@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-staging.2

package/src/runtime/routes/credential-routes.ts

@@ -43,7 +43,7 @@ import {
   deleteCredentialMetadata,
   getCredentialMetadata,
   getCredentialMetadataById,
-  listCredentialRecordsLive,
+  listCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import type { CredentialInjectionTemplate } from "../../tools/credentials/policy-types.js";
 import {
@@ -228,9 +228,6 @@ function assertNotPlatformManaged(
   }
 }
 
-const CREDENTIAL_STORE_UNREACHABLE =
-  "Credential store is unreachable. Retry in a moment, or check that the credential vault is running.";
-
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -238,14 +235,9 @@ const CREDENTIAL_STORE_UNREACHABLE =
 async function handleCredentialsList({ body }: RouteHandlerArgs) {
   const search = (body as { search?: string } | undefined)?.search;
 
-  const live = await listCredentialRecordsLive();
-  if (live.unreachable) {
-    throw new InternalError(CREDENTIAL_STORE_UNREACHABLE);
-  }
-
   // Platform-provisioned credentials are not the user's to act on, so they
   // never become a Settings row (and never a click-to-reveal).
-  let allMetadata = live.records.filter(
+  let allMetadata = listCredentialMetadata().filter(
     (m) => !isPlatformManagedCredential(m.service, m.field),
   );
 
@@ -280,12 +272,7 @@ async function handleCredentialsList({ body }: RouteHandlerArgs) {
 
   const credentials = await Promise.all(
     allMetadata.map(async (m) => {
-      const { value: secret, unreachable } = await getSecureKeyResultAsync(
-        credentialKey(m.service, m.field),
-      );
-      if (unreachable) {
-        throw new InternalError(CREDENTIAL_STORE_UNREACHABLE);
-      }
+      const secret = await getSecureKeyAsync(credentialKey(m.service, m.field));
       const connection = connectionsByProvider.get(m.service);
       return buildCredentialOutput(m, secret, connection);
     }),
@@ -323,7 +310,9 @@ async function handleCredentialsInspect({ body }: RouteHandlerArgs) {
 
   if (!lookup.metadata && (secret == null || secret.length === 0)) {
     if (unreachable) {
-      throw new InternalError(CREDENTIAL_STORE_UNREACHABLE);
+      throw new InternalError(
+        "Credential store is unreachable — ensure the assistant is running",
+      );
     }
     throw new BadRequestError("Credential not found");
   }
@@ -385,7 +374,9 @@ async function handleCredentialsReveal({ body, headers }: RouteHandlerArgs) {
 
   if (secret == null || secret.length === 0) {
     if (unreachable) {
-      throw new InternalError(CREDENTIAL_STORE_UNREACHABLE);
+      throw new InternalError(
+        "Credential store is unreachable — ensure the assistant is running",
+      );
     }
     throw new BadRequestError("Credential not found");
   }
@@ -629,7 +620,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "List all credentials with metadata",
     description:
-      "Return credentials from the live credential vault, with OAuth connection info and platform-managed credentials. Fails if the vault is unreachable.",
+      "Return all stored credentials with metadata, OAuth connection info, and platform-managed credentials.",
     tags: ["credentials"],
     requestBody: z.object({
       search: z.string().optional().describe("Filter by substring match"),

