@vellumai/vellum-gateway 0.12.0-staging.1 → 0.12.0

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/__tests__/channels.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  botProviderForChannel,
   CHANNEL_BOT_PROVIDER,
   CHANNEL_IDS,
+  channelForBotProvider,
   isChannelBotProvider,
   isChannelUserIntegration,
   isChannelId,
@@ -41,6 +43,35 @@ describe("isChannelId", () => {
   });
 });
 
+describe("botProviderForChannel and channelForBotProvider", () => {
+  test("are inverses over every entry of the map", () => {
+    for (const [channelId, botProviderKey] of Object.entries(
+      CHANNEL_BOT_PROVIDER,
+    )) {
+      expect(botProviderForChannel(channelId)).toBe(botProviderKey);
+      expect(channelForBotProvider(botProviderKey)).toBe(
+        channelId as keyof typeof CHANNEL_BOT_PROVIDER,
+      );
+    }
+  });
+
+  test("answer nothing for a channel without a bot, a person's grant, or an unknown key", () => {
+    expect(botProviderForChannel("phone")).toBeUndefined();
+    expect(botProviderForChannel("vellum")).toBeUndefined();
+    expect(botProviderForChannel("not-a-channel")).toBeUndefined();
+    // `slack` is the person's integration standing beside the bot's key.
+    expect(channelForBotProvider("slack")).toBeUndefined();
+    expect(channelForBotProvider("google")).toBeUndefined();
+  });
+
+  test("never resolve an inherited object property as a channel or a key", () => {
+    for (const name of ["constructor", "toString", "__proto__"]) {
+      expect(botProviderForChannel(name)).toBeUndefined();
+      expect(channelForBotProvider(name)).toBeUndefined();
+    }
+  });
+});
+
 describe("isChannelUserIntegration", () => {
   test("names the grant standing beside a bot of the same brand", () => {
     expect(isChannelUserIntegration("slack")).toBe(true);

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/channels.ts

@@ -93,9 +93,34 @@ export const CHANNEL_BOT_PROVIDER = {
  * connected" question, for any provider key.
  */
 export function isChannelBotProvider(providerKey: string): boolean {
-  return (Object.values(CHANNEL_BOT_PROVIDER) as readonly string[]).includes(
-    providerKey,
-  );
+  return channelForBotProvider(providerKey) !== undefined;
+}
+
+/**
+ * The provider key holding a channel's bot credential, or `undefined` when
+ * the channel has none, or is not a channel at all. Walks the map's own
+ * entries, so an inherited object property name is never a channel.
+ */
+export function botProviderForChannel(channelId: string): string | undefined {
+  return Object.entries(CHANNEL_BOT_PROVIDER).find(
+    ([id]) => id === channelId,
+  )?.[1];
+}
+
+/**
+ * The channel whose bot credential a provider key holds, or `undefined` when
+ * the key is not a bot's. The inverse of `botProviderForChannel`, for a
+ * surface that has only the provider key in hand and needs to speak in the
+ * channel's vocabulary.
+ */
+export function channelForBotProvider(
+  providerKey: string,
+): keyof typeof CHANNEL_BOT_PROVIDER | undefined {
+  return (
+    Object.entries(CHANNEL_BOT_PROVIDER) as Array<
+      [keyof typeof CHANNEL_BOT_PROVIDER, string]
+    >
+  ).find(([, key]) => key === providerKey)?.[0];
 }
 
 /**

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/__tests__/channels.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  botProviderForChannel,
   CHANNEL_BOT_PROVIDER,
   CHANNEL_IDS,
+  channelForBotProvider,
   isChannelBotProvider,
   isChannelUserIntegration,
   isChannelId,
@@ -41,6 +43,35 @@ describe("isChannelId", () => {
   });
 });
 
+describe("botProviderForChannel and channelForBotProvider", () => {
+  test("are inverses over every entry of the map", () => {
+    for (const [channelId, botProviderKey] of Object.entries(
+      CHANNEL_BOT_PROVIDER,
+    )) {
+      expect(botProviderForChannel(channelId)).toBe(botProviderKey);
+      expect(channelForBotProvider(botProviderKey)).toBe(
+        channelId as keyof typeof CHANNEL_BOT_PROVIDER,
+      );
+    }
+  });
+
+  test("answer nothing for a channel without a bot, a person's grant, or an unknown key", () => {
+    expect(botProviderForChannel("phone")).toBeUndefined();
+    expect(botProviderForChannel("vellum")).toBeUndefined();
+    expect(botProviderForChannel("not-a-channel")).toBeUndefined();
+    // `slack` is the person's integration standing beside the bot's key.
+    expect(channelForBotProvider("slack")).toBeUndefined();
+    expect(channelForBotProvider("google")).toBeUndefined();
+  });
+
+  test("never resolve an inherited object property as a channel or a key", () => {
+    for (const name of ["constructor", "toString", "__proto__"]) {
+      expect(botProviderForChannel(name)).toBeUndefined();
+      expect(channelForBotProvider(name)).toBeUndefined();
+    }
+  });
+});
+
 describe("isChannelUserIntegration", () => {
   test("names the grant standing beside a bot of the same brand", () => {
     expect(isChannelUserIntegration("slack")).toBe(true);

