@vellumai/assistant 0.5.16 → 0.6.0

package/src/skills/skill-memory.ts

@@ -1,17 +1,25 @@
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
+import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
 import { resolveSkillStates } from "../config/skill-state.js";
 import { loadSkillCatalog, type SkillSummary } from "../config/skills.js";
 import { getDb } from "../memory/db.js";
-import { computeMemoryFingerprint } from "../memory/fingerprint.js";
 import { enqueueMemoryJob } from "../memory/jobs-store.js";
-import { memoryItems } from "../memory/schema.js";
+import { memoryGraphNodes } from "../memory/schema.js";
 import { getLogger } from "../util/logger.js";
+import { getCachedCatalogSync } from "./catalog-cache.js";
+import type { CatalogSkill } from "./catalog-install.js";
 
 const log = getLogger("skill-memory");
 
+/** Escape SQL LIKE wildcards so they match literally.
+ * Uses backslash as the escape character — callers must pair with ESCAPE '\\'. */
+function escapeLike(s: string): string {
+  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+}
+
 /**
  * Generic input for building capability statements.
  * Decoupled from CatalogSkill so other skill sources (e.g. bundled skills) can
@@ -39,6 +47,20 @@ export function fromSkillSummary(entry: SkillSummary): SkillCapabilityInput {
   };
 }
 
+/**
+ * Convert a CatalogSkill to a SkillCapabilityInput.
+ * CatalogSkill stores display-name and hints inside nested metadata.
+ */
+export function fromCatalogSkill(entry: CatalogSkill): SkillCapabilityInput {
+  return {
+    id: entry.id,
+    displayName: entry.metadata?.vellum?.["display-name"] ?? entry.name,
+    description: entry.description,
+    activationHints: entry.metadata?.vellum?.["activation-hints"],
+    avoidWhen: entry.metadata?.vellum?.["avoid-when"],
+  };
+}
+
 /**
  * Build a semantically rich capability statement from a skill capability input.
  * Truncated to 500 chars max (matching the limit used by memory item extraction).
@@ -62,8 +84,17 @@ export function buildCapabilityStatement(input: SkillCapabilityInput): string {
   return statement;
 }
 
+/** Default emotional charge for capability graph nodes. */
+const DEFAULT_EMOTIONAL_CHARGE = JSON.stringify({
+  valence: 0,
+  intensity: 0.1,
+  decayCurve: "linear",
+  decayRate: 0.05,
+  originalIntensity: 0.1,
+});
+
 /**
- * Upsert a capability memory item for a skill.
+ * Upsert a capability memory graph node for a skill.
  * Best-effort: errors are logged but never thrown.
  */
 export function upsertSkillCapabilityMemory(
@@ -72,124 +103,121 @@ export function upsertSkillCapabilityMemory(
 ): void {
   try {
     const db = getDb();
-    const subject = `skill:${skillId}`;
     const statement = buildCapabilityStatement(input);
-    const kind = "capability";
+    const content = `skill:${skillId}\n${statement}`;
     const scopeId = "default";
-    const confidence = 1.0;
-    const importance = 0.7;
-    const fingerprint = computeMemoryFingerprint(
-      scopeId,
-      kind,
-      subject,
-      statement,
-    );
     const now = Date.now();
 
     const existing = db
       .select()
-      .from(memoryItems)
+      .from(memoryGraphNodes)
       .where(
         and(
-          eq(memoryItems.kind, kind),
-          eq(memoryItems.subject, subject),
-          eq(memoryItems.scopeId, scopeId),
+          eq(memoryGraphNodes.type, "procedural"),
+          sql`${memoryGraphNodes.content} LIKE ${'skill:' + escapeLike(skillId) + '\n%'} ESCAPE '\\'`,
+          eq(memoryGraphNodes.scopeId, scopeId),
         ),
       )
       .get();
 
     if (existing) {
       if (
-        existing.status === "active" &&
-        existing.fingerprint === fingerprint
+        existing.content === content &&
+        existing.fidelity !== "gone"
       ) {
-        // Same content — just touch lastSeenAt
-        db.update(memoryItems)
-          .set({ lastSeenAt: now })
-          .where(eq(memoryItems.id, existing.id))
+        // Same content — just touch lastAccessed
+        db.update(memoryGraphNodes)
+          .set({ lastAccessed: now })
+          .where(eq(memoryGraphNodes.id, existing.id))
           .run();
         return;
       }
 
