@vellumai/assistant 0.4.41 → 0.4.43

package/src/config/bundled-skills/phone-calls/references/TRANSCRIPTS.md

@@ -0,0 +1,57 @@
+# Retrieving Past Call Transcripts
+
+After a call ends, the full bidirectional transcript (caller speech, assistant responses, tool calls, and tool results) is stored in the SQLite database. The daemon logs (`vellum.log`) only contain caller-side transcripts and lifecycle events at the default log level, so they are **not sufficient** for full transcript reconstruction.
+
+## Finding the conversation
+
+1. **Get the call session ID and voice conversation ID** from `vellum.log` by searching for recent session creation entries:
+
+```bash
+grep "voiceConversationId" ~/.vellum/workspace/data/logs/vellum.log | tail -5
+```
+
+The `voiceConversationId` field in the `Created new inbound voice session` (or outbound equivalent) log line is the key you need.
+
+2. **Query the messages table** in the SQLite database using the voice conversation ID:
+
+```bash
+sqlite3 ~/.vellum/workspace/data/db/assistant.db \
+  "SELECT role, content FROM messages WHERE conversation_id = '<voiceConversationId>' ORDER BY created_at ASC;"
+```
+
+This returns all messages in chronological order with:
+
+- `role: "user"` — caller speech (prefixed with `[SPEAKER]` tags) and system events
+- `role: "assistant"` — assistant responses, including `text` content and any `tool_use`/`tool_result` blocks
+
+## Quick one-liner for the most recent call
+
+```bash
+CONV_ID=$(grep "voiceConversationId" ~/.vellum/workspace/data/logs/vellum.log | tail -1 | python3 -c "import sys,json; print(json.loads(sys.stdin.readline().strip())['voiceConversationId'])")
+
+sqlite3 ~/.vellum/workspace/data/db/assistant.db \
+  "SELECT role, content FROM messages WHERE conversation_id = '$CONV_ID' ORDER BY created_at ASC;"
+```
+
+## Additional tables for call metadata
+
+| Table                     | What it contains                                               |
+| ------------------------- | -------------------------------------------------------------- |
+| `call_sessions`           | Session metadata (start time, duration, phone numbers, status) |
+| `call_events`             | Granular event log for the call lifecycle                      |
+| `notification_decisions`  | Whether notifications were evaluated during the call           |
+| `notification_deliveries` | Notification delivery attempts                                 |
+
+## Key paths
+
+| Resource                                      | Path                                       |
+| --------------------------------------------- | ------------------------------------------ |
+| Assistant logs (caller-side transcripts only) | `~/.vellum/workspace/data/logs/vellum.log` |
+| Full conversation database                    | `~/.vellum/workspace/data/db/assistant.db` |
+| Messages table                                | `messages` (keyed by `conversation_id`)    |
+| Call sessions table                           | `call_sessions`                            |
+| Call events table                             | `call_events`                              |
+
+## Important
+
+`vellum.log` at the default log level does **not** contain assistant responses, TTS text, or LLM completions for voice calls. Always use the `messages` table in `assistant.db` as the source of truth for complete call transcripts.

