@vellumai/assistant 0.4.56 → 0.4.57

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (450) hide show
  1. package/ARCHITECTURE.md +10 -10
  2. package/Dockerfile +3 -0
  3. package/README.md +11 -11
  4. package/docs/architecture/integrations.md +2 -2
  5. package/docs/architecture/memory.md +3 -4
  6. package/docs/credential-execution-service.md +13 -20
  7. package/node_modules/@vellumai/ces-contracts/src/error.ts +5 -4
  8. package/package.json +1 -1
  9. package/src/__tests__/actor-token-service.test.ts +7 -7
  10. package/src/__tests__/anthropic-provider.test.ts +172 -0
  11. package/src/__tests__/app-builder-tool-scripts.test.ts +15 -1
  12. package/src/__tests__/approval-cascade.test.ts +2 -2
  13. package/src/__tests__/approval-routes-http.test.ts +3 -4
  14. package/src/__tests__/asset-materialize-tool.test.ts +5 -5
  15. package/src/__tests__/asset-search-tool.test.ts +1 -1
  16. package/src/__tests__/assistant-attachments.test.ts +5 -5
  17. package/src/__tests__/assistant-events-sse-hardening.test.ts +1 -1
  18. package/src/__tests__/assistant-feature-flags-integration.test.ts +50 -38
  19. package/src/__tests__/attachments-store.test.ts +2 -2
  20. package/src/__tests__/avatar-e2e.test.ts +5 -3
  21. package/src/__tests__/browser-skill-endstate.test.ts +0 -1
  22. package/src/__tests__/call-routes-http.test.ts +2 -2
  23. package/src/__tests__/callback-handoff-copy.test.ts +1 -1
  24. package/src/__tests__/cancel-resolves-conversation-key.test.ts +158 -0
  25. package/src/__tests__/channel-readiness-routes.test.ts +0 -1
  26. package/src/__tests__/channel-readiness-service.test.ts +0 -1
  27. package/src/__tests__/checker.test.ts +31 -32
  28. package/src/__tests__/chrome-cdp.test.ts +47 -18
  29. package/src/__tests__/claude-code-skill-regression.test.ts +2 -2
  30. package/src/__tests__/config-schema-cmd.test.ts +2 -2
  31. package/src/__tests__/config-schema.test.ts +9 -18
  32. package/src/__tests__/confirmation-request-guardian-bridge.test.ts +1 -1
  33. package/src/__tests__/conversation-abort-tool-results.test.ts +4 -4
  34. package/src/__tests__/conversation-agent-loop-overflow.test.ts +2 -2
  35. package/src/__tests__/conversation-agent-loop.test.ts +11 -4
  36. package/src/__tests__/conversation-attachments.test.ts +1 -1
  37. package/src/__tests__/conversation-confirmation-signals.test.ts +2 -2
  38. package/src/__tests__/conversation-error.test.ts +33 -0
  39. package/src/__tests__/conversation-init.benchmark.test.ts +0 -1
  40. package/src/__tests__/conversation-load-history-repair.test.ts +1 -1
  41. package/src/__tests__/conversation-pairing.test.ts +1 -1
  42. package/src/__tests__/conversation-pre-run-repair.test.ts +4 -4
  43. package/src/__tests__/conversation-provider-retry-repair.test.ts +4 -4
  44. package/src/__tests__/conversation-queue.test.ts +23 -14
  45. package/src/__tests__/conversation-routes-slash-commands.test.ts +3 -3
  46. package/src/__tests__/conversation-runtime-assembly.test.ts +185 -173
  47. package/src/__tests__/conversation-seed-composer.test.ts +1 -1
  48. package/src/__tests__/conversation-slash-queue.test.ts +4 -4
  49. package/src/__tests__/conversation-slash-unknown.test.ts +4 -4
  50. package/src/__tests__/conversation-starter-routes.test.ts +291 -0
  51. package/src/__tests__/conversation-wipe.test.ts +438 -0
  52. package/src/__tests__/conversation-workspace-cache-state.test.ts +2 -3
  53. package/src/__tests__/conversation-workspace-injection.test.ts +4 -5
  54. package/src/__tests__/conversation-workspace-tool-tracking.test.ts +4 -5
  55. package/src/__tests__/credential-security-e2e.test.ts +20 -0
  56. package/src/__tests__/credential-security-invariants.test.ts +1 -0
  57. package/src/__tests__/credential-vault-unit.test.ts +227 -0
  58. package/src/__tests__/credentials-cli.test.ts +3 -0
  59. package/src/__tests__/date-context.test.ts +59 -377
  60. package/src/__tests__/drop-capability-card-state-migration.test.ts +169 -0
  61. package/src/__tests__/dynamic-skill-workflow-prompt.test.ts +11 -45
  62. package/src/__tests__/emit-signal-routing-intent.test.ts +3 -3
  63. package/src/__tests__/encrypted-store.test.ts +237 -15
  64. package/src/__tests__/ephemeral-permissions.test.ts +4 -5
  65. package/src/__tests__/event-bus.test.ts +3 -3
  66. package/src/__tests__/gateway-only-enforcement.test.ts +2 -2
  67. package/src/__tests__/gateway-only-guard.test.ts +1 -0
  68. package/src/__tests__/gemini-image-service.test.ts +4 -4
  69. package/src/__tests__/gemini-provider.test.ts +6 -9
  70. package/src/__tests__/guardian-binding-drift-heal.test.ts +128 -0
  71. package/src/__tests__/guardian-dispatch.test.ts +0 -1
  72. package/src/__tests__/host-shell-tool.test.ts +6 -6
  73. package/src/__tests__/http-user-message-parity.test.ts +2 -2
  74. package/src/__tests__/intent-routing.test.ts +51 -99
  75. package/src/__tests__/invite-routes-http.test.ts +5 -0
  76. package/src/__tests__/list-messages-attachments.test.ts +1 -1
  77. package/src/__tests__/managed-proxy-context.test.ts +2 -5
  78. package/src/__tests__/managed-skill-lifecycle.test.ts +8 -8
  79. package/src/__tests__/media-generate-image.test.ts +32 -15
  80. package/src/__tests__/media-reuse-story.e2e.test.ts +1 -1
  81. package/src/__tests__/memory-context-benchmark.benchmark.test.ts +1 -1
  82. package/src/__tests__/memory-lifecycle-e2e.test.ts +24 -18
  83. package/src/__tests__/memory-recall-quality.test.ts +4 -3
  84. package/src/__tests__/memory-regressions.test.ts +86 -90
  85. package/src/__tests__/migration-cross-version-compatibility.test.ts +32 -32
  86. package/src/__tests__/migration-export-http.test.ts +26 -27
  87. package/src/__tests__/migration-import-commit-http.test.ts +165 -37
  88. package/src/__tests__/migration-import-preflight-http.test.ts +81 -20
  89. package/src/__tests__/migration-validate-http.test.ts +16 -16
  90. package/src/__tests__/model-intents.test.ts +1 -1
  91. package/src/__tests__/no-domain-routing-in-prompt-guard.test.ts +1 -1
  92. package/src/__tests__/notification-broadcaster.test.ts +1 -1
  93. package/src/__tests__/notification-decision-fallback.test.ts +2 -2
  94. package/src/__tests__/notification-decision-identity.test.ts +8 -9
  95. package/src/__tests__/notification-decision-strategy.test.ts +1 -1
  96. package/src/__tests__/notification-deep-link.test.ts +1 -1
  97. package/src/__tests__/notification-guardian-path.test.ts +0 -1
  98. package/src/__tests__/notification-schedule-dedup.test.ts +7 -7
  99. package/src/__tests__/oauth-store.test.ts +1 -3
  100. package/src/__tests__/oauth2-gateway-transport.test.ts +6 -1
  101. package/src/__tests__/onboarding-template-contract.test.ts +23 -59
  102. package/src/__tests__/provider-error-scenarios.test.ts +154 -0
  103. package/src/__tests__/provider-fail-open-selection.test.ts +2 -2
  104. package/src/__tests__/provider-managed-proxy-integration.test.ts +8 -9
  105. package/src/__tests__/provider-registry-ollama.test.ts +5 -2
  106. package/src/__tests__/qdrant-manager.test.ts +7 -7
  107. package/src/__tests__/ratelimit.test.ts +0 -74
  108. package/src/__tests__/recording-handler.test.ts +0 -1
  109. package/src/__tests__/require-fresh-approval.test.ts +1 -1
  110. package/src/__tests__/runtime-attachment-metadata.test.ts +1 -1
  111. package/src/__tests__/runtime-events-sse-parity.test.ts +1 -1
  112. package/src/__tests__/runtime-events-sse.test.ts +1 -1
  113. package/src/__tests__/scheduler-recurrence.test.ts +46 -2
  114. package/src/__tests__/schema-transforms.test.ts +114 -54
  115. package/src/__tests__/secret-onetime-send.test.ts +20 -0
  116. package/src/__tests__/secret-routes-managed-proxy.test.ts +5 -2
  117. package/src/__tests__/secret-scanner-executor.test.ts +1 -2
  118. package/src/__tests__/send-endpoint-busy.test.ts +63 -4
  119. package/src/__tests__/send-notification-tool.test.ts +2 -2
  120. package/src/__tests__/shell-credential-ref.test.ts +0 -1
  121. package/src/__tests__/shell-tool-proxy-mode.test.ts +1 -2
