@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/bookmark-routes.ts

@@ -23,6 +23,7 @@ import { getDb } from "../../memory/db-connection.js";
 import { getLogger } from "../../util/logger.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -120,6 +121,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "bookmarks_list",
     endpoint: "bookmarks",
     method: "GET",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List bookmarks",
     description:
       "Return all bookmarks (newest first), joined with their parent message and conversation.",
@@ -131,6 +136,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "bookmarks_create",
     endpoint: "bookmarks",
     method: "POST",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create a bookmark",
     description:
       "Bookmark the given message. Idempotent on `messageId` — calling twice returns the same bookmark.",
@@ -146,6 +155,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "bookmarks_delete_by_message",
     endpoint: "bookmarks/by-message/:messageId",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a bookmark by message id",
     description:
       "Delete the bookmark (if any) attached to the given message. Succeeds even if no row matched.",

package/src/runtime/routes/brain-graph-routes.ts

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { getDb } from "../../memory/db-connection.js";
 import { memoryGraphNodes } from "../../memory/schema.js";
 import { resolveBundledDir } from "../../util/bundled-asset.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { RouteError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -105,6 +106,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "brain_graph_get",
     endpoint: "brain-graph",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get brain graph data",
     description:
       "Return a knowledge-graph shaped for brain-lobe visualization, with memory items mapped to brain regions.",
@@ -124,6 +129,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "brain_graph_ui",
     endpoint: "brain-graph-ui",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve brain graph UI",
     description:
       "Return the brain-graph HTML visualization page. The gateway injects an auth token before serving.",

package/src/runtime/routes/browser-routes.ts

@@ -16,8 +16,9 @@ import {
   BROWSER_OPERATIONS,
   type BrowserOperation,
 } from "../../browser/types.js";
-import { findConversation } from "../../daemon/conversation-store.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
 import type { ContentBlock } from "../../providers/types.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Param validation ─────────────────────────────────────────────────
@@ -105,6 +106,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "browser_execute",
     endpoint: "browser/execute",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleBrowserExecute,
     summary: "Execute a browser operation",
     description:

package/src/runtime/routes/browser-tabs-routes.ts

@@ -7,7 +7,7 @@
 
 import { z } from "zod";
 
-import { findConversation } from "../../daemon/conversation-store.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
 import { getCdpClient } from "../../tools/browser/cdp-client/factory.js";
 import {
   clearPinnedTab,
@@ -15,6 +15,7 @@ import {
   setPinnedTab,
 } from "../../tools/browser/pinned-tabs.js";
 import type { ToolContext } from "../../tools/types.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { browserCliConversationKey } from "./browser-routes.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -72,11 +73,7 @@ async function handleBrowserTabs({ body = {} }: RouteHandlerArgs) {
           ? result.clientId
           : undefined;
       if (result?.tabId !== undefined) {
-        setPinnedTab(
-          resolvedConversationId,
-          String(result.tabId),
-          clientId,
-        );
+        setPinnedTab(resolvedConversationId, String(result.tabId), clientId);
       }
       return { ok: true, tab: result };
     } finally {
@@ -87,10 +84,10 @@ async function handleBrowserTabs({ body = {} }: RouteHandlerArgs) {
   if (command === "new") {
     const cdp = getCdpClient(context, cdpOptions);
     try {
-      const result = await cdp.send<{ tabId?: number | string; clientId?: string }>(
-        "Vellum.createTab",
-        {},
-      );
+      const result = await cdp.send<{
+        tabId?: number | string;
+        clientId?: string;
+      }>("Vellum.createTab", {});
       // Normalise to string for internal use (setCdpSessionId / setPinnedTab)
       // and keep the numeric form for the API response.
       const newTabIdStr: string | undefined =
@@ -171,6 +168,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "browser_tabs",
     endpoint: "browser/tabs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleBrowserTabs,
     summary: "Manage browser tabs",
     description:

package/src/runtime/routes/btw-routes.ts

@@ -9,21 +9,19 @@
  * intro generation. The response is streamed as SSE events (`btw_text_delta`,
  * `btw_complete`, `btw_error`).
  *
- * No messages are persisted. `conversation.processing` is never set or checked.
+ * No messages are persisted. The conversation's processing flag is never set or checked.
  */
 
-import { existsSync, readFileSync } from "node:fs";
-
 import { z } from "zod";
 
