@vellumai/vellum-gateway 0.6.0 → 0.6.2

package/src/slack/socket-mode.ts

@@ -103,6 +103,16 @@ export class SlackSocketModeClient {
         if (data.team) {
           this.config.teamName = data.team;
         }
+        // Warn if the bot token is missing scopes needed for file downloads.
+        const scopes = resp.headers.get("x-oauth-scopes") ?? "";
+        if (!scopes.split(",").some((s) => s.trim() === "files:read")) {
+          log.warn(
+            "Slack bot token is missing the 'files:read' scope — file/image " +
+              "attachments will not be downloaded. Add 'files:read' to your " +
+              "Slack app's Bot Token Scopes and reinstall the app.",
+          );
+        }
+
         log.info(
           {
             botUserId: data.user_id,

package/src/telegram/download.ts

@@ -2,6 +2,7 @@ import { fileTypeFromBuffer } from "file-type";
 import type { ConfigFileCache } from "../config-file-cache.js";
 import type { CredentialCache } from "../credential-cache.js";
 import { credentialKey } from "../credential-key.js";
+import { validateDownloadedContent } from "../download-validation.js";
 import { fetchImpl } from "../fetch.js";
 import { callTelegramApi } from "./api.js";
 
@@ -72,6 +73,8 @@ export async function downloadTelegramFile(
     response.headers.get("Content-Type")?.split(";")[0].trim() ||
     "application/octet-stream";
 
+  await validateDownloadedContent(new Uint8Array(buffer), mimeType, fileId);
+
   const data = Buffer.from(buffer).toString("base64");
 
   return { filename, mimeType, data };

package/src/types.ts

@@ -5,4 +5,5 @@ export type {
   TelegramInboundEvent,
   WhatsAppInboundEvent,
   SlackInboundEvent,
+  EmailInboundEvent,
 } from "./channels/inbound-event.js";

package/src/whatsapp/download.ts

@@ -1,5 +1,6 @@
 import { fileTypeFromBuffer } from "file-type";
 import type { GatewayConfig } from "../config.js";
+import { validateDownloadedContent } from "../download-validation.js";
 import {
   getWhatsAppMediaMetadata,
   downloadWhatsAppMediaBytes,
@@ -79,6 +80,8 @@ export async function downloadWhatsAppFile(
     response.headers.get("Content-Type")?.split(";")[0].trim() ||
     "application/octet-stream";
 
+  await validateDownloadedContent(new Uint8Array(buffer), mimeType, mediaId);
+
   const filename = hint?.fileName || inferFilename(mediaId, mimeType);
   const data = Buffer.from(buffer).toString("base64");