@vellumai/assistant 0.12.6-dev.202609292019.a6f6d85 → 0.12.6-staging.1

package/.env.example

@@ -2,8 +2,6 @@
 ANTHROPIC_API_KEY=sk-ant-...
 OPENAI_API_KEY=sk-...
 GEMINI_API_KEY=...
-# Optional. IO Intelligence (io.net) open-models endpoint.
-IONET_API_KEY=...
 # Optional. TypeSafe / Jev System One decision model.
 TYPESAFE_API_KEY=...
 # Optional for authenticated/proxied Ollama deployments

package/openapi.yaml

@@ -6025,7 +6025,6 @@ paths:
                     - minimax
                     - atlascloud
                     - baseten
-                    - ionet
                     - poolside
                 connectionName:
                   type: string
@@ -16974,8 +16973,8 @@ paths:
             type: string
           description:
             "Filter by provider id. One of: anthropic, openai, gemini, ollama, fireworks, together, openrouter,
-            vercel-ai-gateway, litellm, opencode, openai-compatible, minimax, atlascloud, baseten, ionet, poolside,
-            typesafe, vellum"
+            vercel-ai-gateway, litellm, opencode, openai-compatible, minimax, atlascloud, baseten, poolside, typesafe,
+            vellum"
       responses:
         "200":
           description: Successful response
@@ -17247,8 +17246,8 @@ paths:
             type: string
           description:
             "Filter by provider. One of: anthropic, openai, gemini, ollama, fireworks, together, openrouter,
-            vercel-ai-gateway, litellm, opencode, openai-compatible, minimax, atlascloud, baseten, ionet, poolside,
-            typesafe, vellum, chatgpt"
+            vercel-ai-gateway, litellm, opencode, openai-compatible, minimax, atlascloud, baseten, poolside, typesafe,
+            vellum, chatgpt"
       responses:
         "200":
           description: Successful response
@@ -39426,7 +39425,6 @@ components:
         - minimax
         - atlascloud
         - baseten
-        - ionet
         - poolside
         - typesafe
         - vellum
@@ -39691,7 +39689,6 @@ components:
                     - minimax
                     - atlascloud
                     - baseten
-                    - ionet
                     - poolside
                 connectionName:
                   type: string
@@ -40080,7 +40077,6 @@ components:
                 - minimax
                 - atlascloud
                 - baseten
-                - ionet
                 - poolside
             - type: "null"
         connectionName:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.6-dev.202609292019.a6f6d85",
+  "version": "0.12.6-staging.1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/cli/lib/bundled-marketplace.json

@@ -148,19 +148,6 @@
         "ref": "2d293cdcb68af03d446b61a9915a0ee3dc842d4e"
       }
     },
-    {
-      "name": "contractor-photo-to-quote",
-      "description": "Turns job-site and equipment photos into standardized trade estimates and quotes in Jobber or QuickBooks with multi-tier Good/Better/Best options in 5 minutes.",
-      "category": "commerce",
-      "icon": "📸",
-      "license": "MIT",
-      "homepage": "https://github.com/ZeebBoyBlue/contractor-photo-to-quote",
-      "source": {
-        "source": "github",
-        "repo": "ZeebBoyBlue/contractor-photo-to-quote",
-        "ref": "6c136186faaf03bcf125d202f0b1f51f97d94544"
-      }
-    },
     {
       "name": "contractor-voice-invoicer",
       "description": "Converts 20-second truck voice memos and job photos into itemized client invoices with custom labor rates, material markups, and one-click accounting staging.",
@@ -487,19 +474,6 @@
       "license": "MIT",
       "icon": "\ud83d\udcac"
     },
-    {
-      "name": "quickbooks-expense-categorizer",
-      "description": "Scans uncategorized QuickBooks Online expenses and bank feeds, matches receipts, and stages categorized entries with confidence scoring for 1-click batch review.",
-      "category": "commerce",
-      "icon": "🧾",
-      "license": "MIT",
-      "homepage": "https://github.com/ZeebBoyBlue/quickbooks-expense-categorizer",
-      "source": {
-        "source": "github",
-        "repo": "ZeebBoyBlue/quickbooks-expense-categorizer",
-        "ref": "120776619698cc3e9490caf5c756465f5caaa6c2"
-      }
-    },
     {
       "name": "reading-pal",
       "source": {

package/src/config/feature-flag-registry.json

@@ -560,6 +560,14 @@
       "description": "Streams an interactive virtual desktop from a platform-hosted, containerized assistant over /v1/desktop/stream. Requires platform hosting; self-hosted assistants are excluded. Off: the virtual desktop is hidden. On: the chat header offers its viewer and controls.",
       "defaultEnabled": false
     },
+    {
+      "id": "assistant-inbox",
+      "scope": "client",
+      "key": "assistant-inbox",
+      "label": "Assistant Inbox",
+      "description": "Shows an Assistant Inbox entry above Preferences in the web sidebar and the /assistant/inbox page it opens: a mailbox for the assistant's managed vellum.me address (received and sent, with a reading pane), the inline email setup card for entitled orgs with no address yet, and an upgrade card for orgs without the managed_email entitlement. With it on, email setup happens only there: the billing wizard hands off to the inbox instead of its own domain step, the billing page's finish-setup nudge gives way to the inbox's rail entry, and the Channels page's Email section points there instead of registering an address itself. Off hides the entry, redirects the route to chat, and keeps the older setup surfaces.",
+      "defaultEnabled": false
+    },
     {
       "id": "sidebar-done",
       "scope": "both",

