@vellumai/assistant 0.4.41 → 0.4.43

package/src/cli/commands/twitter/router.ts

@@ -0,0 +1,396 @@
+/**
+ * Strategy router for Twitter operations.
+ * Selects managed proxy, OAuth, or browser path based on the caller-provided strategy.
+ */
+
+import {
+  getTweet as managedGetTweet,
+  getUserByUsername as managedGetUserByUsername,
+  getUserTweets as managedGetUserTweets,
+  postTweet as managedPostTweet,
+  searchRecentTweets as managedSearchRecentTweets,
+  TwitterProxyError,
+} from "../../../twitter/platform-proxy-client.js";
+import type { PostTweetResult, TweetEntry, UserInfo } from "./client.js";
+import {
+  getTweetDetail as browserGetTweetDetail,
+  getUserByScreenName as browserGetUserByScreenName,
+  getUserTweets as browserGetUserTweets,
+  postTweet as browserPostTweet,
+  searchTweets as browserSearchTweets,
+  SessionExpiredError,
+} from "./client.js";
+import {
+  oauthIsAvailable,
+  oauthPostTweet,
+  oauthSupportsOperation,
+} from "./oauth-client.js";
+
+export type TwitterStrategy = "oauth" | "browser" | "auto" | "managed";
+
+export interface RoutedResult<T> {
+  result: T;
+  pathUsed: TwitterStrategy;
+}
+
+export interface RoutedError {
+  message: string;
+  pathUsed: TwitterStrategy;
+  suggestAlternative?: TwitterStrategy;
+  alternativeSetupHint?: string;
+}
+
+export async function routedPostTweet(
+  text: string,
+  opts: {
+    inReplyToTweetId?: string;
+    strategy: TwitterStrategy;
+    oauthToken?: string;
+  },
+): Promise<RoutedResult<PostTweetResult>> {
+  const strategy = opts.strategy;
+  const operation = opts.inReplyToTweetId ? "reply" : "post";
+
+  if (strategy === "managed") {
+    // Route through platform proxy — the platform holds the OAuth credentials
+    try {
+      const response = await managedPostTweet(text, {
+        replyToId: opts.inReplyToTweetId,
+      });
+      const data = response.data as Record<string, unknown>;
+      const tweetData = (data?.data ?? data) as Record<string, unknown>;
+      const tweetId = String(tweetData.id ?? "");
+      if (!tweetId) {
+        throw Object.assign(
+          new Error(
+            "Managed post succeeded but the proxy response did not include a tweet ID",
+          ),
+          {
+            pathUsed: "managed" as const,
+          },
+        );
+      }
+      return {
+        result: {
+          tweetId,
+          text,
+          url: `https://x.com/i/status/${tweetId}`,
+        },
+        pathUsed: "managed",
+      };
+    } catch (err) {
+      if (err instanceof TwitterProxyError) {
+        // Surface actionable error messages from the proxy
+        throw Object.assign(new Error(err.message), {
+          pathUsed: "managed" as const,
+          proxyErrorCode: err.code,
+          retryable: err.retryable,
+        });
+      }
+      throw err;
+    }
+  }
+
+  if (strategy === "oauth") {
+    // User explicitly wants OAuth
+    if (!oauthIsAvailable(opts.oauthToken)) {
+      throw Object.assign(
+        new Error(
+          "OAuth is not configured. Provide your X developer credentials here in the chat to set up OAuth, or switch to browser strategy: `assistant config set twitter.operationStrategy browser`.",
+        ),
+        {
+          pathUsed: "oauth" as const,
+          suggestAlternative: "browser" as const,
+        },
+      );
+    }
+    const result = await oauthPostTweet(text, {
+      inReplyToTweetId: opts.inReplyToTweetId,
+      oauthToken: opts.oauthToken!,
+    });
+    return {
+      result: {
+        tweetId: result.tweetId,
+        text: result.text,
+        url: result.url ?? `https://x.com/i/status/${result.tweetId}`,
+      },
+      pathUsed: "oauth",
+    };
+  }
+
+  if (strategy === "browser") {
+    // User explicitly wants browser
+    try {
+      const result = await browserPostTweet(text, {
+        inReplyToTweetId: opts.inReplyToTweetId,
+      });
+      return { result, pathUsed: "browser" };
+    } catch (err) {
+      if (err instanceof SessionExpiredError) {
+        throw Object.assign(err, {
+          pathUsed: "browser" as const,
+          suggestAlternative: "oauth" as const,
+        });
+      }
+      throw err;
+    }
+  }
+
+  // auto strategy: try OAuth first if available and supported, fallback to browser
+  let oauthError: Error | undefined;
