@vellumai/assistant 0.6.2 → 0.6.4

package/src/__tests__/workspace-policy.test.ts

@@ -221,6 +221,8 @@ describe("isWorkspaceScopedInvocation", () => {
       "browser_scroll",
       "browser_screenshot",
       "browser_close",
+      "browser_attach",
+      "browser_detach",
       "network_request",
     ];
 

package/src/acp/client-handler.ts

@@ -32,6 +32,7 @@ import type {
 
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { UserDecision } from "../permissions/types.js";
+import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { getLogger } from "../util/logger.js";
 
@@ -184,6 +185,15 @@ export class VellumAcpClientHandler implements Client {
       kind: opt.kind,
     }));
 
+    if (isPermissionControlsV2Enabled()) {
+      const allowOptionId = findAllowOptionId(options);
+      return {
+        outcome: allowOptionId
+          ? { outcome: "selected", optionId: allowOptionId }
+          : { outcome: "cancelled" },
+      };
+    }
+
     // Send the confirmation_request first — this triggers makeEventSender
     // which registers a normal "confirmation" entry in pendingInteractions.
     this.sendToVellum({
@@ -422,15 +432,31 @@ function mapDecisionToOptionId(
     const alwaysDeny = options.find((o) => o.kind === "reject_always");
     if (alwaysDeny) return alwaysDeny.optionId;
   }
-  const denyOpt =
-    options.find((o) => o.kind === "reject_once") ??
-    options.find((o) => o.kind === "reject_always");
-  if (denyOpt) return denyOpt.optionId;
+  const denyOpt = findRejectOptionId(options);
+  if (denyOpt) return denyOpt;
 
   // Fallback: return first option
   return options[0]?.optionId ?? "deny";
 }
 
+function findRejectOptionId(
+  options: Array<{ optionId: string; kind: string }>,
+): string | undefined {
+  return (
+    options.find((o) => o.kind === "reject_once")?.optionId ??
+    options.find((o) => o.kind === "reject_always")?.optionId
+  );
+}
+
+function findAllowOptionId(
+  options: Array<{ optionId: string; kind: string }>,
+): string | undefined {
+  return (
+    options.find((o) => o.kind === "allow_once")?.optionId ??
+    options.find((o) => o.kind === "allow_always")?.optionId
+  );
+}
+
 /**
  * Extracts text from a ContentBlock.
  */

package/src/agent/image-optimize.ts

@@ -127,24 +127,36 @@ function runSips(inputBytes: Buffer): Buffer | null {
  * Results are cached on disk by content hash so repeated sends of the same
  * image (or daemon restarts) skip the sips call entirely.
  */
+/**
+ * Decide whether an image needs to be rescaled before sending.
+ *
+ * Anthropic rejects many-image requests when any image exceeds 2000 px on a
+ * side, so dimensions — not file size — are the authoritative gate. A sparse
+ * screenshot can be under 300 KB while still being 3000+ px wide, which the
+ * byte-size heuristic alone would let slip through.
+ *
+ * Exported for unit testing.
+ */
+export function shouldRescaleImage(
+  dims: { width: number; height: number } | null,
+  byteLength: number,
+): boolean {
+  if (dims) {
+    // Dimensions known — they are the authoritative check.
+    return dims.width > MAX_DIMENSION || dims.height > MAX_DIMENSION;
+  }
+  // Dimensions unparseable — fall back to file size as a rough proxy.
+  return byteLength > OPTIMIZE_THRESHOLD_BYTES;
+}
+
 export function optimizeImageForTransport(
   base64Data: string,
   mediaType: string,
 ): { data: string; mediaType: string } {
   const rawBytes = Buffer.from(base64Data, "base64");
-
-  // Small images don't need optimization.
-  if (rawBytes.length <= OPTIMIZE_THRESHOLD_BYTES) {
-    return { data: base64Data, mediaType };
-  }
-
-  // If dimensions are already within limits, skip.
   const dims = parseImageDimensions(base64Data, mediaType);
-  if (
-    dims &&
-    dims.width <= MAX_DIMENSION &&
-    dims.height <= MAX_DIMENSION
-  ) {
+
+  if (!shouldRescaleImage(dims, rawBytes.length)) {
     return { data: base64Data, mediaType };
   }
 

