@vellumai/assistant 0.4.43 → 0.4.45

package/src/config/bundled-skills/computer-use/TOOLS.json

@@ -3,80 +3,17 @@
   "tools": [
     {
       "name": "computer_use_click",
-      "description": "Click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
+      "description": "Click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback. Supports single click, double-click, and right-click via the click_type parameter.",
       "category": "computer-use",
       "risk": "low",
       "input_schema": {
         "type": "object",
         "properties": {
-          "element_id": {
-            "type": "integer",
-            "description": "The [ID] number of the element from the accessibility tree (preferred)"
-          },
-          "x": {
-            "type": "integer",
-            "description": "X coordinate on screen (fallback when no element_id)"
-          },
-          "y": {
-            "type": "integer",
-            "description": "Y coordinate on screen (fallback when no element_id)"
-          },
-          "reasoning": {
-            "type": "string",
-            "description": "Explanation of what you see and why you are clicking here"
-          },
-          "reason": {
-            "type": "string",
-            "description": "Brief non-technical explanation of why this tool is being called"
-          }
-        },
-        "required": ["reasoning"]
-      },
-      "executor": "tools/computer-use-click.ts",
-      "execution_target": "host"
-    },
-    {
-      "name": "computer_use_double_click",
-      "description": "Double-click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
-      "category": "computer-use",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
-          "element_id": {
-            "type": "integer",
-            "description": "The [ID] number of the element from the accessibility tree (preferred)"
-          },
-          "x": {
-            "type": "integer",
-            "description": "X coordinate on screen (fallback when no element_id)"
-          },
-          "y": {
-            "type": "integer",
-            "description": "Y coordinate on screen (fallback when no element_id)"
-          },
-          "reasoning": {
+          "click_type": {
             "type": "string",
-            "description": "Explanation of what you see and why you are double-clicking here"
+            "enum": ["single", "double", "right"],
+            "description": "Type of click to perform (default: \"single\")"
           },
-          "reason": {
-            "type": "string",
-            "description": "Brief non-technical explanation of why this tool is being called"
-          }
-        },
-        "required": ["reasoning"]
-      },
-      "executor": "tools/computer-use-double-click.ts",
-      "execution_target": "host"
-    },
-    {
-      "name": "computer_use_right_click",
-      "description": "Right-click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
-      "category": "computer-use",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
           "element_id": {
             "type": "integer",
             "description": "The [ID] number of the element from the accessibility tree (preferred)"
@@ -91,7 +28,7 @@
           },
           "reasoning": {
             "type": "string",
-            "description": "Explanation of what you see and why you are right-clicking here"
+            "description": "Explanation of what you see and why you are clicking here"
           },
           "reason": {
             "type": "string",
@@ -100,7 +37,7 @@
         },
         "required": ["reasoning"]
       },
-      "executor": "tools/computer-use-right-click.ts",
+      "executor": "tools/computer-use-click.ts",
       "execution_target": "host"
     },
     {

package/src/config/bundled-skills/computer-use/tools/computer-use-click.ts

@@ -4,9 +4,18 @@ import type {
   ToolExecutionResult,
 } from "../../../../tools/types.js";
 
+const CLICK_TYPE_TO_PROXY_TOOL: Record<string, string> = {
+  single: "computer_use_click",
+  double: "computer_use_double_click",
+  right: "computer_use_right_click",
+};
+
 export async function run(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  return forwardComputerUseProxyTool("computer_use_click", input, context);
+  const clickType = (input.click_type as string | undefined) ?? "single";
+  const proxyToolName =
+    CLICK_TYPE_TO_PROXY_TOOL[clickType] ?? "computer_use_click";
+  return forwardComputerUseProxyTool(proxyToolName, input, context);
 }

package/src/config/bundled-skills/contacts/SKILL.md

@@ -2,7 +2,12 @@
 name: contacts
 description: Manage contacts, communication channels, access control, and invite links
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"👥","vellum":{"display-name":"Contacts","user-invocable":true}}
+metadata:
+  emoji: "👥"
+  vellum:
+    display-name: "Contacts"
+    user-invocable: true
+    feature-flag: "contacts"
 ---
 
 Manage the user's contacts, relationship graph, access control (trusted contacts), and invite links. This skill covers contact CRUD with multi-channel tracking, controlling who can message the assistant through external channels (Telegram, phone), and creating/managing invite links that grant access.
@@ -414,6 +419,10 @@ assistant contacts invites revoke <invite_id> --json
 
 Replace `<invite_id>` with the invite's `id` from the list response. The same revoke command is used for both Telegram and voice invites.
 
