@vellumai/assistant 0.4.41 → 0.4.43

package/src/channels/types.ts

@@ -1,7 +1,6 @@
 export const CHANNEL_IDS = [
   "telegram",
-  "sms",
-  "voice",
+  "phone",
   "vellum",
   "whatsapp",
   "slack",
@@ -17,17 +16,8 @@ export function isChannelId(value: unknown): value is ChannelId {
   );
 }
 
-/** Legacy channel IDs that were renamed but may still arrive from pre-rename clients. */
-const LEGACY_CHANNEL_ALIASES: Record<string, ChannelId> = {
-  macos: "vellum",
-  ios: "vellum",
-};
-
 export function parseChannelId(value: unknown): ChannelId | null {
   if (isChannelId(value)) return value;
-  if (typeof value === "string" && value in LEGACY_CHANNEL_ALIASES) {
-    return LEGACY_CHANNEL_ALIASES[value]!;
-  }
   return null;
 }
 
@@ -53,8 +43,7 @@ export const INTERFACE_IDS = [
   "ios",
   "cli",
   "telegram",
-  "sms",
-  "voice",
+  "phone",
   "vellum",
   "whatsapp",
   "slack",

package/src/cli/__tests__/notifications.test.ts

@@ -75,7 +75,7 @@ import { Command } from "commander";
 
 import { getDb, initializeDb, resetDb } from "../../memory/db.js";
 import { createEvent } from "../../notifications/events-store.js";
-import { registerNotificationsCommand } from "../notifications.js";
+import { registerNotificationsCommand } from "../commands/notifications.js";
 
 // ---------------------------------------------------------------------------
 // Helpers

package/src/{amazon → cli/commands/amazon}/client.ts

@@ -13,8 +13,9 @@
  *      page), NOT from `document`. The browser's live page rarely has the data we need.
  *
  *   2. Session cookies live in the Chrome-CDP browser profile
- *      (~Library/Application Support/Google/Chrome-CDP). The session.json on disk is only
- *      used to validate that a session exists. Actual auth goes through the browser's cookies.
+ *      (~Library/Application Support/Google/Chrome-CDP). Session metadata is stored in the
+ *      encrypted credential store and used to validate that a session exists. Actual auth
+ *      goes through the browser's cookies.
  *
  * AMAZON FRESH vs REGULAR CART
  * ============================
@@ -48,18 +49,28 @@
  * not that we're rate-limited. Check the response body before classifying the error.
  */
 
-import type {
-  ExtensionCommand,
-  ExtensionResponse,
-} from "../browser-extension-relay/protocol.js";
-import { extensionRelayServer } from "../browser-extension-relay/server.js";
-import {
-  initAuthSigningKey,
-  isSigningKeyInitialized,
-  loadOrCreateSigningKey,
-} from "../runtime/auth/token-service.js";
-import { gatewayPost } from "../runtime/gateway-internal-client.js";
-import type { ExtractedCredential } from "../tools/browser/network-recording-types.js";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+export interface ExtractedCredential {
+  name: string;
+  value: string;
+  domain: string;
+  path: string;
+  httpOnly: boolean;
+  secure: boolean;
+  expires?: number;
+}
+
+interface RelayResponse {
+  ok: boolean;
+  tabId?: number;
+  result?: unknown;
+  error?: string;
+}
+
 import { type AmazonSession, loadSession, saveSession } from "./session.js";
 
 export const AMAZON_BASE = "https://www.amazon.com";
@@ -67,35 +78,77 @@ export const AMAZON_BASE = "https://www.amazon.com";
 // ---------------------------------------------------------------------------
 // Relay command routing
 // ---------------------------------------------------------------------------
-// When running inside the daemon, extensionRelayServer has a live WebSocket.
-// When running out-of-process (CLI), the relay isn't available, so we fall
-// back to the daemon's HTTP endpoint POST /v1/browser-relay/command.
+// All relay commands are dispatched via the `assistant browser chrome relay`
+// CLI subprocess. Action names are converted from snake_case to kebab-case.
+// The `evaluate` action pipes JavaScript via stdin to avoid shell escaping.
 // ---------------------------------------------------------------------------
 
 export async function sendRelayCommand(
   command: Record<string, unknown>,
-): Promise<ExtensionResponse> {
-  // Try in-process relay first (works when running inside the daemon)
-  const status = extensionRelayServer.getStatus();
-  if (status.connected) {
-    return extensionRelayServer.sendCommand(
-      command as Omit<ExtensionCommand, "id">,
-    );
+): Promise<{
+  success: boolean;
+  tabId?: number;
+  result?: unknown;
+  error?: string;
+}> {
+  const action = command.action as string;
+  const cmdArgs = ["browser", "chrome", "relay", action.replace(/_/g, "-")];
+
+  // Map command fields to CLI flags
+  for (const [key, value] of Object.entries(command)) {
+    if (key === "action") continue;
+    if (key === "code") continue; // handled via stdin for evaluate
+    if (key === "cookie") {
+      cmdArgs.push("--cookie", JSON.stringify(value));
+      continue;
+    }
+    const flag = key.replace(/([A-Z])/g, "-$1").toLowerCase();
+    cmdArgs.push(`--${flag === "tabid" ? "tab-id" : flag}`, String(value));
   }
 
