@vellumai/assistant 0.6.3 → 0.6.5

package/src/context/window-manager.ts

@@ -1,3 +1,6 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
 import type { ContextWindowConfig } from "../config/types.js";
 import type {
   ContentBlock,
@@ -5,7 +8,9 @@ import type {
   Message,
   Provider,
 } from "../providers/types.js";
+import { resolveBundledDir } from "../util/bundled-asset.js";
 import { getLogger } from "../util/logger.js";
+import { safeStringSlice } from "../util/unicode.js";
 import {
   estimateContentBlockTokens,
   estimatePromptTokens,
@@ -25,11 +30,38 @@ const COMPACTION_TOOL_RESULT_MAX_CHARS = 6_000;
 const MIN_COMPACTABLE_PERSISTED_MESSAGES = 2;
 const INTERNAL_CONTEXT_SUMMARY_MESSAGES = new WeakSet<Message>();
 
-const SUMMARY_SYSTEM_PROMPT = [
+/**
+ * Load the compaction summary system prompt from the bundled markdown asset.
+ *
+ * `resolveBundledDir` handles the compiled-binary case where the caller path
+ * points to `/$bunfs/` and the asset lives next to the executable (macOS app
+ * bundle `Contents/Resources/` or sibling dir). In source mode it falls back
+ * to the sibling `prompts/` directory.
+ */
+export function loadCompactPrompt(): string {
+  const callerDir = import.meta.dirname ?? __dirname;
+  const promptsDir = resolveBundledDir(callerDir, "prompts", "compact-prompts");
+  const promptPath = join(promptsDir, "compact.md");
+  const contents = readFileSync(promptPath, "utf-8");
+  if (contents.length === 0) {
+    throw new Error(
+      `compact.md at ${promptPath} is empty — compaction summary prompt missing`,
+    );
+  }
+  return contents;
+}
+
+/**
+ * Hardcoded fallback prompt used when the bundled `compact.md` asset is
+ * missing or unreadable, so the daemon can still compact conversations
+ * rather than failing module import at startup.
+ */
+const SUMMARY_PROMPT_FALLBACK = [
   "You compress long assistant conversations into durable working memory.",
   "Focus on actionable state, not prose.",
   "Preserve concrete facts: goals, constraints, decisions, pending questions, file paths, commands, errors, and TODOs.",
   "Remove repetition and stale details that were superseded.",
+  'Thread anchors: when a "Retained Thread References" section is present, each listed reply cites its parent via `→ Mxxxxxx`. If that parent appears in the Transcript, preserve its text verbatim (reactions may be aggregated as "N users reacted"). Omit when the section is absent.',
   "Return concise markdown using these section headers exactly:",
   "## Goals",
   "## Constraints",
@@ -39,6 +71,42 @@ const SUMMARY_SYSTEM_PROMPT = [
   "## Recent Progress",
 ].join("\n");
 
