@vellumai/assistant 0.8.5 → 0.8.7

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -11,7 +11,11 @@ import type { ChannelId, InterfaceId } from "../../../channels/types.js";
 import { findGuardianForChannel } from "../../../contacts/contact-store.js";
 import type { ServerMessage } from "../../../daemon/message-protocol.js";
 import type { TrustContext } from "../../../daemon/trust-context.js";
-import { updateDeliveredSegmentCount } from "../../../memory/delivery-channels.js";
+import {
+  addSlackDmLiveDeliveredTextResponseIndex,
+  getSlackDmLiveDeliveredTextResponseIndexes,
+  updateDeliveredSegmentCount,
+} from "../../../memory/delivery-channels.js";
 import {
   linkMessage,
   storeReplyMessageId,
@@ -44,6 +48,10 @@ import type {
   MessageProcessor,
   SlackInboundMessageMetadata,
 } from "../../http-types.js";
+import {
+  createSlackDmTextDeliveryController,
+  isSlackDeliveryCallbackUrl,
+} from "../../slack-dm-text-delivery.js";
 import { resolveRoutingState } from "../../trust-context-resolver.js";
 import { deliverReplyViaCallback } from "../channel-delivery-routes.js";
 import { deliverGeneratedApprovalPrompt } from "../guardian-approval-prompt.js";
@@ -228,6 +236,21 @@ export function processChannelMessageInBackground(
             }
           : undefined;
       let replyMessageId: string | undefined;
+      const slackDmTextDelivery = createSlackDmTextDeliveryController({
+        sourceChannel,
+        chatType,
+        replyCallbackUrl,
+        chatId: externalChatId,
+        assistantId,
+        deliveredTextResponseIndexes:
+          getSlackDmLiveDeliveredTextResponseIndexes(eventId),
+        onTextResponseDelivered: (responseIndex, reason) => {
+          addSlackDmLiveDeliveredTextResponseIndex(eventId, responseIndex);
+          if (reason === "before_tool") {
+            slackThinkingStatus?.refreshAfterReply();
+          }
+        },
+      });
       const observeAgentEvent = (msg: ServerMessage): void => {
         if (
           msg.type === "message_complete" &&
@@ -236,34 +259,31 @@ export function processChannelMessageInBackground(
         ) {
           replyMessageId = msg.messageId;
         }
+        slackDmTextDelivery?.observeEvent(msg);
         slackThinkingStatus?.observeEvent(msg);
       };
 
       let userMessageId: string | undefined;
       try {
-        const result = await processMessage(
-          conversationId,
-          content,
+        const result = await processMessage(conversationId, content, {
           attachmentIds,
-          {
-            transport: {
-              channelId: sourceChannel,
-              hints: metadataHints.length > 0 ? metadataHints : undefined,
-              uxBrief: metadataUxBrief,
-              chatType,
-              ...(clientTimezone ? { clientTimezone } : {}),
-            },
-            assistantId,
-            trustContext: trustCtx,
-            isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
-            ...(displayContent !== undefined ? { displayContent } : {}),
-            ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
-            ...(slackInbound ? { slackInbound } : {}),
-            onEvent: observeAgentEvent,
+          transport: {
+            channelId: sourceChannel,
+            hints: metadataHints.length > 0 ? metadataHints : undefined,
+            uxBrief: metadataUxBrief,
+            chatType,
+            ...(clientTimezone ? { clientTimezone } : {}),
           },
+          assistantId,
+          trustContext: trustCtx,
+          isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
+          ...(displayContent !== undefined ? { displayContent } : {}),
+          ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
+          ...(slackInbound ? { slackInbound } : {}),
+          onEvent: observeAgentEvent,
           sourceChannel,
           sourceInterface,
-        );
+        });
         userMessageId = result.messageId;
         linkMessage(eventId, userMessageId);
         markProcessed(eventId);
@@ -297,12 +317,21 @@ export function processChannelMessageInBackground(
           { err, conversationId },
           "Background channel message processing failed",
         );
+        if (slackDmTextDelivery) {
+          await slackDmTextDelivery.waitForPendingDeliveries();
+        }
         recordProcessingFailure(eventId, err);
         return;
       }
 