package/src/config/schemas/llm.ts

@@ -74,7 +74,6 @@ export const KNOWN_LLM_PROVIDERS = [
   "litellm",
   "opencode",
   "baseten",
-  "ionet",
   "poolside",
   "typesafe",
   // Routing identities: "vellum" = the platform-managed route (upstream

package/src/providers/inference/adapter-factory.ts

@@ -35,7 +35,6 @@ import { AtlasCloudProvider } from "../atlascloud/client.js";
 import { BasetenProvider } from "../baseten/client.js";
 import { FireworksProvider } from "../fireworks/client.js";
 import { GeminiProvider } from "../gemini/client.js";
-import { IonetProvider } from "../ionet/client.js";
 import { JevProvider } from "../jev/client.js";
 import { MinimaxProvider } from "../minimax/client.js";
 import { PROVIDER_CATALOG } from "../model-catalog.js";
@@ -207,11 +206,6 @@ const ADAPTER_FACTORIES: Record<string, AdapterFactory> = {
       streamTimeoutMs,
       ...(baseURL ? { baseURL } : {}),
     }),
-  ionet: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
-    new IonetProvider(apiKey, model, {
-      streamTimeoutMs,
-      ...(baseURL ? { baseURL } : {}),
-    }),
   typesafe: ({ apiKey, model, streamTimeoutMs, baseURL }) =>
     new JevProvider(apiKey, model, {
       streamTimeoutMs,

package/src/providers/model-catalog.ts

@@ -2746,46 +2746,6 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
     apiKeyUrl: "https://app.baseten.co/settings/api_keys",
     apiKeyPlaceholder: "Your Baseten API key",
   },
-  {
-    id: "ionet",
-    displayName: "IO Intelligence",
-    subtitle:
-      "Open models served by IO Intelligence, io.net's inference platform (OpenAI-compatible). Requires an IO Intelligence API key.",
-    setupMode: "api-key",
-    setupHint:
-      "Enter your IO Intelligence API key to enable IO Intelligence models.",
-    envVar: "IONET_API_KEY",
-    credentialsGuide: {
-      description: "Sign in to io.net and create an IO Intelligence API key.",
-      url: "https://io.net/docs/guides/intelligence/api-keys-and-secrets",
-      linkLabel: "Open io.net",
-    },
-    // Model ids are Hugging Face-style `org/name`. Context windows and tool
-    // support come from the endpoint's live `GET /models` catalog, and every
-    // entry is accessible at the basic access tier.
-    models: [
-      {
-        id: "meta-llama/Llama-3.3-70B-Instruct",
-        displayName: "Llama 3.3 70B Instruct",
-        contextWindowTokens: 128000,
-        defaultContextWindowTokens: 128000,
-        maxOutputTokens: 4096,
-        supportsToolUse: true,
-      },
-      {
-        id: "openai/gpt-oss-20b",
-        displayName: "GPT-OSS 20B",
-        contextWindowTokens: 64000,
-        defaultContextWindowTokens: 64000,
-        maxOutputTokens: 32768,
-        supportsThinking: true,
-        supportsToolUse: true,
-      },
-    ],
-    defaultModel: "meta-llama/Llama-3.3-70B-Instruct",
-    apiKeyUrl: "https://io.net/docs/guides/intelligence/api-keys-and-secrets",
-    apiKeyPlaceholder: "Your IO Intelligence API key",
-  },
   {
     id: "poolside",
     displayName: "Poolside",

package/src/providers/openai/chat-completions-provider.ts

@@ -212,12 +212,6 @@ export interface OpenAIChatCompletionsProviderOptions {
    *  (Fireworks, Together) keep sending `none` / forced choices. Enabled for
    *  the generic `openai-compatible` adapter, whose upstream is unknown. */
   omitToolChoiceWhenReasoning?: boolean;
-  /** Send `tool_choice: "auto"` whenever tools are offered and the caller
-   *  left the choice unspecified. Strict OpenAI-compatible upstreams default
-   *  an unspecified `tool_choice` to "none" (io.net documents exactly that),
-   *  which would leave the model unable to call any tool; OpenAI's own
-   *  default is "auto", so this option only exists for upstreams that differ. */
-  defaultToolChoiceAuto?: boolean;
   /** Wire field for the output-token limit. OpenAI and OpenAI-compatible
    *  backends use `max_completion_tokens`. OpenRouter defaults to
    *  `max_tokens` because its parameter router matches that key on
@@ -870,7 +864,6 @@ export class OpenAIChatCompletionsProvider implements Provider {
   private coerceObjectArgsToJsonString: boolean;
   private salvageXmlToolCalls: boolean;
   private omitToolChoiceWhenReasoning: boolean;
-  private defaultToolChoiceAuto: boolean;
   private outputTokenLimitField: "max_completion_tokens" | "max_tokens";
 
   constructor(
@@ -903,7 +896,6 @@ export class OpenAIChatCompletionsProvider implements Provider {
       options.salvageXmlToolCalls ?? shouldSalvageXmlToolCalls(model);
     this.omitToolChoiceWhenReasoning =
       options.omitToolChoiceWhenReasoning ?? false;
-    this.defaultToolChoiceAuto = options.defaultToolChoiceAuto ?? false;
     this.outputTokenLimitField =
       options.outputTokenLimitField ?? "max_completion_tokens";
   }
@@ -966,15 +958,6 @@ export class OpenAIChatCompletionsProvider implements Provider {
           maxTokens;
       }
 
