@vellumai/assistant 0.5.16 → 0.6.1

package/src/schedule/scheduler.ts

@@ -1,4 +1,5 @@
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
+import { getConversation } from "../memory/conversation-crud.js";
 import { invalidateAssistantInferredItemsForConversation } from "../memory/task-memory-cleanup.js";
 import { runSequencesOnce } from "../sequence/engine.js";
 import { getLogger } from "../util/logger.js";
@@ -14,6 +15,7 @@ import {
   completeScheduleRun,
   createScheduleRun,
   failOneShot,
+  getLastScheduleConversationId,
   type RoutingIntent,
 } from "./schedule-store.js";
 
@@ -188,7 +190,12 @@ async function runScheduleOnce(
         );
         const { runTask } = await import("../tasks/task-runner.js");
         const result = await runTask(
-          { taskId, workingDir: process.cwd(), source: "schedule", scheduleJobId: job.id },
+          {
+            taskId,
+            workingDir: process.cwd(),
+            source: "schedule",
+            scheduleJobId: job.id,
+          },
           processMessage as (
             conversationId: string,
             message: string,
@@ -235,8 +242,10 @@ async function runScheduleOnce(
         );
         // Create a fallback conversation for the schedule run record
         const fallbackConversation = bootstrapConversation({
+          conversationType: "scheduled",
           source: "schedule",
           scheduleJobId: job.id,
+          groupId: "system:scheduled",
           origin: "schedule",
           systemHint: `Schedule: ${job.name}`,
         });
@@ -252,18 +261,36 @@ async function runScheduleOnce(
       continue;
     }
 
-    const conversation = bootstrapConversation({
-      source: "schedule",
-      scheduleJobId: job.id,
-      origin: "schedule",
-      systemHint: isOneShot ? `Reminder: ${job.name}` : `Schedule: ${job.name}`,
-    });
+    // Reuse the conversation from the last successful run when the flag is set
+    // and a prior conversation still exists; otherwise bootstrap a new one.
+    let conversationId: string | null = null;
+    let conversationReused = false;
+    if (job.reuseConversation && !isOneShot) {
+      const lastId = getLastScheduleConversationId(job.id);
+      if (lastId && getConversation(lastId)) {
+        conversationId = lastId;
+        conversationReused = true;
+      }
+    }
+    if (!conversationId) {
+      const conversation = bootstrapConversation({
+        conversationType: "scheduled",
+        source: "schedule",
+        scheduleJobId: job.id,
+        groupId: "system:scheduled",
+        origin: "schedule",
+        systemHint: isOneShot
+          ? `Reminder: ${job.name}`
+          : `Schedule: ${job.name}`,
+      });
+      conversationId = conversation.id;
+    }
     onScheduleConversationCreated?.({
-      conversationId: conversation.id,
+      conversationId,
       scheduleJobId: job.id,
       title: job.name,
     });
-    const runId = createScheduleRun(job.id, conversation.id);
+    const runId = createScheduleRun(job.id, conversationId);
     const isRruleSetMsg =
       job.syntax === "rrule" &&
       job.expression != null &&
@@ -278,11 +305,11 @@ async function runScheduleOnce(
           expression: job.expression,
           isRruleSet: isRruleSetMsg,
           isOneShot,
-          conversationId: conversation.id,
+          conversationId,
         },
         isOneShot ? "Executing one-shot schedule" : "Executing schedule",
       );
-      await processMessage(conversation.id, job.message, {
+      await processMessage(conversationId, job.message, {
         trustClass: "guardian",
       });
       completeScheduleRun(runId, { status: "ok" });
@@ -310,13 +337,20 @@ async function runScheduleOnce(
       completeScheduleRun(runId, { status: "error", error: message });
       if (isOneShot) failOneShot(job.id);
 
