machinaos 0.0.76 → 0.0.78

package/server/routers/websocket.py

@@ -61,7 +61,10 @@ MessageHandler = Callable[[Dict[str, Any], WebSocket], Awaitable[Dict[str, Any]]
 
 def ws_handler(*required_fields: str):
     """Simple decorator for WebSocket handlers. Validates required fields and wraps errors."""
+    import functools
+
     def decorator(func: MessageHandler) -> MessageHandler:
+        @functools.wraps(func)
         async def wrapper(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
             for field in required_fields:
                 if not data.get(field):
@@ -297,7 +300,7 @@ async def handle_load_options(
     Body: ``{"method": "...", "params": {...}}``
     Response: ``{"options": [{"value": ..., "label": ...}]}``
     """
-    from services.node_option_loaders import dispatch_load_options
+    from services.ws_handler_registry import dispatch_load_options
 
     options = await dispatch_load_options(data["method"], data.get("params", {}))
     return {"method": data["method"], "options": options}
@@ -309,7 +312,7 @@ async def handle_list_load_options_methods(
 ) -> Dict[str, Any]:
     """Return registered loadOptionsMethod names. Editor uses this to
     know which dynamic-option loaders are wired."""
-    from services.node_option_loaders import list_load_options_methods
+    from services.ws_handler_registry import list_load_options_methods
 
     return {"methods": list_load_options_methods()}
 
@@ -358,9 +361,24 @@ async def handle_get_credential_catalogue(data: Dict[str, Any], websocket: WebSo
         kind = provider.get("kind", "")
         status_hook = provider.get("status_hook")
 
-        if status_hook:
-            # Status-hook providers (whatsapp, android, twitter, google, telegram)
-            # use OAuth tokens or special connection state.
+        tokens = None
+        # Declarative per-provider override for the "stored" check.
+        # Lets Telegram (kind=oauth + status_hook but actual storage
+        # is api_key for the bot token) signal that "stored" should
+        # be ``has_valid_key("telegram_bot_token")`` rather than the
+        # default ``get_oauth_tokens(status_hook)`` lookup. Other
+        # providers don't declare ``stored_check`` and keep the
+        # original kind/status_hook-based logic untouched -- so
+        # Google's saved client_secret (password field) does NOT
+        # flip the connected dot before the user actually completes
+        # the OAuth flow.
+        stored_check = provider.get("stored_check")
+        if stored_check and stored_check.get("type") == "api_key":
+            provider["stored"] = await auth_service.has_valid_key(stored_check.get("key", pid))
+        elif status_hook:
+            # Status-hook providers (whatsapp, android, twitter, google,
+            # claude_code, codex_cli) use OAuth tokens for the runtime
+            # connection state.
             tokens = await auth_service.get_oauth_tokens(status_hook)
             provider["stored"] = tokens is not None
         elif kind == "apiKey":
@@ -373,6 +391,15 @@ async def handle_get_credential_catalogue(data: Dict[str, Any], websocket: WebSo
         else:
             provider["stored"] = False
 
+        # Surface the connected account identifier (email > display name)
+        # so the modal can render "Connected as foo@bar.com" without a
+        # per-provider status hook. Twitter / Google / Stripe / Claude
+        # all populate `email` / `name` via `auth_service.store_oauth_tokens`.
+        if tokens:
+            provider["account_label"] = tokens.get("email") or tokens.get("name")
+        else:
+            provider["account_label"] = None
+
     return catalogue
 
 
@@ -1218,35 +1245,61 @@ async def handle_get_ai_models(data: Dict[str, Any], websocket: WebSocket) -> Di
 async def handle_validate_api_key(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
     """Validate and store an API key.
 
-    Single entry point for all providers. Dispatches to provider-specific
-    validators (Google Maps geocode probe, Apify /users/me probe) for
-    non-LLM providers; otherwise falls through to the default LLM
-    ``/v1/models`` probe via ``ai_service.fetch_models``. The frontend
-    calls this one handler for every provider — no per-provider branching
-    on the TypeScript side.
+    Pure dispatch — looks up the plugin's ``Credential`` subclass in
+    ``CREDENTIAL_REGISTRY`` and calls its ``validate`` classmethod. The
+    base ``Credential.validate`` (defined in
+    ``services/plugin/credential.py``) wires the shared scaffold
+    (storage + status broadcast + error classification + response
+    envelope) and dispatches the per-provider probe via the
+    subclass-supplied ``_probe`` hook. Cloud LLM providers inherit
+    ``_LLMApiKey._probe`` (``ai_service.fetch_models``); Maps + Apify +
+    local-LLM credentials override ``_probe`` (or the whole ``validate``
+    method, in the local-LLM case) with their own bespoke probes.
+
+    The router doesn't know about specific providers — adding a new
+    provider with a special validator is a single new ``_probe``
+    override on the plugin's ``Credential`` subclass.
     """
+    from services.plugin.credential import CREDENTIAL_REGISTRY
+
     provider = data["provider"].lower()
     normalized = dict(data, provider=provider)
 