-      // Per-conversation prompt-cache key (OpenAI Chat Completions
-      // `prompt_cache_key`). `RetryProvider` stamps it from the durable
-      // conversation id for providers in PROMPT_CACHE_KEY_PROVIDERS; omitted
-      // from the wire when absent.
-      const promptCacheKey = configObj?.promptCacheKey;
-      if (typeof promptCacheKey === "string" && promptCacheKey.length > 0) {
-        params.prompt_cache_key = promptCacheKey;
-      }
-
       // Profile-scoped token biasing (e.g. the `suppress-cjk` preset). Resolved
       // and gated to this provider family upstream in `RetryProvider`.
       if (logitBias) {
@@ -1045,12 +1028,7 @@ export class OpenAIChatCompletionsProvider implements Provider {
         // wire. Catalog providers that honor `none` / forced choices still
         // receive them; the generic openai-compatible adapter drops every
         // explicit value in thinking mode via `omitToolChoiceWhenReasoning`.
-        const callerToolChoice = mapNeutralToolChoice(configObj?.tool_choice);
-        const toolChoice =
-          callerToolChoice ??
-          (this.defaultToolChoiceAuto
-            ? ("auto" as OpenAI.Chat.Completions.ChatCompletionToolChoiceOption)
-            : undefined);
+        const toolChoice = mapNeutralToolChoice(configObj?.tool_choice);
         xmlToolCallSalvageEnabled =
           this.salvageXmlToolCalls && toolChoice !== "none";
         if (toolChoice !== undefined) {

package/src/providers/retry.ts

@@ -78,16 +78,10 @@ const USAGE_ATTRIBUTION_HEADER_NAMES = {
   subagentSpawnMode: "X-Vellum-Subagent-Spawn-Mode",
 } as const;
 
-/** Providers whose transports consume `promptCacheKey` (OpenAI Responses /
- *  Chat Completions `prompt_cache_key`); `RetryProvider` derives it from
- *  `selectionSeed` for these only. `openai-compatible` is included so
- *  self-hosted bridges (e.g. a Claude Code shim) receive a stable
- *  per-conversation key and can pin server-side sessions / prompt caches to it. */
-const PROMPT_CACHE_KEY_PROVIDERS = new Set([
-  "openai",
-  "openrouter",
-  "openai-compatible",
-]);
+/** Providers whose transports consume `promptCacheKey` (OpenAI Responses
+ *  `prompt_cache_key`); `RetryProvider` derives it from `selectionSeed` for
+ *  these only. */
+const PROMPT_CACHE_KEY_PROVIDERS = new Set(["openai", "openrouter"]);
 
 /** Providers that support the `effort` config (extended thinking / reasoning). */
 const EFFORT_SUPPORTED_PROVIDERS = new Set([

package/src/runtime/migrations/__tests__/vbundle-streaming-validator.test.ts

@@ -30,7 +30,6 @@ import {
 import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
-  MANIFEST_MAX_BYTES,
 } from "../vbundle-validator.js";
 import { defaultV1Options } from "./v1-test-helpers.js";
 
@@ -203,16 +202,15 @@ describe("readAndValidateManifest — negative paths", () => {
   });
 
   test("throws manifest_too_large and fails fast before draining the whole body", async () => {
-    // Fake a tar entry whose body would emit 10x the cap if fully drained.
-    // The validator must destroy() the stream and throw the moment the
-    // running byte count crosses MANIFEST_MAX_BYTES; it must NOT keep
-    // pulling chunks.
+    // Fake a tar entry whose body would emit 5 MiB if fully drained. The
+    // validator must destroy() the stream and throw the moment the running
+    // byte count crosses the 1 MiB cap — it must NOT keep pulling chunks.
     //
     // We count bytes emitted via a _read implementation, and after the
-    // throw assert both that destroy() fired and that far less than the
-    // full body was ever pulled out of the stream.
-    const CHUNK = MANIFEST_MAX_BYTES / 2;
-    const TOTAL_CHUNKS = 20;
+    // throw assert both that destroy() fired and that far fewer than 5 MiB
+    // were ever pulled out of the stream.
+    const CHUNK = 512 * 1024; // 512 KiB
+    const TOTAL_CHUNKS = 10; // 5 MiB worth — way past the 1 MiB cap
     let chunksEmitted = 0;
     let bytesEmitted = 0;
     const body = new Readable({
@@ -247,34 +245,11 @@ describe("readAndValidateManifest — negative paths", () => {
     expect(err).toBeInstanceOf(StreamingValidationError);
     expect(err?.code).toBe("manifest_too_large");
     // Fail-fast assertions: destroy() was called, and we didn't drain past
-    // the cap + one chunk. If the validator had drained to EOF we'd see all
-    // 20 chunks here.
+    // ~1 MiB + one chunk. If the validator had drained to EOF we'd see the
+    // full 5 MiB / 10 chunks here.
     expect(body.destroyed).toBe(true);
     expect(chunksEmitted).toBeLessThanOrEqual(3);
-    expect(bytesEmitted).toBeLessThan(2 * MANIFEST_MAX_BYTES);
-  });
-
-  test("throws bundle_too_many_entries when manifest.contents exceeds maxEntries", async () => {
-    const { archive } = buildVBundle({
-      files: [
-        { path: "data/db/assistant.db", data: new Uint8Array() },
-        { path: "workspace/a.txt", data: new TextEncoder().encode("a") },
-        { path: "workspace/b.txt", data: new TextEncoder().encode("b") },
-      ],
-      ...defaultV1Options(),
-    });
-    const { entry, drainRest } = await firstEntryOf(archive);
-
-    let err: StreamingValidationError | null = null;
-    try {
-      await readAndValidateManifest(entry, { maxEntries: 2 });
-    } catch (e) {
-      err = e as StreamingValidationError;
-    }
-    await drainRest();
-
-    expect(err).toBeInstanceOf(StreamingValidationError);
-    expect(err?.code).toBe("bundle_too_many_entries");
+    expect(bytesEmitted).toBeLessThan(2 * 1024 * 1024);
   });
 
   test("throws manifest_malformed when manifest body is not valid JSON", async () => {

