veryfront 0.1.63 → 0.1.64

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.63",
+    "version": "0.1.64",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/channels/invoke.d.ts

@@ -5,7 +5,7 @@ export declare const ChannelInvokeRequestSchema: z.ZodObject<{
     dispatchId: z.ZodString;
     conversationId: z.ZodString;
     projectId: z.ZodString;
-    agentConfigId: z.ZodString;
+    assistantId: z.ZodString;
     platform: z.ZodLiteral<"slack">;
     inboundMessage: z.ZodObject<{
         text: z.ZodString;
@@ -97,7 +97,7 @@ export declare const ChannelInvokeRequestSchema: z.ZodObject<{
     projectId: string;
     dispatchId: string;
     conversationId: string;
-    agentConfigId: string;
+    assistantId: string;
     inboundMessage: {
         text: string;
         userId: string;
@@ -128,7 +128,7 @@ export declare const ChannelInvokeRequestSchema: z.ZodObject<{
     projectId: string;
     dispatchId: string;
     conversationId: string;
-    agentConfigId: string;
+    assistantId: string;
     inboundMessage: {
         text: string;
         userId: string;
@@ -155,6 +155,67 @@ export declare const ChannelInvokeRequestSchema: z.ZodObject<{
         maxResponseTokens?: number | undefined;
     } | undefined;
 }>;
+export declare const ChannelAssistantsRequestSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    projectId: z.ZodString;
+    platform: z.ZodLiteral<"slack">;
+}, "strip", z.ZodTypeAny, {
+    requestId: string;
+    platform: "slack";
+    projectId: string;
+}, {
+    requestId: string;
+    platform: "slack";
+    projectId: string;
+}>;
+export declare const ChannelAssistantSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    description?: string | null | undefined;
+    model?: string | null | undefined;
+}, {
+    name: string;
+    id: string;
+    description?: string | null | undefined;
+    model?: string | null | undefined;
+}>;
+export declare const ChannelAssistantsResponseSchema: z.ZodObject<{
+    assistants: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        model: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        id: string;
+        description?: string | null | undefined;
+        model?: string | null | undefined;
+    }, {
+        name: string;
+        id: string;
+        description?: string | null | undefined;
+        model?: string | null | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    assistants: {
+        name: string;
+        id: string;
+        description?: string | null | undefined;
+        model?: string | null | undefined;
+    }[];
+}, {
+    assistants: {
+        name: string;
+        id: string;
+        description?: string | null | undefined;
+        model?: string | null | undefined;
+    }[];
+}>;
 export declare const ChannelResponsePartSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<"text">;
     text: z.ZodString;
@@ -405,6 +466,8 @@ declare const dispatchClaimsSchema: z.ZodObject<{
 }>;
 export type ChannelInvokeRequest = z.infer<typeof ChannelInvokeRequestSchema>;
 export type ChannelInvokeResponse = z.infer<typeof ChannelInvokeResponseSchema>;
+export type ChannelAssistantsRequest = z.infer<typeof ChannelAssistantsRequestSchema>;
+export type ChannelAssistantsResponse = z.infer<typeof ChannelAssistantsResponseSchema>;
 type ChannelResponsePart = z.infer<typeof ChannelResponsePartSchema>;
 type DispatchClaims = z.infer<typeof dispatchClaimsSchema>;
 export interface ChannelInvokeDeps {
@@ -413,6 +476,7 @@ export interface ChannelInvokeDeps {
     getAllAgentIds: () => string[];
 }
 export declare const defaultChannelInvokeDeps: ChannelInvokeDeps;
+export declare function listChannelAssistants(ctx: HandlerContext, deps: ChannelInvokeDeps): Promise<ChannelAssistantsResponse>;
 export declare function verifyDispatchJws(jws: string, body: string, options: {
     audience: string;
     publicKeyPem: string;
@@ -420,7 +484,7 @@ export declare function verifyDispatchJws(jws: string, body: string, options: {
     expectedProjectId?: string;
 }): Promise<DispatchClaims>;
 export declare function normalizeConversationHistoryForRuntime(messages: ChannelInvokeRequest["conversationHistory"]): Message[];
-export declare function resolveChannelInvokeAgent(agentConfigId: string, deps: Pick<ChannelInvokeDeps, "getAgent" | "getAllAgentIds">): Agent | undefined;
+export declare function resolveChannelInvokeAgent(assistantId: string, deps: Pick<ChannelInvokeDeps, "getAgent" | "getAllAgentIds">): Agent | undefined;
 export declare function buildChannelResponseParts(response: AgentResponse): ChannelResponsePart[];
 export declare function executeChannelInvoke(payload: ChannelInvokeRequest, ctx: HandlerContext, deps: ChannelInvokeDeps): Promise<ChannelInvokeResponse>;
 export {};

