@vellumai/assistant 0.6.6 → 0.7.0

package/src/runtime/routes/integrations/vercel.ts

@@ -14,76 +14,79 @@ import {
   getVercelConfig,
   setVercelConfig,
 } from "../../../daemon/handlers/config-vercel.js";
-import type { RouteDefinition } from "../../http-router.js";
+import { BadRequestError } from "../errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
-/**
- * GET /v1/integrations/vercel/config
- */
-export async function handleGetVercelConfig(): Promise<Response> {
-  const result = await getVercelConfig();
-  return Response.json(result);
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+async function handleGetVercelConfig() {
+  return getVercelConfig();
 }
 
-/**
- * POST /v1/integrations/vercel/config
- *
- * Body: { action: "set" | "delete"; apiToken?: string }
- *
- * The Swift client uses POST for both set and delete operations,
- * distinguished by the `action` field.
- */
-export async function handlePostVercelConfig(req: Request): Promise<Response> {
-  const body = (await req.json()) as {
+async function handlePostVercelConfig({ body = {} }: RouteHandlerArgs) {
+  const { action, apiToken } = body as {
     action?: "get" | "set" | "delete";
     apiToken?: string;
   };
 
-  switch (body.action) {
-    case "delete": {
-      const result = await deleteVercelConfig();
-      return Response.json(result);
-    }
-    case "get": {
-      const result = await getVercelConfig();
-      return Response.json(result);
-    }
+  switch (action) {
+    case "delete":
+      return deleteVercelConfig();
+    case "get":
+      return getVercelConfig();
     case "set":
     default: {
-      const result = await setVercelConfig(body.apiToken);
-      const status = result.success ? 200 : 400;
-      return Response.json(result, { status });
+      const result = await setVercelConfig(apiToken);
+      if (!result.success) {
+        throw new BadRequestError(
+          (result as { error?: string }).error ?? "Failed to set Vercel config",
+        );
+      }
+      return result;
     }
   }
 }
 
-/**
- * DELETE /v1/integrations/vercel/config
- */
-export async function handleDeleteVercelConfig(): Promise<Response> {
-  const result = await deleteVercelConfig();
-  return Response.json(result);
+async function handleDeleteVercelConfig() {
+  return deleteVercelConfig();
 }
 
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
 
-export function vercelRouteDefinitions(): RouteDefinition[] {
-  return [
-    {
-      endpoint: "integrations/vercel/config",
-      method: "GET",
-      handler: () => handleGetVercelConfig(),
-    },
-    {
-      endpoint: "integrations/vercel/config",
-      method: "POST",
-      handler: async ({ req }) => handlePostVercelConfig(req),
-    },
-    {
-      endpoint: "integrations/vercel/config",
-      method: "DELETE",
-      handler: async () => handleDeleteVercelConfig(),
-    },
-  ];
-}
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "integrations_vercel_config_get",
+    endpoint: "integrations/vercel/config",
+    method: "GET",
+    summary: "Get Vercel config",
+    description: "Check if a Vercel API token is stored.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleGetVercelConfig(),
+  },
+  {
+    operationId: "integrations_vercel_config_post",
+    endpoint: "integrations/vercel/config",
+    method: "POST",
+    summary: "Set or delete Vercel config",
+    description:
+      "Set or delete the Vercel API token. Action is determined by the body action field.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handlePostVercelConfig,
+  },
+  {
+    operationId: "integrations_vercel_config_delete",
+    endpoint: "integrations/vercel/config",
+    method: "DELETE",
+    summary: "Delete Vercel config",
+    description: "Delete the stored Vercel API token.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleDeleteVercelConfig(),
+  },
+];

package/src/runtime/routes/interface-routes.ts

@@ -0,0 +1,43 @@
+/**
+ * GET /v1/interfaces/:path*
+ *
+ * Serves interface definition files from the workspace's `interfaces/`
+ * directory. Returns the raw file content as `text/plain`.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { getInterfacesDir } from "../../util/platform.js";
+import { NotFoundError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "getInterface",
+    endpoint: "interfaces/:path*",
+    method: "GET",
+    policyKey: "interfaces",
+    summary: "Serve an interface definition file",
+    tags: ["interfaces"],
+    responseHeaders: { "Content-Type": "text/plain; charset=utf-8" },
+    handler: ({ pathParams }) => {
+      const interfacePath = pathParams?.path;
+      if (!interfacePath) {
+        throw new NotFoundError("Interface not found");
+      }
+
+      const interfacesDir = getInterfacesDir();
+      const fullPath = resolve(interfacesDir, interfacePath);
+      if (
+        (fullPath !== interfacesDir &&
+          !fullPath.startsWith(interfacesDir + "/")) ||
+        !existsSync(fullPath)
+      ) {
+        throw new NotFoundError("Interface not found");
+      }
+
+      return readFileSync(fullPath, "utf-8");
+    },
+  },
+];

