@vellumai/assistant 0.7.0 → 0.7.2

package/src/runtime/routes/approval-routes.ts

@@ -9,6 +9,7 @@
  */
 import { z } from "zod";
 
+import { findConversation } from "../../daemon/conversation-store.js";
 import { emitFeedEvent } from "../../home/emit-feed-event.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import type { UserDecision } from "../../permissions/types.js";
@@ -97,7 +98,14 @@ function handleConfirm({ body }: RouteHandlerArgs) {
     return { accepted: true };
   }
 
-  interaction.conversation!.handleConfirmationResponse(
+  const conversation = findConversation(interaction.conversationId);
+  if (!conversation) {
+    throw new NotFoundError(
+      "Conversation not found for this pending confirmation",
+    );
+  }
+
+  conversation.handleConfirmationResponse(
     requestId,
     effectiveDecision as UserDecision,
     selectedPattern,
@@ -136,7 +144,14 @@ function handleSecret({ body }: RouteHandlerArgs) {
     throw new NotFoundError("No pending interaction found for this requestId");
   }
 
-  interaction.conversation!.handleSecretResponse(
+  const conversation = findConversation(interaction.conversationId);
+  if (!conversation) {
+    throw new NotFoundError(
+      "Conversation not found for this pending secret request",
+    );
+  }
+
+  conversation.handleSecretResponse(
     requestId,
     value,
     delivery as "store" | "transient_send" | undefined,
@@ -147,24 +162,35 @@ function handleSecret({ body }: RouteHandlerArgs) {
 /**
  * GET /v1/pending-interactions?conversationKey=...&conversationId=...
  *
- * Returns pending confirmations and secrets for a conversation, allowing
- * polling-based clients (like the CLI) to discover approval requests
- * without SSE.
+ * Returns pending interactions. When conversationKey or conversationId is
+ * provided, returns the first pending confirmation and secret for that
+ * conversation. When neither is provided, returns all pending interactions
+ * across all conversations (diagnostic mode).
  */
 function handleListPendingInteractions({ queryParams }: RouteHandlerArgs) {
   const conversationKey = queryParams?.conversationKey;
   const conversationId = queryParams?.conversationId;
 
+  // When no filters are provided, return all interactions (diagnostic mode).
+  if (!conversationId && !conversationKey) {
+    const all = pendingInteractions.getAll();
+    return {
+      interactions: all.map((i) => ({
+        requestId: i.requestId,
+        conversationId: i.conversationId,
+        kind: i.kind,
+        toolName: i.confirmationDetails?.toolName,
+        riskLevel: i.confirmationDetails?.riskLevel,
+      })),
+    };
+  }
+
   let resolvedConversationId: string | undefined;
   if (conversationId) {
     resolvedConversationId = conversationId;
   } else if (conversationKey) {
     const mapping = getConversationByKey(conversationKey);
     resolvedConversationId = mapping?.conversationId;
-  } else {
-    throw new BadRequestError(
-      "conversationKey or conversationId query parameter is required",
-    );
   }
 
   if (!resolvedConversationId) {
@@ -266,27 +292,42 @@ export const ROUTES: RouteDefinition[] = [
     method: "GET",
     handler: handleListPendingInteractions,
     summary: "List pending interactions",
-    description: "Return pending confirmations and secrets for a conversation.",
+    description:
+      "Return pending interactions. When conversationKey or conversationId is provided, returns details for that conversation. When neither is provided, returns all pending interactions.",
     tags: ["approvals"],
     queryParams: [
       {
         name: "conversationKey",
-        description: "Conversation key",
+        description: "Conversation key (optional)",
       },
       {
         name: "conversationId",
-        description: "Conversation ID",
+        description: "Conversation ID (optional)",
       },
     ],
     responseBody: z.object({
       pendingConfirmation: z
         .object({})
         .passthrough()
-        .describe("Pending confirmation details or null"),
+        .describe("Pending confirmation details or null")
+        .optional(),
       pendingSecret: z
         .object({})
         .passthrough()
-        .describe("Pending secret request or null"),
+        .describe("Pending secret request or null")
+        .optional(),
+      interactions: z
+        .array(
+          z.object({
+            requestId: z.string(),
+            conversationId: z.string(),
+            kind: z.string(),
+            toolName: z.string().optional(),
+            riskLevel: z.string().optional(),
+          }),
+        )
+        .describe("All pending interactions (returned when no filters given)")
+        .optional(),
     }),
   },
 ];