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -19,8 +19,6 @@ import {
   canonicalizeJson,
   computeLegacyManifestSha256,
   computeManifestChecksum,
-  MANIFEST_MAX_BYTES,
-  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   validateVBundle,
 } from "../vbundle-validator.js";
@@ -176,52 +174,6 @@ describe("ManifestSchema — v1 acceptance", () => {
   });
 });
 
-describe("validateVBundle: streaming manifest limits", () => {
-  test("rejects a manifest over MANIFEST_MAX_BYTES with MANIFEST_TOO_LARGE", () => {
-    const oversized = new Uint8Array(MANIFEST_MAX_BYTES + 1).fill(0x20);
-    const archive = gzipSync(
-      tarArchive([{ name: "manifest.json", data: oversized }]),
-    );
-    const result = validateVBundle(archive, { enforceStreamingLimits: true });
-    expect(result.is_valid).toBe(false);
-    expect(result.errors.map((e) => e.code)).toEqual(["MANIFEST_TOO_LARGE"]);
-  });
-
-  test("rejects a manifest declaring more than MANIFEST_MAX_ENTRIES with MANIFEST_TOO_MANY_ENTRIES", () => {
-    const skeleton = v1Skeleton();
-    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
-    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
-      ...dbEntry,
-      path: `workspace/${i}`,
-    }));
-    const archive = gzipTarOf(
-      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
-    );
-    const result = validateVBundle(archive, { enforceStreamingLimits: true });
-    expect(result.is_valid).toBe(false);
-    expect(result.errors.map((e) => e.code)).toEqual([
-      "MANIFEST_TOO_MANY_ENTRIES",
-    ]);
-  });
-
-  test("does not apply the limits unless enforceStreamingLimits is set", () => {
-    const skeleton = v1Skeleton();
-    const dbEntry = (skeleton.contents as Array<Record<string, unknown>>)[0]!;
-    const extra = Array.from({ length: MANIFEST_MAX_ENTRIES }, (_, i) => ({
-      ...dbEntry,
-      path: `workspace/${i}`,
-    }));
-    const archive = gzipTarOf(
-      withChecksum({ ...skeleton, contents: [dbEntry, ...extra] }),
-      [{ name: "data/db/assistant.db", data: DB_BYTES }],
-    );
-    const result = validateVBundle(archive);
-    expect(result.errors.map((e) => e.code)).not.toContain(
-      "MANIFEST_TOO_MANY_ENTRIES",
-    );
-  });
-});
-
 describe("ManifestSchema — v1 rejection", () => {
   test("rejects schema_version !== 1", () => {
     const manifest = withChecksum({ ...v1Skeleton(), schema_version: 2 });

package/src/runtime/migrations/vbundle-builder.ts

@@ -31,11 +31,9 @@ import { sanitizeConfigForTransfer } from "../../config/sanitize-for-transfer.js
 import { trackDaemonActivity } from "../../daemon/activity-trail.js";
 import { getLogger } from "../../util/logger.js";
 import type { VBundleOriginMode } from "./origin-mode.js";
-import {
-  MANIFEST_MAX_BYTES,
-  MANIFEST_MAX_ENTRIES,
-  type ManifestFileEntryType,
-  type ManifestType,
+import type {
+  ManifestFileEntryType,
+  ManifestType,
 } from "./vbundle-validator.js";
 
 // ---------------------------------------------------------------------------
@@ -402,20 +400,6 @@ function buildManifestObject(input: {
   const checksum = sha256Hex(canonicalizeJson(manifestWithEmptyChecksum));
   const manifest: ManifestType = { ...manifestWithEmptyChecksum, checksum };
   const manifestData = new TextEncoder().encode(JSON.stringify(manifest));
-  if (
-    manifest.contents.length > MANIFEST_MAX_ENTRIES ||
-    manifestData.length > MANIFEST_MAX_BYTES
-  ) {
-    getLogger("vbundle-builder").warn(
-      {
-        entries: manifest.contents.length,
-        manifestBytes: manifestData.length,
-        maxEntries: MANIFEST_MAX_ENTRIES,
-        maxBytes: MANIFEST_MAX_BYTES,
-      },
-      "Bundle manifest exceeds the streaming import limits; teleport and staged-path imports will reject this bundle",
-    );
-  }
   return { manifest, manifestData };
 }
 

package/src/runtime/migrations/vbundle-streaming-importer.ts

@@ -69,10 +69,7 @@ import {
   verifySymlinkEntry,
 } from "./vbundle-streaming-validator.js";
 import { parseVBundleStream } from "./vbundle-tar-stream.js";
-import {
-  MANIFEST_MAX_ENTRIES,
-  type ManifestType,
-} from "./vbundle-validator.js";
+import type { ManifestType } from "./vbundle-validator.js";
 
 const log = getLogger("vbundle-streaming-importer");
 