       if (replyCallbackUrl) {
         try {
+          if (slackDmTextDelivery) {
+            await slackDmTextDelivery.waitForPendingDeliveries();
+          }
+          const liveDeliveryResumeOptions =
+            slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
+
           await deliverReplyViaCallback(
             conversationId,
             externalChatId,
@@ -311,6 +340,7 @@ export function processChannelMessageInBackground(
             {
               messageId: replyMessageId,
               sinceMessageId: userMessageId,
+              ...liveDeliveryResumeOptions,
               onSegmentDelivered: (count) =>
                 updateDeliveredSegmentCount(eventId, count),
             },
@@ -395,11 +425,13 @@ function startTelegramTypingHeartbeat(
 
 type SlackThinkingStatusController = {
   observeEvent: (msg: ServerMessage) => void;
+  refreshAfterReply: () => void;
   stop: () => void;
 };
 
 type SlackThinkingStatusHandle = {
   updateLoadingMessages: (loadingMessages?: string[]) => void;
+  refresh: (loadingMessages?: string[]) => void;
   clear: () => void;
 };
 
@@ -440,12 +472,9 @@ function shouldEmitSlackThinkingStatus(
   sourceChannel: ChannelId,
   replyCallbackUrl?: string,
 ): boolean {
-  if (sourceChannel !== "slack" || !replyCallbackUrl) return false;
-  try {
-    return new URL(replyCallbackUrl).pathname.endsWith("/deliver/slack");
-  } catch {
-    return replyCallbackUrl.endsWith("/deliver/slack");
-  }
+  return (
+    sourceChannel === "slack" && isSlackDeliveryCallbackUrl(replyCallbackUrl)
+  );
 }
 
 export function shouldStartSlackThinkingStatusImmediately(params: {
@@ -547,6 +576,13 @@ function createSlackThinkingStatusController(params: {
         start();
       }
     },
+    refreshAfterReply() {
+      if (stopped || !slackThinkingStatus) return;
+      // Slack clears assistant thread status when the app sends a reply, so
+      // live pre-tool replies need to reassert it while work continues.
+      slackThinkingStatus.refresh(currentLoadingMessages);
+      lastSentLoadingMessageKey = getLoadingMessagesKey(currentLoadingMessages);
+    },
     stop() {
       stopped = true;
       slackThinkingStatus?.clear();
@@ -627,7 +663,9 @@ function getTaskProgressLoadingMessage(
 
   const activeStep = progress.steps[activeStepIndex]!;
   return [
-    `In progress (${activeStepIndex + 1}/${progress.steps.length}): ${activeStep.label}`,
+    `In progress (${activeStepIndex + 1}/${progress.steps.length}): ${
+      activeStep.label
+    }`,
   ];
 }
 
@@ -656,6 +694,7 @@ function setSlackThinkingStatus(
     if (!messageTs) {
       return {
         updateLoadingMessages: () => {},
+        refresh: () => {},
         clear: () => {},
       };
     }
@@ -697,6 +736,7 @@ function setSlackThinkingStatus(
 
     return {
       updateLoadingMessages: () => {},
+      refresh: () => {},
       clear: clearReaction,
     };
   }
@@ -739,6 +779,10 @@ function setSlackThinkingStatus(
     );
   };
 
+  const refresh = (nextLoadingMessages?: string[]): void => {
+    updateLoadingMessages(nextLoadingMessages);
+  };
+
   const clearStatus = (): void => {
     if (cleared) return;
     cleared = true;
@@ -766,6 +810,7 @@ function setSlackThinkingStatus(
 
   return {
     updateLoadingMessages,
+    refresh,
     clear: clearStatus,
   };
 }

