@vellumai/assistant 0.5.5 → 0.5.7

package/src/cli/commands/oauth/platform.ts

@@ -0,0 +1,179 @@
+import type { Command } from "commander";
+
+import { getConfig } from "../../../config/loader.js";
+import {
+  type Services,
+  ServicesSchema,
+} from "../../../config/schemas/services.js";
+import { getProvider } from "../../../oauth/oauth-store.js";
+import { VellumPlatformClient } from "../../../platform/client.js";
+import { getCliLogger } from "../../logger.js";
+import { shouldOutputJson, writeOutput } from "../../output.js";
+
+const log = getCliLogger("cli");
+
+/**
+ * Normalize a bare provider name (e.g. "google") into the canonical provider
+ * key used internally (e.g. "integration:google").
+ */
+function toProviderKey(provider: string): string {
+  return provider.startsWith("integration:")
+    ? provider
+    : `integration:${provider}`;
+}
+
+export function registerPlatformCommands(oauth: Command): void {
+  const platform = oauth
+    .command("platform")
+    .description(
+      "Query platform-managed OAuth provider status and connections",
+    );
+
+  // ---------------------------------------------------------------------------
+  // platform status <provider>
+  // ---------------------------------------------------------------------------
+
+  platform
+    .command("status <provider>")
+    .description(
+      "Check whether a provider supports managed OAuth and list the user's active connections",
+    )
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  provider   Provider name (e.g. google, slack, twitter)
+
+Checks whether the platform offers managed OAuth for the given provider,
+whether managed mode is currently enabled, and lists any active connections
+the user has set up on the platform.
+
+Examples:
+  $ assistant oauth platform status google
+  $ assistant oauth platform status slack --json`,
+    )
+    .action(
+      async (
+        provider: string,
+        _opts: Record<string, unknown>,
+        cmd: Command,
+      ) => {
+        try {
+          const providerKey = toProviderKey(provider);
+          const providerRow = getProvider(providerKey);
+
+          // 1. Check if the provider even supports managed mode
+          const managedKey = providerRow?.managedServiceConfigKey;
+          if (!managedKey || !(managedKey in ServicesSchema.shape)) {
+            writeOutput(cmd, {
+              ok: true,
+              provider,
+              managedAvailable: false,
+              managedEnabled: false,
+              connections: [],
+            });
+            if (!shouldOutputJson(cmd)) {
+              log.info(
+                `Provider "${provider}" does not support platform-managed OAuth`,
+              );
+            }
+            return;
+          }
+
+          // 2. Check if managed mode is enabled in the services config
+          const services: Services = getConfig().services;
+          const managedEnabled =
+            services[managedKey as keyof Services].mode === "managed";
+
+          if (!managedEnabled) {
+            writeOutput(cmd, {
+              ok: true,
+              provider,
+              managedAvailable: true,
+              managedEnabled: false,
+              connections: [],
+            });
+            if (!shouldOutputJson(cmd)) {
+              log.info(
+                `Provider "${provider}" supports managed OAuth but is set to "your-own" mode`,
+              );
+            }
+            return;
+          }
+
+          // 3. Fetch active connections from the platform
+          const client = await VellumPlatformClient.create();
+          if (!client || !client.platformAssistantId) {
+            writeOutput(cmd, {
+              ok: false,
+              error:
+                "Platform prerequisites not met (not logged in or missing assistant ID)",
+            });
+            process.exitCode = 1;
+            return;
+          }
+
+          const params = new URLSearchParams();
+          params.set("provider", provider);
+          params.set("status", "ACTIVE");
+
+          const path = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/connections/?${params.toString()}`;
+          const response = await client.fetch(path);
+
+          if (!response.ok) {
+            writeOutput(cmd, {
+              ok: false,
+              error: `Platform returned HTTP ${response.status}`,
+            });
+            process.exitCode = 1;
+            return;
+          }
+
+          const body = (await response.json()) as unknown;
+
+          // The platform returns either a flat array or a {results: [...]} wrapper.
+          const rawEntries = (
+            Array.isArray(body)
+              ? body
+              : ((body as Record<string, unknown>).results ?? [])
+          ) as Array<{
+            id: string;
+            account_label?: string;
+            scopes_granted?: string[];
+            status?: string;
+          }>;
+
+          const connections = rawEntries.map((c) => ({
+            id: c.id,
+            accountLabel: c.account_label ?? null,
+            scopesGranted: c.scopes_granted ?? [],
+            status: c.status ?? "ACTIVE",
+          }));
+
+          writeOutput(cmd, {
+            ok: true,
+            provider,
+            managedAvailable: true,
+            managedEnabled: true,
+            connections,
+          });
+
+          if (!shouldOutputJson(cmd)) {
+            if (connections.length === 0) {
+              log.info(
+                `Provider "${provider}" is managed but has no active connections`,
+              );
+            } else {
+              log.info(
+                `Provider "${provider}": ${connections.length} active connection(s)`,
+              );
+            }
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          writeOutput(cmd, { ok: false, error: message });
+          process.exitCode = 1;
+        }
+      },
+    );
+}

