@vellumai/assistant 0.4.2 → 0.4.3

package/src/calls/twilio-routes.ts

@@ -147,10 +147,9 @@ function mapTwilioStatus(twilioStatus: string): CallStatus | null {
  * Supports two modes:
  * - **Outbound** (callSessionId present in query): uses the existing session
  * - **Inbound** (callSessionId absent): creates or reuses a session keyed
- *   by the Twilio CallSid. The optional `forwardedAssistantId` is resolved
- *   by the gateway from the "To" phone number.
+ *   by the Twilio CallSid. Uses daemon internal scope for assistant identity.
  */
-export async function handleVoiceWebhook(req: Request, forwardedAssistantId?: string): Promise<Response> {
+export async function handleVoiceWebhook(req: Request): Promise<Response> {
   const url = new URL(req.url);
   const callSessionId = url.searchParams.get('callSessionId');
 
@@ -167,13 +166,12 @@ export async function handleVoiceWebhook(req: Request, forwardedAssistantId?: st
       return new Response('Missing CallSid', { status: 400 });
     }
 
-    log.info({ callSid, from: callerFrom, to: callerTo, assistantId: forwardedAssistantId }, 'Inbound voice webhook — creating/reusing session');
+    log.info({ callSid, from: callerFrom, to: callerTo }, 'Inbound voice webhook — creating/reusing session');
 
     const { session } = createInboundVoiceSession({
       callSid,
       fromNumber: callerFrom,
       toNumber: callerTo,
-      assistantId: forwardedAssistantId,
     });
 
     return buildVoiceWebhookTwiml(session.id, session.assistantId ?? undefined, session.task, session.guardianVerificationSessionId);

package/src/calls/types.ts

@@ -1,5 +1,5 @@
 export type CallStatus = 'initiated' | 'ringing' | 'in_progress' | 'waiting_on_user' | 'completed' | 'failed' | 'cancelled';
-export type CallEventType = 'call_started' | 'call_connected' | 'caller_spoke' | 'assistant_spoke' | 'user_question_asked' | 'user_answered' | 'user_instruction_relayed' | 'call_ended' | 'call_failed' | 'callee_verification_started' | 'callee_verification_succeeded' | 'callee_verification_failed' | 'guardian_voice_verification_started' | 'guardian_voice_verification_succeeded' | 'guardian_voice_verification_failed' | 'outbound_guardian_voice_verification_started' | 'outbound_guardian_voice_verification_succeeded' | 'outbound_guardian_voice_verification_failed' | 'guardian_consultation_timed_out' | 'guardian_unavailable_skipped' | 'guardian_consult_deferred' | 'guardian_consult_coalesced' | 'inbound_acl_denied' | 'invite_redemption_started' | 'invite_redemption_succeeded' | 'invite_redemption_failed';
+export type CallEventType = 'call_started' | 'call_connected' | 'caller_spoke' | 'assistant_spoke' | 'user_question_asked' | 'user_answered' | 'user_instruction_relayed' | 'call_ended' | 'call_failed' | 'callee_verification_started' | 'callee_verification_succeeded' | 'callee_verification_failed' | 'guardian_voice_verification_started' | 'guardian_voice_verification_succeeded' | 'guardian_voice_verification_failed' | 'outbound_guardian_voice_verification_started' | 'outbound_guardian_voice_verification_succeeded' | 'outbound_guardian_voice_verification_failed' | 'guardian_consultation_timed_out' | 'guardian_unavailable_skipped' | 'guardian_consult_deferred' | 'guardian_consult_coalesced' | 'inbound_acl_denied' | 'inbound_acl_name_capture_started' | 'inbound_acl_name_captured' | 'inbound_acl_name_capture_timeout' | 'inbound_acl_access_approved' | 'inbound_acl_access_denied' | 'inbound_acl_access_timeout' | 'invite_redemption_started' | 'invite_redemption_succeeded' | 'invite_redemption_failed';
 export type PendingQuestionStatus = 'pending' | 'answered' | 'expired' | 'cancelled';
 
