@vellumai/assistant 0.6.5 → 0.7.0

package/src/context/window-manager.ts

@@ -30,6 +30,118 @@ const COMPACTION_TOOL_RESULT_MAX_CHARS = 6_000;
 const MIN_COMPACTABLE_PERSISTED_MESSAGES = 2;
 const INTERNAL_CONTEXT_SUMMARY_MESSAGES = new WeakSet<Message>();
 
+/**
+ * When the existing summary is this fraction or more of the per-summary
+ * token budget, inject a "compress older content aggressively" instruction
+ * so incremental-update passes don't let the summary grow unboundedly.
+ */
+const SUMMARY_COMPRESSION_PRESSURE_RATIO = 0.6;
+
+/**
+ * Text-block prefixes that persist in live history (for prefix-caching
+ * stability and model grounding) but pollute the summarizer's view of the
+ * actual conversation. These blocks are system-metadata attached to user
+ * turns — memory injections, turn context, workspace hints, etc. They are
+ * stripped ONLY from the messages fed to the summarization LLM call. Live
+ * history is never mutated, so prefix caching is preserved.
+ *
+ * This list intentionally overlaps with `RUNTIME_INJECTION_PREFIXES` in
+ * `conversation-runtime-assembly.ts`. That list governs in-flight turn
+ * assembly via pure prefix matching; this one governs compaction input.
+ * Keep the two lists in sync when a new injection type is added.
+ *
+ * Compaction strip coverage is two-tier: this prefix list catches
+ * internal-vocabulary tags and any tag carrying the `__injected`
+ * attribute, while `COMPACTION_ONLY_WRAPPED_STRIP_TAGS` below matches
+ * ambiguous bare-tag blocks that are shaped like a runtime-emitted
+ * open/close wrap. A new ambiguous tag added upstream needs to be
+ * evaluated against both tiers — internal-vocabulary names go here,
+ * and names whose bare form collides with ordinary English
+ * (`<memory>`, `<workspace>`, `<knowledge_base>`, `<pkb>`,
+ * `<system_reminder>`) go in the wrapped-strip list so user prose
+ * mentioning the tag is preserved.
+ */
+const COMPACTION_ONLY_STRIP_PREFIXES = [
+  "<memory __injected>",
+  "<memory_image __injected>",
+  "</memory_image>",
+  "<memory_context __injected>",
+  "<turn_context>",
+  "<channel_turn_context>",
+  "<guardian_context>",
+  "<inbound_actor_context>",
+  "<interface_turn_context>",
+  "<workspace_top_level>",
+  "<now_scratchpad>",
+  "<NOW.md Always keep this up to date",
+  "<active_thread>",
+  "<active_subagents>",
+  "<active_workspace>",
+  "<active_dynamic_page>",
+  "<channel_capabilities>",
+  "<channel_command_context>",
+  "<voice_call_control>",
+  "<transport_hints>",
+  "<system_notice>",
+  "<non_interactive_context>",
+  "<temporal_context>",
+];
+
+/**
+ * Tags whose bare form (`<tag>`) is common English vocabulary or markup a
+ * user might legitimately type in prose. For these we only strip a text
+ * block if it is shaped exactly like a runtime injection: starts with
+ * `<tag>\n` and ends with `</tag>`. This bare-tag wrapped shape
+ * (e.g. `<memory>\n...\n</memory>`) appears in persisted history
+ * alongside the `__injected`-attributed variants, which the prefix list
+ * above already catches via `<memory __injected>`. A user who mentions
+ * `<memory>` in a sentence or inlines `<workspace>...</workspace>` within
+ * other prose will not match this shape.
+ */
+const COMPACTION_ONLY_WRAPPED_STRIP_TAGS = [
+  "memory",
+  "memory_context",
+  "workspace",
+  "knowledge_base",
+  "pkb",
+  "system_reminder",
+];
+
+function isCompactionInjectedBlock(text: string): boolean {
+  if (COMPACTION_ONLY_STRIP_PREFIXES.some((p) => text.startsWith(p))) {
+    return true;
+  }
+  return COMPACTION_ONLY_WRAPPED_STRIP_TAGS.some(
+    (tag) => text.startsWith(`<${tag}>\n`) && text.endsWith(`</${tag}>`),
+  );
+}
+
+/**
+ * Remove text blocks that look like runtime injections from user messages.
+ * Non-text blocks (images, tool_use, tool_result, etc.) are untouched.
+ * Empty messages (every block filtered out) are dropped from the output.
+ *
+ * Used only on the `compactableMessages` slice right before it is
+ * serialized for the summarization LLM — the caller's original message
