@vellumai/assistant 0.4.26 → 0.4.29

package/src/skills/managed-store.ts

@@ -1,23 +1,30 @@
-import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync,rmSync, writeFileSync } from 'node:fs';
-import { dirname,join } from 'node:path';
-
-import { getLogger } from '../util/logger.js';
-import { getWorkspaceSkillsDir } from '../util/platform.js';
-
-const log = getLogger('managed-store');
+import { randomUUID } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+
+import { getLogger } from "../util/logger.js";
+import { getWorkspaceSkillsDir } from "../util/platform.js";
+
+const log = getLogger("managed-store");
 
 // ─── Validation ──────────────────────────────────────────────────────────────
 
 const VALID_SKILL_ID = /^[a-z0-9][a-z0-9._-]*$/;
 
 export function validateManagedSkillId(id: string): string | null {
-  if (!id || typeof id !== 'string') return 'skill_id is required';
-  if (id.includes('..') || id.includes('/') || id.includes('\\')) {
-    return 'skill_id must not contain path traversal characters';
+  if (!id || typeof id !== "string") return "skill_id is required";
+  if (id.includes("..") || id.includes("/") || id.includes("\\")) {
+    return "skill_id must not contain path traversal characters";
   }
   if (!VALID_SKILL_ID.test(id)) {
-    return 'skill_id must start with a lowercase letter or digit and contain only lowercase letters, digits, dots, hyphens, and underscores';
+    return "skill_id must start with a lowercase letter or digit and contain only lowercase letters, digits, dots, hyphens, and underscores";
   }
   return null;
 }
@@ -33,7 +40,7 @@ export function getManagedSkillDir(id: string): string {
 }
 
 function getSkillsIndexPath(): string {
-  return join(getManagedSkillsDir(), 'SKILLS.md');
+  return join(getManagedSkillsDir(), "SKILLS.md");
 }
 
 // ─── SKILL.md generation ─────────────────────────────────────────────────────
@@ -49,28 +56,33 @@ export interface BuildSkillMarkdownInput {
 }
 
 export function buildSkillMarkdown(input: BuildSkillMarkdownInput): string {
-  const esc = (s: string) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r');
-  const lines: string[] = ['---'];
+  const esc = (s: string) =>
+    s
+      .replace(/\\/g, "\\\\")
+      .replace(/"/g, '\\"')
+      .replace(/\n/g, "\\n")
+      .replace(/\r/g, "\\r");
+  const lines: string[] = ["---"];
   lines.push(`name: "${esc(input.name)}"`);
   lines.push(`description: "${esc(input.description)}"`);
   if (input.emoji) {
     lines.push(`emoji: "${esc(input.emoji)}"`);
   }
   if (input.userInvocable === false) {
-    lines.push('user-invocable: false');
+    lines.push("user-invocable: false");
   }
   if (input.disableModelInvocation === true) {
-    lines.push('disable-model-invocation: true');
+    lines.push("disable-model-invocation: true");
   }
   if (input.includes && input.includes.length > 0) {
     lines.push(`includes: ${JSON.stringify(input.includes)}`);
   }
-  lines.push('---');
-  lines.push('');
+  lines.push("---");
+  lines.push("");
   lines.push(input.bodyMarkdown);
   // Ensure trailing newline
-  const content = lines.join('\n');
-  return content.endsWith('\n') ? content : content + '\n';
+  const content = lines.join("\n");
+  return content.endsWith("\n") ? content : content + "\n";
 }
 
 // ─── Atomic write ────────────────────────────────────────────────────────────
@@ -78,7 +90,7 @@ export function buildSkillMarkdown(input: BuildSkillMarkdownInput): string {
 function atomicWriteFile(filePath: string, content: string): void {
   const dir = dirname(filePath);
   const tmpPath = join(dir, `.tmp-${randomUUID()}`);
-  writeFileSync(tmpPath, content, 'utf-8');
+  writeFileSync(tmpPath, content, "utf-8");
   renameSync(tmpPath, filePath);
 }
 
