vellum 0.2.0 → 0.2.2

package/src/runtime/routes/attachment-routes.ts

@@ -7,7 +7,7 @@ import { validateAttachmentUpload, AttachmentUploadError } from '../../memory/at
 /** 30 MB — base64-encoded 20 MB attachment ≈ 27 MB plus JSON wrapper overhead. */
 const MAX_UPLOAD_BODY_BYTES = 30 * 1024 * 1024;
 
-export async function handleUploadAttachment(assistantId: string, req: Request): Promise<Response> {
+export async function handleUploadAttachment(req: Request): Promise<Response> {
   const rawBody = await req.arrayBuffer();
   if (rawBody.byteLength > MAX_UPLOAD_BODY_BYTES) {
     return Response.json(
@@ -56,7 +56,6 @@ export async function handleUploadAttachment(assistantId: string, req: Request):
   let attachment: attachmentsStore.StoredAttachment;
   try {
     attachment = attachmentsStore.uploadAttachment(
-      assistantId,
       filename,
       mimeType,
       data,
@@ -78,7 +77,7 @@ export async function handleUploadAttachment(assistantId: string, req: Request):
   });
 }
 
-export async function handleDeleteAttachment(assistantId: string, req: Request): Promise<Response> {
+export async function handleDeleteAttachment(req: Request): Promise<Response> {
   let body: { attachmentId?: string };
   try {
     body = await req.json() as { attachmentId?: string };
@@ -98,7 +97,7 @@ export async function handleDeleteAttachment(assistantId: string, req: Request):
     );
   }
 
-  const result = attachmentsStore.deleteAttachment(assistantId, attachmentId);
+  const result = attachmentsStore.deleteAttachment(attachmentId);
 
   if (result === 'not_found') {
     return Response.json(
@@ -117,8 +116,8 @@ export async function handleDeleteAttachment(assistantId: string, req: Request):
   return new Response(null, { status: 204 });
 }
 
-export function handleGetAttachment(assistantId: string, attachmentId: string): Response {
-  const attachment = attachmentsStore.getAttachmentById(assistantId, attachmentId);
+export function handleGetAttachment(attachmentId: string): Response {
+  const attachment = attachmentsStore.getAttachmentById(attachmentId);
   if (!attachment) {
     return Response.json({ error: 'Attachment not found' }, { status: 404 });
   }

package/src/runtime/routes/call-routes.ts

@@ -0,0 +1,140 @@
+/**
+ * Runtime HTTP route handlers for the call API.
+ *
+ * POST   /v1/calls/start              — initiate a new call
+ * GET    /v1/calls/:callSessionId      — get call status
+ * POST   /v1/calls/:callSessionId/cancel — cancel a call
+ * POST   /v1/calls/:callSessionId/answer — answer a pending question
+ */
+
+import { startCall, getCallStatus, cancelCall, answerCall } from '../../calls/call-domain.js';
+import { getConfig } from '../../config/loader.js';
+
+/**
+ * POST /v1/calls/start
+ *
+ * Body: { phoneNumber: string; task: string; context?: string; conversationId: string }
+ */
+export async function handleStartCall(req: Request): Promise<Response> {
+  if (!getConfig().calls.enabled) {
+    return Response.json(
+      { error: 'Calls feature is disabled via configuration. Set calls.enabled to true to use this feature.' },
+      { status: 403 },
+    );
+  }
+
+  let body: {
+    phoneNumber?: string;
+    task?: string;
+    context?: string;
+    conversationId?: string;
+  };
+  try {
+    body = await req.json() as typeof body;
+  } catch {
+    return Response.json({ error: 'Invalid JSON in request body' }, { status: 400 });
+  }
+
+  if (!body.conversationId) {
+    return Response.json({ error: 'conversationId is required' }, { status: 400 });
+  }
+
+  const result = await startCall({
+    phoneNumber: body.phoneNumber ?? '',
+    task: body.task ?? '',
+    context: body.context,
+    conversationId: body.conversationId,
+  });
+
+  if (!result.ok) {
+    return Response.json({ error: result.error }, { status: result.status ?? 500 });
+  }
+
+  return Response.json({
+    callSessionId: result.session.id,
+    callSid: result.callSid,
+    status: result.session.status,
+    toNumber: result.session.toNumber,
+    fromNumber: result.session.fromNumber,
+  }, { status: 201 });
+}
+
+/**
+ * GET /v1/calls/:callSessionId
+ */
+export function handleGetCallStatus(callSessionId: string): Response {
+  const result = getCallStatus(callSessionId);
+
+  if (!result.ok) {
+    return Response.json({ error: result.error }, { status: result.status ?? 500 });
+  }
+
+  const { session } = result;
+  return Response.json({
+    callSessionId: session.id,
+    conversationId: session.conversationId,
+    status: session.status,
+    toNumber: session.toNumber,
+    fromNumber: session.fromNumber,
+    provider: session.provider,
+    providerCallSid: session.providerCallSid,
+    task: session.task,
+    startedAt: session.startedAt ? new Date(session.startedAt).toISOString() : null,
+    endedAt: session.endedAt ? new Date(session.endedAt).toISOString() : null,
+    lastError: session.lastError,
+    pendingQuestion: result.pendingQuestion ?? null,
+    createdAt: new Date(session.createdAt).toISOString(),
+    updatedAt: new Date(session.updatedAt).toISOString(),
+  });
+}
+
+/**
+ * POST /v1/calls/:callSessionId/cancel
+ *
+ * Body: { reason?: string }
+ */
+export async function handleCancelCall(req: Request, callSessionId: string): Promise<Response> {
+  let reason: string | undefined;
+  try {
+    const body = await req.json() as { reason?: string };
+    reason = body.reason;
+  } catch {
+    // Empty body is fine
+  }
+
+  const result = await cancelCall({ callSessionId, reason });
+
+  if (!result.ok) {
+    return Response.json({ error: result.error }, { status: result.status ?? 500 });
+  }
+
+  return Response.json({
+    callSessionId: result.session.id,
+    status: result.session.status,
+  });
+}
+
+/**
+ * POST /v1/calls/:callSessionId/answer
+ *
+ * Body: { answer: string }
+ */
+export async function handleAnswerCall(req: Request, callSessionId: string): Promise<Response> {
+  let body: { answer?: string };
+  try {
+    body = await req.json() as typeof body;
+  } catch {
+    return Response.json({ error: 'Invalid JSON in request body' }, { status: 400 });
+  }
+
+  const result = await answerCall({
+    callSessionId,
+    answer: body.answer ?? '',
+  });
+
+  if (!result.ok) {
+    return Response.json({ error: result.error }, { status: result.status ?? 500 });
+  }
+
+  return Response.json({ ok: true, questionId: result.questionId });
+}

