@vellumai/assistant 0.6.4 → 0.6.6

package/src/config/bundled-skills/outlook-calendar/tools/outlook-calendar-rsvp.ts

@@ -1,36 +0,0 @@
-import type {
-  ToolContext,
-  ToolExecutionResult,
-} from "../../../../tools/types.js";
-import * as calendar from "../calendar-client.js";
-import { getCalendarConnection, ok } from "./shared.js";
-
-export async function run(
-  input: Record<string, unknown>,
-  _context: ToolContext,
-): Promise<ToolExecutionResult> {
-  const account = input.account as string | undefined;
-  const eventId = input.event_id as string;
-  const response = input.response as "accepted" | "declined" | "tentative";
-
-  const connection = await getCalendarConnection(account);
-
-  // Fetch the event to get context for the response message
-  const event = await calendar.getEvent(connection, eventId);
-
-  // If the user is the organizer, no RSVP is needed
-  if (event.responseStatus?.response === "organizer") {
-    return ok("You are the organizer of this event. No RSVP needed.");
-  }
-
-  // Send RSVP via the dedicated Microsoft Graph endpoint, notifying the organizer
-  await calendar.rsvpEvent(connection, eventId, response, true);
-
-  const responseLabel =
-    response === "accepted"
-      ? "Accepted"
-      : response === "declined"
-        ? "Declined"
-        : "Tentatively accepted";
-  return ok(`${responseLabel} the event "${event.subject ?? eventId}".`);
-}

package/src/config/bundled-skills/outlook-calendar/tools/shared.ts

@@ -1,17 +0,0 @@
-import type { OAuthConnection } from "../../../../oauth/connection.js";
-import { resolveOAuthConnection } from "../../../../oauth/connection-resolver.js";
-import type { ToolExecutionResult } from "../../../../tools/types.js";
-
-export function ok(content: string): ToolExecutionResult {
-  return { content, isError: false };
-}
-
-export function err(message: string): ToolExecutionResult {
-  return { content: message, isError: true };
-}
-
-export async function getCalendarConnection(
-  account?: string,
-): Promise<OAuthConnection> {
-  return resolveOAuthConnection("outlook", { account });
-}

