@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/runtime/for-chat-mint-registry.ts

@@ -0,0 +1,118 @@
+/**
+ * for-chat-mint-registry — daemon-side record of `--for-chat` reveals that
+ * actually executed.
+ *
+ * The chat-credential-reveal persist guard re-mints sentinel-shaped spans
+ * whose `service:field` identity matches a `--for-chat` reveal from the
+ * current turn (see `guardForChatSentinels`). The authority for "a
+ * `--for-chat` reveal happened" must be the reveal ROUTE itself — the one
+ * place that enforces the feature flag and proves the credential exists —
+ * never a string parse of the requested shell command: a segment that
+ * merely quotes or comments out a reveal invocation (`echo 'assistant
+ * credentials reveal --for-chat …'`) would otherwise allowlist an identity
+ * for re-minting without the route ever running, letting forged sentinels
+ * survive persistence.
+ *
+ * So: `handleCredentialsReveal` records every successful `--for-chat` mint
+ * here (identity + the exact canonical sentinel it returned), and the
+ * conversation loop asks for mints recorded since its turn started. The
+ * stored sentinel doubles as the re-mint replacement — no vault re-read,
+ * and a tampered type label can't survive because the replacement is the
+ * daemon's own original mint.
+ *
+ * Scope: records are bound to the executing conversation by the reveal
+ * NONCE (see `reveal-nonce.ts`) — a daemon-held secret the shell tools
+ * export to the tool subprocess and the CLI forwards with the reveal. A
+ * predictable identifier (a conversation id in a body field or env var)
+ * would not do: the command under execution can override its subprocess
+ * env and redirect the mint to any conversation it can name, and staging
+ * alone cannot disambiguate CONCURRENT turns (staging is a parse — a turn
+ * that merely quotes a reveal command stages the same identity an
+ * overlapping turn legitimately executes). The consumer accepts a mint
+ * only when its nonce matches the consumer's own conversation AND its
+ * identity was staged by that run's own `tool_use` commands (see
+ * `turnForChatMints` in `conversation-agent-loop-handlers.ts`).
+ * `credentials reveal` is a high-risk, approval-gated command; earning a
+ * mint for a conversation requires an actual route call from that
+ * conversation's own tool shell.
+ */
+
+/** A successful `--for-chat` reveal: identity plus the minted sentinel. */
+export interface ForChatMint {
+  service: string;
+  field: string;
+  /** The canonical sentinel the reveal route returned for this credential. */
+  sentinel: string;
+  /**
+   * The conversation-bound reveal nonce the CLI forwarded (see
+   * `reveal-nonce.ts`). Consumers match on it exactly.
+   */
+  nonce: string;
+}
+
+interface MintRecord extends ForChatMint {
+  seq: number;
+  atMs: number;
+}
+
+/**
+ * Retention guards. Records are tiny (one short sentinel string each), so
+ * the bounds exist only to keep a pathological reveal loop from growing the
+ * array unboundedly. The age bound comfortably outlives any single turn —
+ * a watermark from a turn older than this has long since been superseded.
+ */
+const MAX_RECORDS = 256;
+const MAX_AGE_MS = 6 * 60 * 60 * 1000;
+
+let counter = 0;
+let records: MintRecord[] = [];
+
+/**
+ * Watermark for "now". A turn captures this at start; mints recorded after
+ * the capture are the ones `forChatMintsSince` returns for that turn.
