@vellumai/assistant 0.11.5 → 0.11.6-staging.1

package/src/runtime/channel-readiness-types.ts

@@ -4,8 +4,46 @@ import type { ChannelId } from "../channels/types.js";
 
 export type { ChannelId };
 
-/** Setup progress for a channel: not_configured → incomplete → ready. */
-export type SetupStatus = "not_configured" | "incomplete" | "ready";
+/**
+ * Setup progress for a channel: not_configured → incomplete → ready.
+ *
+ * Progress only. A channel that is fully configured is `ready` here even when
+ * it is not currently working, because "have I finished setting this up" and
+ * "is it working right now" are different questions with different answers and
+ * different remedies. Operational state is {@link ChannelHealth}.
+ */
+export const SETUP_STATUSES = [
+  "not_configured",
+  "incomplete",
+  "ready",
+] as const;
+export type SetupStatus = (typeof SETUP_STATUSES)[number];
+
+/** What a check establishes. */
+export const CHECK_KINDS = [
+  /** Whether the channel is configured: credentials, ingress, policy. */
+  "configuration",
+  /** Whether the channel is currently working: is anything arriving. */
+  "operational",
+] as const;
+export type CheckKind = (typeof CHECK_KINDS)[number];
+
+/**
+ * Whether a configured channel is currently working.
+ *
+ * Absent when a channel measures no operational checks at all, which is not
+ * the same as failing to establish them: nothing was asked, so nothing is
+ * claimed either way, and readiness is decided on configuration alone.
+ */
+export const CHANNEL_HEALTHS = [
+  /** Every operational check confirmed the channel is working. */
+  "ok",
+  /** An operational check found a fault. */
+  "failing",
+  /** Operational checks ran but established nothing either way. */
+  "unknown",
+] as const;
+export type ChannelHealth = (typeof CHANNEL_HEALTHS)[number];
 
 /** Result of a single readiness check (local or remote). */
 export interface ReadinessCheckResult {
@@ -30,13 +68,22 @@ export interface ReadinessCheckResult {
    * require this to be absent or false.
    */
   indeterminate?: boolean;
+  /**
+   * Which question this check answers. Defaults to `configuration`, so a
+   * check that does not say is treated as setup evidence rather than as a
+   * claim about whether the channel is working.
+   */
+  kind?: CheckKind;
 }
 
 /** Point-in-time snapshot of a channel's readiness state. */
 export interface ChannelReadinessSnapshot {
   channel: ChannelId;
+  /** Configured and confirmed working: `setupStatus === "ready"` and health is not in doubt. */
   ready: boolean;
   setupStatus: SetupStatus;
+  /** Absent when the channel measures no operational checks. */
+  health?: ChannelHealth;
   checkedAt: number;
   stale: boolean;
   reasons: Array<{ code: string; text: string }>;

package/src/runtime/channel-reply-delivery.ts

@@ -217,7 +217,7 @@ export async function deliverRenderedReplyViaCallback(
         chatId,
         messageId: editTarget,
         text: segmentText,
-        useBlocks: true,
+        renderRichly: true,
       });
       // An edit replaces the text of one message. Attachments are always new
       // messages, so they still have to be posted alongside it.
@@ -245,7 +245,7 @@ export async function deliverRenderedReplyViaCallback(
       result = await deliverChannelReply(callbackUrl, {
         chatId,
         text: segmentText,
-        useBlocks: true,
+        renderRichly: true,
         attachments: segmentAttachments,
         assistantId,
         audience,

package/src/runtime/desktop-presence.ts

@@ -2,12 +2,12 @@
  * Desktop presence policy.
  *
  * Answers exactly one question for notification producers: is the user
- * demonstrably at their Mac right now? Producers use the answer to skip a
+ * demonstrably at their desktop right now? Producers use the answer to skip a
  * push that the user would see on screen anyway.
  *
  * Fails open by design. Presence is in-memory, best-effort, and reported by
  * a client that can drop off at any time, so anything short of a fresh
- * `active` report from a `macos` client answers `false` and the push goes
+ * `active` report from a desktop client answers `false` and the push goes
  * out. A missed notification is strictly worse than a redundant one.
  */
 
@@ -15,16 +15,17 @@ import { getLogger } from "../util/logger.js";
 import { assistantEventHub } from "./assistant-event-hub.js";
 
 const log = getLogger("desktop-presence");
+const DESKTOP_INTERFACES = ["macos", "windows"] as const;
 