 /**

package/src/calls/voice-session-bridge.ts

@@ -19,6 +19,7 @@ import type { GuardianRuntimeContext } from '../daemon/session-runtime-assembly.
 import { resolveChannelCapabilities } from '../daemon/session-runtime-assembly.js';
 import { buildAssistantEvent } from '../runtime/assistant-event.js';
 import { assistantEventHub } from '../runtime/assistant-event-hub.js';
+import { DAEMON_INTERNAL_ASSISTANT_ID } from '../runtime/assistant-scope.js';
 import { checkIngressForSecrets } from '../security/secret-ingress.js';
 import { computeToolApprovalDigest } from '../security/tool-approval-digest.js';
 import { IngressBlockedError } from '../util/errors.js';
@@ -306,7 +307,7 @@ export async function startVoiceTurn(opts: VoiceTurnOptions): Promise<VoiceTurnH
     ...session.memoryPolicy,
     strictSideEffects,
   };
-  session.setAssistantId(opts.assistantId ?? 'self');
+  session.setAssistantId(opts.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID);
   session.callSessionId = opts.callSessionId;
   session.setGuardianContext(opts.guardianContext ?? null);
   session.setCommandIntent(null);
@@ -330,7 +331,7 @@ export async function startVoiceTurn(opts: VoiceTurnOptions): Promise<VoiceTurnH
         ? (msg as { sessionId: string }).sessionId
         : undefined;
     const resolvedSessionId = msgSessionId ?? opts.conversationId;
-    const event = buildAssistantEvent('self', msg, resolvedSessionId);
+    const event = buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, msg, resolvedSessionId);
     hubChain = (async () => {
       await hubChain;
       try {
@@ -364,7 +365,7 @@ export async function startVoiceTurn(opts: VoiceTurnOptions): Promise<VoiceTurnH
             toolName: msg.toolName,
             inputDigest,
             consumingRequestId: msg.requestId,
-            assistantId: opts.assistantId ?? 'self',
+            assistantId: opts.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
             executionChannel: 'voice',
             conversationId: opts.conversationId,
             callSessionId: opts.callSessionId,

package/src/cli/core-commands.ts

@@ -107,8 +107,9 @@ export function registerDaemonCommand(program: Command): void {
 export function registerDevCommand(program: Command): void {
   program
     .command('dev')
-    .description('Run the daemon in dev mode with auto-restart on file changes')
-    .action(async () => {
+    .description('Run the daemon in dev mode')
+    .option('--watch', 'Auto-restart on source file changes (disruptive during Claude Code sessions)')
+    .action(async (opts: { watch?: boolean }) => {
       let status = await getDaemonStatus();
       if (status.running) {
         log.info('Stopping existing daemon...');
@@ -161,10 +162,12 @@ export function registerDevCommand(program: Command): void {
 
       const mainPath = `${import.meta.dirname}/../daemon/main.ts`;
 
-      log.info('Starting daemon in dev mode (Ctrl+C to stop)');
+      const useWatch = opts.watch === true;
+      log.info(`Starting daemon in dev mode${useWatch ? ' with file watching' : ''} (Ctrl+C to stop)`);
 
       const repoRoot = join(import.meta.dirname, '..', '..', '..');
-      const child = spawn('bun', ['--watch', 'run', mainPath], {
+      const args = useWatch ? ['--watch', 'run', mainPath] : ['run', mainPath];
+      const child = spawn('bun', args, {
         stdio: 'inherit',
         env: {
           ...process.env,

package/src/config/bundled-skills/app-builder/SKILL.md

@@ -673,6 +673,28 @@ Wrap in `.v-metric-grid` for responsive 2-4 column layout. Always use a semantic
 
 `.v-pullquote` — Blockquote with gradient accent border. `.v-comparison` — Before/after cards (3-column grid with `.before`/`.after` modifiers). `.v-page` — Centered container (max-width 600px). Use `.v-animate-in` on children for staggered fade-in. Use `.v-gradient-text` for accent-colored gradient text.
 
+`.v-slideshow` — Presentation slide deck with transitions and navigation. Init with `vellum.widgets.slideshow()`:
+```html
+<div class="v-slideshow" id="deck">
+  <div class="v-slide">
+    <div class="v-slide-header">
+      <span class="v-slide-label">Overview</span>
+    </div>
+    <h1 class="v-slide-title">The city that never <span class="accent-word">sleeps</span></h1>
+    <p class="v-slide-body">Body text here...</p>
+    <div class="v-slide-stats">
+      <div class="v-slide-stat">
+        <span class="v-slide-stat-value">8.3M</span>
+        <span class="v-slide-stat-label">Residents</span>
+      </div>
+    </div>
+  </div>
+  <div class="v-slide"><!-- Slide 2 --></div>
+  <div class="v-slide"><!-- Slide 3 --></div>
+</div>
+```
+Slide content helpers: `.v-slide-label` (section label with colored dot), `.v-slide-title` (responsive heading), `.v-slide-body` (body text, max-width 540px), `.v-slide-stats` (auto-fit grid), `.v-slide-stat` / `.v-slide-stat-value` / `.v-slide-stat-label` (big-number cards), `.v-slide-quote` / `.v-slide-quote-attribution` (blockquote), `.v-slide-list` (styled list), `.v-slide-columns` / `.v-slide-column` (2-column comparison grid).
+
 #### Widget JavaScript utilities
 