-      if (existing.status === "active") {
-        // Content changed — update statement and fingerprint
-        db.update(memoryItems)
+      if (existing.fidelity !== "gone") {
+        // Content changed — update content
+        db.update(memoryGraphNodes)
           .set({
-            statement,
-            fingerprint,
-            lastSeenAt: now,
+            content,
+            lastAccessed: now,
           })
-          .where(eq(memoryItems.id, existing.id))
+          .where(eq(memoryGraphNodes.id, existing.id))
           .run();
-        enqueueMemoryJob("embed_item", { itemId: existing.id });
+        enqueueMemoryJob("embed_graph_node", { nodeId: existing.id });
         return;
       }
 
-      // status === "deleted" or other — reactivate
-      db.update(memoryItems)
+      // fidelity === "gone" — reactivate
+      db.update(memoryGraphNodes)
         .set({
-          status: "active",
-          statement,
-          fingerprint,
-          lastSeenAt: now,
-          firstSeenAt: now,
+          fidelity: "vivid",
+          content,
+          created: now,
+          lastAccessed: now,
         })
-        .where(eq(memoryItems.id, existing.id))
+        .where(eq(memoryGraphNodes.id, existing.id))
         .run();
-      enqueueMemoryJob("embed_item", { itemId: existing.id });
+      enqueueMemoryJob("embed_graph_node", { nodeId: existing.id });
+      log.info({ skillId, nodeId: existing.id }, "Reactivated skill capability memory");
       return;
     }
 
-    // No existing — insert new row
+    // No existing — insert new graph node
     const id = uuid();
-    db.insert(memoryItems)
+    db.insert(memoryGraphNodes)
       .values({
         id,
-        kind,
-        subject,
-        statement,
-        status: "active",
-        confidence,
-        importance,
-        fingerprint,
-        sourceType: "extraction",
+        content,
+        type: "procedural",
+        created: now,
+        lastAccessed: now,
+        lastConsolidated: now,
+        emotionalCharge: DEFAULT_EMOTIONAL_CHARGE,
+        fidelity: "vivid",
+        confidence: 1.0,
+        significance: 0.7,
+        stability: 14,
+        reinforcementCount: 0,
+        lastReinforced: now,
+        sourceConversations: JSON.stringify([]),
+        sourceType: "inferred",
+        narrativeRole: null,
+        partOfStory: null,
         scopeId,
-        firstSeenAt: now,
-        lastSeenAt: now,
       })
       .run();
-    enqueueMemoryJob("embed_item", { itemId: id });
+    enqueueMemoryJob("embed_graph_node", { nodeId: id });
+    log.info({ skillId, nodeId: id }, "Created skill capability memory");
   } catch (err) {
     log.warn({ err, skillId }, "Failed to upsert skill capability memory");
   }
 }
 
 /**
- * Soft-delete the capability memory item for a skill.
+ * Soft-delete the capability memory graph node for a skill.
  * Best-effort: errors are logged but never thrown.
  */
 export function deleteSkillCapabilityMemory(skillId: string): void {
   try {
     const db = getDb();
-    const subject = `skill:${skillId}`;
     const now = Date.now();
 
     const existing = db
       .select()
-      .from(memoryItems)
+      .from(memoryGraphNodes)
       .where(
         and(
-          eq(memoryItems.kind, "capability"),
-          eq(memoryItems.subject, subject),
-          eq(memoryItems.scopeId, "default"),
+          eq(memoryGraphNodes.type, "procedural"),
+          sql`${memoryGraphNodes.content} LIKE ${'skill:' + escapeLike(skillId) + '\n%'} ESCAPE '\\'`,
+          eq(memoryGraphNodes.scopeId, "default"),
+          sql`${memoryGraphNodes.fidelity} != 'gone'`,
         ),
       )
       .get();
 