package/src/config/bundled-skills/outlook-calendar/types.ts

@@ -1,120 +0,0 @@
-/** Microsoft Graph date+time pair. timeZone may be omitted when dateTime carries an offset. */
-export interface OutlookDateTimeZone {
-  dateTime: string;
-  timeZone?: string;
-}
-
-/** Attendee on a calendar event. */
-export interface OutlookCalendarAttendee {
-  emailAddress: { address: string; name?: string };
-  type: "required" | "optional" | "resource";
-  status?: {
-    response:
-      | "none"
-      | "organizer"
-      | "tentativelyAccepted"
-      | "accepted"
-      | "declined"
-      | "notResponded";
-    time?: string;
-  };
-}
-
-/** Physical or virtual location for a calendar event. */
-export interface OutlookLocation {
-  displayName?: string;
-  locationType?: string;
-  address?: Record<string, unknown>;
-  coordinates?: Record<string, unknown>;
-}
-
-/** Rich-text body of a calendar item. */
-export interface OutlookItemBody {
-  contentType: "text" | "html";
-  content: string;
-}
-
-/** A single calendar event from Microsoft Graph. */
-export interface OutlookCalendarEvent {
-  id: string;
-  subject?: string;
-  bodyPreview?: string;
-  body?: OutlookItemBody;
-  start?: OutlookDateTimeZone;
-  end?: OutlookDateTimeZone;
-  location?: OutlookLocation;
-  locations?: OutlookLocation[];
-  attendees?: OutlookCalendarAttendee[];
-  organizer?: { emailAddress: { address: string; name?: string } };
-  isAllDay?: boolean;
-  isCancelled?: boolean;
-  showAs?:
-    | "free"
-    | "tentative"
-    | "busy"
-    | "oof"
-    | "workingElsewhere"
-    | "unknown";
-  importance?: "low" | "normal" | "high";
-  sensitivity?: "normal" | "personal" | "private" | "confidential";
-  webLink?: string;
-  onlineMeetingUrl?: string;
-  createdDateTime?: string;
-  lastModifiedDateTime?: string;
-  seriesMasterId?: string;
-  type?: "singleInstance" | "occurrence" | "exception" | "seriesMaster";
-  categories?: string[];
-  responseStatus?: { response: string; time?: string };
-}
-
-/** Paginated list of calendar events. */
-export interface OutlookCalendarEventListResponse {
-  value?: OutlookCalendarEvent[];
-  "@odata.nextLink"?: string;
-  "@odata.deltaLink"?: string;
-  "@odata.count"?: number;
-}
-
-/** A single schedule item (free/busy block). */
-export interface OutlookScheduleItem {
-  status:
-    | "free"
-    | "tentative"
-    | "busy"
-    | "oof"
-    | "workingElsewhere"
-    | "unknown";
-  start: OutlookDateTimeZone;
-  end: OutlookDateTimeZone;
-  subject?: string;
-  location?: string;
-}
-
-/** Schedule information for one user. */
-export interface OutlookScheduleInformation {
-  scheduleId: string;
-  availabilityView: string;
-  scheduleItems: OutlookScheduleItem[];
-  error?: Record<string, unknown>;
-}
-
-/** Response from the getSchedule endpoint. */
-export interface OutlookScheduleResponse {
-  value?: OutlookScheduleInformation[];
-}
-
-/** A calendar in the user's mailbox. */
-export interface OutlookCalendar {
-  id: string;
-  name?: string;
-  color?: string;
-  isDefaultCalendar?: boolean;
-  canEdit?: boolean;
-  owner?: { name: string; address: string };
-}
-
-/** Paginated list of calendars. */
-export interface OutlookCalendarListResponse {
-  value?: OutlookCalendar[];
-  "@odata.nextLink"?: string;
-}

package/src/config/bundled-skills/screen-watch/SKILL.md

@@ -1,27 +0,0 @@
----
-name: screen-watch
-description: Observe the screen at regular intervals with OCR
-compatibility: "Designed for Vellum personal assistants"
-metadata:
-  emoji: "\U0001F441\uFE0F"
-  vellum:
-    display-name: "Screen Watch"
----
-
-Start observing the screen at regular intervals for a specified duration. Captures OCR text from the active window and provides periodic commentary.
-
-## Usage
-
-Use `start_screen_watch` when the user wants you to monitor what's happening on their screen. The tool captures OCR text from the active window at configurable intervals and provides commentary based on a specified focus area.
-
-## Parameters
-
-- **focus_area** (required) - What to focus on observing
-- **duration_minutes** - How long to watch in minutes (1-15, default 5)
-- **interval_seconds** - Seconds between screen captures (5-30, default 10)
-
-## Constraints
-
-- Only one active watch session per conversation at a time
-- Duration is clamped to 1-15 minutes
-- Capture interval is clamped to 5-30 seconds

package/src/config/bundled-skills/screen-watch/TOOLS.json

@@ -1,35 +0,0 @@
-{
-  "version": 1,
-  "tools": [
-    {
-      "name": "start_screen_watch",
-      "description": "Start observing the screen at regular intervals for a specified duration. Captures OCR text from the active window and provides periodic commentary.",
-      "category": "observation",
-      "risk": "low",
-      "input_schema": {
-        "type": "object",
-        "properties": {
-          "duration_minutes": {
-            "type": "number",
-            "description": "How long to watch in minutes (1-15, default 5)"
-          },
-          "interval_seconds": {
-            "type": "number",
-            "description": "Seconds between screen captures (5-30, default 10)"
-          },
-          "focus_area": {
-            "type": "string",
-            "description": "What to focus on observing"
-          },
-          "activity": {
-            "type": "string",
-            "description": "Brief non-technical explanation of what you are watching and why, shown to the user as a status update. Use simple language a non-technical person would understand."
-          }
-        },
-        "required": ["focus_area"]
-      },
-      "executor": "tools/start-screen-watch.ts",
-      "execution_target": "host"
-    }
-  ]
-}