-    if provider in _SPECIAL_PROVIDER_VALIDATORS:
-        return await _SPECIAL_PROVIDER_VALIDATORS[provider](normalized, websocket)
+    cred_cls = CREDENTIAL_REGISTRY.get(provider)
+    if cred_cls is None:
+        return {
+            "success": False,
+            "valid": False,
+            "error": f"Unknown provider '{provider}' — no Credential class registered.",
+        }
+    return await cred_cls.validate(normalized)
 
-    ai_service = container.ai_service()
-    auth_service = container.auth_service()
-    broadcaster = get_status_broadcaster()
-    api_key = data["api_key"].strip()
 
-    # Fetch models for AI providers (any provider with a models_endpoint in llm_defaults.json)
-    from services.ai import PROVIDER_CONFIGS
-    models = await ai_service.fetch_models(provider, api_key) if provider in PROVIDER_CONFIGS else []
-    await auth_service.store_api_key(provider=provider, api_key=api_key, models=models,
-                                      session_id=data.get("session_id", "default"))
-    # Broadcast with hasKey and models so frontend can update reactively
-    await broadcaster.update_api_key_status(
-        provider=provider, valid=True, message="API key validated",
-        has_key=True, models=models
-    )
-    return {"provider": provider, "valid": True, "models": models, "timestamp": time.time()}
+def _lookup_credential_default(storage_key: str) -> Optional[str]:
+    """Look up a field's catalogue ``default`` for the given storage key.
+
+    Storage keys are either the provider id (``"openai"`` for cloud
+    providers whose field key is ``apiKey``) or the field key itself
+    (``"lmstudio_proxy"`` etc. for local-LLM providers). Both shapes
+    map back to a credential_providers.json field; this helper finds
+    the one and returns its ``default`` value if declared. Used by
+    ``handle_get_stored_api_key`` to surface canonical defaults
+    (e.g. local-LLM Base URL ``http://localhost:1234/v1``) to the
+    frontend without requiring per-panel pre-fill logic.
+    """
+    from services.credential_registry import get_credential_registry
+    registry = get_credential_registry()
+    for provider in registry.get_all_providers():
+        provider_id = provider.get("id") or provider.get("name", "").lower()
+        for field in (provider.get("fields") or []):
+            field_key = field.get("key")
+            if not field_key:
+                continue
+            field_storage_key = provider_id if field_key == "apiKey" else field_key
+            if field_storage_key == storage_key:
+                default = field.get("default")
+                return default if default else None
+    return None
 
 
 @ws_handler("provider")
@@ -1257,11 +1310,21 @@ async def handle_get_stored_api_key(data: Dict[str, Any], websocket: WebSocket)
     ``update_api_key_status`` broadcast shape — every WS payload the
     frontend receives for API key state uses the same convention, so no
     per-field adapter is needed on the TypeScript side.
+
+    When nothing is stored AND the catalogue declares a ``default``
+    for this field (e.g. local-LLM canonical Base URL), the default
+    value is returned in ``apiKey`` with ``hasKey: false``. The
+    frontend renders the value but tracks ``stored`` separately via
+    ``hasKey`` so the validated/connected badge stays honest. Lets
+    users click Fetch on a fresh install without retyping the URL.
     """
     auth_service = container.auth_service()
     provider = data["provider"].lower()
     api_key = await auth_service.get_api_key(provider, data.get("session_id", "default"))
     if not api_key:
+        default = _lookup_credential_default(provider)
+        if default is not None:
+            return {"provider": provider, "hasKey": False, "apiKey": default}
         return {"provider": provider, "hasKey": False}
     models = await auth_service.get_stored_models(provider, data.get("session_id", "default"))
     return {"provider": provider, "hasKey": True, "apiKey": api_key, "models": models, "timestamp": time.time()}
@@ -1283,12 +1346,20 @@ async def handle_save_api_key(data: Dict[str, Any], websocket: WebSocket) -> Dic
 
     async def _do_save() -> Dict[str, Any]:
         auth_service = container.auth_service()
+        broadcaster = get_status_broadcaster()
         await auth_service.store_api_key(
             provider=provider,
             api_key=data["api_key"].strip(),
             models=data.get("models", []),
             session_id=data.get("session_id", "default"),
         )
+        # Symmetric broadcast: tells every connected client to refetch
+        # the catalogue so the `stored` flag flips on this provider.
+        # Don't claim validity here — save_api_key doesn't validate.
+        await broadcaster.broadcast_credential_event(
+            "credential.api_key.saved",
+            provider=provider,
+        )
         return {"provider": data["provider"]}
 
     return await store.run(data.get("request_id"), _do_save)
@@ -1307,7 +1378,20 @@ async def handle_delete_api_key(data: Dict[str, Any], websocket: WebSocket) -> D
 
     async def _do_delete() -> Dict[str, Any]:
         auth_service = container.auth_service()
+        broadcaster = get_status_broadcaster()
         await auth_service.remove_api_key(provider, data.get("session_id", "default"))
+        # Two broadcasts: api_key_status clears `apiKeyStatuses[provider]`
+        # on every connected client (in-memory validation cache); the
+        # CloudEvents-typed credential.api_key.deleted invalidates the
+        # catalogue so the `stored` flag flips. Both go through the
+        # 300 ms invalidateCatalogue debounce — one refetch.
+        await broadcaster.update_api_key_status(
+            provider, valid=False, has_key=False, message="deleted", models=[],
+        )
+        await broadcaster.broadcast_credential_event(
+            "credential.api_key.deleted",
+            provider=provider,
+        )
         return {"provider": data["provider"]}
 
     return await store.run(data.get("request_id"), _do_delete)
@@ -1326,306 +1410,17 @@ async def handle_claude_oauth_login(data: Dict[str, Any], websocket: WebSocket)
 
