@vellumai/assistant 0.8.3 → 0.8.4

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -0,0 +1,246 @@
+/**
+ * Route definitions for ChatGPT subscription OAuth authentication.
+ *
+ * POST /v1/inference/chatgpt-subscription/auth — generate a PKCE authorize
+ *   URL for the user to visit. Returns `{ authorize_url, state }`.
+ *
+ * POST /v1/inference/chatgpt-subscription/auth/exchange — accept the
+ *   authorization code + state from the redirect, exchange for tokens,
+ *   store in CES, and upsert the provider connection.
+ */
+
+import { z } from "zod";
+
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
+import { getConfigReadOnly } from "../../config/loader.js";
+import { getDb } from "../../memory/db-connection.js";
+import {
+  createConnection,
+  getConnection,
+  updateConnection,
+} from "../../providers/inference/connections.js";
+import type { OAuth2Config } from "../../security/oauth2.js";
+import {
+  exchangeCodeForTokens,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+} from "../../security/oauth2.js";
+import { setSecureKeyAsync } from "../../security/secure-keys.js";
+import { getLogger } from "../../util/logger.js";
+import { BadRequestError } from "./errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+function requireFeatureFlag() {
+  const config = getConfigReadOnly();
+  if (!isAssistantFeatureFlagEnabled("chatgpt-subscription-auth", config)) {
+    throw new BadRequestError(
+      "ChatGPT subscription auth is not enabled for this assistant.",
+    );
+  }
+}
+
+const log = getLogger("chatgpt-subscription-auth");
+
+// ---------------------------------------------------------------------------
+// OAuth config
+// ---------------------------------------------------------------------------
+
+const OPENAI_OAUTH_CONFIG: OAuth2Config = {
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenExchangeUrl: "https://auth.openai.com/oauth/token",
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  scopeSeparator: " ",
+  authorizeParams: { id_token_add_organizations: "true" },
+};
+
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const CONNECTION_NAME = "chatgpt-subscription";
+
+// ---------------------------------------------------------------------------
+// Module-level PKCE state storage
+// ---------------------------------------------------------------------------
+
+interface PendingAuth {
+  codeVerifier: string;
+  createdAt: number;
+}
+
+const pendingAuths = new Map<string, PendingAuth>();
+
+const PENDING_AUTH_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+/** Remove entries older than 10 minutes. */
+function cleanupExpiredEntries(): void {
+  const cutoff = Date.now() - PENDING_AUTH_TTL_MS;
+  for (const [key, entry] of pendingAuths) {
+    if (entry.createdAt < cutoff) {
+      pendingAuths.delete(key);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+async function handleStartAuth(_args: RouteHandlerArgs) {
+  requireFeatureFlag();
+  cleanupExpiredEntries();
+
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = generateCodeChallenge(codeVerifier);
+  const state = generateState();
+
+  pendingAuths.set(state, { codeVerifier, createdAt: Date.now() });
+
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: OPENAI_OAUTH_CONFIG.clientId,
+    redirect_uri: REDIRECT_URI,
+    scope: OPENAI_OAUTH_CONFIG.scopes.join(
+      OPENAI_OAUTH_CONFIG.scopeSeparator,
+    ),
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    ...OPENAI_OAUTH_CONFIG.authorizeParams,
+  });
+
+  const authorizeUrl = `${OPENAI_OAUTH_CONFIG.authorizeUrl}?${params.toString()}`;
+
+  return { authorize_url: authorizeUrl, state };
+}
+
+async function handleExchange(args: RouteHandlerArgs) {
+  requireFeatureFlag();
+  const { code, state } = args.body as { code: string; state: string };
+
+  const pending = pendingAuths.get(state);
+  if (!pending) {
+    throw new Error(
+      "Invalid or expired state parameter. Please restart the auth flow.",
+    );
+  }
+
+  pendingAuths.delete(state);
+
+  // Check TTL
+  if (Date.now() - pending.createdAt > PENDING_AUTH_TTL_MS) {
+    throw new Error("Auth flow expired. Please restart the auth flow.");
+  }
+
+  const { tokens } = await exchangeCodeForTokens(
+    OPENAI_OAUTH_CONFIG,
+    code,
+    REDIRECT_URI,
+    pending.codeVerifier,
+  );
+
+  // Store tokens in CES
+  const accessStored = await setSecureKeyAsync(
+    "credential/chatgpt/access_token",
+    tokens.accessToken,
+  );
+  if (!accessStored) {
+    log.error("Failed to store ChatGPT access token in CES");
+    throw new Error("Failed to store access token");
+  }
+
+  if (tokens.refreshToken) {
+    const refreshStored = await setSecureKeyAsync(
+      "credential/chatgpt/refresh_token",
+      tokens.refreshToken,
+    );
+    if (!refreshStored) {
+      log.error("Failed to store ChatGPT refresh token in CES");
+      throw new Error("Failed to store refresh token");
+    }
+  }
+
+  if (tokens.expiresIn) {
+    const expiresAt = Math.floor(Date.now() / 1000 + tokens.expiresIn);
+    await setSecureKeyAsync(
+      "credential/chatgpt/expires_at",
+      String(expiresAt),
+    );
+  }
+
+  // Upsert provider connection
+  const db = getDb();
+  const authInput = {
+    type: "oauth_subscription" as const,
+    credential: "credential/chatgpt/access_token",
+  };
+
+  const existing = getConnection(db, CONNECTION_NAME);
+  if (existing) {
+    const updateResult = updateConnection(db, CONNECTION_NAME, {
+      auth: authInput,
+    });
+    if (!updateResult.ok) {
+      log.error(
+        { error: updateResult.error },
+        "Failed to update chatgpt-subscription connection",
+      );
+      throw new Error("Failed to update connection");
+    }
+  } else {
+    const createResult = createConnection(db, {
+      name: CONNECTION_NAME,
+      provider: "openai",
+      auth: authInput,
+    });
+    if (!createResult.ok) {
+      log.error(
+        { error: createResult.error },
+        "Failed to create chatgpt-subscription connection",
+      );
+      throw new Error("Failed to create connection");
+    }
+  }
+
+  log.info("ChatGPT subscription auth flow completed successfully");
+  return { ok: true };
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "inference_chatgpt_subscription_auth",
+    endpoint: "inference/chatgpt-subscription/auth",
+    method: "POST",
+    policyKey: "inference/provider-connections",
+    summary: "Start ChatGPT subscription OAuth PKCE flow",
+    description:
+      "Generate a PKCE authorize URL for ChatGPT subscription auth. Returns the URL and state for the client to open in a browser.",
+    tags: ["inference"],
+    responseBody: z.object({
+      authorize_url: z.string(),
+      state: z.string(),
+    }),
+    handler: handleStartAuth,
+  },
+  {
+    operationId: "inference_chatgpt_subscription_auth_exchange",
+    endpoint: "inference/chatgpt-subscription/auth/exchange",
+    method: "POST",
+    policyKey: "inference/provider-connections",
+    summary: "Exchange ChatGPT subscription OAuth authorization code",
+    description:
+      "Accept an authorization code and state from the OAuth redirect, exchange it for tokens, store them in CES, and upsert the provider connection.",
+    tags: ["inference"],
+    requestBody: z.object({
+      code: z.string(),
+      state: z.string(),
+    }),
+    responseBody: z.object({
+      ok: z.boolean(),
+    }),
+    handler: handleExchange,
+  },
+];