package/src/config/bundled-skills/phone-calls/references/TROUBLESHOOTING.md

@@ -0,0 +1,67 @@
+# Troubleshooting
+
+## "Twilio credentials not configured"
+
+Load the `twilio-setup` skill to store your Account SID and Auth Token.
+
+## "Calls feature is disabled"
+
+Run `assistant config set calls.enabled true`.
+
+## "No public base URL configured"
+
+Run the **public-ingress** skill to set up ngrok and configure `ingress.publicBaseUrl`.
+
+## Call fails immediately after initiating
+
+- Check that the phone number is in E.164 format
+- Verify Twilio credentials are correct (wrong auth token causes API errors)
+- On trial accounts, ensure the destination number is verified
+- Check that the ngrok tunnel is still running (`curl -s http://127.0.0.1:4040/api/tunnels`)
+
+## Call connects but no audio / one-way audio
+
+- The ConversationRelay WebSocket may not be connecting. Check that `ingress.publicBaseUrl` is correct and the tunnel is active
+- Verify the assistant runtime is running
+
+## "Number not eligible for caller identity"
+
+The user's phone number is not owned by or verified with the Twilio account. The number must be either purchased through Twilio or added as a verified caller ID at https://console.twilio.com/us1/develop/phone-numbers/manage/verified.
+
+## "Per-call caller identity override is disabled"
+
+The setting `calls.callerIdentity.allowPerCallOverride` is set to `false`, so per-call `caller_identity_mode` selection is not allowed. Re-enable overrides with `assistant config set calls.callerIdentity.allowPerCallOverride true`.
+
+## Caller identity call fails on trial account
+
+Twilio trial accounts can only place calls to verified numbers, regardless of caller identity mode. The user's phone number must also be verified with Twilio. Upgrade to a paid account or verify both the source and destination numbers.
+
+## "This phone number is not allowed to be called"
+
+Emergency numbers (911, 112, 999, 000, 110, 119) are permanently blocked for safety.
+
+## ngrok tunnel URL changed
+
+If you restarted ngrok, the public URL has changed. Update it:
+
+```bash
+assistant config set ingress.publicBaseUrl "<new-url>"
+```
+
+Or re-run the public-ingress skill to auto-detect and save the new URL.
+
+## Call drops after 30 seconds of silence
+
+The system has a 30-second silence timeout. If nobody speaks for 30 seconds during normal conversation, the agent will ask "Are you still there?" This is expected behavior. During guardian wait states (inbound access-request wait or in-call guardian consultation wait), this generic silence nudge is suppressed — the guardian-wait heartbeat messaging is used instead.
+
+## Call quality sounds off
+
+- Verify `elevenlabs.voiceId` is set to a valid ElevenLabs voice ID
+- Ask for the desired voice style again and try a different voice selection
+
+## Twilio says "application error" right after answer
+
+- This often means ConversationRelay rejected voice configuration after TwiML fetch
+- Keep `elevenlabs.voiceModelId` empty first (bare `voiceId` mode)
+- If you set `voiceModelId`, try clearing it and retesting:
+  `assistant config set elevenlabs.voiceModelId ""`

package/src/config/bundled-skills/playbooks/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: "Playbooks"
-description: "Trigger-action automation rules for handling incoming messages"
-metadata: {"vellum": {"emoji": "\ud83d\udcd6"}}
+name: playbooks
+description: Trigger-action automation rules for handling incoming messages
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"📖","vellum":{"display-name":"Playbooks"}}
 ---
 
 Playbooks are trigger-action automation rules that tell the assistant how to handle incoming messages matching a pattern.

package/src/config/bundled-skills/public-ingress/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: "Public Ingress"
-description: "Set up and manage ngrok-based public ingress for webhooks and OAuth callbacks via ingress.publicBaseUrl"
-user-invocable: true
-metadata: { "vellum": { "emoji": "🌍" } }
+name: public-ingress
+description: Set up and manage ngrok-based public ingress for webhooks and OAuth callbacks via ingress.publicBaseUrl
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🌍","vellum":{"display-name":"Public Ingress","user-invocable":true}}
 ---
 
 You are setting up and managing a public ingress tunnel so that external services (Telegram webhooks, OAuth callbacks, etc.) can reach the local Vellum gateway. This skill uses ngrok to create a secure tunnel and persists the public URL as `ingress.publicBaseUrl`.
@@ -22,14 +22,16 @@ This skill installs ngrok, configures authentication, starts a tunnel, discovers
 First, check whether ingress is already configured:
 
 ```bash
-assistant integrations ingress config --json
+assistant config get ingress.publicBaseUrl
+assistant config get ingress.enabled
 ```
 
-The response includes:
+Note: The local gateway target is `$INTERNAL_GATEWAY_BASE_URL` (e.g. `http://127.0.0.1:7830`).
 