package/src/runtime/routes/internal-oauth-routes.ts

@@ -0,0 +1,56 @@
+/**
+ * Internal OAuth callback route — receives forwarded OAuth results from the
+ * gateway and resolves the corresponding pending callback promise in the
+ * assistant runtime.
+ */
+
+import { z } from "zod";
+
+import {
+  consumeCallback,
+  consumeCallbackError,
+} from "../../security/oauth-callback-registry.js";
+import { BadRequestError, NotFoundError } from "./errors.js";
+import type { RouteDefinition } from "./types.js";
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "internal_oauth_callback",
+    endpoint: "internal/oauth/callback",
+    method: "POST",
+    summary: "Internal OAuth callback",
+    description:
+      "Receives forwarded OAuth callback results (code or error) from the gateway and resolves the pending callback in the runtime.",
+    tags: ["internal"],
+    requestBody: z.object({
+      state: z.string(),
+      code: z.string().optional(),
+      error: z.string().optional(),
+    }),
+    handler: ({ body }) => {
+      const { state, code, error } = body as {
+        state: string;
+        code?: string;
+        error?: string;
+      };
+
+      if (!state) {
+        throw new BadRequestError("Missing state parameter");
+      }
+
+      if (error) {
+        const consumed = consumeCallbackError(state, error);
+        if (!consumed) throw new NotFoundError("Unknown state");
+        return { ok: true };
+      }
+
+      if (code) {
+        const consumed = consumeCallback(state, code);
+        if (!consumed) throw new NotFoundError("Unknown state");
+        return { ok: true };
+      }
+
+      throw new BadRequestError("Missing code or error parameter");
+    },
+  },
+];

package/src/runtime/routes/internal-twilio-routes.ts

@@ -0,0 +1,46 @@
+/**
+ * Internal Twilio webhook forwarding routes (gateway → runtime).
+ *
+ * These routes accept pre-parsed webhook payloads from the gateway
+ * and delegate to the core voice webhook logic in twilio-routes.ts.
+ */
+
+import {
+  handleInternalConnectAction,
+  handleInternalStatusCallback,
+  handleInternalVoiceWebhook,
+} from "../../calls/twilio-routes.js";
+import type { RouteDefinition } from "./types.js";
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "internal_twilio_voice_webhook",
+    endpoint: "internal/twilio/voice-webhook",
+    method: "POST",
+    summary: "Internal Twilio voice webhook",
+    description:
+      "Gateway-to-runtime forwarding for Twilio voice webhook. Accepts pre-parsed form params as JSON.",
+    tags: ["internal"],
+    handler: handleInternalVoiceWebhook,
+  },
+  {
+    operationId: "internal_twilio_status",
+    endpoint: "internal/twilio/status",
+    method: "POST",
+    summary: "Internal Twilio status callback",
+    description:
+      "Gateway-to-runtime forwarding for Twilio call status updates. Accepts pre-parsed form params as JSON.",
+    tags: ["internal"],
+    handler: handleInternalStatusCallback,
+  },
+  {
+    operationId: "internal_twilio_connect_action",
+    endpoint: "internal/twilio/connect-action",
+    method: "POST",
+    summary: "Internal Twilio connect-action",
+    description:
+      "Gateway-to-runtime forwarding for ConversationRelay connect-action callback.",
+    tags: ["internal"],
+    handler: handleInternalConnectAction,
+  },
+];

package/src/runtime/routes/llm-context-normalization.ts

@@ -466,6 +466,7 @@ function normalizeOpenAiResponsesResponsePayload(
   }
 
   const usage = asRecord(response.usage);
+  const inputTokensDetails = asRecord(usage?.input_tokens_details);
   const toolCallNames = toolCallSections
     .map((section) => section.toolName)
     .filter((name): name is string => typeof name === "string");
@@ -482,7 +483,7 @@ function normalizeOpenAiResponsesResponsePayload(
       inputTokens: asNumber(usage?.input_tokens),
       outputTokens: asNumber(usage?.output_tokens),
       cacheCreationInputTokens: undefined,
-      cacheReadInputTokens: undefined,
+      cacheReadInputTokens: asNumber(inputTokensDetails?.cached_tokens),
       stopReason,
       requestMessageCount: undefined,
       requestToolCount: undefined,
@@ -536,6 +537,7 @@ function normalizeOpenAiChatCompletionsResponsePayload(
   responseSections.push(...responseToolSections);
 