package/src/runtime/routes/index.ts

@@ -40,6 +40,7 @@ import { ROUTES as CONTENT_SOURCE_ROUTES } from "./content-source-routes.js";
 import { ROUTES as CONVERSATION_ANALYSIS_ROUTES } from "./conversation-analysis-routes.js";
 import { ROUTES as CONVERSATION_ATTENTION_ROUTES } from "./conversation-attention-routes.js";
 import { ROUTES as CONVERSATION_CLI_ROUTES } from "./conversation-cli-routes.js";
+import { ROUTES as CONVERSATION_COMPACTION_ROUTES } from "./conversation-compaction-routes.js";
 import { ROUTES as CONVERSATION_LIST_ROUTES } from "./conversation-list-routes.js";
 import { ROUTES as CONVERSATION_MANAGEMENT_ROUTES } from "./conversation-management-routes.js";
 import { ROUTES as CONVERSATION_QUERY_ROUTES } from "./conversation-query-routes.js";
@@ -179,6 +180,7 @@ export const ROUTES: RouteDefinition[] = [
   ...CREDENTIAL_PROMPT_ROUTES,
   ...CREDENTIAL_ROUTES,
   ...DEFER_ROUTES,
+  ...CONVERSATION_COMPACTION_ROUTES,
   ...CONVERSATION_QUERY_ROUTES,
   ...CONVERSATION_STARTER_ROUTES,
   ...DEBUG_BASH_ROUTES,

package/src/runtime/routes/inference-profile-session-routes.ts

@@ -8,6 +8,7 @@
 
 import { z } from "zod";
 
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import {
   closeInferenceProfileSession,
@@ -65,7 +66,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_open",
     endpoint: "conversations/inference-profile-session",
     method: "POST",
-    policyKey: "conversations/inference-profile-session/open",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Open an inference-profile session",
     description:
       "Open (or replace) a session-backed inference-profile override for a conversation. " +
@@ -97,7 +101,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_close",
     endpoint: "conversations/inference-profile-session/close",
     method: "POST",
-    policyKey: "conversations/inference-profile-session/close",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Close an inference-profile session",
     description:
       "Close the active session-backed inference-profile override for a conversation. " +
@@ -122,7 +129,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_list",
     endpoint: "conversations/inference-profile-sessions",
     method: "GET",
-    policyKey: "conversations/inference-profile-sessions",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List active inference-profile sessions",
     description:
       "List all active (non-expired) session-backed inference-profile overrides, " +

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -4,7 +4,7 @@
  * GET    /v1/inference/provider-connections          — list all connections (optional ?provider= filter)
  * GET    /v1/inference/provider-connections/:name    — single connection by name
  * POST   /v1/inference/provider-connections          — create a new connection
- * PATCH  /v1/inference/provider-connections/:name    — update auth/label/status (cannot rename or change provider; auth is locked to platform for managed connections)
+ * PATCH  /v1/inference/provider-connections/:name    — update auth/label (cannot rename or change provider; auth is locked to platform for managed connections)
  * DELETE /v1/inference/provider-connections/:name    — delete (rejects if profiles or call sites reference it; rejects outright for managed connections)
  */
 
@@ -18,7 +18,6 @@ import {
   type ConnectionModel,
   ConnectionModelSchema,
   ConnectionProviderSchema,
-  ConnectionStatusSchema,
   ProviderConnectionSchema,
   VALID_CONNECTION_PROVIDERS,
 } from "../../providers/inference/auth.js";
@@ -36,6 +35,7 @@ import {
   resolveHostAddresses,
   resolveRequestAddress,
 } from "../../tools/network/url-safety.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -223,14 +223,6 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
 
-  const statusResult =
-    body.status !== undefined
-      ? ConnectionStatusSchema.safeParse(body.status)
-      : null;
-  if (statusResult && !statusResult.success) {
-    throw new BadRequestError(`Invalid status: must be "active" or "disabled"`);
-  }
-
   const labelRaw = body.label;
   if (
     labelRaw !== undefined &&
@@ -248,7 +240,6 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
     name,
     provider: providerResult.data,
     auth: authResult.data,
-    ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
     ...customFields,
   });
@@ -302,14 +293,6 @@ async function handleUpdateConnection({
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
 
-  const statusResult =
-    body.status !== undefined
-      ? ConnectionStatusSchema.safeParse(body.status)
-      : null;
-  if (statusResult && !statusResult.success) {
-    throw new BadRequestError(`Invalid status: must be "active" or "disabled"`);
-  }
-
   const labelRaw = body.label;
   if (
     labelRaw !== undefined &&
@@ -323,8 +306,8 @@ async function handleUpdateConnection({
 
