@vellumai/assistant 0.4.45 → 0.4.48

package/src/config/bundled-skills/messaging/tools/messaging-sender-digest.ts

@@ -2,7 +2,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, resolveProvider, withProviderToken } from "./shared.js";
+import { err, getProviderConnection, ok, resolveProvider } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -23,47 +23,46 @@ export async function run(
       );
     }
 
-    return withProviderToken(provider, async (token) => {
-      const result = await provider.senderDigest!(token, query, {
-        maxMessages,
-        maxSenders,
-        pageToken,
-      });
-
-      if (result.senders.length === 0) {
-        return ok(
-          JSON.stringify({
-            senders: [],
-            total_scanned: result.totalScanned,
-            query_used: result.queryUsed,
-            ...(result.truncated ? { truncated: true } : {}),
-            message:
-              "No emails found matching the query. Try broadening the search (e.g. remove category filter or extend date range).",
-          }),
-        );
-      }
-
-      // Map to snake_case output format for LLM consumption
-      const senders = result.senders.map((s) => ({
-        id: s.id,
-        display_name: s.displayName,
-        email: s.email,
-        message_count: s.messageCount,
-        has_unsubscribe: s.hasUnsubscribe,
-        newest_message_id: s.newestMessageId,
-        search_query: s.searchQuery,
-      }));
+    const conn = getProviderConnection(provider);
+    const result = await provider.senderDigest!(conn, query, {
+      maxMessages,
+      maxSenders,
+      pageToken,
+    });
 
+    if (result.senders.length === 0) {
       return ok(
         JSON.stringify({
-          senders,
+          senders: [],
           total_scanned: result.totalScanned,
           query_used: result.queryUsed,
           ...(result.truncated ? { truncated: true } : {}),
-          note: `message_count reflects emails found per sender within the ${result.totalScanned} messages scanned. Use messaging_archive_by_sender with the sender's search_query to archive their messages.`,
+          message:
+            "No emails found matching the query. Try broadening the search (e.g. remove category filter or extend date range).",
         }),
       );
-    });
+    }
+
+    // Map to snake_case output format for LLM consumption
+    const senders = result.senders.map((s) => ({
+      id: s.id,
+      display_name: s.displayName,
+      email: s.email,
+      message_count: s.messageCount,
+      has_unsubscribe: s.hasUnsubscribe,
+      newest_message_id: s.newestMessageId,
+      search_query: s.searchQuery,
+    }));
+
+    return ok(
+      JSON.stringify({
+        senders,
+        total_scanned: result.totalScanned,
+        query_used: result.queryUsed,
+        ...(result.truncated ? { truncated: true } : {}),
+        note: `message_count reflects emails found per sender within the ${result.totalScanned} messages scanned. Use messaging_archive_by_sender with the sender's search_query to archive their messages.`,
+      }),
+    );
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/messaging/tools/shared.ts

@@ -8,7 +8,8 @@ import {
   getMessagingProvider,
   isPlatformEnabled,
 } from "../../../../messaging/registry.js";
-import { withValidToken } from "../../../../security/token-manager.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
+import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
 import type { ToolExecutionResult } from "../../../../tools/types.js";
 
 export function ok(content: string): ToolExecutionResult {
@@ -126,16 +127,15 @@ export function resolveProvider(platformInput?: string): MessagingProvider {
 }
 
 /**
- * Execute a callback with a valid OAuth token for the given provider.
- * Providers that manage their own auth (e.g. Telegram with a bot token)
- * expose isConnected() and don't need an OAuth access_token lookup.
+ * Resolve an OAuthConnection (or empty string for non-OAuth providers)
+ * for the given messaging provider.
+ *
+ * Non-OAuth providers (e.g. Telegram) use isConnected() and don't need
+ * tokens — they receive an empty string which the string overload handles.
  */
-export async function withProviderToken<T>(
+export function getProviderConnection(
   provider: MessagingProvider,
-  fn: (token: string) => Promise<T>,
-): Promise<T> {
-  if (provider.isConnected?.()) {
-    return fn("");
-  }
-  return withValidToken(provider.credentialService, fn);
+): OAuthConnection | string {
+  if (provider.isConnected?.()) return "";
+  return resolveOAuthConnection(provider.credentialService);
 }

package/src/config/bundled-skills/notifications/SKILL.md

@@ -38,4 +38,4 @@ Thread grouping is handled by the LLM-powered decision engine, not by any parame
 ## Important
 
