vellum 0.2.0 → 0.2.2

package/src/tools/contacts/contact-merge.ts

@@ -1,87 +1,55 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
-import type { ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
+import type { ToolContext, ToolExecutionResult } from '../types.js';
 import { mergeContacts, getContact } from '../../contacts/contact-store.js';
 
-const definition: ToolDefinition = {
-  name: 'contact_merge',
-  description: 'Merge two contacts when you discover they are the same person (e.g. same person on email and Slack). Combines channels, keeps the higher importance, and deletes the donor contact.',
-  input_schema: {
-    type: 'object',
-    properties: {
-      keep_id: {
-        type: 'string',
-        description: 'ID of the contact to keep (the surviving contact)',
-      },
-      merge_id: {
-        type: 'string',
-        description: 'ID of the contact to merge into the kept contact (will be deleted)',
-      },
-    },
-    required: ['keep_id', 'merge_id'],
-  },
-};
+export async function executeContactMerge(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const keepId = input.keep_id as string | undefined;
+  const mergeId = input.merge_id as string | undefined;
 
-class ContactMergeTool implements Tool {
-  name = 'contact_merge';
-  description = definition.description;
-  category = 'contacts';
-  defaultRiskLevel = RiskLevel.Medium;
-
-  getDefinition(): ToolDefinition {
-    return definition;
+  if (!keepId || typeof keepId !== 'string') {
+    return { content: 'Error: keep_id is required', isError: true };
+  }
+  if (!mergeId || typeof mergeId !== 'string') {
+    return { content: 'Error: merge_id is required', isError: true };
   }
 
-  async execute(input: Record<string, unknown>, _context: ToolContext): Promise<ToolExecutionResult> {
-    const keepId = input.keep_id as string | undefined;
-    const mergeId = input.merge_id as string | undefined;
-
-    if (!keepId || typeof keepId !== 'string') {
-      return { content: 'Error: keep_id is required', isError: true };
-    }
-    if (!mergeId || typeof mergeId !== 'string') {
-      return { content: 'Error: merge_id is required', isError: true };
-    }
-
-    // Show what will be merged for clarity
-    const keepContact = getContact(keepId);
-    const mergeContact = getContact(mergeId);
-
-    if (!keepContact) {
-      return { content: `Error: Contact "${keepId}" not found`, isError: true };
-    }
-    if (!mergeContact) {
-      return { content: `Error: Contact "${mergeId}" not found`, isError: true };
-    }
-
-    try {
-      const merged = mergeContacts(keepId, mergeId);
+  // Show what will be merged for clarity
+  const keepContact = getContact(keepId);
+  const mergeContact = getContact(mergeId);
 
-      const channelList = merged.channels
-        .map((ch) => `  - ${ch.type}: ${ch.address}${ch.isPrimary ? ' (primary)' : ''}`)
-        .join('\n');
+  if (!keepContact) {
+    return { content: `Error: Contact "${keepId}" not found`, isError: true };
+  }
+  if (!mergeContact) {
+    return { content: `Error: Contact "${mergeId}" not found`, isError: true };
+  }
 
-      return {
-        content: [
-          `Merged "${mergeContact.displayName}" into "${keepContact.displayName}".`,
-          ``,
-          `Surviving contact (${merged.id}):`,
-          `  Name: ${merged.displayName}`,
-          `  Importance: ${merged.importance.toFixed(2)}`,
-          `  Interactions: ${merged.interactionCount}`,
-          merged.relationship ? `  Relationship: ${merged.relationship}` : null,
-          merged.channels.length > 0 ? `  Channels:\n${channelList}` : null,
-          ``,
-          `Deleted contact: ${mergeContact.displayName} (${mergeId})`,
-        ].filter(Boolean).join('\n'),
-        isError: false,
-      };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { content: `Error: ${msg}`, isError: true };
-    }
+  try {
+    const merged = mergeContacts(keepId, mergeId);
+
+    const channelList = merged.channels
+      .map((ch) => `  - ${ch.type}: ${ch.address}${ch.isPrimary ? ' (primary)' : ''}`)
+      .join('\n');
+
+    return {
+      content: [
+        `Merged "${mergeContact.displayName}" into "${keepContact.displayName}".`,
+        ``,
+        `Surviving contact (${merged.id}):`,
+        `  Name: ${merged.displayName}`,
+        `  Importance: ${merged.importance.toFixed(2)}`,
+        `  Interactions: ${merged.interactionCount}`,
+        merged.relationship ? `  Relationship: ${merged.relationship}` : null,
+        merged.channels.length > 0 ? `  Channels:\n${channelList}` : null,
+        ``,
+        `Deleted contact: ${mergeContact.displayName} (${mergeId})`,
+      ].filter(Boolean).join('\n'),
+      isError: false,
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: `Error: ${msg}`, isError: true };
   }
 }
-
-registerTool(new ContactMergeTool());

