@vellumai/assistant 0.4.49 → 0.4.50

package/src/cli/commands/skills.ts

@@ -8,6 +8,14 @@ import {
   readLocalCatalog,
   uninstallSkillLocally,
 } from "../../skills/catalog-install.js";
+import type { AuditResponse } from "../../skills/skillssh-registry.js";
+import {
+  fetchSkillAudits,
+  formatAuditBadges,
+  installExternalSkill,
+  resolveSkillSource,
+  searchSkillsRegistry,
+} from "../../skills/skillssh-registry.js";
 import { log } from "../logger.js";
 
 // ---------------------------------------------------------------------------
@@ -28,9 +36,13 @@ capabilities with pre-built workflows and tools.
 Examples:
   $ assistant skills list
   $ assistant skills list --json
+  $ assistant skills search react
+  $ assistant skills search react --limit 5 --json
   $ assistant skills install weather
   $ assistant skills install weather --overwrite
-  $ assistant skills uninstall weather`,
+  $ assistant skills uninstall weather
+  $ assistant skills add vercel-labs/skills@find-skills
+  $ assistant skills add vercel-labs/skills/find-skills --overwrite`,
   );
 
   skills
@@ -79,6 +91,102 @@ Examples:
       }
     });
 
+  skills
+    .command("search <query>")
+    .description("Search the skills.sh community registry")
+    .option("--limit <n>", "Maximum number of results", "10")
+    .option("--json", "Machine-readable JSON output")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  query    Free-text search term matched against skill names, descriptions,
+           and tags in the skills.sh registry.
+
+Searches the skills.sh community registry and displays matching skills
+with install counts and security audit badges (ATH, Socket, Snyk).
+Audit fetch failures are non-fatal — results are still shown without
+security data.
+
+Examples:
+  $ assistant skills search react
+  $ assistant skills search "file management" --limit 3
+  $ assistant skills search deploy --json`,
+    )
+    .action(async (query: string, opts: { limit: string; json?: boolean }) => {
+      const json = opts.json ?? false;
+      const limit = parseInt(opts.limit, 10) || 10;
+
+      try {
+        const results = await searchSkillsRegistry(query, limit);
+
+        if (results.length === 0) {
+          if (json) {
+            console.log(JSON.stringify({ ok: true, results: [], audits: {} }));
+          } else {
+            log.info(`No skills found for "${query}".`);
+          }
+          return;
+        }
+
+        // Group skill slugs by source for batch audit lookups
+        const sourceToSlugs = new Map<string, string[]>();
+        for (const r of results) {
+          const slugs = sourceToSlugs.get(r.source) ?? [];
+          slugs.push(r.skillId);
+          sourceToSlugs.set(r.source, slugs);
+        }
+
+        // Fetch audits for each unique source, keyed by source/skillId
+        // to avoid collisions when different sources share the same slug.
+        const allAudits: AuditResponse = {};
+        for (const [source, slugs] of sourceToSlugs) {
+          try {
+            const audits = await fetchSkillAudits(source, slugs);
+            for (const [skillId, auditData] of Object.entries(audits)) {
+              allAudits[`${source}/${skillId}`] = auditData;
+            }
+          } catch {
+            // Audit fetch failures are non-fatal; display results without audits
+          }
+        }
+
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: true,
+              results,
+              audits: allAudits,
+            }),
+          );
+          return;
+        }
+
+        log.info(`Search results for "${query}" (${results.length}):\n`);
+        for (const r of results) {
+          log.info(`  ${r.name}`);
+          log.info(`    ID: ${r.skillId}`);
+          log.info(`    Source: ${r.source}`);
+          log.info(`    Installs: ${r.installs}`);
+          const auditData = allAudits[`${r.source}/${r.skillId}`];
+          if (auditData) {
+            log.info(`    ${formatAuditBadges(auditData)}`);
+          } else {
+            log.info("    Security: no audit data");
+          }
+          log.info("");
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (json) {
+          console.log(JSON.stringify({ ok: false, error: msg }));
+        } else {
+          log.error(`Error: ${msg}`);
+        }
+        process.exitCode = 1;
+      }
+    });
+
   skills
     .command("install <skill-id>")
     .description("Install a skill from the catalog")
@@ -157,4 +265,68 @@ Examples:
         process.exitCode = 1;
       }
     });
+
+  skills
+    .command("add <source>")
+    .description(
+      "Install a community skill from the skills.sh registry (GitHub)",
+    )
+    .option("--overwrite", "Replace an already installed skill")
+    .option("--json", "Machine-readable JSON output")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  source   Skill source in one of these formats:
+             owner/repo@skill-name
+             owner/repo/skill-name
+             https://github.com/owner/repo/tree/<branch>/skills/skill-name
+
+Notes:
+  Fetches the skill's SKILL.md and supporting files from the specified GitHub
+  repository and installs them into the workspace skills directory. A
+  version.json file is written with origin metadata for provenance tracking.
+
+Examples:
+  $ assistant skills add vercel-labs/skills@find-skills
+  $ assistant skills add vercel-labs/skills/find-skills
+  $ assistant skills add vercel-labs/skills@find-skills --overwrite`,
+    )
+    .action(
+      async (source: string, opts: { overwrite?: boolean; json?: boolean }) => {
+        const json = opts.json ?? false;
+
+        try {
+          const { owner, repo, skillSlug, ref } = resolveSkillSource(source);
+
+          await installExternalSkill(
+            owner,
+            repo,
+            skillSlug,
+            opts.overwrite ?? false,
+            ref,
+          );
+
+          if (json) {
+            console.log(
+              JSON.stringify({
+                ok: true,
+                skillSlug,
+                source: `${owner}/${repo}`,
+              }),
+            );
+          } else {
+            log.info(`Installed skill "${skillSlug}" from ${owner}/${repo}.`);
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (json) {
+            console.log(JSON.stringify({ ok: false, error: msg }));
+          } else {
+            log.error(`Error: ${msg}`);
+          }
+          process.exitCode = 1;
+        }
+      },
+    );
 }

