@vellumai/assistant 0.6.4 → 0.6.5

package/src/daemon/handlers/shared.ts

@@ -1,10 +1,10 @@
 import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../../config/loader.js";
-import type { Speed } from "../../config/schemas/inference.js";
+import type { LLMCallSite, Speed } from "../../config/schemas/llm.js";
 import type { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
-import type { ModelIntent } from "../../providers/types.js";
+import { isPlaceholderSentinelText } from "../../providers/anthropic/client.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
 import type { DebouncerMap } from "../../util/debounce.js";
 import { getLogger } from "../../util/logger.js";
@@ -102,6 +102,22 @@ export interface RenderedHistoryContent {
   thinkingSegments: string[];
 }
 
+/**
+ * Slack-specific metadata extracted at the inbound HTTP boundary and threaded
+ * through to user-message persistence so the row can be tagged with a
+ * `slackMeta` envelope for the chronological renderer.
+ */
+export interface SlackInboundMessageMetadata {
+  /** Slack channel id (conversation external id) — recorded as `channelId`. */
+  channelId: string;
+  /** Slack `ts` for this message — required so persistence can record `channelTs`. */
+  channelTs: string;
+  /** Parent `thread_ts` when the message lives inside a thread; absent for top-level. */
+  threadTs?: string;
+  /** Resolved sender label (display name preferred, username fallback). */
+  displayName?: string;
+}
+
 /**
  * Optional overrides for conversation creation (e.g. interview mode).
  */
@@ -128,19 +144,26 @@ export interface ConversationCreateOptions {
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   /** Optional callback to receive real-time agent loop events (text deltas, tool starts, etc.). */
   onEvent?: (msg: ServerMessage) => void;
-  /**
-   * Optional model selection strategy for this conversation's agent loop.
-   * When set, overrides the provider's default model per-turn. Used by the
-   * auto-analyze loop to route the analysis agent to a dedicated model.
-   */
-  modelIntent?: ModelIntent;
   /**
    * Optional explicit model override (provider/model string) for this
-   * conversation's agent loop. Takes precedence over `modelIntent` when
-   * both are set. Used by the auto-analyze loop to pin the analysis agent
-   * to a specific model.
+   * conversation's agent loop. Used by the auto-analyze loop to pin the
+   * analysis agent to a specific model.
    */
   modelOverride?: string;
+  /**
+   * Optional LLM call-site identifier threaded through to the per-call
+   * provider config. Adapter callers (heartbeat, filing, schedule, etc.)
+   * pass their call-site here so the agent loop routes through
+   * `resolveCallSiteConfig` instead of the global default.
+   */
+  callSite?: LLMCallSite;
+  /**
+   * Slack inbound metadata captured at the channel ingress boundary. When
+   * present (and the turn channel resolves to Slack), persistence writes a
+   * `slackMeta` sub-object into the message's `metadata` JSON for the
+   * chronological renderer to consume.
+   */
+  slackInbound?: SlackInboundMessageMetadata;
 }
 
 /**
@@ -329,6 +352,11 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
       // path — e.g. empty segments between consecutive tool_use blocks that
       // break tool-call grouping in the UI.
       if (block.text.trim().length === 0) continue;
+      // Drop Anthropic provider placeholder sentinels. These are injected
+      // into outbound API requests to preserve role alternation and must
+      // never be rendered to users. Belt-and-suspenders with the persist-
+      // time filter in cleanAssistantContent and migration 222.
+      if (isPlaceholderSentinelText(block.text)) continue;
       textParts.push(block.text);
       ensureSegment();
       currentSegmentParts.push(block.text);

package/src/daemon/handlers/skills.ts

@@ -1517,7 +1517,7 @@ export async function draftSkill(
     if (missing.length > 0) {
       let llmGenerated = false;
       try {
-        const provider = await getConfiguredProvider();
+        const provider = await getConfiguredProvider("skillCategoryInference");
         if (provider) {
           const { signal, cleanup } = createTimeout(LLM_DRAFT_TIMEOUT_MS);
           try {
@@ -1539,7 +1539,7 @@ export async function draftSkill(
               [],
               undefined,
               {
-                config: { modelIntent: "latency-optimized", max_tokens: 256 },
+                config: { callSite: "skillCategoryInference", max_tokens: 256 },
                 signal,
               },
             );