-- `publicBaseUrl` — currently configured public ingress URL (if any)
-- `enabled` — whether ingress is enabled
-- `localGatewayTarget` — local gateway URL ngrok should forward to
+The commands return:
+
+- `ingress.publicBaseUrl` — currently configured public ingress URL (if any)
+- `ingress.enabled` — whether ingress is enabled
 
 If `publicBaseUrl` is already set and the tunnel is running (check via `curl -s http://127.0.0.1:4040/api/tunnels`), tell the user the current status and ask if they want to reconfigure or if this is sufficient.
 
@@ -115,7 +117,7 @@ sleep 1
 Start ngrok in the background, tunneling to the local gateway target:
 
 ```bash
-nohup ngrok http "<localGatewayTarget from Step 1>" --log=stdout > /tmp/ngrok.log 2>&1 &
+nohup ngrok http "$INTERNAL_GATEWAY_BASE_URL" --log=stdout > /tmp/ngrok.log 2>&1 &
 echo $! > /tmp/ngrok.pid
 ```
 
@@ -125,6 +127,42 @@ Wait a few seconds for the tunnel to establish:
 sleep 3
 ```
 
+## Step 4b: Verify Port Alignment
+
+Before discovering the public URL, verify that ngrok is forwarding to the same port the gateway is actually listening on. A mismatch here causes silent failures — webhooks appear to be delivered but never reach the gateway.
+
+Query the ngrok tunnel's target port and the gateway's configured port, then compare them:
+
+```bash
+curl -s http://127.0.0.1:4040/api/tunnels | python3 -c "
+import sys, json, re
+
+data = json.load(sys.stdin)
+tunnels = data.get('tunnels', [])
+if not tunnels:
+    print('ERROR: no active ngrok tunnel found')
+    sys.exit(1)
+
+addr = tunnels[0].get('config', {}).get('addr', '')
+match = re.search(r':(\d+)$', addr)
+if not match:
+    print(f'ERROR: could not extract port from ngrok tunnel addr: {addr}')
+    sys.exit(1)
+
+print(match.group(1))
+"
+```
+
+```bash
+echo "$INTERNAL_GATEWAY_BASE_URL" | grep -oE '[0-9]+$'
+```
+
+Compare the two port numbers. If they differ, warn the user:
+
+> **Port mismatch detected:** ngrok is forwarding to port **X** but the gateway is listening on port **Y** (from `$INTERNAL_GATEWAY_BASE_URL`). Webhooks will not reach the gateway. Stop ngrok (`pkill -f ngrok`), then re-run this skill to start ngrok on the correct port.
+
+If the ports match, proceed silently to Step 5.
+
 ## Step 5: Discover the Public URL
 
 Query the ngrok local API for the tunnel's public URL:
@@ -163,7 +201,8 @@ assistant config set ingress.enabled true
 Verify it was saved:
 
