@vellumai/assistant 0.5.15 → 0.6.0

package/src/config/bundled-tool-registry.ts

@@ -56,7 +56,7 @@ import * as contactMerge from "./bundled-skills/contacts/tools/contact-merge.js"
 import * as contactSearch from "./bundled-skills/contacts/tools/contact-search.js";
 import * as contactUpsert from "./bundled-skills/contacts/tools/contact-upsert.js";
 import * as googleContacts from "./bundled-skills/contacts/tools/google-contacts.js";
-// ── conversations ─────────────────────────────────────────────────────────────
+// ── conversations ──────────────────────────────────────────────────────────────
 import * as renameConversation from "./bundled-skills/conversations/tools/rename-conversation.js";
 // ── document ───────────────────────────────────────────────────────────────────
 import * as documentCreate from "./bundled-skills/document/tools/document-create.js";
@@ -107,6 +107,25 @@ import * as messagingSend from "./bundled-skills/messaging/tools/messaging-send.
 import * as messagingSenderDigest from "./bundled-skills/messaging/tools/messaging-sender-digest.js";
 // ── notifications ──────────────────────────────────────────────────────────────
 import * as sendNotification from "./bundled-skills/notifications/tools/send-notification.js";
+// ── outlook ────────────────────────────────────────────────────────────────────
+import * as outlookAttachments from "./bundled-skills/outlook/tools/outlook-attachments.js";
+import * as outlookCategories from "./bundled-skills/outlook/tools/outlook-categories.js";
+import * as outlookDraft from "./bundled-skills/outlook/tools/outlook-draft.js";
+import * as outlookFollowUp from "./bundled-skills/outlook/tools/outlook-follow-up.js";
+import * as outlookForward from "./bundled-skills/outlook/tools/outlook-forward.js";
+import * as outlookOutreachScan from "./bundled-skills/outlook/tools/outlook-outreach-scan.js";
+import * as outlookRules from "./bundled-skills/outlook/tools/outlook-rules.js";
+import * as outlookSendDraft from "./bundled-skills/outlook/tools/outlook-send-draft.js";
+import * as outlookSenderDigest from "./bundled-skills/outlook/tools/outlook-sender-digest.js";
+import * as outlookTrash from "./bundled-skills/outlook/tools/outlook-trash.js";
+import * as outlookUnsubscribe from "./bundled-skills/outlook/tools/outlook-unsubscribe.js";
+import * as outlookVacation from "./bundled-skills/outlook/tools/outlook-vacation.js";
+// ── outlook-calendar ───────────────────────────────────────────────────────────
+import * as outlookCalendarCheckAvailability from "./bundled-skills/outlook-calendar/tools/outlook-calendar-check-availability.js";
+import * as outlookCalendarCreateEvent from "./bundled-skills/outlook-calendar/tools/outlook-calendar-create-event.js";
+import * as outlookCalendarGetEvent from "./bundled-skills/outlook-calendar/tools/outlook-calendar-get-event.js";
+import * as outlookCalendarListEvents from "./bundled-skills/outlook-calendar/tools/outlook-calendar-list-events.js";
+import * as outlookCalendarRsvp from "./bundled-skills/outlook-calendar/tools/outlook-calendar-rsvp.js";
 // ── phone-calls ────────────────────────────────────────────────────────────────
 import * as callEnd from "./bundled-skills/phone-calls/tools/call-end.js";
 import * as callStart from "./bundled-skills/phone-calls/tools/call-start.js";
@@ -290,6 +309,39 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   // notifications
   ["notifications:tools/send-notification.ts", sendNotification],
 
