@vellumai/assistant 0.6.3 → 0.6.4

package/src/security/secure-keys.ts

@@ -17,6 +17,8 @@
  * sidecar and credential data.
  */
 
+import { AsyncLocalStorage } from "node:async_hooks";
+
 import type {
   SecureKeyBackend,
   SecureKeyDeleteResult,
@@ -75,6 +77,18 @@ let _lastReconnectAttempt = 0;
 /** In-flight reconnection promise — concurrent callers share the same attempt. */
 let _reconnectInFlight: Promise<boolean> | undefined;
 
+/**
+ * Per-async-context flag set while we are running the user-registered
+ * `_cesReconnect` callback. Reentrant credential reads from within the
+ * callback (on the same async call chain) must not `await`
+ * `_reconnectInFlight` — that would await the caller's own reconnect and
+ * deadlock until `CREDENTIAL_OP_TIMEOUT_MS` (45s) fires. Using
+ * AsyncLocalStorage (rather than a module-level boolean) scopes the guard
+ * to the actual reentrant stack, so unrelated concurrent callers keep
+ * sharing the in-flight reconnect promise normally.
+ */
+const _reconnectContext = new AsyncLocalStorage<true>();
+
 /**
  * Set to true when a ces-http operation returns an unreachable result.
  * Triggers CES RPC reconnection on the next resolveBackendAsync() call so
@@ -240,6 +254,15 @@ function tryFailoverToCesHttpBackend(
 async function attemptCesReconnection(): Promise<boolean> {
   if (!_cesReconnect) return false;
 
+  // Reentrancy guard. A nested credential read from inside the reconnect
+  // callback must not `await` our own in-flight promise — that would
+  // deadlock on the 45-second credential-op timeout. Report the reconnect
+  // as failed so the caller sees "unreachable" and falls back (env vars,
+  // dead-backend response) without blocking. Concurrent callers on other
+  // async chains don't see the ALS store, so they still share the
+  // in-flight promise normally.
+  if (_reconnectContext.getStore()) return false;
+
   // If a reconnection is already in flight, share it.
   if (_reconnectInFlight) return _reconnectInFlight;
 
@@ -249,7 +272,7 @@ async function attemptCesReconnection(): Promise<boolean> {
   _lastReconnectAttempt = Date.now();
   log.warn("Credential backend unavailable — attempting CES reconnection");
 
-  _reconnectInFlight = (async () => {
+  _reconnectInFlight = _reconnectContext.run(true, async () => {
     try {
       const newClient = await _cesReconnect!();
       if (newClient) {
@@ -262,7 +285,7 @@ async function attemptCesReconnection(): Promise<boolean> {
       log.warn({ err }, "CES reconnection failed");
     }
     return false;
-  })();
+  });
 
   try {
     return await _reconnectInFlight;

package/src/security/token-manager.ts

@@ -101,6 +101,7 @@ interface RefreshConfig {
   secret?: string;
   refreshToken?: string;
   authMethod?: TokenEndpointAuthMethod;
+  tokenExchangeBodyFormat?: "form" | "json";
   connId: string;
 }
 
@@ -166,6 +167,10 @@ async function resolveRefreshConfig(
     | TokenEndpointAuthMethod
     | undefined;
 
+  const tokenExchangeBodyFormat =
+    (provider.tokenExchangeBodyFormat as "form" | "json" | undefined) ??
+    undefined;
+
   return {
     connId: conn.id,
     tokenExchangeUrl,
@@ -173,6 +178,7 @@ async function resolveRefreshConfig(
     secret,
     refreshToken,
     authMethod,
+    tokenExchangeBodyFormat,
   };
 }
 
@@ -192,6 +198,7 @@ async function doRefresh(service: string, connId: string): Promise<string> {
     clientId: resolvedClientId,
     secret,
     authMethod,
+    tokenExchangeBodyFormat,
     refreshToken,
   } = refreshConfig;
 
@@ -222,6 +229,7 @@ async function doRefresh(service: string, connId: string): Promise<string> {
       refreshToken,
       secret,
       authMethod,
+      tokenExchangeBodyFormat,
     );
   } catch (err) {
     circuitBreaker.recordFailure(connId);

package/src/sequence/engine.ts

@@ -6,6 +6,7 @@
  * sends through the messaging layer.
  */
 
+import { emitFeedEvent } from "../home/emit-feed-event.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { getMessages } from "../memory/conversation-crud.js";
 import type { ScheduleMessageProcessor } from "../schedule/scheduler.js";
@@ -200,6 +201,28 @@ async function processEnrollment(
   recordSend(sequence.id);
   recordEvent(sequence.id, enrollment.id, "send", step.index);
 