@@ -87,19 +99,24 @@ function atomicWriteFile(filePath: string, content: string): void {
 function readIndexLines(): string[] {
   const indexPath = getSkillsIndexPath();
   if (!existsSync(indexPath)) return [];
-  return readFileSync(indexPath, 'utf-8').split('\n');
+  return readFileSync(indexPath, "utf-8").split("\n");
 }
 
 function writeIndexLines(lines: string[]): void {
-  const content = lines.join('\n');
-  atomicWriteFile(getSkillsIndexPath(), content.endsWith('\n') ? content : content + '\n');
+  const content = lines.join("\n");
+  atomicWriteFile(
+    getSkillsIndexPath(),
+    content.endsWith("\n") ? content : content + "\n",
+  );
 }
 
 function indexEntryRegex(id: string): RegExp {
-  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   // Match both - and * bullets, optional backticks, optional markdown link wrapping,
   // and optional /SKILL.md suffix (inside or outside link parens)
-  return new RegExp(`^[-*]\\s+(?:\`)?(?:\\[.*?\\]\\()?${escaped}(?:/SKILL\\.md)?(?:\\))?(?:\`)?\\s*$`);
+  return new RegExp(
+    `^[-*]\\s+(?:\`)?(?:\\[.*?\\]\\()?${escaped}(?:/SKILL\\.md)?(?:\\))?(?:\`)?\\s*$`,
+  );
 }
 
 export function upsertSkillsIndexEntry(id: string): void {
@@ -112,7 +129,7 @@ export function upsertSkillsIndexEntry(id: string): void {
   const nonEmpty = lines.filter((l) => l.trim());
   nonEmpty.push(`- ${id}`);
   writeIndexLines(nonEmpty);
-  log.info({ id }, 'Added managed skill to SKILLS.md index');
+  log.info({ id }, "Added managed skill to SKILLS.md index");
 }
 
 export function removeSkillsIndexEntry(id: string): void {
@@ -123,7 +140,7 @@ export function removeSkillsIndexEntry(id: string): void {
     return; // not found
   }
   writeIndexLines(filtered.filter((l) => l.trim()));
-  log.info({ id }, 'Removed managed skill from SKILLS.md index');
+  log.info({ id }, "Removed managed skill from SKILLS.md index");
 }
 
 // ─── Version metadata ─────────────────────────────────────────────────────────
@@ -134,19 +151,22 @@ interface SkillVersionMeta {
 }
 
 function getVersionMetaPath(id: string): string {
-  return join(getManagedSkillDir(id), 'version.json');
+  return join(getManagedSkillDir(id), "version.json");
 }
 
 function writeVersionMeta(id: string, version: string): void {
-  const meta: SkillVersionMeta = { version, installedAt: new Date().toISOString() };
-  atomicWriteFile(getVersionMetaPath(id), JSON.stringify(meta, null, 2) + '\n');
+  const meta: SkillVersionMeta = {
+    version,
+    installedAt: new Date().toISOString(),
+  };
+  atomicWriteFile(getVersionMetaPath(id), JSON.stringify(meta, null, 2) + "\n");
 }
 
 export function readSkillVersion(id: string): string | null {
   const metaPath = getVersionMetaPath(id);
   if (!existsSync(metaPath)) return null;
   try {
-    const raw = readFileSync(metaPath, 'utf-8');
+    const raw = readFileSync(metaPath, "utf-8");
     const meta: SkillVersionMeta = JSON.parse(raw);
     return meta.version ?? null;
   } catch {
@@ -177,21 +197,38 @@ export interface CreateManagedSkillResult {
   error?: string;
 }
 