+/**
+ * Load the compact prompt with graceful fallback. If `loader` throws (missing
+ * or unreadable bundled asset, partial deployment, filesystem corruption),
+ * logs a warning and returns the hardcoded fallback string so module import
+ * never fails. The loader is injectable for testability.
+ */
+export function loadCompactPromptOrFallback(
+  loader: () => string = loadCompactPrompt,
+): string {
+  try {
+    return loader();
+  } catch (err) {
+    log.warn(
+      { err },
+      "Failed to load compact.md from bundle; using inline fallback prompt. The bundled asset may be missing or unreadable.",
+    );
+    return SUMMARY_PROMPT_FALLBACK;
+  }
+}
+
+const SUMMARY_SYSTEM_PROMPT = loadCompactPromptOrFallback();
+
+/**
+ * Pattern matching a Slack-style reply tag-line's parent-alias reference.
+ * The chronological renderer emits reply lines as
+ * `[MM/DD/YY HH:MM @sender → Mxxxxxx]: body`, or, for edited replies,
+ * `[MM/DD/YY HH:MM @sender → Mxxxxxx, edited MM/DD/YY HH:MM]: body`. The
+ * character after the 6-hex parent alias is therefore `]` for a plain reply
+ * or `,` for an edited one — the regex accepts either. `Mxxxxxx` is the
+ * first 6 hex chars of sha256(threadTs). A retained-tail text block that
+ * contains this pattern is carrying a live reference to a parent that may
+ * still live in the compactable region — the summarizer needs to know about
+ * it to act on the Thread-anchors clause of SUMMARY_SYSTEM_PROMPT.
+ */
+const THREAD_REPLY_REFERENCE_PATTERN = /→ M[0-9a-f]{6}[,\]]/;
+
 export interface ContextWindowResult {
   messages: Message[];
   compacted: boolean;
@@ -57,6 +125,13 @@ export interface ContextWindowResult {
   summaryRawResponses?: unknown[];
   summaryText: string;
   reason?: string;
+  /**
+   * True when the summary LLM call threw and the local fallback produced the
+   * summary. Callers use this to distinguish provider-side summary failures
+   * from successful compactions so they can apply circuit-breaker logic
+   * without losing the fallback-compacted messages.
+   */
+  summaryFailed?: boolean;
 }
 
 export interface ShouldCompactResult {
@@ -72,13 +147,22 @@ export interface ContextWindowCompactOptions {
    * Override the minimum number of recent user turns to preserve.
    * Set to `0` for emergency recovery that can compact the entire history
    * (except the summary message itself). When omitted, the default floor
-   * of 1 recent user turn is enforced.
+   * is `1` (or `8` when `conversationOriginChannel === "slack"`).
    */
   minKeepRecentUserTurns?: number;
+  /**
+   * Origin channel hint used when `minKeepRecentUserTurns` is omitted.
+   * Slack-originated conversations bump the default keep floor so multi-turn
+   * thread context (replies, quoted messages) is not summarized away too
+   * aggressively. Explicit `minKeepRecentUserTurns` overrides this hint.
+   */
+  conversationOriginChannel?: string;
   /**
    * Override the target input token budget used for keep-boundary
-   * projected-fit checks. Allows the caller to demand a stricter fit
-   * than the normal `config.targetInputTokens` during forced recovery.
+   * projected-fit checks. Clamped to no looser than `config.targetInputTokens`
+   * — i.e. the override may only demand a *stricter* fit. Passing a looser
+   * value has no effect. Intended for forced recovery paths that need a
+   * tighter target than the default.
    */
   targetInputTokensOverride?: number;
   /**
@@ -110,6 +194,16 @@ export class ContextWindowManager {
    * after a successful compaction pass.
    */
   nonPersistedPrefixCount = 0;
+  /**
+   * True when the message at index 0 is a context summary that was inherited
+   * from a parent fork (i.e. injected as part of the non-persisted prefix),
+   * rather than produced by this conversation's own compaction. The parent
+   * summary sits at index 0 but is excluded from `compactableMessages` by
+   * `summaryOffset`, so its slot in `nonPersistedPrefixCount` must be
+   * accounted for separately. Cleared after the first compaction replaces
+   * the parent summary with a child-owned one.
+   */
+  summaryIsInjected = false;
   /**
    * Cached resolved system prompt. Lazily populated on first access via the
    * `systemPrompt` getter and cleared after each compaction pass so the next
@@ -124,6 +218,16 @@ export class ContextWindowManager {
     this.toolTokenBudget = options.toolTokenBudget ?? 0;
   }
 
