@vellumai/assistant 0.11.8-dev.202609022016.7bd8f87 → 0.11.8-dev.202609030046.e26b25a

package/Dockerfile

@@ -186,53 +186,11 @@ RUN printf '%s\n' \
     >> /home/assistant/.bashrc && \
     chown assistant:assistant /home/assistant/.bashrc
 
-RUN printf '%s\n' \
-    '#!/usr/bin/env sh' \
-    'set -eu' \
-    '. /app/assistant/docker-kata-runtime-family.sh' \
-    'if ! vellum_is_kata_family_runtime; then' \
-    '  exec /usr/bin/apt-get "$@"' \
-    'fi' \
-    'export DEBIAN_FRONTEND=noninteractive' \
-    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
-    '/app/assistant/docker-init-apt-root.sh' \
-    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt-get" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
-    '  exec chroot "${DATA_ROOT}" /usr/bin/apt-get "$@"' \
-    'fi' \
-    'exec /usr/bin/apt-get "$@"' \
-    > /usr/local/bin/apt-get && \
-    chmod +x /usr/local/bin/apt-get && \
-    printf '%s\n' \
-    '#!/usr/bin/env sh' \
-    'set -eu' \
-    '. /app/assistant/docker-kata-runtime-family.sh' \
-    'if ! vellum_is_kata_family_runtime; then' \
-    '  exec /usr/bin/apt "$@"' \
-    'fi' \
-    'export DEBIAN_FRONTEND=noninteractive' \
-    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
-    '/app/assistant/docker-init-apt-root.sh' \
-    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
-    '  exec chroot "${DATA_ROOT}" /usr/bin/apt "$@"' \
-    'fi' \
-    'exec /usr/bin/apt "$@"' \
-    > /usr/local/bin/apt && \
-    chmod +x /usr/local/bin/apt && \
-    printf '%s\n' \
-    '#!/usr/bin/env sh' \
-    'set -eu' \
-    '. /app/assistant/docker-kata-runtime-family.sh' \
-    'if ! vellum_is_kata_family_runtime; then' \
-    '  exec /usr/bin/dpkg "$@"' \
-    'fi' \
-    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
-    '/app/assistant/docker-init-apt-root.sh' \
-    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/dpkg" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
-    '  exec chroot "${DATA_ROOT}" /usr/bin/dpkg "$@"' \
-    'fi' \
-    'exec /usr/bin/dpkg "$@"' \
-    > /usr/local/bin/dpkg && \
-    chmod +x /usr/local/bin/dpkg
+# apt/apt-get/dpkg must persist like pip: on Kata-family runtimes the wrapper
+# routes package operations into the persistent apt chroot.
+RUN ln -s /app/assistant/docker-kata-apt-wrapper.sh /usr/local/bin/apt-get && \
+    ln -s /app/assistant/docker-kata-apt-wrapper.sh /usr/local/bin/apt && \
+    ln -s /app/assistant/docker-kata-apt-wrapper.sh /usr/local/bin/dpkg
 
 # pip must persist like apt: on Kata-family runtimes the wrapper routes root
 # installs into the persistent apt chroot.
@@ -274,8 +232,10 @@ RUN chmod +x \
     /app/assistant/docker-entrypoint.sh \
     /app/assistant/docker-init-apt-root.sh \
     /app/assistant/docker-kata-apt-env.sh \
+    /app/assistant/docker-kata-apt-shims.sh \
+    /app/assistant/docker-kata-apt-wrapper.sh \
+    /app/assistant/docker-kata-chroot-exec.sh \
     /app/assistant/docker-kata-pip.sh \
-    /app/assistant/docker-kata-pip-chroot.sh \
     /app/assistant/docker-kata-runtime-family.sh \
     /usr/local/bin/vellum-block-volume-common.sh \
     /usr/local/bin/vellum-block-volume-init.sh \

package/docker-entrypoint.sh

@@ -11,7 +11,11 @@ KATA_APT_INIT_PID=""
 if vellum_is_kata_family_runtime && [ -x /app/assistant/docker-init-apt-root.sh ]; then
   export VELLUM_APT_DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"
   # Warm the chroot used by Kata-family apt wrappers without blocking assistant readiness.
-  /app/assistant/docker-init-apt-root.sh &
+  (
+    /app/assistant/docker-init-apt-root.sh
+    # Refresh persisted wrapper-script shims before commands use the overlay.
+    /app/assistant/docker-kata-apt-shims.sh || true
+  ) &
   KATA_APT_INIT_PID="$!"
 fi
 