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/channels.ts

@@ -93,9 +93,34 @@ export const CHANNEL_BOT_PROVIDER = {
  * connected" question, for any provider key.
  */
 export function isChannelBotProvider(providerKey: string): boolean {
-  return (Object.values(CHANNEL_BOT_PROVIDER) as readonly string[]).includes(
-    providerKey,
-  );
+  return channelForBotProvider(providerKey) !== undefined;
+}
+
+/**
+ * The provider key holding a channel's bot credential, or `undefined` when
+ * the channel has none, or is not a channel at all. Walks the map's own
+ * entries, so an inherited object property name is never a channel.
+ */
+export function botProviderForChannel(channelId: string): string | undefined {
+  return Object.entries(CHANNEL_BOT_PROVIDER).find(
+    ([id]) => id === channelId,
+  )?.[1];
+}
+
+/**
+ * The channel whose bot credential a provider key holds, or `undefined` when
+ * the key is not a bot's. The inverse of `botProviderForChannel`, for a
+ * surface that has only the provider key in hand and needs to speak in the
+ * channel's vocabulary.
+ */
+export function channelForBotProvider(
+  providerKey: string,
+): keyof typeof CHANNEL_BOT_PROVIDER | undefined {
+  return (
+    Object.entries(CHANNEL_BOT_PROVIDER) as Array<
+      [keyof typeof CHANNEL_BOT_PROVIDER, string]
+    >
+  ).find(([, key]) => key === providerKey)?.[0];
 }
 
 /**

package/node_modules/@vellumai/gateway-client/src/__tests__/plugin-admission-denied-contract.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 import {
   ACCESS_DENIED_NOT_APPROVED_REPLY,
   PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PLUGIN_NOTICES_ROUTE_PREFIX,
   PluginAdmissionDeniedNoticeSchema,
 } from "../plugin-admission-denied-contract.js";
 
@@ -19,6 +20,15 @@ describe("plugin admission-denied contract", () => {
     );
   });
 
+  test("the notice lives under the gateway-only notices prefix", () => {
+    // The runtime reserves this prefix for the gateway's service principal,
+    // so a notice posted anywhere else would be reachable by actor clients.
+    expect(PLUGIN_NOTICES_ROUTE_PREFIX).toBe("notices");
+    expect(PLUGIN_ADMISSION_DENIED_NOTICE_PATH).toStartWith(
+      `${PLUGIN_NOTICES_ROUTE_PREFIX}/`,
+    );
+  });
+
   test("round-trips a floor-deny notice", () => {
     const notice = {
       reason: "admission_floor" as const,

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -104,6 +104,7 @@ export type {
 export {
   ACCESS_DENIED_NOT_APPROVED_REPLY,
   PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PLUGIN_NOTICES_ROUTE_PREFIX,
   PluginAdmissionDeniedNoticeSchema,
 } from "./plugin-admission-denied-contract.js";
 

package/node_modules/@vellumai/gateway-client/src/plugin-admission-denied-contract.ts

@@ -22,10 +22,23 @@ export const ACCESS_DENIED_NOT_APPROVED_REPLY =
   "Sorry, you haven't been approved to message this assistant.";
 
 /**
- * Plugin route the gateway posts the notice to, under
+ * Prefix, under `/x/plugins/<plugin>/`, of the routes reserved for notices
+ * the gateway posts to a plugin.
+ *
+ * The runtime serves every path under it to the gateway's service principal
+ * only (`assistant/src/runtime/routes/user-routes.ts`). A notice is the
+ * gateway's own verified decision, and a plugin acts on it without running a
+ * turn, so an authenticated client must not be able to post one: a forged
+ * notice would have the plugin spend its vendor credentials on a recipient
+ * and a message the client chose.
+ */
+export const PLUGIN_NOTICES_ROUTE_PREFIX = "notices";
+
+/**
+ * Plugin route the gateway posts the admission-denied notice to, under
  * `/v1/x/plugins/<plugin>/`. Not a public ingress path.
  */
-export const PLUGIN_ADMISSION_DENIED_NOTICE_PATH = "notices/admission-denied";
+export const PLUGIN_ADMISSION_DENIED_NOTICE_PATH = `${PLUGIN_NOTICES_ROUTE_PREFIX}/admission-denied`;
 
