@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/tools/permission-checker.ts

@@ -1,13 +1,18 @@
+import type {
+  RiskAllowlistOption,
+  RiskDirectoryScopeOption,
+  RiskPatternScopeOption,
+} from "@vellumai/gateway-client";
+
 import { getIsContainerized } from "../config/env-registry.js";
 import { mapApprovalProvenance } from "../permissions/approval-provenance.js";
 import { buildChannelPermissionCellQuery } from "../permissions/channel-permission-query.js";
 import {
   check,
   classifyRisk,
-  generateAllowlistOptions,
   generateScopeOptions,
-  getCachedAssessment,
   isDynamicSkillLoadInvocation,
+  type RiskClassificationWithMeta,
 } from "../permissions/checker.js";
 import { getAutoApproveThreshold } from "../permissions/gateway-threshold-reader.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
@@ -37,19 +42,15 @@ export type PermissionDecision =
       decision: string;
       riskLevel: string;
       wasPrompted?: boolean;
-      /** ID of the trust rule that matched this invocation (if any). Always set when a rule matched, even for non-classifier tools where riskMeta is absent. */
+      /** ID of the trust rule that matched this invocation (if any). */
       matchedTrustRuleId?: string;
-      /** Risk metadata from the classifier assessment cache (when available). */
-      riskMeta?: {
+      /** Risk metadata from the invocation's classification. */
+      riskMeta: {
         riskLevel: string;
         riskReason: string;
-        riskScopeOptions: Array<{ pattern: string; label: string }>;
-        riskAllowlistOptions?: Array<{
-          label: string;
-          description: string;
-          pattern: string;
-        }>;
-        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+        riskScopeOptions: RiskPatternScopeOption[];
+        riskAllowlistOptions?: RiskAllowlistOption[];
+        riskDirectoryScopeOptions?: RiskDirectoryScopeOption[];
         isContainerized?: boolean;
       };
       approvalMode?: ApprovalMode;
@@ -61,19 +62,15 @@ export type PermissionDecision =
       decision: string;
       riskLevel: string;
       content: string;
-      /** ID of the trust rule that matched this invocation (if any). Always set when a rule matched, even for non-classifier tools where riskMeta is absent. */
+      /** ID of the trust rule that matched this invocation (if any). */
       matchedTrustRuleId?: string;
-      /** Risk metadata from the classifier assessment cache (when available). */
-      riskMeta?: {
+      /** Risk metadata from the invocation's classification. */
+      riskMeta: {
         riskLevel: string;
         riskReason: string;
-        riskScopeOptions: Array<{ pattern: string; label: string }>;
-        riskAllowlistOptions?: Array<{
-          label: string;
-          description: string;
-          pattern: string;
-        }>;
-        riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+        riskScopeOptions: RiskPatternScopeOption[];
+        riskAllowlistOptions?: RiskAllowlistOption[];
+        riskDirectoryScopeOptions?: RiskDirectoryScopeOption[];
         isContainerized?: boolean;
       };
       approvalMode?: ApprovalMode;
@@ -89,10 +86,13 @@ export class PermissionChecker {
   }
 
   /**
-   * Run risk classification, trust rule evaluation, and (if needed) user
-   * prompting for a tool invocation. Returns whether the tool is allowed
-   * to execute, along with the decision string and risk level for lifecycle
-   * event reporting.
+   * Run trust rule evaluation and (if needed) user prompting for a tool
+   * invocation. Returns whether the tool is allowed to execute, along with
+   * the decision string and risk level for lifecycle event reporting.
+   *
+   * `classification` is the invocation's gateway classification when the
+   * executor already holds it (it classifies once, before its gates); absent
+   * that, the same input is classified here.
    */
   async checkPermission(
     name: string,
@@ -113,10 +113,11 @@ export class PermissionChecker {
         }
       | undefined
     >,
+    classification?: RiskClassificationWithMeta,
   ): Promise<PermissionDecision> {
     // Sandbox/host routing for the prompt comes from the tool's manifest.
     const executionTarget = resolveExecutionTarget(tool);
-    const { level: risk, reason: riskReason } = await classifyRisk(
+    classification ??= await classifyRisk(
       name,
       input,
       context.workingDir,
@@ -124,26 +125,19 @@ export class PermissionChecker {
       undefined,
       context.signal,
     );
+    const { level: risk, reason: riskReason } = classification;
     const riskLevel: string = risk;
 
