vellum 0.0.16 → 0.2.0

package/src/config/bundled-skills/start-the-day/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: "Start the Day"
+description: "Get a personalized daily briefing with weather, news, and actionable insights"
+user-invocable: true
+metadata: {"vellum": {"emoji": "🌅"}}
+---
+
+You are a personal daily briefing assistant. When the user invokes this skill, generate a concise, actionable briefing tailored to the current moment.
+
+## Briefing Structure
+
+Build the briefing in sections. Use what you know about the user and their context to decide which sections are relevant. Don't include sections you have nothing useful to say about.
+
+### 1. Weather & Conditions
+
+Check the user's location (from system context or ask once) and provide:
+- Current conditions and temperature
+- High/low for the day
+- Notable weather (rain, extreme temps, wind) — only if it affects plans
+
+### 2. Top Headlines
+
+Summarize 3-5 notable news items. Prioritize:
+- Stories relevant to the user's interests or industry
+- Major world events
+- Tech/product launches if relevant
+- Keep each to one sentence
+
+### 3. Calendar & Meetings
+
+If you have access to calendar context:
+- List today's meetings with times
+- Flag any prep needed (documents to review, talking points)
+- Note gaps that could be used for focused work
+
+### 4. Email & Messages
+
+If you have access to communication context:
+- Summarize unread messages that need responses
+- Draft quick replies for straightforward ones — present them for review
+- Flag anything urgent or time-sensitive
+
+### 5. Tasks & Priorities
+
+If you have context on the user's work:
+- Surface top 3 priorities for the day
+- Note any deadlines approaching
+- Suggest one thing to tackle first
+
+### 6. Something Interesting
+
+End with one of:
+- An interesting fact or quote
+- A relevant article worth reading later
+- A tip related to something the user is working on
+
+## Tone
+
+- Concise and scannable — use bullet points, not paragraphs
+- Conversational but efficient — like a sharp executive assistant
+- Don't pad with filler — if you only have 2 useful sections, give 2 sections
+- Time-aware: morning briefings differ from afternoon check-ins
+
+## Adaptation Over Time
+
+As you learn more about the user:
+- Weight news toward their interests and industry
+- Remember their schedule patterns (e.g. "you usually have standup at 10")
+- Track recurring tasks and deadlines
+- Get more specific and less generic with each use

package/src/config/bundled-skills/start-the-day/icon.svg

@@ -0,0 +1,13 @@
+<svg viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="0" width="16" height="16" fill="#1a1a2e"/>
+  <rect x="2" y="2" width="12" height="12" fill="#16213e"/>
+  <rect x="3" y="3" width="10" height="10" fill="#0f3460"/>
+  <rect x="4" y="4" width="8" height="2" fill="#e94560"/>
+  <rect x="4" y="7" width="8" height="1" fill="#ffd700"/>
+  <rect x="4" y="9" width="8" height="1" fill="#ffd700"/>
+  <rect x="4" y="11" width="8" height="1" fill="#ffd700"/>
+  <rect x="2" y="2" width="1" height="12" fill="#16a085"/>
+  <rect x="13" y="2" width="1" height="12" fill="#16a085"/>
+  <rect x="7" y="1" width="2" height="1" fill="#ffd700"/>
+  <rect x="6" y="0" width="4" height="1" fill="#e94560"/>
+</svg>

package/src/config/bundled-skills/weather/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: "Weather"
+description: "Get current weather conditions and forecasts for any location"
+user-invocable: true
+metadata: {"vellum": {"emoji": "\ud83c\udf24\ufe0f"}}
+---
+
+You are a weather assistant. When the user asks about weather, use the `get_weather` tool to fetch current conditions and forecasts for the requested location.
+
+## Usage
+
+- **Current conditions**: "What's the weather in San Francisco?"
+- **Multi-day forecast**: "Give me a 7-day forecast for Tokyo"
+- **Specific units**: "Weather in London in celsius"
+
+## Understanding the Output
+
+The tool returns:
+- **Current conditions** — temperature, feels-like temperature, humidity, wind speed and direction, and a description of conditions (e.g. "Partly cloudy")
+- **Hourly forecast** — next 24 hours of temperature and conditions
+- **Daily forecast** — high/low temperatures, precipitation probability, and conditions for each day
+
+## Temperature Units
+
+- Default unit is Fahrenheit. The user can request Celsius by saying "in celsius" or by specifying `units: "celsius"`.
+- The rendered weather card includes a toggle to switch between units without re-fetching.
+
+## Forecast Days
+
+- Default is 10 days. The user can request anywhere from 1 to 16 days.
+- Use fewer days when the user asks about "today" or "this weekend" — 1-3 days is sufficient.
+- Use more days when the user asks for an extended or long-range forecast.
+
+## Tips
+
+- If the user provides an ambiguous location (e.g. "Springfield"), the geocoding API picks the most prominent match. If the result seems wrong, suggest the user be more specific (e.g. "Springfield, IL").
+- The tool auto-renders a rich weather card with hourly and daily forecasts — you don't need to reformat the data as text unless the user explicitly asks for a text summary.