 - Do **NOT** use AppleScript `display notification` or other OS-level notification commands for assistant-managed alerts. Always use `send_notification`.
-- For sending rich content (digests, summaries, reports) to a specific chat, email, or SMS destination, use the messaging skill's `messaging_send` instead. The decision engine rewrites `send_notification` content into short alerts, which strips rich formatting.
+- For sending rich content (digests, summaries, reports) to a specific chat or email destination, use the messaging skill's `messaging_send` instead. The decision engine rewrites `send_notification` content into short alerts, which strips rich formatting.

package/src/config/bundled-skills/phone-calls/SKILL.md

@@ -147,10 +147,10 @@ During an active call, the user can interact with the AI voice agent via the HTT
 
 #### Answering questions
 
-When the AI voice agent encounters something it needs user input for, it dispatches an **ASK_GUARDIAN** request to all configured guardian channels (mac desktop, Telegram, SMS). The call status changes to `waiting_on_user`.
+When the AI voice agent encounters something it needs user input for, it dispatches an **ASK_GUARDIAN** request to all configured guardian channels (mac desktop, Telegram). The call status changes to `waiting_on_user`.
 
 1. The question is delivered simultaneously to every configured channel. The first channel to respond wins (first-response-wins semantics) -- once one channel provides an answer, the other channels receive a "already answered" notice.
-2. On the mac desktop, a guardian request thread is created with the question. On Telegram/SMS, the question text and a request code are delivered via the gateway.
+2. On the mac desktop, a guardian request thread is created with the question. On Telegram, the question text and a request code are delivered via the gateway.
 3. If DTMF callee verification is enabled, the callee must enter a verification code before the call proceeds (see the **DTMF Callee Verification** section above).
 4. The guardian provides an answer through whichever channel they prefer. The answer is routed to the AI voice agent, which continues the conversation naturally.
 
@@ -160,16 +160,16 @@ When the AI voice agent encounters something it needs user input for, it dispatc
 
 When a consultation times out, the voice agent apologizes to the caller and moves on -- but the interaction is not lost. If the guardian responds after the timeout:
 
-1. **Late reply detection**: The system recognizes the late answer on whichever channel it arrives (desktop, Telegram, or SMS) and presents a follow-up prompt asking the guardian what they would like to do.
+1. **Late reply detection**: The system recognizes the late answer on whichever channel it arrives (desktop or Telegram) and presents a follow-up prompt asking the guardian what they would like to do.
 2. **Follow-up options**: The guardian can choose to:
    - **Call back** the original caller with the answer
    - **Send a text message** to the caller with the answer
    - **Decline** if the follow-up is no longer needed
-3. **Automatic execution**: If the guardian chooses to call back or send a message, the system resolves the original caller's phone number from the call record and executes the action automatically -- placing an outbound callback call or sending an SMS via the gateway.
+3. **Automatic execution**: If the guardian chooses to call back or send a message, the system resolves the original caller's phone number from the call record and executes the action automatically -- placing an outbound callback call or sending a message via the gateway.
 
 All user-facing messages in this flow (timeout acknowledgments, follow-up prompts, completion confirmations) are generated by the assistant to maintain a natural, conversational tone. No fixed/canned responses are used.
 
-The follow-up flow works across all guardian channels. The guardian can receive the timeout notice on Telegram, reply late via SMS, and choose to call back -- the system handles cross-channel routing transparently.
+The follow-up flow works across all guardian channels. The guardian can receive the timeout notice on Telegram and choose to call back -- the system handles cross-channel routing transparently.
 
 #### Steering with instructions
 

package/src/config/bundled-skills/schedule/SKILL.md

@@ -147,7 +147,7 @@ Before confirming a schedule to the user, you MUST verify that you have the capa
 When `schedule_create` returns, it includes an integration status summary. Cross-reference the scheduled task's requirements against the available integrations:
 
