@vellumai/assistant 0.11.7 → 0.11.8-staging.1

package/src/tools/credentials/metadata-store.ts

@@ -1,16 +1,19 @@
 /**
  * Credential metadata store.
  *
- * Reads stay on the workspace `metadata.json` file (sync). When a CES
- * record backend is injected, upserts and deletes also write-through to
- * CES so the CES catalog stays current.
+ * Production: CES owns identity + policy records. This module keeps a
+ * synchronous in-process cache so existing call sites stay sync, and
+ * write-throughs to CES when a record backend is injected.
+ *
+ * The cache is filled lazily: the first catalog read or write starts a
+ * single-flight CES `list()`. Leftover workspace `metadata.json` is not
+ * read. CES import (003) may leave that file in place; this module
+ * ignores it.
  *
  * Tests: `_setMetadataPath` keeps the file-backed store and skips CES
- * write-through.
+ * load and write-through.
  */
 
-import { join } from "node:path";
-
 import {
   credentialKey,
   StaticCredentialMetadataStore,
@@ -19,7 +22,6 @@ import type { CredentialRecord } from "@vellumai/service-contracts/credential-rp
 
 import type { CredentialRecordBackend } from "../../security/ces-rpc-record-backend.js";
 import { getLogger } from "../../util/logger.js";
-import { getDataDir } from "../../util/platform.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
 
 const log = getLogger("credential-metadata-store");
@@ -48,15 +50,23 @@ export interface CredentialMetadata {
 // Singleton store instance
 // ---------------------------------------------------------------------------
 
+const CES_MEMORY_PATH = "ces-in-memory-credential-metadata";
+
 let _store: StaticCredentialMetadataStore | undefined;
 let _overridePath: string | null = null;
 let _recordBackend: CredentialRecordBackend | undefined;
+let _cesRecordsLoaded = false;
+let _cesLoad: Promise<void> | undefined;
+let _cesLoadGeneration = 0;
 
 function getStore(): StaticCredentialMetadataStore {
   if (!_store) {
-    const path =
-      _overridePath ?? join(getDataDir(), "credentials", "metadata.json");
-    _store = new StaticCredentialMetadataStore(path);
+    if (_overridePath) {
+      _store = new StaticCredentialMetadataStore(_overridePath);
+    } else {
+      _store = new StaticCredentialMetadataStore(CES_MEMORY_PATH);
+      _store.useMemory([]);
+    }
   }
   return _store;
 }
@@ -76,7 +86,15 @@ function toRecord(metadata: CredentialMetadata): CredentialRecord {
   };
 }
 
-async function persistRecord(metadata: CredentialMetadata): Promise<void> {
+function resetCesLoad(): void {
+  _cesRecordsLoaded = false;
+  _cesLoad = undefined;
+  _cesLoadGeneration += 1;
+}
+
+async function persistCredentialMetadata(
+  metadata: CredentialMetadata,
+): Promise<void> {
   if (!_recordBackend || _overridePath) {
     return;
   }
@@ -90,17 +108,81 @@ async function persistRecord(metadata: CredentialMetadata): Promise<void> {
   }
 }
 
