@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/integrations/telegram.ts

@@ -8,13 +8,17 @@
  * POST   /v1/integrations/telegram/setup    — composite: set config + register commands
  */
 
+import { z } from "zod";
+
 import {
   clearTelegramConfig,
   getTelegramConfig,
   setTelegramCommands,
   setTelegramConfig,
   setupTelegram,
+  TelegramConfigResultSchema,
 } from "../../../daemon/handlers/config-telegram.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -31,8 +35,7 @@ async function handleSetTelegramConfig({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramConfig(botToken);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram config",
+      (result as { error?: string }).error ?? "Failed to set Telegram config",
     );
   }
   return result;
@@ -49,8 +52,7 @@ async function handleSetTelegramCommands({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramCommands(commands);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram commands",
+      (result as { error?: string }).error ?? "Failed to set Telegram commands",
     );
   }
   return result;
@@ -79,50 +81,73 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_telegram_config_get",
     endpoint: "integrations/telegram/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Telegram config",
     description: "Check current Telegram bot configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TelegramConfigResultSchema,
     handler: () => handleGetTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_config_post",
     endpoint: "integrations/telegram/config",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Telegram config",
     description: "Set bot token and configure webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTelegramConfig,
+    requestBody: z.object({
+      botToken: z.string().describe("Telegram bot token"),
+    }),
+    responseBody: TelegramConfigResultSchema,
   },
   {
     operationId: "integrations_telegram_config_delete",
     endpoint: "integrations/telegram/config",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Telegram config",
     description: "Clear credentials and deregister webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TelegramConfigResultSchema,
     handler: () => handleClearTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_commands_post",
     endpoint: "integrations/telegram/commands",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Register Telegram commands",
     description: "Register bot commands with the Telegram API.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TelegramConfigResultSchema,
     handler: handleSetTelegramCommands,
   },
   {
     operationId: "integrations_telegram_setup_post",
     endpoint: "integrations/telegram/setup",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Setup Telegram",
     description: "Composite: set config + register commands.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TelegramConfigResultSchema,
     handler: handleSetupTelegram,
   },
 ];

package/src/runtime/routes/integrations/twilio.ts

@@ -10,6 +10,8 @@
  * POST   /v1/integrations/twilio/numbers/release                     — release a phone number
  */
 
+import { z } from "zod";
+
 import {
   getTwilioCredentials,
   hasTwilioCredentials,
@@ -30,9 +32,45 @@ import {
   deleteCredentialMetadata,
   upsertCredentialMetadata,
 } from "../../../tools/credentials/metadata-store.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError, InternalError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
+// ---------------------------------------------------------------------------
+// Response schemas
+// ---------------------------------------------------------------------------
+
+const TwilioPhoneNumberSchema = z.object({
+  phoneNumber: z.string(),
+  friendlyName: z.string(),
+  capabilities: z.object({ voice: z.boolean() }),
+});
+
+const TwilioConfigResultSchema = z.object({
+  success: z.boolean(),
+  hasCredentials: z.boolean(),
+  accountSid: z.string().optional(),
+  phoneNumber: z.string().optional(),
+});
+
+const TwilioCredentialsResultSchema = z.object({
+  success: z.boolean(),
+  hasCredentials: z.boolean(),
+});
+
+const TwilioNumbersResultSchema = z.object({
+  success: z.boolean(),
+  hasCredentials: z.boolean(),
+  numbers: z.array(TwilioPhoneNumberSchema),
+});
+
+const TwilioNumberMutationResultSchema = z.object({
+  success: z.boolean(),
+  hasCredentials: z.boolean(),
+  phoneNumber: z.string().optional(),
+  warning: z.string().optional(),
+});
+
 // ---------------------------------------------------------------------------
 // Shared helpers
 // ---------------------------------------------------------------------------
@@ -352,70 +390,102 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_twilio_config_get",
     endpoint: "integrations/twilio/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Twilio config",
     description: "Return current Twilio configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioConfigResultSchema,
     handler: () => handleGetTwilioConfig(),
   },
   {
     operationId: "integrations_twilio_credentials_post",
     endpoint: "integrations/twilio/credentials",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Twilio credentials",
     description: "Validate and store Twilio account SID and auth token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTwilioCredentials,
+    requestBody: z.object({
+      accountSid: z.string().describe("Twilio account SID"),
+      authToken: z.string().describe("Twilio auth token"),
+    }),
+    responseBody: TwilioCredentialsResultSchema,
   },
   {
     operationId: "integrations_twilio_credentials_delete",
     endpoint: "integrations/twilio/credentials",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Twilio credentials",
     description: "Remove stored Twilio credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioCredentialsResultSchema,
     handler: () => handleClearTwilioCredentials(),
   },
   {
     operationId: "integrations_twilio_numbers_get",
     endpoint: "integrations/twilio/numbers",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List Twilio numbers",
     description: "List phone numbers on the Twilio account.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioNumbersResultSchema,
     handler: () => handleListTwilioNumbers(),
   },
   {
     operationId: "integrations_twilio_numbers_provision_post",
     endpoint: "integrations/twilio/numbers/provision",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Provision Twilio number",
     description: "Search for and provision a new phone number.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioNumberMutationResultSchema,
     handler: handleProvisionTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_assign_post",
     endpoint: "integrations/twilio/numbers/assign",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Assign Twilio number",
     description: "Assign an existing phone number to this assistant.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioNumberMutationResultSchema,
     handler: handleAssignTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_release_post",
     endpoint: "integrations/twilio/numbers/release",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Release Twilio number",
     description: "Release a phone number back to Twilio.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
+    responseBody: TwilioNumberMutationResultSchema,
     handler: handleReleaseTwilioNumber,
   },
 ];