package/esm/src/channels/invoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/src/channels/invoke.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBrC,CAAC;AAiCH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMpC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYtC,CAAC;AAQH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASxB,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,KAAK,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACrE,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;CAChC;AAED,eAAO,MAAM,wBAAwB,EAAE,iBAItC,CAAC;AAyCF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAqCD,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,GACpD,OAAO,EAAE,CAUX;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,gBAAgB,CAAC,GAC3D,KAAK,GAAG,SAAS,CA2BnB;AAsDD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,GAAG,mBAAmB,EAAE,CAiDxF;AAgBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}
+{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/src/channels/invoke.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiDxB,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAiC,CAAC;AAEzE,eAAO,MAAM,8BAA8B;;;;;;;;;;;;EAIzC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;EAKjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE1C,CAAC;AAiCH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMpC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYtC,CAAC;AAQH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASxB,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACrE,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;CAChC;AAED,eAAO,MAAM,wBAAwB,EAAE,iBAItC,CAAC;AAeF,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,yBAAyB,CAAC,CAUpC;AAyCD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAqCD,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,GACpD,OAAO,EAAE,CAUX;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,gBAAgB,CAAC,GAC3D,KAAK,GAAG,SAAS,CAEnB;AAsDD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,GAAG,mBAAmB,EAAE,CAiDxF;AAgBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}