-    // Look up the cached assessment to extract risk metadata for the tool result.
-    // This is populated by classifyRisk() for classifier-backed tools (bash, file, web, skill).
-    // For tools without classifiers (e.g. MCP tools), the cache returns undefined.
-    const cachedAssessment = getCachedAssessment(name, input);
-    const riskMeta = cachedAssessment
-      ? {
-          riskLevel: cachedAssessment.riskLevel,
-          riskReason: cachedAssessment.reason,
-          // Display ladder (regex patterns — internal only, not for save).
-          riskScopeOptions: cachedAssessment.scopeOptions,
-          // Save ladder (Minimatch globs — what the gateway matches against).
-          // Populated for classifiers that produce allowlist options
-          // (bash, file, skill); undefined otherwise.
-          riskAllowlistOptions: cachedAssessment.allowlistOptions,
-          riskDirectoryScopeOptions: cachedAssessment.directoryScopeOptions,
-          isContainerized: getIsContainerized(),
-        }
-      : undefined;
+    const riskMeta = {
+      riskLevel: classification.level,
+      riskReason: classification.reason,
+      // Display ladder: bash only, internal, never persisted as a rule.
+      riskScopeOptions: classification.scopeOptions,
+      // Save ladder: the patterns the gateway matches a rule by, exactly.
+      riskAllowlistOptions: classification.allowlistOptions,
+      riskDirectoryScopeOptions: classification.directoryScopeOptions,
+      isContainerized: getIsContainerized(),
+    };
 
     // Wrap the rest of permission evaluation so that any exception
     // carries the classified risk level back to the caller. Without
@@ -158,6 +152,7 @@ export class PermissionChecker {
         policyContext,
         undefined,
         context.signal,
+        classification,
       );
 
       // Every threshold read for this invocation must consult the same
@@ -240,7 +235,7 @@ export class PermissionChecker {
       if (
         context.isInteractive === false &&
         isDynamicSkillLoadInvocation(name, input) &&
-        getCachedAssessment(name, input)?.matchType !== "user_rule"
+        classification.matchType !== "user_rule"
       ) {
         log.info(
           { toolName: name, riskLevel },
@@ -385,11 +380,7 @@ export class PermissionChecker {
           context.workingDir,
         );
         const promptOptions = {
-          allowlistOptions: await generateAllowlistOptions(
-            name,
-            input,
-            context.signal,
-          ),
+          allowlistOptions: classification.allowlistOptions ?? [],
           scopeOptions: generateScopeOptions(context.workingDir, name),
           persistentDecisionsAllowed: !context.requireFreshApproval,
         };
@@ -410,7 +401,7 @@ export class PermissionChecker {
           context.toolUseId,
           riskReason,
           getIsContainerized(),
-          cachedAssessment?.directoryScopeOptions,
+          classification.directoryScopeOptions,
         );
 
         const decision = response.decision;

package/src/tools/schema-transforms.ts

@@ -6,6 +6,45 @@ import type { ToolDefinition } from "../providers/types.js";
  */
 export const ACTIVITY_SKIP_SET = new Set<string>();
 
+/** The status field injected into every advertised tool input schema. */
+export const ACTIVITY_FIELD = "activity";
+
+const ACTIVITY_PROPERTY = {
+  type: "string",
+  description:
+    "Brief, natural description of what you're doing, shown as a live status update (e.g. 'Checking your project settings')",
+};
+
+/**
+ * Add the injected `activity` property to a schema, so a validator checking a
+ * call against the tool's own schema accepts the field the advertised schema
+ * asked the model to send.
+ *
+ * `injectActivityField` rewrites the definitions the model sees, not the
+ * manifest a skill tool validates against, so without this the model is
+ * offered a field its own tool then rejects as unknown. The property is added
+ * but never the `required` entry: the advertised copy asks for it, and a call
+ * that leaves it out is still a call the tool can serve.
+ */
+export function withActivityProperty(
+  schema: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+  if (!schema || schema.type !== "object") {
+    return schema;
+  }
+  const properties = schema.properties;
+  if (typeof properties !== "object" || properties === null) {
+    return schema;
+  }
+  if (schemaDefinesProperty(schema, ACTIVITY_FIELD)) {
+    return schema;
+  }
+  return {
+    ...schema,
+    properties: { ...properties, [ACTIVITY_FIELD]: ACTIVITY_PROPERTY },
+  };
+}
+
 /**
  * Injects an `activity` string property into each tool definition's input
  * schema, unless the tool is in the skip set, already has an activity field,
@@ -46,11 +85,7 @@ export function injectActivityField(
     // Deep clone to avoid mutating shared refs
     const newProperties = {
       ...properties,
-      activity: {
-        type: "string",
-        description:
-          "Brief, natural description of what you're doing, shown as a live status update (e.g. 'Checking your project settings')",
-      },
+      [ACTIVITY_FIELD]: ACTIVITY_PROPERTY,
     };
     const existingRequired = Array.isArray(schema.required)
       ? [...schema.required, "activity"]

