@vellumai/assistant 0.4.43 → 0.4.45

package/src/config/schema.ts

@@ -127,17 +127,14 @@ export {
 export type { NotificationsConfig } from "./schemas/notifications.js";
 export { NotificationsConfigSchema } from "./schemas/notifications.js";
 export type {
-  AvatarConfig,
   DaemonConfig,
   PlatformConfig,
   UiConfig,
 } from "./schemas/platform.js";
 export {
-  AvatarConfigSchema,
   DaemonConfigSchema,
   PlatformConfigSchema,
   UiConfigSchema,
-  VALID_AVATAR_STRATEGIES,
 } from "./schemas/platform.js";
 export type { SandboxConfig } from "./schemas/sandbox.js";
 export { SandboxConfigSchema } from "./schemas/sandbox.js";
@@ -202,7 +199,6 @@ import { McpConfigSchema } from "./schemas/mcp.js";
 import { MemoryConfigSchema } from "./schemas/memory.js";
 import { NotificationsConfigSchema } from "./schemas/notifications.js";
 import {
-  AvatarConfigSchema,
   DaemonConfigSchema,
   PlatformConfigSchema,
   UiConfigSchema,
@@ -274,11 +270,6 @@ export const AssistantConfigSchema = z
       .int("maxTokens must be an integer")
       .positive("maxTokens must be a positive integer")
       .default(16000),
-    maxToolUseTurns: z
-      .number({ error: "maxToolUseTurns must be a number" })
-      .int("maxToolUseTurns must be an integer")
-      .nonnegative("maxToolUseTurns must be a non-negative integer")
-      .default(40),
     effort: EffortSchema,
     thinking: ThinkingConfigSchema.default(ThinkingConfigSchema.parse({})),
     contextWindow: ContextWindowConfigSchema.default(
@@ -321,7 +312,6 @@ export const AssistantConfigSchema = z
     notifications: NotificationsConfigSchema.default(
       NotificationsConfigSchema.parse({}),
     ),
-    avatar: AvatarConfigSchema.default(AvatarConfigSchema.parse({})),
     ui: UiConfigSchema.default(UiConfigSchema.parse({})),
     assistantFeatureFlagValues: z
       .record(
@@ -334,16 +324,29 @@ export const AssistantConfigSchema = z
   })
   .superRefine((config, ctx) => {
     if (
-      config.contextWindow?.targetInputTokens != null &&
-      config.contextWindow?.maxInputTokens != null &&
-      config.contextWindow.targetInputTokens >=
-        config.contextWindow.maxInputTokens
+      config.contextWindow?.targetBudgetRatio != null &&
+      config.contextWindow?.compactThreshold != null &&
+      config.contextWindow.targetBudgetRatio >=
+        config.contextWindow.compactThreshold
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        path: ["contextWindow", "targetInputTokens"],
+        path: ["contextWindow", "targetBudgetRatio"],
         message:
-          "contextWindow.targetInputTokens must be less than contextWindow.maxInputTokens",
+          "contextWindow.targetBudgetRatio must be less than contextWindow.compactThreshold",
+      });
+    }
+    if (
+      config.contextWindow?.targetBudgetRatio != null &&
+      config.contextWindow?.summaryBudgetRatio != null &&
+      config.contextWindow.targetBudgetRatio <=
+        config.contextWindow.summaryBudgetRatio
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["contextWindow", "targetBudgetRatio"],
+        message:
+          "contextWindow.targetBudgetRatio must be greater than contextWindow.summaryBudgetRatio",
       });
     }
     const segmentation = config.memory?.segmentation;

