@vellumai/assistant 0.5.5 → 0.5.7

package/src/runtime/auth/__tests__/external-assistant-id.test.ts

@@ -1,21 +1,7 @@
 /**
- * Tests for getExternalAssistantId resolution order.
+ * Tests for getExternalAssistantId.
  */
-import { afterEach, describe, expect, mock, test } from "bun:test";
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
-// Controllable mock for readLockfile — defaults to null (no lockfile data)
-const mockReadLockfile = mock(() => null as Record<string, unknown> | null);
-
-mock.module("../../../util/platform.js", () => ({
-  readLockfile: mockReadLockfile,
-}));
+import { afterEach, describe, expect, test } from "bun:test";
 
 import {
   getExternalAssistantId,
@@ -24,65 +10,24 @@ import {
 
 afterEach(() => {
   resetExternalAssistantIdCache();
-  mockReadLockfile.mockReset();
-  mockReadLockfile.mockImplementation(() => null);
-  delete process.env.BASE_DATA_DIR;
+  delete process.env.VELLUM_ASSISTANT_NAME;
 });
 
 describe("getExternalAssistantId", () => {
-  test("resolves from lockfile assistants array (most recently hatched)", () => {
-    mockReadLockfile.mockImplementation(() => ({
-      assistants: [
-        { assistantId: "vellum-old-fox", hatchedAt: "2025-01-01T00:00:00Z" },
-        { assistantId: "vellum-new-eel", hatchedAt: "2025-06-15T12:00:00Z" },
-      ],
-    }));
-    expect(getExternalAssistantId()).toBe("vellum-new-eel");
-  });
-
-  test("resolves from lockfile with single assistant entry", () => {
-    mockReadLockfile.mockImplementation(() => ({
-      assistants: [
-        { assistantId: "vellum-solo-cat", hatchedAt: "2025-03-01T00:00:00Z" },
-      ],
-    }));
-    expect(getExternalAssistantId()).toBe("vellum-solo-cat");
-  });
-
-  test("resolves from BASE_DATA_DIR when lockfile has no data", () => {
-    process.env.BASE_DATA_DIR = "/tmp/vellum/assistants/vellum-true-eel";
-    expect(getExternalAssistantId()).toBe("vellum-true-eel");
-  });
-
-  test("resolves from BASE_DATA_DIR with trailing slash", () => {
-    process.env.BASE_DATA_DIR = "/tmp/vellum/assistants/vellum-cool-heron/";
-    expect(getExternalAssistantId()).toBe("vellum-cool-heron");
-  });
-
-  test("resolves from BASE_DATA_DIR with Windows-style backslashes", () => {
-    process.env.BASE_DATA_DIR =
-      "C:\\Users\\user\\.local\\share\\vellum\\assistants\\vellum-nice-fox";
-    expect(getExternalAssistantId()).toBe("vellum-nice-fox");
-  });
-
-  test("resolves from BASE_DATA_DIR with /instances/<name> path", () => {
-    process.env.BASE_DATA_DIR = "/home/user/.vellum/instances/vellum-swift-owl";
-    expect(getExternalAssistantId()).toBe("vellum-swift-owl");
-  });
-
-  test("resolves from BASE_DATA_DIR with /instances/<name> trailing slash", () => {
-    process.env.BASE_DATA_DIR =
-      "/home/user/.vellum/instances/vellum-swift-owl/";
-    expect(getExternalAssistantId()).toBe("vellum-swift-owl");
+  test("resolves from VELLUM_ASSISTANT_NAME env var", () => {
+    process.env.VELLUM_ASSISTANT_NAME = "vellum-cool-eel";
+    expect(getExternalAssistantId()).toBe("vellum-cool-eel");
   });
 
