@vellumai/assistant 0.8.2 → 0.8.4

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -10,10 +10,13 @@
 
 import { z } from "zod";
 
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfigReadOnly } from "../../config/loader.js";
 import { getDb } from "../../memory/db-connection.js";
 import {
   AuthSchema,
+  type ConnectionModel,
+  ConnectionModelSchema,
   ConnectionProviderSchema,
   ConnectionStatusSchema,
   ProviderConnectionSchema,
@@ -25,8 +28,14 @@ import {
   getConnection,
   listConnections,
   MANAGED_CONNECTION_NAMES,
+  PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   updateConnection,
 } from "../../providers/inference/connections.js";
+import {
+  isPrivateOrLocalHost,
+  resolveHostAddresses,
+  resolveRequestAddress,
+} from "../../tools/network/url-safety.js";
 import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -35,6 +44,125 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 // ---------------------------------------------------------------------------
 
 const providerConnectionResponseSchema = ProviderConnectionSchema;
+const OPENAI_COMPATIBLE_ENDPOINTS_FLAG = "openai-compatible-endpoints";
+
+function openAICompatibleEndpointsEnabled(): boolean {
+  return isAssistantFeatureFlagEnabled(
+    OPENAI_COMPATIBLE_ENDPOINTS_FLAG,
+    getConfigReadOnly(),
+  );
+}
+
+function rejectDisabledOpenAICompatibleProvider(provider: string): void {
+  if (provider !== "openai-compatible") return;
+  if (openAICompatibleEndpointsEnabled()) return;
+  throw new BadRequestError(
+    "OpenAI-compatible endpoints are disabled. Enable the openai-compatible-endpoints feature flag to configure this provider.",
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Custom provider field parsing (openai-compatible base_url + models)
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse and validate `base_url` and `models` from the request body.
+ *
+ * `base_url` is only accepted for providers in
+ * `PROVIDERS_REQUIRING_BASE_URL_AND_MODELS` (currently `openai-compatible`).
+ * For all other providers, supplying `base_url` returns a 400. This prevents
+ * API-key exfiltration: an attacker cannot create an `anthropic` connection
+ * with a `base_url` pointing to their own server, which would redirect all
+ * LLM calls (and the API key) to the attacker.
+ *
+ * Even for `openai-compatible`, the `base_url` must not point to private
+ * networks or cloud metadata endpoints (SSRF protection).
+ */
+async function parseCustomProviderFields(
+  body: Record<string, unknown>,
+  provider: string,
+): Promise<{
+  baseUrl?: string | null;
+  models?: ConnectionModel[] | null;
+}> {
+  const out: {
+    baseUrl?: string | null;
+    models?: ConnectionModel[] | null;
+  } = {};
+
+  if ("base_url" in body) {
+    const raw = body.base_url;
+
+    // Gate: base_url is only valid for openai-compatible providers.
+    if (
+      raw !== null &&
+      raw !== undefined &&
+      !PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)
+    ) {
+      throw new BadRequestError(
+        `base_url is only valid for openai-compatible providers. Remove base_url or use the openai-compatible provider type.`,
+      );
+    }
+
+    if (raw === null) {
+      out.baseUrl = null;
+    } else if (typeof raw === "string" && raw.length > 0) {
+      let parsed: URL;
+      try {
+        parsed = new URL(raw);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+          throw new BadRequestError(`Invalid base_url: must be an http(s) URL`);
+        }
+      } catch (err) {
+        if (err instanceof BadRequestError) throw err;
+        throw new BadRequestError(
+          `Invalid base_url: must be a valid http(s) URL`,
+        );
+      }
+
+      // SSRF protection: reject private IPs, localhost, cloud metadata endpoints.
+      const hostname = parsed.hostname;
+      if (isPrivateOrLocalHost(hostname)) {
+        throw new BadRequestError(
+          `Invalid base_url: must not point to a private or local network address.`,
+        );
+      }
+
+      // DNS resolution check: hostname may resolve to a private IP.
+      const resolved = await resolveRequestAddress(
+        hostname,
+        resolveHostAddresses,
+        /* allowPrivateNetwork */ false,
+      );
+      if (resolved.blockedAddress) {
+        throw new BadRequestError(
+          `Invalid base_url: hostname resolves to a private network address.`,
+        );
+      }
+
+      out.baseUrl = raw;
+    } else {
+      throw new BadRequestError(
+        `Invalid base_url: must be a non-empty string or null`,
+      );
+    }
+  }
+
+  if ("models" in body) {
+    const raw = body.models;
+    if (raw === null) {
+      out.models = null;
+    } else {
+      const parsed = z.array(ConnectionModelSchema).safeParse(raw);
+      if (!parsed.success) {
+        throw new BadRequestError(`Invalid models: ${parsed.error.message}`);
+      }
+      out.models = parsed.data;
+    }
+  }
+
+  return out;
+}
 
