@vellumai/assistant 0.6.2 → 0.6.4

package/src/runtime/routes/oauth-apps.ts

@@ -60,8 +60,8 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
       endpoint: "oauth/apps",
       method: "GET",
       handler: ({ url }) => {
-        const providerKey = url.searchParams.get("provider_key");
-        if (!providerKey) {
+        const provider = url.searchParams.get("provider_key");
+        if (!provider) {
           return httpError(
             "BAD_REQUEST",
             "provider_key query parameter is required",
@@ -70,20 +70,18 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
         }
 
         const allApps = listApps();
-        const filtered = allApps.filter(
-          (row) => row.providerKey === providerKey,
-        );
+        const filtered = allApps.filter((row) => row.provider === provider);
 
-        const providerRow = getProvider(providerKey);
-        const provider = providerRow
+        const providerRow = getProvider(provider);
+        const providerSummary = providerRow
           ? serializeProviderSummary(providerRow)
           : null;
 
         return Response.json({
-          provider,
+          provider: providerSummary,
           apps: filtered.map((row) => ({
             id: row.id,
-            provider_key: row.providerKey,
+            provider_key: row.provider,
             client_id: row.clientId,
             created_at: row.createdAt,
             updated_at: row.updatedAt,
@@ -138,7 +136,7 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
           {
             app: {
               id: app.id,
-              provider_key: app.providerKey,
+              provider_key: app.provider,
               client_id: app.clientId,
               created_at: app.createdAt,
               updated_at: app.updatedAt,
@@ -165,9 +163,9 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
         }
 
         // Disconnect all connections for this app first to clean up tokens.
-        const connections = listConnections(app.providerKey, app.clientId);
+        const connections = listConnections(app.provider, app.clientId);
         for (const conn of connections) {
-          await disconnectOAuthProvider(app.providerKey, app.clientId, conn.id);
+          await disconnectOAuthProvider(app.provider, app.clientId, conn.id);
         }
 
         await deleteApp(params.id);
@@ -190,12 +188,12 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
           );
         }
 
-        const connections = listConnections(app.providerKey, app.clientId);
+        const connections = listConnections(app.provider, app.clientId);
 
         return Response.json({
           connections: connections.map((row) => ({
             id: row.id,
-            provider_key: row.providerKey,
+            provider_key: row.provider,
             account_info: row.accountInfo,
             granted_scopes: parseGrantedScopes(row.grantedScopes),
             status: row.status,
@@ -223,7 +221,7 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
         }
 
         const result = await disconnectOAuthProvider(
-          conn.providerKey,
+          conn.provider,
           undefined,
           conn.id,
         );
@@ -282,7 +280,7 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
         const clientSecret = await getAppClientSecret(app);
 
         const result = await orchestrateOAuthConnect({
-          service: app.providerKey,
+          service: app.provider,
           clientId: app.clientId,
           clientSecret,
           requestedScopes: body.scopes,
@@ -292,7 +290,7 @@ export function oauthAppsRouteDefinitions(): RouteDefinition[] {
 
         if (result.success && result.deferred) {
           return Response.json({
-            auth_url: result.authUrl,
+            auth_url: result.authorizeUrl,
             state: result.state,
           });
         }

package/src/runtime/routes/oauth-providers.ts

@@ -44,6 +44,10 @@ export function oauthProvidersRouteDefinitions(): RouteDefinition[] {
     },
 
     // GET /v1/oauth/providers/:providerKey — Get a single provider.
+    // The path parameter name `providerKey` is preserved for backward
+    // compatibility with the published OpenAPI spec (operationId
+    // `oauth_providers_by_providerKey_get`). The actual URL the client hits
+    // (`/v1/oauth/providers/google`) is unchanged either way.
     {
       endpoint: "oauth/providers/:providerKey",
       method: "GET",

package/src/runtime/routes/schedule-routes.ts

@@ -25,6 +25,10 @@ import type { RouteDefinition } from "../http-router.js";
 import type { SendMessageDeps } from "../http-types.js";
 
 const log = getLogger("schedule-routes");
+const SCHEDULE_GUARDIAN_TRUST_CONTEXT = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+} as const;
 