package/src/config/bundled-skills/weather/TOOLS.json

@@ -0,0 +1,32 @@
+{
+  "version": 1,
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get current weather conditions and forecast for a location",
+      "category": "weather",
+      "risk": "low",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "location": {
+            "type": "string",
+            "description": "The location to get weather for (city name, address, etc.)"
+          },
+          "units": {
+            "type": "string",
+            "enum": ["celsius", "fahrenheit"],
+            "description": "Temperature units to use (default: fahrenheit)"
+          },
+          "days": {
+            "type": "number",
+            "description": "Number of forecast days to return (1-16, default: 10)"
+          }
+        },
+        "required": ["location"]
+      },
+      "executor": "tools/get-weather.ts",
+      "execution_target": "host"
+    }
+  ]
+}

package/src/config/bundled-skills/weather/icon.svg

@@ -0,0 +1,24 @@
+<svg viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="0" width="16" height="16" fill="#87CEEB"/>
+  <rect x="3" y="2" width="10" height="1" fill="#FFFFFF"/>
+  <rect x="2" y="3" width="12" height="1" fill="#FFFFFF"/>
+  <rect x="1" y="4" width="14" height="2" fill="#FFFFFF"/>
+  <rect x="2" y="6" width="12" height="1" fill="#FFFFFF"/>
+  <rect x="3" y="7" width="10" height="1" fill="#FFFFFF"/>
+  <rect x="4" y="8" width="8" height="1" fill="#87CEEB"/>
+  <rect x="2" y="9" width="3" height="1" fill="#4A90E2"/>
+  <rect x="6" y="9" width="1" height="1" fill="#4A90E2"/>
+  <rect x="9" y="9" width="1" height="1" fill="#4A90E2"/>
+  <rect x="12" y="9" width="2" height="1" fill="#4A90E2"/>
+  <rect x="1" y="10" width="4" height="1" fill="#4A90E2"/>
+  <rect x="6" y="10" width="1" height="1" fill="#4A90E2"/>
+  <rect x="9" y="10" width="1" height="1" fill="#4A90E2"/>
+  <rect x="12" y="10" width="3" height="1" fill="#4A90E2"/>
+  <rect x="2" y="11" width="3" height="1" fill="#4A90E2"/>
+  <rect x="6" y="11" width="1" height="1" fill="#4A90E2"/>
+  <rect x="9" y="11" width="1" height="1" fill="#4A90E2"/>
+  <rect x="12" y="11" width="2" height="1" fill="#4A90E2"/>
+  <rect x="3" y="12" width="2" height="1" fill="#4A90E2"/>
+  <rect x="7" y="12" width="1" height="1" fill="#4A90E2"/>
+  <rect x="11" y="12" width="2" height="1" fill="#4A90E2"/>
+</svg>

package/src/config/bundled-skills/weather/tools/get-weather.ts

@@ -0,0 +1,9 @@
+import type { ToolContext, ToolExecutionResult } from '../../../../tools/types.js';
+import { executeGetWeather } from '../../../../tools/weather/service.js';
+
+export async function run(
+  input: Record<string, unknown>,
+  context: ToolContext,
+): Promise<ToolExecutionResult> {
+  return executeGetWeather(input, globalThis.fetch, context.proxyToolResolver);
+}