package/src/runtime/routes/approval-strategies/guardian-text-engine-strategy.ts

@@ -17,7 +17,7 @@ import type {
   ApprovalConversationGenerator,
   ApprovalCopyGenerator,
 } from "../../http-types.js";
-import type { ApprovalInterceptionResult } from "../guardian-approval-interception.js";
+import type { ApprovalInterceptionResult } from "../approval-interception-types.js";
 import { deliverStaleApprovalReply } from "../guardian-approval-reply-helpers.js";
 
 const log = getLogger("runtime-http");

package/src/runtime/routes/avatar-routes.ts

@@ -9,7 +9,6 @@ import { getLogger } from "../../util/logger.js";
 import { getAvatarImagePath } from "../../util/platform.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import {
   BadRequestError,
   RouteError,
@@ -19,11 +18,11 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("avatar-routes");
 
-export function publishAvatarUpdated(): void {
+function publishAvatarUpdated(): void {
   const avatarPath = getAvatarImagePath();
   assistantEventHub
     .publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {
+      buildAssistantEvent({
         type: "avatar_updated",
         avatarPath,
       }),
@@ -105,8 +104,7 @@ export const ROUTES: RouteDefinition[] = [
       return { ok: true };
     },
     summary: "Notify avatar updated",
-    description:
-      "Publish an avatar_updated SSE event to connected clients.",
+    description: "Publish an avatar_updated SSE event to connected clients.",
     tags: ["avatar"],
     responseBody: z.object({
       ok: z.boolean(),

package/src/runtime/routes/backup-routes.ts

@@ -26,17 +26,11 @@ import { dirname, sep } from "node:path";
 
 import { z } from "zod";
 
-import { readBackupKey } from "../../backup/backup-key.js";
-import {
-  type BackupRunResult,
-  createSnapshotNow,
-} from "../../backup/backup-worker.js";
 import {
   listSnapshotsInDir,
   type SnapshotEntry,
 } from "../../backup/list-snapshots.js";
 import {
-  getBackupKeyPath,
   getLocalBackupsDir,
   resolveOffsiteDestinations,
 } from "../../backup/paths.js";
@@ -47,7 +41,7 @@ import { getMemoryCheckpoint } from "../../memory/checkpoints.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir, getWorkspaceHooksDir } from "../../util/platform.js";
 import { DefaultPathResolver } from "../migrations/vbundle-import-analyzer.js";
-import { BadRequestError, ConflictError, RouteError } from "./errors.js";
+import { BadRequestError, RouteError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("backup-routes");
@@ -115,23 +109,16 @@ async function validateSnapshotPath(rawPath: unknown): Promise<string> {
 }
 
 /**
- * Load the backup decryption key iff the target snapshot is encrypted.
- * Returns null for plaintext bundles. Throws BadRequestError when an
- * encrypted bundle is supplied but no key file exists.
+ * Reject encrypted snapshots — decryption has moved to the gateway (ATL-397).
+ * The assistant daemon no longer has access to the backup key.
  */
-async function loadKeyIfEncrypted(
-  snapshotPath: string,
-): Promise<Buffer | null> {
-  if (!snapshotPath.endsWith(".vbundle.enc")) {
-    return null;
-  }
-  const key = await readBackupKey(getBackupKeyPath());
-  if (key == null) {
+function rejectIfEncrypted(snapshotPath: string): void {
+  if (snapshotPath.endsWith(".vbundle.enc")) {
     throw new BadRequestError(
-      "Encrypted snapshot requires a backup key, but backup.key is missing",
+      "Encrypted snapshot restore/verify must go through the gateway, " +
+        "which owns the backup key. Use the gateway's backup endpoints instead.",
     );
   }
-  return key;
 }
 
 // ---------------------------------------------------------------------------
@@ -189,24 +176,17 @@ export async function handleBackupList(): Promise<BackupListResponse> {
   return { local, offsite, offsiteEnabled, nextRunAt };
 }
 