package/docker-kata-apt-env.sh

@@ -36,6 +36,9 @@ _vellum_kata_prepend_library_path() {
   esac
 }
 
+# Shims for chroot wrapper scripts with hardcoded absolute paths must shadow
+# the broken originals in the chroot bin dirs below (docker-kata-apt-shims.sh).
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/.host-shims"
 _vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/bin"
 _vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/local/sbin"
 _vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/local/bin"

package/docker-kata-apt-shims.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env sh
+# Regenerates host-side shims for chroot-installed commands whose bin entry
+# is a pure trampoline script exec'ing a hardcoded absolute path (Debian
+# 7zip's /usr/bin/7z execs /usr/lib/7zip/7z, for example). Those targets only
+# exist inside the chroot, so running the wrapper through the host PATH
+# overlay fails; each shim execs the chroot-prefixed target instead.
+# docker-kata-apt-env.sh and buildSanitizedEnv put the shim dir on PATH ahead
+# of the chroot bin dirs so shims shadow the broken wrappers.
+set -eu
+
+DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"
+SHIM_DIR="${DATA_ROOT}/.host-shims"
+MARKER="# vellum-apt-shim:"
+# dpkg-managed dirs that can hold trampolines (Debian policy keeps packages
+# out of /usr/local; /bin and /sbin are usrmerge symlinks into these).
+SCAN_DIRS="usr/bin usr/sbin usr/games"
+# Every overlay bin dir in PATH priority order (usrmerge collapses bin/sbin
+# into their usr counterparts): precedence must also see the /usr/local dirs
+# that chroot pip installs populate, so a dpkg trampoline never shims over a
+# higher-priority local command.
+PRIORITY_DIRS="usr/bin usr/local/sbin usr/local/bin usr/sbin usr/games"
+
+[ -d "${DATA_ROOT}/usr/bin" ] || exit 0
+mkdir -p "${SHIM_DIR}"
+
+# Scanning the bin dirs forks a few processes per file; skip it when the
+# overlay state is unchanged (read-only invocations like `apt list` or
+# `dpkg -l`). The stamp covers command names, links, effective modes, and small
+# executable contents so reinstalls and pip changes invalidate stale shims.
+STAMP_FILE="${SHIM_DIR}/.overlay-stamp"
+STAMP="$(
+  {
+    md5sum "${DATA_ROOT}/var/lib/dpkg/status" 2>/dev/null
+    for d in ${PRIORITY_DIRS}; do
+      printf '%s\0' "${d}"
+      find "${DATA_ROOT}/${d}" -mindepth 1 -maxdepth 1 -printf '%P %y %m %l\0' 2>/dev/null | sort -z
+      find -L "${DATA_ROOT}/${d}" -mindepth 1 -maxdepth 1 -printf '%P %y %m\0' 2>/dev/null | sort -z
+    done
+    for d in ${SCAN_DIRS}; do
+      find -L "${DATA_ROOT}/${d}" -mindepth 1 -maxdepth 1 -type f -size -513c -perm /111 -print0 2>/dev/null |
+        sort -z |
+        xargs -0 -r md5sum -z
+    done
+  } | md5sum | cut -d' ' -f1
+)"
+if [ "${STAMP}" = "$(cat "${STAMP_FILE}" 2>/dev/null || true)" ]; then
+  exit 0
+fi
+
+# Prints the target of a pure trampoline: a tiny script whose body is nothing
+# but the shebang, comments, blank lines, and a single `exec /abs/path "$@"`
+# line. Wrappers that do anything else (export env vars, cd, pass extra
+# flags) print nothing: a direct-exec shim would bypass that setup.
+wrapper_target() {
+  [ -f "$1" ] && [ -x "$1" ] || return 0
+  [ "$(wc -c <"$1")" -le 512 ] || return 0
+  case "$(head -c 2 "$1" 2>/dev/null)" in
+    '#!') ;;
+    *) return 0 ;;
+  esac
+  body="$(sed -e '1d' -e '/^[[:space:]]*#/d' -e '/^[[:space:]]*$/d' "$1")"
+  [ -n "${body}" ] || return 0
+  [ "$(printf '%s' "${body}" | wc -l)" -eq 0 ] || return 0
+  printf '%s\n' "${body}" | sed -n 's/^[[:space:]]*exec[[:space:]][[:space:]]*\(\/[^"[:space:]][^"[:space:]]*\)[[:space:]][[:space:]]*"\$@"[[:space:]]*$/\1/p'
+}
+
+# Highest-priority overlay dir that holds an entry for this shim name.
+shim_source() {
+  for d in ${PRIORITY_DIRS}; do
+    candidate="${DATA_ROOT}/${d}/$1"
+    if [ -f "${candidate}" ] && [ -x "${candidate}" ]; then
+      printf '%s\n' "${candidate}"
+      return 0
+    fi
+  done
+}
+
+generation_failed=0
+for d in ${SCAN_DIRS}; do
+  for bin in "${DATA_ROOT}/${d}/"*; do
+    # Shims outrank every chroot bin dir on PATH, so only the
+    # highest-priority entry for a name may produce one: a trampoline in a
+    # lower dir must not shadow a real command above it.
+    [ "$(shim_source "${bin##*/}")" = "${bin}" ] || continue
+    target="$(wrapper_target "${bin}")"
+    [ -n "${target}" ] || continue
+    # Only shim when the hardcoded path is broken on the host but real in
+    # the chroot.
+    if [ -e "${target}" ] || [ ! -x "${DATA_ROOT}${target}" ]; then
+      continue
+    fi
+    shim="${SHIM_DIR}/${bin##*/}"
+    if ! tmp="$(mktemp "${SHIM_DIR}/.shim.XXXXXX")"; then
+      generation_failed=1
+      continue
+    fi
+    if printf '%s\n' \
+      '#!/bin/sh' \
+      "${MARKER} ${target}" \
+      "exec \"${DATA_ROOT}${target}\" \"\$@\"" \
+      >"${tmp}" &&
+      chmod 0755 "${tmp}" &&
+      mv -f "${tmp}" "${shim}"; then
+      :
+    else
+      rm -f "${tmp}"
+      generation_failed=1
+    fi
+  done
+done
+
+if [ "${generation_failed}" -ne 0 ]; then
+  exit 1
+fi
+
+# Drop shims that remain stale after desired replacements are installed.
+for shim in "${SHIM_DIR}"/*; do
+  [ -f "${shim}" ] || continue
+  grep -qs "^${MARKER}" "${shim}" || continue
+  target="$(sed -n "s|^${MARKER} ||p" "${shim}" | sed -n '1p')"
+  src="$(shim_source "$(basename "${shim}")")"
+  if [ -z "${target}" ] || [ -z "${src}" ] || [ ! -x "${DATA_ROOT}${target}" ] || [ "$(wrapper_target "${src}")" != "${target}" ]; then
+    rm -f "${shim}"
+  fi
+done
+
+printf '%s\n' "${STAMP}" >"${STAMP_FILE}"