 // ---------------------------------------------------------------------------
 // Handlers
@@ -42,10 +170,18 @@ const providerConnectionResponseSchema = ProviderConnectionSchema;
 
 function handleListConnections({ queryParams = {} }: RouteHandlerArgs) {
   const provider = queryParams.provider;
+  if (provider) rejectDisabledOpenAICompatibleProvider(provider);
   const connections = listConnections(
     getDb(),
     provider ? { provider } : undefined,
   );
+  if (!openAICompatibleEndpointsEnabled()) {
+    return {
+      connections: connections.filter(
+        (conn) => conn.provider !== "openai-compatible",
+      ),
+    };
+  }
   return { connections };
 }
 
@@ -55,11 +191,17 @@ function handleGetConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   const conn = getConnection(getDb(), name);
   if (!conn) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (
+    conn.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
 
   return conn;
 }
 
-function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
+async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
   const name = body.name;
   const provider = body.provider;
   const auth = body.auth;
@@ -74,6 +216,7 @@ function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
+  rejectDisabledOpenAICompatibleProvider(providerResult.data);
 
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
@@ -99,12 +242,15 @@ function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
     );
   }
 
+  const customFields = await parseCustomProviderFields(body, providerResult.data);
+
   const result = createConnection(getDb(), {
     name,
     provider: providerResult.data,
     auth: authResult.data,
     ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
+    ...customFields,
   });
 
   if (!result.ok) {
@@ -118,19 +264,38 @@ function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
         `Invalid provider "${result.error.provider}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
       );
     }
+    if (result.error.code === "base_url_required") {
+      throw new BadRequestError(
+        "base_url is required for openai-compatible connections.",
+      );
+    }
+    if (result.error.code === "models_required") {
+      throw new BadRequestError(
+        "At least one model is required for openai-compatible connections.",
+      );
+    }
     throw new BadRequestError("Invalid auth configuration.");
   }
 
   return result.connection;
 }
 
-function handleUpdateConnection({
+async function handleUpdateConnection({
   pathParams = {},
   body = {},
 }: RouteHandlerArgs) {
   const { name } = pathParams;
   if (!name) throw new BadRequestError("name is required");
 
+  const existing = getConnection(getDb(), name);
+  if (!existing) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (
+    existing.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
+
   const auth = body.auth;
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
@@ -169,16 +334,29 @@ function handleUpdateConnection({
     );
   }
 
+  const customFields = await parseCustomProviderFields(body, existing.provider);
+
   const result = updateConnection(getDb(), name, {
     auth: authResult.data,
     ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
+    ...customFields,
   });
 
   if (!result.ok) {
     if (result.error.code === "not_found") {
       throw new NotFoundError(`Connection "${name}" not found.`);
     }
+    if (result.error.code === "base_url_required") {
+      throw new BadRequestError(
+        "base_url is required for openai-compatible connections.",
+      );
+    }
+    if (result.error.code === "models_required") {
+      throw new BadRequestError(
+        "At least one model is required for openai-compatible connections.",
+      );
+    }
     throw new BadRequestError("Invalid auth configuration.");
   }
 
