@vellumai/assistant 0.4.44 → 0.4.45

package/src/config/bundled-skills/computer-use/TOOLS.json

@@ -3,80 +3,17 @@
   "tools": [
     {
       "name": "computer_use_click",
-      "description": "Click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
+      "description": "Click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback. Supports single click, double-click, and right-click via the click_type parameter.",
       "category": "computer-use",
       "risk": "low",
       "input_schema": {
         "type": "object",
         "properties": {
-          "element_id": {
-            "type": "integer",
-            "description": "The [ID] number of the element from the accessibility tree (preferred)"
-          },
-          "x": {
-            "type": "integer",
-            "description": "X coordinate on screen (fallback when no element_id)"
-          },
-          "y": {
-            "type": "integer",
-            "description": "Y coordinate on screen (fallback when no element_id)"
-          },
-          "reasoning": {
-            "type": "string",
-            "description": "Explanation of what you see and why you are clicking here"
-          },
-          "reason": {
-            "type": "string",
-            "description": "Brief non-technical explanation of why this tool is being called"
-          }
-        },
-        "required": ["reasoning"]
-      },
-      "executor": "tools/computer-use-click.ts",
-      "execution_target": "host"
-    },
-    {
-      "name": "computer_use_double_click",
-      "description": "Double-click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
-      "category": "computer-use",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
-          "element_id": {
-            "type": "integer",
-            "description": "The [ID] number of the element from the accessibility tree (preferred)"
-          },
-          "x": {
-            "type": "integer",
-            "description": "X coordinate on screen (fallback when no element_id)"
-          },
-          "y": {
-            "type": "integer",
-            "description": "Y coordinate on screen (fallback when no element_id)"
-          },
-          "reasoning": {
+          "click_type": {
             "type": "string",
-            "description": "Explanation of what you see and why you are double-clicking here"
+            "enum": ["single", "double", "right"],
+            "description": "Type of click to perform (default: \"single\")"
           },
-          "reason": {
-            "type": "string",
-            "description": "Brief non-technical explanation of why this tool is being called"
-          }
-        },
-        "required": ["reasoning"]
-      },
-      "executor": "tools/computer-use-double-click.ts",
-      "execution_target": "host"
-    },
-    {
-      "name": "computer_use_right_click",
-      "description": "Right-click on a UI element by its [ID] from the accessibility tree, or at raw screen coordinates as fallback.",
-      "category": "computer-use",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
           "element_id": {
             "type": "integer",
             "description": "The [ID] number of the element from the accessibility tree (preferred)"
@@ -91,7 +28,7 @@
           },
           "reasoning": {
             "type": "string",
-            "description": "Explanation of what you see and why you are right-clicking here"
+            "description": "Explanation of what you see and why you are clicking here"
           },
           "reason": {
             "type": "string",
@@ -100,7 +37,7 @@
         },
         "required": ["reasoning"]
       },
-      "executor": "tools/computer-use-right-click.ts",
+      "executor": "tools/computer-use-click.ts",
       "execution_target": "host"
     },
     {

package/src/config/bundled-skills/computer-use/tools/computer-use-click.ts

@@ -4,9 +4,18 @@ import type {
   ToolExecutionResult,
 } from "../../../../tools/types.js";
 
+const CLICK_TYPE_TO_PROXY_TOOL: Record<string, string> = {
+  single: "computer_use_click",
+  double: "computer_use_double_click",
+  right: "computer_use_right_click",
+};
+
 export async function run(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  return forwardComputerUseProxyTool("computer_use_click", input, context);
+  const clickType = (input.click_type as string | undefined) ?? "single";
+  const proxyToolName =
+    CLICK_TYPE_TO_PROXY_TOOL[clickType] ?? "computer_use_click";
+  return forwardComputerUseProxyTool(proxyToolName, input, context);
 }

package/src/config/bundled-skills/contacts/SKILL.md

@@ -2,7 +2,12 @@
 name: contacts
 description: Manage contacts, communication channels, access control, and invite links
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"👥","vellum":{"display-name":"Contacts","user-invocable":true}}
+metadata:
+  emoji: "👥"
+  vellum:
+    display-name: "Contacts"
+    user-invocable: true
+    feature-flag: "contacts"
 ---
 