 /**
- * Bounds how long suppression can outlive the Mac going to sleep or dropping
+ * Bounds how long suppression can outlive the desktop sleeping or dropping
  * off, while still tolerating two dropped reports at the 30s report interval.
  */
 export const PRESENCE_STALE_AFTER_MS = 90_000;
 
 export interface DesktopAttendanceOptions {
   /**
-   * Only count macOS clients whose verified actor principal matches this id.
+   * Only count desktop clients whose verified actor principal matches this id.
    * A client that connected without a principal (legacy or service token)
    * never matches a supplied id.
    */
@@ -34,13 +35,13 @@ export interface DesktopAttendanceOptions {
 }
 
 /**
- * Whether some macOS client has reported `active` recently enough to trust.
- * Stale, absent, non-macOS, and error reads all answer `false`.
+ * Whether some desktop client has reported `active` recently enough to trust.
+ * Stale, absent, non-desktop, and error reads all answer `false`.
  *
  * Callers whose notification targets one recipient (guardian-scoped or
  * otherwise per-recipient pushes) must pass that recipient's
- * `actorPrincipalId`, or another user's attended Mac suppresses the push.
- * Omitting it treats any attended macOS client as attendance, which only
+ * `actorPrincipalId`, or another user's attended desktop suppresses the push.
+ * Omitting it treats any attended desktop client as attendance, which only
  * suits notifications with no single recipient.
  */
 export function isDesktopAttended(
@@ -48,19 +49,21 @@ export function isDesktopAttended(
 ): boolean {
   const { actorPrincipalId, now = new Date() } = options;
   try {
-    return assistantEventHub.listClientsByInterface("macos").some((client) => {
-      if (
-        actorPrincipalId !== undefined &&
-        client.actorPrincipalId !== actorPrincipalId
-      ) {
-        return false;
-      }
-      return (
-        client.presence?.state === "active" &&
-        now.getTime() - client.presence.reportedAt.getTime() <=
-          PRESENCE_STALE_AFTER_MS
-      );
-    });
+    return DESKTOP_INTERFACES.some((interfaceId) =>
+      assistantEventHub.listClientsByInterface(interfaceId).some((client) => {
+        if (
+          actorPrincipalId !== undefined &&
+          client.actorPrincipalId !== actorPrincipalId
+        ) {
+          return false;
+        }
+        return (
+          client.presence?.state === "active" &&
+          now.getTime() - client.presence.reportedAt.getTime() <=
+            PRESENCE_STALE_AFTER_MS
+        );
+      }),
+    );
   } catch (err) {
     // Returning false sends the push, which is the safe direction.
     log.warn({ err }, "desktop presence read failed; treating as unattended");