+ */
+export function currentForChatMintWatermark(): number {
+  return counter;
+}
+
+/** Record a successful `--for-chat` reveal. Called by the reveal route. */
+export function recordForChatMint(mint: ForChatMint): void {
+  counter += 1;
+  records.push({ ...mint, seq: counter, atMs: Date.now() });
+  const cutoff = Date.now() - MAX_AGE_MS;
+  if (records.length > MAX_RECORDS || records[0]!.atMs < cutoff) {
+    records = records.filter((r) => r.atMs >= cutoff).slice(-MAX_RECORDS);
+  }
+}
+
+/**
+ * Mints recorded after `watermark`, deduplicated per nonce+identity (latest
+ * wins — one conversation re-revealing the same credential re-mints the
+ * same canonical sentinel). The nonce is part of the dedupe key on purpose:
+ * consumers filter the result by THEIR nonce afterwards, so an
+ * identity-only dedupe would let a concurrent conversation's later reveal
+ * of the same credential clobber this conversation's legitimate mint and
+ * neutralize its echoed sentinel. Callers MUST intersect the result with
+ * their own trusted staging context before treating a mint as re-mint
+ * authority — see the module doc.
+ */
+export function forChatMintsSince(watermark: number): ForChatMint[] {
+  const byNonceAndIdentity = new Map<string, ForChatMint>();
+  for (const r of records) {
+    if (r.seq > watermark) {
+      byNonceAndIdentity.set(`${r.nonce}\u0000${r.service}\u0000${r.field}`, {
+        service: r.service,
+        field: r.field,
+        sentinel: r.sentinel,
+        nonce: r.nonce,
+      });
+    }
+  }
+  return [...byNonceAndIdentity.values()];
+}
+
+/** Test-only: drop all records and reset the watermark counter. */
+export function resetForChatMintRegistryForTest(): void {
+  counter = 0;
+  records = [];
+}

package/src/runtime/reveal-nonce.ts

@@ -0,0 +1,49 @@
+/**
+ * reveal-nonce — per-conversation secret binding reveal-derived authority
+ * to the conversation whose tool shell actually executed the reveal.
+ *
+ * The reveal route's records (plaintext proofs and `--for-chat` mints) are
+ * process-global, and the identities a run STAGES are parsed from command
+ * text — so with two turns running concurrently, conversation B could
+ * quote a reveal command (staging the identity) while conversation A
+ * executes a real reveal for the same identity, and B's guard would treat
+ * A's record as its own authority. Every caller-visible conversation
+ * identifier (`__CONVERSATION_ID`, a body field) is overridable by the
+ * command under execution, so the binding must be a value other
+ * conversations cannot know.
+ *
+ * This module holds one random nonce per conversation, created lazily and
+ * kept only in daemon memory. The shell tools export it to the tool
+ * subprocess as `__REVEAL_NONCE`; the CLI forwards it on reveal calls; the
+ * route stamps it onto every record; and the conversation loop accepts
+ * only records carrying its own nonce. A quoted/commented-out invocation
+ * never reaches the route, so it never produces a record with any nonce.
+ * A model can read its own conversation's nonce from the tool env, but
+ * spending it requires an actual route call from its own approval-gated
+ * tool shell — which is precisely the authority the binding encodes.
+ * Another conversation's nonce appears in no transcript, log, or URL;
+ * stealing one requires an exfiltration channel between two already-
+ * compromised conversations, which defeats any per-conversation binding.
+ *
+ * Nonces are not persisted: a daemon restart rotates them, which only
+ * invalidates records that are themselves turn-scoped and in-memory.
+ */
+
+import { randomBytes } from "node:crypto";
+
+const nonces = new Map<string, string>();
+
+/** The secret reveal nonce for a conversation (lazily created). */
+export function conversationRevealNonce(conversationId: string): string {
+  let nonce = nonces.get(conversationId);
+  if (nonce === undefined) {
+    nonce = randomBytes(16).toString("hex");
+    nonces.set(conversationId, nonce);
+  }
+  return nonce;
+}
+
+/** Test-only: drop all nonces so each test starts unbound. */
+export function _resetRevealNoncesForTest(): void {
+  nonces.clear();
+}

package/src/runtime/reveal-success-registry.ts

@@ -0,0 +1,306 @@
+/**
+ * In-process registry of successful `credentials_reveal` route executions.
