@vellumai/vellum-gateway 0.8.2 → 0.8.4

package/src/__tests__/slack-socket-mode-thread-tracking.test.ts

@@ -4,6 +4,7 @@ import { drizzle } from "drizzle-orm/bun-sqlite";
 import type { GatewayConfig } from "../config.js";
 import { SlackStore } from "../db/slack-store.js";
 import * as schema from "../db/schema.js";
+import type { RuntimeInboundPayload } from "../runtime/client.js";
 import type { NormalizedSlackEvent } from "../slack/normalize.js";
 
 type FetchFn = (
@@ -27,14 +28,42 @@ function makeSlackUserResponse(): Response {
 let fetchMock: ReturnType<typeof mock<FetchFn>> = mock(async () =>
   makeSlackUserResponse(),
 );
+const runtimePayloads: RuntimeInboundPayload[] = [];
 
 mock.module("../fetch.js", () => ({
   fetchImpl: (...args: Parameters<FetchFn>) => fetchMock(...args),
 }));
 
+mock.module("../runtime/client.js", () => ({
+  CircuitBreakerOpenError: class CircuitBreakerOpenError extends Error {
+    readonly retryAfterSecs: number;
+
+    constructor(retryAfterSecs: number) {
+      super("Circuit breaker is open");
+      this.name = "CircuitBreakerOpenError";
+      this.retryAfterSecs = retryAfterSecs;
+    }
+  },
+  forwardToRuntime: mock(
+    async (_config: GatewayConfig, payload: RuntimeInboundPayload) => {
+      runtimePayloads.push(payload);
+      return {
+        accepted: true,
+        duplicate: false,
+        eventId: "runtime-event-1",
+      };
+    },
+  ),
+}));
+
+mock.module("../verification/text-verification.js", () => ({
+  tryTextVerificationIntercept: mock(async () => ({ intercepted: false })),
+}));
+
 const { SlackSocketModeClient } = await import("../slack/socket-mode.js");
 const { clearChannelInfoCache, clearUserInfoCache, resolveSlackUser } =
   await import("../slack/normalize.js");
+const { handleInbound } = await import("../handlers/handle-inbound.js");
 import type { SlackSocketModeConfig } from "../slack/socket-mode.js";
 
 type SocketModeHarness = {
@@ -149,6 +178,7 @@ function flushAsyncEventEmission(): Promise<void> {
 }
 
 beforeEach(() => {
+  runtimePayloads.length = 0;
   clearUserInfoCache();
   clearChannelInfoCache();
   fetchMock = mock(async () => makeSlackUserResponse());
@@ -706,21 +736,85 @@ describe("SlackSocketModeClient thread tracking", () => {
     }
   });
 
+  test("emits a plain app mention without resolving the event channel name", async () => {
+    const { rawDb, store } = createSlackStore();
+    const config = makeConfig();
+    const emitted: NormalizedSlackEvent[] = [];
+    const client = createHarness(store, (event) => emitted.push(event));
+    const ws = makeOpenSocket();
+    const conversationInfoChannels: string[] = [];
+
+    fetchMock = mock(async (input) => {
+      const url = new URL(String(input));
+      if (url.pathname.endsWith("/conversations.info")) {
+        const channelId = url.searchParams.get("channel");
+        if (channelId) {
+          conversationInfoChannels.push(channelId);
+        }
+        return new Response(
+          JSON.stringify({
+            ok: true,
+            channel: { id: channelId, name: "support-triage" },
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      return makeSlackUserResponse();
+    });
+
+    try {
+      client.handleMessage(
+        JSON.stringify({
+          envelope_id: "env-channel-name",
+          type: "events_api",
+          payload: {
+            event_id: "Ev-channel-name",
+            event: {
+              type: "app_mention",
+              user: "U-actor",
+              text: "<@UBOT> please summarize this",
+              ts: "1700000000.000950",
+              channel: "C-thread",
+            },
+          },
+        }),
+        ws,
+      );
+      await flushAsyncEventEmission();
+
+      expect(emitted).toHaveLength(1);
+      expect(emitted[0].event.source.channelName).toBeUndefined();
+      expect(conversationInfoChannels).toEqual([]);
+
+      await handleInbound(config, emitted[0].event, {
+        routingOverride: emitted[0].routing,
+      });
+
+      expect(runtimePayloads).toHaveLength(1);
+      expect(runtimePayloads[0].sourceMetadata?.channelName).toBeUndefined();
+    } finally {
+      rawDb.close();
+    }
+  });
+
   test("keeps embedded Slack channel labels without conversations.info lookup", async () => {
     const { rawDb, store } = createSlackStore();
     const emitted: NormalizedSlackEvent[] = [];
     const client = createHarness(store, (event) => emitted.push(event));
     const ws = makeOpenSocket();
-    let conversationInfoCalls = 0;
+    const conversationInfoChannels: string[] = [];
 