package/src/cli/http-client.ts

@@ -64,23 +64,3 @@ export async function httpSend(
   }
   return fetch(url, { ...init, headers });
 }
-
-// ---------------------------------------------------------------------------
-// Health check
-// ---------------------------------------------------------------------------
-
-/**
- * Perform an HTTP health check against the daemon's `/healthz` endpoint.
- * Returns true if the daemon responds with HTTP 200, false otherwise.
- */
-export async function httpHealthCheck(timeoutMs = 2000): Promise<boolean> {
-  try {
-    const url = `${getHttpBaseUrl()}/healthz`;
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}

package/src/cli/main-screen.tsx

@@ -1,8 +1,8 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
+import { getGatewayInternalBaseUrl } from "../config/env.js";
 import { getWorkspaceDir } from "../util/platform.js";
-import { getHttpBaseUrl } from "./http-client.js";
 
 const LEFT_PANEL_WIDTH = 36;
 const RIGHT_LINE_COUNT = 11;
@@ -14,7 +14,7 @@ export interface MainScreenLayout {
 }
 
 export function renderMainScreen(): MainScreenLayout {
-  const httpUrl = getHttpBaseUrl();
+  const httpUrl = getGatewayInternalBaseUrl();
   const workspace = getWorkspaceDir();
   const assistantId = workspace.split("/").pop() ?? "vellum";
 

package/src/cli/program.ts

@@ -1,8 +1,7 @@
-import { createRequire } from "node:module";
-
 import { Command } from "commander";
 
 import { registerHooksCommand } from "../hooks/cli.js";
+import { APP_VERSION } from "../version.js";
 import { registerAuditCommand } from "./commands/audit.js";
 import { registerAutonomyCommand } from "./commands/autonomy.js";
 import { registerBrowserRelayCommand } from "./commands/browser-relay.js";
@@ -25,13 +24,13 @@ import { registerSessionsCommand } from "./commands/sessions.js";
 import { registerSkillsCommand } from "./commands/skills.js";
 import { registerTrustCommand } from "./commands/trust.js";
 