@@ -94,11 +91,11 @@ const log = getLogger("vbundle-streaming-importer");
 const DEFAULT_MAX_BUNDLE_BYTES = 16 * 1024 * 1024 * 1024;
 
 /**
- * Entry-count ceiling for the bundle, shared with manifest validation so
- * preflight and import agree. Also applied to tar-level entries so padding
- * extras cannot exceed what the manifest declared.
+ * Entry-count ceiling for the bundle. 100k is well above the largest
+ * workspace we ship; anything past that is almost certainly an attack or
+ * a corrupted archive.
  */
-const DEFAULT_MAX_BUNDLE_ENTRIES = MANIFEST_MAX_ENTRIES;
+const DEFAULT_MAX_BUNDLE_ENTRIES = 100_000;
 
 /**
  * Prefixes used for scratch dirs the streaming importer creates INSIDE the
@@ -156,7 +153,7 @@ export interface StreamCommitArgs {
   maxBundleBytes?: number;
   /**
    * Test-only override for the entry-count ceiling. Production callers
-   * should omit this and rely on the `MANIFEST_MAX_ENTRIES` default.
+   * should omit this and rely on the 100_000 default.
    */
   maxBundleEntries?: number;
 }
@@ -316,9 +313,7 @@ export async function streamCommitImport(
       if (entryIndex === 0) {
         // First entry MUST be manifest.json — readAndValidateManifest
         // enforces that and throws StreamingValidationError otherwise.
-        const manifestResult = await readAndValidateManifest(entry, {
-          maxEntries: bundleEntryCap,
-        });
+        const manifestResult = await readAndValidateManifest(entry);
         manifest = manifestResult.manifest;
         expected = manifestResult.expected;
 
@@ -345,8 +340,18 @@ export async function streamCommitImport(
           );
         }
 
-        // Only NOW, after the manifest is parsed (including its entry-count
-        // ceiling) and the version gate passes, do we materialize the
+        // Entry-count ceiling check. The manifest declares every file the
+        // bundle claims to contain, so one check here bounds the work the
+        // importer is willing to do for this bundle.
+        if (manifest.contents.length > bundleEntryCap) {
+          throw new StreamingValidationError(
+            "bundle_too_many_entries",
+            `bundle contains more than ${bundleEntryCap} entries (declared: ${manifest.contents.length})`,
+          );
+        }
+
+        // Only NOW — after the manifest is parsed, the version gate passes,
+        // and the entry-count ceiling is enforced — do we materialize the
         // temp staging dir on disk. Doing this lazily preserves the plan
         // invariant that importers gate on runtime-version compat BEFORE
         // any state mutation. If this throws, the outer catch runs

package/src/runtime/migrations/vbundle-streaming-validator.ts

@@ -28,8 +28,6 @@ import {
   computeLegacyManifestSha256,
   computeManifestChecksum,
   LegacyManifestSchema,
-  MANIFEST_MAX_BYTES,
-  MANIFEST_MAX_ENTRIES,
   ManifestSchema,
   type ManifestType,
   translateLegacyManifest,
@@ -76,17 +74,21 @@ export class StreamingValidationError extends Error {
 // Manifest validation
 // ---------------------------------------------------------------------------
 
+// Manifests are metadata only — typically tens to hundreds of KB even for
+// huge bundles. A 1 MiB cap is comfortably above realistic sizes and
+// protects against a malicious archive whose "manifest" is actually a
+// multi-GB stream intended to OOM the validator.
+const MANIFEST_MAX_BYTES = 1 * 1024 * 1024;
+
 /**
  * Drain the first tar entry — which MUST be `manifest.json` — and run the
  * full manifest-level validation pipeline:
  *   1. Entry name check.
- *   2. Size cap (`MANIFEST_MAX_BYTES`).
+ *   2. Size cap (1 MiB).
  *   3. JSON parse.
  *   4. Zod schema validation.
  *   5. Self-referencing `checksum` verification against the
  *      canonicalized JSON (minus that field).
- *   6. Entry-count ceiling on `contents` (`maxEntries`, default
- *      `MANIFEST_MAX_ENTRIES`).
  *
  * On success, returns the parsed manifest plus a `Map` keyed by archive
  * path that callers consult as each subsequent entry streams past.
@@ -96,9 +98,7 @@ export class StreamingValidationError extends Error {
  */
 export async function readAndValidateManifest(
   first: StreamedTarEntry,
-  options: { maxEntries?: number } = {},
 ): Promise<ManifestReadResult> {
-  const maxEntries = options.maxEntries ?? MANIFEST_MAX_ENTRIES;
   if (first.header.name !== "manifest.json") {
     // Drain the body so the underlying tar extractor isn't left dangling
     // on backpressure before the caller reports the error.
@@ -186,13 +186,6 @@ export async function readAndValidateManifest(
     manifest = translateLegacyManifest(legacy);
   }
 
-  if (manifest.contents.length > maxEntries) {
-    throw new StreamingValidationError(
-      "bundle_too_many_entries",
-      `bundle contains more than ${maxEntries} entries (declared: ${manifest.contents.length})`,
-    );
-  }
-
   const expected = new Map<
     string,
     { sha256: string; size: number; linkTarget: string | null }

package/src/runtime/migrations/vbundle-validator.ts

@@ -381,33 +381,6 @@ export function computeManifestChecksum(manifest: unknown): string {
 // Core validation
 // ---------------------------------------------------------------------------
 