package/src/runtime/routes/debug-bash-routes.ts

@@ -0,0 +1,173 @@
+/**
+ * IPC route for executing shell commands through the assistant process.
+ *
+ * The CLI sends the command over the IPC socket and receives a single
+ * response containing stdout, stderr, and the exit code.
+ *
+ * **Security**: Gated behind VELLUM_DEBUG=1. When debug mode is off (the
+ * default), the handler returns an error immediately so the CLI surfaces a
+ * clear rejection instead of hanging. The assistant must be restarted with
+ * VELLUM_DEBUG=1 for this route to execute commands.
+ */
+
+import { spawn } from "node:child_process";
+
+import { z } from "zod";
+
+import { getIsContainerized } from "../../config/env-registry.js";
+import { buildSanitizedEnv } from "../../tools/terminal/safe-env.js";
+import { getWorkspaceDir } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+function isDebugMode(): boolean {
+  return (
+    process.env.VELLUM_DEBUG === "1" || process.env.VELLUM_DEBUG === "true"
+  );
+}
+
+interface DebugBashResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  error?: string;
+}
+
+function handleDebugBash({ body }: RouteHandlerArgs): Promise<DebugBashResult> {
+  if (getIsContainerized()) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "debug bash is not available in containerized environments",
+    });
+  }
+
+  if (!isDebugMode()) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error:
+        "Bash debug execution is disabled. The running assistant process must have been started with VELLUM_DEBUG=1 (setting it on the CLI command alone is not enough). Restart the assistant with: vellum sleep && VELLUM_DEBUG=1 vellum wake",
+    });
+  }
+
+  const { command, timeoutMs } = body as {
+    command?: string;
+    timeoutMs?: number;
+  };
+
+  if (!command || typeof command !== "string") {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "command is required",
+    });
+  }
+
+  const effectiveTimeout =
+    typeof timeoutMs === "number" && timeoutMs > 0
+      ? timeoutMs
+      : DEFAULT_TIMEOUT_MS;
+
+  return new Promise<DebugBashResult>((resolve) => {
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let timedOut = false;
+    let settled = false;
+
+    const finish = (result: DebugBashResult) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve(result);
+    };
+
+    const child = spawn("bash", ["-c", command], {
+      cwd: getWorkspaceDir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+      env: buildSanitizedEnv(),
+      windowsHide: true,
+    });
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        process.kill(-child.pid!, "SIGKILL");
+      } catch {
+        // Process group may have already exited.
+      }
+    }, effectiveTimeout);
+
+    child.stdout.on("data", (data: Buffer) => {
+      stdoutChunks.push(data);
+    });
+
+    child.stderr.on("data", (data: Buffer) => {
+      stderrChunks.push(data);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({
+        stdout: Buffer.concat(stdoutChunks).toString(),
+        stderr: Buffer.concat(stderrChunks).toString(),
+        exitCode: code,
+        timedOut,
+      });
+    });
+
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish({
+        stdout: "",
+        stderr: "",
+        exitCode: null,
+        timedOut: false,
+        error: err.message,
+      });
+    });
+  });
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "debug_bash",
+    endpoint: "debug/bash",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    requireGuardian: false,
+    summary: "Execute a shell command in the assistant process",
+    description:
+      "Developer debugging tool. Requires the assistant to be running with VELLUM_DEBUG=1.",
+    tags: ["debug"],
+    requestBody: z.object({
+      command: z.string().describe("Shell command to execute via bash -c"),
+      timeoutMs: z
+        .number()
+        .optional()
+        .describe("Execution timeout in milliseconds (default: 30000)"),
+    }),
+    responseBody: z.object({
+      stdout: z.string(),
+      stderr: z.string(),
+      exitCode: z.number().nullable(),
+      timedOut: z.boolean(),
+      error: z.string().optional(),
+    }),
+    handler: handleDebugBash,
+  },
+];

package/src/runtime/routes/diagnostics-routes.ts

@@ -22,7 +22,6 @@ import {
   getConfiguredProvider,
   userMessage,
 } from "../../providers/provider-send-message.js";
-import { isMaxTokensStopReason } from "../../providers/stop-reasons.js";
 import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
@@ -177,44 +176,9 @@ function buildCommandPrompt(body: DictationBody, stylePrompt?: string): string {
   return sections.join("\n");
 }
 
