@vellumai/assistant 0.6.5 → 0.7.0

package/src/config/schemas/llm.ts

@@ -13,7 +13,7 @@ import { z } from "zod";
 // Provider enum
 // ---------------------------------------------------------------------------
 
-export const LLMProvider = z.enum([
+const LLMProvider = z.enum([
   "anthropic",
   "openai",
   "gemini",
@@ -21,7 +21,7 @@ export const LLMProvider = z.enum([
   "fireworks",
   "openrouter",
 ]);
-export type LLMProvider = z.infer<typeof LLMProvider>;
+type LLMProvider = z.infer<typeof LLMProvider>;
 
 // ---------------------------------------------------------------------------
 // Call-site enum
@@ -39,11 +39,15 @@ export const LLMCallSiteEnum = z.enum([
   "subagentSpawn",
   "heartbeatAgent",
   "filingAgent",
+  "compactionAgent",
   "analyzeConversation",
   "callAgent",
   "memoryExtraction",
   "memoryConsolidation",
   "memoryRetrieval",
+  "memoryV2Migration",
+  "memoryV2Sweep",
+  "recall",
   "narrativeRefinement",
   "patternScan",
   "conversationSummarization",
@@ -57,8 +61,6 @@ export const LLMCallSiteEnum = z.enum([
   "guardianQuestionCopy",
   "approvalCopy",
   "approvalConversation",
-  "watchCommentary",
-  "watchSummary",
   "interactionClassifier",
   "styleAnalyzer",
   "inviteInstructionGenerator",
@@ -66,19 +68,42 @@ export const LLMCallSiteEnum = z.enum([
   "meetConsentMonitor",
   "meetChatOpportunity",
   "inference",
+  "feedEventCopy",
+  "trustRuleSuggestion",
 ]);
 export type LLMCallSite = z.infer<typeof LLMCallSiteEnum>;
 
 // ---------------------------------------------------------------------------
-// Effort & Speed
+// Effort, Speed & Verbosity
 // ---------------------------------------------------------------------------
 
-export const EffortEnum = z.enum(["low", "medium", "high", "xhigh", "max"]);
+/**
+ * Reasoning/thinking effort tier. `"none"` is a Vellum-specific value meaning
+ * "the user has opted out of provider-side reasoning". Each provider
+ * translates it however actually disables reasoning on that wire format:
+ * OpenAI Responses sends `reasoning.effort: "none"` and Chat Completions
+ * sends `reasoning_effort: "none"` explicitly, because omitting the field
+ * causes OpenAI to default to `"medium"`; Anthropic omits
+ * `output_config.effort` entirely, which is the documented opt-out there.
+ * When adding a new provider, pick whichever encoding actually disables
+ * reasoning on that wire format — do not assume omission is universally safe.
+ * All other values map to provider-specific tiers via each provider's own
+ * mapping table.
+ */
+const EffortEnum = z.enum(["none", "low", "medium", "high", "xhigh", "max"]);
 export type Effort = z.infer<typeof EffortEnum>;
 
 export const SpeedEnum = z.enum(["standard", "fast"]);
 export type Speed = z.infer<typeof SpeedEnum>;
 
+/**
+ * Response verbosity. Currently consumed by OpenAI's Responses API as
+ * `text.verbosity` (low|medium|high). Providers that don't support this knob
+ * are stripped in `retry.ts` normalization.
+ */
+const VerbosityEnum = z.enum(["low", "medium", "high"]);
+export type Verbosity = z.infer<typeof VerbosityEnum>;
+
 // ---------------------------------------------------------------------------
 // Leaf primitives (shared between LLMConfigBase and LLMConfigFragment)
 //
@@ -121,7 +146,7 @@ const TemperatureSchema = z.number().min(0).max(2).nullable();
 const ThinkingEnabledSchema = z.boolean();
 const ThinkingStreamThinkingSchema = z.boolean();
 
-export const ThinkingSchema = z.object({
+const ThinkingSchema = z.object({
   enabled: ThinkingEnabledSchema.default(true),
   streamThinking: ThinkingStreamThinkingSchema.default(true),
 });
@@ -173,7 +198,7 @@ const ContextTargetBudgetRatioSchema = z.number().finite().gt(0).lte(1);
 const ContextCompactThresholdSchema = z.number().finite().gt(0).lte(1);
 const ContextSummaryBudgetRatioSchema = z.number().finite().gt(0).lte(1);
 