-/** Await CES write-through for a record already in the local file store. */
-export async function persistCredentialMetadata(
-  metadata: CredentialMetadata,
-): Promise<void> {
-  await persistRecord(metadata);
-}
-
 export function setCredentialRecordBackend(
   backend: CredentialRecordBackend | undefined,
 ): void {
   _recordBackend = backend;
+  resetCesLoad();
+}
+
+function ensureCesRecordsLoaded(): Promise<void> {
+  if (_overridePath || !_recordBackend || _cesRecordsLoaded) {
+    return Promise.resolve();
+  }
+  if (_cesLoad) {
+    return _cesLoad;
+  }
+  const generation = _cesLoadGeneration;
+  _cesLoad = loadCesRecords(generation).finally(() => {
+    if (_cesLoadGeneration === generation) {
+      _cesLoad = undefined;
+    }
+  });
+  return _cesLoad;
+}
+
+async function loadCesRecords(generation: number): Promise<void> {
+  try {
+    if (!_recordBackend || _overridePath || generation !== _cesLoadGeneration) {
+      return;
+    }
+    let available = false;
+    try {
+      available = _recordBackend.isAvailable();
+    } catch {
+      available = false;
+    }
+    if (!available) {
+      log.warn("CES record backend unavailable; keeping in-process cache");
+      return;
+    }
+
+    const remote = await _recordBackend.list();
+    if (generation !== _cesLoadGeneration) {
+      return;
+    }
+    if (remote === null) {
+      log.warn("CES record list failed; keeping in-process cache");
+      return;
+    }
+
+    const store = getStore();
+    const localByAccount = new Map(
+      store
+        .list()
+        .map((record) => [credentialKey(record.service, record.field), record]),
+    );
+    const merged = remote.map((entry) => {
+      const local = localByAccount.get(entry.account);
+      if (local) {
+        localByAccount.delete(entry.account);
+        return local;
+      }
+      return entry.record;
+    });
+    for (const leftover of localByAccount.values()) {
+      merged.push(leftover);
+    }
+    store.useMemory(merged);
+    _cesRecordsLoaded = true;
+    log.info({ count: remote.length }, "Loaded credential records from CES");
+  } catch (err) {
+    log.warn({ err }, "CES record load failed");
+  }
+}
+
+function touchCesCache(): void {
+  void ensureCesRecordsLoaded();
 }
 
 // ---------------------------------------------------------------------------
@@ -113,12 +195,15 @@ export function setCredentialRecordBackend(
  * so the operation fails cleanly before any side effects.
  */
 export function assertMetadataWritable(): void {
+  touchCesCache();
   getStore().assertWritable();
 }
 
 /**
  * Create or update a credential metadata record.
  * If a record with the same service+field exists, it is updated.
+ * When a CES record backend is attached, the upsert also write-throughs
+ * to CES.
  */
 export function upsertCredentialMetadata(
   service: string,
@@ -133,8 +218,9 @@ export function upsertCredentialMetadata(
     injectionTemplates?: CredentialInjectionTemplate[] | null;
   },
 ): CredentialMetadata {
+  touchCesCache();
   const record = getStore().upsert(service, field, policy) as CredentialMetadata;
-  void persistRecord(record);
+  void persistCredentialMetadata(record);
   return record;
 }
 
@@ -145,6 +231,7 @@ export function getCredentialMetadata(
   service: string,
   field: string,
 ): CredentialMetadata | undefined {
+  touchCesCache();
   return getStore().getByServiceField(service, field) as
     | CredentialMetadata
     | undefined;
@@ -156,6 +243,7 @@ export function getCredentialMetadata(
 export function getCredentialMetadataById(
   credentialId: string,
 ): CredentialMetadata | undefined {
+  touchCesCache();
   return getStore().getById(credentialId) as CredentialMetadata | undefined;
 }
 
@@ -163,6 +251,7 @@ export function getCredentialMetadataById(
  * List all credential metadata records.
  */
 export function listCredentialMetadata(): CredentialMetadata[] {
+  touchCesCache();
   return getStore().list() as CredentialMetadata[];
 }
 
@@ -173,6 +262,7 @@ export function deleteCredentialMetadata(
   service: string,
   field: string,
 ): boolean {
+  touchCesCache();
   const deleted = getStore().delete(service, field);
   if (deleted && _recordBackend && !_overridePath) {
     void _recordBackend.delete(credentialKey(service, field));
@@ -180,9 +270,15 @@ export function deleteCredentialMetadata(
   return deleted;
 }
 