 - If the task involves **email** (reading, sending, OTP verification): an email integration must be connected (check the "email" category)
-- If the task involves **sending SMS or making calls**: SMS/Twilio must be connected
+- If the task involves **making calls**: Twilio must be connected
 - If the task involves **web browsing or form-filling**: browser automation must be available (check client type)
 - If the task involves a **multi-step workflow** (e.g., book appointment → read confirmation email), trace the full dependency chain
 

package/src/config/bundled-skills/skill-management/SKILL.md

@@ -2,8 +2,8 @@
 name: skill-management
 description: Create and delete custom managed skills
 metadata:
+  emoji: "\U0001F9E9"
   vellum:
-    emoji: "\U0001F9E9"
     display-name: "Skill Management"
     user-invocable: true
 ---

package/src/config/bundled-skills/slack/tools/shared.ts

@@ -2,8 +2,8 @@
  * Shared utilities for slack skill tools.
  */
 
-import { getMessagingProvider } from "../../../../messaging/registry.js";
-import { withValidToken } from "../../../../security/token-manager.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
+import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
 import type { ToolExecutionResult } from "../../../../tools/types.js";
 
 export function ok(content: string): ToolExecutionResult {
@@ -14,12 +14,6 @@ export function err(message: string): ToolExecutionResult {
   return { content: message, isError: true };
 }
 
-/**
- * Execute a callback with a valid Slack OAuth token.
- */
-export async function withSlackToken<T>(
-  fn: (token: string) => Promise<T>,
-): Promise<T> {
-  const provider = getMessagingProvider("slack");
-  return withValidToken(provider.credentialService, fn);
+export function getSlackConnection(): OAuthConnection {
+  return resolveOAuthConnection("integration:slack");
 }

package/src/config/bundled-skills/slack/tools/slack-add-reaction.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -18,10 +18,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await addReaction(token, channel, timestamp, emoji);
-      return ok(`Added :${emoji}: reaction.`);
-    });
+    const connection = getSlackConnection();
+    await addReaction(connection, channel, timestamp, emoji);
+    return ok(`Added :${emoji}: reaction.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-channel-details.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -16,23 +16,22 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      const resp = await slack.conversationInfo(token, channelId);
-      const conv = resp.channel;
+    const connection = getSlackConnection();
+    const resp = await slack.conversationInfo(connection, channelId);
+    const conv = resp.channel;
 
-      const result = {
-        channelId: conv.id,
-        name: conv.name ?? conv.id,
-        topic: conv.topic?.value || null,
-        purpose: conv.purpose?.value || null,
-        isPrivate: conv.is_private ?? conv.is_group ?? false,
-        isArchived: conv.is_archived ?? false,
-        memberCount: conv.num_members ?? null,
-        latestActivityTs: conv.latest?.ts ?? null,
-      };
+    const result = {
+      channelId: conv.id,
+      name: conv.name ?? conv.id,
+      topic: conv.topic?.value || null,
+      purpose: conv.purpose?.value || null,
+      isPrivate: conv.is_private ?? conv.is_group ?? false,
+      isArchived: conv.is_archived ?? false,
+      memberCount: conv.num_members ?? null,
+      latestActivityTs: conv.latest?.ts ?? null,
+    };
 
-      return ok(JSON.stringify(result, null, 2));
-    });
+    return ok(JSON.stringify(result, null, 2));
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-delete-message.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -17,10 +17,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await deleteMessage(token, channel, timestamp);
-      return ok(`Message deleted.`);
-    });
+    const connection = getSlackConnection();
+    await deleteMessage(connection, channel, timestamp);
+    return ok(`Message deleted.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-edit-message.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -18,10 +18,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await updateMessage(token, channel, timestamp, text);
-      return ok(`Message updated.`);
-    });
+    const connection = getSlackConnection();
+    await updateMessage(connection, channel, timestamp, text);
+    return ok(`Message updated.`);
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-leave-channel.ts

@@ -3,7 +3,7 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 export async function run(
   input: Record<string, unknown>,
@@ -16,10 +16,9 @@ export async function run(
   }
 
   try {
-    return await withSlackToken(async (token) => {
-      await leaveConversation(token, channel);
-      return ok("Left channel.");
-    });
+    const connection = getSlackConnection();
+    await leaveConversation(connection, channel);
+    return ok("Left channel.");
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts

@@ -1,11 +1,12 @@
 import { getConfig } from "../../../../config/loader.js";
 import * as slack from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
+import type { OAuthConnection } from "../../../../oauth/connection.js";
 import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
-import { err, ok, withSlackToken } from "./shared.js";
+import { err, getSlackConnection, ok } from "./shared.js";
 
 interface ThreadSummary {
   threadTs: string;
@@ -26,13 +27,16 @@ interface ChannelDigest {
 
 const userNameCache = new Map<string, string>();
 