package/src/cli/commands/platform.ts

@@ -24,7 +24,7 @@ export function registerPlatformCommand(program: Command): void {
     `
 The platform subsystem manages callback routing, containerized deployment
 context, and webhook forwarding for assistants running inside platform
-containers. When IS_CONTAINERIZED=true with a configured PLATFORM_BASE_URL
+containers. When IS_CONTAINERIZED=true with a configured VELLUM_PLATFORM_URL
 and PLATFORM_ASSISTANT_ID, external service callbacks (Telegram webhooks,
 Twilio webhooks, OAuth redirects) route through the platform's gateway proxy
 instead of hitting the assistant directly.
@@ -51,7 +51,7 @@ running.
 
 Fields:
   containerized       Whether IS_CONTAINERIZED is set (boolean)
-  baseUrl             PLATFORM_BASE_URL — the platform gateway base URL
+  baseUrl             VELLUM_PLATFORM_URL — the platform gateway base URL
   assistantId         PLATFORM_ASSISTANT_ID — this assistant's platform UUID
   hasInternalApiKey   Whether PLATFORM_INTERNAL_API_KEY is set (boolean,
                       value not disclosed)
@@ -136,7 +136,7 @@ Known callback path/type combinations:
   --path oauth/callback             --type oauth
 
 Requires a containerized environment (IS_CONTAINERIZED=true) with
-PLATFORM_BASE_URL and PLATFORM_ASSISTANT_ID configured. Returns the
+VELLUM_PLATFORM_URL and PLATFORM_ASSISTANT_ID configured. Returns the
 platform-provided stable callback URL that external services should use.
 
 Examples:

package/src/config/assistant-feature-flags.ts

@@ -5,7 +5,8 @@
  * `meta/feature-flags/feature-flag-registry.json` and resolves the effective
  * enabled/disabled state for each declared assistant-scope flag by consulting
  * (in priority order):
- *   1. `config.assistantFeatureFlagValues[key]`  (explicit override)
+ *   1. Override values from `~/.vellum/protected/feature-flags.json` (local)
+ *      or via the gateway HTTP API (Docker/containerized)
  *   2. defaults registry `defaultEnabled`         (for declared keys)
  *   3. `true`                                     (for undeclared keys)
  *
@@ -14,8 +15,10 @@
  */
 
 import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
+import { getBaseDataDir, getIsContainerized } from "./env-registry.js";
 import type { AssistantConfig } from "./schema.js";
 
 // ---------------------------------------------------------------------------
@@ -105,6 +108,182 @@ function parseRegistryToDefaults(parsed: unknown): FeatureFlagDefaultsRegistry {
   return result;
 }
 