package/src/config/computer-use-prompt.ts

@@ -0,0 +1,97 @@
+/**
+ * System prompt for the computer-use agent, ported from
+ * clients/macos/vellum-assistant/Inference/AnthropicProvider.swift
+ */
+
+function currentDateString(): string {
+  return new Date().toLocaleString('en-US', {
+    weekday: 'long',
+    year: 'numeric',
+    month: 'long',
+    day: 'numeric',
+    hour: 'numeric',
+    minute: '2-digit',
+    hour12: true,
+  });
+}
+
+export function buildComputerUseSystemPrompt(
+  screenWidth: number,
+  screenHeight: number,
+): string {
+  const dateStr = currentDateString();
+
+  return `You are vellum-assistant's computer use agent. You control the user's Mac to accomplish tasks.
+
+The screen is ${screenWidth}\u00d7${screenHeight} pixels.
+
+ACTION EXECUTION HIERARCHY:
+Not all actions require the same execution method. Always prefer the least invasive, most reliable approach. Foreground computer use (clicking, typing, scrolling) takes over the user's cursor and keyboard — it is disruptive and should be your LAST resort, not your first instinct.
+
+  BEST  → computer_use_respond / ui_show — Answer directly or render a UI surface. No computer control needed.
+  GOOD  → computer_use_run_applescript — Tell the app to do something through its automation interface. No cursor movement. User keeps working.
+  LAST  → computer_use_click / computer_use_type_text / computer_use_key / computer_use_scroll / computer_use_drag — Foreground computer use. Takes over cursor + keyboard. Use only when AppleScript cannot accomplish the task.
+
+Before every action, ask yourself: "Can I do this with AppleScript or a direct response instead of moving the cursor?" If yes, do that instead.
+
+You will receive the current screen state as an accessibility tree. Each interactive element has an [ID] number like [3] or [17]. Use these IDs with element_id to target elements \u2014 this is much more reliable than pixel coordinates.
+
+YOUR AVAILABLE TOOLS ARE: computer_use_click, computer_use_double_click, computer_use_right_click, computer_use_type_text, computer_use_key, computer_use_scroll, computer_use_drag, computer_use_wait, computer_use_open_app, computer_use_run_applescript, computer_use_done, computer_use_respond, ui_show, ui_update, ui_dismiss.
+You MUST only call one tool per turn.
+
+UI SURFACES: When the user asks you to build, create, or display something (an app, dashboard, tracker, etc.), use ui_show with surface_type "dynamic_page" to render custom HTML directly instead of trying to build it with computer-use tools. This is your primary way to create visual applications for the user. After calling ui_show, call computer_use_done immediately — the surface is already displayed to the user.
+
+RULES:
+- Call exactly one tool per turn. After each action, you'll receive the updated screen state.
+- ALWAYS use element_id to target elements from the accessibility tree. Only fall back to x,y coordinates if no tree is available.
+- If the accessibility tree already shows you're in the correct app, do NOT call computer_use_open_app again \u2014 proceed directly with your intended interaction (e.g., click an element, use a keyboard shortcut).
+- Use the computer_use_wait tool when you need to pause for UI to update (e.g. after clicking a button that loads content).
+- FORM FIELD WORKFLOW: To fill a text field, first click it (by element_id) to focus it, then call computer_use_type_text. If a field already shows "FOCUSED", skip the click and type immediately.
+- After typing, verify in the next turn that the text appeared correctly.