-/**
- * Hard caps on `manifest.json`, shared by the buffered and streaming
- * validators so preflight and import agree on what is acceptable. The two
- * are sized together: the manifest carries one `contents` entry (path,
- * sha256, size) per bundled file at roughly 150 bytes each, so 200,000
- * entries serialize to about 32 MiB.
- *
- * That absorbs a workspace with a stray dependency install or checked-out
- * repo while still bounding the transient memory a hostile "manifest" can
- * force the importer to hold (buffer, decoded string, parsed object,
- * canonical re-serialization for the self-checksum) and the per-entry work
- * it commits to, on a memory-constrained pod.
- */
-export const MANIFEST_MAX_BYTES = 32 * 1024 * 1024;
-export const MANIFEST_MAX_ENTRIES = 200_000;
-
-export interface ValidateVBundleOptions {
-  /**
-   * Reject manifests over `MANIFEST_MAX_BYTES` or `MANIFEST_MAX_ENTRIES`.
-   * Preflights that precede a streaming import set this so they never
-   * approve a bundle the import will refuse. The buffered import path
-   * (`commitImport`) has no such ceilings, so it stays off there to keep
-   * existing large backups restorable.
-   */
-  enforceStreamingLimits?: boolean;
-}
-
 // Only manifest.json is structurally required. The DB and config live under
 // workspace/ (new format) or data/db/ + config/ (old format) — both are valid.
 const REQUIRED_ENTRIES = ["manifest.json"];
@@ -424,10 +397,7 @@ const MAX_DECOMPRESSED_SIZE = 2 * 1024 * 1024 * 1024;
  * 3. Manifest checksum (SHA-256 of canonicalized JSON with the `checksum` field set to empty string)
  * 4. Per-file content integrity (SHA-256 of each file vs manifest declaration)
  */
-export function validateVBundle(
-  data: Uint8Array,
-  { enforceStreamingLimits = false }: ValidateVBundleOptions = {},
-): VBundleValidationResult {
+export function validateVBundle(data: Uint8Array): VBundleValidationResult {
   const errors: ValidationError[] = [];
 
   // Step 1: Decompress gzip with size cap to prevent zip-bomb DoS
@@ -485,17 +455,6 @@ export function validateVBundle(
   }
 
   // Step 4: Parse and validate manifest schema
-  if (
-    enforceStreamingLimits &&
-    manifestEntry.data.length > MANIFEST_MAX_BYTES
-  ) {
-    errors.push({
-      code: "MANIFEST_TOO_LARGE",
-      message: `manifest.json exceeds ${MANIFEST_MAX_BYTES} byte limit (${manifestEntry.data.length} bytes)`,
-      path: "manifest.json",
-    });
-    return { is_valid: false, errors };
-  }
   let manifestRaw: unknown;
   try {
     manifestRaw = JSON.parse(new TextDecoder().decode(manifestEntry.data));
@@ -564,18 +523,6 @@ export function validateVBundle(
     manifest = translateLegacyManifest(legacy);
   }
 
-  if (
-    enforceStreamingLimits &&
-    manifest.contents.length > MANIFEST_MAX_ENTRIES
-  ) {
-    errors.push({
-      code: "MANIFEST_TOO_MANY_ENTRIES",
-      message: `manifest.json declares more than ${MANIFEST_MAX_ENTRIES} entries (${manifest.contents.length})`,
-      path: "manifest.json",
-    });
-    return { is_valid: false, errors };
-  }
-
   // Step 6: Verify per-file content integrity
   const manifestFilePaths = new Set(manifest.contents.map((f) => f.path));
 

package/src/runtime/routes/migration-routes.ts

@@ -2056,9 +2056,7 @@ export async function handleMigrationPreflightFromGcs({
   }
 
   const bytes = new Uint8Array(await upstream.arrayBuffer());
-  const validationResult = validateVBundle(bytes, {
-    enforceStreamingLimits: true,
-  });
+  const validationResult = validateVBundle(bytes);
 
   if (!validationResult.is_valid || !validationResult.manifest) {
     return {

package/src/tools/host-terminal/host-shell.ts

@@ -486,7 +486,7 @@ export const hostShellTool = {
       // Only the first handler to fire should wake the agent.
       let completed = false;
 
-      child.on("close", (code, signal) => {
+      child.on("close", (code) => {
         if (completed) {
           return;
         }
@@ -494,7 +494,6 @@ export const hostShellTool = {
         clearTimeout(timer);
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
-          signal: aborted ? null : signal,
         });
         // Cancel takes precedence over the SIGKILL-induced error result.
         const status = aborted
@@ -668,13 +667,12 @@ export const hostShellTool = {
         }
       }
 
