@vellumai/assistant 0.6.2 → 0.6.3

package/bun.lock

@@ -5,53 +5,53 @@
     "": {
       "name": "@vellumai/assistant",
       "dependencies": {
-        "@agentclientprotocol/sdk": "^0.16.1",
-        "@anthropic-ai/sdk": "^0.78.0",
-        "@google/genai": "^1.40.0",
-        "@modelcontextprotocol/sdk": "^1.15.1",
-        "@qdrant/js-client-rest": "^1.16.2",
-        "@resvg/resvg-js": "^2.6.2",
-        "@sentry/node": "^10.38.0",
+        "@agentclientprotocol/sdk": "0.16.1",
+        "@anthropic-ai/sdk": "0.78.0",
+        "@google/genai": "1.45.0",
+        "@modelcontextprotocol/sdk": "1.27.1",
+        "@qdrant/js-client-rest": "1.17.0",
+        "@resvg/resvg-js": "2.6.2",
+        "@sentry/node": "10.43.0",
         "@vellumai/ces-contracts": "file:../packages/ces-contracts",
         "@vellumai/credential-storage": "file:../packages/credential-storage",
         "@vellumai/egress-proxy": "file:../packages/egress-proxy",
-        "agentmail": "^0.1.0",
-        "archiver": "^7.0.1",
-        "commander": "^13.1.0",
-        "croner": "^10.0.1",
-        "dotenv": "^17.3.1",
-        "drizzle-orm": "^0.38.4",
-        "jszip": "^3.10.1",
-        "minimatch": "^10.2.4",
-        "openai": "^6.18.0",
-        "pino": "^9.6.0",
-        "pino-pretty": "^13.1.3",
-        "playwright": "^1.58.2",
-        "postgres": "^3.4.8",
-        "qrcode": "^1.5.4",
-        "react": "^19.2.4",
-        "rrule": "^2.8.1",
-        "tldts": "^7.0.23",
+        "agentmail": "0.1.19",
+        "archiver": "7.0.1",
+        "commander": "13.1.0",
+        "croner": "10.0.1",
+        "dotenv": "17.3.1",
+        "drizzle-orm": "0.38.4",
+        "jszip": "3.10.1",
+        "minimatch": "10.2.4",
+        "openai": "6.29.0",
+        "pino": "9.14.0",
+        "pino-pretty": "13.1.3",
+        "playwright": "1.58.2",
+        "postgres": "3.4.8",
+        "qrcode": "1.5.4",
+        "react": "19.2.4",
+        "rrule": "2.8.1",
+        "tldts": "7.0.25",
         "tree-sitter-bash": "0.25.1",
-        "uuid": "^11.1.0",
+        "uuid": "11.1.0",
         "web-tree-sitter": "0.26.5",
-        "yaml": "^2.7.1",
-        "zod": "^4.3.6",
+        "yaml": "2.8.2",
+        "zod": "4.3.6",
       },
       "devDependencies": {
-        "@types/archiver": "^7.0.0",
-        "@types/bun": "^1.2.4",
-        "@types/node": "^25.2.2",
-        "@types/react": "^19.2.14",
-        "@types/uuid": "^10.0.0",
-        "drizzle-kit": "^0.30.4",
-        "eslint": "^10.0.0",
-        "eslint-plugin-simple-import-sort": "^12.1.1",
-        "fast-check": "^4.5.3",
-        "knip": "^5.83.1",
-        "prettier": "^3.8.1",
-        "typescript": "^5.7.3",
-        "typescript-eslint": "^8.54.0",
+        "@types/archiver": "7.0.0",
+        "@types/bun": "1.3.10",
+        "@types/node": "25.5.0",
+        "@types/react": "19.2.14",
+        "@types/uuid": "10.0.0",
+        "drizzle-kit": "0.30.6",
+        "eslint": "10.0.3",
+        "eslint-plugin-simple-import-sort": "12.1.1",
+        "fast-check": "4.6.0",
+        "knip": "5.86.0",
+        "prettier": "3.8.1",
+        "typescript": "5.9.3",
+        "typescript-eslint": "8.57.0",
       },
     },
   },

package/bunfig.toml

@@ -1,3 +1,6 @@
+[install]
+exact = true
+
 [test]
 root = "./src"
 preload = ["./src/__tests__/test-preload.ts"]

package/docs/architecture/memory.md

@@ -566,7 +566,7 @@ The Anthropic provider places `cache_control: { type: 'ephemeral' }` on the **la
 
 The session injects a unified `<turn_context>` block into every user message, giving the model awareness of the current timestamp (with timezone), interface, channel, and actor identity. This replaces the former separate `<temporal_context>`, `<inbound_actor_context>`, and per-channel turn context blocks. The unified block persists in conversation history so the assistant retains temporal and actor grounding across turns. Legacy blocks from pre-change history are stripped for backward compatibility.
 