+/** @internal Test-only: wait for the in-flight CES list to populate the cache. */
+export function _ensureCesRecordsLoaded(): Promise<void> {
+  return ensureCesRecordsLoaded();
+}
+
 /** @internal Test-only: override the metadata file path. */
 export function _setMetadataPath(path: string | null): void {
   _overridePath = path;
+  resetCesLoad();
   if (_store) {
     if (path) {
       _store.setPath(path);

package/src/tools/credentials/store.ts

@@ -37,7 +37,6 @@ import {
 import { getLogger } from "../../util/logger.js";
 import {
   assertMetadataWritable,
-  persistCredentialMetadata,
   upsertCredentialMetadata,
 } from "./metadata-store.js";
 import type { CredentialInjectionTemplate } from "./policy-types.js";
@@ -162,7 +161,6 @@ export async function storeCredentialValue(
     allowedDomains: input.allowedDomains,
     injectionTemplates: input.injectionTemplates,
   });
-  await persistCredentialMetadata(metadata);
   const { syncManualTokenConnection } =
     await import("../../oauth/manual-token-connection.js");
   await syncManualTokenConnection(service);

package/src/tools/filesystem/read.ts

@@ -45,7 +45,7 @@ export const fileReadInputSchema = z.looseObject({
   max_chars: z
     .number()
     .describe(
-      "Maximum number of characters to read. Defaults to 20000, which is also the ceiling. Text files only.",
+      "Maximum number of characters to read. Defaults to 100000, which is also the ceiling. Text files only.",
     )
     .optional()
     .catch(undefined),
@@ -61,7 +61,7 @@ export const fileReadInputSchema = z.looseObject({
 export const fileReadTool = {
   name: "file_read",
   description:
-    "Read the contents of a file on your own machine. Text reads return the first 20000 characters unless you pass `max_chars`; when a read stops short the result says so, and `start_index` pages on from there. To find where something is in a large file, code_search is cheaper than paging through it. For image files (JPEG, PNG, GIF, WebP), returns the image for visual analysis. For audio files (MP3, WAV, OGG, FLAC, AAC, M4A), returns the audio for listening. Use host_file_read for files on your guardian's device instead.",
+    "Read the contents of a file on your own machine. Text reads return the first 100000 characters unless you pass `max_chars`; when a read stops short the result says so, and `start_index` pages on from there. To find where something is in a large file, code_search is cheaper than paging through it. For image files (JPEG, PNG, GIF, WebP), returns the image for visual analysis. For audio files (MP3, WAV, OGG, FLAC, AAC, M4A), returns the audio for listening. Use host_file_read for files on your guardian's device instead.",
   category: "filesystem",
   executionTarget: "sandbox",
   defaultRiskLevel: RiskLevel.Low,

package/src/tools/host-filesystem/read.ts

@@ -53,7 +53,7 @@ export const hostFileReadInputSchema = z.looseObject({
   max_chars: z
     .number()
     .describe(
-      "Maximum number of characters to read. Defaults to 20000, which is also the ceiling. Text files only.",
+      "Maximum number of characters to read. Defaults to 100000, which is also the ceiling. Text files only.",
     )
     .optional()
     .catch(undefined),
@@ -69,7 +69,7 @@ export const hostFileReadInputSchema = z.looseObject({
 export const hostFileReadTool = {
   name: "host_file_read",
   description:
-    "Read the contents of a file on your guardian's device, including images (JPEG, PNG, GIF, WebP) and audio (MP3, WAV, OGG, FLAC, AAC, M4A). Text reads return the first 20000 characters unless you pass `max_chars`; when a read stops short the result says so, and `start_index` pages on from there. For files on your own machine, use file_read instead.",
+    "Read the contents of a file on your guardian's device, including images (JPEG, PNG, GIF, WebP) and audio (MP3, WAV, OGG, FLAC, AAC, M4A). Text reads return the first 100000 characters unless you pass `max_chars`; when a read stops short the result says so, and `start_index` pages on from there. For files on your own machine, use file_read instead.",
   category: "host-filesystem",
   executionTarget: "host",
   defaultRiskLevel: RiskLevel.Medium,

package/src/tools/host-terminal/host-shell.test.ts

@@ -104,6 +104,10 @@ mock.module("../../daemon/host-bash-proxy.js", () => ({
 // Import under test — MUST come after mock.module calls.
 // ---------------------------------------------------------------------------
 