 Interactive utilities at `window.vellum.widgets.*`:
@@ -724,6 +746,13 @@ vellum.widgets.toast('Connection lost', 'error', 0);      // Manual dismiss
 vellum.widgets.countdown('timer-el', '2025-12-31T00:00:00Z', {
   onComplete: () => console.log('Done!')
 });
+
+// Slideshow — presentation deck with transitions and navigation
+vellum.widgets.slideshow('deck', {
+  transition: 'fade', showDots: true, showArrows: true,
+  showCounter: true, keyboard: true, loop: true
+});
+// Returns: { goTo(index), next(), prev() }
 ```
 
 #### Composition recipes
@@ -992,9 +1021,142 @@ async function handleBulk(action) {
 }
 ```
 
+**Presentation slideshow** — multi-slide deck with 8 layout variants (title, stats, bullets, quote, comparison, visual, timeline, closing). Use the slideshow widget for presentations, pitch decks, and multi-slide educational content. The model provides slide content; the widget handles navigation, transitions, and keyboard support.
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<style>
+  :root { --v-accent: #8B5CF6; }
+  body { margin: 0; padding: 0; background: linear-gradient(-45deg, #0f172a, #1e1b4b, #172554); min-height: 100vh; }
+  .v-slideshow { border-radius: 0; min-height: 100vh; }
+  .accent-word { color: var(--v-accent); }
+  .trust-pill { display: inline-flex; align-items: center; gap: 6px; padding: 6px 14px; border-radius: 999px; font-size: 13px; font-weight: 500; background: color-mix(in srgb, var(--v-surface) 60%, transparent); border: 1px solid var(--v-surface-border); color: var(--v-text-secondary); margin-top: var(--v-spacing-lg); }
+  .trust-pill.accent { border-color: color-mix(in srgb, var(--v-accent) 30%, transparent); color: var(--v-accent); }
+  .v-slide-list li { font-size: 15px; line-height: 1.7; }
+  .v-slide-columns h3 { margin: 0 0 var(--v-spacing-sm); color: var(--v-text); font-size: var(--v-font-size-lg); }
+  .slide-visual { position: relative; overflow: hidden; }
+  .slide-visual-bg { position: absolute; inset: 0; background: radial-gradient(ellipse at 30% 40%, color-mix(in srgb, var(--v-accent) 15%, transparent), transparent 70%), radial-gradient(ellipse at 70% 60%, color-mix(in srgb, var(--v-forest-500, #22c55e) 10%, transparent), transparent 60%); }
+  .slide-visual-overlay { position: relative; z-index: 1; background: color-mix(in srgb, var(--v-bg) 40%, transparent); backdrop-filter: blur(20px); -webkit-backdrop-filter: blur(20px); border-radius: var(--v-radius-lg); padding: var(--v-spacing-xl); max-width: 500px; }
+</style>
+</head>
+<body>
+<div class="v-slideshow" id="deck">
+
+  <!-- 1. Title slide -->
+  <div class="v-slide">
+    <span class="v-slide-label">Introduction</span>
+    <h1 class="v-slide-title">The city that never <span class="accent-word">sleeps</span></h1>
+    <p class="v-slide-body">A brief subtitle or tagline here.</p>
+    <span class="trust-pill accent">&#x1f5fd; 8.3 million residents</span>
+  </div>
+
+  <!-- 2. Content + Stats slide -->
+  <div class="v-slide">
+    <span class="v-slide-label">By the Numbers</span>
+    <h2 class="v-slide-title">Economy at a glance</h2>
+    <p class="v-slide-body">New York generates more GDP than most countries...</p>
+    <div class="v-slide-stats">
+      <div class="v-slide-stat"><span class="v-slide-stat-value">$2.1T</span><span class="v-slide-stat-label">Metro GDP</span></div>
+      <div class="v-slide-stat"><span class="v-slide-stat-value">4.7M</span><span class="v-slide-stat-label">Jobs</span></div>
+      <div class="v-slide-stat"><span class="v-slide-stat-value">#1</span><span class="v-slide-stat-label">Financial Hub</span></div>
+    </div>
+  </div>
+
+  <!-- 3. Bullet points slide -->
+  <div class="v-slide">
+    <span class="v-slide-label">Culture</span>
+    <h2 class="v-slide-title">What makes it <span class="accent-word">unique</span></h2>
+    <ul class="v-slide-list">
+      <li>&#x1f3ad; Broadway — 41 professional theaters in the Theater District</li>
+      <li>&#x1f3db;&#xfe0f; 80+ world-class museums including the Met and MoMA</li>
+      <li>&#x1f355; Over 27,000 restaurants spanning every cuisine on earth</li>
+      <li>&#x1f333; 843 acres of Central Park in the heart of Manhattan</li>
+    </ul>
+  </div>
+
+  <!-- 4. Quote slide -->
+  <div class="v-slide" style="justify-content: center; align-items: center; text-align: center;">
+    <div class="v-slide-quote" style="border-left: none; padding-left: 0;">
+      "There is no place like New York. It is the most exciting city in the world."
+    </div>
+    <div class="v-slide-quote-attribution">— John Updike</div>
+  </div>
+
+  <!-- 5. Comparison / Two-column slide -->
+  <div class="v-slide">
+    <span class="v-slide-label">Comparison</span>
+    <h2 class="v-slide-title">Manhattan vs Brooklyn</h2>
+    <div class="v-slide-columns">
+      <div class="v-slide-column">
+        <h3>&#x1f3d9;&#xfe0f; Manhattan</h3>
+        <p class="v-slide-body" style="margin-bottom: var(--v-spacing-sm);">Financial center, dense skyscrapers, high-energy nightlife, world-famous landmarks.</p>
+        <span class="v-slide-stat-value">1.6M</span>
+        <span class="v-slide-stat-label">Population</span>
+      </div>
+      <div class="v-slide-column">
+        <h3>&#x1f309; Brooklyn</h3>
+        <p class="v-slide-body" style="margin-bottom: var(--v-spacing-sm);">Creative hub, brownstone neighborhoods, artisan food scene, waterfront parks.</p>
+        <span class="v-slide-stat-value">2.7M</span>
+        <span class="v-slide-stat-label">Population</span>
+      </div>
+    </div>
+  </div>
+
+  <!-- 6. Image/visual slide -->
+  <div class="v-slide slide-visual">
+    <div class="slide-visual-bg"></div>
+    <div class="slide-visual-overlay">
+      <span class="v-slide-label">Skyline</span>
+      <h2 class="v-slide-title">An iconic <span class="accent-word">horizon</span></h2>
+      <p class="v-slide-body">The Manhattan skyline is recognized worldwide...</p>
+    </div>
+  </div>
+
+  <!-- 7. Timeline slide -->
+  <div class="v-slide">
+    <span class="v-slide-label">History</span>
+    <h2 class="v-slide-title">Key <span class="accent-word">milestones</span></h2>
+    <div class="v-timeline" style="margin-top: var(--v-spacing-lg);">
+      <div class="v-timeline-entry"><span class="v-timeline-time">1626</span><span class="v-timeline-title">Manhattan purchased</span></div>
+      <div class="v-timeline-entry"><span class="v-timeline-time">1886</span><span class="v-timeline-title">Statue of Liberty dedicated</span></div>
+      <div class="v-timeline-entry active"><span class="v-timeline-time">1931</span><span class="v-timeline-title">Empire State Building opens</span></div>
+    </div>
+  </div>
+
+  <!-- 8. Closing / CTA slide -->
+  <div class="v-slide" style="text-align: center; align-items: center;">
+    <h1 class="v-slide-title">The world's <span class="accent-word">capital</span></h1>
+    <p class="v-slide-body" style="max-width: 400px;">New York isn't just a city — it's an idea that never stops evolving.</p>
+    <div class="v-slide-stats" style="margin-top: var(--v-spacing-xxl);">
+      <div class="v-slide-stat"><span class="v-slide-stat-value">800+</span><span class="v-slide-stat-label">Languages spoken</span></div>
+      <div class="v-slide-stat"><span class="v-slide-stat-value">62M</span><span class="v-slide-stat-label">Annual visitors</span></div>
+    </div>
+  </div>
+
+</div>
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  vellum.widgets.slideshow('deck', {
+    transition: 'fade',
+    showDots: true,
+    showArrows: true,
+    showCounter: true,
+    keyboard: true,
+    loop: true
+  });
+});
+</script>
+</body>
+</html>
+```
+
 #### When to use widgets vs custom HTML
 