-const require = createRequire(import.meta.url);
-const { version } = require("../../package.json") as { version: string };
-
 export function buildCliProgram(): Command {
   const program = new Command();
 
-  program.name("assistant").description("Local AI assistant").version(version);
+  program
+    .name("assistant")
+    .description("Local AI assistant")
+    .version(APP_VERSION);
 
   registerDefaultAction(program);
   registerSessionsCommand(program);

package/src/cli.ts

@@ -3,7 +3,7 @@ import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 import * as readline from "node:readline";
 
-import { httpHealthCheck, httpSend, readHttpToken } from "./cli/http-client.js";
+import { httpSend } from "./cli/http-client.js";
 import {
   type MainScreenLayout,
   renderMainScreen,
@@ -11,6 +11,7 @@ import {
   updateStatusText,
 } from "./cli/main-screen.jsx";
 import { shouldAutoStartDaemon } from "./daemon/connection-policy.js";
+import { isHttpHealthy } from "./daemon/daemon-control.js";
 import { ensureDaemonRunning } from "./daemon/lifecycle.js";
 import type {
   ConfirmationRequest,
@@ -637,7 +638,7 @@ export async function startCli(): Promise<void> {
       case "memory_recalled":
         spinner.stop();
         process.stdout.write(
-          `\n\x1B[2m[Memory recalled: ${msg.injectedTokens} tokens | lexical ${msg.lexicalHits} | semantic ${msg.semanticHits} | recency ${msg.recencyHits} | entity ${msg.entityHits} | merged ${msg.mergedCount} → selected ${msg.selectedCount}${msg.rerankApplied ? " (reranked)" : ""} | ${msg.provider}/${msg.model} | ${msg.latencyMs}ms]\x1B[0m\n`,
+          `\n\x1B[2m[Memory recalled: ${msg.injectedTokens} tokens | t1 ${msg.tier1Count} t2 ${msg.tier2Count} | semantic ${msg.semanticHits} | recency ${msg.recencyHits} | merged ${msg.mergedCount} → selected ${msg.selectedCount}${msg.sparseVectorUsed ? " (sparse)" : ""} | hybrid ${msg.hybridSearchLatencyMs}ms | ${msg.provider}/${msg.model} | ${msg.latencyMs}ms]\x1B[0m\n`,
         );
         spinner.start("Thinking...");
         break;
@@ -885,17 +886,10 @@ export async function startCli(): Promise<void> {
 
   /** Connect the SSE event stream for the current conversation. */
   async function connectSse(): Promise<void> {
-    const token = readHttpToken();
     const controller = new AbortController();
     sseAbortController = controller;
 
     const url = `/v1/events?conversationKey=${encodeURIComponent(conversationKey)}`;
-    const headers: Record<string, string> = {
-      Accept: "text/event-stream",
-    };
-    if (token) {
-      headers["Authorization"] = `Bearer ${token}`;
-    }
 
     try {
       const response = await httpSend(url, {
@@ -1010,7 +1004,7 @@ export async function startCli(): Promise<void> {
       try {
         if (shouldAutoStartDaemon()) await ensureDaemonRunning();
         // Verify the daemon is healthy before attempting SSE
-        const healthy = await httpHealthCheck(2000);
+        const healthy = await isHttpHealthy();
         if (!healthy) throw new Error("Health check failed");
         await connectSse();
         reconnectDelay = RECONNECT_BASE_DELAY_MS;

package/src/config/bundled-skills/computer-use/TOOLS.json

@@ -301,7 +301,7 @@
     },
     {
       "name": "computer_use_respond",
-      "description": "Respond directly to the user with a text answer. Use this when the user is asking a question (about their schedule, meetings, calendar, etc.) rather than asking you to control the computer.",
+      "description": "Respond to the user with a text answer instead of performing computer actions. Use this when you can answer directly without interacting with the screen.",
       "category": "computer-use",
       "risk": "low",
       "input_schema": {

