Assistant message

import { createServer } from "node:http";
import Cadenya from "@cadenya/cadenya";

// Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
const cadenya = new Cadenya();

createServer(async (req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/cadenya") {
    res.writeHead(404).end();
    return;
  }

  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const payload = Buffer.concat(chunks).toString("utf8");

  let event;
  try {
    // Checks the signature and timestamp, then parses the envelope.
    event = await cadenya.webhooks.unwrap(payload, req.headers);
  } catch {
    res.writeHead(401).end("bad signature");
    return;
  }

  if (event.type === "objective_event.assistant_message") {
    const { objective, objectiveEvent } = event.data;
    if (objectiveEvent.data.type === "assistantMessage") {
      const { content, toolCalls } = objectiveEvent.data.assistantMessage;
      console.log(objective.id, content ?? "(no text)", toolCalls.map((c) => c.functionName));
    }
  }

  // Answer quickly. Do slow work after the 2xx.
  res.writeHead(200).end();
}).listen(3000);

package main

import (
	"io"
	"log"
	"net/http"

	cadenya "go.cadenya.com/cadenya-go"
)

func main() {
	// Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
	client, err := cadenya.NewClient()
	if err != nil {
		log.Fatal(err)
	}

	http.HandleFunc("POST /webhooks/cadenya", func(w http.ResponseWriter, r *http.Request) {
		payload, err := io.ReadAll(r.Body)
		if err != nil {
			http.Error(w, "read failed", http.StatusBadRequest)
			return
		}

		// Checks the signature and timestamp, then parses the envelope.
		event, err := client.Webhooks().Unwrap(payload, r.Header)
		if err != nil {
			http.Error(w, "bad signature", http.StatusUnauthorized)
			return
		}

		if m := event.Data.ObjectiveEvent.Data.AssistantMessage; m != nil {
			names := make([]string, 0, len(m.AssistantMessage.ToolCalls))
			for _, c := range m.AssistantMessage.ToolCalls {
				names = append(names, c.FunctionName)
			}
			text := ""
			if m.AssistantMessage.Content != nil {
				text = *m.AssistantMessage.Content
			}
			log.Printf("%s said %q and called %v", event.Data.Objective.ID, text, names)
		}

		// Answer quickly. Do slow work after the 2xx.
		w.WriteHeader(http.StatusOK)
	})

	log.Fatal(http.ListenAndServe(":3000", nil))
}

# gem install sinatra cadenya
require "sinatra"
require "cadenya"

# Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
client = Cadenya::Client.new

post "/webhooks/cadenya" do
  payload = request.body.read
  headers = {
    "webhook-id" => request.env["HTTP_WEBHOOK_ID"],
    "webhook-timestamp" => request.env["HTTP_WEBHOOK_TIMESTAMP"],
    "webhook-signature" => request.env["HTTP_WEBHOOK_SIGNATURE"]
  }

  begin
    # Checks the signature and timestamp, then parses the envelope.
    event = client.unwrap_webhook(payload, headers)
  rescue Cadenya::WebhookVerificationError
    halt 401, "bad signature"
  end

  if event.type == "objective_event.assistant_message"
    data = event.data.objective_event.data
    if data.is_a?(Cadenya::Types::ObjectiveEventData_AssistantMessage)
      message = data.assistant_message
      puts "#{event.data.objective.id} said #{message.content.inspect} and called #{message.tool_calls.map(&:function_name)}"
    end
  end

  # Answer quickly. Do slow work after the 2xx.
  status 200
end

# Point SECRET at the same whsec_ key your handler uses, or verification fails.
SECRET="whsec_V2ViaG9va3NBcmVGdW5Ub0RvY3VtZW50ISEhISEhISE="
URL="http://localhost:3000/webhooks/cadenya"

ID="wh_01HXKD2E5NQM3T9AYWCFGVF6Y6"
TS="$(date +%s)"
BODY="$(cat <<'JSON'
{
  "type": "objective_event.assistant_message",
  "timestamp": "2026-08-26T14:03:11Z",
  "data": {
    "agent": {
      "id": "agent_01HXKD2E5NQM3T9AYWCFMGWT9Y",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "name": "Support Triage",
      "externalId": "",
      "labels": {},
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-01T09:00:00Z",
      "updatedAt": "2026-08-01T09:00:00Z"
    },
    "agentVariation": {
      "id": "agentvar_01HXKD2E5NQM3T9AYWCF32BSPP",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "name": "sonnet-strict-tools",
      "externalId": "",
      "labels": {},
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-01T09:00:00Z",
      "updatedAt": "2026-08-01T09:00:00Z"
    },
    "objective": {
      "id": "obj_01HXKD2E5NQM3T9AYWCFQAZGFV",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "externalId": "ticket-4821",
      "labels": {
        "source": "zendesk"
      },
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-26T14:03:11Z"
    },
    "objectiveEvent": {
      "metadata": {
        "id": "objevt_01HXKD2E5NQM3T9AYWCF8ZWBY0",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
        "externalId": "",
        "labels": {},
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "createdAt": "2026-08-26T14:03:11Z"
      },
      "contextWindowId": "objwin_01HXKD2E5NQM3T9AYWCFN7BSTR",
      "data": {
        "type": "assistantMessage",
        "assistantMessage": {
          "content": "I'll pull up the invoice first.",
          "toolCalls": [
            {
              "functionName": "get_invoice",
              "arguments": "{\"invoice_id\":\"inv_4821\"}",
              "tool": {
                "type": "tool",
                "tool": {
                  "id": "tool_01HXKD2E5NQM3T9AYWCFWVYY9K",
                  "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
                  "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
                  "name": "get_invoice",
                  "externalId": "",
                  "labels": {},
                  "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
                  "createdAt": "2026-08-01T09:00:00Z",
                  "updatedAt": "2026-08-01T09:00:00Z"
                }
              }
            }
          ]
        }
      },
      "startedAt": "2026-08-26T14:03:08Z",
      "duration": "2.4s"
    }
  }
}
JSON
)"

# Standard Webhooks: HMAC-SHA256 over "id.timestamp.body", keyed with the base64-decoded secret.
KEY_HEX="$(printf '%s' "${SECRET#whsec_}" | base64 -d | xxd -p -c 256)"
SIG="$(printf '%s.%s.%s' "$ID" "$TS" "$BODY" \
  | openssl dgst -sha256 -mac HMAC -macopt "hexkey:$KEY_HEX" -binary \
  | base64)"

curl -X POST "$URL" \
  -H "content-type: application/json" \
  -H "webhook-id: $ID" \
  -H "webhook-timestamp: $TS" \
  -H "webhook-signature: v1,$SIG" \
  --data-binary "$BODY"