@vellumai/assistant 0.10.4-dev.202607021737.083736d → 0.10.4-dev.202607021852.8dcc2d9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.4-dev.202607021737.083736d",
+  "version": "0.10.4-dev.202607021852.8dcc2d9",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/acp-session.test.ts

@@ -185,7 +185,6 @@ describe("VellumAcpClientHandler", () => {
       expect(sent).toHaveLength(0);
       expect(handler.pendingRequestIds.size).toBe(0);
     });
-
   });
 });
 
@@ -264,6 +263,8 @@ describe("AcpSessionManager", () => {
         initialize: mock(() => Promise.resolve()),
         createSession: mock(() => Promise.resolve("proto-session")),
         cancel: mock(() => Promise.resolve()),
+        markStderr: () => 0,
+        stderrSince: () => "",
       };
       const fakeHandler = new VellumAcpClientHandler(
         "test-session",
@@ -324,6 +325,8 @@ describe("AcpSessionManager", () => {
       const fakeProcess = {
         prompt: () => promptPromise,
         kill: mock(() => {}),
+        markStderr: () => 0,
+        stderrSince: () => "",
       };
       const fakeHandler = new VellumAcpClientHandler(
         "test-session-2",

package/src/__tests__/guardian-question-mode.test.ts

@@ -9,10 +9,12 @@ import {
   buildGuardianRequestCodeInstruction,
   hasGuardianRequestCodeInstruction,
   parseGuardianQuestionPayload,
+  parseInteractiveApprovalPayload,
   resolveGuardianInstructionModeForRequest,
   resolveGuardianInstructionModeFromFields,
   resolveGuardianQuestionInstructionMode,
   stripConflictingGuardianRequestInstructions,
+  stripGuardianRequestCodeInstructions,
 } from "../notifications/guardian-question-mode.js";
 
 describe("guardian-question-mode", () => {
@@ -228,4 +230,59 @@ describe("guardian-question-mode", () => {
       ),
     ).toBe("");
   });
+
+  test("stripGuardianRequestCodeInstructions removes both-mode directives and bare code mentions", () => {
+    const text = [
+      "Alice is asking to run ls /tmp.",
+      "Approval code: A1B2C3",
+      'Reference code: A1B2C3. Reply "A1B2C3 approve" or "A1B2C3 reject".',
+      'Reply "A1B2C3 <your answer>".',
+    ].join("\n");
+
+    expect(stripGuardianRequestCodeInstructions(text, "A1B2C3")).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+  });
+
+  test("stripGuardianRequestCodeInstructions leaves unrelated text and other codes intact", () => {
+    const text = 'Approval code: ZZZZZZ. Reply "A1B2C3 approve" if you agree.';
+    expect(stripGuardianRequestCodeInstructions(text, "A1B2C3")).toBe(text);
+  });
+
+  test("parseInteractiveApprovalPayload accepts approval-mode payloads with a requestId", () => {
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "tool_grant_request",
+        requestId: "req-1",
+        requestCode: "A1B2C3",
+        questionText: "Allow host bash?",
+        toolName: "host_bash",
+      }),
+    ).not.toBeNull();
+  });
+
+  test("parseInteractiveApprovalPayload rejects answer-mode and unparseable payloads", () => {
+    // Answer mode: free-text questions get no Approve/Reject buttons.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-2",
+        requestCode: "A1B2C3",
+        questionText: "What time works?",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      }),
+    ).toBeNull();
+
+    // Strict-parse failure: missing required pending_question fields.
+    expect(
+      parseInteractiveApprovalPayload({
+        requestKind: "pending_question",
+        requestId: "req-3",
+        requestCode: "A1B2C3",
+        questionText: "Allow send_email?",
+        toolName: "send_email",
+      }),
+    ).toBeNull();
+  });
 });