package/src/agent/loop.ts

@@ -82,7 +82,12 @@ export type AgentEvent =
       toolUseId: string;
       input: Record<string, unknown>;
     }
-  | { type: "server_tool_complete"; toolUseId: string; isError: boolean }
+  | {
+      type: "server_tool_complete";
+      toolUseId: string;
+      isError: boolean;
+      content?: unknown[];
+    }
   | { type: "error"; error: Error }
   | {
       type: "usage";
@@ -98,12 +103,13 @@ export type AgentEvent =
     };
 
 const DEFAULT_CONFIG: AgentLoopConfig = {
-  maxTokens: 16000,
+  maxTokens: 64000,
   effort: "high",
   minTurnIntervalMs: 150,
 };
 
 const MAX_CONSECUTIVE_ERROR_NUDGES = 3;
+const MAX_EMPTY_RESPONSE_RETRIES = 1;
 
 export interface ResolvedSystemPrompt {
   systemPrompt: string;
@@ -202,6 +208,7 @@ export class AgentLoop {
     const history = [...messages];
     let toolUseTurns = 0;
     let consecutiveErrorTurns = 0;
+    let emptyResponseRetries = 0;
     let lastLlmCallTime = 0;
     const rlog = requestId ? log.child({ requestId }) : log;
 
@@ -344,6 +351,7 @@ export class AgentLoop {
                   type: "server_tool_complete",
                   toolUseId: event.toolUseId,
                   isError: event.isError,
+                  ...(event.content ? { content: event.content } : {}),
                 });
               }
             },
@@ -392,9 +400,6 @@ export class AgentLoop {
           role: "assistant",
           content: response.content,
         };
-        history.push(assistantMessage);
-
-        await onEvent({ type: "message_complete", message: assistantMessage });
 
         // Check for tool use
         toolUseBlocks = response.content.filter(
@@ -402,6 +407,47 @@ export class AgentLoop {
             block.type === "tool_use",
         );
 
+        // Detect empty responses: no user-visible text and no tool calls.
+        // This can happen when the model fails to produce output after
+        // receiving a large tool result. Retry once with a nudge before
+        // the message is persisted.
+        const hasVisibleText = response.content.some(
+          (block) => block.type === "text" && block.text.trim().length > 0,
+        );
+        if (
+          !hasVisibleText &&
+          toolUseBlocks.length === 0 &&
+          toolUseTurns > 0 &&
+          emptyResponseRetries < MAX_EMPTY_RESPONSE_RETRIES
+        ) {
+          emptyResponseRetries++;
+          rlog.warn(
+            { turn: toolUseTurns, retry: emptyResponseRetries },
+            "Model returned empty response after tool results — retrying",
+          );
+          history.push({
+            role: "user",
+            content: [
+              {
+                type: "text",
+                text: "<system_notice>Your previous response was empty. You must respond to the user with a summary of what you found or did. Do not use any tools — just respond with text.</system_notice>",
+              },
+            ],
+          });
+          continue;
+        }
+
+        if (!hasVisibleText && toolUseBlocks.length === 0 && toolUseTurns > 0) {
+          rlog.error(
+            { turn: toolUseTurns, retries: emptyResponseRetries },
+            "Model returned empty response after tool results — retries exhausted",
+          );
+        }
+
+        history.push(assistantMessage);
+
+        await onEvent({ type: "message_complete", message: assistantMessage });
+
         if (toolUseBlocks.length === 0 || !this.toolExecutor) {
           break;
         }
@@ -709,10 +755,10 @@ export function compactAxTreeHistory(messages: Message[]): Message[] {
  * once by the LLM on the turn it was captured, then replaced with a text
  * placeholder on subsequent turns.
  *
- * We look for the last user message with tool_results (not just the last user
- * message) because the empty-response nudge path appends a text-only user
- * message after the tool results. Preserving images in that case ensures
- * the model still sees the screenshot on the retry.
+ * We target the last user message with tool_results (not just the last user
+ * message) because a plain-text user message may follow the tool-result
+ * turn. Using the last user message unconditionally would leave the most
+ * recent tool screenshots unprotected from stripping.
  */
 function stripOldImageBlocks(history: Message[]): Message[] {
   // Find the last user message that contains tool_result blocks.