+ *
+ * The chat-credential-reveal persist seams need PROOF that a reveal
+ * actually ran before candidate resolution may read a plaintext from the
+ * store: a shell tool's overall success is not that proof (`assistant
+ * credentials reveal … || true` succeeds when the route failed, and an
+ * `echo` containing the command text never calls the route at all). The
+ * reveal route handler is the single place plaintext legitimately leaves
+ * the store for a reveal, so it records each success here and the agent
+ * loop promotes staged candidate refs only when a matching identity was
+ * recorded between the tool's proposal and its result.
+ *
+ * Watermarks are a monotonic sequence counter: callers capture the
+ * watermark when a tool_use stages refs and query "did identity X succeed
+ * since?" at result time — records from earlier turns or long-dead tools
+ * never match. The registry is process-local (route handlers and the
+ * conversation loop share the daemon process) and bounded by count and
+ * age so it cannot grow without limit (recent records get a short grace
+ * from the count cap so an active tool window cannot lose its proof).
+ *
+ * Only DIRECT local-principal reveals record here (the unix-socket IPC
+ * identity a tool shell's CLI invocation carries — see the route handler's
+ * gate): a web or gateway-proxied reveal (Settings row, chat chips) is not
+ * evidence any tool ran a reveal and must never become proof — including
+ * local-mode web calls, where the gateway derives the `local` principal
+ * from the JWT but always stamps `x-vellum-proxy-server: ipc`.
+ *
+ * Records are conversation-bound via the reveal NONCE (see
+ * `reveal-nonce.ts`): the shell tools export each conversation's secret
+ * nonce to the tool subprocess, the CLI forwards it, the route stamps it
+ * onto the record, and readers require an exact match. A concurrent
+ * conversation's reveal of the SAME identity therefore cannot satisfy
+ * another conversation's proof check — its records carry a different
+ * nonce — and a reveal with no nonce (outside any conversation's tool
+ * shell) records nothing.
+ */
+
+interface RevealSuccessRecord {
+  readonly seq: number;
+  readonly service: string;
+  readonly field: string;
+  /**
+   * The plaintext the route actually served for this success. Retained so the
+   * persist seams redact the EXACT bytes the tool printed, rather than a later
+   * vault read that a rotation/deletion between reveal and persist could make
+   * diverge (or empty). This is the same secret the model already received in
+   * the tool result — holding it in the process-local, count-and-age-bounded
+   * registry for the length of one turn adds no new exposure surface.
+   */
+  readonly value: string;
+  /**
+   * The conversation-bound reveal nonce the CLI forwarded (see
+   * `reveal-nonce.ts`). Readers match on it exactly, so a record can only
+   * ever prove refs for the conversation whose tool shell executed the
+   * reveal.
+   */
+  readonly nonce: string;
+  readonly recordedAtMs: number;
+}
+
+const MAX_RECORDS = 256;
+const MAX_AGE_MS = 6 * 60 * 60 * 1000;
+/**
+ * Records younger than this are exempt from the count cap: a success may
+ * still be inside an active propose→result window (a single command with
+ * hundreds of reveal invocations, or concurrent turns), and count-evicting
+ * it would silently drop the proof — the tool's stdout then persists raw.
+ * Memory stays bounded: the age prune always applies, and the count cap
+ * resumes for anything older than the grace period.
+ */
+const COUNT_PRUNE_GRACE_MS = 15 * 60 * 1000;
+
+let seqCounter = 0;
+let records: RevealSuccessRecord[] = [];
+/**
+ * Evicts expired records even when the registry goes idle. Records hold
+ * credential plaintext, and pruning only on the next write would retain a
+ * lone reveal's secret in memory indefinitely — there may never be another
+ * reveal. Armed on every write for the earliest record's expiry,
+ * self-reschedules while records remain, and unref'd so it never holds the
+ * process open. Reads prune too, so an active conversation drops expired
+ * records without waiting for the timer.
