@vellumai/assistant 0.12.5 → 0.12.6-dev.202609292116.41f7caa

package/src/providers/model-intents.ts

@@ -51,10 +51,10 @@ const PROVIDER_MODEL_INTENTS: Record<string, Record<ModelIntent, string>> = {
   },
   fireworks: {
     balanced: "accounts/fireworks/models/minimax-m3",
-    "cost-optimized": "accounts/fireworks/models/deepseek-v4-flash-0731",
-    "latency-optimized": "accounts/fireworks/models/deepseek-v4-flash-0731",
-    "quality-optimized": "accounts/fireworks/models/kimi-k2p6",
-    "vision-optimized": "accounts/fireworks/models/kimi-k2p6",
+    "cost-optimized": "accounts/fireworks/models/deepseek-v4p1-flash",
+    "latency-optimized": "accounts/fireworks/models/deepseek-v4p1-flash",
+    "quality-optimized": "accounts/fireworks/models/kimi-k3",
+    "vision-optimized": "accounts/fireworks/models/kimi-k3",
   },
   openrouter: {
     balanced: "anthropic/claude-sonnet-4.6",

package/src/providers/openai/chat-completions-provider.ts

@@ -39,6 +39,7 @@ import {
   extractOverflowTokensFromMessage,
 } from "../types.js";
 import {
+  boundUnparseableToolArgsRaw,
   isUnparseableToolArgs,
   wrapUnparseableToolArgs,
 } from "../unparseable-tool-args.js";
@@ -212,6 +213,12 @@ export interface OpenAIChatCompletionsProviderOptions {
    *  (Fireworks, Together) keep sending `none` / forced choices. Enabled for
    *  the generic `openai-compatible` adapter, whose upstream is unknown. */
   omitToolChoiceWhenReasoning?: boolean;
+  /** Send `tool_choice: "auto"` whenever tools are offered and the caller
+   *  left the choice unspecified. Strict OpenAI-compatible upstreams default
+   *  an unspecified `tool_choice` to "none" (io.net documents exactly that),
+   *  which would leave the model unable to call any tool; OpenAI's own
+   *  default is "auto", so this option only exists for upstreams that differ. */
+  defaultToolChoiceAuto?: boolean;
   /** Wire field for the output-token limit. OpenAI and OpenAI-compatible
    *  backends use `max_completion_tokens`. OpenRouter defaults to
    *  `max_tokens` because its parameter router matches that key on
@@ -864,6 +871,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
   private coerceObjectArgsToJsonString: boolean;
   private salvageXmlToolCalls: boolean;
   private omitToolChoiceWhenReasoning: boolean;
+  private defaultToolChoiceAuto: boolean;
   private outputTokenLimitField: "max_completion_tokens" | "max_tokens";
 
   constructor(
@@ -896,6 +904,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
       options.salvageXmlToolCalls ?? shouldSalvageXmlToolCalls(model);
     this.omitToolChoiceWhenReasoning =
       options.omitToolChoiceWhenReasoning ?? false;
+    this.defaultToolChoiceAuto = options.defaultToolChoiceAuto ?? false;
     this.outputTokenLimitField =
       options.outputTokenLimitField ?? "max_completion_tokens";
   }
@@ -958,6 +967,15 @@ export class OpenAIChatCompletionsProvider implements Provider {
           maxTokens;
       }
 