  122. package/src/__tests__/skill-memory.test.ts +547 -0
  123. package/src/__tests__/skill-script-runner-sandbox.test.ts +1 -2
  124. package/src/__tests__/slack-app-setup-skill-regression.test.ts +37 -0
  125. package/src/__tests__/slack-channel-config.test.ts +109 -94
  126. package/src/__tests__/swarm-conversation-integration.test.ts +2 -2
  127. package/src/__tests__/swarm-recursion.test.ts +2 -2
  128. package/src/__tests__/swarm-tool.test.ts +2 -2
  129. package/src/__tests__/system-prompt.test.ts +19 -66
  130. package/src/__tests__/telegram-config.test.ts +121 -0
  131. package/src/__tests__/terminal-tools.test.ts +1 -1
  132. package/src/__tests__/tool-execution-abort-cleanup.test.ts +1 -2
  133. package/src/__tests__/tool-executor-lifecycle-events.test.ts +1 -1
  134. package/src/__tests__/tool-executor-shell-integration.test.ts +1 -1
  135. package/src/__tests__/tool-executor.test.ts +1 -1
  136. package/src/__tests__/trace-emitter.test.ts +8 -1
  137. package/src/__tests__/trust-store.test.ts +7 -8
  138. package/src/__tests__/twilio-routes.test.ts +1 -18
  139. package/src/__tests__/user-reference.test.ts +82 -2
  140. package/src/__tests__/vbundle-pax-and-symlink.test.ts +196 -0
  141. package/src/__tests__/verification-control-plane-policy.test.ts +1 -1
  142. package/src/approvals/guardian-request-resolvers.ts +3 -3
  143. package/src/avatar/ascii-renderer.ts +2 -2
  144. package/src/avatar/png-renderer.ts +2 -2
  145. package/src/avatar/resvg-lazy.ts +21 -0
  146. package/src/calls/guardian-dispatch.ts +1 -1
  147. package/src/calls/relay-access-wait.ts +2 -2
  148. package/src/calls/twilio-rest.ts +0 -248
  149. package/src/cli/AGENTS.md +5 -8
  150. package/src/cli/__tests__/notifications.test.ts +5 -5
  151. package/src/cli/commands/avatar.ts +64 -2
  152. package/src/cli/commands/conversations.ts +131 -1
  153. package/src/cli/commands/credentials.ts +2 -0
  154. package/src/cli/commands/notifications.ts +3 -3
  155. package/src/cli.ts +10 -0
  156. package/src/config/bundled-skills/acp/SKILL.md +5 -5
  157. package/src/config/bundled-skills/acp/TOOLS.json +6 -6
  158. package/src/config/bundled-skills/app-builder/SKILL.md +42 -42
  159. package/src/config/bundled-skills/app-builder/TOOLS.json +10 -10
  160. package/src/config/bundled-skills/browser/SKILL.md +15 -15
  161. package/src/config/bundled-skills/browser/TOOLS.json +14 -14
  162. package/src/config/bundled-skills/chatgpt-import/SKILL.md +2 -2
  163. package/src/config/bundled-skills/chatgpt-import/TOOLS.json +1 -1
  164. package/src/config/bundled-skills/chatgpt-import/tools/chatgpt-import.ts +1 -1
  165. package/src/config/bundled-skills/claude-code/SKILL.md +5 -5
  166. package/src/config/bundled-skills/computer-use/SKILL.md +2 -2
  167. package/src/config/bundled-skills/computer-use/TOOLS.json +15 -15
  168. package/src/config/bundled-skills/contacts/SKILL.md +3 -3
  169. package/src/config/bundled-skills/contacts/TOOLS.json +4 -4
  170. package/src/config/bundled-skills/document/SKILL.md +4 -4
  171. package/src/config/bundled-skills/document/TOOLS.json +2 -2
  172. package/src/config/bundled-skills/followups/TOOLS.json +3 -3
  173. package/src/config/bundled-skills/gmail/SKILL.md +32 -32
  174. package/src/config/bundled-skills/gmail/TOOLS.json +16 -16
  175. package/src/config/bundled-skills/gmail/tools/gmail-archive.ts +1 -1
  176. package/src/config/bundled-skills/gmail/tools/gmail-sender-digest.ts +1 -1
  177. package/src/config/bundled-skills/google-calendar/SKILL.md +1 -1
  178. package/src/config/bundled-skills/google-calendar/TOOLS.json +5 -5
  179. package/src/config/bundled-skills/google-calendar/types.ts +1 -1
  180. package/src/config/bundled-skills/heartbeat/SKILL.md +43 -0
  181. package/src/config/bundled-skills/image-studio/SKILL.md +3 -3
  182. package/src/config/bundled-skills/image-studio/TOOLS.json +2 -3
  183. package/src/config/bundled-skills/image-studio/tools/media-generate-image.ts +16 -12
  184. package/src/config/bundled-skills/media-processing/SKILL.md +40 -40
  185. package/src/config/bundled-skills/media-processing/TOOLS.json +8 -8
  186. package/src/config/bundled-skills/media-processing/__tests__/concurrency-pool.test.ts +2 -2
  187. package/src/config/bundled-skills/media-processing/__tests__/preprocess.test.ts +1 -1
  188. package/src/config/bundled-skills/media-processing/services/gemini-map.ts +5 -5
  189. package/src/config/bundled-skills/media-processing/services/gemini-video.ts +2 -2
  190. package/src/config/bundled-skills/media-processing/services/preprocess.ts +2 -2
  191. package/src/config/bundled-skills/media-processing/services/processing-pipeline.ts +2 -2
  192. package/src/config/bundled-skills/media-processing/services/reduce.ts +3 -3
  193. package/src/config/bundled-skills/media-processing/tools/generate-clip.ts +2 -2
  194. package/src/config/bundled-skills/media-processing/tools/query-media-events.ts +1 -1
  195. package/src/config/bundled-skills/messaging/SKILL.md +29 -25
  196. package/src/config/bundled-skills/messaging/TOOLS.json +11 -11
  197. package/src/config/bundled-skills/messaging/tools/messaging-send.ts +1 -1
  198. package/src/config/bundled-skills/messaging/tools/shared.ts +1 -1
  199. package/src/config/bundled-skills/notifications/SKILL.md +3 -3
  200. package/src/config/bundled-skills/notifications/TOOLS.json +2 -2
  201. package/src/config/bundled-skills/notifications/tools/send-notification.ts +3 -3
  202. package/src/config/bundled-skills/orchestration/SKILL.md +1 -1
  203. package/src/config/bundled-skills/orchestration/TOOLS.json +1 -1
  204. package/src/config/bundled-skills/phone-calls/SKILL.md +18 -14
  205. package/src/config/bundled-skills/phone-calls/TOOLS.json +3 -3
  206. package/src/config/bundled-skills/phone-calls/references/CONFIG.md +2 -2
  207. package/src/config/bundled-skills/phone-calls/references/TRANSCRIPTS.md +2 -2
  208. package/src/config/bundled-skills/phone-calls/references/TROUBLESHOOTING.md +1 -1
  209. package/src/config/bundled-skills/playbooks/TOOLS.json +4 -4
  210. package/src/config/bundled-skills/schedule/SKILL.md +26 -26
  211. package/src/config/bundled-skills/schedule/TOOLS.json +5 -5
  212. package/src/config/bundled-skills/screen-watch/SKILL.md +3 -3
  213. package/src/config/bundled-skills/screen-watch/TOOLS.json +1 -1
  214. package/src/config/bundled-skills/sequences/SKILL.md +2 -2
  215. package/src/config/bundled-skills/sequences/TOOLS.json +10 -10
  216. package/src/config/bundled-skills/sequences/tools/sequence-analytics.ts +2 -2
  217. package/src/config/bundled-skills/sequences/tools/sequence-enroll.ts +2 -2
  218. package/src/config/bundled-skills/sequences/tools/sequence-enrollment-list.ts +1 -1
  219. package/src/config/bundled-skills/sequences/tools/sequence-get.ts +1 -1
  220. package/src/config/bundled-skills/sequences/tools/sequence-import.ts +3 -3
  221. package/src/config/bundled-skills/sequences/tools/sequence-list.ts +1 -1
  222. package/src/config/bundled-skills/sequences/tools/sequence-update.ts +1 -1
  223. package/src/config/bundled-skills/settings/TOOLS.json +3 -3
  224. package/src/config/bundled-skills/settings/tools/open-system-settings.ts +1 -1
  225. package/src/config/bundled-skills/skill-management/TOOLS.json +5 -5
  226. package/src/config/bundled-skills/skills-catalog/SKILL.md +84 -0
  227. package/src/config/bundled-skills/slack/SKILL.md +2 -2
  228. package/src/config/bundled-skills/slack/TOOLS.json +8 -8
  229. package/src/config/bundled-skills/slack/tools/slack-scan-digest.ts +3 -3
  230. package/src/config/bundled-skills/subagent/TOOLS.json +5 -5
  231. package/src/config/bundled-skills/tasks/SKILL.md +1 -1
  232. package/src/config/bundled-skills/tasks/TOOLS.json +9 -9
  233. package/src/config/bundled-skills/transcribe/SKILL.md +5 -5
  234. package/src/config/bundled-skills/transcribe/TOOLS.json +1 -1
  235. package/src/config/bundled-skills/transcribe/tools/transcribe-media.ts +10 -10
  236. package/src/config/bundled-skills/watcher/SKILL.md +4 -4