   const usage = asRecord(response.usage);
+  const promptTokensDetails = asRecord(usage?.prompt_tokens_details);
   const toolCallNames = responseToolSections
     .map((section) => section.toolName)
     .filter((name): name is string => typeof name === "string");
@@ -548,7 +550,7 @@ function normalizeOpenAiChatCompletionsResponsePayload(
       inputTokens: asNumber(usage?.prompt_tokens),
       outputTokens: asNumber(usage?.completion_tokens),
       cacheCreationInputTokens: undefined,
-      cacheReadInputTokens: undefined,
+      cacheReadInputTokens: asNumber(promptTokensDetails?.cached_tokens),
       stopReason: asString(firstChoice?.finish_reason),
       requestMessageCount: undefined,
       requestToolCount: undefined,

package/src/runtime/routes/log-export/workspace-allowlist.ts

@@ -39,7 +39,7 @@ const log = getLogger("log-export-workspace");
  * `log-export-routes.ts` so that the workspace section can never blow past
  * the same 10 MB cap that already governs the daemon-logs section.
  */
-export const MAX_WORKSPACE_PAYLOAD_BYTES = 10 * 1024 * 1024;
+const MAX_WORKSPACE_PAYLOAD_BYTES = 10 * 1024 * 1024;
 
 export interface CollectWorkspaceDataOptions {
   /** Absolute path of the export staging directory. */

package/src/runtime/routes/log-export-routes.ts

@@ -1,5 +1,5 @@
 /**
- * HTTP route handler for exporting audit data and daemon log files.
+ * Route handler for exporting audit data and daemon log files.
  *
  * A single POST /v1/export endpoint allows clients (e.g. macOS Export Logs)
  * to retrieve audit database records, daemon log files, and a sanitized
@@ -22,7 +22,7 @@ import { join } from "node:path";
 import { and, desc, eq, gte, lte } from "drizzle-orm";
 import { z } from "zod";
 
-import { getDb } from "../../memory/db.js";
+import { getDb } from "../../memory/db-connection.js";
 import {
   llmRequestLogs,
   llmUsageEvents,
@@ -36,10 +36,10 @@ import {
   getWorkspaceConfigPath,
 } from "../../util/platform.js";
 import { APP_VERSION, COMMIT_SHA } from "../../version.js";
-import { httpError } from "../http-errors.js";
-import type { RouteDefinition } from "../http-router.js";
 import { createTarGz } from "./archive-utils.js";
+import { InternalError } from "./errors.js";
 import { collectWorkspaceData } from "./log-export/workspace-allowlist.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("log-export-routes");
 
@@ -48,30 +48,30 @@ const MAX_LOG_PAYLOAD_BYTES = 10 * 1024 * 1024;
 
 interface ExportRequestBody {
   auditLimit?: number;
-  conversationId?: string; // scope to a single conversation
-  full?: boolean; // include all conversation data (messages + LLM logs) — use for test data debugging
-  startTime?: number; // epoch ms — lower bound (inclusive)
-  endTime?: number; // epoch ms — upper bound (inclusive)
+  conversationId?: string;
+  full?: boolean;
+  startTime?: number;
+  endTime?: number;
 }
 
 /**
  * Collect audit data, daemon log files, and a sanitized config snapshot,
  * then package everything into a tar.gz archive.
  *
- * Archive layout:
- *   audit-data.json                 — tool invocation records
- *   config-snapshot.json            — sanitized workspace config
- *   daemon-logs/<name>              — daemon log files
- *   workspace/conversations/<dir>/  — allowlisted workspace data (see ./log-export/AGENTS.md)
+ * Returns the archive as a Uint8Array — the HTTP adapter handles binary
+ * responses natively.
  */
-async function handleExport(body: ExportRequestBody): Promise<Response> {
+async function handleExport({
+  body = {},
+}: RouteHandlerArgs): Promise<Uint8Array> {
+  const { conversationId, full, startTime, endTime, auditLimit } =
+    body as ExportRequestBody;
+
   const staging = mkdtempSync(join(tmpdir(), "vellum-export-"));
 
   try {
-    const { conversationId, full, startTime, endTime } = body;
-
     // --- Audit data ---
-    const limit = body.auditLimit ?? 1000;
+    const limit = auditLimit ?? 1000;
     const db = getDb();
 
     const auditQuery = db.select().from(toolInvocations);
@@ -100,7 +100,6 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
     );
 