package/src/daemon/handlers/slack-channel-oauth-install.ts

@@ -0,0 +1,197 @@
+/**
+ * Runs an OAuth2 loopback flow to install the user's Slack app and capture
+ * bot + user tokens in a single exchange.
+ *
+ * Prerequisites: client_id, client_secret, and app_token must already be
+ * stored in the credential vault (service: slack_channel).
+ *
+ * The handler reads client credentials from secure storage, starts a
+ * loopback OAuth server on port 17322, opens the browser to Slack's
+ * authorize URL, and waits for the user to click "Allow". Slack's
+ * oauth.v2.access response contains both the bot token (access_token)
+ * and user token (authed_user.access_token). Both are stored via
+ * setSlackChannelConfig.
+ */
+
+import { credentialKey } from "../../security/credential-key.js";
+import { startOAuth2Flow } from "../../security/oauth2.js";
+import { getSecureKeyAsync } from "../../security/secure-keys.js";
+import { openInHostBrowser } from "../../util/browser.js";
+import { getLogger } from "../../util/logger.js";
+import { setSlackChannelConfig } from "./config-slack-channel.js";
+
+const log = getLogger("slack-channel-oauth-install");
+
+/** Port pre-registered for Slack in seed-providers.ts. */
+const SLACK_LOOPBACK_PORT = 17322;
+
+/** Bot scopes matching the manifest in SKILL.md. */
+const BOT_SCOPES = [
+  "app_mentions:read",
+  "assistant:write",
+  "channels:history",
+  "channels:join",
+  "channels:read",
+  "chat:write",
+  "files:read",
+  "files:write",
+  "groups:history",
+  "groups:read",
+  "im:history",
+  "im:read",
+  "im:write",
+  "mpim:history",
+  "mpim:read",
+  "reactions:read",
+  "reactions:write",
+  "users:read",
+];
+
+/** User scopes matching the manifest in SKILL.md. */
+const USER_SCOPES = [
+  "channels:history",
+  "channels:read",
+  "groups:history",
+  "groups:read",
+  "im:history",
+  "im:read",
+  "mpim:history",
+  "mpim:read",
+  "users:read",
+  "search:read",
+  "reactions:read",
+];
+
+export interface SlackOAuthInstallResult {
+  success: boolean;
+  hasBotToken: boolean;
+  hasUserToken: boolean;
+  error?: string;
+}
+
+export async function runSlackChannelOAuthInstall(): Promise<SlackOAuthInstallResult> {
+  // Read client credentials from secure storage
+  const clientId = await getSecureKeyAsync(
+    credentialKey("slack_channel", "client_id"),
+  );
+  if (!clientId) {
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error:
+        "Client ID not found in credential store. Store it first via credential_store prompt (service: slack_channel, field: client_id).",
+    };
+  }
+
+  const clientSecret = await getSecureKeyAsync(
+    credentialKey("slack_channel", "client_secret"),
+  );
+  if (!clientSecret) {
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error:
+        "Client Secret not found in credential store. Store it first via credential_store prompt (service: slack_channel, field: client_secret).",
+    };
+  }
+
+  const appToken = await getSecureKeyAsync(
+    credentialKey("slack_channel", "app_token"),
+  );
+  if (!appToken) {
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error:
+        "App Token not found in credential store. Store it first via credential_store prompt (service: slack_channel, field: app_token).",
+    };
+  }
+
+  log.info("Starting Slack OAuth install flow via loopback");
+
+  let result;
+  try {
+    result = await startOAuth2Flow(
+      {
+        authorizeUrl: "https://slack.com/oauth/v2/authorize",
+        tokenExchangeUrl: "https://slack.com/api/oauth.v2.access",
+        scopes: BOT_SCOPES,
+        clientId,
+        clientSecret,
+        scopeSeparator: ",",
+        authorizeParams: {
+          user_scope: USER_SCOPES.join(","),
+        },
+      },
+      {
+        openUrl: (url) => openInHostBrowser(url),
+      },
+      {
+        callbackTransport: "loopback",
+        loopbackPort: SLACK_LOOPBACK_PORT,
+      },
+    );
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error({ err: msg }, "Slack OAuth install flow failed");
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error: `OAuth flow failed: ${msg}`,
+    };
+  }
+
+  // Slack's oauth.v2.access returns:
+  //   access_token: "xoxb-..." (bot token)
+  //   authed_user: { access_token: "xoxp-..." } (user token)
+  const raw = result.rawTokenResponse;
+  const botToken = raw.access_token as string | undefined;
+  const authedUser = raw.authed_user as { access_token?: string } | undefined;
+  const userToken = authedUser?.access_token as string | undefined;
+
+  if (!botToken) {
+    log.error(
+      { rawKeys: Object.keys(raw) },
+      "Slack OAuth response missing bot access_token",
+    );
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error:
+        "Slack OAuth response did not include a bot token (access_token). The app may not have bot scopes configured.",
+    };
+  }
+
+  log.info(
+    { hasBotToken: true, hasUserToken: !!userToken },
+    "Slack OAuth tokens received, storing via setSlackChannelConfig",
+  );
+
+  // Store bot token (and user token if present) via the Slack channel handler,
+  // which validates tokens and persists workspace metadata.
+  const configResult = await setSlackChannelConfig(
+    botToken,
+    appToken,
+    userToken,
+  );
+
+  if (!configResult.success) {
+    return {
+      success: false,
+      hasBotToken: false,
+      hasUserToken: false,
+      error: configResult.error ?? "Failed to store Slack tokens",
+    };
+  }
+
+  return {
+    success: true,
+    hasBotToken: true,
+    hasUserToken: !!userToken,
+  };
+}

