@vellumai/assistant 0.6.2 → 0.6.4

package/src/context/window-manager.ts

@@ -6,6 +6,7 @@ import type {
   Provider,
 } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
+import { safeStringSlice } from "../util/unicode.js";
 import {
   estimateContentBlockTokens,
   estimatePromptTokens,
@@ -102,6 +103,24 @@ export class ContextWindowManager {
   private readonly _systemPrompt: string | (() => string);
   private readonly config: ContextWindowConfig;
   private readonly toolTokenBudget: number;
+  /**
+   * Number of leading messages that are non-persisted (injected inherited
+   * context from a parent conversation).  `countPersistedMessages` subtracts
+   * this so `compactedPersistedMessages` only reflects DB-backed messages.
+   * Set by `Conversation.injectInheritedContext` and consumed (decremented)
+   * after a successful compaction pass.
+   */
+  nonPersistedPrefixCount = 0;
+  /**
+   * True when the message at index 0 is a context summary that was inherited
+   * from a parent fork (i.e. injected as part of the non-persisted prefix),
+   * rather than produced by this conversation's own compaction. The parent
+   * summary sits at index 0 but is excluded from `compactableMessages` by
+   * `summaryOffset`, so its slot in `nonPersistedPrefixCount` must be
+   * accounted for separately. Cleared after the first compaction replaces
+   * the parent summary with a child-owned one.
+   */
+  summaryIsInjected = false;
   /**
    * Cached resolved system prompt. Lazily populated on first access via the
    * `systemPrompt` getter and cleared after each compaction pass so the next
@@ -116,6 +135,16 @@ export class ContextWindowManager {
     this.toolTokenBudget = options.toolTokenBudget ?? 0;
   }
 
+  /**
+   * Provider key for the local token estimator. Wrapper providers (e.g.
+   * OpenRouter routing to `anthropic/*`) override `tokenEstimationProvider`
+   * so image/PDF sizing uses the same rules as the upstream API instead of
+   * the generic `base64/4` fallback.
+   */
+  private get estimationProviderName(): string {
+    return this.provider.tokenEstimationProvider ?? this.provider.name;
+  }
+
   /** Lazily resolve and cache the system prompt for the duration of a compaction pass. */
   private get systemPrompt(): string {
     if (this._resolvedSystemPrompt !== undefined) {
@@ -143,7 +172,7 @@ export class ContextWindowManager {
     if (!this.config.enabled) return { needed: false, estimatedTokens: 0 };
     try {
       const estimated = estimatePromptTokens(messages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
       const threshold = Math.floor(
@@ -175,7 +204,7 @@ export class ContextWindowManager {
     const previousEstimatedInputTokens =
       options?.precomputedEstimate ??
       estimatePromptTokens(messages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
     const thresholdTokens = Math.floor(
@@ -258,7 +287,7 @@ export class ContextWindowManager {
       const didTruncate = truncatedCount > 0;
       const estimatedAfterTruncation = didTruncate
         ? estimatePromptTokens(truncatedMessages, this.systemPrompt, {
-            providerName: this.provider.name,
+            providerName: this.estimationProviderName,
             toolTokenBudget: this.toolTokenBudget,
           })
         : previousEstimatedInputTokens;
@@ -305,8 +334,19 @@ export class ContextWindowManager {
       };
     }
 
+    // When the summary at index 0 was injected from a parent fork, it
+    // contributes 1 to `nonPersistedPrefixCount` but is excluded from
+    // `compactableMessages` by `summaryOffset`; subtract it here so the
+    // remaining injected count lines up with compactableMessages. A summary
+    // produced by this conversation's own prior compaction is not part of
+    // `nonPersistedPrefixCount` (already decremented), so no subtraction.
+    const injectedSummaryOffset = this.summaryIsInjected ? summaryOffset : 0;
+    const injectedInCompactable = Math.min(
+      Math.max(0, this.nonPersistedPrefixCount - injectedSummaryOffset),
+      compactableMessages.length,
+    );
     const compactedPersistedMessages =
-      countPersistedMessages(compactableMessages);
+      countPersistedMessages(compactableMessages) - injectedInCompactable;
     const rawProjectedMessages = [
       createContextSummaryMessage(existingSummary ?? "Projected summary"),
       ...messages.slice(keepPlan.keepFromIndex),
@@ -319,7 +359,7 @@ export class ContextWindowManager {
       projectedMessages,
       this.systemPrompt,
       {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       },
     );
@@ -448,10 +488,21 @@ export class ContextWindowManager {
       compactedMessages,
       this.systemPrompt,
       {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       },
     );
+    // Consume the injected prefix messages that were compacted away. When the
+    // parent-injected summary was replaced by a freshly produced child summary,
+    // also consume its slot (it was excluded from injectedInCompactable via
+    // injectedSummaryOffset) and clear the flag so subsequent compactions treat
+    // the summary at index 0 as child-owned.
+    this.nonPersistedPrefixCount = Math.max(
+      0,
+      this.nonPersistedPrefixCount - injectedInCompactable - injectedSummaryOffset,
+    );
+    this.summaryIsInjected = false;
+
     log.info(
       {
         previousEstimatedInputTokens,
@@ -523,7 +574,7 @@ export class ContextWindowManager {
         COMPACTION_TOOL_RESULT_MAX_CHARS,
       );
       return estimatePromptTokens(projectedMessages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
     };
@@ -592,7 +643,7 @@ export class ContextWindowManager {
     );
 
