@vellumai/assistant 0.8.0 → 0.8.2

package/src/runtime/routes/app-management-routes.ts

@@ -2,6 +2,7 @@
  * Route handlers for app CRUD, bundling, sharing, versioning,
  * gallery, and signing operations.
  */
+import { randomBytes } from "node:crypto";
 import {
   existsSync,
   mkdirSync,
@@ -9,8 +10,8 @@ import {
   readFileSync,
   writeFileSync,
 } from "node:fs";
-import { stat } from "node:fs/promises";
-import { homedir } from "node:os";
+import { stat, unlink } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 
 import { z } from "zod";
@@ -48,7 +49,11 @@ import {
 import { createSharedAppLink } from "../../memory/shared-app-links-store.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
-import { BadRequestError, NotFoundError } from "./errors.js";
+import {
+  BadRequestError,
+  NotFoundError,
+  PayloadTooLargeError,
+} from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("app-management-routes");
@@ -352,6 +357,189 @@ async function openBundle(filePath: string): Promise<Record<string, unknown>> {
   };
 }
 
+const MAX_IMPORT_BUNDLE_BYTES = 25 * 1024 * 1024; // 25 MB
+
+async function importBundle(
+  rawBody: Uint8Array,
+  headers: Record<string, string>,
+): Promise<{
+  success: true;
+  appId: string;
+  name: string;
+  scanResult: { passed: boolean; blocked: string[]; warnings: string[] };
+  signatureResult: {
+    trustTier: string;
+    signerKeyId?: string;
+    signerDisplayName?: string;
+    signerAccount?: string;
+  };
+}> {
+  const contentLength = headers["content-length"];
+  if (contentLength && Number(contentLength) > MAX_IMPORT_BUNDLE_BYTES) {
+    throw new PayloadTooLargeError(
+      `Bundle too large (limit: ${MAX_IMPORT_BUNDLE_BYTES / (1024 * 1024)} MB)`,
+    );
+  }
+
+  // Determine the actual bundle bytes based on content type
+  let bundleBytes: Uint8Array;
+  const contentType = headers["content-type"] ?? "";
+  if (contentType.includes("multipart/form-data")) {
+    // Reconstruct a Request to use the platform's multipart parser
+    const syntheticReq = new Request("http://localhost", {
+      method: "POST",
+      headers: { "content-type": contentType },
+      body: rawBody.buffer as ArrayBuffer,
+    });
+
+    let formData: FormData;
+    try {
+      formData = await syntheticReq.formData();
+    } catch {
+      throw new BadRequestError("Invalid multipart form data");
+    }
+
+    const file = formData.get("file");
+    if (!file || !(file instanceof Blob)) {
+      throw new BadRequestError(
+        'Multipart upload requires a "file" field containing the .vbundle',
+      );
+    }
+    bundleBytes = new Uint8Array(await file.arrayBuffer());
+  } else {
+    // application/octet-stream or any other content type — use raw body directly
+    bundleBytes = rawBody;
+  }
+
+  if (bundleBytes.length > MAX_IMPORT_BUNDLE_BYTES) {
+    throw new PayloadTooLargeError(
+      `Bundle too large (limit: ${MAX_IMPORT_BUNDLE_BYTES / (1024 * 1024)} MB)`,
+    );
+  }
+
+  // Write to temp file for scanning and signature verification
+  const tempPath = join(
+    tmpdir(),
+    `vellum-import-${randomBytes(8).toString("hex")}.vbundle`,
+  );
+  writeFileSync(tempPath, bundleBytes);
+
+  try {
+    const [scanResult, signatureResult] = await Promise.all([
+      scanBundle(tempPath),
+      verifyBundleSignature(tempPath).catch(
+        (): Awaited<ReturnType<typeof verifyBundleSignature>> => ({
+          trustTier: "tampered",
+          message: "Signature verification failed — bundle may be tampered",
+        }),
+      ),
+    ]);
+
+    const blocked = scanResult.findings
+      .filter((f) => f.level === "block")
+      .map((f) => f.message);
+    const warnings = scanResult.findings
+      .filter((f) => f.level === "warn")
+      .map((f) => f.message);
+
+    if (!scanResult.passed) {
+      throw new BadRequestError(
+        `Bundle blocked by security scan: ${blocked.join("; ")}`,
+      );
+    }
+
+    // Load the zip and extract contents
+    const JSZip = (await import("jszip")).default;
+    const zip = await JSZip.loadAsync(bundleBytes);
+
+    // Extract manifest
+    const manifestFile = zip.file("manifest.json");
+    let manifest: {
+      name?: string;
+      description?: string;
+      entry?: string;
+      format_version?: number;
+    } = {};
+    if (manifestFile) {
+      const manifestText = await manifestFile.async("text");
+      manifest = JSON.parse(manifestText);
+    }
+
+    const appName = manifest.name ?? "Imported App";
+    const appDescription = manifest.description;
+    const entry = manifest.entry ?? "index.html";
+    const isMultiFile = manifest.format_version === 2;
+
+    // Extract entry HTML
+    const entryFile = zip.file(entry);
+    if (!entryFile) {
+      throw new BadRequestError("Bundle missing entry file");
+    }
+    const htmlDefinition = await entryFile.async("text");
+
+    // Extract icon if present
+    let icon: string | undefined;
+    const iconFile = zip.file("icon.png");
+    if (iconFile) {
+      icon = await iconFile.async("base64");
+    }
+
+    // Create the local app
+    const newApp = createApp({
+      name: appName,
+      description: appDescription,
+      schemaJson: JSON.stringify({ type: "object", properties: {} }),
+      htmlDefinition,
+      icon,
+      formatVersion: isMultiFile ? 2 : undefined,
+    });
+
+    // For multi-file apps, extract compiled dist assets (main.js, main.css)
+    // into the app's dist/ directory so the app can run correctly.
+    if (isMultiFile) {
+      const appDir = getAppDirPath(newApp.id);
+      const distDir = join(appDir, "dist");
+      mkdirSync(distDir, { recursive: true });
+
+      // Write dist/index.html
+      writeFileSync(join(distDir, "index.html"), htmlDefinition, "utf-8");
+
+      // Write dist/main.js if present in the bundle
+      const mainJsFile = zip.file("main.js");
+      if (mainJsFile) {
+        const mainJs = await mainJsFile.async("text");
+        writeFileSync(join(distDir, "main.js"), mainJs, "utf-8");
+      }
+
+      // Write dist/main.css if present in the bundle
+      const mainCssFile = zip.file("main.css");
+      if (mainCssFile) {
+        const mainCss = await mainCssFile.async("text");
+        writeFileSync(join(distDir, "main.css"), mainCss, "utf-8");
+      }
+    }
+
+    return {
+      success: true,
+      appId: newApp.id,
+      name: newApp.name,
+      scanResult: {
+        passed: scanResult.passed,
+        blocked,
+        warnings,
+      },
+      signatureResult: {
+        trustTier: signatureResult.trustTier,
+        signerKeyId: signatureResult.signerKeyId,
+        signerDisplayName: signatureResult.signerDisplayName,
+        signerAccount: signatureResult.signerAccount,
+      },
+    };
+  } finally {
+    void unlink(tempPath);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Route handlers
 // ---------------------------------------------------------------------------
@@ -371,6 +559,15 @@ async function handleOpenBundle({ body }: RouteHandlerArgs) {
   return openBundle(body.filePath as string);
 }
 