     fetchMock = mock(async (input) => {
       const url = new URL(String(input));
       if (url.pathname.endsWith("/conversations.info")) {
-        conversationInfoCalls++;
+        const channelId = url.searchParams.get("channel");
+        if (channelId) {
+          conversationInfoChannels.push(channelId);
+        }
         return new Response(
           JSON.stringify({
             ok: true,
-            channel: { id: "CFEEDBACK", name: "private-name" },
+            channel: { id: channelId, name: "private-name" },
           }),
           { status: 200, headers: { "content-type": "application/json" } },
         );
@@ -752,7 +846,7 @@ describe("SlackSocketModeClient thread tracking", () => {
       expect(emitted[0].event.message.content).toBe(
         "@Example User continue in #visible-name",
       );
-      expect(conversationInfoCalls).toBe(0);
+      expect(conversationInfoChannels).toEqual([]);
     } finally {
       rawDb.close();
     }

package/src/__tests__/twilio-webhooks.test.ts

@@ -826,6 +826,53 @@ describe("Twilio webhook signature with canonical ingress base URL", () => {
     });
   });
 
+  test("uses platform callback assistant ID for Twilio websocket URL", async () => {
+    const assistantId = "019e2d0d-f355-744c-a12c-d7e7dcefcf1e";
+    fetchMock = mock(
+      async () =>
+        new Response(
+          '<?xml version="1.0" encoding="UTF-8"?><Response><Connect>' +
+            '<ConversationRelay url="wss://__VELLUM_PUBLIC_BASE_URL__/webhooks/twilio/relay?token=__VELLUM_RELAY_TOKEN__"/>' +
+            "</Connect></Response>",
+          {
+            status: 200,
+            headers: { "Content-Type": "text/xml" },
+          },
+        ),
+    );
+
+    const handler = createTwilioVoiceWebhookHandler(
+      makeConfig({ velayBaseUrl: "https://velay-staging.vellum.ai" }),
+      makeCaches(),
+    );
+
+    const platformCallbackUrl =
+      `https://staging-platform.vellum.ai/v1/gateway/callbacks/${assistantId}` +
+      "/webhooks/twilio/voice?callSessionId=platform-wss-test";
+    const localUrl =
+      "http://localhost:7830/webhooks/twilio/voice?callSessionId=platform-wss-test";
+    const params = { CallSid: "CA-platform-wss" };
+    const signature = computeSignature(platformCallbackUrl, params, AUTH_TOKEN);
+    const req = new Request(localUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "X-Twilio-Signature": signature,
+        "X-Vellum-Ingress-URL": platformCallbackUrl,
+      },
+      body: new URLSearchParams(params).toString(),
+    });
+
+    const res = await handler(req);
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).toContain(
+      `url="wss://velay-staging.vellum.ai/${assistantId}/webhooks/twilio/relay?`,
+    );
+    expect(body).not.toContain("__VELLUM_PUBLIC_BASE_URL__");
+    expect(body).not.toContain("staging-platform.vellum.ai");
+  });
+
   test("platform proxy URL takes priority over configured ingress", async () => {
     fetchMock = mock(
       async () =>

package/src/auth/ipc-route-policy.ts

@@ -223,6 +223,12 @@ const POLICY_TABLE: PolicyEntry[] = [
   ["updateHeartbeatConfig", ["settings.write"]],
 