+import {
+  MAX_OUTPUT_LENGTH,
+  OUTPUT_TRUNCATED_TAG,
+} from "../shared/shell-output.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 import { hostShellTool } from "./host-shell.js";
 
@@ -362,4 +366,24 @@ describe("host_bash background lifecycle events — direct spawn path", () => {
     expect(completed[0]!.output).toContain("cancelled");
     expect(completed[0]!.output).not.toContain("failed");
   });
+
+  test("drops stdout past the cap without a recovery file", async () => {
+    await hostShellTool.execute(
+      { command: "yes", background: true },
+      makeContext(),
+    );
+
+    latestChild!.stdout.emit("data", Buffer.alloc(80_000, 0x78));
+    latestChild!.stdout.emit("data", Buffer.alloc(80_000, 0x79));
+    latestChild!.emit("close", 0);
+    await flush();
+
+    const completed = completedEvents();
+    expect(completed).toHaveLength(1);
+    const output = String(completed[0]!.output);
+    expect(output).toContain(OUTPUT_TRUNCATED_TAG);
+    expect(output).not.toContain("file=");
+    expect(output.length).toBeLessThan(MAX_OUTPUT_LENGTH + 80);
+    expect(output).not.toContain("y");
+  });
 });

package/src/tools/host-terminal/host-shell.ts

@@ -40,7 +40,7 @@ import {
   removeBackgroundTool,
 } from "../background-tool-registry.js";
 import {
-  formatShellOutput,
+  attachBoundedStdio,
   MAX_OUTPUT_LENGTH,
 } from "../shared/shell-output.js";
 import {
@@ -336,7 +336,7 @@ export const hostShellTool = {
               untrustedOutput: {
                 content: output || "(no output)",
                 source: "tool_result",
-                // Preserve formatShellOutput's recovery marker (see shell.ts).
+                // Bounded output plus the truncation marker (see shell.ts).
                 maxChars: MAX_OUTPUT_LENGTH * 2,
               },
             });
@@ -472,10 +472,10 @@ export const hostShellTool = {
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
         detached: true,
+        windowsHide: true,
       });
 
-      const stdoutChunks: Buffer[] = [];
-      const stderrChunks: Buffer[] = [];
+      const collector = attachBoundedStdio(child);
       let timedOut = false;
       // Set when cancelled via the registry's cancel callback so the completion
       // event reports "cancelled" rather than "failed".
@@ -488,9 +488,6 @@ export const hostShellTool = {
         killTree();
       }, timeoutMs);
 
-      child.stdout.on("data", (data: Buffer) => stdoutChunks.push(data));
-      child.stderr.on("data", (data: Buffer) => stderrChunks.push(data));
-
       // Guard against double-wake: when spawn fails (e.g. invalid cwd),
       // Node emits both 'error' and 'close' for the same child process.
       // Only the first handler to fire should wake the agent.
@@ -502,15 +499,7 @@ export const hostShellTool = {
         }
         completed = true;
         clearTimeout(timer);
-        const stdout = Buffer.concat(stdoutChunks).toString();
-        const stderr = Buffer.concat(stderrChunks).toString();
-        const result = formatShellOutput(
-          stdout,
-          stderr,
-          code,
-          timedOut,
-          timeoutSec,
-        );
+        const result = collector.format(code, timedOut, timeoutSec);
         // Cancel takes precedence over the SIGKILL-induced error result.
         const status = aborted
           ? "cancelled"
@@ -563,7 +552,7 @@ export const hostShellTool = {
           untrustedOutput: {
             content: output || "(no output)",
             source: "tool_result",
-            // Preserve formatShellOutput's recovery marker (see shell.ts).
+            // Bounded output plus the truncation marker (see shell.ts).
             maxChars: MAX_OUTPUT_LENGTH * 2,
           },
         });
@@ -649,8 +638,6 @@ export const hostShellTool = {
     }
 
     return new Promise<ToolExecutionResult>((resolve) => {
-      const stdoutChunks: Buffer[] = [];
-      const stderrChunks: Buffer[] = [];
       let timedOut = false;
 
       const wrapped = buildShellInvocation(command);
@@ -659,6 +646,10 @@ export const hostShellTool = {
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
         detached: true,
+        windowsHide: true,
+      });
+      const collector = attachBoundedStdio(child, {
+        onOutput: context.onOutput,
       });
 
       const killTree = () => terminateProcessTree(child);
@@ -678,29 +669,11 @@ export const hostShellTool = {
         }
       }
 