package/src/config/schemas/inference.ts

@@ -80,34 +80,24 @@ export const ContextWindowConfigSchema = z.object({
     .int("contextWindow.maxInputTokens must be an integer")
     .positive("contextWindow.maxInputTokens must be a positive integer")
     .default(200000),
-  targetInputTokens: z
-    .number({ error: "contextWindow.targetInputTokens must be a number" })
-    .int("contextWindow.targetInputTokens must be an integer")
-    .positive("contextWindow.targetInputTokens must be a positive integer")
-    .default(110000),
+  targetBudgetRatio: z
+    .number({ error: "contextWindow.targetBudgetRatio must be a number" })
+    .finite("contextWindow.targetBudgetRatio must be finite")
+    .gt(0, "contextWindow.targetBudgetRatio must be greater than 0")
+    .lte(1, "contextWindow.targetBudgetRatio must be less than or equal to 1")
+    .default(0.3),
   compactThreshold: z
     .number({ error: "contextWindow.compactThreshold must be a number" })
     .finite("contextWindow.compactThreshold must be finite")
     .gt(0, "contextWindow.compactThreshold must be greater than 0")
     .lte(1, "contextWindow.compactThreshold must be less than or equal to 1")
     .default(0.8),
-  preserveRecentUserTurns: z
-    .number({ error: "contextWindow.preserveRecentUserTurns must be a number" })
-    .int("contextWindow.preserveRecentUserTurns must be an integer")
-    .positive(
-      "contextWindow.preserveRecentUserTurns must be a positive integer",
-    )
-    .default(8),
-  summaryMaxTokens: z
-    .number({ error: "contextWindow.summaryMaxTokens must be a number" })
-    .int("contextWindow.summaryMaxTokens must be an integer")
-    .positive("contextWindow.summaryMaxTokens must be a positive integer")
-    .default(1200),
-  chunkTokens: z
-    .number({ error: "contextWindow.chunkTokens must be a number" })
-    .int("contextWindow.chunkTokens must be an integer")
-    .positive("contextWindow.chunkTokens must be a positive integer")
-    .default(12000),
+  summaryBudgetRatio: z
+    .number({ error: "contextWindow.summaryBudgetRatio must be a number" })
+    .finite("contextWindow.summaryBudgetRatio must be finite")
+    .gt(0, "contextWindow.summaryBudgetRatio must be greater than 0")
+    .lte(1, "contextWindow.summaryBudgetRatio must be less than or equal to 1")
+    .default(0.05),
   overflowRecovery: ContextOverflowRecoveryConfigSchema.default(
     ContextOverflowRecoveryConfigSchema.parse({}),
   ),

package/src/config/schemas/memory-storage.ts

@@ -29,7 +29,25 @@ export const MemoryEmbeddingsConfigSchema = z.object({
     .default("text-embedding-3-small"),
   geminiModel: z
     .string({ error: "memory.embeddings.geminiModel must be a string" })
-    .default("gemini-embedding-001"),
+    .default("gemini-embedding-2-preview"),
+  geminiTaskType: z
+    .enum([
+      "SEMANTIC_SIMILARITY",
+      "CLASSIFICATION",
+      "CLUSTERING",
+      "RETRIEVAL_DOCUMENT",
+      "RETRIEVAL_QUERY",
+      "CODE_RETRIEVAL_QUERY",
+      "QUESTION_ANSWERING",
+      "FACT_VERIFICATION",
+    ], { error: "memory.embeddings.geminiTaskType must be a valid task type" })
+    .optional(),
+  geminiDimensions: z
+    .number({ error: "memory.embeddings.geminiDimensions must be a number" })
+    .int("memory.embeddings.geminiDimensions must be an integer")
+    .min(128, "memory.embeddings.geminiDimensions must be >= 128")
+    .max(3072, "memory.embeddings.geminiDimensions must be <= 3072")
+    .optional(),
   ollamaModel: z
     .string({ error: "memory.embeddings.ollamaModel must be a string" })
     .default("nomic-embed-text"),

package/src/config/schemas/platform.ts

@@ -1,21 +1,5 @@
 import { z } from "zod";
 
-export const VALID_AVATAR_STRATEGIES = [
-  "managed_required",
-  "managed_prefer",
-  "local_only",
-] as const;
-
-export const AvatarConfigSchema = z.object({
-  generationStrategy: z
-    .enum(VALID_AVATAR_STRATEGIES, {
-      error: `avatar.generationStrategy must be one of: ${VALID_AVATAR_STRATEGIES.join(", ")}`,
-    })
-    .default("local_only"),
-});
-
-export type AvatarConfig = z.infer<typeof AvatarConfigSchema>;
-
 export const PlatformConfigSchema = z.object({
   baseUrl: z
     .string({ error: "platform.baseUrl must be a string" })

package/src/config/skill-state.ts

@@ -14,13 +14,15 @@ export interface ResolvedSkill {
 }
 
 /**
- * Derive the feature flag key for a given skill ID.
- *
- * Exported so other modules (system-prompt, session-skill-tools, skill loader)
- * can perform the same mapping.
+ * Derive the feature flag key for a skill from its frontmatter `featureFlag` field.
+ * Returns undefined if the skill has no feature flag declared.
  */
-export function skillFlagKey(skillId: string): string {
-  return `feature_flags.${skillId}.enabled`;
+export function skillFlagKey(
+  skill: Pick<SkillSummary, "featureFlag">,
+): string | undefined {
+  return skill.featureFlag
+    ? `feature_flags.${skill.featureFlag}.enabled`
+    : undefined;
 }
 
