@vellumai/assistant 0.4.37 → 0.4.41

package/src/config/bundled-skills/mcp-setup/SKILL.md

@@ -9,12 +9,12 @@ Help users configure MCP servers so external tools (e.g. Linear, GitHub, Notion)
 
 ## CLI Commands
 
-All commands use `vellum mcp`. Run them via `host_bash`.
+All commands use `assistant mcp`. Run them via `host_bash`.
 
 ### List servers
 
 ```
-vellum mcp list
+assistant mcp list
 ```
 
 Shows all configured servers with connection status, transport type, and URL.
@@ -22,7 +22,7 @@ Shows all configured servers with connection status, transport type, and URL.
 ### Add a server
 
 ```
-vellum mcp add <name> -t <transport-type> -u <url> [-r <risk>] [--disabled]
+assistant mcp add <name> -t <transport-type> -u <url> [-r <risk>] [--disabled]
 ```
 
 - `<name>` — unique identifier (e.g. `linear`, `github`)
@@ -34,36 +34,36 @@ vellum mcp add <name> -t <transport-type> -u <url> [-r <risk>] [--disabled]
 Examples:
 
 ```
-vellum mcp add linear -t streamable-http -u https://mcp.linear.app/mcp
-vellum mcp add context7 -t streamable-http -u https://mcp.context7.com/mcp -r low
-vellum mcp add local-db -t stdio -c npx -a -y @my/mcp-server
+assistant mcp add linear -t streamable-http -u https://mcp.linear.app/mcp
+assistant mcp add context7 -t streamable-http -u https://mcp.context7.com/mcp -r low
+assistant mcp add local-db -t stdio -c npx -a -y @my/mcp-server
 ```
 
 ### Authenticate (OAuth)
 
 ```
-vellum mcp auth <name>
+assistant mcp auth <name>
 ```
 
 Opens the user's browser for OAuth authorization. Only works for `sse`/`streamable-http` servers that require authentication. After the user completes login in the browser, tokens are saved automatically.
 
 Use this when:
 
-- A server shows `! Needs authentication` in `vellum mcp list`
+- A server shows `! Needs authentication` in `assistant mcp list`
 - An MCP tool call fails with an auth/token error
 - Setting up a new OAuth-protected server for the first time
 
 ### Remove a server
 
 ```
-vellum mcp remove <name>
+assistant mcp remove <name>
 ```
 
 Removes the server config and cleans up any stored OAuth credentials.
 
 ## After Changes
 
-After adding, removing, or authenticating a server, the user must **quit and relaunch the Vellum app** for changes to take effect. The app runs its own assistant process — `vellum daemon restart` only restarts the CLI assistant, which is a separate process.
+After adding, removing, or authenticating a server, the user must **quit and relaunch the Vellum app** for changes to take effect. The app runs its own assistant process — `assistant daemon restart` only restarts the CLI assistant, which is a separate process.
 
 Tell the user: "Please quit and relaunch the Vellum app, then start a new conversation."
 
@@ -71,5 +71,5 @@ Tell the user: "Please quit and relaunch the Vellum app, then start a new conver
 
 - User asks to connect/set up an external service via MCP
 - User asks "what MCP servers do I have?"
-- An MCP tool returns an auth error — offer to run `vellum mcp auth <name>`
+- An MCP tool returns an auth error — offer to run `assistant mcp auth <name>`
 - User wants to remove an MCP integration

package/src/config/bundled-skills/phone-calls/SKILL.md

@@ -41,14 +41,16 @@ The user's assistant gets its own personal phone number through Twilio. All impl
 Check whether Twilio credentials, phone number, and public ingress are already configured:
 
 ```bash
-vellum integrations twilio config --json
+assistant config get twilio.accountSid
+assistant credentials inspect twilio:auth_token --json  # check "hasSecret" field
+assistant config get twilio.phoneNumber
 ```
 
 ```bash
-vellum config get calls.enabled
+assistant config get calls.enabled
 ```
 
-If `hasCredentials` is `true`, `phoneNumber` is set, and `calls.enabled` is `true`, skip to the **Making Outbound Calls** section.
+If `twilio.accountSid` has a value, `hasSecret` is `true`, `twilio.phoneNumber` is set, and `calls.enabled` is `true`, skip to the **Making Outbound Calls** section.
 