 Manage the user's contacts, relationship graph, access control (trusted contacts), and invite links. This skill covers contact CRUD with multi-channel tracking, controlling who can message the assistant through external channels (Telegram, phone), and creating/managing invite links that grant access.
@@ -414,6 +419,10 @@ assistant contacts invites revoke <invite_id> --json
 
 Replace `<invite_id>` with the invite's `id` from the list response. The same revoke command is used for both Telegram and voice invites.
 
+## Google Contacts
+
+Use `google_contacts` to list or search the user's Google Contacts by name or email. Returns name, email, phone, and organization. Requires the `contacts.readonly` OAuth scope — users may need to re-authorize Gmail to grant this additional permission.
+
 ## Contact Fields
 
 - **displayName** -- the contact's name (required)

package/src/config/bundled-skills/contacts/TOOLS.json

@@ -121,6 +121,41 @@
       },
       "executor": "tools/contact-merge.ts",
       "execution_target": "host"
+    },
+    {
+      "name": "google_contacts",
+      "description": "List or search Google Contacts. Requires contacts.readonly scope (re-authorization may be needed).",
+      "category": "contacts",
+      "risk": "low",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "action": {
+            "type": "string",
+            "enum": ["list", "search"],
+            "description": "Contacts action"
+          },
+          "query": {
+            "type": "string",
+            "description": "Search query (for search action)"
+          },
+          "page_size": {
+            "type": "number",
+            "description": "Number of contacts to return (default 50, for list)"
+          },
+          "page_token": {
+            "type": "string",
+            "description": "Pagination token (for list)"
+          },
+          "reason": {
+            "type": "string",
+            "description": "Brief non-technical explanation of why this tool is being called"
+          }
+        },
+        "required": ["action"]
+      },
+      "executor": "tools/google-contacts.ts",
+      "execution_target": "host"
     }
   ]
 }

package/src/config/bundled-skills/{messaging → contacts}/tools/google-contacts.ts

@@ -9,7 +9,14 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok } from "./shared.js";
+
+function ok(text: string): ToolExecutionResult {
+  return { content: text, isError: false };
+}
+
+function err(text: string): ToolExecutionResult {
+  return { content: text, isError: true };
+}
 
 function formatContact(person: Person): Record<string, unknown> {
   const name = person.names?.[0];
@@ -38,7 +45,7 @@ export async function run(
 
   try {
     const provider = getMessagingProvider("gmail");
-    return withValidToken(provider.credentialService, async (token) => {
+    return await withValidToken(provider.credentialService, async (token) => {
       switch (action) {
         case "list": {
           const pageSize = (input.page_size as number) ?? 50;

package/src/config/bundled-skills/document/SKILL.md

@@ -2,7 +2,10 @@
 name: document
 description: Write, draft, or compose long-form text (blog posts, articles, essays, reports, guides). Use when the user says write, draft, compose, or create a blog/article/essay.
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"📄","vellum":{"display-name":"Document"}}
+metadata:
+  emoji: "📄"
+  vellum:
+    display-name: "Document"
 ---
 
 Create and edit long-form documents using the built-in rich text editor. Documents open in workspace mode with chat docked to the side.

package/src/config/bundled-skills/doordash/SKILL.md

@@ -2,7 +2,14 @@
 name: doordash
 description: Order food, groceries, and convenience items from DoorDash using the built-in CLI integration
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🍕","vellum":{"display-name":"DoorDash","user-invocable":true,"cli":{"command":"doordash","entry":"doordash-entry.ts"}}}
+metadata:
+  emoji: "🍕"
+  vellum:
+    display-name: "DoorDash"
+    user-invocable: true
+    cli:
+      command: "doordash"
+      entry: "doordash-entry.ts"
 ---
 