+// ---------------------------------------------------------------------------
+// Override loading — reads from protected directory or gateway HTTP
+// ---------------------------------------------------------------------------
+
+/**
+ * Module-level cache of feature flag override values. Populated lazily on
+ * first access, invalidated by `clearFeatureFlagOverridesCache()`.
+ */
+let cachedOverrides: Record<string, boolean> | null = null;
+
+/**
+ * File format for `~/.vellum/protected/feature-flags.json`, matching the
+ * gateway's feature-flag-store.ts schema.
+ */
+interface FeatureFlagFileData {
+  version: 1;
+  values: Record<string, boolean>;
+}
+
+/**
+ * Resolve the path to the feature flag overrides file.
+ *
+ * Docker: `GATEWAY_SECURITY_DIR/feature-flags.json`
+ * Local:  `~/.vellum/protected/feature-flags.json`
+ *
+ * Uses `BASE_DATA_DIR` when set (multi-instance mode) so per-instance
+ * feature flag files are correctly scoped.
+ */
+function getFeatureFlagOverridesPath(): string {
+  const securityDir = process.env.GATEWAY_SECURITY_DIR;
+  if (securityDir) {
+    return join(securityDir, "feature-flags.json");
+  }
+  const root = join(getBaseDataDir() || homedir(), ".vellum");
+  return join(root, "protected", "feature-flags.json");
+}
+
+/**
+ * Load override values from the protected feature-flags.json file.
+ * Returns an empty record if the file doesn't exist or is malformed.
+ */
+function loadOverridesFromFile(): Record<string, boolean> {
+  const path = getFeatureFlagOverridesPath();
+  if (!existsSync(path)) return {};
+
+  try {
+    const raw = readFileSync(path, "utf-8");
+    const data = JSON.parse(raw) as FeatureFlagFileData;
+    if (data.version !== 1) return {};
+    if (
+      data.values &&
+      typeof data.values === "object" &&
+      !Array.isArray(data.values)
+    ) {
+      const filtered: Record<string, boolean> = {};
+      for (const [k, v] of Object.entries(data.values)) {
+        if (typeof v === "boolean") filtered[k] = v;
+      }
+      return filtered;
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Load override values from the gateway via synchronous HTTP call.
+ *
+ * Follows the trust-client pattern: uses `Bun.spawnSync` + `curl` to make
+ * a blocking GET request to the gateway's feature-flags endpoint. The
+ * gateway returns `{ flags: Array<{ key, enabled, ... }> }` and we extract
+ * just the key → enabled map.
+ */
+function loadOverridesFromGateway(): Record<string, boolean> {
+  try {
+    // Lazy-import to avoid circular dependency and keep this module
+    // importable from bootstrap code when not in containerized mode.
+    const { getGatewayInternalBaseUrl } =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      require("./env.js") as typeof import("./env.js");
+    const { mintEdgeRelayToken } =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      require("../runtime/auth/token-service.js") as typeof import("../runtime/auth/token-service.js");
+
+    const url = `${getGatewayInternalBaseUrl()}/v1/feature-flags`;
+    const token = mintEdgeRelayToken();
+
+    const proc = Bun.spawnSync(
+      [
+        "curl",
+        "-s",
+        "-S",
+        "-X",
+        "GET",
+        "--max-time",
+        "10",
+        "-H",
+        `Authorization: Bearer ${token}`,
+        "-H",
+        "Accept: application/json",
+        "-w",
+        "\n%{http_code}",
+        url,
+      ],
+      { stdout: "pipe", stderr: "pipe" },
+    );
+
+    if (proc.exitCode !== 0) return {};
+
+    const output = proc.stdout.toString().trim();
+    const lastNewline = output.lastIndexOf("\n");
+    const responseBody = lastNewline >= 0 ? output.slice(0, lastNewline) : "";
+    const statusCode = parseInt(
+      lastNewline >= 0 ? output.slice(lastNewline + 1) : output,
+      10,
+    );
+
+    if (statusCode < 200 || statusCode >= 300) return {};
+    if (!responseBody) return {};
+
+    const parsed = JSON.parse(responseBody) as {
+      flags?: Array<{ key: string; enabled: boolean }>;
+    };
+    if (!Array.isArray(parsed.flags)) return {};
+
+    const result: Record<string, boolean> = {};
+    for (const entry of parsed.flags) {
+      if (typeof entry.key === "string" && typeof entry.enabled === "boolean") {
+        result[entry.key] = entry.enabled;
+      }
+    }
+    return result;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Load overrides from the appropriate source based on runtime mode.
+ * Results are cached at module level.
+ */
+function loadOverrides(): Record<string, boolean> {
+  if (cachedOverrides != null) return cachedOverrides;
+
+  cachedOverrides = getIsContainerized()
+    ? loadOverridesFromGateway()
+    : loadOverridesFromFile();
+
+  return cachedOverrides;
+}
+
+/**
+ * Invalidate the cached override values so the next call to
+ * `isAssistantFeatureFlagEnabled` re-reads from the source.
+ *
+ * Called by the config watcher when the feature-flags file changes.
+ */
+export function clearFeatureFlagOverridesCache(): void {
+  cachedOverrides = null;
+}
+
+/**
+ * Directly inject override values into the module-level cache.
+ *
+ * **Test-only** — bypasses file/gateway loading so unit tests can control
+ * flag state without writing to disk. Production code should never call this;
+ * use `clearFeatureFlagOverridesCache()` instead and let the resolver
+ * re-read from the appropriate source.
+ */
+export function _setOverridesForTesting(
+  overrides: Record<string, boolean>,
+): void {
+  cachedOverrides = { ...overrides };
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -113,19 +292,21 @@ function parseRegistryToDefaults(parsed: unknown): FeatureFlagDefaultsRegistry {
  * Resolve whether an assistant feature flag is enabled.
  *
  * Resolution order:
- *   1. `config.assistantFeatureFlagValues[key]`  (explicit override)
+ *   1. Override from `~/.vellum/protected/feature-flags.json` (local) or
+ *      gateway HTTP (Docker/containerized)
  *   2. defaults registry `defaultEnabled`         (for declared assistant-scope keys)
  *   3. `true`                                     (for undeclared keys with no override)
  */
 export function isAssistantFeatureFlagEnabled(
   key: string,
-  config: AssistantConfig,
+  _config: AssistantConfig,
 ): boolean {
   const defaults = loadDefaultsRegistry();
   const declared = defaults[key];
+  const overrides = loadOverrides();
 
