vellum 0.2.0 → 0.2.2

package/src/messaging/style-analyzer.ts

@@ -8,6 +8,7 @@
 
 import type { Message as ProviderMessage } from './provider-types.js';
 import type { Message, ToolDefinition } from '../providers/types.js';
+import { truncate } from '../util/truncate.js';
 import { getProvider } from '../providers/registry.js';
 import { getConfig } from '../config/loader.js';
 
@@ -97,7 +98,7 @@ function buildCorpus(messages: ProviderMessage[]): string[] {
   for (const msg of messages) {
     if (!msg.text.trim()) continue;
     const to = msg.conversationId;
-    const truncatedBody = msg.text.slice(0, 500);
+    const truncatedBody = truncate(msg.text, 500, '');
     entries.push(`To: ${to}\n\n${truncatedBody}`);
   }
   return entries;
@@ -143,7 +144,7 @@ export async function extractStylePatterns(
 
   const stylePatterns: StylePattern[] = (result.style_patterns ?? []).map((p) => ({
     aspect: p.aspect,
-    summary: p.summary.slice(0, 500),
+    summary: truncate(p.summary, 500, ''),
     importance: p.importance,
     examples: p.examples,
   }));

package/src/messaging/thread-summarizer.ts

@@ -1,11 +1,13 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { getConfig } from '../config/loader.js';
 import { getLogger } from '../util/logger.js';
+import { truncate } from '../util/truncate.js';
 import type { ThreadMessage, ThreadSummary } from './types.js';
 
 const log = getLogger('thread-summarizer');
 
 const SUMMARIZATION_MODEL = 'claude-haiku-4-5-20251001';
+const SUMMARIZATION_TIMEOUT_MS = 20_000;
 const DEFAULT_MAX_TOKENS = 4000;
 const CHARS_PER_TOKEN = 4;
 
@@ -172,14 +174,10 @@ function extractParticipants(messages: ThreadMessage[]): Array<{ name: string }>
 
 function summarizeSingleMessage(message: ThreadMessage): ThreadSummary {
   return {
-    summary: message.body.length > 200
-      ? message.body.slice(0, 197) + '...'
-      : message.body,
+    summary: truncate(message.body, 200),
     participants: [{ name: message.sender }],
     openQuestions: [],
-    lastAction: message.body.length > 200
-      ? message.body.slice(0, 197) + '...'
-      : message.body,
+    lastAction: truncate(message.body, 200),
     sentiment: 'neutral',
     messageCount: 1,
   };
@@ -225,7 +223,7 @@ async function summarizeWithLLM(
         timer = setTimeout(() => {
           abortController.abort();
           reject(new Error('Thread summarization LLM timeout'));
-        }, 20000);
+        }, SUMMARIZATION_TIMEOUT_MS);
       }),
     ]);
 
@@ -249,7 +247,7 @@ async function summarizeWithLLM(
       : 'neutral';
 
     return {
-      summary: String(input.summary ?? '').slice(0, 2000),
+      summary: truncate(String(input.summary ?? ''), 2000, ''),
       participants: Array.isArray(input.participants)
         ? input.participants.map((p) => ({
             name: String(p.name),
@@ -259,7 +257,7 @@ async function summarizeWithLLM(
       openQuestions: Array.isArray(input.openQuestions)
         ? input.openQuestions.map((q) => String(q))
         : [],
-      lastAction: String(input.lastAction ?? '').slice(0, 500),
+      lastAction: truncate(String(input.lastAction ?? ''), 500, ''),
       sentiment,
       messageCount: messages.length,
     };
@@ -280,9 +278,7 @@ function buildFallbackSummary(messages: ThreadMessage[]): ThreadSummary {
     summary: `Thread with ${messages.length} message(s) from ${extractParticipants(messages).map((p) => p.name).join(', ')}.`,
     participants: extractParticipants(messages),
     openQuestions: [],
-    lastAction: lastMsg.body.length > 200
-      ? lastMsg.body.slice(0, 197) + '...'
-      : lastMsg.body,
+    lastAction: truncate(lastMsg.body, 200),
     sentiment: 'neutral',
     messageCount: messages.length,
   };

