@vellumai/assistant 0.4.43 → 0.4.45

package/src/config/bundled-skills/gmail/tools/gmail-attachments.ts

@@ -0,0 +1,110 @@
+import { writeFile } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+
+import {
+  getAttachment,
+  getMessage,
+} from "../../../../messaging/providers/gmail/client.js";
+import type { GmailMessagePart } from "../../../../messaging/providers/gmail/types.js";
+import { getMessagingProvider } from "../../../../messaging/registry.js";
+import { withValidToken } from "../../../../security/token-manager.js";
+import type {
+  ToolContext,
+  ToolExecutionResult,
+} from "../../../../tools/types.js";
+import { err, ok } from "./shared.js";
+
+interface AttachmentInfo {
+  partId: string;
+  filename: string;
+  mimeType: string;
+  size: number;
+  attachmentId: string;
+}
+
+/** Recursively walk the MIME parts tree to find attachments. */
+function collectAttachments(
+  parts: GmailMessagePart[] | undefined,
+): AttachmentInfo[] {
+  if (!parts) return [];
+  const result: AttachmentInfo[] = [];
+  for (const part of parts) {
+    if (part.filename && part.body?.attachmentId) {
+      result.push({
+        partId: part.partId ?? "",
+        filename: part.filename,
+        mimeType: part.mimeType ?? "application/octet-stream",
+        size: part.body.size ?? 0,
+        attachmentId: part.body.attachmentId,
+      });
+    }
+    if (part.parts) {
+      result.push(...collectAttachments(part.parts));
+    }
+  }
+  return result;
+}
+
+export async function run(
+  input: Record<string, unknown>,
+  context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const action = input.action as string;
+  const messageId = input.message_id as string;
+
+  if (!action) return err("action is required.");
+  if (!messageId) return err("message_id is required.");
+
+  if (action === "list") {
+    try {
+      const provider = getMessagingProvider("gmail");
+      return await withValidToken(provider.credentialService, async (token) => {
+        const message = await getMessage(token, messageId, "full");
+        const attachments = collectAttachments(message.payload?.parts);
+
+        if (attachments.length === 0) {
+          return ok("No attachments found on this message.");
+        }
+
+        return ok(JSON.stringify(attachments, null, 2));
+      });
+    } catch (e) {
+      return err(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  if (action === "download") {
+    const attachmentId = input.attachment_id as string;
+    const filename = input.filename as string;
+
+    if (!attachmentId) return err("attachment_id is required for download.");
+    if (!filename) return err("filename is required for download.");
+
+    try {
+      const provider = getMessagingProvider("gmail");
+      return await withValidToken(provider.credentialService, async (token) => {
+        const attachment = await getAttachment(token, messageId, attachmentId);
+
+        // Gmail returns base64url; convert to standard base64 then to Buffer
+        const base64 = attachment.data.replace(/-/g, "+").replace(/_/g, "/");
+        const buffer = Buffer.from(base64, "base64");
+
+        const outputDir = context.workingDir ?? process.cwd();
+        // Sanitize filename: strip path separators to prevent traversal attacks from crafted MIME filenames
+        const safeName = basename(filename).replace(/\.\./g, "_");
+        const outputPath = resolve(outputDir, safeName);
+        if (!outputPath.startsWith(outputDir))
+          return err("Invalid filename: path traversal detected.");
+        await writeFile(outputPath, buffer);
+
+        return ok(
+          `Attachment saved to ${outputPath} (${buffer.length} bytes).`,
+        );
+      });
+    } catch (e) {
+      return err(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  return err(`Unknown action: ${action}. Expected "list" or "download".`);
+}

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-draft.ts

@@ -24,7 +24,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       const draft = await createDraft(
         token,
         to,

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-filters.ts

@@ -27,7 +27,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       switch (action) {
         case "list": {
           const filters = await listFilters(token);

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-follow-up.ts

@@ -36,7 +36,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       switch (action) {
         case "track": {
           const messageId = input.message_id as string;