-    if (existing && existing.status !== "deleted") {
-      db.update(memoryItems)
-        .set({ status: "deleted", lastSeenAt: now })
-        .where(eq(memoryItems.id, existing.id))
+    if (existing) {
+      db.update(memoryGraphNodes)
+        .set({ fidelity: "gone", lastAccessed: now })
+        .where(eq(memoryGraphNodes.id, existing.id))
         .run();
     }
   } catch (err) {
@@ -198,7 +226,7 @@ export function deleteSkillCapabilityMemory(skillId: string): void {
 }
 
 /**
- * Seed capability memory items for all enabled skills (bundled, managed, workspace, extra).
+ * Seed capability memory graph nodes for all enabled skills (bundled, managed, workspace, extra).
  * Prunes stale entries whose skills are no longer in the enabled set.
  * Best-effort: errors are logged but never thrown.
  */
@@ -231,31 +259,78 @@ export function seedCatalogSkillMemories(): void {
     }
 
     // Prune stale capability memories for skills no longer in the enabled set
+    // and not available in the remote/local catalog.
     const db = getDb();
     const allCapabilities = db
       .select()
-      .from(memoryItems)
+      .from(memoryGraphNodes)
       .where(
         and(
-          eq(memoryItems.kind, "capability"),
-          eq(memoryItems.scopeId, "default"),
-          eq(memoryItems.status, "active"),
+          eq(memoryGraphNodes.type, "procedural"),
+          eq(memoryGraphNodes.scopeId, "default"),
+          sql`${memoryGraphNodes.fidelity} != 'gone'`,
         ),
       )
       .all();
 
+    const allLocalSkillIds = new Set(catalog.map((s) => s.id));
+    const cachedCatalog = getCachedCatalogSync();
+    const cachedCatalogIds = new Set(cachedCatalog.map((s) => s.id));
+
     const now = Date.now();
     for (const item of allCapabilities) {
-      if (!item.subject.startsWith("skill:")) continue;
-      const itemSkillId = item.subject.replace("skill:", "");
-      if (!catalogIds.has(itemSkillId)) {
-        db.update(memoryItems)
-          .set({ status: "deleted", lastSeenAt: now })
-          .where(eq(memoryItems.id, item.id))
-          .run();
-      }
+      if (!item.content.startsWith("skill:")) continue;
+      const itemSkillId = item.content.split("\n")[0].replace("skill:", "");
+
+      // Keep enabled skills
+      if (catalogIds.has(itemSkillId)) continue;
+
+      // Keep uninstalled catalog skills that are still in the remote catalog
+      if (cachedCatalogIds.has(itemSkillId)) continue;
+
+      // If the catalog cache is empty (cold start, before async fetch),
+      // we can't tell whether an unknown skill is a stale entry or
+      // a valid uninstalled catalog skill. Only prune skills we can
+      // positively identify as local-but-disabled.
+      if (cachedCatalogIds.size === 0 && !allLocalSkillIds.has(itemSkillId)) continue;
+
+      log.info({ skillId: itemSkillId, nodeId: item.id, catalogSize: catalogIds.size, cacheSize: cachedCatalogIds.size }, "Pruning stale skill capability memory");
+      db.update(memoryGraphNodes)
+        .set({ fidelity: "gone", lastAccessed: now })
+        .where(eq(memoryGraphNodes.id, item.id))
+        .run();
     }
   } catch (err) {
     log.warn({ err }, "Failed to seed catalog skill memories");
   }
 }
+
+/**
+ * Seed capability memories for catalog skills that are not yet installed.
+ * This makes uninstalled skills discoverable via memory injection so the LLM
+ * can auto-install them via skill_load when relevant.
+ * Best-effort: errors are logged but never thrown.
+ */
+export async function seedUninstalledCatalogSkillMemories(): Promise<void> {
+  try {
+    const { getCatalog } = await import("./catalog-cache.js");
+    const fullCatalog = await getCatalog();
+    if (fullCatalog.length === 0) return;
+
+    const installedCatalog = loadSkillCatalog();
+    const installedIds = new Set(installedCatalog.map((s) => s.id));
+
+    const config = getConfig();
+    for (const entry of fullCatalog) {
+      if (installedIds.has(entry.id)) continue;
+
+      const flagKey = entry.metadata?.vellum?.["feature-flag"];
+      if (flagKey && !isAssistantFeatureFlagEnabled(flagKey, config)) continue;
+
+      const input = fromCatalogSkill(entry);
+      upsertSkillCapabilityMemory(entry.id, input);
+    }
+  } catch (err) {
+    log.warn({ err }, "Failed to seed uninstalled catalog skill memories");
+  }
+}