package/src/messaging/triage-engine.ts

@@ -8,6 +8,7 @@
  */
 
 import Anthropic from '@anthropic-ai/sdk';
+import { truncate } from '../util/truncate.js';
 import { v4 as uuid } from 'uuid';
 import { and, eq, isNull, desc } from 'drizzle-orm';
 import { getConfig } from '../config/loader.js';
@@ -24,6 +25,7 @@ import { DEFAULT_TRIAGE_CATEGORIES } from './types.js';
 const log = getLogger('triage-engine');
 
 const TRIAGE_MODEL = 'claude-haiku-4-5-20251001';
+const TRIAGE_CLASSIFICATION_TIMEOUT_MS = 15_000;
 
 // ── Playbook fetching ────────────────────────────────────────────────
 
@@ -244,7 +246,7 @@ async function classifyWithLLM(
       timer = setTimeout(() => {
         abortController.abort();
         reject(new Error('Triage classification LLM timeout'));
-      }, 15000);
+      }, TRIAGE_CLASSIFICATION_TIMEOUT_MS);
     }),
   ]);
 
@@ -282,7 +284,7 @@ async function classifyWithLLM(
     category: typeof input.category === 'string' ? input.category : 'needs_response',
     confidence,
     suggestedAction: typeof input.suggestedAction === 'string'
-      ? input.suggestedAction.slice(0, 500)
+      ? truncate(input.suggestedAction, 500, '')
       : 'Review manually',
     matchedPlaybooks,
   };

package/src/providers/openrouter/client.ts

@@ -0,0 +1,20 @@
+import { OpenAIProvider } from '../openai/client.js';
+
+export interface OpenRouterProviderOptions {
+  apiKey?: string;
+  baseURL?: string;
+  streamTimeoutMs?: number;
+}
+
+const DEFAULT_OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
+
+export class OpenRouterProvider extends OpenAIProvider {
+  constructor(apiKey: string, model: string, options: OpenRouterProviderOptions = {}) {
+    super(apiKey, model, {
+      baseURL: options.baseURL?.trim() || DEFAULT_OPENROUTER_BASE_URL,
+      providerName: 'openrouter',
+      providerLabel: 'OpenRouter',
+      streamTimeoutMs: options.streamTimeoutMs,
+    });
+  }
+}

package/src/providers/registry.ts

@@ -4,6 +4,7 @@ import { OpenAIProvider } from "./openai/client.js";
 import { GeminiProvider } from "./gemini/client.js";
 import { OllamaProvider } from "./ollama/client.js";
 import { FireworksProvider } from "./fireworks/client.js";
+import { OpenRouterProvider } from "./openrouter/client.js";
 import { RetryProvider } from "./retry.js";
 import { FailoverProvider } from "./failover.js";
 import { wrapWithLogfire } from "../logfire.js";
@@ -15,6 +16,7 @@ const DEFAULT_MODELS: Record<string, string> = {
   gemini: 'gemini-3-flash',
   ollama: 'llama3.2',
   fireworks: 'accounts/fireworks/models/kimi-k2p5',
+  openrouter: 'x-ai/grok-4',
 };
 
 const providers = new Map<string, Provider>();
@@ -135,4 +137,10 @@ export function initializeProviders(config: ProvidersConfig): void {
       wrapWithLogfire(new FireworksProvider(config.apiKeys.fireworks, model, { streamTimeoutMs })),
     ));
   }
+  if (config.apiKeys.openrouter) {
+    const model = resolveModel(config, 'openrouter');
+    registerProvider('openrouter', new RetryProvider(
+      wrapWithLogfire(new OpenRouterProvider(config.apiKeys.openrouter, model, { streamTimeoutMs })),
+    ));
+  }
 }

package/src/runtime/http-server.ts

@@ -10,6 +10,7 @@ import { resolve } from 'node:path';
 import { timingSafeEqual } from 'node:crypto';
 import { ConfigError, IngressBlockedError } from '../util/errors.js';
 import { getLogger } from '../util/logger.js';
+import { TwilioConversationRelayProvider } from '../calls/twilio-provider.js';
 import type { RunOrchestrator } from './run-orchestrator.js';
 
