@vellumai/assistant 0.8.5 → 0.8.7

package/src/runtime/routes/integrations/slack/share.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
 import { getLogger } from "../../../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../../../auth/route-policy.js";
 import {
   BadRequestError,
   InternalError,
@@ -197,20 +198,26 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "slack_channels_get",
     endpoint: "slack/channels",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List Slack channels",
     description: "List Slack channels, groups, and DMs for the channel picker.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleListSlackChannels(),
   },
   {
     operationId: "slack_share_post",
     endpoint: "slack/share",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Share to Slack channel",
     description: "Post an app link directly to a Slack channel.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleShareToSlackChannel,
   },
 ];

package/src/runtime/routes/integrations/telegram.ts

@@ -8,6 +8,8 @@
  * POST   /v1/integrations/telegram/setup    — composite: set config + register commands
  */
 
+import { z } from "zod";
+
 import {
   clearTelegramConfig,
   getTelegramConfig,
@@ -15,6 +17,7 @@ import {
   setTelegramConfig,
   setupTelegram,
 } from "../../../daemon/handlers/config-telegram.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -31,8 +34,7 @@ async function handleSetTelegramConfig({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramConfig(botToken);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram config",
+      (result as { error?: string }).error ?? "Failed to set Telegram config",
     );
   }
   return result;
@@ -49,8 +51,7 @@ async function handleSetTelegramCommands({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramCommands(commands);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram commands",
+      (result as { error?: string }).error ?? "Failed to set Telegram commands",
     );
   }
   return result;
@@ -79,50 +80,68 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_telegram_config_get",
     endpoint: "integrations/telegram/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Telegram config",
     description: "Check current Telegram bot configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_config_post",
     endpoint: "integrations/telegram/config",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Telegram config",
     description: "Set bot token and configure webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTelegramConfig,
+    requestBody: z.object({
+      botToken: z.string().describe("Telegram bot token"),
+    }),
   },
   {
     operationId: "integrations_telegram_config_delete",
     endpoint: "integrations/telegram/config",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Telegram config",
     description: "Clear credentials and deregister webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_commands_post",
     endpoint: "integrations/telegram/commands",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Register Telegram commands",
     description: "Register bot commands with the Telegram API.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTelegramCommands,
   },
   {
     operationId: "integrations_telegram_setup_post",
     endpoint: "integrations/telegram/setup",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Setup Telegram",
     description: "Composite: set config + register commands.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetupTelegram,
   },
 ];

package/src/runtime/routes/integrations/twilio.ts

@@ -10,6 +10,8 @@
  * POST   /v1/integrations/twilio/numbers/release                     — release a phone number
  */
 
+import { z } from "zod";
+
 import {
   getTwilioCredentials,
   hasTwilioCredentials,
@@ -30,6 +32,7 @@ import {
   deleteCredentialMetadata,
   upsertCredentialMetadata,
 } from "../../../tools/credentials/metadata-store.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError, InternalError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -352,70 +355,95 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_twilio_config_get",
     endpoint: "integrations/twilio/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Twilio config",
     description: "Return current Twilio configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetTwilioConfig(),
   },
   {
     operationId: "integrations_twilio_credentials_post",
     endpoint: "integrations/twilio/credentials",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Twilio credentials",
     description: "Validate and store Twilio account SID and auth token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTwilioCredentials,
+    requestBody: z.object({
+      accountSid: z.string().describe("Twilio account SID"),
+      authToken: z.string().describe("Twilio auth token"),
+    }),
   },
   {
     operationId: "integrations_twilio_credentials_delete",
     endpoint: "integrations/twilio/credentials",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Twilio credentials",
     description: "Remove stored Twilio credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearTwilioCredentials(),
   },
   {
     operationId: "integrations_twilio_numbers_get",
     endpoint: "integrations/twilio/numbers",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List Twilio numbers",
     description: "List phone numbers on the Twilio account.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleListTwilioNumbers(),
   },
   {
     operationId: "integrations_twilio_numbers_provision_post",
     endpoint: "integrations/twilio/numbers/provision",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Provision Twilio number",
     description: "Search for and provision a new phone number.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleProvisionTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_assign_post",
     endpoint: "integrations/twilio/numbers/assign",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Assign Twilio number",
     description: "Assign an existing phone number to this assistant.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleAssignTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_release_post",
     endpoint: "integrations/twilio/numbers/release",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Release Twilio number",
     description: "Release a phone number back to Twilio.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleReleaseTwilioNumber,
   },
 ];

package/src/runtime/routes/integrations/vercel.ts

@@ -9,6 +9,8 @@
  * ("set" or "delete") rather than using HTTP verbs directly.
  */
 