package/src/runtime/host-observe.ts

@@ -0,0 +1,246 @@
+/**
+ * Screen observation raised by the daemon outside any conversation or tool
+ * call.
+ *
+ * `computer_use_observe` normally reaches the desktop client through
+ * `HostCuProxy`, which only exists inside an agent turn. This helper drives the
+ * `host_cu` wire protocol directly for callers that have no turn to hang the
+ * request off: it mints a requestId, registers a pending interaction,
+ * broadcasts a `host_cu_request` envelope to a single client, and awaits that
+ * client's POST to `/v1/host-cu-result`.
+ *
+ * Every request is bound to the actor principal that initiated it, the same
+ * binding `HostBashProxy.request()` applies. The target client is either
+ * auto-resolved among that actor's own `host_cu` clients
+ * ({@link pickSameUserAutoResolve}) or, when named explicitly, checked against
+ * the actor before dispatch ({@link enforceSameActorOrErrorResult}), so a
+ * caller can only capture the accessibility tree and screenshot of a machine
+ * its own authenticated user is signed in on.
+ *
+ * Every failure path resolves to `{ ok: false, reason }` rather than throwing:
+ * a caller observing in the background must degrade, never crash.
+ */
+
+import { randomUUID } from "node:crypto";
+
+import { getLogger } from "../util/logger.js";
+import { assistantEventHub, broadcastMessage } from "./assistant-event-hub.js";
+import {
+  ambiguousSameUserError,
+  enforceSameActorOrErrorResult,
+  pickSameUserAutoResolve,
+} from "./auth/same-actor.js";
+import * as pendingInteractions from "./pending-interactions.js";
+
+const log = getLogger("host-observe");
+
+const DEFAULT_OBSERVE_TIMEOUT_MS = 30_000;
+const MAX_OBSERVE_TIMEOUT_MS = 120_000;
+
+const NO_CLIENT_REASON =
+  "No connected client supports screen observation for this user. Make sure the desktop app is running and signed in.";
+
+/**
+ * Observation fields returned by the host CU executor. Mirrors the optional
+ * fields of `CU_RESULT_SCHEMA` (see
+ * `packages/electron-desktop/src/host-proxy/cu-executor.ts`) so the executor's
+ * result deserializes as-is. `executionResult` and `secondaryWindows` are
+ * omitted: an observe-only request executes no action, so they carry nothing
+ * for the caller.
+ */
+export interface HostObservationFields {
+  axTree?: string;
+  axDiff?: string;
+  screenshot?: string;
+  screenshotWidthPx?: number;
+  screenshotHeightPx?: number;
+  screenWidthPt?: number;
+  screenHeightPt?: number;
+  executionError?: string;
+}
+
+/** A successful observation, or a structured failure. Never throws. */
+export type HostObservation =
+  | ({ ok: true } & HostObservationFields)
+  | { ok: false; reason: string; timedOut?: boolean };
+
+export interface ObserveHostScreenOptions {
+  /**
+   * Principal id of the actor on whose behalf the observation is taken.
+   * Required, and the only identity the target client is matched against.
+   * `undefined` (no authenticated actor) fails closed: it selects no client
+   * and rejects any explicitly named one.
+   */
+  sourceActorPrincipalId: string | undefined;
+  /** How long to wait for the client. Defaults to 30s, capped at 120s. */
+  timeoutMs?: number;
+  /** Keep the base64 screenshot in the result. Defaults to true. */
+  includeScreenshot?: boolean;
+  /**
+   * Target a specific client. Must belong to `sourceActorPrincipalId`.
+   * Defaults to the actor's own `host_cu` client when exactly one is
+   * connected.
+   */
+  clientId?: string;
+}
+
+/**
+ * Failure raised by this module's own lifecycle paths (timeout, send failure),
+ * as opposed to an observation delivered by the client. Distinguished from
+ * {@link HostObservationFields} by its `failureReason` key.
+ */
+interface LocalFailure {
+  failureReason: string;
+  timedOut: boolean;
+}
+
+/**
+ * Resolve the `host_cu` client to observe, bound to the initiating actor.
+ * Returns the client id, or the failure to hand back to the caller.
+ */
+function resolveObserveTarget(
+  sourceActorPrincipalId: string | undefined,
+  clientId: string | undefined,
+): { clientId: string } | { reason: string } {
+  let resolvedClientId: string;
+  if (clientId) {
+    const target = assistantEventHub.getClientById(clientId);
+    if (!target?.capabilities.includes("host_cu")) {
+      return {
+        reason: `Client "${clientId}" is not connected or does not support host_cu.`,
+      };
+    }
+    resolvedClientId = clientId;
+  } else {