   // Integrations / ingress
+  [
+    "integrations_a2a_invite_complete_post",
+    ["internal.write"],
+    ["svc_gateway"],
+  ],
+  ["integrations_a2a_invite_redeem_post", ["internal.write"], ["svc_gateway"]],
   ["integrations_ingress_config_get", ["settings.read"]],
   ["integrations_ingress_config_put", ["settings.write"]],
   ["integrations_oauth_start_post", ["settings.write"]],

package/src/channels/inbound-event.ts

@@ -10,7 +10,7 @@ import type { ChannelId } from "./types.js";
 
 export type InboundChannelId = Extract<
   ChannelId,
-  "telegram" | "whatsapp" | "slack" | "email"
+  "telegram" | "whatsapp" | "slack" | "email" | "a2a"
 >;
 
 interface InboundEventBase<C extends InboundChannelId> {
@@ -40,6 +40,9 @@ interface InboundEventBase<C extends InboundChannelId> {
     lastName?: string;
     languageCode?: string;
     isBot?: boolean;
+    timezone?: string;
+    timezoneLabel?: string;
+    timezoneOffsetSeconds?: number;
   };
   source: {
     updateId: string;
@@ -51,6 +54,7 @@ interface InboundEventBase<C extends InboundChannelId> {
      * `In-Reply-To`, etc.) can reuse the field later.
      */
     threadId?: string;
+    channelName?: string;
   };
   raw: Record<string, unknown>;
 }
@@ -59,9 +63,11 @@ export type TelegramInboundEvent = InboundEventBase<"telegram">;
 export type WhatsAppInboundEvent = InboundEventBase<"whatsapp">;
 export type SlackInboundEvent = InboundEventBase<"slack">;
 export type EmailInboundEvent = InboundEventBase<"email">;
+export type A2aInboundEvent = InboundEventBase<"a2a">;
 
 export type GatewayInboundEvent =
   | TelegramInboundEvent
   | WhatsAppInboundEvent
   | SlackInboundEvent
-  | EmailInboundEvent;
+  | EmailInboundEvent
+  | A2aInboundEvent;

package/src/channels/types.ts

@@ -5,6 +5,7 @@ export const CHANNEL_IDS = [
   "whatsapp",
   "slack",
   "email",
+  "a2a",
 ] as const;
 
 export type ChannelId = (typeof CHANNEL_IDS)[number];
@@ -30,6 +31,7 @@ export const INTERFACE_IDS = [
   "whatsapp",
   "slack",
   "email",
+  "a2a",
 ] as const;
 
 export type InterfaceId = (typeof INTERFACE_IDS)[number];

package/src/config-file-watcher.ts

@@ -15,6 +15,14 @@ import { getLogger } from "./logger.js";
 const log = getLogger("config-file-watcher");
 
 const DEBOUNCE_MS = 500;
+const FALLBACK_POLL_MS = 1_000;
+
+type IntervalHandle = ReturnType<typeof setInterval>;
+
+type TimerApi = {
+  setInterval: (fn: () => void, delayMs: number) => IntervalHandle;
+  clearInterval: (timer: IntervalHandle) => void;
+};
 
 export type ConfigChangeEvent = {
   /** Full parsed config.json data. */
@@ -32,16 +40,27 @@ export type ConfigChangeCallback = (event: ConfigChangeEvent) => void;
 
 export class ConfigFileWatcher {
   private watcher: FSWatcher | null = null;
+  private pollTimer: IntervalHandle | null = null;
   private watchingDirectory = false;
   private debounceTimer: ReturnType<typeof setTimeout> | null = null;
   private lastSerialized: Map<string, string> = new Map();
   private lastValues: Map<string, unknown> = new Map();
   private callback: ConfigChangeCallback;
   private configPath: string;
+  private pollIntervalMs: number;
+  private timerApi: TimerApi;
 
