@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/heartbeat-routes.ts

@@ -18,9 +18,12 @@ import {
 } from "../../config/loader.js";
 import { listHeartbeatRuns } from "../../heartbeat/heartbeat-run-store.js";
 import { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
+import { getConversation } from "../../memory/conversation-crud.js";
+import { getUsageCostForConversationWindow } from "../../memory/llm-usage-store.js";
 import { readTextFileSync } from "../../util/fs.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspacePromptPath } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -37,19 +40,34 @@ function handleListRuns(queryParams: Record<string, string>) {
     : 20;
 
   const runs = listHeartbeatRuns(limit);
+  const now = Date.now();
   return {
-    runs: runs.map((r) => ({
-      id: r.id,
-      scheduledFor: r.scheduledFor,
-      startedAt: r.startedAt,
-      finishedAt: r.finishedAt,
-      durationMs: r.durationMs,
-      status: r.status,
-      skipReason: r.skipReason,
-      error: r.error,
-      conversationId: r.conversationId,
-      createdAt: r.createdAt,
-    })),
+    runs: runs.map((r) => {
+      const conversation = r.conversationId
+        ? getConversation(r.conversationId)
+        : null;
+      return {
+        id: r.id,
+        scheduledFor: r.scheduledFor,
+        startedAt: r.startedAt,
+        finishedAt: r.finishedAt,
+        durationMs: r.durationMs,
+        status: r.status,
+        skipReason: r.skipReason,
+        error: r.error,
+        conversationId: r.conversationId,
+        conversationExists: conversation != null,
+        conversationArchivedAt: conversation?.archivedAt ?? null,
+        estimatedCostUsd: r.conversationId
+          ? getUsageCostForConversationWindow({
+              conversationId: r.conversationId,
+              from: r.startedAt ?? r.scheduledFor,
+              to: r.finishedAt ?? now,
+            })
+          : 0,
+        createdAt: r.createdAt,
+      };
+    }),
   };
 }
 
@@ -88,7 +106,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listHeartbeatRuns",
     endpoint: "heartbeat/runs",
     method: "GET",
-    policyKey: "heartbeat",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List heartbeat runs",
     description: "Return recent heartbeat conversation runs.",
     tags: ["heartbeat"],
@@ -112,6 +133,9 @@ export const ROUTES: RouteDefinition[] = [
             skipReason: z.string().nullable(),
             error: z.string().nullable(),
             conversationId: z.string().nullable(),
+            conversationExists: z.boolean(),
+            conversationArchivedAt: z.number().nullable(),
+            estimatedCostUsd: z.number(),
             createdAt: z.number(),
           }),
         )
@@ -124,7 +148,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getHeartbeatChecklist",
     endpoint: "heartbeat/checklist",
     method: "GET",
-    policyKey: "heartbeat",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get heartbeat checklist",
     description: "Return the HEARTBEAT.md checklist content.",
     tags: ["heartbeat"],
@@ -138,7 +165,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "writeHeartbeatChecklist",
     endpoint: "heartbeat/checklist",
     method: "PUT",
-    policyKey: "heartbeat",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Write heartbeat checklist",
     description: "Overwrite the HEARTBEAT.md checklist content.",
     tags: ["heartbeat"],
@@ -154,8 +184,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getHeartbeatConfig",
     endpoint: "heartbeat/config",
     method: "GET",
-    policyKey: "heartbeat",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get heartbeat config",
     description: "Return the current heartbeat schedule configuration.",
     tags: ["heartbeat"],
@@ -190,8 +222,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateHeartbeatConfig",
     endpoint: "heartbeat/config",
     method: "PUT",
-    policyKey: "heartbeat",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update heartbeat config",
     description: "Update the heartbeat schedule configuration.",
     tags: ["heartbeat"],
@@ -295,8 +329,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runHeartbeatNow",
     endpoint: "heartbeat/run-now",
     method: "POST",
-    policyKey: "heartbeat",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run heartbeat now",
     description: "Trigger an immediate heartbeat run.",
     tags: ["heartbeat"],

package/src/runtime/routes/home-feed-routes.ts

@@ -24,10 +24,10 @@ import { z } from "zod";
 
 import {
   type FeedItem,
-  feedItemSchema,
+  FeedItemSchema,
   type FeedItemStatus,
-  suggestedPromptSchema,
-} from "../../home/feed-types.js";
+  HomeFeedResponseSchema,
+} from "../../api/responses/home.js";
 import { patchFeedItemStatus, readHomeFeed } from "../../home/feed-writer.js";
 import { getPersonalizedGreeting } from "../../home/home-greeting.js";
 import { getSuggestedPrompts } from "../../home/suggested-prompts.js";
@@ -36,6 +36,7 @@ import {
   createConversation,
 } from "../../memory/conversation-crud.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -45,19 +46,6 @@ const log = getLogger("home-feed-routes");
 // Response / request schemas
 // ---------------------------------------------------------------------------
 
