@vellumai/vellum-gateway 0.7.0 → 0.7.2

package/src/http/middleware/auth.ts

@@ -5,18 +5,59 @@ import { resolveScopeProfile } from "../../auth/scopes.js";
 import type { Scope } from "../../auth/types.js";
 import type { AuthRateLimiter } from "../../auth-rate-limiter.js";
 import { getLogger } from "../../logger.js";
-import { isLoopbackPeer } from "../routes/browser-relay-websocket.js";
+import { isLoopbackPeer } from "../../util/is-loopback-address.js";
 
 const log = getLogger("auth");
 
 type GetClientIp = () => string;
 
+// ---------------------------------------------------------------------------
+// DISABLE_HTTP_AUTH — platform-managed deployments bypass JWT validation
+// ---------------------------------------------------------------------------
+
+let _httpAuthDisabled: boolean | undefined;
+
+/**
+ * True when HTTP auth is disabled via DISABLE_HTTP_AUTH=true.
+ * Cached after first call so the env var is only read once.
+ */
+export function isHttpAuthDisabled(): boolean {
+  if (_httpAuthDisabled === undefined) {
+    _httpAuthDisabled =
+      process.env.DISABLE_HTTP_AUTH?.trim().toLowerCase() === "true";
+  }
+  return _httpAuthDisabled;
+}
+
+/**
+ * Log the auth bypass state at gateway startup.
+ * Call once from the main entrypoint after the logger is ready.
+ */
+export function logAuthBypassState(): void {
+  if (!isHttpAuthDisabled()) return;
+  const isPlatform =
+    process.env.IS_PLATFORM?.trim().toLowerCase() === "true" ||
+    process.env.IS_PLATFORM?.trim() === "1";
+  if (isPlatform) {
+    log.info(
+      "DISABLE_HTTP_AUTH is set — HTTP auth disabled (expected: platform handles auth)",
+    );
+  } else {
+    log.warn(
+      "DISABLE_HTTP_AUTH is set — HTTP API authentication is DISABLED. All endpoints are accessible without a bearer token.",
+    );
+  }
+}
+
 /**
  * Build edge-auth guard functions that share a rate limiter and IP resolver.
  *
  * Both guards validate a JWT bearer token (aud=vellum-gateway) and record
  * failures against the rate limiter. `requireEdgeAuthWithScope` additionally
  * checks for a specific scope in the token's profile.
+ *
+ * When DISABLE_HTTP_AUTH is set (platform-managed deployments), all JWT
+ * checks are bypassed — the platform handles authentication upstream.
  */
 export function createAuthMiddleware(
   authRateLimiter: AuthRateLimiter,
@@ -31,6 +72,7 @@ export function createAuthMiddleware(
     req: Request,
     server?: Server<unknown>,
   ): Response | null {
+    if (isHttpAuthDisabled()) return null;
     if (server && isLoopbackPeer(server, req)) {
       return null;
     }
@@ -65,6 +107,7 @@ export function createAuthMiddleware(
     scope: Scope,
     server?: Server<unknown>,
   ): Response | null {
+    if (isHttpAuthDisabled()) return null;
     if (server && isLoopbackPeer(server, req)) {
       return null;
     }

package/src/http/middleware/cors.ts

@@ -1,3 +1,4 @@
+import { KNOWN_EXTENSION_ORIGINS } from "../../chrome-extension-origins.js";
 import { getLogger } from "../../logger.js";
 
 const log = getLogger("cors");
@@ -23,6 +24,89 @@ const ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS";
 const ALLOWED_HEADERS =
   "Authorization, Content-Type, X-Session-Token, Vellum-Organization-Id, X-Trace-Id";
 