package/src/skills/skillssh-registry.ts

@@ -5,6 +5,7 @@ import { dirname, join, resolve, sep } from "node:path";
 
 import { getWorkspaceSkillsDir } from "../util/platform.js";
 import { upsertSkillsIndex } from "./catalog-install.js";
+import { computeSkillHash, writeInstallMeta } from "./install-meta.js";
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -434,9 +435,12 @@ export function validateSkillSlug(slug: string): void {
  * 1. Validates the skill slug for path safety
  * 2. Fetches all files from `skills/<skillSlug>/` in the source repo
  * 3. Writes them to `<workspace>/skills/<skillSlug>/` with path traversal protection
- * 4. Writes `version.json` with origin metadata
- * 5. Runs `bun install` if a `package.json` is present
- * 6. Registers the skill in SKILLS.md only after all steps succeed
+ * 4. Writes `install-meta.json` with origin metadata
+ * 5. Installs npm dependencies (if package.json exists)
+ * 6. Updates SKILLS.md index
+ *
+ * Auto-enable and memory seeding are handled by the caller (e.g.
+ * `postInstallSkill()` in the daemon, or left to the user for CLI installs).
  */
 export async function installExternalSkill(
   owner: string,
@@ -444,6 +448,7 @@ export async function installExternalSkill(
   skillSlug: string,
   overwrite: boolean,
   ref?: string,
+  contactId?: string,
 ): Promise<void> {
   // Validate slug before using in filesystem paths
   validateSkillSlug(skillSlug);
@@ -480,20 +485,19 @@ export async function installExternalSkill(
     writeFileSync(destPath, content, "utf-8");
   }
 
-  // Write origin metadata
-  const meta = {
-    origin: "skills.sh",
-    source: `${owner}/${repo}`,
-    skillSlug,
+  // Write install metadata
+  writeInstallMeta(skillDir, {
+    origin: "skillssh",
+    slug: skillSlug,
+    sourceRepo: `${owner}/${repo}`,
     installedAt: new Date().toISOString(),
-  };
-  writeFileSync(
-    join(skillDir, "version.json"),
-    JSON.stringify(meta, null, 2) + "\n",
-    "utf-8",
-  );
+    ...(contactId ? { installedBy: contactId } : {}),
+    contentHash: computeSkillHash(skillDir) ?? undefined,
+  });
 
-  // Install npm dependencies if the skill ships a package.json
+  // Post-install: install dependencies first, then index the skill.
+  // Running bun install before upsertSkillsIndex ensures we don't index a
+  // skill whose dependencies failed to install.
   if (existsSync(join(skillDir, "package.json"))) {
     const bunPath = `${homedir()}/.bun/bin`;
     execSync("bun install", {
@@ -502,7 +506,5 @@ export async function installExternalSkill(
       env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
     });
   }
-
-  // Register in SKILLS.md only after files are written and deps installed
   upsertSkillsIndex(skillSlug);
 }

package/src/tasks/task-runner.ts

@@ -64,8 +64,10 @@ export async function runTask(
     // Scheduled section; non-schedule tasks use "background" to stay out of
     // the main conversation list.
     conversationType: opts.source === "schedule" ? undefined : "background",
-    source: opts.source,
+    source: opts.source === "schedule" ? "schedule" : "task",
     scheduleJobId: opts.scheduleJobId,
+    groupId:
+      opts.source === "schedule" ? "system:scheduled" : "system:background",
     origin: "task",
     systemHint: `Task: ${task.title}`,
   });

