@vellumai/assistant 0.4.44 → 0.4.45

package/src/config/bundled-skills/guardian-verify-setup/SKILL.md

@@ -1,203 +0,0 @@
----
-name: guardian-verify-setup
-description: Set up channel verification for phone, Telegram, or Slack channels via outbound verification flow
-compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🔐","vellum":{"display-name":"Guardian Verify Setup","user-invocable":true}}
----
-
-You are helping your user set up channel verification for a messaging channel (phone, Telegram, or Slack). This links their identity as the trusted guardian for the chosen channel. Use the `assistant channel-verification-sessions` CLI for all verification operations.
-
-## Prerequisites
-
-- Run shell commands for this skill with `bash`.
-- Keep narration minimal: execute required calls first, then provide a concise status update. Do not narrate internal install/check/load chatter unless something fails.
-
-## Step 1: Confirm Channel
-
-Ask the user which channel they want to verify:
-
-- **phone** -- verify a phone number for voice calls
-- **telegram** -- verify a Telegram account
-- **slack** -- verify a Slack account
-
-If the user's intent already specifies a channel (e.g. "verify my phone number for voice calls", "verify me on Slack"), skip the prompt and proceed.
-
-## Step 2: Collect Destination
-
-Based on the chosen channel, ask for the required destination:
-
-- **Phone**: Ask for their phone number. Accept any common format (e.g. +15551234567, (555) 123-4567, 555-123-4567). The API normalizes it to E.164.
-- **Telegram**: Ask for their Telegram chat ID (numeric) or @handle. Explain:
-  - If they know their numeric chat ID, provide it directly. The bot will send the code to that chat.
-  - If they only know their @handle, the flow uses a bootstrap deep-link that they must click first.
-- **Slack**: Ask for their Slack user ID. Explain that this is their Slack member ID (e.g. U01ABCDEF), not their display name or email. They can find it in their Slack profile under "More" > "Copy member ID". The bot will send a verification code via Slack DM.
-
-## Step 3: Start Outbound Verification
-
-Execute the outbound start request:
-
-```bash
-assistant channel-verification-sessions create --channel <channel> --destination "<destination>" --json
-```
-
-Replace `<channel>` with `phone`, `telegram`, or `slack`, and `<destination>` with the phone number, Telegram destination, or Slack user ID.
-
-### On success (`success: true`)
-
-Report the exact next action based on the channel:
-
-- **Phone**: The response includes a `secret` field with the verification code. Tell the user the code BEFORE the call connects: "I'm calling [number] now. Your verification code is [secret]. When you answer the call, enter this code using your phone's keypad." The `create` command already initiates the voice call. Do NOT place a separate `call_start` call. **After delivering the code, immediately begin the voice auto-check polling loop** (see [Voice Auto-Check Polling](#voice-auto-check-polling) below).
-- **Telegram with chat ID** (no `telegramBootstrapUrl` in response): The response includes a `secret` field. Show it in the current chat: "Your verification code is **[secret]**. I've also sent it to your Telegram. Open the Telegram bot chat and reply with that 6-digit code to complete verification." If the response does not contain a `secret` field, treat this as a control-plane error: tell the user something went wrong and ask them to retry from Step 3 or resend (Step 4).
-- **Telegram with handle** (`telegramBootstrapUrl` present in response): "Tap this deep-link first: [telegramBootstrapUrl]. After Telegram binds your identity, I'll send your verification code."
-- **Slack**: The response includes a `secret` field with the verification code. Show it in the current chat: "Your verification code is **[secret]**. I've also sent it to you as a Slack DM. Open the DM from the Vellum bot in Slack and reply with that 6-digit code to complete verification." The DM channel ID is captured automatically during this process for future message delivery. If the response does not contain a `secret` field, treat this as a control-plane error: tell the user something went wrong and ask them to retry from Step 3 or resend (Step 4). **After delivering the code, immediately begin the Slack auto-check polling loop** (see [Slack Auto-Check Polling](#slack-auto-check-polling) below).
-
-After reporting the bootstrap URL for Telegram handle flows, wait for the user to confirm they clicked the link. Then check verification status (Step 6) to see if the bootstrap completed and a code was sent.