 export function resolveSkillStates(
@@ -34,8 +36,9 @@ export function resolveSkillStates(
   };
 
   for (const skill of catalog) {
-    // Assistant feature flag gate: if the flag is explicitly OFF, skip this skill entirely
-    if (!isAssistantFeatureFlagEnabled(skillFlagKey(skill.id), config)) {
+    // Assistant feature flag gate: if the skill declares a flag and it's disabled, skip it
+    const flagKey = skillFlagKey(skill);
+    if (flagKey && !isAssistantFeatureFlagEnabled(flagKey, config)) {
       continue;
     }
 

package/src/config/skills.ts

@@ -1,5 +1,6 @@
 import {
   existsSync,
+  lstatSync,
   readdirSync,
   readFileSync,
   realpathSync,
@@ -69,6 +70,7 @@ const VellumMetadataSchema = z
     "disable-model-invocation": z.union([z.boolean(), z.string()]).optional(),
     includes: z.array(z.string()).optional(),
     "credential-setup-for": z.string().optional(),
+    "feature-flag": z.string().optional(),
   })
   .passthrough();
 
@@ -136,6 +138,8 @@ export interface SkillSummary {
   includes?: string[];
   /** Declares which credential this skill sets up (e.g. "vercel:api_token"). */
   credentialSetupFor?: string;
+  /** Feature flag ID declared in frontmatter. Only skills with this field are subject to feature flag gating. */
+  featureFlag?: string;
 }
 
 export interface SkillDefinition extends SkillSummary {
@@ -329,6 +333,7 @@ interface ParsedFrontmatter {
   metadata?: VellumMetadata;
   includes?: string[];
   credentialSetupFor?: string;
+  featureFlag?: string;
 }
 
 function parseFrontmatter(
@@ -343,8 +348,11 @@ function parseFrontmatter(
 
   const { fields, body } = result;
 
-  const name = fields.name?.trim();
-  const description = fields.description?.trim();
+  const name = typeof fields.name === "string" ? fields.name.trim() : undefined;
+  const description =
+    typeof fields.description === "string"
+      ? fields.description.trim()
+      : undefined;
   if (!name || !description) {
     log.warn(
       { skillFilePath },
@@ -353,25 +361,31 @@ function parseFrontmatter(
     return null;
   }
 
-  // Parse metadata as single-line JSON string, validate with Zod schema
+  // metadata is already a parsed object from YAML — validate with Zod schema
   let metadata: VellumMetadata | undefined;
   let parsedMeta: z.infer<typeof SkillMetadataSchema> | undefined;
   let vellum: z.infer<typeof VellumMetadataSchema> | undefined;
 
-  const metadataRaw = fields.metadata?.trim();
-  if (metadataRaw) {
-    try {
-      const json = JSON.parse(metadataRaw);
-      const result = SkillMetadataSchema.safeParse(json);
-      if (result.success) {
-        parsedMeta = result.data;
+  const metadataRaw = fields.metadata;
+  if (metadataRaw != null) {
+    if (typeof metadataRaw === "string") {
+      // metadata is a string — this means someone wrote inline JSON or a
+      // bare string value. YAML metadata must be a nested object.
+      log.warn(
+        { skillFilePath },
+        "Metadata must be a YAML object, not a string; ignoring metadata field",
+      );
+    } else if (typeof metadataRaw === "object") {
+      const zodResult = SkillMetadataSchema.safeParse(metadataRaw);
+      if (zodResult.success) {
+        parsedMeta = zodResult.data;
         vellum = parsedMeta.vellum;
         if (parsedMeta.vellum) {
           metadata = parsedMeta.vellum as VellumMetadata;
         }
         // Inject top-level emoji into metadata when metadata.vellum doesn't
         // carry its own emoji. The Agent Skills spec places emoji at the
-        // top level of the metadata JSON, so bundled skills that follow
+        // top level of the metadata object, so bundled skills that follow
         // this convention would otherwise lose their emoji value.
         if (parsedMeta.emoji) {
           if (metadata && !metadata.emoji) {
@@ -381,27 +395,30 @@ function parseFrontmatter(
           }
         }
       } else {
-        // Zod validation failed — fall back to raw JSON so we don't lose
-        // all metadata because of a single bad field value.  We coerce
+        // Zod validation failed — fall back to raw parsed object so we don't
+        // lose all metadata because of a single bad field value.  We coerce
         // critical array fields so downstream code that iterates them
         // (e.g. `.join()`, `for...of`, `.some()`) won't crash.
         log.warn(
-          { err: result.error, skillFilePath },
-          "Metadata failed schema validation; falling back to raw JSON",
+          { err: zodResult.error, skillFilePath },
+          "Metadata failed schema validation; falling back to raw object",
         );
-        parsedMeta = json;
-        vellum = json?.vellum;
-        if (json?.vellum && typeof json.vellum === "object") {
-          const raw = json.vellum as Record<string, unknown>;
+        const raw = metadataRaw as Record<string, unknown>;
+        parsedMeta = raw as z.infer<typeof SkillMetadataSchema>;
+        vellum = raw?.vellum as z.infer<typeof VellumMetadataSchema>;
+        if (raw?.vellum && typeof raw.vellum === "object") {
+          const vellumRaw = raw.vellum as Record<string, unknown>;
 