-export function computeMaxTokens(inputLength: number): number {
+function computeMaxTokens(inputLength: number): number {
   const estimatedInputTokens = Math.ceil(inputLength / 3);
-  // The cleanup tool call carries the whole transcript back in its `text`
-  // argument, plus a `reasoning` string and the JSON scaffolding around both,
-  // so the budget has to cover well more than the input alone. `max_tokens` is
-  // a ceiling rather than a target: a call that stops short of it costs no
-  // extra latency.
-  return Math.max(512, estimatedInputTokens * 2 + 256);
-}
-
-export type CleanupRejection = "truncated";
-
-/**
- * Decide whether the cleanup model's rewrite is safe to use as the payload.
- *
- * The rewrite replaces what the user actually said. A token-cap stop means the
- * tool JSON was cut mid-argument, so however complete the `text` argument
- * happens to look, it is a fragment; the raw transcript is the safer payload
- * then. Unpolished beats wrong.
- *
- * Whether a shorter rewrite still preserved the meaning is the model's call
- * (the prompt asks it to drop fillers and tighten phrasing), so there is no
- * length check here: a deterministic ratio cannot tell a concise cleanup from
- * a summary.
- */
-export function resolveCleanedDictation(
-  raw: string,
-  cleaned: string,
-  stopReason: string | null | undefined,
-): { text: string; rejected: CleanupRejection | null } {
-  const trimmed = cleaned.trim();
-  if (!trimmed) {
-    return { text: raw, rejected: null };
-  }
-  if (isMaxTokensStopReason(stopReason)) {
-    return { text: raw, rejected: "truncated" };
-  }
-  return { text: trimmed, rejected: null };
+  return Math.max(256, estimatedInputTokens + 128);
 }
 
 interface DictationResult {
@@ -365,23 +329,7 @@ async function handleDictation(body: DictationBody): Promise<DictationResult> {
             ...profileMeta,
           };
         }
-        const { text: cleanedText, rejected } = resolveCleanedDictation(
-          transcription,
-          input.text ?? "",
-          response.stopReason,
-        );
-        if (rejected) {
-          // Lengths only -- transcript content must never be logged.
-          log.warn(
-            {
-              rejected,
-              stopReason: response.stopReason,
-              rawChars: transcription.length,
-              cleanedChars: input.text?.trim().length ?? 0,
-            },
-            "Dictation cleanup rejected, using raw transcription",
-          );
-        }
+        const cleanedText = input.text?.trim() || transcription;
         const normalizedText = applyDictionary(cleanedText, profile.dictionary);
         return {
           text: normalizedText,

package/src/runtime/routes/index.ts

@@ -39,7 +39,6 @@ import { ROUTES as CALL_ROUTES } from "./call-routes.js";
 import { ROUTES as CHANNEL_AVAILABILITY_ROUTES } from "./channel-availability-routes.js";
 import { ROUTES as CHANNEL_READINESS_ROUTES } from "./channel-readiness-routes.js";
 import { CHANNEL_ROUTES } from "./channel-route-definitions.js";
-import { ROUTES as CHANNEL_SEND_ROUTES } from "./channel-send-routes.js";
 import { ROUTES as CHANNEL_VERIFICATION_ROUTES } from "./channel-verification-routes.js";
 import { ROUTES as CHATGPT_SUBSCRIPTION_AUTH_ROUTES } from "./chatgpt-subscription-auth-routes.js";
 import { ROUTES as CLIENT_ROUTES } from "./client-routes.js";
@@ -59,10 +58,10 @@ import { ROUTES as CONVERSATIONS_IMPORT_ROUTES } from "./conversations-import-ro
 import { ROUTES as CREDENTIAL_PROMPT_ROUTES } from "./credential-prompt-routes.js";
 import { ROUTES as CREDENTIAL_REQUEST_ROUTES } from "./credential-request-routes.js";
 import { ROUTES as CREDENTIAL_ROUTES } from "./credential-routes.js";
+import { ROUTES as DEBUG_BASH_ROUTES } from "./debug-bash-routes.js";
 import { ROUTES as DEBUG_ROUTES } from "./debug-routes.js";
 import { ROUTES as DEFAULT_PROVIDER_ROUTES } from "./default-provider-routes.js";
 import { ROUTES as DEFER_ROUTES } from "./defer-routes.js";
-import { ROUTES as DESKTOP_SETUP_ROUTES } from "./desktop-setup-routes.js";
 import { ROUTES as DIAGNOSTICS_ROUTES } from "./diagnostics-routes.js";
 import { ROUTES as DISK_PRESSURE_ROUTES } from "./disk-pressure-routes.js";
 import { ROUTES as DOCUMENT_COMMENT_ROUTES } from "./document-comments-routes.js";
@@ -192,7 +191,6 @@ export const ROUTES: RouteDefinition[] = [
   ...CHANNEL_VERIFICATION_ROUTES,
   ...CHANNEL_AVAILABILITY_ROUTES,
   ...CHANNEL_READINESS_ROUTES,
-  ...CHANNEL_SEND_ROUTES,
   ...BROWSER_ROUTES,
   ...BROWSER_TABS_ROUTES,
   ...BTW_ROUTES,
@@ -217,9 +215,9 @@ export const ROUTES: RouteDefinition[] = [
   ...CONVERSATION_QUERY_ROUTES,
   ...CONVERSATION_STARTER_ROUTES,
   ...ACTIVATION_ROUTES,
+  ...DEBUG_BASH_ROUTES,
   ...DEBUG_ROUTES,
   ...DEFAULT_PROVIDER_ROUTES,
-  ...DESKTOP_SETUP_ROUTES,
   ...DIAGNOSTICS_ROUTES,
   ...DISK_PRESSURE_ROUTES,
   ...RESOURCE_PRESSURE_ROUTES,

