@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/tools/credential-execution/manage-secure-command-tool.ts

@@ -18,8 +18,13 @@
 import type { ManageSecureCommandTool } from "@vellumai/service-contracts/rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
+import { getCesClient } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
-import type { ToolContext, ToolDefinition, ToolExecutionResult } from "../types.js";
+import type {
+  ToolContext,
+  ToolDefinition,
+  ToolExecutionResult,
+} from "../types.js";
 
 const log = getLogger("ces-tool:manage-secure-command-tool");
 
@@ -34,211 +39,211 @@ class ManageSecureCommandToolImpl implements ToolDefinition {
   defaultRiskLevel = RiskLevel.High;
 
   input_schema = {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["register", "unregister"],
+        description:
+          'Whether to install/update ("register") or remove ("unregister") the secure command tool.',
+      },
+      toolName: {
+        type: "string",
+        description:
+          "Unique tool name for the secure command (e.g. aws-cli, kubectl).",
+      },
+      bundleId: {
+        type: "string",
+        description:
+          "Bundle identifier for the secure command package (required for register).",
+      },
+      version: {
+        type: "string",
+        description:
+          "Semantic version of the bundle to install (required for register).",
+      },
+      sourceUrl: {
+        type: "string",
+        description:
+          "URL from which CES will download the bundle (required for register). Must be HTTPS.",
+      },
+      sha256: {
+        type: "string",
+        description:
+          "SHA-256 hash of the bundle for integrity verification (required for register).",
+      },
+      credentialHandle: {
+        type: "string",
+        description:
+          "CES credential handle the tool should use (required for register).",
+      },
+      description: {
+        type: "string",
+        description:
+          "Human-readable description of what the secure command tool does (required for register).",
+      },
+      secureCommandManifest: {
         type: "object",
+        description:
+          "Full secure command manifest for the bundle (required for register). " +
+          "Contains entrypoint, command profiles, auth adapter, egress mode, etc. " +
+          "CES validates this manifest before publishing the bundle.",
         properties: {
-          action: {
+          schemaVersion: {
             type: "string",
-            enum: ["register", "unregister"],
-            description:
-              'Whether to install/update ("register") or remove ("unregister") the secure command tool.',
+            description: 'Manifest schema version. Must be "1".',
           },
-          toolName: {
+          bundleDigest: {
             type: "string",
-            description:
-              "Unique tool name for the secure command (e.g. aws-cli, kubectl).",
+            description: "SHA-256 hex digest of the command bundle.",
           },
           bundleId: {
             type: "string",
-            description:
-              "Bundle identifier for the secure command package (required for register).",
+            description: "Unique identifier for the command bundle.",
           },
           version: {
             type: "string",
-            description:
-              "Semantic version of the bundle to install (required for register).",
-          },
-          sourceUrl: {
-            type: "string",
-            description:
-              "URL from which CES will download the bundle (required for register). Must be HTTPS.",
-          },
-          sha256: {
-            type: "string",
-            description:
-              "SHA-256 hash of the bundle for integrity verification (required for register).",
+            description: "Semantic version of the bundle.",
           },
-          credentialHandle: {
+          entrypoint: {
             type: "string",
             description:
-              "CES credential handle the tool should use (required for register).",
+              'Path to the executable entrypoint within the bundle (e.g. "bin/gh").',
           },
-          description: {
-            type: "string",
+          commandProfiles: {
+            type: "object",
             description:
-              "Human-readable description of what the secure command tool does (required for register).",
+              "Named command profiles. Each profile defines a narrow execution boundary.",
+            additionalProperties: {
+              type: "object",
+              properties: {
+                description: { type: "string" },
+                allowedArgvPatterns: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      name: { type: "string" },
+                      tokens: {