-  // 1. Check config overrides
-  const explicit = config.assistantFeatureFlagValues?.[key];
+  // 1. Check overrides from protected feature-flags file / gateway
+  const explicit = overrides[key];
   if (typeof explicit === "boolean") return explicit;
 
   // 2. For declared keys, use the registry default

package/src/config/bundled-skills/messaging/SKILL.md

@@ -70,7 +70,7 @@ Slack connects via Socket Mode using a bot token and app-level token (not OAuth)
 - Call `skill_load` with `skill: "slack-app-setup"` to load the dependency skill.
 - Tell the user Slack isn't connected yet and briefly explain what the setup involves, then follow the skill's guided flow.
 
-The slack-app-setup skill handles: manifest-driven app creation, app token and bot token collection via secure prompt (never accept tokens pasted in plaintext chat), and Slack connection setup through the same settings handler used by the Settings UI. That handler validates the bot token, stores workspace metadata, and activates Socket Mode. The skill also covers optional guardian verification.
+The slack-app-setup skill handles: manifest-driven app creation, app token and bot token collection via secure prompt (never accept tokens pasted in plaintext chat), and Slack connection setup through the same settings handler used by the Settings UI. That handler validates the bot token, stores workspace metadata, and activates Socket Mode. The skill also covers optional identity verification.
 
 ### Telegram
 
@@ -81,15 +81,15 @@ Telegram uses a bot token (not OAuth). Load the **telegram-setup** skill (which
 
 The telegram-setup skill handles: verifying the bot token from @BotFather, generating a webhook secret, registering bot commands, and storing credentials securely via the secure credential prompt flow. **Never accept a Telegram bot token pasted in plaintext chat - always use the secure prompt.** Webhook registration with Telegram is handled automatically by the gateway on startup and whenever credentials change.
 
-The telegram-setup skill also includes **guardian verification**, which links your Telegram account as the trusted guardian for the bot.
+The telegram-setup skill also includes **channel verification**, which links your Telegram account for verified message delivery.
 
-### Guardian Verification (Voice or Telegram)
+### Channel Verification (Voice or Telegram)
 
-If the user asks to verify their guardian identity for voice or Telegram, load the **guardian-verify-setup** skill:
+If the user asks to verify their identity for voice or Telegram, load the **guardian-verify-setup** skill:
 
 - Call `skill_load` with `skill: "guardian-verify-setup"` to load the dependency skill.
 
