@vellumai/assistant 0.12.6 → 0.12.7-staging.1

package/src/runtime/channel-reply-delivery.ts

@@ -3,6 +3,7 @@ import type { MessageAudience } from "@vellumai/gateway-client";
 import { stripVellumLinks } from "../daemon/assistant-attachments.js";
 import type { RenderedHistoryContent } from "../daemon/handlers/shared.js";
 import { renderHistoryContent } from "../daemon/handlers/shared.js";
+import { DEFAULT_LOCALE } from "../i18n/index.js";
 import { editChannelMessage } from "../messaging/providers/index.js";
 import { getAttachmentMetadataForMessage } from "../persistence/attachments-store.js";
 import {
@@ -344,6 +345,7 @@ function readPersistedAssistantReply(msg: PersistedMessage): {
     undefined,
     undefined,
     msg.metadata,
+    DEFAULT_LOCALE,
   );
 
   const linked = getAttachmentMetadataForMessage(msg.id);

package/src/runtime/http-router.ts

@@ -10,7 +10,10 @@
  * `normalizeEndpointForPolicy`.
  */
 
-import { enforcePolicy } from "./auth/route-policy.js";
+import { tokenMayReachRoute } from "@vellumai/gateway-client";
+
+import { getLogger } from "../util/logger.js";
+import { enforcePolicy, type RoutePolicy } from "./auth/route-policy.js";
 import type { AuthContext } from "./auth/types.js";
 import { httpError } from "./http-errors.js";
 import type { HTTPRouteDefinition, RouteParams } from "./http-router-types.js";
@@ -18,6 +21,9 @@ import { withErrorHandling } from "./middleware/error-handler.js";
 import { routeDefinitionsToHTTPRoutes } from "./routes/http-adapter.js";
 import { ROUTES } from "./routes/index.js";
 import type { RouteLoggingConfig } from "./routes/types.js";
+import { resolveSharedPrincipalFresh } from "./shared-principal-lookup.js";
+
+const log = getLogger("http-router");
 
 // ---------------------------------------------------------------------------
 // Compiled route — internal representation with pre-built regex
@@ -106,6 +112,15 @@ export class HttpRouter {
         continue;
       }
 
+      const trustDenied = await enforceTrustClass(
+        compiled.def.endpoint,
+        compiled.def.policy,
+        authContext,
+      );
+      if (trustDenied) {
+        return trustDenied;
+      }
+
       // Extract named params
       const params: RouteParams = {};
       for (let i = 0; i < compiled.paramNames.length; i++) {
@@ -143,6 +158,51 @@ export class HttpRouter {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Trust class
+// ---------------------------------------------------------------------------
+
+/**
+ * Refuses a caller on a route that does not admit its trust class, with the
+ * same 404 an unmatched path gets so it cannot probe which routes exist. It
+ * runs ahead of path decoding and the scope check so neither can answer 400 or
+ * 403 first, and under the dev auth bypass too, because a trust-checked
+ * context exists only when its bearer was verified.
+ *
+ * A trust-exempt profile (see {@link isTrustCheckedScopeProfile}) counts as
+ * the guardian with no lookup, so guardian, service and local callers never
+ * wait on the gateway here. A trust-checked one is read fresh, matching the
+ * gateway's per-request ACL read on the IPC path, so a revoked contact is
+ * refused on its next request.
+ */
+async function enforceTrustClass(
+  endpoint: string,
+  policy: RoutePolicy | null,
+  authContext: AuthContext,
+): Promise<Response | null> {
+  const principalId = authContext.actorPrincipalId;
+  const admitted = await tokenMayReachRoute(
+    authContext.scopeProfile,
+    policy?.allowedTrustClasses,
+    async () =>
+      principalId
+        ? (await resolveSharedPrincipalFresh(principalId)).trustClass
+        : undefined,
+  );
+  if (admitted) {
+    return null;
+  }
+  log.warn(
+    {
+      endpoint,
+      scopeProfile: authContext.scopeProfile,
+      actorPrincipalId: principalId,
+    },
+    "Route policy denied: trust class not admitted",
+  );
+  return httpError("NOT_FOUND", "Not found", 404);
+}
+
 // ---------------------------------------------------------------------------
 // Compilation helpers
 // ---------------------------------------------------------------------------

package/src/runtime/http-types.ts

@@ -12,6 +12,7 @@ import type {
   ConversationCreateOptions,
   SlackInboundMessageMetadata,
 } from "../daemon/handlers/shared.js";
+import type { SupportedLocale } from "../i18n/index.js";
 