package/src/__tests__/notification-decision-fallback.test.ts

@@ -285,6 +285,100 @@ describe("notification decision fallback copy", () => {
     expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 reject"');
     expect(decision.renderedCopy.vellum?.body).not.toContain("<your answer>");
   });
+
+  test("slack approval copy is stripped of request-code instructions instead of enforced", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-1",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "vellum",
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    // Vellum keeps the code-reply directive.
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 approve"');
+    // Slack renders Approve/Reject buttons — no code anywhere in its copy.
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Approve tool: bash — ls /tmp (requested by Alice)",
+    );
+    expect(decision.renderedCopy.slack?.body).not.toContain("A1B2C3");
+  });
+
+  test("slack copy strips LLM-authored approval-code phrasing for approval requests", async () => {
+    configuredProvider = {
+      sendMessage: async () => ({ content: [] }),
+    };
+    extractedToolUse = {
+      name: "record_notification_decision",
+      input: {
+        shouldNotify: true,
+        selectedChannels: ["slack"],
+        reasoningSummary: "LLM decision",
+        renderedCopy: {
+          slack: {
+            title: "Tool Grant Request",
+            body: "Alice is asking to run ls /tmp.",
+            deliveryText:
+              'Alice is asking to run ls /tmp.\nApproval code: A1B2C3\nReference code: A1B2C3. Reply "A1B2C3 approve" or "A1B2C3 reject".',
+          },
+        },
+        dedupeKey: "guardian-question-slack-llm-test",
+        confidence: 0.9,
+      },
+    };
+
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-2",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(false);
+    expect(decision.renderedCopy.slack?.deliveryText).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+  });
+
+  test("slack answer-mode questions keep code instructions (no buttons render)", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-pending-slack-1",
+        questionText: "What is the gate code?",
+        requestCode: "A1B2C3",
+        requestKind: "pending_question",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    expect(decision.renderedCopy.slack?.body).toContain(
+      '"A1B2C3 <your answer>"',
+    );
+  });
 });
 
 // ── Access-request instruction enforcement ──────────────────────────────

package/src/__tests__/plugin-import-boundary-guard.test.ts

@@ -144,6 +144,7 @@ const BASELINE: Record<string, readonly string[]> = {
     "../../../../skills/catalog-cache.js",
     "../../../../skills/install-meta.js",
     "../../../../skills/skill-memory.js",
+    "../../../../telemetry/watchdog-events-store.js",
     "../../../../tools/skills/delete-managed.js",
     "../../../../util/abort-reasons.js",
     "../../../../util/errors.js",

package/src/__tests__/slack-notification-approval-card.test.ts

@@ -10,7 +10,7 @@ import type { ApprovalUIMetadata } from "../runtime/channel-approval-types.js";
  * quoted-preview body, action callback ids, source/permalink and requester-id
  * context blocks, the security-warning context block, and guardian
  * verification note that `buildApprovalNotificationBlocks` emits for an
- * access request.
+ * access request — plus the tool-approval card body/continuation split.
  */
 
 const APPROVAL: ApprovalUIMetadata = {
@@ -39,7 +39,9 @@ type Block = Record<string, unknown>;
 
 function card(blocks: unknown[]): Block {
   const c = (blocks as Block[]).find((b) => b.type === "card");
-  if (!c) throw new Error("no card block");
+  if (!c) {
+    throw new Error("no card block");
+  }
   return c;
 }
 
