@vellumai/assistant 0.4.37 → 0.4.41

package/src/daemon/handlers/config-integrations.ts

@@ -1,10 +1,15 @@
 import * as net from "node:net";
 
-import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import {
-  deleteSecureKey,
+  getNestedValue,
+  loadRawConfig,
+  saveRawConfig,
+  setNestedValue,
+} from "../../config/loader.js";
+import {
+  deleteSecureKeyAsync,
   getSecureKey,
-  setSecureKey,
+  setSecureKeyAsync,
 } from "../../security/secure-keys.js";
 import {
   deleteCredentialMetadata,
@@ -17,11 +22,11 @@ import type {
 } from "../ipc-protocol.js";
 import { defineHandlers, type HandlerContext, log } from "./shared.js";
 
-export function handleVercelApiConfig(
+export async function handleVercelApiConfig(
   msg: VercelApiConfigRequest,
   socket: net.Socket,
   ctx: HandlerContext,
-): void {
+): Promise<void> {
   try {
     if (msg.action === "get") {
       const existing = getSecureKey("credential:vercel:api_token");
@@ -40,7 +45,10 @@ export function handleVercelApiConfig(
         });
         return;
       }
-      const stored = setSecureKey("credential:vercel:api_token", msg.apiToken);
+      const stored = await setSecureKeyAsync(
+        "credential:vercel:api_token",
+        msg.apiToken,
+      );
       if (!stored) {
         ctx.send(socket, {
           type: "vercel_api_config_response",
@@ -59,7 +67,16 @@ export function handleVercelApiConfig(
         success: true,
       });
     } else {
-      deleteSecureKey("credential:vercel:api_token");
+      const r = await deleteSecureKeyAsync("credential:vercel:api_token");
+      if (r === "error") {
+        ctx.send(socket, {
+          type: "vercel_api_config_response",
+          hasToken: !!getSecureKey("credential:vercel:api_token"),
+          success: false,
+          error: "Failed to delete Vercel API token from secure storage",
+        });
+        return;
+      }
       deleteCredentialMetadata("vercel", "api_token");
       ctx.send(socket, {
         type: "vercel_api_config_response",
@@ -87,27 +104,27 @@ function hasTwitterClientId(): boolean {
   );
 }
 
