@vellumai/assistant 0.4.43 → 0.4.45

package/src/runtime/routes/global-search-routes.ts

@@ -49,7 +49,7 @@ interface GlobalSearchMemory {
 interface GlobalSearchSchedule {
   id: string;
   name: string;
-  expression: string;
+  expression: string | null;
   message: string;
   enabled: boolean;
   nextRunAt: number | null;

package/src/runtime/routes/host-bash-routes.ts

@@ -0,0 +1,83 @@
+/**
+ * Route handler for host bash result submissions.
+ *
+ * Resolves pending host bash proxy requests by requestId when the desktop
+ * client returns execution results via HTTP.
+ */
+import { requireBoundGuardian } from "../auth/require-bound-guardian.js";
+import type { AuthContext } from "../auth/types.js";
+import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
+import * as pendingInteractions from "../pending-interactions.js";
+
+/**
+ * POST /v1/host-bash-result — resolve a pending host bash request by requestId.
+ * Requires AuthContext with guardian-bound actor.
+ */
+export async function handleHostBashResult(
+  req: Request,
+  authContext: AuthContext,
+): Promise<Response> {
+  const authError = requireBoundGuardian(authContext);
+  if (authError) return authError;
+
+  const body = (await req.json()) as {
+    requestId?: string;
+    stdout?: string;
+    stderr?: string;
+    exitCode?: number | null;
+    timedOut?: boolean;
+  };
+
+  const { requestId, stdout, stderr, exitCode, timedOut } = body;
+
+  if (!requestId || typeof requestId !== "string") {
+    return httpError("BAD_REQUEST", "requestId is required", 400);
+  }
+
+  // Peek first (non-destructive) so we can validate the interaction kind
+  // without accidentally consuming a confirmation or secret interaction.
+  const peeked = pendingInteractions.get(requestId);
+  if (!peeked) {
+    return httpError(
+      "NOT_FOUND",
+      "No pending interaction found for this requestId",
+      404,
+    );
+  }
+
+  if (peeked.kind !== "host_bash") {
+    return httpError(
+      "CONFLICT",
+      `Pending interaction is of kind "${peeked.kind}", expected "host_bash"`,
+      409,
+    );
+  }
+
+  // Validation passed — consume the pending interaction.
+  const interaction = pendingInteractions.resolve(requestId)!;
+
+  interaction.session.resolveHostBash(requestId, {
+    stdout: stdout ?? "",
+    stderr: stderr ?? "",
+    exitCode: exitCode ?? null,
+    timedOut: timedOut ?? false,
+  });
+
+  return Response.json({ accepted: true });
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function hostBashRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "host-bash-result",
+      method: "POST",
+      handler: async ({ req, authContext }) =>
+        handleHostBashResult(req, authContext),
+    },
+  ];
+}

package/src/runtime/routes/host-file-routes.ts

@@ -0,0 +1,79 @@
+/**
+ * Route handler for host file result submissions.
+ *
+ * Resolves pending host file proxy requests by requestId when the desktop
+ * client returns execution results via HTTP.
+ */
+import { requireBoundGuardian } from "../auth/require-bound-guardian.js";
+import type { AuthContext } from "../auth/types.js";
+import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
+import * as pendingInteractions from "../pending-interactions.js";
+
+/**
+ * POST /v1/host-file-result — resolve a pending host file request by requestId.
+ * Requires AuthContext with guardian-bound actor.
+ */
+export async function handleHostFileResult(
+  req: Request,
+  authContext: AuthContext,
+): Promise<Response> {
+  const authError = requireBoundGuardian(authContext);
+  if (authError) return authError;
+
+  const body = (await req.json()) as {
+    requestId?: string;
+    content?: string;
+    isError?: boolean;
+  };
+
+  const { requestId, content, isError } = body;
+
+  if (!requestId || typeof requestId !== "string") {
+    return httpError("BAD_REQUEST", "requestId is required", 400);
+  }
+
+  // Peek first (non-destructive) so we can validate the interaction kind
+  // without accidentally consuming a confirmation or secret interaction.
+  const peeked = pendingInteractions.get(requestId);
+  if (!peeked) {
+    return httpError(
+      "NOT_FOUND",
+      "No pending interaction found for this requestId",
+      404,
+    );
+  }
+
+  if (peeked.kind !== "host_file") {
+    return httpError(
+      "CONFLICT",
+      `Pending interaction is of kind "${peeked.kind}", expected "host_file"`,
+      409,
+    );
+  }
+
+  // Validation passed — consume the pending interaction.
+  const interaction = pendingInteractions.resolve(requestId)!;
+
+  interaction.session.resolveHostFile(requestId, {
+    content: content ?? "",
+    isError: isError ?? false,
+  });
+
+  return Response.json({ accepted: true });
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function hostFileRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "host-file-result",
+      method: "POST",
+      handler: async ({ req, authContext }) =>
+        handleHostFileResult(req, authContext),
+    },
+  ];
+}