           // Coerce `os` to string[] — a bare string is wrapped in an array.
-          if (raw.os !== undefined) {
-            raw.os = Array.isArray(raw.os) ? raw.os : [raw.os];
+          if (vellumRaw.os !== undefined) {
+            vellumRaw.os = Array.isArray(vellumRaw.os)
+              ? vellumRaw.os
+              : [vellumRaw.os];
           }
 
           // Coerce `requires` sub-fields to arrays.
-          if (raw.requires && typeof raw.requires === "object") {
-            const req = raw.requires as Record<string, unknown>;
+          if (vellumRaw.requires && typeof vellumRaw.requires === "object") {
+            const req = vellumRaw.requires as Record<string, unknown>;
             for (const key of ["bins", "anyBins", "env", "config"] as const) {
               if (req[key] !== undefined && !Array.isArray(req[key])) {
                 req[key] = typeof req[key] === "string" ? [req[key]] : [];
@@ -409,14 +426,9 @@ function parseFrontmatter(
             }
           }
 
-          metadata = raw as unknown as VellumMetadata;
+          metadata = vellumRaw as unknown as VellumMetadata;
         }
       }
-    } catch (err) {
-      log.warn(
-        { err, skillFilePath },
-        "Failed to parse metadata JSON in frontmatter",
-      );
     }
   }
 
@@ -459,6 +471,11 @@ function parseFrontmatter(
       ? vellum["credential-setup-for"]
       : undefined;
 
+  const featureFlag =
+    typeof vellum?.["feature-flag"] === "string"
+      ? vellum["feature-flag"]
+      : undefined;
+
   const displayName =
     (typeof vellum?.["display-name"] === "string"
       ? vellum["display-name"]
@@ -474,6 +491,7 @@ function parseFrontmatter(
     metadata,
     includes,
     credentialSetupFor,
+    featureFlag,
   };
 }
 
@@ -628,6 +646,7 @@ function readSkillFromDirectory(
       toolManifest: detectToolManifest(directoryPath),
       includes: parsed.includes,
       credentialSetupFor: parsed.credentialSetupFor,
+      featureFlag: parsed.featureFlag,
     };
   } catch (err) {
     log.warn({ err, skillFilePath }, "Failed to read skill file");
@@ -678,6 +697,7 @@ function readBundledSkillFromDirectory(
       toolManifest: detectToolManifest(directoryPath),
       includes: parsed.includes,
       credentialSetupFor: parsed.credentialSetupFor,
+      featureFlag: parsed.featureFlag,
     };
   } catch (err) {
     log.warn({ err, skillFilePath }, "Failed to read bundled skill file");
@@ -736,6 +756,7 @@ function loadBundledSkills(): SkillSummary[] {
       toolManifest: skill.toolManifest,
       includes: skill.includes,
       credentialSetupFor: skill.credentialSetupFor,
+      featureFlag: skill.featureFlag,
     });
   }
 
@@ -873,6 +894,7 @@ function skillSummaryFromDefinition(
     toolManifest: skill.toolManifest,
     includes: skill.includes,
     credentialSetupFor: skill.credentialSetupFor,
+    featureFlag: skill.featureFlag,
   };
 }
 