-export const ContextWindowSchema = z.object({
+const ContextWindowSchema = z.object({
   enabled: ContextEnabledSchema.default(true),
   maxInputTokens: ContextMaxInputTokensSchema.default(200000),
   targetBudgetRatio: ContextTargetBudgetRatioSchema.default(0.3),
@@ -211,7 +236,7 @@ const ContextWindowDeepPartialSchema = z.object({
 
 const OpenRouterOnlyItemSchema = z.string().min(1);
 
-export const OpenRouterSchema = z.object({
+const OpenRouterSchema = z.object({
   only: z.array(OpenRouterOnlyItemSchema).default([]),
 });
 export type OpenRouter = z.infer<typeof OpenRouterSchema>;
@@ -224,7 +249,7 @@ const OpenRouterDeepPartialSchema = z.object({
 // Pricing overrides
 // ---------------------------------------------------------------------------
 
-export const PricingOverrideSchema = z.object({
+const PricingOverrideSchema = z.object({
   provider: z.string(),
   modelPattern: z.string(),
   inputPer1M: z.number().nonnegative(),
@@ -248,6 +273,7 @@ export const LLMConfigBase = z.object({
   maxTokens: MaxTokensSchema.default(64000),
   effort: EffortEnum.default("max"),
   speed: SpeedEnum.default("standard"),
+  verbosity: VerbosityEnum.default("medium"),
   temperature: TemperatureSchema.default(null),
   thinking: ThinkingSchema.default(ThinkingSchema.parse({})),
   contextWindow: ContextWindowSchema.default(ContextWindowSchema.parse({})),
@@ -267,6 +293,7 @@ export const LLMConfigFragment = z.object({
   maxTokens: MaxTokensSchema.optional(),
   effort: EffortEnum.optional(),
   speed: SpeedEnum.optional(),
+  verbosity: VerbosityEnum.optional(),
   temperature: TemperatureSchema.optional(),
   thinking: ThinkingFragmentSchema.optional(),
   contextWindow: ContextWindowDeepPartialSchema.optional(),
@@ -292,6 +319,9 @@ export const LLMSchema = z
   .object({
     default: LLMConfigBase.default(LLMConfigBase.parse({})),
     profiles: z.record(z.string().min(1), LLMConfigFragment).default({}),
+    // Presentation-only order for named profiles. The resolver ignores this;
+    // clients use it to render profile pickers consistently.
+    profileOrder: z.array(z.string().min(1)).default([]),
     // `partialRecord` (vs `record`) makes call-site keys optional while still
     // rejecting keys that aren't members of `LLMCallSiteEnum` — exactly the
     // behavior we want (typo detection without requiring callers to declare
@@ -299,6 +329,7 @@ export const LLMSchema = z
     // are seeded into the user's on-disk config by migration 040, not at
     // schema level, so `LLMSchema.parse({})` yields an empty map.
     callSites: z.partialRecord(LLMCallSiteEnum, LLMCallSiteConfig).default({}),
+    activeProfile: z.string().min(1).optional(),
     pricingOverrides: z.array(PricingOverrideSchema).default([]),
   })
   .superRefine((config, ctx) => {
@@ -313,6 +344,16 @@ export const LLMSchema = z
         });
       }
     }
+    if (
+      config.activeProfile != null &&
+      !profileNames.has(config.activeProfile)
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["activeProfile"],
+        message: `Profile "${config.activeProfile}" referenced by llm.activeProfile is not defined in llm.profiles`,
+      });
+    }
   });
 
 export type LLMConfig = z.infer<typeof LLMSchema>;

package/src/config/schemas/memory-storage.ts

@@ -38,7 +38,7 @@ export const MemoryEmbeddingsConfigSchema = z
       .describe("Model name for the OpenAI embedding provider"),
     geminiModel: z
       .string({ error: "memory.embeddings.geminiModel must be a string" })
-      .default("gemini-embedding-2-preview")
+      .default("gemini-embedding-2")
       .describe("Model name for the Gemini embedding provider"),
     geminiTaskType: z
       .enum(