-- **Use widgets** for standard patterns — tables, metrics, timelines, notifications
+- **Use widgets** for standard patterns — tables, metrics, timelines, notifications, presentations
 - **Use custom HTML** for novel or creative UIs — games, art tools, unique dashboards
 - **Mix freely** — widgets compose well together and with custom elements
 - Always prioritize the ideal user experience over using the widget library
@@ -1326,6 +1488,7 @@ Before delivering any app, mentally verify these 10 items — they cover the gap
 | `.v-pill-toggles` | Time range / filter toggle group | `.v-pill-toggle` (`.active`) — container with pill buttons |
 | `.v-chip-group` | Suggestion / filter chip row | `.v-chip` (`.active`) — wrapping row of clickable pills |
 | `.v-metric-card .v-metric-icon` | Emoji icon in metric cards | Place emoji `<span>` with `.v-metric-icon` inside `.v-metric-card` |
+| `.v-slideshow` | Presentation slide deck with transitions | `.v-slide` (`.active`), `.v-slide-label`, `.v-slide-title`, `.v-slide-body`, `.v-slide-stats`, `.v-slide-stat`, `.v-slide-quote` — init with `vellum.widgets.slideshow()` |
 
 Every app should include: search/filter, toast notifications for all CRUD operations, `window.vellum.confirm()` for destructive actions, staggered page-load animation, card hover effects, and skeleton loading states.
 