package/src/config/bundled-skills/computer-use/tools/computer-use-observe.ts

@@ -0,0 +1,12 @@
+import { forwardComputerUseProxyTool } from "../../../../tools/computer-use/skill-proxy-bridge.js";
+import type {
+  ToolContext,
+  ToolExecutionResult,
+} from "../../../../tools/types.js";
+
+export async function run(
+  input: Record<string, unknown>,
+  context: ToolContext,
+): Promise<ToolExecutionResult> {
+  return forwardComputerUseProxyTool("computer_use_observe", input, context);
+}

package/src/config/bundled-tool-registry.ts

@@ -48,6 +48,7 @@ import * as computerUseClick from "./bundled-skills/computer-use/tools/computer-
 import * as computerUseDone from "./bundled-skills/computer-use/tools/computer-use-done.js";
 import * as computerUseDrag from "./bundled-skills/computer-use/tools/computer-use-drag.js";
 import * as computerUseKey from "./bundled-skills/computer-use/tools/computer-use-key.js";
+import * as computerUseObserve from "./bundled-skills/computer-use/tools/computer-use-observe.js";
 import * as computerUseOpenApp from "./bundled-skills/computer-use/tools/computer-use-open-app.js";
 import * as computerUseRespond from "./bundled-skills/computer-use/tools/computer-use-respond.js";
 import * as computerUseRunApplescript from "./bundled-skills/computer-use/tools/computer-use-run-applescript.js";
@@ -88,8 +89,6 @@ import * as calendarListEvents from "./bundled-skills/google-calendar/tools/cale
 import * as calendarRsvp from "./bundled-skills/google-calendar/tools/calendar-rsvp.js";
 // ── image-studio ───────────────────────────────────────────────────────────────
 import * as mediaGenerateImage from "./bundled-skills/image-studio/tools/media-generate-image.js";
-// ── knowledge-graph ────────────────────────────────────────────────────────────
-import * as graphQuery from "./bundled-skills/knowledge-graph/tools/graph-query.js";
 // ── media-processing ───────────────────────────────────────────────────────────
 import * as analyzeKeyframes from "./bundled-skills/media-processing/tools/analyze-keyframes.js";
 import * as extractKeyframes from "./bundled-skills/media-processing/tools/extract-keyframes.js";
@@ -219,6 +218,7 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   ["claude-code:tools/claude-code.ts", claudeCode],
 
   // computer-use
+  ["computer-use:tools/computer-use-observe.ts", computerUseObserve],
   ["computer-use:tools/computer-use-click.ts", computerUseClick],
   ["computer-use:tools/computer-use-type-text.ts", computerUseTypeText],
   ["computer-use:tools/computer-use-key.ts", computerUseKey],
@@ -276,9 +276,6 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   // image-studio
   ["image-studio:tools/media-generate-image.ts", mediaGenerateImage],
 
-  // knowledge-graph
-  ["knowledge-graph:tools/graph-query.ts", graphQuery],
-
   // media-processing
   ["media-processing:tools/ingest-media.ts", ingestMedia],
   ["media-processing:tools/media-status.ts", mediaStatus],

package/src/config/schema.ts

@@ -91,27 +91,16 @@ export {
   MemoryRetentionConfigSchema,
 } from "./schemas/memory-lifecycle.js";
 export type {
-  MemoryConflictsConfig,
-  MemoryEntityConfig,
   MemoryExtractionConfig,
-  MemoryProfileConfig,
   MemorySummarizationConfig,
 } from "./schemas/memory-processing.js";
 export {
-  MemoryConflictsConfigSchema,
-  MemoryEntityConfigSchema,
   MemoryExtractionConfigSchema,
-  MemoryProfileConfigSchema,
   MemorySummarizationConfigSchema,
 } from "./schemas/memory-processing.js";
-export type {
-  MemoryRerankingConfig,
-  MemoryRetrievalConfig,
-} from "./schemas/memory-retrieval.js";
+export type { MemoryRetrievalConfig } from "./schemas/memory-retrieval.js";
 export {
   MemoryDynamicBudgetConfigSchema,
-  MemoryEarlyTerminationConfigSchema,
-  MemoryRerankingConfigSchema,
   MemoryRetrievalConfigSchema,
 } from "./schemas/memory-retrieval.js";
 export type {