package/src/approvals/guardian-request-resolvers.ts

@@ -26,6 +26,7 @@ import {
 } from "../notifications/signal.js";
 import { addRule } from "../permissions/trust-store.js";
 import type { UserDecision } from "../permissions/types.js";
+import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { mintDaemonDeliveryToken } from "../runtime/auth/token-service.js";
 import type { ApprovalAction } from "../runtime/channel-approval-types.js";
@@ -192,8 +193,9 @@ const pendingInteractionResolver: GuardianRequestResolver = {
     // Handle approve_always: persist a trust rule when the confirmation
     // explicitly allows persistence and provides explicit options.
     if (
-      decision.action === "approve_always" ||
-      decision.action === "approve_once"
+      !isPermissionControlsV2Enabled() &&
+      (decision.action === "approve_always" ||
+        decision.action === "approve_once")
     ) {
       const details = interaction.confirmationDetails;
       if (
@@ -237,19 +239,23 @@ const pendingInteractionResolver: GuardianRequestResolver = {
     // temporal modes (approve_10m, approve_conversation) reach the session with
     // the correct UserDecision instead of collapsing to plain "allow".
     let userDecision: UserDecision;
-    switch (decision.action) {
-      case "reject":
-        userDecision = "deny";
-        break;
-      case "approve_10m":
-        userDecision = "allow_10m";
-        break;
-      case "approve_conversation":
-        userDecision = "allow_conversation";
-        break;
-      default:
-        userDecision = "allow";
-        break;
+    if (isPermissionControlsV2Enabled()) {
+      userDecision = decision.action === "reject" ? "deny" : "allow";
+    } else {
+      switch (decision.action) {
+        case "reject":
+          userDecision = "deny";
+          break;
+        case "approve_10m":
+          userDecision = "allow_10m";
+          break;
+        case "approve_conversation":
+          userDecision = "allow_conversation";
+          break;
+        default:
+          userDecision = "allow";
+          break;
+      }
     }
     resolved.conversation!.handleConfirmationResponse(
       request.id,