package/src/config/bundled-skills/vercel-token-setup/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: "Vercel Token Setup"
+description: "Set up a Vercel API token for publishing apps using browser automation"
+includes: ["browser"]
+metadata: {"vellum": {"emoji": "▲"}}
+---
+
+You are helping your user set up a Vercel API token so they can publish apps to the web.
+
+## Client Check
+
+Determine whether the user has browser automation available (macOS desktop app) or is on a non-interactive channel (Telegram, SMS, etc.).
+
+- **macOS desktop app**: Follow the **Automated Setup** path below.
+- **Telegram or other channel** (no browser automation): Follow the **Manual Setup for Channels** path below.
+
+---
+
+# Path A: Manual Setup for Channels (Telegram, SMS, etc.)
+
+When the user is on Telegram or any non-macOS client, walk them through a text-based setup. No browser automation is used — the user follows links and performs each action manually.
+
+### Channel Step 1: Confirm and Explain
+
+Tell the user:
+
+> **Setting up Vercel API Token**
+>
+> Since I can't automate the browser from here, I'll walk you through each step with direct links. You'll need:
+> 1. A Vercel account (free tier works)
+> 2. About 2 minutes
+>
+> Ready to start?
+
+If the user declines, acknowledge and stop.
+
+### Channel Step 2: Create the Token
+
+Tell the user:
+
+> **Step 1: Create an API token**
+>
+> Open this link to go to your Vercel tokens page:
+> https://vercel.com/account/tokens
+>
+> 1. Click **"Create"** (or **"Create Token"**)
+> 2. Set the token name to **"Vellum Assistant"**
+> 3. Select scope: **"Full Account"**
+> 4. Set expiration to the longest option available (or **"No Expiration"** if offered)
+> 5. Click **"Create Token"**
+>
+> A token value will appear — **copy it now**, as it's only shown once.
+
+### Channel Step 3: Store the Token
+
+Tell the user:
+
+> **Step 2: Send me the token**
+>
+> Please paste the token value into the secure prompt below.
+
+Present the secure prompt:
+
+```
+credential_store prompt:
+  service: "vercel"
+  field: "api_token"
+  label: "Vercel API Token"
+  description: "Paste the API token you just created on vercel.com"
+  placeholder: "Enter your Vercel API token"
+```
+
+Wait for the user to complete the prompt. Once received, store it:
+
+```
+credential_store store:
+  service: "vercel"
+  field: "api_token"
+  value: "<the token the user provided>"
+  allowedTools: ["publish_page", "unpublish_page"]
+  allowedDomains: ["api.vercel.com"]
+```
+
+### Channel Step 4: Done!
+
+> **Vercel is connected!** You can now publish apps to the web. Try clicking Publish on any app you've built.
+
+---
+
+# Path B: Automated Setup (macOS Desktop App)
+
+You will automate Vercel token creation via the browser while the user watches. The user's only manual action is signing in to Vercel (if needed) and one copy-paste for the token value.
+
+## Browser Interaction Principles
+
+Vercel's UI may change over time. Do NOT memorize or depend on specific element IDs, CSS selectors, or DOM structures. Instead:
+
+1. **Screenshot first, act second.** Before every interaction, take a `browser_screenshot` to see the current visual state. Use `browser_snapshot` to find interactive elements.
+2. **Adapt to what you see.** If a button's label or position differs from what you expect, use the screenshot to find the correct element.
+3. **Verify after every action.** After clicking, typing, or navigating, take a new screenshot to confirm the action succeeded.
+4. **Never assume DOM structure.** Use the snapshot to identify what's on the page and interact accordingly.
+5. **When stuck, screenshot and describe.** If you cannot find an expected element after 2 attempts, take a screenshot, describe what you see to the user, and ask for guidance.
+
+## Anti-Loop Guardrails
+
+Each step has a **retry budget of 3 attempts**. An attempt is one try at the step's primary action (e.g., clicking a button, filling a form). If a step fails after 3 attempts:
+
+1. **Stop trying.** Do not continue retrying the same approach.
+2. **Fall back to manual.** Tell the user what you were trying to do and ask them to complete that step manually in the browser. Give them the direct URL and clear text instructions.
+3. **Resume automation** at the next step once the user confirms the manual step is done.
+
+If **two or more steps** require manual fallback, abandon the automated flow entirely and switch to giving the user the remaining steps as clear text instructions with links.
+
+## Things That Do Not Work — Do Not Attempt
+
+These actions are technically impossible in the browser automation environment:
+
+- **Downloading files.** `browser_click` on a Download button does not save files to disk.
+- **Reading the token value from a screenshot.** The token IS visible in the creation dialog, but you MUST NOT attempt to read it from a screenshot — it is too easy to misread characters, and the value must be exact. Always use the `credential_store prompt` approach to let the user copy-paste it accurately.
+- **Clipboard operations.** You cannot copy/paste via browser automation.
+
+## Step 1: Single Upfront Confirmation
+
+Tell the user:
+
+> **Setting up your Vercel API token so we can publish your app...**
+>
+> Here's what will happen:
+> 1. **A browser opens** to your Vercel account settings
+> 2. **You sign in** (if not already signed in)
+> 3. **I create the token** — you just watch
+> 4. **One quick copy-paste** — I'll ask you to copy the token value into a secure prompt
+>
+> Takes about a minute. Ready?
+
+If the user declines, acknowledge and stop. No further confirmations are needed after this point.
+
+## Step 2: Open Vercel and Sign In
+
+**Goal:** The user is signed in and the Vercel tokens page is loaded.
+
+Navigate to `https://vercel.com/account/tokens`.
+
+Take a screenshot and snapshot to check the page state:
+- **Sign-in page:** Tell the user: "Please sign in to your Vercel account in the browser." Then auto-detect sign-in completion by polling screenshots every 5-10 seconds. Check if the current URL has moved away from the login/sign-in page to the tokens page. Do NOT ask the user to "let me know when you're done" — detect it automatically. Once sign-in is detected, tell the user: "Signed in! Creating your API token now..."
+- **Already signed in:** Tell the user: "Already signed in — creating your API token now..." and continue immediately.
+
+**Verify:** URL contains `vercel.com/account/tokens` and no sign-in overlay is visible.
+
+## Step 3: Create Token
+
+**Goal:** A new API token named "Vellum Assistant" is created.
+
+Take a screenshot and snapshot. Find and click the button to create a new token (typically labeled "Create" or "Create Token").
+
+On the creation form:
+- Token name: **"Vellum Assistant"**
+- Scope: Select **"Full Account"** (or the broadest scope available)
+- Expiration: Select the longest option available, or **"No Expiration"** if offered
+- Click create/submit
+
+**Verify:** Take a screenshot. A dialog or section should now display the newly created token value.
+
+## Step 4: Capture Token via Secure Prompt
+
+**Goal:** The token value is securely captured and stored.
+
+### CRITICAL — Token Capture Protocol
+
+After token creation, Vercel shows the token value **once**. You MUST follow this exact sequence — **no improvisation**:
+
+1. Tell the user: "Your token has been created! Please copy the token value shown on screen and paste it into the secure prompt below."
+2. **IMMEDIATELY** present a `credential_store prompt` for the token. This is your ONLY next action.
+3. Wait for the user to paste the token.
+
+**Absolute prohibitions during this step:**
+- Do NOT try to read the token value from the screenshot. It must come from the user via secure prompt to ensure accuracy.
+- Do NOT navigate away from the page until the user has pasted the token.
+- Do NOT click any download or copy buttons.
+
+Present the secure prompt:
+
+```
+credential_store prompt:
+  service: "vercel"
+  field: "api_token"
+  label: "Vercel API Token"
+  description: "Copy the token value shown on the Vercel page and paste it here."
+  placeholder: "Enter your Vercel API token"
+```
+
+Wait for the user to complete the prompt. Once received, store it:
+
+```
+credential_store store:
+  service: "vercel"
+  field: "api_token"
+  value: "<the token the user provided>"
+  allowedTools: ["publish_page", "unpublish_page"]
+  allowedDomains: ["api.vercel.com"]
+```
+
+**Verify:** `credential_store list` shows `api_token` for `vercel`.
+
+## Step 5: Done!
+
+"**Vercel is connected!** Your API token is set up and ready to go. You can now publish apps to the web."
+
+## Error Handling
+
+- **Page load failures:** Retry navigation once. If it still fails, tell the user and ask them to check their internet connection.
+- **Element not found:** Take a fresh screenshot to re-assess. The Vercel UI may have changed. Describe what you see and try alternative approaches. If stuck after 2 attempts, ask the user for guidance.
+- **Token already exists with same name:** This is fine — Vercel allows multiple tokens with the same name. Proceed with creation.
+- **Any unexpected state:** Take a `browser_screenshot`, describe what you see, and ask the user for guidance.