+  if (oauthIsAvailable(opts.oauthToken) && oauthSupportsOperation(operation)) {
+    try {
+      const result = await oauthPostTweet(text, {
+        inReplyToTweetId: opts.inReplyToTweetId,
+        oauthToken: opts.oauthToken!,
+      });
+      return {
+        result: {
+          tweetId: result.tweetId,
+          text: result.text,
+          url: result.url ?? `https://x.com/i/status/${result.tweetId}`,
+        },
+        pathUsed: "oauth",
+      };
+    } catch (err) {
+      oauthError = err instanceof Error ? err : new Error(String(err));
+      // Fall through to browser
+    }
+  }
+
+  // Fallback to browser
+  try {
+    const result = await browserPostTweet(text, {
+      inReplyToTweetId: opts.inReplyToTweetId,
+    });
+    return { result, pathUsed: "browser" };
+  } catch (err) {
+    if (err instanceof SessionExpiredError) {
+      throw Object.assign(err, {
+        pathUsed: "auto" as const,
+        oauthError: oauthError?.message,
+      });
+    }
+    if (oauthError) {
+      const browserError = err instanceof Error ? err : new Error(String(err));
+      throw Object.assign(browserError, {
+        pathUsed: "auto" as const,
+        oauthError: oauthError.message,
+      });
+    }
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Routed read operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Look up a user by screen name.
+ * Managed mode uses GET /2/users/by/username/:username; browser mode uses GraphQL.
+ */
+export async function routedGetUserByScreenName(
+  screenName: string,
+  opts: { strategy: TwitterStrategy },
+): Promise<RoutedResult<UserInfo>> {
+  if (opts.strategy === "managed") {
+    try {
+      const response = await managedGetUserByUsername(screenName, {
+        "user.fields": "id,name,username",
+      });
+      const data = response.data as Record<string, unknown>;
+      const userData = (data?.data ?? data) as Record<string, unknown>;
+      if (!userData.id) {
+        throw Object.assign(new Error(`User not found: @${screenName}`), {
+          pathUsed: "managed" as const,
+        });
+      }
+      return {
+        result: {
+          userId: String(userData.id),
+          screenName: String(
+            userData.username ?? userData.screen_name ?? screenName,
+          ),
+          name: String(userData.name ?? screenName),
+        },
+        pathUsed: "managed",
+      };
+    } catch (err) {
+      if (err instanceof TwitterProxyError) {
+        throw Object.assign(new Error(err.message), {
+          pathUsed: "managed" as const,
+          proxyErrorCode: err.code,
+          retryable: err.retryable,
+        });
+      }
+      throw err;
+    }
+  }
+
+  // Browser path (used for browser, oauth, auto — read operations always go through browser)
+  const result = await browserGetUserByScreenName(screenName);
+  return { result, pathUsed: "browser" };
+}
+
+/**
+ * Fetch a user's recent tweets.
+ * Managed mode uses GET /2/users/:id/tweets; browser mode uses GraphQL.
+ */
+export async function routedGetUserTweets(
+  userId: string,
+  count: number,
+  opts: { strategy: TwitterStrategy },
+): Promise<RoutedResult<TweetEntry[]>> {
+  if (opts.strategy === "managed") {
+    try {
+      const response = await managedGetUserTweets(userId, {
+        max_results: String(Math.min(count, 100)),
+        "tweet.fields": "id,text,created_at,author_id",
+      });
+      const data = response.data as Record<string, unknown>;
+      const tweetsArray = (data?.data ?? []) as Array<Record<string, unknown>>;
+      const tweets: TweetEntry[] = tweetsArray.map((t) => ({
+        tweetId: String(t.id ?? ""),
+        text: String(t.text ?? ""),
+        url: `https://x.com/i/status/${t.id}`,
+        createdAt: String(t.created_at ?? ""),
+      }));
+      return { result: tweets, pathUsed: "managed" };
+    } catch (err) {
+      if (err instanceof TwitterProxyError) {
+        throw Object.assign(new Error(err.message), {
+          pathUsed: "managed" as const,
+          proxyErrorCode: err.code,
+          retryable: err.retryable,
+        });
+      }
+      throw err;
+    }
+  }
+
+  const result = await browserGetUserTweets(userId, count);
+  return { result, pathUsed: "browser" };
+}
+
+/**
+ * Fetch a single tweet by ID.
+ * Managed mode uses GET /2/tweets/:id; browser mode uses GraphQL TweetDetail.
+ */