 If Twilio is not yet configured, load the **twilio-setup** skill — it handles credential storage, phone number provisioning, and public ingress setup:
 
@@ -61,13 +63,13 @@ Once twilio-setup completes, return here to enable calls.
 Enable the calls feature:
 
 ```bash
-vellum config set calls.enabled true
+assistant config set calls.enabled true
 ```
 
 Verify:
 
 ```bash
-vellum config get calls.enabled
+assistant config get calls.enabled
 ```
 
 ## Step 3: Choose a Voice
@@ -81,7 +83,7 @@ The shared config key `elevenlabs.voiceId` is the single source of truth for Ele
 Before presenting the voice list, check the current shared voice:
 
 ```bash
-vellum config get elevenlabs.voiceId
+assistant config get elevenlabs.voiceId
 ```
 
 **If a non-default voice is already set**, the user chose it during voice-setup or a previous session. Tell them:
@@ -137,37 +139,33 @@ voice_config_update setting="tts_voice_id" value="<selected-voice-id>"
 
 Before making real calls, offer a quick verification:
 
-1. Confirm credentials are stored: run `vellum integrations twilio config --json` and verify `hasCredentials: true` plus `phoneNumber`
-2. Confirm ingress is running: `ingress.publicBaseUrl` must be set and the tunnel active
-3. Confirm calls are enabled: `calls.enabled` must be `true`
-4. Confirm voice is configured: `elevenlabs.voiceId` should be set
+1. Confirm credentials are stored: `assistant config get twilio.accountSid` should return a value and `assistant credentials inspect twilio:auth_token --json` should show `hasSecret: true`
+2. Confirm phone number is assigned: `assistant config get twilio.phoneNumber` should return a number
+3. Confirm ingress is running: `ingress.publicBaseUrl` must be set and the tunnel active
+4. Confirm calls are enabled: `calls.enabled` must be `true`
+5. Confirm voice is configured: `elevenlabs.voiceId` should be set
 
 Suggest a test call to the user's own phone: **"Want to do a quick test call to your phone to make sure everything works? This is a good way to hear how your chosen voice sounds."**
 
 If they agree, ask for their personal phone number and place a test call with a simple task like "Introduce yourself and confirm the call system is working."
 
-## Step 5: Verify Guardian Identity (Voice)
+## Step 5: Guardian Verification (Optional)
 
-Now link the user's phone number as the trusted voice guardian. Tell the user: "Now let's verify your guardian identity for voice. This links your phone number so the assistant can verify inbound callers."
+Link the user's phone number as the trusted voice guardian so the assistant can verify inbound callers.
 
-Load the **guardian-verify-setup** skill to handle the verification flow:
+Load the guardian-verify-setup skill with `channel: "voice"`:
 
-- Call `skill_load` with `skill: "guardian-verify-setup"` to load the dependency skill.
-
-When invoking the skill, indicate the channel is `voice`. The guardian-verify-setup skill manages the full outbound verification flow, including:
-
-- Collecting the user's phone number as the destination
-- Starting the outbound verification session via the gateway endpoint `POST /v1/integrations/guardian/outbound/start` with `channel: "voice"`
-- Calling the phone number and providing a code for the user to enter via their phone's keypad
-- Proactively polling for completion (voice auto-check) so the user gets instant confirmation
-- Checking guardian status to confirm the binding was created
-- Handling resend, cancel, and error cases
+```
+skill_load skill=guardian-verify-setup
+```
 
-Tell the user: _"I've loaded the guardian verification guide. It will walk you through linking your phone number as the trusted voice guardian."_
+The skill handles the full verification flow (outbound call, code entry, confirmation). If the user declines, skip this step.
 
-After the guardian-verify-setup skill completes (or the user skips), continue to the next sections.
+To re-check guardian status later:
 
-**Note:** Guardian verification is optional but recommended. If the user declines or wants to skip, proceed without blocking. Once verified, inbound callers can be prompted for voice verification before calls proceed (see the **Guardian voice verification for inbound calls** section below).
+```bash
+assistant integrations guardian status --channel voice --json
+```
 
 ## Caller Identity
 
@@ -179,18 +177,18 @@ If the user wants a specific call to appear as coming from their own phone numbe
 