 ```bash
-assistant integrations ingress config --json
+assistant config get ingress.publicBaseUrl
+assistant config get ingress.enabled
 ```
 
 ## Step 7: Report Completion
@@ -171,14 +210,14 @@ assistant integrations ingress config --json
 Summarize the setup:
 
 - **Public URL:** `<the-url>` (this is your `ingress.publicBaseUrl`)
-- **Local gateway target:** `<localGatewayTarget from assistant integrations ingress config --json>`
+- **Local gateway target:** `$INTERNAL_GATEWAY_BASE_URL`
 - **ngrok dashboard:** http://127.0.0.1:4040
 
 Provide useful follow-up commands:
 
 - **Check tunnel status:** `curl -s http://127.0.0.1:4040/api/tunnels | python3 -c "import sys,json; [print(t['public_url']) for t in json.load(sys.stdin)['tunnels']]"`
 - **View ngrok logs:** `cat /tmp/ngrok.log`
-- **Restart tunnel:** `pkill -f ngrok; sleep 1; nohup ngrok http "<localGatewayTarget>" --log=stdout > /tmp/ngrok.log 2>&1 &`
+- **Restart tunnel:** `pkill -f ngrok; sleep 1; nohup ngrok http "$INTERNAL_GATEWAY_BASE_URL" --log=stdout > /tmp/ngrok.log 2>&1 &`
 - **Stop tunnel:** `pkill -f ngrok`
 - **Rotate URL:** Stop and restart ngrok (free tier assigns a new URL each time; update `ingress.publicBaseUrl` afterward)
 
@@ -200,8 +239,20 @@ The ngrok process may not be running. Check with `ps aux | grep ngrok`. If not r
 
 ### Gateway not reachable on local target
 
-Re-check local gateway target with `assistant integrations ingress config --json`, then run `curl -s "<localGatewayTarget>/healthz"`. If the gateway is not running, start the assistant first.
+Re-check the local gateway target with `echo "$INTERNAL_GATEWAY_BASE_URL"`. Run `curl -s "$INTERNAL_GATEWAY_BASE_URL/healthz"` to verify it is reachable. If the gateway is not running, start the assistant first.
 
 ### "Too many connections" or tunnel limit errors
 
 ngrok's free tier allows one tunnel at a time. Stop any other ngrok tunnels before starting a new one.
+
+### ngrok port doesn't match gateway port
+
+**Symptom:** Webhooks return connection refused or timeouts even though both ngrok and the gateway appear to be running.
+
+**Cause:** ngrok is forwarding to a different port than the gateway is listening on. This can happen if the gateway port was changed after ngrok was started, or if ngrok was started manually with a hardcoded port.
+
+**Fix:** Stop ngrok (`pkill -f ngrok`), verify the gateway URL with `echo "$INTERNAL_GATEWAY_BASE_URL"`, then re-run this skill to start ngrok on the correct port.
+
+### ngrok automatically restarts with wrong port
+
+If after killing the ngrok process, it automatically re-spawns and is still attached to the incorrect port, check to see if there is a launch agent process configured to auto-restart it. This might exist at `~/Library/LaunchAgents/com.ngrok.tunnel.plist`. If so, it needs to be either removed or updated.

package/src/config/bundled-skills/reminder/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: "Reminder"
-description: "One-time time-based reminders that fire at a specific future time"
-metadata: {"vellum": {"emoji": "🔔"}}
+name: reminder
+description: One-time time-based reminders that fire at a specific future time
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🔔","vellum":{"display-name":"Reminder"}}
 ---
 
 Create, list, and cancel one-time reminders. Reminders fire at a specific future time and either notify the user or execute a message through the assistant.

package/src/config/bundled-skills/restaurant-reservation/SKILL.md

@@ -1,10 +1,8 @@
 ---
-name: "Restaurant Reservation Booking"
-description: "Book reservations on OpenTable or Resy with explicit confirmations"
-user-invocable: true
-disable-model-invocation: true
-includes: ["browser"]
-metadata: {"vellum": {"emoji": "🍽️"}}
+name: restaurant-reservation
+description: Book reservations on OpenTable or Resy with explicit confirmations
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🍽️","vellum":{"display-name":"Restaurant Reservation Booking","user-invocable":true,"disable-model-invocation":true,"includes":["browser"]}}
 ---
 
 Book restaurant reservations on OpenTable or Resy using browser automation.

package/src/config/bundled-skills/schedule/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: "Schedule"
-description: "Recurring automation that dispatches messages on a cron or RRULE schedule"
-metadata: { "vellum": { "emoji": "\ud83d\udcc5" } }
+name: schedule
+description: Recurring automation that dispatches messages on a cron or RRULE schedule
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"📅","vellum":{"display-name":"Schedule"}}