 You can order food from DoorDash for the user using the `doordash` CLI.

package/src/config/bundled-skills/doordash/lib/shared/platform.ts

@@ -44,7 +44,10 @@ export function buildDaemonUrl(port?: number): string {
  */
 export function readHttpToken(): string | null {
   try {
-    const token = readFileSync(join(getRootDir(), "http-token"), "utf-8").trim();
+    const token = readFileSync(
+      join(getRootDir(), "http-token"),
+      "utf-8",
+    ).trim();
     return token || null;
   } catch {
     return null;

package/src/config/bundled-skills/followups/SKILL.md

@@ -2,7 +2,10 @@
 name: followups
 description: Track sent messages awaiting responses across communication channels
 compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"📨","vellum":{"display-name":"Followups"}}
+metadata:
+  emoji: "📨"
+  vellum:
+    display-name: "Followups"
 ---
 
 Track messages sent on external channels (email, Slack, WhatsApp, etc.) that are awaiting a response.

package/src/config/bundled-skills/gmail/SKILL.md

@@ -0,0 +1,180 @@
+---
+name: gmail
+description: Archive, label, draft, unsubscribe, and manage Gmail with smart inbox tools
+compatibility: "Designed for Vellum personal assistants"
+metadata:
+  emoji: "📨"
+  vellum:
+    display-name: "Gmail"
+    user-invocable: true
+    feature-flag: "gmail"
+---
+
+This skill provides Gmail-specific tools. For cross-platform messaging (send, read, search, reply), use the **messaging** skill. Gmail tools depend on the messaging skill's provider infrastructure — load messaging first if Gmail is not yet connected.
+
+## Email Routing Priority
+
+When the user mentions "email" — sending, reading, checking, decluttering, drafting, or anything else — **always default to the user's own email (Gmail)** unless they explicitly ask about the assistant's own email address (e.g., "set up your email", "send from your address", "check your inbox"). The vast majority of email requests are about the user's Gmail, not the assistant's AgentMail address.
+
+Do not offer AgentMail as an option or mention it unless the user specifically asks. If Gmail is not connected, guide them through Gmail setup — do not suggest AgentMail as an alternative.
+
+## Communication Style
+
+- **Be action-oriented.** When the user asks to do something ("declutter", "check my email"), start doing it immediately. Don't ask for permission to read their inbox — that's obviously what they want.
+- **Keep it human.** Never mention OAuth, tokens, APIs, sandboxes, credential proxies, or other technical internals. If something isn't working, say "Gmail needs to be reconnected" — not "the OAuth2 access token for integration:gmail has expired."
+- **Show progress.** When running a tool that scans many emails, tell the user what you're doing: "Scanning your inbox for clutter..." Don't go silent.
+- **Be brief and warm.** One or two sentences per update is plenty. Don't over-explain what you're about to do — just do it and narrate lightly.
+
+## Connection Setup
+
+### Gmail
+
+1. **Try connecting directly first.** Call `credential_store` with `action: "oauth2_connect"` and `service: "gmail"`. The tool auto-fills Google's OAuth endpoints and looks up any previously stored client credentials — so this single call may be all that's needed.
+2. **If it fails because no client_id is found:** The user needs to create Google Cloud OAuth credentials first. Load the **google-oauth-setup** skill (which depends on **public-ingress** for the redirect URI):
+   - Call `skill_load` with `skill: "google-oauth-setup"` to load the dependency skill.
+   - Tell the user Gmail isn't connected yet and briefly explain what the setup involves, then use `ui_show` with `surface_type: "confirmation"` to ask for permission to start:
+     - **message:** "Ready to set up Gmail?"
+     - **detail:** "I'll open a browser where you sign in to Google, then automate everything else — creating a project, enabling APIs, and connecting your account. Takes 2-3 minutes and you can watch in the browser preview panel."
