vellum 0.2.1 → 0.2.2

package/src/daemon/handlers/shared.ts

@@ -5,7 +5,7 @@ import { ComputerUseSession } from '../computer-use-session.js';
 import { getLogger } from '../../util/logger.js';
 import { execSync } from 'node:child_process';
 import { estimateBase64Bytes } from '../assistant-attachments.js';
-import type { CuSessionCreate, ServerMessage, SessionTransportMetadata } from '../ipc-protocol.js';
+import type { ClientMessage, CuSessionCreate, ServerMessage, SessionTransportMetadata } from '../ipc-protocol.js';
 import type { SecretPromptResult } from '../../permissions/secret-prompter.js';
 import { getConfig } from '../../config/loader.js';
 
@@ -13,6 +13,9 @@ const log = getLogger('handlers');
 
 export { log };
 
+/** Debounce window for suppressing file-watcher config reloads after programmatic saves. */
+export const CONFIG_RELOAD_DEBOUNCE_MS = 300;
+
 const HISTORY_ATTACHMENT_TEXT_LIMIT = 500;
 
 export const FALLBACK_SCREEN = { width: 1920, height: 1080 };
@@ -67,6 +70,13 @@ export interface RenderedHistoryContent {
   surfaces: HistorySurface[];
 }
 
+export interface SubagentNotificationData {
+  subagentId: string;
+  label: string;
+  status: 'completed' | 'failed' | 'aborted';
+  error?: string;
+}
+
 export interface ParsedHistoryMessage {
   id?: string;
   role: string;
@@ -77,6 +87,7 @@ export interface ParsedHistoryMessage {
   textSegments: string[];
   contentOrder: string[];
   surfaces: HistorySurface[];
+  subagentNotification?: SubagentNotificationData;
 }
 
 /**
@@ -120,6 +131,30 @@ export interface HandlerContext {
   touchSession(sessionId: string): void;
 }
 
+// ─── Typed dispatch ──────────────────────────────────────────────────────────
+
+type MessageType = ClientMessage['type'];
+// 'auth' is handled at the transport layer (server.ts) and never reaches dispatch.
+export type DispatchableType = Exclude<MessageType, 'auth'>;
+type MessageOfType<T extends MessageType> = Extract<ClientMessage, { type: T }>;
+type MessageHandler<T extends MessageType> = (
+  msg: MessageOfType<T>,
+  socket: net.Socket,
+  ctx: HandlerContext,
+) => void | Promise<void>;
+export type DispatchMap = { [T in DispatchableType]: MessageHandler<T> };
+
+/**
+ * Type-safe handler group definition. Preserves exact key types so the
+ * combined spread in index.ts can be checked for exhaustiveness via
+ * `satisfies DispatchMap` instead of an unsafe `as DispatchMap` cast.
+ */
+export function defineHandlers<K extends DispatchableType>(
+  handlers: Pick<DispatchMap, K>,
+): Pick<DispatchMap, K> {
+  return handlers;
+}
+
 /**
  * Query the main display dimensions via CoreGraphics.
  * Cached after the first successful call; falls back to 1920x1080.

package/src/daemon/handlers/signing.ts

@@ -0,0 +1,37 @@
+import { log, pendingSignBundlePayload, pendingSigningIdentity, defineHandlers } from './shared.js';
+
+export const signingHandlers = defineHandlers({
+  sign_bundle_payload_response: (msg) => {
+    const pending = pendingSignBundlePayload.get(msg.requestId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      pendingSignBundlePayload.delete(msg.requestId);
+      if (msg.error) {
+        pending.reject(new Error(msg.error));
+      } else if (msg.signature && msg.keyId && msg.publicKey) {
+        pending.resolve({ signature: msg.signature, keyId: msg.keyId, publicKey: msg.publicKey });
+      } else {
+        pending.reject(new Error('Missing required fields in sign_bundle_payload_response'));
+      }
+    } else {
+      log.warn({ requestId: msg.requestId }, 'Received sign_bundle_payload_response with no pending request');
+    }
+  },
+
+  get_signing_identity_response: (msg) => {
+    const pending = pendingSigningIdentity.get(msg.requestId);
+    if (pending) {
+      clearTimeout(pending.timer);
+      pendingSigningIdentity.delete(msg.requestId);
+      if (msg.error) {
+        pending.reject(new Error(msg.error));
+      } else if (msg.keyId && msg.publicKey) {
+        pending.resolve({ keyId: msg.keyId, publicKey: msg.publicKey });
+      } else {
+        pending.reject(new Error('Missing required fields in get_signing_identity_response'));
+      }
+    } else {
+      log.warn({ requestId: msg.requestId }, 'Received get_signing_identity_response with no pending request');
+    }
+  },
+});