package/src/runtime/routes/content-source-routes.ts

@@ -0,0 +1,78 @@
+/**
+ * Route definitions for content-source configuration.
+ *
+ * POST /v1/content-source — validate and persist a content source URL as sidecar
+ *
+ * Uses policyKey: "secrets" — writes workspace data, same policy tier as
+ * the existing secrets routes.
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { z } from "zod";
+
+import { getWorkspaceDir } from "../../util/platform.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function writeSidecar(relPath: string, data: Record<string, unknown>): void {
+  const workspaceDir = getWorkspaceDir();
+  const absPath = join(workspaceDir, relPath);
+  mkdirSync(dirname(absPath), { recursive: true });
+  writeFileSync(absPath, JSON.stringify(data, null, 2), "utf-8");
+}
+
+function validateUrl(
+  raw: string,
+): { ok: true; normalized: string } | { ok: false; error: "invalid_url" } {
+  const trimmed = raw.trim();
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return { ok: false, error: "invalid_url" };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, error: "invalid_url" };
+  }
+  parsed.username = "";
+  parsed.password = "";
+  return { ok: true, normalized: parsed.href };
+}
+
+// ---------------------------------------------------------------------------
+// POST /v1/content-source
+// ---------------------------------------------------------------------------
+
+function handleContentSource(args: RouteHandlerArgs): Record<string, unknown> {
+  const rawUrl = typeof args.body?.url === "string" ? args.body.url : "";
+
+  const result = validateUrl(rawUrl);
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+
+  writeSidecar("data/content-source.json", { url: result.normalized });
+
+  return { ok: true };
+}
+
+// ---------------------------------------------------------------------------
+// Route definition
+// ---------------------------------------------------------------------------
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "content_source_set",
+    endpoint: "content-source",
+    method: "POST",
+    policyKey: "secrets",
+    summary: "Validate and persist a content source URL",
+    requestBody: z.object({ url: z.string() }),
+    handler: handleContentSource,
+  },
+];