-      try {
-        invalidateAssistantInferredItemsForConversation(conversation.id);
-      } catch (cleanupErr) {
-        log.warn(
-          { err: cleanupErr, conversationId: conversation.id },
-          "Failed to invalidate assistant-inferred memory items",
-        );
+      // Only skip invalidation when the conversation was *actually* reused,
+      // i.e. it contains prior successful context worth preserving. When
+      // reuseConversation is true but no prior conversation existed (first run
+      // or deleted), the conversation is brand-new and should be invalidated
+      // like any other failed conversation.
+      if (!conversationReused) {
+        try {
+          invalidateAssistantInferredItemsForConversation(conversationId);
+        } catch (cleanupErr) {
+          log.warn(
+            { err: cleanupErr, conversationId },
+            "Failed to invalidate assistant-inferred memory items",
+          );
+        }
       }
     }
   }

package/src/security/oauth2.ts

@@ -61,7 +61,7 @@ export interface OAuth2TokenResult {
 
 export interface OAuth2FlowCallbacks {
   /** Open a URL in the user's browser (e.g. via `open_url` message). */
-  openUrl: (url: string) => void;
+  openUrl: (url: string) => void | Promise<void>;
 }
 
 export interface OAuth2FlowOptions {

package/src/security/secure-keys.ts

@@ -22,9 +22,9 @@ import type {
   SecureKeyDeleteResult,
 } from "@vellumai/credential-storage";
 
-import providerEnvVarsRegistry from "../../../meta/provider-env-vars.json" with { type: "json" };
 import { getIsContainerized } from "../config/env-registry.js";
 import type { CesClient } from "../credential-execution/client.js";
+import { PROVIDER_ENV_VAR_NAMES } from "../shared/provider-env-vars.js";
 import { getLogger } from "../util/logger.js";
 import { createCesCredentialBackend } from "./ces-credential-client.js";
 import { CesRpcCredentialBackend } from "./ces-rpc-credential-backend.js";
@@ -395,14 +395,10 @@ export async function deleteSecureKeyAsync(
 // ---------------------------------------------------------------------------
 
 /**
- * Env var names keyed by provider. Loaded from the shared registry at
- * `meta/provider-env-vars.json` — the single source of truth also consumed
- * by the CLI and the macOS client.
- * Ollama is intentionally omitted from the registry — it doesn't require
- * an API key.
+ * Env var names keyed by provider.
+ * Ollama is intentionally omitted — it doesn't require an API key.
  */
-const PROVIDER_ENV_VARS: Record<string, string> =
-  providerEnvVarsRegistry.providers;
+const PROVIDER_ENV_VARS: Record<string, string> = PROVIDER_ENV_VAR_NAMES;
 
 /**
  * Retrieve a provider API key, checking secure storage first and falling

package/src/shared/provider-env-vars.ts

@@ -0,0 +1,19 @@
+/**
+ * Provider API key environment variable names, keyed by provider ID.
+ *
+ * Keep in sync with:
+ *   - cli/src/shared/provider-env-vars.ts
+ *   - meta/provider-env-vars.json  (consumed by the macOS client build)
+ *
+ * Once a consolidated shared package exists in packages/, all three
+ * copies can be replaced by a single import.
+ */
+export const PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY",
+  gemini: "GEMINI_API_KEY",
+  fireworks: "FIREWORKS_API_KEY",
+  openrouter: "OPENROUTER_API_KEY",
+  brave: "BRAVE_API_KEY",
+  perplexity: "PERPLEXITY_API_KEY",
+};

package/src/skills/catalog-cache.ts

@@ -37,6 +37,11 @@ export async function getCatalog(): Promise<CatalogSkill[]> {
   return catalog;
 }
 
