@vellumai/vellum-gateway 0.4.53 → 0.4.55

package/ARCHITECTURE.md

@@ -583,11 +583,11 @@ Entry points:
 
 Both paths converge at:
   → Daemon handler validates token via Telegram getMe API
-    → setSecureKey("credential/telegram/bot_token", token)
+    → setSecureKeyAsync("credential/telegram/bot_token", token)
     → upsertCredentialMetadata("telegram", "bot_token", {})
     → Stores bot username in config at telegram.botUsername
     → Auto-generates webhook secret if missing
-      → setSecureKey("credential/telegram/webhook_secret", secret)
+      → setSecureKeyAsync("credential/telegram/webhook_secret", secret)
       → upsertCredentialMetadata("telegram", "webhook_secret", {})
       → On storage failure: rolls back bot_token + metadata, returns error
     → If webhook secret already exists: upserts metadata anyway (self-heal)
@@ -641,7 +641,7 @@ The Slack channel enables inbound and outbound messaging via Slack's Socket Mode
 3. Events are deduplicated by `event_id` using an in-memory `Map<string, number>` with a 24-hour TTL. A periodic cleanup sweep runs every hour to evict expired entries.
 4. The `normalizeSlackAppMention()` function strips leading bot-mention tokens (`<@U...>`) from the message text and produces a `GatewayInboundEvent` with `sourceChannel: "slack"`, using the Slack channel ID as `conversationExternalId` and the sender's user ID as `actorExternalId`.
 5. Routing uses the standard `resolveAssistant()` chain (conversation_id -> actor_id -> default/reject). Events that cannot be routed are dropped.
-6. The normalized event is forwarded to the runtime via `POST /v1/channels/inbound` with Slack-specific transport hints and a `replyCallbackUrl` pointing to `/deliver/slack`.
+6. The normalized event is forwarded to the runtime via `POST /v1/channels/inbound` with a `replyCallbackUrl` pointing to `/deliver/slack`.
 
 **Egress** (`POST /deliver/slack`):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.4.53",
+  "version": "0.4.55",
   "type": "module",
   "exports": {
     "./twilio/verify": "./src/twilio/verify.ts",

package/src/channels/transport-hints.ts

@@ -16,16 +16,6 @@ export function buildTelegramTransportMetadata(): {
   };
 }
 
-export const SLACK_CHANNEL_TRANSPORT_HINTS = [
-  "chat-first-medium",
-  "threaded-channel",
-  "mention-triggered",
-  "defer-dashboard-only-tasks",
-] as const;
-
-export const SLACK_CHANNEL_TRANSPORT_UX_BRIEF =
-  "Slack is a threaded channel medium. Replies should stay in-thread when a thread_ts is present. Use plain text or Slack mrkdwn formatting; avoid markdown tables and complex block layouts.";
-
 export const WHATSAPP_CHANNEL_TRANSPORT_HINTS = [
   "chat-first-medium",
   "channel-safe-onboarding",

package/src/feature-flag-registry.json

@@ -25,20 +25,12 @@
       "description": "Enable browser skill prerequisites section in the system prompt",
       "defaultEnabled": true
     },
-    {
-      "id": "messaging",
-      "scope": "assistant",
-      "key": "feature_flags.messaging.enabled",
-      "label": "Messaging",
-      "description": "Enable messaging skill section in the system prompt",
-      "defaultEnabled": true
-    },
     {
       "id": "collect-usage-data",
       "scope": "assistant",
       "key": "feature_flags.collect-usage-data.enabled",
       "label": "Collect usage data",
-      "description": "Send crash reports and error diagnostics to help improve the app",
+      "description": "Send crash reports, error diagnostics, and anonymized usage telemetry to help improve the app",
       "defaultEnabled": true
     },
     {
@@ -49,14 +41,6 @@
       "description": "Enable user-hosted onboarding flow",
       "defaultEnabled": false
     },
-    {
-      "id": "command-palette",
-      "scope": "assistant",
-      "key": "feature_flags.command-palette.enabled",
-      "label": "Command Palette",
-      "description": "Enable the CMD+K command palette for unified search across conversations, memories, schedules, and contacts",
-      "defaultEnabled": false
-    },
     {
       "id": "contacts",
       "scope": "assistant",
@@ -73,14 +57,6 @@
       "description": "Show the Email channel card on the Contacts page and enable the email-setup skill",
       "defaultEnabled": false
     },
-    {
-      "id": "outbound-proxy-sidecar",
-      "scope": "assistant",
-      "key": "feature_flags.outbound-proxy-sidecar.enabled",
-      "label": "Outbound Proxy Sidecar",
-      "description": "Route proxy session management through the sidecar process instead of running in-process",
-      "defaultEnabled": false
-    },
     {
       "id": "app-builder-multifile",
       "scope": "assistant",
@@ -105,22 +81,6 @@
       "description": "Show the Mobile (iOS) pairing card in Settings > Account",
       "defaultEnabled": false
     },
-    {
-      "id": "gmail",
-      "scope": "assistant",
-      "key": "feature_flags.gmail.enabled",
-      "label": "Gmail",
-      "description": "Enable Gmail management skill (archive, label, declutter)",
-      "defaultEnabled": true
-    },
-    {
-      "id": "sequences",
-      "scope": "assistant",
-      "key": "feature_flags.sequences.enabled",
-      "label": "Email Sequences",
-      "description": "Enable email sequence management skill",
-      "defaultEnabled": true
-    },
     {
       "id": "settings-developer-nav",
       "scope": "assistant",
@@ -129,6 +89,14 @@
       "description": "Control Developer nav visibility in macOS settings",
       "defaultEnabled": true
     },
+    {
+      "id": "developer-menu-items",
+      "scope": "macos",
+      "key": "developer_menu_items_enabled",
+      "label": "Developer Menu Items",
+      "description": "Show Component Gallery and Replay Onboarding in the menu bar",
+      "defaultEnabled": false
+    },
     {
       "id": "logfire",
       "scope": "assistant",

package/src/http/routes/browser-relay-websocket.ts

@@ -10,7 +10,7 @@ const log = getLogger("browser-relay-ws");
 // Cap buffered messages to prevent unbounded memory growth if upstream stalls
 const MAX_PENDING_MESSAGES = 100;
 
-export function isPrivateAddress(addr: string): boolean {
+function isPrivateAddress(addr: string): boolean {
   const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
   const normalized = v4Mapped ? v4Mapped[1] : addr;
 
@@ -39,7 +39,7 @@ export function isPrivateAddress(addr: string): boolean {
   return false;
 }
 
-export function isPrivateNetworkPeer(
+function isPrivateNetworkPeer(
   server: import("bun").Server<unknown>,
   req: Request,
 ): boolean {
@@ -53,7 +53,7 @@ export function isPrivateNetworkPeer(
  * Use this instead of isPrivateNetworkPeer for endpoints that must be
  * restricted to the local machine (e.g. token minting).
  */
-export function isLoopbackAddress(addr: string): boolean {
+function isLoopbackAddress(addr: string): boolean {
   const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
   const normalized = v4Mapped ? v4Mapped[1] : addr;