+/**
+ * Check whether the request `Origin` header matches a known Vellum Chrome
+ * extension. Returns the validated origin string, or null if CORS headers
+ * should not be added.
+ *
+ * Chrome enforces the `chrome-extension://<id>` origin at the network layer —
+ * an extension cannot impersonate another extension's origin. Chrome's Private
+ * Network Access (PNA) policy additionally requires a successful CORS preflight
+ * before any extension can reach a localhost endpoint. Together these mean that
+ * narrowing CORS to KNOWN_EXTENSION_ORIGINS blocks all other Chrome extensions
+ * from accessing the gateway — they fail the PNA preflight and Chrome never
+ * sends the actual request.
+ *
+ * Note: PNA enforcement only applies to browser contexts. A local process can
+ * set an arbitrary Origin header without going through Chrome. This is the
+ * residual risk; the loopback IP check in individual route handlers (e.g.
+ * pair.ts) is the defence-in-depth boundary for that case.
+ */
+export function resolveExtensionOrigin(req: Request): string | null {
+  const origin = req.headers.get("origin");
+  if (!origin) return null;
+  if (!KNOWN_EXTENSION_ORIGINS.has(origin)) return null;
+  return origin;
+}
+
+/**
+ * Build CORS response headers for a known Vellum Chrome extension origin,
+ * including the Private Network Access header required for localhost fetches.
+ */
+export function extensionCorsHeaders(origin: string): Record<string, string> {
+  return {
+    "Access-Control-Allow-Origin": origin,
+    // GET for SSE (/v1/events), POST for pair + host-browser callbacks
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    // All headers the extension service worker sends across these routes:
+    //   /v1/pair          → content-type, x-vellum-interface-id
+    //   /v1/events (SSE)  → accept, x-vellum-client-id, x-vellum-interface-id
+    //   /v1/host-browser-* → content-type, authorization
+    "Access-Control-Allow-Headers":
+      "Accept, Authorization, Content-Type, X-Vellum-Client-Id, X-Vellum-Interface-Id",
+    "Access-Control-Allow-Private-Network": "true",
+    "Access-Control-Max-Age": "86400",
+  };
+}
+
+/**
+ * Handle a Private Network Access preflight from a Chrome extension.
+ * Returns 204 with all required CORS + PNA headers.
+ */
+export function handleExtensionPreflight(origin: string): Response {
+  log.debug({ origin }, "Chrome extension PNA preflight response");
+  return new Response(null, {
+    status: 204,
+    headers: extensionCorsHeaders(origin),
+  });
+}
+
+/**
+ * Append extension CORS headers to an existing response.
+ */
+export function withExtensionCorsHeaders(
+  response: Response,
+  origin: string,
+): Response {
+  const headers = extensionCorsHeaders(origin);
+  try {
+    for (const [key, value] of Object.entries(headers)) {
+      response.headers.set(key, value);
+    }
+    return response;
+  } catch {
+    const merged = new Headers(response.headers);
+    for (const [key, value] of Object.entries(headers)) {
+      merged.set(key, value);
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: merged,
+    });
+  }
+}
+
 /**
  * Check whether the request `Origin` header matches a known webview origin.
  * Returns the validated origin string, or null if CORS headers should not be

package/src/http/middleware/rate-limit.ts

@@ -47,19 +47,17 @@ export function checkAuthRateLimit(
 }
 
 /**
- * Routes subject to the auth-failure rate limiter: authenticated endpoints,
- * pairing endpoints, and unauthenticated endpoints that forward to the
- * runtime (OAuth callback is publicly reachable and forwards every
- * valid-looking request).
+ * Routes subject to the auth-failure rate limiter: authenticated endpoints
+ * and unauthenticated endpoints that forward to the runtime (OAuth callback
+ * is publicly reachable and forwards every valid-looking request).
  *
- * Excluded: Twilio webhook/relay and browser-relay paths which use their
- * own authentication mechanisms (Twilio signature validation, etc.).
+ * Excluded: Twilio webhook/relay paths which use their own authentication
+ * mechanisms (Twilio signature validation, etc.).
  */
 function isRateLimitedRoute(url: URL): boolean {
   return (
     url.pathname === "/integrations/status" ||
-    url.pathname.startsWith("/pairing/") ||
     url.pathname === "/webhooks/oauth/callback" ||
-    (url.pathname.startsWith("/v1/") && url.pathname !== "/v1/browser-relay")
+    url.pathname.startsWith("/v1/")
   );
 }

package/src/http/routes/auto-approve-thresholds.ts

@@ -48,12 +48,14 @@ export function createGlobalThresholdGetHandler() {
         return Response.json({
           interactive: "medium",
           autonomous: "low",
+          headless: "none",
         });
       }
 
       return Response.json({
         interactive: row.interactive,
         autonomous: row.autonomous,
+        headless: row.headless,
       });
     } catch (err) {
       log.error({ err }, "Failed to read global thresholds");
@@ -85,7 +87,10 @@ export function createGlobalThresholdPutHandler() {
       );
     }
 