@@ -191,7 +369,14 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   // Existence check first so a stale `llm.default.provider_connection`
   // reference to a missing connection returns 404 (not 409).
-  if (!getConnection(getDb(), name)) {
+  const existing = getConnection(getDb(), name);
+  if (!existing) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
+  if (
+    existing.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
     throw new NotFoundError(`Connection "${name}" not found.`);
   }
 
@@ -301,6 +486,8 @@ export const ROUTES: RouteDefinition[] = [
       auth: AuthSchema,
       label: z.string().min(1).optional(),
       status: ConnectionStatusSchema.optional(),
+      base_url: z.string().url().nullable().optional(),
+      models: z.array(ConnectionModelSchema).nullable().optional(),
     }),
     responseBody: providerConnectionResponseSchema,
     responseStatus: "201",
@@ -324,6 +511,8 @@ export const ROUTES: RouteDefinition[] = [
       auth: AuthSchema,
       status: ConnectionStatusSchema.optional(),
       label: z.string().min(1).nullable().optional(),
+      base_url: z.string().url().nullable().optional(),
+      models: z.array(ConnectionModelSchema).nullable().optional(),
     }),
     responseBody: providerConnectionResponseSchema,
     additionalResponses: {

package/src/runtime/routes/integrations/a2a.ts

@@ -0,0 +1,294 @@
+/**
+ * Route handlers for A2A integration config endpoints.
+ *
+ * GET    /v1/integrations/a2a/config          — get current A2A config status
+ * POST   /v1/integrations/a2a/config          — enable A2A channel
+ * DELETE /v1/integrations/a2a/config          — disable A2A channel
+ * POST   /v1/integrations/a2a/invite          — create a shareable A2A invite token
+ * POST   /v1/integrations/a2a/invite/complete — sender-side invite completion
+ * POST   /v1/integrations/a2a/invite/redeem   — receiver-side invite redemption
+ * POST   /v1/integrations/a2a/invite/accept   — self-hosted broker: orchestrate complete + redeem
+ */
+
+import { isA2AEnabled } from "../../../a2a/feature-gate.js";
+import { getConfig } from "../../../config/loader.js";
+import {
+  acceptA2AInvite,
+  clearA2AConfig,
+  completeA2AInvite,
+  createA2AInvite,
+  getA2AConfig,
+  redeemA2AInvite,
+  setA2AConfig,
+} from "../../../daemon/handlers/config-a2a.js";
+import { BadGatewayError, BadRequestError } from "../errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function assertA2AFlag(): void {
+  if (!isA2AEnabled(getConfig())) {
+    throw new BadRequestError("A2A channel is not available");
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+function handleGetA2AConfig() {
+  assertA2AFlag();
+  return getA2AConfig();
+}
+
+function handleSetA2AConfig() {
+  assertA2AFlag();
+  const result = setA2AConfig();
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to enable A2A");
+  }
+  return result;
+}
+
+function handleClearA2AConfig() {
+  assertA2AFlag();
+  return clearA2AConfig();
+}
+
+function handleCreateA2AInvite({ body = {} }: RouteHandlerArgs) {
+  assertA2AFlag();
+  const { expiresInHours } = body as { expiresInHours?: unknown };
+  if (expiresInHours !== undefined) {
+    if (
+      typeof expiresInHours !== "number" ||
+      !Number.isFinite(expiresInHours) ||
+      expiresInHours <= 0
+    ) {
+      throw new BadRequestError(
+        "expiresInHours must be a positive finite number",
+      );
+    }
+  }
+  const result = createA2AInvite({
+    expiresInHours: expiresInHours as number | undefined,
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to create A2A invite");
+  }
+  return result;
+}
+
+function handleCompleteA2AInvite({ body = {} }: RouteHandlerArgs) {
+  const { token, senderAssistantId, acceptor } = body as {
+    token?: unknown;
+    senderAssistantId?: unknown;
+    acceptor?: {
+      assistantId?: unknown;
+      displayName?: unknown;
+      gatewayUrl?: unknown;
+    };
+  };
+
+  if (typeof token !== "string" || !token) {
+    throw new BadRequestError(
+      "token is required and must be a non-empty string",
+    );
+  }
+  if (typeof senderAssistantId !== "string" || !senderAssistantId) {
+    throw new BadRequestError(
+      "senderAssistantId is required and must be a non-empty string",
+    );
+  }
+  if (
+    !acceptor ||
+    typeof acceptor.assistantId !== "string" ||
+    !acceptor.assistantId ||
+    typeof acceptor.displayName !== "string" ||
+    !acceptor.displayName ||
+    typeof acceptor.gatewayUrl !== "string" ||
+    !acceptor.gatewayUrl
+  ) {
+    throw new BadRequestError(
+      "acceptor must include non-empty assistantId, displayName, and gatewayUrl",
+    );
+  }
+
+  const result = completeA2AInvite({
+    token,
+    senderAssistantId,
+    acceptor: {
+      assistantId: acceptor.assistantId,
+      displayName: acceptor.displayName,