     const estimateBlockTokens = (b: ContentBlock): number =>
-      estimateContentBlockTokens(b, { providerName: this.provider.name });
+      estimateContentBlockTokens(b, { providerName: this.estimationProviderName });
 
     let totalTokens = 0;
     for (const block of blocks) {
@@ -734,7 +785,7 @@ export class ContextWindowManager {
     // Budget in tokens → approximate char limit (4 chars ≈ 1 token).
     const maxChars = this.summaryMaxTokens * 4;
     if (summary.length <= maxChars) return summary;
-    return `${summary.slice(0, maxChars)}...`;
+    return `${safeStringSlice(summary, 0, maxChars)}...`;
   }
 }
 
@@ -1007,7 +1058,7 @@ function serializeBlock(block: ContentBlock): string {
 
 function clampText(text: string): string {
   if (text.length <= MAX_BLOCK_PREVIEW_CHARS) return text;
-  return `${text.slice(0, MAX_BLOCK_PREVIEW_CHARS)}... [truncated ${
+  return `${safeStringSlice(text, 0, MAX_BLOCK_PREVIEW_CHARS)}... [truncated ${
     text.length - MAX_BLOCK_PREVIEW_CHARS
   } chars]`;
 }

package/src/credential-execution/approval-bridge.ts

@@ -21,6 +21,7 @@ import type {
 
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { UserDecision } from "../permissions/types.js";
+import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import { getLogger } from "../util/logger.js";
 import type { CesClient } from "./client.js";
 
@@ -173,13 +174,7 @@ export async function bridgeCesApproval(
     signal?: AbortSignal;
   },
 ): Promise<CesApprovalBridgeResult> {
-  const {
-    proposal,
-    renderedProposal,
-    proposalHash,
-    sessionId,
-    conversationId,
-  } = approval;
+  const { proposal, renderedProposal, proposalHash, sessionId } = approval;
 
   // Non-interactive sessions have no client to respond — fail closed.
   if (options?.isInteractive === false) {
@@ -194,6 +189,24 @@ export async function bridgeCesApproval(
     return { outcome: "denied", userDecision: "deny" };
   }
 
+  if (isPermissionControlsV2Enabled()) {
+    log.info(
+      {
+        event: "ces_approval_bridge_v2_suppressed",
+        proposalHash,
+        sessionId,
+      },
+      "CES approval request auto-approved without deterministic prompt under v2",
+    );
+    const v2Decision = mapUserDecisionToCesDecision("allow");
+    return recordCesGrant({
+      approval,
+      cesClient,
+      decision: v2Decision,
+      reason: "permission_controls_v2_auto_allow",
+    });
+  }
+
   // Build the tool name and input for the confirmation prompt. The tool
   // name uses a `ces:` prefix so the client can distinguish CES approval
   // requests from regular tool confirmation prompts.
@@ -262,8 +275,29 @@ export async function bridgeCesApproval(
     `CES approval bridge: guardian decision is "${cesDecision.grantDecision}"`,
   );
 
-  if (cesDecision.grantDecision === "denied") {
-    return { outcome: "denied", userDecision: response.decision };
+  return recordCesGrant({
+    approval,
+    cesClient,
+    decision: cesDecision,
+    reason: response.decisionContext,
+  });
+}
+
+async function recordCesGrant({
+  approval,
+  cesClient,
+  decision,
+  reason,
+}: {
+  approval: ApprovalRequired;
+  cesClient: CesClient;
+  decision: CesApprovalDecision;
+  reason?: string;
+}): Promise<CesApprovalBridgeResult> {
+  const { proposal, proposalHash, sessionId, conversationId } = approval;
+
+  if (decision.grantDecision === "denied") {
+    return { outcome: "denied", userDecision: decision.userDecision };
   }
 