 // Route handlers — grouped by domain
@@ -45,6 +46,19 @@ import {
   handleDeleteSharedApp,
 } from './routes/app-routes.js';
 import { handleAddSecret } from './routes/secret-routes.js';
+import {
+  handleStartCall,
+  handleGetCallStatus,
+  handleCancelCall,
+  handleAnswerCall,
+} from './routes/call-routes.js';
+import {
+  handleVoiceWebhook,
+  handleStatusCallback,
+  handleConnectAction,
+} from '../calls/twilio-routes.js';
+import { RelayConnection, activeRelayConnections } from '../calls/relay-server.js';
+import type { RelayWebSocketData } from '../calls/relay-server.js';
 
 // Re-export shared types so existing consumers don't need to update imports
 export type {
@@ -95,6 +109,108 @@ function getDiskSpaceInfo(): DiskSpaceInfo | null {
   }
 }
 
+/**
+ * Regex to extract the Twilio webhook subpath from both top-level and
+ * assistant-scoped route shapes:
+ *   /v1/calls/twilio/<subpath>
+ *   /v1/assistants/<id>/calls/twilio/<subpath>
+ */
+const TWILIO_WEBHOOK_RE = /^\/v1\/(?:assistants\/[^/]+\/)?calls\/twilio\/(.+)$/;
+
+/**
+ * Gateway-compatible Twilio webhook paths:
+ *   /webhooks/twilio/<subpath>
+ *
+ * Maps gateway path segments to the internal subpath names used by the
+ * dispatcher below (e.g. "voice" -> "voice-webhook").
+ */
+const TWILIO_GATEWAY_WEBHOOK_RE = /^\/webhooks\/twilio\/(.+)$/;
+const GATEWAY_SUBPATH_MAP: Record<string, string> = {
+  voice: 'voice-webhook',
+  status: 'status',
+  'connect-action': 'connect-action',
+};
+
+/**
+ * Validate a Twilio webhook request's X-Twilio-Signature header.
+ *
+ * Returns the raw body text on success so callers can reconstruct the Request
+ * for downstream handlers (which also need to read the body).
+ * Returns a 403 Response if signature validation fails.
+ *
+ * Fail-closed: if the auth token is not configured, the request is rejected
+ * with 403 rather than silently skipping validation. An explicit local-dev
+ * bypass is available via TWILIO_WEBHOOK_VALIDATION_DISABLED=true.
+ */
+async function validateTwilioWebhook(
+  req: Request,
+): Promise<{ body: string } | Response> {
+  const rawBody = await req.text();
+
+  // Allow explicit local-dev bypass — must be exactly "true"
+  if (process.env.TWILIO_WEBHOOK_VALIDATION_DISABLED === 'true') {
+    log.warn('Twilio webhook signature validation explicitly disabled via TWILIO_WEBHOOK_VALIDATION_DISABLED');
+    return { body: rawBody };
+  }
+
+  const authToken = TwilioConversationRelayProvider.getAuthToken();
+
+  // Fail-closed: reject if no auth token is configured
+  if (!authToken) {
+    log.error('Twilio auth token not configured — rejecting webhook request (fail-closed)');
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const signature = req.headers.get('x-twilio-signature');
+  if (!signature) {
+    log.warn('Twilio webhook request missing X-Twilio-Signature header');
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  // Parse form-urlencoded body into key-value params for signature computation
+  const params: Record<string, string> = {};
+  const formData = new URLSearchParams(rawBody);
+  for (const [key, value] of formData.entries()) {
+    params[key] = value;
+  }
+
+  // Reconstruct the public-facing URL that Twilio signed against.
+  // Behind proxies/gateways, req.url is the local server URL (e.g.
+  // http://127.0.0.1:7821/...) which differs from the public URL Twilio
+  // used to compute the HMAC-SHA1 signature.
+  const publicBaseUrl = process.env.TWILIO_WEBHOOK_BASE_URL;
+  const parsedUrl = new URL(req.url);
+  const publicUrl = publicBaseUrl
+    ? publicBaseUrl.replace(/\/$/, '') + parsedUrl.pathname + parsedUrl.search
+    : req.url;
+
+  const isValid = TwilioConversationRelayProvider.verifyWebhookSignature(
+    publicUrl,
+    params,
+    signature,
+    authToken,
+  );
+
+  if (!isValid) {
+    log.warn('Twilio webhook signature validation failed');
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  return { body: rawBody };
+}
+
+/**
+ * Re-create a Request with the same method, headers, and URL but with a
+ * pre-read body string so downstream handlers can call req.text() again.
+ */
+function cloneRequestWithBody(original: Request, body: string): Request {
+  return new Request(original.url, {
+    method: original.method,
+    headers: original.headers,
+    body,
+  });
+}
+
 export class RuntimeHttpServer {
   private server: ReturnType<typeof Bun.serve> | null = null;
   private port: number;
@@ -120,11 +236,37 @@ export class RuntimeHttpServer {
   }
 