-  constructor(callback: ConfigChangeCallback) {
+  constructor(
+    callback: ConfigChangeCallback,
+    opts?: { pollIntervalMs?: number; timerApi?: TimerApi },
+  ) {
     this.callback = callback;
     this.configPath = getConfigPath();
+    this.pollIntervalMs = opts?.pollIntervalMs ?? FALLBACK_POLL_MS;
+    this.timerApi = opts?.timerApi ?? {
+      setInterval,
+      clearInterval,
+    };
   }
 
   start(): void {
@@ -77,6 +96,8 @@ export class ConfigFileWatcher {
         "Failed to start config file watcher",
       );
     }
+
+    this.startFallbackPolling();
   }
 
   stop(): void {
@@ -84,12 +105,34 @@ export class ConfigFileWatcher {
       clearTimeout(this.debounceTimer);
       this.debounceTimer = null;
     }
+    if (this.pollTimer) {
+      this.timerApi.clearInterval(this.pollTimer);
+      this.pollTimer = null;
+    }
     if (this.watcher) {
       this.watcher.close();
       this.watcher = null;
     }
   }
 
+  private startFallbackPolling(): void {
+    if (this.pollIntervalMs <= 0 || this.pollTimer) return;
+
+    this.pollTimer = this.timerApi.setInterval(() => {
+      this.pollOnce();
+
+      if (this.watchingDirectory && existsSync(this.configPath)) {
+        this.upgradeWatcher();
+      }
+    }, this.pollIntervalMs);
+    (this.pollTimer as { unref?: () => void }).unref?.();
+
+    log.info(
+      { intervalMs: this.pollIntervalMs },
+      "Polling config file for missed change events",
+    );
+  }
+
   private scheduleCheck(): void {
     if (this.debounceTimer) {
       clearTimeout(this.debounceTimer);

package/src/db/slack-store.ts

@@ -67,6 +67,16 @@ export class SlackStore {
     return row !== undefined;
   }
 
+  detachThread(threadTs: string, channelId: string): boolean {
+    const raw = (this.db as unknown as { $client: Database }).$client;
+    const changes = raw
+      .prepare(
+        "DELETE FROM slack_active_threads WHERE thread_ts = ? AND channel_id = ?",
+      )
+      .run(threadTs, channelId).changes;
+    return changes > 0;
+  }
+
   /**
    * Returns all unexpired active threads with a known channel for reconnect
    * catch-up. Rows with a NULL `channel_id` (legacy rows from before the