+import { z } from "zod";
+
 import {
   deleteVercelConfig,
   getVercelConfig,
@@ -17,6 +19,12 @@ import {
 import { BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
+const vercelConfigResponseSchema = z.object({
+  hasToken: z.boolean(),
+  success: z.boolean(),
+  error: z.string().optional(),
+});
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -62,31 +70,38 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_get",
     endpoint: "integrations/vercel/config",
     method: "GET",
+    policy: null,
     summary: "Get Vercel config",
     description: "Check if a Vercel API token is stored.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: vercelConfigResponseSchema,
     handler: () => handleGetVercelConfig(),
   },
   {
     operationId: "integrations_vercel_config_post",
     endpoint: "integrations/vercel/config",
     method: "POST",
+    policy: null,
     summary: "Set or delete Vercel config",
     description:
       "Set or delete the Vercel API token. Action is determined by the body action field.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    requestBody: z.object({
+      action: z.enum(["get", "set", "delete"]).optional(),
+      apiToken: z.string().optional(),
+    }),
+    responseBody: vercelConfigResponseSchema,
     handler: handlePostVercelConfig,
   },
   {
     operationId: "integrations_vercel_config_delete",
     endpoint: "integrations/vercel/config",
     method: "DELETE",
+    policy: null,
     summary: "Delete Vercel config",
     description: "Delete the stored Vercel API token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: vercelConfigResponseSchema,
     handler: () => handleDeleteVercelConfig(),
   },
 ];

package/src/runtime/routes/internal-oauth-routes.ts

@@ -10,6 +10,7 @@ import {
   consumeCallback,
   consumeCallbackError,
 } from "../../security/oauth-callback-registry.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -18,6 +19,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_callback",
     endpoint: "internal/oauth/callback",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal OAuth callback",
     description:
       "Receives forwarded OAuth callback results (code or error) from the gateway and resolves the pending callback in the runtime.",

package/src/runtime/routes/internal-twilio-routes.ts

@@ -10,6 +10,7 @@ import {
   handleInternalStatusCallback,
   handleInternalVoiceWebhook,
 } from "../../calls/twilio-routes.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
 export const ROUTES: RouteDefinition[] = [
@@ -17,6 +18,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_voice_webhook",
     endpoint: "internal/twilio/voice-webhook",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio voice webhook",
     description:
       "Gateway-to-runtime forwarding for Twilio voice webhook. Accepts pre-parsed form params as JSON.",
@@ -27,6 +32,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_status",
     endpoint: "internal/twilio/status",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio status callback",
     description:
       "Gateway-to-runtime forwarding for Twilio call status updates. Accepts pre-parsed form params as JSON.",
@@ -37,6 +46,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_connect_action",
     endpoint: "internal/twilio/connect-action",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio connect-action",
     description:
       "Gateway-to-runtime forwarding for ConversationRelay connect-action callback.",

package/src/runtime/routes/llm-call-sites-routes.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
 import { loadConfig } from "../../config/loader.js";
 import {
@@ -5,8 +7,27 @@ import {
   CALL_SITE_DOMAINS,
 } from "../../config/schemas/call-site-catalog.js";
 import type { LLMCallSite } from "../../config/schemas/llm.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
+const callSiteDomainSchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+});
+
+const callSiteEntrySchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  domain: z.string(),
+  defaultProfile: z.string().optional(),
+});
+
+const callSiteCatalogResponseSchema = z.object({
+  domains: z.array(callSiteDomainSchema),
+  callSites: z.array(callSiteEntrySchema),
+});
+
 async function handleGetCallSites() {
   const { llm } = loadConfig();
   return {
@@ -18,12 +39,16 @@ async function handleGetCallSites() {
   };
 }
 
-export interface LlmProfilesListResult {
+const llmProfilesListResponseSchema = z.object({
   /** Sorted list of profile names defined in `llm.profiles`. */
-  profiles: string[];
+  profiles: z.array(z.string()),
   /** The workspace-wide active profile name, if one is set. */
-  activeProfile: string | null;
-}
+  activeProfile: z.string().nullable(),
+});
+
+export type LlmProfilesListResult = z.infer<
+  typeof llmProfilesListResponseSchema
+>;
 
 async function handleListProfiles(): Promise<LlmProfilesListResult> {
   const { llm } = loadConfig();
@@ -39,21 +64,31 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "llm_call_sites_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/call-sites",
     handler: handleGetCallSites,
     summary: "List LLM call sites",
     description:
       "Returns the full catalog of LLM call sites with display names, descriptions, and domain groupings. Used by clients to render the per-call-site override settings UI.",
     tags: ["config"],
+    responseBody: callSiteCatalogResponseSchema,
   },
   {
     operationId: "llm_profiles_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/profiles",
     handler: handleListProfiles,
     summary: "List defined LLM profiles",
     description:
       "Returns the sorted list of profile names defined in `llm.profiles` plus the workspace-wide active profile. Used to populate per-call profile dropdowns (e.g. memory router playground) without requiring the caller to type profile names.",
     tags: ["config"],
+    responseBody: llmProfilesListResponseSchema,
   },
 ];