+  // Fire-and-forget home-feed activity log entry. Each (enrollment,
+  // step) pair is a distinct real signal (an email actually went
+  // out), so the dedupKey embeds both — repeat emits for the same
+  // step are impossible because the enrollment advances after this
+  // line, but if they did occur they'd land on the same entry.
+  void emitFeedEvent({
+    source: "assistant",
+    title: sequence.name,
+    summary: `Sent step ${step.index + 1} of ${sequence.steps.length} to ${enrollment.contactEmail}.`,
+    dedupKey: `sequence-step:${enrollment.id}:${step.index}`,
+  }).catch((err) => {
+    log.warn(
+      {
+        err,
+        sequenceId: sequence.id,
+        enrollmentId: enrollment.id,
+        step: step.index,
+      },
+      "Failed to emit sequence step feed event",
+    );
+  });
+
   // Advance to the next step
   const nextStepIndex = enrollment.currentStep + 1;
   if (nextStepIndex >= sequence.steps.length) {

package/src/sequence/types.ts

@@ -26,7 +26,7 @@ export interface Sequence {
   id: string;
   name: string;
   description: string | null;
-  channel: string; // messaging channel (gmail, agentmail, slack)
+  channel: string; // messaging channel (gmail, email, slack)
   steps: SequenceStep[];
   exitOnReply: boolean;
   status: SequenceStatus;

package/src/skills/catalog-files.ts

@@ -29,14 +29,16 @@ import {
 import { basename, join, posix, sep } from "node:path";
 
 import { getPlatformBaseUrl } from "../config/env.js";
+import type { SlimSkillResponse } from "../daemon/message-types/skills.js";
 import {
   isTextMimeType as isTextMime,
   MAX_INLINE_TEXT_SIZE,
 } from "../runtime/routes/workspace-utils.js";
 import { getLogger } from "../util/logger.js";
 import { readPlatformToken } from "../util/platform.js";
-import { getCatalog } from "./catalog-cache.js";
-import { getRepoSkillsDir } from "./catalog-install.js";
+import { getCachedCatalogSync, getCatalog } from "./catalog-cache.js";
+import { type CatalogSkill, getRepoSkillsDir } from "./catalog-install.js";
+import type { SkillFileProvider } from "./skill-file-provider.js";
 
 const log = getLogger("catalog-files");
 
@@ -490,3 +492,63 @@ export async function readCatalogSkillFileContent(
     content: response.content,
   };
 }
+
+// ─── Catalog-to-slim conversion ──────────────────────────────────────────────
+
+/**
+ * Map a `CatalogSkill` (from the Vellum platform API) to a `SlimSkillResponse`
+ * shaped for the "available catalog skill" case. Shared between
+ * `listSkillsWithCatalog` (merging catalog entries into the installed list),
+ * `getSkillFiles` (catalog fallback for preview listings), and the
+ * `VellumCatalogProvider`. Keeping the mapping in one place avoids divergence
+ * between the list and detail paths.
+ *
+ * Extracted here (rather than in `daemon/handlers/skills.ts`) to avoid a
+ * circular import — catalog-files depends on `catalog-cache.ts`, which would
+ * otherwise be reachable via the handler module.
+ */
+export function catalogSkillToSlim(cs: CatalogSkill): SlimSkillResponse {
+  return {
+    id: cs.id,
+    name: cs.metadata?.vellum?.["display-name"] ?? cs.name,
+    description: cs.description,
+    emoji: cs.emoji,
+    kind: "catalog",
+    origin: "vellum",
+    status: "available",
+  };
+}
+
+// ─── Vellum Catalog Provider ─────────────────────────────────────────────────
+
+/**
+ * Create a `SkillFileProvider` that wraps the existing catalog-files functions
+ * for the Vellum first-party catalog. This is the first provider implementation
+ * in the unified file-preview chain.
+ */
+export function createVellumCatalogProvider(): SkillFileProvider {
+  return {
+    canHandle(skillId: string): boolean {
+      const cached = getCachedCatalogSync();
+      return cached.some((s) => s.id === skillId);
+    },
+
+    listFiles(skillId: string): Promise<SkillFileEntry[] | null> {
+      return readCatalogSkillFiles(skillId);
+    },
+
+    readFileContent(
+      skillId: string,
+      sanitizedPath: string,
+    ): Promise<SkillFileEntry | null> {
+      return readCatalogSkillFileContent(skillId, sanitizedPath);
+    },
+
+    async toSlimSkill(skillId: string): Promise<SlimSkillResponse | null> {
+      const catalog = await getCatalog();
+      const cs = catalog.find((s) => s.id === skillId);
+      if (!cs) return null;
+      return catalogSkillToSlim(cs);
+    },
+  };
+}