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-forward.ts

@@ -77,7 +77,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       const message = await getMessage(token, messageId, "full");
       const headers = message.payload?.headers ?? [];
       const originalFrom = extractHeader(headers, "From");

package/src/config/bundled-skills/gmail/tools/gmail-label.ts

@@ -0,0 +1,50 @@
+import {
+  batchModifyMessages,
+  modifyMessage,
+} from "../../../../messaging/providers/gmail/client.js";
+import { getMessagingProvider } from "../../../../messaging/registry.js";
+import { withValidToken } from "../../../../security/token-manager.js";
+import type {
+  ToolContext,
+  ToolExecutionResult,
+} from "../../../../tools/types.js";
+import { err, ok } from "./shared.js";
+
+export async function run(
+  input: Record<string, unknown>,
+  _context: ToolContext,
+): Promise<ToolExecutionResult> {
+  const messageId = input.message_id as string | undefined;
+  const messageIds = input.message_ids as string[] | undefined;
+  const addLabelIds = input.add_label_ids as string[] | undefined;
+  const removeLabelIds = input.remove_label_ids as string[] | undefined;
+
+  if (messageIds && messageIds.length > 0) {
+    try {
+      const provider = getMessagingProvider("gmail");
+      return await withValidToken(provider.credentialService, async (token) => {
+        await batchModifyMessages(token, messageIds, {
+          addLabelIds,
+          removeLabelIds,
+        });
+        return ok(`Labels updated on ${messageIds.length} message(s).`);
+      });
+    } catch (e) {
+      return err(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  if (messageId) {
+    try {
+      const provider = getMessagingProvider("gmail");
+      return await withValidToken(provider.credentialService, async (token) => {
+        await modifyMessage(token, messageId, { addLabelIds, removeLabelIds });
+        return ok("Labels updated.");
+      });
+    } catch (e) {
+      return err(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  return err("Provide message_id or message_ids.");
+}

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-outreach-scan.ts

@@ -1,8 +1,3 @@
-import type { EmailMetadata } from "../../../../messaging/email-classifier.js";
-import {
-  classifyOutreach,
-  type OutreachClassification,
-} from "../../../../messaging/outreach-classifier.js";
 import {
   batchGetMessages,
   listMessages,
@@ -31,8 +26,6 @@ interface OutreachSenderAggregation {
   messageIds: string[];
   hasMore: boolean;
   sampleSubjects: string[];
-  outreachTypes: string[];
-  confidenceSum: number;
 }
 
 /** Parse "Display Name <email@example.com>" into parts. */
@@ -48,39 +41,6 @@ function parseFrom(from: string): { displayName: string; email: string } {
   return { displayName: "", email: bare };
 }
 
-function buildSuggestedActions(email: string, count: number): string[] {
-  const actions: string[] = [`Archive all ${count} messages`];
-  if (count >= 2) {
-    actions.push(`Create filter to auto-archive future emails from ${email}`);
-  }
-  if (count >= 3) {
-    const domain = email.split("@")[1];
-    if (domain) {
-      actions.push(
-        `Create filter to auto-archive future emails from @${domain}`,
-      );
-    }
-  }
-  return actions;
-}
-
-/** Find the most common string in an array. */
-function mostCommon(items: string[]): string {
-  const counts = new Map<string, number>();
-  for (const item of items) {
-    counts.set(item, (counts.get(item) ?? 0) + 1);
-  }
-  let best = items[0] ?? "other";
-  let bestCount = 0;
-  for (const [item, count] of counts) {
-    if (count > bestCount) {
-      best = item;
-      bestCount = count;
-    }
-  }
-  return best;
-}
-
 export async function run(
   input: Record<string, unknown>,
   _context: ToolContext,
@@ -91,14 +51,13 @@ export async function run(
   );
   const maxSenders = (input.max_senders as number) ?? 30;
   const timeRange = (input.time_range as string) ?? "90d";
-  const minConfidence = (input.min_confidence as number) ?? 0.5;
   const inputPageToken = input.page_token as string | undefined;
 
   const query = `in:inbox -has:unsubscribe newer_than:${timeRange}`;
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       // Pipeline: fire metadata fetches for each page of IDs as they arrive
       const allMessageIds: string[] = [];
       const fetchPromises: Promise<GmailMessage[]>[] = [];
@@ -142,42 +101,17 @@ export async function run(
           JSON.stringify({
             senders: [],
             total_scanned: 0,
-            outreach_detected: 0,
-            message: "No emails found matching the query.",
+            note: "No emails found matching the query.",
           }),
         );
       }
 
       const messages = (await Promise.all(fetchPromises)).flat();
 