-    const { interactive, autonomous } = body as Record<string, unknown>;
+    const { interactive, autonomous, headless } = body as Record<
+      string,
+      unknown
+    >;
 
     if (interactive !== undefined && !isValidThreshold(interactive)) {
       return Response.json(
@@ -103,6 +108,14 @@ export function createGlobalThresholdPutHandler() {
         { status: 400 },
       );
     }
+    if (headless !== undefined && !isValidThreshold(headless)) {
+      return Response.json(
+        {
+          error: `"headless" must be one of: ${VALID_THRESHOLDS.join(", ")}`,
+        },
+        { status: 400 },
+      );
+    }
 
     try {
       const db = getGatewayDb();
@@ -112,12 +125,14 @@ export function createGlobalThresholdPutHandler() {
           id: 1,
           ...(interactive ? { interactive } : {}),
           ...(autonomous ? { autonomous } : {}),
+          ...(headless ? { headless } : {}),
         })
         .onConflictDoUpdate({
           target: autoApproveThresholds.id,
           set: {
             ...(interactive ? { interactive } : {}),
             ...(autonomous ? { autonomous } : {}),
+            ...(headless ? { headless } : {}),
             updatedAt: sql`datetime('now')`,
           },
         })
@@ -127,6 +142,7 @@ export function createGlobalThresholdPutHandler() {
       return Response.json({
         interactive: row.interactive,
         autonomous: row.autonomous,
+        headless: row.headless,
       });
     } catch (err) {
       log.error({ err }, "Failed to upsert global thresholds");

package/src/http/routes/brain-graph-proxy.ts

@@ -2,7 +2,7 @@
  * Gateway proxy endpoints for the brain graph knowledge-graph visualizer.
  *
  * Exposes GET /v1/brain-graph and GET /v1/brain-graph-ui through the gateway
- * even when the broad runtime proxy is disabled.
+ * for dedicated auth handling.
  *
  * The brain-graph-ui endpoint proxies plain HTML from the daemon and injects
  * an auth token meta tag before returning the page to the client. The daemon

package/src/http/routes/channel-readiness-proxy.ts

@@ -1,8 +1,8 @@
 /**
  * Gateway proxy endpoints for channel readiness control-plane routes.
  *
- * These routes remain available even when the broad runtime proxy is
- * disabled, so skills and clients can use gateway URLs exclusively.
+ * These routes are registered as explicit gateway routes for dedicated
+ * auth handling rather than falling through to the catch-all proxy.
  */
 
 import { proxyForwardToResponse } from "@vellumai/assistant-client";

package/src/http/routes/channel-verification-session-proxy.ts

@@ -1,8 +1,8 @@
 /**
  * Gateway proxy endpoints for channel verification session control-plane routes.
  *
- * These routes remain available even when the broad runtime proxy is
- * disabled, so skills and clients can use gateway URLs exclusively.
+ * These routes are registered as explicit gateway routes for dedicated
+ * auth handling rather than falling through to the catch-all proxy.
  */
 
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
@@ -159,11 +159,20 @@ export function createChannelVerificationSessionProxyHandler(
       const expectedSecrets = parseBootstrapSecrets();
       const provided = req.headers.get("x-bootstrap-secret");
 
+      // Platform-managed mode: the gateway runs as an authenticated sidecar;
+      // the platform handles auth upstream (via vembda's /gateway-query proxy)
+      // before the request ever reaches the gateway. Skip the bare-metal
+      // loopback guard entirely — it would always reject because the request
+      // arrives from a pod IP, not from 127.0.0.1.
+      const isManaged =
+        process.env.IS_PLATFORM?.trim().toLowerCase() === "true" ||
+        process.env.IS_PLATFORM?.trim() === "1";
+
       // Bare-metal mode: restrict to loopback callers only. Without a
       // bootstrap secret the lockfile is the sole guard, so a remote
       // client that can reach the gateway (e.g. via ngrok) must not be
       // able to race the legitimate local user.
-      if (expectedSecrets.length === 0) {
+      if (!isManaged && expectedSecrets.length === 0) {
         if (clientIp && !isLoopbackAddress(clientIp)) {
           log.warn(
             { clientIp },
@@ -274,8 +283,7 @@ export function createChannelVerificationSessionProxyHandler(
           guardianInitInFlight = false;
           return Response.json(
             {
-              error:
-                "Invalid platform. Bootstrap is macOS/CLI/web-only; iOS uses QR pairing.",
+              error: "Invalid platform. Bootstrap is macOS/CLI/web-only.",
             },
             { status: 400 },
           );
@@ -347,58 +355,33 @@ export function createChannelVerificationSessionProxyHandler(
     async handleGuardianRefresh(req: Request): Promise<Response> {
       try {
         const body = (await req.json()) as Record<string, unknown>;
-        const platform =
-          typeof body.platform === "string" ? body.platform.trim() : "";
-        const deviceId =
-          typeof body.deviceId === "string" ? body.deviceId.trim() : "";
         const refreshToken =
           typeof body.refreshToken === "string" ? body.refreshToken : "";
 