package/src/config/schemas/memory-v2.ts

@@ -0,0 +1,176 @@
+import { z } from "zod";
+
+/**
+ * Tolerance for floating-point comparisons of weight sums. Using 0.001 lets
+ * users specify weights to three decimal places without spurious rejections,
+ * while still catching obvious mis-sums.
+ */
+const WEIGHT_SUM_TOLERANCE = 0.001;
+
+/**
+ * Memory v2 (concept-page activation model) configuration.
+ *
+ * Activation weights (`d`, `c_user`, `c_assistant`, `c_now`) must sum to 1.0
+ * because they form a convex combination in the per-turn activation formula:
+ *   A_o = d·prev + c_user·sim_u + c_assistant·sim_a + c_now·sim_n
+ *
+ * Hybrid retrieval weights (`dense_weight`, `sparse_weight`) must likewise
+ * sum to 1.0 since they fuse normalized dense and sparse similarity scores.
+ */
+export const MemoryV2ConfigSchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "memory.v2.enabled must be a boolean" })
+      .default(false)
+      .describe(
+        "Whether the v2 memory subsystem (concept-page activation model) is enabled. Independent of the memory-v2-enabled feature flag — both must be true for v2 to run.",
+      ),
+    sweep_enabled: z
+      .boolean({ error: "memory.v2.sweep_enabled must be a boolean" })
+      .default(false)
+      .describe(
+        "Whether the v2 idle-debounced sweep job is enabled. Off by default — `remember()` is the primary capture path; opt in only when the model is missing entries the sweep would have caught.",
+      ),
+    d: z
+      .number({ error: "memory.v2.d must be a number" })
+      .min(0, "memory.v2.d must be >= 0")
+      .max(1, "memory.v2.d must be <= 1")
+      .default(0.3)
+      .describe(
+        "Decay weight on prior activation in the per-turn activation formula",
+      ),
+    c_user: z
+      .number({ error: "memory.v2.c_user must be a number" })
+      .min(0, "memory.v2.c_user must be >= 0")
+      .max(1, "memory.v2.c_user must be <= 1")
+      .default(0.3)
+      .describe(
+        "Weight on similarity to the latest user message in the per-turn activation formula",
+      ),
+    c_assistant: z
+      .number({ error: "memory.v2.c_assistant must be a number" })
+      .min(0, "memory.v2.c_assistant must be >= 0")
+      .max(1, "memory.v2.c_assistant must be <= 1")
+      .default(0.2)
+      .describe(
+        "Weight on similarity to the latest assistant message in the per-turn activation formula",
+      ),
+    c_now: z
+      .number({ error: "memory.v2.c_now must be a number" })
+      .min(0, "memory.v2.c_now must be >= 0")
+      .max(1, "memory.v2.c_now must be <= 1")
+      .default(0.2)
+      .describe(
+        "Weight on similarity to NOW context (essentials/threads/recent) in the per-turn activation formula",
+      ),
+    k: z
+      .number({ error: "memory.v2.k must be a number" })
+      .min(0, "memory.v2.k must be >= 0")
+      .max(1, "memory.v2.k must be <= 1")
+      .default(0.5)
+      .describe(
+        "Spreading-activation propagation coefficient — fraction of own activation that flows to neighbors per hop",
+      ),
+    hops: z
+      .number({ error: "memory.v2.hops must be a number" })
+      .int("memory.v2.hops must be an integer")
+      .nonnegative("memory.v2.hops must be non-negative")
+      .default(2)
+      .describe(
+        "Maximum BFS distance for spreading activation across the concept graph",
+      ),
+    top_k: z
+      .number({ error: "memory.v2.top_k must be a number" })
+      .int("memory.v2.top_k must be an integer")
+      .positive("memory.v2.top_k must be a positive integer")
+      .default(20)
+      .describe(