+## Google Contacts
+
+Use `google_contacts` to list or search the user's Google Contacts by name or email. Returns name, email, phone, and organization. Requires the `contacts.readonly` OAuth scope — users may need to re-authorize Gmail to grant this additional permission.
+
 ## Contact Fields
 
 - **displayName** -- the contact's name (required)

package/src/config/bundled-skills/contacts/TOOLS.json

@@ -121,6 +121,41 @@
       },
       "executor": "tools/contact-merge.ts",
       "execution_target": "host"
+    },
+    {
+      "name": "google_contacts",
+      "description": "List or search Google Contacts. Requires contacts.readonly scope (re-authorization may be needed).",
+      "category": "contacts",
+      "risk": "low",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "action": {
+            "type": "string",
+            "enum": ["list", "search"],
+            "description": "Contacts action"
+          },
+          "query": {
+            "type": "string",
+            "description": "Search query (for search action)"
+          },
+          "page_size": {
+            "type": "number",
+            "description": "Number of contacts to return (default 50, for list)"
+          },
+          "page_token": {
+            "type": "string",
+            "description": "Pagination token (for list)"
+          },
+          "reason": {
+            "type": "string",
+            "description": "Brief non-technical explanation of why this tool is being called"
+          }
+        },
+        "required": ["action"]
+      },
+      "executor": "tools/google-contacts.ts",
+      "execution_target": "host"
     }
   ]
 }

package/src/config/bundled-skills/{messaging → contacts}/tools/google-contacts.ts

@@ -9,7 +9,14 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok } from "./shared.js";
+
+function ok(text: string): ToolExecutionResult {
+  return { content: text, isError: false };
+}
+
+function err(text: string): ToolExecutionResult {
+  return { content: text, isError: true };
+}
 
 function formatContact(person: Person): Record<string, unknown> {
   const name = person.names?.[0];
@@ -38,7 +45,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       switch (action) {
         case "list": {
           const pageSize = (input.page_size as number) ?? 50;

package/src/config/bundled-skills/document/SKILL.md

@@ -2,7 +2,10 @@
 name: document
 description: Write, draft, or compose long-form text (blog posts, articles, essays, reports, guides). Use when the user says write, draft, compose, or create a blog/article/essay.
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"📄","vellum":{"display-name":"Document"}}
+metadata:
+  emoji: "📄"
+  vellum:
+    display-name: "Document"
 ---
 
 Create and edit long-form documents using the built-in rich text editor. Documents open in workspace mode with chat docked to the side.

package/src/config/bundled-skills/doordash/SKILL.md

@@ -2,7 +2,14 @@
 name: doordash
 description: Order food, groceries, and convenience items from DoorDash using the built-in CLI integration
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🍕","vellum":{"display-name":"DoorDash","user-invocable":true,"cli":{"command":"doordash","entry":"doordash-entry.ts"}}}
+metadata:
+  emoji: "🍕"
+  vellum:
+    display-name: "DoorDash"
+    user-invocable: true
+    cli:
+      command: "doordash"
+      entry: "doordash-entry.ts"
 ---
 