package/src/daemon/lifecycle.ts

@@ -1,3 +1,5 @@
+import { join } from "node:path";
+
 import { config as dotenvConfig } from "dotenv";
 
 import type { BackupWorkerHandle } from "../backup/backup-worker.js";
@@ -72,7 +74,6 @@ import {
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
 import { ensurePromptFiles } from "../prompts/system-prompt.js";
-import { syncUpdateBulletinOnStartup } from "../prompts/update-bulletin.js";
 import { resolveManagedProxyContext } from "../providers/managed-proxy/context.js";
 import { buildAssistantEvent } from "../runtime/assistant-event.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
@@ -89,6 +90,7 @@ import {
 } from "../runtime/capability-tokens.js";
 import { ensureVellumGuardianBinding } from "../runtime/guardian-vellum-migration.js";
 import { RuntimeHttpServer } from "../runtime/http-server.js";
+import { recoverInterruptedImport } from "../runtime/migrations/vbundle-streaming-importer.js";
 import { startScheduler } from "../schedule/scheduler.js";
 import {
   onCesClientChanged,
@@ -278,6 +280,36 @@ export async function runDaemon(): Promise<void> {
 
     ensureDataDir();
 
+    // Recover from any streaming `.vbundle` import that was interrupted by a
+    // crash or SIGKILL. If the previous process died between
+    // `carryOverPreservedPaths` and the atomic workspace swap, the live
+    // workspace may be missing `data/db` / `data/qdrant` / etc. The marker
+    // at `<workspaceDir>.import-marker.json` (persisted before any rename
+    // runs) tells us where the orphaned preserved paths landed; the
+    // recovery helper moves them back into the live workspace and cleans
+    // up the temp tree. Running this BEFORE `initializeDb()` ensures the
+    // DB singleton opens against the fully-restored `assistant.db`.
+    try {
+      const recoveryResult = await recoverInterruptedImport(getWorkspaceDir());
+      if (!recoveryResult.ok) {
+        // Rollback is intentionally unresolved — backup/temp/marker are
+        // preserved on disk so an operator (or a later retry) can finish
+        // the recovery. Log loudly so ops sees it, but don't block start-up:
+        // the daemon still needs to come up for diagnostics. The next
+        // `streamCommitImport` will refuse to start a new import until the
+        // marker is resolved.
+        log.error(
+          { failedCount: recoveryResult.failedCount },
+          "Interrupted-import recovery is INCOMPLETE; leftover .pre-import-* / .import-* scratch dirs remain in the workspace. Manual intervention may be required before the next import can run.",
+        );
+      }
+    } catch (err) {
+      log.warn(
+        { err },
+        "recoverInterruptedImport threw during daemon startup; continuing",
+      );
+    }
+
     // Load (or generate + persist) the auth signing key so tokens survive
     // daemon restarts.
     const signingKey = resolveSigningKey();
@@ -543,18 +575,6 @@ export async function runDaemon(): Promise<void> {
     log.info("Daemon startup: loading config");
     const config = loadConfig();
 
