@vellumai/assistant 0.4.49 → 0.4.50

package/src/runtime/routes/memory-item-routes.ts

@@ -0,0 +1,503 @@
+/**
+ * Route handlers for memory item CRUD endpoints.
+ *
+ * GET    /v1/memory-items        — list memory items (with filtering, search, sort, pagination)
+ * GET    /v1/memory-items/:id    — get a single memory item
+ * POST   /v1/memory-items        — create a new memory item
+ * PATCH  /v1/memory-items/:id    — update an existing memory item
+ * DELETE /v1/memory-items/:id    — delete a memory item and its embeddings
+ */
+
+import { and, asc, count, desc, eq, like, ne, or } from "drizzle-orm";
+import { v4 as uuid } from "uuid";
+
+import { getDb } from "../../memory/db.js";
+import { computeMemoryFingerprint } from "../../memory/fingerprint.js";
+import { enqueueMemoryJob } from "../../memory/jobs-store.js";
+import { memoryEmbeddings, memoryItems } from "../../memory/schema.js";
+import { truncate } from "../../util/truncate.js";
+import { httpError } from "../http-errors.js";
+import type { RouteContext, RouteDefinition } from "../http-router.js";
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+const VALID_KINDS = [
+  "identity",
+  "preference",
+  "project",
+  "decision",
+  "constraint",
+  "event",
+] as const;
+
+type MemoryItemKind = (typeof VALID_KINDS)[number];
+
+const VALID_SORT_FIELDS = [
+  "lastSeenAt",
+  "importance",
+  "kind",
+  "firstSeenAt",
+] as const;
+
+type SortField = (typeof VALID_SORT_FIELDS)[number];
+
+const SORT_COLUMN_MAP = {
+  lastSeenAt: memoryItems.lastSeenAt,
+  importance: memoryItems.importance,
+  kind: memoryItems.kind,
+  firstSeenAt: memoryItems.firstSeenAt,
+} as const;
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function isValidKind(value: string): value is MemoryItemKind {
+  return (VALID_KINDS as readonly string[]).includes(value);
+}
+
+function isValidSortField(value: string): value is SortField {
+  return (VALID_SORT_FIELDS as readonly string[]).includes(value);
+}
+
+// ---------------------------------------------------------------------------
+// GET /v1/memory-items
+// ---------------------------------------------------------------------------
+
+export function handleListMemoryItems(url: URL): Response {
+  const kindParam = url.searchParams.get("kind");
+  const statusParam = url.searchParams.get("status") ?? "active";
+  const searchParam = url.searchParams.get("search");
+  const sortParam = url.searchParams.get("sort") ?? "lastSeenAt";
+  const orderParam = url.searchParams.get("order") ?? "desc";
+  const limitParam = Number(url.searchParams.get("limit") ?? 100);
+  const offsetParam = Number(url.searchParams.get("offset") ?? 0);
+
+  if (kindParam && !isValidKind(kindParam)) {
+    return httpError(
+      "BAD_REQUEST",
+      `Invalid kind "${kindParam}". Must be one of: ${VALID_KINDS.join(", ")}`,
+      400,
+    );
+  }
+
+  if (!isValidSortField(sortParam)) {
+    return httpError(
+      "BAD_REQUEST",
+      `Invalid sort "${sortParam}". Must be one of: ${VALID_SORT_FIELDS.join(", ")}`,
+      400,
+    );
+  }
+
+  if (orderParam !== "asc" && orderParam !== "desc") {
+    return httpError(
+      "BAD_REQUEST",
+      `Invalid order "${orderParam}". Must be "asc" or "desc"`,
+      400,
+    );
+  }
+
+  const db = getDb();
+
+  // Build WHERE conditions
+  const conditions = [];
+  if (statusParam && statusParam !== "all") {
+    conditions.push(eq(memoryItems.status, statusParam));
+  }
+  if (kindParam) {
+    conditions.push(eq(memoryItems.kind, kindParam));
+  }
+  if (searchParam) {
+    conditions.push(
+      or(
+        like(memoryItems.subject, `%${searchParam}%`),
+        like(memoryItems.statement, `%${searchParam}%`),
+      )!,
+    );
+  }
+
+  const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
+
+  // Count query
+  const countResult = db
+    .select({ count: count() })
+    .from(memoryItems)
+    .where(whereClause)
+    .get();
+  const total = countResult?.count ?? 0;
+
+  // Data query
+  const sortColumn = SORT_COLUMN_MAP[sortParam];
+  const orderFn = orderParam === "asc" ? asc : desc;
+
+  const items = db
+    .select()
+    .from(memoryItems)
+    .where(whereClause)
+    .orderBy(orderFn(sortColumn))
+    .limit(limitParam)
+    .offset(offsetParam)
+    .all();
+
+  return Response.json({ items, total });
+}
+
+// ---------------------------------------------------------------------------
+// GET /v1/memory-items/:id
+// ---------------------------------------------------------------------------
