@vellumai/assistant 0.4.44 → 0.4.45

package/src/runtime/routes/app-management-routes.ts

@@ -2,7 +2,7 @@
  * HTTP route definitions for app CRUD, bundling, sharing, versioning,
  * gallery, and signing operations.
  *
- * Business logic is extracted from the IPC handlers in
+ * Business logic is extracted from the handlers in
  * `daemon/handlers/apps.ts`, `daemon/handlers/publish.ts`,
  * `daemon/handlers/signing.ts`, and `daemon/handlers/open-bundle-handler.ts`
  * so that the same operations are available over HTTP.
@@ -887,8 +887,7 @@ export function appManagementRouteDefinitions(): RouteDefinition[] {
       handler: async ({ params }) => {
         try {
           // Package without signing callback (HTTP clients handle signing
-          // separately or skip it). The IPC flow used a socket-based
-          // signing callback; HTTP callers can use the sign-bundle
+          // separately or skip it). HTTP callers can use the sign-bundle
           // endpoint independently if needed.
           const result = await packageApp(params.id);
           const bundleData = readFileSync(result.bundlePath);

package/src/runtime/routes/approval-routes.ts

@@ -107,9 +107,7 @@ export async function handleConfirm(
     }
 
     if (selectedScope) {
-      const validScopes = (confirmation.scopeOptions ?? []).map(
-        (o) => o.scope,
-      );
+      const validScopes = (confirmation.scopeOptions ?? []).map((o) => o.scope);
       if (validScopes.length === 0) {
         if (selectedScope !== "everywhere") {
           return httpError(

package/src/runtime/routes/btw-routes.ts

@@ -0,0 +1,155 @@
+/**
+ * HTTP route handler for the POST /v1/btw SSE-streaming side-chain endpoint.
+ *
+ * Runs an ephemeral LLM call that reuses the session's provider, system prompt,
+ * tool definitions, and message history for prompt-cache efficiency. The response
+ * is streamed as SSE events (`btw_text_delta`, `btw_complete`, `btw_error`).
+ *
+ * No messages are persisted. `session.processing` is never set or checked.
+ */
+
+import { buildToolDefinitions } from "../../daemon/session-tool-setup.js";
+import { getOrCreateConversation } from "../../memory/conversation-key-store.js";
+import {
+  createTimeout,
+  userMessage,
+} from "../../providers/provider-send-message.js";
+import { getLogger } from "../../util/logger.js";
+import type { AuthContext } from "../auth/types.js";
+import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
+import type { SendMessageDeps } from "../http-types.js";
+
+const log = getLogger("btw-routes");
+
+// ---------------------------------------------------------------------------
+// Handler
+// ---------------------------------------------------------------------------
+
+async function handleBtw(
+  req: Request,
+  deps: { sendMessageDeps?: SendMessageDeps },
+  _authContext: AuthContext,
+): Promise<Response> {
+  const body = (await req.json()) as {
+    conversationKey?: string;
+    content?: string;
+  };
+
+  const { conversationKey, content } = body;
+
+  if (!conversationKey) {
+    return httpError("BAD_REQUEST", "conversationKey is required", 400);
+  }
+  if (!content || typeof content !== "string") {
+    return httpError("BAD_REQUEST", "content must be a non-empty string", 400);
+  }
+
+  if (!deps.sendMessageDeps) {
+    return httpError(
+      "SERVICE_UNAVAILABLE",
+      "Message processing is not available",
+      503,
+    );
+  }
+
+  const mapping = getOrCreateConversation(conversationKey);
+  const session = await deps.sendMessageDeps.getOrCreateSession(
+    mapping.conversationId,
+  );
+
+  const messages = [...session.getMessages(), userMessage(content.trim())];
+  const tools = buildToolDefinitions();
+  const { signal: timeoutSignal, cleanup: cleanupTimeout } =
+    createTimeout(30_000);
+
+  // Combine the timeout signal with the request's abort signal so that
+  // disconnection or timeout both cancel the provider call.
+  const combinedController = new AbortController();
+  const onTimeoutAbort = () => combinedController.abort();
+  const onRequestAbort = () => combinedController.abort();
+  timeoutSignal.addEventListener("abort", onTimeoutAbort, { once: true });
+  req.signal.addEventListener("abort", onRequestAbort, { once: true });
+  const combinedSignal = combinedController.signal;
+
+  const encoder = new TextEncoder();
+
+  const stream = new ReadableStream({
+    start(controller) {
+      (async () => {
+        try {
+          await session.provider.sendMessage(
+            messages,
+            tools,
+            session.systemPrompt,
+            {
+              config: {
+                max_tokens: 1024,
+                tool_choice: { type: "none" },
+                modelIntent: "latency-optimized",
+              },
+              onEvent: (event) => {
+                if (event.type === "text_delta") {
+                  controller.enqueue(
+                    encoder.encode(
+                      `event: btw_text_delta\ndata: ${JSON.stringify({ text: event.text })}\n\n`,
+                    ),
+                  );
+                }
+              },
+              signal: combinedSignal,
+            },
+          );
+
+          controller.enqueue(
+            encoder.encode(`event: btw_complete\ndata: {}\n\n`),
+          );
+          controller.close();
+        } catch (err: unknown) {
+          const message = err instanceof Error ? err.message : "Unknown error";
+          log.error({ err }, "btw side-chain streaming error");
+          try {
+            controller.enqueue(
+              encoder.encode(
+                `event: btw_error\ndata: ${JSON.stringify({ error: message })}\n\n`,
+              ),
+            );
+            controller.close();
+          } catch {
+            /* stream already closed */
+          }
+        } finally {
+          cleanupTimeout();
+          timeoutSignal.removeEventListener("abort", onTimeoutAbort);
+          req.signal.removeEventListener("abort", onRequestAbort);
+        }
+      })();
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function btwRouteDefinitions(deps: {
+  sendMessageDeps?: SendMessageDeps;
+}): RouteDefinition[] {
+  return [
+    {
+      endpoint: "btw",
+      method: "POST",
+      policyKey: "btw",
+      handler: async ({ req, authContext }) =>
+        handleBtw(req, deps, authContext),
+    },
+  ];
+}