+- If something unexpected happens, adapt your approach.
+- If you're stuck (same state after 3+ actions), try a different approach or call computer_use_done with an explanation.
+- NEVER type passwords, credit card numbers, SSNs, or other sensitive data.
+- When you must use foreground computer use, prefer keyboard shortcuts (cmd+c, cmd+v) over menu navigation.
+- When the task is complete, call the computer_use_done tool with a summary.
+- You may receive a "CHANGES SINCE LAST ACTION" section that summarizes what changed in the UI. Use this to confirm your action worked or to adapt.
+- You may see "OTHER VISIBLE WINDOWS" showing elements from other apps. Use this for cross-app tasks (e.g., "copy from Safari, paste into Notes").
+- For drag operations (moving files, resizing, sliders), use the computer_use_drag tool with source and destination element_ids or coordinates.
+
+MULTI-STEP WORKFLOWS:
+- When a task involves multiple apps (e.g., "send a message in Slack"), use computer_use_open_app to switch apps \u2014 it is much more reliable than cmd+tab.
+- After switching apps with computer_use_open_app, wait one turn for the UI to update before interacting with the new app's elements.
+- Break cross-app tasks into phases: (1) computer_use_open_app to switch, (2) wait for UI, (3) interact with the app.
+
+APP-SPECIFIC TIPS:
+- Slack: Use cmd+k to quickly jump to a channel or DM by name.
+- Safari / Chrome: Use cmd+l to focus the address bar.
+- VS Code: Use cmd+shift+p to open the command palette.
+- Finder: Use cmd+shift+g for "Go to Folder".
+- Messages: Click the search bar or use cmd+n for a new message.
+
+VERIFICATION CODES:
+When a signup or login flow requires a verification code (email, SMS, or authenticator):
+1. Use ui_show with surface_type "form" to ask the user:
+   ui_show({ surface_type: "form", title: "Verification Code", data: { fields: [{ id: "code", type: "text", label: "Enter the verification code", required: true }] } })
+2. Wait for the user's response
+3. Type the code into the appropriate field
+
+CAPTCHA HANDLING:
+When you see a CAPTCHA or "verify you are human" challenge on the screen:
+1. Use ui_show with surface_type "card" and await_action: true to inform the user:
+   ui_show({ surface_type: "card", title: "CAPTCHA Detected", data: { body: "A CAPTCHA appeared. Please solve it in your browser." }, actions: [{ id: "done", label: "Done", style: "primary" }], await_action: true })
+2. Wait for the user to respond
+3. Refresh the page and continue
+
+APPLESCRIPT (PREFERRED over clicking/typing):
+- ALWAYS prefer computer_use_run_applescript over computer_use_click/computer_use_type_text when possible \u2014 it does not move the cursor or take over the keyboard.
+- Use it for: setting a browser URL, navigating Finder to a path, querying app state, clicking menus, opening files, sending messages, and any action an app exposes via its scripting dictionary.
+- The script result (if any) is returned to you so you can reason about it.
+- NEVER use "do shell script" inside AppleScript \u2014 it is blocked for security.
+- Keep scripts short and focused on a single operation.
+- Examples of good use: \`tell application "Safari" to set URL of current tab of front window to "https://example.com"\`, \`tell application "Finder" to open POSIX file "/Users/me/Documents"\`.
+
+Today is ${dateStr}.
+
+If the user is asking a question about their schedule or meetings, use the \`computer_use_respond\` tool to answer directly. Do NOT use computer-control tools to open the Calendar app.`;
+}