-export function handleTwitterIntegrationConfig(
+export async function handleTwitterIntegrationConfig(
   msg: TwitterIntegrationConfigRequest,
   socket: net.Socket,
   ctx: HandlerContext,
-): void {
+): Promise<void> {
   try {
     if (msg.action === "get") {
       const raw = loadRawConfig();
       const mode =
-        (raw.twitterIntegrationMode as "local_byo" | "managed" | undefined) ??
-        "local_byo";
+        (getNestedValue(raw, "twitter.integrationMode") as
+          | "local_byo"
+          | "managed"
+          | undefined) ?? "local_byo";
       const strategy =
-        (raw.twitterOperationStrategy as
+        (getNestedValue(raw, "twitter.operationStrategy") as
           | "oauth"
           | "browser"
           | "auto"
           | undefined) ?? "auto";
-      const strategyConfigured = Object.prototype.hasOwnProperty.call(
-        raw,
-        "twitterOperationStrategy",
-      );
+      const strategyConfigured =
+        getNestedValue(raw, "twitter.operationStrategy") !== undefined;
       const localClientConfigured = hasTwitterClientId();
       const connected = !!getSecureKey(
         "credential:integration:twitter:access_token",
@@ -127,15 +144,13 @@ export function handleTwitterIntegrationConfig(
     } else if (msg.action === "get_strategy") {
       const raw = loadRawConfig();
       const strategy =
-        (raw.twitterOperationStrategy as
+        (getNestedValue(raw, "twitter.operationStrategy") as
           | "oauth"
           | "browser"
           | "auto"
           | undefined) ?? "auto";
-      const strategyConfigured = Object.prototype.hasOwnProperty.call(
-        raw,
-        "twitterOperationStrategy",
-      );
+      const strategyConfigured =
+        getNestedValue(raw, "twitter.operationStrategy") !== undefined;
       ctx.send(socket, {
         type: "twitter_integration_config_response",
         success: true,
@@ -162,7 +177,7 @@ export function handleTwitterIntegrationConfig(
         return;
       }
       const raw = loadRawConfig();
-      raw.twitterOperationStrategy = value;
+      setNestedValue(raw, "twitter.operationStrategy", value);
       saveRawConfig(raw);
       ctx.send(socket, {
         type: "twitter_integration_config_response",
@@ -177,7 +192,7 @@ export function handleTwitterIntegrationConfig(
       });
     } else if (msg.action === "set_mode") {
       const raw = loadRawConfig();
-      raw.twitterIntegrationMode = msg.mode ?? "local_byo";
+      setNestedValue(raw, "twitter.integrationMode", msg.mode ?? "local_byo");
       saveRawConfig(raw);
       ctx.send(socket, {
         type: "twitter_integration_config_response",
@@ -205,8 +220,8 @@ export function handleTwitterIntegrationConfig(
       const previousClientId =
         getSecureKey("credential:integration:twitter:client_id") ??
         getSecureKey("credential:integration:twitter:oauth_client_id");
-      // Write canonical key
-      const storedId = setSecureKey(
+      // Write canonical key (async — writes broker + encrypted store)
+      const storedId = await setSecureKeyAsync(
         "credential:integration:twitter:client_id",
         msg.clientId,
       );
@@ -222,30 +237,34 @@ export function handleTwitterIntegrationConfig(
         return;
       }
       // Also write legacy key for backward compatibility
-      setSecureKey(
+      await setSecureKeyAsync(
         "credential:integration:twitter:oauth_client_id",
         msg.clientId,
       );
       if (msg.clientSecret) {
         // Write canonical key
-        const storedSecret = setSecureKey(
+        const storedSecret = await setSecureKeyAsync(
           "credential:integration:twitter:client_secret",
           msg.clientSecret,
         );
         if (!storedSecret) {
           // Roll back the client ID to its previous value to avoid inconsistent OAuth state
           if (previousClientId) {
-            setSecureKey(
+            await setSecureKeyAsync(
               "credential:integration:twitter:client_id",
               previousClientId,
             );
-            setSecureKey(
+            await setSecureKeyAsync(
               "credential:integration:twitter:oauth_client_id",
               previousClientId,
             );
           } else {
-            deleteSecureKey("credential:integration:twitter:client_id");
-            deleteSecureKey("credential:integration:twitter:oauth_client_id");
+            await deleteSecureKeyAsync(
+              "credential:integration:twitter:client_id",
+            );
+            await deleteSecureKeyAsync(
+              "credential:integration:twitter:oauth_client_id",
+            );
           }
           ctx.send(socket, {
             type: "twitter_integration_config_response",
@@ -258,14 +277,18 @@ export function handleTwitterIntegrationConfig(