+        "Number of top-activation concept pages considered for injection per turn",
+      ),
+    top_k_skills: z
+      .number({ error: "memory.v2.top_k_skills must be a number" })
+      .int()
+      .nonnegative()
+      .default(5)
+      .describe(
+        "Cap on the per-turn skill-autoinjection slate rendered in `### Skills You Can Use`. 0 disables skill autoinjection without code changes.",
+      ),
+    epsilon: z
+      .number({ error: "memory.v2.epsilon must be a number" })
+      .min(0, "memory.v2.epsilon must be >= 0")
+      .max(1, "memory.v2.epsilon must be <= 1")
+      .default(0.01)
+      .describe(
+        "Activation cutoff — slugs with activation <= epsilon are dropped from the persisted state",
+      ),
+    dense_weight: z
+      .number({ error: "memory.v2.dense_weight must be a number" })
+      .min(0, "memory.v2.dense_weight must be >= 0")
+      .max(1, "memory.v2.dense_weight must be <= 1")
+      .default(0.7)
+      .describe(
+        "Weight on dense (cosine) similarity in the hybrid retrieval score",
+      ),
+    sparse_weight: z
+      .number({ error: "memory.v2.sparse_weight must be a number" })
+      .min(0, "memory.v2.sparse_weight must be >= 0")
+      .max(1, "memory.v2.sparse_weight must be <= 1")
+      .default(0.3)
+      .describe(
+        "Weight on sparse (BM25-style) similarity in the hybrid retrieval score",
+      ),
+    consolidation_interval_hours: z
+      .number({
+        error: "memory.v2.consolidation_interval_hours must be a number",
+      })
+      .int("memory.v2.consolidation_interval_hours must be an integer")
+      .positive(
+        "memory.v2.consolidation_interval_hours must be a positive integer",
+      )
+      .default(4)
+      .describe(
+        "Hours between scheduled consolidation runs that synthesize buffered memories into concept pages",
+      ),
+    max_page_chars: z
+      .number({ error: "memory.v2.max_page_chars must be a number" })
+      .int("memory.v2.max_page_chars must be an integer")
+      .positive("memory.v2.max_page_chars must be a positive integer")
+      .default(5000)
+      .describe(
+        "Soft upper bound on concept-page body length — pages exceeding this are flagged for split during consolidation",
+      ),
+  })
+  .describe(
+    "Memory v2 — concept-page activation model with hourly LLM-driven consolidation",
+  )
+  .superRefine((config, ctx) => {
+    const activationSum =
+      config.d + config.c_user + config.c_assistant + config.c_now;
+    if (Math.abs(activationSum - 1.0) >= WEIGHT_SUM_TOLERANCE) {
+      const message = `memory.v2 activation weights (d + c_user + c_assistant + c_now) must sum to 1.0 (got ${activationSum.toFixed(4)})`;
+      // Emit on every contributing field so validateWithSchema's
+      // delete-and-retry repair can strip the offending values and fall
+      // back to the documented defaults rather than wiping the whole v2
+      // block.
+      for (const path of ["d", "c_user", "c_assistant", "c_now"] as const) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [path],
+          message,
+        });
+      }
+    }
+    const hybridSum = config.dense_weight + config.sparse_weight;
+    if (Math.abs(hybridSum - 1.0) >= WEIGHT_SUM_TOLERANCE) {
+      const message = `memory.v2 hybrid weights (dense_weight + sparse_weight) must sum to 1.0 (got ${hybridSum.toFixed(4)})`;
+      for (const path of ["dense_weight", "sparse_weight"] as const) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [path],
+          message,
+        });
+      }
+    }
+  });
+
+export type MemoryV2Config = z.infer<typeof MemoryV2ConfigSchema>;