-async function resolveUserName(token: string, userId: string): Promise<string> {
+async function resolveUserName(
+  connection: OAuthConnection,
+  userId: string,
+): Promise<string> {
   if (!userId) return "unknown";
   const cached = userNameCache.get(userId);
   if (cached) return cached;
 
   try {
-    const resp = await slack.userInfo(token, userId);
+    const resp = await slack.userInfo(connection, userId);
     const name =
       resp.user.profile?.display_name ||
       resp.user.profile?.real_name ||
@@ -46,7 +50,7 @@ async function resolveUserName(token: string, userId: string): Promise<string> {
 }
 
 async function scanChannel(
-  token: string,
+  connection: OAuthConnection,
   conv: SlackConversation,
   oldestTs: string,
   includeThreads: boolean,
@@ -57,7 +61,7 @@ async function scanChannel(
 
   try {
     const history = await slack.conversationHistory(
-      token,
+      connection,
       channelId,
       100,
       undefined,
@@ -71,7 +75,7 @@ async function scanChannel(
     }
 
     const keyParticipants = await Promise.all(
-      [...participantIds].map((uid) => resolveUserName(token, uid)),
+      [...participantIds].map((uid) => resolveUserName(connection, uid)),
     );
 
     const threadMessages = messages
@@ -86,7 +90,7 @@ async function scanChannel(
         if (includeThreads) {
           try {
             const replies = await slack.conversationReplies(
-              token,
+              connection,
               channelId,
               msg.ts,
               10,
@@ -97,11 +101,11 @@ async function scanChannel(
             }
             participants = await Promise.all(
               [...threadParticipantIds].map((uid) =>
-                resolveUserName(token, uid),
+                resolveUserName(connection, uid),
               ),
             );
           } catch {
-            participants = [await resolveUserName(token, msg.user ?? "")];
+            participants = [await resolveUserName(connection, msg.user ?? "")];
           }
         }
 
@@ -260,15 +264,34 @@ export async function run(
   const format = (input.format as string) ?? "text";
 
   try {
-    return await withSlackToken(async (token) => {
-      const oldestTs = String((Date.now() - hoursBack * 60 * 60 * 1000) / 1000);
+    const connection = getSlackConnection();
+    const oldestTs = String((Date.now() - hoursBack * 60 * 60 * 1000) / 1000);
 
-      let channelsToScan: SlackConversation[];
-      let failedLookups = 0;
+    let channelsToScan: SlackConversation[];
+    let failedLookups = 0;
 
-      if (channelIds?.length) {
+    if (channelIds?.length) {
+      const results = await Promise.allSettled(
+        channelIds.map((id) => slack.conversationInfo(connection, id)),
+      );
+      channelsToScan = results
+        .filter(
+          (
+            r,
+          ): r is PromiseFulfilledResult<
+            Awaited<ReturnType<typeof slack.conversationInfo>>
+          > => r.status === "fulfilled",
+        )
+        .map((r) => r.value.channel);
+      failedLookups = results.filter((r) => r.status === "rejected").length;
+    } else {
+      const config = getConfig();
+      const preferredIds = config.skills?.entries?.slack?.config
+        ?.preferredChannels as string[] | undefined;
+
+      if (preferredIds?.length) {
         const results = await Promise.allSettled(
-          channelIds.map((id) => slack.conversationInfo(token, id)),
+          preferredIds.map((id) => slack.conversationInfo(connection, id)),
         );
         channelsToScan = results
           .filter(
@@ -281,89 +304,69 @@ export async function run(
           .map((r) => r.value.channel);
         failedLookups = results.filter((r) => r.status === "rejected").length;
       } else {
-        const config = getConfig();
-        const preferredIds = config.skills?.entries?.slack?.config
-          ?.preferredChannels as string[] | undefined;
-
-        if (preferredIds?.length) {
-          const results = await Promise.allSettled(
-            preferredIds.map((id) => slack.conversationInfo(token, id)),
+        const allChannels: SlackConversation[] = [];
+        let cursor: string | undefined;
+        do {
+          const resp = await slack.listConversations(
+            connection,
+            "public_channel,private_channel",
+            true,
+            200,
+            cursor,
           );
-          channelsToScan = results
-            .filter(
-              (
-                r,
-              ): r is PromiseFulfilledResult<
-                Awaited<ReturnType<typeof slack.conversationInfo>>
-              > => r.status === "fulfilled",
-            )
-            .map((r) => r.value.channel);
-          failedLookups = results.filter((r) => r.status === "rejected").length;
-        } else {
-          const allChannels: SlackConversation[] = [];
-          let cursor: string | undefined;
-          do {
-            const resp = await slack.listConversations(
-              token,
-              "public_channel,private_channel",
-              true,
-              200,
-              cursor,
-            );
-            allChannels.push(...resp.channels);
-            cursor = resp.response_metadata?.next_cursor || undefined;
-          } while (cursor);
-
-          channelsToScan = allChannels
-            .filter((c) => c.is_member)
-            .sort((a, b) => {
-              const aTs = a.latest?.ts ? parseFloat(a.latest.ts) : 0;
-              const bTs = b.latest?.ts ? parseFloat(b.latest.ts) : 0;
-              return bTs - aTs;
-            })
-            .slice(0, maxChannels);
-        }
+          allChannels.push(...resp.channels);
+          cursor = resp.response_metadata?.next_cursor || undefined;
+        } while (cursor);
+
+        channelsToScan = allChannels
+          .filter((c) => c.is_member)
+          .sort((a, b) => {
+            const aTs = a.latest?.ts ? parseFloat(a.latest.ts) : 0;
+            const bTs = b.latest?.ts ? parseFloat(b.latest.ts) : 0;
+            return bTs - aTs;
+          })
+          .slice(0, maxChannels);
       }
+    }
 
