vellum 0.2.0 → 0.2.2

package/src/daemon/handlers/index.ts

@@ -3,114 +3,23 @@ import type { ClientMessage } from '../ipc-protocol.js';
 import { handleRideShotgunStart, handleRideShotgunStop } from '../ride-shotgun-handler.js';
 import { handleWatchObservation } from '../watch-handler.js';
 import { handleOpenBundle } from './open-bundle-handler.js';
-import { log, pendingSignBundlePayload, pendingSigningIdentity, type HandlerContext } from './shared.js';
-import { browserManager } from '../../tools/browser/browser-manager.js';
-
-import {
-  handleUserMessage,
-  handleConfirmationResponse,
-  handleSecretResponse,
-  handleSessionList,
-  handleSessionsClear,
-  handleSessionCreate,
-  handleSessionSwitch,
-  handleCancel,
-  handleDeleteQueuedMessage,
-  handleHistoryRequest,
-  handleUndo,
-  handleRegenerate,
-  handleUsageRequest,
-  handleSandboxSet,
-} from './sessions.js';
-
-import {
-  handleSkillsList,
-  handleSkillDetail,
-  handleSkillsEnable,
-  handleSkillsDisable,
-  handleSkillsConfigure,
-  handleSkillsInstall,
-  handleSkillsUninstall,
-  handleSkillsUpdate,
-  handleSkillsCheckUpdates,
-  handleSkillsSearch,
-  handleSkillsInspect,
-} from './skills.js';
-
-import {
-  handleAppDataRequest,
-  handleAppOpenRequest,
-  handleAppUpdatePreview,
-  handleAppPreview,
-  handleAppsList,
-  handleSharedAppsList,
-  handleSharedAppDelete,
-  handleForkSharedApp,
-  handleShareAppCloud,
-  handleBundleApp,
-  handleGalleryList,
-  handleGalleryInstall,
-} from './apps.js';
-
-import {
-  handleModelGet,
-  handleModelSet,
-  handleAddTrustRule,
-  handleTrustRulesList,
-  handleRemoveTrustRule,
-  handleUpdateTrustRule,
-  handleAcceptStarterBundle,
-  handleSchedulesList,
-  handleScheduleToggle,
-  handleScheduleRemove,
-  handleRemindersList,
-  handleReminderCancel,
-  handleShareToSlack,
-  handleSlackWebhookConfig,
-  handleVercelApiConfig,
-  handleEnvVarsRequest,
-} from './config.js';
-
-import {
-  handleCuSessionCreate,
-  handleCuSessionAbort,
-  handleCuObservation,
-} from './computer-use.js';
-
-import {
-  handlePublishPage,
-  handleUnpublishPage,
-} from './publish.js';
-import { handleHomeBaseGet } from './home-base.js';
-import { handleDiagnosticsExport } from './diagnostics.js';
-
-import {
-  handleTaskSubmit,
-  handleSuggestionRequest,
-  handleLinkOpenRequest,
-  handleIpcBlobProbe,
-} from './misc.js';
-
-import {
-  handleDocumentSave,
-  handleDocumentLoad,
-  handleDocumentList,
-} from './documents.js';
-
-import {
-  handleWorkItemsList,
-  handleWorkItemGet,
-  handleWorkItemCreate,
-  handleWorkItemUpdate,
-  handleWorkItemComplete,
-  handleWorkItemRunTask,
-} from './work-items.js';
-
-import {
-  handleSubagentAbort,
-  handleSubagentStatus,
-  handleSubagentMessage,
-} from './subagents.js';
+import { log, defineHandlers, type HandlerContext, type DispatchMap } from './shared.js';
+
+import { sessionHandlers } from './sessions.js';
+import { skillHandlers } from './skills.js';
+import { appHandlers } from './apps.js';
+import { configHandlers } from './config.js';
+import { computerUseHandlers } from './computer-use.js';
+import { publishHandlers } from './publish.js';
+import { homeBaseHandlers } from './home-base.js';
+import { diagnosticsHandlers } from './diagnostics.js';
+import { miscHandlers } from './misc.js';
+import { documentHandlers } from './documents.js';
+import { workItemHandlers } from './work-items.js';
+import { subagentHandlers } from './subagents.js';
+import { browserHandlers } from './browser.js';
+import { signingHandlers } from './signing.js';
+import { twitterAuthHandlers } from './twitter-auth.js';
 