+async function handleImportBundle({ rawBody, headers }: RouteHandlerArgs) {
+  if (!rawBody || rawBody.length === 0) {
+    throw new BadRequestError(
+      "Request body is required — upload a .vbundle file",
+    );
+  }
+  return importBundle(rawBody, headers ?? {});
+}
+
 function handleListSharedApps() {
   return { apps: listSharedApps() };
 }
@@ -656,6 +853,34 @@ export const ROUTES: RouteDefinition[] = [
       gallery: z.array(z.unknown()).describe("Gallery app entries"),
     }),
   },
+  {
+    operationId: "apps_import_bundle",
+    endpoint: "apps/import-bundle",
+    method: "POST",
+    policyKey: "apps/import-bundle",
+    handler: handleImportBundle,
+    summary: "Import a .vbundle file",
+    description:
+      "Upload, validate, and install a .vbundle archive as a new local app.",
+    tags: ["apps"],
+    rawBody: true,
+    responseBody: z.object({
+      success: z.boolean(),
+      appId: z.string(),
+      name: z.string(),
+      scanResult: z.object({
+        passed: z.boolean(),
+        blocked: z.array(z.string()),
+        warnings: z.array(z.string()),
+      }),
+      signatureResult: z.object({
+        trustTier: z.string(),
+        signerKeyId: z.string().optional(),
+        signerDisplayName: z.string().optional(),
+        signerAccount: z.string().optional(),
+      }),
+    }),
+  },
   {
     operationId: "apps_sign_bundle",
     endpoint: "apps/sign-bundle",

package/src/runtime/routes/approval-routes.ts

@@ -10,7 +10,6 @@
 import { z } from "zod";
 
 import { findConversation } from "../../daemon/conversation-store.js";
-import { emitFeedEvent } from "../../home/emit-feed-event.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getLogger } from "../../util/logger.js";
@@ -76,23 +75,6 @@ function handleConfirm({ body }: RouteHandlerArgs) {
     "Confirmation resolved",
   );
 