package/src/runtime/routes/channel-routes.ts

@@ -18,7 +18,7 @@ import type {
 
 const log = getLogger('runtime-http');
 
-export async function handleDeleteConversation(assistantId: string, req: Request): Promise<Response> {
+export async function handleDeleteConversation(req: Request): Promise<Response> {
   const body = await req.json() as {
     sourceChannel?: string;
     externalChatId?: string;
@@ -34,13 +34,12 @@ export async function handleDeleteConversation(assistantId: string, req: Request
   }
 
   const conversationKey = `${sourceChannel}:${externalChatId}`;
-  deleteConversationKey(assistantId, conversationKey);
+  deleteConversationKey(conversationKey);
 
   return Response.json({ ok: true });
 }
 
 export async function handleChannelInbound(
-  assistantId: string,
   req: Request,
   processMessage?: MessageProcessor,
 ): Promise<Response> {
@@ -90,7 +89,7 @@ export async function handleChannelInbound(
   }
 
   if (hasAttachments) {
-    const resolved = attachmentsStore.getAttachmentsByIds(assistantId, attachmentIds);
+    const resolved = attachmentsStore.getAttachmentsByIds(attachmentIds);
     if (resolved.length !== attachmentIds.length) {
       const resolvedIds = new Set(resolved.map((a) => a.id));
       const missing = attachmentIds.filter((id) => !resolvedIds.has(id));
@@ -113,7 +112,6 @@ export async function handleChannelInbound(
   if (isEdit && sourceMessageId) {
     // Dedup the edit event itself (retried edited_message webhooks)
     const editResult = channelDeliveryStore.recordInbound(
-      assistantId,
       sourceChannel,
       externalChatId,
       externalMessageId,
@@ -137,7 +135,6 @@ export async function handleChannelInbound(
     let original: { messageId: string; conversationId: string } | null = null;
     for (let attempt = 0; attempt <= EDIT_LOOKUP_RETRIES; attempt++) {
       original = channelDeliveryStore.findMessageBySourceId(
-        assistantId,
         sourceChannel,
         externalChatId,
         sourceMessageId,
@@ -145,7 +142,7 @@ export async function handleChannelInbound(
       if (original) break;
       if (attempt < EDIT_LOOKUP_RETRIES) {
         log.info(
-          { assistantId, sourceMessageId, attempt: attempt + 1, maxAttempts: EDIT_LOOKUP_RETRIES },
+          { assistantId: "self", sourceMessageId, attempt: attempt + 1, maxAttempts: EDIT_LOOKUP_RETRIES },
           'Original message not linked yet, retrying edit lookup',
         );
         await new Promise((resolve) => setTimeout(resolve, EDIT_LOOKUP_DELAY_MS));
@@ -155,12 +152,12 @@ export async function handleChannelInbound(
     if (original) {
       conversationStore.updateMessageContent(original.messageId, content ?? '');
       log.info(
-        { assistantId, sourceMessageId, messageId: original.messageId },
+        { assistantId: "self", sourceMessageId, messageId: original.messageId },
         'Updated message content from edited_message',
       );
     } else {
       log.warn(
-        { assistantId, sourceChannel, externalChatId, sourceMessageId },
+        { assistantId: "self", sourceChannel, externalChatId, sourceMessageId },
         'Could not find original message for edit after retries, ignoring',
       );
     }
@@ -174,7 +171,6 @@ export async function handleChannelInbound(
 