package/src/config/schemas/memory.ts

@@ -15,6 +15,7 @@ import {
   MemorySegmentationConfigSchema,
   QdrantConfigSchema,
 } from "./memory-storage.js";
+import { MemoryV2ConfigSchema } from "./memory-v2.js";
 
 export const MemoryConfigSchema = z
   .object({
@@ -45,6 +46,7 @@ export const MemoryConfigSchema = z
     summarization: MemorySummarizationConfigSchema.default(
       MemorySummarizationConfigSchema.parse({}),
     ),
+    v2: MemoryV2ConfigSchema.default(MemoryV2ConfigSchema.parse({})),
   })
   .describe(
     "Long-term memory system — stores, retrieves, and manages persistent knowledge across conversations",

package/src/config/schemas/security.ts

@@ -1,9 +1,6 @@
 import { z } from "zod";
 
 const VALID_SECRET_ACTIONS = ["redact", "warn", "block", "prompt"] as const;
-const VALID_PERMISSIONS_MODES = ["strict", "workspace"] as const;
-
-export { VALID_PERMISSIONS_MODES, VALID_SECRET_ACTIONS };
 
 const CustomSecretPatternSchema = z
   .object({
@@ -67,61 +64,4 @@ export const SecretDetectionConfigSchema = z
     "Automatic secret detection and redaction to prevent leaking sensitive data",
   );
 
-export const PermissionsConfigSchema = z
-  .object({
-    mode: z
-      .enum(VALID_PERMISSIONS_MODES, {
-        error: `permissions.mode must be one of: ${VALID_PERMISSIONS_MODES.join(
-          ", ",
-        )}`,
-      })
-      .default("workspace")
-      .describe(
-        "Permission mode — 'strict' requires explicit approval for all operations, 'workspace' allows operations within the workspace",
-      ),
-    hostAccess: z
-      .boolean({
-        error: "permissions.hostAccess must be a boolean",
-      })
-      .default(false)
-      .describe(
-        "Whether the assistant can execute commands on the host machine without prompting",
-      ),
-    autoApproveUpTo: z
-      .union([
-        z.enum(["none", "low", "medium"], {
-          error:
-            "permissions.autoApproveUpTo must be one of: none, low, medium",
-        }),
-        z.object({
-          conversation: z
-            .enum(["none", "low", "medium"])
-            .default("low")
-            .describe(
-              "Threshold for interactive conversation sessions (default: low)",
-            ),
-          background: z
-            .enum(["none", "low", "medium"])
-            .default("medium")
-            .describe(
-              "Threshold for non-interactive guardian sessions (default: medium)",
-            ),
-          headless: z
-            .enum(["none", "low", "medium"])
-            .default("none")
-            .describe(
-              "Threshold for non-interactive non-guardian sessions (default: none)",
-            ),
-        }),
-      ])
-      .default({ conversation: "low", background: "medium", headless: "none" })
-      .describe(
-        "Auto-approve tools at or below this risk level without prompting. " +
-          "Accepts a scalar ('none', 'low', 'medium') applied to all contexts, " +
-          "or an object with per-context overrides: { conversation, background, headless }.",
-      ),
-  })
-  .describe("Permission enforcement mode for tool operations");
-
 export type SecretDetectionConfig = z.infer<typeof SecretDetectionConfigSchema>;
-export type PermissionsConfig = z.infer<typeof PermissionsConfigSchema>;

package/src/config/schemas/services.ts

@@ -23,7 +23,7 @@ export const VALID_WEB_SEARCH_PROVIDERS = [
   "inference-provider-native",
 ] as const;
 
-export const BaseServiceSchema = z.object({
+const BaseServiceSchema = z.object({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type BaseService = z.infer<typeof BaseServiceSchema>;
@@ -54,36 +54,74 @@ export const WebSearchServiceSchema = BaseServiceSchema.extend({
 });
 export type WebSearchService = z.infer<typeof WebSearchServiceSchema>;
 
-export const GoogleOAuthServiceSchema = BaseServiceSchema.extend({
+const GoogleOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type GoogleOAuthService = z.infer<typeof GoogleOAuthServiceSchema>;
 
-export const OutlookOAuthServiceSchema = BaseServiceSchema.extend({
+const OutlookOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type OutlookOAuthService = z.infer<typeof OutlookOAuthServiceSchema>;
 
-export const LinearOAuthServiceSchema = BaseServiceSchema.extend({
+const LinearOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type LinearOAuthService = z.infer<typeof LinearOAuthServiceSchema>;
 
-export const GitHubOAuthServiceSchema = BaseServiceSchema.extend({
+const GitHubOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type GitHubOAuthService = z.infer<typeof GitHubOAuthServiceSchema>;
 
-export const NotionOAuthServiceSchema = BaseServiceSchema.extend({
+const NotionOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type NotionOAuthService = z.infer<typeof NotionOAuthServiceSchema>;
 