package/src/runtime/routes/integrations/vercel.ts

@@ -70,10 +70,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_get",
     endpoint: "integrations/vercel/config",
     method: "GET",
+    policy: null,
     summary: "Get Vercel config",
     description: "Check if a Vercel API token is stored.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     responseBody: vercelConfigResponseSchema,
     handler: () => handleGetVercelConfig(),
   },
@@ -81,11 +81,11 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_post",
     endpoint: "integrations/vercel/config",
     method: "POST",
+    policy: null,
     summary: "Set or delete Vercel config",
     description:
       "Set or delete the Vercel API token. Action is determined by the body action field.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     requestBody: z.object({
       action: z.enum(["get", "set", "delete"]).optional(),
       apiToken: z.string().optional(),
@@ -97,10 +97,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_delete",
     endpoint: "integrations/vercel/config",
     method: "DELETE",
+    policy: null,
     summary: "Delete Vercel config",
     description: "Delete the stored Vercel API token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     responseBody: vercelConfigResponseSchema,
     handler: () => handleDeleteVercelConfig(),
   },

package/src/runtime/routes/internal-oauth-routes.ts

@@ -10,6 +10,7 @@ import {
   consumeCallback,
   consumeCallbackError,
 } from "../../security/oauth-callback-registry.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -18,6 +19,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_callback",
     endpoint: "internal/oauth/callback",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal OAuth callback",
     description:
       "Receives forwarded OAuth callback results (code or error) from the gateway and resolves the pending callback in the runtime.",