-    // Run bulletin sync AFTER the config merge + load so that getConfig()
-    // inside syncUpdateBulletinOnStartup() observes the fully merged config.
-    // Running it earlier would populate the config cache with pre-merge
-    // values, poisoning every downstream getConfig() consumer.
-    if (dbReady) {
-      try {
-        syncUpdateBulletinOnStartup();
-      } catch (err) {
-        log.warn({ err }, "Bulletin sync failed — continuing startup");
-      }
-    }
-
     // Seed module-level ingress state from the workspace config so that
     // getIngressPublicBaseUrl() returns the correct value immediately after
     // startup (before any handleIngressConfig("set") call). Without this,
@@ -655,7 +675,9 @@ export async function runDaemon(): Promise<void> {
               ...(startupProxyCtx.assistantApiKey
                 ? { assistantApiKey: startupProxyCtx.assistantApiKey }
                 : {}),
-              ...(startupAssistantId ? { assistantId: startupAssistantId } : {}),
+              ...(startupAssistantId
+                ? { assistantId: startupAssistantId }
+                : {}),
             });
             if (accepted) {
               log.info("CES reconnection handshake accepted");
@@ -690,6 +712,24 @@ export async function runDaemon(): Promise<void> {
     await server.start();
     log.info("Daemon startup: DaemonServer started");
 
+    // Kick off the update bulletin background job AFTER `server.start()`
+    // resolves. `server.start()` installs the default wake resolver (via
+    // `registerDefaultWakeResolver()`), which the job depends on to actually
+    // invoke the agent. Dispatching before that point races the resolver
+    // registration and causes `wakeAgentForOpportunity()` to silently return
+    // `{invoked: false}`, leaving an orphan background conversation and a
+    // wasted LLM title-generation call every startup.
+    //
+    // Kept fire-and-forget (`void import(...).then(...).catch(...)`) so the
+    // daemon never blocks startup on it.
+    if (dbReady) {
+      void import("../prompts/update-bulletin-job.js")
+        .then((m) => m.runUpdateBulletinJobIfNeeded())
+        .catch((err) =>
+          log.warn({ err }, "Update bulletin job failed — continuing startup"),
+        );
+    }
+
     // Mutable refs for Qdrant, memory worker, and backup worker so background
     // init can assign them and the shutdown handler always sees the latest value.
     const bgRefs: {
@@ -774,6 +814,28 @@ export async function runDaemon(): Promise<void> {
             "Qdrant client initialization failed — memory features will be degraded",
           );
         }
+
+        // Reconcile the PKB Qdrant index against the on-disk tree. Kept
+        // inside the `qdrantStarted` guard so we don't call
+        // `getQdrantClient()` (which throws "not initialized") on every
+        // startup when Qdrant is unavailable. Fire-and-forget so enqueued
+        // re-index jobs drain in the background and first-turn latency
+        // stays unaffected.
+        void (async () => {
+          try {
+            const { reconcilePkbIndex } =
+              await import("../memory/pkb/pkb-reconcile.js");
+            const { PKB_WORKSPACE_SCOPE } =
+              await import("../memory/pkb/types.js");
+            const pkbRoot = join(getWorkspaceDir(), "pkb");
+            await reconcilePkbIndex(pkbRoot, PKB_WORKSPACE_SCOPE);
+          } catch (err) {
+            log.warn(
+              { err },
+              "PKB index reconciliation failed — continuing startup",
+            );
+          }
+        })();
       }
 
       log.info("Daemon startup: starting memory worker");

package/src/daemon/message-types/conversations.ts

@@ -434,6 +434,19 @@ export interface ContextCompacted {
   summaryModel: string;
 }
 