 // Re-export so route modules (background-dispatch, etc.) can pull the type
 // from the runtime barrel without reaching into daemon internals.
@@ -110,6 +111,8 @@ export interface RuntimeMessageConversationOptions {
   sourceChannel?: ChannelId;
   /** Originating interface (e.g. "cli", "web"). Defaults to "web". */
   sourceInterface?: InterfaceId;
+  /** Locale for daemon-authored text emitted during this turn. */
+  locale?: SupportedLocale;
 }
 
 export type MessageProcessor = (

package/src/runtime/migrations/__tests__/vbundle-streaming-validator.test.ts

@@ -30,6 +30,7 @@ import {
 import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
+  MANIFEST_MAX_BYTES,
 } from "../vbundle-validator.js";
 import { defaultV1Options } from "./v1-test-helpers.js";
 
@@ -202,15 +203,16 @@ describe("readAndValidateManifest — negative paths", () => {
   });
 
   test("throws manifest_too_large and fails fast before draining the whole body", async () => {
-    // Fake a tar entry whose body would emit 5 MiB if fully drained. The
-    // validator must destroy() the stream and throw the moment the running
-    // byte count crosses the 1 MiB cap — it must NOT keep pulling chunks.
+    // Fake a tar entry whose body would emit 10x the cap if fully drained.
+    // The validator must destroy() the stream and throw the moment the
+    // running byte count crosses MANIFEST_MAX_BYTES; it must NOT keep
+    // pulling chunks.
     //
     // We count bytes emitted via a _read implementation, and after the
-    // throw assert both that destroy() fired and that far fewer than 5 MiB
-    // were ever pulled out of the stream.
-    const CHUNK = 512 * 1024; // 512 KiB
-    const TOTAL_CHUNKS = 10; // 5 MiB worth — way past the 1 MiB cap
+    // throw assert both that destroy() fired and that far less than the
+    // full body was ever pulled out of the stream.
+    const CHUNK = MANIFEST_MAX_BYTES / 2;
+    const TOTAL_CHUNKS = 20;
     let chunksEmitted = 0;
     let bytesEmitted = 0;
     const body = new Readable({
@@ -245,11 +247,34 @@ describe("readAndValidateManifest — negative paths", () => {
     expect(err).toBeInstanceOf(StreamingValidationError);
     expect(err?.code).toBe("manifest_too_large");
     // Fail-fast assertions: destroy() was called, and we didn't drain past
-    // ~1 MiB + one chunk. If the validator had drained to EOF we'd see the
-    // full 5 MiB / 10 chunks here.
+    // the cap + one chunk. If the validator had drained to EOF we'd see all
+    // 20 chunks here.
     expect(body.destroyed).toBe(true);
     expect(chunksEmitted).toBeLessThanOrEqual(3);
-    expect(bytesEmitted).toBeLessThan(2 * 1024 * 1024);
+    expect(bytesEmitted).toBeLessThan(2 * MANIFEST_MAX_BYTES);
+  });
+
+  test("throws bundle_too_many_entries when manifest.contents exceeds maxEntries", async () => {
+    const { archive } = buildVBundle({
+      files: [
+        { path: "data/db/assistant.db", data: new Uint8Array() },
+        { path: "workspace/a.txt", data: new TextEncoder().encode("a") },
+        { path: "workspace/b.txt", data: new TextEncoder().encode("b") },
+      ],
+      ...defaultV1Options(),
+    });
+    const { entry, drainRest } = await firstEntryOf(archive);
+
+    let err: StreamingValidationError | null = null;
+    try {
+      await readAndValidateManifest(entry, { maxEntries: 2 });
+    } catch (e) {
+      err = e as StreamingValidationError;
+    }
+    await drainRest();
+
+    expect(err).toBeInstanceOf(StreamingValidationError);
+    expect(err?.code).toBe("bundle_too_many_entries");
   });
 
   test("throws manifest_malformed when manifest body is not valid JSON", async () => {

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -19,6 +19,8 @@ import {
   canonicalizeJson,
   computeLegacyManifestSha256,
   computeManifestChecksum,
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   validateVBundle,
 } from "../vbundle-validator.js";
@@ -174,6 +176,52 @@ describe("ManifestSchema — v1 acceptance", () => {
   });
 });
 