 export const PluginAdmissionDeniedNoticeSchema = z.object({
   reason: z.literal("admission_floor"),

package/node_modules/@vellumai/service-contracts/src/__tests__/channels.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  botProviderForChannel,
   CHANNEL_BOT_PROVIDER,
   CHANNEL_IDS,
+  channelForBotProvider,
   isChannelBotProvider,
   isChannelUserIntegration,
   isChannelId,
@@ -41,6 +43,35 @@ describe("isChannelId", () => {
   });
 });
 
+describe("botProviderForChannel and channelForBotProvider", () => {
+  test("are inverses over every entry of the map", () => {
+    for (const [channelId, botProviderKey] of Object.entries(
+      CHANNEL_BOT_PROVIDER,
+    )) {
+      expect(botProviderForChannel(channelId)).toBe(botProviderKey);
+      expect(channelForBotProvider(botProviderKey)).toBe(
+        channelId as keyof typeof CHANNEL_BOT_PROVIDER,
+      );
+    }
+  });
+
+  test("answer nothing for a channel without a bot, a person's grant, or an unknown key", () => {
+    expect(botProviderForChannel("phone")).toBeUndefined();
+    expect(botProviderForChannel("vellum")).toBeUndefined();
+    expect(botProviderForChannel("not-a-channel")).toBeUndefined();
+    // `slack` is the person's integration standing beside the bot's key.
+    expect(channelForBotProvider("slack")).toBeUndefined();
+    expect(channelForBotProvider("google")).toBeUndefined();
+  });
+
+  test("never resolve an inherited object property as a channel or a key", () => {
+    for (const name of ["constructor", "toString", "__proto__"]) {
+      expect(botProviderForChannel(name)).toBeUndefined();
+      expect(channelForBotProvider(name)).toBeUndefined();
+    }
+  });
+});
+
 describe("isChannelUserIntegration", () => {
   test("names the grant standing beside a bot of the same brand", () => {
     expect(isChannelUserIntegration("slack")).toBe(true);

package/node_modules/@vellumai/service-contracts/src/channels.ts

@@ -93,9 +93,34 @@ export const CHANNEL_BOT_PROVIDER = {
  * connected" question, for any provider key.
  */
 export function isChannelBotProvider(providerKey: string): boolean {
-  return (Object.values(CHANNEL_BOT_PROVIDER) as readonly string[]).includes(
-    providerKey,
-  );
+  return channelForBotProvider(providerKey) !== undefined;
+}
+
+/**
+ * The provider key holding a channel's bot credential, or `undefined` when
+ * the channel has none, or is not a channel at all. Walks the map's own
+ * entries, so an inherited object property name is never a channel.
+ */
+export function botProviderForChannel(channelId: string): string | undefined {
+  return Object.entries(CHANNEL_BOT_PROVIDER).find(
+    ([id]) => id === channelId,
+  )?.[1];
+}
+
+/**
+ * The channel whose bot credential a provider key holds, or `undefined` when
+ * the key is not a bot's. The inverse of `botProviderForChannel`, for a
+ * surface that has only the provider key in hand and needs to speak in the
+ * channel's vocabulary.
+ */
+export function channelForBotProvider(
+  providerKey: string,
+): keyof typeof CHANNEL_BOT_PROVIDER | undefined {
+  return (
+    Object.entries(CHANNEL_BOT_PROVIDER) as Array<
+      [keyof typeof CHANNEL_BOT_PROVIDER, string]
+    >
+  ).find(([, key]) => key === providerKey)?.[0];
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.12.0-staging.1",
+  "version": "0.12.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/feature-flag-registry.json