+  // outlook
+  ["outlook:tools/outlook-rules.ts", outlookRules],
+  ["outlook:tools/outlook-vacation.ts", outlookVacation],
+  ["outlook:tools/outlook-sender-digest.ts", outlookSenderDigest],
+  ["outlook:tools/outlook-outreach-scan.ts", outlookOutreachScan],
+  ["outlook:tools/outlook-draft.ts", outlookDraft],
+  ["outlook:tools/outlook-send-draft.ts", outlookSendDraft],
+  ["outlook:tools/outlook-forward.ts", outlookForward],
+  ["outlook:tools/outlook-trash.ts", outlookTrash],
+  ["outlook:tools/outlook-categories.ts", outlookCategories],
+  ["outlook:tools/outlook-follow-up.ts", outlookFollowUp],
+  ["outlook:tools/outlook-unsubscribe.ts", outlookUnsubscribe],
+  ["outlook:tools/outlook-attachments.ts", outlookAttachments],
+
+  // outlook-calendar
+  [
+    "outlook-calendar:tools/outlook-calendar-list-events.ts",
+    outlookCalendarListEvents,
+  ],
+  [
+    "outlook-calendar:tools/outlook-calendar-get-event.ts",
+    outlookCalendarGetEvent,
+  ],
+  [
+    "outlook-calendar:tools/outlook-calendar-create-event.ts",
+    outlookCalendarCreateEvent,
+  ],
+  [
+    "outlook-calendar:tools/outlook-calendar-check-availability.ts",
+    outlookCalendarCheckAvailability,
+  ],
+  ["outlook-calendar:tools/outlook-calendar-rsvp.ts", outlookCalendarRsvp],
+
   // phone-calls
   ["phone-calls:tools/call-start.ts", callStart],
   ["phone-calls:tools/call-status.ts", callStatus],
@@ -322,12 +374,12 @@ export const bundledToolRegistry = new Map<string, SkillToolScript>([
   ["sequences:tools/sequence-analytics.ts", sequenceAnalytics],
 
   // settings
-  ["settings:tools/avatar-get.ts", avatarGet],
-  ["settings:tools/avatar-update.ts", avatarUpdate],
-  ["settings:tools/avatar-remove.ts", avatarRemove],
   ["settings:tools/voice-config-update.ts", voiceConfigUpdate],
   ["settings:tools/open-system-settings.ts", openSystemSettings],
   ["settings:tools/navigate-settings-tab.ts", navigateSettingsTab],
+  ["settings:tools/avatar-update.ts", avatarUpdate],
+  ["settings:tools/avatar-remove.ts", avatarRemove],
+  ["settings:tools/avatar-get.ts", avatarGet],
 
   // skill-management
   ["skill-management:tools/scaffold-managed.ts", scaffoldManaged],

package/src/config/env-registry.ts

@@ -45,17 +45,24 @@ export function getIsContainerized(): boolean {
 }
 
 /**
- * Whether this assistant is running as a platform-managed remote instance.
+ * IS_PLATFORM — boolean, default: false
+ * When true, indicates the assistant is running as a platform-managed
+ * remote instance. Controls platform-specific behaviors like webhook
+ * callback registration and blocking `platform disconnect`.
  *
- * Currently this is determined solely by the IS_CONTAINERIZED env var, which
- * the platform sets when provisioning assistant containers. This is not ideal
- * because any Docker environment could set it. We plan to replace this with a
- * less spoof-able mechanism in the future — e.g. a signed platform token
- * verified via asymmetric cryptography or an authenticated attestation
- * endpoint on the platform.
+ * Separate from IS_CONTAINERIZED because local Docker assistants are
+ * containerized (need CES sidecar, gateway trust store, etc.) but are
+ * not platform-managed.
+ */
+export function getIsPlatform(): boolean {
+  return flag("IS_PLATFORM");
+}
+
+/**
+ * Whether this assistant is running as a platform-managed remote instance.
  */
 export function isPlatformRemote(): boolean {
-  return getIsContainerized();
+  return getIsPlatform();
 }
 