-  // Fall back to HTTP relay endpoint via the gateway.
-  // The gateway validates edge JWTs (aud=vellum-gateway) and mints an
-  // exchange token for the runtime. In CLI out-of-process contexts the
-  // signing key may not be initialized yet — load it from disk.
-  if (!isSigningKeyInitialized()) {
-    initAuthSigningKey(loadOrCreateSigningKey());
+  // For evaluate commands, pipe code via stdin to avoid shell escaping issues
+  if (action === "evaluate" && command.code) {
+    return new Promise((resolve, reject) => {
+      const proc = spawn("assistant", cmdArgs);
+      let stdout = "";
+      let stderr = "";
+      proc.stdout.on("data", (d: Buffer) => {
+        stdout += d;
+      });
+      proc.stderr.on("data", (d: Buffer) => {
+        stderr += d;
+      });
+      proc.on("close", (code) => {
+        try {
+          const result: RelayResponse = JSON.parse(stdout);
+          resolve({
+            success: result.ok,
+            tabId: result.tabId,
+            result: result.result,
+            error: result.error,
+          });
+        } catch {
+          if (code !== 0) {
+            reject(new Error(stderr || stdout || `Exit code ${code}`));
+          } else {
+            reject(new Error(`Invalid JSON from relay: ${stdout}`));
+          }
+        }
+      });
+      proc.on("error", reject);
+      proc.stdin.write(command.code as string);
+      proc.stdin.end();
+    });
   }
 
-  const { data } = await gatewayPost<ExtensionResponse>(
-    "/v1/browser-relay/command",
-    command,
-  );
-  return data;
+  const { stdout } = await execFileAsync("assistant", cmdArgs);
+  const result: RelayResponse = JSON.parse(stdout);
+  return {
+    success: result.ok,
+    tabId: result.tabId,
+    result: result.result,
+    error: result.error,
+  };
 }
 
 /** Thrown when the session is missing or expired. The CLI handles this specially. */
@@ -114,8 +167,8 @@ export class RateLimitError extends Error {
   }
 }
 
-function requireSession(): AmazonSession {
-  const session = loadSession();
+async function requireSession(): Promise<AmazonSession> {
+  const session = await loadSession();
   if (!session) {
     throw new SessionExpiredError("No Amazon session found.");
   }
@@ -130,7 +183,7 @@ export async function prepareRequest(): Promise<{
   tabId: number;
   session: AmazonSession;
 }> {
-  const session = requireSession();
+  const session = await requireSession();
   const tabId = await findAmazonTab();
   // Skip cookie sync — use Chrome's own live cookies instead of overwriting with stale CLI ones
   // await syncCookiesToBrowser(session.cookies);
@@ -177,7 +230,7 @@ async function _syncCookiesToBrowser(
   for (const cookie of cookies) {
     const domain = cookie.domain || ".amazon.com";
     const cleanDomain = domain.startsWith(".") ? domain.slice(1) : domain;
-    await extensionRelayServer.sendCommand({
+    await sendRelayCommand({
       action: "set_cookie",
       cookie: {
         url: `https://${cleanDomain}`,
@@ -201,7 +254,12 @@ async function _syncCookiesToBrowser(
  * Returns the JSON-parsed result value.
  */
 export async function cdpEval(tabId: number, script: string): Promise<unknown> {
-  let resp: ExtensionResponse;
+  let resp: {
+    success: boolean;
+    tabId?: number;
+    result?: unknown;
+    error?: string;
+  };
   try {
     resp = await sendRelayCommand({ action: "evaluate", tabId, code: script });
   } catch (err) {
@@ -433,10 +491,9 @@ export async function refreshSessionFromExtension(): Promise<AmazonSession> {
 
   const session: AmazonSession = {
     cookies,
-    importedAt: new Date().toISOString(),
   };
 