 You can order food from DoorDash for the user using the `doordash` CLI.
@@ -125,7 +132,6 @@ doordash cart add --store-id <id> --menu-id <id> --item-id <id> --item-name "Lat
 ```
 doordash status --json              # Check if logged in
 doordash refresh --json             # Capture fresh session via Ride Shotgun (auto-stops after login)
-doordash login --recording <path>   # Import session from a recording file manually
 doordash logout --json              # Clear session
 doordash search "<query>" --json    # Search restaurants
 doordash menu <storeId> --json      # Get store menu (auto-detects retail stores)

package/src/config/bundled-skills/doordash/__tests__/doordash-session.test.ts

@@ -1,20 +1,11 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { describe, expect, it } from "bun:test";
 
 import {
   type DoorDashSession,
   getCookieHeader,
   getCsrfToken,
-  importFromRecording,
 } from "../lib/session.js";
 
-// Override VELLUM_DATA_DIR to use a temp directory during tests.
-// session.ts reads process.env.VELLUM_DATA_DIR directly.
-const TEST_DIR = join(tmpdir(), `vellum-dd-test-${process.pid}`);
-let originalDataDir: string | undefined;
-
 function makeCookie(
   name: string,
   value: string,
@@ -81,75 +72,3 @@ describe("DoorDash session helpers", () => {
     });
   });
 });
-
-describe("DoorDash session persistence", () => {
-  // These tests exercise the real loadSession/saveSession/clearSession
-  // by pointing VELLUM_DATA_DIR at a temp directory and testing via
-  // importFromRecording which exercises save+load.
-
-  beforeEach(() => {
-    originalDataDir = process.env.VELLUM_DATA_DIR;
-    process.env.VELLUM_DATA_DIR = TEST_DIR;
-    mkdirSync(TEST_DIR, { recursive: true });
-  });
-
-  afterEach(() => {
-    if (originalDataDir === undefined) {
-      delete process.env.VELLUM_DATA_DIR;
-    } else {
-      process.env.VELLUM_DATA_DIR = originalDataDir;
-    }
-    if (existsSync(TEST_DIR)) {
-      rmSync(TEST_DIR, { recursive: true, force: true });
-    }
-  });
-
-  describe("importFromRecording", () => {
-    it("throws when the recording file does not exist", () => {
-      expect(() => importFromRecording("/nonexistent/recording.json")).toThrow(
-        "Recording not found",
-      );
-    });
-
-    it("throws when the recording contains no cookies", () => {
-      const recordingPath = join(TEST_DIR, "empty-recording.json");
-      writeFileSync(
-        recordingPath,
-        JSON.stringify({
-          id: "rec-empty",
-          startedAt: 0,
-          endedAt: 1,
-          targetDomain: "doordash.com",
-          networkEntries: [],
-          cookies: [],
-          observations: [],
-        }),
-      );
-      expect(() => importFromRecording(recordingPath)).toThrow(
-        "Recording contains no cookies",
-      );
-    });
-
-    it("successfully imports a recording with cookies", () => {
-      const recordingPath = join(TEST_DIR, "valid-recording.json");
-      writeFileSync(
-        recordingPath,
-        JSON.stringify({
-          id: "rec-valid",
-          startedAt: 0,
-          endedAt: 1,
-          targetDomain: "doordash.com",
-          networkEntries: [],
-          cookies: [makeCookie("session_id", "xyz")],
-          observations: [],
-        }),
-      );
-      const session = importFromRecording(recordingPath);
-      expect(session.cookies).toHaveLength(1);
-      expect(session.cookies[0].name).toBe("session_id");
-      expect(session.cookies[0].value).toBe("xyz");
-      expect(session.recordingId).toBe("rec-valid");
-      expect(session.importedAt).toBeTruthy();
-    });
-  });
-});

package/src/config/bundled-skills/doordash/doordash-cli.ts

@@ -33,11 +33,16 @@ import {
 import { extractQueries, saveQueries } from "./lib/query-extractor.js";
 import {
   clearSession,
-  importFromRecording,
+  importFromCredentialStore,
   loadSession,
 } from "./lib/session.js";
 import { NetworkRecorder } from "./lib/shared/network-recorder.js";
-import { buildDaemonUrl, getDataDir, getHttpPort, readHttpToken } from "./lib/shared/platform.js";
+import {
+  buildDaemonUrl,
+  getDataDir,
+  getHttpPort,
+  readHttpToken,
+} from "./lib/shared/platform.js";
 import { loadRecording, saveRecording } from "./lib/shared/recording-store.js";
 import type { SessionRecording } from "./lib/shared/recording-types.js";
 
@@ -94,27 +99,10 @@ export function registerDoordashCommand(program: Command): void {
   const dd = program
     .command("doordash")
     .description(
-      "Order food from DoorDash. Requires a session imported from a Ride Shotgun recording.",
+      'Order food from DoorDash. Requires an active session (use "refresh" to authenticate).',
     )
     .option("--json", "Machine-readable JSON output");
 
-  // =========================================================================
-  // login — import session from a recording
-  // =========================================================================
-  dd.command("login")
-    .description("Import a DoorDash session from a Ride Shotgun recording")
-    .requiredOption("--recording <path>", "Path to the recording JSON file")
-    .action(async (opts: { recording: string }, cmd: Command) => {
-      await run(cmd, async () => {
-        const session = importFromRecording(opts.recording);
-        return {