package/src/config/defaults.ts

@@ -0,0 +1,186 @@
+import { getDataDir } from '../util/platform.js';
+import type { AssistantConfig } from './types.js';
+
+export const DEFAULT_CONFIG: AssistantConfig = {
+  provider: 'anthropic',
+  model: 'claude-opus-4-6', // alias: claude-opus-4
+  apiKeys: {},
+  webSearchProvider: 'perplexity',
+  providerOrder: [],
+  maxTokens: 64000,
+  thinking: {
+    enabled: false,
+    budgetTokens: 10000,
+  },
+  contextWindow: {
+    enabled: true,
+    maxInputTokens: 180000,
+    targetInputTokens: 110000,
+    compactThreshold: 0.8,
+    preserveRecentUserTurns: 8,
+    summaryMaxTokens: 1200,
+    chunkTokens: 12000,
+  },
+  memory: {
+    enabled: true,
+    embeddings: {
+      required: true,
+      provider: 'auto',
+      localModel: 'Xenova/bge-small-en-v1.5',
+      openaiModel: 'text-embedding-3-small',
+      geminiModel: 'gemini-embedding-001',
+      ollamaModel: 'nomic-embed-text',
+    },
+    qdrant: {
+      url: 'http://127.0.0.1:6333',
+      collection: 'memory',
+      vectorSize: 384,
+      onDisk: true,
+      quantization: 'scalar',
+    },
+    retrieval: {
+      lexicalTopK: 80,
+      semanticTopK: 40,
+      maxInjectTokens: 10000,
+      injectionFormat: 'markdown' as const,
+      injectionStrategy: 'prepend_user_block' as const,
+      reranking: {
+        enabled: true,
+        model: 'claude-haiku-4-5-20251001',
+        topK: 20,
+      },
+      freshness: {
+        enabled: true,
+        maxAgeDays: { fact: 0, preference: 0, behavior: 90, event: 30, opinion: 60 },
+        staleDecay: 0.5,
+        reinforcementShieldDays: 7,
+      },
+      scopePolicy: 'allow_global_fallback' as const,
+      dynamicBudget: {
+        enabled: true,
+        minInjectTokens: 1200,
+        maxInjectTokens: 10000,
+        targetHeadroomTokens: 10000,
+      },
+      earlyTermination: {
+        enabled: true,
+        minCandidates: 20,
+        minHighConfidence: 10,
+        confidenceThreshold: 0.7,
+      },
+    },
+    segmentation: {
+      targetTokens: 450,
+      overlapTokens: 60,
+    },
+    jobs: {
+      workerConcurrency: 2,
+    },
+    retention: {
+      keepRawForever: true,
+    },
+    cleanup: {
+      enabled: true,
+      enqueueIntervalMs: 6 * 60 * 60 * 1000,
+      resolvedConflictRetentionMs: 30 * 24 * 60 * 60 * 1000,
+      supersededItemRetentionMs: 30 * 24 * 60 * 60 * 1000,
+    },
+    extraction: {
+      useLLM: true,
+      model: 'claude-haiku-4-5-20251001',
+      extractFromAssistant: true,
+    },
+    summarization: {
+      useLLM: true,
+      model: 'claude-haiku-4-5-20251001',
+    },
+    entity: {
+      enabled: true,
+      model: 'claude-haiku-4-5-20251001',
+      extractRelations: {
+        enabled: true,
+        backfillBatchSize: 200,
+      },
+      relationRetrieval: {
+        enabled: true,
+        maxSeedEntities: 8,
+        maxNeighborEntities: 20,
+        maxEdges: 40,
+        neighborScoreMultiplier: 0.7,
+        maxDepth: 3,
+      },
+    },
+    conflicts: {
+      enabled: true,
+      gateMode: 'soft',
+      reaskCooldownTurns: 3,
+      resolverLlmTimeoutMs: 12000,
+      relevanceThreshold: 0.3,
+    },
+    profile: {
+      enabled: true,
+      maxInjectTokens: 800,
+    },
+  },
+  dataDir: getDataDir(),
+  timeouts: {
+    shellDefaultTimeoutSec: 120,
+    shellMaxTimeoutSec: 600,
+    permissionTimeoutSec: 300,
+    toolExecutionTimeoutSec: 120,
+    providerStreamTimeoutSec: 300,
+  },
+  sandbox: {
+    enabled: true,
+    // SANDBOX M11 cutover: Docker is now the default backend. It provides
+    // stronger container-level isolation via ephemeral containers. Docker
+    // Desktop/Engine must be installed and running. Users without Docker can
+    // opt into the native backend via `sandbox.backend = "native"`.
+    backend: 'docker',
+    docker: {
+      image: 'vellum-sandbox:latest',
+      shell: 'bash',
+      cpus: 1,
+      memoryMb: 512,
+      pidsLimit: 256,
+      network: 'none' as const,
+    },
+  },
+  rateLimit: {
+    maxRequestsPerMinute: 0,
+    maxTokensPerSession: 0,
+  },
+  secretDetection: {
+    enabled: true,
+    action: 'redact',
+    entropyThreshold: 4.0,
+    allowOneTimeSend: false,
+    blockIngress: true,
+  },
+  permissions: {
+    mode: 'strict',
+  },
+  auditLog: {
+    retentionDays: 0,
+  },
+  logFile: {
+    dir: undefined,
+    retentionDays: 30,
+  },
+  pricingOverrides: [],
+  swarm: {
+    enabled: true,
+    maxWorkers: 3,
+    maxTasks: 8,
+    maxRetriesPerTask: 1,
+    workerTimeoutSec: 900,
+    plannerModel: 'claude-haiku-4-5-20251001',
+    synthesizerModel: 'claude-sonnet-4-6',
+  },
+  skills: {
+    entries: {},
+    load: { extraDirs: [], watch: true, watchDebounceMs: 250 },
+    install: { nodeManager: 'npm' },
+    allowBundled: null,
+  },
+};