-      // Build EmailMetadata for the classifier
-      const emailMetadata: EmailMetadata[] = messages.map((msg) => {
-        const headers = msg.payload?.headers ?? [];
-        const from =
-          headers.find((h) => h.name.toLowerCase() === "from")?.value ?? "";
-        const subject =
-          headers.find((h) => h.name.toLowerCase() === "subject")?.value ?? "";
-        return { id: msg.id, from, subject, snippet: "", labels: [] };
-      });
-
-      // Classify in batches
-      const classifications = await classifyOutreach(emailMetadata);
-
-      // Index classifications by message ID
-      const classificationMap = new Map<string, OutreachClassification>();
-      for (const c of classifications) {
-        if (c.isOutreach) {
-          classificationMap.set(c.id, c);
-        }
-      }
-
-      // Aggregate by sender email (only outreach-classified messages)
+      // Aggregate all fetched messages by sender
       const senderMap = new Map<string, OutreachSenderAggregation>();
 
       for (const msg of messages) {
-        const classification = classificationMap.get(msg.id);
-        if (!classification) continue;
-
         const headers = msg.payload?.headers ?? [];
         const fromHeader =
           headers.find((h) => h.name.toLowerCase() === "from")?.value ?? "";
@@ -201,15 +135,11 @@ export async function run(
             messageIds: [],
             hasMore: false,
             sampleSubjects: [],
-            outreachTypes: [],
-            confidenceSum: 0,
           };
           senderMap.set(email, agg);
         }
 
         agg.messageCount++;
-        agg.outreachTypes.push(classification.outreachType);
-        agg.confidenceSum += classification.confidence;
 
         if (!agg.displayName && displayName) agg.displayName = displayName;
 
@@ -241,33 +171,21 @@ export async function run(
         }
       }
 
-      // Sort by message count desc, filter by confidence, take top N
-      const qualified = [...senderMap.values()]
-        .map((s) => ({
-          ...s,
-          avgConfidence:
-            s.messageCount > 0 ? s.confidenceSum / s.messageCount : 0,
-          outreachType: mostCommon(s.outreachTypes),
-        }))
-        .filter((s) => s.avgConfidence >= minConfidence)
-        .sort((a, b) => b.messageCount - a.messageCount);
-
-      const totalOutreachDetected = qualified.length;
-      const sorted = qualified.slice(0, maxSenders);
+      // Sort by message count desc, take top N
+      const sorted = [...senderMap.values()]
+        .sort((a, b) => b.messageCount - a.messageCount)
+        .slice(0, maxSenders);
 
       const senders = sorted.map((s) => ({
         id: Buffer.from(s.email).toString("base64url"),
         display_name: s.displayName || s.email.split("@")[0],
         email: s.email,
         message_count: s.messageCount,
-        outreach_type: s.outreachType,
-        confidence: Math.round(s.avgConfidence * 100) / 100,
         newest_message_id: s.newestMessageId,
         oldest_date: s.oldestDate,
         newest_date: s.newestDate,
         search_query: `from:${s.email}`,
         sample_subjects: s.sampleSubjects,
-        suggested_actions: buildSuggestedActions(s.email, s.messageCount),
       }));
 
       // Store message IDs server-side to keep them out of LLM context
@@ -285,9 +203,9 @@ export async function run(
           scan_id: scanId,
           senders,
           total_scanned: allMessageIds.length,
-          outreach_detected: totalOutreachDetected,
           ...(truncated ? { truncated: true } : {}),
           ...(timeBudgetExceeded ? { time_budget_exceeded: true } : {}),
+          note: "Scanned inbox for senders without List-Unsubscribe headers (potential cold outreach). Use gmail_archive and gmail_filters for cleanup.",
         }),
       );
     });

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-send-draft.ts

@@ -16,7 +16,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       const msg = await sendDraft(token, draftId);
       return ok(`Draft sent (Message ID: ${msg.id}).`);
     });