package/src/runtime/routes/computer-use-routes.ts

@@ -2,9 +2,7 @@
  * HTTP route handlers for computer use session lifecycle.
  *
  * These endpoints expose CU session management, ride-shotgun, and watch
- * observation functionality over HTTP. The existing IPC handlers remain
- * as the primary transport; these routes provide the HTTP-first API
- * surface for the phase-out-ipc migration.
+ * observation functionality over HTTP.
  *
  * All CU write operations require the `chat.write` scope.
  */
@@ -51,13 +49,15 @@ export interface ComputerUseDeps {
   /** Handle a ride-shotgun stop request. */
   handleRideShotgunStop: (watchId: string) => Promise<void>;
   /** Get ride-shotgun session status by watchId. */
-  getRideShotgunStatus: (watchId: string) => {
-    status: "active" | "completing" | "completed" | "cancelled";
-    sessionId: string;
-    recordingId?: string;
-    savedRecordingPath?: string;
-    bootstrapFailureReason?: string;
-  } | undefined;
+  getRideShotgunStatus: (watchId: string) =>
+    | {
+        status: "active" | "completing" | "completed" | "cancelled";
+        sessionId: string;
+        recordingId?: string;
+        savedRecordingPath?: string;
+        bootstrapFailureReason?: string;
+      }
+    | undefined;
   /** Handle a watch observation. */
   handleWatchObservation: (params: {
     watchId: string;
@@ -126,10 +126,18 @@ async function handleCreateSession(
     return httpError("BAD_REQUEST", "task is required", 400);
   }
   if (typeof screenWidth !== "number" || screenWidth <= 0) {
-    return httpError("BAD_REQUEST", "screenWidth must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "screenWidth must be a positive number",
+      400,
+    );
   }
   if (typeof screenHeight !== "number" || screenHeight <= 0) {
-    return httpError("BAD_REQUEST", "screenHeight must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "screenHeight must be a positive number",
+      400,
+    );
   }
 
   // Abort any existing session with the same ID to prevent zombies
@@ -157,13 +165,15 @@ async function handleCreateSession(
   const sessionRef: { current?: ComputerUseSession } = {};
   const onTerminal = (sid: string) => {
     removeCuSessionReferences(deps, sid, sessionRef.current);
-    log.info({ sessionId: sid }, "Computer-use session cleaned up after terminal state");
+    log.info(
+      { sessionId: sid },
+      "Computer-use session cleaned up after terminal state",
+    );
   };
 