-The guardian-verify-setup skill handles the full outbound verification flow for voice and Telegram channels. It collects the user's destination (phone number or Telegram chat ID/handle), initiates an outbound verification session, and guides the user through entering or replying with the verification code. This is the single source of truth for guardian verification setup -- do not duplicate the verification flow inline.
+The guardian-verify-setup skill handles the full outbound verification flow for voice and Telegram channels. It collects the user's destination (phone number or Telegram chat ID/handle), initiates an outbound verification session, and guides the user through entering or replying with the verification code. This is the single source of truth for channel verification setup -- do not duplicate the verification flow inline.
 
 ## Error Recovery
 

package/src/config/bundled-skills/phone-calls/TOOLS.json

@@ -26,6 +26,10 @@
             "enum": ["assistant_number", "user_number"],
             "description": "Which phone number to use as the caller ID. assistant_number uses the AI assistant's Twilio number; user_number uses the user's verified personal number."
           },
+          "skip_disclosure": {
+            "type": "boolean",
+            "description": "Skip the disclosure announcement at the start of the call. Set to true when calling someone who already knows who you are (e.g. your guardian, a family member, or a close contact)."
+          },
           "activity": {
             "type": "string",
             "description": "Brief non-technical explanation of why this tool is being called"

package/src/config/bundled-skills/settings/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "voice_config_update",
-      "description": "Update a voice configuration setting (TTS voice ID, PTT activation key, conversation timeout). Changes take effect immediately.",
+      "description": "Update a voice configuration setting (TTS provider, TTS voice ID, Fish Audio reference ID, PTT activation key, conversation timeout). Changes take effect immediately.",
       "category": "system",
       "risk": "low",
       "input_schema": {
@@ -11,7 +11,7 @@
         "properties": {
           "setting": {
             "type": "string",
-            "enum": ["activation_key", "conversation_timeout", "tts_voice_id"],
+            "enum": ["activation_key", "conversation_timeout", "fish_audio_reference_id", "tts_provider", "tts_voice_id"],
             "description": "The voice setting to change"
           },
           "value": {

package/src/config/bundled-skills/settings/tools/voice-config-update.ts

@@ -24,6 +24,11 @@ const VOICE_SETTINGS = {
     type: "number" as const,
   },
   tts_voice_id: { userDefaultsKey: "ttsVoiceId", type: "string" as const },
+  tts_provider: { userDefaultsKey: "ttsProvider", type: "string" as const },
+  fish_audio_reference_id: {
+    userDefaultsKey: "fishAudioReferenceId",
+    type: "string" as const,
+  },
 } as const;
 
 type VoiceSettingName = keyof typeof VOICE_SETTINGS;
@@ -36,6 +41,8 @@ const FRIENDLY_NAMES: Record<VoiceSettingName, string> = {
   activation_key: "PTT activation key",
   conversation_timeout: "Conversation timeout",
   tts_voice_id: "ElevenLabs voice",
+  tts_provider: "TTS provider",
+  fish_audio_reference_id: "Fish Audio voice",
 };
 
 function validateSetting(
@@ -97,6 +104,25 @@ function validateSetting(
       }
       return { ok: true, coerced: trimmed };
     }
+    case "tts_provider": {
+      const valid = ["elevenlabs", "fish-audio"];
+      if (typeof value !== "string" || !valid.includes(value.trim())) {
+        return {
+          ok: false,
+          error: `tts_provider must be one of: ${valid.join(", ")}`,
+        };
+      }
+      return { ok: true, coerced: value.trim() };
+    }
+    case "fish_audio_reference_id": {
+      if (typeof value !== "string" || value.trim().length === 0) {
+        return {
+          ok: false,
+          error: "fish_audio_reference_id must be a non-empty string",
+        };
+      }
+      return { ok: true, coerced: value.trim() };
+    }
     default:
       return { ok: false, error: `Unknown setting "${setting}"` };
   }
@@ -166,6 +192,22 @@ export async function run(
     invalidateConfigCache();
   }
 