+/** Return the cached catalog synchronously, or [] if no cache exists yet. */
+export function getCachedCatalogSync(): CatalogSkill[] {
+  return cachedCatalog ?? [];
+}
+
 /** Invalidate the cache (for testing or forced refresh). */
 export function invalidateCatalogCache(): void {
   cachedCatalog = null;

package/src/skills/catalog-install.ts

@@ -14,9 +14,10 @@ import { dirname, join, posix, resolve, sep } from "node:path";
 import { gunzipSync } from "node:zlib";
 
 import { getPlatformBaseUrl } from "../config/env.js";
+import { deleteSkillCapabilityNode } from "../memory/graph/capability-seed.js";
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceSkillsDir, readPlatformToken } from "../util/platform.js";
-import { deleteSkillCapabilityMemory } from "./skill-memory.js";
+import { computeSkillHash, writeInstallMeta } from "./install-meta.js";
 
 const log = getLogger("catalog-install");
 
@@ -263,13 +264,14 @@ export function uninstallSkillLocally(skillId: string): void {
 
   rmSync(skillDir, { recursive: true, force: true });
   removeSkillsIndexEntry(skillId);
-  deleteSkillCapabilityMemory(skillId);
+  deleteSkillCapabilityNode(skillId);
 }
 
 export async function installSkillLocally(
   skillId: string,
   catalogEntry: CatalogSkill,
   overwrite: boolean,
+  contactId?: string,
 ): Promise<void> {
   const skillDir = join(getWorkspaceSkillsDir(), skillId);
   const skillFilePath = join(skillDir, "SKILL.md");
@@ -294,19 +296,18 @@ export async function installSkillLocally(
     await fetchAndExtractSkill(skillId, skillDir);
   }
 
-  // Write version metadata
-  if (catalogEntry.version) {
-    const meta = {
-      version: catalogEntry.version,
-      installedAt: new Date().toISOString(),
-    };
-    atomicWriteFile(
-      join(skillDir, "version.json"),
-      JSON.stringify(meta, null, 2) + "\n",
-    );
-  }
+  // Write install metadata
+  writeInstallMeta(skillDir, {
+    origin: "vellum",
+    installedAt: new Date().toISOString(),
+    ...(catalogEntry.version ? { version: catalogEntry.version } : {}),
+    ...(contactId ? { installedBy: contactId } : {}),
+    contentHash: computeSkillHash(skillDir) ?? undefined,
+  });
 
-  // Install npm dependencies if the skill has a package.json
+  // Post-install: install dependencies first, then index the skill.
+  // Running bun install before upsertSkillsIndex ensures we don't index a
+  // skill whose dependencies failed to install.
   if (existsSync(join(skillDir, "package.json"))) {
     const bunPath = `${homedir()}/.bun/bin`;
     execSync("bun install", {
@@ -315,8 +316,6 @@ export async function installSkillLocally(
       env: { ...process.env, PATH: `${bunPath}:${process.env.PATH}` },
     });
   }
-
-  // Register in SKILLS.md only after all steps succeed
   upsertSkillsIndex(skillId);
 }
 
@@ -393,6 +392,16 @@ export async function autoInstallFromCatalog(
     return false;
   }
 
+  // If the skill already exists on disk (stale index), re-index it instead
+  // of attempting a fresh install that would fail.
+  const skillDir = join(getWorkspaceSkillsDir(), skillId);
+  if (existsSync(join(skillDir, "SKILL.md"))) {
+    upsertSkillsIndex(skillId);
+    return true;
+  }
+
+  // installSkillLocally handles dependency installation and SKILLS.md indexing.
   await installSkillLocally(skillId, entry, false);
+
   return true;
 }

package/src/skills/clawhub.ts

@@ -1,14 +1,13 @@
-import {
-  existsSync,
-  readdirSync,
-  readFileSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceSkillsDir } from "../util/platform.js";
+import {
+  computeSkillHash,
+  readInstallMeta,
+  writeInstallMeta,
+} from "./install-meta.js";
 
 const log = getLogger("clawhub");
 
@@ -54,61 +53,15 @@ export function loadIntegrityManifest(): IntegrityManifest {
   }
 }
 