 ---
 
 Manage recurring scheduled automations. Each schedule has an expression (cron or RRULE) that defines when it fires, and a message that gets dispatched to the assistant at trigger time.

package/src/config/bundled-skills/screen-recording/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: "Screen Recording"
-description: "Record the user's screen as a video file"
-metadata: { "vellum": { "emoji": "🎬", "os": ["darwin"] } }
+name: screen-recording
+description: Record the user's screen as a video file
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🎬","vellum":{"display-name":"Screen Recording","os":["darwin"]}}
 ---
 
 Capture screen recordings as video files attached to the conversation.

package/src/config/bundled-skills/self-upgrade/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: "Self Upgrade"
-description: "Upgrade vellum to the latest version, restart the assistant, and restart the gateway"
-user-invocable: true
-metadata: { "vellum": { "emoji": "⬆️" } }
+name: self-upgrade
+description: Upgrade vellum to the latest version, restart the assistant, and restart the gateway
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"⬆️","vellum":{"display-name":"Self Upgrade","user-invocable":true}}
 ---
 
 You are performing a self-upgrade of the Vellum assistant. Follow these steps **in order**. Use the `bash` tool to run each command. Confirm each step succeeds before moving to the next.

package/src/config/bundled-skills/skills-catalog/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: "Skills Catalog"
-description: "Discover bundled skills and search/install community skills from Clawhub"
-user-invocable: true
-metadata: { "vellum": { "emoji": "🧩" } }
+name: skills-catalog
+description: Discover bundled skills and search/install community skills from Clawhub
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🧩","vellum":{"display-name":"Skills Catalog","user-invocable":true}}
 ---
 
 You can help the user discover what skills are available and find community skills to extend the assistant's capabilities.

package/src/config/bundled-skills/slack/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: "Slack"
-description: "Scan channels, summarize threads, and manage Slack with privacy guardrails"
-user-invocable: true
-metadata: { "vellum": { "emoji": "💬" } }
+name: slack
+description: Scan channels, summarize threads, and manage Slack with privacy guardrails
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"💬","vellum":{"display-name":"Slack","user-invocable":true}}
 ---
 
 You are a Slack assistant that helps users stay on top of their Slack workspace. Use the slack tools for channel scanning, thread summarization, and Slack-specific operations.
@@ -71,10 +71,6 @@ When you need to **send** content to Slack proactively (e.g. a scheduled digest,
 
 For setting up recurring digests, load the `slack-digest-setup` skill which covers the full configuration, scheduling, and delivery protocol.
 
-## Watcher Integration
-
-For real-time monitoring (not just on-demand scanning), the user can set up a Slack watcher using the watcher skill with the same channel IDs. Mention this if the user wants ongoing monitoring.
-
 ## Connection
 
 Before using any Slack tool, verify that Slack is connected. If not connected, guide the user through the Slack setup flow described in the messaging skill.

package/src/config/bundled-skills/slack/tools/slack-channel-permissions.ts

@@ -11,7 +11,7 @@ import {
   removeChannelPermissionProfile,
   setAllChannelPermissions,
   setChannelPermissionProfile,
-} from "../../../../config/channel-permission-profiles.js";
+} from "../../../../channels/permission-profiles.js";
 import type {
   ToolContext,
   ToolExecutionResult,

package/src/config/bundled-skills/slack-app-setup/SKILL.md

@@ -1,23 +1,24 @@
 ---
-name: "Slack App Setup"
-description: "Connect a Slack app to the Vellum Assistant via Socket Mode with guided app creation and guardian verification"
-user-invocable: true
-includes: ["guardian-verify-setup"]
-metadata: { "vellum": { "emoji": "💬" } }
+name: slack-app-setup
+description: Connect a Slack app to the Vellum Assistant via Socket Mode with guided app creation and guardian verification
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"💬","vellum":{"display-name":"Slack App Setup","user-invocable":true,"includes":["guardian-verify-setup"]}}
 ---
 