-export function createManagedSkill(params: CreateManagedSkillParams): CreateManagedSkillResult {
+export function createManagedSkill(
+  params: CreateManagedSkillParams,
+): CreateManagedSkillResult {
   const validationError = validateManagedSkillId(params.id);
   if (validationError) {
-    return { created: false, path: '', indexUpdated: false, error: validationError };
+    return {
+      created: false,
+      path: "",
+      indexUpdated: false,
+      error: validationError,
+    };
   }
 
   if (!params.name || !params.name.trim()) {
-    return { created: false, path: '', indexUpdated: false, error: 'name is required' };
+    return {
+      created: false,
+      path: "",
+      indexUpdated: false,
+      error: "name is required",
+    };
   }
   if (!params.description || !params.description.trim()) {
-    return { created: false, path: '', indexUpdated: false, error: 'description is required' };
+    return {
+      created: false,
+      path: "",
+      indexUpdated: false,
+      error: "description is required",
+    };
   }
 
   const skillDir = getManagedSkillDir(params.id);
-  const skillFilePath = join(skillDir, 'SKILL.md');
+  const skillFilePath = join(skillDir, "SKILL.md");
 
   if (existsSync(skillFilePath) && !params.overwrite) {
     return {
@@ -225,7 +262,10 @@ export function createManagedSkill(params: CreateManagedSkillParams): CreateMana
     }
   }
 
-  log.info({ id: params.id, path: skillFilePath, version: params.version }, 'Created managed skill');
+  log.info(
+    { id: params.id, path: skillFilePath, version: params.version },
+    "Created managed skill",
+  );
 
   let indexUpdated = false;
   if (params.addToIndex !== false) {
@@ -253,11 +293,15 @@ export function deleteManagedSkill(
 
   const skillDir = getManagedSkillDir(id);
   if (!existsSync(skillDir)) {
-    return { deleted: false, indexUpdated: false, error: `Managed skill "${id}" not found` };
+    return {
+      deleted: false,
+      indexUpdated: false,
+      error: `Managed skill "${id}" not found`,
+    };
   }
 
   rmSync(skillDir, { recursive: true });
-  log.info({ id, path: skillDir }, 'Deleted managed skill');
+  log.info({ id, path: skillDir }, "Deleted managed skill");
 
   let indexUpdated = false;
   if (removeFromIndex) {
@@ -266,7 +310,10 @@ export function deleteManagedSkill(
       indexUpdated = true;
     } catch (err) {
       // Best-effort: skill dir is already gone, don't fail the whole delete
-      log.warn({ id, err }, 'Failed to update skills index after deleting managed skill');
+      log.warn(
+        { id, err },
+        "Failed to update skills index after deleting managed skill",
+      );
     }
   }
 

package/src/skills/path-classifier.ts

@@ -1,8 +1,8 @@
-import { existsSync,realpathSync } from 'node:fs';
-import { basename, dirname, normalize, resolve, sep } from 'node:path';
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, normalize, resolve, sep } from "node:path";
 
-import { getBundledSkillsDir } from '../config/skills.js';
-import { getWorkspaceSkillsDir } from '../util/platform.js';
+import { getBundledSkillsDir } from "../config/skills.js";
+import { getWorkspaceSkillsDir } from "../util/platform.js";
 
 /**
  * Returns the managed skills root directory. Managed skills are user-installed
@@ -44,7 +44,7 @@ export function normalizeDirPath(dirPath: string): string {
   while (current !== dirname(current)) {
     if (existsSync(current)) {
       const realBase = realpathSync(current);
-      const tail = segments.reduceRight((acc, seg) => acc + sep + seg, '');
+      const tail = segments.reduceRight((acc, seg) => acc + sep + seg, "");
       const full = normalize(realBase + tail);
       return full.endsWith(sep) ? full : full + sep;
     }
@@ -91,10 +91,7 @@ export function normalizeFilePath(filePath: string): string {
  * be passed via the `extraRoots` parameter.
  */
 export function getSkillRoots(extraRoots?: string[]): string[] {
-  const roots = [
-    getManagedSkillsRoot(),
-    getBundledSkillsRoot(),
-  ];
+  const roots = [getManagedSkillsRoot(), getBundledSkillsRoot()];
   if (extraRoots) {
     for (const root of extraRoots) {
       roots.push(normalizeDirPath(root));
@@ -115,7 +112,10 @@ export function getSkillRoots(extraRoots?: string[]): string[] {
  * @param extraRoots - Optional additional skill root directories to check.
  * @returns true if the path is inside any skill directory.
  */
-export function isSkillSourcePath(absPath: string, extraRoots?: string[]): boolean {
+export function isSkillSourcePath(
+  absPath: string,
+  extraRoots?: string[],
+): boolean {
   const normalizedPath = normalizeFilePath(absPath);
   const roots = getSkillRoots(extraRoots);
 