package/src/runtime/routes/llm-context-normalization.ts

@@ -1057,8 +1057,13 @@ function extractOpenAiResponsesRequestToolNames(tools: unknown): string[] {
       if (asString(tool.type) === "function" && asString(tool.name)) {
         return asString(tool.name);
       }
-      // Native web search tool: { type: "web_search_preview" }
-      if (asString(tool.type) === "web_search_preview") {
+      // Native web search tools:
+      // - OpenAI API: { type: "web_search_preview" }
+      // - Codex subscription endpoint: { type: "web_search" }
+      if (
+        asString(tool.type) === "web_search_preview" ||
+        asString(tool.type) === "web_search"
+      ) {
         return "web_search";
       }
       return undefined;

package/src/runtime/routes/log-export-routes.ts

@@ -37,6 +37,7 @@ import {
 } from "../../util/platform.js";
 import { APP_VERSION, COMMIT_SHA } from "../../version.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { createTarGz } from "./archive-utils.js";
 import { InternalError } from "./errors.js";
 import { collectWorkspaceData } from "./log-export/workspace-allowlist.js";
@@ -221,7 +222,9 @@ async function handleExport({
       }
     }
 
-    // --- Daemon log grep for conversationId ---
+    // --- Conversation-scoped daemon log slice ---
+    // Write a `conversation-filtered.jsonl` slice of the lines that mention the
+    // conversationId as a quick index into the full daily logs.
     if (conversationId && collectedLogFiles.length > 0) {
       const matchingLines: string[] = [];
       for (const logFile of collectedLogFiles) {
@@ -244,13 +247,22 @@ async function handleExport({
         );
       }
 
-      for (const logFile of collectedLogFiles) {
-        try {
-          rmSync(logFile, { force: true });
-        } catch {
-          // Best-effort removal
-        }
-      }
+      // We intentionally retain the full daily `assistant-*.log` and
+      // `daemon-stderr.log` files rather than removing them here. Agent-loop
+      // failures — stream aborts, stack traces, provider errors — are routinely
+      // logged without the conversationId, so the grep above drops exactly the
+      // lines needed to debug a failed turn. We cannot currently guarantee that
+      // every log line emitted while handling a conversation carries its
+      // conversationId; until we can, the full daily log must stay in the
+      // bundle. Re-enable the removal below only once that guarantee holds.
+      //
+      // for (const logFile of collectedLogFiles) {
+      //   try {
+      //     rmSync(logFile, { force: true });
+      //   } catch {
+      //     // Best-effort removal
+      //   }
+      // }
     }
 
     // --- Workspace allowlist ---
@@ -486,7 +498,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs",
     endpoint: "export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data",
     description:
@@ -507,7 +522,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs_alias",
     endpoint: "logs/export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data (alias)",
     description:

package/src/runtime/routes/mcp-auth-routes.ts

@@ -20,6 +20,7 @@ import { orchestrateMcpOAuthConnect } from "../../mcp/mcp-auth-orchestrator.js";
 import { getMcpAuthState } from "../../mcp/mcp-auth-state.js";
 import { deleteMcpOAuthCredentials } from "../../mcp/mcp-oauth-provider.js";
 import { getLogger } from "../../util/logger.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -332,6 +333,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_auth_start",
     endpoint: "internal/mcp/auth/start",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Start MCP OAuth flow",
     description:
       "Starts a daemon-owned MCP OAuth flow and returns the authorization URL for the CLI to open in the browser.",
@@ -343,6 +348,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_auth_status",
     endpoint: "internal/mcp/auth/status/:serverId",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Poll MCP OAuth flow status",
     description:
       "Returns the current status of an in-flight MCP OAuth flow (pending/complete/error).",
@@ -357,6 +366,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_reload",
     endpoint: "internal/mcp/reload",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Trigger MCP server reload",
     description:
       "Kicks off reloadMcpServers() async on the daemon. Returns immediately.",
@@ -367,6 +380,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_list",
     endpoint: "internal/mcp/list",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "List MCP servers with health status",
     description:
       "Returns configured MCP servers with live health-check results (connected, needs auth, error, disabled).",
@@ -377,6 +394,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_add",
     endpoint: "internal/mcp/add",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Add an MCP server configuration",
     description:
       "Writes a new MCP server entry to config.json and triggers a reload.",
@@ -396,6 +417,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_remove",
     endpoint: "internal/mcp/remove",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Remove an MCP server configuration",
     description:
       "Removes an MCP server from config.json, cleans up OAuth credentials, and triggers a reload.",