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -504,17 +504,15 @@ describe("UsageTelemetryReporter", () => {
     // No HTTP call should have been made
     expect(mockFetch).not.toHaveBeenCalled();
 
-    // All 6 watermarks should have been advanced (3 timestamps + 3 IDs)
-    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(6);
+    // All 3 timestamp watermarks should have been advanced (IDs left untouched
+    // so the compound-cursor branch stays active)
+    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(3);
 
     const calls = mockSetMemoryCheckpoint.mock.calls;
     const keys = calls.map((c) => c[0]);
     expect(keys).toContain("telemetry:usage:last_reported_at");
-    expect(keys).toContain("telemetry:usage:last_reported_id");
     expect(keys).toContain("telemetry:turns:last_reported_at");
-    expect(keys).toContain("telemetry:turns:last_reported_id");
     expect(keys).toContain("telemetry:lifecycle:last_reported_at");
-    expect(keys).toContain("telemetry:lifecycle:last_reported_id");
   });
 
   test("events sent normally after re-enabling collectUsageData", async () => {

package/src/tools/browser/runtime-check.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { ensureBun } from "../../util/bun-runtime.js";
 import { getExternalDir } from "../../util/platform.js";
 
 export interface BrowserRuntimeStatus {
@@ -83,7 +84,8 @@ export async function importPlaywright(): Promise<typeof import("playwright")> {
     if (!existsSync(join(externalDir, "package.json"))) {
       writeFileSync(join(externalDir, "package.json"), '{"private":true}\n');
     }
-    const proc = Bun.spawn(["bun", "add", "playwright"], {
+    const bunPath = await ensureBun();
+    const proc = Bun.spawn([bunPath, "add", "playwright"], {
       cwd: externalDir,
       stdout: "pipe",
       stderr: "pipe",

package/src/tools/memory/register.ts

@@ -1,67 +1,56 @@
 import { getConfig } from "../../config/loader.js";
+import {
+  handleRecall,
+  handleRemember,
+  type RecallInput,
+  type RememberInput,
+} from "../../memory/graph/tool-handlers.js";
+import {
+  graphRecallDefinition,
+  graphRememberDefinition,
+} from "../../memory/graph/tools.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
-import {
-  memoryManageDefinition,
-  memoryRecallDefinition,
-} from "./definitions.js";
-import {
-  handleMemoryDelete,
-  handleMemoryRecall,
-  handleMemorySave,
-  handleMemoryUpdate,
-} from "./handlers.js";
 
-// ── memory_manage ────────────────────────────────────────────────────
+// ── remember ────────────────────────────────────────────────────────
 
-class MemoryManageTool implements Tool {
-  name = "memory_manage";
-  description = memoryManageDefinition.description;
+class RememberTool implements Tool {
+  name = "remember";
+  description = graphRememberDefinition.description;
   category = "memory";
   defaultRiskLevel = RiskLevel.Low;
 
   getDefinition(): ToolDefinition {
-    return memoryManageDefinition;
+    return graphRememberDefinition;
   }
 
   async execute(
     input: Record<string, unknown>,
     context: ToolContext,
   ): Promise<ToolExecutionResult> {
-    const config = getConfig();
-    switch (input.op) {
-      case "save":
-        return handleMemorySave(
-          input,
-          config,
-          context.conversationId,
-          context.requestId,
-          context.memoryScopeId,
-        );
-      case "update":
-        return handleMemoryUpdate(input, config, context.memoryScopeId);
-      case "delete":
-        return handleMemoryDelete(input, config, context.memoryScopeId);
-      default:
-        return {
-          content: `Error: unknown op "${input.op}". Must be one of: save, update, delete`,
-          isError: true,
-        };
-    }
+    const result = handleRemember(
+      input as unknown as RememberInput,
+      context.conversationId,
+      context.memoryScopeId ?? "default",
+    );
+    return {
+      content: result.message,
+      isError: !result.success,
+    };
   }
 }
 