-You are helping your user connect a Slack bot to the Vellum Assistant gateway via Socket Mode. The gateway manages the Socket Mode connection — it never hits the assistant runtime directly. When this skill is invoked, walk through each step below using only existing tools.
+You are helping your user connect a Slack bot to the Vellum Assistant via Socket Mode. Walk through each step below.
 
-## Prerequisites — Check Before Starting
+## Value Classification
 
-Before beginning setup, verify these conditions are met:
+| Value     | Type       | Storage method            | Secret? |
+| --------- | ---------- | ------------------------- | ------- |
+| App Token | Credential | `credential_store` prompt | **Yes** |
+| Bot Token | Credential | `credential_store` prompt | **Yes** |
 
-1. **Gateway API base URL is set and reachable:** Use the injected `INTERNAL_GATEWAY_BASE_URL`, then run `curl -sf "$INTERNAL_GATEWAY_BASE_URL/healthz"` — it should return gateway health JSON (for example `{"status":"ok"}`). If it fails, tell the user to start the assistant with `vellum wake` and wait for it to become healthy before continuing.
-2. **Use gateway control-plane routes only.** Slack setup/config actions in this skill must call gateway endpoints under `/v1/integrations/slack/channel/*` — never call the assistant runtime port directly.
+- Both tokens are secrets. Always collect via `credential_store` prompt — never accept them pasted in plaintext chat.
 
-## Setup Steps
+# Setup Steps
 
-### Step 1: Generate Manifest & Create Slack App
+## Step 1: Generate Manifest & Create Slack App
 
 Ask the user what they'd like to name their Slack bot and optionally provide a short description. Use their answers (or sensible defaults) to generate a pre-configured Slack app manifest.
 
@@ -81,11 +82,9 @@ https://api.slack.com/apps?new_app=1&manifest_json=<url_encoded_manifest>
 
 Present the link to the user: "Click this link to create your Slack app. It's pre-configured with all the right permissions, events, and Socket Mode. Just select your workspace and click **Create**."
 
-The manifest pre-configures everything needed: Socket Mode, 9 minimal bot scopes, 4 event subscriptions, bot user, App Home, and interactivity. No manual scope or event configuration is needed.
-
 Wait for the user to confirm they've created the app before proceeding.
 
-### Step 2: Generate App Token & Collect It
+## Step 2: Generate App Token & Collect It
 
 Tell the user to navigate to **Settings > Basic Information > App-Level Tokens** in their newly created Slack app, then:
 
@@ -94,13 +93,25 @@ Tell the user to navigate to **Settings > Basic Information > App-Level Tokens**
 3. Add scope: `connections:write`
 4. Click **Generate**
 
-**Immediately** collect the app token securely:
+Collect the app token securely:
 
 - Call `credential_store` with `action: "prompt"`, `service: "slack_channel"`, `field: "app_token"`, `label: "App-Level Token"`, `placeholder: "xapp-..."`, `description: "Paste the App-Level Token you just generated"`
 
-**IMPORTANT — Secure credential collection only:** Never accept tokens pasted in plaintext chat. If the user pastes a token in the conversation, inform them that for security reasons you cannot use tokens shared in chat and must collect it through the secure prompt instead.
+After collection, validate the app token format:
+
+```bash
+APP_TOKEN=$(assistant credentials reveal slack_channel:app_token)
+if [[ "$APP_TOKEN" != xapp-* ]]; then
+  echo "ERROR: App token must start with xapp-"
+  assistant credentials delete slack_channel:app_token
+  exit 1
+fi
+echo "App token format valid"
+```
+
+If the token does not start with `xapp-`, inform the user it is invalid, delete it, and ask them to re-enter (repeat the collection above).
 
-### Step 3: Install App & Collect Bot Token
+## Step 3: Install App & Collect Bot Token
 
 Tell the user to navigate to **Settings > Install App** in the sidebar, then click **Install to Workspace** and authorize the requested permissions (already pre-configured from the manifest).
 
@@ -108,93 +119,60 @@ After installation, collect the bot token securely:
 
 - Call `credential_store` with `action: "prompt"`, `service: "slack_channel"`, `field: "bot_token"`, `label: "Bot User OAuth Token"`, `placeholder: "xoxb-..."`, `description: "Paste the Bot User OAuth Token shown after installing"`
 
-**IMPORTANT — Secure credential collection only:** Never accept tokens pasted in plaintext chat. Always collect through the secure prompt.
-
-### Step 4: Validate & Connect
-
-After both tokens are collected, submit them to the gateway for validation and storage:
+## Step 4: Validate Bot Token & Store Workspace Metadata
 
