vellum 0.2.1 → 0.2.2

package/src/memory/db.ts

@@ -3,6 +3,9 @@ import { drizzle } from 'drizzle-orm/bun-sqlite';
 import { computeMemoryFingerprint } from './fingerprint.js';
 import * as schema from './schema.js';
 import { getDbPath, ensureDataDir, migrateToDataLayout, migrateToWorkspaceLayout } from '../util/platform.js';
+import { getLogger } from '../util/logger.js';
+
+const log = getLogger('memory-db');
 
 let db: ReturnType<typeof drizzle<typeof schema>> | null = null;
 
@@ -271,6 +274,7 @@ export function initializeDb(): void {
       name TEXT NOT NULL,
       enabled INTEGER NOT NULL DEFAULT 1,
       cron_expression TEXT NOT NULL,
+      schedule_syntax TEXT NOT NULL DEFAULT 'cron',
       timezone TEXT,
       message TEXT NOT NULL,
       next_run_at INTEGER NOT NULL,
@@ -337,8 +341,8 @@ export function initializeDb(): void {
     )
   `);
 
-  try { database.run(/*sql*/ `ALTER TABLE published_pages ADD COLUMN app_id TEXT`); } catch {}
-  try { database.run(/*sql*/ `ALTER TABLE published_pages ADD COLUMN project_slug TEXT`); } catch {}
+  try { database.run(/*sql*/ `ALTER TABLE published_pages ADD COLUMN app_id TEXT`); } catch (e) { log.debug({ err: e }, 'ALTER TABLE published_pages ADD COLUMN app_id (likely already exists)'); }
+  try { database.run(/*sql*/ `ALTER TABLE published_pages ADD COLUMN project_slug TEXT`); } catch (e) { log.debug({ err: e }, 'ALTER TABLE published_pages ADD COLUMN project_slug (likely already exists)'); }
 
   database.run(/*sql*/ `
     CREATE TABLE IF NOT EXISTS shared_app_links (
@@ -538,6 +542,9 @@ export function initializeDb(): void {
   try { database.run(/*sql*/ `ALTER TABLE channel_inbound_events ADD COLUMN raw_payload TEXT`); } catch { /* already exists */ }
   try { database.run(/*sql*/ `ALTER TABLE conversations ADD COLUMN thread_type TEXT NOT NULL DEFAULT 'standard'`); } catch { /* already exists */ }
   try { database.run(/*sql*/ `ALTER TABLE conversations ADD COLUMN memory_scope_id TEXT NOT NULL DEFAULT 'default'`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE attachments ADD COLUMN thumbnail_base64 TEXT`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE cron_jobs ADD COLUMN schedule_syntax TEXT NOT NULL DEFAULT 'cron'`); } catch { /* already exists */ }
+  try { database.run(/*sql*/ `ALTER TABLE messages ADD COLUMN metadata TEXT`); } catch { /* already exists */ }
 
   migrateJobDeferrals(database);
   migrateToolInvocationsFk(database);
@@ -601,6 +608,7 @@ export function initializeDb(): void {
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_reminders_status_fire_at ON reminders(status, fire_at)`);
 
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_cron_jobs_enabled_next_run ON cron_jobs(enabled, next_run_at)`);
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_cron_jobs_syntax_enabled_next_run ON cron_jobs(schedule_syntax, enabled, next_run_at)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_cron_runs_job_id ON cron_runs(job_id)`);
 
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_accounts_service ON accounts(service)`);
@@ -728,12 +736,32 @@ export function initializeDb(): void {
     )
   `);
 
+  database.run(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS processed_callbacks (
+      id TEXT PRIMARY KEY,
+      dedupe_key TEXT NOT NULL UNIQUE,
+      call_session_id TEXT NOT NULL REFERENCES call_sessions(id) ON DELETE CASCADE,
+      created_at INTEGER NOT NULL
+    )
+  `);
+
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_sessions_conversation_id ON call_sessions(conversation_id)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_sessions_provider_call_sid ON call_sessions(provider_call_sid)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_sessions_status ON call_sessions(status)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_events_call_session_id ON call_events(call_session_id)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_pending_questions_call_session_id ON call_pending_questions(call_session_id)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_call_pending_questions_status ON call_pending_questions(status)`);
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_processed_callbacks_dedupe_key ON processed_callbacks(dedupe_key)`);
+  database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_processed_callbacks_call_session_id ON processed_callbacks(call_session_id)`);
+
+  // Add claim ownership token to prevent cross-handler claim interference
+  try { database.run(/*sql*/ `ALTER TABLE processed_callbacks ADD COLUMN claim_id TEXT`); } catch { /* already exists */ }
+
+  // Unique constraint: at most one non-null provider_call_sid per (provider, provider_call_sid).
+  // On upgraded databases that pre-date this constraint, duplicate rows may exist; deduplicate
+  // them first to avoid a UNIQUE constraint failure that would prevent startup.
+  migrateCallSessionsProviderSidDedup(database);
+  database.run(/*sql*/ `CREATE UNIQUE INDEX IF NOT EXISTS idx_call_sessions_provider_sid_unique ON call_sessions(provider, provider_call_sid) WHERE provider_call_sid IS NOT NULL`);
 
