@vellumai/assistant 0.6.0 → 0.6.2

package/src/cli/commands/skills.ts

@@ -3,6 +3,9 @@ import { join } from "node:path";
 
 import type { Command } from "commander";
 
+import { getConfig } from "../../config/loader.js";
+import { resolveSkillStates } from "../../config/skill-state.js";
+import { loadSkillCatalog } from "../../config/skills.js";
 import type { CatalogSkill } from "../../skills/catalog-install.js";
 import {
   fetchCatalog,
@@ -56,13 +59,13 @@ Examples:
 
   skills
     .command("list")
-    .description("List available catalog skills")
+    .description("List all skills (bundled, installed, and catalog)")
     .option("--json", "Machine-readable JSON output")
     .addHelpText(
       "after",
       `
-Lists all skills available in the Vellum catalog with their ID, name,
-description, and dependency information.
+Lists all skills: bundled (compiled-in), installed (user-added), and
+available catalog skills with their ID, name, and description.
 
 Examples:
   $ assistant skills list
@@ -70,34 +73,103 @@ Examples:
     )
     .action(async (opts: { json?: boolean }) => {
       try {
-        // In dev mode, use the local catalog as the source of truth
-        // and skip the remote Platform API entirely.
+        // ── Bundled + installed skills (from loadSkillCatalog) ────────
+        const localCatalog = loadSkillCatalog();
+        const config = getConfig();
+        const resolved = resolveSkillStates(localCatalog, config);
+        const bundled = resolved.filter(
+          (r) => r.summary.source === "bundled",
+        );
+        const installed = resolved.filter(
+          (r) =>
+            r.summary.source === "managed" ||
+            r.summary.source === "workspace" ||
+            r.summary.source === "extra",
+        );
+
+        // ── Remote catalog skills ────────────────────────────────────
         const repoSkillsDir = getRepoSkillsDir();
-        let catalog: CatalogSkill[];
+        let remoteCatalog: CatalogSkill[];
         if (repoSkillsDir) {
-          catalog = readLocalCatalog(repoSkillsDir);
+          remoteCatalog = readLocalCatalog(repoSkillsDir);
         } else {
-          catalog = await fetchCatalog();
+          remoteCatalog = await fetchCatalog();
         }
+        // Exclude catalog skills that are already installed/bundled
+        const localIds = new Set(localCatalog.map((s) => s.id));
+        const availableCatalog = remoteCatalog.filter(
+          (s) => !localIds.has(s.id),
+        );
+
+        const totalCount =
+          bundled.length + installed.length + availableCatalog.length;
 
         if (opts.json) {
-          console.log(JSON.stringify({ ok: true, skills: catalog }));
+          const bundledJson = bundled.map((r) => ({
+            id: r.summary.id,
+            name: r.summary.displayName,
+            description: r.summary.description,
+            emoji: r.summary.emoji,
+            state: r.state,
+          }));
+          const installedJson = installed.map((r) => ({
+            id: r.summary.id,
+            name: r.summary.displayName,
+            description: r.summary.description,
+            emoji: r.summary.emoji,
+            state: r.state,
+          }));
+          console.log(
+            JSON.stringify({
+              ok: true,
+              skills: [...bundledJson, ...installedJson, ...availableCatalog],
+              bundled: bundledJson,
+              installed: installedJson,
+              catalog: availableCatalog,
+            }),
+          );
           return;
         }
 
-        if (catalog.length === 0) {
-          log.info("No skills available in the catalog.");
+        if (totalCount === 0) {
+          log.info("No skills available.");
           return;
         }
 