           return;
         }
         // Also write legacy key for backward compatibility
-        setSecureKey(
+        await setSecureKeyAsync(
           "credential:integration:twitter:oauth_client_secret",
           msg.clientSecret,
         );
       } else {
         // Clear any stale secret when updating client without a secret (e.g. switching to PKCE)
-        deleteSecureKey("credential:integration:twitter:client_secret");
-        deleteSecureKey("credential:integration:twitter:oauth_client_secret");
+        await deleteSecureKeyAsync(
+          "credential:integration:twitter:client_secret",
+        );
+        await deleteSecureKeyAsync(
+          "credential:integration:twitter:oauth_client_secret",
+        );
       }
       ctx.send(socket, {
         type: "twitter_integration_config_response",
@@ -278,35 +301,83 @@ export function handleTwitterIntegrationConfig(
       });
     } else if (msg.action === "clear_local_client") {
       // If connected, disconnect first
+      const deleteResults: Array<"deleted" | "not-found" | "error"> = [];
       if (getSecureKey("credential:integration:twitter:access_token")) {
-        deleteSecureKey("credential:integration:twitter:access_token");
-        deleteSecureKey("credential:integration:twitter:refresh_token");
-        deleteCredentialMetadata("integration:twitter", "access_token");
+        deleteResults.push(
+          await deleteSecureKeyAsync(
+            "credential:integration:twitter:access_token",
+          ),
+        );
+        deleteResults.push(
+          await deleteSecureKeyAsync(
+            "credential:integration:twitter:refresh_token",
+          ),
+        );
       }
       // Remove both canonical and legacy client credential keys
-      deleteSecureKey("credential:integration:twitter:client_id");
-      deleteSecureKey("credential:integration:twitter:client_secret");
-      deleteSecureKey("credential:integration:twitter:oauth_client_id");
-      deleteSecureKey("credential:integration:twitter:oauth_client_secret");
+      deleteResults.push(
+        await deleteSecureKeyAsync("credential:integration:twitter:client_id"),
+      );
+      deleteResults.push(
+        await deleteSecureKeyAsync(
+          "credential:integration:twitter:client_secret",
+        ),
+      );
+      deleteResults.push(
+        await deleteSecureKeyAsync(
+          "credential:integration:twitter:oauth_client_id",
+        ),
+      );
+      deleteResults.push(
+        await deleteSecureKeyAsync(
+          "credential:integration:twitter:oauth_client_secret",
+        ),
+      );
+      const hasDeleteError = deleteResults.some((r) => r === "error");
+      if (!hasDeleteError) {
+        deleteCredentialMetadata("integration:twitter", "access_token");
+      }
       ctx.send(socket, {
         type: "twitter_integration_config_response",
-        success: true,
+        success: !hasDeleteError,
         managedAvailable: false,
-        localClientConfigured: false,
-        connected: false,
+        localClientConfigured: hasDeleteError ? hasTwitterClientId() : false,
+        connected: hasDeleteError
+          ? !!getSecureKey("credential:integration:twitter:access_token")
+          : false,
+        ...(hasDeleteError
+          ? {
+              error:
+                "Failed to delete some Twitter credentials from secure storage",
+            }
+          : {}),
       });
     } else if (msg.action === "disconnect") {
-      deleteSecureKey("credential:integration:twitter:access_token");
-      deleteSecureKey("credential:integration:twitter:refresh_token");
-      deleteCredentialMetadata("integration:twitter", "access_token");
+      const dr1 = await deleteSecureKeyAsync(
+        "credential:integration:twitter:access_token",
+      );
+      const dr2 = await deleteSecureKeyAsync(
+        "credential:integration:twitter:refresh_token",
+      );
       // Client credentials (client_id, oauth_client_id, etc.) are intentionally
       // preserved so the user can re-connect without reconfiguring.
+      const disconnectFailed = dr1 === "error" || dr2 === "error";
+      if (!disconnectFailed) {
+        deleteCredentialMetadata("integration:twitter", "access_token");
+      }
       ctx.send(socket, {
         type: "twitter_integration_config_response",
-        success: true,
+        success: !disconnectFailed,
         managedAvailable: false,
         localClientConfigured: hasTwitterClientId(),
-        connected: false,
+        connected: disconnectFailed
+          ? !!getSecureKey("credential:integration:twitter:access_token")
+          : false,
+        ...(disconnectFailed
+          ? {
+              error: "Failed to delete Twitter tokens from secure storage",
+            }
+          : {}),
       });
     } else {
       ctx.send(socket, {