-          message: "Session imported successfully",
-          cookieCount: session.cookies.length,
-          recordingId: session.recordingId,
-        };
-      });
-    });
-
   // =========================================================================
   // logout — clear saved session
   // =========================================================================
@@ -148,13 +136,13 @@ export function registerDoordashCommand(program: Command): void {
         }
 
         const result = await startLearnSession(duration);
-        if (result.recordingPath) {
-          const session = importFromRecording(result.recordingPath);
+        if (result.recordingId) {
+          const session = await importFromCredentialStore("doordash.com");
 
           // Also extract and save captured queries for self-healing
           let queriesCaptured = 0;
           try {
-            const recording = loadRecording(result.recordingId ?? "");
+            const recording = loadRecording(result.recordingId);
             if (recording) {
               const queries = extractQueries(recording);
               if (queries.length > 0) {
@@ -188,7 +176,7 @@ export function registerDoordashCommand(program: Command): void {
           output(
             {
               ok: false,
-              error: "Recording completed but no recording path returned",
+              error: "Recording completed but no recording ID returned",
               recordingId: result.recordingId,
             },
             json,
@@ -1020,7 +1008,10 @@ async function startLearnSession(
       // Poll session status to detect failures early
       try {
         const fetchAbort = AbortSignal.timeout(10_000);
-        const statusRes = await fetch(statusUrl, { headers, signal: fetchAbort });
+        const statusRes = await fetch(statusUrl, {
+          headers,
+          signal: fetchAbort,
+        });
         if (statusRes.ok) {
           const status = (await statusRes.json()) as {
             status: string;
@@ -1073,9 +1064,7 @@ async function startLearnSession(
 
             // Completed but no recordingId — cannot correlate
             reject(
-              new Error(
-                "Learn session completed but no recording was saved.",
-              ),
+              new Error("Learn session completed but no recording was saved."),
             );
             return;
           }

package/src/config/bundled-skills/doordash/lib/session.ts

@@ -1,8 +1,9 @@
 /**
  * DoorDash session persistence.
- * Stores/loads auth cookies from a recording or manual login.
+ * Stores/loads auth cookies via the credential store.
  */
 
+import { execFile } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
@@ -11,12 +12,12 @@ import {
   writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
+import { promisify } from "node:util";
 
 import { ConfigError } from "./shared/errors.js";
-import type {
-  ExtractedCredential,
-  SessionRecording,
-} from "./shared/recording-types.js";
+import type { ExtractedCredential } from "./shared/recording-types.js";
+
+const execFileAsync = promisify(execFile);
 
 export interface DoorDashSession {
   cookies: ExtractedCredential[];
@@ -56,22 +57,25 @@ export function clearSession(): void {
 }
 
 /**
- * Import cookies from a Ride Shotgun recording file.
+ * Import cookies that the daemon saved to the credential store under the
+ * target domain key. Copies them into the local DoorDash session file.
  */
-export function importFromRecording(recordingPath: string): DoorDashSession {
-  if (!existsSync(recordingPath)) {
-    throw new ConfigError(`Recording not found: ${recordingPath}`);
-  }
-  const recording = JSON.parse(
-    readFileSync(recordingPath, "utf-8"),
-  ) as SessionRecording;
-  if (!recording.cookies?.length) {
-    throw new ConfigError("Recording contains no cookies");
+export async function importFromCredentialStore(
+  targetDomain: string,
+): Promise<DoorDashSession> {
+  const { stdout } = await execFileAsync("assistant", [
+    "credentials",
+    "reveal",
+    `${targetDomain}:session:cookies`,
+  ]);
+  const cookies = JSON.parse(stdout.trim()) as ExtractedCredential[];
+  if (!cookies.length) {
+    throw new ConfigError("No cookies found in credential store");
   }
+
   const session: DoorDashSession = {
-    cookies: recording.cookies,
+    cookies,
     importedAt: new Date().toISOString(),
-    recordingId: recording.id,
   };
   saveSession(session);
   return session;

package/src/config/bundled-skills/doordash/lib/shared/platform.ts

@@ -44,7 +44,10 @@ export function buildDaemonUrl(port?: number): string {
  */
 export function readHttpToken(): string | null {
   try {
-    const token = readFileSync(join(getRootDir(), "http-token"), "utf-8").trim();
+    const token = readFileSync(
+      join(getRootDir(), "http-token"),
+      "utf-8",
+    ).trim();
     return token || null;
   } catch {
     return null;

package/src/config/bundled-skills/followups/SKILL.md

@@ -2,7 +2,10 @@
 name: followups
 description: Track sent messages awaiting responses across communication channels
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"📨","vellum":{"display-name":"Followups"}}
+metadata:
+  emoji: "📨"
+  vellum:
+    display-name: "Followups"
 ---
 
 Track messages sent on external channels (email, Slack, WhatsApp, etc.) that are awaiting a response.