 @ws_handler()
 async def handle_claude_oauth_status(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Check Claude OAuth credentials status."""
-    from services.claude_oauth import get_claude_credentials
-    return get_claude_credentials()
-
-
-# ============================================================================
-# Twitter OAuth Handlers
-# ============================================================================
-
-@ws_handler()
-async def handle_twitter_oauth_login(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Initiate Twitter OAuth 2.0 with PKCE flow.
-
-    Opens browser to Twitter authorization page. After user authorizes,
-    Twitter redirects to /api/twitter/callback which stores tokens.
-    """
-    from services.twitter_oauth import TwitterOAuth
-
-    auth_service = container.auth_service()
-
-    # Get stored client credentials (configured via Credentials Modal)
-    client_id = await auth_service.get_api_key("twitter_client_id")
-    client_secret = await auth_service.get_api_key("twitter_client_secret")
-
-    if not client_id:
-        return {
-            "success": False,
-            "error": "Twitter Client ID not configured. Add your Twitter API credentials first."
-        }
-
-    # Create OAuth instance and generate authorization URL
-    from services.oauth_utils import get_redirect_uri
-    redirect_uri = get_redirect_uri(websocket, "twitter")
-
-    oauth = TwitterOAuth(
-        client_id=client_id,
-        client_secret=client_secret,
-        redirect_uri=redirect_uri,
-    )
-
-    auth_data = oauth.generate_authorization_url()
-
-    return {
-        "success": True,
-        "message": "Opening Twitter authorization in browser...",
-        "url": auth_data["url"],
-        "state": auth_data["state"],
-    }
-
-
-@ws_handler()
-async def handle_twitter_oauth_status(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Check Twitter OAuth connection status.
-
-    Returns connection status and user info if connected.
-    Uses OAuth token system (matches REST endpoint in routers/twitter.py).
-    """
-    from services.twitter_oauth import TwitterOAuth
-
-    auth_service = container.auth_service()
-
-    # Get tokens from OAuth system (NOT api_key system)
-    tokens = await auth_service.get_oauth_tokens("twitter", customer_id="owner")
-
-    if not tokens or not tokens.get("access_token"):
-        return {
-            "connected": False,
-            "username": None,
-            "user_id": None,
-        }
-
-    access_token = tokens["access_token"]
-    refresh_token = tokens.get("refresh_token", "")
-
-    # Get client credentials for API calls (these are correctly stored as API keys)
-    client_id = await auth_service.get_api_key("twitter_client_id") or ""
-    client_secret = await auth_service.get_api_key("twitter_client_secret")
-
-    from services.oauth_utils import get_redirect_uri
-    redirect_uri = get_redirect_uri(websocket, "twitter")
-
-    oauth = TwitterOAuth(
-        client_id=client_id,
-        client_secret=client_secret,
-        redirect_uri=redirect_uri,
-    )
-
-    # Verify token by getting user info
-    user_info = await oauth.get_user_info(access_token)
-
-    if not user_info.get("success") and refresh_token:
-        refresh_result = await oauth.refresh_access_token(refresh_token)
-        if refresh_result.get("success"):
-            # Store refreshed tokens in OAuth system
-            await auth_service.store_oauth_tokens(
-                provider="twitter",
-                access_token=refresh_result["access_token"],
-                refresh_token=refresh_result.get("refresh_token") or refresh_token,
-                email=tokens.get("email", ""),
-                name=tokens.get("name", ""),
-                scopes=tokens.get("scopes", ""),
-                customer_id="owner",
-            )
-            # Retry user info
-            user_info = await oauth.get_user_info(refresh_result["access_token"])
-
-    if not user_info.get("success"):
-        return {
-            "connected": False,
-            "username": None,
-            "user_id": None,
-            "error": user_info.get("error"),
-        }
-
-    return {
-        "connected": True,
-        "username": user_info.get("username"),
-        "user_id": user_info.get("id"),
-        "name": user_info.get("name"),
-        "profile_image_url": user_info.get("profile_image_url"),
-        "verified": user_info.get("verified"),
-    }
-
-
-@ws_handler()
-async def handle_twitter_logout(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Disconnect Twitter by revoking tokens and clearing stored credentials.
-    Uses OAuth token system (matches REST endpoint in routers/twitter.py).
-    """
-    from services.twitter_oauth import TwitterOAuth
-
-    auth_service = container.auth_service()
-
-    # Get tokens from OAuth system
-    tokens = await auth_service.get_oauth_tokens("twitter", customer_id="owner")
-    access_token = tokens.get("access_token") if tokens else None
-    refresh_token = tokens.get("refresh_token") if tokens else None
-
-    # Get client credentials (correctly stored as API keys)
-    client_id = await auth_service.get_api_key("twitter_client_id") or ""
-    client_secret = await auth_service.get_api_key("twitter_client_secret")
-
-    # Revoke tokens if we have them
-    if access_token or refresh_token:
-        from services.oauth_utils import get_redirect_uri
-        redirect_uri = get_redirect_uri(websocket, "twitter")
-
-        oauth = TwitterOAuth(
-            client_id=client_id,
-            client_secret=client_secret,
-            redirect_uri=redirect_uri,
-        )
-
-        if access_token:
-            await oauth.revoke_token(access_token, "access_token")
-        if refresh_token:
-            await oauth.revoke_token(refresh_token, "refresh_token")
-
-    # Clear from OAuth system
-    await auth_service.remove_oauth_tokens("twitter", customer_id="owner")
-
-    # Clean up any stale API key entries (from old broken code)
-    for key in ["twitter_access_token", "twitter_refresh_token", "twitter_user_info"]:
-        try:
-            await auth_service.remove_api_key(key)
-        except Exception:
-            pass
-
-    return {"success": True, "message": "Twitter disconnected"}
-
-
-# ============================================================================
-# Google Workspace OAuth Handlers
-# ============================================================================
-
-@ws_handler()
-async def handle_google_oauth_login(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Initiate Google Workspace OAuth 2.0 flow.
-
-    Opens browser to Google authorization page. After user authorizes,
-    Google redirects to /api/google/callback which stores tokens.
-    Grants access to all Google Workspace services (Gmail, Calendar, Drive, etc).
-    """
-    from services.google_oauth import GoogleOAuth
-
-    auth_service = container.auth_service()
-
-    client_id = await auth_service.get_api_key("google_client_id")
-    client_secret = await auth_service.get_api_key("google_client_secret")
-
-    if not client_id or not client_secret:
-        return {
-            "success": False,
-            "error": "Google Workspace Client ID and Secret not configured. Add your Google API credentials first."
-        }
-
-    from services.oauth_utils import get_redirect_uri
-    redirect_uri = get_redirect_uri(websocket, "google")
+    """Check Claude OAuth credentials status via ``claude auth status``."""
+    from services.claude_oauth import claude_auth_status
+    has_token = await claude_auth_status()
+    return {"success": True, "has_token": has_token}
 