-The `timestamp:` field format is: `2026-04-02 (Wed) 14:30:00 -05:00 (America/Chicago)` — date, abbreviated weekday, local time, UTC offset, and IANA timezone name.
+The `current_time:` field format is: `2026-04-02 (Wednesday) 14:30:00 -05:00 (America/Chicago)` — date, weekday name, local time, UTC offset, and IANA timezone name.
 
 ### Per-turn flow
 

package/node_modules/@vellumai/ces-contracts/src/rpc.ts

@@ -65,6 +65,8 @@ export const CesRpcMethod = {
   DeleteCredential: "delete_credential",
   /** List all credential account names. */
   ListCredentials: "list_credentials",
+  /** Bulk-import credentials (set multiple at once). */
+  BulkSetCredentials: "bulk_set_credentials",
 } as const;
 
 export type CesRpcMethod =
@@ -513,6 +515,38 @@ export type ListCredentialsResponse = z.infer<
   typeof ListCredentialsResponseSchema
 >;
 
+// ---------------------------------------------------------------------------
+// bulk_set_credentials
+// ---------------------------------------------------------------------------
+
+export const BulkSetCredentialsSchema = z.object({
+  /** Array of credentials to set in bulk. */
+  credentials: z.array(
+    z.object({
+      /** The account name to store the credential under. */
+      account: z.string(),
+      /** The credential value to store. */
+      value: z.string(),
+    }),
+  ),
+});
+export type BulkSetCredentials = z.infer<typeof BulkSetCredentialsSchema>;
+
+export const BulkSetCredentialsResponseSchema = z.object({
+  /** Per-credential results indicating success or failure. */
+  results: z.array(
+    z.object({
+      /** The account name that was set. */
+      account: z.string(),
+      /** Whether the credential was successfully stored. */
+      ok: z.boolean(),
+    }),
+  ),
+});
+export type BulkSetCredentialsResponse = z.infer<
+  typeof BulkSetCredentialsResponseSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Full RPC contract type map
 // ---------------------------------------------------------------------------
@@ -574,6 +608,10 @@ export interface CesRpcContract {
     request: ListCredentials;
     response: ListCredentialsResponse;
   };
+  [CesRpcMethod.BulkSetCredentials]: {
+    request: BulkSetCredentials;
+    response: BulkSetCredentialsResponse;
+  };
 }
 
 /**
@@ -632,4 +670,8 @@ export const CesRpcSchemas = {
     request: ListCredentialsSchema,
     response: ListCredentialsResponseSchema,
   },
+  [CesRpcMethod.BulkSetCredentials]: {
+    request: BulkSetCredentialsSchema,
+    response: BulkSetCredentialsResponseSchema,
+  },
 } as const;