+ * array is never mutated.
+ */
+export function stripCompactionOnlyInjections(messages: Message[]): Message[] {
+  return messages
+    .map((message) => {
+      if (message.role !== "user") return message;
+      const nextContent = message.content.filter((block) => {
+        if (block.type !== "text") return true;
+        return !isCompactionInjectedBlock(block.text);
+      });
+      if (nextContent.length === message.content.length) return message;
+      if (nextContent.length === 0) return null;
+      return { ...message, content: nextContent };
+    })
+    .filter(
+      (message): message is NonNullable<typeof message> => message != null,
+    );
+}
+
 /**
  * Load the compaction summary system prompt from the bundled markdown asset.
  *
@@ -57,18 +169,27 @@ export function loadCompactPrompt(): string {
  * rather than failing module import at startup.
  */
 const SUMMARY_PROMPT_FALLBACK = [
-  "You compress long assistant conversations into durable working memory.",
-  "Focus on actionable state, not prose.",
-  "Preserve concrete facts: goals, constraints, decisions, pending questions, file paths, commands, errors, and TODOs.",
-  "Remove repetition and stale details that were superseded.",
-  'Thread anchors: when a "Retained Thread References" section is present, each listed reply cites its parent via `→ Mxxxxxx`. If that parent appears in the Transcript, preserve its text verbatim (reactions may be aggregated as "N users reacted"). Omit when the section is absent.',
-  "Return concise markdown using these section headers exactly:",
-  "## Goals",
-  "## Constraints",
-  "## Decisions",
-  "## Open Conversations",
-  "## Key Artifacts",
-  "## Recent Progress",
+  "You are summarizing a long conversation so that the assistant can keep working with it after older messages are dropped. Your summary will REPLACE those messages — the assistant's only access to what was said earlier will be what you write here.",
+  "",
+  "Be thorough. Capture what happened, why it mattered, what's unresolved, and what was felt. Do not compress away emotional tone, relationship context, or nuance. Keep specific details (names, numbers, file paths, commands, URLs, exact phrasings) when they might matter later.",
+  "",
+  "Target length: aim for 1500–4000 tokens. Use the upper end when the conversation is rich in decisions, relationships, emotional content, or threads that are still open. Use the lower end for short or simple task execution.",
+  "",
+  "Open with a 1–2 paragraph narrative describing what the conversation is about and where it currently stands. Then use `## ` section headers. Use these when they apply; skip sections that have nothing to say; add your own headers when something doesn't fit:",
+  "- `## What We're Working On`",
+  "- `## Decisions & Commitments`",
+  "- `## Facts Worth Remembering`",
+  "- `## Open Threads`",
+  "- `## Emotional Arc / Relationship Notes` (include when relevant)",
+  "- `## Artifacts & References`",
+  "",
+  "If an existing summary is provided, update it: merge new information in, prefer the most recent and explicit detail on conflicts, and preserve anything still unresolved or still true. Do not restart from scratch.",
+  "",
+  "Never include in the summary: content inside `<memory __injected>`, `<memory>`, `<turn_context>`, `<workspace>`, `<knowledge_base>`, `<system_reminder>`, `<now_scratchpad>`, `<NOW.md …>`, `<active_thread>`, `<channel_capabilities>`, `<transport_hints>`, `<system_notice>`, or any other angle-bracket-tagged system blocks. Tool-call boilerplate (retries, failed attempts the assistant recovered from, routine status updates) — summarize the outcome instead. Repetitive chit-chat that adds nothing.",
+  "",
+  'Thread anchors (Slack only): if the input includes a "Retained Thread References" section, each listed reply cites its parent via `→ Mxxxxxx`. If that parent appears in the Transcript, preserve its text verbatim. Omit when absent.',
+  "",
+  "Return only the summary itself in markdown — no preamble, no meta-commentary.",
 ].join("\n");
 