package/src/runtime/routes/log-export-routes.ts

@@ -22,7 +22,6 @@ import { join } from "node:path";
 import { and, desc, eq, gte, lte } from "drizzle-orm";
 import { z } from "zod";
 
-import { overlayWorkspaceMcpForConfigRead } from "../../mcp/workspace-mcp-config.js";
 import { getDb, getLogsDb } from "../../persistence/db-connection.js";
 import {
   llmRequestLogs,
@@ -569,7 +568,6 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
       }
     }
 
-    overlayWorkspaceMcpForConfigRead(config);
     const mcpServers = asRecord(asRecord(config.mcp)?.servers);
     for (const server of Object.values(mcpServers ?? {})) {
       const transport = asRecord(asRecord(server)?.transport);

package/src/runtime/routes/mcp-auth-routes.ts

@@ -14,7 +14,8 @@
 
 import { z } from "zod";
 
-import type { McpServerConfig } from "../../config/schemas/mcp.js";
+import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
+import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
 import { McpClient } from "../../mcp/client.js";
@@ -30,10 +31,6 @@ import {
   deleteMcpOAuthCredentials,
   hasMcpOAuthTokens,
 } from "../../mcp/mcp-oauth-provider.js";
-import {
-  loadWorkspaceMcpConfig,
-  saveWorkspaceMcpConfig,
-} from "../../mcp/workspace-mcp-config.js";
 import { readPluginMcpServers } from "../../plugins/mcp-servers.js";
 import { getMcpToolsByServer } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
@@ -68,18 +65,6 @@ const McpAddParams = z.object({
 
 const McpRemoveParams = z.object({ name: z.string() });
 
-function persistWorkspaceMcpConfig(config: {
-  servers: Record<string, McpServerConfig>;
-}): void {
-  try {
-    saveWorkspaceMcpConfig(config);
-  } catch (err) {
-    throw new InternalError(
-      err instanceof Error ? err.message : String(err),
-    );
-  }
-}
-
 async function handleMcpAuthStart({
   body,
 }: {
@@ -91,7 +76,8 @@ async function handleMcpAuthStart({
 }> {
   const { serverId } = parseBody(McpServerIdParams, body);
 
-  const servers = loadWorkspaceMcpConfig().servers;
+  const raw = loadRawConfig();
+  const servers = (raw.mcp as Partial<McpConfig> | undefined)?.servers ?? {};
   const serverConfig = servers[serverId];
 
   if (!serverConfig) {
@@ -267,7 +253,9 @@ function detectAuthType(headers: Record<string, string>): "bearer" | "api-key" {
 async function handleMcpList(_args: {
   body?: Record<string, unknown>;
 }): Promise<{ servers: McpServerEntry[] }> {
-  const servers = loadWorkspaceMcpConfig().servers;
+  const raw = loadRawConfig();
+  const mcpConfig = raw.mcp as Partial<McpConfig> | undefined;
+  const servers = mcpConfig?.servers ?? {};
   const configEntries = (
     Object.entries(servers) as [string, McpServerConfig][]
   ).filter(([, config]) => config && typeof config === "object");
@@ -446,13 +434,18 @@ async function handleMcpUpdate({
 }): Promise<{ updated: true }> {
   const { name, headers } = parseBody(McpUpdateParams, body);
 