-    oauth = GoogleOAuth(
-        client_id=client_id,
-        client_secret=client_secret,
-        redirect_uri=redirect_uri,
-    )
 
-    auth_data = oauth.generate_authorization_url()
+# NOTE: `cli_login` / `cli_auth_status` handlers are owned by
+# `services/cli_agent/_handlers.py` and self-registered into
+# `services.ws_handler_registry` on package import — no entries needed
+# here. See `services/cli_agent/__init__.py`.
 
-    return {
-        "success": True,
-        "message": "Opening Google authorization in browser...",
-        "url": auth_data["url"],
-        "state": auth_data["state"],
-    }
-
-
-@ws_handler()
-async def handle_google_oauth_status(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Check Google Workspace OAuth connection status.
-
-    Returns connection status and user info if connected.
-    Also updates broadcaster status so all clients stay in sync.
-    """
-    from services.google_oauth import GoogleOAuth
-    from services.status_broadcaster import get_status_broadcaster
-
-    auth_service = container.auth_service()
-    broadcaster = get_status_broadcaster()
-
-    tokens = await auth_service.get_oauth_tokens("google", customer_id="owner")
-
-    if not tokens or not tokens.get("access_token"):
-        status = {"connected": False, "email": None, "name": None}
-        broadcaster._status["google"] = status
-        return status
-
-    email = tokens.get("email")
-    name = tokens.get("name")
-    refresh_token = tokens.get("refresh_token")
-
-    # Try to refresh token proactively
-    try:
-        client_id = await auth_service.get_api_key("google_client_id") or ""
-        client_secret = await auth_service.get_api_key("google_client_secret") or ""
-
-        if refresh_token and client_id and client_secret:
-            refreshed = GoogleOAuth.refresh_credentials(
-                refresh_token=refresh_token,
-                client_id=client_id,
-                client_secret=client_secret,
-            )
-            if refreshed.get("success") and refreshed.get("access_token"):
-                await auth_service.store_oauth_tokens(
-                    provider="google",
-                    access_token=refreshed["access_token"],
-                    refresh_token=refresh_token,
-                    email=email,
-                    name=name,
-                    customer_id="owner",
-                )
-
-        status = {"connected": True, "email": email, "name": name}
-        broadcaster._status["google"] = status
-        # Broadcast so all connected clients update
-        await broadcaster.broadcast({
-            "type": "google_status",
-            "data": status,
-        })
-        return status
-    except Exception as e:
-        logger.warning(f"Google token validation failed: {e}")
-        status = {"connected": False, "email": None, "name": None, "error": str(e)}
-        broadcaster._status["google"] = {"connected": False, "email": None, "name": None}
-        return status
-
-
-@ws_handler()
-async def handle_google_logout(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """
-    Disconnect Google Workspace by clearing stored credentials.
-    """
-    from services.status_broadcaster import get_status_broadcaster
-
-    auth_service = container.auth_service()
-    broadcaster = get_status_broadcaster()
-
-    await auth_service.remove_oauth_tokens("google", customer_id="owner")
-
-    # Clear broadcaster status and notify all clients
-    broadcaster._status["google"] = {"connected": False, "email": None, "name": None}
-    await broadcaster.broadcast({
-        "type": "google_status",
-        "data": {"connected": False, "email": None, "name": None},
-    })
-
-    return {"success": True, "message": "Google Workspace disconnected"}
 