-// ── memory_recall ────────────────────────────────────────────────────
+// ── recall ──────────────────────────────────────────────────────────
 
-class MemoryRecallTool implements Tool {
-  name = "memory_recall";
-  description = memoryRecallDefinition.description;
+class RecallTool implements Tool {
+  name = "recall";
+  description = graphRecallDefinition.description;
   category = "memory";
   defaultRiskLevel = RiskLevel.Low;
 
   getDefinition(): ToolDefinition {
-    return memoryRecallDefinition;
+    return graphRecallDefinition;
   }
 
   async execute(
@@ -69,16 +58,44 @@ class MemoryRecallTool implements Tool {
     context: ToolContext,
   ): Promise<ToolExecutionResult> {
     const config = getConfig();
-    return handleMemoryRecall(
-      input,
+    const result = await handleRecall(
+      input as unknown as RecallInput,
       config,
-      context.memoryScopeId,
-      context.conversationId,
+      context.memoryScopeId ?? "default",
     );
+
+    if (result.results.length === 0) {
+      return { content: "No results found.", isError: false };
+    }
+
+    const formatted = result.results
+      .map((r) => {
+        const ts = formatTimestamp(r.created);
+        const meta =
+          result.mode === "memory"
+            ? `[${r.type}] ${ts} (confidence: ${r.confidence.toFixed(2)}, score: ${r.score.toFixed(3)})`
+            : `[archive] ${ts}`;
+        return `${meta}\n${r.content}`;
+      })
+      .join("\n\n---\n\n");
+
+    return { content: formatted, isError: false };
   }
 }
 
+// ── Helpers ─────────────────────────────────────────────────────────
+
+function formatTimestamp(epochMs: number): string {
+  const d = new Date(epochMs);
+  const mm = String(d.getMonth() + 1).padStart(2, "0");
+  const dd = String(d.getDate()).padStart(2, "0");
+  const yy = String(d.getFullYear()).slice(-2);
+  const hh = String(d.getHours()).padStart(2, "0");
+  const min = String(d.getMinutes()).padStart(2, "0");
+  return `${mm}/${dd}/${yy} ${hh}:${min}`;
+}
+
 // ── Exported tool instances ──────────────────────────────────────────
 
-export const memoryManageTool = new MemoryManageTool();
-export const memoryRecallTool = new MemoryRecallTool();
+export const rememberTool = new RememberTool();
+export const recallTool = new RecallTool();

package/src/tools/permission-checker.ts

@@ -8,6 +8,7 @@ import {
 } from "../permissions/checker.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import { addRule } from "../permissions/trust-store.js";
+import { RiskLevel } from "../permissions/types.js";
 import {
   getEffectiveMode,
   setConversationMode,
@@ -145,6 +146,10 @@ export class PermissionChecker {
         // Exception: inline-command skill loads (skill_load_dynamic:*) must
         // never be silently auto-approved — they execute embedded commands
         // and require explicit human review or a pinned trust rule.
+        // Exception: high-risk tools (e.g. destructive shell commands, writes
+        // to sensitive paths) are denied — unattended sessions must not
+        // auto-approve operations that could cause significant damage if
+        // triggered by prompt injection from untrusted content.
         const isDynamicSkillLoad =
           result.matchedRule?.pattern.startsWith("skill_load_dynamic:") ===
           true;
@@ -152,7 +157,8 @@ export class PermissionChecker {
           context.isInteractive === false &&
           context.trustClass === "guardian" &&
           !context.requireFreshApproval &&
-          !isDynamicSkillLoad
+          !isDynamicSkillLoad &&
+          riskLevel !== RiskLevel.High
         ) {
           log.info(
             { toolName: name, riskLevel },