package/src/daemon/handlers/skills.ts

@@ -19,7 +19,7 @@ import type {
   SkillsSearchRequest,
   SkillsInspectRequest,
 } from '../ipc-protocol.js';
-import { log, ensureSkillEntry, type HandlerContext } from './shared.js';
+import { log, CONFIG_RELOAD_DEBOUNCE_MS, ensureSkillEntry, defineHandlers, type HandlerContext } from './shared.js';
 
 export function handleSkillsList(socket: net.Socket, ctx: HandlerContext): void {
   const config = getConfig();
@@ -63,7 +63,7 @@ export function handleSkillsEnable(
 
     const existingSuppressTimer = ctx.debounceTimers.get('__suppress_reset__');
     if (existingSuppressTimer) clearTimeout(existingSuppressTimer);
-    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, 300);
+    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, CONFIG_RELOAD_DEBOUNCE_MS);
     ctx.debounceTimers.set('__suppress_reset__', resetTimer);
 
     ctx.updateConfigFingerprint();
@@ -110,7 +110,7 @@ export function handleSkillsDisable(
 
     const existingSuppressTimer = ctx.debounceTimers.get('__suppress_reset__');
     if (existingSuppressTimer) clearTimeout(existingSuppressTimer);
-    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, 300);
+    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, CONFIG_RELOAD_DEBOUNCE_MS);
     ctx.debounceTimers.set('__suppress_reset__', resetTimer);
 
     ctx.updateConfigFingerprint();
@@ -167,7 +167,7 @@ export function handleSkillsConfigure(
 
     const existingSuppressTimer = ctx.debounceTimers.get('__suppress_reset__');
     if (existingSuppressTimer) clearTimeout(existingSuppressTimer);
-    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, 300);
+    const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, CONFIG_RELOAD_DEBOUNCE_MS);
     ctx.debounceTimers.set('__suppress_reset__', resetTimer);
 
     ctx.updateConfigFingerprint();
@@ -228,7 +228,7 @@ export async function handleSkillsInstall(
       invalidateConfigCache();
       const existingSuppressTimer = ctx.debounceTimers.get('__suppress_reset__');
       if (existingSuppressTimer) clearTimeout(existingSuppressTimer);
-      const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, 300);
+      const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, CONFIG_RELOAD_DEBOUNCE_MS);
       ctx.debounceTimers.set('__suppress_reset__', resetTimer);
       ctx.updateConfigFingerprint();
     } catch (err) {
@@ -323,7 +323,7 @@ export async function handleSkillsUninstall(
 
       const existingSuppressTimer = ctx.debounceTimers.get('__suppress_reset__');
       if (existingSuppressTimer) clearTimeout(existingSuppressTimer);
-      const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, 300);
+      const resetTimer = setTimeout(() => { ctx.setSuppressConfigReload(false); }, CONFIG_RELOAD_DEBOUNCE_MS);
       ctx.debounceTimers.set('__suppress_reset__', resetTimer);
 