package/src/tools/shared/input-repairs.ts

@@ -0,0 +1,160 @@
+/**
+ * Pre-validation repairs for bundled tool calls whose arguments arrive in a
+ * shape the tool did not declare but whose intent is unambiguous.
+ *
+ * The sibling module `input-misuse.ts` answers a misused parameter shape with
+ * a better error message. This one answers the shapes we can act on instead:
+ * the call carries what the tool needs, spelled the way the surrounding prose
+ * asks for it rather than the way the schema declares it, so rewriting it is
+ * closer to the caller's intent than rejecting it. Repairs run before
+ * `validateInputAgainstSchema`, so a repaired call validates on its merits and
+ * anything left unrepaired keeps its normal error.
+ *
+ * Generic, schema-derivable coercions (a string holding a JSON array, one
+ * element where a list was expected) belong in `skills/validate-input.ts`.
+ * What lives here is knowledge of a specific tool's contract that no schema
+ * states.
+ *
+ * Rules describe the first-party tools that ship in `bundled-skills/`, and
+ * tool names are not reserved: a managed, workspace, extra, or plugin skill
+ * may define its own `scaffold_managed_skill` with a different contract. The
+ * `bundled` prefix on the export is the reminder that callers must establish
+ * bundled provenance before applying a repair.
+ */
+
+import { isPlainObject } from "../../util/object.js";
+
+interface ToolInputRepairRules {
+  /**
+   * Parameter spellings the tool accepts as another parameter's name.
+   *
+   * Each entry is a name the prose around the tool uses for a parameter the
+   * schema declares under a different one, and models follow prose over
+   * schema. `scaffold_managed_skill` declares `body_markdown` while the
+   * skill-authoring prose talks throughout about writing "the body"; the
+   * retrospective prompt tells the model to call `find_similar_skills` with a
+   * short description, which the schema declares as `goal`.
+   *
+   * An alias applies only when the canonical parameter is absent, so a call
+   * that spells the parameter correctly is never overwritten.
+   */
+  aliases?: Readonly<Record<string, string>>;
+  /** Whether the tool's `files` parameter also reads a path-keyed map. */
+  filesMap?: boolean;
+}
+
+const REPAIR_RULES: Readonly<Record<string, ToolInputRepairRules>> = {
+  scaffold_managed_skill: {
+    aliases: {
+      body: "body_markdown",
+      content: "body_markdown",
+      title: "name",
+      summary: "description",
+    },
+    filesMap: true,
+  },
+  find_similar_skills: {
+    aliases: { description: "goal", query: "goal" },
+  },
+};
+
+/** The properties one `files` entry declares. */
+const FILE_ENTRY_KEYS: ReadonlySet<string> = new Set([
+  "path",
+  "content",
+  "copy_from",
+]);
+
+/** The properties a `files` entry may carry besides its path. */
+const FILE_BYTES_KEYS: ReadonlySet<string> = new Set(["content", "copy_from"]);
+
+/**
+ * Read a `files` object written as a map from path to contents, the shape
+ * models reach for when asked for companion files keyed by where they go:
+ * `{"references/failure-modes.md": "..."}`, or with the entry spelled out as
+ * `{"scripts/run.sh": {"copy_from": "/abs/path"}}`.
+ *
+ * Returns the declared array shape, or `undefined` when any entry is not
+ * readable as one file, in which case the whole value is left alone: a partial
+ * reading would drop files the caller asked for without saying so. Guessing
+ * which path wins for an entry that names its own is a guess about intent
+ * rather than a repair, so those are left too.
+ */
+function filesMapToEntries(
+  map: Record<string, unknown>,
+): unknown[] | undefined {
+  const entries = Object.entries(map);
+  // An object spelling out one entry's own fields is a single file, not a map
+  // of them. Reading it as a map would turn its field names into paths.
+  if (
+    entries.length === 0 ||
+    entries.every(([key]) => FILE_ENTRY_KEYS.has(key))
+  ) {
+    return undefined;
+  }
+  const files: Record<string, unknown>[] = [];
+  for (const [path, entry] of entries) {
+    if (!path.trim()) {
+      return undefined;
+    }
+    if (typeof entry === "string") {
+      files.push({ path, content: entry });
+      continue;
+    }
+    if (!isPlainObject(entry)) {
+      return undefined;
+    }
+    const keys = Object.keys(entry);
+    if (keys.length === 0 || !keys.every((key) => FILE_BYTES_KEYS.has(key))) {
+      return undefined;
+    }
+    files.push({ path, ...entry });
+  }
+  return files;
+}
+
+/**
+ * Rewrite a bundled tool's input into the shape its schema declares, when the
+ * arguments say what was meant unambiguously.
+ *
+ * Only call this for a tool that came from a bundled skill. `toolName` alone
+ * does not establish that.
+ *
+ * Pure: returns a new object when a repair applies, otherwise returns `input`
+ * unchanged. Never mutates `input`.
+ */
+export function bundledToolInputRepairs(
+  toolName: string,
+  input: Record<string, unknown>,
+): Record<string, unknown> {
+  const rules = REPAIR_RULES[toolName];
+  if (!rules) {
+    return input;
+  }
+  let repaired: Record<string, unknown> | undefined;
+
+  for (const [alias, canonical] of Object.entries(rules.aliases ?? {})) {
+    if (!(alias in input) || canonical in input) {
+      continue;
+    }
+    repaired ??= { ...input };
+    repaired[canonical] = repaired[alias];
+    delete repaired[alias];
+  }
+
+  const files = input.files;
+  if (rules.filesMap && isPlainObject(files)) {
+    const entries = filesMapToEntries(files);
+    if (entries) {
+      repaired ??= { ...input };
+      repaired.files = entries;
+    }
+  }
+
+  return repaired ?? input;
+}
+
+/** Every alias a bundled `toolName` accepts, for drift guards. */
+export function bundledToolInputAliases(toolName: string): string[] {
+  return Object.keys(REPAIR_RULES[toolName]?.aliases ?? {});
+}

