@vellumai/assistant 0.4.48 → 0.4.50

package/src/cli/commands/skills.ts

@@ -1,348 +1,22 @@
-import { execSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { gunzipSync } from "node:zlib";
-
 import type { Command } from "commander";
 
+import type { CatalogSkill } from "../../skills/catalog-install.js";
 import {
-  getWorkspaceConfigPath,
-  getWorkspaceSkillsDir,
-  readPlatformToken,
-} from "../../util/platform.js";
-import { log } from "../logger.js";
-
-// ---------------------------------------------------------------------------
-// Path helpers
-// ---------------------------------------------------------------------------
-
-function getSkillsIndexPath(): string {
-  return join(getWorkspaceSkillsDir(), "SKILLS.md");
-}
-
-/**
- * Resolve the repo-level skills/ directory when running in dev mode.
- * Returns the path if VELLUM_DEV is set and the directory exists, or undefined.
- */
-function getRepoSkillsDir(): string | undefined {
-  if (!process.env.VELLUM_DEV) return undefined;
-
-  // assistant/src/cli/commands/skills.ts -> ../../../../skills/
-  const candidate = join(import.meta.dir, "..", "..", "..", "..", "skills");
-  if (existsSync(join(candidate, "catalog.json"))) {
-    return candidate;
-  }
-  return undefined;
-}
-
-/**
- * Read skills from the repo-local catalog.json.
- */
-function readLocalCatalog(repoSkillsDir: string): CatalogSkill[] {
-  try {
-    const raw = readFileSync(join(repoSkillsDir, "catalog.json"), "utf-8");
-    const manifest = JSON.parse(raw) as CatalogManifest;
-    if (!Array.isArray(manifest.skills)) return [];
-    return manifest.skills;
-  } catch {
-    return [];
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Platform API client
-// ---------------------------------------------------------------------------
-
-function getConfigPlatformUrl(): string | undefined {
-  try {
-    const configPath = getWorkspaceConfigPath();
-    if (!existsSync(configPath)) return undefined;
-    const raw = JSON.parse(readFileSync(configPath, "utf-8")) as Record<
-      string,
-      unknown
-    >;
-    const platform = raw.platform as Record<string, unknown> | undefined;
-    const baseUrl = platform?.baseUrl;
-    if (typeof baseUrl === "string" && baseUrl.trim()) return baseUrl.trim();
-  } catch {
-    // ignore
-  }
-  return undefined;
-}
-
-function getPlatformUrl(): string {
-  return (
-    process.env.VELLUM_ASSISTANT_PLATFORM_URL ??
-    getConfigPlatformUrl() ??
-    "https://platform.vellum.ai"
-  );
-}
-
-function buildHeaders(): Record<string, string> {
-  const headers: Record<string, string> = {};
-  const token = readPlatformToken();
-  if (token) {
-    headers["X-Session-Token"] = token;
-  }
-  return headers;
-}
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-interface CatalogSkill {
-  id: string;
-  name: string;
-  description: string;
-  emoji?: string;
-  includes?: string[];
-  version?: string;
-}
-
-interface CatalogManifest {
-  version: number;
-  skills: CatalogSkill[];
-}
-
-// ---------------------------------------------------------------------------
-// Catalog operations
-// ---------------------------------------------------------------------------
-
-async function fetchCatalog(): Promise<CatalogSkill[]> {
-  const url = `${getPlatformUrl()}/v1/skills/`;
-  const response = await fetch(url, {
-    headers: buildHeaders(),
-    signal: AbortSignal.timeout(10000),
-  });
-
-  if (!response.ok) {
-    throw new Error(
-      `Platform API error ${response.status}: ${response.statusText}`,