 ```bash
-curl -s -X POST "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/slack/channel/config" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"botToken": "<bot_token>", "appToken": "<app_token>"}'
+BOT_TOKEN=$(assistant credentials reveal slack_channel:bot_token)
+AUTH_RESPONSE=$(curl -sf -X POST "https://slack.com/api/auth.test" \
+  -H "Authorization: Bearer $BOT_TOKEN")
+echo "$AUTH_RESPONSE" | jq .
 ```
 
-The endpoint validates the bot token via Slack's `auth.test` API and stores both tokens in the secure key store.
-
-**On success** (`success: true`, `connected: true`):
-
-- Report the bot username and workspace name to the user
-- Proceed to Step 5
-
-**On failure:**
+If `ok` is `false`, the token is invalid — ask the user to re-enter (repeat Step 3).
 
-| Error                    | Action                                                                               |
-| ------------------------ | ------------------------------------------------------------------------------------ |
-| `invalid_auth`           | Bot token is invalid — re-prompt for the correct token (repeat Step 3 collection)    |
-| Missing scopes           | Tell the user which scopes to add in the Slack app configuration                     |
-| Socket Mode not enabled  | Instruct the user to enable Socket Mode in the app settings                          |
-| App token format invalid | Must start with `xapp-` — re-prompt for the correct token (repeat Step 2 collection) |
+If `ok` is `true`, parse the response and persist workspace metadata so the Settings UI can display the connected bot and workspace:
 
-### Step 5: Guardian Verification
-
-Tell the user: "Now let's verify your identity as the trusted guardian for Slack."
+```bash
+TEAM_ID=$(echo "$AUTH_RESPONSE" | jq -r '.team_id')
+TEAM_NAME=$(echo "$AUTH_RESPONSE" | jq -r '.team')
+BOT_USER_ID=$(echo "$AUTH_RESPONSE" | jq -r '.user_id')
+BOT_USERNAME=$(echo "$AUTH_RESPONSE" | jq -r '.user')
+assistant config set slack.teamId "$TEAM_ID"
+assistant config set slack.teamName "$TEAM_NAME"
+assistant config set slack.botUserId "$BOT_USER_ID"
+assistant config set slack.botUsername "$BOT_USERNAME"
+```
 
-Load the **guardian-verify-setup** skill to handle the verification flow:
+Report the bot username and workspace from the response.
 
-- Call `skill_load` with `skill: "guardian-verify-setup"` to load the dependency skill.
+Socket Mode connects automatically once both credentials are stored — no further action needed.
 
-The guardian-verify-setup skill manages the full outbound verification flow for Slack, including:
+## Step 5: Guardian Verification (Optional)
 
-- Collecting the user's Slack user ID as the destination
-- Starting the outbound verification session via the gateway endpoint `POST /v1/integrations/guardian/outbound/start` with `channel: "slack"`
-- Sending a verification code via Slack DM
-- Auto-polling for completion (the guardian-verify-setup skill handles this)
-- Checking guardian status to confirm the binding was created
+Link the user's Slack account as the trusted guardian. Load the **guardian-verify-setup** skill:
 
-Tell the user: _"I've loaded the guardian verification guide. It will walk you through linking your Slack account as the trusted guardian."_
+- Call `skill_load` with `skill: "guardian-verify-setup"`.
 
-After the guardian-verify-setup skill completes (or the user skips), continue to Step 6.
+If the user declines, skip and continue.
 
-**Note:** Guardian verification is optional but recommended. If the user declines or wants to skip, proceed to Step 6 without blocking.
+## Step 6: Report Success
 
-### Step 6: Verify Connection & Report Success
+Summarize:
 
-Check the final connection status:
+- Bot connected: {username} in {workspace}
+- Socket Mode: active (gateway auto-connects when credentials are stored)
+- Guardian: {verified | skipped}
+- Usage: @{botUsername} in any channel, or DM the bot directly
 
-```bash
-curl -s "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/slack/channel/config" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN"
-```
+# Clearing Credentials
 
-Check guardian binding status:
+To disconnect Slack:
 