package/openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.0
 info:
   title: Vellum Assistant API
-  version: 0.6.1
+  version: 0.6.3
   description: Auto-generated OpenAPI specification for the Vellum Assistant runtime HTTP server.
 servers:
   - url: http://127.0.0.1:7821
@@ -1169,15 +1169,9 @@ paths:
       responses:
         "200":
           description: Successful response
-  /v1/browser-relay/command:
+  /v1/browser-cdp:
     post:
-      operationId: browserrelay_command_post
-      responses:
-        "200":
-          description: Successful response
-  /v1/browser-relay/status:
-    get:
-      operationId: browserrelay_status_get
+      operationId: browsercdp_post
       responses:
         "200":
           description: Successful response
@@ -2412,7 +2406,12 @@ paths:
                     description: Total number of available starters
                   status:
                     type: string
-                    description: "One of: ready, empty, generating"
+                    enum:
+                      - ready
+                      - refreshing
+                      - empty
+                      - generating
+                    description: "One of: ready, refreshing, empty, generating"
                 required:
                   - starters
                   - total
@@ -2553,6 +2552,75 @@ paths:
           required: true
           schema:
             type: string
+  /v1/conversations/{id}/host-access:
+    get:
+      operationId: conversations_by_id_hostaccess_get
+      summary: Get conversation host access
+      description: Return whether the conversation can use host tools.
+      tags:
+        - conversations
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  conversationId:
+                    type: string
+                  hostAccess:
+                    type: boolean
+                required:
+                  - conversationId
+                  - hostAccess
+                additionalProperties: false
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+    patch:
+      operationId: conversations_by_id_hostaccess_patch
+      summary: Update conversation host access
+      description: Enable or disable host access for a conversation.
+      tags:
+        - conversations
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  conversationId:
+                    type: string
+                  hostAccess:
+                    type: boolean
+                required:
+                  - conversationId
+                  - hostAccess
+                additionalProperties: false
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                hostAccess:
+                  type: boolean
+              required:
+                - hostAccess
+              additionalProperties: false
   /v1/conversations/{id}/name:
     patch:
       operationId: conversations_by_id_name_patch
@@ -2825,10 +2893,13 @@ paths:
                     type: string
                   conversationType:
                     type: string
+                  hostAccess:
+                    type: boolean
                 required:
                   - conversationId
                   - title
                   - conversationType
+                  - hostAccess
                 additionalProperties: false
       requestBody:
         required: true
@@ -3140,6 +3211,11 @@ paths:
                 conversationId:
                   description: Scope to a single conversation
                   type: string
+                full:
+                  description:
+                    Full export — include messages, LLM request logs, and usage events for all conversations. Use for test data
+                    debugging.
+                  type: boolean
                 startTime:
                   description: Lower bound epoch ms
                   type: number
@@ -3836,6 +3912,43 @@ paths:
               required:
                 - requestId
               additionalProperties: false
+  /v1/host-browser-result:
+    post:
+      operationId: hostbrowserresult_post
+      summary: Submit host browser result
+      description: Resolve a pending host browser request by requestId.
+      tags:
+        - host
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  accepted:
+                    type: boolean
+                required:
+                  - accepted
+                additionalProperties: false
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                requestId:
+                  type: string
+                  description: Pending browser request ID
+                content:
+                  type: string
+                isError:
+                  type: boolean
+              required:
+                - requestId
+              additionalProperties: false
   /v1/host-cu-result:
     post:
       operationId: hostcuresult_post
@@ -3930,6 +4043,9 @@ paths:
                 isError:
                   type: boolean
                   description: Whether the result is an error
+                imageData:
+                  type: string
+                  description: Optional base64-encoded image bytes for successful image reads
               required:
                 - requestId
               additionalProperties: false
@@ -4298,6 +4414,11 @@ paths:
                 conversationId:
                   description: Scope to a single conversation
                   type: string
+                full:
+                  description:
+                    Full export — include messages, LLM request logs, and usage events for all conversations. Use for test data
+                    debugging.
+                  type: boolean
                 startTime:
                   description: Lower bound epoch ms
                   type: number
@@ -5109,63 +5230,6 @@ paths:
           schema:
             type: string
           description: Conversation ID
-  /v1/permission-mode:
-    get:
-      operationId: permissionmode_get
-      summary: Get permission mode
-      description: Return the current two-axis permission mode (askBeforeActing, hostAccess).
-      tags:
-        - settings
-      responses:
-        "200":
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  askBeforeActing:
-                    type: boolean
-                  hostAccess:
-                    type: boolean
-                required:
-                  - askBeforeActing
-                  - hostAccess
-                additionalProperties: false
-    put:
-      operationId: permissionmode_put
-      summary: Update permission mode
-      description: Update the two-axis permission mode. Requires the permission-controls-v2 feature flag.
-      tags:
-        - settings
-      responses:
-        "200":
-          description: Successful response
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  askBeforeActing:
-                    type: boolean
-                  hostAccess:
-                    type: boolean
-                required:
-                  - askBeforeActing
-                  - hostAccess
-                additionalProperties: false
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                askBeforeActing:
-                  type: boolean
-                hostAccess:
-                  type: boolean
-              additionalProperties: false
   /v1/profiler/runs:
     get:
       operationId: profiler_runs_get
@@ -6710,6 +6774,57 @@ paths:
           required: true
           schema:
             type: string
+  /v1/skills/{id}/files/content:
+    get:
+      operationId: skills_by_id_files_content_get
+      summary: Get skill file content
+      description: Return the content of a single file belonging to an installed or catalog skill.
+      tags:
+        - skills
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  path:
+                    type: string
+                  name:
+                    type: string
+                  size:
+                    type: integer
+                    minimum: -9007199254740991
+                    maximum: 9007199254740991
+                  mimeType:
+                    type: string
+                  isBinary:
+                    type: boolean
+                  content:
+                    anyOf:
+                      - type: string
+                      - type: "null"
+                required:
+                  - path
+                  - name
+                  - size
+                  - mimeType
+                  - isBinary
+                  - content
+                additionalProperties: false
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: path
+          in: query
+          required: true
+          schema:
+            type: string
+          description: Relative path of the file within the skill directory
   /v1/skills/{id}/inspect:
     get:
       operationId: skills_by_id_inspect_get
@@ -7672,7 +7787,7 @@ paths:
     get:
       operationId: usage_breakdown_get
       summary: Get usage breakdown
-      description: Return grouped usage breakdown (by actor, provider, or model).
+      description: Return grouped usage breakdown (by actor, provider, model, or conversation).
       tags:
         - usage
       responses:
@@ -7708,7 +7823,7 @@ paths:
           required: false
           schema:
             type: string
-          description: "Group by: actor, provider, or model (required)"
+          description: "Group by: actor, provider, model, or conversation (required)"
   /v1/usage/daily:
     get:
       operationId: usage_daily_get