  237. package/src/config/bundled-skills/watcher/TOOLS.json +5 -5
  238. package/src/config/feature-flag-registry.json +33 -17
  239. package/src/config/schemas/sandbox.ts +1 -1
  240. package/src/config/schemas/services.ts +13 -3
  241. package/src/config/schemas/timeouts.ts +0 -10
  242. package/src/contacts/contact-store.ts +63 -0
  243. package/src/contacts/contacts-write.ts +1 -1
  244. package/src/daemon/assistant-attachments.ts +2 -2
  245. package/src/daemon/conversation-agent-loop-handlers.ts +2 -2
  246. package/src/daemon/conversation-agent-loop.ts +7 -30
  247. package/src/daemon/conversation-error.ts +24 -0
  248. package/src/daemon/conversation-memory.ts +8 -7
  249. package/src/daemon/conversation-runtime-assembly.ts +139 -274
  250. package/src/daemon/conversation-slash.ts +7 -26
  251. package/src/daemon/conversation-surfaces.ts +14 -0
  252. package/src/daemon/conversation-tool-setup.ts +9 -8
  253. package/src/daemon/conversation.ts +2 -0
  254. package/src/daemon/daemon-control.ts +1 -1
  255. package/src/daemon/date-context.ts +10 -83
  256. package/src/daemon/handlers/config-channels.ts +12 -2
  257. package/src/daemon/handlers/config-slack-channel.ts +7 -1
  258. package/src/daemon/handlers/config-telegram.ts +6 -1
  259. package/src/daemon/handlers/conversations.ts +2 -2
  260. package/src/daemon/handlers/skills.ts +4 -0
  261. package/src/daemon/lifecycle.ts +28 -4
  262. package/src/daemon/providers-setup.ts +1 -1
  263. package/src/daemon/server.ts +1 -5
  264. package/src/daemon/shutdown-handlers.ts +9 -3
  265. package/src/daemon/tool-side-effects.ts +40 -0
  266. package/src/daemon/trace-emitter.ts +25 -2
  267. package/src/events/domain-events.ts +1 -1
  268. package/src/events/tool-permission-telemetry-listener.ts +46 -0
  269. package/src/inbound/platform-callback-registration.ts +0 -18
  270. package/src/media/app-icon-generator.ts +15 -8
  271. package/src/media/avatar-router.ts +15 -8
  272. package/src/media/gemini-image-service.ts +125 -21
  273. package/src/memory/attachments-store.ts +3 -3
  274. package/src/memory/channel-verification-sessions.ts +6 -6
  275. package/src/memory/conversation-crud.ts +196 -1
  276. package/src/memory/{thread-starters-cadence.ts → conversation-starters-cadence.ts} +9 -42
  277. package/src/memory/conversation-title-service.ts +2 -3
  278. package/src/memory/db-init.ts +25 -1
  279. package/src/memory/invite-store.ts +4 -4
  280. package/src/memory/items-extractor.ts +4 -4
  281. package/src/memory/job-handlers/{thread-starters.ts → conversation-starters.ts} +123 -38
  282. package/src/memory/jobs-store.ts +3 -2
  283. package/src/memory/jobs-worker.ts +7 -5
  284. package/src/memory/lifecycle-events-store.ts +63 -0
  285. package/src/memory/migrations/172-rename-created-by-session-id.ts +27 -0
  286. package/src/memory/migrations/173-rename-source-session-id.ts +16 -0
  287. package/src/memory/migrations/174-rename-thread-starters-table.ts +52 -0
  288. package/src/memory/migrations/175-create-lifecycle-events.ts +15 -0
  289. package/src/memory/migrations/176-drop-capability-card-state.ts +36 -0
  290. package/src/memory/migrations/177-create-trace-events-table.ts +40 -0
  291. package/src/memory/migrations/index.ts +6 -0
  292. package/src/memory/migrations/registry.ts +13 -0
  293. package/src/memory/retriever.test.ts +223 -96
  294. package/src/memory/retriever.ts +115 -138
  295. package/src/memory/schema/calls.ts +1 -1
  296. package/src/memory/schema/contacts.ts +1 -1
  297. package/src/memory/schema/infrastructure.ts +29 -0
  298. package/src/memory/schema/memory-core.ts +7 -17
  299. package/src/memory/schema/notifications.ts +1 -1
  300. package/src/memory/search/formatting.ts +23 -6
  301. package/src/memory/search/lexical.ts +2 -0
  302. package/src/memory/search/semantic.ts +2 -0
  303. package/src/memory/search/staleness.ts +1 -0
  304. package/src/memory/search/types.ts +4 -0
  305. package/src/memory/task-memory-cleanup.ts +96 -6
  306. package/src/memory/trace-event-store.ts +148 -0
  307. package/src/notifications/README.md +1 -1
  308. package/src/notifications/decision-engine.ts +2 -2
  309. package/src/notifications/emit-signal.ts +4 -4
  310. package/src/notifications/events-store.ts +4 -4
  311. package/src/notifications/signal.ts +1 -1
  312. package/src/oauth/manual-token-connection.ts +49 -25
  313. package/src/permissions/checker.ts +6 -5
  314. package/src/permissions/defaults.ts +4 -4
  315. package/src/prompts/__tests__/build-cli-reference-section.test.ts +9 -90
  316. package/src/prompts/cache-boundary.ts +8 -0
  317. package/src/prompts/system-prompt.ts +105 -634
  318. package/src/prompts/templates/BOOTSTRAP.md +166 -33
  319. package/src/prompts/templates/IDENTITY.md +8 -23
  320. package/src/prompts/templates/SOUL.md +20 -41
  321. package/src/prompts/templates/USER.md +3 -19
  322. package/src/prompts/user-reference.ts +14 -16
  323. package/src/providers/anthropic/client.ts +46 -2
  324. package/src/providers/gemini/client.ts +6 -9
  325. package/src/providers/managed-proxy/constants.ts +1 -7
  326. package/src/providers/managed-proxy/context.ts +0 -1
  327. package/src/providers/model-intents.ts +5 -5
  328. package/src/providers/openai/client.ts +10 -1
  329. package/src/providers/openrouter/client.ts +1 -0
  330. package/src/providers/ratelimit.ts +0 -35
  331. package/src/providers/registry.ts +3 -5
  332. package/src/providers/retry.ts +18 -1
  333. package/src/runtime/access-request-helper.ts +1 -1
  334. package/src/runtime/auth/route-policy.ts +7 -0
  335. package/src/runtime/channel-verification-service.ts +1 -1
  336. package/src/runtime/confirmation-request-guardian-bridge.ts +1 -1
  337. package/src/runtime/guardian-vellum-migration.ts +63 -1
  338. package/src/runtime/http-server.ts +8 -4
  339. package/src/runtime/migrations/vbundle-builder.ts +212 -32
  340. package/src/runtime/migrations/vbundle-import-analyzer.ts +74 -8
  341. package/src/runtime/migrations/vbundle-importer.ts +66 -1
  342. package/src/runtime/migrations/vbundle-validator.ts +17 -3
  343. package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts +4 -4
  344. package/src/runtime/routes/attachment-routes.ts +2 -2
  345. package/src/runtime/routes/btw-routes.ts +9 -0
  346. package/src/runtime/routes/channel-verification-routes.ts +19 -2
  347. package/src/runtime/routes/conversation-management-routes.ts +55 -1
  348. package/src/runtime/routes/conversation-query-routes.ts +1 -1
  349. package/src/runtime/routes/conversation-routes.ts +49 -5
  350. package/src/runtime/routes/conversation-starter-routes.ts +207 -0
  351. package/src/runtime/routes/guardian-bootstrap-routes.ts +13 -9
  352. package/src/runtime/routes/inbound-stages/escalation-intercept.ts +1 -1
  353. package/src/runtime/routes/inbound-stages/verification-intercept.ts +1 -1
  354. package/src/runtime/routes/migration-routes.ts +25 -13
  355. package/src/runtime/routes/secret-routes.ts +18 -0
  356. package/src/runtime/routes/settings-routes.ts +8 -8
  357. package/src/runtime/routes/telemetry-routes.ts +53 -0
  358. package/src/runtime/routes/trace-event-routes.ts +62 -0
  359. package/src/runtime/tool-grant-request-helper.ts +1 -1
  360. package/src/runtime/verification-outbound-actions.ts +47 -31
  361. package/src/security/encrypted-store.ts +263 -78
  362. package/src/skills/catalog-install.ts +10 -0
  363. package/src/skills/managed-store.ts +2 -0
  364. package/src/skills/skill-memory.ts +220 -0
  365. package/src/subagent/manager.ts +1 -4
  366. package/src/telemetry/types.ts +10 -1
  367. package/src/telemetry/usage-telemetry-reporter.test.ts +1 -1
  368. package/src/telemetry/usage-telemetry-reporter.ts +51 -4
  369. package/src/tools/AGENTS.md +11 -11
  370. package/src/tools/acp/spawn.ts +1 -1
  371. package/src/tools/apps/executors.ts +8 -8
  372. package/src/tools/apps/registry.ts +1 -1
  373. package/src/tools/assets/materialize.ts +6 -6
  374. package/src/tools/assets/search.ts +10 -10