package/src/daemon/handlers/config-slack-channel.ts

@@ -1,7 +1,7 @@
 import {
-  deleteSecureKey,
+  deleteSecureKeyAsync,
   getSecureKey,
-  setSecureKey,
+  setSecureKeyAsync,
 } from "../../security/secure-keys.js";
 import {
   deleteCredentialMetadata,
@@ -122,7 +122,10 @@ export async function setSlackChannelConfig(
       };
     }
 
-    const stored = setSecureKey("credential:slack_channel:bot_token", botToken);
+    const stored = await setSecureKeyAsync(
+      "credential:slack_channel:bot_token",
+      botToken,
+    );
     if (!stored) {
       const storedBotToken = !!getSecureKey(
         "credential:slack_channel:bot_token",
@@ -166,7 +169,10 @@ export async function setSlackChannelConfig(
       };
     }
 
-    const stored = setSecureKey("credential:slack_channel:app_token", appToken);
+    const stored = await setSecureKeyAsync(
+      "credential:slack_channel:app_token",
+      appToken,
+    );
     if (!stored) {
       const storedBotToken = !!getSecureKey(
         "credential:slack_channel:bot_token",
@@ -207,10 +213,23 @@ export async function setSlackChannelConfig(
   };
 }
 
-export function clearSlackChannelConfig(): SlackChannelConfigResult {
-  deleteSecureKey("credential:slack_channel:bot_token");
+export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResult> {
+  const r1 = await deleteSecureKeyAsync("credential:slack_channel:bot_token");
+  const r2 = await deleteSecureKeyAsync("credential:slack_channel:app_token");
+
+  if (r1 === "error" || r2 === "error") {
+    const hasBotToken = !!getSecureKey("credential:slack_channel:bot_token");
+    const hasAppToken = !!getSecureKey("credential:slack_channel:app_token");
+    return {
+      success: false,
+      hasBotToken,
+      hasAppToken,
+      connected: hasBotToken && hasAppToken,
+      error: "Failed to delete Slack channel credentials from secure storage",
+    };
+  }
+
   deleteCredentialMetadata("slack_channel", "bot_token");
-  deleteSecureKey("credential:slack_channel:app_token");
   deleteCredentialMetadata("slack_channel", "app_token");
 
   return {

package/src/daemon/handlers/config-slack.ts

@@ -1,61 +1,9 @@
 import * as net from "node:net";
 
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
-import { getApp } from "../../memory/app-store.js";
-import { postToSlackWebhook } from "../../slack/slack-webhook.js";
-import type {
-  ShareToSlackRequest,
-  SlackWebhookConfigRequest,
-} from "../ipc-protocol.js";
+import type { SlackWebhookConfigRequest } from "../ipc-protocol.js";
 import { defineHandlers, type HandlerContext, log } from "./shared.js";
 
-export async function handleShareToSlack(
-  msg: ShareToSlackRequest,
-  socket: net.Socket,
-  ctx: HandlerContext,
-): Promise<void> {
-  try {
-    const config = loadRawConfig();
-    const webhookUrl = config.slackWebhookUrl as string | undefined;
-    if (!webhookUrl) {
-      ctx.send(socket, {
-        type: "share_to_slack_response",
-        success: false,
-        error:
-          "No Slack webhook URL configured. Provide one here in the chat, or set it from the Settings page.",
-      });
-      return;
-    }
-
-    const app = getApp(msg.appId);
-    if (!app) {
-      ctx.send(socket, {
-        type: "share_to_slack_response",
-        success: false,
-        error: `App not found: ${msg.appId}`,
-      });
-      return;
-    }
-
-    await postToSlackWebhook(
-      webhookUrl,
-      app.name,
-      app.description ?? "",
-      "\u{1F4F1}",
-    );
-
-    ctx.send(socket, { type: "share_to_slack_response", success: true });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    log.error({ err, appId: msg.appId }, "Failed to share app to Slack");
-    ctx.send(socket, {
-      type: "share_to_slack_response",
-      success: false,
-      error: message,
-    });
-  }
-}
-
 export function handleSlackWebhookConfig(
   msg: SlackWebhookConfigRequest,
   socket: net.Socket,
@@ -89,6 +37,5 @@ export function handleSlackWebhookConfig(
 }
 
 export const slackHandlers = defineHandlers({
-  share_to_slack: handleShareToSlack,
   slack_webhook_config: handleSlackWebhookConfig,
 });

package/src/daemon/handlers/config-telegram.ts

@@ -6,9 +6,9 @@ import {
   shouldUsePlatformCallbacks,
 } from "../../inbound/platform-callback-registration.js";
 import {
-  deleteSecureKey,
+  deleteSecureKeyAsync,
   getSecureKey,
-  setSecureKey,
+  setSecureKeyAsync,
 } from "../../security/secure-keys.js";
 import {
   deleteCredentialMetadata,
@@ -130,8 +130,11 @@ export async function setTelegramConfig(
     };
   }
 