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-sender-digest.ts

@@ -59,7 +59,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       // Pipeline: fire metadata fetches for each page of IDs as they arrive,
       // overlapping fetch latency with pagination latency
       const allMessageIds: string[] = [];
@@ -235,7 +235,7 @@ export async function run(
           query_used: query,
           ...(truncated ? { truncated: true } : {}),
           ...(timeBudgetExceeded ? { time_budget_exceeded: true } : {}),
-          note: `message_count reflects emails found per sender within the ${allMessageIds.length} messages scanned. Use scan_id with gmail_batch_archive to archive messages (pass scan_id + sender_ids instead of message_ids).`,
+          note: `message_count reflects emails found per sender within the ${allMessageIds.length} messages scanned. Use scan_id with gmail_archive to archive messages (pass scan_id + sender_ids instead of message_ids).`,
         }),
       );
     });

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-trash.ts

@@ -19,7 +19,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       await trashMessage(token, messageId);
       return ok("Message moved to trash.");
     });

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-unsubscribe.ts

@@ -33,7 +33,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       const message = await getMessage(token, messageId, "metadata", [
         "List-Unsubscribe",
         "List-Unsubscribe-Post",

package/src/config/bundled-skills/{messaging → gmail}/tools/gmail-vacation.ts

@@ -23,7 +23,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       switch (action) {
         case "get": {
           const settings = await getVacation(token);

package/src/config/bundled-skills/gmail/tools/shared.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared utilities for gmail skill tools.
+ */
+
+import {
+  request as httpsRequest,
+  type RequestOptions as HttpsRequestOptions,
+} from "node:https";
+
+import type { ToolExecutionResult } from "../../../../tools/types.js";
+
+export function ok(content: string): ToolExecutionResult {
+  return { content, isError: false };
+}
+
+export function err(message: string): ToolExecutionResult {
+  return { content: message, isError: true };
+}
+
+/** Make an HTTPS request pinned to a specific resolved IP to prevent DNS rebinding. */
+export function pinnedHttpsRequest(
+  target: URL,
+  resolvedAddress: string,
+  options?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+  },
+): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const reqOpts: HttpsRequestOptions = {
+      method: options?.method ?? "GET",
+      hostname: resolvedAddress,
+      port: target.port ? Number(target.port) : undefined,
+      path: `${target.pathname}${target.search}`,
+      headers: { host: target.host, ...options?.headers },
+      servername: target.hostname,
+    };
+    const req = httpsRequest(reqOpts, (res) => {
+      res.resume();
+      resolve(res.statusCode ?? 0);
+    });
+    req.once("error", reject);
+    if (options?.body) req.write(options.body);
+    req.end();
+  });
+}

package/src/config/bundled-skills/google-calendar/SKILL.md

@@ -2,7 +2,11 @@
 name: google-calendar
 description: View, create, and manage Google Calendar events and check availability
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"📅","vellum":{"display-name":"Google Calendar","user-invocable":true}}
+metadata:
+  emoji: "📅"
+  vellum:
+    display-name: "Google Calendar"
+    user-invocable: true
 ---
 
 You are a Google Calendar assistant with full access to the user's calendar. Use the Calendar tools to help them view, create, and manage events.

package/src/config/bundled-skills/image-studio/SKILL.md

@@ -2,7 +2,11 @@
 name: image-studio
 description: Generate and edit images using AI
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🎨","vellum":{"display-name":"Image Studio","user-invocable":true}}
+metadata:
+  emoji: "🎨"
+  vellum:
+    display-name: "Image Studio"
+    user-invocable: true
 ---
 
 You are an image generation assistant. When the user asks you to create or edit images, use the `media_generate_image` tool.

package/src/config/bundled-skills/knowledge-graph/SKILL.md

@@ -2,7 +2,10 @@
 name: knowledge-graph
 description: Query the entity knowledge graph to explore relationships between people, projects, tools, and other entities tracked in memory
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🕸️","vellum":{"display-name":"Knowledge Graph"}}
+metadata:
+  emoji: "🕸️"
+  vellum:
+    display-name: "Knowledge Graph"
 ---
 
 # Knowledge Graph

package/src/config/bundled-skills/media-processing/SKILL.md

@@ -2,7 +2,10 @@
 name: media-processing
 description: "Ingest and process media files (video, audio, image) through a 3-phase pipeline: preprocess, map (Gemini), and reduce (Claude)"
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🎬","vellum":{"display-name":"Media Processing"}}
+metadata:
+  emoji: "🎬"
+  vellum:
+    display-name: "Media Processing"
 ---
 
 Ingest and track processing of media files (video, audio, images) through a configurable 3-phase pipeline.
@@ -80,15 +83,6 @@ Parameters:
 
 Extract a video clip from a media asset using ffmpeg. Applies configurable pre/post-roll padding (clamped to file boundaries), outputs the clip as a temporary file.
 