+     - **confirmLabel:** "Get Started"
+     - **cancelLabel:** "Not Now"
+   - If the user confirms, briefly acknowledge (e.g., "Setting up Gmail now...") and proceed with the setup guide. If they decline, acknowledge and let them know they can set it up later.
+3. **If the user provides a client_id directly in chat:** Call `credential_store` with `action: "oauth2_connect"`, `service: "gmail"`, and `client_id: "<their value>"`. Include `client_secret` too if they provide one. Everything else is auto-filled.
+
+## Error Recovery
+
+When a Gmail tool fails with a token or authorization error:
+
+1. **Try to reconnect silently.** Call `credential_store` with `action: "oauth2_connect"` and `service: "gmail"`. This often resolves expired tokens automatically.
+2. **If reconnection fails, go straight to setup.** Don't present options, ask which route the user prefers, or explain what went wrong technically. Just tell the user briefly (e.g., "Gmail needs to be reconnected — let me set that up") and immediately follow the connection setup flow for Gmail (e.g., install and load **google-oauth-setup**). The user came to you to get something done, not to troubleshoot OAuth — make it seamless.
+3. **Never try alternative approaches.** Don't use bash, curl, browser automation, or any workaround. If the Gmail tools can't do it, the reconnection flow is the answer.
+4. **Never expose error details.** The user doesn't need to see error messages about tokens, OAuth, or API failures. Translate errors into plain language.
+
+## Capabilities
+
+### Gmail-specific
+
+- **Archive**: Remove message from inbox
+- **Label**: Add/remove labels
+- **Trash**: Move to trash
+- **Unsubscribe**: Unsubscribe via List-Unsubscribe header
+- **Draft (native)**: Create a draft in Gmail's Drafts folder
+
+### Attachments
+
+- **Attachments**: `gmail_attachments` — list or download Gmail attachments. Use `action: "list"` to enumerate attachments on a message (returns filename, MIME type, size, and attachment ID), then `action: "download"` with `attachment_id` and `filename` to save a specific attachment to disk.
+- **Send with Attachments**: `messaging_send` with `attachment_paths` — create a Gmail draft with file attachments (reads files from disk, builds multipart MIME)
+
+Workflow: use `gmail_attachments` with `action: "list"` to discover attachments, then `gmail_attachments` with `action: "download"` to save them locally.
+
+### Forward & Thread Operations
+
+- **Forward**: `gmail_forward` — forward a message to another recipient, preserving all attachments. Optionally prepend your own text
+- **Follow-up Tracking**: `gmail_follow_up` — track/untrack messages for follow-up using a dedicated "Follow-up" label, or list all tracked messages
+
+### Inbox Automation
+
+- **Filters**: `gmail_filters` — list, create, or delete Gmail filters. Filter criteria include from, to, subject, query, has_attachment. Actions include adding/removing labels and forwarding
+- **Vacation Responder**: `gmail_vacation` — get, enable, or disable the vacation auto-responder with custom message, date range, and domain/contact restrictions
+
+## Drafting vs Sending (Gmail)
+
+Gmail uses a **draft-first workflow**. All compose and reply tools create Gmail drafts automatically:
+
+- `messaging_send` (Gmail) → creates a draft in Gmail Drafts
+- `messaging_send` with `thread_id` (Gmail) → creates a threaded draft with reply-all recipients
+- `gmail_draft` → creates a draft
+- `messaging_send` with `attachment_paths` → creates a draft with attachments
+- `gmail_forward` → creates a forward draft
+
+**To actually send**: Use `gmail_send_draft` with the draft ID after the user has reviewed it. Only call `gmail_send_draft` when the user explicitly says "send it" or equivalent.
+
+**Reply-all**: `messaging_send` with `thread_id` for Gmail automatically builds the reply-all recipient list from the thread. You do not need to manually look up recipients.
+
+## Email Threading (Gmail)
+
+When replying to or continuing an email thread:
+