package/esm/src/channels/invoke.js

@@ -24,11 +24,11 @@ const channelInvokeHistoryMessageSchema = z.object({
     metadata: z.record(z.unknown()).optional(),
     createdAt: z.string().optional(),
 });
-export const ChannelInvokeRequestSchema = z.object({
+const channelInvokeRequestWireSchema = z.object({
     dispatchId: z.string().min(1),
     conversationId: z.string().min(1),
     projectId: z.string().min(1),
-    agentConfigId: z.string().min(1),
+    assistantId: z.string().min(1),
     platform: z.literal("slack"),
     inboundMessage: z.object({
         text: z.string(),
@@ -42,6 +42,21 @@ export const ChannelInvokeRequestSchema = z.object({
         maxResponseTokens: z.number().int().positive().max(16384).optional(),
     }).optional(),
 });
+export const ChannelInvokeRequestSchema = channelInvokeRequestWireSchema;
+export const ChannelAssistantsRequestSchema = z.object({
+    requestId: z.string().min(1),
+    projectId: z.string().min(1),
+    platform: z.literal("slack"),
+});
+export const ChannelAssistantSchema = z.object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().nullable().optional(),
+    model: z.string().nullable().optional(),
+});
+export const ChannelAssistantsResponseSchema = z.object({
+    assistants: z.array(ChannelAssistantSchema),
+});
 const channelTextPartSchema = z.object({
     type: z.literal("text"),
     text: z.string(),
@@ -108,6 +123,26 @@ export const defaultChannelInvokeDeps = {
     getAgent: getRegisteredAgent,
     getAllAgentIds: getRegisteredAgentIds,
 };
+function getAssistantMetadata(agent) {
+    const rawConfig = agent.config;
+    return ChannelAssistantSchema.parse({
+        id: agent.id,
+        name: typeof rawConfig.name === "string" && rawConfig.name.trim().length > 0
+            ? rawConfig.name
+            : agent.id,
+        description: typeof rawConfig.description === "string" ? rawConfig.description : null,
+        model: agent.config.model ?? null,
+    });
+}
+export async function listChannelAssistants(ctx, deps) {
+    await deps.ensureProjectDiscovery(ctx);
+    const assistants = deps.getAllAgentIds()
+        .map((id) => deps.getAgent(id))
+        .filter((agent) => Boolean(agent))
+        .map(getAssistantMetadata)
+        .sort((left, right) => left.name.localeCompare(right.name));
+    return ChannelAssistantsResponseSchema.parse({ assistants });
+}
 function base64urlDecodeToBytes(input) {
     const normalized = input
         .replaceAll("-", "+")
@@ -217,27 +252,8 @@ export function normalizeConversationHistoryForRuntime(messages) {
         ...(message.metadata ? { metadata: message.metadata } : {}),
     }));
 }
-export function resolveChannelInvokeAgent(agentConfigId, deps) {
-    const exactAgent = deps.getAgent(agentConfigId);
-    if (exactAgent) {
-        return exactAgent;
-    }
-    const agentIds = deps.getAllAgentIds();
-    if (agentIds.length !== 1) {
-        return undefined;
-    }
-    const onlyAgentId = agentIds[0];
-    if (!onlyAgentId) {
-        return undefined;
-    }
-    const onlyAgent = deps.getAgent(onlyAgentId);
-    if (onlyAgent) {
-        logger.warn("Channel invoke fell back to the only discovered runtime agent because agentConfigId did not match a registry id", {
-            requestedAgentConfigId: agentConfigId,
-            resolvedAgentId: onlyAgentId,
-        });
-    }
-    return onlyAgent;
+export function resolveChannelInvokeAgent(assistantId, deps) {
+    return deps.getAgent(assistantId);
 }
 function normalizeToolCallState(status) {
     switch (status) {
@@ -338,10 +354,10 @@ function classifyRuntimeError(error) {
 }
 export async function executeChannelInvoke(payload, ctx, deps) {
     await deps.ensureProjectDiscovery(ctx);
-    const agent = resolveChannelInvokeAgent(payload.agentConfigId, deps);
+    const agent = resolveChannelInvokeAgent(payload.assistantId, deps);
     if (!agent) {
         logger.error("Channel invoke could not resolve a runtime agent for the request", {
-            requestedAgentConfigId: payload.agentConfigId,
+            requestedAssistantId: payload.assistantId,
             discoveredAgentIds: deps.getAllAgentIds(),
             projectSlug: ctx.projectSlug,
             projectId: ctx.projectId,
@@ -364,7 +380,7 @@ export async function executeChannelInvoke(payload, ctx, deps) {
                 dispatchId: payload.dispatchId,
                 conversationId: payload.conversationId,
                 projectId: payload.projectId,
-                agentConfigId: payload.agentConfigId,
+                assistantId: payload.assistantId,
                 channel: payload.inboundMessage,
             },
             ...(payload.generation?.maxResponseTokens

package/esm/src/integrations/endpoint-executor.d.ts

@@ -1,4 +1,5 @@
 import type { IntegrationEndpoint } from "./types.js";
+export declare function validateEndpointUrl(url: string): void;
 interface ExecutionContext {
     integration: string;
     toolId: string;

package/esm/src/integrations/endpoint-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-executor.d.ts","sourceRoot":"","sources":["../../../src/src/integrations/endpoint-executor.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGtD,UAAU,gBAAgB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C"}
+{"version":3,"file":"endpoint-executor.d.ts","sourceRoot":"","sources":["../../../src/src/integrations/endpoint-executor.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAetD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAiCrD;AAED,UAAU,gBAAgB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C"}

