@vruum/skills 0.6.43 → 0.6.45

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vruum",
-  "version": "0.6.43",
+  "version": "0.6.45",
   "description": "Vruum AI skills + remote MCP server for B2B GTM teams. Slash commands for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis, paired with the full Vruum MCP tool surface over OAuth 2.1.",
   "author": {
     "name": "Vruum AI",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vruum",
-  "version": "0.6.43",
+  "version": "0.6.45",
   "description": "Vruum AI skills + remote MCP server for B2B GTM teams. Skills for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis, paired with the full Vruum MCP tool surface over OAuth 2.1.",
   "author": {
     "name": "Vruum AI",

package/install.js

@@ -196,6 +196,45 @@ function syncVruumRoot({ dryRun }) {
   return rows;
 }
 
+function pathApiFor(platform) {
+  return platform === 'win32' ? path.win32 : path.posix;
+}
+
+function normalizePathForComparison(value, platform = process.platform) {
+  const pathApi = pathApiFor(platform);
+  let normalized = pathApi.resolve(value);
+  if (platform === 'win32') {
+    // Junction readlink results may use a \\?\ namespace prefix and different
+    // casing from os.homedir(). Normalize both forms for identity/ownership.
+    normalized = pathApi.toNamespacedPath(normalized).toLowerCase();
+  }
+  const root = pathApi.parse(normalized).root;
+  while (normalized.length > root.length && normalized.endsWith(pathApi.sep)) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
+}
+
+function pathsEqual(left, right, platform = process.platform) {
+  return normalizePathForComparison(left, platform)
+    === normalizePathForComparison(right, platform);
+}
+
+function pathIsWithin(candidate, root, platform = process.platform) {
+  const pathApi = pathApiFor(platform);
+  const normalizedCandidate = normalizePathForComparison(candidate, platform);
+  const normalizedRoot = normalizePathForComparison(root, platform);
+  return normalizedCandidate === normalizedRoot
+    || normalizedCandidate.startsWith(normalizedRoot + pathApi.sep);
+}
+
+function resolveLinkTarget(dst, linkTarget, platform = process.platform) {
+  const pathApi = pathApiFor(platform);
+  return pathApi.isAbsolute(linkTarget)
+    ? pathApi.resolve(linkTarget)
+    : pathApi.resolve(pathApi.dirname(dst), linkTarget);
+}
+
 // A symlink is "ours" if its target resolves into ~/.vruum/skills/. Resolve
 // textually from the readlink string (relative links against the link's own
 // dir) — never realpathSync, which THROWS on a dangling link, i.e. exactly the
@@ -204,21 +243,14 @@ function syncVruumRoot({ dryRun }) {
 // ~/.vruum/skills-operator, so a bare startsWith would wrongly claim the
 // operator installer's links. Equality covers a link straight at the dir.
 function isOurLink(dst, linkTarget) {
-  const resolved = path.isAbsolute(linkTarget)
-    ? path.resolve(linkTarget)
-    : path.resolve(path.dirname(dst), linkTarget);
-  return resolved === VRUUM_SKILLS || resolved.startsWith(VRUUM_SKILLS + path.sep);
+  return pathIsWithin(resolveLinkTarget(dst, linkTarget), VRUUM_SKILLS);
 }
 
 // Operator skills are a strict superset with multi-company scoping. When both
 // installers are present, operator links win for overlapping names regardless
 // of install order. Public-only names still link normally.
 function isOperatorLink(dst, linkTarget) {
-  const resolved = path.isAbsolute(linkTarget)
-    ? path.resolve(linkTarget)
-    : path.resolve(path.dirname(dst), linkTarget);
-  return resolved === VRUUM_OPERATOR_ROOT
-    || resolved.startsWith(VRUUM_OPERATOR_ROOT + path.sep);
+  return pathIsWithin(resolveLinkTarget(dst, linkTarget), VRUUM_OPERATOR_ROOT);
 }
 
 function hasSkillFile(dir) {
@@ -297,14 +329,12 @@ function linkSkill({ name, srcAbs, target, dryRun }) {
     if (err.code !== 'ENOENT') throw err;
   }
 
-  if (existing?.kind === 'symlink' && existing.target === srcAbs) {
-    return { name, target, action: 'already-linked' };
-  }
   const resolvedExistingTarget = existing?.kind === 'symlink'
-    ? (path.isAbsolute(existing.target)
-      ? path.resolve(existing.target)
-      : path.resolve(path.dirname(dst), existing.target))
+    ? resolveLinkTarget(dst, existing.target)
     : null;
+  if (resolvedExistingTarget && pathsEqual(resolvedExistingTarget, srcAbs)) {
+    return { name, target, action: 'already-linked' };
+  }
   const operatorSkillIsUsable = resolvedExistingTarget
     && isOperatorLink(dst, existing.target)
     && hasSkillFile(resolvedExistingTarget);
@@ -330,7 +360,9 @@ function linkSkill({ name, srcAbs, target, dryRun }) {
   if (existing?.kind === 'symlink') {
     fs.unlinkSync(dst);
   }
-  fs.symlinkSync(srcAbs, dst, 'dir');
+  // Windows directory symlinks require Developer Mode or elevation. Directory
+  // junctions work for this absolute, same-machine target without either.
+  fs.symlinkSync(srcAbs, dst, process.platform === 'win32' ? 'junction' : 'dir');
   return { name, target, action: existing ? 'relinked' : 'linked' };
 }
 