 // ---------------------------------------------------------------------------
 // Handlers
@@ -202,17 +206,23 @@ async function handleRunScheduleNow(
             );
           }
           const conversation =
-            await sendMessageDeps.getOrCreateConversation(conversationId);
+            await sendMessageDeps.getOrCreateConversation(conversationId, {
+              trustContext: SCHEDULE_GUARDIAN_TRUST_CONTEXT,
+            });
           conversation.taskRunId = taskRunId;
-          await conversation.processMessage(
-            message,
-            [],
-            () => {}, // no event callback for HTTP mode
-            undefined,
-            undefined,
-            undefined,
-            { isInteractive: false },
-          );
+          try {
+            await conversation.processMessage(
+              message,
+              [],
+              () => {}, // no event callback for HTTP mode
+              undefined,
+              undefined,
+              undefined,
+              { isInteractive: false },
+            );
+          } finally {
+            conversation.taskRunId = undefined;
+          }
         },
       );
 
@@ -276,7 +286,10 @@ async function handleRunScheduleNow(
       throw new Error("sendMessageDeps not available for schedule execution");
     }
     const activeConversation =
-      await sendMessageDeps.getOrCreateConversation(conversationId);
+      await sendMessageDeps.getOrCreateConversation(conversationId, {
+        trustContext: SCHEDULE_GUARDIAN_TRUST_CONTEXT,
+      });
+    activeConversation.taskRunId = undefined;
     await activeConversation.processMessage(
       schedule.message,
       [],

package/src/runtime/routes/settings-routes.ts

@@ -8,20 +8,15 @@
  */
 
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 
 import { z } from "zod";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import {
   getPlatformBaseUrl,
   setIngressPublicBaseUrl,
 } from "../../config/env.js";
-import {
-  getConfig,
-  loadRawConfig,
-  saveRawConfig,
-} from "../../config/loader.js";
+import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import { loadSkillCatalog } from "../../config/skills.js";
 import {
   computeGatewayTarget,
@@ -41,12 +36,8 @@ import {
   generateAllowlistOptions,
   generateScopeOptions,
 } from "../../permissions/checker.js";
-import {
-  getMode,
-  onModeChanged,
-  setAskBeforeActing,
-  setHostAccess,
-} from "../../permissions/permission-mode-store.js";
+import { resolveGuardianPersonaPath } from "../../prompts/persona-resolver.js";
+import type { ToolDefinition } from "../../providers/types.js";
 import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { parseToolManifestFile } from "../../skills/tool-manifest.js";
 import {
@@ -72,24 +63,6 @@ import { resolveWorkspacePath } from "./workspace-utils.js";
 
 const log = getLogger("settings-routes");
 
-// ---------------------------------------------------------------------------
-// Permission mode SSE broadcast
-// ---------------------------------------------------------------------------
-
-onModeChanged((mode) => {
-  assistantEventHub
-    .publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {
-        type: "permission_mode_update",
-        askBeforeActing: mode.askBeforeActing,
-        hostAccess: mode.hostAccess,
-      }),
-    )
-    .catch((err) => {
-      log.warn({ err }, "Failed to publish permission_mode_update event");
-    });
-});
-
 // ---------------------------------------------------------------------------
 // Voice config
 // ---------------------------------------------------------------------------
@@ -240,7 +213,7 @@ async function handleOAuthConnectStart(body: {
   try {
     // For HTTP, we cannot send `open_url` mid-request. The auth URL is
     // returned to the client to open.
-    let authUrl: string | undefined;
+    let authorizeUrl: string | undefined;
 
     const result = await orchestrateOAuthConnect({
       service,
@@ -250,7 +223,7 @@ async function handleOAuthConnectStart(body: {
       callbackTransport: "loopback",
       isInteractive: true,
       openUrl: (url: string) => {
-        authUrl = url;
+        authorizeUrl = url;
       },
       onDeferredComplete: (deferredResult) => {
         // Prefer accountInfo from oauth-store when available.
@@ -309,7 +282,9 @@ async function handleOAuthConnectStart(body: {
       return Response.json({
         ok: true,
         deferred: true,
-        authUrl: result.authUrl,
+        // Wire key stays `authUrl` for backward compatibility with existing
+        // clients; the internal field on `result` is `authorizeUrl`.
+        authUrl: result.authorizeUrl,
       });
     }
 