-  test("falls back to undefined when BASE_DATA_DIR does not match known patterns", () => {
-    process.env.BASE_DATA_DIR = "/tmp/some-other-path";
-    expect(getExternalAssistantId()).toBe(undefined);
+  test("caches the resolved value", () => {
+    process.env.VELLUM_ASSISTANT_NAME = "vellum-cool-eel";
+    expect(getExternalAssistantId()).toBe("vellum-cool-eel");
+    // Change env var — cached value should still be returned
+    process.env.VELLUM_ASSISTANT_NAME = "vellum-other-fox";
+    expect(getExternalAssistantId()).toBe("vellum-cool-eel");
   });
 
-  test("falls back to undefined when BASE_DATA_DIR is not set", () => {
-    delete process.env.BASE_DATA_DIR;
+  test("returns undefined when env var is not set", () => {
     expect(getExternalAssistantId()).toBe(undefined);
   });
 });

package/src/runtime/auth/external-assistant-id.ts

@@ -6,81 +6,35 @@
  * must identify which assistant the token belongs to, while the daemon
  * internally uses 'self'.
  *
- * Resolution order:
- *   1. Cached in-memory value (populated on first call)
- *   2. Most recently hatched entry in lockfile assistants array
- *      (sorted by `hatchedAt` descending) → assistantId
- *   3. BASE_DATA_DIR path matching `/assistants/<name>` or `/instances/<name>` suffix
- *   4. `undefined` — callers must handle the missing value
+ * Reads from the VELLUM_ASSISTANT_NAME env var, which is set by CLI
+ * hatch and Docker setup. Returns `undefined` if the env var is not set.
  *
- * The value is cached in memory after the first successful read.
+ * The value is cached in memory after the first read.
  */
 
-import { getBaseDataDir } from "../../config/env-registry.js";
 import { getLogger } from "../../util/logger.js";
-import { readLockfile } from "../../util/platform.js";
 
 const log = getLogger("external-assistant-id");
 
 let cached: string | null | undefined;
 
 /**
- * Get the external assistant ID.
- *
- * Resolution order:
- *   1. Cached in-memory value (populated on first call)
- *   2. Most recently hatched entry in lockfile assistants array
- *      (sorted by `hatchedAt` descending) → assistantId
- *   3. BASE_DATA_DIR path matching `/assistants/<name>` or `/instances/<name>` suffix
- *   4. `undefined` when resolution fails entirely
+ * Get the external assistant ID from the VELLUM_ASSISTANT_NAME env var.
+ * Returns `undefined` when the env var is not set.
  */
 export function getExternalAssistantId(): string | undefined {
   if (cached !== undefined) {
     return cached ?? undefined;
   }
 
-  try {
-    const lockData = readLockfile();
-    if (lockData) {
-      const assistants = lockData.assistants as
-        | Array<Record<string, unknown>>
-        | undefined;
-      if (assistants && assistants.length > 0) {
-        // Sort by hatchedAt descending to use the most recent entry,
-        // matching the pattern used elsewhere in the codebase.
-        const sorted = [...assistants].sort((a, b) => {
-          const dateA = new Date((a.hatchedAt as string) || 0).getTime();
-          const dateB = new Date((b.hatchedAt as string) || 0).getTime();
-          return dateB - dateA;
-        });
-        const latest = sorted[0];
-        if (typeof latest.assistantId === "string") {
-          cached = latest.assistantId;
-          log.info(
-            { externalAssistantId: cached },
-            "Resolved external assistant ID from lockfile",
-          );
-          return cached;
-        }
-      }
-    }
-  } catch (err) {
-    log.warn({ err }, "Failed to read lockfile for external assistant ID");
-  }
-
-  // Fallback: derive from BASE_DATA_DIR path
-  const base = getBaseDataDir();
-  if (base && typeof base === "string") {
-    const normalized = base.replace(/\\/g, "/").replace(/\/+$/, "");
-    const match = normalized.match(/\/(?:assistants|instances)\/([^/]+)$/);
-    if (match) {
-      cached = match[1];
-      log.info(
-        { externalAssistantId: cached },
-        "Resolved external assistant ID from BASE_DATA_DIR",
-      );
-      return cached;
-    }
+  const envName = process.env.VELLUM_ASSISTANT_NAME;
+  if (envName) {
+    cached = envName;
+    log.info(
+      { externalAssistantId: cached },
+      "Resolved external assistant ID from VELLUM_ASSISTANT_NAME",
+    );
+    return cached;
   }
 