   // ── Follow-ups ─────────────────────────────────────────────────────
 
@@ -823,6 +851,13 @@ export function initializeDb(): void {
     )
   `);
 
+  // Work item run contract snapshot
+  try { database.run(/*sql*/ `ALTER TABLE work_items ADD COLUMN required_tools TEXT`); } catch (e) { log.debug({ err: e }, 'ALTER TABLE work_items ADD COLUMN required_tools (likely already exists)'); }
+
+  // Work item permission preflight columns
+  try { database.run(/*sql*/ `ALTER TABLE work_items ADD COLUMN approved_tools TEXT`); } catch (e) { log.debug({ err: e }, 'ALTER TABLE work_items ADD COLUMN approved_tools (likely already exists)'); }
+  try { database.run(/*sql*/ `ALTER TABLE work_items ADD COLUMN approval_status TEXT DEFAULT 'none'`); } catch (e) { log.debug({ err: e }, 'ALTER TABLE work_items ADD COLUMN approval_status (likely already exists)'); }
+
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_work_items_status ON work_items(status)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_work_items_task_id ON work_items(task_id)`);
   database.run(/*sql*/ `CREATE INDEX IF NOT EXISTS idx_work_items_priority_sort ON work_items(priority_tier, sort_index)`);
@@ -1369,3 +1404,62 @@ function migrateAssistantIdToSelf(database: ReturnType<typeof drizzle<typeof sch
     throw e;
   }
 }
+
+/**
+ * One-shot migration: remove duplicate (provider, provider_call_sid) rows from
+ * call_sessions so that the unique index can be created safely on upgraded databases
+ * that pre-date the constraint.
+ *
+ * For each set of duplicates, the most recently updated row is kept.
+ */
+function migrateCallSessionsProviderSidDedup(database: ReturnType<typeof drizzle<typeof schema>>): void {
+  const raw = (database as unknown as { $client: Database }).$client;
+
+  // Quick check: if the unique index already exists, no dedup is needed.
+  const idxExists = raw.query(
+    `SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = 'idx_call_sessions_provider_sid_unique'`,
+  ).get();
+  if (idxExists) return;
+
+  // Check if the table even exists yet (first boot).
+  const tableExists = raw.query(
+    `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'call_sessions'`,
+  ).get();
+  if (!tableExists) return;
+
+  // Count duplicates before doing any work.
+  const dupCount = raw.query(/*sql*/ `
+    SELECT COUNT(*) AS c FROM (
+      SELECT provider, provider_call_sid
+      FROM call_sessions
+      WHERE provider_call_sid IS NOT NULL
+      GROUP BY provider, provider_call_sid
+      HAVING COUNT(*) > 1
+    )
+  `).get() as { c: number } | null;
+
+  if (!dupCount || dupCount.c === 0) return;
+
+  log.warn({ duplicateGroups: dupCount.c }, 'Deduplicating call_sessions with duplicate provider_call_sid before creating unique index');
+
+  try {
+    raw.exec('BEGIN');
+
+    // Keep the most recently updated row per (provider, provider_call_sid);
+    // delete the rest.
+    raw.exec(/*sql*/ `
+      DELETE FROM call_sessions
+      WHERE provider_call_sid IS NOT NULL
+        AND rowid NOT IN (
+          SELECT MAX(rowid) FROM call_sessions
+          WHERE provider_call_sid IS NOT NULL
+          GROUP BY provider, provider_call_sid
+        )
+    `);
+
+    raw.exec('COMMIT');
+  } catch (e) {
+    try { raw.exec('ROLLBACK'); } catch { /* no active transaction */ }
+    throw e;
+  }
+}

package/src/memory/entity-extractor.ts

@@ -3,11 +3,14 @@ import { eq, sql } from 'drizzle-orm';
 import { getConfig } from '../config/loader.js';
 import type { MemoryEntityConfig } from '../config/types.js';
 import { getLogger } from '../util/logger.js';
+import { truncate } from '../util/truncate.js';
 import { getDb } from './db.js';
 import { memoryEntities, memoryEntityRelations, memoryItemEntities } from './schema.js';
 
 const log = getLogger('memory-entity-extractor');
 
