vellum 0.2.1 → 0.2.7

package/src/tools/contacts/contact-upsert.ts

@@ -1,9 +1,5 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
-import type { ToolDefinition } from '../../providers/types.js';
-import { registerTool } from '../registry.js';
+import type { ToolContext, ToolExecutionResult } from '../types.js';
 import { upsertContact } from '../../contacts/contact-store.js';
-import { CHANNEL_TYPES } from '../../contacts/types.js';
 
 function formatContact(c: ReturnType<typeof upsertContact>): string {
   const lines = [
@@ -25,113 +21,44 @@ function formatContact(c: ReturnType<typeof upsertContact>): string {
   return lines.join('\n');
 }
 
-const definition: ToolDefinition = {
-  name: 'contact_upsert',
-  description: 'Create or update a contact in the relationship graph. Use this to track people the user interacts with across channels (email, Slack, etc.).',
-  input_schema: {
-    type: 'object',
-    properties: {
-      id: {
-        type: 'string',
-        description: 'Contact ID to update. Omit to create a new contact (or auto-match by channel address).',
-      },
-      display_name: {
-        type: 'string',
-        description: 'Display name for the contact',
-      },
-      relationship: {
-        type: 'string',
-        description: 'Relationship type (e.g. colleague, friend, manager, client, family)',
-      },
-      importance: {
-        type: 'number',
-        description: 'Importance score 0-1 (default 0.5). Higher = more important.',
-      },
-      response_expectation: {
-        type: 'string',
-        description: 'Expected response speed (e.g. immediate, within_hours, within_day, casual)',
-      },
-      preferred_tone: {
-        type: 'string',
-        description: 'Preferred communication tone (e.g. formal, casual, friendly, professional)',
-      },
-      channels: {
-        type: 'array',
-        description: 'Communication channels for this contact',
-        items: {
-          type: 'object',
-          properties: {
-            type: {
-              type: 'string',
-              enum: [...CHANNEL_TYPES],
-              description: 'Channel type',
-            },
-            address: {
-              type: 'string',
-              description: 'Channel address (email address, Slack handle, phone number, etc.)',
-            },
-            is_primary: {
-              type: 'boolean',
-              description: 'Whether this is the primary channel for this type',
-            },
-          },
-          required: ['type', 'address'],
-        },
-      },
-    },
-    required: ['display_name'],
-  },
-};
-
-class ContactUpsertTool implements Tool {
-  name = 'contact_upsert';
-  description = definition.description;
-  category = 'contacts';
-  defaultRiskLevel = RiskLevel.Low;
-
-  getDefinition(): ToolDefinition {
-    return definition;
+export async function executeContactUpsert(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const displayName = input.display_name as string | undefined;
+  if (!displayName || typeof displayName !== 'string' || displayName.trim().length === 0) {
+    return { content: 'Error: display_name is required and must be a non-empty string', isError: true };
   }
 
-  async execute(input: Record<string, unknown>, _context: ToolContext): Promise<ToolExecutionResult> {
-    const displayName = input.display_name as string | undefined;
-    if (!displayName || typeof displayName !== 'string' || displayName.trim().length === 0) {
-      return { content: 'Error: display_name is required and must be a non-empty string', isError: true };
-    }
-
-    const importance = input.importance as number | undefined;
-    if (importance !== undefined && (typeof importance !== 'number' || importance < 0 || importance > 1)) {
-      return { content: 'Error: importance must be a number between 0 and 1', isError: true };
-    }
+  const importance = input.importance as number | undefined;
+  if (importance !== undefined && (typeof importance !== 'number' || importance < 0 || importance > 1)) {
+    return { content: 'Error: importance must be a number between 0 and 1', isError: true };
+  }
 
-    const rawChannels = input.channels as Array<{ type: string; address: string; is_primary?: boolean }> | undefined;
-    const channels = rawChannels?.map((ch) => ({
-      type: ch.type,
-      address: ch.address,
-      isPrimary: ch.is_primary,
-    }));
+  const rawChannels = input.channels as Array<{ type: string; address: string; is_primary?: boolean }> | undefined;
+  const channels = rawChannels?.map((ch) => ({
+    type: ch.type,
+    address: ch.address,
+    isPrimary: ch.is_primary,
+  }));
 
-    try {
-      const contact = upsertContact({
-        id: input.id as string | undefined,
-        displayName: displayName.trim(),
-        relationship: input.relationship as string | undefined,
-        importance,
-        responseExpectation: input.response_expectation as string | undefined,
-        preferredTone: input.preferred_tone as string | undefined,
-        channels,
-      });
+  try {
+    const contact = upsertContact({
+      id: input.id as string | undefined,
+      displayName: displayName.trim(),
+      relationship: input.relationship as string | undefined,
+      importance,
+      responseExpectation: input.response_expectation as string | undefined,
+      preferredTone: input.preferred_tone as string | undefined,
+      channels,
+    });
 