package/src/runtime/routes/internal-telemetry-routes.ts

@@ -0,0 +1,88 @@
+/**
+ * Internal telemetry routes — receive operational signals forwarded from the
+ * gateway over the internal (service-token) transport.
+ *
+ * POST /v1/internal/telemetry/auth-fallback — record aggregated counts of
+ * requests served via the legacy loopback auth fallback. The gateway counts
+ * fallbacks in memory and flushes them here per window; the usage telemetry
+ * reporter ships the persisted rows to the platform.
+ */
+
+import { z } from "zod";
+
+import {
+  type AuthFallbackCount,
+  recordAuthFallbackCounts,
+} from "../../memory/auth-fallback-events-store.js";
+import { getLogger } from "../../util/logger.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
+import { BadRequestError } from "./errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+const log = getLogger("internal-telemetry-routes");
+
+const authFallbackBody = z.object({
+  window_start: z.number().int().nonnegative(),
+  window_end: z.number().int().nonnegative(),
+  counts: z
+    .array(
+      z.object({
+        guard: z.string().min(1),
+        path: z.string().min(1),
+        failure_kind: z.string().min(1),
+        count: z.number().int().positive(),
+      }),
+    )
+    .min(1),
+});
+
+function handleRecordAuthFallback({ body }: RouteHandlerArgs) {
+  const parsed = authFallbackBody.safeParse(body);
+  if (!parsed.success) {
+    throw new BadRequestError(
+      `Invalid auth-fallback payload: ${parsed.error.message}`,
+    );
+  }
+  const { window_start, window_end, counts } = parsed.data;
+  const mapped: AuthFallbackCount[] = counts.map((c) => ({
+    guard: c.guard,
+    path: c.path,
+    failureKind: c.failure_kind,
+    count: c.count,
+  }));
+
+  const recorded = recordAuthFallbackCounts(window_start, window_end, mapped);
+  if (recorded === 0) {
+    // collectUsageData disabled — counts dropped to honor the opt-out.
+    return { skipped: true };
+  }
+  log.debug({ recorded }, "Recorded auth-fallback counts");
+  return { recorded };
+}
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "internal_telemetry_auth_fallback",
+    endpoint: "internal/telemetry/auth-fallback",
+    method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
+    summary: "Record auth-fallback counts",
+    description:
+      "Receives aggregated legacy-loopback auth-fallback counts forwarded by " +
+      "the gateway and persists them for telemetry reporting.",
+    tags: ["internal", "telemetry"],
+    requestBody: authFallbackBody,
+    responseBody: z.union([
+      z.object({ recorded: z.number().int().nonnegative() }),
+      z.object({
+        skipped: z
+          .literal(true)
+          .describe("Counts dropped because usage data collection is disabled"),
+      }),
+    ]),
+    handler: handleRecordAuthFallback,
+  },
+];

package/src/runtime/routes/internal-twilio-routes.ts

@@ -10,6 +10,7 @@ import {
   handleInternalStatusCallback,
   handleInternalVoiceWebhook,
 } from "../../calls/twilio-routes.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
 export const ROUTES: RouteDefinition[] = [
@@ -17,6 +18,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_voice_webhook",
     endpoint: "internal/twilio/voice-webhook",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio voice webhook",
     description:
       "Gateway-to-runtime forwarding for Twilio voice webhook. Accepts pre-parsed form params as JSON.",
@@ -27,6 +32,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_status",
     endpoint: "internal/twilio/status",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio status callback",
     description:
       "Gateway-to-runtime forwarding for Twilio call status updates. Accepts pre-parsed form params as JSON.",
@@ -37,6 +46,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_connect_action",
     endpoint: "internal/twilio/connect-action",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio connect-action",
     description:
       "Gateway-to-runtime forwarding for ConversationRelay connect-action callback.",

package/src/runtime/routes/llm-call-sites-routes.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
 import { loadConfig } from "../../config/loader.js";
 import {
@@ -5,8 +7,27 @@ import {
   CALL_SITE_DOMAINS,
 } from "../../config/schemas/call-site-catalog.js";
 import type { LLMCallSite } from "../../config/schemas/llm.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
+const callSiteDomainSchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+});
+
+const callSiteEntrySchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  domain: z.string(),
+  defaultProfile: z.string().optional(),
+});
+
+const callSiteCatalogResponseSchema = z.object({
+  domains: z.array(callSiteDomainSchema),
+  callSites: z.array(callSiteEntrySchema),
+});
+
 async function handleGetCallSites() {
   const { llm } = loadConfig();
   return {
@@ -18,12 +39,16 @@ async function handleGetCallSites() {
   };
 }
 