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfig } from "../../config/loader.js";
-import { readNowScratchpad } from "../../daemon/conversation-runtime-assembly.js";
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
-import { parseIdentityFields } from "../../daemon/handlers/identity.js";
+import { readNowScratchpad } from "../../daemon/now-scratchpad.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import { getAllToolDefinitions } from "../../tools/registry.js";
 import { getLogger } from "../../util/logger.js";
-import { getWorkspacePromptPath } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { runBtwSidechain } from "../btw-sidechain.js";
 import { BadRequestError, ServiceUnavailableError } from "./errors.js";
 import { getCachedIntro, setCachedIntro } from "./identity-intro-cache.js";
@@ -36,6 +34,9 @@ const IDENTITY_INTRO_KEY = "identity-intro";
 
 /** Conversation key used by the client for empty-state greeting generation. */
 const GREETING_KEY = "greeting";
+const EMPTY_STATE_DYNAMIC_GREETINGS_FLAG =
+  "empty-state-dynamic-greetings" as const;
+const STATIC_EMPTY_STATE_GREETING = "What are we working on?";
 
 // ---------------------------------------------------------------------------
 // SSE helpers
@@ -67,26 +68,22 @@ async function handleBtw({
 
   const trimmedContent = content.trim();
 
-  // ----- Identity intro fast-path -----
+  if (
+    conversationKey === GREETING_KEY &&
+    !isAssistantFeatureFlagEnabled(
+      EMPTY_STATE_DYNAMIC_GREETINGS_FLAG,
+      getConfig(),
+    )
+  ) {
+    return streamText(STATIC_EMPTY_STATE_GREETING);
+  }
+
+  // ----- Cached identity intro fast-path -----
   if (conversationKey === IDENTITY_INTRO_KEY) {
-    let fastText: string | undefined;
-    const identityPath = getWorkspacePromptPath("IDENTITY.md");
-    if (existsSync(identityPath)) {
-      const fields = parseIdentityFields(readFileSync(identityPath, "utf-8"));
-      if (fields.name) {
-        fastText = `Hi, I'm ${fields.name}!`;
-      }
-    }
-    fastText ??= getCachedIntro()?.greetings[0];
+    const fastText = getCachedIntro()?.greetings[0];
     if (fastText) {
       log.debug("Returning identity intro fast-path");
-      return new ReadableStream({
-        start(controller) {
-          controller.enqueue(sseEvent("btw_text_delta", { text: fastText }));
-          controller.enqueue(sseEvent("btw_complete", {}));
-          controller.close();
-        },
-      });
+      return streamText(fastText);
     }
   }
 
@@ -170,6 +167,16 @@ async function handleBtw({
   });
 }
 
+function streamText(text: string): ReadableStream<Uint8Array> {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(sseEvent("btw_text_delta", { text }));
+      controller.enqueue(sseEvent("btw_complete", {}));
+      controller.close();
+    },
+  });
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -179,7 +186,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runBtwSidechain",
     endpoint: "btw",
     method: "POST",
-    policyKey: "btw",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run ephemeral LLM side-chain",
     description:
       "Stream an ephemeral LLM call reusing the conversation's provider and message history. Response is SSE (btw_text_delta, btw_complete, btw_error).",

package/src/runtime/routes/cache-routes.ts

@@ -12,6 +12,7 @@ import {
   getCacheEntry,
   setCacheEntry,
 } from "../../skills/skill-cache-store.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Handlers ──────────────────────────────────────────────────────────
@@ -55,6 +56,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_set",
     endpoint: "cache/set",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheSet,
     summary: "Set a cache entry",
     description:
@@ -69,6 +74,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_get",
     endpoint: "cache/get",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheGet,
     summary: "Get a cache entry",
     description: "Retrieve a cached value by key. Returns null if not found.",
@@ -84,6 +93,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "cache_delete",
     endpoint: "cache/delete",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleCacheDelete,
     summary: "Delete a cache entry",
     description: "Remove a cached value by key.",