 
 @ws_handler("url")
@@ -1666,458 +1461,22 @@ async def handle_test_ai_proxy(data: Dict[str, Any], websocket: WebSocket) -> Di
 
 
 # ============================================================================
-# Android Handlers
-# ============================================================================
-
-@ws_handler()
-async def handle_get_android_devices(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get list of connected Android devices."""
-    android_service = container.android_service()
-    devices = await android_service.list_devices()
-    return {"devices": devices, "timestamp": time.time()}
-
-
-@ws_handler("service_id", "action")
-async def handle_execute_android_action(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Execute an Android service action."""
-    android_service = container.android_service()
-    broadcaster = get_status_broadcaster()
-    service_id, action = data["service_id"], data["action"]
-    node_id = data.get("node_id", f"android_{service_id}_{action}")
-
-    await broadcaster.update_node_status(node_id, "executing")
-    result = await android_service.execute_service(
-        node_id=node_id, service_id=service_id, action=action,
-        parameters=data.get("parameters", {}),
-        android_host=data.get("android_host", "localhost"),
-        android_port=data.get("android_port", 8888)
-    )
-
-    status = "success" if result.get("success") else "error"
-    await broadcaster.update_node_status(node_id, status, result.get("result") or {"error": result.get("error")})
-    return result
-
-
-@ws_handler()
-async def handle_android_relay_connect(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Connect to Android relay server.
-
-    Establishes WebSocket connection to relay server and broadcasts QR code for pairing.
-    Status updates are automatically broadcast via the relay client's broadcaster integration.
-    """
-    from services.android import get_relay_client
-
-    url = data.get("url", "")
-    api_key = data.get("api_key")
-
-    if not url:
-        return {
-            "success": False,
-            "connected": False,
-            "error": "Relay URL is required"
-        }
-
-    if not api_key:
-        return {
-            "success": False,
-            "connected": False,
-            "error": "API key is required"
-        }
-
-    logger.info(f"[WebSocket] Android relay connect: {url}")
-
-    try:
-        client, error = await get_relay_client(url, api_key)
-        if client:
-            logger.info(f"[WebSocket] Android relay connect success, qr_data present: {bool(client.qr_data)}, session_token: {client.session_token}")
-            return {
-                "success": True,
-                "connected": True,
-                "session_token": client.session_token,
-                "qr_data": client.qr_data,
-                "message": "Connected to relay server"
-            }
-        else:
-            return {
-                "success": False,
-                "connected": False,
-                "error": error or "Failed to connect to relay server"
-            }
-    except Exception as e:
-        logger.error(f"[WebSocket] Android relay connect error: {e}")
-        return {"success": False, "error": str(e)}
-
-
-@ws_handler()
-async def handle_android_relay_disconnect(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Disconnect from Android relay server.
-
-    Closes the relay WebSocket connection and broadcasts disconnected status.
-    """
-    from services.android import close_relay_client
-
-    logger.info("[WebSocket] Android relay disconnect requested")
-
-    try:
-        await close_relay_client()
-        return {
-            "success": True,
-            "connected": False,
-            "message": "Disconnected from relay server"
-        }
-    except Exception as e:
-        logger.error(f"[WebSocket] Android relay disconnect error: {e}")
-        return {"success": False, "error": str(e)}
-
-
-@ws_handler()
-async def handle_android_relay_reconnect(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Reconnect to Android relay server with a new session token.
-
-    Forces disconnect and reconnect to get fresh session_token and QR code.
-    Useful when pairing fails or Android device needs to re-pair.
-    """
-    from services.android import close_relay_client, get_relay_client
-
-    url = data.get("url", "")
-    api_key = data.get("api_key")
-
-    if not url:
-        return {
-            "success": False,
-            "connected": False,
-            "error": "Relay URL is required"
-        }
-
-    if not api_key:
-        return {
-            "success": False,
-            "connected": False,
-            "error": "API key is required"
-        }
-
-    logger.info("[WebSocket] Android relay reconnect: forcing new session")
-
-    try:
-        # Force disconnect existing connection
-        await close_relay_client()
-
-        # Small delay to ensure clean disconnect
-        await asyncio.sleep(0.5)
-
-        # Reconnect with fresh session
-        client, error = await get_relay_client(url, api_key)
-        if client:
-            return {
-                "success": True,
-                "connected": True,
-                "session_token": client.session_token,
-                "qr_data": client.qr_data,
-                "message": "Reconnected with new session token"
-            }
-        else:
-            return {
-                "success": False,
-                "connected": False,
-                "error": error or "Failed to reconnect to relay server"
-            }
-    except Exception as e:
-        logger.error(f"[WebSocket] Android relay reconnect error: {e}")
-        return {"success": False, "error": str(e)}
-
-
-# ============================================================================
-# Maps Handlers
-# ============================================================================
-
-async def handle_validate_maps_key(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Validate Google Maps API key and save to database if valid."""
-    import httpx
-    broadcaster = get_status_broadcaster()
-    auth_service = container.auth_service()
-
-    api_key = data.get("api_key", "").strip()
-    session_id = data.get("session_id", "default")
-
-    if not api_key:
-        return {"success": False, "valid": False, "error": "api_key required"}
-
-    try:
-        # Test the API key with a simple geocoding request
-        async with httpx.AsyncClient() as client:
-            response = await client.get(
-                "https://maps.googleapis.com/maps/api/geocode/json",
-                params={
-                    "address": "1600 Amphitheatre Parkway, Mountain View, CA",
-                    "key": api_key
-                },
-                timeout=10.0
-            )
-
-            response_data = response.json()
-
-            if response_data.get("status") == "OK":
-                # Save the validated key to database
-                await auth_service.store_api_key(
-                    provider="google_maps",
-                    api_key=api_key,
-                    models=[],
-                    session_id=session_id
-                )
-                await broadcaster.update_api_key_status(
-                    provider="google_maps",
-                    valid=True,
-                    message="API key validated successfully"
-                )
-                return {"success": True, "valid": True, "message": "Google Maps API key is valid"}
-
-            elif response_data.get("status") == "REQUEST_DENIED":
-                error_msg = response_data.get("error_message", "Invalid API key")
-                await broadcaster.update_api_key_status(
-                    provider="google_maps",
-                    valid=False,
-                    message=error_msg
-                )
-                return {"success": True, "valid": False, "message": error_msg}
-
-            else:
-                # Other statuses like ZERO_RESULTS still mean the key works
-                # Save the validated key to database
-                await auth_service.store_api_key(
-                    provider="google_maps",
-                    api_key=api_key,
-                    models=[],
-                    session_id=session_id
-                )
-                await broadcaster.update_api_key_status(
-                    provider="google_maps",
-                    valid=True,
-                    message="API key validated"
-                )
-                return {"success": True, "valid": True, "message": f"API key is valid (status: {response_data.get('status')})"}
-
-    except httpx.TimeoutException:
-        await broadcaster.update_api_key_status(
-            provider="google_maps",
-            valid=False,
-            message="Validation request timed out"
-        )
-        return {"success": False, "valid": False, "error": "Validation request timed out"}
-
-    except Exception as e:
-        logger.error("Maps key validation failed", error=str(e))
-        await broadcaster.update_api_key_status(
-            provider="google_maps",
-            valid=False,
-            message=str(e)
-        )
-        return {"success": False, "valid": False, "error": str(e)}
-
-
-# ============================================================================
-# Apify Handlers
+# Android handlers (5 of them: get_android_devices, execute_android_action,
+# android_relay_{connect,disconnect,reconnect}) live in
+# ``nodes/android/_handlers.py`` and self-register via
+# ``register_ws_handlers``. The plugin's HTTP router lives in
+# ``nodes/android/_router.py`` and mounts via the plugin-router loop.
 # ============================================================================
 