+ */
+let pruneTimer: ReturnType<typeof setTimeout> | undefined;
+
+function prune(nowMs: number): void {
+  records = records.filter((r) => nowMs - r.recordedAtMs <= MAX_AGE_MS);
+  let excess = records.length - MAX_RECORDS;
+  if (excess > 0) {
+    // Oldest-first eviction (records are in seq order), skipping anything
+    // still inside the grace window.
+    records = records.filter((r) => {
+      if (excess > 0 && nowMs - r.recordedAtMs > COUNT_PRUNE_GRACE_MS) {
+        excess -= 1;
+        return false;
+      }
+      return true;
+    });
+  }
+}
+
+function schedulePrune(nowMs: number): void {
+  if (pruneTimer !== undefined || records.length === 0) {
+    return;
+  }
+  const earliestExpiryMs = records[0]!.recordedAtMs + MAX_AGE_MS;
+  const timer = setTimeout(
+    () => {
+      pruneTimer = undefined;
+      const t = Date.now();
+      prune(t);
+      schedulePrune(t);
+    },
+    Math.max(earliestExpiryMs - nowMs, 1000),
+  );
+  timer.unref?.();
+  pruneTimer = timer;
+}
+
+/**
+ * Current watermark. Capture BEFORE the reveal tool executes; only
+ * successes recorded after this point satisfy {@link hasRevealSuccessSince}.
+ */
+export function currentRevealSuccessWatermark(): number {
+  return seqCounter;
+}
+
+/**
+ * Open proof windows — one per tool_use that STAGED reveal refs, closed
+ * when its tool_result consumes the proof. Plaintext is only ever recorded
+ * while at least one window is open: a user's own local CLI reveal outside
+ * any assistant tool turn has no pending proof to satisfy, and retaining
+ * its value for the age bound would expand every CLI reveal's exposure for
+ * nothing. Windows auto-expire at the age bound so a leaked window (a tool
+ * whose result never arrives) cannot arm recording forever.
+ */
+interface RevealProofWindow {
+  readonly token: number;
+  readonly openedAtMs: number;
+}
+
+let windowCounter = 0;
+let openWindows: RevealProofWindow[] = [];
+
+function expireWindows(nowMs: number): void {
+  openWindows = openWindows.filter((w) => nowMs - w.openedAtMs <= MAX_AGE_MS);
+  clearRecordsIfNoWindows();
+}
+
+/**
+ * Drop every retained record the moment no proof window remains open.
+ * Proof consumption is the records' only purpose, and once the last
+ * window closes nothing can ever read them again: the consuming
+ * `filterRefsByRevealProof` runs BEFORE its window is closed, promoted
+ * refs carry the plaintext themselves, and any future staging captures a
+ * watermark at the current sequence counter — above every existing
+ * record's seq. Waiting for the age bound would keep credential plaintext
+ * in memory long after the proof was needed.
+ */
+function clearRecordsIfNoWindows(): void {
+  if (openWindows.length > 0 || records.length === 0) {
+    return;
+  }
+  records = [];
+  if (pruneTimer !== undefined) {
+    clearTimeout(pruneTimer);
+    pruneTimer = undefined;
+  }
+}
+
+/**
+ * Open a proof window. Call when a tool_use stages reveal refs — BEFORE
+ * the tool executes, so the route's success during the run is recordable.
+ * Returns a token the staging seam must pass to
+ * {@link closeRevealProofWindow} when the tool's result consumes the proof.
+ */
+export function openRevealProofWindow(): number {
+  expireWindows(Date.now());
+  windowCounter += 1;
+  openWindows.push({ token: windowCounter, openedAtMs: Date.now() });
+  return windowCounter;
+}
+
+/** Close a proof window once its staged refs have been consumed. */
+export function closeRevealProofWindow(token: number): void {
+  openWindows = openWindows.filter((w) => w.token !== token);
+  clearRecordsIfNoWindows();
+}
+
+/**
+ * Record a successful reveal. Call ONLY from the `credentials_reveal`
+ * route handler, after the plaintext has been located AND the caller was
+ * verified as the `local` principal (a tool shell's direct-IPC CLI call) —
+ * this is the ground truth the promotion check trusts. `value` is the
+ * plaintext the route served, retained so persist redacts the exact
+ * printed bytes. A no-op while no proof window is open — with no staged
+ * tool reveal anywhere, there is nothing the plaintext could prove.