package/src/tools/contacts/contact-search.ts

@@ -1,7 +1,4 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
-import type { ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
+import type { ToolContext, ToolExecutionResult } from '../types.js';
 import { searchContacts } from '../../contacts/contact-store.js';
 import type { ContactWithChannels } from '../../contacts/types.js';
 
@@ -18,85 +15,44 @@ function formatContactSummary(c: ContactWithChannels): string {
   return parts.join('\n');
 }
 
-const definition: ToolDefinition = {
-  name: 'contact_search',
-  description: 'Search for contacts by name, channel address, relationship type, or other criteria. Returns matching contacts with their channel information.',
-  input_schema: {
-    type: 'object',
-    properties: {
-      query: {
-        type: 'string',
-        description: 'Search by display name (partial match)',
-      },
-      channel_address: {
-        type: 'string',
-        description: 'Search by channel address (email, phone, handle — partial match)',
-      },
-      channel_type: {
-        type: 'string',
-        description: 'Filter by channel type when searching by address (email, slack, whatsapp, phone, etc.)',
-      },
-      relationship: {
-        type: 'string',
-        description: 'Filter by relationship type (exact match)',
-      },
-      limit: {
-        type: 'number',
-        description: 'Maximum results to return (default 20, max 100)',
-      },
-    },
-    required: [],
-  },
-};
-
-class ContactSearchTool implements Tool {
-  name = 'contact_search';
-  description = definition.description;
-  category = 'contacts';
-  defaultRiskLevel = RiskLevel.Low;
-
-  getDefinition(): ToolDefinition {
-    return definition;
+export async function executeContactSearch(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const query = input.query as string | undefined;
+  const channelAddress = input.channel_address as string | undefined;
+  const channelType = input.channel_type as string | undefined;
+  const relationship = input.relationship as string | undefined;
+  const limit = input.limit as number | undefined;
+
+  if (!query && !channelAddress && !relationship) {
+    return {
+      content: 'Error: At least one search criterion is required (query, channel_address, or relationship)',
+      isError: true,
+    };
   }
 
-  async execute(input: Record<string, unknown>, _context: ToolContext): Promise<ToolExecutionResult> {
-    const query = input.query as string | undefined;
-    const channelAddress = input.channel_address as string | undefined;
-    const channelType = input.channel_type as string | undefined;
-    const relationship = input.relationship as string | undefined;
-    const limit = input.limit as number | undefined;
-
-    if (!query && !channelAddress && !relationship) {
-      return {
-        content: 'Error: At least one search criterion is required (query, channel_address, or relationship)',
-        isError: true,
-      };
+  try {
+    const results = searchContacts({
+      query,
+      channelAddress,
+      channelType,
+      relationship,
+      limit,
+    });
+
+    if (results.length === 0) {
+      return { content: 'No contacts found matching the search criteria.', isError: false };
     }
 