@@ -545,7 +577,7 @@ function commandList({ targets: extraTargets }) {
         const lstat = fs.lstatSync(dst);
         if (lstat.isSymbolicLink()) {
           const linkTarget = fs.readlinkSync(dst);
-          const match = linkTarget === srcAbs;
+          const match = pathsEqual(resolveLinkTarget(dst, linkTarget), srcAbs);
           console.log(`  ${match ? 'installed' : 'other-link'.padEnd(10)}  ${skillName}${match ? '' : `  -> ${linkTarget}`}`);
         } else {
           console.log(`  present      ${skillName}  (not our symlink)`);
@@ -598,6 +630,8 @@ if (require.main === module) main();
 module.exports = {
   parseArgs,
   listAvailableSkills,
+  pathsEqual,
+  pathIsWithin,
   linkSkill,
   isOurLink,
   isOperatorLink,

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@vruum/skills",
-  "version": "0.6.43",
+  "version": "0.6.45",
   "description": "Vruum AI skills for Claude Code, Claude Desktop, Codex CLI, and any AI assistant with a skill directory. Slash commands for outreach triage, engagement triage, pipeline filling, prospect enrichment, and reply diagnosis. Pairs with the Vruum MCP server at https://api.vruum.ai/mcp.",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/vruum-gtm/vruum_ai.git",
-    "directory": ".agents"
+    "url": "git+https://github.com/vruum-gtm/skills.git"
   },
   "homepage": "https://vruum.ai",
   "bugs": {
@@ -42,5 +41,5 @@
     "outreach",
     "gtm"
   ],
-  "contentHash": "936d7001a7e17a1ce672e7fde300f4f6e10726a7148c792b06a1f59a3f1f6d5a"
+  "contentHash": "843a119196d95663bc210d5543eb53a5f48a2a2780d425afce7c713577d4b1ac"
 }

package/skills/pipeline-fill/RESEARCH-ENGINE.md

@@ -234,7 +234,9 @@ Apply the requested mode before any persistence:
 Per surviving prospect:
 
 ### a. Save company research (once per company)
-When Phase A produced any newly researched fixed fields, call `research(action="save_company", payload={idempotency_key: <stable run/company save key>, name: <Phase A COMPANY>, website: <Phase A DOMAIN or canonical URL>, company_summary, company_stage, funding_data, growth_metrics, current_priorities: <newline-joined descriptions>, sources_by_field})`. The API field is `name`, not `company_name`; it accepts `website`, not `domain`; and `current_priorities` is one string. Omit reusable fields that were not revalidated so the atomic patch preserves them. Explicit null deliberately clears a field, so do not send null merely because Phase A did not research it. `sources_by_field` keys must equal exactly the supplied non-null research fields. Preserve the identical idempotency key and payload for unknown-commit replay; every bulk item needs its own key.
+When Phase A produced any newly researched fixed fields, call `research(action="save_company", payload={idempotency_key: <stable run/company save key>, name: <Phase A COMPANY>, website: <Phase A DOMAIN or canonical URL>, person_id: <the person's Vruum UUID, when researching an EXISTING person's employer>, company_summary, company_stage, funding_data, growth_metrics, current_priorities: <newline-joined descriptions>, sources_by_field})`. The API field is `name`, not `company_name`; it accepts `website`, not `domain`; and `current_priorities` is one string. Omit reusable fields that were not revalidated so the atomic patch preserves them. Explicit null deliberately clears a field, so do not send null merely because Phase A did not research it. `sources_by_field` keys must equal exactly the supplied non-null research fields. Preserve the identical idempotency key and payload for unknown-commit replay; every bulk item needs its own key.
+
+**Person linkage check (VRU-767):** when the research is about a saved person's employer (triage/authoring-time refresh), ALWAYS pass their UUID as `payload.person_id` and read the response's `person_link`. `matched`/`linked`/`repointed` mean the person's future touches will see this research. `mismatch` means no pin was written because the evidence disagreed — the pin sits on a DIFFERENT company (anchored, or a stub whose name carries more identity than the researched one), or an unpinned person's known positions show no role at the researched company. People can hold multiple positions and researching a secondary employer never switches the primary pin. This research will NOT surface on their touches — verify which company they actually work for before authoring from it. `conflict` is a transient race (the pin changed mid-save): replay the identical payload with the same idempotency key once — `person_id` is exempt from the idempotency hash, so adding it to a replay of an earlier save is also the supported repair path. Never assume a bare `success` means the research reached the person.
 
 ### b. Identity prep (names + company linkage for the atomic save)