-export async function handleBackupCreate(): Promise<BackupRunResult> {
-  try {
-    const config = getConfig();
-    return await createSnapshotNow(config.backup, new Date());
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (message.startsWith("snapshot in progress")) {
-      throw new ConflictError("A snapshot is already in progress");
-    }
-    log.error({ err }, "Manual backup snapshot failed");
-    throw new RouteError(message, "INTERNAL_ERROR", 500);
-  }
+export async function handleBackupCreate(): Promise<never> {
+  throw new BadRequestError(
+    "Backup snapshot creation has moved to the gateway. " +
+      "Use the gateway's POST /v1/backups/create endpoint instead.",
+  );
 }
 
 export async function handleBackupRestore({ body }: RouteHandlerArgs) {
   const path = body?.path;
   const snapshotPath = await validateSnapshotPath(path);
-  const key = await loadKeyIfEncrypted(snapshotPath);
+  rejectIfEncrypted(snapshotPath);
 
   try {
     const pathResolver = new DefaultPathResolver(
@@ -215,7 +195,6 @@ export async function handleBackupRestore({ body }: RouteHandlerArgs) {
     );
 
     const result = await restoreFromSnapshot(snapshotPath, {
-      key: key ?? undefined,
       pathResolver,
       workspaceDir: getWorkspaceDir(),
     });
@@ -239,12 +218,10 @@ export async function handleBackupRestore({ body }: RouteHandlerArgs) {
 export async function handleBackupVerify({ body }: RouteHandlerArgs) {
   const path = body?.path;
   const snapshotPath = await validateSnapshotPath(path);
-  const key = await loadKeyIfEncrypted(snapshotPath);
+  rejectIfEncrypted(snapshotPath);
 
   try {
-    return await verifySnapshot(snapshotPath, {
-      key: key ?? undefined,
-    });
+    return await verifySnapshot(snapshotPath);
   } catch (err) {
     log.error({ err, snapshotPath }, "Snapshot verification failed");
     throw new RouteError(

package/src/runtime/routes/browser-routes.ts

@@ -18,7 +18,6 @@ import {
 } from "../../browser/types.js";
 import { findConversation } from "../../daemon/conversation-store.js";
 import type { ContentBlock } from "../../providers/types.js";
-import { getClientRegistry } from "../client-registry.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Param validation ─────────────────────────────────────────────────
@@ -70,8 +69,7 @@ async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
 
   // When the caller passes a live conversation ID (e.g. from
   // __CONVERSATION_ID in a nested bash invocation), reuse that
-  // conversation's browser proxy wiring so operations like `status`
-  // see extension connectivity from the parent turn.
+  // conversation's trust context and transport interface.
   const conversation = conversationId
     ? findConversation(conversationId)
     : undefined;
@@ -80,12 +78,6 @@ async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
     ? conversationId!
     : browserCliConversationKey(sessionId);
 
-  // When there's no conversation context (e.g. `assistant browser status`
-  // from the CLI), check the client registry for connected host_browser
-  // clients so the status command can report accurate extension availability.
-  const registry = getClientRegistry();
-  const browserClients = registry.listByCapability("host_browser");
-
   const result = await executeBrowserOperation(
     operation as BrowserOperation,
     input,
@@ -93,13 +85,7 @@ async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
       workingDir: process.cwd(),
       conversationId: resolvedConversationId,
       trustClass: conversation?.trustContext?.trustClass ?? "unknown",
-      hostBrowserProxy: conversation?.hostBrowserProxy,
       transportInterface: conversation?.transportInterface,
-      hostBrowserRegistryRouted: !!conversation?.hostBrowserSenderOverride,
-      connectedBrowserClients: browserClients.map((c) => ({
-        clientId: c.clientId,
-        interfaceId: c.interfaceId,
-      })),
     },
   );
 

package/src/runtime/routes/btw-routes.ts

@@ -18,6 +18,8 @@ import { z } from "zod";
 
 import { readNowScratchpad } from "../../daemon/conversation-runtime-assembly.js";
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
+import { buildToolDefinitions } from "../../daemon/conversation-tool-setup.js";
+import { parseIdentityFields } from "../../daemon/handlers/identity.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import { resolvePersonaContext } from "../../prompts/persona-resolver.js";
 import { getLogger } from "../../util/logger.js";
@@ -35,33 +37,6 @@ const IDENTITY_INTRO_KEY = "identity-intro";
 /** Conversation key used by the client for empty-state greeting generation. */
 const GREETING_KEY = "greeting";
 