-  saveSession(session);
+  await saveSession(session);
   return session;
 }
 

package/src/cli/{amazon.ts → commands/amazon/index.ts}

@@ -9,6 +9,7 @@ import { Command } from "commander";
 
 import {
   addToCart,
+  type ExtractedCredential,
   getCheckoutSummary,
   getFreshDeliverySlots,
   getPaymentMethods,
@@ -20,13 +21,13 @@ import {
   selectFreshDeliverySlot,
   SessionExpiredError,
   viewCart,
-} from "../amazon/client.js";
+} from "./client.js";
 import {
   clearSession,
   importFromRecording,
   loadSession,
   saveSession,
-} from "../amazon/session.js";
+} from "./session.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -138,11 +139,10 @@ Examples:
     )
     .action(async (opts: { recording: string }, cmd: Command) => {
       await run(cmd, async () => {
-        const session = importFromRecording(opts.recording);
+        const session = await importFromRecording(opts.recording);
         return {
           message: "Session imported successfully",
           cookieCount: session.cookies.length,
-          recordingId: session.recordingId,
         };
       });
     });
@@ -163,8 +163,8 @@ all shopping commands will fail until a new session is established via
 Examples:
   $ assistant amazon logout`,
     )
-    .action((_opts: unknown, cmd: Command) => {
-      clearSession();
+    .action(async (_opts: unknown, cmd: Command) => {
+      await clearSession();
       output({ ok: true, message: "Session cleared" }, getJson(cmd));
     });
 
@@ -242,7 +242,7 @@ Examples:
       const json = getJson(cmd);
       try {
         const session = await extractSessionFromChromeCookies();
-        saveSession(session);
+        await saveSession(session);
         output(
           {
             ok: true,
@@ -266,8 +266,7 @@ Examples:
       "after",
       `
 Reports whether an Amazon session is currently stored locally. If a session
-exists, returns the cookie count, import timestamp, and recording ID. If no
-session exists, returns loggedIn: false.
+exists, returns the cookie count. If no session exists, returns loggedIn: false.
 
 Use this to verify session health before running shopping commands.
 
@@ -275,16 +274,14 @@ Examples:
   $ assistant amazon status
   $ assistant amazon status --json`,
     )
-    .action((_opts: unknown, cmd: Command) => {
-      const session = loadSession();
+    .action(async (_opts: unknown, cmd: Command) => {
+      const session = await loadSession();
       if (session) {
         output(
           {
             ok: true,
             loggedIn: true,
             cookieCount: session.cookies.length,
-            importedAt: session.importedAt,
-            recordingId: session.recordingId,
           },
           getJson(cmd),
         );
@@ -802,7 +799,7 @@ function decryptChromeCookie(
  *   - macOS Keychain access for 'Chrome Safe Storage' (will prompt once)
  */
 async function extractSessionFromChromeCookies(): Promise<
-  import("../amazon/session.js").AmazonSession
+  import("./session.js").AmazonSession
 > {
   // 1. Get Chrome Safe Storage key from macOS Keychain
   let keychainPassword: string;
@@ -873,8 +870,7 @@ async function extractSessionFromChromeCookies(): Promise<
   }
 
   // 4. Decrypt each cookie
-  const cookies: import("../tools/browser/network-recording-types.js").ExtractedCredential[] =
-    [];
+  const cookies: ExtractedCredential[] = [];
   for (const line of rawOutput.split("\n")) {
     const parts = line.split("|");
     if (parts.length < 7) continue;
@@ -920,6 +916,5 @@ async function extractSessionFromChromeCookies(): Promise<
 
   return {
     cookies,
-    importedAt: new Date().toISOString(),
   };
 }

package/src/{amazon → cli/commands/amazon}/request-extractor.ts

@@ -9,8 +9,44 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
-import type { SessionRecording } from "../tools/browser/network-recording-types.js";
-import { getDataDir } from "../util/platform.js";
+interface NetworkRecordedRequest {
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+  postData?: string;
+}
+
+interface NetworkRecordedEntry {
+  requestId: string;
+  resourceType: string;
+  timestamp: number;
+  request: NetworkRecordedRequest;
+  response?: unknown;
+}
+
+interface SessionRecording {
+  id: string;
+  startedAt: number;
+  endedAt: number;
+  targetDomain?: string;
+  networkEntries: NetworkRecordedEntry[];
+  cookies: Array<{
+    name: string;
+    value: string;
+    domain: string;
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    expires?: number;
+  }>;
+  observations: Array<{
+    ocrText: string;
+    appName?: string;
+    windowTitle?: string;
+    timestamp: number;
+    captureIndex: number;
+  }>;
+}
 
 export type AmazonRequestKey =
   | "search"
@@ -30,7 +66,7 @@ export interface CapturedRequest {
 }
 
 function getCapturedRequestsPath(): string {
-  return join(getDataDir(), "amazon", "captured-requests.json");
+  return join(process.env.VELLUM_DATA_DIR!, "amazon", "captured-requests.json");
 }
 