package/src/tools/skills/skill-tool-factory.ts

@@ -1,11 +1,14 @@
 import type { SkillToolEntry } from "../../config/skills.js";
 import { RiskLevel } from "../../permissions/types.js";
 import {
+  coerceArrayShapes,
   coerceStringBooleans,
   coerceStringNumbers,
   validateInputAgainstSchema,
 } from "../../skills/validate-input.js";
+import { withActivityProperty } from "../schema-transforms.js";
 import { bundledToolInputMisuseMessage } from "../shared/input-misuse.js";
+import { bundledToolInputRepairs } from "../shared/input-repairs.js";
 import type { ExecutionTarget } from "../tool-types.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../types.js";
 import { runSkillToolScript } from "./skill-script-runner.js";
@@ -43,11 +46,22 @@ export function createSkillTool(
       input: Record<string, unknown>,
       context: ToolContext,
     ): Promise<ToolExecutionResult> {
-      const schema = entry.input_schema as Record<string, unknown> | undefined;
-      const coercedInput = coerceStringNumbers(
-        coerceStringBooleans(input, schema),
-        schema,
+      // Validate against the schema the model was actually shown: tool
+      // definitions carry an injected `activity` field the manifest does not
+      // declare, and a call that fills it must not be rejected as unknown.
+      const schema = withActivityProperty(
+        entry.input_schema as Record<string, unknown> | undefined,
       );
+      // Tool-specific repairs first: they rewrite keys and shapes the schema
+      // does not describe, and the generic coercions below then see the
+      // declared parameter names. Repairs describe first-party tools, so only
+      // bundled skills consult them.
+      const repairedInput = bundled
+        ? bundledToolInputRepairs(entry.name, input)
+        : input;
+      const withBooleans = coerceStringBooleans(repairedInput, schema);
+      const withNumbers = coerceStringNumbers(withBooleans, schema);
+      const coercedInput = coerceArrayShapes(withNumbers, schema);
       const validation = validateInputAgainstSchema(
         entry.name,
         coercedInput,

package/src/tools/subagent/spawn.ts

@@ -595,7 +595,6 @@ async function runAdvisorConsult(args: {
       workingDir: context.workingDir,
       allowedToolNames: context.allowedToolNames,
       trustClass: context.trustClass,
-      sourceChannel: context.executionChannel,
       enabledPluginSet: context.enabledPluginSet,
       // The parent's warm per-turn catalog keeps the synchronous on-disk
       // catalog scan out of the consult path.