 // Re-export types and utilities for backwards compatibility
 export type {
@@ -129,105 +38,13 @@ export {
 
 // ─── Typed dispatch ──────────────────────────────────────────────────────────
 
-type MessageType = ClientMessage['type'];
-// 'auth' is handled at the transport layer (server.ts) and never reaches dispatch.
-type DispatchableType = Exclude<MessageType, 'auth'>;
-type MessageOfType<T extends MessageType> = Extract<ClientMessage, { type: T }>;
-type MessageHandler<T extends MessageType> = (
-  msg: MessageOfType<T>,
-  socket: net.Socket,
-  ctx: HandlerContext,
-) => void | Promise<void>;
-type DispatchMap = { [T in DispatchableType]: MessageHandler<T> };
-
-const handlers: DispatchMap = {
-  user_message: handleUserMessage,
-  confirmation_response: handleConfirmationResponse,
-  secret_response: handleSecretResponse,
-  session_list: (_msg, socket, ctx) => handleSessionList(socket, ctx),
-  session_create: handleSessionCreate,
-  sessions_clear: (_msg, socket, ctx) => handleSessionsClear(socket, ctx),
-  session_switch: handleSessionSwitch,
-  cancel: handleCancel,
-  delete_queued_message: handleDeleteQueuedMessage,
-  model_get: (_msg, socket, ctx) => handleModelGet(socket, ctx),
-  model_set: handleModelSet,
-  history_request: handleHistoryRequest,
-  undo: handleUndo,
-  regenerate: handleRegenerate,
-  usage_request: handleUsageRequest,
-  sandbox_set: handleSandboxSet,
-  cu_session_create: handleCuSessionCreate,
-  cu_session_abort: handleCuSessionAbort,
-  cu_observation: handleCuObservation,
+// Inline handlers for messages not owned by any feature group
+const inlineHandlers = defineHandlers({
   ride_shotgun_start: handleRideShotgunStart,
   ride_shotgun_stop: handleRideShotgunStop,
   watch_observation: handleWatchObservation,
-  task_submit: handleTaskSubmit,
-  app_data_request: handleAppDataRequest,
-  skills_list: (_msg, socket, ctx) => handleSkillsList(socket, ctx),
-  skill_detail: handleSkillDetail,
-  skills_enable: handleSkillsEnable,
-  skills_disable: handleSkillsDisable,
-  skills_configure: handleSkillsConfigure,
-  skills_install: handleSkillsInstall,
-  skills_uninstall: handleSkillsUninstall,
-  skills_update: handleSkillsUpdate,
-  skills_check_updates: handleSkillsCheckUpdates,
-  skills_search: handleSkillsSearch,
-  skills_inspect: handleSkillsInspect,
-  suggestion_request: handleSuggestionRequest,
-  add_trust_rule: handleAddTrustRule,
-  trust_rules_list: (_msg, socket, ctx) => handleTrustRulesList(socket, ctx),
-  remove_trust_rule: handleRemoveTrustRule,
-  update_trust_rule: handleUpdateTrustRule,
-  accept_starter_bundle: (_msg, socket, ctx) => handleAcceptStarterBundle(socket, ctx),
-  schedules_list: (_msg, socket, ctx) => handleSchedulesList(socket, ctx),
-  schedule_toggle: handleScheduleToggle,
-  schedule_remove: handleScheduleRemove,
-  reminders_list: (_msg, socket, ctx) => handleRemindersList(socket, ctx),
-  reminder_cancel: handleReminderCancel,
-  share_app_cloud: handleShareAppCloud,
-  bundle_app: handleBundleApp,
   open_bundle: handleOpenBundle,
-  app_open_request: (msg, socket, ctx) => handleAppOpenRequest(msg, socket, ctx),
-  app_update_preview: handleAppUpdatePreview,
-  apps_list: (_msg, socket, ctx) => handleAppsList(socket, ctx),
-  app_preview_request: handleAppPreview,
-  home_base_get: handleHomeBaseGet,
-  shared_apps_list: (_msg, socket, ctx) => handleSharedAppsList(socket, ctx),
-  shared_app_delete: handleSharedAppDelete,
-  fork_shared_app: handleForkSharedApp,
-  sign_bundle_payload_response: (msg) => {
-    const pending = pendingSignBundlePayload.get(msg.requestId);
-    if (pending) {
-      clearTimeout(pending.timer);
-      pendingSignBundlePayload.delete(msg.requestId);
-      pending.resolve({ signature: msg.signature, keyId: msg.keyId, publicKey: msg.publicKey });
-    } else {
-      log.warn({ requestId: msg.requestId }, 'Received sign_bundle_payload_response with no pending request');
-    }
-  },
-  get_signing_identity_response: (msg) => {
-    const pending = pendingSigningIdentity.get(msg.requestId);
-    if (pending) {
-      clearTimeout(pending.timer);
-      pendingSigningIdentity.delete(msg.requestId);
-      pending.resolve({ keyId: msg.keyId, publicKey: msg.publicKey });
-    } else {
-      log.warn({ requestId: msg.requestId }, 'Received get_signing_identity_response with no pending request');
-    }
-  },
-  gallery_list: (_msg, socket, ctx) => handleGalleryList(socket, ctx),
-  gallery_install: handleGalleryInstall,
-  share_to_slack: handleShareToSlack,
-  slack_webhook_config: handleSlackWebhookConfig,
-  vercel_api_config: handleVercelApiConfig,
-  publish_page: handlePublishPage,
-  unpublish_page: handleUnpublishPage,
-  ping: (_msg, socket, ctx) => { ctx.send(socket, { type: 'pong' }); },
-  link_open_request: handleLinkOpenRequest,
-  ipc_blob_probe: handleIpcBlobProbe,
+
   ui_surface_action: (msg, _socket, ctx) => {
     const cuSession = ctx.cuSessions.get(msg.sessionId);
     if (cuSession) {
@@ -251,15 +68,6 @@ const handlers: DispatchMap = {
     }
     log.warn({ sessionId: msg.sessionId, surfaceId: msg.surfaceId }, 'No session found for surface undo');
   },
-  diagnostics_export_request: handleDiagnosticsExport,
-  env_vars_request: (_msg, socket, ctx) => handleEnvVarsRequest(socket, ctx),
-  document_save: handleDocumentSave,
-  document_load: handleDocumentLoad,
-  document_list: handleDocumentList,
-
-  browser_cdp_response: (msg) => {
-    browserManager.resolveCDPResponse(msg.sessionId, msg.success, msg.declined);
-  },
 