       ctx.updateConfigFingerprint();
@@ -485,3 +485,17 @@ export async function handleSkillDetail(
     });
   }
 }
+
+export const skillHandlers = defineHandlers({
+  skills_list: (_msg, socket, ctx) => handleSkillsList(socket, ctx),
+  skill_detail: handleSkillDetail,
+  skills_enable: handleSkillsEnable,
+  skills_disable: handleSkillsDisable,
+  skills_configure: handleSkillsConfigure,
+  skills_install: handleSkillsInstall,
+  skills_uninstall: handleSkillsUninstall,
+  skills_update: handleSkillsUpdate,
+  skills_check_updates: handleSkillsCheckUpdates,
+  skills_search: handleSkillsSearch,
+  skills_inspect: handleSkillsInspect,
+});

package/src/daemon/handlers/subagents.ts

@@ -6,7 +6,7 @@ import * as net from 'node:net';
 import type { SubagentAbortRequest, SubagentStatusRequest, SubagentMessageRequest } from '../ipc-protocol.js';
 import type { HandlerContext } from './shared.js';
 import { getSubagentManager } from '../../subagent/index.js';
-import { log } from './shared.js';
+import { log, defineHandlers } from './shared.js';
 
 export function handleSubagentAbort(
   msg: SubagentAbortRequest,
@@ -66,8 +66,7 @@ export function handleSubagentStatus(
   }
 
   // Return all subagents for the caller's session.
-  const sessionId = callerSessionId;
-  const children = manager.getChildrenOf(sessionId);
+  const children = manager.getChildrenOf(callerSessionId);
   for (const child of children) {
     ctx.send(socket, {
       type: 'subagent_status_changed',
@@ -120,3 +119,9 @@ export function handleSubagentMessage(
     });
   }
 }
+
+export const subagentHandlers = defineHandlers({
+  subagent_abort: handleSubagentAbort,
+  subagent_status: handleSubagentStatus,
+  subagent_message: handleSubagentMessage,
+});