+      // Per-conversation prompt-cache key (OpenAI Chat Completions
+      // `prompt_cache_key`). `RetryProvider` stamps it from the durable
+      // conversation id for providers in PROMPT_CACHE_KEY_PROVIDERS; omitted
+      // from the wire when absent.
+      const promptCacheKey = configObj?.promptCacheKey;
+      if (typeof promptCacheKey === "string" && promptCacheKey.length > 0) {
+        params.prompt_cache_key = promptCacheKey;
+      }
+
       // Profile-scoped token biasing (e.g. the `suppress-cjk` preset). Resolved
       // and gated to this provider family upstream in `RetryProvider`.
       if (logitBias) {
@@ -1028,7 +1046,12 @@ export class OpenAIChatCompletionsProvider implements Provider {
         // wire. Catalog providers that honor `none` / forced choices still
         // receive them; the generic openai-compatible adapter drops every
         // explicit value in thinking mode via `omitToolChoiceWhenReasoning`.
-        const toolChoice = mapNeutralToolChoice(configObj?.tool_choice);
+        const callerToolChoice = mapNeutralToolChoice(configObj?.tool_choice);
+        const toolChoice =
+          callerToolChoice ??
+          (this.defaultToolChoiceAuto
+            ? ("auto" as OpenAI.Chat.Completions.ChatCompletionToolChoiceOption)
+            : undefined);
         xmlToolCallSalvageEnabled =
           this.salvageXmlToolCalls && toolChoice !== "none";
         if (toolChoice !== undefined) {
@@ -1149,6 +1172,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
           id: string;
           name: string;
           args: string;
+          inspectableArgs?: string;
           providerMetadata?: ToolUseContent["providerMetadata"];
         }
       >();
@@ -1450,6 +1474,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
           input = JSON.parse(tc.args);
         } catch {
           input = wrapUnparseableToolArgs(tc.args);
+          tc.inspectableArgs = boundUnparseableToolArgsRaw(tc.args);
         }
         const objectKeys = coercedObjectKeys.get(tc.name);
         if (objectKeys && !isUnparseableToolArgs(input)) {
@@ -1457,6 +1482,9 @@ export class OpenAIChatCompletionsProvider implements Provider {
           input = decoded.failedKey
             ? wrapUnparseableToolArgs(tc.args)
             : decoded.input;
+          if (decoded.failedKey) {
+            tc.inspectableArgs = boundUnparseableToolArgsRaw(tc.args);
+          }
         }
         content.push({
           type: "tool_use",
@@ -1484,7 +1512,10 @@ export class OpenAIChatCompletionsProvider implements Provider {
                         {
                           id: tc.id,
                           type: "function",
-                          function: { name: tc.name, arguments: tc.args },
+                          function: {
+                            name: tc.name,
+                            arguments: tc.inspectableArgs ?? tc.args,
+                          },
                         },
                         thoughtSignatureFromToolUseMetadata(
                           tc.providerMetadata,

package/src/providers/retry.ts

@@ -35,6 +35,7 @@ import {
   shouldSkipPrimary,
   tryAcquireRecoveryProbe,
 } from "./fallback-breaker.js";
+import { resolveFireworksRequestHeaders } from "./fireworks/client.js";
 import { resolveLogitBiasPreset } from "./inference/logit-bias.js";
 import { MALFORMED_TOOL_CALL_MESSAGE } from "./malformed-tool-call.js";
 import {
@@ -77,10 +78,16 @@ const USAGE_ATTRIBUTION_HEADER_NAMES = {
   subagentSpawnMode: "X-Vellum-Subagent-Spawn-Mode",
 } as const;
 
-/** Providers whose transports consume `promptCacheKey` (OpenAI Responses
- *  `prompt_cache_key`); `RetryProvider` derives it from `selectionSeed` for
- *  these only. */
-const PROMPT_CACHE_KEY_PROVIDERS = new Set(["openai", "openrouter"]);
+/** Providers whose transports consume `promptCacheKey` (OpenAI Responses /
+ *  Chat Completions `prompt_cache_key`); `RetryProvider` derives it from
+ *  `selectionSeed` for these only. `openai-compatible` is included so
+ *  self-hosted bridges (e.g. a Claude Code shim) receive a stable
+ *  per-conversation key and can pin server-side sessions / prompt caches to it. */
+const PROMPT_CACHE_KEY_PROVIDERS = new Set([
+  "openai",
+  "openrouter",
+  "openai-compatible",
+]);
 
 /** Providers that support the `effort` config (extended thinking / reasoning). */
 const EFFORT_SUPPORTED_PROVIDERS = new Set([
@@ -681,6 +688,19 @@ function normalizeSendMessageOptions(
     nextConfig.requestHeaders = resolveOpenCodeRequestHeaders(conversationId);
   }
 