package/src/config/calls-schema.ts

@@ -125,6 +125,18 @@ export const CallsConfigSchema = z.object({
     .positive('calls.userConsultTimeoutSeconds must be a positive integer')
     .max(2_147_483, 'calls.userConsultTimeoutSeconds must be at most 2147483 (setTimeout-safe limit)')
     .default(120),
+  ttsPlaybackDelayMs: z
+    .number({ error: 'calls.ttsPlaybackDelayMs must be a number' })
+    .int('calls.ttsPlaybackDelayMs must be an integer')
+    .min(0, 'calls.ttsPlaybackDelayMs must be >= 0')
+    .max(10_000, 'calls.ttsPlaybackDelayMs must be at most 10000')
+    .default(3000),
+  accessRequestPollIntervalMs: z
+    .number({ error: 'calls.accessRequestPollIntervalMs must be a number' })
+    .int('calls.accessRequestPollIntervalMs must be an integer')
+    .min(50, 'calls.accessRequestPollIntervalMs must be >= 50')
+    .max(10_000, 'calls.accessRequestPollIntervalMs must be at most 10000')
+    .default(500),
   disclosure: CallsDisclosureConfigSchema.default(CallsDisclosureConfigSchema.parse({})),
   safety: CallsSafetyConfigSchema.default(CallsSafetyConfigSchema.parse({})),
   voice: CallsVoiceConfigSchema.default(CallsVoiceConfigSchema.parse({})),

package/src/config/feature-flag-registry.json

@@ -49,14 +49,6 @@
       "description": "Send crash reports and error diagnostics to help improve the app",
       "defaultEnabled": true
     },
-    {
-      "id": "voice-invite-redemption",
-      "scope": "assistant",
-      "key": "feature_flags.voice-invite-redemption.enabled",
-      "label": "Voice Invite Redemption",
-      "description": "Enable voice invite code redemption for inbound callers with active voice invites",
-      "defaultEnabled": false
-    },
     {
       "id": "user-hosted-enabled",
       "scope": "macos",

package/src/config/vellum-skills/trusted-contacts/SKILL.md

@@ -254,6 +254,8 @@ INVITE_JSON=$(curl -s -X POST "$INTERNAL_GATEWAY_BASE_URL/v1/ingress/invites" \
   -d '{
     "sourceChannel": "voice",
     "expectedExternalUserId": "<phone_number_E164>",
+    "friendName": "<invitee_first_name>",
+    "guardianName": "<guardian_first_name>",
     "maxUses": 1,
     "note": "<optional note, e.g. the person it is for>"
   }')
@@ -263,6 +265,8 @@ printf '%s\n' "$INVITE_JSON"
 Required fields:
 - `sourceChannel` — must be `"voice"`
 - `expectedExternalUserId` — the invitee's phone number in E.164 format (e.g., `+15551234567`)
+- `friendName` — the invitee's first name (used in the voice greeting)
+- `guardianName` — the guardian's first name (used in the voice greeting)
 
 Optional fields:
 - `maxUses` — how many times the code can be used (default: 1)
@@ -348,6 +352,8 @@ Replace `<invite_id>` with the invite's `id` from the list response. The same re
   - `sourceChannel is required for create` — when creating an invite, always pass `"sourceChannel": "telegram"` for Telegram or `"sourceChannel": "voice"` for voice invites.
   - `expectedExternalUserId is required for voice invites` — voice invites must include the invitee's phone number.
   - `expectedExternalUserId must be in E.164 format` — the phone number must start with `+` followed by country code and number (e.g., `+15551234567`).
+  - `friendName is required for voice invites` — ask for the invitee's first name.
+  - `guardianName is required for voice invites` — ask for the guardian's (your user's) first name.
   - `Invite not found or already revoked` — the invite ID may be invalid or the invite is already revoked.
 