+export async function routedGetTweetDetail(
+  tweetId: string,
+  opts: { strategy: TwitterStrategy },
+): Promise<RoutedResult<TweetEntry[]>> {
+  if (opts.strategy === "managed") {
+    try {
+      const response = await managedGetTweet(tweetId, {
+        "tweet.fields": "id,text,created_at,author_id,conversation_id",
+      });
+      const data = response.data as Record<string, unknown>;
+      const tweetData = (data?.data ?? data) as Record<string, unknown>;
+      const primaryTweet: TweetEntry = {
+        tweetId: String(tweetData.id ?? ""),
+        text: String(tweetData.text ?? ""),
+        url: `https://x.com/i/status/${tweetData.id}`,
+        createdAt: String(tweetData.created_at ?? ""),
+      };
+
+      // If the tweet has a conversation_id, fetch the thread via search
+      const conversationId = tweetData.conversation_id as string | undefined;
+      if (conversationId) {
+        try {
+          const threadResponse = await managedSearchRecentTweets(
+            `conversation_id:${conversationId}`,
+            {
+              "tweet.fields": "id,text,created_at,author_id",
+              max_results: "100",
+            },
+          );
+          const threadData = threadResponse.data as Record<string, unknown>;
+          const threadArray = (threadData?.data ?? []) as Array<
+            Record<string, unknown>
+          >;
+          const threadTweets: TweetEntry[] = threadArray.map((t) => ({
+            tweetId: String(t.id ?? ""),
+            text: String(t.text ?? ""),
+            url: `https://x.com/i/status/${t.id}`,
+            createdAt: String(t.created_at ?? ""),
+          }));
+          // Deduplicate: the primary tweet may already be in the search results
+          const seen = new Set(threadTweets.map((t) => t.tweetId));
+          if (!seen.has(primaryTweet.tweetId)) {
+            threadTweets.unshift(primaryTweet);
+          }
+          return { result: threadTweets, pathUsed: "managed" };
+        } catch {
+          // If thread search fails, fall back to returning just the single tweet
+        }
+      }
+
+      return { result: [primaryTweet], pathUsed: "managed" };
+    } catch (err) {
+      if (err instanceof TwitterProxyError) {
+        throw Object.assign(new Error(err.message), {
+          pathUsed: "managed" as const,
+          proxyErrorCode: err.code,
+          retryable: err.retryable,
+        });
+      }
+      throw err;
+    }
+  }
+
+  const result = await browserGetTweetDetail(tweetId);
+  return { result, pathUsed: "browser" };
+}
+
+/**
+ * Search tweets.
+ * Managed mode uses GET /2/tweets/search/recent; browser mode uses GraphQL SearchTimeline.
+ */
+export async function routedSearchTweets(
+  query: string,
+  product: "Top" | "Latest" | "People" | "Media",
+  opts: { strategy: TwitterStrategy },
+): Promise<RoutedResult<TweetEntry[]>> {
+  if (opts.strategy === "managed") {
+    if (product === "People" || product === "Media") {
+      throw Object.assign(
+        new Error(
+          `Product type "${product}" is not supported in managed mode. Only "Top" and "Latest" are supported.`,
+        ),
+        { pathUsed: "managed" as const },
+      );
+    }
+    try {
+      const queryParams: Record<string, string> = {
+        "tweet.fields": "id,text,created_at,author_id",
+      };
+      if (product === "Latest") {
+        queryParams.sort_order = "recency";
+      }
+      const response = await managedSearchRecentTweets(query, queryParams);
+      const data = response.data as Record<string, unknown>;
+      const tweetsArray = (data?.data ?? []) as Array<Record<string, unknown>>;
+      const tweets: TweetEntry[] = tweetsArray.map((t) => ({
+        tweetId: String(t.id ?? ""),
+        text: String(t.text ?? ""),
+        url: `https://x.com/i/status/${t.id}`,
+        createdAt: String(t.created_at ?? ""),
+      }));
+      return { result: tweets, pathUsed: "managed" };
+    } catch (err) {
+      if (err instanceof TwitterProxyError) {
+        throw Object.assign(new Error(err.message), {
+          pathUsed: "managed" as const,
+          proxyErrorCode: err.code,
+          retryable: err.retryable,
+        });
+      }
+      throw err;
+    }
+  }
+
+  const result = await browserSearchTweets(query, product);
+  return { result, pathUsed: "browser" };
+}