@@ -326,7 +301,9 @@ async function handleOAuthConnectStart(body: {
       ok: true,
       grantedScopes: result.grantedScopes,
       accountInfo: responseAccountInfo,
-      ...(authUrl ? { authUrl } : {}),
+      // Wire key stays `authUrl` for backward compatibility with existing
+      // clients; the local variable was renamed to `authorizeUrl`.
+      ...(authorizeUrl ? { authUrl: authorizeUrl } : {}),
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -339,16 +316,31 @@ async function handleOAuthConnectStart(body: {
 // Workspace files (list/read)
 // ---------------------------------------------------------------------------
 
-const WORKSPACE_FILES = ["IDENTITY.md", "SOUL.md", "USER.md", "skills/"];
+/**
+ * Build the list of workspace files exposed via the workspace-files endpoint.
+ *
+ * Returns the static identity/soul files and skills directory plus the
+ * guardian's resolved per-user persona file at `users/<slug>.md` when a
+ * guardian exists. Callers should invoke this per-request instead of
+ * caching, since the guardian can change over the lifetime of the daemon.
+ */
+function getWorkspaceFiles(): string[] {
+  const files = ["IDENTITY.md", "SOUL.md", "skills/"];
+  const guardianPath = resolveGuardianPersonaPath();
+  if (guardianPath) {
+    files.push(`users/${basename(guardianPath)}`);
+  }
+  return files;
+}
 
 function handleWorkspaceFilesList(): Response {
   const base = getWorkspaceDir();
-  const files = WORKSPACE_FILES.map((name) => ({
+  const files = getWorkspaceFiles().map((name) => ({
     path: name,
     name,
     exists: pathExists(join(base, name)),
   }));
-  return Response.json({ files });
+  return Response.json({ type: "workspace_files_list_response", files });
 }
 
 function handleWorkspaceFileRead(requestedPath: string): Response {
@@ -414,7 +406,7 @@ function handleToolNamesList(): Response {
   const schemas: Record<string, SchemaShape> = {};
 
   // Collect raw definitions from the registry so we can transform them.
-  const rawDefs: import("../../providers/types.js").ToolDefinition[] = [];
+  const rawDefs: ToolDefinition[] = [];
   for (const tool of tools) {
     try {
       rawDefs.push(tool.getDefinition());
@@ -921,68 +913,5 @@ export function settingsRouteDefinitions(): RouteDefinition[] {
         }
       },
     },
-
-    // Permission mode (GET always available; PUT gated on feature flag)
-    {
-      endpoint: "permission-mode",
-      method: "GET",
-      policyKey: "permission-mode:GET",
-      summary: "Get permission mode",
-      description:
-        "Return the current two-axis permission mode (askBeforeActing, hostAccess).",
-      tags: ["settings"],
-      responseBody: z.object({
-        askBeforeActing: z.boolean(),
-        hostAccess: z.boolean(),
-      }),
-      handler: () => {
-        const mode = getMode();
-        return Response.json({
-          askBeforeActing: mode.askBeforeActing,
-          hostAccess: mode.hostAccess,
-        });
-      },
-    },
-    {
-      endpoint: "permission-mode",
-      method: "PUT",
-      policyKey: "permission-mode",
-      summary: "Update permission mode",
-      description:
-        "Update the two-axis permission mode. Requires the permission-controls-v2 feature flag.",
-      tags: ["settings"],
-      requestBody: z.object({
-        askBeforeActing: z.boolean().optional(),
-        hostAccess: z.boolean().optional(),
-      }),
-      responseBody: z.object({
-        askBeforeActing: z.boolean(),
-        hostAccess: z.boolean(),
-      }),
-      handler: async ({ req }) => {
-        const config = getConfig();
-        if (!isAssistantFeatureFlagEnabled("permission-controls-v2", config)) {
-          return httpError("NOT_FOUND", "Not found", 404);
-        }
-
-        const body = (await req.json()) as {
-          askBeforeActing?: boolean;
-          hostAccess?: boolean;
-        };
-
-        if (typeof body.askBeforeActing === "boolean") {
-          setAskBeforeActing(body.askBeforeActing);
-        }
-        if (typeof body.hostAccess === "boolean") {
-          setHostAccess(body.hostAccess);
-        }
-
-        const mode = getMode();
-        return Response.json({
-          askBeforeActing: mode.askBeforeActing,
-          hostAccess: mode.hostAccess,
-        });
-      },
-    },
   ];
 }