-/**
- * Parse the `## Identity Intro` section from SOUL.md.
- * Returns the first non-empty line under that heading, or null.
- */
-function readSoulIdentityIntro(): string | null {
-  try {
-    const soulPath = getWorkspacePromptPath("SOUL.md");
-    if (!existsSync(soulPath)) return null;
-    const content = readFileSync(soulPath, "utf-8");
-
-    let inSection = false;
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (/^#+\s/.test(trimmed)) {
-        inSection = trimmed.toLowerCase().includes("identity intro");
-        continue;
-      }
-      if (inSection && trimmed.length > 0) {
-        return trimmed;
-      }
-    }
-  } catch {
-    // Fall through — no SOUL.md intro available
-  }
-  return null;
-}
-
 // ---------------------------------------------------------------------------
 // SSE helpers
 // ---------------------------------------------------------------------------
@@ -94,14 +69,17 @@ async function handleBtw({
 
   // ----- Identity intro fast-path -----
   if (conversationKey === IDENTITY_INTRO_KEY) {
-    const soulIntro = readSoulIdentityIntro();
-    const fastText = soulIntro ?? getCachedIntro()?.text;
+    let fastText: string | undefined;
+    const identityPath = getWorkspacePromptPath("IDENTITY.md");
+    if (existsSync(identityPath)) {
+      const fields = parseIdentityFields(readFileSync(identityPath, "utf-8"));
+      if (fields.name) {
+        fastText = `Hi, I'm ${fields.name}!`;
+      }
+    }
+    fastText ??= getCachedIntro()?.text;
     if (fastText) {
-      log.debug(
-        soulIntro
-          ? "Returning SOUL.md identity intro"
-          : "Returning cached identity intro",
-      );
+      log.debug("Returning identity intro fast-path");
       return new ReadableStream({
         start(controller) {
           controller.enqueue(sseEvent("btw_text_delta", { text: fastText }));
@@ -129,9 +107,7 @@ async function handleBtw({
   try {
     conversation = await getOrCreateConversation(conversationId);
   } catch {
-    throw new ServiceUnavailableError(
-      "Message processing is not available",
-    );
+    throw new ServiceUnavailableError("Message processing is not available");
   }
 
   return new ReadableStream({
@@ -145,6 +121,7 @@ async function handleBtw({
           const result = await runBtwSidechain({
             content: effectiveContent,
             conversation,
+            tools: buildToolDefinitions(),
             signal: abortSignal,
             userPersona,
             channelPersona,

package/src/runtime/routes/channel-guardian-routes.ts

@@ -10,12 +10,8 @@
 export {
   type ApprovalInterceptionParams,
   type ApprovalInterceptionResult,
-  handleApprovalInterception,
 } from "./guardian-approval-interception.js";
-export {
-  deliverGeneratedApprovalPrompt,
-  type DeliverGeneratedApprovalPromptParams,
-} from "./guardian-approval-prompt.js";
+export { type DeliverGeneratedApprovalPromptParams } from "./guardian-approval-prompt.js";
 export {
   startGuardianExpirySweep,
   stopGuardianExpirySweep,

package/src/runtime/routes/channel-readiness-routes.ts

@@ -45,7 +45,7 @@ async function enrichSnapshots(
 /**
  * GET /v1/channels/readiness
  */
-export async function handleGetChannelReadiness({
+async function handleGetChannelReadiness({
   queryParams = {},
 }: RouteHandlerArgs) {
   const channel = (queryParams.channel as ChannelId | undefined) ?? undefined;
@@ -61,9 +61,7 @@ export async function handleGetChannelReadiness({
 /**
  * POST /v1/channels/readiness/refresh
  */
-export async function handleRefreshChannelReadiness({
-  body = {},
-}: RouteHandlerArgs) {
+async function handleRefreshChannelReadiness({ body = {} }: RouteHandlerArgs) {
   const channel = (body.channel as ChannelId | undefined) ?? undefined;
   const includeRemote =
     body.includeRemote !== undefined ? Boolean(body.includeRemote) : true;
@@ -130,9 +128,7 @@ export const ROUTES: RouteDefinition[] = [
     }),
     responseBody: z.object({
       success: z.boolean(),
-      snapshots: z
-        .array(z.unknown())
-        .describe("Refreshed readiness snapshots"),
+      snapshots: z.array(z.unknown()).describe("Refreshed readiness snapshots"),
     }),
   },
 ];

package/src/runtime/routes/channel-route-shared.ts

@@ -119,39 +119,13 @@ export function buildGuardianDenyContext(
   return `Permission denied for "${toolName}": guardian approval was required, but no guardian is configured for this channel. In your next assistant reply, explain this and offer guardian setup. Mention that setup provides a verification code that the user replies with in the channel.`;
 }
 