package/src/cli/commands/twitter/session.ts

@@ -0,0 +1,121 @@
+/**
+ * Twitter session persistence.
+ * Delegates to the `assistant credentials` CLI for CRUD;
+ * keeps Twitter-specific cookie validation and CSRF extraction.
+ */
+
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+class ConfigError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ConfigError";
+  }
+}
+
+export interface TwitterSession {
+  cookies: ExtractedCredential[];
+}
+
+interface SessionRecording {
+  cookies?: ExtractedCredential[];
+}
+
+interface ExtractedCredential {
+  name: string;
+  value: string;
+  domain: string;
+  path: string;
+  httpOnly: boolean;
+  secure: boolean;
+  expires?: number;
+}
+
+export async function loadSession(): Promise<TwitterSession | null> {
+  try {
+    const { stdout } = await execFileAsync("assistant", [
+      "credentials",
+      "reveal",
+      "twitter:session:cookies",
+    ]);
+    const cookies = JSON.parse(stdout.trim()) as ExtractedCredential[];
+    return { cookies };
+  } catch {
+    return null;
+  }
+}
+
+export async function saveSession(session: TwitterSession): Promise<void> {
+  try {
+    await execFileAsync("assistant", [
+      "credentials",
+      "set",
+      "twitter:session:cookies",
+      JSON.stringify(session.cookies),
+    ]);
+  } catch (err) {
+    throw new ConfigError(
+      `Failed to save Twitter session: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
+export async function clearSession(): Promise<void> {
+  try {
+    await execFileAsync("assistant", [
+      "credentials",
+      "delete",
+      "twitter:session:cookies",
+    ]);
+  } catch {
+    // Clearing a non-existent session is fine — no-op
+  }
+}
+
+/**
+ * Import cookies from a Ride Shotgun recording file.
+ */
+export async function importFromRecording(
+  recordingPath: string,
+): Promise<TwitterSession> {
+  try {
+    if (!existsSync(recordingPath)) {
+      throw new ConfigError(`Recording not found: ${recordingPath}`);
+    }
+    const recording = JSON.parse(
+      readFileSync(recordingPath, "utf-8"),
+    ) as SessionRecording;
+    if (!recording.cookies?.length) {
+      throw new ConfigError("Recording contains no cookies");
+    }
+
+    const cookieNames = new Set(recording.cookies.map((c) => c.name));
+
+    if (!cookieNames.has("ct0") || !cookieNames.has(`auth_${"token"}`)) {
+      throw new ConfigError(
+        "Recording is missing required Twitter session cookies. " +
+          "Make sure you are logged in to x.com before recording.",
+      );
+    }
+
+    const session: TwitterSession = { cookies: recording.cookies };
+    await saveSession(session);
+    return session;
+  } catch (error) {
+    if (error instanceof ConfigError) throw error;
+    throw new ConfigError(
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+}
+
+/**
+ * Get the CSRF token from session cookies (ct0 cookie).
+ */
+export function getCsrfToken(session: TwitterSession): string | undefined {
+  return session.cookies.find((c) => c.name === "ct0")?.value;
+}

package/src/cli/db.ts

@@ -0,0 +1 @@
+export { initializeDb } from "../memory/db.js";