-  const servers = loadWorkspaceMcpConfig().servers;
-  const server = servers[name];
+  const raw = loadRawConfig();
+  const mcpConfig = raw.mcp as Record<string, unknown> | undefined;
+  const serverMap = mcpConfig?.servers as
+    | Record<string, Record<string, unknown>>
+    | undefined;
 
-  if (!server) {
+  if (!serverMap || !serverMap[name]) {
     throw new NotFoundError(`MCP server "${name}" not found.`);
   }
 
+  const server = serverMap[name];
+
   if (headers !== undefined) {
     const transport = server.transport as Record<string, unknown> | undefined;
     if (
@@ -481,7 +474,7 @@ async function handleMcpUpdate({
     }
   }
 
-  persistWorkspaceMcpConfig({ servers });
+  saveRawConfig(raw);
   triggerReload("internal_mcp_update");
 
   return { updated: true };
@@ -501,7 +494,7 @@ async function handleMcpAdd({
     body,
   );
 
-  let transport: McpServerConfig["transport"];
+  let transport: Record<string, unknown>;
   switch (transportType) {
     case "stdio":
       if (!command) {
@@ -524,16 +517,27 @@ async function handleMcpAdd({
       );
   }
 
-  const servers = { ...loadWorkspaceMcpConfig().servers };
+  const raw = loadRawConfig();
+  if (!raw.mcp) {
+    raw.mcp = { servers: {} };
+  }
+  const mcpConfig = raw.mcp as Record<string, unknown>;
+  if (!mcpConfig.servers) {
+    mcpConfig.servers = {};
+  }
+  const serverMap = mcpConfig.servers as Record<string, unknown>;
 
-  if (servers[name]) {
+  if (serverMap[name]) {
     throw new BadRequestError(
       `MCP server "${name}" already exists. Remove it first with: assistant mcp remove ${name}`,
     );
   }
 
-  servers[name] = { transport };
+  serverMap[name] = {
+    transport,
+  };
 
+  // Store auth headers in credential store, not config
   if (headers && Object.keys(headers).length > 0) {
     const ok = await setMcpHeaders(name, headers);
     if (!ok) {
@@ -543,7 +547,7 @@ async function handleMcpAdd({
     }
   }
 
-  persistWorkspaceMcpConfig({ servers });
+  saveRawConfig(raw);
   triggerReload("internal_mcp_add");
 
   return { added: true };
@@ -560,7 +564,8 @@ async function handleMcpAuthRevoke({
 }): Promise<{ revoked: true }> {
   const { serverId } = parseBody(McpServerIdParams, body);
 
-  const servers = loadWorkspaceMcpConfig().servers;
+  const raw = loadRawConfig();
+  const servers = (raw.mcp as Partial<McpConfig> | undefined)?.servers ?? {};
   const serverConfig = servers[serverId];
 
   if (!serverConfig) {
@@ -597,29 +602,32 @@ async function handleMcpRemove({
 }): Promise<{ removed: true }> {
   const { name } = parseBody(McpRemoveParams, body);
 
-  const servers = { ...loadWorkspaceMcpConfig().servers };
-  const serverConfig = servers[name];
+  const raw = loadRawConfig();
+  const mcpConfig = raw.mcp as Record<string, unknown> | undefined;
+  const serverMap = mcpConfig?.servers as Record<string, unknown> | undefined;
 
-  if (!serverConfig) {
+  if (!serverMap || !serverMap[name]) {
     throw new NotFoundError(`MCP server "${name}" not found.`);
   }
 
-  if (
-    serverConfig.transport.type === "sse" ||
-    serverConfig.transport.type === "streamable-http"
-  ) {
+  // Best-effort cleanup of credentials stored for this server
+  const serverConfig = serverMap[name] as Record<string, unknown>;
+  const transport = serverConfig?.transport as
+    | Record<string, unknown>
+    | undefined;
+  if (transport?.type === "sse" || transport?.type === "streamable-http") {
     try {
       await Promise.all([
         deleteMcpOAuthCredentials(name),
         deleteMcpHeaders(name),
       ]);
     } catch {
-      // Credentials may not exist.
+      // Ignore — credentials may not exist
     }
   }
 
