@vellumai/assistant 0.12.5 → 0.12.6-dev.202609292116.41f7caa

package/src/runtime/migrations/vbundle-streaming-importer.ts

@@ -69,7 +69,10 @@ import {
   verifySymlinkEntry,
 } from "./vbundle-streaming-validator.js";
 import { parseVBundleStream } from "./vbundle-tar-stream.js";
-import type { ManifestType } from "./vbundle-validator.js";
+import {
+  MANIFEST_MAX_ENTRIES,
+  type ManifestType,
+} from "./vbundle-validator.js";
 
 const log = getLogger("vbundle-streaming-importer");
 
@@ -91,11 +94,11 @@ const log = getLogger("vbundle-streaming-importer");
 const DEFAULT_MAX_BUNDLE_BYTES = 16 * 1024 * 1024 * 1024;
 
 /**
- * Entry-count ceiling for the bundle. 100k is well above the largest
- * workspace we ship; anything past that is almost certainly an attack or
- * a corrupted archive.
+ * Entry-count ceiling for the bundle, shared with manifest validation so
+ * preflight and import agree. Also applied to tar-level entries so padding
+ * extras cannot exceed what the manifest declared.
  */
-const DEFAULT_MAX_BUNDLE_ENTRIES = 100_000;
+const DEFAULT_MAX_BUNDLE_ENTRIES = MANIFEST_MAX_ENTRIES;
 
 /**
  * Prefixes used for scratch dirs the streaming importer creates INSIDE the
@@ -153,7 +156,7 @@ export interface StreamCommitArgs {
   maxBundleBytes?: number;
   /**
    * Test-only override for the entry-count ceiling. Production callers
-   * should omit this and rely on the 100_000 default.
+   * should omit this and rely on the `MANIFEST_MAX_ENTRIES` default.
    */
   maxBundleEntries?: number;
 }
@@ -313,7 +316,9 @@ export async function streamCommitImport(
       if (entryIndex === 0) {
         // First entry MUST be manifest.json — readAndValidateManifest
         // enforces that and throws StreamingValidationError otherwise.
-        const manifestResult = await readAndValidateManifest(entry);
+        const manifestResult = await readAndValidateManifest(entry, {
+          maxEntries: bundleEntryCap,
+        });
         manifest = manifestResult.manifest;
         expected = manifestResult.expected;
 
@@ -340,18 +345,8 @@ export async function streamCommitImport(
           );
         }
 
-        // Entry-count ceiling check. The manifest declares every file the
-        // bundle claims to contain, so one check here bounds the work the
-        // importer is willing to do for this bundle.
-        if (manifest.contents.length > bundleEntryCap) {
-          throw new StreamingValidationError(
-            "bundle_too_many_entries",
-            `bundle contains more than ${bundleEntryCap} entries (declared: ${manifest.contents.length})`,
-          );
-        }
-
-        // Only NOW — after the manifest is parsed, the version gate passes,
-        // and the entry-count ceiling is enforced — do we materialize the
+        // Only NOW, after the manifest is parsed (including its entry-count
+        // ceiling) and the version gate passes, do we materialize the
         // temp staging dir on disk. Doing this lazily preserves the plan
         // invariant that importers gate on runtime-version compat BEFORE
         // any state mutation. If this throws, the outer catch runs

package/src/runtime/migrations/vbundle-streaming-validator.ts

@@ -28,6 +28,8 @@ import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
   LegacyManifestSchema,
+  MANIFEST_MAX_BYTES,
+  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   type ManifestType,
   translateLegacyManifest,
@@ -74,21 +76,17 @@ export class StreamingValidationError extends Error {
 // Manifest validation
 // ---------------------------------------------------------------------------
 
-// Manifests are metadata only — typically tens to hundreds of KB even for
-// huge bundles. A 1 MiB cap is comfortably above realistic sizes and
-// protects against a malicious archive whose "manifest" is actually a
-// multi-GB stream intended to OOM the validator.
-const MANIFEST_MAX_BYTES = 1 * 1024 * 1024;
-
 /**
  * Drain the first tar entry — which MUST be `manifest.json` — and run the
  * full manifest-level validation pipeline:
  *   1. Entry name check.
- *   2. Size cap (1 MiB).
+ *   2. Size cap (`MANIFEST_MAX_BYTES`).
  *   3. JSON parse.
  *   4. Zod schema validation.
  *   5. Self-referencing `checksum` verification against the
  *      canonicalized JSON (minus that field).
+ *   6. Entry-count ceiling on `contents` (`maxEntries`, default
+ *      `MANIFEST_MAX_ENTRIES`).
  *
  * On success, returns the parsed manifest plus a `Map` keyed by archive
  * path that callers consult as each subsequent entry streams past.
@@ -98,7 +96,9 @@ const MANIFEST_MAX_BYTES = 1 * 1024 * 1024;
  */
 export async function readAndValidateManifest(
   first: StreamedTarEntry,
+  options: { maxEntries?: number } = {},
 ): Promise<ManifestReadResult> {
+  const maxEntries = options.maxEntries ?? MANIFEST_MAX_ENTRIES;
   if (first.header.name !== "manifest.json") {
     // Drain the body so the underlying tar extractor isn't left dangling
     // on backpressure before the caller reports the error.
@@ -186,6 +186,13 @@ export async function readAndValidateManifest(
     manifest = translateLegacyManifest(legacy);
   }
 
