@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/runtime/routes/log-export-routes.ts

@@ -22,6 +22,7 @@ import { join } from "node:path";
 import { and, desc, eq, gte, lte } from "drizzle-orm";
 import { z } from "zod";
 
+import { overlayWorkspaceMcpForConfigRead } from "../../mcp/workspace-mcp-config.js";
 import { getDb, getLogsDb } from "../../persistence/db-connection.js";
 import {
   llmRequestLogs,
@@ -568,6 +569,7 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
       }
     }
 
+    overlayWorkspaceMcpForConfigRead(config);
     const mcpServers = asRecord(asRecord(config.mcp)?.servers);
     for (const server of Object.values(mcpServers ?? {})) {
       const transport = asRecord(asRecord(server)?.transport);

package/src/runtime/routes/mcp-auth-routes.ts

@@ -14,8 +14,7 @@
 
 import { z } from "zod";
 
-import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
-import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
+import type { McpServerConfig } from "../../config/schemas/mcp.js";
 import { estimateToolDefinitionTokens } from "../../context/token-estimator.js";
 import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
 import { McpClient } from "../../mcp/client.js";
@@ -31,6 +30,10 @@ import {
   deleteMcpOAuthCredentials,
   hasMcpOAuthTokens,
 } from "../../mcp/mcp-oauth-provider.js";
+import {
+  loadWorkspaceMcpConfig,
+  saveWorkspaceMcpConfig,
+} from "../../mcp/workspace-mcp-config.js";
 import { readPluginMcpServers } from "../../plugins/mcp-servers.js";
 import { getMcpToolsByServer } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
@@ -65,6 +68,18 @@ const McpAddParams = z.object({
 
 const McpRemoveParams = z.object({ name: z.string() });
 
+function persistWorkspaceMcpConfig(config: {
+  servers: Record<string, McpServerConfig>;
+}): void {
+  try {
+    saveWorkspaceMcpConfig(config);
+  } catch (err) {
+    throw new InternalError(
+      err instanceof Error ? err.message : String(err),
+    );
+  }
+}
+
 async function handleMcpAuthStart({
   body,
 }: {
@@ -76,8 +91,7 @@ async function handleMcpAuthStart({
 }> {
   const { serverId } = parseBody(McpServerIdParams, body);
 
-  const raw = loadRawConfig();
-  const servers = (raw.mcp as Partial<McpConfig> | undefined)?.servers ?? {};
+  const servers = loadWorkspaceMcpConfig().servers;
   const serverConfig = servers[serverId];
 
   if (!serverConfig) {
@@ -253,9 +267,7 @@ function detectAuthType(headers: Record<string, string>): "bearer" | "api-key" {
 async function handleMcpList(_args: {
   body?: Record<string, unknown>;
 }): Promise<{ servers: McpServerEntry[] }> {
-  const raw = loadRawConfig();
-  const mcpConfig = raw.mcp as Partial<McpConfig> | undefined;
-  const servers = mcpConfig?.servers ?? {};
+  const servers = loadWorkspaceMcpConfig().servers;
   const configEntries = (
     Object.entries(servers) as [string, McpServerConfig][]
   ).filter(([, config]) => config && typeof config === "object");
@@ -434,18 +446,13 @@ async function handleMcpUpdate({
 }): Promise<{ updated: true }> {
   const { name, headers } = parseBody(McpUpdateParams, body);
 
-  const raw = loadRawConfig();
-  const mcpConfig = raw.mcp as Record<string, unknown> | undefined;
-  const serverMap = mcpConfig?.servers as
-    | Record<string, Record<string, unknown>>
-    | undefined;
+  const servers = loadWorkspaceMcpConfig().servers;
+  const server = servers[name];
 
-  if (!serverMap || !serverMap[name]) {
+  if (!server) {
     throw new NotFoundError(`MCP server "${name}" not found.`);
   }
 
-  const server = serverMap[name];
-
   if (headers !== undefined) {
     const transport = server.transport as Record<string, unknown> | undefined;
     if (
@@ -474,7 +481,7 @@ async function handleMcpUpdate({
     }
   }
 
-  saveRawConfig(raw);
+  persistWorkspaceMcpConfig({ servers });
   triggerReload("internal_mcp_update");
 
   return { updated: true };
@@ -494,7 +501,7 @@ async function handleMcpAdd({
     body,
   );
 
-  let transport: Record<string, unknown>;
+  let transport: McpServerConfig["transport"];
   switch (transportType) {
     case "stdio":
       if (!command) {
@@ -517,27 +524,16 @@ async function handleMcpAdd({
       );
   }
 