-async def handle_validate_apify_key(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Validate Apify API token and save to database if valid."""
-    from nodes.scraper.apify_actor import validate_apify_token
-
-    broadcaster = get_status_broadcaster()
-    auth_service = container.auth_service()
-
-    api_key = data.get("api_key", "").strip()
-    session_id = data.get("session_id", "default")
-
-    if not api_key:
-        return {"success": False, "valid": False, "error": "api_key required"}
-
-    try:
-        result = await validate_apify_token(api_key)
-
-        if result.get("valid"):
-            # Save the validated key to database
-            await auth_service.store_api_key(
-                provider="apify",
-                api_key=api_key,
-                models=[],
-                session_id=session_id
-            )
-            await broadcaster.update_api_key_status(
-                provider="apify",
-                valid=True,
-                message=f"Apify token validated - user: {result.get('username', 'unknown')}"
-            )
-            return {
-                "success": True,
-                "valid": True,
-                "message": "Apify API token is valid",
-                "username": result.get("username"),
-                "email": result.get("email"),
-                "plan": result.get("plan")
-            }
-        else:
-            error_msg = result.get("error", "Invalid API token")
-            await broadcaster.update_api_key_status(
-                provider="apify",
-                valid=False,
-                message=error_msg
-            )
-            return {"success": True, "valid": False, "message": error_msg}
-
-    except Exception as e:
-        logger.error("Apify key validation failed", error=str(e))
-        await broadcaster.update_api_key_status(
-            provider="apify",
-            valid=False,
-            message=str(e)
-        )
-        return {"success": False, "valid": False, "error": str(e)}
 