-export interface LlmProfilesListResult {
+const llmProfilesListResponseSchema = z.object({
   /** Sorted list of profile names defined in `llm.profiles`. */
-  profiles: string[];
+  profiles: z.array(z.string()),
   /** The workspace-wide active profile name, if one is set. */
-  activeProfile: string | null;
-}
+  activeProfile: z.string().nullable(),
+});
+
+export type LlmProfilesListResult = z.infer<
+  typeof llmProfilesListResponseSchema
+>;
 
 async function handleListProfiles(): Promise<LlmProfilesListResult> {
   const { llm } = loadConfig();
@@ -39,21 +64,31 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "llm_call_sites_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/call-sites",
     handler: handleGetCallSites,
     summary: "List LLM call sites",
     description:
       "Returns the full catalog of LLM call sites with display names, descriptions, and domain groupings. Used by clients to render the per-call-site override settings UI.",
     tags: ["config"],
+    responseBody: callSiteCatalogResponseSchema,
   },
   {
     operationId: "llm_profiles_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/profiles",
     handler: handleListProfiles,
     summary: "List defined LLM profiles",
     description:
       "Returns the sorted list of profile names defined in `llm.profiles` plus the workspace-wide active profile. Used to populate per-call profile dropdowns (e.g. memory router playground) without requiring the caller to type profile names.",
     tags: ["config"],
+    responseBody: llmProfilesListResponseSchema,
   },
 ];

package/src/runtime/routes/log-export-routes.ts

@@ -37,6 +37,7 @@ import {
 } from "../../util/platform.js";
 import { APP_VERSION, COMMIT_SHA } from "../../version.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { createTarGz } from "./archive-utils.js";
 import { InternalError } from "./errors.js";
 import { collectWorkspaceData } from "./log-export/workspace-allowlist.js";
@@ -221,7 +222,9 @@ async function handleExport({
       }
     }
 
-    // --- Daemon log grep for conversationId ---
+    // --- Conversation-scoped daemon log slice ---
+    // Write a `conversation-filtered.jsonl` slice of the lines that mention the
+    // conversationId as a quick index into the full daily logs.
     if (conversationId && collectedLogFiles.length > 0) {
       const matchingLines: string[] = [];
       for (const logFile of collectedLogFiles) {
@@ -244,13 +247,22 @@ async function handleExport({
         );
       }
 
-      for (const logFile of collectedLogFiles) {
-        try {
-          rmSync(logFile, { force: true });
-        } catch {
-          // Best-effort removal
-        }
-      }
+      // We intentionally retain the full daily `assistant-*.log` and
+      // `daemon-stderr.log` files rather than removing them here. Agent-loop
+      // failures — stream aborts, stack traces, provider errors — are routinely
+      // logged without the conversationId, so the grep above drops exactly the
+      // lines needed to debug a failed turn. We cannot currently guarantee that
+      // every log line emitted while handling a conversation carries its
+      // conversationId; until we can, the full daily log must stay in the
+      // bundle. Re-enable the removal below only once that guarantee holds.
+      //
+      // for (const logFile of collectedLogFiles) {
+      //   try {
+      //     rmSync(logFile, { force: true });
+      //   } catch {
+      //     // Best-effort removal
+      //   }
+      // }
     }
 
     // --- Workspace allowlist ---
@@ -486,13 +498,20 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs",
     endpoint: "export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data",
     description:
       "Export audit records, assistant logs, and config as a tar.gz archive.",
     tags: ["export"],
     requestBody: exportRequestBody,
+    responseBody: {
+      contentType: "application/gzip",
+      schema: { type: "string", format: "binary" },
+    },
     responseHeaders: {
       "Content-Type": "application/gzip",
       "Content-Disposition": 'attachment; filename="logs.tar.gz"',
@@ -507,13 +526,20 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs_alias",
     endpoint: "logs/export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data (alias)",
     description:
       "Alias for /v1/export. Export audit records, assistant logs, and config as a tar.gz archive.",
     tags: ["export"],
     requestBody: exportRequestBody,
+    responseBody: {
+      contentType: "application/gzip",
+      schema: { type: "string", format: "binary" },
+    },
     responseHeaders: {
       "Content-Type": "application/gzip",
       "Content-Disposition": 'attachment; filename="logs.tar.gz"',