+const ENTITY_EXTRACTION_TIMEOUT_MS = 15_000;
+
 export type EntityType =
   | 'person'
   | 'project'
@@ -145,7 +148,7 @@ export async function extractEntitiesWithLLM(
         messages: [{ role: 'user' as const, content: text }],
       }) as Promise<Anthropic.Message>,
       new Promise<never>((_, reject) =>
-        setTimeout(() => reject(new Error('Entity extraction LLM timeout')), 15000),
+        setTimeout(() => reject(new Error('Entity extraction LLM timeout')), ENTITY_EXTRACTION_TIMEOUT_MS),
       ),
     ]) as Anthropic.Message;
 
@@ -460,12 +463,12 @@ function dedupeAliasList(rawAliases: string[], canonicalName: string): string[]
 
 function normalizeEntityName(value: string | null | undefined): string | null {
   if (!value) return null;
-  const normalized = String(value).trim().slice(0, 200);
+  const normalized = truncate(String(value).trim(), 200, '');
   return normalized.length > 0 ? normalized : null;
 }
 
 function normalizeEvidence(value: string | null | undefined): string | null {
   if (!value) return null;
-  const normalized = String(value).trim().slice(0, 500);
+  const normalized = truncate(String(value).trim(), 500, '');
   return normalized.length > 0 ? normalized : null;
 }

package/src/memory/items-extractor.ts

@@ -4,6 +4,7 @@ import { v4 as uuid } from 'uuid';
 import { getConfig } from '../config/loader.js';
 import type { MemoryExtractionConfig } from '../config/types.js';
 import { getLogger } from '../util/logger.js';
+import { truncate } from '../util/truncate.js';
 import { computeMemoryFingerprint } from './fingerprint.js';
 import { enqueueMemoryJob } from './jobs-store.js';
 import { extractTextFromStoredMessageContent } from './message-content.js';
@@ -199,8 +200,8 @@ async function extractItemsWithLLM(
     for (const raw of input.items) {
       if (!VALID_KINDS.has(raw.kind)) continue;
       if (!raw.subject || !raw.statement) continue;
-      const subject = String(raw.subject).slice(0, 80);
-      const statement = String(raw.statement).slice(0, 500);
+      const subject = truncate(String(raw.subject), 80, '');
+      const statement = truncate(String(raw.statement), 500, '');
       const confidence = clamp(parseScore(raw.confidence, 0.5), 0, 1);
       const importance = clamp(parseScore(raw.importance, 0.5), 0, 1);
       const fingerprint = computeMemoryFingerprint(scopeId, raw.kind, subject, statement);
@@ -333,7 +334,7 @@ export async function extractAndUpsertMemoryItemsForMessage(messageId: string, s
     db.insert(memoryItemSources).values({
       memoryItemId,
       messageId,
-      evidence: item.statement.slice(0, 500),
+      evidence: truncate(item.statement, 500, ''),
       createdAt: now,
     }).onConflictDoNothing().run();
 
@@ -410,7 +411,7 @@ function inferSubject(sentence: string, kind: MemoryItemKind): string {
     if (match) return match[1];
   }
   const words = trimmed.split(/\s+/).slice(0, 6).join(' ');
-  return words.slice(0, 80);
+  return truncate(words, 80, '');
 }
 
 function includesAny(text: string, needles: string[]): boolean {

package/src/memory/jobs-store.ts

@@ -2,6 +2,7 @@ import { and, asc, eq, lte, notInArray, inArray } from 'drizzle-orm';
 import { v4 as uuid } from 'uuid';
 import { getDb } from './db.js';
 import { memoryJobs } from './schema.js';
+import { truncate } from '../util/truncate.js';
 
 export type MemoryJobType =
   | 'embed_segment'
@@ -331,7 +332,7 @@ export function failMemoryJob(
         status: 'failed',
         attempts,
         updatedAt: now,
-        lastError: error.slice(0, 2000),
+        lastError: truncate(error, 2000, ''),
       })
       .where(eq(memoryJobs.id, id))
       .run();
@@ -343,7 +344,7 @@ export function failMemoryJob(
       attempts,
       runAfter: now + retryDelayMs,
       updatedAt: now,
-      lastError: error.slice(0, 2000),
+      lastError: truncate(error, 2000, ''),
     })
     .where(eq(memoryJobs.id, id))
     .run();