   // Stub handlers: the integration registry was removed but the Swift client
   // still sends these messages. Return safe no-op responses so the client
@@ -275,66 +83,27 @@ const handlers: DispatchMap = {
       error: 'Please use chat to connect integrations.',
     });
   },
-
-  browser_user_click: async (msg) => {
-    try {
-      const page = await browserManager.getOrCreateSessionPage(msg.sessionId);
-      const viewport = await page.evaluate('(() => ({ vw: window.innerWidth, vh: window.innerHeight }))()') as { vw: number; vh: number };
-      const scale = Math.min(1280 / viewport.vw, 960 / viewport.vh);
-      const pageX = msg.x / scale;
-      const pageY = msg.y / scale;
-      const options: Record<string, unknown> = {};
-      if (msg.button === 'right') options.button = 'right';
-      if (msg.doubleClick) options.clickCount = 2;
-      await page.mouse.click(pageX, pageY, options);
-    } catch (err) {
-      log.warn({ err, sessionId: msg.sessionId }, 'Failed to forward user click');
-    }
-  },
-
-  browser_user_scroll: async (msg) => {
-    try {
-      const page = await browserManager.getOrCreateSessionPage(msg.sessionId);
-      await page.mouse.wheel(msg.deltaX, msg.deltaY);
-    } catch (err) {
-      log.warn({ err, sessionId: msg.sessionId }, 'Failed to forward user scroll');
-    }
-  },
-
-  browser_user_keypress: async (msg) => {
-    try {
-      const page = await browserManager.getOrCreateSessionPage(msg.sessionId);
-      const combo = msg.modifiers?.length ? [...msg.modifiers, msg.key].join('+') : msg.key;
-      await page.keyboard.press(combo);
-    } catch (err) {
-      log.warn({ err, sessionId: msg.sessionId }, 'Failed to forward user keypress');
-    }
-  },
-
-  browser_interactive_mode: (msg, socket, ctx) => {
-    log.info({ sessionId: msg.sessionId, enabled: msg.enabled }, 'Interactive mode toggled');
-    browserManager.setInteractiveMode(msg.sessionId, msg.enabled);
-    ctx.send(socket, {
-      type: 'browser_interactive_mode_changed',
-      sessionId: msg.sessionId,
-      surfaceId: msg.surfaceId,
-      enabled: msg.enabled,
-    });
-  },
-
   integration_disconnect: () => { /* no-op — integration registry removed */ },
-
-  work_items_list: handleWorkItemsList,
-  work_item_get: handleWorkItemGet,
-  work_item_create: handleWorkItemCreate,
-  work_item_update: handleWorkItemUpdate,
-  work_item_complete: handleWorkItemComplete,
-  work_item_run_task: handleWorkItemRunTask,
-
-  subagent_abort: handleSubagentAbort,
-  subagent_status: handleSubagentStatus,
-  subagent_message: handleSubagentMessage,
-};
+});
+
+const handlers = {
+  ...sessionHandlers,
+  ...skillHandlers,
+  ...appHandlers,
+  ...configHandlers,
+  ...computerUseHandlers,
+  ...publishHandlers,
+  ...homeBaseHandlers,
+  ...diagnosticsHandlers,
+  ...miscHandlers,
+  ...documentHandlers,
+  ...workItemHandlers,
+  ...subagentHandlers,
+  ...browserHandlers,
+  ...signingHandlers,
+  ...twitterAuthHandlers,
+  ...inlineHandlers,
+} satisfies DispatchMap;
 