-    try {
-      const results = searchContacts({
-        query,
-        channelAddress,
-        channelType,
-        relationship,
-        limit,
-      });
-
-      if (results.length === 0) {
-        return { content: 'No contacts found matching the search criteria.', isError: false };
-      }
-
-      const lines = [`Found ${results.length} contact(s):\n`];
-      for (const contact of results) {
-        lines.push(formatContactSummary(contact));
-      }
-
-      return { content: lines.join('\n'), isError: false };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { content: `Error: ${msg}`, isError: true };
+    const lines = [`Found ${results.length} contact(s):\n`];
+    for (const contact of results) {
+      lines.push(formatContactSummary(contact));
     }
+
+    return { content: lines.join('\n'), isError: false };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: `Error: ${msg}`, isError: true };
   }
 }
-
-registerTool(new ContactSearchTool());

package/src/tools/contacts/contact-upsert.ts

@@ -1,9 +1,5 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
-import type { ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
+import type { ToolContext, ToolExecutionResult } from '../types.js';
 import { upsertContact } from '../../contacts/contact-store.js';
-import { CHANNEL_TYPES } from '../../contacts/types.js';
 
 function formatContact(c: ReturnType<typeof upsertContact>): string {
   const lines = [
@@ -25,113 +21,44 @@ function formatContact(c: ReturnType<typeof upsertContact>): string {
   return lines.join('\n');
 }
 
-const definition: ToolDefinition = {
-  name: 'contact_upsert',
-  description: 'Create or update a contact in the relationship graph. Use this to track people the user interacts with across channels (email, Slack, etc.).',
-  input_schema: {
-    type: 'object',
-    properties: {
-      id: {
-        type: 'string',
-        description: 'Contact ID to update. Omit to create a new contact (or auto-match by channel address).',
-      },
-      display_name: {
-        type: 'string',
-        description: 'Display name for the contact',
-      },
-      relationship: {
-        type: 'string',
-        description: 'Relationship type (e.g. colleague, friend, manager, client, family)',
-      },
-      importance: {
-        type: 'number',
-        description: 'Importance score 0-1 (default 0.5). Higher = more important.',
-      },
-      response_expectation: {
-        type: 'string',
-        description: 'Expected response speed (e.g. immediate, within_hours, within_day, casual)',
-      },
-      preferred_tone: {
-        type: 'string',
-        description: 'Preferred communication tone (e.g. formal, casual, friendly, professional)',
-      },
-      channels: {
-        type: 'array',
-        description: 'Communication channels for this contact',
-        items: {
-          type: 'object',
-          properties: {
-            type: {
-              type: 'string',
-              enum: [...CHANNEL_TYPES],
-              description: 'Channel type',
-            },
-            address: {
-              type: 'string',
-              description: 'Channel address (email address, Slack handle, phone number, etc.)',
-            },
-            is_primary: {
-              type: 'boolean',
-              description: 'Whether this is the primary channel for this type',
-            },
-          },
-          required: ['type', 'address'],
-        },
-      },
-    },
-    required: ['display_name'],
-  },
-};
-
-class ContactUpsertTool implements Tool {
-  name = 'contact_upsert';
-  description = definition.description;
-  category = 'contacts';
-  defaultRiskLevel = RiskLevel.Low;
-
-  getDefinition(): ToolDefinition {
-    return definition;
+export async function executeContactUpsert(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const displayName = input.display_name as string | undefined;
+  if (!displayName || typeof displayName !== 'string' || displayName.trim().length === 0) {
+    return { content: 'Error: display_name is required and must be a non-empty string', isError: true };
   }
 
-  async execute(input: Record<string, unknown>, _context: ToolContext): Promise<ToolExecutionResult> {
-    const displayName = input.display_name as string | undefined;
-    if (!displayName || typeof displayName !== 'string' || displayName.trim().length === 0) {
-      return { content: 'Error: display_name is required and must be a non-empty string', isError: true };
-    }
-
-    const importance = input.importance as number | undefined;
-    if (importance !== undefined && (typeof importance !== 'number' || importance < 0 || importance > 1)) {
-      return { content: 'Error: importance must be a number between 0 and 1', isError: true };
-    }
+  const importance = input.importance as number | undefined;
+  if (importance !== undefined && (typeof importance !== 'number' || importance < 0 || importance > 1)) {
+    return { content: 'Error: importance must be a number between 0 and 1', isError: true };
+  }
 