     // --- Conversation data tables ---
-    // Included when scoped to a single conversation OR when all conversations are requested.
     if (conversationId || full) {
       const conversationFilter = conversationId
         ? [eq(messages.conversationId, conversationId)]
@@ -182,13 +181,12 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
     if (existsSync(logsDir)) {
       const entries = readdirSync(logsDir);
       for (const entry of entries) {
-        // Filter dated log files by time range
         const dateMatch = entry.match(LOG_FILE_PATTERN);
         if (dateMatch && (startDate || endDate)) {
-          const fileDate = new Date(dateMatch[1] + "T23:59:59.999Z"); // end of day
+          const fileDate = new Date(dateMatch[1] + "T23:59:59.999Z");
           const fileDateStart = new Date(dateMatch[1] + "T00:00:00.000Z");
-          if (startDate && fileDate < startDate) continue; // entire day is before range
-          if (endDate && fileDateStart > endDate) continue; // entire day is after range
+          if (startDate && fileDate < startDate) continue;
+          if (endDate && fileDateStart > endDate) continue;
         }
         const filePath = join(logsDir, entry);
         try {
@@ -245,9 +243,6 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
         );
       }
 
-      // Remove full unfiltered log files — conversation-scoped exports
-      // should only include conversation-filtered.jsonl to avoid leaking
-      // data from unrelated conversations.
       for (const logFile of collectedLogFiles) {
         try {
           rmSync(logFile, { force: true });
@@ -258,9 +253,6 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
     }
 
     // --- Workspace allowlist ---
-    // Includes specific subpaths from <workspace>/ governed by the rules in
-    // ./log-export/AGENTS.md. Honors the same time + conversation filters as
-    // the rest of the export.
     const workspaceResult = collectWorkspaceData({
       staging,
       conversationId: conversationId || undefined,
@@ -315,23 +307,17 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
     );
 
     // --- Create tar.gz archive ---
-    const archiveBytes = createTarGz(staging);
-    if (!archiveBytes) {
-      return httpError("INTERNAL_ERROR", "Failed to create archive", 500);
+    const archiveBuffer = createTarGz(staging);
+    if (!archiveBuffer) {
+      throw new InternalError("Failed to create archive");
     }
 
-    return new Response(archiveBytes, {
-      status: 200,
-      headers: {
-        "Content-Type": "application/gzip",
-        "Content-Disposition": 'attachment; filename="logs.tar.gz"',
-        "Content-Length": String(archiveBytes.byteLength),
-      },
-    });
+    return new Uint8Array(archiveBuffer);
   } catch (err) {
+    if (err instanceof InternalError) throw err;
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err }, "Failed to export");
-    return httpError("INTERNAL_ERROR", `Failed to export: ${message}`, 500);
+    throw new InternalError(`Failed to export: ${message}`);
   } finally {
     try {
       rmSync(staging, { recursive: true, force: true });
@@ -341,17 +327,14 @@ async function handleExport(body: ExportRequestBody): Promise<Response> {
   }
 }
 
-/**
- * Replaces a string value with a presence flag: "(set)" if truthy, "(empty)" otherwise.
- */
+// ---------------------------------------------------------------------------
+// Config sanitization helpers
+// ---------------------------------------------------------------------------
+
 function redactStringValue(val: unknown): string {
   return val ? "(set)" : "(empty)";
 }
 
-/**
- * Reads the workspace config.json and strips sensitive fields.
- * Returns undefined if the file is missing or unreadable.
- */
 function readSanitizedConfig(): Record<string, unknown> | undefined {
   const configPath = getWorkspaceConfigPath();
   if (!existsSync(configPath)) return undefined;
@@ -360,10 +343,8 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
     const raw = readFileSync(configPath, "utf-8");
     const config = JSON.parse(raw) as Record<string, unknown>;
 
-    // Strip legacy apiKeys (removed from schema but may still exist in old config files)
     delete config.apiKeys;
 
-    // Strip ingress webhook secret
     if (config.ingress && typeof config.ingress === "object") {
       const ingress = config.ingress as Record<string, unknown>;
       if (ingress.webhook && typeof ingress.webhook === "object") {
@@ -374,7 +355,6 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
       config.ingress = ingress;
     }
 