package/src/tools/tool-approval-handler.ts

@@ -136,23 +136,29 @@ const TC_GRANT_WAIT_INTERVAL_MS = 500;
 export const TC_GRANT_WAIT_MAX_MS = 60_000;
 
 /**
- * Resolve the wait budget for an escalated tool grant.
+ * Resolve how long one approval decision stays open, in milliseconds.
  *
- * A guardian answering an escalated tool call is making the same decision as a
- * local user answering a permission prompt, so both paths spend the same
+ * Every actor deciding a gated tool call is making the same decision as a
+ * local user answering a permission prompt, so every path spends the same
  * budget: `timeouts.permissionTimeoutSec` (read by `permissions/prompter.ts`).
- * If anything, this path needs the larger share of it: the prompter's user
- * already has the prompt on screen, while the guardian is notified
- * out-of-band and has to context-switch before deciding.
+ * If anything, an off-channel path needs the larger share of it: the
+ * prompter's user already has the prompt on screen, while a guardian is
+ * notified out-of-band and has to context-switch before deciding.
  *
  * Falls back to {@link TC_GRANT_WAIT_MAX_MS} rather than the tool-execution
  * default on a non-positive value, so a bad config can never collapse the
  * window to zero and auto-deny every escalation.
  *
- * Exported because the grant resolver sizes its `inline_wait_active` staleness
- * threshold off this same budget: if the two drift, an approval arriving while
- * a waiter is still live gets misread as a dead waiter and the requester is
- * told to retry a call that is about to resume on its own.
+ * This is the one owner of that budget, and every clock measuring the same
+ * window reads it here rather than restating the number:
+ *
+ * - the inline grant wait, which spends it directly;
+ * - the grant resolver's `inline_wait_active` staleness threshold, because if
+ *   the two drift, an approval arriving while a waiter is still live gets
+ *   misread as a dead waiter and the requester is told to retry a call that is
+ *   about to resume on its own;
+ * - the `tool_approval` row deadline, so the card stops offering a decision at
+ *   the same moment the prompt stops waiting for one.
  */
 export function resolveInlineGrantWaitMs(): number {
   return safeTimeoutMs(

package/src/tools/tool-types.ts

@@ -5,9 +5,10 @@
  * Pure type-level declarations only (+ the `RiskLevel` enum, which is a
  * value). No runtime helpers live here — the assistant keeps all behavior
  * functions in `assistant/src/tools/` and re-exports the types from this
- * file. This module imports nothing, so it can sit at the bottom of the
- * import graph and be consumed by `tools/types.ts`, `providers/types.ts`,
- * and `permissions/types.ts` without creating cycles.
+ * file. This module imports nothing from `assistant/src` (only type-only
+ * wire shapes from `@vellumai/gateway-client`), so it can sit at the bottom
+ * of the import graph and be consumed by `tools/types.ts`,
+ * `providers/types.ts`, and `permissions/types.ts` without creating cycles.
  *
  * Heavy daemon-internal references (CES client, host-proxy classes, trust
  * classifications, interface IDs, content blocks, CES `ApprovalRequired`)
@@ -25,6 +26,12 @@
 // Simple type-level declarations — moved in full
 // ---------------------------------------------------------------------------
 
+import type {
+  RiskAllowlistOption,
+  RiskDirectoryScopeOption,
+  RiskPatternScopeOption,
+} from "@vellumai/gateway-client";
+
 export type ExecutionTarget = "sandbox" | "host";
 
 /** The kind of extension that owns a tool. Core tools have no owner. */
@@ -49,6 +56,14 @@ export enum RiskLevel {
   High = "high",
 }
 