 ```bash
-assistant integrations guardian status --channel slack --json
+assistant credentials delete slack_channel:bot_token
+assistant credentials delete slack_channel:app_token
+assistant config set slack.teamId ""
+assistant config set slack.teamName ""
+assistant config set slack.botUserId ""
+assistant config set slack.botUsername ""
 ```
-
-The Settings > Channels > Slack card auto-refreshes on view appear via `fetchSlackChannelConfig()`, so the user will see the "Connected" status badge when they open or re-open that page.
-
-Summarize what was done:
-
-- Bot connected: {username} in {workspace}
-- Socket Mode: active
-- Guardian: {verified | not configured}
-- Usage: "@{botUsername} in any channel, or DM the bot directly"
-
-Tell the user: "Your Slack bot is now connected! Open **Settings > Channels** to see it reflected there."
-
-## Automated vs Manual Steps
-
-| Step                    | Status                       | Details                                                       |
-| ----------------------- | ---------------------------- | ------------------------------------------------------------- |
-| App manifest generation | Automated                    | Skill generates manifest JSON with all scopes/events/settings |
-| App creation            | Manual (one-click)           | User clicks manifest URL, selects workspace, creates          |
-| App token generation    | Manual                       | User generates in Slack settings (can't be automated)         |
-| App installation        | Manual                       | User clicks "Install to Workspace"                            |
-| Token collection        | Manual (secure prompt)       | Via `credential_store` — never plaintext                      |
-| Token validation        | Automated                    | `auth.test` validates bot token on submission                 |
-| Socket Mode connection  | Automated                    | Gateway connects when tokens are stored                       |
-| Routing                 | Automated (single-assistant) | CLI sets defaults                                             |
-| Guardian verification   | Semi-automated               | Via `guardian-verify-setup` skill                             |

package/src/config/bundled-skills/slack-digest-setup/SKILL.md

@@ -1,9 +1,8 @@
 ---
-name: "Slack Digest Setup"
-description: "Set up recurring Slack channel digests with scanning schedules, channel configuration, and delivery — codifies best practices for high-quality automated summaries"
-user-invocable: true
-includes: ["slack", "schedule"]
-metadata: { "vellum": { "emoji": "📊" } }
+name: slack-digest-setup
+description: Set up recurring Slack channel digests with scanning schedules, channel configuration, and delivery — codifies best practices for high-quality automated summaries
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"📊","vellum":{"display-name":"Slack Digest Setup","user-invocable":true,"includes":["slack","schedule"]}}
 ---
 
 You are helping your user set up a recurring Slack digest: automated channel scanning on a schedule that delivers prose-style summaries of what's happening across their workspace. This skill walks through configuration, scheduling, and — critically — the execution protocol that ensures every digest is actually useful.

package/src/config/bundled-skills/slack-oauth-setup/SKILL.md

@@ -1,9 +1,8 @@
 ---
-name: "Slack OAuth Setup"
-description: "Create Slack App and OAuth credentials for Slack integration using browser automation"
-user-invocable: true
-includes: ["browser"]
-metadata: {"vellum": {"emoji": "🔑"}}
+name: slack-oauth-setup
+description: Create Slack App and OAuth credentials for Slack integration using browser automation
+compatibility: "Designed for Vellum personal assistants"
+metadata: {"emoji":"🔑","vellum":{"display-name":"Slack OAuth Setup","user-invocable":true,"includes":["browser"]}}
 ---
 
 You are helping your user create a Slack App and OAuth credentials so the Messaging integration can connect to their Slack workspace. Walk through each step below using `browser_navigate`, `browser_snapshot`, `browser_screenshot`, `browser_click`, `browser_type`, and `browser_extract` tools.