-        log.info(`Available skills (${catalog.length}):\n`);
-        for (const s of catalog) {
-          const emoji = s.emoji ? `${s.emoji} ` : "";
-          const deps = s.includes?.length
-            ? ` (requires: ${s.includes.join(", ")})`
-            : "";
-          log.info(`  ${emoji}${s.id}`);
-          log.info(`    ${s.name} — ${s.description}${deps}`);
+        if (bundled.length > 0) {
+          log.info(`Bundled skills (${bundled.length}):\n`);
+          for (const r of bundled) {
+            const s = r.summary;
+            const emoji = s.emoji ? `${s.emoji} ` : "";
+            const state = r.state === "disabled" ? " [disabled]" : "";
+            log.info(`  ${emoji}${s.id}${state}`);
+            log.info(`    ${s.displayName} — ${s.description}`);
+          }
+          log.info("");
+        }
+
+        if (installed.length > 0) {
+          log.info(`Installed skills (${installed.length}):\n`);
+          for (const r of installed) {
+            const s = r.summary;
+            const emoji = s.emoji ? `${s.emoji} ` : "";
+            const state = r.state === "disabled" ? " [disabled]" : "";
+            log.info(`  ${emoji}${s.id}${state}`);
+            log.info(`    ${s.displayName} — ${s.description}`);
+          }
+          log.info("");
+        }
+
+        if (availableCatalog.length > 0) {
+          log.info(`Available catalog skills (${availableCatalog.length}):\n`);
+          for (const s of availableCatalog) {
+            const emoji = s.emoji ? `${s.emoji} ` : "";
+            const deps = s.includes?.length
+              ? ` (requires: ${s.includes.join(", ")})`
+              : "";
+            log.info(`  ${emoji}${s.id}`);
+            log.info(`    ${s.name} — ${s.description}${deps}`);
+          }
         }
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -139,6 +211,14 @@ Examples:
       const limit = parseInt(opts.limit, 10) || 10;
 
       try {
+        // ── Bundled + installed skill search ─────────────────────────
+        const localCatalog = loadSkillCatalog();
+        const bundledMatches = filterByQuery(localCatalog, query, [
+          (s) => s.id,
+          (s) => s.displayName,
+          (s) => s.description,
+        ]);
+
         // ── Vellum catalog search ────────────────────────────────────
         const repoSkillsDir = getRepoSkillsDir();
         let catalog: CatalogSkill[];
@@ -151,8 +231,11 @@ Examples:
             catalog = [];
           }
         }
+        // Exclude catalog entries that match a bundled/installed skill
+        const localIds = new Set(localCatalog.map((s) => s.id));
+        const filteredCatalog = catalog.filter((s) => !localIds.has(s.id));
 
-        const catalogMatches = filterByQuery(catalog, query, [
+        const catalogMatches = filterByQuery(filteredCatalog, query, [
           (s) => s.id,
           (s) => s.name,
           (s) => s.description,
@@ -202,6 +285,7 @@ Examples:
         ]);
 
         if (
+          bundledMatches.length === 0 &&
           catalogMatches.length === 0 &&
           registryResults.length === 0 &&
           clawhubResults.length === 0
@@ -210,6 +294,7 @@ Examples:
             console.log(
               JSON.stringify({
                 ok: true,
+                bundled: [],
                 catalog: [],
                 community: [],
                 clawhub: [],
@@ -255,6 +340,13 @@ Examples:
           console.log(
             JSON.stringify({
               ok: true,
+              bundled: bundledMatches.map((s) => ({
+                id: s.id,
+                name: s.displayName,
+                description: s.description,
+                emoji: s.emoji,
+                source: s.source,
+              })),
               catalog: catalogMatches,
               community: registryResults,
               clawhub: clawhubResults,
@@ -271,6 +363,24 @@ Examples:
         const isInstalled = (id: string) =>
           existsSync(join(skillsDir, id, "SKILL.md"));
 