+/**
+ * `riskLevel` recorded on a `tool_invocations` audit row when the call's risk
+ * was never classified (classification aborted, or the gateway was
+ * unreachable, before any decision was reached). Distinct from every
+ * {@link RiskLevel} so a reader can tell "not assessed" from "assessed as low".
+ */
+export const RISK_LEVEL_UNCLASSIFIED = "unclassified";
+
 export interface ToolDefinition {
   name: string;
   description: string;
@@ -162,7 +177,7 @@ export interface ToolExecutionResult {
   /** Whether the daemon is running in a containerized (Docker) environment. */
   isContainerized?: boolean;
   /** Scope options ladder for the rule editor (narrowest to broadest). */
-  riskScopeOptions?: Array<{ pattern: string; label: string }>;
+  riskScopeOptions?: RiskPatternScopeOption[];
 }
 
 export type ProxyToolResolver = (
@@ -174,16 +189,14 @@ export type ProxyToolResolver = (
 // Permission prompt option ladders
 // ---------------------------------------------------------------------------
 
-export interface AllowlistOption {
-  label: string;
-  description: string;
-  pattern: string;
-}
+/** The prompt's "always allow" ladder entry: the gateway's wire shape. */
+export type AllowlistOption = RiskAllowlistOption;
 
-export interface ScopeOption {
-  label: string;
-  scope: string;
-}
+/**
+ * A directory-scope ladder entry (`scope` is a path glob or `everywhere`);
+ * the same wire shape the gateway emits as `directoryScopeOptions`.
+ */
+export type ScopeOption = RiskDirectoryScopeOption;
 
 // ---------------------------------------------------------------------------
 // Tool context

package/src/tools/types.ts

@@ -1,3 +1,7 @@
+import type {
+  RiskAllowlistOption,
+  RiskDirectoryScopeOption,
+} from "@vellumai/gateway-client";
 import { z } from "zod";
 
 import type { AnsweredQuestion } from "../api/events/question-answered.js";
@@ -124,13 +128,9 @@ export interface ToolExecutionResult {
    * wildcards) — what the gateway actually matches against. Mirrors
    * the `allowlistOptions` field on `ConfirmationRequest` SSE events.
    */
-  riskAllowlistOptions?: Array<{
-    label: string;
-    description: string;
-    pattern: string;
-  }>;
+  riskAllowlistOptions?: RiskAllowlistOption[];
   /** Directory scope ladder for the rule editor (narrowest to broadest). */
-  riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+  riskDirectoryScopeOptions?: RiskDirectoryScopeOption[];
   /** Structured activity metadata for client rendering (web search, web fetch, etc).
    *  Populated by daemon-internal tools; plugins must not set this. */
   activityMetadata?: ToolActivityMetadata;

package/src/util/__tests__/cgroup-memory.test.ts

@@ -19,6 +19,7 @@ vmalloc 0
 shmem 8192
 zswap 0
 zswapped 0
+inactive_file 1073741824
 file_mapped 209715200
 file_dirty 135168
 file_writeback 0
@@ -38,6 +39,7 @@ describe("parseMemoryStat", () => {
     expect(stat).toEqual({
       anonBytes: 2147483648,
       fileBytes: 1610612736,
+      inactiveFileBytes: 1073741824,
       kernelBytes: 943718400,
       slabReclaimableBytes: 838860800,
       slabUnreclaimableBytes: 104857600,
@@ -72,6 +74,7 @@ describe("parseMemoryStat", () => {
     expect(parseMemoryStat("")).toEqual({
       anonBytes: null,
       fileBytes: null,
+      inactiveFileBytes: null,
       kernelBytes: null,
       slabReclaimableBytes: null,
       slabUnreclaimableBytes: null,

package/src/util/cgroup-memory.ts

@@ -134,6 +134,8 @@ export interface ContainerMemoryStat {
   fileBytes: number | null;
   /** Total kernel memory charged to the cgroup (includes slab). */
   kernelBytes: number | null;
+  /** File-backed pages on the inactive LRU: readily reclaimable cache. */
+  inactiveFileBytes: number | null;
   /** Slab memory the kernel can reclaim under pressure (dentries, inodes). */
   slabReclaimableBytes: number | null;
   /** Slab memory pinned until explicitly freed. */
@@ -172,6 +174,7 @@ export function parseMemoryStat(raw: string): ContainerMemoryStat {
   return {
     anonBytes,
     fileBytes,
+    inactiveFileBytes: counts.inactive_file ?? null,
     kernelBytes: counts.kernel ?? null,
     slabReclaimableBytes,
     slabUnreclaimableBytes,