-      child.stdout.on("data", (data: Buffer) => {
-        stdoutChunks.push(data);
-        context.onOutput?.(data.toString());
-      });
-
-      child.stderr.on("data", (data: Buffer) => {
-        stderrChunks.push(data);
-        context.onOutput?.(data.toString());
-      });
-
       child.on("close", (code) => {
         clearTimeout(timer);
         context.signal?.removeEventListener("abort", onAbort);
 
-        const stdout = Buffer.concat(stdoutChunks).toString();
-        const stderr = Buffer.concat(stderrChunks).toString();
-        const result = formatShellOutput(
-          stdout,
-          stderr,
-          code,
-          timedOut,
-          timeoutSec,
-        );
+        const result = collector.format(code, timedOut, timeoutSec);
 
         resolve({
           content: result.content,

package/src/tools/shared/filesystem/file-ops-service.ts

@@ -78,12 +78,15 @@ function pathError(
 }
 
 /**
- * Characters returned by a read that names no `max_chars`. Stays under
- * `THRESHOLD_CHARS` in `context/post-turn-tool-result-truncation.ts`, which
- * spools any larger tool result to disk and replaces it inline with a short
- * stub, so a default read returns content rather than a stub.
+ * Characters returned by a read that names no `max_chars`, and the ceiling for
+ * one that does. File reads are exempt from the result-time spool pass
+ * (`RESULT_TIME_SPOOL_EXEMPT_TOOLS` in `context/tool-result-spool.ts`), so the
+ * full window reaches the model for the turn that read it; the post-turn pass
+ * compacts oversized results to recoverable stubs at turn end, and the
+ * `tool-result-truncate` plugin bounds any single result against the model's
+ * context window.
  */
-export const READ_CHAR_BUDGET = 20_000;
+export const READ_CHAR_BUDGET = 100_000;
 
 /**
  * Trailing marker appended when a read stops short of the end of the file. A
@@ -169,8 +172,8 @@ export class FileSystemOps {
     try {
       const raw = await readFile(filePath, "utf-8");
 
-      // A ceiling, not just a default: a larger window would be spooled to
-      // disk and replaced with a stub, returning less than this.
+      // A ceiling, not just a default: an uncapped `max_chars` would put an
+      // arbitrarily large file inline in a single result.
       const maxChars = Math.min(
         READ_CHAR_BUDGET,
         Math.max(0, input.maxChars ?? READ_CHAR_BUDGET),