-  const approved = effectiveDecision === "allow";
-  const toolName = interaction.confirmationDetails?.toolName ?? "unknown tool";
-  void emitFeedEvent({
-    source: "assistant",
-    title: `${approved ? "Approved" : "Denied"} use of ${toolName}.`,
-    summary: `${approved ? "Approved" : "Denied"} use of ${toolName}.`,
-    dedupKey: `tool-approval:${requestId}`,
-    urgency: approved ? undefined : "medium",
-    conversationId: interaction.conversationId,
-    detailPanel: { kind: "toolPermission" },
-  }).catch((err) => {
-    log.warn(
-      { err, requestId },
-      "Failed to emit tool approval resolution feed event",
-    );
-  });
-
   // ACP permissions: resolve directly without a Conversation object.
   // No PermissionPrompter involved, so the route owns deregistration.
   if (interaction.directResolve) {

package/src/runtime/routes/audit-routes.ts

@@ -0,0 +1,43 @@
+/**
+ * Route handlers for tool invocation audit log.
+ *
+ * GET /v1/audit?limit=20 — list recent tool invocations
+ */
+
+import { z } from "zod";
+
+import { getRecentInvocations } from "../../memory/tool-usage-store.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+function handleAuditList({ queryParams }: RouteHandlerArgs) {
+  const limitRaw = queryParams?.limit;
+  const limit =
+    limitRaw !== undefined ? parseInt(limitRaw, 10) : 20;
+  const invocations = getRecentInvocations(
+    Number.isFinite(limit) && limit > 0 ? limit : 20,
+  );
+  return { invocations };
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "audit_list",
+    endpoint: "audit",
+    method: "GET",
+    summary: "List recent tool invocations",
+    description:
+      "Returns recent tool invocation records from the audit log, ordered by most recent first.",
+    tags: ["audit"],
+    queryParams: [
+      {
+        name: "limit",
+        type: "integer",
+        description: "Maximum number of entries to return (default 20)",
+      },
+    ],
+    responseBody: z.object({
+      invocations: z.array(z.unknown()).describe("Tool invocation records"),
+    }),
+    handler: handleAuditList,
+  },
+];

package/src/runtime/routes/auth-routes.ts

@@ -0,0 +1,72 @@
+/**
+ * Route handlers for authentication status.
+ *
+ * GET /v1/auth/info — return platform identity and authentication status
+ */
+
+import { z } from "zod";
+
+import {
+  getPlatformAssistantId,
+  getPlatformBaseUrl,
+  getPlatformOrganizationId,
+  getPlatformUserId,
+} from "../../config/env.js";
+import { resolveManagedProxyContext } from "../../providers/platform-proxy/context.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+interface AuthInfoResult {
+  platformUrl: string | null;
+  assistantId: string | null;
+  organizationId: string | null;
+  userId: string | null;
+  authenticated: boolean;
+  message?: string;
+}
+
+async function handleAuthInfo(_args: RouteHandlerArgs): Promise<AuthInfoResult> {
+  const ctx = await resolveManagedProxyContext();
+
+  const platformUrl = getPlatformBaseUrl();
+  const assistantId = getPlatformAssistantId();
+  const organizationId = getPlatformOrganizationId();
+  const userId = getPlatformUserId();
+  const authenticated = ctx.enabled;
+
+  const result: AuthInfoResult = {
+    platformUrl: platformUrl || null,
+    assistantId: assistantId || null,
+    organizationId: organizationId || null,
+    userId: userId || null,
+    authenticated,
+  };
+
+  if (!authenticated) {
+    result.message = !platformUrl
+      ? "Platform URL not configured. Run assistant config set platform.baseUrl <url>"
+      : "Assistant API key not found. Store one with: assistant keys set credential/vellum/assistant_api_key <key>";
+  }
+
+  return result;
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "auth_info",
+    endpoint: "auth/info",
+    method: "GET",
+    summary: "Get authentication status",
+    description:
+      "Returns platform identity and authentication status for this assistant.",
+    tags: ["auth"],
+    responseBody: z.object({
+      platformUrl: z.string().nullable(),
+      assistantId: z.string().nullable(),
+      organizationId: z.string().nullable(),
+      userId: z.string().nullable(),
+      authenticated: z.boolean(),
+      message: z.string().optional(),
+    }),
+    handler: handleAuthInfo,
+  },
+];