+        // ── Display bundled/installed results ─────────────────────────
+        if (bundledMatches.length > 0) {
+          log.info(
+            `Bundled & installed skills (${bundledMatches.length}):\n`,
+          );
+          for (const s of bundledMatches) {
+            const emoji = s.emoji ? `${s.emoji} ` : "";
+            const tag = s.source === "bundled" ? " [bundled]" : " [installed]";
+            log.info(`  ${emoji}${s.displayName}${tag}`);
+            if (s.displayName !== s.id) {
+              log.info(`    ID: ${s.id}`);
+            }
+            log.info(`    ${s.description}`);
+            log.info(`    Load: skill_load skill=${s.id}`);
+            log.info("");
+          }
+        }
+
         // ── Display catalog results ──────────────────────────────────
         if (catalogMatches.length > 0) {
           log.info(`Vellum catalog (${catalogMatches.length}):\n`);

package/src/cli/program.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 
+import { initFeatureFlagOverrides } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
 import { isEmailEnabled } from "../email/feature-gate.js";
 import { registerHooksCommand } from "../hooks/cli.js";
@@ -26,19 +27,26 @@ import { registerMemoryCommand } from "./commands/memory.js";
 import { registerNotificationsCommand } from "./commands/notifications.js";
 import { registerOAuthCommand } from "./commands/oauth/index.js";
 import { registerPlatformCommand } from "./commands/platform/index.js";
+import { registerRoutesCommand } from "./commands/routes.js";
 import { registerSequenceCommand } from "./commands/sequence.js";
 import { registerShotgunCommand } from "./commands/shotgun.js";
 import { registerSkillsCommand } from "./commands/skills.js";
 import { registerTrustCommand } from "./commands/trust.js";
 import { registerUsageCommand } from "./commands/usage.js";
 
-export function buildCliProgram(): Command {
+/**
+ * Build the CLI program tree. Pre-populates the feature flag cache from
+ * the gateway so flag-gated commands are registered correctly.
+ */
+export async function buildCliProgram(): Promise<Command> {
+  await initFeatureFlagOverrides();
   const program = new Command();
 
   program
     .name("assistant")
     .description("Local AI assistant")
-    .version(APP_VERSION);
+    .version(APP_VERSION)
+    .allowExcessArguments(true);
 
   program.addHelpText(
     "after",
@@ -75,6 +83,7 @@ Examples:
   registerNotificationsCommand(program);
   registerPlatformCommand(program);
   registerOAuthCommand(program);
+  registerRoutesCommand(program);
   registerSkillsCommand(program);
   registerBrowserRelayCommand(program);
   registerUsageCommand(program);

package/src/cli.ts

@@ -33,11 +33,6 @@ import {
   type EventStreamWatcher,
   watchEventStream,
 } from "./signals/event-stream.js";
-import {
-  copyToClipboard,
-  extractLastCodeBlock,
-  formatConversationForExport,
-} from "./util/clipboard.js";
 import { formatDiff, formatNewFileDiff } from "./util/diff.js";
 import { getHistoryPath, getSignalsDir } from "./util/platform.js";
 import { Spinner } from "./util/spinner.js";
@@ -143,7 +138,6 @@ export async function startCli(): Promise<void> {
   let conversationId = "";
   let pendingUserContent: string | null = null;
   let generating = false;
-  let lastResponse = "";
   let lastUsage: {
     inputTokens: number;
     outputTokens: number;
@@ -153,7 +147,6 @@ export async function startCli(): Promise<void> {
     model: string;
   } | null = null;
   let pendingSessionPick = false;
-  let pendingCopySession = false;
   let toolStreaming = false;
   let lastDisplayedError: string | null = null;
   let eventSubscription: EventStreamWatcher | null = null;
@@ -398,7 +391,6 @@ export async function startCli(): Promise<void> {
         if (pendingUserContent) {
           const content = pendingUserContent;
           pendingUserContent = null;
-          lastResponse = "";
           sendUserMessage(content).then((result) => {
             if (result.ok) {
               generating = true;
@@ -408,7 +400,6 @@ export async function startCli(): Promise<void> {
                 process.stdout.write(`${result.message}\n`);
                 rl.question("Send anyway? (y/N): ", (answer) => {
                   if (answer.trim().toLowerCase() === "y") {
-                    lastResponse = "";
                     sendUserMessage(content, {
                       bypassSecretCheck: true,
                     }).then((retryResult) => {
@@ -439,7 +430,6 @@ export async function startCli(): Promise<void> {
 
       case "assistant_text_delta":
         spinner.stop();
-        lastResponse += msg.text;
         process.stdout.write(msg.text);
         break;
 