+describe("validateVBundle: streaming manifest limits", () => {
+  test("rejects a manifest over MANIFEST_MAX_BYTES with MANIFEST_TOO_LARGE", () => {
+    const oversized = new Uint8Array(MANIFEST_MAX_BYTES + 1).fill(0x20);
+    const archive = gzipSync(
+      tarArchive([{ name: "manifest.json", data: oversized }]),
+    );
+    const result = validateVBundle(archive, { enforceStreamingLimits: true });
+    expect(result.is_valid).toBe(false);
+    expect(result.errors.map((e) => e.code)).toEqual(["MANIFEST_TOO_LARGE"]);
+  });
+
+  test("rejects a manifest declaring more than MANIFEST_MAX_ENTRIES with MANIFEST_TOO_MANY_ENTRIES", () => {
+    const skeleton = v1Skeleton();
+    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
+    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
+      ...dbEntry,
+      path: `workspace/${i}`,
+    }));
+    const archive = gzipTarOf(
+      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
+    );
+    const result = validateVBundle(archive, { enforceStreamingLimits: true });
+    expect(result.is_valid).toBe(false);
+    expect(result.errors.map((e) => e.code)).toEqual([
+      "MANIFEST_TOO_MANY_ENTRIES",
+    ]);
+  });
+
+  test("does not apply the limits unless enforceStreamingLimits is set", () => {
+    const skeleton = v1Skeleton();
+    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
+    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
+      ...dbEntry,
+      path: `workspace/${i}`,
+    }));
+    const archive = gzipTarOf(
+      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
+      [{ name: "data/db/assistant.db", data: DB_BYTES }],
+    );
+    const result = validateVBundle(archive);
+    expect(result.errors.map((e) => e.code)).not.toContain(
+      "MANIFEST_TOO_MANY_ENTRIES",
+    );
+  });
+});
+
 describe("ManifestSchema — v1 rejection", () => {
   test("rejects schema_version !== 1", () => {
     const manifest = withChecksum({ ...v1Skeleton(), schema_version: 2 });

package/src/runtime/migrations/vbundle-builder.ts

@@ -31,9 +31,11 @@ import { sanitizeConfigForTransfer } from "../../config/sanitize-for-transfer.js
 import { trackDaemonActivity } from "../../daemon/activity-trail.js";
 import { getLogger } from "../../util/logger.js";
 import type { VBundleOriginMode } from "./origin-mode.js";
-import type {
-  ManifestFileEntryType,
-  ManifestType,
+import {
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
+  type ManifestFileEntryType,
+  type ManifestType,
 } from "./vbundle-validator.js";
 
 // ---------------------------------------------------------------------------
@@ -400,6 +402,20 @@ function buildManifestObject(input: {
   const checksum = sha256Hex(canonicalizeJson(manifestWithEmptyChecksum));
   const manifest: ManifestType = { ...manifestWithEmptyChecksum, checksum };
   const manifestData = new TextEncoder().encode(JSON.stringify(manifest));
+  if (
+    manifest.contents.length > MANIFEST_MAX_ENTRIES ||
+    manifestData.length > MANIFEST_MAX_BYTES
+  ) {
+    getLogger("vbundle-builder").warn(
+      {
+        entries: manifest.contents.length,
+        manifestBytes: manifestData.length,
+        maxEntries: MANIFEST_MAX_ENTRIES,
+        maxBytes: MANIFEST_MAX_BYTES,
+      },
+      "Bundle manifest exceeds the streaming import limits; teleport and staged-path imports will reject this bundle",
+    );
+  }
   return { manifest, manifestData };
 }
 

package/src/runtime/migrations/vbundle-streaming-importer.ts

@@ -69,7 +69,10 @@ import {
   verifySymlinkEntry,
 } from "./vbundle-streaming-validator.js";
 import { parseVBundleStream } from "./vbundle-tar-stream.js";
-import type { ManifestType } from "./vbundle-validator.js";
+import {
+  MANIFEST_MAX_ENTRIES,
+  type ManifestType,
+} from "./vbundle-validator.js";
 
 const log = getLogger("vbundle-streaming-importer");
 
@@ -91,11 +94,11 @@ const log = getLogger("vbundle-streaming-importer");
 const DEFAULT_MAX_BUNDLE_BYTES = 16 * 1024 * 1024 * 1024;
 
 /**
- * Entry-count ceiling for the bundle. 100k is well above the largest
- * workspace we ship; anything past that is almost certainly an attack or
- * a corrupted archive.
+ * Entry-count ceiling for the bundle, shared with manifest validation so
+ * preflight and import agree. Also applied to tar-level entries so padding
+ * extras cannot exceed what the manifest declared.
  */
-const DEFAULT_MAX_BUNDLE_ENTRIES = 100_000;
+const DEFAULT_MAX_BUNDLE_ENTRIES = MANIFEST_MAX_ENTRIES;
 