-      const isNew = contact.createdAt === contact.updatedAt;
-      return {
-        content: `${isNew ? 'Created' : 'Updated'} contact:\n${formatContact(contact)}`,
-        isError: false,
-      };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { content: `Error: ${msg}`, isError: true };
-    }
+    return {
+      content: `${contact.created ? 'Created' : 'Updated'} contact:\n${formatContact(contact)}`,
+      isError: false,
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: `Error: ${msg}`, isError: true };
   }
 }
-
-registerTool(new ContactUpsertTool());

package/src/tools/credentials/vault.ts

@@ -95,15 +95,19 @@ function findStoredOAuthField(service: string, fieldNames: string[]): string | u
     }
   }
 
-  // Fallback: check credential metadata on the access_token record, where
-  // oauth2_connect persists the client config after a successful flow.
+  // Legacy fallback: check credential metadata on the access_token record.
+  // Older OAuth2 flows stored client_id/client_secret only in metadata JSON.
+  // New flows persist them in the keychain (checked above) for defense in depth.
   const metadataKey = fieldNames.some((f) => f.includes('client_id'))
     ? 'oauth2ClientId' as const
     : 'oauth2ClientSecret' as const;
   for (const svc of servicesToCheck) {
     const meta = getCredentialMetadata(svc, 'access_token');
     const value = meta?.[metadataKey];
-    if (value) return value;
+    if (value) {
+      log.debug({ service: svc, field: metadataKey }, 'OAuth client credential resolved from metadata (legacy fallback)');
+      return value;
+    }
   }
 
   return undefined;
@@ -569,7 +573,7 @@ class CredentialStoreTool implements Tool {
             return { content: 'Error: failed to store access token in secure storage', isError: true };
           }
 
-          const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : undefined;
+          const expiresAt = tokens.expiresIn ? Date.now() + tokens.expiresIn * 1000 : null;
 
           let accountInfo: string | undefined;
           if (userinfoUrl && grantedScopes.some((s) => s.includes('userinfo'))) {
@@ -586,6 +590,18 @@ class CredentialStoreTool implements Tool {
             }
           }
 
+          // Persist client credentials in keychain for defense in depth
+          const clientIdStored = setSecureKey(`credential:${service}:client_id`, clientId);
+          if (!clientIdStored) {
+            return { content: 'Error: failed to store client_id in secure storage', isError: true };
+          }
+          if (clientSecret) {
+            const clientSecretStored = setSecureKey(`credential:${service}:client_secret`, clientSecret);
+            if (!clientSecretStored) {
+              return { content: 'Error: failed to store client_secret in secure storage', isError: true };
+            }
+          }
+
           upsertCredentialMetadata(service, 'access_token', {
             allowedTools: allowedTools ?? [],
             expiresAt,

package/src/tools/document/document-tool.ts

@@ -1,165 +1,92 @@
-import { RiskLevel } from '../../permissions/types.js';
-import type { Tool, ToolContext, ToolExecutionResult } from '../types.js';
-import type { ToolDefinition } from '../../providers/types.js';
+import type { ToolContext, ToolExecutionResult } from '../types.js';
 import { randomUUID } from 'node:crypto';
 
-// ── document_create ──────────────────────────────────────────────────
-
-export class DocumentCreateTool implements Tool {
-  name = 'document_create';
-  description =
-    'Create a new long-form document with a rich text editor. Use this when the user asks to write a blog post, article, or any long-form content. The editor opens in workspace mode with chat docked to the side.';
-  category = 'document';
-  defaultRiskLevel = RiskLevel.Low;
-  executionMode = 'local' as const;
-
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
-        type: 'object',
-        properties: {
-          title: {
-            type: 'string',
-            description: 'Initial title for the document (optional, can be updated later)',
-          },
-          initial_content: {
-            type: 'string',
-            description: 'Initial Markdown content to populate the editor (optional)',
-          },
-        },
-      },
-    };
-  }
-
-  async execute(input: Record<string, unknown>, context: ToolContext): Promise<ToolExecutionResult> {
-    const title = (input.title as string | undefined) || 'Untitled Document';
-    const initialContent = (input.initial_content as string | undefined) || '';
-    const surfaceId = `doc-${randomUUID()}`;
-
-    // Send document_editor_show IPC message to open the built-in RTE
-    if (context.sendToClient) {
-      context.sendToClient({
-        type: 'document_editor_show',
-        sessionId: context.sessionId,
-        surfaceId,
-        title,
-        initialContent,
-      });
-
-      context.sendToClient({
-        type: 'ui_surface_show',
-        sessionId: context.sessionId,
-        surfaceId: `preview-${surfaceId}`,
-        surfaceType: 'document_preview',
-        display: 'inline',
+// ── Exported execute functions ──────────────────────────────────────
+
+export function executeDocumentCreate(input: Record<string, unknown>, context: ToolContext): ToolExecutionResult {
+  const title = (input.title as string | undefined) || 'Untitled Document';
+  const initialContent = (input.initial_content as string | undefined) || '';
+  const surfaceId = `doc-${randomUUID()}`;
+
+  // Send document_editor_show IPC message to open the built-in RTE
+  if (context.sendToClient) {
+    context.sendToClient({
+      type: 'document_editor_show',
+      sessionId: context.sessionId,
+      surfaceId,
+      title,
+      initialContent,
+    });
+
+    context.sendToClient({
+      type: 'ui_surface_show',
+      sessionId: context.sessionId,
+      surfaceId: `preview-${surfaceId}`,
+      surfaceType: 'document_preview',
+      display: 'inline',
+      title,
+      data: {
         title,
-        data: {
-          title,
-          surfaceId,
-          subtitle: 'Document',
-        },
-      });
-
-      return {
-        content: JSON.stringify({
-          surface_id: surfaceId,
-          title,
-          opened: true,
-          message: 'Document editor opened in Directory panel',
-        }),
-        isError: false,
-      };
-    }
+        surfaceId,
+        subtitle: 'Document',
+      },
+    });
 