+      gatewayUrl: acceptor.gatewayUrl,
+    },
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to complete A2A invite");
+  }
+  return result;
+}
+
+function handleRedeemA2AInvite({ body = {} }: RouteHandlerArgs) {
+  const { sender } = body as {
+    sender?: {
+      assistantId?: unknown;
+      displayName?: unknown;
+      gatewayUrl?: unknown;
+    };
+  };
+
+  if (
+    !sender ||
+    typeof sender.assistantId !== "string" ||
+    !sender.assistantId ||
+    typeof sender.displayName !== "string" ||
+    !sender.displayName ||
+    typeof sender.gatewayUrl !== "string" ||
+    !sender.gatewayUrl
+  ) {
+    throw new BadRequestError(
+      "sender must include non-empty assistantId, displayName, and gatewayUrl",
+    );
+  }
+
+  const result = redeemA2AInvite({
+    sender: {
+      assistantId: sender.assistantId,
+      displayName: sender.displayName,
+      gatewayUrl: sender.gatewayUrl,
+    },
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to redeem A2A invite");
+  }
+  return result;
+}
+
+async function handleAcceptA2AInvite({ body = {} }: RouteHandlerArgs) {
+  assertA2AFlag();
+  const { senderGatewayUrl, senderAssistantId, token } = body as {
+    senderGatewayUrl?: unknown;
+    senderAssistantId?: unknown;
+    token?: unknown;
+  };
+
+  if (typeof senderGatewayUrl !== "string" || !senderGatewayUrl) {
+    throw new BadRequestError(
+      "senderGatewayUrl is required and must be a non-empty string",
+    );
+  }
+  try {
+    new URL(senderGatewayUrl);
+  } catch {
+    throw new BadRequestError("senderGatewayUrl must be a valid URL");
+  }
+  if (typeof senderAssistantId !== "string" || !senderAssistantId) {
+    throw new BadRequestError(
+      "senderAssistantId is required and must be a non-empty string",
+    );
+  }
+  if (typeof token !== "string" || !token) {
+    throw new BadRequestError(
+      "token is required and must be a non-empty string",
+    );
+  }
+
+  const result = await acceptA2AInvite({
+    senderGatewayUrl,
+    senderAssistantId,
+    token,
+  });
+  if (!result.success) {
+    const isSenderFault =
+      result.errorCode === "sender_unreachable" ||
+      result.errorCode === "complete_failed";
+    if (isSenderFault) {
+      throw new BadGatewayError(result.error ?? "Failed to accept A2A invite");
+    }
+    throw new BadRequestError(result.error ?? "Failed to accept A2A invite");
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "integrations_a2a_config_get",
+    endpoint: "integrations/a2a/config",
+    method: "GET",
+    summary: "Get A2A config",
+    description: "Check current A2A channel configuration status.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleGetA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_config_post",
+    endpoint: "integrations/a2a/config",
+    method: "POST",
+    summary: "Enable A2A channel",
+    description: "Enable the A2A channel for inter-assistant communication.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleSetA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_config_delete",
+    endpoint: "integrations/a2a/config",
+    method: "DELETE",
+    summary: "Disable A2A channel",
+    description: "Disable the A2A channel.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleClearA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_invite_post",
+    endpoint: "integrations/a2a/invite",
+    method: "POST",
+    summary: "Create A2A invite",
+    description:
+      "Create a shareable A2A invite token for link-based contact creation.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleCreateA2AInvite,
+  },
+  {
+    operationId: "integrations_a2a_invite_complete_post",
+    endpoint: "integrations/a2a/invite/complete",
+    method: "POST",
+    summary: "Complete A2A invite (sender side)",
+    description:
+      "Called by the platform to finalize the sender side of a link-based A2A connection.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleCompleteA2AInvite,
+  },
+  {
+    operationId: "integrations_a2a_invite_redeem_post",
+    endpoint: "integrations/a2a/invite/redeem",
+    method: "POST",
+    summary: "Redeem A2A invite (receiver side)",
+    description:
+      "Called by the platform to create a trusted contact on the receiver side of a link-based A2A connection.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleRedeemA2AInvite,
+  },
+  {
+    operationId: "integrations_a2a_invite_accept_post",
+    endpoint: "integrations/a2a/invite/accept",
+    method: "POST",
+    summary: "Accept A2A invite (self-hosted broker)",
+    description:
+      "Orchestrate cross-daemon invite acceptance for self-hosted deployments. Calls the sender's invite/complete, then creates a local contact via invite/redeem.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleAcceptA2AInvite,
+  },
+];