   cached = null;

package/src/runtime/auth/route-policy.ts

@@ -176,6 +176,7 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
 
   // Settings / integrations / identity
   { endpoint: "identity", scopes: ["settings.read"] },
+  { endpoint: "identity/intro", scopes: ["settings.read"] },
   { endpoint: "brain-graph", scopes: ["settings.read"] },
   { endpoint: "brain-graph-ui", scopes: ["settings.read"] },
   { endpoint: "contacts", scopes: ["settings.read"] },
@@ -347,6 +348,14 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   { endpoint: "config/embeddings:GET", scopes: ["settings.read"] },
   { endpoint: "config/embeddings:PUT", scopes: ["settings.write"] },
 
+  // Permissions config
+  { endpoint: "config/permissions/skip:GET", scopes: ["settings.read"] },
+  { endpoint: "config/permissions/skip:PUT", scopes: ["settings.write"] },
+
+  // Generic config read/patch
+  { endpoint: "config:GET", scopes: ["settings.read"] },
+  { endpoint: "config:PATCH", scopes: ["settings.write"] },
+
   // Conversation management
   { endpoint: "conversations:DELETE", scopes: ["chat.write"] },
   { endpoint: "conversations/wipe", scopes: ["chat.write"] },
@@ -355,9 +364,13 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
   // Conversation search
   { endpoint: "conversations/search", scopes: ["chat.read"] },
 
+  // Conversation starters
+  { endpoint: "conversation-starters", scopes: ["chat.read"] },
+
   // Message content
   { endpoint: "messages/content", scopes: ["chat.read"] },
   { endpoint: "messages/llm-context", scopes: ["chat.read"] },
+  { endpoint: "messages/tts", scopes: ["chat.read"] },
 
   // Queued message deletion
   { endpoint: "messages/queued", scopes: ["chat.write"] },
@@ -435,7 +448,6 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
 
   // Diagnostics
   { endpoint: "export", scopes: ["settings.read"] },
-  { endpoint: "diagnostics/export", scopes: ["settings.read"] },
   { endpoint: "diagnostics/env-vars", scopes: ["settings.read"] },
 
   // Dictation
@@ -498,3 +510,19 @@ for (const endpoint of INTERNAL_ENDPOINTS) {
     allowedPrincipalTypes: ["svc_gateway"],
   });
 }
+
+// Admin control-plane endpoints: gateway-only
+registerPolicy("admin/upgrade-broadcast", {
+  requiredScopes: ["internal.write"],
+  allowedPrincipalTypes: ["svc_gateway"],
+});
+
+registerPolicy("admin/workspace-commit", {
+  requiredScopes: ["internal.write"],
+  allowedPrincipalTypes: ["svc_gateway"],
+});
+
+registerPolicy("admin/rollback-migrations", {
+  requiredScopes: ["internal.write"],
+  allowedPrincipalTypes: ["svc_gateway"],
+});

package/src/runtime/auth/token-service.ts

@@ -42,28 +42,44 @@ function getSigningKeyPath(): string {
   return join(getRootDir(), "protected", "actor-token-signing-key");
 }
 