package/src/memory/llm-usage-store.ts

@@ -16,7 +16,7 @@ export function recordUsageEvent(input: UsageEventInput, pricing: PricingResult)
   db.insert(llmUsageEvents).values({
     id: event.id,
     createdAt: event.createdAt,
-    assistantId: event.assistantId,
+    assistantId: 'self',
     conversationId: event.conversationId,
     runId: event.runId,
     requestId: event.requestId,
@@ -45,7 +45,6 @@ export function listUsageEvents(options?: { limit?: number }): UsageEvent[] {
   return rows.map(row => ({
     id: row.id,
     createdAt: row.createdAt,
-    assistantId: row.assistantId,
     conversationId: row.conversationId,
     runId: row.runId,
     requestId: row.requestId,

package/src/memory/runs-store.ts

@@ -85,7 +85,6 @@ function rowToRun(row: typeof messageRuns.$inferSelect): Run {
 // ---------------------------------------------------------------------------
 
 export function createRun(
-  assistantId: string,
   conversationId: string,
   messageId?: string,
 ): Run {
@@ -95,7 +94,7 @@ export function createRun(
 
   const row = {
     id,
-    assistantId,
+    assistantId: 'self',
     conversationId,
     messageId: messageId ?? null,
     status: 'running' as const,

package/src/memory/schema.ts

@@ -23,6 +23,7 @@ export const messages = sqliteTable('messages', {
   role: text('role').notNull(),
   content: text('content').notNull(),
   createdAt: integer('created_at').notNull(),
+  metadata: text('metadata'),
 });
 
 export const toolInvocations = sqliteTable('tool_invocations', {
@@ -164,6 +165,7 @@ export const attachments = sqliteTable('attachments', {
   kind: text('kind').notNull(),
   dataBase64: text('data_base64').notNull(),
   contentHash: text('content_hash'),
+  thumbnailBase64: text('thumbnail_base64'),
   createdAt: integer('created_at').notNull(),
 });
 
@@ -242,13 +244,14 @@ export const reminders = sqliteTable('reminders', {
   updatedAt: integer('updated_at').notNull(),
 });
 
-// ── Cron / Deferred Tasks ────────────────────────────────────────────
+// ── Recurrence Schedules ─────────────────────────────────────────────
 
 export const cronJobs = sqliteTable('cron_jobs', {
   id: text('id').primaryKey(),
   name: text('name').notNull(),
   enabled: integer('enabled', { mode: 'boolean' }).notNull().default(true),
   cronExpression: text('cron_expression').notNull(),    // e.g. '0 9 * * 1-5'
+  scheduleSyntax: text('schedule_syntax').notNull().default('cron'),  // 'cron' | 'rrule'
   timezone: text('timezone'),                           // e.g. 'America/Los_Angeles'
   message: text('message').notNull(),
   nextRunAt: integer('next_run_at').notNull(),
@@ -288,6 +291,11 @@ export const cronRuns = sqliteTable('cron_runs', {
   createdAt: integer('created_at').notNull(),
 });
 
+// Recurrence-centric aliases — prefer these in new code.
+// Physical table names remain `cron_jobs` / `cron_runs` for migration compatibility.
+export const scheduleJobs = cronJobs;
+export const scheduleRuns = cronRuns;
+
 // ── LLM Usage Events (cost tracking ledger) ─────────────────────────
 