   async start(): Promise<void> {
-    this.server = Bun.serve({
+    this.server = Bun.serve<RelayWebSocketData>({
       port: this.port,
       hostname: this.hostname,
       maxRequestBodySize: MAX_REQUEST_BODY_BYTES,
-      fetch: (req) => this.handleRequest(req),
+      fetch: (req, server) => this.handleRequest(req, server),
+      websocket: {
+        open(ws) {
+          const callSessionId = ws.data?.callSessionId;
+          log.info({ callSessionId }, 'ConversationRelay WebSocket opened');
+          if (callSessionId) {
+            const connection = new RelayConnection(ws, callSessionId);
+            activeRelayConnections.set(callSessionId, connection);
+          }
+        },
+        message(ws, message) {
+          const callSessionId = ws.data?.callSessionId;
+          if (callSessionId) {
+            const connection = activeRelayConnections.get(callSessionId);
+            connection?.handleMessage(typeof message === 'string' ? message : new TextDecoder().decode(message));
+          }
+        },
+        close(ws, code, reason) {
+          const callSessionId = ws.data?.callSessionId;
+          log.info({ callSessionId, code, reason: reason?.toString() }, 'ConversationRelay WebSocket closed');
+          if (callSessionId) {
+            const connection = activeRelayConnections.get(callSessionId);
+            connection?.destroy();
+            activeRelayConnections.delete(callSessionId);
+          }
+        },
+      },
     });
 
     // Sweep failed channel inbound events for retry every 30 seconds
@@ -162,7 +304,7 @@ export class RuntimeHttpServer {
     return timingSafeEqual(a, b);
   }
 
-  private async handleRequest(req: Request): Promise<Response> {
+  private async handleRequest(req: Request, server: ReturnType<typeof Bun.serve>): Promise<Response> {
     const url = new URL(req.url);
     const path = url.pathname;
 
@@ -171,6 +313,56 @@ export class RuntimeHttpServer {
       return this.handleHealth();
     }
 