package/esm/src/integrations/endpoint-executor.js

@@ -8,6 +8,48 @@
 import * as dntShim from "../../_dnt.shims.js";
 import { logger } from "../utils/index.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
+const PRIVATE_IP_RANGES = [
+    /^127\./, // 127.0.0.0/8
+    /^10\./, // 10.0.0.0/8
+    /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
+    /^192\.168\./, // 192.168.0.0/16
+    /^169\.254\./, // 169.254.0.0/16
+    /^0\./, // 0.0.0.0/8
+    /^::1$/, // IPv6 loopback
+    /^f[cd][0-9a-f]{2}:/i, // IPv6 unique local (fc00::/7)
+    /^fe80:/i, // IPv6 link-local (fe80::/10)
+];
+export function validateEndpointUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw INVALID_ARGUMENT.create({ detail: `Invalid endpoint URL: ${url}` });
+    }
+    if (parsed.protocol !== "https:") {
+        throw INVALID_ARGUMENT.create({
+            detail: `Endpoint URL must use HTTPS: ${parsed.protocol}`,
+        });
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === "localhost") {
+        throw INVALID_ARGUMENT.create({
+            detail: "Endpoint URL must not target localhost",
+        });
+    }
+    // Strip IPv6 brackets for regex matching
+    const bare = hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+    for (const range of PRIVATE_IP_RANGES) {
+        if (range.test(bare)) {
+            throw INVALID_ARGUMENT.create({
+                detail: "Endpoint URL must not target private/internal networks",
+            });
+        }
+    }
+}
 export async function executeEndpoint(endpoint, args, accessToken, ctx) {
     if (endpoint.type === "graphql") {
         return executeGraphQL(endpoint, args, accessToken, ctx);
@@ -40,6 +82,7 @@ async function executeGraphQL(endpoint, args, accessToken, ctx) {
             headers[key] = args[key] !== undefined ? String(args[key]) : String(def.default ?? "");
         }
     }
+    validateEndpointUrl(endpoint.url);
     logger.debug("Executing GraphQL endpoint", {
         integration: ctx.integration,
         tool: ctx.toolId,
@@ -112,6 +155,7 @@ async function executeRest(endpoint, args, accessToken, ctx) {
         body = JSON.stringify(bodyObj);
         headers["Content-Type"] = endpoint.contentType ?? "application/json";
     }
+    validateEndpointUrl(urlObj.toString());
     logger.debug("Executing REST endpoint", {
         integration: ctx.integration,
         tool: ctx.toolId,

package/esm/src/server/handlers/request/channel-assistants.handler.d.ts

@@ -0,0 +1,11 @@
+import * as dntShim from "../../../../_dnt.shims.js";
+import { BaseHandler } from "../response/base.js";
+import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
+import { type ChannelInvokeDeps } from "../../../channels/invoke.js";
+export declare class ChannelAssistantsHandler extends BaseHandler {
+    private readonly deps;
+    metadata: HandlerMetadata;
+    constructor(deps?: ChannelInvokeDeps);
+    handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult>;
+}
+//# sourceMappingURL=channel-assistants.handler.d.ts.map

package/esm/src/server/handlers/request/channel-assistants.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-assistants.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/channel-assistants.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAEL,KAAK,iBAAiB,EAIvB,MAAM,6BAA6B,CAAC;AASrC,qBAAa,wBAAyB,SAAQ,WAAW;IAO3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,QAAQ,EAAE,eAAe,CAIvB;gBAE2B,IAAI,GAAE,iBAA4C;IAIzE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAgEhF"}