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -29,38 +29,38 @@
     "prepack": "node ../scripts/prepack-bundled-deps.mjs"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^0.16.1",
-    "@anthropic-ai/sdk": "^0.78.0",
-    "@google/genai": "^1.40.0",
-    "@modelcontextprotocol/sdk": "^1.15.1",
-    "@qdrant/js-client-rest": "^1.16.2",
-    "@resvg/resvg-js": "^2.6.2",
-    "@sentry/node": "^10.38.0",
+    "@agentclientprotocol/sdk": "0.16.1",
+    "@anthropic-ai/sdk": "0.78.0",
+    "@google/genai": "1.45.0",
+    "@modelcontextprotocol/sdk": "1.27.1",
+    "@qdrant/js-client-rest": "1.17.0",
+    "@resvg/resvg-js": "2.6.2",
+    "@sentry/node": "10.43.0",
     "@vellumai/ces-contracts": "file:../packages/ces-contracts",
     "@vellumai/credential-storage": "file:../packages/credential-storage",
     "@vellumai/egress-proxy": "file:../packages/egress-proxy",
-    "agentmail": "^0.1.0",
-    "archiver": "^7.0.1",
-    "commander": "^13.1.0",
-    "croner": "^10.0.1",
-    "dotenv": "^17.3.1",
-    "drizzle-orm": "^0.38.4",
-    "jszip": "^3.10.1",
-    "minimatch": "^10.2.4",
-    "openai": "^6.18.0",
-    "pino": "^9.6.0",
-    "pino-pretty": "^13.1.3",
-    "playwright": "^1.58.2",
-    "postgres": "^3.4.8",
-    "qrcode": "^1.5.4",
-    "react": "^19.2.4",
-    "rrule": "^2.8.1",
-    "tldts": "^7.0.23",
+    "agentmail": "0.1.19",
+    "archiver": "7.0.1",
+    "commander": "13.1.0",
+    "croner": "10.0.1",
+    "dotenv": "17.3.1",
+    "drizzle-orm": "0.38.4",
+    "jszip": "3.10.1",
+    "minimatch": "10.2.4",
+    "openai": "6.29.0",
+    "pino": "9.14.0",
+    "pino-pretty": "13.1.3",
+    "playwright": "1.58.2",
+    "postgres": "3.4.8",
+    "qrcode": "1.5.4",
+    "react": "19.2.4",
+    "rrule": "2.8.1",
+    "tldts": "7.0.25",
     "tree-sitter-bash": "0.25.1",
-    "uuid": "^11.1.0",
+    "uuid": "11.1.0",
     "web-tree-sitter": "0.26.5",
-    "yaml": "^2.7.1",
-    "zod": "^4.3.6"
+    "yaml": "2.8.2",
+    "zod": "4.3.6"
   },
   "engines": {
     "node": ">=20.12.0"
@@ -75,18 +75,18 @@
     "path-to-regexp": "^8.4.0"
   },
   "devDependencies": {
-    "@types/archiver": "^7.0.0",
-    "@types/bun": "^1.2.4",
-    "@types/node": "^25.2.2",
-    "@types/react": "^19.2.14",
-    "@types/uuid": "^10.0.0",
-    "drizzle-kit": "^0.30.4",
-    "eslint": "^10.0.0",
-    "eslint-plugin-simple-import-sort": "^12.1.1",
-    "fast-check": "^4.5.3",
-    "knip": "^5.83.1",
-    "prettier": "^3.8.1",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.54.0"
+    "@types/archiver": "7.0.0",
+    "@types/bun": "1.3.10",
+    "@types/node": "25.5.0",
+    "@types/react": "19.2.14",
+    "@types/uuid": "10.0.0",
+    "drizzle-kit": "0.30.6",
+    "eslint": "10.0.3",
+    "eslint-plugin-simple-import-sort": "12.1.1",
+    "fast-check": "4.6.0",
+    "knip": "5.86.0",
+    "prettier": "3.8.1",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.57.0"
   }
 }

package/scripts/generate-openapi.ts

@@ -212,8 +212,7 @@ async function collectRoutesFromModules(): Promise<RouteEntry[]> {
  * here if openapi.yaml is also stale. Plan items B2/C2 address this gap.
  */
 const INLINE_ROUTES: RouteEntry[] = [
-  { endpoint: "browser-relay/status", method: "GET" },
-  { endpoint: "browser-relay/command", method: "POST" },
+  { endpoint: "browser-cdp", method: "POST" },
   { endpoint: "conversations", method: "GET" },
   { endpoint: "conversations/seen", method: "POST" },
   { endpoint: "conversations/unread", method: "POST" },