package/docker-kata-apt-wrapper.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+# apt/apt-get/dpkg wrapper (symlinked from /usr/local/bin). On Kata-family
+# runtimes, package operations are routed into the persistent apt chroot so
+# they survive machine saves; the image rootfs is discarded on every save.
+# The chroot runs through docker-kata-chroot-exec.sh in a private mount
+# namespace with /dev, /dev/pts and /proc available, so apt can allocate a
+# pty for term.log and maintainer scripts see a normal system.
+set -eu
+
+TOOL_NAME="$(basename "$0")"
+case "${TOOL_NAME}" in
+  apt | apt-get | dpkg) ;;
+  *) TOOL_NAME="apt-get" ;;
+esac
+
+. /app/assistant/docker-kata-runtime-family.sh
+
+if ! vellum_is_kata_family_runtime; then
+  exec "/usr/bin/${TOOL_NAME}" "$@"
+fi
+
+if [ "${TOOL_NAME}" != "dpkg" ]; then
+  export DEBIAN_FRONTEND=noninteractive
+fi
+DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"
+
+/app/assistant/docker-init-apt-root.sh
+if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/${TOOL_NAME}" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then
+  rc=0
+  # Platform kata pods are privileged inside their per-assistant VM, so
+  # unshare -m works there; if this environment can't create a mount
+  # namespace, fall back to a bare chroot: installs still persist, but with
+  # no /dev/pts or /proc apt logs a pty warning and the caller's cwd is not
+  # restored.
+  if unshare -m true 2>/dev/null; then
+    unshare -m /app/assistant/docker-kata-chroot-exec.sh "${DATA_ROOT}" "${PWD}" "/usr/bin/${TOOL_NAME}" "$@" || rc=$?
+  else
+    chroot "${DATA_ROOT}" "/usr/bin/${TOOL_NAME}" "$@" || rc=$?
+  fi
+  # Packages can install wrapper scripts that hardcode absolute paths which
+  # only resolve inside the chroot; refresh host-side shims for those.
+  /app/assistant/docker-kata-apt-shims.sh || true
+  exit "${rc}"
+fi
+exec "/usr/bin/${TOOL_NAME}" "$@"