-  const raw = loadRawConfig();
-  if (!raw.mcp) {
-    raw.mcp = { servers: {} };
-  }
-  const mcpConfig = raw.mcp as Record<string, unknown>;
-  if (!mcpConfig.servers) {
-    mcpConfig.servers = {};
-  }
-  const serverMap = mcpConfig.servers as Record<string, unknown>;
+  const servers = { ...loadWorkspaceMcpConfig().servers };
 
-  if (serverMap[name]) {
+  if (servers[name]) {
     throw new BadRequestError(
       `MCP server "${name}" already exists. Remove it first with: assistant mcp remove ${name}`,
     );
   }
 
-  serverMap[name] = {
-    transport,
-  };
+  servers[name] = { transport };
 
-  // Store auth headers in credential store, not config
   if (headers && Object.keys(headers).length > 0) {
     const ok = await setMcpHeaders(name, headers);
     if (!ok) {
@@ -547,7 +543,7 @@ async function handleMcpAdd({
     }
   }
 
-  saveRawConfig(raw);
+  persistWorkspaceMcpConfig({ servers });
   triggerReload("internal_mcp_add");
 
   return { added: true };
@@ -564,8 +560,7 @@ async function handleMcpAuthRevoke({
 }): Promise<{ revoked: true }> {
   const { serverId } = parseBody(McpServerIdParams, body);
 
-  const raw = loadRawConfig();
-  const servers = (raw.mcp as Partial<McpConfig> | undefined)?.servers ?? {};
+  const servers = loadWorkspaceMcpConfig().servers;
   const serverConfig = servers[serverId];
 
   if (!serverConfig) {
@@ -602,32 +597,29 @@ async function handleMcpRemove({
 }): Promise<{ removed: true }> {
   const { name } = parseBody(McpRemoveParams, body);
 
-  const raw = loadRawConfig();
-  const mcpConfig = raw.mcp as Record<string, unknown> | undefined;
-  const serverMap = mcpConfig?.servers as Record<string, unknown> | undefined;
+  const servers = { ...loadWorkspaceMcpConfig().servers };
+  const serverConfig = servers[name];
 
-  if (!serverMap || !serverMap[name]) {
+  if (!serverConfig) {
     throw new NotFoundError(`MCP server "${name}" not found.`);
   }
 
-  // Best-effort cleanup of credentials stored for this server
-  const serverConfig = serverMap[name] as Record<string, unknown>;
-  const transport = serverConfig?.transport as
-    | Record<string, unknown>
-    | undefined;
-  if (transport?.type === "sse" || transport?.type === "streamable-http") {
+  if (
+    serverConfig.transport.type === "sse" ||
+    serverConfig.transport.type === "streamable-http"
+  ) {
     try {
       await Promise.all([
         deleteMcpOAuthCredentials(name),
         deleteMcpHeaders(name),
       ]);
     } catch {
-      // Ignore — credentials may not exist
+      // Credentials may not exist.
     }
   }
 
-  delete serverMap[name];
-  saveRawConfig(raw);
+  delete servers[name];
+  persistWorkspaceMcpConfig({ servers });
   triggerReload("internal_mcp_remove");
 
   return { removed: true };

package/src/runtime/routes/migration-routes.ts

@@ -22,8 +22,8 @@ import { PassThrough, Readable } from "node:stream";
 
 import { z } from "zod";
 
-import { getPlatformAssistantId } from "../../config/env.js";
 import { invalidateConfigCache } from "../../config/loader.js";
+import { resolvePlatformAssistantId } from "../../config/platform-identity.js";
 import { getAssistantName } from "../../daemon/identity-helpers.js";
 import { runAsyncSqlite } from "../../persistence/db-async-query.js";
 import {
@@ -236,28 +236,14 @@ interface ExportManifestInputs {
 /**
  * Resolve the `assistant.id` for an export.
  *
- * Mirrors `platform/client.ts`'s precedence: in-memory override (set at
- * daemon startup or by secret-routes) → credential store → daemon-internal
- * fallback. The schema requires `id` to be non-empty, so we fall back to
+ * In-memory identity (validate rehydration or secret-routes). The schema
+ * requires `id` to be non-empty, so we fall back to
  * `DAEMON_INTERNAL_ASSISTANT_ID` rather than the empty string.
  */
 async function resolveAssistantId(): Promise<string> {
-  const inMemory = getPlatformAssistantId();
-  if (inMemory) {
-    return inMemory;
-  }
-  try {
-    const stored = await getSecureKeyAsync(
-      credentialKey("vellum", "platform_assistant_id"),
-    );
-    if (stored) {
-      return stored;
-    }
-  } catch (err) {
-    log.warn(
-      { err },
-      "Failed to read platform_assistant_id from credential store; falling back to daemon-internal id",
-    );
+  const resolved = await resolvePlatformAssistantId();
+  if (resolved) {
+    return resolved;
   }
   return DAEMON_INTERNAL_ASSISTANT_ID;
 }