 /**
@@ -392,7 +513,7 @@ export class ContextWindowManager {
         summaryText: existingSummary ?? "",
         reason: didTruncate
           ? "truncated tool results without summarization"
-          : "unable to compact while keeping recent turns",
+          : "conversation already fits within the compaction target",
       };
     }
 
@@ -535,8 +656,14 @@ export class ContextWindowManager {
     const retainedThreadRefs = collectRetainedThreadReferences(
       messages.slice(keepPlan.keepFromIndex),
     );
+    // Strip runtime injections (memory, turn context, workspace hints, etc.)
+    // from the messages fed to the summarizer. These blocks are system
+    // metadata; leaving them in causes the summary to echo rotating memory
+    // content instead of the actual conversation. The caller's live message
+    // array is untouched so prefix caching stays intact.
+    const transcriptSource = stripCompactionOnlyInjections(compactableMessages);
     const transcriptBlocks = this.capTranscriptBlocksToTokenBudget(
-      serializeMessagesToContentBlocks(compactableMessages),
+      serializeMessagesToContentBlocks(transcriptSource),
       existingSummary ?? "No previous summary.",
       retainedThreadRefs,
     );
@@ -882,10 +1009,18 @@ export class ContextWindowManager {
      */
     failed: boolean;
   }> {
+    // When the existing summary is already consuming most of its budget,
+    // nudge the model to compress older durable content aggressively so
+    // incremental-update passes don't let the summary grow unboundedly.
+    const existingSummaryTokens = estimateTextTokens(currentSummary);
+    const compressionPressure =
+      existingSummaryTokens >=
+      this.summaryMaxTokens * SUMMARY_COMPRESSION_PRESSURE_RATIO;
     const contentBlocks = buildSummaryContentBlocks(
       currentSummary,
       transcriptBlocks,
       retainedThreadRefs,
+      { compressionPressure },
     );
     const summaryMessage: Message = { role: "user", content: contentBlocks };
     let failed = false;
@@ -895,7 +1030,10 @@ export class ContextWindowManager {
         undefined,
         SUMMARY_SYSTEM_PROMPT,
         {
-          config: { max_tokens: this.summaryMaxTokens },
+          config: {
+            callSite: "conversationSummarization" as const,
+            max_tokens: this.summaryMaxTokens,
+          },
           signal,
         },
       );
@@ -942,10 +1080,38 @@ export class ContextWindowManager {
     // Budget in tokens → approximate char limit (4 chars ≈ 1 token).
     const maxChars = this.summaryMaxTokens * 4;
     if (summary.length <= maxChars) return summary;
-    return `${safeStringSlice(summary, 0, maxChars)}...`;
+    return clampSummaryAtSectionBoundary(summary, maxChars);
   }
 }
 
+/**
+ * Truncate a markdown summary that exceeds `maxChars`, preferring a
+ * section boundary (`\n## `) so we never cut a heading mid-text. Falls
+ * back to a hard character slice when no boundary exists in the safe
+ * region (first half of the budget).
+ */
+export function clampSummaryAtSectionBoundary(
+  summary: string,
+  maxChars: number,
+): string {
+  if (summary.length <= maxChars) return summary;
+  const ELLIPSIS = "...";
+  // Hard limit we must stay under, leaving room for the ellipsis suffix.
+  const cutoff = maxChars - ELLIPSIS.length;
+  if (cutoff <= 0) return ELLIPSIS;
+  const head = safeStringSlice(summary, 0, cutoff);
+  // Find the last `## ` heading at a line start. Require it to be past the
+  // midpoint of the allowed region so we don't drop most of the summary
+  // just to hit a boundary — better to cut mid-section late than to keep
+  // almost nothing.
+  const halfway = Math.floor(cutoff / 2);
+  const boundary = head.lastIndexOf("\n## ");
+  if (boundary >= halfway) {
+    return `${head.slice(0, boundary).trimEnd()}\n${ELLIPSIS}`;
+  }
+  return `${head}${ELLIPSIS}`;
+}
+
 function collectUserTurnStartIndexes(messages: Message[]): number[] {
   const starts: number[] = [];
   for (let i = 0; i < messages.length; i++) {
@@ -1092,17 +1258,25 @@ function buildSummaryContentBlocks(
   currentSummary: string,
   transcriptBlocks: ContentBlock[],
   retainedThreadRefs: string[],
+  options: { compressionPressure: boolean } = { compressionPressure: false },
 ): ContentBlock[] {
   const lines = [
     "Update the summary with new transcript data.",
     "If new information conflicts with older notes, keep the most recent and explicit detail.",
     "Keep all unresolved asks and next steps.",
     "For any images included below, describe their visual content in the summary so the information is preserved after compaction.",
+  ];
+  if (options.compressionPressure) {
+    lines.push(
+      "The existing summary is approaching its token budget. Compress older durable content aggressively (drop detail that is no longer load-bearing, merge bullets, tighten prose) while preserving the most recent turns' nuance.",
+    );
+  }
+  lines.push(
     "",
     "### Existing Summary",
     currentSummary.trim().length > 0 ? currentSummary.trim() : "None.",
     "",
-  ];
+  );
   if (retainedThreadRefs.length > 0) {
     lines.push(
       "### Retained Thread References",

package/src/credential-execution/approval-bridge.ts

@@ -4,11 +4,11 @@
  * Translates a CES `approval_required` response into an interactive
  * confirmation prompt using the existing PermissionPrompter transport.
  * When the guardian approves, the bridge commits the decision back to CES
- * via the `record_grant` RPC rather than writing into `trust.json`.
+ * via the `record_grant` RPC rather than through local trust rules.
  *
  * Design principles:
  * - The assistant never sees raw secret values. The rendered proposal text
- *   comes from CES (generated by `@vellumai/ces-contracts` rendering).
+ *   comes from CES (generated by `@vellumai/service-contracts` rendering).
  * - Approved decisions are persisted inside CES, not in local trust rules.
  * - After approval the bridge returns a `grantId` so the caller can retry
  *   the original tool invocation with the grant attached.
@@ -17,11 +17,10 @@
 import type {
   ApprovalRequired,
   RecordGrantResponse,
-} from "@vellumai/ces-contracts";
+} from "@vellumai/service-contracts/credential-rpc";
 