@@ -925,6 +947,7 @@ export function loadSkillCatalog(
             toolManifest: detectToolManifest(directory),
             includes: parsed.includes,
             credentialSetupFor: parsed.credentialSetupFor,
+            featureFlag: parsed.featureFlag,
           });
         } catch (err) {
           log.warn({ err, directory }, "Failed to read skill from extraDirs");
@@ -1021,6 +1044,7 @@ export function loadSkillCatalog(
           toolManifest: detectToolManifest(directory),
           includes: parsed.includes,
           credentialSetupFor: parsed.credentialSetupFor,
+          featureFlag: parsed.featureFlag,
         };
 
         if (seenIds.has(id)) {
@@ -1080,24 +1104,51 @@ function applyFeatureGatedSections(body: string): string {
   return result;
 }
 
+/**
+ * Returns true if `filePath` is a symlink whose resolved real path escapes
+ * `rootDir`. Symlinks that stay within `rootDir` are allowed; only those that
+ * point outside are considered unsafe.
+ */
+function isEscapingSymlink(filePath: string, rootDir: string): boolean {
+  try {
+    if (!lstatSync(filePath).isSymbolicLink()) return false;
+    const real = realpathSync(filePath);
+    const normalizedRoot = getCanonicalPath(rootDir);
+    return (
+      real !== normalizedRoot &&
+      !real.startsWith(normalizedRoot + "/") &&
+      !real.startsWith(normalizedRoot + "\\")
+    );
+  } catch {
+    // If we can't resolve (e.g. dangling symlink), treat as escaping.
+    return true;
+  }
+}
+
 /**
  * Scan for a `references/` subdirectory within a skill directory and append
  * the contents of any `.md` files found there to the skill body. Each
  * reference file is labeled with a `--- Reference: <Name> ---` header.
  * Files are appended in alphabetical order for deterministic output.
- * Non-`.md` files are ignored. Errors are logged as warnings and the
- * original body is returned unchanged.
+ * Non-`.md` files are ignored. Symlinks that resolve outside the skill
+ * directory are skipped. Errors are logged as warnings and the original body
+ * is returned unchanged.
  */
 function appendReferenceFiles(body: string, directoryPath: string): string {
   try {
     const refsDir = join(directoryPath, "references");
-    if (!existsSync(refsDir) || !statSync(refsDir).isDirectory()) {
+    if (
+      !existsSync(refsDir) ||
+      isEscapingSymlink(refsDir, directoryPath) ||
+      !statSync(refsDir).isDirectory()
+    ) {
       return body;
     }
 
     const entries = readdirSync(refsDir);
     const mdFiles = entries
       .filter((f) => f.toLowerCase().endsWith(".md"))
+      .filter((f) => !isEscapingSymlink(join(refsDir, f), directoryPath))
       .sort((a, b) => a.localeCompare(b));
 
     if (mdFiles.length === 0) return body;

package/src/context/token-estimator.ts

@@ -7,6 +7,7 @@ const TOOL_BLOCK_OVERHEAD_TOKENS = 16;
 const IMAGE_BLOCK_TOKENS = 1024;
 const IMAGE_BLOCK_OVERHEAD_TOKENS = 16;
 const FILE_BLOCK_OVERHEAD_TOKENS = 48;
+const WEB_SEARCH_RESULT_TOKENS = 800;
 const OTHER_BLOCK_TOKENS = 16;
 const SYSTEM_PROMPT_OVERHEAD_TOKENS = 8;
 const GEMINI_INLINE_FILE_MIME_TYPES = new Set(["application/pdf"]);
@@ -84,6 +85,16 @@ export function estimateContentBlockTokens(
       return TEXT_BLOCK_OVERHEAD_TOKENS + estimateTextTokens(block.thinking);
     case "redacted_thinking":
       return TEXT_BLOCK_OVERHEAD_TOKENS + estimateTextTokens(block.data);
+    case "server_tool_use":
+      return (
+        TOOL_BLOCK_OVERHEAD_TOKENS +
+        estimateTextTokens(block.name) +
+        estimateTextTokens(stableJson(block.input))
+      );
+    case "web_search_tool_result":
+      return (
+        WEB_SEARCH_RESULT_TOKENS + estimateTextTokens(stableJson(block.content))
+      );
     default:
       return OTHER_BLOCK_TOKENS;
   }