+  if (manifest.contents.length > maxEntries) {
+    throw new StreamingValidationError(
+      "bundle_too_many_entries",
+      `bundle contains more than ${maxEntries} entries (declared: ${manifest.contents.length})`,
+    );
+  }
+
   const expected = new Map<
     string,
     { sha256: string; size: number; linkTarget: string | null }

package/src/runtime/migrations/vbundle-validator.ts

@@ -381,6 +381,33 @@ export function computeManifestChecksum(manifest: unknown): string {
 // Core validation
 // ---------------------------------------------------------------------------
 
+/**
+ * Hard caps on `manifest.json`, shared by the buffered and streaming
+ * validators so preflight and import agree on what is acceptable. The two
+ * are sized together: the manifest carries one `contents` entry (path,
+ * sha256, size) per bundled file at roughly 150 bytes each, so 200,000
+ * entries serialize to about 32 MiB.
+ *
+ * That absorbs a workspace with a stray dependency install or checked-out
+ * repo while still bounding the transient memory a hostile "manifest" can
+ * force the importer to hold (buffer, decoded string, parsed object,
+ * canonical re-serialization for the self-checksum) and the per-entry work
+ * it commits to, on a memory-constrained pod.
+ */
+export const MANIFEST_MAX_BYTES = 32 * 1024 * 1024;
+export const MANIFEST_MAX_ENTRIES = 200_000;
+
+export interface ValidateVBundleOptions {
+  /**
+   * Reject manifests over `MANIFEST_MAX_BYTES` or `MANIFEST_MAX_ENTRIES`.
+   * Preflights that precede a streaming import set this so they never
+   * approve a bundle the import will refuse. The buffered import path
+   * (`commitImport`) has no such ceilings, so it stays off there to keep
+   * existing large backups restorable.
+   */
+  enforceStreamingLimits?: boolean;
+}
+
 // Only manifest.json is structurally required. The DB and config live under
 // workspace/ (new format) or data/db/ + config/ (old format) — both are valid.
 const REQUIRED_ENTRIES = ["manifest.json"];
@@ -397,7 +424,10 @@ const MAX_DECOMPRESSED_SIZE = 2 * 1024 * 1024 * 1024;
  * 3. Manifest checksum (SHA-256 of canonicalized JSON with the `checksum` field set to empty string)
  * 4. Per-file content integrity (SHA-256 of each file vs manifest declaration)
  */
-export function validateVBundle(data: Uint8Array): VBundleValidationResult {
+export function validateVBundle(
+  data: Uint8Array,
+  { enforceStreamingLimits = false }: ValidateVBundleOptions = {},
+): VBundleValidationResult {
   const errors: ValidationError[] = [];
 
   // Step 1: Decompress gzip with size cap to prevent zip-bomb DoS
@@ -455,6 +485,17 @@ export function validateVBundle(data: Uint8Array): VBundleValidationResult {
   }
 
   // Step 4: Parse and validate manifest schema
+  if (
+    enforceStreamingLimits &&
+    manifestEntry.data.length > MANIFEST_MAX_BYTES
+  ) {
+    errors.push({
+      code: "MANIFEST_TOO_LARGE",
+      message: `manifest.json exceeds ${MANIFEST_MAX_BYTES} byte limit (${manifestEntry.data.length} bytes)`,
+      path: "manifest.json",
+    });
+    return { is_valid: false, errors };
+  }
   let manifestRaw: unknown;
   try {
     manifestRaw = JSON.parse(new TextDecoder().decode(manifestEntry.data));
@@ -523,6 +564,18 @@ export function validateVBundle(data: Uint8Array): VBundleValidationResult {
     manifest = translateLegacyManifest(legacy);
   }
 
+  if (
+    enforceStreamingLimits &&
+    manifest.contents.length > MANIFEST_MAX_ENTRIES
+  ) {
+    errors.push({
+      code: "MANIFEST_TOO_MANY_ENTRIES",
+      message: `manifest.json declares more than ${MANIFEST_MAX_ENTRIES} entries (${manifest.contents.length})`,
+      path: "manifest.json",
+    });
+    return { is_valid: false, errors };
+  }
+
   // Step 6: Verify per-file content integrity
   const manifestFilePaths = new Set(manifest.contents.map((f) => f.path));
 

package/src/runtime/pending-interactions.ts

@@ -23,7 +23,10 @@ import type { QuestionEntry } from "../api/events/question-request.js";
 import { findConversationOrSubagent } from "../daemon/conversation-registry.js";
 import type { UserDecision } from "../permissions/types.js";
 import { getLogger } from "../util/logger.js";
-import { broadcastMessage } from "./assistant-event-hub.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "./assistant-event-hub.js";
 
 const log = getLogger("pending-interactions");
 