-
-### On error (`success: false`)
-
-Handle each error code:
-
-| Error code            | Action                                                                                                                                                                                                                                             |
-| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `missing_destination` | Ask the user to provide their phone number, Telegram destination, or Slack user ID.                                                                                                                                                                |
-| `invalid_destination` | Tell the user the format is invalid. For phone: suggest E.164 format (+15551234567). For Telegram: explain that group chat IDs (negative numbers) are not supported. For Slack: explain that the value must be a Slack member ID (e.g. U01ABCDEF). |
-| `already_bound`       | Tell the user a guardian is already bound for this channel. Ask if they want to replace it. If yes, re-run the create command with `--rebind` added.                                                                         |
-| `rate_limited`        | Tell the user they have sent too many verification attempts to this destination. Ask them to wait and try again later.                                                                                                                             |
-| `unsupported_channel` | Tell the user the channel is not supported. Only phone, telegram, and slack are valid.                                                                                                                                                             |
-| `no_bot_username`     | Telegram bot is not configured. Load and run the `telegram-setup` skill first.                                                                                                                                                                     |
-
-## Step 4: Handle Resend
-
-If the user says they did not receive the code or asks to resend:
-
-```bash
-assistant channel-verification-sessions resend --channel <channel> --json
-```
-
-On success, report the next action based on the channel:
-
-- **Phone**: The resend response includes a fresh `secret` field with a new verification code. Tell the user the new code BEFORE the call connects — just like the initial start flow: "I'm calling [number] again. Your new verification code is [secret]. When you answer the call, enter this code using your phone's keypad." The `resend` command already initiates the voice call. Do NOT place a separate `call_start` call. **After delivering the code, immediately begin the voice auto-check polling loop** (see [Voice Auto-Check Polling](#voice-auto-check-polling) below).
-- **Telegram**: The resend response includes a fresh `secret` field. Show the new code in the current chat: "Your new verification code is **[secret]**. I've also sent it to your Telegram. Open the Telegram bot chat and reply with that 6-digit code to complete verification." If the response does not contain a `secret` field, treat this as a control-plane error: tell the user something went wrong and ask them to retry from Step 3.
-- **Slack**: The resend response includes a fresh `secret` field. Show the new code in the current chat: "Your new verification code is **[secret]**. I've also sent it to you as a Slack DM. Reply to the DM with that 6-digit code to complete verification. (resent)" If the response does not contain a `secret` field, treat this as a control-plane error: tell the user something went wrong and ask them to retry from Step 3. **After delivering the code, immediately begin the Slack auto-check polling loop** (see [Slack Auto-Check Polling](#slack-auto-check-polling) below).
-
-### Resend errors
-
-Handle each error code from the resend endpoint:
-
-| Error code           | Action                                                                                                                                                                                            |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `rate_limited`       | Tell the user to wait before trying again (the cooldown is 15 seconds between resends).                                                                                                           |
-| `max_sends_exceeded` | Tell the user they have reached the maximum number of resends for this session (5 sends per session). Suggest canceling the current session (Step 5) and starting a new verification from Step 3. |
-| `no_destination`     | This should not normally occur during resend. Tell the user to cancel (Step 5) and restart verification from scratch at Step 3.                                                                   |
-| `pending_bootstrap`  | Remind the user to click the Telegram deep-link first before a code can be sent.                                                                                                                  |
-| `no_active_session`  | No session is active. Start a new one from Step 3.                                                                                                                                                |
-
-## Step 5: Handle Cancel
-
-If the user wants to cancel the verification:
-
-```bash
-assistant channel-verification-sessions cancel --channel <channel> --json
-```
-
-Confirm cancellation to the user. On `no_active_session`, tell them there is nothing to cancel.
-
-## Voice Auto-Check Polling
-
-For **voice** verification only: after telling the user their code and instructing keypad entry (in Step 3 or Step 4), do NOT wait for the user to report back. Instead, proactively poll for completion so the user gets instant confirmation without having to ask "did it work?"
-
-**Polling procedure:**
-
-1. Wait ~15 seconds after delivering the code (to give the user time to answer the call and enter the code).
-2. Check the binding status via Vellum CLI:
-
-```bash
-assistant channel-verification-sessions status --channel phone --json
-```
-
-3. If the response shows `bound: true`: immediately send a proactive success message in the current chat — "Voice verification complete! Your phone number is now the trusted guardian." Stop polling.
-4. If not yet bound: wait ~15 seconds and poll again.
-5. Continue polling for up to **2 minutes** (approximately 8 attempts).
-6. If the 2-minute timeout is reached without `bound: true`: proactively tell the user — "I've been checking for about 2 minutes but verification hasn't completed yet. The code may have expired or wasn't entered. Would you like me to resend a new code (Step 4) or start a new session (Step 3)?"