-function saveIntegrityManifest(manifest: IntegrityManifest): void {
-  writeFileSync(
-    getIntegrityPath(),
-    JSON.stringify(manifest, null, 2) + "\n",
-    "utf-8",
-  );
-}
-
-/** Collect all file contents in a directory tree, sorted by relative path for determinism. */
-function collectFileContents(
-  dir: string,
-  prefix = "",
-): Array<{ relPath: string; content: Buffer }> {
-  const results: Array<{ relPath: string; content: Buffer }> = [];
-  if (!existsSync(dir)) return results;
-
-  const entries = readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
-    const fullPath = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...collectFileContents(fullPath, relPath));
-    } else if (entry.isFile()) {
-      results.push({ relPath, content: readFileSync(fullPath) });
-    }
-  }
-  return results.sort((a, b) => a.relPath.localeCompare(b.relPath));
-}
-
-/**
- * Compute a SHA-256 hash over all files in a skill directory.
- * Returns format: "v2:sha256hex" (version prefix added to support hash format evolution).
- */
-function computeSkillHash(skillDir: string): string | null {
-  if (!existsSync(skillDir) || !statSync(skillDir).isDirectory()) return null;
-
-  const files = collectFileContents(skillDir);
-  if (files.length === 0) return null;
-
-  const hasher = new Bun.CryptoHasher("sha256");
-  for (const file of files) {
-    // Length-prefix each segment to prevent boundary ambiguity collisions
-    const pathBuf = Buffer.from(file.relPath, "utf-8");
-    hasher.update(`${pathBuf.length}:`);
-    hasher.update(pathBuf);
-    hasher.update(`${file.content.length}:`);
-    hasher.update(file.content);
-  }
-  return `v2:${hasher.digest("hex")}`;
-}
-
 /**
  * Record or verify the content hash of an installed skill.
  * On first install: stores the hash (trust-on-first-use).
  * On subsequent installs: compares with stored hash and warns on mismatch.
+ *
+ * Always writes to `install-meta.json`. For skills that don't have one yet,
+ * creates a new `install-meta.json` with minimal metadata. Reads from the
+ * legacy `.integrity.json` manifest as a read-only fallback for stored hashes
+ * from skills that haven't been migrated yet.
  */
 export function verifyAndRecordSkillHash(slug: string): void {
   const skillDir = join(getManagedSkillsDir(), slug);
@@ -118,17 +71,28 @@ export function verifyAndRecordSkillHash(slug: string): void {
     return;
   }
 
-  const manifest = loadIntegrityManifest();
-  const existing = manifest[slug];
+  // Try install-meta.json first for stored hash
+  const installMeta = readInstallMeta(skillDir);
+  let storedHash: string | undefined;
 
-  if (existing) {
-    const storedHash = existing.sha256;
+  if (installMeta?.contentHash) {
+    storedHash = installMeta.contentHash;
+  } else {
+    // Fall back to legacy .integrity.json manifest
+    const manifest = loadIntegrityManifest();
+    const existing = manifest[slug];
+    if (existing) {
+      storedHash =
+        typeof existing.sha256 === "string" ? existing.sha256 : undefined;
+    }
+  }
 
-    // Guard against corrupted manifest entries where sha256 is not a string
+  if (storedHash) {
+    // Guard against corrupted entries where hash is not a string
     if (typeof storedHash !== "string") {
       log.warn(
         { slug },
-        "Integrity manifest entry has non-string sha256 — re-recording hash",
+        "Stored hash has non-string value — re-recording hash",
       );
     } else if (!storedHash.startsWith("v2:")) {
       // Unknown format (not v2: prefix) — warn about integrity mismatch
@@ -155,9 +119,18 @@ export function verifyAndRecordSkillHash(slug: string): void {
     );
   }
 