 /**
  * Prefixes used for scratch dirs the streaming importer creates INSIDE the
@@ -153,7 +156,7 @@ export interface StreamCommitArgs {
   maxBundleBytes?: number;
   /**
    * Test-only override for the entry-count ceiling. Production callers
-   * should omit this and rely on the 100_000 default.
+   * should omit this and rely on the `MANIFEST_MAX_ENTRIES` default.
    */
   maxBundleEntries?: number;
 }
@@ -313,7 +316,9 @@ export async function streamCommitImport(
       if (entryIndex === 0) {
         // First entry MUST be manifest.json — readAndValidateManifest
         // enforces that and throws StreamingValidationError otherwise.
-        const manifestResult = await readAndValidateManifest(entry);
+        const manifestResult = await readAndValidateManifest(entry, {
+          maxEntries: bundleEntryCap,
+        });
         manifest = manifestResult.manifest;
         expected = manifestResult.expected;
 
@@ -340,18 +345,8 @@ export async function streamCommitImport(
           );
         }
 
-        // Entry-count ceiling check. The manifest declares every file the
-        // bundle claims to contain, so one check here bounds the work the
-        // importer is willing to do for this bundle.
-        if (manifest.contents.length > bundleEntryCap) {
-          throw new StreamingValidationError(
-            "bundle_too_many_entries",
-            `bundle contains more than ${bundleEntryCap} entries (declared: ${manifest.contents.length})`,
-          );
-        }
-
-        // Only NOW — after the manifest is parsed, the version gate passes,
-        // and the entry-count ceiling is enforced — do we materialize the
+        // Only NOW, after the manifest is parsed (including its entry-count
+        // ceiling) and the version gate passes, do we materialize the
         // temp staging dir on disk. Doing this lazily preserves the plan
         // invariant that importers gate on runtime-version compat BEFORE
         // any state mutation. If this throws, the outer catch runs

package/src/runtime/migrations/vbundle-streaming-validator.ts

@@ -28,6 +28,8 @@ import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
   LegacyManifestSchema,
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   type ManifestType,
   translateLegacyManifest,
@@ -74,21 +76,17 @@ export class StreamingValidationError extends Error {
 // Manifest validation
 // ---------------------------------------------------------------------------
 
-// Manifests are metadata only — typically tens to hundreds of KB even for
-// huge bundles. A 1 MiB cap is comfortably above realistic sizes and
-// protects against a malicious archive whose "manifest" is actually a
-// multi-GB stream intended to OOM the validator.
-const MANIFEST_MAX_BYTES = 1 * 1024 * 1024;
-
 /**
  * Drain the first tar entry — which MUST be `manifest.json` — and run the
  * full manifest-level validation pipeline:
  *   1. Entry name check.
- *   2. Size cap (1 MiB).
+ *   2. Size cap (`MANIFEST_MAX_BYTES`).
  *   3. JSON parse.
  *   4. Zod schema validation.
  *   5. Self-referencing `checksum` verification against the
  *      canonicalized JSON (minus that field).
+ *   6. Entry-count ceiling on `contents` (`maxEntries`, default
+ *      `MANIFEST_MAX_ENTRIES`).
  *
  * On success, returns the parsed manifest plus a `Map` keyed by archive
  * path that callers consult as each subsequent entry streams past.
@@ -98,7 +96,9 @@ const MANIFEST_MAX_BYTES = 1 * 1024 * 1024;
  */
 export async function readAndValidateManifest(
   first: StreamedTarEntry,
+  options: { maxEntries?: number } = {},
 ): Promise<ManifestReadResult> {
+  const maxEntries = options.maxEntries ?? MANIFEST_MAX_ENTRIES;
   if (first.header.name !== "manifest.json") {
     // Drain the body so the underlying tar extractor isn't left dangling
     // on backpressure before the caller reports the error.
@@ -186,6 +186,13 @@ export async function readAndValidateManifest(
     manifest = translateLegacyManifest(legacy);
   }
 
+  if (manifest.contents.length > maxEntries) {
+    throw new StreamingValidationError(
+      "bundle_too_many_entries",
+      `bundle contains more than ${maxEntries} entries (declared: ${manifest.contents.length})`,
+    );
+  }
+
   const expected = new Map<
     string,
     { sha256: string; size: number; linkTarget: string | null }

package/src/runtime/migrations/vbundle-validator.ts

@@ -381,6 +381,33 @@ export function computeManifestChecksum(manifest: unknown): string {
 // Core validation
 // ---------------------------------------------------------------------------
 