@@ -16,7 +16,10 @@
       "label": "In-Chat Onboarding Tour",
       "description": "Multivariate experiment for the eyes-led in-chat onboarding tour. control = straight to chat after research onboarding (current behavior); tour = the extended tour auto-plays on first workspace entry. Desktop-only: phone-width viewports and the native shell get neither the tour nor its telemetry (not even the exposure event), so the funnel measures desktop sessions exclusively. Targeted via LaunchDarkly (70% tour / 30% control).",
       "defaultEnabled": "control",
-      "values": ["control", "tour"]
+      "values": [
+        "control",
+        "tour"
+      ]
     },
     {
       "id": "user-hosted-enabled",
@@ -33,7 +36,10 @@
       "label": "Proactive Tips",
       "description": "Gates the dismissible proactive tip card in the web sidebar. String-valued so future A/B arms can be added as new values.",
       "defaultEnabled": "off",
-      "values": ["off", "on"]
+      "values": [
+        "off",
+        "on"
+      ]
     },
     {
       "id": "vision-mode",
@@ -42,7 +48,10 @@
       "label": "Vision Mode",
       "description": "Gates hold-to-Live ambient frame sampling in the voice room camera. String-valued so future A/B arms can be added as new values.",
       "defaultEnabled": "off",
-      "values": ["off", "on"]
+      "values": [
+        "off",
+        "on"
+      ]
     },
     {
       "id": "assistant-initiated-threads",
@@ -51,7 +60,10 @@
       "label": "Assistant-Initiated Threads",
       "description": "Gates the sidebar section collecting the conversations the assistant started on its own: rows stamped `source='assistant_initiated'` at creation by producers that opt a thread in (heartbeat realizations worth the user's time; nothing stamps it yet, so the section starts empty and holds only new threads by construction). Transactional notification trails keep `source='notification'` and stay in Chats and the bell. When on, the daemon emits an `assistant` row from the section index and withholds member conversations from the Chats bucket; when off, they stay in Chats and no `assistant` row is emitted, which is the shipped behavior. Deliberately daemon-scope only: the index row is self-describing, so clients render the section on its presence rather than on a flag of their own. A second client-side gate could only hide a section whose rows the daemon has already withheld from Chats, which would lose those threads instead of reverting the feature. String-valued so future A/B arms can be added as new values.",
       "defaultEnabled": "off",
-      "values": ["off", "on"]
+      "values": [
+        "off",
+        "on"
+      ]
     },
     {
       "id": "experiment-activation-flow-2026-06-03",
@@ -60,7 +72,11 @@
       "label": "Activation Flow Experiment 2026-06-03",
       "description": "Multivariate activation-flow experiment. control = standard flow; variant-a = activation rail; personal-page = new sign-up-page variant (front-end only). Targeted via LaunchDarkly.",
       "defaultEnabled": "control",
-      "values": ["control", "variant-a", "personal-page"]
+      "values": [
+        "control",
+        "variant-a",
+        "personal-page"
+      ]
     },
     {
       "id": "local-docker-enabled",
@@ -486,6 +502,20 @@
       "description": "Platform pods resolve webhook callback URLs from the Velay-published ingress URL instead of registering platform callback routes. Falls back to platform callback registration while no tunnel URL is published.",
       "defaultEnabled": false
     },
+    {
+      "id": "experiment-activation-checklist-2026-09-10",
+      "scope": "client",
+      "key": "experiment-activation-checklist-2026-09-10",
+      "label": "Experiment: Activation Checklist (2026-09-10)",
+      "description": "A/B test of the post-onboarding activation checklist (welcome modal, suggestions pill, inspiration list). off = control, the standard chat landing with no checklist; smb / parent / general = the checklist with that persona's task list. Any other value hides the checklist. Percentages per arm are set in LaunchDarkly; the readout keys a user on their first-ever assignment, so a new round gets a new key.",
+      "defaultEnabled": "off",
+      "values": [
+        "off",
+        "smb",
+        "parent",
+        "general"
+      ]
+    },
     {
       "id": "send-user-message",
       "scope": "both",

package/src/risk/bash-risk-classifier.test.ts

@@ -914,6 +914,40 @@ describe("assistant subcommand classification", () => {
     expect(result.riskLevel).toBe("medium");
   });
 
+  // The bot-identity door can produce any effect the bot's API allows, reads
+  // and writes alike, so the whole command is high: the rating follows what
+  // the command can do, not what a caller means to use it for.
+  test("assistant channels request → high, whatever the endpoint", async () => {
+    for (const command of [
+      "assistant channels request slack /conversations.history",
+      "assistant channels request slack -X POST -d '{}' /chat.postMessage",
+      "assistant channels request discord /users/@me",
+    ]) {
+      const result = await classifier.classify({ command, toolName: "bash" });
+      expect(result.riskLevel).toBe("high");
+    }
+  });
+
+  // The OAuth request door reaches the same bot when --provider names a bot
+  // credential, so that form is high too; a person's integration stays at
+  // the door's own rating.
+  test("assistant oauth request as a channel bot → high; as a person → medium", async () => {
+    for (const command of [
+      "assistant oauth request --provider slack_channel /conversations.history",
+      "assistant oauth request --provider=discord_channel /users/@me",
+      "assistant oauth request /getMe --provider telegram",
+    ]) {
+      const result = await classifier.classify({ command, toolName: "bash" });
+      expect(result.riskLevel).toBe("high");
+    }
+    const person = await classifier.classify({
+      command:
+        "assistant oauth request --provider google /gmail/v1/users/me/messages",
+      toolName: "bash",
+    });
+    expect(person.riskLevel).toBe("medium");
+  });
+
   test("assistant oauth connect → low", async () => {
     const result = await classifier.classify({
       command: "assistant oauth connect",