+
+export function handleGetMemoryItem(ctx: RouteContext): Response {
+  const { id } = ctx.params;
+  const db = getDb();
+
+  const item = db
+    .select()
+    .from(memoryItems)
+    .where(eq(memoryItems.id, id))
+    .get();
+
+  if (!item) {
+    return httpError("NOT_FOUND", "Memory item not found", 404);
+  }
+
+  let supersedesSubject: string | undefined;
+  let supersededBySubject: string | undefined;
+
+  if (item.supersedes) {
+    const superseded = db
+      .select({ subject: memoryItems.subject })
+      .from(memoryItems)
+      .where(eq(memoryItems.id, item.supersedes))
+      .get();
+    supersedesSubject = superseded?.subject;
+  }
+
+  if (item.supersededBy) {
+    const superseding = db
+      .select({ subject: memoryItems.subject })
+      .from(memoryItems)
+      .where(eq(memoryItems.id, item.supersededBy))
+      .get();
+    supersededBySubject = superseding?.subject;
+  }
+
+  return Response.json({
+    item: {
+      ...item,
+      ...(supersedesSubject !== undefined ? { supersedesSubject } : {}),
+      ...(supersededBySubject !== undefined ? { supersededBySubject } : {}),
+    },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// POST /v1/memory-items
+// ---------------------------------------------------------------------------
+
+export async function handleCreateMemoryItem(
+  ctx: RouteContext,
+): Promise<Response> {
+  const body = (await ctx.req.json()) as {
+    kind?: string;
+    subject?: string;
+    statement?: string;
+    importance?: number;
+  };
+
+  const { kind, subject, statement, importance } = body;
+
+  // Validate kind
+  if (typeof kind !== "string" || !isValidKind(kind)) {
+    return httpError(
+      "BAD_REQUEST",
+      `kind is required and must be one of: ${VALID_KINDS.join(", ")}`,
+      400,
+    );
+  }
+
+  // Validate subject
+  if (typeof subject !== "string" || subject.trim().length === 0) {
+    return httpError(
+      "BAD_REQUEST",
+      "subject is required and must be a non-empty string",
+      400,
+    );
+  }
+
+  // Validate statement
+  if (typeof statement !== "string" || statement.trim().length === 0) {
+    return httpError(
+      "BAD_REQUEST",
+      "statement is required and must be a non-empty string",
+      400,
+    );
+  }
+
+  const trimmedSubject = truncate(subject.trim(), 80, "");
+  const trimmedStatement = truncate(statement.trim(), 500, "");
+
+  const scopeId = "default";
+  const fingerprint = computeMemoryFingerprint(
+    scopeId,
+    kind,
+    trimmedSubject,
+    trimmedStatement,
+  );
+
+  const db = getDb();
+
+  // Check for existing item with same fingerprint + scopeId
+  const existing = db
+    .select()
+    .from(memoryItems)
+    .where(
+      and(
+        eq(memoryItems.fingerprint, fingerprint),
+        eq(memoryItems.scopeId, scopeId),
+      ),
+    )
+    .get();
+
+  if (existing) {
+    return httpError(
+      "CONFLICT",
+      "A memory with this content already exists",
+      409,
+    );
+  }
+
+  const id = uuid();
+  const now = Date.now();
+
+  db.insert(memoryItems)
+    .values({
+      id,
+      kind,
+      subject: trimmedSubject,
+      statement: trimmedStatement,
+      status: "active",
+      confidence: 0.95,
+      importance: importance ?? 0.8,
+      fingerprint,
+      verificationState: "user_confirmed",
+      scopeId,
+      firstSeenAt: now,
+      lastSeenAt: now,
+      lastUsedAt: null,
+      overrideConfidence: "explicit",
+    })
+    .run();
+
+  enqueueMemoryJob("embed_item", { itemId: id });
+
+  // Fetch the inserted row to return it
+  const insertedRow = db
+    .select()
+    .from(memoryItems)
+    .where(eq(memoryItems.id, id))
+    .get();
+
+  return Response.json({ item: insertedRow }, { status: 201 });
+}
+
+// ---------------------------------------------------------------------------
+// PATCH /v1/memory-items/:id
+// ---------------------------------------------------------------------------
+
+export async function handleUpdateMemoryItem(
+  ctx: RouteContext,
+): Promise<Response> {
+  const { id } = ctx.params;
+  const body = (await ctx.req.json()) as {
+    subject?: string;
+    statement?: string;
+    kind?: string;
+    status?: string;
+    importance?: number;
+    verificationState?: string;
+  };
+
+  const db = getDb();
+
+  const existing = db
+    .select()
+    .from(memoryItems)
+    .where(eq(memoryItems.id, id))
+    .get();
+
+  if (!existing) {
+    return httpError("NOT_FOUND", "Memory item not found", 404);
+  }
+