+/**
+ * Emitted when the compaction circuit breaker trips. After three consecutive
+ * summary-LLM failures (with local fallback covering each), auto-compaction is
+ * suspended until `openUntil` to avoid repeatedly hammering a broken provider.
+ * User-initiated compaction (`/compact`, `force: true`) bypasses the breaker.
+ */
+export interface CompactionCircuitOpen {
+  type: "compaction_circuit_open";
+  reason: "3_consecutive_failures";
+  /** Timestamp (ms since epoch) when the breaker will allow auto-compaction again. */
+  openUntil: number;
+}
+
 export type ConversationErrorCode =
   | "PROVIDER_NETWORK"
   | "PROVIDER_RATE_LIMIT"
@@ -531,6 +544,7 @@ export type _ConversationsServerMessages =
   | UsageUpdate
   | UsageResponse
   | ContextCompacted
+  | CompactionCircuitOpen
   | ConversationErrorMessage
   | ConversationInfo
   | ConversationTitleUpdated

package/src/daemon/message-types/messages.ts

@@ -23,6 +23,10 @@ export interface UserMessage {
   microphonePermissionGranted?: boolean;
   /** Structured command intent — bypasses text parsing when present. */
   commandIntent?: CommandIntent;
+  /** Client-generated correlation nonce for echo dedup. See
+   *  `UserMessageEcho.clientMessageId` — the server echoes this value
+   *  back on the matching `user_message_echo` event. */
+  clientMessageId?: string;
 }
 
 export interface ConfirmationResponse {
@@ -33,7 +37,6 @@ export interface ConfirmationResponse {
     | "allow_10m"
     | "allow_conversation"
     | "always_allow"
-    | "always_allow_high_risk"
     | "deny"
     | "always_deny";
   selectedPattern?: string;
@@ -67,6 +70,11 @@ export interface UserMessageEcho {
   /** Server-generated request ID for the send. Allows correlation with
    *  `message_queued` / `message_dequeued` events for the same turn. */
   requestId?: string;
+  /** Client-generated correlation nonce from the HTTP POST body. Echoed
+   *  back so the originating client can dedupe its optimistic row even
+   *  if the SSE echo beats the 202 response. Absent for synthetic echoes
+   *  (e.g. surface-action prompts) that did not originate from a client POST. */
+  clientMessageId?: string;
 }
 
 export interface AssistantTextDelta {

package/src/daemon/message-types/trust.ts

@@ -8,8 +8,6 @@ export interface AddTrustRule {
   pattern: string;
   scope: string;
   decision: "allow" | "deny" | "ask";
-  /** When true, the rule also covers high-risk invocations. */
-  allowHighRisk?: boolean;
   /** Execution target override for this rule. */
   executionTarget?: "host" | "sandbox";
 }

package/src/daemon/parse-actual-tokens-from-error.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
-import { parseActualTokensFromError } from "./conversation-agent-loop.js";
+import { ContextOverflowError } from "../providers/types.js";
+import { parseActualTokensFromError } from "./parse-actual-tokens-from-error.js";
 