+  /**
+   * Provider key for the local token estimator. Wrapper providers (e.g.
+   * OpenRouter routing to `anthropic/*`) override `tokenEstimationProvider`
+   * so image/PDF sizing uses the same rules as the upstream API instead of
+   * the generic `base64/4` fallback.
+   */
+  private get estimationProviderName(): string {
+    return this.provider.tokenEstimationProvider ?? this.provider.name;
+  }
+
   /** Lazily resolve and cache the system prompt for the duration of a compaction pass. */
   private get systemPrompt(): string {
     if (this._resolvedSystemPrompt !== undefined) {
@@ -151,7 +255,7 @@ export class ContextWindowManager {
     if (!this.config.enabled) return { needed: false, estimatedTokens: 0 };
     try {
       const estimated = estimatePromptTokens(messages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
       const threshold = Math.floor(
@@ -183,7 +287,7 @@ export class ContextWindowManager {
     const previousEstimatedInputTokens =
       options?.precomputedEstimate ??
       estimatePromptTokens(messages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
     const thresholdTokens = Math.floor(
@@ -253,6 +357,8 @@ export class ContextWindowManager {
     const keepPlan = this.pickKeepBoundary(messages, userTurnStarts, {
       minKeepRecentUserTurns: options?.minKeepRecentUserTurns,
       targetInputTokensOverride: options?.targetInputTokensOverride,
+      conversationOriginChannel: options?.conversationOriginChannel,
+      force: options?.force,
     });
     if (keepPlan.keepFromIndex <= summaryOffset) {
       // All turns fit after truncation projection, but the real in-memory
@@ -266,7 +372,7 @@ export class ContextWindowManager {
       const didTruncate = truncatedCount > 0;
       const estimatedAfterTruncation = didTruncate
         ? estimatePromptTokens(truncatedMessages, this.systemPrompt, {
-            providerName: this.provider.name,
+            providerName: this.estimationProviderName,
             toolTokenBudget: this.toolTokenBudget,
           })
         : previousEstimatedInputTokens;
@@ -313,8 +419,15 @@ export class ContextWindowManager {
       };
     }
 
+    // When the summary at index 0 was injected from a parent fork, it
+    // contributes 1 to `nonPersistedPrefixCount` but is excluded from
+    // `compactableMessages` by `summaryOffset`; subtract it here so the
+    // remaining injected count lines up with compactableMessages. A summary
+    // produced by this conversation's own prior compaction is not part of
+    // `nonPersistedPrefixCount` (already decremented), so no subtraction.
+    const injectedSummaryOffset = this.summaryIsInjected ? summaryOffset : 0;
     const injectedInCompactable = Math.min(
-      Math.max(0, this.nonPersistedPrefixCount - summaryOffset),
+      Math.max(0, this.nonPersistedPrefixCount - injectedSummaryOffset),
       compactableMessages.length,
     );
     const compactedPersistedMessages =
@@ -331,7 +444,7 @@ export class ContextWindowManager {
       projectedMessages,
       this.systemPrompt,
       {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       },
     );
@@ -419,13 +532,18 @@ export class ContextWindowManager {
       };
     }
 
+    const retainedThreadRefs = collectRetainedThreadReferences(
+      messages.slice(keepPlan.keepFromIndex),
+    );
     const transcriptBlocks = this.capTranscriptBlocksToTokenBudget(
       serializeMessagesToContentBlocks(compactableMessages),
       existingSummary ?? "No previous summary.",
+      retainedThreadRefs,
     );
     const summaryUpdate = await this.updateSummary(
       existingSummary ?? "No previous summary.",
       transcriptBlocks,
+      retainedThreadRefs,
       signal,
     );
     const summary = summaryUpdate.summary;
@@ -435,6 +553,7 @@ export class ContextWindowManager {
     const summaryCacheCreationInputTokens =
       summaryUpdate.cacheCreationInputTokens;
     const summaryCacheReadInputTokens = summaryUpdate.cacheReadInputTokens;
+    const summaryFailed = summaryUpdate.failed;
     const summaryRawResponses: unknown[] = [];
     if (Array.isArray(summaryUpdate.rawResponse)) {
       summaryRawResponses.push(...summaryUpdate.rawResponse);
@@ -460,15 +579,22 @@ export class ContextWindowManager {
       compactedMessages,
       this.systemPrompt,
       {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       },
     );
-    // Consume the injected prefix messages that were compacted away.
+    // Consume the injected prefix messages that were compacted away. When the
+    // parent-injected summary was replaced by a freshly produced child summary,
+    // also consume its slot (it was excluded from injectedInCompactable via
+    // injectedSummaryOffset) and clear the flag so subsequent compactions treat
+    // the summary at index 0 as child-owned.
     this.nonPersistedPrefixCount = Math.max(
       0,
-      this.nonPersistedPrefixCount - injectedInCompactable,
+      this.nonPersistedPrefixCount -
+        injectedInCompactable -
+        injectedSummaryOffset,
     );
+    this.summaryIsInjected = false;
 