+  // Build the update set with only provided fields
+  const set: Record<string, unknown> = {
+    lastSeenAt: Date.now(),
+  };
+
+  if (body.subject !== undefined) {
+    if (typeof body.subject !== "string") {
+      return httpError("BAD_REQUEST", "subject must be a string", 400);
+    }
+    set.subject = truncate(body.subject.trim(), 80, "");
+  }
+  if (body.statement !== undefined) {
+    if (typeof body.statement !== "string") {
+      return httpError("BAD_REQUEST", "statement must be a string", 400);
+    }
+    set.statement = truncate(body.statement.trim(), 500, "");
+  }
+  if (body.kind !== undefined) {
+    if (!isValidKind(body.kind)) {
+      return httpError(
+        "BAD_REQUEST",
+        `Invalid kind "${body.kind}". Must be one of: ${VALID_KINDS.join(", ")}`,
+        400,
+      );
+    }
+    set.kind = body.kind;
+  }
+  if (body.status !== undefined) {
+    set.status = body.status;
+  }
+  if (body.importance !== undefined) {
+    set.importance = body.importance;
+  }
+  if (body.verificationState !== undefined) {
+    set.verificationState = body.verificationState;
+  }
+
+  // If subject, statement, or kind changed, recompute fingerprint
+  const contentChanged =
+    body.subject !== undefined ||
+    body.statement !== undefined ||
+    body.kind !== undefined;
+
+  if (contentChanged) {
+    const newSubject = (set.subject as string | undefined) ?? existing.subject;
+    const newStatement =
+      (set.statement as string | undefined) ?? existing.statement;
+    const newKind = (set.kind as string | undefined) ?? existing.kind;
+    const scopeId = existing.scopeId;
+
+    const fingerprint = computeMemoryFingerprint(
+      scopeId,
+      newKind,
+      newSubject,
+      newStatement,
+    );
+
+    // Check for collision (exclude self)
+    const collision = db
+      .select({ id: memoryItems.id })
+      .from(memoryItems)
+      .where(
+        and(
+          eq(memoryItems.fingerprint, fingerprint),
+          eq(memoryItems.scopeId, scopeId),
+          ne(memoryItems.id, id),
+        ),
+      )
+      .get();
+
+    if (collision) {
+      return httpError(
+        "CONFLICT",
+        "Another memory item with this content already exists",
+        409,
+      );
+    }
+
+    set.fingerprint = fingerprint;
+  }
+
+  db.update(memoryItems).set(set).where(eq(memoryItems.id, id)).run();
+
+  // If statement changed, enqueue embed job
+  if (body.statement !== undefined) {
+    enqueueMemoryJob("embed_item", { itemId: id });
+  }
+
+  // Fetch and return the updated row
+  const updatedRow = db
+    .select()
+    .from(memoryItems)
+    .where(eq(memoryItems.id, id))
+    .get();
+
+  return Response.json({ item: updatedRow });
+}
+
+// ---------------------------------------------------------------------------
+// DELETE /v1/memory-items/:id
+// ---------------------------------------------------------------------------
+
+export async function handleDeleteMemoryItem(
+  ctx: RouteContext,
+): Promise<Response> {
+  const { id } = ctx.params;
+  const db = getDb();
+
+  const existing = db
+    .select()
+    .from(memoryItems)
+    .where(eq(memoryItems.id, id))
+    .get();
+
+  if (!existing) {
+    return httpError("NOT_FOUND", "Memory item not found", 404);
+  }
+
+  // Delete embeddings for this item
+  db.delete(memoryEmbeddings)
+    .where(
+      and(
+        eq(memoryEmbeddings.targetType, "item"),
+        eq(memoryEmbeddings.targetId, id),
+      ),
+    )
+    .run();
+
+  // Delete the item (cascades memoryItemSources)
+  db.delete(memoryItems).where(eq(memoryItems.id, id)).run();
+
+  return new Response(null, { status: 204 });
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function memoryItemRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "memory-items",
+      method: "GET",
+      handler: (ctx) => handleListMemoryItems(ctx.url),
+    },
+    {
+      endpoint: "memory-items/:id",
+      method: "GET",
+      policyKey: "memory-items",
+      handler: (ctx) => handleGetMemoryItem(ctx),
+    },
+    {
+      endpoint: "memory-items",
+      method: "POST",
+      handler: (ctx) => handleCreateMemoryItem(ctx),
+    },
+    {
+      endpoint: "memory-items/:id",
+      method: "PATCH",
+      policyKey: "memory-items",
+      handler: (ctx) => handleUpdateMemoryItem(ctx),
+    },
+    {
+      endpoint: "memory-items/:id",
+      method: "DELETE",
+      policyKey: "memory-items",
+      handler: (ctx) => handleDeleteMemoryItem(ctx),
+    },
+  ];
+}