package/esm/src/server/handlers/request/channel-assistants.handler.js

@@ -0,0 +1,71 @@
+import { BaseHandler } from "../response/base.js";
+import { ChannelAssistantsRequestSchema, defaultChannelInvokeDeps, listChannelAssistants, verifyDispatchJws, } from "../../../channels/invoke.js";
+import { HTTP_INTERNAL_SERVER_ERROR, PRIORITY_MEDIUM_API, } from "../../../utils/constants/index.js";
+const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
+const MAX_DISPATCH_SIGNATURE_AGE_SECONDS = 60;
+export class ChannelAssistantsHandler extends BaseHandler {
+    deps;
+    metadata = {
+        name: "ChannelAssistantsHandler",
+        priority: PRIORITY_MEDIUM_API,
+        patterns: [{ pattern: "/channels/assistants", exact: true, method: "POST" }],
+    };
+    constructor(deps = defaultChannelInvokeDeps) {
+        super();
+        this.deps = deps;
+    }
+    async handle(req, ctx) {
+        if (!this.shouldHandle(req, ctx)) {
+            return this.continue();
+        }
+        return this.withProxyContext(ctx, async () => {
+            const builder = this.createResponseBuilder(ctx)
+                .withCORS(req, ctx.securityConfig?.cors)
+                .withSecurity(ctx.securityConfig ?? undefined, req);
+            const publicKeyPem = ctx.adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+            if (!publicKeyPem) {
+                this.logWarn("Missing CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY for channel assistants endpoint");
+                return this.respond(builder.json({ error: "Channel dispatch verification is not configured" }, HTTP_INTERNAL_SERVER_ERROR));
+            }
+            const projectSlug = ctx.projectSlug;
+            if (!projectSlug) {
+                this.logWarn("Channel assistants request arrived without resolved project slug");
+                return this.respond(builder.json({ error: "Project context is unavailable" }, 400));
+            }
+            const dispatchJws = req.headers.get(DISPATCH_JWS_HEADER);
+            if (!dispatchJws) {
+                return this.respond(builder.json({ error: "Missing dispatch signature" }, 401));
+            }
+            const rawBody = await req.text();
+            try {
+                await verifyDispatchJws(dispatchJws, rawBody, {
+                    audience: projectSlug,
+                    expectedProjectId: ctx.projectId,
+                    publicKeyPem,
+                    maxAgeSeconds: MAX_DISPATCH_SIGNATURE_AGE_SECONDS,
+                });
+            }
+            catch (error) {
+                this.logWarn("Channel assistants signature verification failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                    projectSlug,
+                    projectId: ctx.projectId,
+                });
+                return this.respond(builder.json({ error: "Invalid dispatch signature" }, 401));
+            }
+            try {
+                ChannelAssistantsRequestSchema.parse(JSON.parse(rawBody));
+            }
+            catch (error) {
+                this.logWarn("Channel assistants request validation failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                    projectSlug,
+                    projectId: ctx.projectId,
+                });
+                return this.respond(builder.json({ error: "Invalid channel assistants request" }, 400));
+            }
+            const response = await listChannelAssistants(ctx, this.deps);
+            return this.respond(builder.json(response, 200));
+        });
+    }
+}

package/esm/src/server/runtime-handler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAQlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAyF7D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAwanF;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAQlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA0F7D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAyanF;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}

package/esm/src/server/runtime-handler/index.js

@@ -42,6 +42,7 @@ import { HMRHandler } from "../handlers/preview/hmr.handler.js";
 import { MarkdownPreviewHandler } from "../handlers/preview/markdown-preview.handler.js";
 import { OpenAPIHandler } from "../handlers/request/openapi.handler.js";
 import { OpenAPIDocsHandler } from "../handlers/request/openapi-docs.handler.js";
+import { ChannelAssistantsHandler } from "../handlers/request/channel-assistants.handler.js";
 import { ChannelInvokeHandler } from "../handlers/request/channel-invoke.handler.js";
 import { DevDashboardHandler } from "../handlers/dev/dashboard/index.js";
 import { ProjectsHandler } from "../handlers/dev/projects/index.js";
@@ -124,6 +125,7 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
         new DebugContextHandler(),
         new OpenAPIHandler(),
         new OpenAPIDocsHandler(),
+        new ChannelAssistantsHandler(),
         new ChannelInvokeHandler(),
         new DevDashboardHandler(),
         new ProjectsHandler(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/channels/invoke.ts

@@ -34,11 +34,11 @@ const channelInvokeHistoryMessageSchema = z.object({
   createdAt: z.string().optional(),
 });
 
-export const ChannelInvokeRequestSchema = z.object({
+const channelInvokeRequestWireSchema = z.object({
   dispatchId: z.string().min(1),
   conversationId: z.string().min(1),
   projectId: z.string().min(1),
-  agentConfigId: z.string().min(1),
+  assistantId: z.string().min(1),
   platform: z.literal("slack"),
   inboundMessage: z.object({
     text: z.string(),
@@ -53,6 +53,25 @@ export const ChannelInvokeRequestSchema = z.object({
   }).optional(),
 });
 