package/src/config/bundled-skills/screen-watch/tools/start-screen-watch.ts

@@ -1,12 +0,0 @@
-import type {
-  ToolContext,
-  ToolExecutionResult,
-} from "../../../../tools/types.js";
-import { screenWatchTool } from "../../../../tools/watch/screen-watch.js";
-
-export async function run(
-  input: Record<string, unknown>,
-  context: ToolContext,
-): Promise<ToolExecutionResult> {
-  return screenWatchTool.execute(input, context);
-}

package/src/config/bundled-skills/skills-catalog/SKILL.md

@@ -1,84 +0,0 @@
----
-name: skills-catalog
-description: Discover bundled skills and search/install community skills from the skills.sh registry
-compatibility: "Designed for Vellum personal assistants"
-metadata:
-  emoji: "\U0001F9E9"
-  vellum:
-    display-name: "Skills Catalog"
-    activation-hints:
-      - "what can you do"
-      - "find a skill"
-      - "install a skill"
-      - "community skills"
-      - "skills.sh"
-      - "search for skills"
-    avoid-when:
-      - "User is asking about a specific bundled skill already visible in the catalog"
----
-
-You can help the user discover what skills are available and find community skills to extend the assistant's capabilities.
-
-## Bundled skills (first-party)
-
-First-party skills are **bundled** with the assistant - they are compiled in and always available. They do not need to be installed or downloaded. To activate a bundled skill, use the `skill_load` tool:
-
-```
-skill_load skill=<skill-id>
-```
-
-The skill catalog shown in the system prompt lists all bundled skills with their IDs. When a user asks about capabilities, refer to this list to find relevant bundled skills and load them as needed.
-
-## Community skills (skills.sh)
-
-Community skills are published on the skills.sh registry and can be searched, inspected, and installed on demand using the `assistant skills` CLI.
-
-### Searching for community skills
-
-```bash
-assistant skills search "<query>"
-```
-
-Returns matching skills with their slug, source, install counts, and security audit badges. Use this when the user asks for a capability not covered by bundled skills.
-
-### Installing a community skill
-
-**Trust model - check the source guardian before installing:**
-
-- **Vellum-owned** (`vellum-ai/*`): First-party skills published by the Vellum team. Install these directly without prompting - they are vetted and trusted.
-- **Third-party** (any other guardian): Ask the user for permission first. Present the skill name, source, audit results, and install count. Say something like: "I found a community skill that could help, but it's published by a third party - we haven't vetted it. Want to install it anyway?"
-
-```bash
-assistant skills add <owner>/<repo>@<skill-name>
-```
-
-For example:
-```bash
-assistant skills add vercel-labs/skills@find-skills
-```
-
-Once installed, the skill appears in the workspace skills directory and can be loaded with `skill_load` like any other skill.
-
-## Typical flow
-
-1. **User asks about capabilities** - "Can you order food?" or "What can you do?"
-   - Check the bundled skills list in the system prompt
-   - Present relevant skills to the user
-   - Load any that match with `skill_load`
-
-2. **User wants a capability not covered by bundled skills** - "Can you do X?"
-   - Search with `assistant skills search "<query>"`
-   - Present matching results with descriptions, install counts, and audit badges
-   - Check the source guardian to determine trust level (see trust model above)
-   - Install with `assistant skills add <owner>/<repo>@<skill-name>`
-   - Load it with `skill_load`
-
-3. **Skill has dependencies** - if `includes` lists other skill IDs, load those first with `skill_load`
-
-## Notes
-
-- Bundled skills are always available and do not need installation
-- Community skills are installed to the workspace skills directory
-- After installing a community skill, it is auto-enabled and immediately loadable
-- Skills can be enabled or disabled via feature flags without uninstalling them
-- Never install third-party community skills without explicit user confirmation

