@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/app-routes.ts

@@ -21,6 +21,7 @@ import {
   incrementDownloadCount,
 } from "../../memory/shared-app-links-store.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError, RouteError } from "./errors.js";
 import type {
   ResponseHeaderArgs,
@@ -328,7 +329,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "pages_serve",
     endpoint: "pages/:appId",
     method: "GET",
-    policyKey: "pages",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve app page",
     description: "Render and serve a shareable app page as HTML.",
     tags: ["apps"],
@@ -339,7 +343,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_dist_file",
     endpoint: "apps/:appId/dist/:filename",
     method: "GET",
-    policyKey: "apps/dist",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve app dist file",
     description:
       "Serve a static asset from an app's compiled dist/ directory.",
@@ -356,6 +363,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_share",
     endpoint: "apps/share",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Share an app",
     description: "Upload a zip app bundle and create a shareable link.",
     tags: ["apps"],
@@ -370,7 +381,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_metadata",
     endpoint: "apps/shared/:token/metadata",
     method: "GET",
-    policyKey: "apps/shared/metadata",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get shared app metadata",
     description: "Return metadata for a shared app bundle.",
     tags: ["apps"],
@@ -386,7 +400,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_download",
     endpoint: "apps/shared/:token",
     method: "GET",
-    policyKey: "apps/shared",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Download shared app",
     description: "Download a shared app bundle as a zip file.",
     tags: ["apps"],
@@ -400,7 +417,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_delete",
     endpoint: "apps/shared/:token",
     method: "DELETE",
-    policyKey: "apps/shared",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete shared app",
     description: "Remove a shared app link.",
     tags: ["apps"],

package/src/runtime/routes/approval-routes.ts

@@ -13,6 +13,7 @@ import { findConversation } from "../../daemon/conversation-store.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import * as pendingInteractions from "../pending-interactions.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -96,11 +97,10 @@ function handleConfirm({ body }: RouteHandlerArgs) {
   conversation.handleConfirmationResponse(
     requestId,
     effectiveDecision as UserDecision,
-    selectedPattern,
-    selectedScope,
-    undefined,
     {
-      source: "button",
+      selectedPattern,
+      selectedScope,
+      emissionContext: { source: "button" },
     },
   );
 
@@ -233,6 +233,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "confirm",
     endpoint: "confirm",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleConfirm,
     requireGuardian: true,
     summary: "Resolve a pending confirmation",
@@ -258,6 +262,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secret",
     endpoint: "secret",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSecret,
     requireGuardian: true,
     summary: "Resolve a pending secret request",
@@ -279,6 +287,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "pending_interactions",
     endpoint: "pending-interactions",
     method: "GET",
+    policy: {
+      requiredScopes: ["approval.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListPendingInteractions,
     summary: "List pending interactions",
     description:

package/src/runtime/routes/attachment-routes.ts

@@ -27,6 +27,7 @@ import {
   validateAttachmentUpload,
 } from "../../memory/attachments-store.js";
 import { getWorkspaceDir } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS, LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   ConflictError,
@@ -653,7 +654,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_content",
     endpoint: "attachments/:id/content",
     method: "GET",
-    policyKey: "attachments/content",
+    policy: {
+      requiredScopes: ["attachments.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get attachment content",
     description:
       "Serve raw file bytes for an attachment. Supports Range headers.",
@@ -668,6 +672,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_delete",
     endpoint: "attachments",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["attachments.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete attachment",
     description: "Delete an attachment by ID.",
     tags: ["attachments"],
@@ -681,6 +689,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_get",
     endpoint: "attachments/:id",
     method: "GET",
+    policy: {
+      requiredScopes: ["attachments.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get attachment metadata",
     description: "Return metadata and optional base64 data for an attachment.",
     tags: ["attachments"],
@@ -699,6 +711,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_upload",
     endpoint: "attachments",
     method: "POST",
+    policy: {
+      requiredScopes: ["attachments.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Upload attachment",
     description:
       "Upload an attachment. Supports application/json (base64 data or file path reference), multipart/form-data (file + filename + mimeType fields), and application/octet-stream (raw bytes with filename and mimeType query params).",
@@ -731,6 +747,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_register",
     endpoint: "attachments/register",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Register a file-backed attachment",
     description:
       "Register an on-disk file as a file-backed attachment. The file must be within the workspace directory and must remain on disk for the lifetime of the attachment.",
@@ -758,6 +778,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_lookup",
     endpoint: "attachments/lookup",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Look up attachment by source path",
     description:
       "Search for a previously registered attachment by its original source path, scoped to a conversation.",

package/src/runtime/routes/audio-routes.ts

@@ -49,6 +49,7 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "audio_get",
     endpoint: "audio/:audioId",
     method: "GET",
+    policy: null,
     isPublic: true,
     summary: "Get audio segment",
     description:

package/src/runtime/routes/audit-routes.ts

@@ -7,6 +7,7 @@
 import { z } from "zod";
 
 import { getRecentInvocations } from "../../memory/tool-usage-store.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 function handleAuditList({ queryParams }: RouteHandlerArgs) {
@@ -24,6 +25,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "audit_list",
     endpoint: "audit",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "List recent tool invocations",
     description:
       "Returns recent tool invocation records from the audit log, ordered by most recent first.",

package/src/runtime/routes/auth-routes.ts

@@ -13,6 +13,7 @@ import {
   getPlatformUserId,
 } from "../../config/env.js";
 import { resolveManagedProxyContext } from "../../providers/platform-proxy/context.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 interface AuthInfoResult {
@@ -55,6 +56,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "auth_info",
     endpoint: "auth/info",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get authentication status",
     description:
       "Returns platform identity and authentication status for this assistant.",