@@ -174,3 +176,88 @@ describe("Slack access-request card blocks", () => {
     ).toBe(true);
   });
 });
+
+const TOOL_APPROVAL: ApprovalUIMetadata = {
+  requestId: "req-456",
+  actions: [
+    { id: "approve_once", label: "Approve once" },
+    { id: "reject", label: "Reject" },
+  ],
+  plainTextFallback: 'Reply "ABC123 approve" or "ABC123 reject"',
+  permissionDetails: {
+    toolName: "bash",
+    riskLevel: "medium",
+    toolInput: { command: "ls /tmp" },
+    requesterIdentifier: "Alice",
+  },
+};
+
+function buildToolApprovalPayload(): ChannelDeliveryPayload {
+  return {
+    sourceEventName: "guardian.question",
+    copy: { title: "Guardian Question", body: "Approve tool: bash" },
+    urgency: "high",
+    approvalContext: TOOL_APPROVAL,
+  };
+}
+
+function sectionTexts(blocks: unknown[]): string[] {
+  return (blocks as Block[])
+    .filter((b) => b.type === "section")
+    .map((b) => text(b.text));
+}
+
+describe("Slack tool-approval card blocks", () => {
+  test("short message renders entirely in the card body with no companion section", () => {
+    const message = "Alice is requesting approval to run: ls /tmp";
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+    expect(text(card(blocks).body)).toBe(message);
+    expect(sectionTexts(blocks)).toHaveLength(0);
+  });
+
+  test("card carries tool title and tool/requester subtitle", () => {
+    const c = card(
+      buildApprovalNotificationBlocks(buildToolApprovalPayload(), "msg"),
+    );
+    expect(text(c.title)).toBe("Tool Approval");
+    expect(text(c.subtitle)).toBe("bash — requested by Alice");
+  });
+
+  test("long message continues in a section without repeating the card body", () => {
+    const message = Array.from(
+      { length: 40 },
+      (_, i) => `word${String(i).padStart(2, "0")}`,
+    ).join(" "); // 279 chars of distinct words
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+
+    const body = text(card(blocks).body);
+    expect(body.length).toBeLessThanOrEqual(200);
+    expect(body.endsWith(" ↓")).toBe(true);
+
+    const sections = sectionTexts(blocks);
+    expect(sections).toHaveLength(1);
+    const continuation = sections[0];
+
+    // Body + continuation reassemble the full message with nothing repeated
+    // and nothing lost — the guardian reads each word exactly once.
+    const bodyWords = body.replace(/ ↓$/, "").split(" ");
+    const continuationWords = continuation.replace(/^… /, "").split(" ");
+    expect([...bodyWords, ...continuationWords].join(" ")).toBe(message);
+  });
+
+  test("split lands on a word boundary", () => {
+    const message = `${"a".repeat(190)} ${"b".repeat(60)}`;
+    const blocks = buildApprovalNotificationBlocks(
+      buildToolApprovalPayload(),
+      message,
+    );
+    expect(text(card(blocks).body)).toBe(`${"a".repeat(190)} ↓`);
+    expect(sectionTexts(blocks)[0]).toBe(`… ${"b".repeat(60)}`);
+  });
+});

package/src/acp/__tests__/session-manager-persistence.test.ts

@@ -75,6 +75,8 @@ function buildSessionWithFakeProcess(opts: {
     initialize: () => Promise.resolve(),
     createSession: () => Promise.resolve(opts.protocolSessionId),
     cancel: () => Promise.resolve(),
+    markStderr: () => 0,
+    stderrSince: () => "",
   };
 
   // Match spawn()'s wiring: pre-create the buffer and route emitted updates

package/src/acp/__tests__/session-manager-resume.test.ts

@@ -129,6 +129,14 @@ class FakeAcpAgentProcess {
 
   async cancel(): Promise<void> {}
 
+  markStderr(): number {
+    return 0;
+  }
+
+  stderrSince(): string {
+    return "";
+  }
+
   kill(): void {
     this.killed = true;
   }

package/src/acp/__tests__/session-manager-usage.test.ts

@@ -35,6 +35,12 @@ mock.module("../agent-process.js", () => ({
       return new Promise(() => {});
     }
     async cancel(): Promise<void> {}
+    markStderr(): number {
+      return 0;
+    }
+    stderrSince(): string {
+      return "";
+    }
     kill(): void {}
   },
 }));

package/src/acp/__tests__/session-manager.test.ts

@@ -37,6 +37,12 @@ mock.module("../agent-process.js", () => ({
     async cancel(sessionId: string): Promise<void> {
       cancelCalls.push(sessionId);
     }
+    markStderr(): number {
+      return 0;
+    }
+    stderrSince(): string {
+      return "";
+    }
     kill(): void {}
   },
 }));