-    );
-  }
-
-  const manifest = (await response.json()) as CatalogManifest;
-  if (!Array.isArray(manifest.skills)) {
-    throw new Error("Platform catalog has invalid skills array");
-  }
-  return manifest.skills;
-}
-
-/**
- * Extract all files from a tar archive (uncompressed) into a directory.
- * Returns true if a SKILL.md was found in the archive.
- */
-function extractTarToDir(tarBuffer: Buffer, destDir: string): boolean {
-  let foundSkillMd = false;
-  let offset = 0;
-  while (offset + 512 <= tarBuffer.length) {
-    const header = tarBuffer.subarray(offset, offset + 512);
-
-    // End-of-archive (two consecutive zero blocks)
-    if (header.every((b) => b === 0)) break;
-
-    // Filename (bytes 0-99, null-terminated)
-    const nameEnd = header.indexOf(0, 0);
-    const name = header
-      .subarray(0, Math.min(nameEnd >= 0 ? nameEnd : 100, 100))
-      .toString("utf-8");
-
-    // File type (byte 156): '5' = directory, '0' or '\0' = regular file
-    const typeFlag = header[156];
-
-    // File size (bytes 124-135, octal)
-    const sizeStr = header.subarray(124, 136).toString("utf-8").trim();
-    const size = parseInt(sizeStr, 8) || 0;
-
-    offset += 512; // past header
-
-    // Skip directories and empty names
-    if (name && typeFlag !== 53 /* '5' */) {
-      // Prevent path traversal
-      const normalizedName = name.replace(/^\.\//, "");
-      if (!normalizedName.startsWith("..") && !normalizedName.includes("/..")) {
-        const destPath = join(destDir, normalizedName);
-        mkdirSync(dirname(destPath), { recursive: true });
-        writeFileSync(destPath, tarBuffer.subarray(offset, offset + size));
-
-        if (
-          normalizedName === "SKILL.md" ||
-          normalizedName.endsWith("/SKILL.md")
-        ) {
-          foundSkillMd = true;
-        }
-      }
-    }
-
-    // Skip to next header (data padded to 512 bytes)
-    offset += Math.ceil(size / 512) * 512;
-  }
-  return foundSkillMd;
-}
-
-async function fetchAndExtractSkill(
-  skillId: string,
-  destDir: string,
-): Promise<void> {
-  const url = `${getPlatformUrl()}/v1/skills/${encodeURIComponent(skillId)}/`;
-  const response = await fetch(url, {
-    headers: buildHeaders(),
-    signal: AbortSignal.timeout(15000),
-  });
-
-  if (!response.ok) {
-    throw new Error(
-      `Failed to fetch skill "${skillId}": HTTP ${response.status}`,
-    );
-  }
-
-  const gzipBuffer = Buffer.from(await response.arrayBuffer());
-  const tarBuffer = gunzipSync(gzipBuffer);
-  const foundSkillMd = extractTarToDir(tarBuffer, destDir);
-
-  if (!foundSkillMd) {
-    throw new Error(`SKILL.md not found in archive for "${skillId}"`);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Managed skill installation
-// ---------------------------------------------------------------------------
-
-function atomicWriteFile(filePath: string, content: string): void {
-  const dir = dirname(filePath);
-  mkdirSync(dir, { recursive: true });
-  const tmpPath = join(dir, `.tmp-${randomUUID()}`);
-  writeFileSync(tmpPath, content, "utf-8");
-  renameSync(tmpPath, filePath);
-}
-
-function upsertSkillsIndex(id: string): void {
-  const indexPath = getSkillsIndexPath();
-  let lines: string[] = [];
-  if (existsSync(indexPath)) {
-    lines = readFileSync(indexPath, "utf-8").split("\n");
-  }
-
-  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`^[-*]\\s+(?:\`)?${escaped}(?:\`)?\\s*$`);
-  if (lines.some((line) => pattern.test(line))) return;
-