package/src/runtime/routes/oauth-commands-routes.ts

@@ -41,9 +41,11 @@ import {
   listConnections,
   type OAuthProviderRow,
 } from "../../oauth/oauth-store.js";
+import { missingScopesForStoredToken } from "../../oauth/scope-utils.js";
 import { VellumPlatformClient } from "../../platform/client.js";
 import { withValidToken } from "../../security/token-manager.js";
 import { matchHostPattern } from "../../tools/credentials/host-pattern-match.js";
+import { parseJsonSafe } from "../../util/json.js";
 import { getLogger } from "../../util/logger.js";
 import {
   findContentTypeHeader,
@@ -64,6 +66,7 @@ interface PlatformConnectionEntry {
   id: string;
   account_label?: string;
   scopes_granted?: string[];
+  provider_params?: Record<string, string> | null;
   status?: string;
 }
 
@@ -230,6 +233,31 @@ function assertOAuthRequestUrlAllowed(
   }
 }
 
+/**
+ * Required scopes the resolved connection's stored grant lacks. Credential
+ * health measures the same thing on the heartbeat; measuring it on the
+ * request names the gap at the moment a call may depend on it, since a
+ * connection made before a scope was required keeps working for every call
+ * that does not need it. A managed connection has no local row and reports
+ * nothing.
+ */
+function missingScopesForConnection(
+  providerRow: OAuthProviderRow,
+  connectionId: string,
+): string[] {
+  const row = getConnection(connectionId);
+  if (!row) {
+    return [];
+  }
+  return missingScopesForStoredToken(
+    parseJsonSafe<string[]>(providerRow.defaultScopes ?? "[]") ?? [],
+    parseJsonSafe<Record<string, string>>(providerRow.authorizeParams ?? "") ??
+      undefined,
+    providerRow.scopeSeparator,
+    parseJsonSafe<string[]>(row.grantedScopes ?? "[]") ?? [],
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Disconnect handler
 // ---------------------------------------------------------------------------
@@ -547,6 +575,9 @@ async function handleStatus({ queryParams = {} }: RouteHandlerArgs) {
       account: c.account_label ?? null,
       grantedScopes: c.scopes_granted ?? [],
       status: c.status ?? "ACTIVE",
+      // Values the provider scopes the connection by (QuickBooks' realm id),
+      // so a caller can address resources the proxy's base URL does not.
+      providerParams: c.provider_params ?? {},
     }));
 
     return {
@@ -1002,6 +1033,15 @@ export async function handleRequest({ body = {} }: RouteHandlerArgs) {
       `(e.g. https://host/full/path) so the host and full path are set explicitly.`;
   }
 
+  const missingScopes = missingScopesForConnection(providerRow, connection.id);
+  if (missingScopes.length > 0) {
+    const scopeHint =
+      `The ${b.provider} connection is missing required scopes: ${missingScopes.join(", ")}. ` +
+      `It was connected before they were required, so calls that need them fail. ` +
+      `Reconnect it from Integrations, or run 'assistant oauth connect ${b.provider}', to grant them.`;
+    result.hint = result.hint ? `${scopeHint}\n\n${result.hint}` : scopeHint;
+  }
+
   return result;
 }
 
@@ -1024,6 +1064,8 @@ async function handleManagedConnect({ body = {} }: RouteHandlerArgs) {
     provider: string;
     scopes?: string[];
     redirect_after_connect?: string;
+    /** Per-tenant providers (Shopify): the customer's own host. */
+    tenant_host?: string;
   };
 
   if (!b.provider) {
@@ -1040,6 +1082,13 @@ async function handleManagedConnect({ body = {} }: RouteHandlerArgs) {
   }
   reqBody.redirect_after_connect =
     b.redirect_after_connect ?? "/account/oauth/complete";
+  // Only forwarded when present: the platform validates it against the
+  // provider's pattern and rejects per-tenant providers that omit it.
+  const tenantHost =
+    typeof b.tenant_host === "string" ? b.tenant_host.trim() : "";
+  if (tenantHost) {
+    reqBody.tenant_host = tenantHost;
+  }
 