-    // Strip skill-level API keys and env vars
     if (config.skills && typeof config.skills === "object") {
       const skills = config.skills as Record<string, unknown>;
       if (skills.entries && typeof skills.entries === "object") {
@@ -395,14 +375,12 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
       }
     }
 
-    // Strip Twilio accountSid
     if (config.twilio && typeof config.twilio === "object") {
       const twilio = config.twilio as Record<string, unknown>;
       twilio.accountSid = redactStringValue(twilio.accountSid);
       config.twilio = twilio;
     }
 
-    // Strip MCP transport headers (SSE/streamable-http) and env vars (stdio)
     if (config.mcp && typeof config.mcp === "object") {
       const mcp = config.mcp as Record<string, unknown>;
       if (mcp.servers && typeof mcp.servers === "object") {
@@ -444,55 +422,67 @@ function readSanitizedConfig(): Record<string, unknown> | undefined {
 // Route definitions
 // ---------------------------------------------------------------------------
 
-export function logExportRouteDefinitions(): RouteDefinition[] {
-  const exportRequestBody = z.object({
-    auditLimit: z
-      .number()
-      .int()
-      .optional()
-      .describe("Max audit records (default 1000)"),
-    conversationId: z
-      .string()
-      .optional()
-      .describe("Scope to a single conversation"),
-    full: z
-      .boolean()
-      .optional()
-      .describe(
-        "Full export — include messages, LLM request logs, and usage events for all conversations. Use for test data debugging.",
-      ),
-    startTime: z.number().optional().describe("Lower bound epoch ms"),
-    endTime: z.number().optional().describe("Upper bound epoch ms"),
-  });
-
-  return [
-    {
-      endpoint: "export",
-      method: "POST",
-      policyKey: "export",
-      summary: "Export logs and audit data",
-      description:
-        "Export audit records, assistant logs, and config as a tar.gz archive.",
-      tags: ["export"],
-      requestBody: exportRequestBody,
-      handler: async ({ req }) => {
-        const body = (await req.json()) as ExportRequestBody;
-        return handleExport(body);
+const exportRequestBody = z.object({
+  auditLimit: z
+    .number()
+    .int()
+    .optional()
+    .describe("Max audit records (default 1000)"),
+  conversationId: z
+    .string()
+    .optional()
+    .describe("Scope to a single conversation"),
+  full: z
+    .boolean()
+    .optional()
+    .describe(
+      "Full export — include messages, LLM request logs, and usage events for all conversations.",
+    ),
+  startTime: z.number().optional().describe("Lower bound epoch ms"),
+  endTime: z.number().optional().describe("Upper bound epoch ms"),
+});
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "export_logs",
+    endpoint: "export",
+    method: "POST",
+    policyKey: "export",
+    handler: handleExport,
+    summary: "Export logs and audit data",
+    description:
+      "Export audit records, assistant logs, and config as a tar.gz archive.",
+    tags: ["export"],
+    requestBody: exportRequestBody,
+    responseHeaders: {
+      "Content-Type": "application/gzip",
+      "Content-Disposition": 'attachment; filename="logs.tar.gz"',
+    },
+    additionalResponses: {
+      "500": {
+        description: "Failed to create archive",
       },
     },
-    {
-      endpoint: "logs/export",
-      method: "POST",
-      policyKey: "export",
-      summary: "Export logs and audit data (alias)",
-      description:
-        "Alias for /v1/export. Export audit records, assistant logs, and config as a tar.gz archive.",
-      tags: ["export"],
-      requestBody: exportRequestBody,
-      handler: async ({ req }) => {
-        const body = (await req.json()) as ExportRequestBody;
-        return handleExport(body);
+  },
+  {
+    operationId: "export_logs_alias",
+    endpoint: "logs/export",
+    method: "POST",
+    policyKey: "export",
+    handler: handleExport,
+    summary: "Export logs and audit data (alias)",
+    description:
+      "Alias for /v1/export. Export audit records, assistant logs, and config as a tar.gz archive.",
+    tags: ["export"],
+    requestBody: exportRequestBody,
+    responseHeaders: {
+      "Content-Type": "application/gzip",
+      "Content-Disposition": 'attachment; filename="logs.tar.gz"',
+    },
+    additionalResponses: {
+      "500": {
+        description: "Failed to create archive",
       },
     },
-  ];
-}
+  },
+];