+    // WebSocket upgrade for ConversationRelay — before auth check because
+    // Twilio WebSocket connections don't use bearer tokens.
+    if (path.startsWith('/v1/calls/relay') && req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+      const wsUrl = new URL(req.url);
+      const callSessionId = wsUrl.searchParams.get('callSessionId');
+      if (!callSessionId) {
+        return new Response('Missing callSessionId', { status: 400 });
+      }
+      const upgraded = server.upgrade(req, { data: { callSessionId } });
+      if (!upgraded) {
+        return new Response('WebSocket upgrade failed', { status: 500 });
+      }
+      // Bun handles the response after a successful upgrade.
+      // The RelayConnection is created in the websocket.open handler.
+      return undefined as unknown as Response;
+    }
+
+    // ── Twilio webhook endpoints — before auth check because Twilio
+    //    webhook POSTs don't include bearer tokens.
+    //    Supports /v1/calls/twilio/*, /v1/assistants/:id/calls/twilio/*,
+    //    and gateway-compatible /webhooks/twilio/* paths.
+    //    Validates X-Twilio-Signature to prevent unauthorized access. ──
+    const twilioMatch = path.match(TWILIO_WEBHOOK_RE);
+    const gatewayTwilioMatch = !twilioMatch ? path.match(TWILIO_GATEWAY_WEBHOOK_RE) : null;
+    const resolvedTwilioSubpath = twilioMatch
+      ? twilioMatch[1]
+      : gatewayTwilioMatch
+        ? GATEWAY_SUBPATH_MAP[gatewayTwilioMatch[1]]
+        : null;
+    if (resolvedTwilioSubpath && req.method === 'POST') {
+      const twilioSubpath = resolvedTwilioSubpath;
+
+      // Validate Twilio request signature before dispatching
+      const validation = await validateTwilioWebhook(req);
+      if (validation instanceof Response) return validation;
+
+      // Reconstruct request so handlers can read the body
+      const validatedReq = cloneRequestWithBody(req, validation.body);
+
+      if (twilioSubpath === 'voice-webhook') {
+        return await handleVoiceWebhook(validatedReq);
+      }
+      if (twilioSubpath === 'status') {
+        return await handleStatusCallback(validatedReq);
+      }
+      if (twilioSubpath === 'connect-action') {
+        return await handleConnectAction(validatedReq);
+      }
+    }
+
     // Require bearer token when configured
     if ((process.env.DISABLE_HTTP_AUTH ?? "").toLowerCase() !== "true" && this.bearerToken) {
       const authHeader = req.headers.get('authorization');
@@ -247,7 +439,7 @@ export class RuntimeHttpServer {
     // Paths already handled above (/v1/apps/..., /v1/secrets) will never reach here.
     const newRouteMatch = path.match(/^\/v1\/(?!assistants\/)(.+)$/);
     if (newRouteMatch) {
-      return this.dispatchEndpoint('local-assistant', newRouteMatch[1], req, url);
+      return this.dispatchEndpoint(newRouteMatch[1], req, url);
     }
 
     // Legacy: /v1/assistants/:assistantId/<endpoint>
@@ -259,7 +451,7 @@ export class RuntimeHttpServer {
     const assistantId = match[1];
     const endpoint = match[2];
     log.warn({ endpoint, assistantId }, '[deprecated] /v1/assistants/:assistantId/... route used; migrate to /v1/...');
-    return this.dispatchEndpoint(assistantId, endpoint, req, url);
+    return this.dispatchEndpoint(endpoint, req, url);
   }
 
   /**
@@ -268,7 +460,6 @@ export class RuntimeHttpServer {
    * legacy assistant-scoped routes (/v1/assistants/:assistantId/<endpoint>).
    */
   private async dispatchEndpoint(
-    assistantId: string,
     endpoint: string,
     req: Request,
     url: URL,
@@ -279,32 +470,32 @@ export class RuntimeHttpServer {
       }
 
       if (endpoint === 'messages' && req.method === 'GET') {
-        return handleListMessages(assistantId, url, this.interfacesDir);
+        return handleListMessages(url, this.interfacesDir);
       }
 
       if (endpoint === 'messages' && req.method === 'POST') {
-        return await handleSendMessage(assistantId, req, {
+        return await handleSendMessage(req, {
           processMessage: this.processMessage,
           persistAndProcessMessage: this.persistAndProcessMessage,
         });
       }
 
       if (endpoint === 'attachments' && req.method === 'POST') {
-        return await handleUploadAttachment(assistantId, req);
+        return await handleUploadAttachment(req);
       }
 
       if (endpoint === 'attachments' && req.method === 'DELETE') {
-        return await handleDeleteAttachment(assistantId, req);
+        return await handleDeleteAttachment(req);
       }
 