package/src/skills/remote-skill-policy.ts

@@ -1,7 +1,13 @@
-export type RemoteSkillProvider = 'clawhub' | 'skillssh';
+export type RemoteSkillProvider = "clawhub" | "skillssh";
 
-export type SkillsShRisk = 'safe' | 'low' | 'medium' | 'high' | 'critical' | 'unknown';
-export type SkillsShRiskThreshold = Exclude<SkillsShRisk, 'unknown'>;
+export type SkillsShRisk =
+  | "safe"
+  | "low"
+  | "medium"
+  | "high"
+  | "critical"
+  | "unknown";
+export type SkillsShRiskThreshold = Exclude<SkillsShRisk, "unknown">;
 
 export interface RemoteSkillPolicy {
   /**
@@ -35,12 +41,12 @@ interface RemoteSkillCandidateBase {
 }
 
 export interface ClawhubRemoteSkillCandidate extends RemoteSkillCandidateBase {
-  provider: 'clawhub';
+  provider: "clawhub";
   moderation?: ClawhubModerationState | null;
 }
 
 export interface SkillsShRemoteSkillCandidate extends RemoteSkillCandidateBase {
-  provider: 'skillssh';
+  provider: "skillssh";
   audit?: SkillsShAuditState | null;
 }
 
@@ -49,20 +55,21 @@ export type RemoteSkillCandidate =
   | SkillsShRemoteSkillCandidate;
 
 export type RemoteSkillDenyReason =
-  | 'clawhub_suspicious'
-  | 'clawhub_malware_blocked'
-  | 'clawhub_moderation_missing'
-  | 'skillssh_risk_exceeds_threshold';
+  | "clawhub_suspicious"
+  | "clawhub_malware_blocked"
+  | "clawhub_moderation_missing"
+  | "skillssh_risk_exceeds_threshold";
 
 export type RemoteSkillInstallDecision =
   | { ok: true }
   | { ok: false; reason: RemoteSkillDenyReason };
 
-export const DEFAULT_REMOTE_SKILL_POLICY: Readonly<RemoteSkillPolicy> = Object.freeze({
-  blockSuspicious: true,
-  blockMalware: true,
-  maxSkillsShRisk: 'medium',
-});
+export const DEFAULT_REMOTE_SKILL_POLICY: Readonly<RemoteSkillPolicy> =
+  Object.freeze({
+    blockSuspicious: true,
+    blockMalware: true,
+    maxSkillsShRisk: "medium",
+  });
 
 const SKILLS_SH_RISK_RANK: Record<SkillsShRisk, number> = {
   safe: 0,
@@ -74,11 +81,13 @@ const SKILLS_SH_RISK_RANK: Record<SkillsShRisk, number> = {
   unknown: 5,
 };
 
-function normalizeSkillsShRisk(audit: SkillsShAuditState | null | undefined): SkillsShRisk {
+function normalizeSkillsShRisk(
+  audit: SkillsShAuditState | null | undefined,
+): SkillsShRisk {
   const risk = audit?.risk;
-  if (risk == null) return 'unknown';
+  if (risk == null) return "unknown";
   // Coerce unrecognized risk labels to 'unknown' so we fail closed.
-  if (!Object.hasOwn(SKILLS_SH_RISK_RANK, risk)) return 'unknown';
+  if (!Object.hasOwn(SKILLS_SH_RISK_RANK, risk)) return "unknown";
   return risk;
 }
 