package/src/runtime/routes/call-routes.ts

@@ -20,6 +20,7 @@ import {
 import { getConfig } from "../../config/loader.js";
 import { VALID_CALLER_IDENTITY_MODES } from "../../config/schema.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, ForbiddenError, RouteError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -238,8 +239,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_start",
     endpoint: "calls/start",
     method: "POST",
-    policyKey: "calls/start",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start a call",
     description:
       "Initiate a new outbound phone call. Supports idempotency keys to prevent duplicate calls.",
@@ -276,8 +279,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_cancel",
     endpoint: "calls/:callSessionId/cancel",
     method: "POST",
-    policyKey: "calls/cancel",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Cancel a call",
     description: "Cancel an active or pending call.",
     tags: ["calls"],
@@ -294,8 +299,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_answer",
     endpoint: "calls/:callSessionId/answer",
     method: "POST",
-    policyKey: "calls/answer",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Answer a pending call question",
     description:
       "Provide an answer to a pending question during an active call.",
@@ -317,8 +324,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_instruction",
     endpoint: "calls/:callSessionId/instruction",
     method: "POST",
-    policyKey: "calls/instruction",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Relay instruction to active call",
     description: "Send a real-time instruction to an active call.",
     tags: ["calls"],
@@ -334,8 +343,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "calls_get",
     endpoint: "calls/:callSessionId",
     method: "GET",
-    policyKey: "calls",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["calls.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get call status",
     description: "Return the current status and details of a call session.",
     tags: ["calls"],

package/src/runtime/routes/channel-availability-routes.ts

@@ -26,6 +26,7 @@ import {
 } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
 import { VellumPlatformClient } from "../../platform/client.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // Base list every assistant currently surfaces. Order is the display
@@ -108,6 +109,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channels_available_get",
     endpoint: "channels/available",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get available channels",
     description:
       "Return the channels this assistant can surface to clients, with " +
@@ -115,7 +120,6 @@ export const ROUTES: RouteDefinition[] = [
       "copy). Today this is a fixed base list plus `email` when an inbox " +
       "is registered; will become plugin/skill-driven in future.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleGetChannelAvailability,
     responseBody: z.object({
       channels: z

package/src/runtime/routes/channel-readiness-routes.ts

@@ -9,6 +9,7 @@ import { z } from "zod";
 
 import type { ChannelId } from "../../channels/types.js";
 import { getReadinessService } from "../../daemon/handlers/config-channels.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   getInviteAdapterRegistry,
   resolveAdapterHandle,
@@ -80,6 +81,28 @@ async function handleRefreshChannelReadiness({ body = {} }: RouteHandlerArgs) {
   return { success: true, snapshots: enriched };
 }
 
+// ---------------------------------------------------------------------------
+// Response schemas (drive OpenAPI spec → codegen → typed SDK)
+// ---------------------------------------------------------------------------
+
+const readinessCheckSchema = z.object({
+  name: z.string(),
+  passed: z.boolean(),
+  message: z.string().nullable().optional(),
+});
+
+const readinessSnapshotSchema = z.object({
+  channel: z.string(),
+  ready: z.boolean(),
+  setupStatus: z.string().nullable().optional(),
+  checkedAt: z.number().nullable().optional(),
+  stale: z.boolean().optional(),
+  reasons: z.array(z.string()).optional(),
+  localChecks: z.array(readinessCheckSchema).optional(),
+  remoteChecks: z.array(readinessCheckSchema).optional(),
+  channelHandle: z.string().nullable().optional(),
+});
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -89,10 +112,13 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channels_readiness_get",
     endpoint: "channels/readiness",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get channel readiness",
     description: "Return readiness snapshots for one or all channels.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleGetChannelReadiness,
     queryParams: [
       {
@@ -108,17 +134,22 @@ export const ROUTES: RouteDefinition[] = [
     ],
     responseBody: z.object({
       success: z.boolean(),
-      snapshots: z.array(z.unknown()).describe("Channel readiness snapshots"),
+      snapshots: z
+        .array(readinessSnapshotSchema)
+        .describe("Channel readiness snapshots"),
     }),
   },
   {
     operationId: "channels_readiness_refresh_post",
     endpoint: "channels/readiness/refresh",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Refresh channel readiness",
     description: "Invalidate cache and re-evaluate channel readiness.",
     tags: ["channels"],
-    requirePolicyEnforcement: true,
     handler: handleRefreshChannelReadiness,
     requestBody: z.object({
       channel: z.string().describe("Optional channel ID to refresh"),
@@ -128,7 +159,9 @@ export const ROUTES: RouteDefinition[] = [
     }),
     responseBody: z.object({
       success: z.boolean(),
-      snapshots: z.array(z.unknown()).describe("Refreshed readiness snapshots"),
+      snapshots: z
+        .array(readinessSnapshotSchema)
+        .describe("Refreshed readiness snapshots"),
     }),
   },
 ];