package/src/acp/agent-process.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test } from "bun:test";
+
+import { AcpAgentProcess } from "./agent-process.js";
+import type { AcpAgentConfig } from "./types.js";
+
+const config: AcpAgentConfig = { command: "noop", args: [] };
+
+// The client factory is never invoked in these tests (no spawn), so a stub is
+// sufficient.
+const clientFactory = (() => ({})) as never;
+
+function newProcess(): AcpAgentProcess {
+  return new AcpAgentProcess("test-agent", config, clientFactory);
+}
+
+// retainStderr is the private handler path the stderr "data" listener calls
+// after logging; feed it directly to keep the test deterministic (no real
+// child process or stream timing).
+function feed(proc: AcpAgentProcess, line: string): void {
+  (proc as unknown as { retainStderr(text: string): void }).retainStderr(line);
+}
+
+describe("AcpAgentProcess.stderrSince(0)", () => {
+  test("returns empty string before any stderr is captured", () => {
+    expect(newProcess().stderrSince(0)).toBe("");
+  });
+
+  test("retains captured lines joined by newlines, in order", () => {
+    const proc = newProcess();
+    feed(proc, "line 1");
+    feed(proc, "line 2");
+    feed(proc, "line 3");
+
+    expect(proc.stderrSince(0)).toBe("line 1\nline 2\nline 3");
+  });
+
+  test("evicts oldest lines once the byte cap is exceeded", () => {
+    const proc = newProcess();
+    // Each line is ~1 KB; a handful exceeds the ~4 KB cap and forces eviction
+    // of the earliest lines while preserving newest-line ordering.
+    const kb = "x".repeat(1024);
+    for (let i = 0; i < 8; i++) {
+      feed(proc, `${i}:${kb}`);
+    }
+
+    const retained = proc.stderrSince(0).split("\n");
+    // Oldest ("0:") evicted, newest ("7:") retained, still in insertion order.
+    expect(retained.at(0)).not.toContain("0:");
+    expect(retained.at(-1)).toContain("7:");
+    expect(Buffer.byteLength(proc.stderrSince(0))).toBeLessThanOrEqual(
+      4096 + kb.length,
+    );
+
+    const indices = retained.map((l) => Number(l.split(":")[0]));
+    const sorted = [...indices].sort((a, b) => a - b);
+    expect(indices).toEqual(sorted);
+  });
+
+  test("truncates an oversized line to the cap, keeping its tail (the diagnostic)", () => {
+    const proc = newProcess();
+    // The real adapter error sits at the END of the chunk; deriveFailureError
+    // reads from the tail, so truncation must drop the head, not the tail.
+    const huge = "H".repeat(6000) + "TAIL_DIAGNOSTIC";
+    feed(proc, huge);
+
+    const retained = proc.stderrSince(0);
+    expect(retained.length).toBe(4096);
+    expect(retained.endsWith("TAIL_DIAGNOSTIC")).toBe(true);
+  });
+
+  test("stderrSince(0) is pure: repeated reads do not clear the buffer", () => {
+    const proc = newProcess();
+    feed(proc, "only line");
+
+    expect(proc.stderrSince(0)).toBe("only line");
+    expect(proc.stderrSince(0)).toBe("only line");
+  });
+});
+
+describe("AcpAgentProcess.markStderr / stderrSince", () => {
+  test("stderrSince returns only lines produced after the mark", () => {
+    const proc = newProcess();
+    feed(proc, "before 1");
+    feed(proc, "before 2");
+
+    const mark = proc.markStderr();
+    feed(proc, "after 1");
+    feed(proc, "after 2");
+
+    expect(proc.stderrSince(mark)).toBe("after 1\nafter 2");
+  });
+
+  test("a mark taken after all lines excludes everything retained so far", () => {
+    const proc = newProcess();
+    feed(proc, "line 1");
+    feed(proc, "line 2");
+
+    const mark = proc.markStderr();
+    expect(proc.stderrSince(mark)).toBe("");
+  });
+
+  test("mark is monotonic across eviction: seq keeps counting evicted lines", () => {
+    const proc = newProcess();
+    // Overflow the byte cap so early lines are evicted, then mark and add one
+    // fresh line: only the post-mark line comes back, unaffected by eviction.
+    const kb = "z".repeat(1024);
+    for (let i = 0; i < 8; i++) {
+      feed(proc, `${i}:${kb}`);
+    }
+
+    const mark = proc.markStderr();
+    feed(proc, "fresh failure");
+
+    expect(proc.stderrSince(mark)).toBe("fresh failure");
+  });
+});

package/src/acp/agent-process.ts

@@ -30,6 +30,13 @@ const log = getLogger("acp");
  */
 const AUTH_REQUIRED_CODE = -32000;
 