package/src/skills/category-inference.ts

@@ -0,0 +1,122 @@
+/**
+ * Skill category inference — ports the Swift `inferCategory` logic from
+ * `ConstellationView.swift` to TypeScript for server-side use.
+ *
+ * Pure function with no side effects or external dependencies.
+ */
+
+export type SkillCategory =
+  | "communication"
+  | "productivity"
+  | "development"
+  | "media"
+  | "automation"
+  | "webSocial"
+  | "knowledge"
+  | "integration";
+
+export const SKILL_CATEGORIES: SkillCategory[] = [
+  "communication",
+  "productivity",
+  "development",
+  "automation",
+  "media",
+  "webSocial",
+  "knowledge",
+  "integration",
+];
+
+const CATEGORY_KEYWORDS: [SkillCategory, string[]][] = [
+  [
+    "communication",
+    [
+      "email",
+      "message",
+      "messaging",
+      "chat",
+      "phone",
+      "phone call",
+      "voice call",
+      "video call",
+      "contact",
+      "notification",
+      "followup",
+      "slack",
+      "telegram",
+    ],
+  ],
+  [
+    "productivity",
+    [
+      "task",
+      "calendar",
+      "reminder",
+      "schedule",
+      "document",
+      "playbook",
+      "notion",
+    ],
+  ],
+  [
+    "development",
+    [
+      "code",
+      "app builder",
+      "github",
+      "developer",
+      "programming",
+      "debug",
+      "typescript",
+      "frontend",
+      "subagent",
+      "api mapping",
+      "cli discovery",
+    ],
+  ],
+  ["automation", ["browser", "computer use", "macos", "watcher", "automat"]],
+  [
+    "media",
+    ["image", "screen", "media", "transcri", "video", "audio", "recording"],
+  ],
+  [
+    "webSocial",
+    [
+      "x.com",
+      "twitter",
+      "public ingress",
+      "influencer",
+      "doordash",
+      "amazon",
+      "restaurant",
+    ],
+  ],
+  [
+    "knowledge",
+    [
+      "knowledge",
+      "weather",
+      "start the day",
+      "skills catalog",
+      "self upgrade",
+      "briefing",
+    ],
+  ],
+  ["integration", ["oauth", "setup", "configure", "connect", "webhook"]],
+];
+
+export function inferCategory(
+  name: string,
+  description: string,
+): SkillCategory {
+  const combined = `${name} ${description}`.toLowerCase();
+
+  for (const [category, keywords] of CATEGORY_KEYWORDS) {
+    for (const keyword of keywords) {
+      if (combined.includes(keyword)) {
+        return category;
+      }
+    }
+  }
+
+  return "knowledge";
+}