   // ── New message path ──
   const result = channelDeliveryStore.recordInbound(
-    assistantId,
     sourceChannel,
     externalChatId,
     externalMessageId,
@@ -221,7 +217,6 @@ export async function handleChannelInbound(
       }
 
       const { messageId: userMessageId } = await processMessage(
-        assistantId,
         result.conversationId,
         content ?? '',
         hasAttachments ? attachmentIds : undefined,
@@ -241,7 +236,6 @@ export async function handleChannelInbound(
     } catch (err) {
       // Secret ingress blocks are not retryable — let the top-level handler return 422
       if (err instanceof IngressBlockedError) throw err;
-      console.error(`[runtime-http] Processing failed`, err);
       log.error({ err, conversationId: result.conversationId }, 'Failed to process channel inbound message');
       channelDeliveryStore.recordProcessingFailure(result.eventId, err);
     }
@@ -259,7 +253,7 @@ export async function handleChannelInbound(
         try { parsed = JSON.parse(msgs[i].content); } catch { parsed = msgs[i].content; }
         const rendered = renderHistoryContent(parsed);
 
-        const linked = attachmentsStore.getAttachmentMetadataForMessage(msgs[i].id, assistantId);
+        const linked = attachmentsStore.getAttachmentMetadataForMessage(msgs[i].id);
         const replyAttachments: RuntimeAttachmentMetadata[] = linked.map((a) => ({
           id: a.id,
           filename: a.originalFilename,
@@ -291,12 +285,12 @@ export async function handleChannelInbound(
   });
 }
 
-export function handleListDeadLetters(assistantId: string): Response {
-  const events = channelDeliveryStore.getDeadLetterEvents(assistantId);
+export function handleListDeadLetters(): Response {
+  const events = channelDeliveryStore.getDeadLetterEvents();
   return Response.json({ events });
 }
 
-export async function handleReplayDeadLetters(assistantId: string, req: Request): Promise<Response> {
+export async function handleReplayDeadLetters(req: Request): Promise<Response> {
   const body = await req.json() as { eventIds?: string[] };
   const eventIds = body.eventIds;
 
@@ -304,11 +298,11 @@ export async function handleReplayDeadLetters(assistantId: string, req: Request)
     return Response.json({ error: 'eventIds array is required' }, { status: 400 });
   }
 
-  const replayed = channelDeliveryStore.replayDeadLetters(assistantId, eventIds);
+  const replayed = channelDeliveryStore.replayDeadLetters(eventIds);
   return Response.json({ replayed });
 }
 
-export async function handleChannelDeliveryAck(assistantId: string, req: Request): Promise<Response> {
+export async function handleChannelDeliveryAck(req: Request): Promise<Response> {
   const body = await req.json() as {
     sourceChannel?: string;
     externalChatId?: string;
@@ -328,7 +322,6 @@ export async function handleChannelDeliveryAck(assistantId: string, req: Request
   }
 
   const acked = channelDeliveryStore.acknowledgeDelivery(
-    assistantId,
     sourceChannel,
     externalChatId,
     externalMessageId,

package/src/runtime/routes/conversation-routes.ts

@@ -43,7 +43,6 @@ function getInterfaceFilesWithMtimes(interfacesDir: string | null): Array<{ path
 }
 
 export function handleListMessages(
-  assistantId: string,
   url: URL,
   interfacesDir: string | null,
 ): Response {
@@ -55,7 +54,7 @@ export function handleListMessages(
     );
   }
 