+export const ChannelInvokeRequestSchema = channelInvokeRequestWireSchema;
+
+export const ChannelAssistantsRequestSchema = z.object({
+  requestId: z.string().min(1),
+  projectId: z.string().min(1),
+  platform: z.literal("slack"),
+});
+
+export const ChannelAssistantSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().nullable().optional(),
+  model: z.string().nullable().optional(),
+});
+
+export const ChannelAssistantsResponseSchema = z.object({
+  assistants: z.array(ChannelAssistantSchema),
+});
+
 const channelTextPartSchema = z.object({
   type: z.literal("text"),
   text: z.string(),
@@ -125,9 +144,12 @@ const dispatchClaimsSchema = z.object({
 
 export type ChannelInvokeRequest = z.infer<typeof ChannelInvokeRequestSchema>;
 export type ChannelInvokeResponse = z.infer<typeof ChannelInvokeResponseSchema>;
+export type ChannelAssistantsRequest = z.infer<typeof ChannelAssistantsRequestSchema>;
+export type ChannelAssistantsResponse = z.infer<typeof ChannelAssistantsResponseSchema>;
 
 type ChannelResponsePart = z.infer<typeof ChannelResponsePartSchema>;
 type DispatchClaims = z.infer<typeof dispatchClaimsSchema>;
+type ChannelAssistant = z.infer<typeof ChannelAssistantSchema>;
 
 export interface ChannelInvokeDeps {
   ensureProjectDiscovery: (ctx: HandlerContext) => Promise<void>;
@@ -141,6 +163,34 @@ export const defaultChannelInvokeDeps: ChannelInvokeDeps = {
   getAllAgentIds: getRegisteredAgentIds,
 };
 
+function getAssistantMetadata(agent: Agent): ChannelAssistant {
+  const rawConfig = agent.config as unknown as Record<string, unknown>;
+
+  return ChannelAssistantSchema.parse({
+    id: agent.id,
+    name: typeof rawConfig.name === "string" && rawConfig.name.trim().length > 0
+      ? rawConfig.name
+      : agent.id,
+    description: typeof rawConfig.description === "string" ? rawConfig.description : null,
+    model: agent.config.model ?? null,
+  });
+}
+
+export async function listChannelAssistants(
+  ctx: HandlerContext,
+  deps: ChannelInvokeDeps,
+): Promise<ChannelAssistantsResponse> {
+  await deps.ensureProjectDiscovery(ctx);
+
+  const assistants = deps.getAllAgentIds()
+    .map((id) => deps.getAgent(id))
+    .filter((agent): agent is Agent => Boolean(agent))
+    .map(getAssistantMetadata)
+    .sort((left, right) => left.name.localeCompare(right.name));
+
+  return ChannelAssistantsResponseSchema.parse({ assistants });
+}
+
 function base64urlDecodeToBytes(input: string): ArrayBuffer {
   const normalized = input
     .replaceAll("-", "+")
@@ -300,35 +350,10 @@ export function normalizeConversationHistoryForRuntime(
 }
 
 export function resolveChannelInvokeAgent(
-  agentConfigId: string,
+  assistantId: string,
   deps: Pick<ChannelInvokeDeps, "getAgent" | "getAllAgentIds">,
 ): Agent | undefined {
-  const exactAgent = deps.getAgent(agentConfigId);
-  if (exactAgent) {
-    return exactAgent;
-  }
-
-  const agentIds = deps.getAllAgentIds();
-  if (agentIds.length !== 1) {
-    return undefined;
-  }
-
-  const onlyAgentId = agentIds[0];
-  if (!onlyAgentId) {
-    return undefined;
-  }
-  const onlyAgent = deps.getAgent(onlyAgentId);
-  if (onlyAgent) {
-    logger.warn(
-      "Channel invoke fell back to the only discovered runtime agent because agentConfigId did not match a registry id",
-      {
-        requestedAgentConfigId: agentConfigId,
-        resolvedAgentId: onlyAgentId,
-      },
-    );
-  }
-
-  return onlyAgent;
+  return deps.getAgent(assistantId);
 }
 
 function normalizeToolCallState(status: string): "pending" | "completed" | "error" {
@@ -455,10 +480,10 @@ export async function executeChannelInvoke(
 ): Promise<ChannelInvokeResponse> {
   await deps.ensureProjectDiscovery(ctx);
 