   // Commit the approved grant to CES via record_grant RPC.
@@ -274,12 +308,12 @@ export async function bridgeCesApproval(
         decision: {
           proposal,
           proposalHash,
-          decision: cesDecision.grantDecision,
+          decision: decision.grantDecision,
           decidedBy: "guardian",
           decidedAt: new Date().toISOString(),
-          reason: response.decisionContext,
-          ttl: cesDecision.ttl,
-          grantType: cesDecision.grantType,
+          reason,
+          ttl: decision.ttl,
+          grantType: decision.grantType,
         },
         sessionId,
         conversationId,
@@ -323,7 +357,7 @@ export async function bridgeCesApproval(
         proposalHash,
         sessionId,
         grantId,
-        userDecision: response.decision,
+        userDecision: decision.userDecision,
       },
       "CES approval bridge: grant recorded successfully",
     );
@@ -331,7 +365,7 @@ export async function bridgeCesApproval(
     return {
       outcome: "approved",
       grantId,
-      userDecision: response.decision,
+      userDecision: decision.userDecision,
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/src/credential-execution/executable-discovery.ts

@@ -17,7 +17,7 @@
  */
 
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
 import { getLogger } from "../util/logger.js";
@@ -65,9 +65,19 @@ function getManagedBootstrapSocketPath(): string {
  * `getDataDir()` (under `~/.vellum/workspace/data`) was previously included
  * but is inside the sandbox write boundary, so a sandboxed tool could plant
  * a malicious binary there. Removed to close the sandbox-escape vector.
+ *
+ * Search order:
+ * 1. Alongside the running executable (packaged macOS app:
+ *    `<App>.app/Contents/MacOS/credential-executor`). When running from
+ *    source via `bun run`, `process.execPath` points at the bun binary
+ *    itself, so this path won't exist and the search falls through.
+ * 2. `<binDir>/credential-executor` — user-installed override (dev flow).
  */
 function getLocalBinarySearchPaths(): string[] {
-  return [join(getBinDir(), "credential-executor")];
+  return [
+    join(dirname(process.execPath), "credential-executor"),
+    join(getBinDir(), "credential-executor"),
+  ];
 }
 
 // ---------------------------------------------------------------------------

package/src/credential-execution/process-manager.ts

@@ -240,7 +240,7 @@ export function createCesProcessManager(
       cmd: [discovery.executablePath],
       stdin: "pipe",
       stdout: "pipe",
-      stderr: "ignore",
+      stderr: "pipe",
       env: {
         ...process.env,
         // Signal to CES that it was launched by the assistant
@@ -251,6 +251,7 @@ export function createCesProcessManager(
     childProcess = proc;
 
     log.info({ pid: proc.pid }, "CES child process started");
+    forwardStderrToLogger(proc);
 
     return createStdioTransport(proc);
   }
@@ -272,7 +273,7 @@ export function createCesProcessManager(
       cmd: [bunPath, "run", discovery.sourcePath],
       stdin: "pipe",
       stdout: "pipe",
-      stderr: "ignore",
+      stderr: "pipe",
       env: {
         ...process.env,
         // Signal to CES that it was launched by the assistant
@@ -283,6 +284,7 @@ export function createCesProcessManager(
     childProcess = proc;
 
     log.info({ pid: proc.pid }, "CES child process started (from source)");
+    forwardStderrToLogger(proc);
 
     return createStdioTransport(proc);
   }
@@ -442,6 +444,35 @@ function createSocketTransport(socket: Socket): CesTransport {
 // Helpers
 // ---------------------------------------------------------------------------
 
+function forwardStderrToLogger(proc: Subprocess): void {
+  if (!proc.stderr || typeof proc.stderr === "number") return;
+
+  const reader = proc.stderr.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+
+  void (async () => {
+    try {
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done) break;
+
+        buffer += decoder.decode(value, { stream: true });
+        let newlineIdx: number;
+        while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
+          const line = buffer.slice(0, newlineIdx).trimEnd();
+          buffer = buffer.slice(newlineIdx + 1);
+          if (line) log.error({ pid: proc.pid }, `[ces-stderr] ${line}`);
+        }
+      }
+      const trailing = buffer.trimEnd();
+      if (trailing) log.error({ pid: proc.pid }, `[ces-stderr] ${trailing}`);
+    } catch {
+      // Process ended or stream closed; nothing to forward.
+    }
+  })();
+}
+
 async function stopLocalProcess(proc: Subprocess): Promise<void> {
   log.info({ pid: proc.pid }, "Stopping CES child process");
   proc.kill("SIGTERM");