  375. package/src/tools/browser/__tests__/auth-cache.test.ts +2 -2
  376. package/src/tools/browser/__tests__/auth-detector.test.ts +4 -4
  377. package/src/tools/browser/auth-detector.ts +6 -6
  378. package/src/tools/browser/browser-execution.ts +13 -13
  379. package/src/tools/browser/browser-manager.ts +3 -3
  380. package/src/tools/browser/chrome-cdp.ts +5 -5
  381. package/src/tools/browser/jit-auth.ts +2 -2
  382. package/src/tools/browser/network-recorder.test.ts +2 -2
  383. package/src/tools/browser/network-recorder.ts +3 -3
  384. package/src/tools/browser/runtime-check.ts +3 -3
  385. package/src/tools/claude-code/claude-code.ts +2 -2
  386. package/src/tools/computer-use/definitions.ts +18 -18
  387. package/src/tools/credential-execution/make-authenticated-request.ts +4 -4
  388. package/src/tools/credential-execution/manage-secure-command-tool.ts +3 -3
  389. package/src/tools/credential-execution/run-authenticated-command.ts +4 -4
  390. package/src/tools/credentials/broker-types.ts +5 -5
  391. package/src/tools/credentials/broker.ts +15 -15
  392. package/src/tools/credentials/metadata-store.ts +2 -2
  393. package/src/tools/credentials/resolve.ts +1 -1
  394. package/src/tools/credentials/selection.ts +1 -1
  395. package/src/tools/credentials/tool-policy.ts +1 -1
  396. package/src/tools/credentials/vault.ts +115 -25
  397. package/src/tools/execution-target.ts +2 -2
  398. package/src/tools/executor.ts +7 -7
  399. package/src/tools/filesystem/edit.ts +2 -2
  400. package/src/tools/filesystem/read.ts +1 -1
  401. package/src/tools/filesystem/write.ts +1 -1
  402. package/src/tools/host-filesystem/edit.ts +2 -1
  403. package/src/tools/host-filesystem/read.ts +2 -1
  404. package/src/tools/host-filesystem/write.ts +1 -1
  405. package/src/tools/host-terminal/host-shell.ts +9 -8
  406. package/src/tools/mcp/mcp-tool-factory.ts +7 -6
  407. package/src/tools/memory/definitions.ts +6 -5
  408. package/src/tools/memory/handlers.test.ts +1 -1
  409. package/src/tools/network/__tests__/web-search.test.ts +3 -3
  410. package/src/tools/network/domain-normalize.ts +2 -2
  411. package/src/tools/network/script-proxy/session-manager.ts +10 -10
  412. package/src/tools/network/web-fetch.ts +1 -1
  413. package/src/tools/network/web-search.ts +3 -3
  414. package/src/tools/permission-checker.ts +8 -8
  415. package/src/tools/registry.ts +7 -7
  416. package/src/tools/schedule/list.ts +2 -2
  417. package/src/tools/schema-transforms.ts +31 -21
  418. package/src/tools/secret-detection-handler.ts +1 -1
  419. package/src/tools/sensitive-output-placeholders.ts +1 -1
  420. package/src/tools/shared/filesystem/edit-engine.ts +1 -1
  421. package/src/tools/shared/filesystem/file-ops-service.ts +3 -3
  422. package/src/tools/shared/filesystem/image-read.ts +25 -5
  423. package/src/tools/shared/filesystem/path-policy.ts +2 -2
  424. package/src/tools/shared/shell-output.ts +1 -1
  425. package/src/tools/side-effects.ts +1 -1
  426. package/src/tools/skills/execute.ts +1 -1
  427. package/src/tools/skills/load.ts +3 -3
  428. package/src/tools/skills/sandbox-runner.ts +3 -3
  429. package/src/tools/subagent/read.ts +1 -1
  430. package/src/tools/subagent/spawn.ts +2 -2
  431. package/src/tools/swarm/delegate.ts +3 -3
  432. package/src/tools/system/request-permission.ts +5 -4
  433. package/src/tools/terminal/backends/native.ts +4 -4
  434. package/src/tools/terminal/parser.ts +6 -6
  435. package/src/tools/terminal/sandbox-diagnostics.ts +1 -1
  436. package/src/tools/terminal/shell.ts +16 -16
  437. package/src/tools/tool-approval-handler.ts +21 -12
  438. package/src/tools/tool-manifest.ts +4 -4
  439. package/src/tools/types.ts +3 -3
  440. package/src/tools/ui-surface/definitions.ts +9 -37
  441. package/src/tools/watcher/list.ts +1 -1
  442. package/src/util/logger.ts +7 -2
  443. package/src/util/retry.ts +29 -1
  444. package/src/workspace/migrations/007-web-search-provider-rename.ts +37 -0
  445. package/src/workspace/migrations/registry.ts +2 -0
  446. package/src/__tests__/cli-help-reference-sync.test.ts +0 -26
  447. package/src/__tests__/onboarding-starter-tasks.test.ts +0 -190
  448. package/src/cli/reference.ts +0 -38
  449. package/src/memory/job-handlers/capability-cards.ts +0 -420
  450. package/src/runtime/routes/thread-starter-routes.ts +0 -294
@@ -3,7 +3,7 @@
3
3
  "tools": [
4
4
  {
5
5
  "name": "acp_spawn",
6
- "description": "Spawn an external coding agent (e.g. Claude Code, Codex, Gemini CLI) via ACP to work on a task. The agent runs as a subprocess and streams results back. Use this when you want to delegate a coding task to an external agent that has its own tools, file editing, and terminal access. If ACP is not enabled, follow the setup instructions in SKILL.md to install claude-agent-acp and configure it. The command MUST be 'claude-agent-acp' NEVER use 'claude', 'claude -p', or 'claude --acp'.",
6
+ "description": "Spawn an external coding agent (e.g. Claude Code, Codex, Gemini CLI) via ACP to work on a task. The agent runs as a subprocess and streams results back. Use this when you want to delegate a coding task to an external agent that has its own tools, file editing, and terminal access. If ACP is not enabled, follow the setup instructions in SKILL.md to install claude-agent-acp and configure it. The command MUST be 'claude-agent-acp' - NEVER use 'claude', 'claude -p', or 'claude --acp'.",
7
7
  "category": "orchestration",
8
8
  "risk": "low",
9
9
  "input_schema": {
@@ -15,13 +15,13 @@
15
15
  },
16
16
  "task": {
17
17
  "type": "string",
18
- "description": "The task to give the agent what it should accomplish"
18
+ "description": "The task to give the agent - what it should accomplish"
19
19
  },
20
20
  "cwd": {
21
21
  "type": "string",
22
22
  "description": "Working directory for the agent. This determines where the agent runs and where its session is stored. Set this to the project/repo root the user wants the agent to work in. Defaults to current conversation's working directory."
23
23
  },
24
- "reason": {
24
+ "activity": {
25
25
  "type": "string",
26
26
  "description": "Brief explanation of why this tool is being called"
27
27
  }
@@ -33,7 +33,7 @@
33
33
  },
34
34
  {
35
35
  "name": "acp_status",
36
- "description": "Get the status of a specific ACP session or list all ACP sessions. Only use this when the user explicitly asks about ACP session status do NOT poll automatically, as you will be notified when sessions complete.",
36
+ "description": "Get the status of a specific ACP session or list all ACP sessions. Only use this when the user explicitly asks about ACP session status - do NOT poll automatically, as you will be notified when sessions complete.",
37
37
  "category": "orchestration",
38
38
  "risk": "low",
39
39
  "input_schema": {
@@ -43,7 +43,7 @@
43
43
  "type": "string",
44
44
  "description": "Optional ACP session ID to query. If omitted, returns all ACP sessions."
45
45
  },
46
- "reason": {
46
+ "activity": {
47
47
  "type": "string",
48
48
  "description": "Brief explanation of why this tool is being called"
49
49
  }
@@ -65,7 +65,7 @@
65
65
  "type": "string",
66
66
  "description": "The ID of the ACP session to abort."
67
67
  },
68
- "reason": {
68
+ "activity": {
69
69
  "type": "string",
70
70
  "description": "Brief explanation of why this tool is being called"
71
71
  }
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: app-builder
3
- description: Build interactive apps, dashboards, calculators, games, trackers, tools, landing pages, and data visualizations with HTML/CSS/JS. Use when the user says build, create, or make an app/dashboard/calculator/game.
3
+ description: Build interactive apps, dashboards, calculators, games, trackers, tools, landing pages, and data visualizations with HTML/CSS/JS
4
4
  compatibility: "Designed for Vellum personal assistants"
5
5
  metadata:
6
6
  emoji: "🏗️"
@@ -10,9 +10,9 @@ metadata:
10
10
  - "frontend-design"
11
11
  ---
12
12
 
