@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/conversation-query-routes.ts

@@ -20,6 +20,7 @@
 
 import { z } from "zod";
 
+import { LlmContextResponseSchema } from "../../api/responses/llm-context-response.js";
 import {
   deepMergeOverwrite,
   fillContextDefaultsForMissingKeys,
@@ -71,6 +72,7 @@ import { type LogRow } from "../../memory/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../memory/memory-recall-log-store.js";
 import { getMemoryV2ActivationLogByMessageIds } from "../../memory/memory-v2-activation-log-store.js";
 import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../memory/v2/constants.js";
+import { getMemoryV3SelectionForInspector } from "../../plugins/defaults/memory-v3-shadow/selection-log-store.js";
 import {
   createConnection,
   listConnections,
@@ -107,6 +109,7 @@ type LlmContextRouteResult = Omit<LlmContextNormalizationResult, "summary"> & {
 };
 
 import { MANAGED_PROFILE_NAMES } from "../../config/seed-inference-profiles.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 
 const RESERVED_PROFILE_NAMES = new Set([
   "__proto__",
@@ -877,13 +880,11 @@ function handleGetMessageContent({
   return result;
 }
 
-const CONVERSATION_KINDS = [
-  "user",
-  "background",
-  "background_memory_consolidation",
-  "scheduled",
-] as const;
-type ConversationKind = (typeof CONVERSATION_KINDS)[number];
+type ConversationKind =
+  | "user"
+  | "background"
+  | "background_memory_consolidation"
+  | "scheduled";
 
 function resolveConversationKind(
   source: string,
@@ -921,6 +922,12 @@ async function handleGetLlmContext({ pathParams = {} }: RouteHandlerArgs) {
   // turn finishes — see `assistant/src/memory/conversation-crud.ts`.
   const conversationTotalEstimatedCostUsd =
     conversation?.totalEstimatedCost ?? null;
+  const memoryV3Selection = message
+    ? await getMemoryV3SelectionForInspector(
+        message.conversationId,
+        memoryV2Activation?.turn ?? null,
+      )
+    : null;
   return {
     messageId,
     conversationKind,
@@ -928,6 +935,7 @@ async function handleGetLlmContext({ pathParams = {} }: RouteHandlerArgs) {
     logs: logs.map(normalizeLlmContextLog),
     memoryRecall: memoryRecallLog ?? null,
     memoryV2Activation: memoryV2Activation ?? null,
+    memoryV3Selection,
   };
 }
 
@@ -953,6 +961,7 @@ async function handleGetConversationLlmContext({
         logs: [],
         memoryRecall: null,
         memoryV2Activation: null,
+        memoryV3Selection: null,
       };
     }
     throw new BadRequestError(
@@ -971,6 +980,7 @@ async function handleGetConversationLlmContext({
         logs: [],
         memoryRecall: null,
         memoryV2Activation: null,
+        memoryV3Selection: null,
       };
     }
     throw new NotFoundError(`Conversation ${conversationId} not found`);
@@ -993,6 +1003,7 @@ async function handleGetConversationLlmContext({
     logs: logs.map(normalizeLlmContextLog),
     memoryRecall: null,
     memoryV2Activation: null,
+    memoryV3Selection: null,
   };
 }
 