package/src/runtime/routes/channel-route-definitions.ts

@@ -1,6 +1,7 @@
 /**
  * Static ROUTES array for channel endpoints.
  */
+import { ACTOR_PRINCIPALS, GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import {
   handleChannelDeliveryAck,
   handleListDeadLetters,
@@ -17,6 +18,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_delete_conversation",
     endpoint: "channels/conversation",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete channel conversation",
     description: "Delete a conversation by channel source.",
     tags: ["channels"],
@@ -26,6 +31,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_inbound",
     endpoint: "channels/inbound",
     method: "POST",
+    policy: {
+      requiredScopes: ["ingress.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Process inbound channel message",
     description: "Receive an inbound message from a channel integration.",
     tags: ["channels"],
@@ -35,6 +44,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_delivery_ack",
     endpoint: "channels/delivery-ack",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Acknowledge channel delivery",
     description: "Acknowledge delivery of a channel message.",
     tags: ["channels"],
@@ -45,6 +58,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_dead_letters",
     endpoint: "channels/dead-letters",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List dead letters",
     description: "Return undeliverable channel messages.",
     tags: ["channels"],
@@ -54,6 +71,10 @@ export const CHANNEL_ROUTES: RouteDefinition[] = [
     operationId: "channel_replay_dead_letters",
     endpoint: "channels/replay",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Replay dead letters",
     description: "Retry delivery of dead-letter messages.",
     tags: ["channels"],

package/src/runtime/routes/channel-verification-routes.ts

@@ -19,6 +19,7 @@ import {
 } from "../../daemon/handlers/config-channels.js";
 import { normalizePhoneNumber } from "../../util/phone.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { revokePendingSessions } from "../channel-verification-service.js";
 import {
   cancelOutbound,
@@ -271,6 +272,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_create",
     endpoint: "channel-verification-sessions",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create verification session",
     description:
       "Create a channel verification session (inbound challenge, outbound, or trusted contact).",
@@ -290,6 +295,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_resend",
     endpoint: "channel-verification-sessions/resend",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Resend verification code",
     description: "Resend the outbound verification code.",
     tags: ["channel-verification"],
@@ -303,6 +312,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_cancel",
     endpoint: "channel-verification-sessions",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Cancel verification sessions",
     description:
       "Cancel all active inbound and outbound verification sessions.",
@@ -316,6 +329,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_revoke",
     endpoint: "channel-verification-sessions/revoke",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Revoke verification binding",
     description: "Cancel all sessions and revoke the guardian binding.",
     tags: ["channel-verification"],
@@ -328,6 +345,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "channel_verification_sessions_status",
     endpoint: "channel-verification-sessions/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get verification status",
     description: "Check guardian binding and verification session status.",
     tags: ["channel-verification"],

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -28,6 +28,7 @@ import {
 } from "../../security/oauth2.js";
 import { setSecureKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -214,7 +215,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_chatgpt_subscription_auth",
     endpoint: "inference/chatgpt-subscription/auth",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start ChatGPT subscription OAuth PKCE flow",
     description:
       "Generate a PKCE authorize URL for ChatGPT subscription auth. Returns the URL and state for the client to open in a browser.",
@@ -229,7 +233,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_chatgpt_subscription_auth_exchange",
     endpoint: "inference/chatgpt-subscription/auth/exchange",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Exchange ChatGPT subscription OAuth authorization code",
     description:
       "Accept an authorization code and state from the OAuth redirect, exchange it for tokens, store them in CES, and upsert the provider connection.",

package/src/runtime/routes/client-routes.ts

@@ -11,6 +11,7 @@ import type { HostProxyCapability } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { datesToISO } from "../../util/json.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -19,6 +20,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "list_clients",
     endpoint: "clients",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List connected clients",
     description:
       "Return all connected clients, optionally filtered by capability.",
@@ -78,6 +83,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "disconnect_client",
     endpoint: "clients/disconnect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Force-disconnect a client",
     description:
       "Dispose all hub subscribers for the given clientId, forcibly closing their SSE streams.",