13
- You are an expert app builder and visual designer. When the user asks you to create an app, tool, or utility, you immediately design a data schema, choose a stunning visual direction, build the interface, and open it all in one step. You don't discuss or ask for permission to be creative. You ARE the designer: you pick the colors, the layout, the atmosphere, the micro-interactions. Your apps should make users stop and say "whoa" they should feel designed, not generated.
13
+ You are an expert app builder and visual designer. When the user asks you to create an app, tool, or utility, you immediately design a data schema, choose a stunning visual direction, build the interface, and open it - all in one step. You don't discuss or ask for permission to be creative. You ARE the designer: you pick the colors, the layout, the atmosphere, the micro-interactions. Your apps should make users stop and say "whoa" - they should feel designed, not generated.
14
14
 
15
- **Every app gets its own visual identity.** A plant tracker should feel earthy and green. A finance dashboard should feel precise and navy. A fitness app should feel energetic and purple. Apps should look like they were designed by a boutique studio for that specific domain not like generic branded tools. Think standalone premium product, not template.
15
+ **Every app gets its own visual identity.** A plant tracker should feel earthy and green. A finance dashboard should feel precise and navy. A fitness app should feel energetic and purple. Apps should look like they were designed by a boutique studio for that specific domain - not like generic branded tools. Think standalone premium product, not template.
16
16
 
17
17
  **Your default behavior:** Build immediately. The user types "build me a habit tracker" and you deliver a complete, polished app with a domain-matched color palette, atmospheric background, and thoughtful interactions. Don't ask what colors they want. Don't show wireframes. Just build something stunning and let them refine from there.
18
18
 
@@ -24,7 +24,7 @@ You are an expert app builder and visual designer. When the user asks you to cre
24
24
 
25
25
  **Default: just build.** When a user says "build me a habit tracker," don't ask what colors they want or how many fields to include. Immediately:
26
26
 
27
- 1. Envision the ideal version of this app what would make someone excited to use it?
27
+ 1. Envision the ideal version of this app - what would make someone excited to use it?
28
28
  2. Pick a distinctive visual direction following the `frontend-design` skill
29
29
  3. Design a clean data schema
30
30
  4. Build the complete, polished app with animations, interactions, and empty states
@@ -42,15 +42,15 @@ You are an expert app builder and visual designer. When the user asks you to cre
42
42
 
43
43
  <!-- feature:app-builder-multifile:alt:end -->
44
44
 
45
- **Only ask questions when the request is genuinely ambiguous** e.g., "build me an app" with no indication of what kind. Even then, prefer building something impressive based on context clues over asking a battery of questions.
45
+ **Only ask questions when the request is genuinely ambiguous** - e.g., "build me an app" with no indication of what kind. Even then, prefer building something impressive based on context clues over asking a battery of questions.
46
46
 
47
- **When in doubt, build something impressive** and let the user refine with `app_update`. The first impression matters most a beautiful app with the wrong shade of blue is easy to fix. A correct but ugly app is hard to come back from.
47
+ **When in doubt, build something impressive** and let the user refine with `app_update`. The first impression matters most - a beautiful app with the wrong shade of blue is easy to fix. A correct but ugly app is hard to come back from.
48
48
 
49
49
  **There are no "quick" builds.** Every app, regardless of complexity, gets the full design treatment. A 3-field form and a 20-section dashboard get the same design care. The only difference is scope, not quality.
50
50
 
51
51
  ### 2. Design the Data Schema
52
52
 
53
- Create a JSON Schema that defines the structure of a single record. Every record automatically gets `id`, `appId`, `createdAt`, and `updatedAt` you only define user-facing fields.
53
+ Create a JSON Schema that defines the structure of a single record. Every record automatically gets `id`, `appId`, `createdAt`, and `updatedAt` - you only define user-facing fields.
54
54
 
55
55
  Schema guidelines:
56
56
 
@@ -58,7 +58,7 @@ Schema guidelines:
58
58
  - Define `properties` for each field
59
59
  - Supported types: `string`, `number`, `boolean`
60
60
  - Add a `required` array for mandatory fields
61
- - Keep schemas reasonably flat encode complex nested data as JSON strings when needed
61
+ - Keep schemas reasonably flat - encode complex nested data as JSON strings when needed
62
62
 
63
63
  Example schema for a project tracker:
64
64
 
@@ -96,8 +96,8 @@ Build apps as multi-file TSX projects. You get component reuse, TypeScript type-
96
96
 
97
97
  ```
98
98
  src/
99
- index.html # Entry HTML minimal shell, loads compiled bundle
100
- main.tsx # App entry renders root component into #app
99
+ index.html # Entry HTML - minimal shell, loads compiled bundle
100
+ main.tsx # App entry - renders root component into #app
101
101
  components/ # Preact functional components
102
102
  Header.tsx
103
103
  RecordList.tsx
@@ -139,7 +139,7 @@ export const Header: FunctionComponent<Props> = ({ title, count }) => {
139
139
 
140
140
  **CSS:** Import CSS files directly in TSX (`import './styles.css'`). You can also use inline styles via the `style` attribute on JSX elements.
141
141
 
142
- **Data bridge:** The same `window.vellum.data` API works in TSX components call it from `useEffect` hooks or event handlers:
142
+ **Data bridge:** The same `window.vellum.data` API works in TSX components - call it from `useEffect` hooks or event handlers:
143
143
 
144
144
  ```tsx
145
145
  const [records, setRecords] = useState<Record[]>([]);
@@ -151,9 +151,9 @@ useEffect(() => {
151
151
 
152
152
  **File workflow:** Use `app_file_write` for each source file. Each write automatically triggers a recompile of the project.
153
153
 