+  if (providerName === "fireworks") {
+    // Covers BYOK Fireworks and the Vellum-managed Fireworks upstream, which
+    // both dispatch through `FireworksProvider`. Keyless calls send no header.
+    const sessionKey = [config.selectionSeed, config.conversationId].find(
+      (value): value is string =>
+        typeof value === "string" && value.trim().length > 0,
+    );
+    const headers = resolveFireworksRequestHeaders(sessionKey);
+    if (Object.keys(headers).length > 0) {
+      nextConfig.requestHeaders = headers;
+    }
+  }
+
   // `overrideProfile`, `forceOverrideProfile`, `selectionSeed`,
   // `conversationId`, and `nativeWebSearchSentinel` are routing/resolution-time
   // concerns (consumed by the resolver below, `CallSiteRoutingProvider`'s
@@ -689,6 +709,7 @@ function normalizeSendMessageOptions(
   // (after the `openai` promptCacheKey copy above) so they never leak into
   // provider request bodies even when callers set them without a `callSite`.
   delete nextConfig.overrideProfile;
+  delete nextConfig.overrideProfileOrigin;
   delete nextConfig.forceOverrideProfile;
   delete nextConfig.selectionSeed;
   delete nextConfig.conversationId;
@@ -703,6 +724,7 @@ function normalizeSendMessageOptions(
     const attribution = resolveUsageAttribution({
       callSite: config.callSite,
       overrideProfile: config.overrideProfile,
+      overrideProfileOrigin: config.overrideProfileOrigin,
       forceOverrideProfile: config.forceOverrideProfile,
       selectionSeed: config.selectionSeed,
     });
@@ -912,6 +934,36 @@ function normalizeSendMessageOptions(
     }
   }
 
+  // Adaptive-thinking-only Claude models (Fable, Opus 5.5, Sonnet 5.5) cannot
+  // turn reasoning off, so stripping `thinking` below does not clear the
+  // forced-tool conflict and Anthropic 400s the request. Downgrade the forced
+  // choice to `auto` so the call goes out. The tool is no longer guaranteed:
+  // forced-tool call sites already treat a missing tool call as a failed
+  // result, which is what the 400 gave them on every request.
+  const forcedToolModel =
+    typeof nextConfig.model === "string" ? nextConfig.model : "";
+  const forcedToolChoice = nextConfig.tool_choice as
+    | Record<string, unknown>
+    | undefined;
+  if (
+    forcedToolChoice != null &&
+    (forcedToolChoice.type === "tool" || forcedToolChoice.type === "any") &&
+    isAdaptiveThinkingOnlyModel(forcedToolModel) &&
+    targetsAnthropicWire(providerName, forcedToolModel)
+  ) {
+    log.warn(
+      {
+        providerName,
+        callSite: config.callSite,
+        model: forcedToolModel,
+        droppedToolChoice: forcedToolChoice,
+      },
+      "Downgrading forced `tool_choice` to `auto` because this model always " +
+        "reasons and rejects forced tool use.",
+    );
+    nextConfig.tool_choice = { type: "auto" };
+  }
+
   // Anthropic (and the gateways fronting Anthropic) rejects requests that
   // combine extended thinking with forced tool use (`tool_choice.type` of
   // `"tool"` or `"any"`).  Strip thinking when both are present so the

package/src/providers/search-provider-catalog.ts

@@ -197,6 +197,16 @@ export const SEARCH_PROVIDER_CATALOG: readonly SearchProviderCatalogEntry[] = [
     fallbackOrder: 9,
     privacyPolicyUrl: "https://exa.ai/privacy-policy",
   },
+  {
+    id: "serply",
+    displayName: "Serply",
+    kind: "byok",
+    apiKeyPrefix: "Serply API key...",
+    envVar: "SERPLY_API_KEY",
+    secretKey: "serply",
+    fallbackOrder: 10,
+    privacyPolicyUrl: "https://serply.io/privacy",
+  },
 ];
 