package/src/backup/__tests__/backup-key.test.ts

@@ -0,0 +1,152 @@
+/**
+ * Tests for the backup key read/generate helpers. All tests run against a
+ * temp directory and explicitly pass the key path -- nothing touches the
+ * real `~/.vellum/` tree or depends on daemon startup state.
+ */
+
+import {
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import * as fsPromises from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+
+import { ensureBackupKey, readBackupKey } from "../backup-key.js";
+
+describe("backup-key", () => {
+  let root: string;
+  let keyPath: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "vellum-backup-key-"));
+    // Nest the key file one level down so we can verify that the
+    // parent directory is created on demand with the expected mode.
+    keyPath = join(root, "backup", "backup.key");
+  });
+
+  afterEach(() => {
+    try {
+      rmSync(root, { recursive: true, force: true });
+    } catch {
+      // best-effort
+    }
+  });
+
+  describe("ensureBackupKey", () => {
+    test("first call generates a fresh 32-byte key and writes it with mode 0600", async () => {
+      const key = await ensureBackupKey(keyPath);
+
+      expect(key).toBeInstanceOf(Buffer);
+      expect(key.length).toBe(32);
+
+      const fileMode = statSync(keyPath).mode & 0o777;
+      expect(fileMode).toBe(0o600);
+    });
+
+    test("creates the parent directory with mode 0700 when missing", async () => {
+      await ensureBackupKey(keyPath);
+
+      const parent = join(root, "backup");
+      const dirMode = statSync(parent).mode & 0o777;
+      // On some platforms umask can strip bits further, but it must
+      // never be more permissive than 0o700.
+      expect(dirMode & ~0o700).toBe(0);
+      expect(dirMode & 0o700).toBe(0o700);
+    });
+
+    test("second call returns the same bytes persisted on the first call", async () => {
+      const first = await ensureBackupKey(keyPath);
+      const second = await ensureBackupKey(keyPath);
+      expect(Buffer.compare(first, second)).toBe(0);
+    });
+
+    test("throws when an existing key file has the wrong size", async () => {
+      mkdirSync(join(root, "backup"), { recursive: true, mode: 0o700 });
+      // 16 bytes is half the expected length -- simulate a truncated or
+      // otherwise corrupt key file.
+      writeFileSync(keyPath, Buffer.alloc(16, 0xaa), { mode: 0o600 });
+
+      await expect(ensureBackupKey(keyPath)).rejects.toThrow(
+        /invalid length 16/,
+      );
+    });
+
+    test("does not leave any .tmp file behind after a successful write", async () => {
+      await ensureBackupKey(keyPath);
+      const parent = join(root, "backup");
+      const base = basename(keyPath);
+      const entries = readdirSync(parent);
+      const tmpEntries = entries.filter((e) => e.startsWith(`${base}.tmp.`));
+      expect(tmpEntries).toEqual([]);
+    });
+
+    test("two concurrent callers converge on the same persisted bytes", async () => {
+      // Race two ensureBackupKey calls. Exactly one caller's bytes win
+      // the rename; the other caller must re-read the file and return
+      // those same bytes rather than the key it generated locally.
+      const [a, b] = await Promise.all([
+        ensureBackupKey(keyPath),
+        ensureBackupKey(keyPath),
+      ]);
+      expect(Buffer.compare(a, b)).toBe(0);
+      const onDisk = statSync(keyPath);
+      expect(onDisk.size).toBe(32);
+    });
+
+    test("propagates non-ENOENT stat errors instead of treating them as missing", async () => {
+      // Simulate flaky storage (EIO / ESTALE). If pathExists swallowed
+      // these, the key file would appear "missing" and be silently
+      // regenerated, rotating away bytes used to encrypt existing data.
+      const statSpy = spyOn(fsPromises, "stat").mockImplementation(
+        async () => {
+          const err = new Error("simulated EIO") as NodeJS.ErrnoException;
+          err.code = "EIO";
+          throw err;
+        },
+      );
+      try {
+        await expect(ensureBackupKey(keyPath)).rejects.toThrow(
+          /simulated EIO/,
+        );
+        // And the key file must NOT have been created as a side effect.
+        expect(() => statSync(keyPath)).toThrow();
+      } finally {
+        statSpy.mockRestore();
+      }
+    });
+  });
+
+  describe("readBackupKey", () => {
+    test("returns null when the key file is missing", async () => {
+      const result = await readBackupKey(keyPath);
+      expect(result).toBeNull();
+    });
+
+    test("returns the same bytes that ensureBackupKey wrote", async () => {
+      const generated = await ensureBackupKey(keyPath);
+      const read = await readBackupKey(keyPath);
+      expect(read).not.toBeNull();
+      expect(Buffer.compare(read!, generated)).toBe(0);
+    });
+
+    test("throws when the existing key file has the wrong size", async () => {
+      mkdirSync(join(root, "backup"), { recursive: true, mode: 0o700 });
+      writeFileSync(keyPath, Buffer.alloc(8, 0xff), { mode: 0o600 });
+
+      await expect(readBackupKey(keyPath)).rejects.toThrow(/invalid length 8/);
+    });
+  });
+});