package/docker-kata-chroot-exec.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env sh
+# Runs a command inside the persistent apt chroot. Must be invoked under
+# `unshare -m` (see docker-kata-pip.sh and docker-kata-apt-wrapper.sh): the
+# bind mounts below live in a private mount namespace so they disappear with
+# the process and are never visible to other processes; a lingering /data
+# bind inside the chroot would create a path cycle (/data/system/data/system/...)
+# for anything walking /data.
+set -eu
+
+DATA_ROOT="$1"
+CALLER_CWD="$2"
+shift 2
+
+for dir in /workspace /data /tmp /var/tmp; do
+  [ -d "${dir}" ] || continue
+  mkdir -p "${DATA_ROOT}${dir}"
+  mount --bind "${dir}" "${DATA_ROOT}${dir}" 2>/dev/null || true
+done
+
+# /proc and /dev make the chroot behave like a normal system: apt needs a pty
+# (posix_openpt via /dev/ptmx) to write /var/log/apt/term.log, and package
+# maintainer scripts routinely read /proc. The recursive /dev bind carries the
+# container's /dev/pts along; the devpts mount is a fallback for environments
+# where it did not produce one.
+mkdir -p "${DATA_ROOT}/proc" "${DATA_ROOT}/dev"
+mount --bind /proc "${DATA_ROOT}/proc" 2>/dev/null || true
+mount --rbind /dev "${DATA_ROOT}/dev" 2>/dev/null || true
+if [ ! -e "${DATA_ROOT}/dev/pts/ptmx" ]; then
+  mkdir -p "${DATA_ROOT}/dev/pts" 2>/dev/null || true
+  mount -t devpts -o gid=5,mode=620,ptmxmode=666 devpts "${DATA_ROOT}/dev/pts" 2>/dev/null || true
+fi
+
+# chroot(1) always chdirs to /; restore the caller's cwd when it exists inside
+# the chroot so relative paths keep working.
+exec chroot "${DATA_ROOT}" /bin/sh -c 'cd "$1" 2>/dev/null || cd /; shift; exec "$@"' sh "${CALLER_CWD}" "$@"

package/docker-kata-pip.sh

@@ -38,10 +38,16 @@ if [ "$(id -u)" = "0" ]; then
       # unshare -m works there; if this environment can't create a mount
       # namespace, fall back to a bare chroot — index installs still persist,
       # only caller-path installs lose visibility.
+      rc=0
       if unshare -m true 2>/dev/null; then
-        exec unshare -m /app/assistant/docker-kata-pip-chroot.sh "${DATA_ROOT}" "${PWD}" "/usr/bin/${PIP_NAME}" "$@"
+        unshare -m /app/assistant/docker-kata-chroot-exec.sh "${DATA_ROOT}" "${PWD}" "/usr/bin/${PIP_NAME}" "$@" || rc=$?
+      else
+        chroot "${DATA_ROOT}" /bin/sh -c 'cd "$1" 2>/dev/null || cd /; shift; exec "$@"' sh "${PWD}" "/usr/bin/${PIP_NAME}" "$@" || rc=$?
       fi
-      exec chroot "${DATA_ROOT}" /bin/sh -c 'cd "$1" 2>/dev/null || cd /; shift; exec "$@"' sh "${PWD}" "/usr/bin/${PIP_NAME}" "$@"
+      # pip can add usr/local commands that outrank existing shims on the
+      # PATH overlay; refresh so a stale shim never shadows them.
+      /app/assistant/docker-kata-apt-shims.sh || true
+      exit "${rc}"
     fi
   fi
   echo "Warning: persistent pip root unavailable; falling back to the image pip (installs will not survive a save)" >&2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.8-dev.202609022016.7bd8f87",
+  "version": "0.11.8-dev.202609030046.e26b25a",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/attachment-stored-path-annotation.test.ts