 export function handleMessage(
   msg: ClientMessage,

package/src/daemon/handlers/misc.ts

@@ -18,7 +18,7 @@ import type {
   IpcBlobProbe,
   CuSessionCreate,
 } from '../ipc-protocol.js';
-import { log, wireEscalationHandler, renderHistoryContent, type HandlerContext } from './shared.js';
+import { log, wireEscalationHandler, renderHistoryContent, defineHandlers, type HandlerContext } from './shared.js';
 import { handleCuSessionCreate } from './computer-use.js';
 
 // ─── Task submit handler ────────────────────────────────────────────────────
@@ -321,3 +321,11 @@ export function handleIpcBlobProbe(
     observedNonceSha256: observedHash,
   });
 }
+
+export const miscHandlers = defineHandlers({
+  task_submit: handleTaskSubmit,
+  suggestion_request: handleSuggestionRequest,
+  link_open_request: handleLinkOpenRequest,
+  ipc_blob_probe: handleIpcBlobProbe,
+  ping: (_msg, socket, ctx) => { ctx.send(socket, { type: 'pong' }); },
+});

package/src/daemon/handlers/publish.ts

@@ -10,7 +10,7 @@ import type {
   PublishPageRequest,
   UnpublishPageRequest,
 } from '../ipc-protocol.js';
-import { log, requestSecretStandalone, type HandlerContext } from './shared.js';
+import { log, requestSecretStandalone, defineHandlers, type HandlerContext } from './shared.js';
 
 export async function handlePublishPage(
   msg: PublishPageRequest,
@@ -180,3 +180,8 @@ export async function handleUnpublishPage(
     });
   }
 }
+
+export const publishHandlers = defineHandlers({
+  publish_page: handlePublishPage,
+  unpublish_page: handleUnpublishPage,
+});