-  // Always store the latest hash
-  manifest[slug] = { sha256: hash, installedAt: new Date().toISOString() };
-  saveIntegrityManifest(manifest);
+  // Write to install-meta.json (preferred). If no install-meta exists yet,
+  // create one with minimal metadata.
+  if (installMeta) {
+    writeInstallMeta(skillDir, { ...installMeta, contentHash: hash });
+  } else {
+    writeInstallMeta(skillDir, {
+      origin: "clawhub",
+      installedAt: new Date().toISOString(),
+      slug,
+      contentHash: hash,
+    });
+  }
 }
 
 interface ClawhubInstallResult {
@@ -248,7 +221,7 @@ async function runClawhub(
 
 export async function clawhubInstall(
   slug: string,
-  opts?: { version?: string },
+  opts?: { version?: string; contactId?: string },
 ): Promise<ClawhubInstallResult> {
   if (!validateSlug(slug)) {
     return { success: false, error: `Invalid skill slug: ${slug}` };
@@ -264,7 +237,19 @@ export async function clawhubInstall(
         result.stderr.trim() || result.stdout.trim() || "Unknown error";
       return { success: false, error };
     }
-    verifyAndRecordSkillHash(slug);
+
+    // Write install-meta.json for the installed skill.
+    // contentHash is included here, so there's no need to call
+    // verifyAndRecordSkillHash() — it would just rewrite the same data.
+    const skillDir = join(getManagedSkillsDir(), slug);
+    writeInstallMeta(skillDir, {
+      origin: "clawhub",
+      slug,
+      installedAt: new Date().toISOString(),
+      ...(opts?.contactId ? { installedBy: opts.contactId } : {}),
+      contentHash: computeSkillHash(skillDir) ?? undefined,
+    });
+
     return { success: true, skillName: slug };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -292,63 +277,63 @@ export async function clawhubUpdate(
 
 export async function clawhubSearch(
   query: string,
+  opts?: { limit?: number },
 ): Promise<ClawhubSearchResult> {
+  const limit = opts?.limit ?? 25;
+
   // Empty query: use explore (browse trending) instead of search
   if (!query.trim()) {
-    return clawhubExplore();
+    return clawhubExplore({ limit });
   }
 
+  const result = await runClawhub(["search", query, "--limit", String(limit)]);
+  if (result.exitCode !== 0) {
+    const error =
+      result.stderr.trim() || result.stdout.trim() || "Unknown error";
+    throw new Error(`clawhub search failed: ${error}`);
+  }
+  // Try JSON first
   try {
-    const result = await runClawhub(["search", query, "--limit", "25"]);
-    if (result.exitCode !== 0) {
-      return { skills: [] };
+    const parsed = JSON.parse(result.stdout);
+    if (Array.isArray(parsed)) {
+      return {
+        skills: parsed.map((s: ClawhubSearchResultItem) => ({
+          ...s,
+          source: s.source ?? ("clawhub" as const),
+        })),
+      };
     }
-    // Try JSON first
-    try {
-      const parsed = JSON.parse(result.stdout);
-      if (Array.isArray(parsed)) {
-        return {
-          skills: parsed.map((s: ClawhubSearchResultItem) => ({
-            ...s,
-            source: s.source ?? ("clawhub" as const),
-          })),
-        };
-      }
-      if (parsed.skills && Array.isArray(parsed.skills)) {
-        return {
-          skills: parsed.skills.map((s: ClawhubSearchResultItem) => ({
-            ...s,
-            source: s.source ?? ("clawhub" as const),
-          })),
-        };
-      }
-    } catch {
-      // CLI outputs text: "slug vVersion  DisplayName  (score)"
+    if (parsed.skills && Array.isArray(parsed.skills)) {
+      return {
+        skills: parsed.skills.map((s: ClawhubSearchResultItem) => ({
+          ...s,
+          source: s.source ?? ("clawhub" as const),
+        })),
+      };
     }
+  } catch {
+    // CLI outputs text: "slug vVersion  DisplayName  (score)"
+  }
 