-
-**Rebind guard:**
-When in a **rebind flow** (i.e., the session creation request included `"rebind": true` because a binding already existed), do NOT treat `bound: true` alone as success. The pre-existing binding will show `bound: true` before the user has entered the new code, which would be a false positive. To guard against this:
-
-- Only report success when BOTH conditions are met: `bound: true` AND `verificationSessionId` is **absent** from the status response. The `verificationSessionId` field is present while a verification session is still active (pending). When the user enters the correct code, the session is consumed and `verificationSessionId` disappears from subsequent status responses. This proves the new outbound session was consumed and the binding is fresh.
-- If a poll shows `bound: true` but `verificationSessionId` is still present, the old binding is still active and the new code has not yet been consumed — continue polling.
-- Non-rebind flows (fresh verification with no prior binding) are unaffected — the first `bound: true` is trustworthy because there was no prior binding to confuse the result.
-
-**Important polling rules:**
-
-- This polling loop is voice-only. Do NOT poll for Telegram channels (Telegram has its own bot-driven flow). For Slack, use the separate Slack Auto-Check Polling loop below.
-- Do NOT require the user to ask "did it work?" — the whole point is proactive confirmation.
-- If the user sends a message while polling is in progress, handle their message normally. If their message is about verification status, the next poll iteration will provide the answer.
-
-## Slack Auto-Check Polling
-
-For **Slack** verification: after telling the user their code and instructing them to reply in the Slack DM (in Step 3 or Step 4), proactively poll for completion so the user gets instant confirmation.
-
-**Polling procedure:**
-
-1. Wait ~15 seconds after delivering the code (to give the user time to open the Slack DM and reply with the code).
-2. Check the binding status via Vellum CLI:
-
-```bash
-assistant channel-verification-sessions status --channel slack --json
-```
-
-3. If the response shows `bound: true`: immediately send a proactive success message in the current chat — "Slack verification complete! Your Slack account is now the trusted guardian. The DM channel has been captured for future message delivery." Stop polling.
-4. If not yet bound: wait ~15 seconds and poll again.
-5. Continue polling for up to **2 minutes** (approximately 8 attempts).
-6. If the 2-minute timeout is reached without `bound: true`: proactively tell the user — "I've been checking for about 2 minutes but verification hasn't completed yet. The code may have expired or wasn't entered. Would you like me to resend a new code (Step 4) or start a new session (Step 3)?"
-
-**Rebind guard:**
-When in a **rebind flow** (i.e., the session creation request included `"rebind": true` because a binding already existed), do NOT treat `bound: true` alone as success. The pre-existing binding will show `bound: true` before the user has entered the new code, which would be a false positive. To guard against this:
-
-- Only report success when BOTH conditions are met: `bound: true` AND `verificationSessionId` is **absent** from the status response. The `verificationSessionId` field is present while a verification session is still active (pending). When the user enters the correct code, the session is consumed and `verificationSessionId` disappears from subsequent status responses. This proves the new outbound session was consumed and the binding is fresh.
-- If a poll shows `bound: true` but `verificationSessionId` is still present, the old binding is still active and the new code has not yet been consumed — continue polling.
-- Non-rebind flows (fresh verification with no prior binding) are unaffected — the first `bound: true` is trustworthy because there was no prior binding to confuse the result.
-
-**Important polling rules:**
-
-- Do NOT require the user to ask "did it work?" — the whole point is proactive confirmation.
-- If the user sends a message while polling is in progress, handle their message normally.
-
-## Step 6: Check Verification Status
-
-After the user reports entering the code, verify the binding was created:
-
-```bash
-CHANNEL="<channel>"
-assistant channel-verification-sessions status --channel "$CHANNEL" --json
-```
-
-If the response shows the channel is bound, confirm success: "Verification complete! Your [channel] identity is now the trusted guardian."
-
-If not yet bound, offer to resend (Step 4) or generate a new session (Step 3).
-
-## Step 7: Revoke Guardian Binding
-
-If the user wants to remove themselves (or the current guardian) from a channel, use the revoke endpoint:
-
-```bash
-assistant channel-verification-sessions revoke --channel <channel> --json
-```
-
-Replace `<channel>` with the channel to unbind from (e.g. `phone`, `telegram`, `slack`).