-  const mapping = getConversationByKey(assistantId, conversationKey);
+  const mapping = getConversationByKey(conversationKey);
   if (!mapping) {
     return Response.json({ messages: [] });
   }
@@ -90,7 +89,7 @@ export function handleListMessages(
   const messages: RuntimeMessagePayload[] = merged.map((m) => {
     let msgAttachments: RuntimeAttachmentMetadata[] = [];
     if (m.role === 'assistant' && m.id) {
-      const linked = attachmentsStore.getAttachmentMetadataForMessage(m.id, assistantId);
+      const linked = attachmentsStore.getAttachmentMetadataForMessage(m.id);
       if (linked.length > 0) {
         msgAttachments = linked.map((a) => ({
           id: a.id,
@@ -129,7 +128,6 @@ export function handleListMessages(
 }
 
 export async function handleSendMessage(
-  assistantId: string,
   req: Request,
   deps: {
     processMessage?: MessageProcessor;
@@ -172,7 +170,7 @@ export async function handleSendMessage(
 
   // Validate that all attachment IDs resolve
   if (hasAttachments) {
-    const resolved = attachmentsStore.getAttachmentsByIds(assistantId, attachmentIds);
+    const resolved = attachmentsStore.getAttachmentsByIds(attachmentIds);
     if (resolved.length !== attachmentIds.length) {
       const resolvedIds = new Set(resolved.map((a) => a.id));
       const missing = attachmentIds.filter((id) => !resolvedIds.has(id));
@@ -183,7 +181,7 @@ export async function handleSendMessage(
     }
   }
 
-  const mapping = getOrCreateConversation(assistantId, conversationKey);
+  const mapping = getOrCreateConversation(conversationKey);
 
   const processor = deps.persistAndProcessMessage ?? deps.processMessage;
   if (!processor) {
@@ -192,7 +190,6 @@ export async function handleSendMessage(
 
   try {
     const result = await processor(
-      assistantId,
       mapping.conversationId,
       content ?? '',
       hasAttachments ? attachmentIds : undefined,
@@ -236,7 +233,6 @@ async function generateLlmSuggestion(provider: Provider, assistantText: string):
 }
 
 export async function handleGetSuggestion(
-  assistantId: string,
   url: URL,
   deps: {
     suggestionCache: Map<string, string>;
@@ -251,7 +247,7 @@ export async function handleGetSuggestion(
     );
   }
 
-  const mapping = getConversationByKey(assistantId, conversationKey);
+  const mapping = getConversationByKey(conversationKey);
   if (!mapping) {
     return Response.json({ suggestion: null, messageId: null, source: 'none' as const });
   }

package/src/runtime/routes/run-routes.ts

@@ -11,7 +11,6 @@ import type { RunOrchestrator } from '../run-orchestrator.js';
 const log = getLogger('runtime-http');
 
 export async function handleCreateRun(
-  assistantId: string,
   req: Request,
   runOrchestrator: RunOrchestrator,
 ): Promise<Response> {
@@ -39,7 +38,7 @@ export async function handleCreateRun(
   }
 
   if (hasAttachments) {
-    const resolved = attachmentsStore.getAttachmentsByIds(assistantId, attachmentIds);
+    const resolved = attachmentsStore.getAttachmentsByIds(attachmentIds);
     if (resolved.length !== attachmentIds.length) {
       const resolvedIds = new Set(resolved.map((a) => a.id));
       const missing = attachmentIds.filter((id) => !resolvedIds.has(id));
@@ -50,11 +49,10 @@ export async function handleCreateRun(
     }
   }
 
-  const mapping = getOrCreateConversation(assistantId, conversationKey);
+  const mapping = getOrCreateConversation(conversationKey);
 
   try {
     const run = await runOrchestrator.startRun(
-      assistantId,
       mapping.conversationId,
       content ?? '',
       hasAttachments ? attachmentIds : undefined,
@@ -77,12 +75,11 @@ export async function handleCreateRun(
 }
 
 export function handleGetRun(
-  assistantId: string,
   runId: string,
   runOrchestrator: RunOrchestrator,
 ): Response {
   const run = runOrchestrator.getRun(runId);
-  if (!run || run.assistantId !== assistantId) {
+  if (!run) {
     return Response.json({ error: 'Run not found' }, { status: 404 });
   }
 