-
-# Per-provider validation strategies. Register any non-LLM provider here
-# and `handle_validate_api_key` will dispatch to it automatically, so the
-# frontend only ever calls one WS message type.
-_SPECIAL_PROVIDER_VALIDATORS = {
-    "google_maps": handle_validate_maps_key,
-    "apify": handle_validate_apify_key,
-}
-
-
-# ============================================================================
-# WhatsApp Handlers - Wrappers for services.whatsapp_service functions
-# ============================================================================
-
-from services.whatsapp_service import (
-    handle_whatsapp_status as _wa_status,
-    handle_whatsapp_connected_phone as _wa_connected_phone,
-    handle_whatsapp_qr as _wa_qr,
-    handle_whatsapp_send as _wa_send,
-    handle_whatsapp_start as _wa_start,
-    handle_whatsapp_restart as _wa_restart,
-    handle_whatsapp_groups as _wa_groups,
-    handle_whatsapp_group_info as _wa_group_info,
-    handle_whatsapp_chat_history as _wa_chat_history,
-    handle_whatsapp_newsletters as _wa_newsletters,
-    whatsapp_rpc_call as _wa_rpc_call,
-)
-
-
-async def handle_whatsapp_status(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    return await _wa_status()
-
-
-async def handle_whatsapp_connected_phone(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get the connected WhatsApp phone number."""
-    return await _wa_connected_phone()
-
-
-async def handle_whatsapp_qr(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    return await _wa_qr()
-
-
-async def handle_whatsapp_send(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Forward all send params to WhatsApp handler - supports all message types."""
-    return await _wa_send(data)
-
-
-async def handle_whatsapp_start(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    return await _wa_start()
-
-
-async def handle_whatsapp_restart(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    return await _wa_restart()
-
-
-async def handle_whatsapp_groups(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    return await _wa_groups()
-
-
-async def handle_whatsapp_newsletters(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get list of subscribed newsletter channels."""
-    return await _wa_newsletters()
-
-
-async def handle_whatsapp_group_info(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get group participants with resolved phone numbers."""
-    group_id = data.get("group_id", "")
-    return await _wa_group_info(group_id)
-
-
-async def handle_whatsapp_chat_history(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get chat history from WhatsApp history store."""
-    return await _wa_chat_history(data)
-
-
-async def handle_whatsapp_rate_limit_get(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get rate limit config and current stats."""
-    result = await _wa_rpc_call("rate_limit_get", {})
-    return result
-
-
-async def handle_whatsapp_rate_limit_set(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Update rate limit configuration."""
-    config = data.get("config", {})
-    result = await _wa_rpc_call("rate_limit_set", config)
-    return result
-
-
-async def handle_whatsapp_rate_limit_stats(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get current rate limit statistics."""
-    result = await _wa_rpc_call("rate_limit_stats", {})
-    return result
-
-
-async def handle_whatsapp_rate_limit_unpause(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Resume rate limiting after automatic pause."""
-    result = await _wa_rpc_call("rate_limit_unpause", {})
-    return result
-
-
-async def handle_whatsapp_mark_read(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Mark messages as read. Schema: mark_read({message_ids, chat_jid, sender_jid?})"""
-    message_ids = data.get("message_ids", [])
-    chat_jid = data.get("chat_jid", "")
-    if not message_ids or not chat_jid:
-        return {"success": False, "error": "message_ids (array) and chat_jid are required"}
-    params: Dict[str, Any] = {"message_ids": message_ids, "chat_jid": chat_jid}
-    sender_jid = data.get("sender_jid")
-    if sender_jid:
-        params["sender_jid"] = sender_jid
-    result = await _wa_rpc_call("mark_read", params)
-    return result
-
-
-async def handle_whatsapp_typing(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Send typing indicator. Schema: typing({jid, state: 'composing'|'paused', media?})"""
-    jid = data.get("jid", "")
-    state = data.get("state", "composing")
-    if not jid:
-        return {"success": False, "error": "jid is required"}
-    params: Dict[str, Any] = {"jid": jid, "state": state}
-    media = data.get("media")
-    if media:
-        params["media"] = media
-    result = await _wa_rpc_call("typing", params)
-    return result
-
-
-async def handle_whatsapp_presence(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Set online/offline presence. Schema: presence({status: 'available'|'unavailable'})"""
-    status = data.get("status", "available")
-    result = await _wa_rpc_call("presence", {"status": status})
-    return result
-
-
-async def handle_whatsapp_stop(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Graceful WhatsApp shutdown."""
-    result = await _wa_rpc_call("stop", {})
-    return result
-
-
-async def handle_whatsapp_diagnostics(data: Dict[str, Any], websocket: WebSocket) -> Dict[str, Any]:
-    """Get WhatsApp diagnostics/debug info."""
-    result = await _wa_rpc_call("diagnostics", {})
-    return result
+# ----------------------------------------------------------------------------
+# Per-provider credential validators (Maps geocode probe, Apify /users/me,
+# Ollama / LM Studio SDK probes) live on their plugins Credential
+# subclass via the shared Credential._probe / Credential.validate scaffold
+# in services/plugin/credential.py. handle_validate_api_key (above) is a
+# pure dispatch through CREDENTIAL_REGISTRY  no per-provider branches in
+# this router.
+# ----------------------------------------------------------------------------
 