-
-### On success (`success: true`)
-
-The response includes `bound: false` after the operation completes. Check the previous binding state to tailor the message:
-
-- If a binding was previously active (i.e., the user explicitly asked to revoke their guardian): "Guardian binding revoked for [channel]. The previous guardian no longer has access to this channel."
-- If no binding existed (`bound: false` and there was nothing to revoke): "There is no active guardian binding for [channel] — nothing to revoke. Any pending verification challenges have been cleared."
-
-## Important Notes
-
-- Verification codes expire after 10 minutes. If the session expires, start a new one.
-- The resend cooldown is 15 seconds between sends, with a maximum of 5 sends per session.
-- Per-destination rate limiting allows up to 10 sends within a 1-hour rolling window.
-- Channel verification is identity-bound: the code can only be consumed by the identity matching the destination provided at start time.
-- **Missing `secret` guardrail**: For voice, Telegram chat-ID, and Slack flows, the API response MUST include a `secret` field. If `secret` is unexpectedly absent from a start or resend response that otherwise indicates success, treat this as a control-plane error. Do NOT fabricate a code or tell the user to proceed without one. Instead, tell the user something went wrong and ask them to retry the start (Step 3) or resend (Step 4).
-- **Revoking a guardian**: To remove the current guardian from a channel, use the revoke API (Step 7). This revokes the binding AND revokes the guardian's contact record, so they lose access to the channel. A new guardian can then be verified for that channel.

package/src/config/bundled-skills/influencer/SKILL.md

@@ -1,144 +0,0 @@
----
-name: influencer
-description: Research influencers on Instagram, TikTok, and X/Twitter using the Chrome extension relay
-compatibility: "Designed for Vellum personal assistants"
-metadata: {"emoji":"🔍","vellum":{"display-name":"Influencer Research","user-invocable":true}}
----
-
-You can research and discover influencers across Instagram, TikTok, and X/Twitter using the bundled influencer scripts.
-
-## Script Setup
-
-**IMPORTANT: Always use `host_bash` (not `bash`) for all influencer commands.** The scripts need host access for the `assistant` CLI binary (used for the Chrome extension relay), which is not available inside the sandbox.
-
-The influencer scripts are bundled with this skill. Run them via `bun run {baseDir}/scripts/influencer.ts <subcommand> [options]`.
-
-## Prerequisites
-
-- The Chrome extension relay must be connected (user should have the Vellum extension loaded in Chrome)
-- The user must be **logged in** on each platform they want to search (Instagram, TikTok, X) in their Chrome browser
-- The extension MUST have the `debugger` permission (required to bypass CSP on Instagram and other Meta sites)
-- If the relay is not connected, tell the user: "Please open Chrome, click the Vellum extension icon, and click Connect — then I'll retry."
-
-## Platform-Specific Architecture
-
-### Instagram
-Instagram's search at `/explore/search/keyword/?q=...` shows a **grid of posts**, NOT profiles. The discovery flow is:
-1. Search by keyword → extract post links (`/p/` and `/reel/`)
-2. Visit each post → find the author username from page links
-3. Deduplicate usernames
-4. Visit each unique profile → scrape stats from `meta[name="description"]` (most reliable source, format: "49K Followers, 463 Following, 551 Posts - Display Name (@user)")
-5. Filter and rank by criteria
-
-**CSP Note:** Instagram blocks `eval()`, `new Function()`, inline scripts, and blob URLs via strict CSP. The extension uses `chrome.debugger` API (CDP Runtime.evaluate) as a fallback, which bypasses all CSP restrictions.
-
-### TikTok
-TikTok has a dedicated user search at `/search/user?q=...`. Each result card produces a predictable text pattern in `innerText`:
-```
-DisplayName
-username
-77.9K
-Followers
-·
-1.5M
-Likes
-Follow
-```
-We parse this pattern directly (DOM class selectors are obfuscated and unreliable on TikTok). After extracting usernames and follower counts, we visit each profile for bios.
-
-### X/Twitter
-X has a people search at `/search?q=...&f=user` with `[data-testid="UserCell"]` components containing username, display name, bio, and verified status.
-
-## Typical Flow
-
-When the user asks to find or research influencers:
-
-1. **Understand the criteria.** Ask about:
-   - **Niche/topic** — what kind of influencers? (fitness, beauty, tech, food, etc.)
-   - **Platforms** — Instagram, TikTok, X/Twitter, or all three?
-   - **Follower range** — micro (1K-10K), mid-tier (10K-100K), macro (100K-1M), mega (1M+)?
-   - **Verified only?** — do they need the blue checkmark?