-export function buildPromptDeliveryFailureContext(toolName: string): string {
-  return `Permission denied for "${toolName}": approval UI delivery failed and no plain-text fallback could be delivered. In your next assistant reply, apologize briefly, explain approval delivery failed, and ask the user to retry.`;
-}
-
 export function stripVerificationFailurePrefix(reason: string): string {
   const trimmed = reason.trim();
   return trimmed.replace(/^verification failed\.?\s*/i, "").trim() || trimmed;
 }
-
-// ---------------------------------------------------------------------------
-// Poll constants
-// ---------------------------------------------------------------------------
-
-export const RUN_POLL_INTERVAL_MS = 500;
-const RUN_POLL_MAX_WAIT_MS = 300_000; // 5 minutes
-
-/** Post-decision delivery poll: uses the same budget as the main poll since
- *  this is the only delivery path for late approvals after the main poll exits. */
-export const POST_DECISION_POLL_INTERVAL_MS = 500;
-export const POST_DECISION_POLL_MAX_WAIT_MS = RUN_POLL_MAX_WAIT_MS;
-
-/**
- * Override the poll max-wait for tests. When set, used in place of
- * RUN_POLL_MAX_WAIT_MS so tests can exercise timeout paths without
- * waiting 5 minutes.
- */
-let testPollMaxWaitOverride: number | null = null;
+let _testPollMaxWaitOverride: number | null = null;
 
 /** @internal — test-only: set an override for the poll max-wait. */
 export function _setTestPollMaxWait(ms: number | null): void {
-  testPollMaxWaitOverride = ms;
-}
-
-export function getEffectivePollMaxWait(): number {
-  return testPollMaxWaitOverride ?? RUN_POLL_MAX_WAIT_MS;
+  _testPollMaxWaitOverride = ms;
 }

package/src/runtime/routes/client-routes.ts

@@ -1,13 +1,16 @@
 /**
  * Client registry routes — list connected clients and their capabilities.
+ *
+ * Queries the assistant event hub's client subscribers rather than a
+ * separate registry. Clients register as hub subscribers via SSE /events.
  */
 
 import { z } from "zod";
 
-import {
-  ClientRegistry,
-  getClientRegistry,
-} from "../client-registry.js";
+import type { HostProxyCapability } from "../../channels/types.js";
+import { datesToISO } from "../../util/json.js";
+import { assistantEventHub } from "../assistant-event-hub.js";
+import { NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
 export const ROUTES: RouteDefinition[] = [
@@ -31,18 +34,49 @@ export const ROUTES: RouteDefinition[] = [
       clients: z.array(z.object({}).passthrough()),
     }),
     handler: ({ queryParams }) => {
-      const registry = getClientRegistry();
-      const capability = queryParams?.capability;
+      const capability = queryParams?.capability as
+        | HostProxyCapability
+        | undefined;
 
-      const entries = capability
-        ? registry.listByCapability(
-            capability as Parameters<typeof registry.listByCapability>[0],
-          )
-        : registry.listAll();
+      const clients = capability
+        ? assistantEventHub.listClientsByCapability(capability)
+        : assistantEventHub.listClients();
 
       return {
-        clients: entries.map((e) => ClientRegistry.toJSON(e)),
+        clients: clients.map((c) =>
+          datesToISO({
+            clientId: c.clientId,
+            interfaceId: c.interfaceId,
+            capabilities: c.capabilities,
+            machineName: c.machineName,
+            connectedAt: c.connectedAt,
+            lastActiveAt: c.lastActiveAt,
+          }),
+        ),
       };
     },
   },
+  {
+    operationId: "disconnect_client",
+    endpoint: "clients/disconnect",
+    method: "POST",
+    summary: "Force-disconnect a client",
+    description:
+      "Dispose all hub subscribers for the given clientId, forcibly closing their SSE streams.",
+    tags: ["clients"],
+    requestBody: z.object({
+      clientId: z.string().describe("The client UUID to disconnect."),
+    }),
+    responseBody: z.object({
+      disconnected: z.number().describe("Number of disposed subscribers."),
+    }),
+    handler: ({ body }) => {
+      const { clientId } = body as { clientId: string };
+      const count = assistantEventHub.disposeClient(clientId);
+      if (count === 0) {
+        throw new NotFoundError(`No connected client with id "${clientId}"`);
+      }
+      return { disconnected: count };
+    },
+  },
 ];