 /**

package/src/config/feature-flag-registry.json

@@ -18,21 +18,13 @@
       "defaultEnabled": false
     },
     {
-      "id": "platform-hosted-enabled",
+      "id": "local-docker-enabled",
       "scope": "macos",
-      "key": "platform-hosted-enabled",
-      "label": "Platform Hosted Assistants",
-      "description": "Enable the Vellum Cloud hosting option on the Hosting screen",
+      "key": "local-docker-enabled",
+      "label": "Local Docker Mode",
+      "description": "When enabled, the Local hosting option uses Docker under the hood for sandboxed execution, hiding the separate Docker card",
       "defaultEnabled": false
     },
-    {
-      "id": "contacts",
-      "scope": "assistant",
-      "key": "contacts",
-      "label": "Contacts",
-      "description": "Show the Contacts tab in Settings for viewing and managing contacts",
-      "defaultEnabled": true
-    },
     {
       "id": "email-channel",
       "scope": "assistant",
@@ -137,102 +129,6 @@
       "description": "Enable managed (organization-hosted) sign-in flow in the onboarding experience",
       "defaultEnabled": true
     },
-    {
-      "id": "integration-twitter",
-      "scope": "assistant",
-      "key": "integration-twitter",
-      "label": "Twitter / X Integration",
-      "description": "Enable the Twitter / X OAuth setup skill for connecting to the Twitter API",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-github",
-      "scope": "assistant",
-      "key": "integration-github",
-      "label": "GitHub Integration",
-      "description": "Enable the GitHub OAuth setup skill for connecting to GitHub",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-linear",
-      "scope": "assistant",
-      "key": "integration-linear",
-      "label": "Linear Integration",
-      "description": "Enable the Linear OAuth setup skill for connecting to Linear",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-spotify",
-      "scope": "assistant",
-      "key": "integration-spotify",
-      "label": "Spotify Integration",
-      "description": "Enable the Spotify OAuth setup skill for connecting to the Spotify API",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-todoist",
-      "scope": "assistant",
-      "key": "integration-todoist",
-      "label": "Todoist Integration",
-      "description": "Enable the Todoist OAuth setup skill for connecting to Todoist",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-discord",
-      "scope": "assistant",
-      "key": "integration-discord",
-      "label": "Discord Integration",
-      "description": "Enable the Discord OAuth setup skill for connecting to Discord",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-dropbox",
-      "scope": "assistant",
-      "key": "integration-dropbox",
-      "label": "Dropbox Integration",
-      "description": "Enable the Dropbox OAuth setup skill for connecting to Dropbox",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-asana",
-      "scope": "assistant",
-      "key": "integration-asana",
-      "label": "Asana Integration",
-      "description": "Enable the Asana OAuth setup skill for connecting to Asana",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-airtable",
-      "scope": "assistant",
-      "key": "integration-airtable",
-      "label": "Airtable Integration",
-      "description": "Enable the Airtable OAuth setup skill for connecting to Airtable",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-hubspot",
-      "scope": "assistant",
-      "key": "integration-hubspot",
-      "label": "HubSpot Integration",
-      "description": "Enable the HubSpot OAuth setup skill for connecting to HubSpot CRM",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-figma",
-      "scope": "assistant",
-      "key": "integration-figma",
-      "label": "Figma Integration",
-      "description": "Enable the Figma OAuth setup skill for connecting to Figma",
-      "defaultEnabled": false
-    },
-    {
-      "id": "integration-notion",
-      "scope": "assistant",
-      "key": "integration-notion",
-      "label": "Notion Integration",
-      "description": "Enable the Notion setup skill for connecting to Notion",
-      "defaultEnabled": false
-    },
     {
       "id": "conversation-starters",
       "scope": "assistant",
@@ -273,6 +169,14 @@
       "description": "Show the Schedules tab in Settings for viewing and managing schedules",
       "defaultEnabled": false
     },
+    {
+      "id": "settings-integrations-grid",
+      "scope": "assistant",
+      "key": "settings-integrations-grid",
+      "label": "Integrations Grid",
+      "description": "Show the Integrations grid in Models & Services settings, replacing individual OAuth provider cards",
+      "defaultEnabled": false
+    },
     {
       "id": "quick-input",
       "scope": "macos",
@@ -337,14 +241,6 @@
       "description": "Show older versions in the version picker, allowing rollback to previous releases",
       "defaultEnabled": true
     },
-    {
-      "id": "show-background-conversations",
-      "scope": "assistant",
-      "key": "show-background-conversations",
-      "label": "Show Background Conversations",
-      "description": "Include background conversations (heartbeat, tasks) in the sidebar conversation list",
-      "defaultEnabled": false
-    },
     {
       "id": "voice-mode",
       "scope": "assistant",
@@ -360,6 +256,23 @@
       "label": "Fast Mode",
       "description": "Enable Anthropic fast mode for Opus 4.6, delivering up to 2.5x higher output tokens per second at premium pricing",
       "defaultEnabled": false
+    },
+    {
+      "id": "conversation-groups-ui",
+      "scope": "assistant",
+      "key": "conversation-groups-ui",
+      "label": "Conversation Groups",
+      "description": "Enable custom conversation group creation, move-to-group, and group management in the sidebar",
+      "defaultEnabled": false
+    },
+    {
+      "id": "teleport",
+      "scope": "macos",
+      "key": "teleport",
+      "label": "Teleport",
+      "description": "Enable teleport UI in General settings for moving assistants between hosting environments",
+      "defaultEnabled": false
     }
   ]
 }
+