-  // Store bot token securely
-  const stored = setSecureKey("credential:telegram:bot_token", resolvedToken);
+  // Store bot token securely (async — writes broker + encrypted store)
+  const stored = await setSecureKeyAsync(
+    "credential:telegram:bot_token",
+    resolvedToken,
+  );
   if (!stored) {
     return {
       success: false,
@@ -152,7 +155,7 @@ export async function setTelegramConfig(
   if (!hasWebhookSecret) {
     const { randomUUID } = await import("node:crypto");
     const webhookSecret = randomUUID();
-    const secretStored = setSecureKey(
+    const secretStored = await setSecureKeyAsync(
       "credential:telegram:webhook_secret",
       webhookSecret,
     );
@@ -164,7 +167,7 @@ export async function setTelegramConfig(
       // When the token came from secure storage it was already valid
       // configuration; deleting it would destroy working state.
       if (isNewToken) {
-        deleteSecureKey("credential:telegram:bot_token");
+        await deleteSecureKeyAsync("credential:telegram:bot_token");
         deleteCredentialMetadata("telegram", "bot_token");
       }
       return {
@@ -226,10 +229,8 @@ export async function clearTelegramConfig(): Promise<TelegramConfigResult> {
     }
   }
 
-  deleteSecureKey("credential:telegram:bot_token");
-  deleteCredentialMetadata("telegram", "bot_token");
-  deleteSecureKey("credential:telegram:webhook_secret");
-  deleteCredentialMetadata("telegram", "webhook_secret");
+  const r1 = await deleteSecureKeyAsync("credential:telegram:bot_token");
+  const r2 = await deleteSecureKeyAsync("credential:telegram:webhook_secret");
 
   // Trigger reconcile to deregister webhook
   const effectiveUrl = getIngressPublicBaseUrl();
@@ -237,6 +238,23 @@ export async function clearTelegramConfig(): Promise<TelegramConfigResult> {
     triggerGatewayReconcile(effectiveUrl);
   }
 
+  if (r1 === "error" || r2 === "error") {
+    const hasBotToken = !!getSecureKey("credential:telegram:bot_token");
+    const hasWebhookSecret = !!getSecureKey(
+      "credential:telegram:webhook_secret",
+    );
+    return {
+      success: false,
+      hasBotToken,
+      connected: hasBotToken && hasWebhookSecret,
+      hasWebhookSecret,
+      error: "Failed to delete Telegram credentials from secure storage",
+    };
+  }
+
+  deleteCredentialMetadata("telegram", "bot_token");
+  deleteCredentialMetadata("telegram", "webhook_secret");
+
   return {
     success: true,
     hasBotToken: false,

package/src/daemon/handlers/config.ts

@@ -40,10 +40,7 @@ export {
   handleSchedulesList,
   handleScheduleToggle,
 } from "./config-scheduling.js";
-export {
-  handleShareToSlack,
-  handleSlackWebhookConfig,
-} from "./config-slack.js";
+export { handleSlackWebhookConfig } from "./config-slack.js";
 export {
   handleTelegramConfig,
   summarizeTelegramError,

package/src/daemon/handlers/twitter-auth.ts

@@ -1,6 +1,10 @@
 import * as net from "node:net";
 
-import { loadConfig, loadRawConfig } from "../../config/loader.js";
+import {
+  getNestedValue,
+  loadConfig,
+  loadRawConfig,
+} from "../../config/loader.js";
 import { getPublicBaseUrl } from "../../inbound/public-ingress-urls.js";
 import { orchestrateOAuthConnect } from "../../oauth/connect-orchestrator.js";
 import { getSecureKey } from "../../security/secure-keys.js";
@@ -51,7 +55,8 @@ export async function handleTwitterAuthStart(
   try {
     const raw = loadRawConfig();
     const mode =
-      (raw.twitterIntegrationMode as string | undefined) ?? "local_byo";
+      (getNestedValue(raw, "twitter.integrationMode") as string | undefined) ??
+      "local_byo";
     if (mode !== "local_byo") {
       ctx.send(socket, {
         type: "twitter_auth_result",
@@ -186,8 +191,10 @@ export function handleTwitterAuthStatus(
     );
     const raw = loadRawConfig();
     const mode =
-      (raw.twitterIntegrationMode as "local_byo" | "managed" | undefined) ??
-      "local_byo";
+      (getNestedValue(raw, "twitter.integrationMode") as
+        | "local_byo"
+        | "managed"
+        | undefined) ?? "local_byo";
     const meta = getCredentialMetadata("integration:twitter", "access_token");
 
     ctx.send(socket, {

package/src/daemon/ipc-contract/apps.ts

@@ -127,11 +127,6 @@ export interface ShareAppCloudRequest {
   appId: string;
 }
 