 describe("parseActualTokensFromError", () => {
   test("returns null for null input", () => {
@@ -68,4 +69,59 @@ describe("parseActualTokensFromError", () => {
   test("returns null when no numeric pattern matches", () => {
     expect(parseActualTokensFromError("context window exceeded")).toBeNull();
   });
+
+  // ── Typed-error branch ─────────────────────────────────────────────
+
+  test("prefers ContextOverflowError.actualTokens over string-regex match", () => {
+    // Message would regex-parse to 999999, but typed field wins.
+    const err = new ContextOverflowError(
+      "Anthropic API error (400): prompt is too long: 999999 tokens > 200000 maximum",
+      "anthropic",
+      {
+        actualTokens: 242201,
+        maxTokens: 200000,
+      },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("falls back to regex when ContextOverflowError has no actualTokens", () => {
+    const err = new ContextOverflowError(
+      "OpenAI API error (400): too many input tokens: 150000 > 128000",
+      "openai",
+      {},
+    );
+    expect(parseActualTokensFromError(err)).toBe(150000);
+  });
+
+  test("returns null when ContextOverflowError has neither typed field nor matching message", () => {
+    const err = new ContextOverflowError("context window exceeded", "openai");
+    expect(parseActualTokensFromError(err)).toBeNull();
+  });
+
+  test("typed-error parsing takes precedence over string regex even when both present", () => {
+    // String has 999999 tokens > 200000; typed field says 242201.
+    // The typed field MUST win — this is the core contract.
+    const err = new ContextOverflowError(
+      "prompt is too long: 999999 tokens > 200000 maximum",
+      "anthropic",
+      { actualTokens: 242201 },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("accepts an untyped Error instance and parses its message", () => {
+    const err = new Error("prompt is too long: 242201 tokens > 200000 maximum");
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("ignores non-numeric/invalid actualTokens on typed error", () => {
+    // actualTokens of 0 should fall through (typed check requires > 0).
+    const err = new ContextOverflowError(
+      "prompt is too long: 242201 tokens > 200000 maximum",
+      "anthropic",
+      { actualTokens: 0 },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
 });

package/src/daemon/parse-actual-tokens-from-error.ts

@@ -0,0 +1,66 @@
+import { isContextOverflowError } from "../providers/types.js";
+
+/**
+ * Parse the actual token count reported by the provider for a
+ * context-too-large failure.
+ *
+ * Prefers the typed `ContextOverflowError.actualTokens` field when the
+ * thrown error is one. Falls back to regex-parsing the message for patterns
+ * like:
+ *   "prompt is too long: 242201 tokens > 200000 maximum"   (Anthropic)
+ *   "too many input tokens: 242201 > 200000"                (OpenAI)
+ *
+ * The regex path remains a safety net for provider-adapter paths (e.g.
+ * managed-proxy rewrappers) that surface untyped errors.
+ *
+ * Accepts a raw error object, an `Error` instance, or a plain string.
+ * Returns the actual token count, or `null` when it cannot be determined.
+ */
+export function parseActualTokensFromError(
+  errorOrMessage: unknown,
+): number | null {
+  // Typed path — the provider client wrapped a matching upstream error as
+  // ContextOverflowError. Use the parsed field directly when available.
+  if (isContextOverflowError(errorOrMessage)) {
+    const actual = errorOrMessage.actualTokens;
+    if (typeof actual === "number" && actual > 0) return actual;
+    // Typed error without `actualTokens` — fall through to regex-parse the
+    // underlying message in case the upstream body carries it in text form.
+    return parseFromMessage(errorOrMessage.message ?? null);
+  }
+
+  // Untyped path — accept either an Error or a string.
+  if (errorOrMessage == null) return null;
+  if (typeof errorOrMessage === "string") {
+    return parseFromMessage(errorOrMessage);
+  }
+  if (typeof errorOrMessage === "object" && "message" in errorOrMessage) {
+    const msg = (errorOrMessage as { message?: unknown }).message;
+    if (typeof msg === "string") return parseFromMessage(msg);
+  }
+  return null;
+}
+
+function parseFromMessage(errorMessage: string | null): number | null {
+  if (!errorMessage) return null;
+
+  // Match patterns like "242201 tokens > 200000" or "242201 > 200000 maximum"
+  const match = errorMessage.match(
+    /(\d[\d,]*)\s*tokens?\s*[>≥]|:\s*(\d[\d,]*)\s*[>≥]/i,
+  );
+  if (match) {
+    const raw = (match[1] || match[2]).replace(/,/g, "");
+    const parsed = parseInt(raw, 10);
+    if (!isNaN(parsed) && parsed > 0) return parsed;
+  }
+
+  // Fallback: match "too many input tokens: N > M"
+  const fallback = errorMessage.match(/(\d[\d,]*)\s*[>≥]\s*\d/);
+  if (fallback) {
+    const raw = fallback[1].replace(/,/g, "");
+    const parsed = parseInt(raw, 10);
+    if (!isNaN(parsed) && parsed > 0) return parsed;
+  }
+
+  return null;
+}