     log.info(
       {
@@ -499,6 +625,7 @@ export class ContextWindowManager {
       summaryCacheReadInputTokens,
       summaryRawResponses,
       summaryText: summary,
+      summaryFailed,
     };
   }
 
@@ -515,14 +642,24 @@ export class ContextWindowManager {
     opts?: {
       minKeepRecentUserTurns?: number;
       targetInputTokensOverride?: number;
+      conversationOriginChannel?: string;
+      force?: boolean;
     },
   ): { keepFromIndex: number; keepTurns: number } {
+    // Slack-originated conversations rely on multi-turn thread context
+    // (reply chains, quoted messages, contextual references). Bump the
+    // default keep floor for them so compaction does not summarize away
+    // recent turns that the next reply may directly cite. Explicit
+    // `minKeepRecentUserTurns` (including emergency `0`) wins.
+    const defaultTurns = opts?.conversationOriginChannel === "slack" ? 8 : 1;
     const minFloor = Math.min(
-      Math.max(0, Math.floor(opts?.minKeepRecentUserTurns ?? 1)),
+      Math.max(0, Math.floor(opts?.minKeepRecentUserTurns ?? defaultTurns)),
       userTurnStarts.length,
     );
-    const targetTokens =
-      opts?.targetInputTokensOverride ?? this.targetInputTokens;
+    const targetTokens = Math.min(
+      opts?.targetInputTokensOverride ?? this.targetInputTokens,
+      this.targetInputTokens,
+    );
 
     // Binary search for the maximum keepTurns whose projected tokens fit
     // within the budget. Token count is monotonically non-decreasing with
@@ -541,7 +678,7 @@ export class ContextWindowManager {
         COMPACTION_TOOL_RESULT_MAX_CHARS,
       );
       return estimatePromptTokens(projectedMessages, this.systemPrompt, {
-        providerName: this.provider.name,
+        providerName: this.estimationProviderName,
         toolTokenBudget: this.toolTokenBudget,
       });
     };
@@ -564,6 +701,32 @@ export class ContextWindowManager {
       lo = hi;
     }
 
+    // Under forced compaction with only the implicit default floor in play,
+    // that floor stops being an absolute override when the kept region still
+    // exceeds the target. Walk keepTurns below the floor — down to 0 if
+    // needed — so /compact can always drive the conversation toward target,
+    // even when the floor turn itself is oversized (e.g. a huge paste in the
+    // last user message). Exceptions that still treat the floor as hard:
+    //   - Explicit `minKeepRecentUserTurns` (the caller opted in to that
+    //     floor; emergency recovery already passes 0 when it wants to go all
+    //     the way down).
+    //   - Slack origin (the bumped 8-turn floor protects thread reply chains
+    //     and quoted-message context that the next reply may directly cite).
+    // Automatic mid-loop compaction (force !== true) always honors the floor
+    // so the in-flight agent turn isn't summarized away.
+    const floorIsImplicitDefault =
+      opts?.minKeepRecentUserTurns === undefined &&
+      opts?.conversationOriginChannel !== "slack";
+    if (
+      opts?.force &&
+      floorIsImplicitDefault &&
+      projectedTokensForKeep(lo) > targetTokens
+    ) {
+      while (lo > 0 && projectedTokensForKeep(lo) > targetTokens) {
+        lo--;
+      }
+    }
+
     const keepTurns = lo;
     const rawKeepFromIndex =
       keepTurns === 0
@@ -595,10 +758,13 @@ export class ContextWindowManager {
   private capTranscriptBlocksToTokenBudget(
     blocks: ContentBlock[],
     currentSummary: string,
+    retainedThreadRefs: string[],
   ): ContentBlock[] {
+    const retainedRefsText = retainedThreadRefs.join("\n");
     const overheadTokens =
       estimateTextTokens(SUMMARY_SYSTEM_PROMPT) +
       estimateTextTokens(currentSummary) +
+      estimateTextTokens(retainedRefsText) +
       // Scaffolding text in buildSummaryContentBlocks ("Update the summary...",
       // section headers, etc.) — generous fixed estimate.
       200 +
@@ -610,7 +776,9 @@ export class ContextWindowManager {
     );
 