-      const scanResults = await Promise.allSettled(
-        channelsToScan.map((conv) =>
-          scanChannel(token, conv, oldestTs, includeThreads),
-        ),
-      );
-
-      const digests: ChannelDigest[] = scanResults
-        .filter(
-          (r): r is PromiseFulfilledResult<ChannelDigest> =>
-            r.status === "fulfilled",
-        )
-        .map((r) => r.value)
-        .filter((d) => d.messageCount > 0 || d.error);
-
-      const skippedCount = scanResults.filter(
-        (r) => r.status === "rejected",
-      ).length;
-
-      if (format === "blocks") {
-        const blocks = buildBlockKitOutput(
-          digests,
-          hoursBack,
-          channelsToScan.length,
-          skippedCount,
-        );
-        return ok(JSON.stringify({ blocks }, null, 2));
-      }
+    const scanResults = await Promise.allSettled(
+      channelsToScan.map((conv) =>
+        scanChannel(connection, conv, oldestTs, includeThreads),
+      ),
+    );
 
-      const result = {
-        scannedChannels: digests.length,
-        totalChannelsAttempted: channelsToScan.length,
-        skippedDueToErrors: skippedCount,
-        failedLookups,
+    const digests: ChannelDigest[] = scanResults
+      .filter(
+        (r): r is PromiseFulfilledResult<ChannelDigest> =>
+          r.status === "fulfilled",
+      )
+      .map((r) => r.value)
+      .filter((d) => d.messageCount > 0 || d.error);
+
+    const skippedCount = scanResults.filter(
+      (r) => r.status === "rejected",
+    ).length;
+
+    if (format === "blocks") {
+      const blocks = buildBlockKitOutput(
+        digests,
         hoursBack,
-        channels: digests,
-      };
+        channelsToScan.length,
+        skippedCount,
+      );
+      return ok(JSON.stringify({ blocks }, null, 2));
+    }
 
-      return ok(JSON.stringify(result, null, 2));
-    });
+    const result = {
+      scannedChannels: digests.length,
+      totalChannelsAttempted: channelsToScan.length,
+      skippedDueToErrors: skippedCount,
+      failedLookups,
+      hoursBack,
+      channels: digests,
+    };
+
+    return ok(JSON.stringify(result, null, 2));
   } catch (e) {
     return err(e instanceof Error ? e.message : String(e));
   }

package/src/config/loader.ts

@@ -333,6 +333,12 @@ export function loadConfig(): AssistantConfig {
     }
 
     // Environment variables override everything
+    if (process.env.VELLUM_CONFIG_SANDBOX_ENABLED === "false") {
+      config.sandbox.enabled = false;
+    } else if (process.env.VELLUM_CONFIG_SANDBOX_ENABLED === "true") {
+      config.sandbox.enabled = true;
+    }
+
     if (process.env.ANTHROPIC_API_KEY) {
       config.apiKeys.anthropic = process.env.ANTHROPIC_API_KEY;
     }