@@ -8,6 +8,7 @@
  * stays bound to the oldest upload.
  */
 import { readFileSync } from "node:fs";
+import { basename } from "node:path";
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import { reinjectAttachmentPathAnnotations } from "../daemon/conversation-lifecycle.js";
@@ -119,6 +120,85 @@ describe("persistQueuedMessageBody stored path annotations", () => {
     expect(rebuiltBlock.text).toBe(annotation.text);
   });
 
+  test("offloaded oversized text records its stored path for history reload", async () => {
+    const conv = createConversation();
+    const ctx = makeCtx(conv.id);
+    const original = "x".repeat(8_000_001);
+
+    await persistQueuedMessageBody(ctx, { content: original });
+
+    const row = rawGet<{ metadata: string; content: string }>(
+      "test:offloadMessage",
+      "SELECT metadata, content FROM messages ORDER BY created_at DESC LIMIT 1",
+    );
+    const meta = JSON.parse(row!.metadata) as {
+      attachmentStoredPaths?: Record<string, string>;
+    };
+    const storedPaths = Object.values(meta.attachmentStoredPaths ?? {});
+    expect(storedPaths).toHaveLength(1);
+    const filename = basename(storedPaths[0]!);
+    expect(filename.startsWith("oversized-content-")).toBe(true);
+    expect(filename.endsWith(".txt")).toBe(true);
+    expect(readFileSync(storedPaths[0]!).toString("utf8")).toBe(original);
+
+    const annotation = lastAnnotationBlock(ctx);
+    expect(annotation.text).toBe(
+      `[Attachment "${filename}" is stored at: ${storedPaths[0]}]`,
+    );
+
+    const persisted = JSON.parse(row!.content) as ContentBlock[];
+    const rebuilt = reinjectAttachmentPathAnnotations(
+      persisted,
+      "user",
+      row!.metadata,
+    );
+    const rebuiltBlock = rebuilt.at(-1) as { type: "text"; text: string };
+    expect(rebuiltBlock.text).toBe(annotation.text);
+  });
+
+  test("two oversized messages in one conversation get distinct filenames", async () => {
+    const conv = createConversation();
+    const ctx = makeCtx(conv.id);
+
+    await persistQueuedMessageBody(ctx, { content: "a".repeat(8_000_001) });
+    await persistQueuedMessageBody(ctx, { content: "b".repeat(8_000_001) });
+
+    const first = (ctx.messages[0].content as ContentBlock[]).at(-1) as {
+      text: string;
+    };
+    const second = (ctx.messages[1].content as ContentBlock[]).at(-1) as {
+      text: string;
+    };
+    expect(first.text).toContain("oversized-content-");
+    expect(second.text).toContain("oversized-content-");
+    expect(first.text).not.toBe(second.text);
+  });
+
+  test("display-only offload is not named on the model-facing list", async () => {
+    const conv = createConversation();
+    const ctx = makeCtx(conv.id);
+    const display = "y".repeat(8_000_001);
+
+    await persistQueuedMessageBody(ctx, {
+      content: "fenced model copy",
+      displayContent: display,
+    });
+
+    const llmContent = ctx.messages[0].content as ContentBlock[];
+    expect(JSON.stringify(llmContent)).not.toContain("oversized-content-");
+    expect(JSON.stringify(llmContent)).toContain("fenced model copy");
+    expect(JSON.stringify(llmContent)).not.toContain(display);
+
+    const row = rawGet<{ metadata: string }>(
+      "test:displayOnlyOffloadMetadata",
+      "SELECT metadata FROM messages ORDER BY created_at DESC LIMIT 1",
+    );
+    const meta = JSON.parse(row!.metadata) as {
+      attachmentStoredPaths?: Record<string, string>;
+    };
+    expect(meta.attachmentStoredPaths).toBeUndefined();
+  });
+
   test("messages without attachments get no annotation block", async () => {
     const conv = createConversation();
     const ctx = makeCtx(conv.id);

package/src/__tests__/attachments-store.test.ts

@@ -2,6 +2,10 @@ import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { beforeEach, describe, expect, test } from "bun:test";
 