package/src/runtime/routes/conversation-cli-routes.ts

@@ -11,6 +11,7 @@ import { z } from "zod";
 
 import { clearAllConversations as clearAllActive } from "../../daemon/handlers/conversations.js";
 import { formatJson, formatMarkdown } from "../../export/formatter.js";
+import { ipcCall as ipcCallGateway } from "../../ipc/gateway-client.js";
 import {
   addMessage,
   createConversation,
@@ -19,8 +20,10 @@ import {
 } from "../../memory/conversation-crud.js";
 import { setConversationKey } from "../../memory/conversation-key-store.js";
 import { listConversations } from "../../memory/conversation-queries.js";
+import { getBindingByConversation } from "../../memory/external-conversation-store.js";
+import { sendSlackReply } from "../../messaging/providers/slack/send.js";
 import { getLogger } from "../../util/logger.js";
-import { BadRequestError, NotFoundError } from "./errors.js";
+import { BadGatewayError, BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("conversation-cli-routes");
@@ -150,6 +153,136 @@ async function handleClearCli(_args: RouteHandlerArgs) {
   return { cleared };
 }
 
+// ---------------------------------------------------------------------------
+// slack detach (CLI)
+// ---------------------------------------------------------------------------
+
+const slackDetachRequestSchema = z.object({
+  conversationId: z.string().trim().min(1).optional(),
+  channelId: z.string().trim().min(1).optional(),
+  threadTs: z.string().trim().min(1).optional(),
+});
+
+const slackDetachResponseSchema = z.object({
+  detached: z.boolean(),
+  channelId: z.string(),
+  threadTs: z.string(),
+  source: z.enum(["explicit", "conversation_binding"]),
+  conversationId: z.string().optional(),
+});
+
+type SlackDetachGatewayResponse = {
+  detached: boolean;
+  channelId: string;
+  threadTs: string;
+};
+
+const SLACK_DETACH_CONFIRMATION_TEXT =
+  "Muted this Slack thread. I won't respond to further replies here unless you mention me again.";
+
+function isSlackDetachGatewayResponse(
+  value: unknown,
+): value is SlackDetachGatewayResponse {
+  return (
+    value != null &&
+    typeof value === "object" &&
+    typeof (value as SlackDetachGatewayResponse).detached === "boolean" &&
+    typeof (value as SlackDetachGatewayResponse).channelId === "string" &&
+    typeof (value as SlackDetachGatewayResponse).threadTs === "string"
+  );
+}
+
+async function handleSlackDetachCli({ body = {} }: RouteHandlerArgs) {
+  const parsed = slackDetachRequestSchema.parse(body);
+  const explicitChannelId = parsed.channelId;
+  const explicitThreadTs = parsed.threadTs;
+
+  let channelId: string;
+  let threadTs: string;
+  let source: "explicit" | "conversation_binding";
+  let conversationId: string | undefined;
+
+  if (explicitChannelId || explicitThreadTs) {
+    if (!explicitChannelId || !explicitThreadTs) {
+      throw new BadRequestError(
+        "Both channelId and threadTs are required when detaching by explicit Slack identifiers",
+      );
+    }
+    channelId = explicitChannelId;
+    threadTs = explicitThreadTs;
+    source = "explicit";
+  } else {
+    if (!parsed.conversationId) {
+      throw new BadRequestError(
+        "conversationId is required unless channelId and threadTs are provided",
+      );
+    }
+
+    const binding = getBindingByConversation(parsed.conversationId);
+    if (!binding) {
+      throw new NotFoundError(
+        `No channel binding found for conversation ${parsed.conversationId}`,
+      );
+    }
+    if (binding.sourceChannel !== "slack") {
+      throw new BadRequestError(
+        `Conversation ${parsed.conversationId} is bound to ${binding.sourceChannel}, not Slack`,
+      );
+    }
+    if (!binding.externalThreadId) {
+      throw new BadRequestError(
+        `Conversation ${parsed.conversationId} is not bound to a Slack thread`,
+      );
+    }
+
+    channelId = binding.externalChatId;
+    threadTs = binding.externalThreadId;
+    source = "conversation_binding";
+    conversationId = parsed.conversationId;
+  }
+
+  const gatewayResult = await ipcCallGateway(
+    "detach_slack_active_thread",
+    { channelId, threadTs },
+    5_000,
+  );
+  if (!isSlackDetachGatewayResponse(gatewayResult)) {
+    throw new BadGatewayError(
+      "Could not detach Slack thread from assistant listening",
+    );
+  }
+
+  if (gatewayResult.detached) {
+    try {
+      await sendSlackReply(
+        gatewayResult.channelId,
+        SLACK_DETACH_CONFIRMATION_TEXT,
+        { threadTs: gatewayResult.threadTs },
+      );
+    } catch (err) {
+      log.warn(
+        {
+          err,
+          channelId: gatewayResult.channelId,
+          threadTs: gatewayResult.threadTs,
+        },
+        "Slack thread detached, but confirmation message failed",
+      );
+      throw new BadGatewayError(
+        "Detached Slack thread but could not send confirmation",
+      );
+    }
+  }
+
+  return {
+    detached: gatewayResult.detached,
+    channelId: gatewayResult.channelId,
+    threadTs: gatewayResult.threadTs,
+    source,
+    ...(conversationId ? { conversationId } : {}),
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -230,4 +363,16 @@ export const ROUTES: RouteDefinition[] = [
     }),
     handler: handleClearCli,
   },
+  {
+    operationId: "conversation_slack_detach_cli",
+    endpoint: "conversations/cli/slack/detach",
+    method: "POST",
+    summary: "Detach the assistant from a Slack thread (CLI)",
+    description:
+      "Stops Slack active-thread listening for a Slack thread. The CLI resolves current conversation defaults.",
+    tags: ["conversations"],
+    requestBody: slackDetachRequestSchema,
+    responseBody: slackDetachResponseSchema,
+    handler: handleSlackDetachCli,
+  },
 ];