package/src/runtime/routes/session-management-routes.ts

@@ -29,7 +29,7 @@ export interface SessionManagementDeps {
   renameSession: (sessionId: string, name: string) => boolean;
   clearAllSessions: () => number;
   cancelGeneration: (sessionId: string) => boolean;
-  undoLastMessage: (sessionId: string) => { removedCount: number } | null;
+  undoLastMessage: (sessionId: string) => Promise<{ removedCount: number } | null>;
   regenerateResponse: (
     sessionId: string,
   ) => Promise<{ requestId: string } | null>;
@@ -115,8 +115,8 @@ export function sessionManagementRouteDefinitions(
       endpoint: "conversations/:id/undo",
       method: "POST",
       policyKey: "conversations/undo",
-      handler: ({ params }) => {
-        const result = deps.undoLastMessage(params.id);
+      handler: async ({ params }) => {
+        const result = await deps.undoLastMessage(params.id);
         if (!result) {
           return httpError(
             "NOT_FOUND",

package/src/runtime/routes/settings-routes.ts

@@ -160,7 +160,7 @@ async function handleOAuthConnectStart(body: {
     const app = getApp(conn.oauthAppId);
     if (app) {
       clientId = app.clientId;
-      clientSecret = getSecureKey(`oauth_app/${app.id}/client_secret`);
+      clientSecret = getSecureKey(app.clientSecretCredentialPath);
     }
   }
 
@@ -170,7 +170,7 @@ async function handleOAuthConnectStart(body: {
     if (dbApp) {
       clientId = dbApp.clientId;
       if (!clientSecret) {
-        clientSecret = getSecureKey(`oauth_app/${dbApp.id}/client_secret`);
+        clientSecret = getSecureKey(dbApp.clientSecretCredentialPath);
       }
     }
   }

package/src/runtime/routes/trust-rules-routes.ts

@@ -48,6 +48,13 @@ export async function handleAddTrustRuleManage(
   if (!toolName || typeof toolName !== "string") {
     return httpError("BAD_REQUEST", "toolName is required", 400);
   }
+  if (toolName.startsWith("__internal:")) {
+    return httpError(
+      "BAD_REQUEST",
+      "toolName must not start with __internal:",
+      400,
+    );
+  }
   if (!pattern || typeof pattern !== "string") {
     return httpError("BAD_REQUEST", "pattern is required", 400);
   }
@@ -124,6 +131,13 @@ export async function handleUpdateTrustRuleManage(
     priority?: number;
   };
 