154
- **Allowed third-party packages:** `date-fns`, `chart.js`, `lodash-es`, `zod`, `clsx`, `lucide`. Import them directly esbuild resolves them at build time. No CDN imports. Note: `lucide` is the vanilla JS icon library (not `lucide-react`). Use its `createElement` or `createIcons` API, or manually inline SVG do not import JSX icon components.
154
+ **Allowed third-party packages:** `date-fns`, `chart.js`, `lodash-es`, `zod`, `clsx`, `lucide`. Import them directly - esbuild resolves them at build time. No CDN imports. Note: `lucide` is the vanilla JS icon library (not `lucide-react`). Use its `createElement` or `createIcons` API, or manually inline SVG - do not import JSX icon components.
155
155
 
156
- **Example creating a multi-file project:**
156
+ **Example - creating a multi-file project:**
157
157
 
158
158
  ```
159
159
  app_file_write(app_id, "src/index.html", `<!DOCTYPE html>
@@ -209,12 +209,12 @@ app_file_write(app_id, "src/styles.css", `.app { padding: var(--v-spacing-lg); }
209
209
 
210
210
  **Technical constraints (multi-file):**
211
211
 
212
- - No CDN imports use esbuild-resolved packages from the allowlist above
213
- - Preact for UI (not React) `import { render } from 'preact'`
212
+ - No CDN imports - use esbuild-resolved packages from the allowlist above
213
+ - Preact for UI (not React) - `import { render } from 'preact'`
214
214
  - TypeScript encouraged for all `.tsx`/`.ts` files
215
- - No external fonts, images, or resources use system fonts and CSS/SVG for visuals
215
+ - No external fonts, images, or resources - use system fonts and CSS/SVG for visuals
216
216
  - Design for 400-600px width with graceful resizing
217
- - The WebView blocks all navigation links and form `action` attributes won't work
217
+ - The WebView blocks all navigation - links and form `action` attributes won't work
218
218
  <!-- feature:app-builder-multifile:end -->
219
219
 
220
220
  <!-- feature:app-builder-multifile:alt -->
@@ -225,11 +225,11 @@ Write a complete, self-contained HTML document.
225
225
 
226
226
  **Technical constraints (single-file):**
227
227
 
228
- - Single HTML string no external files, CDNs, or imports
228
+ - Single HTML string - no external files, CDNs, or imports
229
229
  - All CSS in `<style>` in `<head>`, all JavaScript in `<script>` before `</body>`
230
- - No external fonts, images, or resources use system fonts and CSS/SVG for visuals
230
+ - No external fonts, images, or resources - use system fonts and CSS/SVG for visuals
231
231
  - Design for 400-600px width with graceful resizing
232
- - The WebView blocks all navigation links and form `action` attributes won't work
232
+ - The WebView blocks all navigation - links and form `action` attributes won't work
233
233
 
234
234
  <!-- feature:app-builder-multifile:alt:end -->
235
235
 
@@ -237,7 +237,7 @@ Write a complete, self-contained HTML document.
237
237
 
238
238
  A design system CSS is auto-injected inside a `@layer`, so your styles always take priority. It provides element defaults and automatic light/dark mode switching via `prefers-color-scheme`.
239
239
 
240
- **Use `--v-*` variables and `.v-*` classes** they handle light/dark mode automatically. No manual dark mode CSS needed.
240
+ **Use `--v-*` variables and `.v-*` classes** - they handle light/dark mode automatically. No manual dark mode CSS needed.
241
241
 
242
242
  Available design tokens:
243
243
 
@@ -269,7 +269,7 @@ window.addEventListener("vellum-theme-change", (e) => {
269
269
 
270
270
  #### Widget component library
271
271
 
272
- A CSS/JS widget library is auto-injected alongside the design system. Use these for standard UI patterns skip them when custom HTML serves the user better.
272
+ A CSS/JS widget library is auto-injected alongside the design system. Use these for standard UI patterns - skip them when custom HTML serves the user better.
273
273
 
274
274
  **Layout widgets** (class names, infer HTML structure):
275
275
 
@@ -287,7 +287,7 @@ A CSS/JS widget library is auto-injected alongside the design system. Use these
287
287
  | `.v-progress-bar` / `.v-progress-track` / `.v-progress-fill` | Horizontal progress |
288
288
  | `.v-status-badge` | Colored pill with dot (`.success`/`.error`/`.warning`/`.info`) |
289
289
  | `.v-stat-row` / `.v-stat` | Horizontal label-value pairs |
290
- | `.v-toast` | Notification banner prefer `vellum.widgets.toast()` |
290
+ | `.v-toast` | Notification banner - prefer `vellum.widgets.toast()` |
291
291
  | `.v-avatar-row` | Contact/team display |
292
292
  | `.v-tag-group` | Wrapping tag row |
293
293
 
@@ -396,26 +396,26 @@ vellum.widgets.slideshow("deck", {
396
396
 
397
397
  #### When to use widgets vs custom HTML
398
398
 
399
- - **Use widgets** for standard patterns tables, metrics, timelines, notifications, presentations
400
- - **Use custom HTML** for novel or creative UIs games, art tools, unique dashboards
401
- - **Mix freely** widgets compose well together and with custom elements
399
+ - **Use widgets** for standard patterns - tables, metrics, timelines, notifications, presentations
400
+ - **Use custom HTML** for novel or creative UIs - games, art tools, unique dashboards
401
+ - **Mix freely** - widgets compose well together and with custom elements
402
402
  - **ALWAYS use `vellum.widgets.*` chart functions** instead of hand-coding SVG/CSS charts. They handle overflow clipping, bounds, scaling, and dark mode. Hand-coded charts break layouts.
403
403
 
404
404
  #### Data bridge API
405
405
 
406
406
  The HTML interface can read and write records via `window.vellum.data`. All methods return Promises.
407
407
 
408
- - `window.vellum.data.query()` Returns all records: `{ id, appId, data, createdAt, updatedAt }[]`
409
- - `window.vellum.data.create(data)` Creates a record. Returns the created record.
410
- - `window.vellum.data.update(recordId, data)` Updates a record by ID. Returns updated record.
411
- - `window.vellum.data.delete(recordId)` Deletes a record by ID. Returns void.
408
+ - `window.vellum.data.query()` - Returns all records: `{ id, appId, data, createdAt, updatedAt }[]`
409
+ - `window.vellum.data.create(data)` - Creates a record. Returns the created record.
410
+ - `window.vellum.data.update(recordId, data)` - Updates a record by ID. Returns updated record.
411
+ - `window.vellum.data.delete(recordId)` - Deletes a record by ID. Returns void.
412
412
 
413
413
  Important:
414
414
 
415
415
  - Call `query()` on page load to populate initial state
416
416
  - User fields live in `record.data` (e.g., `record.data.title`)
417
417
  - Record IDs are UUID strings
418
- - All operations are async use `async/await`
418
+ - All operations are async - use `async/await`
419
419
  - Wrap all calls in `try/catch`
420
420
 
421
421
  #### Client-side state management
@@ -490,11 +490,11 @@ Call `app_create` with:
490
490
  - `name`: Short descriptive name
491
491
  - `description`: One-sentence summary
492
492
  - `schema_json`: JSON schema as string
493
- - `html`: (optional) Complete HTML document as string for `index.html`. If omitted, a minimal scaffold is created you can then write `index.html` and other files via `app_file_write`.
493
+ - `html`: (optional) Complete HTML document as string for `index.html`. If omitted, a minimal scaffold is created - you can then write `index.html` and other files via `app_file_write`.
494
494
  - `auto_open`: (optional, defaults to `true`) Shows an inline preview card in chat
495
- - `preview`: Always include `title` (required), `subtitle`, `description`, `icon` (image URL preferred, emoji fallback), `metrics` (up to 3 key-value pills)
495
+ - `preview`: Always include - `title` (required), `subtitle`, `description`, `icon` (image URL preferred, emoji fallback), `metrics` (up to 3 key-value pills)
496
496
 
497
- The app is NOT opened in a workspace panel automatically users open it via the 'Open App' button on the inline card.
497
+ The app is NOT opened in a workspace panel automatically - users open it via the 'Open App' button on the inline card.
498
498
 
499
499
  <!-- feature:app-builder-multifile:start -->
500
500
  ### 5. Handle Iteration
@@ -505,9 +505,9 @@ The app is NOT opened in a workspace panel automatically — users open it via t
505
505
 
506
506
  When the user requests changes, prefer **`app_file_edit`** over rewriting the entire file.
507
507
 
508