package/src/risk/command-registry/commands/assistant.ts

@@ -1,3 +1,5 @@
+import { CHANNEL_BOT_PROVIDER } from "@vellumai/service-contracts/channels";
+
 import type {
   ArgRule,
   CommandRiskSpec,
@@ -77,6 +79,7 @@ const ASSISTANT_SUPPORTED_COMMAND_PATHS = [
   "channels",
   "channels list",
   "channels get",
+  "channels request",
   "clients",
   "clients disconnect",
   "clients list",
@@ -830,6 +833,12 @@ const riskOverrides: AssistantRiskOverride[] = [
     risk: "medium",
     reason: "Makes authenticated OAuth request",
   },
+  {
+    path: "channels request",
+    risk: "high",
+    reason:
+      "Acts as the channel's bot with any effect the bot's API allows (sends, edits, deletes, uploads, reactions, as well as reads); the effect is the endpoint's, which the command cannot tell apart",
+  },
   {
     path: "oauth connect",
     risk: "low",
@@ -986,6 +995,34 @@ const oauthModeArgRules: ArgRule[] = [
 ];
 getExistingPath(spec, "oauth mode").argRules = oauthModeArgRules;
 
+// `oauth request` is medium-risk as an authenticated request through a
+// person's OAuth integration, but the same door reaches a channel's bot when
+// `--provider` names a bot credential, and acting as the bot carries every
+// effect the bot's API allows. That form is high, like `channels request`.
+// The bot provider keys come from the channel contract, never a list kept
+// here, so a channel that gains a bot credential is covered by joining the
+// contract's map.
+const botProviderKeyPattern = Object.values(CHANNEL_BOT_PROVIDER)
+  .map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+  .join("|");
+const oauthRequestArgRules: ArgRule[] = [
+  {
+    id: "assistant-oauth-request:bot-provider",
+    flags: ["--provider"],
+    valuePattern: `^(${botProviderKeyPattern})$`,
+    risk: "high",
+    reason:
+      "Acts as a channel's bot through the OAuth request door, with every effect the bot's API allows",
+  },
+];
+const oauthRequestNode = getExistingPath(spec, "oauth request");
+oauthRequestNode.argRules = oauthRequestArgRules;
+// `--provider` consumes the next token as a value; so do the account
+// selectors, so the arg parser pairs every value flag correctly.
+oauthRequestNode.argSchema = {
+  valueFlags: ["--provider", "--account", "--client-id"],
+};
+
 const assistantBashArgRules: ArgRule[] = [
   {
     id: "assistant-bash:command",

package/src/risk/command-registry.test.ts

@@ -1,3 +1,4 @@
+import { CHANNEL_BOT_PROVIDER } from "@vellumai/service-contracts/channels";
 import { describe, expect, test } from "bun:test";
 
 import { DEFAULT_COMMAND_REGISTRY } from "./command-registry/index.js";
@@ -420,6 +421,26 @@ describe("command-registry", () => {
         expect(oauthSpec.subcommands!.request.baseRisk).toBe("medium");
       });
 
+      test("assistant oauth request as a channel bot escalates to high, keyed on the contract's map", () => {
+        const requestSpec = oauthSpec.subcommands!.request;
+        const botRule = requestSpec.argRules!.find(
+          (r) => r.id === "assistant-oauth-request:bot-provider",
+        );
+        expect(botRule).toBeDefined();
+        expect(botRule!.flags).toEqual(["--provider"]);
+        expect(botRule!.risk).toBe("high");
+        expect(requestSpec.argSchema?.valueFlags).toContain("--provider");
+        // Every bot provider the contract names matches; a person's
+        // integration does not. The rule is derived from the map, so a
+        // channel that gains a bot credential is covered without a list here.
+        const pattern = new RegExp(botRule!.valuePattern!);
+        for (const key of Object.values(CHANNEL_BOT_PROVIDER)) {
+          expect(pattern.test(key)).toBe(true);
+        }
+        expect(pattern.test("google")).toBe(false);
+        expect(pattern.test("slack")).toBe(false);
+      });
+
       test("assistant oauth connect is low risk", () => {
         expect(oauthSpec.subcommands!.connect.baseRisk).toBe("low");
       });