Parse and canonicalize a web tool's `url` input, or `null` when it is not a
+ * URL this system will fetch.
+ *
+ * Accepts `https://host/path`, `http://…`, bare `host/path`, and `host:port`
+ * shorthand. Rejects path-only input and any other scheme (`file:`, `data:`,
+ * `javascript:`), so a non-http target can never acquire a web trust rule.
+ */
+export function normalizeWebUrl(rawUrl: string): URL | null {
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (looksLikeHostPortShorthand(trimmed)) {
+    try {
+      return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return canonicalizeWebUrl(parsed);
+    }
+    return null;
+  } catch {
+    // Not an absolute URL; fall through to the shorthand forms.
+  }
+
+  if (looksLikePathOnlyInput(trimmed)) {
+    return null;
+  }
+
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+    return null;
+  }
+
+  try {
+    return canonicalizeWebUrl(new URL(`https://${trimmed}`));
+  } catch {
+    return null;
+  }
+}