package/src/daemon/handlers/sessions.ts

@@ -3,7 +3,8 @@ import { v4 as uuid } from 'uuid';
 import * as conversationStore from '../../memory/conversation-store.js';
 import { checkIngressForSecrets } from '../../security/secret-ingress.js';
 import { classifySessionError, buildSessionErrorMessage } from '../session-error.js';
-import { getAttachmentsForMessageUnscoped } from '../../memory/attachments-store.js';
+import { getAttachmentsForMessage, setAttachmentThumbnail } from '../../memory/attachments-store.js';
+import { generateVideoThumbnail } from '../video-thumbnail.js';
 import type { UserMessageAttachment } from '../ipc-contract.js';
 import { normalizeThreadType } from '../ipc-protocol.js';
 import type {
@@ -30,10 +31,12 @@ import {
   mergeToolResults,
   pendingStandaloneSecrets,
   type HandlerContext,
+  defineHandlers,
   type HistoryToolCall,
   type HistorySurface,
   type ParsedHistoryMessage,
 } from './shared.js';
+import { truncate } from '../../util/truncate.js';
 
 export async function handleUserMessage(
   msg: UserMessage,
@@ -271,14 +274,27 @@ export async function handleSessionSwitch(
     ctx.send(socket, { type: 'error', message: `Session ${msg.sessionId} not found` });
     return;
   }
+
+  // If the target session is headless-locked (actively executing a task run),
+  // skip rebinding the socket so tool confirmations stay suppressed.
+  const existingSession = ctx.sessions.get(msg.sessionId);
+  const isHeadlessLocked = existingSession && (existingSession as unknown as { headlessLock?: boolean }).headlessLock;
+
   ctx.socketToSession.set(socket, msg.sessionId);
-  const session = await ctx.getOrCreateSession(msg.sessionId, socket, true);
-  // Only wire the escalation handler if one isn't already set — handleTaskSubmit
-  // sets a handler with the client's actual screen dimensions, and overwriting it
-  // here would replace those dimensions with the daemon's defaults.
-  if (!session.hasEscalationHandler()) {
-    wireEscalationHandler(session, socket, ctx);
+
+  if (isHeadlessLocked) {
+    // Load the session without rebinding the client — the session stays headless
+    await ctx.getOrCreateSession(msg.sessionId, socket, false);
+  } else {
+    const session = await ctx.getOrCreateSession(msg.sessionId, socket, true);
+    // Only wire the escalation handler if one isn't already set — handleTaskSubmit
+    // sets a handler with the client's actual screen dimensions, and overwriting it
+    // here would replace those dimensions with the daemon's defaults.
+    if (!session.hasEscalationHandler()) {
+      wireEscalationHandler(session, socket, ctx);
+    }
   }
+
   ctx.send(socket, {
     type: 'session_info',
     sessionId: conversation.id,
@@ -326,7 +342,7 @@ export function handleHistoryRequest(
       contentOrder = rendered.contentOrder;
       surfaces = rendered.surfaces;
       if (m.role === 'assistant' && toolCalls.length > 0) {
-        log.info({ messageId: m.id, toolCallCount: toolCalls.length, text: text.substring(0, 100) }, 'History message with tool calls');
+        log.info({ messageId: m.id, toolCallCount: toolCalls.length, text: truncate(text, 100, '') }, 'History message with tool calls');
       }
     } catch (err) {
       log.debug({ err, messageId: m.id }, 'Failed to parse message content as JSON, using raw text');
@@ -335,7 +351,15 @@ export function handleHistoryRequest(
       contentOrder = text ? ['text:0'] : [];
       surfaces = [];
     }
-    return { id: m.id, role: m.role, text, timestamp: m.createdAt, toolCalls, toolCallsBeforeText, textSegments, contentOrder, surfaces };
+    let subagentNotification: ParsedHistoryMessage['subagentNotification'];
+    if (m.metadata) {
+      try {
+        subagentNotification = (JSON.parse(m.metadata) as { subagentNotification?: ParsedHistoryMessage['subagentNotification'] }).subagentNotification;
+      } catch (err) {
+        log.debug({ err, messageId: m.id }, 'Failed to parse message metadata as JSON, ignoring');
+      }
+    }
+    return { id: m.id, role: m.role, text, timestamp: m.createdAt, toolCalls, toolCallsBeforeText, textSegments, contentOrder, surfaces, ...(subagentNotification ? { subagentNotification } : {}) };
   });
 