-  const nonEmpty = lines.filter((l) => l.trim());
-  nonEmpty.push(`- ${id}`);
-  const content = nonEmpty.join("\n");
-  atomicWriteFile(indexPath, content.endsWith("\n") ? content : content + "\n");
-}
-
-function removeSkillsIndexEntry(id: string): void {
-  const indexPath = getSkillsIndexPath();
-  if (!existsSync(indexPath)) return;
-
-  const lines = readFileSync(indexPath, "utf-8").split("\n");
-  const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`^[-*]\\s+(?:\`)?${escaped}(?:\`)?\\s*$`);
-  const filtered = lines.filter((line) => !pattern.test(line));
-
-  // If nothing changed, skip the write
-  if (filtered.length === lines.length) return;
-
-  const content = filtered.join("\n");
-  atomicWriteFile(indexPath, content.endsWith("\n") ? content : content + "\n");
-}
-
-function uninstallSkillLocally(skillId: string): void {
-  const skillDir = join(getWorkspaceSkillsDir(), skillId);
-
-  if (!existsSync(skillDir)) {
-    throw new Error(`Skill "${skillId}" is not installed.`);
-  }
-
-  rmSync(skillDir, { recursive: true, force: true });
-  removeSkillsIndexEntry(skillId);
-}
-
-async function installSkillLocally(
-  skillId: string,
-  catalogEntry: CatalogSkill,
-  overwrite: boolean,
-): Promise<void> {
-  const skillDir = join(getWorkspaceSkillsDir(), skillId);
-  const skillFilePath = join(skillDir, "SKILL.md");
-
-  if (existsSync(skillFilePath) && !overwrite) {
-    throw new Error(
-      `Skill "${skillId}" is already installed. Use --overwrite to replace it.`,
-    );
-  }
-
-  mkdirSync(skillDir, { recursive: true });
-
-  // In dev mode, install from the local repo skills directory if available
-  const repoSkillsDir = getRepoSkillsDir();
-  const repoSkillSource = repoSkillsDir
-    ? join(repoSkillsDir, skillId)
-    : undefined;
-
-  if (repoSkillSource && existsSync(join(repoSkillSource, "SKILL.md"))) {
-    cpSync(repoSkillSource, skillDir, { recursive: true });
-  } else {
-    await fetchAndExtractSkill(skillId, skillDir);
-  }
-
-  // Write version metadata
-  if (catalogEntry.version) {
-    const meta = {
-      version: catalogEntry.version,
-      installedAt: new Date().toISOString(),
-    };
-    atomicWriteFile(
-      join(skillDir, "version.json"),
-      JSON.stringify(meta, null, 2) + "\n",
-    );
-  }
-
-  // Install npm dependencies if the skill has a package.json
-  if (existsSync(join(skillDir, "package.json"))) {
-    const bunPath = `${homedir()}/.bun/bin`;
-    execSync("bun install", {
-      cwd: skillDir,
-      stdio: "inherit",
-      env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
-    });
-  }
-
-  // Register in SKILLS.md only after all steps succeed
-  upsertSkillsIndex(skillId);
-}
-
-// ---------------------------------------------------------------------------
-// Exported types and functions for testing
-// ---------------------------------------------------------------------------
-
-export type { CatalogManifest, CatalogSkill };
-
-export {
-  extractTarToDir,
-  fetchAndExtractSkill,
   fetchCatalog,
-  getSkillsIndexPath,
+  getRepoSkillsDir,
   installSkillLocally,
   readLocalCatalog,
-  removeSkillsIndexEntry,
   uninstallSkillLocally,
-  upsertSkillsIndex,
-};
+} from "../../skills/catalog-install.js";
+import type { AuditResponse } from "../../skills/skillssh-registry.js";
+import {
+  fetchSkillAudits,
+  formatAuditBadges,
+  installExternalSkill,
+  resolveSkillSource,
+  searchSkillsRegistry,
+} from "../../skills/skillssh-registry.js";
+import { log } from "../logger.js";
 