package/src/skills/clawhub-files.ts

@@ -0,0 +1,213 @@
+/**
+ * clawhub-files — SkillFileProvider implementation for clawhub-origin skills.
+ *
+ * Backed by the `clawhub inspect` CLI. The initial `clawhubInspect` call
+ * fetches file metadata *and* SKILL.md content in a single round trip.
+ * Results are cached in memory (5-minute TTL) so that subsequent calls to
+ * `listFiles`, `readFileContent`, and `toSlimSkill` for the same slug
+ * reuse the inspect data without re-running the CLI.
+ *
+ * For non-SKILL.md files, `readFileContent` delegates to `clawhubInspectFile`
+ * which runs a second CLI call for the specific file.
+ */
+
+import { basename } from "node:path";
+
+import type { SlimSkillResponse } from "../daemon/message-types/skills.js";
+import { isTextMimeType as isTextMime } from "../runtime/routes/workspace-utils.js";
+import { getLogger } from "../util/logger.js";
+import type { SkillFileEntry } from "./catalog-files.js";
+import {
+  clawhubInspect,
+  clawhubInspectFile,
+  type ClawhubInspectResult,
+  validateSlug,
+} from "./clawhub.js";
+import type { SkillFileProvider } from "./skill-file-provider.js";
+
+const log = getLogger("clawhub-files");
+
+// ─── Inspect cache ────────────────────────────────────────────────────────────
+
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+interface CacheEntry {
+  data: ClawhubInspectResult;
+  expiresAt: number;
+}
+
+const inspectCache = new Map<string, CacheEntry>();
+
+function getCached(slug: string): ClawhubInspectResult | null {
+  const entry = inspectCache.get(slug);
+  if (!entry) return null;
+  if (Date.now() > entry.expiresAt) {
+    inspectCache.delete(slug);
+    return null;
+  }
+  return entry.data;
+}
+
+function setCache(slug: string, data: ClawhubInspectResult): void {
+  inspectCache.set(slug, { data, expiresAt: Date.now() + CACHE_TTL_MS });
+}
+
+/**
+ * Run `clawhubInspect` with caching. Returns the inspect result or `null`.
+ */
+async function inspectCached(
+  slug: string,
+): Promise<ClawhubInspectResult | null> {
+  const cached = getCached(slug);
+  if (cached) return cached;
+
+  const result = await clawhubInspect(slug);
+  if (!result.data) {
+    log.warn({ slug, error: result.error }, "clawhub inspect failed");
+    return null;
+  }
+  setCache(slug, result.data);
+  return result.data;
+}
+
+// ─── Binary classification ───────────────────────────────────────────────────
+
+/**
+ * Classify a file as binary from its name and optional contentType field.
+ * If the contentType from the inspect result is present and recognised,
+ * prefer it; otherwise fall back to Bun's extension-based MIME detection
+ * (same strategy as `catalog-files.ts`).
+ */
+function classifyBinary(fileName: string, contentType?: string): boolean {
+  if (contentType) {
+    return !isTextMime(contentType, fileName);
+  }
+  const mime = Bun.file(fileName).type;
+  return !isTextMime(mime, fileName);
+}
+
+// ─── Provider factory ─────────────────────────────────────────────────────────
+
+/**
+ * Create a `SkillFileProvider` for clawhub-origin skills.
+ *
+ * `canHandle` returns `true` for slugs that pass clawhub's `validateSlug`
+ * regex AND do not look like a skills.sh slug (skills.sh slugs have three
+ * slash-separated segments: `owner/repo/skill`).
+ */
+export function createClawhubProvider(): SkillFileProvider {
+  return {
+    canHandle(skillId: string): boolean {
+      if (!validateSlug(skillId)) return false;
+      // skills.sh slugs have ≥ 3 segments (owner/repo/skill)
+      if (skillId.split("/").length >= 3) return false;
+      return true;
+    },
+
+    async listFiles(skillId: string): Promise<SkillFileEntry[] | null> {
+      const data = await inspectCached(skillId);
+      if (!data || !data.files) return null;
+
+      const entries: SkillFileEntry[] = data.files.map((f) => {
+        const name = basename(f.path);
+        const isBinary = classifyBinary(name, f.contentType);
+        return {
+          path: f.path,
+          name,
+          size: f.size,
+          mimeType: f.contentType ?? Bun.file(name).type,
+          isBinary,
+          content: null,
+        };
+      });
+      entries.sort((a, b) => a.path.localeCompare(b.path));
+      return entries;
+    },
+
+    async readFileContent(
+      skillId: string,
+      sanitizedPath: string,
+    ): Promise<SkillFileEntry | null> {
+      // If the requested path is SKILL.md and we have cached inspect data
+      // with skillMdContent, return it directly without a second CLI call.
+      const cached = getCached(skillId);
+      if (
+        cached &&
+        sanitizedPath === "SKILL.md" &&
+        cached.skillMdContent != null
+      ) {
+        const name = "SKILL.md";
+        return {
+          path: sanitizedPath,
+          name,
+          size: cached.skillMdContent.length,
+          mimeType: "text/markdown",
+          isBinary: false,
+          content: cached.skillMdContent,
+        };
+      }
+
+      const name = basename(sanitizedPath);
+      const isBinary = classifyBinary(name);
+
+      // For non-SKILL.md files (or when SKILL.md isn't cached), run
+      // a dedicated inspect call for the specific file.
+      const content = await clawhubInspectFile(skillId, sanitizedPath);
+
+      // Binary files: return metadata with content: null (matching the
+      // contract followed by vellum and skills.sh providers). clawhubInspectFile
+      // returns null for binary files, which is expected.
+      if (isBinary) {
+        // Look up file metadata from cached inspect result if available.
+        const inspectData =
+          getCached(skillId) ?? (await inspectCached(skillId));
+        const fileMeta = inspectData?.files?.find(
+          (f) => f.path === sanitizedPath,
+        );
+        return {
+          path: sanitizedPath,
+          name,
+          size: fileMeta?.size ?? 0,
+          mimeType: fileMeta?.contentType ?? Bun.file(name).type,
+          isBinary: true,
+          content: null,
+        };
+      }
+
+      // Text file but content fetch failed — file doesn't exist.
+      if (content == null) return null;
+
+      return {
+        path: sanitizedPath,
+        name,
+        size: content.length,
+        mimeType: Bun.file(name).type,
+        isBinary: false,
+        content,
+      };
+    },
+
+    async toSlimSkill(skillId: string): Promise<SlimSkillResponse | null> {
+      const data = await inspectCached(skillId);
+      if (!data) return null;
+
+      return {
+        id: data.skill.slug,
+        name: data.skill.displayName,
+        description: data.skill.summary,
+        kind: "catalog",
+        status: "available",
+        origin: "clawhub",
+        slug: data.skill.slug,
+        author: data.owner?.handle ?? "",
+        stars: data.stats?.stars ?? 0,
+        installs: data.stats?.installs ?? 0,
+        reports: 0,
+        publishedAt: data.updatedAt
+          ? new Date(data.updatedAt).toISOString()
+          : undefined,
+        version: data.latestVersion?.version ?? "",
+      };
+    },
+  };
+}