+/**
+ * Hard caps on `manifest.json`, shared by the buffered and streaming
+ * validators so preflight and import agree on what is acceptable. The two
+ * are sized together: the manifest carries one `contents` entry (path,
+ * sha256, size) per bundled file at roughly 150 bytes each, so 200,000
+ * entries serialize to about 32 MiB.
+ *
+ * That absorbs a workspace with a stray dependency install or checked-out
+ * repo while still bounding the transient memory a hostile "manifest" can
+ * force the importer to hold (buffer, decoded string, parsed object,
+ * canonical re-serialization for the self-checksum) and the per-entry work
+ * it commits to, on a memory-constrained pod.
+ */
+export const MANIFEST_MAX_BYTES = 32 * 1024 * 1024;
+export const MANIFEST_MAX_ENTRIES = 200_000;
+
+export interface ValidateVBundleOptions {
+  /**
+   * Reject manifests over `MANIFEST_MAX_BYTES` or `MANIFEST_MAX_ENTRIES`.
+   * Preflights that precede a streaming import set this so they never
+   * approve a bundle the import will refuse. The buffered import path
+   * (`commitImport`) has no such ceilings, so it stays off there to keep
+   * existing large backups restorable.
+   */
+  enforceStreamingLimits?: boolean;
+}
+
 // Only manifest.json is structurally required. The DB and config live under
 // workspace/ (new format) or data/db/ + config/ (old format) — both are valid.
 const REQUIRED_ENTRIES = ["manifest.json"];
@@ -397,7 +424,10 @@ const MAX_DECOMPRESSED_SIZE = 2 * 1024 * 1024 * 1024;
  * 3. Manifest checksum (SHA-256 of canonicalized JSON with the `checksum` field set to empty string)
  * 4. Per-file content integrity (SHA-256 of each file vs manifest declaration)
  */
-export function validateVBundle(data: Uint8Array): VBundleValidationResult {
+export function validateVBundle(
+  data: Uint8Array,
+  { enforceStreamingLimits = false }: ValidateVBundleOptions = {},
+): VBundleValidationResult {
   const errors: ValidationError[] = [];
 
   // Step 1: Decompress gzip with size cap to prevent zip-bomb DoS
@@ -455,6 +485,17 @@ export function validateVBundle(data: Uint8Array): VBundleValidationResult {
   }
 
   // Step 4: Parse and validate manifest schema
+  if (
+    enforceStreamingLimits &&
+    manifestEntry.data.length > MANIFEST_MAX_BYTES
+  ) {
+    errors.push({
+      code: "MANIFEST_TOO_LARGE",
+      message: `manifest.json exceeds ${MANIFEST_MAX_BYTES} byte limit (${manifestEntry.data.length} bytes)`,
+      path: "manifest.json",
+    });
+    return { is_valid: false, errors };
+  }
   let manifestRaw: unknown;
   try {
     manifestRaw = JSON.parse(new TextDecoder().decode(manifestEntry.data));
@@ -523,6 +564,18 @@ export function validateVBundle(data: Uint8Array): VBundleValidationResult {
     manifest = translateLegacyManifest(legacy);
   }
 
+  if (
+    enforceStreamingLimits &&
+    manifest.contents.length > MANIFEST_MAX_ENTRIES
+  ) {
+    errors.push({
+      code: "MANIFEST_TOO_MANY_ENTRIES",
+      message: `manifest.json declares more than ${MANIFEST_MAX_ENTRIES} entries (${manifest.contents.length})`,
+      path: "manifest.json",
+    });
+    return { is_valid: false, errors };
+  }
+
   // Step 6: Verify per-file content integrity
   const manifestFilePaths = new Set(manifest.contents.map((f) => f.path));
 