       // Match attachments/:attachmentId
       const attachmentMatch = endpoint.match(/^attachments\/([^/]+)$/);
       if (attachmentMatch && req.method === 'GET') {
-        return handleGetAttachment(assistantId, attachmentMatch[1]);
+        return handleGetAttachment(attachmentMatch[1]);
       }
 
       if (endpoint === 'suggestion' && req.method === 'GET') {
-        return await handleGetSuggestion(assistantId, url, {
+        return await handleGetSuggestion(url, {
           suggestionCache: this.suggestionCache,
           suggestionInFlight: this.suggestionInFlight,
         });
@@ -314,7 +505,7 @@ export class RuntimeHttpServer {
         if (!this.runOrchestrator) {
           return Response.json({ error: 'Run orchestration not configured' }, { status: 503 });
         }
-        return await handleCreateRun(assistantId, req, this.runOrchestrator);
+        return await handleCreateRun(req, this.runOrchestrator);
       }
 
       // Match runs/:runId, runs/:runId/decision, runs/:runId/trust-rule
@@ -325,17 +516,17 @@ export class RuntimeHttpServer {
         }
         const runId = runsMatch[1];
         if (runsMatch[2] === '/decision' && req.method === 'POST') {
-          return await handleRunDecision(assistantId, runId, req, this.runOrchestrator);
+          return await handleRunDecision(runId, req, this.runOrchestrator);
         }
         if (runsMatch[2] === '/trust-rule' && req.method === 'POST') {
           const run = this.runOrchestrator.getRun(runId);
-          if (!run || run.assistantId !== assistantId) {
+          if (!run) {
             return Response.json({ error: 'Run not found' }, { status: 404 });
           }
           return await handleAddTrustRule(runId, req);
         }
         if (req.method === 'GET') {
-          return handleGetRun(assistantId, runId, this.runOrchestrator);
+          return handleGetRun(runId, this.runOrchestrator);
         }
       }
 
@@ -345,36 +536,98 @@ export class RuntimeHttpServer {
       }
 
       if (endpoint === 'channels/conversation' && req.method === 'DELETE') {
-        return await handleDeleteConversation(assistantId, req);
+        return await handleDeleteConversation(req);
       }
 
       if (endpoint === 'channels/inbound' && req.method === 'POST') {
-        return await handleChannelInbound(assistantId, req, this.processMessage);
+        return await handleChannelInbound(req, this.processMessage);
       }
 
       if (endpoint === 'channels/delivery-ack' && req.method === 'POST') {
-        return await handleChannelDeliveryAck(assistantId, req);
+        return await handleChannelDeliveryAck(req);
       }
 
       if (endpoint === 'channels/dead-letters' && req.method === 'GET') {
-        return handleListDeadLetters(assistantId);
+        return handleListDeadLetters();
       }
 