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { UserDecision } from "../permissions/types.js";
-import { isPermissionControlsV2Enabled } from "../permissions/v2-consent-policy.js";
 import { getLogger } from "../util/logger.js";
 import type { CesClient } from "./client.js";
 
@@ -35,12 +34,8 @@ const log = getLogger("ces-approval-bridge");
  * CES approval decisions that the bridge presents to the guardian.
  *
  * Maps the existing confirmation transport decisions to CES grant semantics:
- * - `allow`          -> approved (single-use grant, no TTL)
- * - `allow_10m`      -> approved (temporary grant, 10-minute TTL)
- * - `allow_conversation` -> approved (conversation-scoped grant, no TTL but conversation-bound)
- * - `always_allow`   -> approved (persistent grant, no expiry)
- * - `deny`           -> denied
- * - `always_deny`    -> denied
+ * - `allow` -> approved (single-use grant, no TTL)
+ * - `deny`  -> denied
  */
 export interface CesApprovalDecision {
   /** The CES grant decision: approved or denied. */
@@ -48,12 +43,7 @@ export interface CesApprovalDecision {
   /** ISO-8601 duration for temporary grants. Undefined for single-use or persistent. */
   ttl: string | undefined;
   /** The type of grant to create (controls persistence behaviour in CES). */
-  grantType:
-    | "allow_once"
-    | "allow_10m"
-    | "allow_conversation"
-    | "always_allow"
-    | undefined;
+  grantType: "allow_once" | undefined;
   /** The original user decision from the confirmation transport. */
   userDecision: UserDecision;
 }
@@ -69,46 +59,13 @@ function mapUserDecisionToCesDecision(
         grantType: "allow_once",
         userDecision: decision,
       };
-    case "allow_10m":
-      return {
-        grantDecision: "approved",
-        ttl: "PT10M",
-        grantType: "allow_10m",
-        userDecision: decision,
-      };
-    case "allow_conversation":
-      // Conversation-scoped grants don't have a wall-clock TTL — they are bound
-      // to the conversation lifetime. CES handles the conversation binding; we pass
-      // no TTL so the grant remains active until the conversation ends.
-      return {
-        grantDecision: "approved",
-        ttl: undefined,
-        grantType: "allow_conversation",
-        userDecision: decision,
-      };
-    case "always_allow":
-      // Persistent grant — no expiry. CES stores it with expiresAt: null.
-      return {
-        grantDecision: "approved",
-        ttl: undefined,
-        grantType: "always_allow",
-        userDecision: decision,
-      };
     case "deny":
-    case "always_deny":
       return {
         grantDecision: "denied",
         ttl: undefined,
         grantType: undefined,
         userDecision: decision,
       };
-    case "temporary_override":
-      return {
-        grantDecision: "approved",
-        ttl: undefined,
-        grantType: "allow_once",
-        userDecision: decision,
-      };
     default: {
       // Exhaustiveness guard — treat unknown decisions as denials.
       const _exhaustive: never = decision;
@@ -188,24 +145,6 @@ export async function bridgeCesApproval(
     return { outcome: "denied", userDecision: "deny" };
   }
 
-  if (isPermissionControlsV2Enabled()) {
-    log.info(
-      {
-        event: "ces_approval_bridge_v2_suppressed",
-        proposalHash,
-        sessionId,
-      },
-      "CES approval request auto-approved without deterministic prompt under v2",
-    );
-    const v2Decision = mapUserDecisionToCesDecision("allow");
-    return recordCesGrant({
-      approval,
-      cesClient,
-      decision: v2Decision,
-      reason: "permission_controls_v2_auto_allow",
-    });
-  }
-
   // Build the tool name and input for the confirmation prompt. The tool
   // name uses a `ces:` prefix so the client can distinguish CES approval
   // requests from regular tool confirmation prompts.
@@ -236,7 +175,6 @@ export async function bridgeCesApproval(
     "host", // CES operations target the host
     false, // Persistent decisions are managed by CES, not trust.json
     options?.signal,
-    ["allow_10m", "allow_conversation"], // Offer temporary approval options
   );
 
   // Detect prompter timeout: the PermissionPrompter resolves timeouts as
@@ -278,7 +216,7 @@ export async function bridgeCesApproval(
     approval,
     cesClient,
     decision: cesDecision,
-    reason: response.decisionContext,
+    reason: response.decision === "allow" ? "guardian_approved" : "guardian_denied",
   });
 }