+    // Auto-resolve to the unique same-user client. Refusing the ambiguous case
+    // keeps one observation from fanning out across every machine the user has
+    // connected.
+    const resolved = pickSameUserAutoResolve({
+      hub: assistantEventHub,
+      capability: "host_cu",
+      sourceActorPrincipalId,
+    });
+    if (resolved.kind === "ambiguous") {
+      return { reason: ambiguousSameUserError("host_cu").content };
+    }
+    if (resolved.kind === "none") {
+      return { reason: NO_CLIENT_REASON };
+    }
+    resolvedClientId = resolved.clientId;
+  }
+
+  // Fail closed before registration and before broadcast, so no caller reaches
+  // a client whose authenticated user is not its own.
+  const rejection = enforceSameActorOrErrorResult({
+    hub: assistantEventHub,
+    sourceActorPrincipalId,
+    targetClientId: resolvedClientId,
+    op: "host_cu",
+  });
+  if (rejection) {
+    return { reason: rejection.content };
+  }
+  return { clientId: resolvedClientId };
+}
+
+/**
+ * Ask the initiating actor's `host_cu`-capable client for the current screen
+ * state.
+ */
+export async function observeHostScreen(
+  options: ObserveHostScreenOptions,
+): Promise<HostObservation> {
+  const { sourceActorPrincipalId, includeScreenshot = true } = options;
+  const timeoutMs = Math.min(
+    options.timeoutMs ?? DEFAULT_OBSERVE_TIMEOUT_MS,
+    MAX_OBSERVE_TIMEOUT_MS,
+  );
+
+  const target = resolveObserveTarget(sourceActorPrincipalId, options.clientId);
+  if ("reason" in target) {
+    return { ok: false, reason: target.reason };
+  }
+  const targetClientId = target.clientId;
+
+  const requestId = randomUUID();
+
+  // `/v1/host-cu-result` resolves this promise with the client's raw
+  // observation fields; the lifecycle paths below resolve it with a failure.
+  const payload = await new Promise<HostObservationFields | LocalFailure>(
+    (resolvePromise) => {
+      const timer = setTimeout(() => {
+        // Resolve the tracker first so a late client POST is tolerated as a
+        // no-op instead of double-resolving this promise.
+        if (!pendingInteractions.resolve(requestId, "cancelled")) {
+          return;
+        }
+        broadcastMessage(
+          { type: "host_cu_cancel", requestId, conversationId: "" },
+          undefined,
+          { targetClientId },
+        );
+        resolvePromise({
+          failureReason: `Timed out after ${timeoutMs}ms waiting for the desktop client. It may be busy, outdated, or disconnected.`,
+          timedOut: true,
+        });
+      }, timeoutMs);
+
+      // The target's actor principal is present by construction: the same-actor
+      // check above rejects a client that registered without one.
+      const targetActorPrincipalId =
+        assistantEventHub.getActorPrincipalIdForClient(targetClientId);
+      pendingInteractions.register(requestId, {
+        kind: "host_cu",
+        rpcResolve: resolvePromise as (value: unknown) => void,
+        timer,
+        targetClientId,
+        ...(targetActorPrincipalId ? { targetActorPrincipalId } : {}),
+      });
+
+      try {
+        broadcastMessage(
+          {
+            type: "host_cu_request",
+            requestId,
+            // Conversation-agnostic. The native helper keys its per-session
+            // state off this id, and an empty string is already what the
+            // desktop executor sends when no conversation is attached.
+            conversationId: "",
+            toolName: "computer_use_observe",
+            input: {},
+            stepNumber: 1,
+          },
+          undefined,
+          { targetClientId },
+        );
+      } catch (err) {
+        pendingInteractions.resolve(requestId, "cancelled");
+        log.warn({ requestId, err }, "Screen observation broadcast failed");
+        resolvePromise({
+          failureReason: `Failed to reach the desktop client: ${String(err)}`,
+          timedOut: false,
+        });
+      }
+    },
+  );
+
+  if ("failureReason" in payload) {
+    return {
+      ok: false,
+      reason: payload.failureReason,
+      ...(payload.timedOut ? { timedOut: true } : {}),
+    };
+  }
+
+  const { executionError, ...observation } = payload;
+  if (executionError) {
+    return { ok: false, reason: executionError };
+  }
+
+  if (!includeScreenshot) {
+    delete observation.screenshot;
+    delete observation.screenshotWidthPx;
+    delete observation.screenshotHeightPx;
+  }
+  return { ok: true, ...observation };
+}