-      child.on("close", (code, signal) => {
+      child.on("close", (code) => {
         clearTimeout(timer);
         context.signal?.removeEventListener("abort", onAbort);
 
         const result = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
-          signal: context.signal?.aborted ? null : signal,
         });
 
         resolve({

package/src/tools/shared/shell-output.test.ts

@@ -112,45 +112,3 @@ describe("formatShellOutput truncation", () => {
     expect(result.content).toContain(OUTPUT_TRUNCATED_TAG);
   });
 });
-
-describe("formatShellOutput kill reporting", () => {
-  test("names the signal and hints at memory for a SIGKILL", () => {
-    const result = formatShellOutput("", "", null, false, 120, {
-      signal: "SIGKILL",
-    });
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain('<command_killed signal="SIGKILL" />');
-    expect(result.content).toContain("out of memory");
-    expect(result.content).not.toContain('code="null"');
-    expect(result.status).toBe('<command_killed signal="SIGKILL" />');
-  });
-
-  test("keeps the output produced before the kill", () => {
-    const result = formatShellOutput("partial", "", null, false, 120, {
-      signal: "SIGTERM",
-    });
-    expect(result.content.startsWith("partial\n")).toBe(true);
-    expect(result.content).toContain("killed by SIGTERM");
-    expect(result.content).not.toContain("out of memory");
-  });
-
-  test("does not infer a kill from a 128 + n exit code", () => {
-    const result = formatShellOutput("", "Killed", 137, false, 120);
-    expect(result.content).toBe("Killed");
-    expect(result.status).toBe('<command_exit code="137" />');
-  });
-
-  test("leaves a timeout framed as a timeout", () => {
-    const result = formatShellOutput("", "", null, true, 120, {
-      signal: "SIGKILL",
-    });
-    expect(result.content).toContain("<command_timeout");
-    expect(result.content).not.toContain("command_killed");
-  });
-
-  test("leaves an ordinary failure unchanged", () => {
-    const result = formatShellOutput("", "boom", 1, false, 120);
-    expect(result.content).toBe("boom");
-    expect(result.status).toBe('<command_exit code="1" />');
-  });
-});

package/src/tools/shared/shell-output.ts

@@ -13,15 +13,6 @@ export interface ShellOutputResult {
   isError: boolean;
 }
 
-function describeKill(signal: NodeJS.Signals): string {
-  const tag = `<command_killed signal="${signal}" />`;
-  const hint =
-    signal === "SIGKILL"
-      ? " A SIGKILL the command did not send itself usually means the system ran out of memory."
-      : "";
-  return `${tag}\nCommand was killed by ${signal} before it finished.${hint}`;
-}
-
 type StdioStream = "stdout" | "stderr";
 
 type DataListener = (data: Buffer | string) => void;
@@ -43,11 +34,7 @@ export function formatShellOutput(
   code: number | null,
   timedOut: boolean,
   timeoutSec: number,
-  options?: {
-    truncated?: boolean;
-    started?: boolean;
-    signal?: NodeJS.Signals | null;
-  },
+  options?: { truncated?: boolean; started?: boolean },
 ): ShellOutputResult {
   if (options?.started === false) {
     return {
@@ -79,12 +66,6 @@ export function formatShellOutput(
     statusParts.push(OUTPUT_TRUNCATED_TAG);
   }
 
-  const killSignal = timedOut ? null : (options?.signal ?? null);
-  if (killSignal) {
-    output += (output ? "\n" : "") + describeKill(killSignal);
-    statusParts.push(`<command_killed signal="${killSignal}" />`);
-  }
-
   if (!output.trim()) {
     if (code === 0) {
       output = "<command_completed />";
@@ -93,7 +74,7 @@ export function formatShellOutput(
       output = `${exitTag}\nCommand failed with exit code ${code}. No stdout or stderr output was produced.`;
       statusParts.push(exitTag);
     }
-  } else if (code !== 0 && !timedOut && !killSignal) {
+  } else if (code !== 0 && !timedOut) {
     statusParts.push(`<command_exit code="${code}" />`);
   }
 
@@ -167,7 +148,7 @@ export class BoundedStdioCollector {
     code: number | null,
     timedOut: boolean,
     timeoutSec: number,
-    options?: { started?: boolean; signal?: NodeJS.Signals | null },
+    options?: { started?: boolean },
   ): ShellOutputResult {
     return formatShellOutput(
       Buffer.concat(this.stdoutParts).toString(),
@@ -175,11 +156,7 @@ export class BoundedStdioCollector {
       code,
       timedOut,
       timeoutSec,
-      {
-        truncated: this.truncated,
-        started: options?.started,
-        signal: options?.signal,
-      },
+      { truncated: this.truncated, started: options?.started },
     );
   }
 }

package/src/tools/terminal/shell.ts

@@ -374,7 +374,6 @@ export const shellTool = {
 
         const fmtResult = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
-          signal: aborted ? null : signal,
         });
 
         const status: BackgroundToolCompletedEvent["status"] = aborted
@@ -586,7 +585,6 @@ export const shellTool = {
 
         const fmtResult = collector.format(code, timedOut, timeoutSec, {
           started: launch.didStart(),
-          signal: context.signal?.aborted ? null : signal,
         });
 