package/src/daemon/handlers/twitter-auth.ts

@@ -0,0 +1,169 @@
+import * as net from 'node:net';
+import { loadRawConfig } from '../../config/loader.js';
+import { getSecureKey, setSecureKey, deleteSecureKey } from '../../security/secure-keys.js';
+import { startOAuth2Flow } from '../../security/oauth2.js';
+import { upsertCredentialMetadata, getCredentialMetadata } from '../../tools/credentials/metadata-store.js';
+import type { TwitterAuthStartRequest, TwitterAuthStatusRequest } from '../ipc-protocol.js';
+import { log, defineHandlers, type HandlerContext } from './shared.js';
+import type { OAuth2Config } from '../../security/oauth2.js';
+
+export async function handleTwitterAuthStart(
+  _msg: TwitterAuthStartRequest,
+  socket: net.Socket,
+  ctx: HandlerContext,
+): Promise<void> {
+  try {
+    const raw = loadRawConfig();
+    const mode = (raw.twitterIntegrationMode as string | undefined) ?? 'local_byo';
+    if (mode !== 'local_byo') {
+      ctx.send(socket, {
+        type: 'twitter_auth_result',
+        success: false,
+        error: 'Twitter integration mode must be "local_byo" to use this flow.',
+      });
+      return;
+    }
+
+    const clientId = getSecureKey('credential:integration:twitter:oauth_client_id');
+    if (!clientId) {
+      ctx.send(socket, {
+        type: 'twitter_auth_result',
+        success: false,
+        error: 'No Twitter client credentials configured. Please set up your Client ID first.',
+      });
+      return;
+    }
+
+    const clientSecret = getSecureKey('credential:integration:twitter:oauth_client_secret') || undefined;
+
+    const oauthConfig: OAuth2Config = {
+      authUrl: 'https://twitter.com/i/oauth2/authorize',
+      tokenUrl: 'https://api.x.com/2/oauth2/token',
+      scopes: ['tweet.read', 'tweet.write', 'users.read', 'offline.access'],
+      clientId,
+      clientSecret,
+      extraParams: {},
+    };
+
+    const result = await startOAuth2Flow(oauthConfig, {
+      openUrl: (url: string) => {
+        ctx.send(socket, { type: 'open_url', url });
+      },
+    });
+
+    // Verify identity via Twitter API before persisting any tokens
+    let accountInfo: string;
+    try {
+      const userResp = await fetch('https://api.x.com/2/users/me', {
+        headers: { Authorization: `Bearer ${result.tokens.accessToken}` },
+      });
+      if (!userResp.ok) {
+        log.error({ status: userResp.status }, 'Twitter identity verification returned non-2xx');
+        ctx.send(socket, {
+          type: 'twitter_auth_result',
+          success: false,
+          error: 'Failed to verify Twitter identity. Please try again.',
+        });
+        return;
+      }
+      const userData = (await userResp.json()) as { data?: { username?: string } };
+      if (!userData.data?.username) {
+        log.error({ userData }, 'Twitter identity verification returned no username');
+        ctx.send(socket, {
+          type: 'twitter_auth_result',
+          success: false,
+          error: 'Failed to verify Twitter identity. Please try again.',
+        });
+        return;
+      }
+      accountInfo = `@${userData.data.username}`;
+    } catch (err) {
+      log.error({ err }, 'Twitter identity verification fetch failed');
+      ctx.send(socket, {
+        type: 'twitter_auth_result',
+        success: false,
+        error: 'Failed to verify Twitter identity. Please try again.',
+      });
+      return;
+    }
+
+    // Persist tokens only after successful verification
+    setSecureKey('credential:integration:twitter:access_token', result.tokens.accessToken);
+    if (result.tokens.refreshToken) {
+      setSecureKey('credential:integration:twitter:refresh_token', result.tokens.refreshToken);
+    } else {
+      deleteSecureKey('credential:integration:twitter:refresh_token');
+    }
+
+    upsertCredentialMetadata('integration:twitter', 'access_token', {
+      accountInfo,
+      allowedTools: ['twitter_post'],
+      allowedDomains: [],
+      oauth2TokenUrl: 'https://api.x.com/2/oauth2/token',
+      oauth2ClientId: clientId,
+      oauth2ClientSecret: clientSecret ?? null,
+      grantedScopes: result.grantedScopes,
+      expiresAt: result.tokens.expiresIn ? Date.now() + result.tokens.expiresIn * 1000 : null,
+    });
+
+    ctx.send(socket, {
+      type: 'twitter_auth_result',
+      success: true,
+      accountInfo,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err }, 'Twitter OAuth flow failed');
+
+    let userError: string;
+    const lower = message.toLowerCase();
+    if (lower.includes('timed out')) {
+      userError = 'Twitter authentication timed out. Please try again.';
+    } else if (lower.includes('user_cancelled') || lower.includes('cancelled')) {
+      userError = 'Twitter authentication was cancelled.';
+    } else if (lower.includes('denied') || lower.includes('invalid_grant')) {
+      userError = 'Twitter denied the authorization request. Please try again.';
+    } else {
+      userError = 'Twitter authentication failed. Please try again.';
+    }
+
+    ctx.send(socket, {
+      type: 'twitter_auth_result',
+      success: false,
+      error: userError,
+    });
+  }
+}
+
+export function handleTwitterAuthStatus(
+  _msg: TwitterAuthStatusRequest,
+  socket: net.Socket,
+  ctx: HandlerContext,
+): void {
+  try {
+    const accessToken = getSecureKey('credential:integration:twitter:access_token');
+    const raw = loadRawConfig();
+    const mode = (raw.twitterIntegrationMode as 'local_byo' | 'managed' | undefined) ?? 'local_byo';
+    const meta = getCredentialMetadata('integration:twitter', 'access_token');
+
+    ctx.send(socket, {
+      type: 'twitter_auth_status_response',
+      connected: !!accessToken,
+      accountInfo: meta?.accountInfo ?? undefined,
+      mode,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err }, 'Failed to get Twitter auth status');
+    ctx.send(socket, {
+      type: 'twitter_auth_status_response',
+      connected: false,
+      error: message,
+    });
+  }
+}
+
+export const twitterAuthHandlers = defineHandlers({
+  twitter_auth_start: handleTwitterAuthStart,
+  twitter_auth_status: handleTwitterAuthStatus,
+});