 // ---------------------------------------------------------------------------
 // Command registration
@@ -362,9 +36,13 @@ capabilities with pre-built workflows and tools.
 Examples:
   $ assistant skills list
   $ assistant skills list --json
+  $ assistant skills search react
+  $ assistant skills search react --limit 5 --json
   $ assistant skills install weather
   $ assistant skills install weather --overwrite
-  $ assistant skills uninstall weather`,
+  $ assistant skills uninstall weather
+  $ assistant skills add vercel-labs/skills@find-skills
+  $ assistant skills add vercel-labs/skills/find-skills --overwrite`,
   );
 
   skills
@@ -413,6 +91,102 @@ Examples:
       }
     });
 
+  skills
+    .command("search <query>")
+    .description("Search the skills.sh community registry")
+    .option("--limit <n>", "Maximum number of results", "10")
+    .option("--json", "Machine-readable JSON output")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  query    Free-text search term matched against skill names, descriptions,
+           and tags in the skills.sh registry.
+
+Searches the skills.sh community registry and displays matching skills
+with install counts and security audit badges (ATH, Socket, Snyk).
+Audit fetch failures are non-fatal — results are still shown without
+security data.
+
+Examples:
+  $ assistant skills search react
+  $ assistant skills search "file management" --limit 3
+  $ assistant skills search deploy --json`,
+    )
+    .action(async (query: string, opts: { limit: string; json?: boolean }) => {
+      const json = opts.json ?? false;
+      const limit = parseInt(opts.limit, 10) || 10;
+
+      try {
+        const results = await searchSkillsRegistry(query, limit);
+
+        if (results.length === 0) {
+          if (json) {
+            console.log(JSON.stringify({ ok: true, results: [], audits: {} }));
+          } else {
+            log.info(`No skills found for "${query}".`);
+          }
+          return;
+        }
+
+        // Group skill slugs by source for batch audit lookups
+        const sourceToSlugs = new Map<string, string[]>();
+        for (const r of results) {
+          const slugs = sourceToSlugs.get(r.source) ?? [];
+          slugs.push(r.skillId);
+          sourceToSlugs.set(r.source, slugs);
+        }
+
+        // Fetch audits for each unique source, keyed by source/skillId
+        // to avoid collisions when different sources share the same slug.
+        const allAudits: AuditResponse = {};
+        for (const [source, slugs] of sourceToSlugs) {
+          try {
+            const audits = await fetchSkillAudits(source, slugs);
+            for (const [skillId, auditData] of Object.entries(audits)) {
+              allAudits[`${source}/${skillId}`] = auditData;
+            }
+          } catch {
+            // Audit fetch failures are non-fatal; display results without audits
+          }
+        }
+
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: true,
+              results,
+              audits: allAudits,
+            }),
+          );
+          return;
+        }
+
+        log.info(`Search results for "${query}" (${results.length}):\n`);
+        for (const r of results) {
+          log.info(`  ${r.name}`);
+          log.info(`    ID: ${r.skillId}`);
+          log.info(`    Source: ${r.source}`);
+          log.info(`    Installs: ${r.installs}`);
+          const auditData = allAudits[`${r.source}/${r.skillId}`];
+          if (auditData) {
+            log.info(`    ${formatAuditBadges(auditData)}`);
+          } else {
+            log.info("    Security: no audit data");
+          }
+          log.info("");
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (json) {
+          console.log(JSON.stringify({ ok: false, error: msg }));
+        } else {
+          log.error(`Error: ${msg}`);
+        }
+        process.exitCode = 1;
+      }
+    });
+
   skills
     .command("install <skill-id>")
     .description("Install a skill from the catalog")
@@ -491,4 +265,68 @@ Examples:
         process.exitCode = 1;
       }
     });
+
+  skills
+    .command("add <source>")
+    .description(
+      "Install a community skill from the skills.sh registry (GitHub)",
+    )
+    .option("--overwrite", "Replace an already installed skill")
+    .option("--json", "Machine-readable JSON output")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  source   Skill source in one of these formats:
+             owner/repo@skill-name
+             owner/repo/skill-name
+             https://github.com/owner/repo/tree/<branch>/skills/skill-name
+
+Notes:
+  Fetches the skill's SKILL.md and supporting files from the specified GitHub
+  repository and installs them into the workspace skills directory. A
+  version.json file is written with origin metadata for provenance tracking.
+
+Examples:
+  $ assistant skills add vercel-labs/skills@find-skills
+  $ assistant skills add vercel-labs/skills/find-skills
+  $ assistant skills add vercel-labs/skills@find-skills --overwrite`,
+    )
+    .action(
+      async (source: string, opts: { overwrite?: boolean; json?: boolean }) => {
+        const json = opts.json ?? false;
+
+        try {
+          const { owner, repo, skillSlug, ref } = resolveSkillSource(source);
+
+          await installExternalSkill(
+            owner,
+            repo,
+            skillSlug,
+            opts.overwrite ?? false,
+            ref,
+          );
+
+          if (json) {
+            console.log(
+              JSON.stringify({
+                ok: true,
+                skillSlug,
+                source: `${owner}/${repo}`,
+              }),
+            );
+          } else {
+            log.info(`Installed skill "${skillSlug}" from ${owner}/${repo}.`);
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (json) {
+            console.log(JSON.stringify({ ok: false, error: msg }));
+          } else {
+            log.error(`Error: ${msg}`);
+          }
+          process.exitCode = 1;
+        }
+      },
+    );
 }

package/src/cli/http-client.ts

@@ -64,23 +64,3 @@ export async function httpSend(
   }
   return fetch(url, { ...init, headers });
 }
-
-// ---------------------------------------------------------------------------
-// Health check
-// ---------------------------------------------------------------------------
-
-/**
- * Perform an HTTP health check against the daemon's `/healthz` endpoint.
- * Returns true if the daemon responds with HTTP 200, false otherwise.
- */
-export async function httpHealthCheck(timeoutMs = 2000): Promise<boolean> {
-  try {
-    const url = `${getHttpBaseUrl()}/healthz`;
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}