     const estimateBlockTokens = (b: ContentBlock): number =>
-      estimateContentBlockTokens(b, { providerName: this.provider.name });
+      estimateContentBlockTokens(b, {
+        providerName: this.estimationProviderName,
+      });
 
     let totalTokens = 0;
     for (const block of blocks) {
@@ -623,7 +791,11 @@ export class ContextWindowManager {
     // images to drop. Images are high-cost and their text context (message
     // headers, surrounding tool_use/tool_result serializations) is preserved.
     const result = [...blocks];
-    for (let i = 0; i < result.length && totalTokens > maxTranscriptTokens; i++) {
+    for (
+      let i = 0;
+      i < result.length && totalTokens > maxTranscriptTokens;
+      i++
+    ) {
       if (result[i].type === "image") {
         totalTokens -= estimateBlockTokens(result[i]);
         const stub: ContentBlock = {
@@ -641,7 +813,11 @@ export class ContextWindowManager {
     // than dropping it entirely so the summarizer always has content to work with.
     let dropUntil = 0;
     let droppedTokens = 0;
-    for (let i = 0; i < result.length && totalTokens > maxTranscriptTokens; i++) {
+    for (
+      let i = 0;
+      i < result.length && totalTokens > maxTranscriptTokens;
+      i++
+    ) {
       const blockTokens = estimateBlockTokens(result[i]);
       const excess = totalTokens - maxTranscriptTokens;
       if (blockTokens > excess && result[i].type === "text") {
@@ -689,6 +865,7 @@ export class ContextWindowManager {
   private async updateSummary(
     currentSummary: string,
     transcriptBlocks: ContentBlock[],
+    retainedThreadRefs: string[],
     signal?: AbortSignal,
   ): Promise<{
     summary: string;
@@ -698,12 +875,20 @@ export class ContextWindowManager {
     cacheCreationInputTokens: number;
     cacheReadInputTokens: number;
     rawResponse?: unknown;
+    /**
+     * True when the provider.sendMessage call threw and the local fallback
+     * was used. Callers (the agent loop) use this to drive circuit-breaker
+     * state without having to reimplement the fallback themselves.
+     */
+    failed: boolean;
   }> {
     const contentBlocks = buildSummaryContentBlocks(
       currentSummary,
       transcriptBlocks,
+      retainedThreadRefs,
     );
     const summaryMessage: Message = { role: "user", content: contentBlocks };
+    let failed = false;
     try {
       const response = await this.provider.sendMessage(
         [summaryMessage],
@@ -726,15 +911,19 @@ export class ContextWindowManager {
             response.usage.cacheCreationInputTokens ?? 0,
           cacheReadInputTokens: response.usage.cacheReadInputTokens ?? 0,
           rawResponse: response.rawResponse,
+          failed: false,
         };
       }
     } catch (err) {
+      failed = true;
       log.warn({ err }, "Summary generation failed, using local fallback");
     }
 