   const response = await client.fetch(startPath, {
     method: "POST",
@@ -1086,6 +1135,7 @@ async function handleManagedConnectPoll({
       id: e.id,
       account_label: e.account_label ?? null,
       scopes_granted: e.scopes_granted ?? [],
+      provider_params: e.provider_params ?? {},
     })),
   };
 }

package/src/runtime/routes/oauth-providers.ts

@@ -397,6 +397,13 @@ export const oauthProviderSummarySchema = z.object({
   supports_managed_mode: z.boolean(),
   managed_service_is_paid: z.boolean(),
   feature_flag: z.string().nullable(),
+  tenant_host: z
+    .object({
+      pattern: z.string(),
+      label: z.string(),
+      placeholder: z.string(),
+    })
+    .nullable(),
   acts_as: z.enum(["user", "assistant"]),
 });
 

package/src/runtime/routes/platform-routes.ts

@@ -39,7 +39,17 @@ import {
 } from "@vellumai/service-contracts/platform-credential";
 import { z } from "zod";
 
+import {
+  setPlatformAssistantId,
+  setPlatformBaseUrl,
+  setPlatformOrganizationId,
+  setPlatformUserId,
+} from "../../config/env.js";
 import { isPlatformRemote } from "../../config/env-registry.js";
+import {
+  resolvePlatformOrganizationId,
+  resolvePlatformUserId,
+} from "../../config/platform-identity.js";
 import {
   registerCallbackRoute,
   resolvePlatformCallbackRegistrationContext,
@@ -289,24 +299,12 @@ async function handlePlatformStatus(
 ): Promise<PlatformStatusResponse> {
   const context = await resolvePlatformCallbackRegistrationContext();
 
-  const [orgIdRaw, userIdRaw, webhookSecretRaw] = await Promise.all([
-    getSecureKeyAsync(
-      credentialKey(
-        CREDENTIAL_KEYS.organizationId.service,
-        CREDENTIAL_KEYS.organizationId.field,
-      ),
-    ),
-    getSecureKeyAsync(
-      credentialKey(
-        CREDENTIAL_KEYS.userId.service,
-        CREDENTIAL_KEYS.userId.field,
-      ),
-    ),
+  const [organizationId, userId, webhookSecretRaw] = await Promise.all([
+    resolvePlatformOrganizationId(),
+    resolvePlatformUserId(),
     getSecureKeyAsync(credentialKey("vellum", "webhook_secret")),
   ]);
 
-  const organizationId = orgIdRaw?.trim() ?? "";
-  const userId = userIdRaw?.trim() ?? "";
   const hasWebhookSecret = !!webhookSecretRaw;
 
   return {
@@ -467,6 +465,11 @@ async function handlePlatformDisconnect(
     );
   }
 
+  setPlatformBaseUrl(undefined);
+  setPlatformAssistantId(undefined);
+  setPlatformOrganizationId(undefined);
+  setPlatformUserId(undefined);
+
   // Notify connected clients
   broadcastMessage({ type: "platform_disconnected" });
 

package/src/runtime/routes/workspace-routes.test.ts

@@ -211,8 +211,8 @@ describe("isTextMimeType", () => {
 describe("GET /v1/workspace/tree", () => {
   const { handler } = getRoute("workspace_tree");
 
-  test("root listing returns entries", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("root listing returns entries", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       path: string;
       entries: Array<{ name: string; type: string }>;
     };
@@ -222,8 +222,8 @@ describe("GET /v1/workspace/tree", () => {
     expect(names).toContain("subdir");
   });
 
-  test("subdirectory listing returns child entries", () => {
-    const result = handler({ queryParams: { path: "subdir" } }) as {
+  test("subdirectory listing returns child entries", async () => {
+    const result = (await handler({ queryParams: { path: "subdir" } })) as {
       path: string;
       entries: Array<{ name: string; type: string }>;
     };
@@ -232,20 +232,20 @@ describe("GET /v1/workspace/tree", () => {
     expect(result.entries[0].type).toBe("file");
   });
 
-  test("non-existent directory throws NotFoundError", () => {
-    expect(() => handler({ queryParams: { path: "nope" } })).toThrow(
+  test("non-existent directory throws NotFoundError", async () => {
+    await expect(handler({ queryParams: { path: "nope" } })).rejects.toThrow(
       NotFoundError,
     );
   });
 
-  test("path traversal attempt throws BadRequestError", () => {
-    expect(() => handler({ queryParams: { path: "../../etc" } })).toThrow(
-      BadRequestError,
-    );
+  test("path traversal attempt throws BadRequestError", async () => {
+    await expect(
+      handler({ queryParams: { path: "../../etc" } }),
+    ).rejects.toThrow(BadRequestError);
   });
 