package/src/runtime/routes/conversation-query-routes.ts

@@ -15,6 +15,7 @@
  * GET    /v1/messages/:id/llm-context   — LLM request logs for a message
  * GET    /v1/llm-request-logs/:id/payload — raw payload for a single log
  * DELETE /v1/messages/queued/:id        — delete queued message
+ * POST   /v1/messages/queued/:id/steer — steer to a queued message
  */
 
 import { z } from "zod";
@@ -49,7 +50,10 @@ import {
   getMessageContent,
   performConversationSearch,
 } from "../../daemon/handlers/conversation-history.js";
-import { deleteQueuedMessage } from "../../daemon/handlers/conversations.js";
+import {
+  deleteQueuedMessage,
+  steerToMessage,
+} from "../../daemon/handlers/conversations.js";
 import {
   CONFIG_RELOAD_DEBOUNCE_MS,
   log,
@@ -854,6 +858,12 @@ async function handleGetLlmContext({ pathParams = {} }: RouteHandlerArgs) {
         requestPayload: null,
         responsePayload: null,
         createdAt: log.createdAt,
+        // Agent-loop exit reason for the iteration that produced this
+        // call, stamped onto the most-recent unstamped log by
+        // `conversation-agent-loop-handlers.ts` after the loop yields.
+        // Only the terminal call in each loop iteration carries a value;
+        // non-terminal calls land here as `null`.
+        agentLoopExitReason: log.agentLoopExitReason ?? null,
         ...result,
       };
     }),
@@ -909,6 +919,36 @@ function handleDeleteQueuedMessage({
   throw new NotFoundError("Queued message not found");
 }
 
+function handleSteerToMessage({
+  queryParams = {},
+  pathParams = {},
+  body,
+}: RouteHandlerArgs) {
+  const conversationId =
+    queryParams.conversationId ??
+    (body && typeof body === "object" && "conversationId" in body
+      ? (body as Record<string, unknown>).conversationId
+      : undefined);
+  if (!conversationId || typeof conversationId !== "string") {
+    throw new BadRequestError(
+      "Missing required parameter: conversationId",
+    );
+  }
+  const result = steerToMessage(conversationId, pathParams.id ?? "");
+  if (result.steered) {
+    return { ok: true, conversationId, requestId: pathParams.id };
+  }
+  if (result.reason === "conversation_not_found") {
+    throw new NotFoundError("Conversation not found");
+  }
+  if (result.reason === "not_processing") {
+    throw new BadRequestError(
+      "Cannot steer: conversation is not currently processing",
+    );
+  }
+  throw new NotFoundError("Queued message not found");
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions (shared HTTP + IPC)
 // ---------------------------------------------------------------------------
@@ -1140,4 +1180,23 @@ export const ROUTES: RouteDefinition[] = [
     ],
     handler: handleDeleteQueuedMessage,
   },
+  {
+    operationId: "messages_queued_steer",
+    endpoint: "messages/queued/:id/steer",
+    method: "POST",
+    policyKey: "messages/queued",
+    summary: "Steer to a queued message",
+    description:
+      "Promote a queued message to the head of the queue and abort the current generation so it is processed next.",
+    tags: ["messages"],
+    queryParams: [
+      {
+        name: "conversationId",
+        schema: { type: "string" },
+        required: true,
+        description: "Conversation ID (required)",
+      },
+    ],
+    handler: handleSteerToMessage,
+  },
 ];