@@ -1080,7 +1091,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "model_get",
     endpoint: "model",
     method: "GET",
-    policyKey: "model",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get current model config",
     description:
       "Return the active LLM model ID, provider, and available models.",
@@ -1091,7 +1105,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "model_image_gen_set",
     endpoint: "model/image-gen",
     method: "PUT",
-    policyKey: "model/image-gen",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set image generation model",
     description: "Change the active image generation model.",
     tags: ["config"],
@@ -1102,7 +1119,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_embeddings_get",
     endpoint: "config/embeddings",
     method: "GET",
-    policyKey: "config/embeddings",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get embedding config",
     description:
       "Return the active embedding provider, model, and available options.",
@@ -1113,7 +1133,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_embeddings_set",
     endpoint: "config/embeddings",
     method: "PUT",
-    policyKey: "config/embeddings",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set embedding config",
     description: "Change the embedding provider and optionally model.",
     tags: ["config"],
@@ -1127,7 +1150,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_get",
     endpoint: "config",
     method: "GET",
-    policyKey: "config",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get full config",
     description: "Return the raw settings.json configuration object.",
     tags: ["config"],
@@ -1137,18 +1163,26 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_patch",
     endpoint: "config",
     method: "PATCH",
-    policyKey: "config",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Patch config",
     description:
       "Deep-merge a partial JSON object into the settings.json configuration.",
     tags: ["config"],
+    requestBody: z.record(z.string(), z.unknown()),
+    responseBody: z.object({ ok: z.boolean() }),
     handler: handlePatchConfig,
   },
   {
     operationId: "config_set",
     endpoint: "config/set",
     method: "POST",
-    policyKey: "config/set",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set a single config path",
     description:
       "Assign a value at a dotted config path with direct-replacement semantics " +
@@ -1161,7 +1195,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_allowlist_validate",
     endpoint: "config/allowlist/validate",
     method: "GET",
-    policyKey: "config/allowlist/validate",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Validate secret-allowlist.json regex patterns",
     description:
       "Compile each regex pattern in secret-allowlist.json and return any " +
@@ -1173,7 +1210,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_schema_get",
     endpoint: "config/schema",
     method: "GET",
-    policyKey: "config/schema",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get config JSON Schema",
     description:
       "Return the JSON Schema for the assistant config, optionally scoped to a dotted-path sub-schema (e.g. ?path=calls).",
@@ -1191,7 +1231,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "config_llm_profiles_replace",
     endpoint: "config/llm/profiles/:name",
     method: "PUT",
-    policyKey: "config",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Replace an inference profile",
     description:
       "Replace the settings-UI-managed leaves of a single llm.profiles entry while preserving non-UI leaves.",
@@ -1202,7 +1245,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "conversations_search",
     endpoint: "conversations/search",
     method: "GET",
-    policyKey: "conversations/search",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Search conversations",
     description:
       "Full-text search across conversation titles and message content.",
@@ -1235,7 +1281,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "messages_content_get",
     endpoint: "messages/:id/content",
     method: "GET",
-    policyKey: "messages/content",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get message content",
     description: "Return the full content of a single message by ID.",
     tags: ["messages"],
@@ -1252,7 +1301,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "conversations_llm_context_get",
     endpoint: "conversations/llm-context",
     method: "GET",
-    policyKey: "conversations/llm-context",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get LLM context for a conversation",
     description:
       "Returns normalized LLM request/response logs for an entire conversation.",
@@ -1271,41 +1323,32 @@ export const ROUTES: RouteDefinition[] = [
         description: "Internal conversation identifier.",
       },
     ],
-    responseBody: z.object({
-      conversationKey: z.string().nullable().optional(),
-      conversationId: z.string().nullable(),
-      conversationKind: z.enum(CONVERSATION_KINDS),
-      conversationTotalEstimatedCostUsd: z.number().nullable(),
-      logs: z.array(z.unknown()),
-      memoryRecall: z.object({}).passthrough().nullable(),
-      memoryV2Activation: z.object({}).passthrough().nullable(),
-    }),
+    responseBody: LlmContextResponseSchema,
     handler: handleGetConversationLlmContext,
   },
   {
     operationId: "messages_llm_context_get",
     endpoint: "messages/:id/llm-context",
     method: "GET",
-    policyKey: "messages/llm-context",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get LLM context for a message",
     description:
       "Return request/response logs and memory recall data for a specific message.",
     tags: ["messages"],
-    responseBody: z.object({
-      messageId: z.string(),
-      conversationKind: z.enum(CONVERSATION_KINDS),
-      conversationTotalEstimatedCostUsd: z.number().nullable(),
-      logs: z.array(z.unknown()),
-      memoryRecall: z.object({}).passthrough().nullable(),
-      memoryV2Activation: z.object({}).passthrough().nullable(),
-    }),
+    responseBody: LlmContextResponseSchema,
     handler: handleGetLlmContext,
   },
   {
     operationId: "llm_request_logs_payload_get",
     endpoint: "llm-request-logs/:id/payload",
     method: "GET",
-    policyKey: "llm-request-logs/payload",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get raw payload for a single LLM request log",
     description:
       "Return the full request and response payloads for a specific log entry.",
@@ -1321,7 +1364,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "messages_queued_delete",
     endpoint: "messages/queued/:id",
     method: "DELETE",
-    policyKey: "messages/queued",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a queued message",
     description:
       "Remove a pending message from the conversation queue before it is processed.",
@@ -1340,7 +1386,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "messages_queued_steer",
     endpoint: "messages/queued/:id/steer",
     method: "POST",
-    policyKey: "messages/queued",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Steer to a queued message",
     description:
       "Promote a queued message to the head of the queue and abort the current generation so it is processed next.",