+                        type: "array",
+                        items: { type: "string" },
+                      },
+                    },
+                    required: ["name", "tokens"],
+                  },
+                },
+                deniedSubcommands: {
+                  type: "array",
+                  items: { type: "string" },
+                },
+                deniedFlags: {
+                  type: "array",
+                  items: { type: "string" },
+                },
+                allowedNetworkTargets: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      hostPattern: { type: "string" },
+                      ports: {
+                        type: "array",
+                        items: { type: "number" },
+                      },
+                      protocols: {
+                        type: "array",
+                        items: { type: "string" },
+                      },
+                    },
+                    required: ["hostPattern"],
+                  },
+                },
+              },
+              required: [
+                "description",
+                "allowedArgvPatterns",
+                "deniedSubcommands",
+              ],
+            },
           },
-          secureCommandManifest: {
+          authAdapter: {
             type: "object",
             description:
-              "Full secure command manifest for the bundle (required for register). " +
-              "Contains entrypoint, command profiles, auth adapter, egress mode, etc. " +
-              "CES validates this manifest before publishing the bundle.",
+              "Auth adapter configuration describing how credentials are injected. " +
+              "Use type=env_var to set an environment variable, type=temp_file to write " +
+              "credentials to a temporary file, or type=credential_process to run a helper command.",
             properties: {
-              schemaVersion: {
+              type: {
                 type: "string",
-                description: 'Manifest schema version. Must be "1".',
-              },
-              bundleDigest: {
-                type: "string",
-                description: "SHA-256 hex digest of the command bundle.",
-              },
-              bundleId: {
-                type: "string",
-                description: "Unique identifier for the command bundle.",
+                enum: ["env_var", "temp_file", "credential_process"],
+                description:
+                  "Adapter type: env_var, temp_file, or credential_process.",
               },
-              version: {
+              envVarName: {
                 type: "string",
-                description: "Semantic version of the bundle.",
+                description:
+                  "Environment variable name for credential injection (required for all types).",
               },
-              entrypoint: {
+              valuePrefix: {
                 type: "string",
                 description:
-                  'Path to the executable entrypoint within the bundle (e.g. "bin/gh").',
+                  'Optional prefix prepended to the credential value (env_var only, e.g. "Bearer ").',
               },
-              commandProfiles: {
-                type: "object",
+              fileExtension: {
+                type: "string",
                 description:
-                  "Named command profiles. Each profile defines a narrow execution boundary.",
-                additionalProperties: {
-                  type: "object",
-                  properties: {
-                    description: { type: "string" },
-                    allowedArgvPatterns: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          name: { type: "string" },
-                          tokens: {
-                            type: "array",
-                            items: { type: "string" },
-                          },
-                        },
-                        required: ["name", "tokens"],
-                      },
-                    },
-                    deniedSubcommands: {
-                      type: "array",
-                      items: { type: "string" },
-                    },
-                    deniedFlags: {
-                      type: "array",
-                      items: { type: "string" },
-                    },
-                    allowedNetworkTargets: {
-                      type: "array",
-                      items: {
-                        type: "object",
-                        properties: {
-                          hostPattern: { type: "string" },
-                          ports: {
-                            type: "array",
-                            items: { type: "number" },
-                          },
-                          protocols: {