 /** Provider ids accepted by the web-search config schema. */

package/src/providers/types.ts

@@ -346,6 +346,13 @@ export interface SendMessageConfig {
    * silently fall through.
    */
   overrideProfile?: string;
+  /**
+   * Who chose `overrideProfile`: `"auto"` when the Auto profile's router
+   * picked it for the turn. Usage attribution reports it as the profile
+   * source so a routed turn is not counted as a user pin. A routing-time
+   * concern only; stripped before any provider wire request.
+   */
+  overrideProfileOrigin?: "auto";
   /**
    * When true, the resolver floats `overrideProfile` above the call-site
    * layers (named site profile + call-site override) for non-main-agent call
@@ -405,8 +412,9 @@ export interface SendMessageConfig {
   usageAttributionHeaders?: Record<string, string>;
   /**
    * Per-request HTTP headers merged onto the transport. `RetryProvider`
-   * stamps these for providers that need support-lookup headers (OpenCode
-   * `x-opencode-session` / `x-opencode-request`). Provider clients pass
+   * stamps these for providers that need per-conversation routing headers
+   * (OpenCode `x-opencode-session` / `x-opencode-request`, Fireworks
+   * `x-session-affinity`). Provider clients pass
    * them through SDK request options only and must never include this
    * object in provider JSON request bodies.
    */

package/src/providers/unparseable-tool-args.ts

@@ -14,7 +14,9 @@
  */
 
 import { safeStringSlice } from "../util/unicode.js";
+
 const UNPARSEABLE_TOOL_ARGS_KEY = "_raw";
+const UNPARSEABLE_TOOL_ARGS_PREVIEW_LIMIT = 200;
 
 /**
  * Message emitted by the Anthropic SDK's stream accumulator when a tool_use
@@ -30,6 +32,32 @@ export function wrapUnparseableToolArgs(raw: string): Record<string, unknown> {
   return { [UNPARSEABLE_TOOL_ARGS_KEY]: raw };
 }
 
+/**
+ * Bound an unparseable marker before it joins history, events, or audit logs.
+ * The prefix is enough to diagnose where JSON broke without retaining a
+ * multi-megabyte partial tool call in every downstream copy.
+ */
+export function boundUnparseableToolArgs(
+  input: Record<string, unknown>,
+): Record<string, unknown> {
+  if (!isUnparseableToolArgs(input)) {
+    return input;
+  }
+  const raw = input[UNPARSEABLE_TOOL_ARGS_KEY];
+  const bounded = boundUnparseableToolArgsRaw(raw);
+  return bounded === raw ? input : wrapUnparseableToolArgs(bounded);
+}
+
+/**
+ * Bound raw malformed arguments for diagnostic copies that retain the provider
+ * response shape rather than the internal `_raw` marker shape.
+ */
+export function boundUnparseableToolArgsRaw(raw: string): string {
+  return raw.length > UNPARSEABLE_TOOL_ARGS_PREVIEW_LIMIT
+    ? `${safeStringSlice(raw, 0, UNPARSEABLE_TOOL_ARGS_PREVIEW_LIMIT)}…`
+    : raw;
+}
+
 /**
  * Detect input produced by {@link wrapUnparseableToolArgs}: exactly one key,
  * the marker key, holding the raw argument string. The exact-shape check
@@ -56,11 +84,7 @@ export function unparseableToolArgsMessage(
   toolName: string,
   raw: string,
 ): string {
-  const PREVIEW_LIMIT = 200;
-  const preview =
-    raw.length > PREVIEW_LIMIT
-      ? `${safeStringSlice(raw, 0, PREVIEW_LIMIT)}…`
-      : raw;
+  const preview = boundUnparseableToolArgsRaw(raw);
   return (
     `Error: the arguments for "${toolName}" were not valid JSON — the argument stream was malformed or truncated, so the tool was NOT executed. ` +
     `Received: ${preview || "(empty)"}\n` +

package/src/providers/usage-tracking.ts

@@ -77,9 +77,11 @@ export class UsageTrackingProvider implements Provider {
       const attribution = resolveUsageAttribution({
         callSite: config.callSite,
         overrideProfile: appliedOverride,
-        ...(response.actualInferenceProfile !== undefined
-          ? { forceOverrideProfile: true }
-          : {}),
+        // A rerouted serve ran on the backup the wrapper chose, not on the
+        // router's pick, so the origin applies only to the original route.
+        ...(response.actualInferenceProfile === undefined
+          ? { overrideProfileOrigin: config.overrideProfileOrigin }
+          : { forceOverrideProfile: true }),
       });
       const providerName = response.actualProvider ?? this.inner.name;
       const pricingUsage = buildPricingUsageFromResponse(

package/src/runtime/assistant-event-hub.ts

@@ -438,6 +438,29 @@ export class AssistantEventHub {
     return undefined;
   }
 