-    // Fallback if no IPC client is connected
     return {
       content: JSON.stringify({
         surface_id: surfaceId,
         title,
-        opened: false,
-        error: 'No IPC client connected to open document editor',
+        opened: true,
+        message: 'Document editor opened in Directory panel',
       }),
       isError: false,
     };
   }
-}
-
-// ── document_update ──────────────────────────────────────────────────
-
-export class DocumentUpdateTool implements Tool {
-  name = 'document_update';
-  description =
-    'Update content in an open document editor. Use this to stream generated content or apply edits.';
-  category = 'document';
-  defaultRiskLevel = RiskLevel.Low;
-  executionMode = 'local' as const;
-
-  getDefinition(): ToolDefinition {
-    return {
-      name: this.name,
-      description: this.description,
-      input_schema: {
-        type: 'object',
-        properties: {
-          surface_id: {
-            type: 'string',
-            description: 'The ID of the document surface to update',
-          },
-          content: {
-            type: 'string',
-            description: 'Markdown content to set or append',
-          },
-          mode: {
-            type: 'string',
-            enum: ['replace', 'append'],
-            description: 'Whether to replace all content or append to the end. Defaults to append.',
-          },
-        },
-        required: ['surface_id', 'content'],
-      },
-    };
-  }
 
-  async execute(input: Record<string, unknown>, context: ToolContext): Promise<ToolExecutionResult> {
-    const surfaceId = input.surface_id as string;
-    const content = input.content as string;
-    const mode = (input.mode as string | undefined) || 'append';
-
-    // Send document_editor_update IPC message to update the built-in RTE
-    if (context.sendToClient) {
-      context.sendToClient({
-        type: 'document_editor_update',
-        sessionId: context.sessionId,
-        surfaceId,
-        markdown: content,
-        mode,
-      });
+  // Fallback if no IPC client is connected
+  return {
+    content: JSON.stringify({
+      surface_id: surfaceId,
+      title,
+      opened: false,
+      error: 'No IPC client connected to open document editor',
+    }),
+    isError: false,
+  };
+}
 
-      return {
-        content: JSON.stringify({
-          success: true,
-          surface_id: surfaceId,
-          mode,
-          message: 'Document content updated',
-        }),
-        isError: false,
-      };
-    }
+export function executeDocumentUpdate(input: Record<string, unknown>, context: ToolContext): ToolExecutionResult {
+  const surfaceId = input.surface_id as string;
+  const content = input.content as string;
+  const mode = (input.mode as string | undefined) || 'append';
+
+  // Send document_editor_update IPC message to update the built-in RTE
+  if (context.sendToClient) {
+    context.sendToClient({
+      type: 'document_editor_update',
+      sessionId: context.sessionId,
+      surfaceId,
+      markdown: content,
+      mode,
+    });
 
-    // Fallback if no IPC client is connected
     return {
       content: JSON.stringify({
-        success: false,
-        error: 'No IPC client connected to update document',
+        success: true,
+        surface_id: surfaceId,
+        mode,
+        message: 'Document content updated',
       }),
-      isError: true,
+      isError: false,
     };
   }
-}
 
-// ── Exported tool instances ──────────────────────────────────────────
-
-export const documentCreateTool = new DocumentCreateTool();
-export const documentUpdateTool = new DocumentUpdateTool();
+  // Fallback if no IPC client is connected
+  return {
+    content: JSON.stringify({
+      success: false,
+      error: 'No IPC client connected to update document',
+    }),
+    isError: true,
+  };
+}