+import {
+  offloadOversizedText,
+  OVERSIZED_CONTENT_FILENAME_PREFIX,
+} from "../daemon/port-oversized-content.js";
 import {
   attachInlineAttachmentToMessage,
   AttachmentUploadError,
@@ -456,6 +460,29 @@ describe("createInlineAttachment (workspace_ref persistence)", () => {
       stored.id,
     ]);
   });
+
+  test("offloadOversizedText writes the original bytes next to the conversation", async () => {
+    const conv = createConversation();
+    const original = "x".repeat(32);
+    const result = await offloadOversizedText(
+      original,
+      {
+        conversationId: conv.id,
+        conversationCreatedAt: conv.createdAt,
+      },
+      16,
+    );
+
+    expect(result.attachmentId).toBeDefined();
+    const filePath = getFilePathForAttachment(result.attachmentId!);
+    expect(filePath).toBeTruthy();
+    expect(result.filename).toBeDefined();
+    expect(filePath!.endsWith(result.filename!)).toBe(true);
+    expect(result.filename!.startsWith(`${OVERSIZED_CONTENT_FILENAME_PREFIX}-`)).toBe(
+      true,
+    );
+    expect(readFileSync(filePath!).toString("utf8")).toBe(original);
+  });
 });
 
 describe("attachInlineAttachmentToMessage filename collisions", () => {

package/src/__tests__/attachments.test.ts

@@ -127,6 +127,32 @@ describe("attachmentsToReferenceBlocks", () => {
     expect(JSON.stringify(blocks)).not.toContain("data");
   });
 
+  test("omits extracted_text on a video workspace_ref", () => {
+    const blocks = attachmentsToReferenceBlocks([
+      {
+        attachmentId: "att-vid",
+        filename: "clip.mp4",
+        mimeType: "video/mp4",
+        sizeBytes: 40_000_000,
+        extractedText: "this must not dump into the prompt",
+      },
+    ]);
+
+    expect(blocks).toEqual([
+      {
+        type: "file",
+        source: {
+          type: "workspace_ref",
+          media_type: "video/mp4",
+          attachmentId: "att-vid",
+          sizeBytes: 40_000_000,
+          filename: "clip.mp4",
+        },
+      },
+    ]);
+    expect(JSON.stringify(blocks)).not.toContain("extracted");
+  });
+
   test("builds a file workspace_ref with filename and extracted text", () => {
     const blocks = attachmentsToReferenceBlocks([
       {
@@ -208,6 +234,23 @@ describe("attachmentsToContentBlocks", () => {
     expect(blocks[0].type).toBe("image");
   });
 
+  test("omits extracted_text on an inline video file block", async () => {
+    const blocks = await attachmentsToContentBlocks([
+      {
+        filename: "clip.mp4",
+        mimeType: "video/mp4",
+        data: "AAAA",
+        extractedText: "must not dump",
+      },
+    ]);
+    expect(blocks).toHaveLength(1);
+    expect(blocks[0]).toMatchObject({
+      type: "file",
+      source: { type: "base64", media_type: "video/mp4", filename: "clip.mp4" },
+    });
+    expect(blocks[0]).not.toHaveProperty("extracted_text");
+  });
+
   test("creates file content block for non-image mime types", async () => {
     const blocks = await attachmentsToContentBlocks([
       { filename: "doc.pdf", mimeType: "application/pdf", data: "pdfdata" },