@@ -98,13 +95,12 @@ export function handleGetRun(
 }
 
 export async function handleRunDecision(
-  assistantId: string,
   runId: string,
   req: Request,
   runOrchestrator: RunOrchestrator,
 ): Promise<Response> {
   const run = runOrchestrator.getRun(runId);
-  if (!run || run.assistantId !== assistantId) {
+  if (!run) {
     return Response.json({ error: 'Run not found' }, { status: 404 });
   }
 

package/src/runtime/run-orchestrator.ts

@@ -14,10 +14,13 @@ import * as runsStore from '../memory/runs-store.js';
 import type { Run } from '../memory/runs-store.js';
 import type { Session } from '../daemon/session.js';
 import type { ServerMessage } from '../daemon/ipc-protocol.js';
+import { resolveChannelCapabilities } from '../daemon/session-runtime-assembly.js';
 import type { UserDecision } from '../permissions/types.js';
 import { checkIngressForSecrets } from '../security/secret-ingress.js';
 import { IngressBlockedError } from '../util/errors.js';
 import { getLogger } from '../util/logger.js';
+import { assistantEventHub } from './assistant-event-hub.js';
+import { buildAssistantEvent } from './assistant-event.js';
 
 const log = getLogger('run-orchestrator');
 
@@ -32,7 +35,7 @@ interface PendingRunState {
 
 export interface RunOrchestratorDeps {
   getOrCreateSession: (conversationId: string) => Promise<Session>;
-  resolveAttachments: (assistantId: string, attachmentIds: string[]) => Array<{
+  resolveAttachments: (attachmentIds: string[]) => Array<{
     id: string;
     filename: string;
     mimeType: string;
@@ -64,7 +67,6 @@ export class RunOrchestrator {
    * and fire the agent loop in the background.
    */
   async startRun(
-    assistantId: string,
     conversationId: string,
     content: string,
     attachmentIds?: string[],
@@ -82,15 +84,34 @@ export class RunOrchestrator {
     }
 
     const attachments = attachmentIds
-      ? this.deps.resolveAttachments(assistantId, attachmentIds)
+      ? this.deps.resolveAttachments(attachmentIds)
       : [];
 
     const requestId = crypto.randomUUID();
     const messageId = session.persistUserMessage(content, attachments, requestId);
-    const run = runsStore.createRun(assistantId, conversationId, messageId);
+    const run = runsStore.createRun(conversationId, messageId);
+
+    // Runs are always HTTP-originated; set channel capabilities so the attachment
+    // scope heuristic resolves to 'self' rather than 'local-assistant'.
+    session.setChannelCapabilities(resolveChannelCapabilities('http-api'));
+
+    // Serialized publish chain so hub subscribers observe events in order.
+    let hubChain: Promise<void> = Promise.resolve();
+    const publishToHub = (msg: ServerMessage): void => {
+      const msgRecord = msg as unknown as Record<string, unknown>;
+      const msgSessionId =
+        'sessionId' in msg && typeof msgRecord.sessionId === 'string'
+          ? (msgRecord.sessionId as string)
+          : undefined;
+      const resolvedSessionId = msgSessionId ?? conversationId;
+      const event = buildAssistantEvent('self', msg, resolvedSessionId);
+      hubChain = hubChain
+        .then(() => assistantEventHub.publish(event))
+        .catch((err: unknown) => {
+          log.warn({ err }, 'assistant-events hub subscriber threw during HTTP run');
+        });
+    };
 
-    // Set the assistant ID so attachments are scoped correctly.
-    session.setAssistantId(assistantId);
 
     // Hook into session to intercept confirmation_request events.
     // When the prompter sends a confirmation_request, we record it in the
@@ -118,11 +139,17 @@ export class RunOrchestrator {
           session,
         });
       }
+      // Mirror every outbound message to the assistant-events hub so SSE
+      // subscribers receive the same payload parity as IPC clients.
+      publishToHub(msg);
     });
 
     // Fire-and-forget the agent loop
     const cleanup = () => {
       this.pending.delete(run.id);
+      // Reset channel capabilities so a subsequent IPC/desktop session on the
+      // same conversation is not incorrectly treated as an HTTP-API client.
+      session.setChannelCapabilities(null);
       // Reset the session's client callback to a no-op so the stale
       // closure doesn't intercept events from future runs on the same session.
       // Set hasNoClient=true here since the run is done and no HTTP caller
@@ -136,6 +163,12 @@ export class RunOrchestrator {
       } else if (msg.type === 'session_error') {
         lastError = msg.userMessage;
       }
+      // Mirror agent-loop events (assistant_text_delta, message_complete,
+      // tool_use_start, tool_result, etc.) to the hub. These travel through
+      // the onEvent path, distinct from the updateClient path used by the
+      // prompter (confirmation_request). Both paths must publish so SSE
+      // consumers receive the full response stream.
+      publishToHub(msg);
     }).then(() => {
       if (lastError) {
         log.error({ runId: run.id, error: lastError }, 'Run failed (error event from agent loop)');