package/src/runtime/routes/integrations/slack/share.ts

@@ -2,7 +2,7 @@
  * Route handlers for Slack channel listing and direct sharing.
  *
  * These endpoints let the UI post app links directly to Slack channels
- * without going through the legacy IPC-based Slack share flow.
+ * without going through the legacy Slack share flow.
  */
 
 import { getApp } from "../../../../memory/app-store.js";

package/src/runtime/routes/log-export-routes.ts

@@ -0,0 +1,120 @@
+/**
+ * HTTP route handler for exporting audit data and daemon log files.
+ *
+ * A single POST /v1/export endpoint allows clients (e.g. macOS Export Logs)
+ * to retrieve audit database records and daemon log files via HTTP instead
+ * of requiring direct filesystem access.
+ */
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+import { desc } from "drizzle-orm";
+
+import { getDb } from "../../memory/db.js";
+import { toolInvocations } from "../../memory/schema.js";
+import { getLogger } from "../../util/logger.js";
+import { getDataDir, getRootDir } from "../../util/platform.js";
+import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
+
+const log = getLogger("log-export-routes");
+
+/** Maximum total payload size for log file contents (10 MB). */
+const MAX_LOG_PAYLOAD_BYTES = 10 * 1024 * 1024;
+
+interface ExportRequestBody {
+  auditLimit?: number;
+}
+
+interface ExportResponse {
+  success: true;
+  auditRows: Array<Record<string, unknown>>;
+  logFiles: Record<string, string>;
+}
+
+/**
+ * Collect audit data rows and daemon log file contents into a single
+ * response payload. Returns both `auditRows` (tool invocation records)
+ * and `logFiles` (filename → text content mapping).
+ */
+async function handleExport(body: ExportRequestBody): Promise<Response> {
+  try {
+    // --- Audit data ---
+    const limit = body.auditLimit ?? 1000;
+    const db = getDb();
+    const auditRows = db
+      .select()
+      .from(toolInvocations)
+      .orderBy(desc(toolInvocations.createdAt))
+      .limit(limit)
+      .all();
+
+    // --- Daemon log files ---
+    const logFiles: Record<string, string> = {};
+    let totalBytes = 0;
+
+    const logsDir = join(getDataDir(), "logs");
+    if (existsSync(logsDir)) {
+      const entries = readdirSync(logsDir);
+      for (const entry of entries) {
+        const filePath = join(logsDir, entry);
+        try {
+          const stat = statSync(filePath);
+          if (!stat.isFile()) continue;
+          if (totalBytes + stat.size > MAX_LOG_PAYLOAD_BYTES) continue;
+          logFiles[entry] = readFileSync(filePath, "utf-8");
+          totalBytes += stat.size;
+        } catch {
+          // Skip unreadable files
+        }
+      }
+    }
+
+    const stderrPath = join(getRootDir(), "daemon-stderr.log");
+    if (existsSync(stderrPath)) {
+      try {
+        const stat = statSync(stderrPath);
+        if (totalBytes + stat.size <= MAX_LOG_PAYLOAD_BYTES) {
+          logFiles["daemon-stderr.log"] = readFileSync(stderrPath, "utf-8");
+        }
+      } catch {
+        // Skip if unreadable
+      }
+    }
+
+    log.info(
+      { auditCount: auditRows.length, logFileCount: Object.keys(logFiles).length, totalBytes },
+      "Export completed",
+    );
+
+    const payload: ExportResponse = { success: true, auditRows, logFiles };
+    return Response.json(payload);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err }, "Failed to export");
+    return httpError(
+      "INTERNAL_ERROR",
+      `Failed to export: ${message}`,
+      500,
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function logExportRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "export",
+      method: "POST",
+      policyKey: "export",
+      handler: async ({ req }) => {
+        const body = (await req.json()) as ExportRequestBody;
+        return handleExport(body);
+      },
+    },
+  ];
+}