@@ -595,9 +585,8 @@ export async function startCli(): Promise<void> {
       case "error":
         spinner.stop();
         generating = false;
-        if (pendingSessionPick || pendingCopySession) {
+        if (pendingSessionPick) {
           pendingSessionPick = false;
-          pendingCopySession = false;
           rl.removeAllListeners("line");
           rl.on("line", handleLine);
         }
@@ -646,26 +635,6 @@ export async function startCli(): Promise<void> {
         break;
 
       case "history_response":
-        if (pendingCopySession) {
-          pendingCopySession = false;
-          if (msg.messages.length === 0) {
-            process.stdout.write("\n  No messages to copy.\n\n");
-          } else {
-            try {
-              const formatted = formatConversationForExport(msg.messages);
-              copyToClipboard(formatted);
-              process.stdout.write(
-                `\n  Copied conversation (${msg.messages.length} messages) to clipboard.\n\n`,
-              );
-            } catch (err) {
-              process.stdout.write(
-                `\n  Clipboard error: ${(err as Error).message}\n\n`,
-              );
-            }
-          }
-          prompt();
-          break;
-        }
         process.stdout.write("\n");
         if (msg.messages.length === 0) {
           process.stdout.write("  No messages in this conversation.\n");
@@ -686,7 +655,6 @@ export async function startCli(): Promise<void> {
         if (msg.removedCount === 0) {
           process.stdout.write("\n  Nothing to undo.\n\n");
         } else {
-          lastResponse = "";
           process.stdout.write(
             `\n  Removed last exchange (${msg.removedCount} messages).\n\n`,
           );
@@ -754,21 +722,6 @@ export async function startCli(): Promise<void> {
       /* ignore */
     }
 
-    if (content === "/copy") {
-      if (!lastResponse) {
-        process.stdout.write("No response to copy.\n");
-      } else {
-        try {
-          copyToClipboard(lastResponse);
-          process.stdout.write("Copied to clipboard.\n");
-        } catch (err) {
-          process.stdout.write(`Clipboard error: ${(err as Error).message}\n`);
-        }
-      }
-      prompt();
-      return;
-    }
-
     if (content === "/conversations") {
       pendingSessionPick = true;
       try {
@@ -787,65 +740,6 @@ export async function startCli(): Promise<void> {
       return;
     }
 
-    if (content === "/copy-code") {
-      const code = extractLastCodeBlock(lastResponse);
-      if (code == null) {
-        process.stdout.write("No code block found.\n");
-      } else {
-        try {
-          copyToClipboard(code);
-          process.stdout.write("Copied code block to clipboard.\n");
-        } catch (err) {
-          process.stdout.write(`Clipboard error: ${(err as Error).message}\n`);
-        }
-      }
-      prompt();
-      return;
-    }
-
-    if (content === "/copy-conversation") {
-      try {
-        const mapping = getConversationByKey(conversationKey);
-        if (!mapping) {
-          process.stdout.write("\n  No messages to copy.\n\n");
-          prompt();
-          return;
-        }
-        const rawMessages = getMessages(mapping.conversationId);
-        if (rawMessages.length === 0) {
-          process.stdout.write("\n  No messages to copy.\n\n");
-        } else {
-          const rendered = rawMessages.map((msg) => {
-            let parsedContent: unknown;
-            try {
-              parsedContent = JSON.parse(msg.content);
-            } catch {
-              parsedContent = msg.content;
-            }
-            return {
-              role: msg.role as "user" | "assistant",
-              text: renderHistoryContent(parsedContent).text,
-            };
-          });
-          try {
-            const formatted = formatConversationForExport(rendered);
-            copyToClipboard(formatted);
-            process.stdout.write(
-              `\n  Copied conversation (${rawMessages.length} messages) to clipboard.\n\n`,
-            );
-          } catch (err) {
-            process.stdout.write(
-              `\n  Clipboard error: ${(err as Error).message}\n\n`,
-            );
-          }
-        }
-      } catch {
-        process.stdout.write("[Failed to fetch history]\n");
-      }
-      prompt();
-      return;
-    }
-
     if (content === "/new") {
       // Create a new conversation by using a unique key
       conversationKey = `builtin-cli:${randomUUID()}`;
@@ -859,7 +753,6 @@ export async function startCli(): Promise<void> {
     }
 