-export const TwitterOAuthServiceSchema = BaseServiceSchema.extend({
+const TwitterOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 export type TwitterOAuthService = z.infer<typeof TwitterOAuthServiceSchema>;
 
+/**
+ * `services.meet.host.*` — daemon-side knobs for the externalized meet-join
+ * skill process. Kept narrow: only the values the daemon reads before the
+ * meet-host child is spawned live here. Skill-internal configuration
+ * (avatar renderer, consent copy, proactive-chat keywords, etc.) lives in
+ * `skills/meet-join/config-schema.ts` and is sourced from the separate
+ * `<workspace>/config/meet.json` file the skill owns.
+ */
+const MeetHostConfigSchema = z
+  .object({
+    idle_timeout_ms: z
+      .number({
+        error: "services.meet.host.idle_timeout_ms must be a number",
+      })
+      .int()
+      .nonnegative()
+      .optional()
+      .describe(
+        "Idle window in milliseconds after the last active meet session closes before the meet-host child is shut down. Defaults to 5 minutes when unset.",
+      ),
+  })
+  .describe("Daemon-side configuration for the external meet-join skill host");
+export type MeetHostConfig = z.infer<typeof MeetHostConfigSchema>;
+
+/**
+ * Daemon-side `services.meet` block. Intentionally distinct from the
+ * skill-internal `MeetServiceSchema` in `skills/meet-join/config-schema.ts`,
+ * which validates the bot-facing `<workspace>/config/meet.json` file. This
+ * schema only describes the keys the assistant itself reads from its global
+ * `config.json` before the meet-host child process is spawned.
+ */
+const MeetDaemonServiceSchema = z
+  .object({
+    host: MeetHostConfigSchema.default(MeetHostConfigSchema.parse({})),
+  })
+  .describe("meet-join skill daemon-side configuration");
+export type MeetDaemonService = z.infer<typeof MeetDaemonServiceSchema>;
+
 export const ServicesSchema = z.object({
   inference: InferenceServiceSchema.default(InferenceServiceSchema.parse({})),
   "image-generation": ImageGenerationServiceSchema.default(
@@ -116,6 +154,7 @@ export const ServicesSchema = z.object({
   "twitter-oauth": TwitterOAuthServiceSchema.default(
     TwitterOAuthServiceSchema.parse({}),
   ),
+  meet: MeetDaemonServiceSchema.default(MeetDaemonServiceSchema.parse({})),
 });
 export type Services = z.infer<typeof ServicesSchema>;
 

package/src/config/schemas/tts.ts

@@ -182,6 +182,7 @@ export const TtsXaiProviderConfigSchema = z
       .string({
         error: "services.tts.providers.xai.language must be a string",
       })
+      .transform((v) => v || "auto")
       .default("auto")
       .describe(
         "BCP-47 language code (e.g. 'en-US') or 'auto' for auto-detection",
@@ -250,6 +251,16 @@ for (const id of VALID_TTS_PROVIDERS) {
     );
   }
 }
+const catalogKeys = new Set<string>(VALID_TTS_PROVIDERS);
+for (const id of schemaKeys) {
+  if (!catalogKeys.has(id)) {
+    throw new Error(
+      `TTS provider "${id}" has a schema entry in TtsProvidersSchema but ` +
+        `is not registered in the provider catalog. Add it to ` +
+        `provider-catalog.ts or remove it from TtsProvidersSchema.`,
+    );
+  }
+}
 
 /**
  * Canonical TTS service configuration.

package/src/config/skill-state.ts

@@ -54,8 +54,12 @@ export function resolveSkillStates(
     if (entry && typeof entry.enabled === "boolean") {
       isEnabled = entry.enabled;
     } else {
-      // Default: bundled and managed (user-installed) skills are enabled, others are disabled
-      isEnabled = skill.source === "bundled" || skill.source === "managed";
+      // Default: bundled, managed (user-installed), and plugin-contributed
+      // skills are enabled. Others (workspace, extra) are disabled by default.
+      isEnabled =
+        skill.source === "bundled" ||
+        skill.source === "managed" ||
+        skill.source === "plugin";
     }
 
     if (!isEnabled) {