     // Fallback: extract text-only transcript for local summary generation.
     const textTranscript = transcriptBlocks
-      .filter((b): b is Extract<ContentBlock, { type: "text" }> => b.type === "text")
+      .filter(
+        (b): b is Extract<ContentBlock, { type: "text" }> => b.type === "text",
+      )
       .map((b) => b.text)
       .join("\n\n");
 
@@ -745,6 +934,7 @@ export class ContextWindowManager {
       model: "",
       cacheCreationInputTokens: 0,
       cacheReadInputTokens: 0,
+      failed,
     };
   }
 
@@ -752,7 +942,7 @@ export class ContextWindowManager {
     // Budget in tokens → approximate char limit (4 chars ≈ 1 token).
     const maxChars = this.summaryMaxTokens * 4;
     if (summary.length <= maxChars) return summary;
-    return `${summary.slice(0, maxChars)}...`;
+    return `${safeStringSlice(summary, 0, maxChars)}...`;
   }
 }
 
@@ -821,7 +1011,11 @@ function adjustForToolPairs(
     // Collect tool_use_ids referenced by tool_results in this user message
     const referencedIds = new Set<string>();
     for (const block of msg.content) {
-      if ((block.type === "tool_result" || block.type === "web_search_tool_result") && "tool_use_id" in block) {
+      if (
+        (block.type === "tool_result" ||
+          block.type === "web_search_tool_result") &&
+        "tool_use_id" in block
+      ) {
         referencedIds.add((block as { tool_use_id: string }).tool_use_id);
       }
     }
@@ -897,26 +1091,68 @@ export function createContextSummaryMessage(summary: string): Message {
 function buildSummaryContentBlocks(
   currentSummary: string,
   transcriptBlocks: ContentBlock[],
+  retainedThreadRefs: string[],
 ): ContentBlock[] {
+  const lines = [
+    "Update the summary with new transcript data.",
+    "If new information conflicts with older notes, keep the most recent and explicit detail.",
+    "Keep all unresolved asks and next steps.",
+    "For any images included below, describe their visual content in the summary so the information is preserved after compaction.",
+    "",
+    "### Existing Summary",
+    currentSummary.trim().length > 0 ? currentSummary.trim() : "None.",
+    "",
+  ];
+  if (retainedThreadRefs.length > 0) {
+    lines.push(
+      "### Retained Thread References",
+      "These reply tag lines remain in the live context after compaction. Each `→ Mxxxxxx` cites a parent message by alias; if that parent appears in the Transcript below, preserve its text verbatim.",
+      ...retainedThreadRefs.map((ref) => `- ${ref}`),
+      "",
+    );
+  }
+  lines.push("### Transcript");
   return [
     {
       type: "text",
-      text: [
-        "Update the summary with new transcript data.",
-        "If new information conflicts with older notes, keep the most recent and explicit detail.",
-        "Keep all unresolved asks and next steps.",
-        "For any images included below, describe their visual content in the summary so the information is preserved after compaction.",
-        "",
-        "### Existing Summary",
-        currentSummary.trim().length > 0 ? currentSummary.trim() : "None.",
-        "",
-        "### Transcript",
-      ].join("\n"),
+      text: lines.join("\n"),
     } as ContentBlock,
     ...transcriptBlocks,
   ];
 }
 