+/**
+ * Load a signing key from disk. Returns the key buffer if found and valid,
+ * or undefined if the file does not exist or is invalid.
+ *
+ * Used in the Docker 403-fallback path where generating a new key would
+ * create a mismatch with the gateway's already-bootstrapped key.
+ */
+export function loadSigningKey(): Buffer | undefined {
+  const keyPath = getSigningKeyPath();
+  if (!existsSync(keyPath)) {
+    return undefined;
+  }
+  try {
+    const raw = readFileSync(keyPath);
+    if (raw.length === 32) {
+      log.info("Auth signing key loaded from disk");
+      return raw;
+    }
+    log.warn("Signing key file has unexpected length");
+    return undefined;
+  } catch (err) {
+    log.warn({ err }, "Failed to read signing key file");
+    return undefined;
+  }
+}
+
 /**
  * Load a signing key from disk or generate and persist a new one.
  * Uses atomic-write + chmod 0o600 for safe persistence.
  */
 export function loadOrCreateSigningKey(): Buffer {
-  const keyPath = getSigningKeyPath();
-
-  // Try to load existing key
-  if (existsSync(keyPath)) {
-    try {
-      const raw = readFileSync(keyPath);
-      if (raw.length === 32) {
-        log.info("Auth signing key loaded from disk");
-        return raw;
-      }
-      log.warn("Signing key file has unexpected length, regenerating");
-    } catch (err) {
-      log.warn({ err }, "Failed to read signing key file, regenerating");
-    }
+  const existing = loadSigningKey();
+  if (existing) {
+    return existing;
   }
 
   // Generate and persist a new key
+  const keyPath = getSigningKeyPath();
   const newKey = randomBytes(32);
   const dir = dirname(keyPath);
   if (!existsSync(dir)) {
@@ -78,6 +94,28 @@ export function loadOrCreateSigningKey(): Buffer {
   return newKey;
 }
 
+/**
+ * Resolve the signing key for the current environment.
+ *
+ * Resolution order:
+ *   1. ACTOR_TOKEN_SIGNING_KEY env var (hex-encoded, set by CLI for Docker)
+ *   2. File-based load/create (~/.vellum/protected/actor-token-signing-key)
+ */
+export function resolveSigningKey(): Buffer {
+  const envKey = process.env.ACTOR_TOKEN_SIGNING_KEY;
+  if (envKey) {
+    if (!/^[0-9a-f]{64}$/i.test(envKey)) {
+      throw new Error(
+        `Invalid ACTOR_TOKEN_SIGNING_KEY: expected 64 hex characters, got ${envKey.length} chars`,
+      );
+    }
+    log.info("Signing key loaded from ACTOR_TOKEN_SIGNING_KEY env var");
+    return Buffer.from(envKey, "hex");
+  }
+
+  return loadOrCreateSigningKey();
+}
+
 function getSigningKey(): Buffer {
   if (!_authSigningKey) {
     if (process.env.NODE_ENV === "test") {
@@ -113,7 +151,7 @@ export function isSigningKeyInitialized(): boolean {
 
 /**
  * Returns a short hex fingerprint of the current signing key.
- * Used by daemon_status to let clients detect instance switches.
+ * Used by assistant_status to let clients detect instance switches.
  */
 export function getSigningKeyFingerprint(): string {
   return createHash("sha256")

package/src/runtime/channel-readiness-service.ts

@@ -15,7 +15,6 @@ import type {
   ReadinessCheckResult,
   SetupStatus,
 } from "./channel-readiness-types.js";
-import { probeLocalGatewayHealth } from "./local-gateway-health.js";
 
 /** Remote check results are cached for 5 minutes before being considered stale. */
 export const REMOTE_TTL_MS = 5 * 60 * 1000;
@@ -82,7 +81,7 @@ const voiceProbe: ChannelProbe = {
     const hasPhone = !!resolveTwilioPhoneNumber();
     const ingress = checkIngress();
 