package/src/config/loader.ts

@@ -124,6 +124,10 @@ const DEPRECATED_FIELDS: Record<string, string> = {
     "providerOrder has been removed from the config schema. " +
     "Provider selection is now handled automatically. " +
     "The field will be removed from your config file.",
+  "permissions.dangerouslySkipPermissions":
+    "permissions.dangerouslySkipPermissions has been removed. " +
+    "Permission prompts are now always shown when required. " +
+    "The field will be removed from your config file.",
 };
 
 /**

package/src/config/schemas/platform.ts

@@ -56,6 +56,14 @@ export const UiConfigSchema = z
       .describe(
         "IANA timezone identifier for displaying dates and times (e.g. 'America/New_York')",
       ),
+    greetingModelIntent: z
+      .enum(["latency-optimized", "quality-optimized"], {
+        error: "ui.greetingModelIntent must be 'latency-optimized' or 'quality-optimized'",
+      })
+      .default("latency-optimized")
+      .describe(
+        "Model intent for empty-state greeting generation (latency-optimized = fast/small model, quality-optimized = primary model)",
+      ),
   })
   .describe("User interface display settings");
 

package/src/config/schemas/security.ts

@@ -79,12 +79,6 @@ export const PermissionsConfigSchema = z
       .describe(
         "Permission mode — 'strict' requires explicit approval for all operations, 'workspace' allows operations within the workspace",
       ),
-    dangerouslySkipPermissions: z
-      .boolean({
-        error: "permissions.dangerouslySkipPermissions must be a boolean",
-      })
-      .default(false)
-      .describe("Auto-accept all permission prompts without asking"),
   })
   .describe("Permission enforcement mode for tool operations");
 

package/src/config/schemas/services.ts

@@ -51,6 +51,11 @@ export const GoogleOAuthServiceSchema = BaseServiceSchema.extend({
 });
 export type GoogleOAuthService = z.infer<typeof GoogleOAuthServiceSchema>;
 
+export const OutlookOAuthServiceSchema = BaseServiceSchema.extend({
+  mode: ServiceModeSchema.default("your-own"),
+});
+export type OutlookOAuthService = z.infer<typeof OutlookOAuthServiceSchema>;
+
 export const ServicesSchema = z.object({
   inference: InferenceServiceSchema.default(InferenceServiceSchema.parse({})),
   "image-generation": ImageGenerationServiceSchema.default(
@@ -62,5 +67,8 @@ export const ServicesSchema = z.object({
   "google-oauth": GoogleOAuthServiceSchema.default(
     GoogleOAuthServiceSchema.parse({}),
   ),
+  "outlook-oauth": OutlookOAuthServiceSchema.default(
+    OutlookOAuthServiceSchema.parse({}),
+  ),
 });
 export type Services = z.infer<typeof ServicesSchema>;

package/src/config/schemas/timeouts.ts

@@ -36,7 +36,7 @@ export const TimeoutConfigSchema = z
       .number({ error: "timeouts.providerStreamTimeoutSec must be a number" })
       .finite("timeouts.providerStreamTimeoutSec must be finite")
       .positive("timeouts.providerStreamTimeoutSec must be a positive number")
-      .default(300)
+      .default(1800)
       .describe(
         "Timeout for waiting on the LLM provider's streaming response (seconds)",
       ),