package/src/runtime/http-server.ts

@@ -7,6 +7,10 @@
 
 import type { ServerWebSocket } from "bun";
 
+import {
+  startAppPinReconcileSweep,
+  stopAppPinReconcileSweep,
+} from "../apps/app-pin-reconciler.js";
 import {
   activeMediaStreamSessions,
   MediaStreamCallSession,
@@ -93,6 +97,12 @@ import {
   startInferenceProfileSessionReaper,
   stopInferenceProfileSessionReaper,
 } from "./routes/inference-profile-session-reaper.js";
+import {
+  activeWatchStreamSessions,
+  closeWatchIngress,
+  drainWatchRetros,
+  WatchStreamSession,
+} from "./routes/watch-routes.js";
 
 // Re-export for consumers
 export { isPrivateAddress } from "./middleware/auth.js";
@@ -166,6 +176,25 @@ interface LiveVoiceWebSocketData {
   wsType: "live-voice";
 }
 
+/**
+ * WebSocket data attached to `/v1/watch/stream` connections. The `wsType`
+ * discriminator routes frames to the watch session orchestrator instead of
+ * the other WebSocket handlers.
+ */
+interface WatchStreamWebSocketData {
+  wsType: "watch-stream";
+  mimeType: string;
+  sampleRate?: number;
+  /** Conversation the session's timeline is keyed on, when the client names one. */
+  conversationId?: string;
+  /** Desktop client to observe, when the actor has more than one connected. */
+  clientId?: string;
+  /** The session ID for tracking in the active sessions registry. */
+  sessionId: string;
+  /** Bound at open time so the close handler tears down the exact session. */
+  session?: WatchStreamSession;
+}
+
 export class RuntimeHttpServer {
   private server: ReturnType<typeof Bun.serve> | null = null;
   private port: number;
@@ -204,7 +233,8 @@ export class RuntimeHttpServer {
     type AllWebSocketData =
       | MediaStreamWebSocketData
       | SttStreamWebSocketData
-      | LiveVoiceWebSocketData;
+      | LiveVoiceWebSocketData
+      | WatchStreamWebSocketData;
     this.server = Bun.serve<AllWebSocketData>({
       port: this.port,
       hostname: this.hostname,
@@ -310,11 +340,41 @@ export class RuntimeHttpServer {
                 send: (frame) => {
                   ws.send(JSON.stringify(frame));
                 },
+                // Lets the daemon hang up on a client that stopped answering.
+                // A normal close (not a retryable one) so the client ends the
+                // call rather than reconnecting into a session that is gone.
+                close: () => {
+                  ws.close(1000, "Live voice session released");
+                },
               }),
             );
             log.info("Live voice WebSocket opened");
             return;
           }
+          if (data.wsType === "watch-stream") {
+            const watchData = data;
+            log.info(
+              {
+                sessionId: watchData.sessionId,
+                mimeType: watchData.mimeType,
+              },
+              "Watch stream WebSocket opened",
+            );
+            const session = new WatchStreamSession(ws, {
+              mimeType: watchData.mimeType,
+              ...(watchData.sampleRate !== undefined
+                ? { sampleRate: watchData.sampleRate }
+                : {}),
+              ...(watchData.conversationId
+                ? { conversationId: watchData.conversationId }
+                : {}),
+              ...(watchData.clientId ? { clientId: watchData.clientId } : {}),
+            });
+            watchData.session = session;
+            activeWatchStreamSessions.set(watchData.sessionId, session);
+            void session.start();
+            return;
+          }
           log.warn("WebSocket opened with unknown data type — closing");
           ws.close(1008, "Unknown WebSocket type");
         },
@@ -353,6 +413,18 @@ export class RuntimeHttpServer {
             void connection?.handleMessage(message);
             return;
           }
+          if (data.wsType === "watch-stream") {
+            const session = data.session;
+            if (!session) {
+              return;
+            }
+            if (typeof message === "string") {
+              session.handleMessage(message);
+            } else {
+              session.handleBinaryAudio(message);
+            }
+            return;
+          }
           log.warn("WebSocket message on unknown data type — closing");
           ws.close(1008, "Unknown WebSocket type");
         },
@@ -423,6 +495,29 @@ export class RuntimeHttpServer {
             connection?.release();
             return;
           }
+          if (data.wsType === "watch-stream") {
+            const watchData = data;
+            log.info(
+              {
+                sessionId: watchData.sessionId,
+                code,
+                reason: reason?.toString(),
+              },
+              "Watch stream WebSocket closed",
+            );
+            const session = watchData.session;
+            if (session) {
+              session.handleClose(code, reason?.toString());
+              // Only drop our own session from the registry, since a
+              // reconnect may have already replaced it under a new id.
+              if (
+                activeWatchStreamSessions.get(watchData.sessionId) === session
+              ) {
+                activeWatchStreamSessions.delete(watchData.sessionId);
+              }
+            }
+            return;
+          }
           log.warn(
             { code, reason: reason?.toString() },
             "WebSocket with unknown data type closed",
@@ -523,10 +618,16 @@ export class RuntimeHttpServer {
     // migrations are unready.
     startPluginScheduleReconcileSweep();
     log.info("Plugin schedule reconcile sweep started");
+
+    // Same backstop for sidebar pins: a disabled plugin's app stops existing,
+    // and its id returns intact when the plugin is re-enabled.
+    startAppPinReconcileSweep();
+    log.info("App pin reconcile sweep started");
   }
 
   async stop(): Promise<void> {
     stopGuardianExpirySweep();
+    stopAppPinReconcileSweep();
     stopInferenceProfileSessionReaper();
     stopTelegramWebhookHealthSweep();
     stopPluginScheduleReconcileSweep();
@@ -543,6 +644,20 @@ export class RuntimeHttpServer {
       activeSttStreamSessions.delete(sessionId);
     }
 