-  delete servers[name];
-  persistWorkspaceMcpConfig({ servers });
+  delete serverMap[name];
+  saveRawConfig(raw);
   triggerReload("internal_mcp_remove");
 
   return { removed: true };

package/src/runtime/routes/migration-routes.ts

@@ -22,8 +22,8 @@ import { PassThrough, Readable } from "node:stream";
 
 import { z } from "zod";
 
+import { getPlatformAssistantId } from "../../config/env.js";
 import { invalidateConfigCache } from "../../config/loader.js";
-import { resolvePlatformAssistantId } from "../../config/platform-identity.js";
 import { getAssistantName } from "../../daemon/identity-helpers.js";
 import { runAsyncSqlite } from "../../persistence/db-async-query.js";
 import {
@@ -236,14 +236,28 @@ interface ExportManifestInputs {
 /**
  * Resolve the `assistant.id` for an export.
  *
- * In-memory identity (validate rehydration or secret-routes). The schema
- * requires `id` to be non-empty, so we fall back to
+ * Mirrors `platform/client.ts`'s precedence: in-memory override (set at
+ * daemon startup or by secret-routes) → credential store → daemon-internal
+ * fallback. The schema requires `id` to be non-empty, so we fall back to
  * `DAEMON_INTERNAL_ASSISTANT_ID` rather than the empty string.
  */
 async function resolveAssistantId(): Promise<string> {
-  const resolved = await resolvePlatformAssistantId();
-  if (resolved) {
-    return resolved;
+  const inMemory = getPlatformAssistantId();
+  if (inMemory) {
+    return inMemory;
+  }
+  try {
+    const stored = await getSecureKeyAsync(
+      credentialKey("vellum", "platform_assistant_id"),
+    );
+    if (stored) {
+      return stored;
+    }
+  } catch (err) {
+    log.warn(
+      { err },
+      "Failed to read platform_assistant_id from credential store; falling back to daemon-internal id",
+    );
   }
   return DAEMON_INTERNAL_ASSISTANT_ID;
 }

package/src/runtime/routes/platform-routes.ts

@@ -39,17 +39,7 @@ import {
 } from "@vellumai/service-contracts/platform-credential";
 import { z } from "zod";
 
-import {
-  setPlatformAssistantId,
-  setPlatformBaseUrl,
-  setPlatformOrganizationId,
-  setPlatformUserId,
-} from "../../config/env.js";
 import { isPlatformRemote } from "../../config/env-registry.js";
-import {
-  resolvePlatformOrganizationId,
-  resolvePlatformUserId,
-} from "../../config/platform-identity.js";
 import {
   registerCallbackRoute,
   resolvePlatformCallbackRegistrationContext,
@@ -299,12 +289,24 @@ async function handlePlatformStatus(
 ): Promise<PlatformStatusResponse> {
   const context = await resolvePlatformCallbackRegistrationContext();
 
-  const [organizationId, userId, webhookSecretRaw] = await Promise.all([
-    resolvePlatformOrganizationId(),
-    resolvePlatformUserId(),
+  const [orgIdRaw, userIdRaw, webhookSecretRaw] = await Promise.all([
+    getSecureKeyAsync(
+      credentialKey(
+        CREDENTIAL_KEYS.organizationId.service,
+        CREDENTIAL_KEYS.organizationId.field,
+      ),
+    ),
+    getSecureKeyAsync(
+      credentialKey(
+        CREDENTIAL_KEYS.userId.service,
+        CREDENTIAL_KEYS.userId.field,
+      ),
+    ),
     getSecureKeyAsync(credentialKey("vellum", "webhook_secret")),
   ]);
 
+  const organizationId = orgIdRaw?.trim() ?? "";
+  const userId = userIdRaw?.trim() ?? "";
   const hasWebhookSecret = !!webhookSecretRaw;
 
   return {
@@ -465,11 +467,6 @@ async function handlePlatformDisconnect(
     );
   }
 
-  setPlatformBaseUrl(undefined);
-  setPlatformAssistantId(undefined);
-  setPlatformOrganizationId(undefined);
-  setPlatformUserId(undefined);
-
   // Notify connected clients
   broadcastMessage({ type: "platform_disconnected" });