package/src/config/bundled-skills/slack/SKILL.md

@@ -1,108 +0,0 @@
----
-name: slack
-description: Read, send, and manage Slack messages via the Web API
-compatibility: "Designed for Vellum personal assistants"
-metadata:
-  emoji: "💬"
-  vellum:
-    display-name: "Slack"
----
-
-You help users interact with their Slack workspace. All Slack operations use the **Slack Web API** directly via the `bash` tool with credential proxy — there are no dedicated Slack tools.
-
-## Making Slack API Calls
-
-Use `bash` with these parameters:
-
-- **`network_mode`**: `"proxied"`
-- **`credential_ids`**: `["slack_channel/bot_token"]`
-
-The proxy intercepts requests to `slack.com` and injects the bot token as a `Bearer` header automatically. You never see or handle the token directly.
-
-Example — list channels:
-
-```
-bash {
-  command: "curl -s https://slack.com/api/conversations.list?types=public_channel,private_channel | jq ."
-  network_mode: "proxied"
-  credential_ids: ["slack_channel/bot_token"]
-  activity: "to list your Slack channels"
-}
-```
-
-Refer to https://api.slack.com/methods for available endpoints. The bot token scopes configured in the Slack app manifest determine what's accessible.
-
-## Common Operations
-
-### Reading messages
-
-- `conversations.list` — list channels
-- `conversations.history` — read recent messages in a channel
-- `conversations.replies` — read a full thread
-- `users.info` — resolve user IDs to display names
-
-### Sending messages
-
-- `chat.postMessage` — send a message to a channel or DM
-- `chat.update` — edit a message the bot previously sent
-- `chat.delete` — delete a message the bot previously sent
-
-### Reacting & managing
-
-- `reactions.add` — add an emoji reaction
-- `conversations.join` — join a public channel
-- `conversations.leave` — leave a channel
-- `search.messages` — search across the workspace
-
-### Channel scanning
-
-When the user asks to scan or catch up on Slack:
-
-1. Call `conversations.list` to get active channels, then `conversations.history` for each
-2. Present an overview first: channel names, message counts, top threads
-3. Offer to drill into specific threads with `conversations.replies`
-4. Summarize with attribution: who said what, decisions made, open questions
-
-## User Resolution
-
-When you need to send a DM or look up a Slack user by name, check contacts first to avoid redundant API calls:
-
-1. **Before calling `users.list`**: Use `contact_search` with `query: "<name>"` and `channel_type: "slack"`. If a matching contact has `externalUserId` (Slack user ID) and `externalChatId` (DM channel ID), skip the API lookups and use those IDs directly with `chat.postMessage`.
-
-   When `contact_search` returns notes for the recipient, use them to inform the message's tone, formality, and content. Contact notes capture relationship context and communication preferences that should shape how you write to this person.
-
-2. **After resolving via API**: When you had to call `users.list` or `conversations.open` to resolve a user, save the contact with `contact_upsert` so you can find them by name next time. External Slack IDs (user ID, DM channel ID) are cached automatically by the messaging layer and should not be passed through `contact_upsert`.
-
-## Privacy Rules
-
-**Channel privacy must be respected at all times:**
-
-- Check `is_private` on each channel before sharing content elsewhere
-- Private channel content must NEVER be shared to other channels, DMs, or external destinations
-- If the user asks to share private channel content, explain why you can't and offer alternatives (summarize the topic without quoting, ask the user to share manually)
-- Public channel content can be shared with attribution ("From #channel: ...")
-- Always confirm with the user before sending content to any destination
-
-## Delivery Notes
-
-- For rich content (digests, reports, formatted summaries): use the Slack API directly via `chat.postMessage` with blocks
-- For short alerts: `send_notification` is fine — it lets the notification router pick the best channel
-- For scheduled tasks: always include an explicit Slack API call to deliver results, otherwise output only lives in the conversation log
-
-## Threading
-
-When responding to messages from Slack channels, replies should be threaded. Pass `thread_ts` to `chat.postMessage` to reply in a thread rather than posting a new top-level message.
-
-## Connection
-
-Before making any Slack API calls, verify that Slack is connected. If not connected, load the **slack-app-setup** skill (`skill_load` with `skill: "slack-app-setup"`) and follow its guided flow. Do NOT improvise setup instructions — the `slack-app-setup` skill is the single source of truth. Slack uses Socket Mode and does not require redirect URLs or any OAuth flow.
-
-## Error Handling
-
-If a Slack API call fails due to missing or invalid credentials — for example, an error indicating that `slack_channel/bot_token` is not found, the credential is missing, or the token is invalid — do NOT attempt to fix the credentials manually. Instead, load the **slack-app-setup** skill (`skill_load` with `skill: "slack-app-setup"`) and follow its guided flow to set up or reconnect Slack. Tell the user something like "Slack needs to be reconnected" and start the setup skill.
-
-## Communication Style
-
-- **Be action-oriented.** When the user asks to check Slack, start scanning immediately.
-- **Keep it human.** Never mention OAuth, tokens, APIs, proxies, or credential IDs. If something isn't working, say "Slack needs to be reconnected."
-- **Show progress.** When scanning multiple channels, tell the user what you're doing.