-    const rawChannels = input.channels as Array<{ type: string; address: string; is_primary?: boolean }> | undefined;
-    const channels = rawChannels?.map((ch) => ({
-      type: ch.type,
-      address: ch.address,
-      isPrimary: ch.is_primary,
-    }));
+  const rawChannels = input.channels as Array<{ type: string; address: string; is_primary?: boolean }> | undefined;
+  const channels = rawChannels?.map((ch) => ({
+    type: ch.type,
+    address: ch.address,
+    isPrimary: ch.is_primary,
+  }));
 
-    try {
-      const contact = upsertContact({
-        id: input.id as string | undefined,
-        displayName: displayName.trim(),
-        relationship: input.relationship as string | undefined,
-        importance,
-        responseExpectation: input.response_expectation as string | undefined,
-        preferredTone: input.preferred_tone as string | undefined,
-        channels,
-      });
+  try {
+    const contact = upsertContact({
+      id: input.id as string | undefined,
+      displayName: displayName.trim(),
+      relationship: input.relationship as string | undefined,
+      importance,
+      responseExpectation: input.response_expectation as string | undefined,
+      preferredTone: input.preferred_tone as string | undefined,
+      channels,
+    });
 
-      const isNew = contact.createdAt === contact.updatedAt;
-      return {
-        content: `${isNew ? 'Created' : 'Updated'} contact:\n${formatContact(contact)}`,
-        isError: false,
-      };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { content: `Error: ${msg}`, isError: true };
-    }
+    return {
+      content: `${contact.created ? 'Created' : 'Updated'} contact:\n${formatContact(contact)}`,
+      isError: false,
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: `Error: ${msg}`, isError: true };
   }
 }
-
-registerTool(new ContactUpsertTool());

package/src/tools/credentials/vault.ts

@@ -95,15 +95,19 @@ function findStoredOAuthField(service: string, fieldNames: string[]): string | u
     }
   }
 
-  // Fallback: check credential metadata on the access_token record, where
-  // oauth2_connect persists the client config after a successful flow.
+  // Legacy fallback: check credential metadata on the access_token record.
+  // Older OAuth2 flows stored client_id/client_secret only in metadata JSON.
+  // New flows persist them in the keychain (checked above) for defense in depth.
   const metadataKey = fieldNames.some((f) => f.includes('client_id'))
     ? 'oauth2ClientId' as const
     : 'oauth2ClientSecret' as const;
   for (const svc of servicesToCheck) {
     const meta = getCredentialMetadata(svc, 'access_token');
     const value = meta?.[metadataKey];
-    if (value) return value;
+    if (value) {
+      log.debug({ service: svc, field: metadataKey }, 'OAuth client credential resolved from metadata (legacy fallback)');
+      return value;
+    }
   }
 
   return undefined;
@@ -113,7 +117,7 @@ class CredentialStoreTool implements Tool {
   name = 'credential_store';
   description = 'Store, list, delete, or prompt for credentials in the secure vault';
   category = 'credentials';
-  defaultRiskLevel = RiskLevel.Medium;
+  defaultRiskLevel = RiskLevel.Low;
 
   getDefinition(): ToolDefinition {
     return {
@@ -569,7 +573,7 @@ class CredentialStoreTool implements Tool {
             return { content: 'Error: failed to store access token in secure storage', isError: true };
           }
 
-          const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : undefined;
+          const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : null;
 
           let accountInfo: string | undefined;
           if (userinfoUrl && grantedScopes.some((s) => s.includes('userinfo'))) {
@@ -586,6 +590,18 @@ class CredentialStoreTool implements Tool {
             }
           }
 
+          // Persist client credentials in keychain for defense in depth
+          const clientIdStored = setSecureKey(`credential:${service}:client_id`, clientId);
+          if (!clientIdStored) {
+            return { content: 'Error: failed to store client_id in secure storage', isError: true };
+          }
+          if (clientSecret) {
+            const clientSecretStored = setSecureKey(`credential:${service}:client_secret`, clientSecret);
+            if (!clientSecretStored) {
+              return { content: 'Error: failed to store client_secret in secure storage', isError: true };
+            }
+          }
+
           upsertCredentialMetadata(service, 'access_token', {
             allowedTools: allowedTools ?? [],
             expiresAt,