package/src/cli/main-screen.tsx

@@ -1,8 +1,8 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
+import { getGatewayInternalBaseUrl } from "../config/env.js";
 import { getWorkspaceDir } from "../util/platform.js";
-import { getHttpBaseUrl } from "./http-client.js";
 
 const LEFT_PANEL_WIDTH = 36;
 const RIGHT_LINE_COUNT = 11;
@@ -14,7 +14,7 @@ export interface MainScreenLayout {
 }
 
 export function renderMainScreen(): MainScreenLayout {
-  const httpUrl = getHttpBaseUrl();
+  const httpUrl = getGatewayInternalBaseUrl();
   const workspace = getWorkspaceDir();
   const assistantId = workspace.split("/").pop() ?? "vellum";
 

package/src/cli/program.ts

@@ -1,8 +1,7 @@
-import { createRequire } from "node:module";
-
 import { Command } from "commander";
 
 import { registerHooksCommand } from "../hooks/cli.js";
+import { APP_VERSION } from "../version.js";
 import { registerAuditCommand } from "./commands/audit.js";
 import { registerAutonomyCommand } from "./commands/autonomy.js";
 import { registerBrowserRelayCommand } from "./commands/browser-relay.js";
@@ -12,31 +11,28 @@ import { registerConfigCommand } from "./commands/config.js";
 import { registerContactsCommand } from "./commands/contacts.js";
 import { registerCredentialsCommand } from "./commands/credentials.js";
 import { registerDefaultAction } from "./commands/default-action.js";
-import { registerDevCommand } from "./commands/dev.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
 import { registerEmailCommand } from "./commands/email.js";
 import { registerKeysCommand } from "./commands/keys.js";
-import { registerMapCommand } from "./commands/map.js";
 import { registerMcpCommand } from "./commands/mcp.js";
 import { registerMemoryCommand } from "./commands/memory.js";
 import { registerNotificationsCommand } from "./commands/notifications.js";
-import { registerOAuthCommand } from "./commands/oauth.js";
+import { registerOAuthCommand } from "./commands/oauth/index.js";
 import { registerPlatformCommand } from "./commands/platform.js";
 import { registerSequenceCommand } from "./commands/sequence.js";
 import { registerSessionsCommand } from "./commands/sessions.js";
 import { registerSkillsCommand } from "./commands/skills.js";
 import { registerTrustCommand } from "./commands/trust.js";
 
-const require = createRequire(import.meta.url);
-const { version } = require("../../package.json") as { version: string };
-
 export function buildCliProgram(): Command {
   const program = new Command();
 
-  program.name("assistant").description("Local AI assistant").version(version);
+  program
+    .name("assistant")
+    .description("Local AI assistant")
+    .version(APP_VERSION);
 
   registerDefaultAction(program);
-  registerDevCommand(program);
   registerSessionsCommand(program);
   registerConfigCommand(program);
   registerKeysCommand(program);
@@ -58,7 +54,6 @@ export function buildCliProgram(): Command {
   registerSkillsCommand(program);
   registerBrowserRelayCommand(program);
 
-  registerMapCommand(program);
   registerSequenceCommand(program);
 
   return program;

package/src/cli/reference.ts

@@ -10,7 +10,6 @@ Options:
   -h, --help                               display help for command
 
 Commands:
-  dev [options]                            Run the assistant in dev mode
   sessions                                 Manage sessions
   config                                   Manage configuration
   keys                                     Manage API keys in secure storage
@@ -28,9 +27,8 @@ Commands:
   completions <shell>                      Generate shell completion script (e.g. assistant completions bash >> ~/.bashrc)
   notifications [options]                  Send and inspect notifications through the unified notification router
   platform [options]                       Manage platform integration for containerized deployments
-  oauth [options]                          Manage OAuth tokens for connected integrations
+  oauth [options]                          Manage OAuth providers, apps, connections, and tokens
   skills                                   Browse and install skills from the Vellum catalog
   browser                                  Browser automation, extension relay, and Chrome CDP management
-  map [options] <domain>                   Auto-navigate a domain and produce a deduplicated API map. Launches Chrome with CDP, starts a Ride Shotgun learn session, then analyzes captured network traffic.
   sequence [options]                       Manage email sequences
 `;