     if (content === "/clear") {
-      lastResponse = "";
       process.stdout.write("\x1b[r");
       process.stdout.write("\x1b[2J\x1b[H");
       mainScreenLayout = renderMainScreen();
@@ -955,7 +848,6 @@ export async function startCli(): Promise<void> {
               if (result.removedCount === 0) {
                 process.stdout.write("\n  Nothing to undo.\n\n");
               } else {
-                lastResponse = "";
                 process.stdout.write(
                   `\n  Removed last exchange (${result.removedCount} messages).\n\n`,
                 );
@@ -1016,15 +908,6 @@ export async function startCli(): Promise<void> {
         "  /undo               Remove last message exchange\n",
       );
       process.stdout.write("  /usage              Show token usage and cost\n");
-      process.stdout.write(
-        "  /copy               Copy last response to clipboard\n",
-      );
-      process.stdout.write(
-        "  /copy-code          Copy last code block to clipboard\n",
-      );
-      process.stdout.write(
-        "  /copy-conversation  Copy entire conversation to clipboard\n",
-      );
       process.stdout.write("  /help               Show this help\n");
       process.stdout.write("\n");
       prompt();
@@ -1032,14 +915,12 @@ export async function startCli(): Promise<void> {
     }
 
     // Regular user message
-    lastResponse = "";
     sendUserMessage(content).then((result) => {
       if (!result.ok) {
         if (result.error === "secret_blocked" && result.message) {
           process.stdout.write(`${result.message}\n`);
           rl.question("Send anyway? (y/N): ", (answer) => {
             if (answer.trim().toLowerCase() === "y") {
-              lastResponse = "";
               sendUserMessage(content, { bypassSecretCheck: true }).then(
                 (retryResult) => {
                   if (retryResult.ok) {

package/src/config/assistant-feature-flags.ts

@@ -20,7 +20,6 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
-import { getIsContainerized } from "./env-registry.js";
 import type { AssistantConfig } from "./schema.js";
 
 // ---------------------------------------------------------------------------
@@ -173,61 +172,49 @@ function loadOverridesFromFile(): Record<string, boolean> {
 }
 
 /**
- * Load override values from the gateway via synchronous HTTP call.
+ * Fetch override values from the gateway via async HTTP.
  *
- * Follows the trust-client pattern: uses `Bun.spawnSync` + `curl` to make
- * a blocking GET request to the gateway's feature-flags endpoint. The
- * gateway returns `{ flags: Array<{ key, enabled, ... }> }` and we extract
- * just the key → enabled map.
+ * Returns the gateway's merged feature flag map (persisted > remote >
+ * registry), or an empty record on any failure (network, auth, parse).
  */
-function loadOverridesFromGateway(): Record<string, boolean> {
+async function fetchOverridesFromGateway(): Promise<Record<string, boolean>> {
   try {
     // Lazy-import to avoid circular dependency and keep this module
     // importable from bootstrap code when not in containerized mode.
     const { getGatewayInternalBaseUrl } =
       // eslint-disable-next-line @typescript-eslint/no-require-imports
       require("./env.js") as typeof import("./env.js");
-    const { mintEdgeRelayToken } =
+    const {
+      mintEdgeRelayToken,
+      isSigningKeyInitialized,
+      initAuthSigningKey,
+      resolveSigningKey,
+    } =
       // eslint-disable-next-line @typescript-eslint/no-require-imports
       require("../runtime/auth/token-service.js") as typeof import("../runtime/auth/token-service.js");
 