package/src/__tests__/docker-kata-apt-shims.test.ts

@@ -0,0 +1,135 @@
+import { execFileSync } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+const scriptPath = join(
+  import.meta.dir,
+  "..",
+  "..",
+  "docker-kata-apt-shims.sh",
+);
+const testRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of testRoots.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+function writeExecutable(path: string, contents: string): void {
+  writeFileSync(path, contents);
+  chmodSync(path, 0o755);
+}
+
+function createDataRoot(): string {
+  const dataRoot = mkdtempSync(join(tmpdir(), "kata-apt-shims-"));
+  testRoots.push(dataRoot);
+  for (const dir of [
+    "usr/bin",
+    "usr/sbin",
+    "usr/games",
+    "usr/local/bin",
+    "usr/local/sbin",
+    "var/lib/dpkg",
+  ]) {
+    mkdirSync(join(dataRoot, dir), { recursive: true });
+  }
+  writeFileSync(join(dataRoot, "var/lib/dpkg/status"), "unchanged\n");
+  return dataRoot;
+}
+
+function refreshShims(dataRoot: string, pathPrefix?: string): void {
+  execFileSync("/bin/sh", [scriptPath], {
+    env: {
+      ...process.env,
+      PATH: pathPrefix
+        ? `${pathPrefix}:${process.env.PATH ?? ""}`
+        : process.env.PATH,
+      VELLUM_APT_DATA_ROOT: dataRoot,
+    },
+  });
+}
+
+describe("docker-kata-apt-shims", () => {
+  test.skipIf(process.platform !== "linux")(
+    "refreshes a shim when a same-version reinstall retargets its trampoline",
+    () => {
+      const dataRoot = createDataRoot();
+
+      const suffix = basename(dataRoot);
+      const firstTarget = `/vellum-apt-shim-test/${suffix}-1`;
+      const secondTarget = `/vellum-apt-shim-test/${suffix}-2`;
+      const source = join(dataRoot, "usr/bin/example-tool");
+      const shim = join(dataRoot, ".host-shims/example-tool");
+
+      for (const target of [firstTarget, secondTarget]) {
+        const chrootTarget = `${dataRoot}${target}`;
+        mkdirSync(join(chrootTarget, ".."), { recursive: true });
+        writeExecutable(chrootTarget, "#!/bin/sh\nexit 0\n");
+      }
+
+      writeExecutable(source, `#!/bin/sh\nexec ${firstTarget} "$@"\n`);
+      refreshShims(dataRoot);
+      expect(readFileSync(shim, "utf8")).toContain(firstTarget);
+
+      writeExecutable(source, `#!/bin/sh\nexec ${secondTarget} "$@"\n`);
+      const fakeBin = join(dataRoot, "fake-bin");
+      const failedOnce = join(dataRoot, "mv-failed-once");
+      mkdirSync(fakeBin);
+      writeExecutable(
+        join(fakeBin, "mv"),
+        `#!/bin/sh
+if [ ! -e "${failedOnce}" ]; then
+  touch "${failedOnce}"
+  exit 91
+fi
+[ -f "$3" ] || exit 92
+exec /bin/mv "$@"
+`,
+      );
+
+      expect(() => refreshShims(dataRoot, fakeBin)).toThrow();
+      expect(readFileSync(shim, "utf8")).toContain(firstTarget);
+      refreshShims(dataRoot, fakeBin);
+
+      const refreshedShim = readFileSync(shim, "utf8");
+      expect(refreshedShim).toContain(secondTarget);
+      expect(refreshedShim).not.toContain(firstTarget);
+    },
+  );
+
+  test.skipIf(process.platform !== "linux")(
+    "ignores non-executable entries and refreshes when they become runnable",
+    () => {
+      const dataRoot = createDataRoot();
+      const suffix = basename(dataRoot);
+      const target = `/vellum-apt-shim-test/${suffix}`;
+      const chrootTarget = `${dataRoot}${target}`;
+      const lowerSource = join(dataRoot, "usr/sbin/example-tool");
+      const higherSource = join(dataRoot, "usr/local/bin/example-tool");
+      const shim = join(dataRoot, ".host-shims/example-tool");
+
+      mkdirSync(join(chrootTarget, ".."), { recursive: true });
+      writeExecutable(chrootTarget, "#!/bin/sh\nexit 0\n");
+      writeExecutable(lowerSource, `#!/bin/sh\nexec ${target} "$@"\n`);
+      writeFileSync(higherSource, "#!/bin/sh\nexit 0\n", { mode: 0o644 });
+
+      refreshShims(dataRoot);
+      expect(readFileSync(shim, "utf8")).toContain(target);
+
+      chmodSync(higherSource, 0o755);
+      refreshShims(dataRoot);
+      expect(existsSync(shim)).toBe(false);
+    },
+  );
+});