package/src/runtime/routes/composer-settings-routes.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, expect, mock, test } from "bun:test";
+
+import { ComposerPreferencesSchema } from "../../config/composer-preferences.js";
+
+const preferences = new Map<
+  string,
+  ReturnType<typeof ComposerPreferencesSchema.parse>
+>();
+const resolvePrincipal = mock(async (id?: string) => id);
+const publish = mock(async (_tags: string[], _origin?: string) => {});
+mock.module("../local-actor-identity.js", () => ({
+  resolveActorPrincipalIdForLocalGuardian: resolvePrincipal,
+}));
+mock.module("../sync/sync-publisher.js", () => ({
+  publishSyncInvalidation: publish,
+}));
+mock.module("../../config/composer-preferences.js", () => ({
+  readComposerPreferences: (id: string) =>
+    preferences.get(id) ?? ComposerPreferencesSchema.parse({}),
+  updateComposerPreferences: (id: string, patch: object) => {
+    const value = ComposerPreferencesSchema.parse({
+      ...preferences.get(id),
+      ...patch,
+    });
+    preferences.set(id, value);
+    return value;
+  },
+}));
+const { ROUTES } = await import("./composer-settings-routes.js");
+const get = ROUTES.find((route) => route.method === "GET")!;
+const patch = ROUTES.find((route) => route.method === "PATCH")!;
+beforeEach(() => {
+  preferences.clear();
+  resolvePrincipal.mockClear();
+  publish.mockClear();
+});
+afterEach(() => {
+  mock.restore();
+});
+test("uses the caller identity and emits value-free invalidation after saving", async () => {
+  await patch.handler({
+    headers: {
+      "x-vellum-actor-principal-id": "user-1",
+      "x-vellum-client-id": "client-1",
+    },
+    body: { lastAutonomy: "low" },
+  });
+  expect(preferences.get("user-1")?.lastAutonomy).toBe("low");
+  expect(publish).toHaveBeenCalledWith(
+    ["assistant:self:composerPreferences"],
+    "client-1",
+  );
+  const result = await get.handler({
+    headers: { "x-vellum-actor-principal-id": "user-2" },
+  });
+  expect(result).toMatchObject({ preferences: { lastAutonomy: null } });
+});
+test("refuses preferences with no resolved identity", async () => {
+  await expect(get.handler({})).rejects.toThrow("signed-in user");
+  expect(publish).not.toHaveBeenCalled();
+});
+test("the body cannot select another user's preferences", async () => {
+  await expect(
+    patch.handler({
+      headers: { "x-vellum-actor-principal-id": "user-1" },
+      body: { principalId: "user-2", lastModeId: "balanced" },
+    }),
+  ).rejects.toThrow();
+  expect(preferences.size).toBe(0);
+  expect(publish).not.toHaveBeenCalled();
+});

package/src/runtime/routes/composer-settings-routes.ts

@@ -0,0 +1,76 @@
+import { z } from "zod";
+
+import {
+  ComposerPreferencesPatchSchema,
+  ComposerPreferencesSchema,
+  readComposerPreferences,
+  updateComposerPreferences,
+} from "../../config/composer-preferences.js";
+import { SYNC_TAGS } from "../../daemon/message-types/sync.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
+import { publishSyncInvalidation } from "../sync/sync-publisher.js";
+import { BadRequestError, UnauthorizedError } from "./errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+const ResponseSchema = z.object({
+  preferences: ComposerPreferencesSchema,
+});
+
+async function principalFor(args: RouteHandlerArgs): Promise<string> {
+  const id = await resolveActorPrincipalIdForLocalGuardian(
+    args.headers?.["x-vellum-actor-principal-id"]?.trim() || undefined,
+  );
+  if (!id) {
+    throw new UnauthorizedError(
+      "A signed-in user is required for composer preferences",
+    );
+  }
+  return id;
+}
+
+function responseFor(principalId: string) {
+  return { preferences: readComposerPreferences(principalId) };
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "composer_settings_get",
+    endpoint: "composer/settings",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Get the current user's composer preferences",
+    tags: ["settings"],
+    responseBody: ResponseSchema,
+    handler: async (args) => responseFor(await principalFor(args)),
+  },
+  {
+    operationId: "composer_settings_patch",
+    endpoint: "composer/settings",
+    method: "PATCH",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Update the current user's composer preferences",
+    tags: ["settings"],
+    requestBody: ComposerPreferencesPatchSchema,
+    responseBody: ResponseSchema,
+    handler: async (args) => {
+      const patch = ComposerPreferencesPatchSchema.safeParse(args.body);
+      if (!patch.success) {
+        throw new BadRequestError(patch.error.message);
+      }
+      const principalId = await principalFor(args);
+      updateComposerPreferences(principalId, patch.data);
+      await publishSyncInvalidation(
+        [SYNC_TAGS.assistantComposerPreferences],
+        args.headers?.["x-vellum-client-id"],
+      );
+      return responseFor(principalId);
+    },
+  },
+];