+/**
+ * Scan retained-tail messages for Slack-style reply tag lines that cite a
+ * thread parent via the `→ Mxxxxxx` alias convention. Returns the full tag
+ * line for each match (de-duplicated, order-preserved) so the summarizer
+ * has a concrete list of parents whose text must be preserved verbatim.
+ *
+ * Non-slack conversations and retained tails without any reply markers
+ * produce an empty list — in that case the summarizer is told explicitly
+ * that no verbatim preservation is required.
+ */
+function collectRetainedThreadReferences(
+  retainedMessages: Message[],
+): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const msg of retainedMessages) {
+    for (const block of msg.content) {
+      if (block.type !== "text") continue;
+      const text = (block as { text: string }).text;
+      for (const line of text.split("\n")) {
+        if (!THREAD_REPLY_REFERENCE_PATTERN.test(line)) continue;
+        const trimmed = line.trim();
+        if (trimmed.length === 0) continue;
+        if (seen.has(trimmed)) continue;
+        seen.add(trimmed);
+        out.push(trimmed);
+      }
+    }
+  }
+  return out;
+}
+
 /**
  * Serialize messages into a sequence of content blocks. Text-based content
  * (tool calls, tool results, thinking, etc.) is serialized into text blocks.
@@ -937,7 +1173,8 @@ function serializeMessagesToContentBlocks(messages: Message[]): ContentBlock[] {
           textLines.length = 0;
         }
         blocks.push(block);
-      } else if (block.type === "tool_result") { // guard:allow-tool-result-only — web_search_tool_result handled by serializeBlock via else branch
+      } else if (block.type === "tool_result") {
+        // guard:allow-tool-result-only — web_search_tool_result handled by serializeBlock via else branch
         // Extract images from tool_result contentBlocks before serializing.
         const collectedImages: ImageContent[] = [];
         textLines.push(serializeToolResultBlock(block, collectedImages));
@@ -1025,7 +1262,7 @@ function serializeBlock(block: ContentBlock): string {
 
 function clampText(text: string): string {
   if (text.length <= MAX_BLOCK_PREVIEW_CHARS) return text;
-  return `${text.slice(0, MAX_BLOCK_PREVIEW_CHARS)}... [truncated ${
+  return `${safeStringSlice(text, 0, MAX_BLOCK_PREVIEW_CHARS)}... [truncated ${
     text.length - MAX_BLOCK_PREVIEW_CHARS
   } chars]`;
 }

package/src/credential-execution/approval-bridge.ts

@@ -87,7 +87,6 @@ function mapUserDecisionToCesDecision(
         userDecision: decision,
       };
     case "always_allow":
-    case "always_allow_high_risk":
       // Persistent grant — no expiry. CES stores it with expiresAt: null.
       return {
         grantDecision: "approved",

package/src/credential-execution/executable-discovery.ts

@@ -17,7 +17,7 @@
  */
 
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
 import { getLogger } from "../util/logger.js";
@@ -65,9 +65,30 @@ function getManagedBootstrapSocketPath(): string {
  * `getDataDir()` (under `~/.vellum/workspace/data`) was previously included
  * but is inside the sandbox write boundary, so a sandboxed tool could plant
  * a malicious binary there. Removed to close the sandbox-escape vector.
+ *
+ * Search order:
+ * 1. Alongside the running executable, but ONLY when running from a
+ *    packaged macOS app bundle (`<App>.app/Contents/MacOS/credential-executor`).
+ *    In dev mode, `process.execPath` points at the bun/node install dir
+ *    (e.g. `~/.bun/bin`), where an unrelated file named `credential-executor`
+ *    could be picked up by accident.
+ * 2. `<binDir>/credential-executor` — user-installed override (dev flow).
  */
 function getLocalBinarySearchPaths(): string[] {
-  return [join(getBinDir(), "credential-executor")];
+  const paths: string[] = [];
+
+  // Only check the sibling of process.execPath when running from a packaged
+  // app bundle — the .app/Contents/MacOS directory is a controlled location.
+  // In dev mode, process.execPath is the bun/node binary (e.g. ~/.bun/bin/bun)
+  // and a sibling lookup there could discover an unrelated or untrusted
+  // executable.
+  const execDir = dirname(process.execPath);
+  if (execDir.includes(".app/Contents/MacOS")) {
+    paths.push(join(execDir, "credential-executor"));
+  }
+
+  paths.push(join(getBinDir(), "credential-executor"));
+  return paths;
 }
 
 // ---------------------------------------------------------------------------