       if (endpoint === 'channels/replay' && req.method === 'POST') {
-        return await handleReplayDeadLetters(assistantId, req);
+        return await handleReplayDeadLetters(req);
+      }
+
+      // ── Call API routes ───────────────────────────────────────────
+      if (endpoint === 'calls/start' && req.method === 'POST') {
+        return await handleStartCall(req);
+      }
+
+      // Match calls/:callSessionId and calls/:callSessionId/cancel, calls/:callSessionId/answer
+      const callsMatch = endpoint.match(/^calls\/([^/]+?)(\/cancel|\/answer)?$/);
+      if (callsMatch) {
+        const callSessionId = callsMatch[1];
+        // Skip known sub-paths that are handled elsewhere (twilio, relay)
+        if (callSessionId !== 'twilio' && callSessionId !== 'relay' && callSessionId !== 'start') {
+          if (callsMatch[2] === '/cancel' && req.method === 'POST') {
+            return await handleCancelCall(req, callSessionId);
+          }
+          if (callsMatch[2] === '/answer' && req.method === 'POST') {
+            return await handleAnswerCall(req, callSessionId);
+          }
+          if (!callsMatch[2] && req.method === 'GET') {
+            return handleGetCallStatus(callSessionId);
+          }
+        }
+      }
+
+      // ── Internal Twilio forwarding endpoints (gateway → runtime) ──
+      // These accept JSON payloads from the gateway (which already validated
+      // the Twilio signature) and reconstruct requests for the existing
+      // Twilio route handlers.
+      if (endpoint === 'internal/twilio/voice-webhook' && req.method === 'POST') {
+        const json = await req.json() as { params: Record<string, string>; originalUrl?: string };
+        const formBody = new URLSearchParams(json.params).toString();
+        // Reconstruct request URL: keep the original URL query string (callSessionId)
+        const reconstructedUrl = json.originalUrl ?? req.url;
+        const fakeReq = new Request(reconstructedUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: formBody,
+        });
+        return await handleVoiceWebhook(fakeReq);
+      }
+
+      if (endpoint === 'internal/twilio/status' && req.method === 'POST') {
+        const json = await req.json() as { params: Record<string, string> };
+        const formBody = new URLSearchParams(json.params).toString();
+        const fakeReq = new Request(req.url, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: formBody,
+        });
+        return await handleStatusCallback(fakeReq);
+      }
+
+      if (endpoint === 'internal/twilio/connect-action' && req.method === 'POST') {
+        const json = await req.json() as { params: Record<string, string> };
+        const formBody = new URLSearchParams(json.params).toString();
+        const fakeReq = new Request(req.url, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: formBody,
+        });
+        return await handleConnectAction(fakeReq);
       }
 
       return Response.json({ error: 'Not found', source: 'runtime' }, { status: 404 });
     } catch (err) {
       if (err instanceof IngressBlockedError) {
-        log.warn({ endpoint, assistantId, detectedTypes: err.detectedTypes }, 'Blocked HTTP request containing secrets');
+        log.warn({ endpoint, detectedTypes: err.detectedTypes }, 'Blocked HTTP request containing secrets');
         return Response.json({ error: err.message, code: err.code }, { status: 422 });
       }
       if (err instanceof ConfigError) {
-        log.warn({ err, endpoint, assistantId }, 'Runtime HTTP config error');
+        log.warn({ err, endpoint }, 'Runtime HTTP config error');
         return Response.json({ error: err.message, code: err.code }, { status: 422 });
       }
-      log.error({ err, endpoint, assistantId }, 'Runtime HTTP handler error');
+      log.error({ err, endpoint }, 'Runtime HTTP handler error');
       const message = err instanceof Error ? err.message : 'Internal server error';
       return Response.json({ error: message }, { status: 500 });
     }
@@ -428,7 +681,6 @@ export class RuntimeHttpServer {
 
       try {
         const { messageId: userMessageId } = await this.processMessage(
-          event.assistantId,
           event.conversationId,
           content,
           attachmentIds,

package/src/runtime/http-types.ts

@@ -12,7 +12,6 @@ export interface RuntimeMessageSessionOptions {
 }
 
 export type MessageProcessor = (
-  assistantId: string,
   conversationId: string,
   content: string,
   attachmentIds?: string[],
@@ -26,7 +25,6 @@ export type MessageProcessor = (
  * immediately.
  */
 export type NonBlockingMessageProcessor = (
-  assistantId: string,
   conversationId: string,
   content: string,
   attachmentIds?: string[],