+- Use `messaging_send` with the thread's `thread_id` — it automatically handles threading, reply-all recipients, and subject lines.
+- The `in_reply_to` field on `gmail_draft` requires the **RFC 822 Message-ID header** (looks like `<CABx...@mail.gmail.com>`), NOT the Gmail message ID (which looks like `18e4a5b2c3d4e5f6`). Get it by reading the thread messages and extracting the `Message-ID` header.
+
+## Gmail Search Syntax
+
+When searching Gmail, the query uses Gmail's search operators:
+
+| Operator         | Example                  | What it finds                       |
+| ---------------- | ------------------------ | ----------------------------------- |
+| `from:`          | `from:alice@example.com` | Messages from a specific sender     |
+| `to:`            | `to:bob@example.com`     | Messages sent to a recipient        |
+| `subject:`       | `subject:meeting`        | Messages with a word in the subject |
+| `newer_than:`    | `newer_than:7d`          | Messages from the last 7 days       |
+| `older_than:`    | `older_than:30d`         | Messages older than 30 days         |
+| `is:unread`      | `is:unread`              | Unread messages                     |
+| `has:attachment` | `has:attachment`         | Messages with attachments           |
+| `label:`         | `label:work`             | Messages with a specific label      |
+
+## Email Decluttering
+
+When a user asks to declutter, clean up, or organize their email — start scanning immediately. Don't ask what kind of cleanup they want or request permission to read their inbox. Go straight to scanning — but once results are ready, always show them via `ui_show` and let the user choose actions before archiving or unsubscribing.
+
+**CRITICAL**: Never call `gmail_archive`, `gmail_unsubscribe`, or `messaging_archive_by_sender` unless the user has clicked an action button on the table for that specific batch. Each batch of results requires its own explicit user confirmation via the table UI. If the user says "keep going" or "keep decluttering," that means scan and present a new table — NOT auto-archive. Previous batch approvals do not carry forward, but **deselections DO carry forward**: when the user deselects senders from a cleanup table, the system records those deselections as user preferences. Before building the next cleanup table, check `<dynamic-user-profile>` for previously deselected senders and exclude them from future cleanup tables — the user already indicated they want to keep those.
+
+### Workflow
+
+1. **Scan**: Call `gmail_sender_digest`. Default query targets promotions from the last 90 days.
+2. **Present**: Show results as a `ui_show` table with `selectionMode: "multiple"`:
+   - **Columns (exactly 3)**: Sender, Emails Found, Unsub?
+     - **Unsub? cell values**: Use rich cell format: `{ "text": "Yes", "icon": "checkmark.circle.fill", "iconColor": "success" }` when `has_unsubscribe` is true, `{ "text": "No", "icon": "minus.circle", "iconColor": "muted" }` when false.
+   - **Pre-select all rows** (`selected: true`) — users deselect what they want to keep
+   - **Caption**: Include two parts separated by a newline: (1) data scope, e.g. "Newsletters, notifications, and outreach from last 90 days. Deselect anything you want to keep." (adjusted to match the query used), and (2) the Unsub? column legend: "Unsub? — \"Yes\" means these emails contain an unsubscribe link, so I can opt you out automatically. \"No\" means no unsubscribe link was found — these will be archived but you may continue receiving them."
+   - **Action buttons (exactly 2)**: "Archive & Unsubscribe" (primary), "Archive Only" (secondary). **NEVER offer Delete, Trash, or any destructive action.**
+3. **Wait for user action**: Stop and wait. Do NOT proceed to archiving or unsubscribing until the user clicks one of the action buttons on the table. When the user clicks an action button:
+   - **Dismiss the table immediately** with `ui_dismiss` — it collapses to a completion chip