 **To configure a user phone number:**
 
-```
-credential_store action=store service=twilio field=user_phone_number value=+14155559999
+```bash
+assistant config set calls.callerIdentity.userNumber "+14155559999"
 ```
 
 **To use it for a specific call**, pass `caller_identity_mode: 'user_number'` when calling `call_start` — see the Making Outbound Calls section for examples. User-number mode cannot be set as a global default; it must be requested explicitly per call.
 
 ### Configuration reference
 
-| Setting                                     | Description                                                                                      | Default   |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------- |
-| `calls.callerIdentity.allowPerCallOverride` | Whether per-call mode selection is allowed                                                       | `true`    |
-| `calls.callerIdentity.userNumber`           | Optional E.164 phone number for user-number mode (alternative to storing via `credential_store`) | _(empty)_ |
+| Setting                                     | Description                                      | Default   |
+| ------------------------------------------- | ------------------------------------------------ | --------- |
+| `calls.callerIdentity.allowPerCallOverride` | Whether per-call mode selection is allowed       | `true`    |
+| `calls.callerIdentity.userNumber`           | Optional E.164 phone number for user-number mode | _(empty)_ |
 
 ## DTMF Callee Verification
 
@@ -236,21 +234,21 @@ Users who have an ElevenLabs account and API key (e.g., from the **voice-setup**
 To check if the user has an API key stored:
 
 ```bash
-credential_store action=get service=elevenlabs field=api_key
+assistant credentials inspect elevenlabs:api_key --json
 ```
 
 If they have a key and want to browse voices, fetch the voice list:
 
 ```bash
 curl -s "https://api.elevenlabs.io/v2/voices?category=premade&page_size=50" \
-  -H "xi-api-key: <api_key_from_credential_store>" | python3 -m json.tool
+  -H "xi-api-key: $(assistant credentials reveal elevenlabs:api_key)" | python3 -m json.tool
 ```
 
 To search for a specific voice style:
 
 ```bash
 curl -s "https://api.elevenlabs.io/v2/voices?search=warm+female&page_size=10" \
-  -H "xi-api-key: <api_key_from_credential_store>" | python3 -m json.tool
+  -H "xi-api-key: $(assistant credentials reveal elevenlabs:api_key)" | python3 -m json.tool
 ```
 
 After the user picks a voice, set the shared voice ID:
@@ -265,13 +263,13 @@ Fine-tune how the selected voice sounds. These parameters apply to all ElevenLab
 
 ```bash
 # Playback speed (0.7 = slower, 1.0 = normal, 1.2 = faster)
-vellum config set elevenlabs.speed 1.0
+assistant config set elevenlabs.speed 1.0
 
 # Stability (0.0 = more expressive/variable, 1.0 = more consistent/monotone)
-vellum config set elevenlabs.stability 0.5
+assistant config set elevenlabs.stability 0.5
 
 # Similarity boost (0.0 = more creative, 1.0 = closer to original voice)
-vellum config set elevenlabs.similarityBoost 0.75
+assistant config set elevenlabs.similarityBoost 0.75
 ```
 
 Lower stability makes the voice more expressive but less predictable — good for conversational calls. Higher stability is better for scripted/formal calls.
@@ -283,7 +281,7 @@ By default, the system sends a **bare** `voiceId` to Twilio ConversationRelay (n
 If you want to force Twilio's extended voice spec, you can optionally set a model ID:
 
 ```bash
-vellum config set elevenlabs.voiceModelId "flash_v2_5"
+assistant config set elevenlabs.voiceModelId "flash_v2_5"
 ```
 
 When `voiceModelId` is set, the emitted voice string becomes:
@@ -365,11 +363,7 @@ No additional configuration is needed beyond Twilio setup and `calls.enabled` be
 
 ### Guardian voice verification for inbound calls
 
-For guardian verification setup, load the skill by calling `skill_load` with `skill: "guardian-verify-setup"`. This skill handles the full outbound verification flow; `phone-calls` does not orchestrate it inline. Do not use `call_start` to place guardian verification calls — the guardian outbound verification endpoints already place those calls.
-
-Once a guardian binding exists for the voice channel, inbound callers may be prompted for verification before calls proceed. The relay server detects pending challenges and prompts callers: "Please enter your six-digit verification code using your keypad, or speak the digits now." If verification fails after 3 attempts, the call ends with "Verification failed. Goodbye."
-
-This feature is separate from the outbound DTMF callee verification. It uses the channel guardian verification system rather than the per-call verification config.
+To set up guardian verification, load the skill: `skill_load skill=guardian-verify-setup`. Once a guardian binding exists, inbound callers may be prompted for verification before calls proceed.
 
 ## Interacting with a Live Call
 
@@ -537,7 +531,7 @@ The `context` field is powerful — use it to give the agent background that hel
 
 ## Configuration Reference
 
-All call-related settings can be managed via `vellum config`:
+All call-related settings can be managed via `assistant config`:
 
 | Setting                                     | Description                                                                                                                   | Default                                                                                                  |
 | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
@@ -562,16 +556,16 @@ All call-related settings can be managed via `vellum config`:
 