- - **`app_file_edit`** preferred for targeted changes (styles, bugs, features). Provide `app_id`, `path`, `old_string`, `new_string`.
509
- - **`app_file_write`** use when creating new files or when changes are so extensive a full rewrite is cleaner.
510
- - **`app_update`** metadata only: `name`, `description`, `schema_json`. Not for code changes.
508
+ - **`app_file_edit`** - preferred for targeted changes (styles, bugs, features). Provide `app_id`, `path`, `old_string`, `new_string`.
509
+ - **`app_file_write`** - use when creating new files or when changes are so extensive a full rewrite is cleaner.
510
+ - **`app_update`** - metadata only: `name`, `description`, `schema_json`. Not for code changes.
511
511
  - Always include a **`status`** parameter describing what you're doing.
512
512
 
513
513
  Apps can have multiple files (`styles.css`, `app.js`, etc.). Link from `index.html` with standard tags.
@@ -528,10 +528,10 @@ Slides are a different domain from apps. Skip app-specific patterns (contextual
528
528
 
529
529
  **Key principles:**
530
530
 
531
- - One idea per slide understood in 3 seconds
532
- - Layout variety 3+ different types per deck, never consecutive same-type
531
+ - One idea per slide - understood in 3 seconds
532
+ - Layout variety - 3+ different types per deck, never consecutive same-type
533
533
  - 8 layout types: Title, Stats, Bullets, Quote, Comparison, Timeline, Visual/Immersive, Closing/CTA
534
- - Bold backgrounds dark, gradient, or strongly tinted
534
+ - Bold backgrounds - dark, gradient, or strongly tinted
535
535
  - Max 6 bullets per slide, max 3 sentences body text
536
536
  - Never go below 15px for any visible text
537
537
 
@@ -540,7 +540,7 @@ Init with `vellum.widgets.slideshow()`. Use `.v-slide` with helpers: `.v-slide-l
540
540
  ## Error Handling
541
541
 
542
542
  - All `window.vellum.data` calls must be wrapped in `try/catch` with user-friendly feedback.
543
- - Never let a failed operation silently pass always show a toast or inline error.
543
+ - Never let a failed operation silently pass - always show a toast or inline error.
544
544
  - If the page loads with no data, show a designed empty state (`.v-empty-state`).
545
545
  - For forms, show validation errors inline next to the relevant field.
546
546
 
@@ -550,7 +550,7 @@ When the user wants to triage or bulk-act on items, generate an interactive UI w
550
550
 
551
551
  1. Fetch data with relevant tools
552
552
  2. Render a `dynamic_page` with selectable items and action buttons
553
- 3. User selects + clicks action UI sends `surfaceAction` with action ID and selected IDs
553
+ 3. User selects + clicks action - UI sends `surfaceAction` with action ID and selected IDs
554
554
  4. Execute tools, update UI with `ui_update`, show feedback via `widgets.toast()`
555
555
  5. Use `window.vellum.confirm()` for destructive actions
556
556
 
@@ -75,7 +75,7 @@
75
75
  },
76
76
  "required": ["title"]
77
77
  },
78
- "reason": {
78
+ "activity": {
79
79
  "type": "string",
80
80
  "description": "Brief non-technical explanation of why this tool is being called"
81
81
  }
@@ -93,7 +93,7 @@
93
93
  "input_schema": {
94
94
  "type": "object",
95
95
  "properties": {
96
- "reason": {
96
+ "activity": {
97
97
  "type": "string",
98
98
  "description": "Brief non-technical explanation of why this tool is being called"
99
99
  }
@@ -114,7 +114,7 @@
114
114
  "type": "string",
115
115
  "description": "The ID of the app to query records for"
116
116
  },
117
- "reason": {
117
+ "activity": {
118
118
  "type": "string",
119
119
  "description": "Brief non-technical explanation of why this tool is being called"
120
120
  }
@@ -159,7 +159,7 @@
159
159
  "type": "string"
160
160
  }
161
161
  },
162
- "reason": {
162
+ "activity": {
163
163
  "type": "string",
164
164
  "description": "Brief non-technical explanation of why this tool is being called"
165
165
  }
@@ -181,7 +181,7 @@
181
181
  "type": "string",
182
182
  "description": "The ID of the app to delete"
183
183
  },
184
- "reason": {
184
+ "activity": {
185
185
  "type": "string",
186
186
  "description": "Brief non-technical explanation of why this tool is being called"
187
187
  }
@@ -203,7 +203,7 @@
203
203
  "type": "string",
204
204
  "description": "The ID of the app"
205
205
  },
206
- "reason": {
206
+ "activity": {
207
207
  "type": "string",
208
208
  "description": "Brief non-technical explanation of why this tool is being called"
209
209
  }
@@ -237,7 +237,7 @@
237
237
  "type": "number",
238
238
  "description": "Number of lines to return (default: all)"
239
239
  },
240
- "reason": {
240
+ "activity": {
241
241
  "type": "string",
242
242
  "description": "Brief non-technical explanation of why this tool is being called"
243
243
  }
@@ -279,7 +279,7 @@
279
279
  "type": "string",
280
280
  "description": "Optional short human-readable progress message shown to the user (e.g. 'adding dark mode styles')"
281
281
  },
282
- "reason": {
282
+ "activity": {
283
283
  "type": "string",
284
284
  "description": "Brief non-technical explanation of why this tool is being called"
285
285
  }
@@ -313,7 +313,7 @@
313
313
  "type": "string",
314
314
  "description": "Optional short human-readable progress message shown to the user (e.g. 'adding dark mode styles')"
315
315
  },
316
- "reason": {
316
+ "activity": {
317
317
  "type": "string",
318
318
  "description": "Brief non-technical explanation of why this tool is being called"
319
319
  }
@@ -339,7 +339,7 @@
339
339
  "type": "string",
340
340
  "description": "Optional description to guide icon generation (e.g. 'a blue calendar with a checkmark'). If omitted, the app name and description are used."
341
341
  },
342
- "reason": {
342
+ "activity": {
343
343
  "type": "string",
344
344
  "description": "Brief non-technical explanation of why this tool is being called"
345
345
  }
@@ -13,24 +13,24 @@ metadata:
13
13
 
14
14
  Use this skill to browse the web. After loading this skill, the following browser tools become available:
15
15
 
16
- - `browser_navigate` Navigate to a URL
17
- - `browser_snapshot` List interactive elements on the current page
18
- - `browser_screenshot` Take a visual screenshot
19
- - `browser_close` Close the browser page
20
- - `browser_click` Click an element
21
- - `browser_type` Type text into an input
22
- - `browser_press_key` Press a keyboard key
23
- - `browser_scroll` Scroll the page or a specific element
24
- - `browser_select_option` Select an option from a native `<select>` element
25
- - `browser_hover` Hover over an element to reveal menus/tooltips
26
- - `browser_wait_for` Wait for a condition
27
- - `browser_extract` Extract page text content
28
- - `browser_wait_for_download` Wait for a file download to complete
29
- - `browser_fill_credential` Fill a stored credential into a form field
16
+ - `browser_navigate` - Navigate to a URL
17
+ - `browser_snapshot` - List interactive elements on the current page
18
+ - `browser_screenshot` - Take a visual screenshot
19
+ - `browser_close` - Close the browser page
20
+ - `browser_click` - Click an element
21
+ - `browser_type` - Type text into an input
22
+ - `browser_press_key` - Press a keyboard key
23
+ - `browser_scroll` - Scroll the page or a specific element
24
+ - `browser_select_option` - Select an option from a native `<select>` element
25
+ - `browser_hover` - Hover over an element to reveal menus/tooltips
26
+ - `browser_wait_for` - Wait for a condition
27
+ - `browser_extract` - Extract page text content
28
+ - `browser_wait_for_download` - Wait for a file download to complete
29
+ - `browser_fill_credential` - Fill a stored credential into a form field
30
30
 
31
31
  ## Capabilities
32
32
 
33
- This browser runs **full Chromium with JavaScript enabled**. It can handle SPAs, React/Vue/Angular apps, dynamic content, date pickers, booking systems, reservation flows, and any JavaScript-heavy interactive site. Never tell the user you "can't handle interactive JavaScript" you can.
33
+ This browser runs **full Chromium with JavaScript enabled**. It can handle SPAs, React/Vue/Angular apps, dynamic content, date pickers, booking systems, reservation flows, and any JavaScript-heavy interactive site. Never tell the user you "can't handle interactive JavaScript" - you can.
34
34
 
35
35
  ## Typical Workflow
36
36
 
@@ -17,7 +17,7 @@
17
17
  "type": "boolean",