package/src/config/schemas/memory-lifecycle.ts

@@ -33,15 +33,6 @@ export const MemoryCleanupConfigSchema = z.object({
     .int("memory.cleanup.enqueueIntervalMs must be an integer")
     .positive("memory.cleanup.enqueueIntervalMs must be a positive integer")
     .default(6 * 60 * 60 * 1000),
-  resolvedConflictRetentionMs: z
-    .number({
-      error: "memory.cleanup.resolvedConflictRetentionMs must be a number",
-    })
-    .int("memory.cleanup.resolvedConflictRetentionMs must be an integer")
-    .positive(
-      "memory.cleanup.resolvedConflictRetentionMs must be a positive integer",
-    )
-    .default(30 * 24 * 60 * 60 * 1000),
   supersededItemRetentionMs: z
     .number({
       error: "memory.cleanup.supersededItemRetentionMs must be a number",

package/src/config/schemas/memory-processing.ts

@@ -1,28 +1,5 @@
 import { z } from "zod";
 
-const VALID_MEMORY_ITEM_KINDS = [
-  "preference",
-  "profile",
-  "project",
-  "decision",
-  "todo",
-  "fact",
-  "constraint",
-  "relationship",
-  "event",
-  "opinion",
-  "instruction",
-  "style",
-] as const;
-
-const DEFAULT_CONFLICTABLE_KINDS = [
-  "preference",
-  "profile",
-  "constraint",
-  "instruction",
-  "style",
-] as const;
-
 export const MemoryExtractionConfigSchema = z.object({
   useLLM: z
     .boolean({ error: "memory.extraction.useLLM must be a boolean" })
@@ -50,166 +27,9 @@ export const MemorySummarizationConfigSchema = z.object({
     .default("latency-optimized"),
 });
 