package/src/config/skills.ts

@@ -73,7 +73,6 @@ export interface SkillSummary {
   bundled?: boolean;
   icon?: string;
   emoji?: string;
-  homepage?: string;
   source: SkillSource;
   /** Parsed tool manifest metadata, if the skill has a valid TOOLS.json. */
   toolManifest?: SkillToolManifestMeta;
@@ -962,8 +961,9 @@ function isEscapingSymlink(filePath: string, rootDir: string): boolean {
 /**
  * Check for a `references/` subdirectory within a skill directory and return
  * a formatted listing of available `.md` reference files with full absolute
- * paths. Returns `null` if no references exist. Files are listed in
- * alphabetical order. Non-`.md` files are ignored. Symlinks that resolve
+ * paths. Returns `null` if no references exist. Files are discovered
+ * recursively through subdirectories and listed alphabetically within each
+ * directory level. Non-`.md` files are ignored. Symlinks that resolve
  * outside the skill directory are skipped.
  */
 export function listReferenceFiles(directoryPath: string): string | null {
@@ -977,10 +977,21 @@ export function listReferenceFiles(directoryPath: string): string | null {
       return null;
     }
 
-    const entries = readdirSync(refsDir);
+    const entries = readdirSync(refsDir, { recursive: true }) as string[];
     const mdFiles = entries
       .filter((f) => f.toLowerCase().endsWith(".md"))
-      .filter((f) => !isEscapingSymlink(join(refsDir, f), directoryPath))
+      .filter((f) => {
+        // Check the file itself
+        if (isEscapingSymlink(join(refsDir, f), directoryPath)) return false;
+        // Check all intermediate directory components (e.g. for "sub/dir/file.md"
+        // check "sub" and "sub/dir") to prevent traversal through symlinked dirs.
+        const parts = f.split("/");
+        for (let i = 1; i < parts.length; i++) {
+          const ancestor = join(refsDir, ...parts.slice(0, i));
+          if (isEscapingSymlink(ancestor, directoryPath)) return false;
+        }
+        return true;
+      })
       .sort((a, b) => a.localeCompare(b));
 
     if (mdFiles.length === 0) return null;
@@ -991,8 +1002,8 @@ export function listReferenceFiles(directoryPath: string): string | null {
       "The following reference files are available in this skill's directory. Use `file_read` to load any that are relevant to the current task:",
       "",
     ];
-    for (const filename of mdFiles) {
-      lines.push(`- \`${join(refsDir, filename)}\``);
+    for (const filepath of mdFiles) {
+      lines.push(`- \`${join(refsDir, filepath)}\` (references/${filepath})`);
     }
 
     return lines.join("\n");

package/src/context/token-estimator.ts

@@ -9,7 +9,6 @@ const CHARS_PER_TOKEN = 4;
 const MESSAGE_OVERHEAD_TOKENS = 4;
 const TEXT_BLOCK_OVERHEAD_TOKENS = 2;
 const TOOL_BLOCK_OVERHEAD_TOKENS = 16;
-const IMAGE_BLOCK_TOKENS = 1024;
 const IMAGE_BLOCK_OVERHEAD_TOKENS = 16;
 const FILE_BLOCK_OVERHEAD_TOKENS = 48;
 const WEB_SEARCH_RESULT_TOKENS = 800;
@@ -20,12 +19,15 @@ const GEMINI_INLINE_FILE_MIME_TYPES = new Set(["application/pdf"]);
 // Anthropic scales images to fit within 1568x1568 maintaining aspect ratio,
 // then charges ~(width * height) / 750 tokens.
 const ANTHROPIC_IMAGE_MAX_DIMENSION = 1568;
+// Anthropic caps images at ~1.2 megapixels in addition to the 1568px dimension limit.
+// Images exceeding this are further scaled down. The docs state images above ~1,600 tokens
+// are resized. 1,200,000 / 750 = 1,600 tokens, matching the documented threshold.
+// Reference table (max sizes that won't be resized):
+//   1:1 → 1092x1092 (~1,590 tokens)   1:2 → 784x1568 (~1,639 tokens)
+// See: https://platform.claude.com/docs/en/build-with-claude/vision#evaluate-image-size
+const ANTHROPIC_IMAGE_MAX_PIXELS = 1_200_000;
 const ANTHROPIC_IMAGE_TOKENS_PER_PIXEL = 1 / 750;
-const ANTHROPIC_IMAGE_MAX_TOKENS = Math.ceil(
-  ANTHROPIC_IMAGE_MAX_DIMENSION *
-    ANTHROPIC_IMAGE_MAX_DIMENSION *
-    ANTHROPIC_IMAGE_TOKENS_PER_PIXEL,
-); // ~3,277 tokens
+const ANTHROPIC_IMAGE_MAX_TOKENS = 1_600;
 