+    // Watch shuts down in order: refuse new sessions, tear down the open ones,
+    // then wait on the retrospectives they left running. Refusing first is what
+    // makes the wait meaningful, because the Bun server below keeps accepting
+    // connections until the very end and a session opened during the wait would
+    // register a retrospective after it had already taken its snapshot.
+    closeWatchIngress();
+    for (const [sessionId, session] of activeWatchStreamSessions) {
+      session.destroy();
+      activeWatchStreamSessions.delete(sessionId);
+    }
+    // Destroying a session starts no retrospective, so this waits only on one
+    // that a socket closing just before shutdown had already under way.
+    await drainWatchRetros();
+
     const liveVoiceManager = getLiveVoiceSessionManager();
     const liveVoiceSessionId = liveVoiceManager.activeSessionId;
     if (liveVoiceSessionId) {
@@ -636,6 +751,16 @@ export class RuntimeHttpServer {
       return this.handleLiveVoiceUpgrade(req, server);
     }
 
+    // WebSocket upgrade for watch narration capture, under the same
+    // private-network restrictions and gateway-service token verification as
+    // STT streaming.
+    if (
+      path === "/v1/watch/stream" &&
+      req.headers.get("upgrade")?.toLowerCase() === "websocket"
+    ) {
+      return this.handleWatchStreamUpgrade(req, server);
+    }
+
     // Twilio webhook endpoints — before auth check because Twilio
     // webhook POSTs don't include bearer tokens.
     const twilioResponse = await this.handleTwilioWebhook(req, path);
@@ -923,6 +1048,61 @@ export class RuntimeHttpServer {
     return undefined!;
   }
 
+  /**
+   * Handle WebSocket upgrade for `/v1/watch/stream`.
+   *
+   * Gated exactly as `/v1/stt/stream` is: private network peers and origins
+   * only, then a gateway service token. The gateway owns downstream client
+   * auth and dials this upstream on the client's behalf.
+   */
+  private handleWatchStreamUpgrade(
+    req: Request,
+    server: ReturnType<typeof Bun.serve>,
+  ): Response {
+    if (!isPrivateNetworkPeer(server, req) || !isPrivateNetworkOrigin(req)) {
+      return httpError(
+        "FORBIDDEN",
+        "Direct watch stream access disabled: only private network peers allowed",
+        403,
+      );
+    }
+
+    const tokenError = this.verifyGatewayServiceToken(req);
+    if (tokenError) {
+      return tokenError;
+    }
+
+    const wsUrl = new URL(req.url);
+    const mimeType = wsUrl.searchParams.get("mimeType");
+    if (!mimeType) {
+      return new Response("Missing required query parameter: mimeType", {
+        status: 400,
+      });
+    }
+
+    const sampleRateRaw = wsUrl.searchParams.get("sampleRate");
+    const sampleRate = sampleRateRaw ? parseInt(sampleRateRaw, 10) : undefined;
+    const conversationId =
+      wsUrl.searchParams.get("conversationId")?.trim() || undefined;
+    const clientId = wsUrl.searchParams.get("clientId")?.trim() || undefined;
+
+    const upgraded = server.upgrade(req, {
+      data: {
+        wsType: "watch-stream",
+        mimeType,
+        sampleRate,
+        conversationId,
+        clientId,
+        sessionId: crypto.randomUUID(),
+      } satisfies WatchStreamWebSocketData,
+    });
+    if (!upgraded) {
+      return new Response("WebSocket upgrade failed", { status: 500 });
+    }
+    // Bun's WebSocket upgrade consumes the request, so no Response is sent.
+    return undefined!;
+  }
+
   private async handleTwilioWebhook(
     req: Request,
     path: string,