package/src/runtime/routes/skills-routes.ts

@@ -19,11 +19,12 @@ import {
   draftSkill,
   enableSkill,
   getSkill,
+  getSkillFileContent,
   getSkillFiles,
   inspectSkill,
   installSkill,
   listSkills,
-  listSkillsWithCatalog,
+  listSkillsFiltered,
   searchSkills,
   uninstallSkill,
   updateSkill,
@@ -39,6 +40,13 @@ export interface SkillRouteDeps {
   getSkillContext: () => SkillOperationContext;
 }
 
+const partnerAuditSchema = z.object({
+  risk: z.enum(["safe", "low", "medium", "high", "critical", "unknown"]),
+  alerts: z.number().optional(),
+  score: z.number().optional(),
+  analyzedAt: z.string(),
+});
+
 const slimSkillBase = {
   id: z.string(),
   name: z.string(),
@@ -59,6 +67,7 @@ const slimSkillSchema = z.discriminatedUnion("origin", [
     installs: z.number(),
     reports: z.number(),
     publishedAt: z.string().optional(),
+    version: z.string(),
   }),
   z.object({
     ...slimSkillBase,
@@ -66,6 +75,7 @@ const slimSkillSchema = z.discriminatedUnion("origin", [
     slug: z.string(),
     sourceRepo: z.string(),
     installs: z.number(),
+    audit: z.record(z.string(), partnerAuditSchema).optional(),
   }),
   z.object({ ...slimSkillBase, origin: z.literal("custom") }),
 ]);
@@ -81,6 +91,7 @@ const skillDetailSchema = z.discriminatedUnion("origin", [
     installs: z.number(),
     reports: z.number(),
     publishedAt: z.string().optional(),
+    version: z.string(),
     owner: z
       .object({
         handle: z.string(),
@@ -114,6 +125,7 @@ const skillDetailSchema = z.discriminatedUnion("origin", [
     slug: z.string(),
     sourceRepo: z.string(),
     installs: z.number(),
+    audit: z.record(z.string(), partnerAuditSchema).optional(),
   }),
   z.object({ ...slimSkillBase, origin: z.literal("custom") }),
 ]);
@@ -128,7 +140,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
       policyKey: "skills",
       summary: "List all skills",
       description:
-        "Return all installed skills. Pass ?include=catalog to also include available catalog skills.",
+        "Return all installed skills. Pass ?include=catalog to also include available catalog skills. Supports optional filter params: origin, kind, q, category.",
       tags: ["skills"],
       queryParams: [
         {
@@ -137,20 +149,126 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
           description:
             "Optional inclusion flag. Use 'catalog' to merge available Vellum catalog skills into the response.",
         },
+        {
+          name: "origin",
+          schema: { type: "string" },
+          description:
+            "Filter by skill origin (e.g. 'vellum', 'clawhub', 'skillssh', 'custom').",
+        },
+        {
+          name: "kind",
+          schema: { type: "string" },
+          description:
+            "Filter by kind: 'installed' (includes bundled), 'available', or pass through as skill.kind.",
+        },
+        {
+          name: "q",
+          schema: { type: "string" },
+          description:
+            "Text search across skill name, description, id, and origin label.",
+        },
+        {
+          name: "category",
+          schema: { type: "string" },
+          description:
+            "Filter by inferred category (e.g. 'communication', 'productivity').",
+        },
       ],
       responseBody: z.object({
         skills: z.array(slimSkillSchema).describe("Skill objects"),
+        categoryCounts: z
+          .record(z.string(), z.number())
+          .optional()
+          .describe(
+            "Count of skills per category (before category filter is applied)",
+          ),
+        totalCount: z
+          .number()
+          .optional()
+          .describe("Total number of skills matching non-category filters"),
       }),
       handler: async ({ url }) => {
         const include = url.searchParams.get("include");
-        const skills =
-          include === "catalog"
-            ? await listSkillsWithCatalog(ctx())
-            : listSkills(ctx());
+        const origin = url.searchParams.get("origin");
+        const kind = url.searchParams.get("kind");
+        const q = url.searchParams.get("q");
+        const category = url.searchParams.get("category");
+
+        const hasFilter = !!(origin || kind || q || category);
+
+        if (hasFilter || include === "catalog") {
+          const result = await listSkillsFiltered(
+            {
+              ...(origin ? { origin } : {}),
+              ...(kind ? { kind } : {}),
+              ...(q ? { q } : {}),
+              ...(category ? { category } : {}),
+              includeCatalog: include === "catalog",
+            },
+            ctx(),
+          );
+          return Response.json({
+            skills: result.skills,
+            categoryCounts: result.categoryCounts,
+            totalCount: result.totalCount,
+          });
+        }
+
+        // No filter params and include !== catalog: preserve existing behavior
+        const skills = listSkills(ctx());
         return Response.json({ skills });
       },
     },
 