   // Managed connections: lock auth to `{type:"platform"}`. The boot upsert in
   // `seedCanonicalConnections` would revert any other value on next restart;
-  // reject the write here so the surprise loop never happens. Label and status
-  // remain user-editable (the boot upsert leaves those alone).
+  // reject the write here so the surprise loop never happens. Label remains
+  // user-editable (the boot upsert leaves it alone).
   if (
     MANAGED_CONNECTION_NAMES.has(name) &&
     authResult.data.type !== "platform"
@@ -338,7 +321,6 @@ async function handleUpdateConnection({
 
   const result = updateConnection(getDb(), name, {
     auth: authResult.data,
-    ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
     ...customFields,
   });
@@ -387,7 +369,7 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   // re-overlaid by `seed-inference-profiles.ts` on boot).
   if (MANAGED_CONNECTION_NAMES.has(name)) {
     throw new BadRequestError(
-      `Cannot delete managed connection "${name}". This is a Vellum-managed connection — disable it via PATCH status="disabled" if you want to opt out of platform inference.`,
+      `Cannot delete managed connection "${name}". This is a Vellum-managed connection that is re-seeded on every startup.`,
     );
   }
 
@@ -441,7 +423,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_list",
     endpoint: "inference/provider-connections",
     method: "GET",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List provider connections",
     description:
       "Return all provider connections. Optionally filter by provider with ?provider=<name>.",
@@ -462,7 +447,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_get",
     endpoint: "inference/provider-connections/:name",
     method: "GET",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get a provider connection",
     description: "Return a single provider connection by name.",
     tags: ["inference"],
@@ -475,7 +463,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_create",
     endpoint: "inference/provider-connections",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create a provider connection",
     description:
       "Create a new named provider connection. Fails with 409 if a connection with this name already exists.",
@@ -485,7 +476,6 @@ export const ROUTES: RouteDefinition[] = [
       provider: ConnectionProviderSchema,
       auth: AuthSchema,
       label: z.string().min(1).optional(),
-      status: ConnectionStatusSchema.optional(),
       base_url: z.string().url().nullable().optional(),
       models: z.array(ConnectionModelSchema).nullable().optional(),
     }),
@@ -501,15 +491,17 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_update",
     endpoint: "inference/provider-connections/:name",
     method: "PATCH",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update a provider connection",
     description:
-      "Update an existing connection. Cannot rename or change the provider. For managed connections (anthropic-managed, openai-managed, gemini-managed) the auth is locked to platform; label and status remain editable.",
+      "Update an existing connection. Cannot rename or change the provider. For managed connections (anthropic-managed, openai-managed, gemini-managed) the auth is locked to platform; label remains editable.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     requestBody: z.object({
       auth: AuthSchema,
-      status: ConnectionStatusSchema.optional(),
       label: z.string().min(1).nullable().optional(),
       base_url: z.string().url().nullable().optional(),
       models: z.array(ConnectionModelSchema).nullable().optional(),
@@ -528,7 +520,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_delete",
     endpoint: "inference/provider-connections/:name",
     method: "DELETE",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a provider connection",
     description:
       "Delete a provider connection. Fails with 400 for managed connections (anthropic-managed, openai-managed, gemini-managed) which are re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",

package/src/runtime/routes/inference-send-routes.ts

@@ -13,6 +13,7 @@ import {
   getConfiguredProvider,
   userMessage,
 } from "../../providers/provider-send-message.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -55,18 +56,14 @@ async function handleInferenceSend({ body = {} }: RouteHandlerArgs) {
     );
   }
 
-  const response = await provider.sendMessage(
-    [userMessage(message)],
-    undefined,
+  const response = await provider.sendMessage([userMessage(message)], {
     systemPrompt,
-    {
-      config: {
-        callSite: "inference",
-        max_tokens: maxTokens,
-        model,
-      },
+    config: {
+      callSite: "inference",
+      max_tokens: maxTokens,
+      model,
     },
-  );
+  });
 
   const text = extractAllText(response);
 
@@ -89,7 +86,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_send",
     endpoint: "inference/send",
     method: "POST",
-    policyKey: "inference/send",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Send a message to the configured LLM",
     description:
       "Send a user message to the configured LLM provider and return the model response. " +

package/src/runtime/routes/integrations/a2a.ts

@@ -10,6 +10,8 @@
  * POST   /v1/integrations/a2a/invite/accept   — self-hosted broker: orchestrate complete + redeem
  */
 