+  /**
+   * Whether `connectionId` is still an active client subscription, optionally
+   * required to belong to `clientId`.
+   */
+  hasActiveClientConnection(
+    connectionId: string,
+    clientId?: string,
+  ): boolean {
+    for (const entry of this.subscribers) {
+      if (entry.connectionId !== connectionId) {
+        continue;
+      }
+      if (!entry.active || entry.type !== "client") {
+        return false;
+      }
+      if (clientId != null && entry.clientId !== clientId) {
+        return false;
+      }
+      return true;
+    }
+    return false;
+  }
+
   /**
    * Return the verified actor principal id captured at SSE subscription time
    * for the given client, or `undefined` if the client is unknown or

package/src/runtime/auth/__tests__/guard-tests.test.ts

@@ -68,11 +68,6 @@ describe("route policy coverage", () => {
     //     handler calls `assertPlaygroundEnabled()`, so the surface
     //     is invisible in prod regardless of policy.
     //
-    // GROUP C — pre-existing latent unprotected on main (the prior
-    // registry had no entry for these endpoints, so `enforcePolicy`
-    // returned allowed). Migration preserves behavior. Triage these
-    // and assign real policies in a follow-up PR:
-    //   - integrations/a2a/invite/accept
     const INTENTIONALLY_UNPROTECTED = new Set([
       // A — design-intentional
       "health",
@@ -87,8 +82,6 @@ describe("route policy coverage", () => {
       "playground/seed-conversation",
       "playground/seeded-conversations",
       "playground/seeded-conversations/:id",
-      // C — pre-existing latent unprotected (follow-up audit owed)
-      "integrations/a2a/invite/accept",
     ]);
 
     const unprotectedFound: string[] = [];

package/src/runtime/auth/__tests__/route-policy.test.ts

@@ -223,7 +223,7 @@ describe("enforcePolicy", () => {
 // An oauth_proxy_v1 grant is printed for a user to export into a stock
 // third-party CLI's environment, so it sits outside this install's trust
 // boundary. `policy: null` admits any valid token, which for this grant means
-// mutating routes it was never minted for (integrations/a2a/invite/accept).
+// mutating routes it was never minted for.
 // ---------------------------------------------------------------------------
 
 /** The context an exported OAuth proxy grant produces. */

package/src/runtime/channel-reply-delivery.ts

@@ -3,6 +3,7 @@ import type { MessageAudience } from "@vellumai/gateway-client";
 import { stripVellumLinks } from "../daemon/assistant-attachments.js";
 import type { RenderedHistoryContent } from "../daemon/handlers/shared.js";
 import { renderHistoryContent } from "../daemon/handlers/shared.js";
+import { DEFAULT_LOCALE } from "../i18n/index.js";
 import { editChannelMessage } from "../messaging/providers/index.js";
 import { getAttachmentMetadataForMessage } from "../persistence/attachments-store.js";
 import {
@@ -344,6 +345,7 @@ function readPersistedAssistantReply(msg: PersistedMessage): {
     undefined,
     undefined,
     msg.metadata,
+    DEFAULT_LOCALE,
   );
 
   const linked = getAttachmentMetadataForMessage(msg.id);

package/src/runtime/channel-retry-sweep.ts

@@ -75,9 +75,8 @@ function parseTrustRuntimeContext(value: unknown): TrustContext | undefined {
   if (!rawSourceChannel || !isChannelId(rawSourceChannel)) {
     return undefined;
   }
-  const sourceChannel = rawSourceChannel;
   return {
-    sourceChannel,
+    sourceChannel: rawSourceChannel,
     trustClass,
     guardianChatId:
       typeof raw.guardianChatId === "string" ? raw.guardianChatId : undefined,

package/src/runtime/http-types.ts

@@ -12,6 +12,7 @@ import type {
   ConversationCreateOptions,
   SlackInboundMessageMetadata,
 } from "../daemon/handlers/shared.js";
+import type { SupportedLocale } from "../i18n/index.js";
 