-  const agent = resolveChannelInvokeAgent(payload.agentConfigId, deps);
+  const agent = resolveChannelInvokeAgent(payload.assistantId, deps);
   if (!agent) {
     logger.error("Channel invoke could not resolve a runtime agent for the request", {
-      requestedAgentConfigId: payload.agentConfigId,
+      requestedAssistantId: payload.assistantId,
       discoveredAgentIds: deps.getAllAgentIds(),
       projectSlug: ctx.projectSlug,
       projectId: ctx.projectId,
@@ -483,7 +508,7 @@ export async function executeChannelInvoke(
         dispatchId: payload.dispatchId,
         conversationId: payload.conversationId,
         projectId: payload.projectId,
-        agentConfigId: payload.agentConfigId,
+        assistantId: payload.assistantId,
         channel: payload.inboundMessage,
       },
       ...(payload.generation?.maxResponseTokens

package/src/src/integrations/endpoint-executor.ts

@@ -12,6 +12,53 @@ import { logger } from "../utils/index.js";
 import type { IntegrationEndpoint } from "./types.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
 
+const PRIVATE_IP_RANGES = [
+  /^127\./, // 127.0.0.0/8
+  /^10\./, // 10.0.0.0/8
+  /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
+  /^192\.168\./, // 192.168.0.0/16
+  /^169\.254\./, // 169.254.0.0/16
+  /^0\./, // 0.0.0.0/8
+  /^::1$/, // IPv6 loopback
+  /^f[cd][0-9a-f]{2}:/i, // IPv6 unique local (fc00::/7)
+  /^fe80:/i, // IPv6 link-local (fe80::/10)
+];
+
+export function validateEndpointUrl(url: string): void {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw INVALID_ARGUMENT.create({ detail: `Invalid endpoint URL: ${url}` });
+  }
+
+  if (parsed.protocol !== "https:") {
+    throw INVALID_ARGUMENT.create({
+      detail: `Endpoint URL must use HTTPS: ${parsed.protocol}`,
+    });
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+  if (hostname === "localhost") {
+    throw INVALID_ARGUMENT.create({
+      detail: "Endpoint URL must not target localhost",
+    });
+  }
+
+  // Strip IPv6 brackets for regex matching
+  const bare = hostname.startsWith("[") && hostname.endsWith("]")
+    ? hostname.slice(1, -1)
+    : hostname;
+
+  for (const range of PRIVATE_IP_RANGES) {
+    if (range.test(bare)) {
+      throw INVALID_ARGUMENT.create({
+        detail: "Endpoint URL must not target private/internal networks",
+      });
+    }
+  }
+}
+
 interface ExecutionContext {
   integration: string;
   toolId: string;
@@ -63,6 +110,8 @@ async function executeGraphQL(
     }
   }
 
+  validateEndpointUrl(endpoint.url);
+
   logger.debug("Executing GraphQL endpoint", {
     integration: ctx.integration,
     tool: ctx.toolId,
@@ -149,6 +198,8 @@ async function executeRest(
     headers["Content-Type"] = endpoint.contentType ?? "application/json";
   }
 
+  validateEndpointUrl(urlObj.toString());
+
   logger.debug("Executing REST endpoint", {
     integration: ctx.integration,
     tool: ctx.toolId,