         resolve({

package/src/providers/ionet/client.test.ts

@@ -1,143 +0,0 @@
-/**
- * Verifies the IO Intelligence (io.net) provider wiring: the SDK client must
- * resolve to the documented IO Intelligence chat-completions endpoint unless
- * an explicit override is supplied (custom-connection / test usage).
- */
-
-import { describe, expect, test } from "bun:test";
-
-import { IonetProvider } from "./client.js";
-
-type MockChunk = {
-  choices: Array<{
-    delta: { content?: string | null };
-    finish_reason?: string | null;
-  }>;
-  usage?: { prompt_tokens: number; completion_tokens: number };
-};
-
-const OK_CHUNKS: MockChunk[] = [
-  {
-    choices: [{ delta: { content: "ok" }, finish_reason: "stop" }],
-    usage: { prompt_tokens: 1, completion_tokens: 1 },
-  },
-];
-
-function makeStream(chunks: MockChunk[]): AsyncIterable<MockChunk> {
-  return {
-    async *[Symbol.asyncIterator]() {
-      for (const c of chunks) {
-        yield c;
-      }
-    },
-  };
-}
-
-function clientOf(provider: IonetProvider) {
-  return (
-    provider as unknown as {
-      client: {
-        baseURL: string;
-        chat: {
-          completions: {
-            create: (params: unknown) => Promise<AsyncIterable<MockChunk>>;
-          };
-        };
-      };
-    }
-  ).client;
-}
-
-describe("IonetProvider", () => {
-  test("defaults the SDK client to the IO Intelligence endpoint", async () => {
-    const provider = new IonetProvider(
-      "test-key",
-      "meta-llama/Llama-3.3-70B-Instruct",
-    );
-
-    const client = clientOf(provider);
-    expect(client.baseURL).toBe("https://api.intelligence.io.solutions/api/v1");
-
-    // The same base URL must be reported on the response, read off the live
-    // client instance rather than a constant.
-    client.chat.completions.create = async () => makeStream(OK_CHUNKS);
-    const response = await provider.sendMessage([
-      { role: "user", content: [{ type: "text", text: "hi" }] },
-    ]);
-    expect(response.resolvedEndpoint).toBe(
-      "https://api.intelligence.io.solutions/api/v1",
-    );
-  });
-
-  test("sends tool_choice auto when tools are offered without an explicit choice", async () => {
-    // io.net defaults an unspecified tool_choice to "none" (not OpenAI's
-    // "auto"), so the provider must send the explicit default or the model
-    // could never invoke an offered tool.
-    const provider = new IonetProvider(
-      "test-key",
-      "meta-llama/Llama-3.3-70B-Instruct",
-    );
-    const client = clientOf(provider);
-
-    let seenParams:
-      | {
-          tools?: unknown;
-          tool_choice?: unknown;
-        }
-      | undefined;
-    client.chat.completions.create = async (params) => {
-      seenParams = params as { tools?: unknown; tool_choice?: unknown };
-      return makeStream(OK_CHUNKS);
-    };
-    await provider.sendMessage(
-      [{ role: "user", content: [{ type: "text", text: "hi" }] }],
-      {
-        tools: [
-          {
-            name: "get_weather",
-            description: "Get the weather",
-            input_schema: { type: "object", properties: {} },
-          },
-        ],
-      },
-    );
-    expect(Array.isArray(seenParams?.tools)).toBe(true);
-    expect(seenParams?.tool_choice).toBe("auto");
-
-    // An explicit caller choice still wins.
-    let forcedParams: { tool_choice?: unknown } | undefined;
-    client.chat.completions.create = async (params) => {
-      forcedParams = params as { tool_choice?: unknown };
-      return makeStream(OK_CHUNKS);
-    };
-    await provider.sendMessage(
-      [{ role: "user", content: [{ type: "text", text: "hi" }] }],
-      {
-        tools: [
-          {
-            name: "get_weather",
-            description: "Get the weather",
-            input_schema: { type: "object", properties: {} },
-          },
-        ],
-        config: { tool_choice: { type: "none" } },
-      },
-    );
-    expect(forcedParams?.tool_choice).toBe("none");
-  });
-
-  test("honours an explicit baseURL override", async () => {
-    const provider = new IonetProvider("test-key", "test-model", {
-      baseURL: "https://inference.example.test/v1",
-    });
-
-    const client = clientOf(provider);
-    expect(client.baseURL).toBe("https://inference.example.test/v1");
-
-    client.chat.completions.create = async () => makeStream(OK_CHUNKS);
-    const response = await provider.sendMessage([
-      { role: "user", content: [{ type: "text", text: "hi" }] },
-    ]);
-    expect(response.resolvedEndpoint).toBe("https://inference.example.test/v1");
-  });
-});

package/src/providers/ionet/client.ts

@@ -1,37 +0,0 @@
-import { OpenAIChatCompletionsProvider } from "../openai/chat-completions-provider.js";
-
-export interface IonetProviderOptions {
-  apiKey?: string;
-  baseURL?: string;
-  streamTimeoutMs?: number;
-}
-
-const DEFAULT_IONET_BASE_URL = "https://api.intelligence.io.solutions/api/v1";
-
-/**
- * IO Intelligence (io.net) serves an OpenAI chat-completions API with
- * Hugging Face-style `org/name` model ids, so it rides the shared
- * chat-completions client with its own default base URL.
- */
-export class IonetProvider extends OpenAIChatCompletionsProvider {
-  constructor(
-    apiKey: string,
-    model: string,
-    options: IonetProviderOptions = {},
-  ) {
-    super(apiKey, model, {
-      baseURL: options.baseURL?.trim() || DEFAULT_IONET_BASE_URL,
-      providerName: "ionet",
-      providerLabel: "IO Intelligence",
-      streamTimeoutMs: options.streamTimeoutMs,
-      // IO Intelligence serves DeepSeek- and GLM-style thinking models whose
-      // reasoning arrives as `reasoning_content`; replay it there so
-      // follow-up requests that include tools stay acceptable upstream.
-      assistantReasoningField: "reasoning_content",
-      // io.net defaults an unspecified `tool_choice` to "none" (unlike
-      // OpenAI's "auto"), so tools offered without an explicit choice must
-      // still send one or the model could never invoke them.
-      defaultToolChoiceAuto: true,
-    });
-  }
-}