 /**

package/src/cli/commands/amazon/session.ts

@@ -0,0 +1,116 @@
+/**
+ * Amazon session persistence.
+ * Delegates cookie CRUD to the `assistant credentials` CLI subprocess;
+ * keeps Amazon-specific cookie validation and CSRF extraction.
+ */
+
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { promisify } from "node:util";
+
+import type { ExtractedCredential } from "./client.js";
+
+const execFileAsync = promisify(execFile);
+
+export interface AmazonSession {
+  cookies: ExtractedCredential[];
+}
+
+interface SessionRecording {
+  cookies?: ExtractedCredential[];
+}
+
+export async function loadSession(): Promise<AmazonSession | null> {
+  try {
+    const { stdout } = await execFileAsync("assistant", [
+      "credentials",
+      "reveal",
+      "amazon:session:cookies",
+    ]);
+    const cookies = JSON.parse(stdout.trim()) as ExtractedCredential[];
+    return { cookies };
+  } catch {
+    return null;
+  }
+}
+
+export async function saveSession(session: AmazonSession): Promise<void> {
+  try {
+    await execFileAsync("assistant", [
+      "credentials",
+      "set",
+      "amazon:session:cookies",
+      JSON.stringify(session.cookies),
+    ]);
+  } catch (err) {
+    throw new Error(
+      `Failed to save Amazon session: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
+export async function clearSession(): Promise<void> {
+  try {
+    await execFileAsync("assistant", [
+      "credentials",
+      "delete",
+      "amazon:session:cookies",
+    ]);
+  } catch {
+    // Clearing a non-existent session is fine — no-op
+  }
+}
+
+/**
+ * Import cookies from a Ride Shotgun recording file.
+ * Validates that the recording contains Amazon's required auth cookies.
+ */
+export async function importFromRecording(
+  recordingPath: string,
+): Promise<AmazonSession> {
+  if (!existsSync(recordingPath)) {
+    throw new Error(`Recording not found: ${recordingPath}`);
+  }
+  const recording = JSON.parse(
+    readFileSync(recordingPath, "utf-8"),
+  ) as SessionRecording;
+  if (!recording.cookies?.length) {
+    throw new Error("Recording contains no cookies");
+  }
+
+  const cookieNames = new Set(recording.cookies.map((c) => c.name));
+
+  if (!cookieNames.has("session-id")) {
+    throw new Error(
+      "Recording is missing required Amazon cookie: session-id. " +
+        "Make sure you are logged in to Amazon.",
+    );
+  }
+  if (!cookieNames.has("ubid-main")) {
+    throw new Error(
+      "Recording is missing required Amazon cookie: ubid-main. " +
+        "Make sure you are logged in to Amazon.",
+    );
+  }
+  if (!cookieNames.has("at-main") && !cookieNames.has("x-main")) {
+    throw new Error(
+      "Recording is missing required Amazon auth cookie (at-main or x-main). " +
+        "Make sure you are fully logged in to Amazon.",
+    );
+  }
+
+  const session: AmazonSession = { cookies: recording.cookies };
+  await saveSession(session);
+  return session;
+}
+
+/**
+ * Get the anti-CSRF token from session cookies.
+ * Amazon uses anti-csrftoken-a2z or csrf-main for cart POST requests.
+ */
+export function getAntiCsrfToken(session: AmazonSession): string | undefined {
+  return (
+    session.cookies.find((c) => c.name === "anti-csrftoken-a2z")?.value ??
+    session.cookies.find((c) => c.name === "csrf-main")?.value
+  );
+}

package/src/cli/{audit.ts → commands/audit.ts}

@@ -1,9 +1,7 @@
 import type { Command } from "commander";
 
-import { getRecentInvocations } from "../memory/tool-usage-store.js";
-import { getCliLogger } from "../util/logger.js";
-
-const log = getCliLogger("cli");
+import { getRecentInvocations } from "../../memory/tool-usage-store.js";
+import { log } from "../logger.js";
 
 export function registerAuditCommand(program: Command): void {
   program

package/src/cli/{autonomy.ts → commands/autonomy.ts}

@@ -4,9 +4,7 @@ import { dirname, join } from "node:path";
 
 import type { Command } from "commander";
 
-import { getCliLogger } from "../util/logger.js";
-
-const log = getCliLogger("cli");
+import { log } from "../logger.js";
 
 // ---------------------------------------------------------------------------
 // Types & constants