-const contextBannerSchema = z.object({
-  greeting: z.string(),
-  timeAwayLabel: z.string(),
-  newCount: z.number().int().min(0),
-});
-
-const getHomeFeedResponseSchema = z.object({
-  items: z.array(feedItemSchema),
-  updatedAt: z.string(),
-  contextBanner: contextBannerSchema,
-  suggestedPrompts: z.array(suggestedPromptSchema),
-});
-
 const patchFeedItemRequestSchema = z.object({
   status: z.enum(["new", "seen", "acted_on", "dismissed"]),
 });
@@ -81,7 +69,7 @@ const listHomeFeedRequestSchema = z.object({
 });
 
 const listHomeFeedResponseSchema = z.object({
-  items: z.array(feedItemSchema),
+  items: z.array(FeedItemSchema),
   total: z.number().int().nonnegative(),
   returned: z.number().int().nonnegative(),
   hasMore: z.boolean(),
@@ -346,6 +334,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "get_home_feed",
     endpoint: "home/feed",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetHomeFeed,
     summary: "Get home activity feed",
     description:
@@ -360,19 +352,23 @@ export const ROUTES: RouteDefinition[] = [
           "Seconds since the user was last active in the client. Used to compute the context-banner relative-time label.",
       },
     ],
-    responseBody: getHomeFeedResponseSchema,
+    responseBody: HomeFeedResponseSchema,
   },
   {
     operationId: "patch_home_feed_item",
     endpoint: "home/feed/:id",
     method: "PATCH",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handlePatchFeedItem,
     summary: "Patch home feed item status",
     description:
       "Update the `status` field of a single feed item (e.g. mark it seen or acted_on). Returns the updated item on success, 404 if the item does not exist, 500 if the underlying write fails.",
     tags: ["home"],
     requestBody: patchFeedItemRequestSchema,
-    responseBody: feedItemSchema,
+    responseBody: FeedItemSchema,
     additionalResponses: {
       "404": { description: "Feed item not found" },
       "500": { description: "Failed to persist feed item status" },
@@ -382,6 +378,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "list_home_feed",
     endpoint: "home/feed/query",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListHomeFeed,
     summary: "List home feed items with filters",
     description:
@@ -394,6 +394,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "trigger_home_feed_action",
     endpoint: "home/feed/:id/actions/:actionId",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handlePostFeedAction,
     summary: "Trigger home feed action",
     description:

package/src/runtime/routes/home-state-routes.ts

@@ -12,54 +12,18 @@
 
 import { existsSync, readFileSync } from "node:fs";
 
-import { z } from "zod";
-
+import { RelationshipStateSchema } from "../../api/responses/home.js";
 import {
   computeRelationshipState,
   getRelationshipStatePath,
 } from "../../home/relationship-state-writer.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { InternalError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
 const log = getLogger("home-state-routes");
 
-// ---------------------------------------------------------------------------
-// Response schema (shared with the OpenAPI generator and runtime validation)
-// ---------------------------------------------------------------------------
-
-const factSchema = z.object({
-  id: z.string(),
-  category: z.enum(["voice", "world", "priorities"]),
-  text: z.string(),
-  confidence: z.enum(["strong", "uncertain"]),
-  source: z.enum(["onboarding", "inferred"]),
-});
-
-const capabilitySchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  description: z.string(),
-  tier: z.enum(["unlocked", "next-up", "earned"]),
-  gate: z.string(),
-  unlockHint: z.string().optional(),
-  ctaLabel: z.string().optional(),
-});
-
-const relationshipStateSchema = z.object({
-  version: z.literal(1),
-  assistantId: z.string(),
-  tier: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)]),
-  progressPercent: z.number(),
-  facts: z.array(factSchema),
-  capabilities: z.array(capabilitySchema),
-  conversationCount: z.number(),
-  hatchedDate: z.string(),
-  assistantName: z.string(),
-  userName: z.string().optional(),
-  updatedAt: z.string(),
-});
-
 // ---------------------------------------------------------------------------
 // Handler
 // ---------------------------------------------------------------------------
@@ -98,7 +62,7 @@ async function handleGetHomeState(): Promise<unknown> {
     try {
       const raw = readFileSync(path, "utf-8");
       const parsed: unknown = JSON.parse(raw);
-      const validated = relationshipStateSchema.safeParse(parsed);
+      const validated = RelationshipStateSchema.safeParse(parsed);
       if (validated.success) {
         return validated.data;
       }
@@ -126,12 +90,16 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "home_state_get",
     endpoint: "home/state",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetHomeState,
     summary: "Get relationship state",
     description:
       "Return the current `RelationshipState` snapshot. Reads the persisted `relationship-state.json` when present; falls back to an on-demand compute so fresh installs never see a 404.",
     tags: ["home"],
-    responseBody: relationshipStateSchema,
+    responseBody: RelationshipStateSchema,
     additionalResponses: {
       "500": {
         description: "Failed to compute relationship state",

package/src/runtime/routes/host-app-control-routes.ts

@@ -14,11 +14,12 @@
  */
 import { z } from "zod";
 