   // Dynamic import to avoid circular dependency
-  const { ComputerUseSession: CUSession } = await import(
-    "../../daemon/computer-use-session.js"
-  );
+  const { ComputerUseSession: CUSession } =
+    await import("../../daemon/computer-use-session.js");
 
   const session = new CUSession(
     sessionId,
@@ -294,8 +304,7 @@ async function handleObservation(
  * POST /v1/computer-use/tasks — submit a task.
  *
  * This is a simplified HTTP version of task_submit that creates a CU session.
- * The full task_submit flow (with routing, recording intents, etc.) remains
- * IPC-only for now; this endpoint provides direct CU session creation.
+ * This endpoint provides direct CU session creation.
  *
  * Body: { task, screenWidth, screenHeight, interactionType? }
  */
@@ -316,10 +325,18 @@ async function handleTaskSubmit(
     return httpError("BAD_REQUEST", "task is required", 400);
   }
   if (typeof screenWidth !== "number" || screenWidth <= 0) {
-    return httpError("BAD_REQUEST", "screenWidth must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "screenWidth must be a positive number",
+      400,
+    );
   }
   if (typeof screenHeight !== "number" || screenHeight <= 0) {
-    return httpError("BAD_REQUEST", "screenHeight must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "screenHeight must be a positive number",
+      400,
+    );
   }
 
   const sessionId = crypto.randomUUID();
@@ -343,12 +360,14 @@ async function handleTaskSubmit(
   const sessionRef: { current?: ComputerUseSession } = {};
   const onTerminal = (sid: string) => {
     removeCuSessionReferences(deps, sid, sessionRef.current);
-    log.info({ sessionId: sid }, "Computer-use session cleaned up after terminal state");
+    log.info(
+      { sessionId: sid },
+      "Computer-use session cleaned up after terminal state",
+    );
   };
 
-  const { ComputerUseSession: CUSession } = await import(
-    "../../daemon/computer-use-session.js"
-  );
+  const { ComputerUseSession: CUSession } =
+    await import("../../daemon/computer-use-session.js");
 
   const session = new CUSession(
     sessionId,
@@ -393,13 +412,28 @@ async function handleRideShotgunStartRoute(
     autoNavigate?: boolean;
   };
 
-  const { durationSeconds, intervalSeconds, mode, targetDomain, navigateDomain, autoNavigate } = body;
+  const {
+    durationSeconds,
+    intervalSeconds,
+    mode,
+    targetDomain,
+    navigateDomain,
+    autoNavigate,
+  } = body;
 
   if (typeof durationSeconds !== "number" || durationSeconds <= 0) {
-    return httpError("BAD_REQUEST", "durationSeconds must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "durationSeconds must be a positive number",
+      400,
+    );
   }
   if (typeof intervalSeconds !== "number" || intervalSeconds <= 0) {
-    return httpError("BAD_REQUEST", "intervalSeconds must be a positive number", 400);
+    return httpError(
+      "BAD_REQUEST",
+      "intervalSeconds must be a positive number",
+      400,
+    );
   }
 
   try {
@@ -413,7 +447,12 @@ async function handleRideShotgunStartRoute(
     });
 
     log.info(
-      { watchId: result.watchId, sessionId: result.sessionId, durationSeconds, mode },
+      {
+        watchId: result.watchId,
+        sessionId: result.sessionId,
+        durationSeconds,
+        mode,
+      },
       "Ride shotgun started via HTTP",
     );
 
@@ -447,7 +486,10 @@ async function handleRideShotgunStopRoute(
     return Response.json({ ok: true });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log.error({ err, watchId: body.watchId }, "Failed to stop ride shotgun via HTTP");
+    log.error(
+      { err, watchId: body.watchId },
+      "Failed to stop ride shotgun via HTTP",
+    );
     return httpError("INTERNAL_ERROR", message, 500);
   }
 }
@@ -523,7 +565,10 @@ async function handleWatchObservationRoute(
     return Response.json({ ok: true });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log.error({ err, watchId: body.watchId }, "Failed to handle watch observation via HTTP");
+    log.error(
+      { err, watchId: body.watchId },
+      "Failed to handle watch observation via HTTP",
+    );
     return httpError("INTERNAL_ERROR", message, 500);
   }
 }
@@ -583,7 +628,8 @@ export function computerUseRouteDefinitions(deps: {
       endpoint: "computer-use/ride-shotgun/status/:watchId",
       method: "GET",
       policyKey: "computer-use/ride-shotgun/status",
-      handler: ({ params }) => handleRideShotgunStatusRoute(params.watchId, getDeps()),
+      handler: ({ params }) =>
+        handleRideShotgunStatusRoute(params.watchId, getDeps()),
     },
     {
       endpoint: "computer-use/watch",