-    const checks: ReadinessCheckResult[] = [
+    return [
       check(
         "twilio_credentials",
         hasCreds,
@@ -97,20 +96,6 @@ const voiceProbe: ChannelProbe = {
       ),
       ingress,
     ];
-
-    if (ingress.passed) {
-      const gw = await probeLocalGatewayHealth();
-      checks.push(
-        check(
-          "gateway_health",
-          gw.healthy,
-          `Local gateway is serving requests at ${gw.target}`,
-          `Local gateway is not serving requests at ${gw.target}${gw.error ? `: ${gw.error}` : ""}`,
-        ),
-      );
-    }
-
-    return checks;
   },
 };
 

package/src/runtime/http-server.ts

@@ -106,6 +106,7 @@ import { handleServePage } from "./routes/app-routes.js";
 import { appRouteDefinitions } from "./routes/app-routes.js";
 import { approvalRouteDefinitions } from "./routes/approval-routes.js";
 import { attachmentRouteDefinitions } from "./routes/attachment-routes.js";
+import { handleGetAudio } from "./routes/audio-routes.js";
 import { avatarRouteDefinitions } from "./routes/avatar-routes.js";
 import { brainGraphRouteDefinitions } from "./routes/brain-graph-routes.js";
 import { btwRouteDefinitions } from "./routes/btw-routes.js";
@@ -144,16 +145,19 @@ import { handleGuardianRefresh } from "./routes/guardian-refresh-routes.js";
 import { hostBashRouteDefinitions } from "./routes/host-bash-routes.js";
 import { hostCuRouteDefinitions } from "./routes/host-cu-routes.js";
 import { hostFileRouteDefinitions } from "./routes/host-file-routes.js";
-import { handleHealth } from "./routes/identity-routes.js";
+import { handleHealth, handleReadyz } from "./routes/identity-routes.js";
 import { identityRouteDefinitions } from "./routes/identity-routes.js";
 import { slackChannelRouteDefinitions } from "./routes/integrations/slack/channel.js";
 import { slackShareRouteDefinitions } from "./routes/integrations/slack/share.js";
 import { telegramRouteDefinitions } from "./routes/integrations/telegram.js";
 import { twilioRouteDefinitions } from "./routes/integrations/twilio.js";
+import { vercelRouteDefinitions } from "./routes/integrations/vercel.js";
 import { inviteRouteDefinitions } from "./routes/invite-routes.js";
 import { logExportRouteDefinitions } from "./routes/log-export-routes.js";
 import { memoryItemRouteDefinitions } from "./routes/memory-item-routes.js";
+import { migrationRollbackRouteDefinitions } from "./routes/migration-rollback-routes.js";
 import { migrationRouteDefinitions } from "./routes/migration-routes.js";
+import { notificationRouteDefinitions } from "./routes/notification-routes.js";
 import { oauthAppsRouteDefinitions } from "./routes/oauth-apps.js";
 import type { PairingHandlerContext } from "./routes/pairing-routes.js";
 import {
@@ -172,9 +176,12 @@ import { surfaceContentRouteDefinitions } from "./routes/surface-content-routes.
 import { telemetryRouteDefinitions } from "./routes/telemetry-routes.js";
 import { traceEventRouteDefinitions } from "./routes/trace-event-routes.js";
 import { trustRulesRouteDefinitions } from "./routes/trust-rules-routes.js";
+import { ttsRouteDefinitions } from "./routes/tts-routes.js";
+import { upgradeBroadcastRouteDefinitions } from "./routes/upgrade-broadcast-routes.js";
 import { usageRouteDefinitions } from "./routes/usage-routes.js";
 import { watchRouteDefinitions } from "./routes/watch-routes.js";
 import { workItemRouteDefinitions } from "./routes/work-items-routes.js";
+import { workspaceCommitRouteDefinitions } from "./routes/workspace-commit-routes.js";
 import { workspaceRouteDefinitions } from "./routes/workspace-routes.js";
 