-export interface ShareToSlackRequest {
-  type: "share_to_slack";
-  appId: string;
-}
-
 export interface PublishPageRequest {
   type: "publish_page";
   html: string;
@@ -341,12 +336,6 @@ export interface AppRestoreResponse {
   error?: string;
 }
 
-export interface ShareToSlackResponse {
-  type: "share_to_slack_response";
-  success: boolean;
-  error?: string;
-}
-
 export interface PublishPageResponse {
   type: "publish_page_response";
   success: boolean;
@@ -389,7 +378,6 @@ export type _AppsClientMessages =
   | AppFileAtVersionRequest
   | AppRestoreRequest
   | ShareAppCloudRequest
-  | ShareToSlackRequest
   | AppUpdatePreviewRequest
   | AppPreviewRequest
   | PublishPageRequest
@@ -414,7 +402,6 @@ export type _AppsServerMessages =
   | AppDiffResponse
   | AppFileAtVersionResponse
   | AppRestoreResponse
-  | ShareToSlackResponse
   | AppUpdatePreviewResponse
   | AppPreviewResponse
   | PublishPageResponse

package/src/daemon/ipc-contract-inventory.json

@@ -134,7 +134,6 @@
     "session_switch",
     "sessions_clear",
     "share_app_cloud",
-    "share_to_slack",
     "shared_app_delete",
     "shared_apps_list",
     "sign_bundle_payload_response",
@@ -291,7 +290,6 @@
     "session_title_updated",
     "sessions_clear_response",
     "share_app_cloud_response",
-    "share_to_slack_response",
     "shared_app_delete_response",
     "shared_apps_list_response",
     "sign_bundle_payload",

package/src/daemon/lifecycle.ts

@@ -10,6 +10,7 @@ import { TwilioConversationRelayProvider } from "../calls/twilio-provider.js";
 import { setVoiceBridgeDeps } from "../calls/voice-session-bridge.js";
 import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import {
+  getQdrantHttpPortEnv,
   getQdrantUrlEnv,
   getRuntimeHttpHost,
   getRuntimeHttpPort,
@@ -250,7 +251,13 @@ export async function runDaemon(): Promise<void> {
     log.info("Daemon startup: DaemonServer started");
 
     // Initialize Qdrant vector store — non-fatal so the daemon stays up without it
-    const qdrantUrl = getQdrantUrlEnv() || config.memory.qdrant.url;
+    // Prefer QDRANT_HTTP_PORT (locally-spawned Qdrant on a specific port) over
+    // QDRANT_URL (external Qdrant instance) so the CLI can set the port without
+    // triggering QdrantManager's external mode which skips local process spawn.
+    const qdrantHttpPort = getQdrantHttpPortEnv();
+    const qdrantUrl = qdrantHttpPort
+      ? `http://127.0.0.1:${qdrantHttpPort}`
+      : getQdrantUrlEnv() || config.memory.qdrant.url;
     log.info({ qdrantUrl }, "Daemon startup: initializing Qdrant");
     const qdrantManager = new QdrantManager({ url: qdrantUrl });
     try {

package/src/daemon/session-messaging.ts

@@ -403,7 +403,7 @@ export function redirectToSecurePrompt(
     .then(async (result): Promise<void> => {
       if (!result.value) return;
 
-      const { setSecureKey } = await import("../security/secure-keys.js");
+      const { setSecureKeyAsync } = await import("../security/secure-keys.js");
       const { upsertCredentialMetadata } =
         await import("../tools/credentials/metadata-store.js");
 
@@ -435,7 +435,7 @@ export function redirectToSecurePrompt(
         );
       } else {
         const key = `credential:${target.service}:${target.field}`;
-        const stored = setSecureKey(key, result.value);
+        const stored = await setSecureKeyAsync(key, result.value);
         if (stored) {
           try {
             upsertCredentialMetadata(target.service, target.field, {});