+ */
+export function recordRevealSuccess(
+  service: string,
+  field: string,
+  value: string,
+  nonce: string,
+): void {
+  const nowMs = Date.now();
+  expireWindows(nowMs);
+  if (openWindows.length === 0) {
+    return;
+  }
+  seqCounter += 1;
+  records.push({
+    seq: seqCounter,
+    service,
+    field,
+    value,
+    nonce,
+    recordedAtMs: nowMs,
+  });
+  prune(nowMs);
+  schedulePrune(nowMs);
+}
+
+/**
+ * Whether the reveal route succeeded for `service`/`field` after
+ * `watermark` was captured.
+ */
+export function hasRevealSuccessSince(
+  watermark: number,
+  service: string,
+  field: string,
+  nonce: string,
+): boolean {
+  return revealedValueSince(watermark, service, field, nonce) !== undefined;
+}
+
+/**
+ * The most recent plaintext the reveal route served for `service`/`field`
+ * after `watermark`, or `undefined` if no matching success was recorded.
+ */
+export function revealedValueSince(
+  watermark: number,
+  service: string,
+  field: string,
+  nonce: string,
+): string | undefined {
+  return revealedValuesSince(watermark, service, field, nonce)[0];
+}
+
+/**
+ * ALL distinct plaintexts the reveal route served for `service`/`field`
+ * after `watermark`, most recent first. Usually a single value, but a
+ * rotate-and-re-reveal inside one window (reveal v1 → `credentials set` →
+ * reveal v2) legitimately serves two different plaintexts — both were
+ * printed to a tool's stdout, so persist redaction must treat each as a
+ * candidate; surfacing only the latest would leave the earlier bytes
+ * unprotected. Callers use these to redact the exact served bytes instead
+ * of re-reading the vault, which a rotation/deletion between reveal and
+ * persist could make diverge.
+ */
+export function revealedValuesSince(
+  watermark: number,
+  service: string,
+  field: string,
+  nonce: string,
+): string[] {
+  const nowMs = Date.now();
+  // Evict, don't just filter: expired records hold plaintext and must
+  // leave memory as soon as any registry activity notices them.
+  prune(nowMs);
+  const matches = records
+    .filter(
+      (r) =>
+        r.seq > watermark &&
+        r.service === service &&
+        r.field === field &&
+        r.nonce === nonce,
+    )
+    .sort((a, b) => b.seq - a.seq);
+  const seen = new Set<string>();
+  const values: string[] = [];
+  for (const r of matches) {
+    if (!seen.has(r.value)) {
+      seen.add(r.value);
+      values.push(r.value);
+    }
+  }
+  return values;
+}
+
+/** Test-only: number of retained records, for retention assertions. */
+export function _recordCountForTest(): number {
+  return records.length;
+}
+
+/** Test-only: clear records, windows, the prune timer, and the watermark. */
+export function _resetRevealSuccessRegistryForTest(): void {
+  seqCounter = 0;
+  records = [];
+  windowCounter = 0;
+  openWindows = [];
+  if (pruneTimer !== undefined) {
+    clearTimeout(pruneTimer);
+    pruneTimer = undefined;
+  }
+}

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -53,13 +53,16 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
 import { loadRawConfig } from "../../../config/loader.js";
 import { LLMConfigBase } from "../../../config/schemas/llm.js";
 import type { ConversationCreateType } from "../../../persistence/conversation-types.js";
-import { getDb, getLogsDb } from "../../../persistence/db-connection.js";
+import {
+  getDb,
+  getLogsDb,
+  getMemorySqlite,
+} from "../../../persistence/db-connection.js";