+    // The router uses strict anchored-regex matching, so this route is never
+    // ambiguous with skills/:id/files.
+    {
+      endpoint: "skills/:id/files/content",
+      method: "GET",
+      policyKey: "skills",
+      summary: "Get skill file content",
+      description:
+        "Return the content of a single file belonging to an installed or catalog skill.",
+      tags: ["skills"],
+      queryParams: [
+        {
+          name: "path",
+          schema: { type: "string" },
+          required: true,
+          description: "Relative path of the file within the skill directory",
+        },
+      ],
+      responseBody: z.object({
+        path: z.string(),
+        name: z.string(),
+        size: z.number().int(),
+        mimeType: z.string(),
+        isBinary: z.boolean(),
+        content: z.string().nullable(),
+      }),
+      handler: async ({ params, url }) => {
+        const path = url.searchParams.get("path");
+        if (!path) {
+          return httpError(
+            "BAD_REQUEST",
+            "path query parameter is required",
+            400,
+          );
+        }
+        const result = await getSkillFileContent(params.id, path, ctx());
+        if ("error" in result) {
+          if (result.status === 400) {
+            return httpError("BAD_REQUEST", result.error, 400);
+          }
+          if (result.status === 404) {
+            return httpError("NOT_FOUND", result.error, 404);
+          }
+          return httpError("INTERNAL_ERROR", result.error, 500);
+        }
+        return Response.json(result);
+      },
+    },
+
     {
       endpoint: "skills/:id/files",
       method: "GET",
@@ -158,8 +276,8 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
       summary: "Get skill files",
       description: "Return skill metadata and directory contents.",
       tags: ["skills"],
-      handler: ({ params }) => {
-        const result = getSkillFiles(params.id, ctx());
+      handler: async ({ params }) => {
+        const result = await getSkillFiles(params.id, ctx());
         if ("error" in result) {
           if (result.status === 404) {
             return httpError("NOT_FOUND", result.error, 404);
@@ -262,6 +380,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
       }),
       responseBody: z.object({
         ok: z.boolean(),
+        skillId: z.string().optional(),
       }),
       handler: async ({ req, authContext }) => {
         const body = (await req.json()) as {
@@ -287,7 +406,7 @@ export function skillRouteDefinitions(deps: SkillRouteDeps): RouteDefinition[] {
         if (!result.success) {
           return httpError("INTERNAL_ERROR", result.error, 500);
         }
-        return Response.json({ ok: true });
+        return Response.json({ ok: true, skillId: result.skillId });
       },
     },