package/src/src/server/handlers/request/channel-assistants.handler.ts

@@ -0,0 +1,94 @@
+import * as dntShim from "../../../../_dnt.shims.js";
+import { BaseHandler } from "../response/base.js";
+import type { HandlerContext, HandlerMetadata, HandlerPriority, HandlerResult } from "../types.js";
+import {
+  ChannelAssistantsRequestSchema,
+  type ChannelInvokeDeps,
+  defaultChannelInvokeDeps,
+  listChannelAssistants,
+  verifyDispatchJws,
+} from "../../../channels/invoke.js";
+import {
+  HTTP_INTERNAL_SERVER_ERROR,
+  PRIORITY_MEDIUM_API,
+} from "../../../utils/constants/index.js";
+
+const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
+const MAX_DISPATCH_SIGNATURE_AGE_SECONDS = 60;
+
+export class ChannelAssistantsHandler extends BaseHandler {
+  metadata: HandlerMetadata = {
+    name: "ChannelAssistantsHandler",
+    priority: PRIORITY_MEDIUM_API as HandlerPriority,
+    patterns: [{ pattern: "/channels/assistants", exact: true, method: "POST" }],
+  };
+
+  constructor(private readonly deps: ChannelInvokeDeps = defaultChannelInvokeDeps) {
+    super();
+  }
+
+  async handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!this.shouldHandle(req, ctx)) {
+      return this.continue();
+    }
+
+    return this.withProxyContext(ctx, async () => {
+      const builder = this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req);
+
+      const publicKeyPem = ctx.adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+      if (!publicKeyPem) {
+        this.logWarn("Missing CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY for channel assistants endpoint");
+        return this.respond(
+          builder.json(
+            { error: "Channel dispatch verification is not configured" },
+            HTTP_INTERNAL_SERVER_ERROR,
+          ),
+        );
+      }
+
+      const projectSlug = ctx.projectSlug;
+      if (!projectSlug) {
+        this.logWarn("Channel assistants request arrived without resolved project slug");
+        return this.respond(builder.json({ error: "Project context is unavailable" }, 400));
+      }
+
+      const dispatchJws = req.headers.get(DISPATCH_JWS_HEADER);
+      if (!dispatchJws) {
+        return this.respond(builder.json({ error: "Missing dispatch signature" }, 401));
+      }
+
+      const rawBody = await req.text();
+      try {
+        await verifyDispatchJws(dispatchJws, rawBody, {
+          audience: projectSlug,
+          expectedProjectId: ctx.projectId,
+          publicKeyPem,
+          maxAgeSeconds: MAX_DISPATCH_SIGNATURE_AGE_SECONDS,
+        });
+      } catch (error) {
+        this.logWarn("Channel assistants signature verification failed", {
+          error: error instanceof Error ? error.message : String(error),
+          projectSlug,
+          projectId: ctx.projectId,
+        });
+        return this.respond(builder.json({ error: "Invalid dispatch signature" }, 401));
+      }
+
+      try {
+        ChannelAssistantsRequestSchema.parse(JSON.parse(rawBody));
+      } catch (error) {
+        this.logWarn("Channel assistants request validation failed", {
+          error: error instanceof Error ? error.message : String(error),
+          projectSlug,
+          projectId: ctx.projectId,
+        });
+        return this.respond(builder.json({ error: "Invalid channel assistants request" }, 400));
+      }
+
+      const response = await listChannelAssistants(ctx, this.deps);
+      return this.respond(builder.json(response, 200));
+    });
+  }
+}

package/src/src/server/runtime-handler/index.ts

@@ -53,6 +53,7 @@ import { HMRHandler } from "../handlers/preview/hmr.handler.js";
 import { MarkdownPreviewHandler } from "../handlers/preview/markdown-preview.handler.js";
 import { OpenAPIHandler } from "../handlers/request/openapi.handler.js";
 import { OpenAPIDocsHandler } from "../handlers/request/openapi-docs.handler.js";
+import { ChannelAssistantsHandler } from "../handlers/request/channel-assistants.handler.js";
 import { ChannelInvokeHandler } from "../handlers/request/channel-invoke.handler.js";
 import { DevDashboardHandler } from "../handlers/dev/dashboard/index.js";
 import { ProjectsHandler } from "../handlers/dev/projects/index.js";
@@ -205,6 +206,7 @@ export function createVeryfrontHandler(
     new DebugContextHandler(),
     new OpenAPIHandler(),
     new OpenAPIDocsHandler(),
+    new ChannelAssistantsHandler(),
     new ChannelInvokeHandler(),
     new DevDashboardHandler(),
     new ProjectsHandler(),