-        if (!platform || !deviceId || !refreshToken) {
-          return Response.json(
-            {
-              error: {
-                code: "BAD_REQUEST",
-                message:
-                  "Missing required fields: platform, deviceId, refreshToken",
-              },
-            },
-            { status: 400 },
-          );
-        }
-
-        if (
-          platform !== "ios" &&
-          platform !== "macos" &&
-          platform !== "cli" &&
-          platform !== "web"
-        ) {
+        if (!refreshToken) {
           return Response.json(
             {
               error: {
                 code: "BAD_REQUEST",
-                message:
-                  'Invalid platform. Must be "ios", "macos", "cli", or "web".',
+                message: "Missing required field: refreshToken",
               },
             },
             { status: 400 },
           );
         }
 
-        const result = rotateCredentials({ refreshToken, platform, deviceId });
+        const result = rotateCredentials({ refreshToken });
 
         if (!result.ok) {
           const statusCode =
             result.error === "refresh_reuse_detected"
               ? 403
-              : result.error === "device_binding_mismatch"
+              : result.error === "revoked"
                 ? 403
-                : result.error === "revoked"
-                  ? 403
-                  : 401;
+                : 401;
 
           log.warn(
-            { error: result.error, platform },
+            { error: result.error },
             "Refresh token rotation failed",
           );
           return Response.json({ error: result.error }, { status: statusCode });
@@ -406,7 +389,6 @@ export function createChannelVerificationSessionProxyHandler(
 
         log.info(
           {
-            platform,
             guardianPrincipalId: result.result.guardianPrincipalId,
           },
           "Refresh token rotation succeeded",