+  // For tts_provider, persist to config file (calls.voice.ttsProvider).
+  if (setting === "tts_provider") {
+    const raw = loadRawConfig();
+    setNestedValue(raw, "calls.voice.ttsProvider", validation.coerced);
+    saveRawConfig(raw);
+    invalidateConfigCache();
+  }
+
+  // For fish_audio_reference_id, persist to config file (fishAudio.referenceId).
+  if (setting === "fish_audio_reference_id") {
+    const raw = loadRawConfig();
+    setNestedValue(raw, "fishAudio.referenceId", validation.coerced);
+    saveRawConfig(raw);
+    invalidateConfigCache();
+  }
+
   return {
     content: `${friendlyName} updated to ${JSON.stringify(
       validation.coerced,

package/src/config/bundled-tool-registry.ts

@@ -13,7 +13,7 @@
  *   bun run scripts/generate-bundled-tool-registry.ts
  */
 import type { SkillToolScript } from "../tools/skills/script-contract.js";
-// ── acp ─────────────────────────────────────────────────────────────────────────
+// ── acp ────────────────────────────────────────────────────────────────────────
 import * as acpAbort from "./bundled-skills/acp/tools/acp-abort.js";
 import * as acpSpawn from "./bundled-skills/acp/tools/acp-spawn.js";
 import * as acpStatus from "./bundled-skills/acp/tools/acp-status.js";
@@ -39,8 +39,6 @@ import * as browserWaitFor from "./bundled-skills/browser/tools/browser-wait-for
 import * as browserWaitForDownload from "./bundled-skills/browser/tools/browser-wait-for-download.js";
 // ── chatgpt-import ─────────────────────────────────────────────────────────────
 import * as chatgptImport from "./bundled-skills/chatgpt-import/tools/chatgpt-import.js";
-// ── claude-code ────────────────────────────────────────────────────────────────
-import * as claudeCode from "./bundled-skills/claude-code/tools/claude-code.js";
 // ── computer-use ───────────────────────────────────────────────────────────────
 import * as computerUseClick from "./bundled-skills/computer-use/tools/computer-use-click.js";
 import * as computerUseDone from "./bundled-skills/computer-use/tools/computer-use-done.js";
@@ -107,8 +105,6 @@ import * as messagingSend from "./bundled-skills/messaging/tools/messaging-send.
 import * as messagingSenderDigest from "./bundled-skills/messaging/tools/messaging-sender-digest.js";
 // ── notifications ──────────────────────────────────────────────────────────────
 import * as sendNotification from "./bundled-skills/notifications/tools/send-notification.js";
-// ── orchestration ──────────────────────────────────────────────────────────────
-import * as swarmDelegate from "./bundled-skills/orchestration/tools/swarm-delegate.js";
 // ── phone-calls ────────────────────────────────────────────────────────────────
 import * as callEnd from "./bundled-skills/phone-calls/tools/call-end.js";
 import * as callStart from "./bundled-skills/phone-calls/tools/call-start.js";
@@ -210,9 +206,6 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   // chatgpt-import
   ["chatgpt-import:tools/chatgpt-import.ts", chatgptImport],
 
-  // claude-code
-  ["claude-code:tools/claude-code.ts", claudeCode],
-
   // computer-use
   ["computer-use:tools/computer-use-observe.ts", computerUseObserve],
   ["computer-use:tools/computer-use-click.ts", computerUseClick],
@@ -298,9 +291,6 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   // notifications
   ["notifications:tools/send-notification.ts", sendNotification],
 
-  // orchestration
-  ["orchestration:tools/swarm-delegate.ts", swarmDelegate],
-
   // phone-calls
   ["phone-calls:tools/call-start.ts", callStart],
   ["phone-calls:tools/call-status.ts", callStatus],

package/src/config/env-registry.ts

@@ -72,7 +72,7 @@ export function getWorkspaceDirOverride(): string | undefined {
 const KNOWN_VELLUM_VARS = new Set([
   "VELLUM_ASSISTANT_NAME",
   "VELLUM_AWS_ROLE_ARN",
-  "VELLUM_CLAUDE_CODE_DEPTH",
+  "VELLUM_CLOUD",
   "VELLUM_CUSTOM_QR_CODE_PATH",
   "VELLUM_DAEMON_AUTOSTART",
   "VELLUM_DAEMON_NOAUTH",