+   - **Show a `task_progress` card** with steps for each phase (e.g., "Archiving 89 senders (2,400 emails)", "Unsubscribing from 72 senders"). Update each step from `in_progress` → `completed` as each phase finishes.
+   - When all senders are processed, set the progress card's `status: "completed"`.
+4. **Act on selection** — batch, don't loop:
+   - **Archive all at once**: Call `gmail_archive` **once** with `scan_id` + **all** selected senders' `id` values in the `sender_ids` array. The tool resolves message IDs server-side and batches the Gmail API calls internally — never loop sender-by-sender.
+   - **Unsubscribe in bulk**: If the action is "Archive & Unsubscribe", call `gmail_unsubscribe` for each sender that has `has_unsubscribe: true` — but emit **all** unsubscribe tool calls in a **single assistant response** (parallel tool use) rather than one-at-a-time across separate turns.
+5. **Accurate summary**: The scan counts are exact — the `message_count` shown in the table matches the number of messages archived. Format: "Cleaned up [total_archived] emails from [sender_count] senders. Unsubscribed from [unsub_count]."
+6. **Ongoing protection offer**: After reporting results, offer auto-archive filters:
+   - "Want me to set up auto-archive filters so future emails from these senders skip your inbox?"
+   - If yes, call `gmail_filters` with `action: "create"` for each sender with `from` set to the sender's email and `remove_label_ids: ["INBOX"]`.
+   - Then offer a recurring declutter schedule: "Want me to scan for new clutter monthly?" If yes, use `schedule_create` to set up a monthly declutter check.
+
+### Edge Cases
+
+- **Zero results**: Tell the user "No newsletter emails found" and suggest broadening the query (e.g. removing the category filter or extending the date range)
+- **Unsubscribe failures**: Report per-sender success/failure; the existing `gmail_unsubscribe` tool handles edge cases
+- **Truncation handling**: The scan covers up to 5,000 messages by default (cap 10,000). If `truncated` is true, the top senders are still captured — don't offer to scan more. Tell the user: "Scanned [N] messages — here are your top senders."
+- **Time budget exceeded**: If the scan returns `time_budget_exceeded: true`, present whatever results were collected. Do not retry or continue — the partial results are useful as-is.
+
+## Scan ID
+
+Scan tools (`gmail_sender_digest`, `gmail_outreach_scan`) return a `scan_id` that references message IDs stored server-side. This keeps thousands of message IDs out of the conversation context. `gmail_outreach_scan` is a pure data aggregation tool — it finds senders without List-Unsubscribe headers (potential cold outreach) and does not use LLM classification.
+
+- Pass `scan_id` + `sender_ids` to `gmail_archive` instead of `message_ids`
+- Scan results expire after **30 minutes** — if archiving fails with an expiration error, re-run the scan
+- Raw `message_ids` still work as a fallback for non-scan workflows
+
+## Batch Operations
+
+- `gmail_archive` supports `scan_id` + `sender_ids` (preferred for declutter workflows) or raw `message_ids`.
+- `gmail_label` supports `message_id` or `message_ids` only — it does not accept `scan_id`.
+- First scan to get a `scan_id`, then use `gmail_archive` to batch-archive by sender.
+- Always confirm with the user before batch operations on large numbers of messages.
+
+## Date Verification
+
+Before composing any email that references a date or time:
+
+1. Check the `<temporal_context>` block in the current turn for today's date and upcoming dates
+2. Verify that "tomorrow" means the day after today's date, "next week" means the upcoming Monday–Friday, etc.
+3. If the email references a date from another message, cross-check it against the temporal context to ensure it's in the future
+
+## Confidence Scores
+
+Medium and high risk tools require a confidence score between 0 and 1:
+
+- **0.9-1.0**: User explicitly requested this exact action
+- **0.7-0.8**: Action is strongly implied by context
+- **0.5-0.6**: Reasonable inference but some ambiguity
+- **Below 0.5**: Ask the user to confirm before proceeding