-  test("entries have correct type field", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("entries have correct type field", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       entries: Array<{ name: string; type: "file" | "directory" }>;
     };
     const subdirEntry = result.entries.find((e) => e.name === "subdir");
@@ -254,8 +254,8 @@ describe("GET /v1/workspace/tree", () => {
     expect(fileEntry?.type).toBe("file");
   });
 
-  test("dotfiles and dot-directories are excluded", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("dotfiles and dot-directories are excluded", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       entries: Array<{ name: string }>;
     };
     const names = result.entries.map((e) => e.name);
@@ -263,8 +263,8 @@ describe("GET /v1/workspace/tree", () => {
     expect(names).not.toContain(".hidden");
   });
 
-  test("directory entries have null size and mimeType", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("directory entries have null size and mimeType", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       entries: Array<{
         name: string;
         type: string;
@@ -278,8 +278,8 @@ describe("GET /v1/workspace/tree", () => {
     expect(dirEntry!.mimeType).toBeNull();
   });
 
-  test("directories sorted before files", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("directories sorted before files", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       entries: Array<{ type: string }>;
     };
     const firstFileIdx = result.entries.findIndex((e) => e.type === "file");
@@ -295,8 +295,10 @@ describe("GET /v1/workspace/tree", () => {
     }
   });
 
-  test("includeDirSizes=true returns recursive byte size for directories", () => {
-    const result = handler({ queryParams: { includeDirSizes: "true" } }) as {
+  test("includeDirSizes=true returns recursive byte size for directories", async () => {
+    const result = (await handler({
+      queryParams: { includeDirSizes: "true" },
+    })) as {
       entries: Array<{ name: string; type: string; size: number | null }>;
     };
     const subdirEntry = result.entries.find((e) => e.name === "subdir");
@@ -307,8 +309,10 @@ describe("GET /v1/workspace/tree", () => {
     expect(subdirEntry!.size).toBe("nested content".length);
   });
 
-  test("includeDirSizes=true preserves accurate file sizes", () => {
-    const result = handler({ queryParams: { includeDirSizes: "true" } }) as {
+  test("includeDirSizes=true preserves accurate file sizes", async () => {
+    const result = (await handler({
+      queryParams: { includeDirSizes: "true" },
+    })) as {
       entries: Array<{ name: string; type: string; size: number | null }>;
     };
     const fileEntry = result.entries.find((e) => e.name === "hello.txt");
@@ -316,8 +320,8 @@ describe("GET /v1/workspace/tree", () => {
     expect(fileEntry!.size).toBe("Hello, world!".length);
   });
 
-  test("includeDirSizes omitted preserves null size for directories", () => {
-    const result = handler({ queryParams: {} }) as {
+  test("includeDirSizes omitted preserves null size for directories", async () => {
+    const result = (await handler({ queryParams: {} })) as {
       entries: Array<{ type: string; size: number | null }>;
     };
     const dirEntry = result.entries.find((e) => e.type === "directory");
@@ -325,11 +329,36 @@ describe("GET /v1/workspace/tree", () => {
     expect(dirEntry!.size).toBeNull();
   });
 
-  test("includeDirSizes=true returns 0 for empty directory", () => {
+  test("recursive=true lists nested entries and the bound fields", async () => {
+    const result = (await handler({ queryParams: { recursive: "true" } })) as {
+      entries: Array<{ path: string }>;
+      truncated: boolean;
+      skipped: string[];
+    };
+    expect(result.entries.map((e) => e.path)).toContain("subdir/nested.txt");
+    expect(result.truncated).toBe(false);
+    expect(Array.isArray(result.skipped)).toBe(true);
+  });
+
+  test("a non-recursive listing carries the same fields, unset", async () => {
+    const result = (await handler({ queryParams: {} })) as {
+      entries: Array<{ path: string }>;
+      truncated: boolean;
+      skipped: string[];
+    };
+    expect(result.entries.map((e) => e.path)).not.toContain(
+      "subdir/nested.txt",
+    );
+    expect(result).toMatchObject({ truncated: false, skipped: [] });
+  });
+
+  test("includeDirSizes=true returns 0 for empty directory", async () => {
     const emptyDir = join(testWorkspaceDir, "empty-for-size");
     mkdirSync(emptyDir, { recursive: true });
 
-    const result = handler({ queryParams: { includeDirSizes: "true" } }) as {
+    const result = (await handler({
+      queryParams: { includeDirSizes: "true" },
+    })) as {
       entries: Array<{ name: string; size: number | null }>;
     };
     const emptyEntry = result.entries.find((e) => e.name === "empty-for-size");