 // Re-export so route modules (background-dispatch, etc.) can pull the type
 // from the runtime barrel without reaching into daemon internals.
@@ -110,6 +111,8 @@ export interface RuntimeMessageConversationOptions {
   sourceChannel?: ChannelId;
   /** Originating interface (e.g. "cli", "web"). Defaults to "web". */
   sourceInterface?: InterfaceId;
+  /** Locale for daemon-authored text emitted during this turn. */
+  locale?: SupportedLocale;
 }
 
 export type MessageProcessor = (

package/src/runtime/migrations/__tests__/vbundle-streaming-validator.test.ts

@@ -30,6 +30,7 @@ import {
 import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
+  MANIFEST_MAX_BYTES,
 } from "../vbundle-validator.js";
 import { defaultV1Options } from "./v1-test-helpers.js";
 
@@ -202,15 +203,16 @@ describe("readAndValidateManifest — negative paths", () => {
   });
 
   test("throws manifest_too_large and fails fast before draining the whole body", async () => {
-    // Fake a tar entry whose body would emit 5 MiB if fully drained. The
-    // validator must destroy() the stream and throw the moment the running
-    // byte count crosses the 1 MiB cap — it must NOT keep pulling chunks.
+    // Fake a tar entry whose body would emit 10x the cap if fully drained.
+    // The validator must destroy() the stream and throw the moment the
+    // running byte count crosses MANIFEST_MAX_BYTES; it must NOT keep
+    // pulling chunks.
     //
     // We count bytes emitted via a _read implementation, and after the
-    // throw assert both that destroy() fired and that far fewer than 5 MiB
-    // were ever pulled out of the stream.
-    const CHUNK = 512 * 1024; // 512 KiB
-    const TOTAL_CHUNKS = 10; // 5 MiB worth — way past the 1 MiB cap
+    // throw assert both that destroy() fired and that far less than the
+    // full body was ever pulled out of the stream.
+    const CHUNK = MANIFEST_MAX_BYTES / 2;
+    const TOTAL_CHUNKS = 20;
     let chunksEmitted = 0;
     let bytesEmitted = 0;
     const body = new Readable({
@@ -245,11 +247,34 @@ describe("readAndValidateManifest — negative paths", () => {
     expect(err).toBeInstanceOf(StreamingValidationError);
     expect(err?.code).toBe("manifest_too_large");
     // Fail-fast assertions: destroy() was called, and we didn't drain past
-    // ~1 MiB + one chunk. If the validator had drained to EOF we'd see the
-    // full 5 MiB / 10 chunks here.
+    // the cap + one chunk. If the validator had drained to EOF we'd see all
+    // 20 chunks here.
     expect(body.destroyed).toBe(true);
     expect(chunksEmitted).toBeLessThanOrEqual(3);
-    expect(bytesEmitted).toBeLessThan(2 * 1024 * 1024);
+    expect(bytesEmitted).toBeLessThan(2 * MANIFEST_MAX_BYTES);
+  });
+
+  test("throws bundle_too_many_entries when manifest.contents exceeds maxEntries", async () => {
+    const { archive } = buildVBundle({
+      files: [
+        { path: "data/db/assistant.db", data: new Uint8Array() },
+        { path: "workspace/a.txt", data: new TextEncoder().encode("a") },
+        { path: "workspace/b.txt", data: new TextEncoder().encode("b") },
+      ],
+      ...defaultV1Options(),
+    });
+    const { entry, drainRest } = await firstEntryOf(archive);
+
+    let err: StreamingValidationError | null = null;
+    try {
+      await readAndValidateManifest(entry, { maxEntries: 2 });
+    } catch (e) {
+      err = e as StreamingValidationError;
+    }
+    await drainRest();
+
+    expect(err).toBeInstanceOf(StreamingValidationError);
+    expect(err?.code).toBe("bundle_too_many_entries");
   });
 
   test("throws manifest_malformed when manifest body is not valid JSON", async () => {