 ```bash
 # Increase max call duration to 2 hours
-vellum config set calls.maxDurationSeconds 7200
+assistant config set calls.maxDurationSeconds 7200
 
 # Disable AI disclosure (check local regulations first)
-vellum config set calls.disclosure.enabled false
+assistant config set calls.disclosure.enabled false
 
 # Custom disclosure message
-vellum config set calls.disclosure.text "Just so you know, this is an assistant calling on behalf of my human."
+assistant config set calls.disclosure.text "Just so you know, this is an assistant calling on behalf of my human."
 
 # Give more time for user consultation
-vellum config set calls.userConsultTimeoutSeconds 300
+assistant config set calls.userConsultTimeoutSeconds 300
 ```
 
 ## Troubleshooting
@@ -582,7 +576,7 @@ Load the `twilio-setup` skill to store your Account SID and Auth Token.
 
 ### "Calls feature is disabled"
 
-Run `vellum config set calls.enabled true`.
+Run `assistant config set calls.enabled true`.
 
 ### "No public base URL configured"
 
@@ -598,7 +592,7 @@ Run the **public-ingress** skill to set up ngrok and configure `ingress.publicBa
 ### Call connects but no audio / one-way audio
 
 - The ConversationRelay WebSocket may not be connecting. Check that `ingress.publicBaseUrl` is correct and the tunnel is active
-- Verify the gateway is running at `$GATEWAY_BASE_URL`
+- Verify the assistant runtime is running
 
 ### "Number not eligible for caller identity"
 
@@ -606,7 +600,7 @@ The user's phone number is not owned by or verified with the Twilio account. The
 
 ### "Per-call caller identity override is disabled"
 
-The setting `calls.callerIdentity.allowPerCallOverride` is set to `false`, so per-call `caller_identity_mode` selection is not allowed. Re-enable overrides with `vellum config set calls.callerIdentity.allowPerCallOverride true`.
+The setting `calls.callerIdentity.allowPerCallOverride` is set to `false`, so per-call `caller_identity_mode` selection is not allowed. Re-enable overrides with `assistant config set calls.callerIdentity.allowPerCallOverride true`.
 
 ### Caller identity call fails on trial account
 
@@ -621,7 +615,7 @@ Emergency numbers (911, 112, 999, 000, 110, 119) are permanently blocked for saf
 If you restarted ngrok, the public URL has changed. Update it:
 
 ```bash
-vellum config set ingress.publicBaseUrl "<new-url>"
+assistant config set ingress.publicBaseUrl "<new-url>"
 ```
 
 Or re-run the public-ingress skill to auto-detect and save the new URL.
@@ -640,4 +634,4 @@ The system has a 30-second silence timeout. If nobody speaks for 30 seconds duri
 - This often means ConversationRelay rejected voice configuration after TwiML fetch
 - Keep `elevenlabs.voiceModelId` empty first (bare `voiceId` mode)
 - If you set `voiceModelId`, try clearing it and retesting:
-  `vellum config set elevenlabs.voiceModelId ""`
+  `assistant config set elevenlabs.voiceModelId ""`

package/src/config/bundled-skills/public-ingress/SKILL.md

@@ -22,7 +22,7 @@ This skill installs ngrok, configures authentication, starts a tunnel, discovers
 First, check whether ingress is already configured:
 
 ```bash
-vellum integrations ingress config --json
+assistant integrations ingress config --json
 ```
 
 The response includes:
@@ -156,14 +156,14 @@ If no tunnel is found, check `/tmp/ngrok.log` for errors and report them to the
 Save the discovered public URL and enable ingress:
 