+/**
+ * Rough byte cap for retained stderr. Oldest lines are evicted once the sum of
+ * retained line lengths exceeds this, so the stderr ring (read via stderrSince)
+ * stays bounded.
+ */
+const STDERR_RETENTION_BYTES = 4096;
+
 /**
  * Detects the ACP auth-required error. Checks the `code` property rather than
  * `instanceof acp.RequestError` so plain JSON-RPC error objects are also
@@ -69,6 +76,20 @@ export class AcpAgentProcess {
    */
   private spawnedEnv: NodeJS.ProcessEnv | null = null;
 
+  /**
+   * Ring of the most recent stderr lines, bounded to ~STDERR_RETENTION_BYTES.
+   * Read once on the failure path to surface the real adapter error. Each
+   * entry carries a monotonic `seq` so a caller can scope reads to lines
+   * produced after a checkpoint (see markStderr/stderrSince).
+   */
+  private stderrRing: { seq: number; text: string }[] = [];
+  private stderrRingBytes = 0;
+  /**
+   * Cumulative count of stderr lines ever retained, including ones later
+   * evicted. Assigned as each line's `seq`; markStderr() snapshots it.
+   */
+  private stderrSeq = 0;
+
   constructor(
     public readonly agentId: string,
     private readonly config: AcpAgentConfig,
@@ -108,6 +129,7 @@ export class AcpAgentProcess {
       const text = chunk.toString().trim();
       if (text) {
         log.error({ agentId: this.agentId, stderr: text }, "ACP agent stderr");
+        this.retainStderr(text);
       }
     });
 
@@ -124,6 +146,55 @@ export class AcpAgentProcess {
     });
   }
 
+  /**
+   * Appends a stderr line to the ring, evicting oldest lines once the retained
+   * total exceeds STDERR_RETENTION_BYTES. Always keeps at least the newest line
+   * so a single oversized line is not fully dropped.
+   */
+  private retainStderr(text: string): void {
+    // Cap a single oversized line: the "keep newest" rule below never evicts it,
+    // so an untruncated multi-MB chunk would blow the ring budget and make the
+    // failure-path stderr scan (deriveFailureError) super-linear on huge input.
+    // Keep the TAIL: the adapter's error JSON / last line sits at the end, and
+    // deriveFailureError reads from the end, so dropping the head is lossless.
+    const line =
+      text.length > STDERR_RETENTION_BYTES
+        ? text.slice(-STDERR_RETENTION_BYTES)
+        : text;
+    this.stderrSeq += 1;
+    this.stderrRing.push({ seq: this.stderrSeq, text: line });
+    this.stderrRingBytes += Buffer.byteLength(line);
+    while (
+      this.stderrRingBytes > STDERR_RETENTION_BYTES &&
+      this.stderrRing.length > 1
+    ) {
+      const evicted = this.stderrRing.shift()!;
+      this.stderrRingBytes -= Buffer.byteLength(evicted.text);
+    }
+  }
+
+  /**
+   * Snapshots the current cumulative stderr line count. Pair with
+   * stderrSince() to read only stderr produced after this checkpoint, so a
+   * prompt's failure derives from its own stderr rather than lines retained
+   * from startup, resume, or an earlier (possibly cancelled) prompt.
+   */
+  markStderr(): number {
+    return this.stderrSeq;
+  }
+
+  /**
+   * Returns retained stderr lines produced after `mark` (a markStderr()
+   * checkpoint), joined by newlines. Best-effort: lines pushed after the mark
+   * but since evicted are simply absent; returns "" when nothing newer remains.
+   */
+  stderrSince(mark: number): string {
+    return this.stderrRing
+      .filter((e) => e.seq > mark)
+      .map((e) => e.text)
+      .join("\n");
+  }
+
   /**
    * Initializes the ACP connection by negotiating protocol version and capabilities.
    */