package/src/feature-flag-registry.json

@@ -10,11 +10,11 @@
       "defaultEnabled": false
     },
     {
-      "id": "memory-retrospective",
+      "id": "memory-retrospective-fork",
       "scope": "assistant",
-      "key": "memory-retrospective",
-      "label": "Memory retrospective pass",
-      "description": "Run a focused, memory-only retrospective during active conversations and at conversation lifecycle. The retrospective agent re-reads the messages added since the last successful run, dedupes against memory/archive/, and calls `remember` for what wasn't captured in the moment. Enabling this also relaxes the in-conversation pressure to call `remember` (lighter PKB reminder + relaxed tool description) so the assistant can stay present and trust the retrospective as the backstop.",
+      "key": "memory-retrospective-fork",
+      "label": "Fork-based memory retrospective",
+      "description": "Fork the source conversation through its latest message for memory retrospectives, instead of rendering the slice into a transcript and waking an empty background conversation. Lets the retrospective hit the provider prompt cache and read compaction summary + tail messages natively.",
       "defaultEnabled": false
     },
     {
@@ -33,6 +33,14 @@
       "description": "When enabled, the Local hosting option uses Docker under the hood for sandboxed execution, hiding the separate Docker card",
       "defaultEnabled": false
     },
+    {
+      "id": "a2a-channel",
+      "scope": "assistant",
+      "key": "a2a-channel",
+      "label": "A2A Channel",
+      "description": "Enable the A2A (Agent-to-Agent) channel for inter-assistant communication via the open A2A protocol",
+      "defaultEnabled": false
+    },
     {
       "id": "email-channel",
       "scope": "assistant",
@@ -43,7 +51,7 @@
     },
     {
       "id": "settings-developer-nav",
-      "scope": "client",
+      "scope": "assistant",
       "key": "settings-developer-nav",
       "label": "Settings Developer Nav",
       "description": "Control Developer nav visibility in macOS settings",
@@ -89,6 +97,14 @@
       "description": "Surface credential grant and audit inspection endpoints for reviewing active grants and access logs",
       "defaultEnabled": false
     },
+    {
+      "id": "chatgpt-subscription-auth",
+      "scope": "assistant",
+      "key": "chatgpt-subscription-auth",
+      "label": "ChatGPT Subscription Auth",
+      "description": "Enable ChatGPT subscription OAuth as a provider auth type for OpenAI models, using the Codex device-code flow.",
+      "defaultEnabled": false
+    },
     {
       "id": "deploy-to-vercel",
       "scope": "assistant",
@@ -145,6 +161,14 @@
       "description": "Show a speaker button on assistant messages to generate and play the message as audio via Fish Audio TTS",
       "defaultEnabled": false
     },
+    {
+      "id": "openai-compatible-endpoints",
+      "scope": "assistant",
+      "key": "openai-compatible-endpoints",
+      "label": "OpenAI-Compatible Endpoints",
+      "description": "Enable user-configured OpenAI-compatible inference endpoints with custom base URLs and model identifiers",
+      "defaultEnabled": false
+    },
     {
       "id": "backward-releases",
       "scope": "assistant",
@@ -267,7 +291,7 @@
     },
     {
       "id": "account-deletion",
-      "scope": "client",
+      "scope": "assistant",
       "key": "account-deletion",
       "label": "Account Deletion",
       "description": "Surfaces the user-initiated account deletion flow in client settings.",
@@ -281,14 +305,6 @@
       "description": "Enable the app-control skill (per-app screenshot + raw input bypassing AX tree)",
       "defaultEnabled": false
     },
-    {
-      "id": "species-migration",
-      "scope": "assistant",
-      "key": "species-migration",
-      "label": "Species Migration",
-      "description": "Enable the Species Migration skill for migrating from OpenClaw, Hermes, Manus, and other assistant species into Vellum.",
-      "defaultEnabled": false
-    },
     {
       "id": "analyze-conversation",
       "scope": "assistant",
@@ -299,7 +315,7 @@
     },
     {
       "id": "pro-plan-adjust",
-      "scope": "assistant",
+      "scope": "client",
       "key": "pro-plan-adjust",
       "label": "Pro Plan Adjust",
       "description": "Show the rich Plan card (current plan, features, Manage/Upgrade CTA) at the top of the macOS Settings \u2192 Billing tab.",
@@ -322,19 +338,91 @@
       "defaultEnabled": false
     },
     {
-      "id": "provider-deepseek",
+      "id": "velvet-theme",
+      "scope": "client",
+      "key": "velvet-theme",
+      "label": "Velvet Theme",
+      "description": "Show the Velvet theme option in the macOS appearance settings. Velvet is a dark-mode variant with red/pink accent colors.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "query-complexity-routing",
+      "scope": "assistant",
+      "key": "query-complexity-routing",
+      "label": "Query Complexity Routing",
+      "description": "Automatically route user messages to the most appropriate inference profile based on query complexity. Simple queries use the speed profile, complex queries escalate to the quality profile. The user is notified of each switch and can opt out by pinning a profile on the conversation.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "queue-steering",
       "scope": "assistant",
-      "key": "provider-deepseek",
-      "label": "DeepSeek Provider",
-      "description": "Enable the DeepSeek direct API provider and its models (V4 Pro, V4 Flash) in the provider picker and model selection UI",
+      "key": "queue-steering",
+      "label": "Queue Steering",
+      "description": "Enable the 'Push to agent' button on queued messages, allowing users to steer the assistant to a specific queued message by aborting the current generation and promoting the message to the head of the queue.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "chat-pull-to-refresh-enabled",
+      "scope": "client",
+      "key": "chat-pull-to-refresh-enabled",
+      "label": "Chat Pull to Refresh",
+      "description": "Enable pull-to-refresh gesture in the chat view.",
       "defaultEnabled": false
     },
     {
-      "id": "provider-minimax",
+      "id": "doctor",
+      "scope": "client",
+      "key": "doctor",
+      "label": "Doctor",
+      "description": "Enable the Doctor diagnostic tab in Debug settings.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "home-page",
+      "scope": "client",
+      "key": "home-page",
+      "label": "Home Page",
+      "description": "Enable the Home page as the default landing view.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "platform-notifications",
+      "scope": "client",
+      "key": "platform-notifications",
+      "label": "Platform Notifications",
+      "description": "Enable the Notifications tab in settings.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "rollback-enabled",
+      "scope": "assistant",
+      "key": "rollback-enabled",
+      "label": "Rollback Enabled",
+      "description": "Show older versions in the version picker, allowing rollback to previous releases.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "self-hosted-assistant",
+      "scope": "client",
+      "key": "self-hosted-assistant",
+      "label": "Self-Hosted Assistant",
+      "description": "Enable self-hosted assistant configuration.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "settings-sleep-policy",
       "scope": "assistant",
-      "key": "provider-minimax",
-      "label": "MiniMax Provider",
-      "description": "Enable the MiniMax direct API provider and its models (M2.7, M2.5, M2.1, M2, and highspeed variants) in the provider picker and model selection UI",
+      "key": "settings-sleep-policy",
+      "label": "Settings Sleep Policy",
+      "description": "Enable sleep policy settings.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "velvet",
+      "scope": "client",
+      "key": "velvet",
+      "label": "Velvet",
+      "description": "Enable the Velvet design theme.",
       "defaultEnabled": false
     }
   ]