-import { findConversation } from "../../daemon/conversation-store.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
 import type {
   HostAppControlResultPayload,
   HostAppControlState,
 } from "../../daemon/message-types/host-app-control.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -134,6 +135,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_app_control_result",
     endpoint: "host-app-control-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host app-control result",
     description:

package/src/runtime/routes/host-bash-routes.ts

@@ -7,6 +7,7 @@
 import { z } from "zod";
 
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -104,6 +105,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_bash_result",
     endpoint: "host-bash-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host bash result",
     description: "Resolve a pending host bash request by requestId.",

package/src/runtime/routes/host-browser-routes.ts

@@ -11,6 +11,7 @@ import {
   publishCdpEvent,
 } from "../../browser-session/events.js";
 import { clearPinnedTabByTabId } from "../../tools/browser/pinned-tabs.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -324,6 +325,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_browser_result",
     endpoint: "host-browser-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host browser result",
     description: "Resolve a pending host browser request by requestId.",
@@ -358,6 +363,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_browser_event",
     endpoint: "host-browser-event",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Forward a CDP event from the browser extension",
     description:
@@ -380,6 +389,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_browser_session_invalidated",
     endpoint: "host-browser-session-invalidated",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Notify runtime that a CDP session was invalidated",
     description:

package/src/runtime/routes/host-cu-routes.ts

@@ -6,7 +6,8 @@
  */
 import { z } from "zod";
 
-import { findConversation } from "../../daemon/conversation-store.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -142,6 +143,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_cu_result",
     endpoint: "host-cu-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host CU result",
     description: "Resolve a pending host computer-use request by requestId.",

package/src/runtime/routes/host-file-routes.ts

@@ -7,6 +7,7 @@
 import { z } from "zod";
 
 import { HostFileProxy } from "../../daemon/host-file-proxy.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -30,12 +31,15 @@ function handleHostFileResult({ body, headers }: RouteHandlerArgs) {
     throw new BadRequestError("Request body is required");
   }
 
-  const { requestId, content, isError, imageData } = body as {
-    requestId?: string;
-    content?: string;
-    isError?: boolean;
-    imageData?: string;
-  };
+  const { requestId, content, isError, imageData, audioData, audioMimeType } =
+    body as {
+      requestId?: string;
+      content?: string;
+      isError?: boolean;
+      imageData?: string;
+      audioData?: string;
+      audioMimeType?: string;
+    };
 
   if (!requestId || typeof requestId !== "string") {
     throw new BadRequestError("requestId is required");
@@ -87,6 +91,8 @@ function handleHostFileResult({ body, headers }: RouteHandlerArgs) {
     content: content ?? "",
     isError: isError ?? false,
     imageData,
+    audioData,
+    audioMimeType,
   });
 
   return { accepted: true };
@@ -101,6 +107,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_file_result",
     endpoint: "host-file-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host file result",
     description:
@@ -119,6 +129,16 @@ export const ROUTES: RouteDefinition[] = [
           "Optional base64-encoded image bytes for successful image reads",
         )
         .optional(),
+      audioData: z
+        .string()
+        .describe(
+          "Optional base64-encoded audio bytes for successful audio reads",
+        )
+        .optional(),
+      audioMimeType: z
+        .string()
+        .describe("MIME type for audioData (e.g. audio/mpeg)")
+        .optional(),
     }),
     responseBody: z.object({
       accepted: z.boolean(),

package/src/runtime/routes/host-transfer-routes.ts

@@ -8,6 +8,7 @@
 import { z } from "zod";
 
 import { HostTransferProxy } from "../../daemon/host-transfer-proxy.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   enforceSameActorOrThrow,
   SAME_ACTOR_FORBIDDEN_DESCRIPTION,
@@ -248,7 +249,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "transfers_get_content",
     endpoint: "transfers/:transferId/content",
     method: "GET",
-    policyKey: "transfers/content",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Get transfer content",
     description:
@@ -270,7 +274,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "transfers_put_content",
     endpoint: "transfers/:transferId/content",
     method: "PUT",
-    policyKey: "transfers/content",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Put transfer content",
     description:
@@ -291,6 +298,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "host_transfer_result",
     endpoint: "host-transfer-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     requireGuardian: true,
     summary: "Submit host transfer result",
     description:

package/src/runtime/routes/http-adapter.ts

@@ -36,8 +36,7 @@ export function routeDefinitionsToHTTPRoutes(
     endpoint: r.endpoint,
     method: r.method,
     operationId: r.operationId,
-    policyKey:
-      r.policyKey ?? r.endpoint.replace(/\/:[^/]+/g, "").replace(/^:/, ""),
+    policy: r.policy,
     pathParams: r.pathParams,
     summary: r.summary,
     description: r.description,