   // Merge tool_result data from user messages into the preceding assistant
@@ -346,7 +370,7 @@ export function handleHistoryRequest(
   const historyMessages = merged.map((m) => {
     let attachments: UserMessageAttachment[] | undefined;
     if (m.role === 'assistant' && m.id) {
-      const linked = getAttachmentsForMessageUnscoped(m.id);
+      const linked = getAttachmentsForMessage(m.id);
       if (linked.length > 0) {
         // Skip embedding base64 data for large video attachments to keep the
         // history_response payload small. Only videos have a lazy-fetch path on
@@ -354,12 +378,23 @@ export function handleHistoryRequest(
         const MAX_INLINE_B64_SIZE = 512 * 1024;
         attachments = linked.map((a) => {
           const omit = a.mimeType.startsWith('video/') && a.dataBase64.length > MAX_INLINE_B64_SIZE;
+
+          // Lazily generate thumbnails for existing video attachments on first history load.
+          if (a.mimeType.startsWith('video/') && !a.thumbnailBase64) {
+            const attachmentId = a.id;
+            const base64 = a.dataBase64;
+            generateVideoThumbnail(base64).then((thumb) => {
+              if (thumb) setAttachmentThumbnail(attachmentId, thumb);
+            }).catch(() => {});
+          }
+
           return {
             id: a.id,
             filename: a.originalFilename,
             mimeType: a.mimeType,
             data: omit ? '' : a.dataBase64,
             ...(omit ? { sizeBytes: a.sizeBytes } : {}),
+            ...(a.thumbnailBase64 ? { thumbnailData: a.thumbnailBase64 } : {}),
           };
         });
       }
@@ -374,6 +409,7 @@ export function handleHistoryRequest(
       ...(m.textSegments.length > 0 ? { textSegments: m.textSegments } : {}),
       ...(m.contentOrder.length > 0 ? { contentOrder: m.contentOrder } : {}),
       ...(m.surfaces.length > 0 ? { surfaces: m.surfaces } : {}),
+      ...(m.subagentNotification ? { subagentNotification: m.subagentNotification } : {}),
     };
   });
   ctx.send(socket, { type: 'history_response', sessionId: msg.sessionId, messages: historyMessages });
@@ -421,10 +457,10 @@ export async function handleRegenerate(
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     log.error({ err, sessionId: msg.sessionId }, 'Error regenerating message');
-    session.traceEmitter.emit('request_error', message.slice(0, 200), {
+    session.traceEmitter.emit('request_error', truncate(message, 200, ''), {
       requestId,
       status: 'error',
-      attributes: { errorClass: err instanceof Error ? err.constructor.name : 'Error', message: message.slice(0, 500) },
+      attributes: { errorClass: err instanceof Error ? err.constructor.name : 'Error', message: truncate(message, 500, '') },
     });
     ctx.send(socket, { type: 'error', message: `Failed to regenerate: ${message}` });
     const classified = classifySessionError(err, { phase: 'regenerate' });
@@ -484,3 +520,20 @@ export function handleDeleteQueuedMessage(
     log.warn({ sessionId: msg.sessionId, requestId: msg.requestId }, 'Queued message not found for deletion');
   }
 }
+
+export const sessionHandlers = defineHandlers({
+  user_message: handleUserMessage,
+  confirmation_response: handleConfirmationResponse,
+  secret_response: handleSecretResponse,
+  session_list: (_msg, socket, ctx) => handleSessionList(socket, ctx),
+  session_create: handleSessionCreate,
+  sessions_clear: (_msg, socket, ctx) => handleSessionsClear(socket, ctx),
+  session_switch: handleSessionSwitch,
+  cancel: handleCancel,
+  delete_queued_message: handleDeleteQueuedMessage,
+  history_request: handleHistoryRequest,
+  undo: handleUndo,
+  regenerate: handleRegenerate,
+  usage_request: handleUsageRequest,
+  sandbox_set: handleSandboxSet,
+});

package/src/daemon/handlers/shared.ts

@@ -5,7 +5,7 @@ import { ComputerUseSession } from '../computer-use-session.js';
 import { getLogger } from '../../util/logger.js';
 import { execSync } from 'node:child_process';
 import { estimateBase64Bytes } from '../assistant-attachments.js';
-import type { CuSessionCreate, ServerMessage, SessionTransportMetadata } from '../ipc-protocol.js';
+import type { ClientMessage, CuSessionCreate, ServerMessage, SessionTransportMetadata } from '../ipc-protocol.js';
 import type { SecretPromptResult } from '../../permissions/secret-prompter.js';
 import { getConfig } from '../../config/loader.js';
 