-   - Don't over-ask. If the user says "find me fitness influencers on Instagram", that's enough to start.
-
-2. **Search** — run `bun run {baseDir}/scripts/influencer.ts search "<query>" --platforms <platforms> [options] --json`
-
-3. **Present results** — show a clean summary of each influencer found:
-   - Username and display name
-   - Platform
-   - Follower count
-   - Bio snippet
-   - Verified status
-   - Content themes detected
-   - Profile URL
-
-4. **Deep dive** (if needed) — run `bun run {baseDir}/scripts/influencer.ts profile <username> --platform <platform> --json` to get detailed data on a specific influencer.
-
-5. **Compare** (if needed) — run `bun run {baseDir}/scripts/influencer.ts compare instagram:user1 twitter:user2 tiktok:user3 --json` to compare influencers side by side.
-
-## Follower Range Shortcuts
-
-When the user describes influencer tiers, map to these ranges:
-- **Nano**: `--min-followers 1000 --max-followers 10000`
-- **Micro**: `--min-followers 10000 --max-followers 100000`
-- **Mid-tier**: `--min-followers 100000 --max-followers 500000`
-- **Macro**: `--min-followers 500000 --max-followers 1000000`
-- **Mega**: `--min-followers 1000000`
-
-Human-friendly numbers are supported: `10k`, `100k`, `1m`, etc.
-
-## Command Reference
-
-```
-bun run {baseDir}/scripts/influencer.ts search "<query>" [options] --json
-  --platforms <list>       Comma-separated: instagram,tiktok,twitter (default: all three)
-  --min-followers <n>      Minimum follower count (e.g. 10k, 100000)
-  --max-followers <n>      Maximum follower count (e.g. 1m, 500k)
-  --limit <n>              Max results per platform (default: 10)
-  --verified               Only return verified accounts
-
-bun run {baseDir}/scripts/influencer.ts profile <username> --platform <platform> --json
-  --platform <platform>    instagram, tiktok, or twitter (default: instagram)
-
-bun run {baseDir}/scripts/influencer.ts compare <platform:username ...> --json
-  Arguments are space-separated platform:username pairs
-  e.g. instagram:nike twitter:nike tiktok:nike
-```
-
-## Important Behavior
-
-- **Use `--json` flag** on all commands for reliable parsing.
-- **Always use `host_bash`** for these commands, never `bash`.
-- **Be patient with results.** The tool navigates actual browser tabs, so each platform search takes 10-30 seconds. Warn the user it may take a moment.
-- **Rate limiting.** Don't hammer the platforms. The tool has built-in delays, but avoid running many searches in rapid succession.
-- **Present results nicely.** Use tables or formatted lists. Group by platform. Highlight standout profiles.
-- **Offer next steps.** After showing results, ask if they want to:
-  - Get more details on specific profiles
-  - Compare top picks side by side
-  - Search with different criteria
-  - Export the results
-- **Handle errors gracefully.** If a platform fails (e.g. not logged in), show results from the platforms that worked and mention which one failed.
-- **Do NOT use the browser skill.** All influencer research goes through the bundled scripts, not browser automation. Do NOT use `assistant influencer` directly — use the bundled scripts.
-
-## Example Interactions
-
-**User**: "Find me fitness influencers on Instagram and TikTok"
-
-1. `bun run {baseDir}/scripts/influencer.ts search "fitness coach workout" --platforms instagram,tiktok --limit 10 --json`
-2. Present results grouped by platform with follower counts and bios
-3. "I found 8 fitness influencers on Instagram and 6 on TikTok. Want me to dig deeper into any of these profiles?"
-
-**User**: "I need micro-influencers in the beauty niche, verified only"
-
-1. `bun run {baseDir}/scripts/influencer.ts search "beauty makeup skincare" --platforms instagram,tiktok,twitter --min-followers 10k --max-followers 100k --verified --limit 10 --json`
-2. Present filtered results
-3. Offer to compare top picks
-
-**User**: "Compare @username1 on Instagram with @username2 on TikTok"
-
-1. `bun run {baseDir}/scripts/influencer.ts compare instagram:username1 tiktok:username2 --json`
-2. Present side-by-side comparison with followers, engagement, bio, themes
-
-**User**: "Tell me more about @specificuser on Instagram"
-
-1. `bun run {baseDir}/scripts/influencer.ts profile specificuser --platform instagram --json`
-2. Show full profile details including bio, follower/following counts, verified status, content themes