+    // CLI subprocesses don't run daemon startup, so the signing key
+    // may not be initialized yet. Initialize it now so mintEdgeRelayToken
+    // can produce a valid JWT for the gateway request.
+    if (!isSigningKeyInitialized()) {
+      initAuthSigningKey(resolveSigningKey());
+    }
+
     const url = `${getGatewayInternalBaseUrl()}/v1/feature-flags`;
     const token = mintEdgeRelayToken();
 
-    const proc = Bun.spawnSync(
-      [
-        "curl",
-        "-s",
-        "-S",
-        "-X",
-        "GET",
-        "--max-time",
-        "10",
-        "-H",
-        `Authorization: Bearer ${token}`,
-        "-H",
-        "Accept: application/json",
-        "-w",
-        "\n%{http_code}",
-        url,
-      ],
-      { stdout: "pipe", stderr: "pipe" },
-    );
-
-    if (proc.exitCode !== 0) return {};
-
-    const output = proc.stdout.toString().trim();
-    const lastNewline = output.lastIndexOf("\n");
-    const responseBody = lastNewline >= 0 ? output.slice(0, lastNewline) : "";
-    const statusCode = parseInt(
-      lastNewline >= 0 ? output.slice(lastNewline + 1) : output,
-      10,
-    );
-
-    if (statusCode < 200 || statusCode >= 300) return {};
-    if (!responseBody) return {};
-
-    const parsed = JSON.parse(responseBody) as {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+      },
+      signal: AbortSignal.timeout(10_000),
+    });
+
+    if (!response.ok) return {};
+
+    const parsed = (await response.json()) as {
       flags?: Array<{ key: string; enabled: boolean }>;
     };
     if (!Array.isArray(parsed.flags)) return {};
@@ -245,25 +232,42 @@ function loadOverridesFromGateway(): Record<string, boolean> {
 }
 
 /**
- * Load overrides, preferring the gateway HTTP API.
+ * Pre-populate the override cache from the gateway (async).
  *
- * In containerized mode, always uses the gateway. In local mode, tries
- * the gateway first and falls back to `loadOverridesFromFile()` when
- * the gateway is not yet available (startup race).
+ * Call this once during startup (daemon or CLI entry) before any sync
+ * `isAssistantFeatureFlagEnabled` calls. In containerized mode, always
+ * uses the gateway. In local mode, falls back to the local file when
+ * the gateway is unreachable.
  *
- * Results are cached at module level.
+ * On failure, the cache is left unset so subsequent sync calls fall
+ * through to the file-based fallback rather than caching an empty map
+ * that masks all overrides for the process lifetime.
  */
-function loadOverrides(): Record<string, boolean> {
-  if (cachedOverrides != null) return cachedOverrides;
-
-  const gatewayOverrides = loadOverridesFromGateway();
-  if (Object.keys(gatewayOverrides).length > 0 || getIsContainerized()) {
+export async function initFeatureFlagOverrides(): Promise<void> {
+  const gatewayOverrides = await fetchOverridesFromGateway();
+  if (Object.keys(gatewayOverrides).length > 0) {
     cachedOverrides = gatewayOverrides;
-    return cachedOverrides;
+    return;
   }
 
-  // Graceful fallback: in local mode, if the gateway hasn't started yet
-  // (empty response), read overrides from file as a temporary measure.
+  // Gateway returned empty or failed. Leave the cache unset so
+  // loadOverrides() falls through to file on the next sync read,
+  // regardless of containerized vs local mode.
+}
+
+/**
+ * Read cached overrides synchronously.
+ *
+ * If `initFeatureFlagOverrides()` was called at startup, this returns the
+ * pre-populated cache. Otherwise falls back to the local file — this
+ * ensures the resolver never blocks on a network call.
+ */
+function loadOverrides(): Record<string, boolean> {
+  if (cachedOverrides != null) return cachedOverrides;
+
+  // Cache not yet populated (initFeatureFlagOverrides wasn't called or
+  // hasn't finished). Fall back to the local file so the resolver still
+  // works, just without gateway data.
   cachedOverrides = loadOverridesFromFile();
   return cachedOverrides;
 }