 // Anthropic renders each PDF page as an image (~1,568 tokens at standard
 // resolution) plus any extracted text. Typical PDF pages are 50-150 KB.
@@ -85,17 +87,23 @@ function estimateFileDataTokens(
 }
 
 function estimateAnthropicImageTokens(width: number, height: number): number {
-  // Scale down to fit within 1568x1568 bounding box, maintaining aspect ratio
-  const scale = Math.min(
+  // Step 1: Scale to fit within 1568px bounding box
+  const dimScale = Math.min(
     1,
     ANTHROPIC_IMAGE_MAX_DIMENSION / Math.max(width, height),
   );
-  const scaledWidth = Math.round(width * scale);
-  const scaledHeight = Math.round(height * scale);
-  return Math.max(
-    IMAGE_BLOCK_TOKENS, // minimum 1024
-    Math.ceil(scaledWidth * scaledHeight * ANTHROPIC_IMAGE_TOKENS_PER_PIXEL),
-  );
+  let scaledWidth = Math.round(width * dimScale);
+  let scaledHeight = Math.round(height * dimScale);
+
+  // Step 2: Scale further if exceeds megapixel budget
+  const pixels = scaledWidth * scaledHeight;
+  if (pixels > ANTHROPIC_IMAGE_MAX_PIXELS) {
+    const mpScale = Math.sqrt(ANTHROPIC_IMAGE_MAX_PIXELS / pixels);
+    scaledWidth = Math.round(scaledWidth * mpScale);
+    scaledHeight = Math.round(scaledHeight * mpScale);
+  }
+
+  return Math.ceil(scaledWidth * scaledHeight * ANTHROPIC_IMAGE_TOKENS_PER_PIXEL);
 }
 
 function estimateImageTokens(
@@ -143,11 +151,10 @@ export function estimateContentBlockTokens(
       return tokens;
     }
     case "image":
-      return Math.max(
-        IMAGE_BLOCK_TOKENS,
+      return (
         IMAGE_BLOCK_OVERHEAD_TOKENS +
-          estimateTextTokens(block.source.media_type) +
-          estimateImageTokens(block, options),
+        estimateTextTokens(block.source.media_type) +
+        estimateImageTokens(block, options)
       );
     case "file":
       return (

package/src/context/window-manager.ts

@@ -581,7 +581,7 @@ export class ContextWindowManager {
     const overheadTokens =
       estimateTextTokens(SUMMARY_SYSTEM_PROMPT) +
       estimateTextTokens(currentSummary) +
-      // Scaffolding text in buildSummaryPrompt ("Update the summary...",
+      // Scaffolding text in buildSummaryContentBlocks ("Update the summary...",
       // section headers, etc.) — generous fixed estimate.
       200 +
       this.summaryMaxTokens;
@@ -598,6 +598,7 @@ export class ContextWindowManager {
     for (const block of blocks) {
       totalTokens += estimateBlockTokens(block);
     }
+    const originalTotalTokens = totalTokens;
     if (totalTokens <= maxTranscriptTokens) return blocks;
 