@@ -94,23 +103,23 @@ export function evaluateRemoteSkillInstall(
   candidate: RemoteSkillCandidate,
   policy: RemoteSkillPolicy = DEFAULT_REMOTE_SKILL_POLICY,
 ): RemoteSkillInstallDecision {
-  if (candidate.provider === 'clawhub') {
+  if (candidate.provider === "clawhub") {
     // Fail closed: block Clawhub skills when moderation data is missing.
     if (candidate.moderation == null) {
-      return { ok: false, reason: 'clawhub_moderation_missing' };
+      return { ok: false, reason: "clawhub_moderation_missing" };
     }
 
     if (policy.blockMalware && candidate.moderation.isMalwareBlocked === true) {
-      return { ok: false, reason: 'clawhub_malware_blocked' };
+      return { ok: false, reason: "clawhub_malware_blocked" };
     }
     if (policy.blockSuspicious && candidate.moderation.isSuspicious === true) {
-      return { ok: false, reason: 'clawhub_suspicious' };
+      return { ok: false, reason: "clawhub_suspicious" };
     }
     return { ok: true };
   }
 
   if (exceedsSkillsShRiskThreshold(candidate.audit, policy.maxSkillsShRisk)) {
-    return { ok: false, reason: 'skillssh_risk_exceeds_threshold' };
+    return { ok: false, reason: "skillssh_risk_exceeds_threshold" };
   }
 
   return { ok: true };

package/src/skills/slash-commands.ts

@@ -1,5 +1,5 @@
-import type { ResolvedSkill } from '../config/skill-state.js';
-import type { SkillSummary } from '../config/skills.js';
+import type { ResolvedSkill } from "../config/skill-state.js";
+import type { SkillSummary } from "../config/skills.js";
 
 /**
  * Parse whether user input starts with a slash-like command token.
@@ -18,19 +18,22 @@ export function extractLeadingToken(input: string): string | null {
   return firstToken || null;
 }
 
-export function parseSlashCandidate(input: string): { kind: 'none' | 'candidate'; token?: string } {
+export function parseSlashCandidate(input: string): {
+  kind: "none" | "candidate";
+  token?: string;
+} {
   const token = extractLeadingToken(input);
-  if (!token || !token.startsWith('/')) {
-    return { kind: 'none' };
+  if (!token || !token.startsWith("/")) {
+    return { kind: "none" };
   }
   if (isPathLikeSlashToken(token)) {
-    return { kind: 'none' };
+    return { kind: "none" };
   }
   const id = token.slice(1);
   if (!isValidSlashSkillId(id)) {
-    return { kind: 'none' };
+    return { kind: "none" };
   }
-  return { kind: 'candidate', token };
+  return { kind: "candidate", token };
 }
 
 /** Validate that a slash skill ID starts with alphanumeric and contains only [A-Za-z0-9._-] */
@@ -41,7 +44,7 @@ export function isValidSlashSkillId(id: string): boolean {
 /** Detect filesystem-like paths: tokens containing more than one `/` */
 export function isPathLikeSlashToken(token: string): boolean {
   // Count slashes — a single leading `/` is expected, but any additional `/` means it's a path
-  const slashCount = token.split('/').length - 1;
+  const slashCount = token.split("/").length - 1;
   return slashCount > 1;
 }
 
@@ -71,7 +74,7 @@ export function buildInvocableSlashCatalog(
   for (const skill of catalog) {
     if (!skill.userInvocable) continue;
     const resolved = stateById.get(skill.id);
-    if (!resolved || resolved.state === 'disabled') continue;
+    if (!resolved || resolved.state === "disabled") continue;
     result.set(skill.id.toLowerCase(), {
       canonicalId: skill.id,
       name: skill.name,
@@ -84,9 +87,9 @@ export function buildInvocableSlashCatalog(
 // ─── Slash command resolution ────────────────────────────────────────────────
 
 export type SlashResolution =
-  | { kind: 'none' }
-  | { kind: 'known'; skillId: string; trailingArgs: string }
-  | { kind: 'unknown'; requestedId: string; message: string };
+  | { kind: "none" }
+  | { kind: "known"; skillId: string; trailingArgs: string }
+  | { kind: "unknown"; requestedId: string; message: string };
 