-                            type: "array",
-                            items: { type: "string" },
-                          },
-                        },
-                        required: ["hostPattern"],
-                      },
-                    },
-                  },
-                  required: [
-                    "description",
-                    "allowedArgvPatterns",
-                    "deniedSubcommands",
-                  ],
-                },
+                  'Optional file extension for the temp file (temp_file only, e.g. ".json").',
               },
-              authAdapter: {
-                type: "object",
+              fileMode: {
+                type: "number",
                 description:
-                  "Auth adapter configuration describing how credentials are injected. " +
-                  "Use type=env_var to set an environment variable, type=temp_file to write " +
-                  "credentials to a temporary file, or type=credential_process to run a helper command.",
-                properties: {
-                  type: {
-                    type: "string",
-                    enum: ["env_var", "temp_file", "credential_process"],
-                    description:
-                      "Adapter type: env_var, temp_file, or credential_process.",
-                  },
-                  envVarName: {
-                    type: "string",
-                    description:
-                      "Environment variable name for credential injection (required for all types).",
-                  },
-                  valuePrefix: {
-                    type: "string",
-                    description:
-                      'Optional prefix prepended to the credential value (env_var only, e.g. "Bearer ").',
-                  },
-                  fileExtension: {
-                    type: "string",
-                    description:
-                      'Optional file extension for the temp file (temp_file only, e.g. ".json").',
-                  },
-                  fileMode: {
-                    type: "number",
-                    description:
-                      "Optional file mode/permissions for the temp file (temp_file only, e.g. 0o600).",
-                  },
-                  helperCommand: {
-                    type: "string",
-                    description:
-                      "Command to run to obtain credentials (credential_process only, required for that type).",
-                  },
-                  timeoutMs: {
-                    type: "number",
-                    description:
-                      "Timeout in milliseconds for the helper command (credential_process only).",
-                  },
-                },
-                required: ["type", "envVarName"],
+                  "Optional file mode/permissions for the temp file (temp_file only, e.g. 0o600).",
               },
-              egressMode: {
+              helperCommand: {
                 type: "string",
-                enum: ["proxy_required", "no_network"],
-                description: "Network egress enforcement mode.",
+                description:
+                  "Command to run to obtain credentials (credential_process only, required for that type).",
               },
-              cleanConfigDirs: {
-                type: "object",
+              timeoutMs: {
+                type: "number",
                 description:
-                  "Config directories to mount as empty tmpfs during execution.",
-                additionalProperties: { type: "string" },
+                  "Timeout in milliseconds for the helper command (credential_process only).",
               },
             },
-            required: [
-              "schemaVersion",
-              "bundleDigest",
-              "bundleId",
-              "version",
-              "entrypoint",
-              "commandProfiles",
-              "authAdapter",
-              "egressMode",
-            ],
+            required: ["type", "envVarName"],
+          },
+          egressMode: {
+            type: "string",
+            enum: ["proxy_required", "no_network"],
+            description: "Network egress enforcement mode.",
+          },
+          cleanConfigDirs: {
+            type: "object",
+            description:
+              "Config directories to mount as empty tmpfs during execution.",
+            additionalProperties: { type: "string" },
           },
         },
-        required: ["action", "toolName"],
-      };
+        required: [
+          "schemaVersion",
+          "bundleDigest",
+          "bundleId",
+          "version",
+          "entrypoint",
+          "commandProfiles",
+          "authAdapter",
+          "egressMode",
+        ],
+      },
+    },
+    required: ["action", "toolName"],
+  };
 