18
18
  "description": "If true, allows navigation to localhost/private-network hosts. Disabled by default for SSRF safety."
19
19
  },
20
- "reason": {
20
+ "activity": {
21
21
  "type": "string",
22
22
  "description": "Brief non-technical explanation of why this tool is being called"
23
23
  }
@@ -35,7 +35,7 @@
35
35
  "input_schema": {
36
36
  "type": "object",
37
37
  "properties": {
38
- "reason": {
38
+ "activity": {
39
39
  "type": "string",
40
40
  "description": "Brief non-technical explanation of why this tool is being called"
41
41
  }
@@ -56,7 +56,7 @@
56
56
  "type": "boolean",
57
57
  "description": "Capture the full scrollable page instead of just the viewport."
58
58
  },
59
- "reason": {
59
+ "activity": {
60
60
  "type": "string",
61
61
  "description": "Brief non-technical explanation of why this tool is being called"
62
62
  }
@@ -77,7 +77,7 @@
77
77
  "type": "boolean",
78
78
  "description": "If true, close all browser pages and the browser context. Default: false (close only the current conversation page)."
79
79
  },
80
- "reason": {
80
+ "activity": {
81
81
  "type": "string",
82
82
  "description": "Brief non-technical explanation of why this tool is being called"
83
83
  }
@@ -102,7 +102,7 @@
102
102
  "type": "string",
103
103
  "description": "A CSS selector to target. Used as fallback when element_id is not available."
104
104
  },
105
- "reason": {
105
+ "activity": {
106
106
  "type": "string",
107
107
  "description": "Brief non-technical explanation of why this tool is being called"
108
108
  }
@@ -139,7 +139,7 @@
139
139
  "type": "boolean",
140
140
  "description": "If true, press Enter after typing the text."
141
141
  },
142
- "reason": {
142
+ "activity": {
143
143
  "type": "string",
144
144
  "description": "Brief non-technical explanation of why this tool is being called"
145
145
  }
@@ -169,7 +169,7 @@
169
169
  "type": "string",
170
170
  "description": "Optional CSS selector to target."
171
171
  },
172
- "reason": {
172
+ "activity": {
173
173
  "type": "string",
174
174
  "description": "Brief non-technical explanation of why this tool is being called"
175
175
  }
@@ -204,7 +204,7 @@
204
204
  "type": "string",
205
205
  "description": "Optional CSS selector of element to scroll within."
206
206
  },
207
- "reason": {
207
+ "activity": {
208
208
  "type": "string",
209
209
  "description": "Brief non-technical explanation of why this tool is being called"
210
210
  }
@@ -242,7 +242,7 @@
242
242
  "type": "number",
243
243
  "description": "The zero-based index of the <option> to select."
244
244
  },
245
- "reason": {
245
+ "activity": {
246
246
  "type": "string",
247
247
  "description": "Brief non-technical explanation of why this tool is being called"
248
248
  }
@@ -267,7 +267,7 @@
267
267
  "type": "string",
268
268
  "description": "A CSS selector to target. Used as fallback when element_id is not available."
269
269
  },
270
- "reason": {
270
+ "activity": {
271
271
  "type": "string",
272
272
  "description": "Brief non-technical explanation of why this tool is being called"
273
273
  }
@@ -300,7 +300,7 @@
300
300
  "type": "number",
301
301
  "description": "Maximum wait time in milliseconds (default and max: 30000)."
302
302
  },
303
- "reason": {
303
+ "activity": {
304
304
  "type": "string",
305
305
  "description": "Brief non-technical explanation of why this tool is being called"
306
306
  }
@@ -321,7 +321,7 @@
321
321
  "type": "boolean",
322
322
  "description": "If true, include a list of links found on the page (up to 200)."
323
323
  },
324
- "reason": {
324
+ "activity": {
325
325
  "type": "string",
326
326
  "description": "Brief non-technical explanation of why this tool is being called"
327
327
  }
@@ -342,7 +342,7 @@
342
342
  "type": "number",
343
343
  "description": "Maximum wait time in milliseconds (default: 30000, max: 120000)."
344
344
  },
345
- "reason": {
345
+ "activity": {
346
346
  "type": "string",
347
347
  "description": "Brief non-technical explanation of why this tool is being called"
348
348
  }
@@ -379,7 +379,7 @@
379
379
  "type": "boolean",
380
380
  "description": "Press Enter after filling"
381
381
  },
382
- "reason": {
382
+ "activity": {
383
383
  "type": "string",
384
384
  "description": "Brief non-technical explanation of why this tool is being called"
385
385
  }
@@ -16,12 +16,12 @@ When a user wants to import their ChatGPT conversations:
16
16
 
17
17
  1. **Tell the user how to export.** They need to go to ChatGPT → Settings → Data controls → Export data. ChatGPT will email them a ZIP file.
18
18
  2. **Ask the user to upload the ZIP file.** Use whatever file upload tools or skills are available to receive the ZIP.
19
- 3. **Run the import.** Once you have the ZIP file path, call `chatgpt_import` with the file path. Report the results how many conversations and messages were imported, and any skipped duplicates.
19
+ 3. **Run the import.** Once you have the ZIP file path, call `chatgpt_import` with the file path. Report the results - how many conversations and messages were imported, and any skipped duplicates.
20
20
 
21
21
  ## Notes
22
22
 
23
23
  - Only ZIP files are accepted (the full export archive from ChatGPT).
24
- - Conversations are deduplicated re-importing the same file will skip already-imported conversations.
24
+ - Conversations are deduplicated - re-importing the same file will skip already-imported conversations.
25
25
  - Only user and assistant messages are imported (system prompts and tool calls are filtered out).
26
26
  - Original timestamps from ChatGPT are preserved.
27
27
  - Imported conversations are automatically indexed for memory search.
@@ -13,7 +13,7 @@
13
13
  "type": "string",
14
14
  "description": "Absolute path to the ChatGPT export ZIP file"
15
15
  },
16
- "reason": {
16
+ "activity": {
17
17
  "type": "string",
18
18
  "description": "Brief non-technical explanation of why this tool is being called"
19
19
  }
@@ -175,7 +175,7 @@ export async function run(
175
175
  memoryConfig,
176
176
  );
177
177
  } catch (err) {
178
- // Indexing failure is non-fatal the message is already persisted,
178
+ // Indexing failure is non-fatal - the message is already persisted,
179
179
  // and failing here would abort the loop before conversationKeys is
180
180
  // written, causing duplicate imports on retry.
181
181
  log.warn(
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: claude-code
3
- description: Delegate coding tasks to Claude Code, an AI-powered coding agent
3
+ description: Delegate coding tasks to Claude Code
4
4
  compatibility: "Designed for Vellum personal assistants"
5
5
  metadata:
6
6
  emoji: "💻"
@@ -45,9 +45,9 @@ Do NOT delegate when:
45
45
 
46
46
  Claude Code supports scoped worker profiles that restrict tool access:
47
47
 
48
- - **general** (default) Full access to all tools.
49
- - **researcher** Read-only access. Can search, read files, and browse the web but cannot write or execute commands.
50
- - **coder** Full read/write/execute access optimized for implementation tasks.
51
- - **reviewer** Read-only access tailored for code review, with emphasis on analysis and feedback.
48
+ - **general** (default) - Full access to all tools.
49
+ - **researcher** - Read-only access. Can search, read files, and browse the web but cannot write or execute commands.
50
+ - **coder** - Full read/write/execute access optimized for implementation tasks.
51
+ - **reviewer** - Read-only access tailored for code review, with emphasis on analysis and feedback.
52
52
 
53
53
  Select the profile that best matches the task to enforce least-privilege access.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: computer-use
3
- description: Computer-use action tools for controlling the macOS desktop via accessibility and screen capture.
3
+ description: Control the macOS desktop
4
4
  compatibility: "Designed for Vellum personal assistants"
5
5
  metadata:
6
6
  emoji: "🖥️"
@@ -13,5 +13,5 @@ the macOS desktop. CU tools run through the main agent loop via HostCuProxy.
13
13
 
14
14
  The skill is internally preactivated for conversations with a connected desktop client.
15
15
 
16
- Tools in this skill are proxy tools execution is forwarded to the connected
16
+ Tools in this skill are proxy tools - execution is forwarded to the connected
17
17
  macOS client, never handled locally by the assistant.