 ## Typical Workflows
@@ -368,9 +374,9 @@ Replace `<invite_id>` with the invite's `id` from the list response. The same re
 
 **"Revoke invite"** / **"Cancel invite link"** — List invites to identify the target, confirm, then revoke by ID.
 
-**"Create a voice invite for +15551234567"** — Create a voice invite with `sourceChannel: "voice"` and the given phone number as `expectedExternalUserId`. Present the invite code and instructions: the person must call from that number and enter the code.
+**"Create a voice invite for +15551234567"** — Ask for the friend's first name and the guardian's first name (if not already known), then create a voice invite with `sourceChannel: "voice"`, the phone number as `expectedExternalUserId`, and both names. Present the invite code and instructions: the person must call from that number and enter the code.
 
-**"Let my mom call in"** / **"Invite someone by phone"** — Ask for the phone number in E.164 format, create a voice invite, and present the code + calling instructions.
+**"Let my mom call in"** / **"Invite someone by phone"** — Ask for the phone number in E.164 format, the friend's first name, and the guardian's first name. Create a voice invite and present the code + calling instructions.
 
 **"Show my voice invites"** / **"List phone invites"** — List invites filtered by `sourceChannel=voice`, present active invites with bound phone number and expiration info.
 

package/src/daemon/handlers/config-channels.ts

@@ -3,6 +3,7 @@ import * as net from 'node:net';
 import type { ChannelId } from '../../channels/types.js';
 import * as externalConversationStore from '../../memory/external-conversation-store.js';
 import { findMember, revokeMember } from '../../memory/ingress-member-store.js';
+import { DAEMON_INTERNAL_ASSISTANT_ID } from '../../runtime/assistant-scope.js';
 import {
   createVerificationChallenge,
   findActiveSession,
@@ -17,7 +18,6 @@ import {
   resendOutbound,
   startOutbound,
 } from '../../runtime/guardian-outbound-actions.js';
-import { normalizeAssistantId } from '../../util/platform.js';
 import type {
   ChannelReadinessRequest,
   GuardianVerificationRequest,
@@ -64,7 +64,7 @@ export function createGuardianChallenge(
   rebind?: boolean,
   sessionId?: string,
 ): GuardianVerificationResult {
-  const resolvedAssistantId = normalizeAssistantId(assistantId ?? 'self');
+  const resolvedAssistantId = DAEMON_INTERNAL_ASSISTANT_ID;
   const resolvedChannel = channel ?? 'telegram';
 
   const existingBinding = getGuardianBinding(resolvedAssistantId, resolvedChannel);
@@ -89,9 +89,9 @@ export function createGuardianChallenge(
 
 export function getGuardianStatus(
   channel?: ChannelId,
-  assistantId?: string,
+  _assistantId?: string,
 ): GuardianVerificationResult {
-  const resolvedAssistantId = normalizeAssistantId(assistantId ?? 'self');
+  const resolvedAssistantId = DAEMON_INTERNAL_ASSISTANT_ID;
   const resolvedChannel = channel ?? 'telegram';
 
   const binding = getGuardianBinding(resolvedAssistantId, resolvedChannel);
@@ -161,9 +161,7 @@ export function handleGuardianVerification(
   socket: net.Socket,
   ctx: HandlerContext,
 ): void {
-  // Normalize the assistant ID so challenges are always stored under the
-  // same key the inbound-call path will use for lookups (typically "self").
-  const assistantId = normalizeAssistantId(msg.assistantId ?? 'self');
+  const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
   const channel = msg.channel ?? 'telegram';
 
   try {

package/src/daemon/handlers/config-inbox.ts

@@ -40,6 +40,8 @@ export function handleIngressInvite(
           note: msg.note,
           maxUses: msg.maxUses,
           expiresInMs: msg.expiresInMs,
+          friendName: msg.friendName,
+          guardianName: msg.guardianName,
         });
         if (!result.ok) {
           ctx.send(socket, { type: 'ingress_invite_response', success: false, error: result.error });