 // Re-export for consumers
@@ -463,7 +470,10 @@ export class RuntimeHttpServer {
     server.timeout(req, 1800);
     // Skip request logging for health-check probes to reduce log noise.
     const url = new URL(req.url);
-    if (url.pathname === "/healthz" && req.method === "GET") {
+    if (
+      (url.pathname === "/healthz" || url.pathname === "/readyz") &&
+      req.method === "GET"
+    ) {
       return this.routeRequest(req, server);
     }
     return withRequestLogging(req, () => this.routeRequest(req, server));
@@ -480,6 +490,10 @@ export class RuntimeHttpServer {
       return handleHealth();
     }
 
+    if (path === "/readyz" && req.method === "GET") {
+      return handleReadyz();
+    }
+
     // WebSocket upgrade for the Chrome extension browser relay.
     if (
       path === "/v1/browser-relay" &&
@@ -502,6 +516,13 @@ export class RuntimeHttpServer {
     const twilioResponse = await this.handleTwilioWebhook(req, path);
     if (twilioResponse) return twilioResponse;
 
+    // Audio serving endpoint — before auth check because Twilio
+    // fetches these URLs directly. The audioId is an unguessable UUID.
+    const audioMatch = path.match(/^\/v1\/audio\/([^/]+)$/);
+    if (audioMatch && req.method === "GET") {
+      return handleGetAudio(audioMatch[1]);
+    }
+
     // Pairing endpoints (unauthenticated, secret-gated)
     if (path === "/v1/pairing/request" && req.method === "POST") {
       return await handlePairingRequest(req, this.pairingContext);
@@ -918,6 +939,9 @@ export class RuntimeHttpServer {
         getCesClient: this.getCesClient,
       }),
       ...identityRouteDefinitions(),
+      ...upgradeBroadcastRouteDefinitions(),
+      ...workspaceCommitRouteDefinitions(),
+      ...migrationRollbackRouteDefinitions(),
       ...debugRouteDefinitions(),
       ...usageRouteDefinitions(),
       ...telemetryRouteDefinitions(),
@@ -929,6 +953,7 @@ export class RuntimeHttpServer {
       ...scheduleRouteDefinitions({
         sendMessageDeps: this.sendMessageDeps,
       }),
+      ...notificationRouteDefinitions(),
       ...diagnosticsRouteDefinitions(),
       ...logExportRouteDefinitions(),
       ...documentRouteDefinitions(),
@@ -959,6 +984,7 @@ export class RuntimeHttpServer {
             }
           : undefined,
       }),
+      ...ttsRouteDefinitions(),
 
       // Browser relay — not extracted into a domain module because
       // these two routes depend on the in-process extensionRelayServer
@@ -1163,6 +1189,7 @@ export class RuntimeHttpServer {
       ...slackChannelRouteDefinitions(),
       ...slackShareRouteDefinitions(),
       ...twilioRouteDefinitions(),
+      ...vercelRouteDefinitions(),
       ...channelReadinessRouteDefinitions(),
       ...oauthAppsRouteDefinitions(),
       ...attachmentRouteDefinitions(),

package/src/runtime/middleware/error-handler.ts

@@ -4,7 +4,6 @@
 
 import {
   ConfigError,
-  IngressBlockedError,
   ProviderNotConfiguredError,
 } from "../../util/errors.js";
 import { getLogger } from "../../util/logger.js";
@@ -14,7 +13,7 @@ const log = getLogger("runtime-http");
 
 /**
  * Wrap an async endpoint handler with standard error handling.
- * Catches IngressBlockedError (422), ConfigError (422), and generic errors (500).
+ * Catches ConfigError (422) and generic errors (500).
  */
 export async function withErrorHandling(
   endpoint: string,
@@ -23,13 +22,6 @@ export async function withErrorHandling(
   try {
     return await handler();
   } catch (err) {
-    if (err instanceof IngressBlockedError) {
-      log.warn(
-        { endpoint, detectedTypes: err.detectedTypes },
-        "Blocked HTTP request containing secrets",
-      );
-      return httpError("UNPROCESSABLE_ENTITY", err.message, 422);
-    }
     if (err instanceof ProviderNotConfiguredError) {
       log.warn({ err, endpoint }, "No LLM provider configured");
       return httpError(