package/src/config/bundled-skills/tasks/SKILL.md

@@ -1,37 +0,0 @@
----
-name: tasks
-description: Two-layer task system with reusable templates and a prioritized work queue
-compatibility: "Designed for Vellum personal assistants"
-metadata:
-  emoji: "✅"
-  vellum:
-    display-name: "Tasks"
-    activation-hints:
-      - "User wants to add, check, or manage items on their to-do list or task queue"
-      - "For one-off action items, not recurring automations (use schedule for those)"
-    avoid-when:
-      - "User wants recurring/scheduled automation — use the schedule skill instead"
----
-
-Two-layer task system: **task templates** (reusable definitions with input placeholders) and **work items** (instances in the Task Queue with priority tiers and status tracking).
-
-## Task Templates
-
-Templates are reusable definitions saved from conversations via `task_save`. They capture the conversation pattern with placeholders that can be run later with different inputs via `task_run`. List templates with `task_list`, delete with `task_delete`.
-
-## Work Items (Task Queue)
-
-Work items are the user-facing "Tasks" managed through conversation. They track status and priority:
-
-- **Priority tiers**: 0 = high, 1 = medium (default), 2 = low
-- **Status flow**: queued -> running -> awaiting_review -> done
-- **Resolution precedence**: work_item_id > task_id > task_name > title
-
-Use `task_list_add` to enqueue items (ad-hoc or from a template), `task_list_show` to view the queue, `task_list_update` to modify, and `task_list_remove` to remove.
-
-## Tips
-
-- When the user says "add to my tasks" or "add to my queue", use `task_list_add` (NOT schedule_create).
-- Use `task_save` only when the user wants to capture a conversation pattern as a reusable template.
-- `task_list` shows saved templates; `task_list_show` shows the active work queue.
-- **Always specify `required_tools`** when calling `task_list_add`. Think about what tools the task will need at execution time and list them explicitly (e.g. `["host_bash"]` for shell commands, `["host_file_read", "host_file_write"]` for file operations, `["web_search", "web_fetch"]` for web lookups). The user must approve these tools before the task can run - omitting them forces a fallback to all tools, which is noisy and may miss non-standard tools the task actually needs.