+import { z } from "zod";
+
 import { isA2AEnabled } from "../../../a2a/feature-gate.js";
 import { getConfig } from "../../../config/loader.js";
 import {
@@ -21,6 +23,10 @@ import {
   redeemA2AInvite,
   setA2AConfig,
 } from "../../../daemon/handlers/config-a2a.js";
+import {
+  ACTOR_PRINCIPALS,
+  GATEWAY_PRINCIPALS,
+} from "../../auth/route-policy.js";
 import { BadGatewayError, BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -221,74 +227,91 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_a2a_config_get",
     endpoint: "integrations/a2a/config",
     method: "GET",
+    policy: null,
     summary: "Get A2A config",
     description: "Check current A2A channel configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetA2AConfig(),
   },
   {
     operationId: "integrations_a2a_config_post",
     endpoint: "integrations/a2a/config",
     method: "POST",
+    policy: null,
     summary: "Enable A2A channel",
     description: "Enable the A2A channel for inter-assistant communication.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleSetA2AConfig(),
   },
   {
     operationId: "integrations_a2a_config_delete",
     endpoint: "integrations/a2a/config",
     method: "DELETE",
+    policy: null,
     summary: "Disable A2A channel",
     description: "Disable the A2A channel.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearA2AConfig(),
   },
   {
     operationId: "integrations_a2a_invite_post",
     endpoint: "integrations/a2a/invite",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create A2A invite",
     description:
       "Create a shareable A2A invite token for link-based contact creation.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleCreateA2AInvite,
+    responseBody: z.object({
+      success: z.boolean(),
+      inviteId: z.string().optional(),
+      token: z.string().optional(),
+      expiresAt: z.number().optional(),
+      senderGatewayUrl: z.string().optional(),
+      error: z.string().optional(),
+    }),
   },
   {
     operationId: "integrations_a2a_invite_complete_post",
     endpoint: "integrations/a2a/invite/complete",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Complete A2A invite (sender side)",
     description:
       "Called by the platform to finalize the sender side of a link-based A2A connection.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleCompleteA2AInvite,
   },
   {
     operationId: "integrations_a2a_invite_redeem_post",
     endpoint: "integrations/a2a/invite/redeem",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Redeem A2A invite (receiver side)",
     description:
       "Called by the platform to create a trusted contact on the receiver side of a link-based A2A connection.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleRedeemA2AInvite,
   },
   {
     operationId: "integrations_a2a_invite_accept_post",
     endpoint: "integrations/a2a/invite/accept",
     method: "POST",
+    policy: null,
     summary: "Accept A2A invite (self-hosted broker)",
     description:
       "Orchestrate cross-daemon invite acceptance for self-hosted deployments. Calls the sender's invite/complete, then creates a local contact via invite/redeem.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleAcceptA2AInvite,
   },
 ];

package/src/runtime/routes/integrations/slack/channel.ts

@@ -6,11 +6,14 @@
  * DELETE /v1/integrations/slack/channel/config        — clear credentials
  */
 
+import { z } from "zod";
+
 import {
   clearSlackChannelConfig,
   getSlackChannelConfig,
   setSlackChannelConfig,
 } from "../../../../daemon/handlers/config-slack-channel.js";
+import { ACTOR_PRINCIPALS } from "../../../auth/route-policy.js";
 import { BadRequestError } from "../../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../../types.js";
 
@@ -52,30 +55,43 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_slack_channel_config_get",
     endpoint: "integrations/slack/channel/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Slack channel config",
     description: "Check current Slack channel configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetSlackChannelConfig(),
   },
   {
     operationId: "integrations_slack_channel_config_post",
     endpoint: "integrations/slack/channel/config",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Slack channel config",
     description: "Validate and store Slack channel credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetSlackChannelConfig,
+    requestBody: z.object({
+      botToken: z.string().describe("Slack bot token"),
+      appToken: z.string().describe("Slack app-level token"),
+    }),
   },
   {
     operationId: "integrations_slack_channel_config_delete",
     endpoint: "integrations/slack/channel/config",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Slack channel config",
     description: "Clear stored Slack channel credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearSlackChannelConfig(),
   },
 ];