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -19,6 +19,8 @@ import {
   canonicalizeJson,
   computeLegacyManifestSha256,
   computeManifestChecksum,
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   validateVBundle,
 } from "../vbundle-validator.js";
@@ -174,6 +176,52 @@ describe("ManifestSchema — v1 acceptance", () => {
   });
 });
 
+describe("validateVBundle: streaming manifest limits", () => {
+  test("rejects a manifest over MANIFEST_MAX_BYTES with MANIFEST_TOO_LARGE", () => {
+    const oversized = new Uint8Array(MANIFEST_MAX_BYTES + 1).fill(0x20);
+    const archive = gzipSync(
+      tarArchive([{ name: "manifest.json", data: oversized }]),
+    );
+    const result = validateVBundle(archive, { enforceStreamingLimits: true });
+    expect(result.is_valid).toBe(false);
+    expect(result.errors.map((e) => e.code)).toEqual(["MANIFEST_TOO_LARGE"]);
+  });
+
+  test("rejects a manifest declaring more than MANIFEST_MAX_ENTRIES with MANIFEST_TOO_MANY_ENTRIES", () => {
+    const skeleton = v1Skeleton();
+    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
+    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
+      ...dbEntry,
+      path: `workspace/${i}`,
+    }));
+    const archive = gzipTarOf(
+      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
+    );
+    const result = validateVBundle(archive, { enforceStreamingLimits: true });
+    expect(result.is_valid).toBe(false);
+    expect(result.errors.map((e) => e.code)).toEqual([
+      "MANIFEST_TOO_MANY_ENTRIES",
+    ]);
+  });
+
+  test("does not apply the limits unless enforceStreamingLimits is set", () => {
+    const skeleton = v1Skeleton();
+    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
+    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
+      ...dbEntry,
+      path: `workspace/${i}`,
+    }));
+    const archive = gzipTarOf(
+      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
+      [{ name: "data/db/assistant.db", data: DB_BYTES }],
+    );
+    const result = validateVBundle(archive);
+    expect(result.errors.map((e) => e.code)).not.toContain(
+      "MANIFEST_TOO_MANY_ENTRIES",
+    );
+  });
+});
+
 describe("ManifestSchema — v1 rejection", () => {
   test("rejects schema_version !== 1", () => {
     const manifest = withChecksum({ ...v1Skeleton(), schema_version: 2 });

package/src/runtime/migrations/vbundle-builder.ts

@@ -31,9 +31,11 @@ import { sanitizeConfigForTransfer } from "../../config/sanitize-for-transfer.js
 import { trackDaemonActivity } from "../../daemon/activity-trail.js";
 import { getLogger } from "../../util/logger.js";
 import type { VBundleOriginMode } from "./origin-mode.js";
-import type {
-  ManifestFileEntryType,
-  ManifestType,
+import {
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
+  type ManifestFileEntryType,
+  type ManifestType,
 } from "./vbundle-validator.js";
 
 // ---------------------------------------------------------------------------
@@ -400,6 +402,20 @@ function buildManifestObject(input: {
   const checksum = sha256Hex(canonicalizeJson(manifestWithEmptyChecksum));
   const manifest: ManifestType = { ...manifestWithEmptyChecksum, checksum };
   const manifestData = new TextEncoder().encode(JSON.stringify(manifest));
+  if (
+    manifest.contents.length > MANIFEST_MAX_ENTRIES ||
+    manifestData.length > MANIFEST_MAX_BYTES
+  ) {
+    getLogger("vbundle-builder").warn(
+      {
+        entries: manifest.contents.length,
+        manifestBytes: manifestData.length,
+        maxEntries: MANIFEST_MAX_ENTRIES,
+        maxBytes: MANIFEST_MAX_BYTES,
+      },
+      "Bundle manifest exceeds the streaming import limits; teleport and staged-path imports will reject this bundle",
+    );
+  }
   return { manifest, manifestData };
 }