package/src/runtime/routes/mcp-routes.ts

@@ -0,0 +1,20 @@
+/**
+ * HTTP routes for MCP server management.
+ */
+
+import { reloadMcpServers } from "../../daemon/mcp-reload-service.js";
+import type { RouteDefinition } from "../http-router.js";
+
+export function mcpRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "mcp/reload",
+      method: "POST",
+      handler: async () => {
+        const result = await reloadMcpServers();
+        const status = result.success ? 200 : 500;
+        return Response.json(result, { status });
+      },
+    },
+  ];
+}

package/src/runtime/routes/migration-routes.ts

@@ -115,7 +115,7 @@ export async function handleMigrationValidate(req: Request): Promise<Response> {
  *        with Content-Disposition header for download.
  *   500: Standard error envelope for unexpected failures.
  *
- * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, ipc.
+ * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, svc_daemon, local.
  */
 export async function handleMigrationExport(req: Request): Promise<Response> {
   let description: string | undefined;
@@ -254,7 +254,7 @@ async function extractFileData(
  *   400: Standard error envelope for missing/empty body
  *   500: Standard error envelope for unexpected failures
  *
- * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, ipc.
+ * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, svc_daemon, local.
  */
 export async function handleMigrationImportPreflight(
   req: Request,
@@ -339,7 +339,7 @@ export async function handleMigrationImportPreflight(
  *   400: Standard error envelope for missing/empty body
  *   500: Standard error envelope for unexpected failures
  *
- * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, ipc.
+ * Auth: Requires settings.write scope. Allowed for actor, svc_gateway, svc_daemon, local.
  */
 export async function handleMigrationImport(req: Request): Promise<Response> {
   const extracted = await extractFileData(req);

package/src/runtime/routes/pairing-routes.ts

@@ -299,7 +299,7 @@ export async function handlePairingRequest(
     // tokens and creating DB records for unapproved devices).
     pendingDeviceIds.set(pairingRequestId, { deviceId, createdAt: Date.now() });
 
-    // Send IPC to macOS to show approval prompt
+    // Broadcast to macOS to show approval prompt
     if (ctx.pairingBroadcast) {
       ctx.pairingBroadcast({
         type: "pairing_approval_request",

package/src/runtime/routes/recording-routes.ts

@@ -76,9 +76,7 @@ async function handleStartRecording(
 
   if (!recordingId) {
     const isIdle = isRecordingIdle();
-    const reason = isIdle
-      ? "unknown"
-      : "A recording is already active";
+    const reason = isIdle ? "unknown" : "A recording is already active";
     log.warn(
       { conversationId: body.conversationId, isIdle },
       "Recording start failed via HTTP",
@@ -266,7 +264,11 @@ async function handlePostRecordingStatus(
       { err, sessionId: body.sessionId, status: body.status },
       "Recording status handler failed",
     );
-    return httpError("INTERNAL_ERROR", "Recording status processing failed", 500);
+    return httpError(
+      "INTERNAL_ERROR",
+      "Recording status processing failed",
+      500,
+    );
   }
 
   log.info(

package/src/runtime/routes/schedule-routes.ts

@@ -1,11 +1,12 @@
 /**
  * HTTP route handlers for schedule management.
  *
- * Migrated from IPC handler: handlers/config-scheduling.ts
+ * HTTP route handlers for schedule management.
  */
 
 import { bootstrapConversation } from "../../memory/conversation-bootstrap.js";
 import {
+  cancelSchedule,
   completeScheduleRun,
   createScheduleRun,
   deleteSchedule,
@@ -44,6 +45,10 @@ function handleListSchedules(): Response {
         j.syntax === "cron"
           ? describeCronExpression(j.cronExpression)
           : j.expression,
+      mode: j.mode,
+      status: j.status,
+      routingIntent: j.routingIntent,
+      isOneShot: j.cronExpression == null,
     })),
   });
 }
@@ -76,6 +81,20 @@ function handleDeleteSchedule(id: string): Response {
   return handleListSchedules();
 }
 