@@ -110,6 +113,12 @@ export interface PendingInteraction {
   directResolve?: (decision: UserDecision) => void;
   /** When set, the host_bash request should be routed to this specific client. */
   targetClientId?: string;
+  /**
+   * Hub connection that was active for `targetClientId` at dispatch. Results
+   * must arrive while this connection is still subscribed so a reconnect
+   * cannot submit under the same client id.
+   */
+  targetConnectionId?: string;
   /**
    * Actor principal captured at registration. Targeted requests snapshot the
    * target client's actor so a brief SSE reconnect does not 403 a legitimate
@@ -167,7 +176,16 @@ export function register(
   requestId: string,
   interaction: PendingInteraction,
 ): void {
-  pending.set(requestId, interaction);
+  const targetConnectionId =
+    interaction.targetConnectionId ??
+    (interaction.targetClientId
+      ? assistantEventHub.getClientById?.(interaction.targetClientId)
+          ?.connectionId
+      : undefined);
+  pending.set(requestId, {
+    ...interaction,
+    ...(targetConnectionId != null ? { targetConnectionId } : {}),
+  });
 }
 
 /**

package/src/runtime/routes/__tests__/contact-routes.test.ts

@@ -275,7 +275,7 @@ describe("contacts read API relays from the gateway", () => {
   });
 
   test("get surfaces a clean gateway not-found as a 404", async () => {
-    ipcResult = { ok: true };
+    ipcResult = null;
 
     await expect(handleGetContact("missing")).rejects.toMatchObject({
       statusCode: 404,
@@ -391,7 +391,8 @@ describe("filtered/native contact reads: daemon filters, gateway hydrates teleme
     expect(contact.interactionCount).toBe(11);
     expect(contact.lastInteraction).toBe(9200);
     expect(
-      (contact as { autoApproveThreshold?: string | null }).autoApproveThreshold,
+      (contact as { autoApproveThreshold?: string | null })
+        .autoApproveThreshold,
     ).toBe("high");
     const channel = contact.channels[0] as Record<string, unknown>;
     expect(channel.interactionCount).toBe(11);
@@ -422,7 +423,8 @@ describe("filtered/native contact reads: daemon filters, gateway hydrates teleme
     expect(contact.interactionCount).toBe(0);
     expect(contact.lastInteraction).toBeNull();
     expect(
-      (contact as { autoApproveThreshold?: string | null }).autoApproveThreshold,
+      (contact as { autoApproveThreshold?: string | null })
+        .autoApproveThreshold,
     ).toBeNull();
     const channel = contact.channels[0] as Record<string, unknown>;
     expect(channel.interactionCount).toBe(0);

package/src/runtime/routes/__tests__/conversation-list-routes.test.ts

@@ -71,6 +71,7 @@ interface ListResponse {
   nextOffset: number;
   hasMore: boolean;
   groups?: unknown[];
+  orderedBy: string;
 }
 
 function findHandler(routes: RouteDefinition[], operationId: string) {
@@ -1380,6 +1381,41 @@ describe("GET /v1/conversations, conversationType=all", () => {
     ]);
   });
 
+  test("files a done row by when it was marked done when that is later than its last message", async () => {
+    const recent = createConversation("recent-foreground");
+    const doneLater = createConversation("old-chat-marked-done-later");
+    const doneEarlier = createConversation("old-chat-done-before-a-reply");
+    setLastMessageAt(recent.id, 2000);
+    setLastMessageAt(doneLater.id, 1000);
+    setLastMessageAt(doneEarlier.id, 1500);
+    rawRun(
+      "test:markDone",
+      "UPDATE conversations SET archived_at = ? WHERE id = ?",
+      3000,
+      doneLater.id,
+    );
+    rawRun(
+      "test:markDone",
+      "UPDATE conversations SET archived_at = ? WHERE id = ?",
+      500,
+      doneEarlier.id,
+    );
+
+    const result = (await invoke({
+      conversationType: "all",
+      archiveStatus: "all",
+    })) as ListResponse;
+
+    expect(result.conversations.map((c) => c.title)).toEqual([
+      "old-chat-marked-done-later",
+      "recent-foreground",
+      "old-chat-done-before-a-reply",
+    ]);
+    // A client paging done rows relies on this to know the order is not
+    // message recency.
+    expect(result.orderedBy).toBe("lastActivity");
+  });
+
   test("excludes legacy private rows and subagent runs", async () => {
     createConversation("foreground-1");
     const legacyPrivate = createConversation("legacy-private");