-    // Parse text output lines: "slug vVersion  Display Name  (score)"
-    const skills: ClawhubSearchResultItem[] = [];
-    for (const line of result.stdout.split("\n")) {
-      const match = line.match(/^(\S+)\s+v(\S+)\s+(.+?)\s+\([\d.]+\)\s*$/);
-      if (match) {
-        skills.push({
-          slug: match[1],
-          version: match[2],
-          name: match[3].trim(),
-          description: "",
-          author: "",
-          stars: 0,
-          installs: 0,
-          createdAt: 0,
-          source: "clawhub",
-        });
-      }
+  // Parse text output lines: "slug vVersion  Display Name  (score)"
+  const skills: ClawhubSearchResultItem[] = [];
+  for (const line of result.stdout.split("\n")) {
+    const match = line.match(/^(\S+)\s+v(\S+)\s+(.+?)\s+\([\d.]+\)\s*$/);
+    if (match) {
+      skills.push({
+        slug: match[1],
+        version: match[2],
+        name: match[3].trim(),
+        description: "",
+        author: "",
+        stars: 0,
+        installs: 0,
+        createdAt: 0,
+        source: "clawhub",
+      });
     }
-    return { skills };
-  } catch (err) {
-    log.warn({ err }, "clawhub search failed");
-    return { skills: [] };
   }
+  return { skills };
 }
 
 export async function clawhubExplore(opts?: {
@@ -358,46 +343,41 @@ export async function clawhubExplore(opts?: {
   const limit = String(opts?.limit ?? 25);
   const sort = opts?.sort ?? "installsAllTime";
 
+  const result = await runClawhub([
+    "explore",
+    "--json",
+    "--limit",
+    limit,
+    "--sort",
+    sort,
+  ]);
+  if (result.exitCode !== 0) {
+    const error =
+      result.stderr.trim() || result.stdout.trim() || "Unknown error";
+    throw new Error(`clawhub explore failed: ${error}`);
+  }
   try {
-    const result = await runClawhub([
-      "explore",
-      "--json",
-      "--limit",
-      limit,
-      "--sort",
-      sort,
-    ]);
-    if (result.exitCode !== 0) {
-      return { skills: [] };
-    }
-    try {
-      const parsed = JSON.parse(result.stdout);
-      const items = parsed.items ?? parsed;
-      if (!Array.isArray(items)) return { skills: [] };
-
-      // Normalize explore response to ClawhubSearchResultItem shape
-      const skills: ClawhubSearchResultItem[] = items.map(
-        (item: Record<string, unknown>) => ({
-          name: (item.displayName as string) ?? (item.slug as string) ?? "",
-          slug: (item.slug as string) ?? "",
-          description: (item.summary as string) ?? "",
-          author: (item.author as string) ?? "",
-          stars: (item.stats as Record<string, number>)?.stars ?? 0,
-          installs:
-            (item.stats as Record<string, number>)?.installsAllTime ?? 0,
-          version: (item.tags as Record<string, string>)?.latest ?? "",
-          createdAt: (item.createdAt as number) ?? 0,
-          source: "clawhub",
-        }),
-      );
-      return { skills };
-    } catch {
-      // parse failure
-    }
-    return { skills: [] };
-  } catch (err) {
-    log.warn({ err }, "clawhub explore failed");
-    return { skills: [] };
+    const parsed = JSON.parse(result.stdout);
+    const items = parsed.items ?? parsed;
+    if (!Array.isArray(items)) return { skills: [] };
+
+    // Normalize explore response to ClawhubSearchResultItem shape
+    const skills: ClawhubSearchResultItem[] = items.map(
+      (item: Record<string, unknown>) => ({
+        name: (item.displayName as string) ?? (item.slug as string) ?? "",
+        slug: (item.slug as string) ?? "",
+        description: (item.summary as string) ?? "",
+        author: (item.author as string) ?? "",
+        stars: (item.stats as Record<string, number>)?.stars ?? 0,
+        installs: (item.stats as Record<string, number>)?.installsAllTime ?? 0,
+        version: (item.tags as Record<string, string>)?.latest ?? "",
+        createdAt: (item.createdAt as number) ?? 0,
+        source: "clawhub",
+      }),
+    );
+    return { skills };
+  } catch {
+    throw new Error("Failed to parse clawhub explore output");
   }
 }