-export const MemoryEntityConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "memory.entity.enabled must be a boolean" })
-    .default(true),
-  modelIntent: z
-    .enum(["latency-optimized", "quality-optimized", "vision-optimized"], {
-      error: "memory.entity.modelIntent must be a valid model intent",
-    })
-    .default("latency-optimized"),
-  extractRelations: z
-    .object({
-      enabled: z
-        .boolean({
-          error: "memory.entity.extractRelations.enabled must be a boolean",
-        })
-        .default(true),
-      backfillBatchSize: z
-        .number({
-          error:
-            "memory.entity.extractRelations.backfillBatchSize must be a number",
-        })
-        .int(
-          "memory.entity.extractRelations.backfillBatchSize must be an integer",
-        )
-        .positive(
-          "memory.entity.extractRelations.backfillBatchSize must be a positive integer",
-        )
-        .default(200),
-    })
-    .default({ enabled: true, backfillBatchSize: 200 }),
-  relationRetrieval: z
-    .object({
-      enabled: z
-        .boolean({
-          error: "memory.entity.relationRetrieval.enabled must be a boolean",
-        })
-        .default(true),
-      maxSeedEntities: z
-        .number({
-          error:
-            "memory.entity.relationRetrieval.maxSeedEntities must be a number",
-        })
-        .int(
-          "memory.entity.relationRetrieval.maxSeedEntities must be an integer",
-        )
-        .positive(
-          "memory.entity.relationRetrieval.maxSeedEntities must be a positive integer",
-        )
-        .default(8),
-      maxNeighborEntities: z
-        .number({
-          error:
-            "memory.entity.relationRetrieval.maxNeighborEntities must be a number",
-        })
-        .int(
-          "memory.entity.relationRetrieval.maxNeighborEntities must be an integer",
-        )
-        .positive(
-          "memory.entity.relationRetrieval.maxNeighborEntities must be a positive integer",
-        )
-        .default(20),
-      maxEdges: z
-        .number({
-          error: "memory.entity.relationRetrieval.maxEdges must be a number",
-        })
-        .int("memory.entity.relationRetrieval.maxEdges must be an integer")
-        .positive(
-          "memory.entity.relationRetrieval.maxEdges must be a positive integer",
-        )
-        .default(40),
-      neighborScoreMultiplier: z
-        .number({
-          error:
-            "memory.entity.relationRetrieval.neighborScoreMultiplier must be a number",
-        })
-        .gt(
-          0,
-          "memory.entity.relationRetrieval.neighborScoreMultiplier must be > 0",
-        )
-        .lte(
-          1,
-          "memory.entity.relationRetrieval.neighborScoreMultiplier must be <= 1",
-        )
-        .default(0.7),
-      maxDepth: z
-        .number({
-          error: "memory.entity.relationRetrieval.maxDepth must be a number",
-        })
-        .int("memory.entity.relationRetrieval.maxDepth must be an integer")
-        .positive(
-          "memory.entity.relationRetrieval.maxDepth must be a positive integer",
-        )
-        .default(3),
-      depthDecay: z
-        .boolean({
-          error: "memory.entity.relationRetrieval.depthDecay must be a boolean",
-        })
-        .default(true),
-    })
-    .default({
-      enabled: true,
-      maxSeedEntities: 8,
-      maxNeighborEntities: 20,
-      maxEdges: 40,
-      neighborScoreMultiplier: 0.7,
-      maxDepth: 3,
-      depthDecay: true,
-    }),
-});
-
-export const MemoryConflictsConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "memory.conflicts.enabled must be a boolean" })
-    .default(true),
-  gateMode: z
-    .enum(["soft"], { error: 'memory.conflicts.gateMode must be "soft"' })
-    .default("soft"),
-  resolverLlmTimeoutMs: z
-    .number({ error: "memory.conflicts.resolverLlmTimeoutMs must be a number" })
-    .int("memory.conflicts.resolverLlmTimeoutMs must be an integer")
-    .positive(
-      "memory.conflicts.resolverLlmTimeoutMs must be a positive integer",
-    )
-    .default(12000),
-  relevanceThreshold: z
-    .number({ error: "memory.conflicts.relevanceThreshold must be a number" })
-    .min(0, "memory.conflicts.relevanceThreshold must be >= 0")
-    .max(1, "memory.conflicts.relevanceThreshold must be <= 1")
-    .default(0.3),
-  conflictableKinds: z
-    .array(
-      z.enum(VALID_MEMORY_ITEM_KINDS, {
-        error: `memory.conflicts.conflictableKinds entries must be one of: ${VALID_MEMORY_ITEM_KINDS.join(
-          ", ",
-        )}`,
-      }),
-    )
-    .nonempty({
-      message: "memory.conflicts.conflictableKinds must not be empty",
-    })
-    .default([...DEFAULT_CONFLICTABLE_KINDS]),
-});
-
-export const MemoryProfileConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "memory.profile.enabled must be a boolean" })
-    .default(true),
-  maxInjectTokens: z
-    .number({ error: "memory.profile.maxInjectTokens must be a number" })
-    .int("memory.profile.maxInjectTokens must be an integer")
-    .positive("memory.profile.maxInjectTokens must be a positive integer")
-    .default(800),
-});
-
 export type MemoryExtractionConfig = z.infer<
   typeof MemoryExtractionConfigSchema
 >;
 export type MemorySummarizationConfig = z.infer<
   typeof MemorySummarizationConfigSchema
 >;
-export type MemoryEntityConfig = z.infer<typeof MemoryEntityConfigSchema>;
-export type MemoryConflictsConfig = z.infer<typeof MemoryConflictsConfigSchema>;
-export type MemoryProfileConfig = z.infer<typeof MemoryProfileConfigSchema>;