   async execute(
     input: Record<string, unknown>,
-    context: ToolContext,
+    _context: ToolContext,
   ): Promise<ToolExecutionResult> {
-    const cesClient = context.cesClient;
+    const cesClient = getCesClient();
     if (!cesClient) {
       return {
         content:

package/src/tools/credential-execution/run-authenticated-command.ts

@@ -16,6 +16,7 @@ import {
 } from "@vellumai/service-contracts/credential-rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
+import { getCesClient } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import type {
   ToolContext,
@@ -106,7 +107,7 @@ export const runAuthenticatedCommandTool = {
     input: Record<string, unknown>,
     context: ToolContext,
   ): Promise<ToolExecutionResult> {
-    const cesClient = context.cesClient;
+    const cesClient = getCesClient();
     if (!cesClient) {
       return {
         content:

package/src/tools/executor.ts

@@ -7,6 +7,7 @@ import { PermissionPrompter } from "../permissions/prompter.js";
 import { RiskLevel } from "../permissions/types.js";
 import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
 import { redactSensitiveFields } from "../security/redaction.js";
+import { getCesClient } from "../security/secure-keys.js";
 import { TokenExpiredError } from "../security/token-manager.js";
 import { PermissionDeniedError, ToolError } from "../util/errors.js";
 import { pathExists, safeStatSync } from "../util/fs.js";
@@ -21,10 +22,11 @@ import { sandboxPolicy } from "./shared/filesystem/path-policy.js";
 import { MAX_FILE_SIZE_BYTES } from "./shared/filesystem/size-guard.js";
 import { ToolApprovalHandler } from "./tool-approval-handler.js";
 import { resolveToolInvocationAlias } from "./tool-name-aliases.js";
-import type {
-  ToolContext,
-  ToolExecutionResult,
-  ToolLifecycleEvent,
+import {
+  stringifyToolInput,
+  type ToolContext,
+  type ToolExecutionResult,
+  type ToolLifecycleEvent,
 } from "./types.js";
 
 const log = getLogger("tool-executor");
@@ -207,7 +209,8 @@ export class ToolExecutor {
       // indicator, present the proposal to the guardian via the existing
       // confirmation transport, commit the decision to CES, and retry
       // the original tool invocation with the granted grantId.
-      if (execResult.cesApprovalRequired && !context.cesClient) {
+      const cesClient = getCesClient();
+      if (execResult.cesApprovalRequired && !cesClient) {
         const msg = `CES approval required for "${name}" but no CES client is available. Ensure the Credential Execution Service is running.`;
         const durationMs = Date.now() - startTime;
         emitLifecycleEvent(context, {
@@ -228,11 +231,11 @@ export class ToolExecutor {
         });
         return { content: msg, isError: true };
       }
-      if (execResult.cesApprovalRequired && context.cesClient) {
+      if (execResult.cesApprovalRequired && cesClient) {
         const bridgeResult = await bridgeCesApproval(
           execResult.cesApprovalRequired,
           this.prompter,
-          context.cesClient,
+          cesClient,
           {
             isInteractive: context.isInteractive,
             conversationId: context.conversationId,
@@ -308,6 +311,15 @@ export class ToolExecutor {
         }
       }
 
+      // Sized from the RAW pre-sanitization result — sensitive-output
+      // extraction below strips directives and swaps raw values for
+      // placeholders, which changes the content length, and telemetry must
+      // report the true payload size. Only the size leaves the device,
+      // never the payload. Stamped here (not centrally in
+      // emitLifecycleEvent) because only this site sees the content before
+      // extractAndSanitize() rewrites it.
+      const rawResultBytes = Buffer.byteLength(execResult.content, "utf8");
+
       // Sensitive output extraction: strip directives, replace raw values
       // with placeholders, and attach bindings for agent-loop substitution.
       const { sanitizedContent, bindings } = extractAndSanitize(
@@ -339,6 +351,7 @@ export class ToolExecutor {
         decision,
         durationMs,
         result: safeResult,
+        resultBytes: rawResultBytes,
       });
 
       // Merge risk metadata from the classifier assessment cache onto the
@@ -491,6 +504,25 @@ function emitLifecycleEvent(
     input: sanitizeToolInput(event.toolName, event.input),
   };
 
+  // Stamp telemetry fields centrally so every executed/error event carries
+  // them — including the pre-execution gate failures (aborted, disk
+  // pressure, unknown/inactive tool) emitted from checkPreExecutionGates(),
+  // whose emission sites don't have to remember to copy them. This is the
+  // sole writer of both fields. (`resultBytes` is the exception: it is
+  // stamped at the executed emission site in executeInternal, the only
+  // place that sees the result content before sensitive-output extraction
+  // rewrites it; the spread above passes it through untouched.)
+  if (sanitizedEvent.type === "executed" || sanitizedEvent.type === "error") {
+    sanitizedEvent.attribution = context.attribution ?? null;
+    // Sized from the RAW pre-sanitization input — redaction changes the
+    // serialized length, and telemetry must report the true payload size.
+    // Only the size leaves the device, never the payload.
+    sanitizedEvent.inputBytes = Buffer.byteLength(
+      stringifyToolInput(event.input),
+      "utf8",
+    );
+  }
+
   try {
     const maybePromise = handler(sanitizedEvent as ToolLifecycleEvent);
     if (maybePromise) {