 /**
  * Resolve user input against the invocable slash catalog.
@@ -101,8 +104,8 @@ export function resolveSlashSkillCommand(
   catalog: Map<string, InvocableSlashSkill>,
 ): SlashResolution {
   const candidate = parseSlashCandidate(input);
-  if (candidate.kind === 'none') {
-    return { kind: 'none' };
+  if (candidate.kind === "none") {
+    return { kind: "none" };
   }
 
   const token = candidate.token!;
@@ -112,18 +115,19 @@ export function resolveSlashSkillCommand(
   // Extract trailing args: everything after the first token
   const trimmed = input.trimStart();
   const firstSpaceIdx = trimmed.search(/\s/);
-  const trailingArgs = firstSpaceIdx === -1 ? '' : trimmed.slice(firstSpaceIdx).trim();
+  const trailingArgs =
+    firstSpaceIdx === -1 ? "" : trimmed.slice(firstSpaceIdx).trim();
 
   const match = catalog.get(lookupKey);
   if (match) {
-    return { kind: 'known', skillId: match.canonicalId, trailingArgs };
+    return { kind: "known", skillId: match.canonicalId, trailingArgs };
   }
 
   const availableIds = Array.from(catalog.values())
     .map((s) => s.canonicalId)
-    .sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' }));
+    .sort((a, b) => a.localeCompare(b, "en", { sensitivity: "base" }));
   return {
-    kind: 'unknown',
+    kind: "unknown",
     requestedId,
     message: formatUnknownSlashSkillMessage(requestedId, availableIds),
   };
@@ -138,16 +142,16 @@ export function formatUnknownSlashSkillMessage(
 ): string {
   const lines = [`Unknown command \`/${requestedId}\`.`];
   if (availableSkillIds.length > 0) {
-    lines.push('');
-    lines.push('Available slash commands:');
+    lines.push("");
+    lines.push("Available slash commands:");
     for (const id of availableSkillIds) {
       lines.push(`- \`/${id}\``);
     }
   } else {
-    lines.push('');
-    lines.push('No slash commands are currently available.');
+    lines.push("");
+    lines.push("No slash commands are currently available.");
   }
-  return lines.join('\n');
+  return lines.join("\n");
 }
 
 // ─── Prompt rewrite for known slash commands ─────────────────────────────────
@@ -169,20 +173,22 @@ export function rewriteKnownSlashCommandPrompt(params: {
   // For the claude-code skill, route trailing args through the `command` input
   // so CC command templates (.claude/commands/*.md) are loaded and $ARGUMENTS
   // substitution is applied, rather than sending them as a raw prompt.
-  if (params.skillId === 'claude-code' && params.trailingArgs) {
+  if (params.skillId === "claude-code" && params.trailingArgs) {
     // Extract the command name (first word of trailing args) and remaining arguments
     const parts = params.trailingArgs.split(/\s+/);
     const commandName = parts[0];
-    const commandArgs = parts.slice(1).join(' ');
+    const commandArgs = parts.slice(1).join(" ");
 
     const lines = [
       `The user invoked the slash command \`/${params.skillId}\`.`,
       `Execute the Claude Code command "${commandName}" using the claude_code tool with command="${commandName}".`,
     ];
     if (commandArgs) {
-      lines.push(`Pass the following as the \`arguments\` input: ${commandArgs}`);
+      lines.push(
+        `Pass the following as the \`arguments\` input: ${commandArgs}`,
+      );
     }
-    return lines.join('\n');
+    return lines.join("\n");
   }
 
   const lines = [
@@ -190,8 +196,8 @@ export function rewriteKnownSlashCommandPrompt(params: {
     `Please invoke the "${params.skillName}" skill (ID: ${params.skillId}).`,
   ];
   if (params.trailingArgs) {
-    lines.push('');
+    lines.push("");
     lines.push(`User arguments: ${params.trailingArgs}`);
   }
-  return lines.join('\n');
+  return lines.join("\n");
 }