package/src/runtime/routes/llm-call-sites-routes.ts

@@ -1,10 +1,20 @@
+import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
+import { loadConfig } from "../../config/loader.js";
 import { CALL_SITE_CATALOG, CALL_SITE_DOMAINS } from "../../config/schemas/call-site-catalog.js";
+import type { LLMCallSite } from "../../config/schemas/llm.js";
 import type { RouteDefinition } from "./types.js";
 
 async function handleGetCallSites() {
+  const { llm } = loadConfig();
   return {
     domains: CALL_SITE_DOMAINS,
-    callSites: CALL_SITE_CATALOG,
+    callSites: CALL_SITE_CATALOG.map((entry) => ({
+      ...entry,
+      defaultProfile: resolveDefaultProfileKey(
+        entry.id as LLMCallSite,
+        llm,
+      ),
+    })),
   };
 }
 

package/src/runtime/routes/log-export-routes.ts

@@ -36,6 +36,7 @@ import {
   getWorkspaceConfigPath,
 } from "../../util/platform.js";
 import { APP_VERSION, COMMIT_SHA } from "../../version.js";
+import { assistantEventHub } from "../assistant-event-hub.js";
 import { createTarGz } from "./archive-utils.js";
 import { InternalError } from "./errors.js";
 import { collectWorkspaceData } from "./log-export/workspace-allowlist.js";
@@ -270,6 +271,44 @@ async function handleExport({
       );
     }
 
+    // --- Connected clients (`assistant clients list --json`) ---
+    try {
+      const clients = assistantEventHub.listClients();
+      const clientsList = {
+        clients: clients.map((c) => ({
+          clientId: c.clientId,
+          interfaceId: c.interfaceId,
+          capabilities: c.capabilities,
+          machineName: c.machineName,
+          connectedAt: c.connectedAt.toISOString(),
+          lastActiveAt: c.lastActiveAt.toISOString(),
+        })),
+      };
+      writeFileSync(
+        join(staging, "clients-list.json"),
+        JSON.stringify(clientsList, null, 2),
+        "utf-8",
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      writeFileSync(
+        join(staging, "clients-list-error.json"),
+        JSON.stringify(
+          {
+            error: message,
+            collectedAt: new Date().toISOString(),
+          },
+          null,
+          2,
+        ),
+        "utf-8",
+      );
+      log.warn(
+        { err },
+        "Failed to collect connected clients list, continuing without it",
+      );
+    }
+
     // --- Export manifest ---
     const manifestType = conversationId
       ? ("conversation-export" as const)