 // ── Entity Graph ─────────────────────────────────────────────────────
@@ -432,7 +440,7 @@ export const workItems = sqliteTable('work_items', {
   taskId: text('task_id').notNull().references(() => tasks.id),
   title: text('title').notNull(),
   notes: text('notes'),
-  status: text('status').notNull().default('queued'),  // queued | running | awaiting_review | failed | done | archived
+  status: text('status').notNull().default('queued'),  // queued | running | awaiting_review | failed | cancelled | done | archived
   priorityTier: integer('priority_tier').notNull().default(1), // 0=high, 1=medium, 2=low
   sortIndex: integer('sort_index'),  // manual ordering within same priority tier; null = fall back to updated_at
   lastRunId: text('last_run_id'),
@@ -440,6 +448,9 @@ export const workItems = sqliteTable('work_items', {
   lastRunStatus: text('last_run_status'),  // 'completed' | 'failed' | null
   sourceType: text('source_type'),  // reserved for future bridge (e.g. 'followup', 'triage')
   sourceId: text('source_id'),      // reserved for future bridge
+  requiredTools: text('required_tools'),  // JSON array snapshot of tools needed for this run (null=unknown, []=none, ["bash",...]=specific)
+  approvedTools: text('approved_tools'),  // JSON array of pre-approved tool names
+  approvalStatus: text('approval_status').default('none'),  // 'none' | 'approved' | 'denied'
   createdAt: integer('created_at').notNull(),
   updatedAt: integer('updated_at').notNull(),
 });
@@ -569,3 +580,13 @@ export const callPendingQuestions = sqliteTable('call_pending_questions', {
   answeredAt: integer('answered_at'),
   answerText: text('answer_text'),
 });
+
+export const processedCallbacks = sqliteTable('processed_callbacks', {
+  id: text('id').primaryKey(),
+  dedupeKey: text('dedupe_key').notNull().unique(),
+  callSessionId: text('call_session_id')
+    .notNull()
+    .references(() => callSessions.id, { onDelete: 'cascade' }),
+  claimId: text('claim_id'),
+  createdAt: integer('created_at').notNull(),
+});

package/src/messaging/style-analyzer.ts

@@ -8,6 +8,7 @@
 
 import type { Message as ProviderMessage } from './provider-types.js';
 import type { Message, ToolDefinition } from '../providers/types.js';
+import { truncate } from '../util/truncate.js';
 import { getProvider } from '../providers/registry.js';
 import { getConfig } from '../config/loader.js';
 
@@ -97,7 +98,7 @@ function buildCorpus(messages: ProviderMessage[]): string[] {
   for (const msg of messages) {
     if (!msg.text.trim()) continue;
     const to = msg.conversationId;
-    const truncatedBody = msg.text.slice(0, 500);
+    const truncatedBody = truncate(msg.text, 500, '');
     entries.push(`To: ${to}\n\n${truncatedBody}`);
   }
   return entries;
@@ -143,7 +144,7 @@ export async function extractStylePatterns(
 
   const stylePatterns: StylePattern[] = (result.style_patterns ?? []).map((p) => ({
     aspect: p.aspect,
-    summary: p.summary.slice(0, 500),
+    summary: truncate(p.summary, 500, ''),
     importance: p.importance,
     examples: p.examples,
   }));

package/src/messaging/thread-summarizer.ts

@@ -1,11 +1,13 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { getConfig } from '../config/loader.js';
 import { getLogger } from '../util/logger.js';
+import { truncate } from '../util/truncate.js';
 import type { ThreadMessage, ThreadSummary } from './types.js';
 
 const log = getLogger('thread-summarizer');
 
 const SUMMARIZATION_MODEL = 'claude-haiku-4-5-20251001';
+const SUMMARIZATION_TIMEOUT_MS = 20_000;
 const DEFAULT_MAX_TOKENS = 4000;
 const CHARS_PER_TOKEN = 4;
 
@@ -172,14 +174,10 @@ function extractParticipants(messages: ThreadMessage[]): Array<{ name: string }>
 
 function summarizeSingleMessage(message: ThreadMessage): ThreadSummary {
   return {
-    summary: message.body.length > 200
-      ? message.body.slice(0, 197) + '...'
-      : message.body,
+    summary: truncate(message.body, 200),
     participants: [{ name: message.sender }],
     openQuestions: [],
-    lastAction: message.body.length > 200
-      ? message.body.slice(0, 197) + '...'
-      : message.body,
+    lastAction: truncate(message.body, 200),
     sentiment: 'neutral',
     messageCount: 1,
   };
@@ -225,7 +223,7 @@ async function summarizeWithLLM(
         timer = setTimeout(() => {
           abortController.abort();
           reject(new Error('Thread summarization LLM timeout'));
-        }, 20000);
+        }, SUMMARIZATION_TIMEOUT_MS);
       }),
     ]);
 