package/src/tools/shared/shell-output.test.ts

@@ -0,0 +1,104 @@
+import { EventEmitter } from "node:events";
+import { describe, expect, test } from "bun:test";
+
+import {
+  attachBoundedStdio,
+  BoundedStdioCollector,
+  formatShellOutput,
+  MAX_OUTPUT_LENGTH,
+  OUTPUT_TRUNCATED_TAG,
+} from "./shell-output.js";
+
+describe("BoundedStdioCollector", () => {
+  test("keeps output under the cap", () => {
+    const collector = new BoundedStdioCollector();
+    collector.consume("stdout", Buffer.from("hello"));
+    const result = collector.format(0, false, 120);
+    expect(result.content).toBe("hello");
+    expect(collector.didTruncate).toBe(false);
+    expect(collector.keptByteLength).toBe(5);
+  });
+
+  test("caps a single oversized chunk without retaining the tail", () => {
+    const collector = new BoundedStdioCollector();
+    const huge = Buffer.alloc(MAX_OUTPUT_LENGTH + 50_000, 0x78);
+    collector.consume("stdout", huge);
+    huge.fill(0x79);
+    expect(collector.keptByteLength).toBe(MAX_OUTPUT_LENGTH);
+    expect(collector.didTruncate).toBe(true);
+    const result = collector.format(0, false, 120);
+    expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
+    expect(result.content).not.toContain("file=");
+    expect(result.content.startsWith("x".repeat(MAX_OUTPUT_LENGTH))).toBe(true);
+    expect(result.content.length).toBeLessThan(MAX_OUTPUT_LENGTH + 80);
+  });
+
+  test("shares the budget across stdout and stderr", () => {
+    const collector = new BoundedStdioCollector();
+    collector.consume("stdout", Buffer.alloc(MAX_OUTPUT_LENGTH - 10, 0x61));
+    collector.consume("stderr", Buffer.alloc(100, 0x62));
+    expect(collector.keptByteLength).toBe(MAX_OUTPUT_LENGTH);
+    expect(collector.didTruncate).toBe(true);
+    const result = collector.format(0, false, 120);
+    expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
+    expect(result.content.includes("b")).toBe(true);
+  });
+
+  test("ignores chunks after the cap", () => {
+    const collector = new BoundedStdioCollector();
+    collector.consume("stdout", Buffer.alloc(MAX_OUTPUT_LENGTH, 0x78));
+    const afterCap = collector.keptByteLength;
+    collector.consume("stdout", Buffer.alloc(10_000, 0x79));
+    collector.consume("stderr", Buffer.alloc(10_000, 0x7a));
+    expect(collector.keptByteLength).toBe(afterCap);
+    const result = collector.format(0, false, 120);
+    expect(result.content).not.toContain("y");
+    expect(result.content).not.toContain("z");
+  });
+
+  test("does not call onOutput for discarded bytes", () => {
+    const seen: string[] = [];
+    const collector = new BoundedStdioCollector();
+    collector.consume("stdout", Buffer.from("abc"), (text) => seen.push(text));
+    collector.consume("stdout", Buffer.alloc(MAX_OUTPUT_LENGTH, 0x78), (text) =>
+      seen.push(text),
+    );
+    collector.consume("stdout", Buffer.from("TAIL"), (text) => seen.push(text));
+    const forwarded = seen.join("");
+    expect(forwarded).not.toContain("TAIL");
+    expect(Buffer.byteLength(forwarded)).toBe(MAX_OUTPUT_LENGTH);
+  });
+});
+
+describe("attachBoundedStdio", () => {
+  test("drains further data events after the cap without growing kept bytes", () => {
+    const child = {
+      stdout: new EventEmitter(),
+      stderr: new EventEmitter(),
+    };
+    const collector = attachBoundedStdio(child);
+    child.stdout.emit("data", Buffer.alloc(MAX_OUTPUT_LENGTH + 1000, 0x78));
+    child.stdout.emit("data", Buffer.alloc(20_000, 0x79));
+    child.stderr.emit("data", Buffer.alloc(20_000, 0x7a));
+    expect(collector.keptByteLength).toBe(MAX_OUTPUT_LENGTH);
+    expect(collector.didTruncate).toBe(true);
+  });
+});
+
+describe("formatShellOutput truncation", () => {
+  test("truncates an already-materialized oversized string without a file path", () => {
+    const longOutput = "x".repeat(30_000);
+    const result = formatShellOutput(longOutput, "", 0, false, 120);
+    expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
+    expect(result.content).not.toContain("file=");
+    expect(result.content.length).toBeLessThan(MAX_OUTPUT_LENGTH + 80);
+  });
+
+  test("honors an explicit truncated flag at the exact cap", () => {
+    const exact = "x".repeat(MAX_OUTPUT_LENGTH);
+    const result = formatShellOutput(exact, "", 0, false, 120, {
+      truncated: true,
+    });
+    expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
+  });
+});