     // First pass: drop images from the beginning until we fit or run out of
@@ -618,17 +619,43 @@ export class ContextWindowManager {
     if (totalTokens <= maxTranscriptTokens) return result;
 
     // Second pass: drop text blocks from the beginning (oldest) until we fit.
+    // If a single text block exceeds the remaining budget, truncate it rather
+    // than dropping it entirely so the summarizer always has content to work with.
     let dropUntil = 0;
     let droppedTokens = 0;
     for (let i = 0; i < result.length && totalTokens > maxTranscriptTokens; i++) {
-      droppedTokens += estimateBlockTokens(result[i]);
-      totalTokens -= estimateBlockTokens(result[i]);
+      const blockTokens = estimateBlockTokens(result[i]);
+      const excess = totalTokens - maxTranscriptTokens;
+      if (blockTokens > excess && result[i].type === "text") {
+        // Truncate this block to shed exactly the excess tokens.
+        // Subtract the cost of the "[...truncated] " prefix so the final
+        // block (prefix + kept text) stays within budget.
+        const truncationPrefix = "[...truncated] ";
+        const prefixTokens = estimateTextTokens(truncationPrefix);
+        const keepTokens = Math.max(1, blockTokens - excess - prefixTokens);
+        const text = (result[i] as { type: "text"; text: string }).text;
+        // Approximate: 1 token ≈ 4 characters for truncation purposes.
+        const keepChars = Math.max(1, Math.floor(keepTokens * 4));
+        const truncatedText = text.slice(-keepChars);
+        const truncatedBlock: ContentBlock = {
+          type: "text",
+          text: `${truncationPrefix}${truncatedText}`,
+        };
+        const newBlockTokens = estimateBlockTokens(truncatedBlock);
+        droppedTokens += blockTokens - newBlockTokens;
+        totalTokens -= blockTokens - newBlockTokens;
+        result[i] = truncatedBlock;
+        dropUntil = i;
+        break;
+      }
+      droppedTokens += blockTokens;
+      totalTokens -= blockTokens;
       dropUntil = i + 1;
     }
 
     log.info(
       {
-        originalTokens: totalTokens + droppedTokens,
+        originalTokens: originalTotalTokens,
         cappedTokens: maxTranscriptTokens,
         droppedTokens,
       },
@@ -892,11 +919,7 @@ function serializeMessagesToContentBlocks(messages: Message[]): ContentBlock[] {
           textLines.length = 0;
         }
         blocks.push(block);
-      } else if (block.type === "web_search_tool_result") {
-        textLines.push(
-          `web_search_tool_result ${block.tool_use_id}: [opaque]`,
-        );
-      } else if (block.type === "tool_result") {
+      } else if (block.type === "tool_result") { // guard:allow-tool-result-only — web_search_tool_result handled by serializeBlock via else branch
         // Extract images from tool_result contentBlocks before serializing.
         const collectedImages: ImageContent[] = [];
         textLines.push(serializeToolResultBlock(block, collectedImages));

package/src/credential-execution/approval-bridge.ts

@@ -103,7 +103,6 @@ function mapUserDecisionToCesDecision(
         userDecision: decision,
       };
     case "temporary_override":
-    case "dangerously_skip_permissions":
       return {
         grantDecision: "approved",
         ttl: undefined,

package/src/credential-execution/process-manager.ts

@@ -31,6 +31,7 @@ import { StringDecoder } from "node:string_decoder";
 import type { Subprocess } from "bun";
 
 import type { AssistantConfig } from "../config/schema.js";
+import { ensureBun } from "../util/bun-runtime.js";
 import { getLogger } from "../util/logger.js";
 import type { CesTransport } from "./client.js";
 import {
@@ -266,8 +267,9 @@ export function createCesProcessManager(
       "Spawning CES child process from source",
     );
 
+    const bunPath = await ensureBun();
     const proc = Bun.spawn({
-      cmd: ["bun", "run", discovery.sourcePath],
+      cmd: [bunPath, "run", discovery.sourcePath],
       stdin: "pipe",
       stdout: "pipe",
       stderr: "ignore",