+  if (typeof body.tool === "string" && body.tool.startsWith("__internal:")) {
+    return httpError(
+      "BAD_REQUEST",
+      "tool must not start with __internal:",
+      400,
+    );
+  }
   if (body.decision !== undefined) {
     const validDecisions = ["allow", "deny", "ask"] as const;
     if (

package/src/runtime/routes/workspace-routes.ts

@@ -33,6 +33,7 @@ interface TreeEntry {
 
 function handleWorkspaceTree(ctx: RouteContext): Response {
   const requestedPath = ctx.url.searchParams.get("path") ?? "";
+  const showHidden = ctx.url.searchParams.get("showHidden") === "true";
   const resolved = resolveWorkspacePath(requestedPath);
   if (resolved === undefined) {
     return httpError("BAD_REQUEST", "Invalid path", 400);
@@ -45,7 +46,7 @@ function handleWorkspaceTree(ctx: RouteContext): Response {
     const entries: TreeEntry[] = [];
     for (const entry of dirents) {
       // Filter out dotfiles/directories (.env, .git, .private, etc.)
-      if (entry.name.startsWith(".")) continue;
+      if (!showHidden && entry.name.startsWith(".")) continue;
 
       const fullPath = join(resolved, entry.name);
 

package/src/security/keychain-broker-client.ts

@@ -33,11 +33,18 @@ const REQUEST_TIMEOUT_MS = 5_000;
  *  back); `{ found: false }` means the key doesn't exist in the keychain. */
 export type BrokerGetResult = { found: boolean; value?: string } | null;
 
+/** Result of a `set()` call — distinguishes broker-unreachable from an active
+ *  rejection so callers can log meaningful diagnostics. */
+export type BrokerSetResult =
+  | { status: "ok" }
+  | { status: "unreachable" }
+  | { status: "rejected"; code: string; message: string };
+
 export interface KeychainBrokerClient {
   isAvailable(): boolean;
   ping(): Promise<{ pong: boolean } | null>;
   get(account: string): Promise<BrokerGetResult>;
-  set(account: string, value: string): Promise<boolean>;
+  set(account: string, value: string): Promise<BrokerSetResult>;
   del(account: string): Promise<boolean>;
   list(): Promise<string[]>;
 }
@@ -360,12 +367,18 @@ export function createBrokerClient(): KeychainBrokerClient {
       }
     },
 
-    async set(account: string, value: string): Promise<boolean> {
+    async set(account: string, value: string): Promise<BrokerSetResult> {
       try {
         const response = await doRequest("key.set", { account, value });
-        return response?.ok === true;
+        if (!response) return { status: "unreachable" };
+        if (response.ok) return { status: "ok" };
+        return {
+          status: "rejected",
+          code: response.error?.code ?? "UNKNOWN",
+          message: response.error?.message ?? "unknown error",
+        };
       } catch {
-        return false;
+        return { status: "unreachable" };
       }
     },
 

package/src/security/secure-keys.ts

@@ -7,10 +7,13 @@
  * encrypted store (startup code paths cannot do async I/O).
  */
 
+import { getLogger } from "../util/logger.js";
 import * as encryptedStore from "./encrypted-store.js";
 import type { KeychainBrokerClient } from "./keychain-broker-client.js";
 import { createBrokerClient } from "./keychain-broker-client.js";
 
+const log = getLogger("secure-keys");
+
 let _broker: KeychainBrokerClient | undefined;
 
 function getBroker(): KeychainBrokerClient {
@@ -120,13 +123,32 @@ export async function setSecureKeyAsync(
 ): Promise<boolean> {
   const broker = getBroker();
   if (broker.isAvailable()) {
-    const brokerOk = await broker.set(account, value);
-    if (!brokerOk) return false;
+    const result = await broker.set(account, value);
+    if (result.status !== "ok") {
+      log.warn(
+        {
+          account,
+          brokerStatus: result.status,
+          ...(result.status === "rejected"
+            ? { brokerCode: result.code, brokerMessage: result.message }
+            : {}),
+        },
+        "Broker set failed for secure key",
+      );
+      return false;
+    }
     // Broker succeeded — also persist to encrypted store for sync callers.
     const encOk = encryptedStore.setKey(account, value);
+    if (!encOk) {
+      log.warn({ account }, "Encrypted store set failed after broker success");
+    }
     return encOk;
   }
-  return encryptedStore.setKey(account, value);
+  const encOk = encryptedStore.setKey(account, value);
+  if (!encOk) {
+    log.warn({ account }, "Encrypted store set failed (broker unavailable)");
+  }
+  return encOk;
 }
 
 /**