package/src/http/routes/contact-prompt.ts

@@ -0,0 +1,149 @@
+/**
+ * Gateway HTTP handler for the contact prompt submission endpoint.
+ *
+ * POST /v1/contacts/prompt/submit
+ *
+ * Called by the client after the user fills in a contact address in response
+ * to a `contact_request` broadcast from the daemon. This route:
+ *   1. Validates the submitted contact info.
+ *   2. Upserts the contact + channel via the assistant DB proxy (gateway owns writes).
+ *   3. Calls daemon IPC `resolve_contact_prompt` to unblock the waiting CLI.
+ *   4. Returns { accepted: true } to the client.
+ *
+ * Auth: edge (same as all ingress contact routes).
+ */
+
+import {
+  assistantDbQuery,
+  assistantDbRun,
+} from "../../db/assistant-db-proxy.js";
+import { ipcCallAssistant } from "../../ipc/assistant-client.js";
+import { getLogger } from "../../logger.js";
+
+const log = getLogger("contact-prompt");
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface ContactPromptSubmitBody {
+  requestId: string;
+  address: string;
+  channelType: string;
+  role?: "guardian" | "trusted-contact" | "unknown";
+  displayName?: string;
+}
+
+// ---------------------------------------------------------------------------
+// Handler
+// ---------------------------------------------------------------------------
+
+export async function handleContactPromptSubmit(req: Request): Promise<Response> {
+  let body: ContactPromptSubmitBody;
+  try {
+    body = (await req.json()) as ContactPromptSubmitBody;
+  } catch {
+    return Response.json({ accepted: false, error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const { requestId, address, channelType, role, displayName } = body;
+
+  if (!requestId || typeof requestId !== "string") {
+    return Response.json({ accepted: false, error: "requestId is required" }, { status: 400 });
+  }
+  if (!address || typeof address !== "string") {
+    return Response.json({ accepted: false, error: "address is required" }, { status: 400 });
+  }
+  if (!channelType || typeof channelType !== "string") {
+    return Response.json({ accepted: false, error: "channelType is required" }, { status: 400 });
+  }
+
+  const normalizedAddress = address.toLowerCase().trim();
+  const effectiveDisplayName = displayName ?? normalizedAddress;
+  // Map prompt roles to valid ContactRole values ("guardian" | "contact").
+  const effectiveRole: string = role === "guardian" ? "guardian" : "contact";
+  const now = Date.now();
+
+  let contactId: string;
+  let channelId: string;
+
+  try {
+    // Check if a channel with this (type, address) already exists.
+    const existing = await assistantDbQuery<{
+      channelId: string;
+      contactId: string;
+    }>(
+      `SELECT cc.id AS channelId, cc.contact_id AS contactId
+       FROM contact_channels cc
+       WHERE cc.type = ? AND cc.address = ?
+       LIMIT 1`,
+      [channelType, normalizedAddress],
+    );
+
+    if (existing.length > 0) {
+      contactId = existing[0].contactId;
+      channelId = existing[0].channelId;
+      log.info(
+        { channelType, address: normalizedAddress, contactId, channelId },
+        "contact-prompt-submit: channel already exists",
+      );
+    } else {
+      contactId = crypto.randomUUID();
+      channelId = crypto.randomUUID();
+
+      await assistantDbRun(
+        `INSERT INTO contacts (id, display_name, role, contact_type, created_at, updated_at)
+         VALUES (?, ?, ?, 'human', ?, ?)`,
+        [contactId, effectiveDisplayName, effectiveRole, now, now],
+      );
+
+      try {
+        await assistantDbRun(
+          `INSERT INTO contact_channels (id, contact_id, type, address, is_primary, status, policy, interaction_count, created_at, updated_at)
+           VALUES (?, ?, ?, ?, 1, 'unverified', 'allow', 0, ?, ?)`,
+          [channelId, contactId, channelType, normalizedAddress, now, now],
+        );
+      } catch (channelErr) {
+        // Compensating delete — remove the orphaned contact row.
+        log.error(
+          { channelErr, contactId, channelType },
+          "contact-prompt-submit: channel INSERT failed, rolling back contact",
+        );
+        await assistantDbRun("DELETE FROM contacts WHERE id = ?", [contactId]);
+
+        // Notify daemon of failure so the CLI doesn't hang.
+        await ipcCallAssistant("resolve_contact_prompt", {
+          body: { requestId, error: "Failed to create contact channel" },
+        });
+        return Response.json(
+          { accepted: false, error: "Failed to create contact channel" },
+          { status: 500 },
+        );
+      }
+
+      log.info(
+        { channelType, address: normalizedAddress, contactId, channelId, role: effectiveRole },
+        "contact-prompt-submit: created new contact + channel",
+      );
+    }
+  } catch (err) {
+    log.error({ err, requestId }, "contact-prompt-submit: DB error");
+    await ipcCallAssistant("resolve_contact_prompt", {
+      body: { requestId, error: "Database error" },
+    });
+    return Response.json({ accepted: false, error: "Database error" }, { status: 500 });
+  }
+
+  // Notify daemon to unblock the waiting contacts/prompt IPC call.
+  const ipcResult = await ipcCallAssistant("resolve_contact_prompt", {
+    body: { requestId, contactId, channelId, channelType, address: normalizedAddress },
+  });
+  if (!ipcResult || (ipcResult as { resolved?: boolean }).resolved === false) {
+    log.warn(
+      { requestId, contactId },
+      "contact-prompt-submit: resolve_contact_prompt IPC did not find a pending prompt — CLI may time out",
+    );
+  }
+
+  return Response.json({ accepted: true });
+}

package/src/http/routes/contacts-control-plane-proxy.ts

@@ -1,8 +1,8 @@
 /**
  * Gateway proxy endpoints for ingress contacts/invites control-plane routes.
  *
- * These routes remain available even when the broad runtime proxy is
- * disabled, so skills and clients can use gateway URLs exclusively.
+ * These routes are registered as explicit gateway routes for dedicated
+ * auth handling rather than falling through to the catch-all proxy.
  */
 
 import { proxyForward } from "@vellumai/assistant-client";

package/src/http/routes/email-webhook.test.ts

@@ -54,7 +54,6 @@ const baseConfig: GatewayConfig = {
   routingEntries: [],
   runtimeInitialBackoffMs: 500,
   runtimeMaxRetries: 2,
-  runtimeProxyEnabled: false,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
   shutdownDrainMs: 5000,