@@ -249,7 +247,7 @@ async function summarizeWithLLM(
       : 'neutral';
 
     return {
-      summary: String(input.summary ?? '').slice(0, 2000),
+      summary: truncate(String(input.summary ?? ''), 2000, ''),
       participants: Array.isArray(input.participants)
         ? input.participants.map((p) => ({
             name: String(p.name),
@@ -259,7 +257,7 @@ async function summarizeWithLLM(
       openQuestions: Array.isArray(input.openQuestions)
         ? input.openQuestions.map((q) => String(q))
         : [],
-      lastAction: String(input.lastAction ?? '').slice(0, 500),
+      lastAction: truncate(String(input.lastAction ?? ''), 500, ''),
       sentiment,
       messageCount: messages.length,
     };
@@ -280,9 +278,7 @@ function buildFallbackSummary(messages: ThreadMessage[]): ThreadSummary {
     summary: `Thread with ${messages.length} message(s) from ${extractParticipants(messages).map((p) => p.name).join(', ')}.`,
     participants: extractParticipants(messages),
     openQuestions: [],
-    lastAction: lastMsg.body.length > 200
-      ? lastMsg.body.slice(0, 197) + '...'
-      : lastMsg.body,
+    lastAction: truncate(lastMsg.body, 200),
     sentiment: 'neutral',
     messageCount: messages.length,
   };

package/src/messaging/triage-engine.ts

@@ -8,6 +8,7 @@
  */
 
 import Anthropic from '@anthropic-ai/sdk';
+import { truncate } from '../util/truncate.js';
 import { v4 as uuid } from 'uuid';
 import { and, eq, isNull, desc } from 'drizzle-orm';
 import { getConfig } from '../config/loader.js';
@@ -24,6 +25,7 @@ import { DEFAULT_TRIAGE_CATEGORIES } from './types.js';
 const log = getLogger('triage-engine');
 
 const TRIAGE_MODEL = 'claude-haiku-4-5-20251001';
+const TRIAGE_CLASSIFICATION_TIMEOUT_MS = 15_000;
 
 // ── Playbook fetching ────────────────────────────────────────────────
 
@@ -244,7 +246,7 @@ async function classifyWithLLM(
       timer = setTimeout(() => {
         abortController.abort();
         reject(new Error('Triage classification LLM timeout'));
-      }, 15000);
+      }, TRIAGE_CLASSIFICATION_TIMEOUT_MS);
     }),
   ]);
 
@@ -282,7 +284,7 @@ async function classifyWithLLM(
     category: typeof input.category === 'string' ? input.category : 'needs_response',
     confidence,
     suggestedAction: typeof input.suggestedAction === 'string'
-      ? input.suggestedAction.slice(0, 500)
+      ? truncate(input.suggestedAction, 500, '')
       : 'Review manually',
     matchedPlaybooks,
   };

package/src/providers/openrouter/client.ts

@@ -0,0 +1,20 @@
+import { OpenAIProvider } from '../openai/client.js';
+
+export interface OpenRouterProviderOptions {
+  apiKey?: string;
+  baseURL?: string;
+  streamTimeoutMs?: number;
+}
+
+const DEFAULT_OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
+
+export class OpenRouterProvider extends OpenAIProvider {
+  constructor(apiKey: string, model: string, options: OpenRouterProviderOptions = {}) {
+    super(apiKey, model, {
+      baseURL: options.baseURL?.trim() || DEFAULT_OPENROUTER_BASE_URL,
+      providerName: 'openrouter',
+      providerLabel: 'OpenRouter',
+      streamTimeoutMs: options.streamTimeoutMs,
+    });
+  }
+}

package/src/providers/registry.ts

@@ -4,6 +4,7 @@ import { OpenAIProvider } from "./openai/client.js";
 import { GeminiProvider } from "./gemini/client.js";
 import { OllamaProvider } from "./ollama/client.js";
 import { FireworksProvider } from "./fireworks/client.js";
+import { OpenRouterProvider } from "./openrouter/client.js";
 import { RetryProvider } from "./retry.js";
 import { FailoverProvider } from "./failover.js";
 import { wrapWithLogfire } from "../logfire.js";
@@ -15,6 +16,7 @@ const DEFAULT_MODELS: Record<string, string> = {
   gemini: 'gemini-3-flash',
   ollama: 'llama3.2',
   fireworks: 'accounts/fireworks/models/kimi-k2p5',
+  openrouter: 'x-ai/grok-4',
 };
 
 const providers = new Map<string, Provider>();
@@ -135,4 +137,10 @@ export function initializeProviders(config: ProvidersConfig): void {
       wrapWithLogfire(new FireworksProvider(config.apiKeys.fireworks, model, { streamTimeoutMs })),
     ));
   }
+  if (config.apiKeys.openrouter) {
+    const model = resolveModel(config, 'openrouter');
+    registerProvider('openrouter', new RetryProvider(
+      wrapWithLogfire(new OpenRouterProvider(config.apiKeys.openrouter, model, { streamTimeoutMs })),
+    ));
+  }
 }