 ```bash
-vellum config set ingress.publicBaseUrl "<public-url>"
-vellum config set ingress.enabled true
+assistant config set ingress.publicBaseUrl "<public-url>"
+assistant config set ingress.enabled true
 ```
 
 Verify it was saved:
 
 ```bash
-vellum integrations ingress config --json
+assistant integrations ingress config --json
 ```
 
 ## Step 7: Report Completion
@@ -171,7 +171,7 @@ vellum integrations ingress config --json
 Summarize the setup:
 
 - **Public URL:** `<the-url>` (this is your `ingress.publicBaseUrl`)
-- **Local gateway target:** `<localGatewayTarget from vellum integrations ingress config --json>`
+- **Local gateway target:** `<localGatewayTarget from assistant integrations ingress config --json>`
 - **ngrok dashboard:** http://127.0.0.1:4040
 
 Provide useful follow-up commands:
@@ -200,7 +200,7 @@ The ngrok process may not be running. Check with `ps aux | grep ngrok`. If not r
 
 ### Gateway not reachable on local target
 
-Re-check local gateway target with `vellum integrations ingress config --json`, then run `curl -s "<localGatewayTarget>/healthz"`. If the gateway is not running, start the assistant first.
+Re-check local gateway target with `assistant integrations ingress config --json`, then run `curl -s "<localGatewayTarget>/healthz"`. If the gateway is not running, start the assistant first.
 
 ### "Too many connections" or tunnel limit errors
 

package/src/config/bundled-skills/slack-app-setup/SKILL.md

@@ -171,7 +171,7 @@ curl -s "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/slack/channel/config" \
 Check guardian binding status:
 
 ```bash
-vellum integrations guardian status --channel slack --json
+assistant integrations guardian status --channel slack --json
 ```
 
 The Settings > Channels > Slack card auto-refreshes on view appear via `fetchSlackChannelConfig()`, so the user will see the "Connected" status badge when they open or re-open that page.

package/src/config/bundled-skills/sms-setup/SKILL.md

@@ -12,7 +12,7 @@ You are helping your user set up SMS messaging. This skill orchestrates Twilio s
 First, check the current SMS channel readiness state via Vellum CLI:
 
 ```bash
-vellum integrations twilio config --json
+assistant integrations twilio config --json
 ```
 
 Inspect the response for `hasCredentials` and `phoneNumber`.
@@ -33,7 +33,7 @@ Tell the user: _"SMS needs Twilio configured first. I've loaded the Twilio setup
 After twilio-setup completes, re-check readiness:
 
 ```bash
-vellum integrations twilio config --json
+assistant integrations twilio config --json
 ```
 
 If baseline is still not ready, report the specific failures and ask the user to address them before continuing.
@@ -43,7 +43,7 @@ If baseline is still not ready, report the specific failures and ask the user to
 Once baseline is ready, check SMS compliance status including remote (Twilio API) checks:
 
 ```bash
-vellum integrations twilio sms compliance --json
+assistant integrations twilio sms compliance --json
 ```
 
 Examine the compliance results:

package/src/config/bundled-skills/telegram-setup/SKILL.md

@@ -100,7 +100,7 @@ If routing is misconfigured, inbound Telegram messages will be rejected and the
 Before reporting success, confirm the guardian binding was actually created. Check guardian binding status via Vellum CLI:
 
 ```bash
-vellum integrations guardian status --channel telegram --json
+assistant integrations guardian status --channel telegram --json
 ```
 
 If the binding is absent and the user said they completed the verification:
@@ -119,7 +119,7 @@ Summarize what was done:
 - Guardian identity: {verified | not configured}
 - Guardian verification status: {verified via outbound flow | skipped}
 - Routing configuration validated
-- To re-check guardian status later, use: `vellum integrations guardian status --channel telegram --json`
+- To re-check guardian status later, use: `assistant integrations guardian status --channel telegram --json`
 
 The gateway automatically detects credentials from the vault, reconciles the Telegram webhook registration, and begins accepting Telegram webhooks shortly. In single-assistant mode, routing is automatically configured — no manual environment variable configuration or webhook registration is needed. If the webhook secret changes later, the gateway's credential watcher will automatically re-register the webhook. If the ingress URL changes (e.g., tunnel restart), the assistant triggers an immediate internal reconcile so the webhook re-registers automatically without a gateway restart.