 import { initializeDb } from "../../../persistence/db-init.js";
 import {
   conversationKeys,
   conversations,
   llmRequestLogs,
-  memoryV2ActivationLogs,
   messages,
   providerConnections,
 } from "../../../persistence/schema/index.js";
@@ -106,7 +109,7 @@ function dispatchConversationLlmContext(queryParams: Record<string, string>) {
 function clearTables(): void {
   const db = getDb();
   getLogsDb()!.delete(llmRequestLogs).run();
-  db.delete(memoryV2ActivationLogs).run();
+  getMemorySqlite()!.exec(`DELETE FROM memory_v2_activation_logs`);
   db.delete(messages).run();
   db.delete(conversationKeys).run();
   db.delete(conversations).run();
@@ -1396,6 +1399,88 @@ describe("custom profile write normalization (complete overrides)", () => {
   });
 });
 
+describe("call-site override tuning backfill", () => {
+  const configPatchRoute = ROUTES.find(
+    (r) => r.operationId === "config_patch",
+  )!;
+
+  const savedCallSites = () =>
+    (
+      loadRawConfig().llm as {
+        callSites?: Record<string, Record<string, unknown>>;
+      }
+    ).callSites ?? {};
+
+  beforeEach(() => {
+    rawConfigFixture = { llm: {} };
+    seedRawConfig();
+  });
+
+  test("PATCH creating a bare { profile } entry backfills shipped tuning", async () => {
+    await configPatchRoute.handler({
+      body: {
+        llm: {
+          callSites: {
+            memoryRouter: { profile: "mine", provider: null, model: null },
+            commitMessage: { profile: "mine", provider: null, model: null },
+          },
+        },
+      },
+    });
+    const memoryRouter = savedCallSites().memoryRouter!;
+    expect(memoryRouter.profile).toBe("mine");
+    expect(memoryRouter.contextWindow).toEqual({ maxInputTokens: 1_000_000 });
+    const commitMessage = savedCallSites().commitMessage!;
+    expect(commitMessage.profile).toBe("mine");
+    expect(commitMessage.maxTokens).toBe(120);
+    expect(commitMessage.effort).toBe("low");
+  });
+
+  test("explicit patch values win over shipped tuning on a new entry", async () => {
+    await configPatchRoute.handler({
+      body: {
+        llm: {
+          callSites: { commitMessage: { profile: "mine", maxTokens: 500 } },
+        },
+      },
+    });
+    const saved = savedCallSites().commitMessage!;
+    expect(saved.maxTokens).toBe(500);
+    expect(saved.temperature).toBe(0.2);
+  });
+
+  test("existing entries are never backfilled — customization is preserved", async () => {
+    rawConfigFixture = {
+      llm: { callSites: { recall: { profile: "old", maxTokens: 200 } } },
+    };
+    seedRawConfig();
+    await configPatchRoute.handler({
+      body: {
+        llm: {
+          callSites: {
+            recall: { profile: "mine", provider: null, model: null },
+          },
+        },
+      },
+    });
+    const saved = savedCallSites().recall!;
+    expect(saved.profile).toBe("mine");
+    expect(saved.maxTokens).toBe(200);
+    expect(saved.disableCache).toBeUndefined();
+  });
+
+  test("deleting an entry (null) is untouched by the backfill", async () => {
+    rawConfigFixture = {
+      llm: { callSites: { recall: { profile: "old" } } },
+    };
+    seedRawConfig();
+    await configPatchRoute.handler({
+      body: { llm: { callSites: { recall: null } } },
+    });
+    expect(savedCallSites().recall).toBeUndefined();
+  });
+});
+
 describe("config invariant flag enrichment", () => {
   const configGetRoute = ROUTES.find((r) => r.operationId === "config_get")!;
   const configPatchRoute = ROUTES.find(