package/src/handlers/handle-inbound.ts

@@ -15,7 +15,6 @@ import type { RuntimeInboundResponse } from "../runtime/client.js";
 import type { GatewayInboundEvent } from "../types.js";
 import { tryTextVerificationIntercept } from "../verification/text-verification.js";
 
-
 const log = getLogger("handle-inbound");
 
 export type InboundResult = {
@@ -119,6 +118,7 @@ export async function handleInbound(
     options?.transportMetadata?.hints,
   );
   const transportUxBrief = options?.transportMetadata?.uxBrief?.trim();
+  const sourceChannelName = event.source.channelName?.trim();
 
   try {
     const response = await forwardToRuntime(
@@ -144,8 +144,12 @@ export async function handleInbound(
           messageId: event.source.messageId,
           chatType: event.source.chatType,
           ...(event.source.threadId ? { threadId: event.source.threadId } : {}),
+          ...(sourceChannelName ? { channelName: sourceChannelName } : {}),
           languageCode: event.actor.languageCode,
           isBot: event.actor.isBot,
+          timezone: event.actor.timezone,
+          timezoneLabel: event.actor.timezoneLabel,
+          timezoneOffsetSeconds: event.actor.timezoneOffsetSeconds,
           ...(transportHints.length > 0 ? { hints: transportHints } : {}),
           ...(transportUxBrief ? { uxBrief: transportUxBrief } : {}),
           ...(options?.sourceMetadata ?? {}),
@@ -176,9 +180,7 @@ export async function handleInbound(
     // writes to both assistant DB and gateway DB. Fire-and-forget so
     // IPC failures here cannot leak as unhandled rejections.
     if (!response.denied) {
-      void touchContactChannelStats(event, response.duplicate).catch(
-        () => {},
-      );
+      void touchContactChannelStats(event, response.duplicate).catch(() => {});
     }
 
     return { forwarded: true, rejected: false, runtimeResponse: response };