+function handleCancelSchedule(id: string): Response {
+  try {
+    const cancelled = cancelSchedule(id);
+    if (!cancelled) {
+      return httpError("NOT_FOUND", "Schedule not found or not cancellable", 404);
+    }
+    log.info({ id }, "Schedule cancelled via HTTP");
+  } catch (err) {
+    log.error({ err }, "Failed to cancel schedule");
+    return httpError("INTERNAL_ERROR", "Failed to cancel schedule", 500);
+  }
+  return handleListSchedules();
+}
+
 async function handleRunScheduleNow(
   id: string,
   sendMessageDeps?: SendMessageDeps,
@@ -99,11 +118,12 @@ async function handleRunScheduleNow(
         { taskId, workingDir: process.cwd(), source: "schedule" },
         async (conversationId, message, taskRunId) => {
           if (!sendMessageDeps) {
-            throw new Error("sendMessageDeps not available for schedule execution");
+            throw new Error(
+              "sendMessageDeps not available for schedule execution",
+            );
           }
-          const session = await sendMessageDeps.getOrCreateSession(
-            conversationId,
-          );
+          const session =
+            await sendMessageDeps.getOrCreateSession(conversationId);
           session.taskRunId = taskRunId;
           await session.processMessage(
             message,
@@ -224,5 +244,11 @@ export function scheduleRouteDefinitions(deps: {
       handler: async ({ params }) =>
         handleRunScheduleNow(params.id, deps.sendMessageDeps),
     },
+    {
+      endpoint: "schedules/:id/cancel",
+      method: "POST",
+      policyKey: "schedules/cancel",
+      handler: ({ params }) => handleCancelSchedule(params.id),
+    },
   ];
 }

package/src/runtime/routes/session-management-routes.ts

@@ -21,9 +21,7 @@ const log = getLogger("session-management-routes");
 // ---------------------------------------------------------------------------
 
 export interface SessionManagementDeps {
-  switchSession: (
-    sessionId: string,
-  ) => Promise<{
+  switchSession: (sessionId: string) => Promise<{
     sessionId: string;
     title: string;
     threadType: string;
@@ -31,9 +29,7 @@ export interface SessionManagementDeps {
   renameSession: (sessionId: string, name: string) => boolean;
   clearAllSessions: () => number;
   cancelGeneration: (sessionId: string) => boolean;
-  undoLastMessage: (
-    sessionId: string,
-  ) => { removedCount: number } | null;
+  undoLastMessage: (sessionId: string) => { removedCount: number } | null;
   regenerateResponse: (
     sessionId: string,
   ) => Promise<{ requestId: string } | null>;

package/src/runtime/routes/session-query-routes.ts

@@ -2,8 +2,7 @@
  * HTTP route definitions for model configuration, conversation search,
  * message content, and queued message deletion.
  *
- * These routes expose IPC-only functionality over the HTTP API, enabling
- * clients to migrate from the Unix socket transport to HTTP+SSE.
+ * These routes expose session query functionality over the HTTP API.
  *
  * GET    /v1/model                   — current model info
  * PUT    /v1/model                   — set model
@@ -64,15 +63,15 @@ export function sessionQueryRouteDefinitions(
       policyKey: "model",
       handler: async ({ req }) => {
         if (!deps.getModelSetContext) {
-          return httpError(
-            "INTERNAL_ERROR",
-            "Model set not available",
-            500,
-          );
+          return httpError("INTERNAL_ERROR", "Model set not available", 500);
         }
         const body = (await req.json()) as { modelId?: string };
         if (!body.modelId || typeof body.modelId !== "string") {
-          return httpError("BAD_REQUEST", "Missing required field: modelId", 400);
+          return httpError(
+            "BAD_REQUEST",
+            "Missing required field: modelId",
+            400,
+          );
         }
         try {
           const info = setModel(body.modelId, deps.getModelSetContext());
@@ -101,7 +100,11 @@ export function sessionQueryRouteDefinitions(
         }
         const body = (await req.json()) as { modelId?: string };
         if (!body.modelId || typeof body.modelId !== "string") {
-          return httpError("BAD_REQUEST", "Missing required field: modelId", 400);
+          return httpError(
+            "BAD_REQUEST",
+            "Missing required field: modelId",
+            400,
+          );
         }
         try {
           setImageGenModel(body.modelId, deps.getModelSetContext());
@@ -125,7 +128,11 @@ export function sessionQueryRouteDefinitions(
       handler: ({ url }) => {
         const q = url.searchParams.get("q");
         if (!q) {
-          return httpError("BAD_REQUEST", "Missing required query parameter: q", 400);
+          return httpError(
+            "BAD_REQUEST",
+            "Missing required query parameter: q",
+            400,
+          );
         }
         const limit = url.searchParams.has("limit")
           ? Number(url.searchParams.get("limit"))
@@ -151,11 +158,7 @@ export function sessionQueryRouteDefinitions(
         const sessionId = url.searchParams.get("sessionId");
         const result = getMessageContent(params.id, sessionId ?? undefined);
         if (!result) {
-          return httpError(
-            "NOT_FOUND",
-            `Message ${params.id} not found`,
-            404,
-          );
+          return httpError("NOT_FOUND", `Message ${params.id} not found`, 404);
         }
         return Response.json(result);
       },