-### media_diagnostics
-
-Get a diagnostic report for a media asset. Returns:
-
-- **Processing stats**: total keyframes extracted.
-- **Per-stage status and timing**: which stages (preprocess, map, reduce) have run, how long each took, current progress.
-- **Failure reasons**: last error from any failed stage.
-- **Cost estimation**: based on segment count and current Gemini pricing.
-
 ## Services
 
 ### Processing Pipeline (services/processing-pipeline.ts)
@@ -240,7 +234,7 @@ The response includes per-stage progress (0-100%) so you can see exactly where p
 
 ### Diagnosing Failures
 
-Use `media_diagnostics` to get a full diagnostic report:
+Use `media_status` to check processing stages:
 
 1. Check the `stages` array for any stage with `status: "failed"`.
 2. Read the `lastError` field for that stage to understand what went wrong.
@@ -254,7 +248,7 @@ After fixing the root cause, re-run the failed stage. The pipeline is resumable
 
 ### Cost Expectations
 
-Use `media_diagnostics` to get per-asset cost estimates. The Map phase (Gemini) is the primary cost driver — it scales with video duration and keyframe interval. The Q&A phase (Claude) is negligible per query.
+The Map phase (Gemini) is the primary cost driver — it scales with video duration and keyframe interval. The Q&A phase (Claude) is negligible per query.
 
 ### Known Limitations
 
@@ -272,7 +266,7 @@ Use `media_diagnostics` to get per-asset cost estimates. The Map phase (Gemini)
 | "No LLM provider available"    | API key not configured                | Add one in Settings                                                    |
 | Map phase slow                 | Large video, small interval           | Increase interval_seconds or reduce concurrency                        |
 | Gemini returns errors          | Rate limits or schema issues          | Check max_retries setting; simplify output_schema if needed            |
-| Pipeline stuck at "processing" | Stage crashed without updating status | Use `media_diagnostics` to find the stuck stage; re-run manually       |
+| Pipeline stuck at "processing" | Stage crashed without updating status | Use `media_status` to check stage progress; re-run manually            |
 
 ## Usage Notes
 

package/src/config/bundled-skills/media-processing/TOOLS.json

@@ -249,28 +249,6 @@
       },
       "executor": "tools/generate-clip.ts",
       "execution_target": "host"
-    },
-    {
-      "name": "media_diagnostics",
-      "description": "Get a diagnostic report for a media asset including processing stats, per-stage timing (preprocess/map/reduce), failure reasons, and Gemini-based cost estimation.",
-      "category": "media",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
-          "asset_id": {
-            "type": "string",
-            "description": "ID of the media asset to diagnose"
-          },
-          "reason": {
-            "type": "string",
-            "description": "Brief non-technical explanation of why this tool is being called"
-          }
-        },
-        "required": ["asset_id"]
-      },
-      "executor": "tools/media-diagnostics.ts",
-      "execution_target": "host"
     }
   ]
 }

package/src/config/bundled-skills/media-processing/tools/generate-clip.ts

@@ -73,6 +73,8 @@ const MIME_BY_FORMAT: Record<string, string> = {
   mov: "video/quicktime",
 };
 
+const ALLOWED_OUTPUT_FORMATS = new Set(Object.keys(MIME_BY_FORMAT));
+
 // ---------------------------------------------------------------------------
 // Tool entry point
 // ---------------------------------------------------------------------------
@@ -105,7 +107,16 @@ export async function run(
 
   const preRoll = (input.pre_roll as number) ?? 3;
   const postRoll = (input.post_roll as number) ?? 2;
-  const outputFormat = (input.output_format as string) ?? "mp4";
+  const outputFormatInput =
+    typeof input.output_format === "string" ? input.output_format : "mp4";
+  const outputFormat = outputFormatInput.toLowerCase();
+  if (!ALLOWED_OUTPUT_FORMATS.has(outputFormat)) {
+    return {
+      content:
+        "output_format must be one of: mp4, webm, mov (defaults to mp4).",
+      isError: true,
+    };
+  }
   const title = input.title as string | undefined;
 
   const asset = getMediaAssetById(assetId);