@@ -13,6 +13,9 @@ const log = getLogger('handlers');
 
 export { log };
 
+/** Debounce window for suppressing file-watcher config reloads after programmatic saves. */
+export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
+
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
 export const FALLBACK_SCREEN = { width: 1920, height: 1080 };
@@ -67,6 +70,13 @@ export interface RenderedHistoryContent {
   surfaces: HistorySurface[];
 }
 
+export interface SubagentNotificationData {
+  subagentId: string;
+  label: string;
+  status: 'completed' | 'failed' | 'aborted';
+  error?: string;
+}
+
 export interface ParsedHistoryMessage {
   id?: string;
   role: string;
@@ -77,6 +87,7 @@ export interface ParsedHistoryMessage {
   textSegments: string[];
   contentOrder: string[];
   surfaces: HistorySurface[];
+  subagentNotification?: SubagentNotificationData;
 }
 
 /**
@@ -120,6 +131,30 @@ export interface HandlerContext {
   touchSession(sessionId: string): void;
 }
 
+// ─── Typed dispatch ──────────────────────────────────────────────────────────
+
+type MessageType = ClientMessage['type'];
+// 'auth' is handled at the transport layer (server.ts) and never reaches dispatch.
+export type DispatchableType = Exclude<MessageType, 'auth'>;
+type MessageOfType<T extends MessageType> = Extract<ClientMessage, { type: T }>;
+type MessageHandler<T extends MessageType> = (
+  msg: MessageOfType<T>,
+  socket: net.Socket,
+  ctx: HandlerContext,
+) => void | Promise<void>;
+export type DispatchMap = { [T in DispatchableType]: MessageHandler<T> };
+
+/**
+ * Type-safe handler group definition. Preserves exact key types so the
+ * combined spread in index.ts can be checked for exhaustiveness via
+ * `satisfies DispatchMap` instead of an unsafe `as DispatchMap` cast.
+ */
+export function defineHandlers<K extends DispatchableType>(
+  handlers: Pick<DispatchMap, K>,
+): Pick<DispatchMap, K> {
+  return handlers;
+}
+
 /**
  * Query the main display dimensions via CoreGraphics.
  * Cached after the first successful call; falls back to 1920x1080.

package/src/daemon/handlers/signing.ts

@@ -0,0 +1,37 @@
+import { log, pendingSignBundlePayload, pendingSigningIdentity, defineHandlers } from './shared.js';
+
+export const signingHandlers = defineHandlers({
+  sign_bundle_payload_response: (msg) => {
+    const pending = pendingSignBundlePayload.get(msg.requestId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      pendingSignBundlePayload.delete(msg.requestId);
+      if (msg.error) {
+        pending.reject(new Error(msg.error));
+      } else if (msg.signature && msg.keyId && msg.publicKey) {
+        pending.resolve({ signature: msg.signature, keyId: msg.keyId, publicKey: msg.publicKey });
+      } else {
+        pending.reject(new Error('Missing required fields in sign_bundle_payload_response'));
+      }
+    } else {
+      log.warn({ requestId: msg.requestId }, 'Received sign_bundle_payload_response with no pending request');
+    }
+  },
+
+  get_signing_identity_response: (msg) => {
+    const pending = pendingSigningIdentity.get(msg.requestId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      pendingSigningIdentity.delete(msg.requestId);
+      if (msg.error) {
+        pending.reject(new Error(msg.error));
+      } else if (msg.keyId && msg.publicKey) {
+        pending.resolve({ keyId: msg.keyId, publicKey: msg.publicKey });
+      } else {
+        pending.reject(new Error('Missing required fields in get_signing_identity_response'));
+      }
+    } else {
+      log.warn({ requestId: msg.requestId }, 'Received get_signing_identity_response with no pending request');
+    }
+  },
+});