package/src/cli/http-client.ts

@@ -0,0 +1,87 @@
+/**
+ * HTTP client helpers for the built-in CLI.
+ *
+ * Provides authenticated HTTP communication with the daemon's HTTP server,
+ * replacing the previous Unix socket IPC transport. Patterns are adapted
+ * from `cli/src/lib/http-client.ts` (external CLI).
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getRuntimeHttpPort } from "../config/env.js";
+import { getRootDir } from "../util/platform.js";
+
+// ---------------------------------------------------------------------------
+// Token
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the HTTP bearer token from `<rootDir>/http-token`.
+ * Returns undefined if the token file doesn't exist or is empty.
+ */
+export function readHttpToken(): string | undefined {
+  const tokenPath = join(getRootDir(), "http-token");
+  try {
+    const token = readFileSync(tokenPath, "utf-8").trim();
+    return token || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Base URL
+// ---------------------------------------------------------------------------
+
+/** Build the base URL for the daemon HTTP server. */
+export function getHttpBaseUrl(): string {
+  return `http://127.0.0.1:${getRuntimeHttpPort()}`;
+}
+
+// ---------------------------------------------------------------------------
+// Authenticated fetch
+// ---------------------------------------------------------------------------
+
+/**
+ * Make an authenticated HTTP request to the daemon.
+ *
+ * @param path   Request path (e.g. `/v1/messages` or `/healthz`)
+ * @param init   Standard fetch RequestInit options
+ * @returns      The fetch Response
+ */
+export async function httpSend(
+  path: string,
+  init: RequestInit = {},
+): Promise<Response> {
+  const token = readHttpToken();
+  const url = `${getHttpBaseUrl()}${path}`;
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    ...(init.headers as Record<string, string> | undefined),
+  };
+  if (token) {
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  return fetch(url, { ...init, headers });
+}
+
+// ---------------------------------------------------------------------------
+// Health check
+// ---------------------------------------------------------------------------
+
+/**
+ * Perform an HTTP health check against the daemon's `/healthz` endpoint.
+ * Returns true if the daemon responds with HTTP 200, false otherwise.
+ */
+export async function httpHealthCheck(timeoutMs = 2000): Promise<boolean> {
+  try {
+    const url = `${getHttpBaseUrl()}/healthz`;
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}

package/src/cli/logger.ts

@@ -0,0 +1,6 @@
+import { getCliLogger } from "../util/logger.js";
+
+/** Shared CLI logger instance. Most commands use this directly. */
+export const log = getCliLogger("cli");
+
+export { getCliLogger } from "../util/logger.js";

package/src/cli/main-screen.tsx

@@ -1,7 +1,8 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
-import { getSocketPath, getWorkspaceDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/platform.js";
+import { getHttpBaseUrl } from "./http-client.js";
 
 const LEFT_PANEL_WIDTH = 36;
 const RIGHT_LINE_COUNT = 11;
@@ -13,7 +14,7 @@ export interface MainScreenLayout {
 }
 
 export function renderMainScreen(): MainScreenLayout {
-  const socketPath = getSocketPath();
+  const httpUrl = getHttpBaseUrl();
   const workspace = getWorkspaceDir();
   const assistantId = workspace.split("/").pop() ?? "vellum";
 
@@ -26,7 +27,7 @@ export function renderMainScreen(): MainScreenLayout {
     render: (runtimeUrl: string, assistantId: string, species: string) => number;
   };
 
-  const height = render(socketPath, assistantId, "vellum");
+  const height = render(httpUrl, assistantId, "vellum");
 
   const statusCanvasLine = RIGHT_LINE_COUNT + 1;
   const statusCol = LEFT_PANEL_WIDTH + 1;

package/src/cli/output.ts

@@ -0,0 +1,19 @@
+import type { Command } from "commander";
+
+export function shouldOutputJson(cmd: Command): boolean {
+  let current: Command | null = cmd;
+  while (current) {
+    if ((current.opts() as { json?: boolean }).json) return true;
+    current = current.parent;
+  }
+  return false;
+}
+
+export function writeOutput(cmd: Command, payload: unknown): void {
+  const compact = shouldOutputJson(cmd);
+  process.stdout.write(
+    compact
+      ? JSON.stringify(payload) + "\n"
+      : JSON.stringify(payload, null, 2) + "\n",
+  );
+}