package/src/runtime/routes/audio-routes.ts

@@ -0,0 +1,40 @@
+/**
+ * HTTP route handler for serving synthesized TTS audio.
+ *
+ * GET /v1/audio/:audioId — retrieve a previously stored audio segment.
+ *
+ * This endpoint is unauthenticated because Twilio fetches audio URLs
+ * directly; the audioId itself is an unguessable UUID that acts as a
+ * capability token.
+ */
+
+import { getAudio } from "../../calls/audio-store.js";
+import { httpError } from "../http-errors.js";
+
+/**
+ * Handle GET /v1/audio/:audioId.
+ *
+ * Returns the audio with its stored Content-Type. For complete audio,
+ * includes Content-Length for efficient playback. For in-progress
+ * streaming entries, uses chunked transfer encoding.
+ */
+export function handleGetAudio(audioId: string): Response {
+  const entry = getAudio(audioId);
+  if (!entry) {
+    return httpError("NOT_FOUND", "Audio not found", 404);
+  }
+  if (entry.type === "buffer") {
+    return new Response(new Uint8Array(entry.buffer), {
+      status: 200,
+      headers: {
+        "Content-Type": entry.contentType,
+        "Content-Length": entry.buffer.length.toString(),
+      },
+    });
+  }
+  // Streaming — Content-Length unknown, chunked transfer encoding
+  return new Response(entry.stream, {
+    status: 200,
+    headers: { "Content-Type": entry.contentType },
+  });
+}

package/src/runtime/routes/btw-routes.ts

@@ -15,7 +15,6 @@
 import { existsSync, readFileSync } from "node:fs";
 
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
-import { checkIngressForSecrets } from "../../security/secret-ingress.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspacePromptPath } from "../../util/platform.js";
 import type { AuthContext } from "../auth/types.js";
@@ -89,22 +88,6 @@ async function handleBtw(
   }
 
   const trimmedContent = content.trim();
-  const ingressCheck = checkIngressForSecrets(trimmedContent);
-  if (ingressCheck.blocked) {
-    log.warn(
-      { detectedTypes: ingressCheck.detectedTypes },
-      "Blocked /v1/btw message containing secrets",
-    );
-    return Response.json(
-      {
-        accepted: false,
-        error: "secret_blocked",
-        message: ingressCheck.userNotice,
-        detectedTypes: ingressCheck.detectedTypes,
-      },
-      { status: 422 },
-    );
-  }
 
   // ----- Identity intro fast-path -----
   // When the client requests the identity intro, check SOUL.md first (persisted

package/src/runtime/routes/conversation-management-routes.ts

@@ -275,24 +275,6 @@ export function conversationManagementRouteDefinitions(
             targetId: summaryId,
           });
         }
-        for (const obsId of result.deletedObservationIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "observation",
-            targetId: obsId,
-          });
-        }
-        for (const chunkId of result.deletedChunkIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "chunk",
-            targetId: chunkId,
-          });
-        }
-        for (const episodeId of result.deletedEpisodeIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "episode",
-            targetId: episodeId,
-          });
-        }
         log.info(
           {
             conversationId: resolvedId,
@@ -349,24 +331,6 @@ export function conversationManagementRouteDefinitions(
             targetId: summaryId,
           });
         }
-        for (const obsId of deleted.deletedObservationIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "observation",
-            targetId: obsId,
-          });
-        }
-        for (const chunkId of deleted.deletedChunkIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "chunk",
-            targetId: chunkId,
-          });
-        }
-        for (const episodeId of deleted.deletedEpisodeIds) {
-          enqueueMemoryJob("delete_qdrant_vectors", {
-            targetType: "episode",
-            targetId: episodeId,
-          });
-        }
         log.info({ conversationId: resolvedId }, "Deleted conversation");
         return new Response(null, { status: 204 });
       },