 
 # ============================================================================
@@ -2736,17 +2095,25 @@ async def handle_clear_memory(data: Dict[str, Any], websocket: WebSocket) -> Dic
 
     Business logic lives in :func:`services.memory.clear_agent_session_state`
     — this handler only decodes the request and shapes the response.
+
+    When ``memory_node_id`` is provided (claude_code_agent JSONL bridge
+    surface), the simpleMemory node's ``memory_content`` is reset and
+    ``memory_jsonl`` + ``last_session_id`` are wiped server-side. Legacy
+    callers that omit it still get ``default_content`` for the
+    frontend's existing markdown reset path.
     """
     from services.memory import clear_agent_session_state
 
     session_id = data.get("session_id", "default")
     workflow_id = data.get("workflow_id")
     clear_long_term = data.get("clear_long_term", False)
+    memory_node_id = data.get("memory_node_id")
 
-    cleared = clear_agent_session_state(
+    cleared = await clear_agent_session_state(
         session_id=session_id,
         workflow_id=workflow_id,
         clear_long_term=clear_long_term,
+        memory_node_id=memory_node_id,
     )
 
     return {
@@ -2754,6 +2121,7 @@ async def handle_clear_memory(data: Dict[str, Any], websocket: WebSocket) -> Dic
         "default_content": "# Conversation History\n\n*No messages yet.*\n",
         "cleared_vector_store": cleared["cleared_vector_store"],
         "cleared_todo_keys": cleared["cleared_todo_keys"],
+        "cleared_memory_node": cleared["cleared_memory_node"],
         "session_id": session_id,
     }
 
@@ -3326,48 +2694,19 @@ MESSAGE_HANDLERS: Dict[str, MessageHandler] = {
     "claude_oauth_status": handle_claude_oauth_status,
 
     # Twitter OAuth operations
-    "twitter_oauth_login": handle_twitter_oauth_login,
-    "twitter_oauth_status": handle_twitter_oauth_status,
-    "twitter_logout": handle_twitter_logout,
 
     # Google Workspace OAuth operations
-    "google_oauth_login": handle_google_oauth_login,
-    "google_oauth_status": handle_google_oauth_status,
-    "google_logout": handle_google_logout,
 
     # Android operations
-    "get_android_devices": handle_get_android_devices,
-    "execute_android_action": handle_execute_android_action,
-    "android_relay_connect": handle_android_relay_connect,
-    "android_relay_disconnect": handle_android_relay_disconnect,
-    "android_relay_reconnect": handle_android_relay_reconnect,
-
-    # Maps operations
-    "validate_maps_key": handle_validate_maps_key,
 
-    # Apify operations
-    "validate_apify_key": handle_validate_apify_key,
+    # Maps + Apify validation now flow through ``handle_validate_api_key``
+    # (which dispatches via ``CREDENTIAL_REGISTRY`` to
+    # ``GoogleMapsCredential._probe`` / ``ApifyCredential._probe``).
+    # The legacy ``validate_maps_key`` / ``validate_apify_key`` WS message
+    # types are no longer needed — the frontend already uses
+    # ``validate_api_key`` for all providers.
 
     # WhatsApp operations
-    "whatsapp_status": handle_whatsapp_status,
-    "whatsapp_connected_phone": handle_whatsapp_connected_phone,
-    "whatsapp_qr": handle_whatsapp_qr,
-    "whatsapp_send": handle_whatsapp_send,
-    "whatsapp_start": handle_whatsapp_start,
-    "whatsapp_restart": handle_whatsapp_restart,
-    "whatsapp_groups": handle_whatsapp_groups,
-    "whatsapp_newsletters": handle_whatsapp_newsletters,
-    "whatsapp_group_info": handle_whatsapp_group_info,
-    "whatsapp_chat_history": handle_whatsapp_chat_history,
-    "whatsapp_rate_limit_get": handle_whatsapp_rate_limit_get,
-    "whatsapp_rate_limit_set": handle_whatsapp_rate_limit_set,
-    "whatsapp_rate_limit_stats": handle_whatsapp_rate_limit_stats,
-    "whatsapp_rate_limit_unpause": handle_whatsapp_rate_limit_unpause,
-    "whatsapp_mark_read": handle_whatsapp_mark_read,
-    "whatsapp_typing": handle_whatsapp_typing,
-    "whatsapp_presence": handle_whatsapp_presence,
-    "whatsapp_stop": handle_whatsapp_stop,
-    "whatsapp_diagnostics": handle_whatsapp_diagnostics,
 
     # Telegram operations live in nodes/telegram/_handlers.py and
     # self-register via services.ws_handler_registry. Dispatch hits them