@vruum/skills-operator

OAuth-gated installer for the Vruum operator skill bundle. If you're a Vruum operator (an account that owns 2+ companies in Vruum), this gives you the 11 operator skills for Claude Code / Codex CLI with one command — no private GitHub access required.

npx @vruum/skills-operator install

What it does

1. Opens your browser for Vruum OAuth sign-in (PKCE + state, loopback redirect).
2. Saves the session to ~/.vruum/auth.json (mode 0600).
3. Downloads the latest operator skill tarball from api.vruum.ai (server verifies your operator role on every request).
4. Extracts to ~/.vruum/skills-operator/<sha>/, updates ~/.vruum/skills-operator/current → <sha>/.
5. Symlinks each skill into ~/.claude/skills/ and ~/.codex/skills/ via current/ so rollback is atomic.

Commands

npx @vruum/skills-operator install                 # fetch latest
npx @vruum/skills-operator install --pin <sha>     # fetch a specific build
npx @vruum/skills-operator install --force         # override dual-install safety
npx @vruum/skills-operator update                  # alias for install
npx @vruum/skills-operator rollback [--to <sha>]   # flip `current` to a prior build, no network
npx @vruum/skills-operator uninstall               # remove symlinks + skills-operator/

Auth

The first install triggers a loopback OAuth flow. Your session is cached at ~/.vruum/auth.json and refreshes automatically. If the refresh token becomes invalid (password change, session revoked), re-run install to trigger fresh sign-in. The installer never silently wipes auth state — you always see an explicit prompt.

Role revocation

When an admin removes your operator role, the next update-check emits OPERATOR_ROLE_REVOKED inside the skill preamble. Existing installed skills keep working locally but can't upgrade until the role is restored.

Dual-install safety

If you also have ./.agents/setup installed from a local vruum_ai checkout, the installer refuses to overwrite those symlinks without --force. The reverse is also true (./.agents/setup refuses over OAuth installs without --force). This protects the Jon-on-laptop case where both flows exist.

Windows

Symlinks require admin or dev-mode on Windows. Without either, the installer falls back to copying files — works fine, but rollback requires re-running install.

Telemetry (opt-in)

Set telemetry: community (or anonymous) in ~/.vruum/config.yaml to help surface installer bugs. Payload is fixed-shape (version, platform, node, phase, error_class, session_id) and carries zero PII. Default is off.

Pairs with

The Vruum MCP server at https://api.vruum.ai/mcp. Slash commands in your AI assistant turn into specialized workflows there.

Issues

github.com/vruum-gtm/skills-operator/issues