@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/runtime/middleware/__tests__/rate-limiter.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test";
+
+import { isLoopbackAddress } from "../auth.js";
+import {
+  apiRateLimiter,
+  loopbackApiRateLimiter,
+  selectAuthenticatedRateLimiter,
+} from "../rate-limiter.js";
+
+describe("isLoopbackAddress", () => {
+  test("accepts loopback addresses", () => {
+    expect(isLoopbackAddress("127.0.0.1")).toBe(true);
+    expect(isLoopbackAddress("127.42.0.7")).toBe(true);
+    expect(isLoopbackAddress("::1")).toBe(true);
+    expect(isLoopbackAddress("::ffff:127.0.0.1")).toBe(true);
+  });
+
+  test("rejects private (non-loopback) and public addresses", () => {
+    expect(isLoopbackAddress("10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("192.168.1.20")).toBe(false);
+    expect(isLoopbackAddress("172.16.0.5")).toBe(false);
+    expect(isLoopbackAddress("169.254.0.1")).toBe(false);
+    expect(isLoopbackAddress("::ffff:10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("fe80::1")).toBe(false);
+    expect(isLoopbackAddress("fd00::1")).toBe(false);
+    expect(isLoopbackAddress("8.8.8.8")).toBe(false);
+  });
+
+  test("rejects malformed input", () => {
+    expect(isLoopbackAddress("")).toBe(false);
+    expect(isLoopbackAddress("localhost")).toBe(false);
+    expect(isLoopbackAddress("127.0.0")).toBe(false);
+    expect(isLoopbackAddress("127.0.0.999")).toBe(false);
+  });
+});
+
+describe("selectAuthenticatedRateLimiter", () => {
+  test("loopback clients get the higher-budget limiter", () => {
+    expect(selectAuthenticatedRateLimiter("127.0.0.1")).toBe(
+      loopbackApiRateLimiter,
+    );
+    expect(selectAuthenticatedRateLimiter("::1")).toBe(loopbackApiRateLimiter);
+    expect(selectAuthenticatedRateLimiter("::ffff:127.0.0.1")).toBe(
+      loopbackApiRateLimiter,
+    );
+  });
+
+  test("remote and LAN clients get the standard limiter", () => {
+    expect(selectAuthenticatedRateLimiter("192.168.1.20")).toBe(apiRateLimiter);
+    expect(selectAuthenticatedRateLimiter("203.0.113.9")).toBe(apiRateLimiter);
+  });
+
+  test("loopback budget exceeds the standard budget", () => {
+    const loopback = loopbackApiRateLimiter.check(
+      "test-loopback-budget",
+      "/v1/test",
+    );
+    const standard = apiRateLimiter.check("test-standard-budget", "/v1/test");
+    expect(loopback.limit).toBeGreaterThan(standard.limit);
+    expect(loopback.limit).toBe(1200);
+    expect(standard.limit).toBe(300);
+  });
+});

package/src/runtime/middleware/auth.ts

@@ -12,6 +12,32 @@ export function isLoopbackHost(hostname: string): boolean {
   );
 }
 
+/** Unwrap IPv4-mapped IPv6 (e.g. ::ffff:10.0.0.1) to its IPv4 part. */
+function unwrapV4Mapped(addr: string): string {
+  const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  return v4Mapped ? v4Mapped[1] : addr;
+}
+
+/**
+ * Determine whether an IP address string is a loopback address —
+ * 127.0.0.0/8, ::1, or their IPv4-mapped IPv6 forms. Strictly narrower
+ * than {@link isPrivateAddress}: LAN peers (RFC 1918, link-local) are
+ * private but not loopback.
+ */
+export function isLoopbackAddress(addr: string): boolean {
+  const normalized = unwrapV4Mapped(addr);
+
+  if (normalized.includes(".")) {
+    const parts = normalized.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255))
+      return false;
+    // Loopback: 127.0.0.0/8
+    return parts[0] === 127;
+  }
+
+  return normalized.toLowerCase() === "::1";
+}
+
 /**
  * @internal Exported for testing.
  *
@@ -24,9 +50,7 @@ export function isLoopbackHost(hostname: string): boolean {
  *   - IPv4-mapped IPv6 variants of all of the above (::ffff:x.x.x.x)
  */
 export function isPrivateAddress(addr: string): boolean {
-  // Handle IPv4-mapped IPv6 (e.g. ::ffff:10.0.0.1) -- extract the IPv4 part
-  const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-  const normalized = v4Mapped ? v4Mapped[1] : addr;
+  const normalized = unwrapV4Mapped(addr);
 
   // IPv4 checks
   if (normalized.includes(".")) {

package/src/runtime/middleware/rate-limiter.ts

@@ -4,7 +4,7 @@
 
 import { getLogger } from "../../util/logger.js";
 import type { HttpErrorResponse } from "../http-errors.js";
-import { isPrivateAddress } from "./auth.js";
+import { isLoopbackAddress, isPrivateAddress } from "./auth.js";
 
 const log = getLogger("rate-limiter");
 
@@ -12,6 +12,14 @@ const DEFAULT_MAX_REQUESTS = 300;
 const DEFAULT_WINDOW_MS = 60_000; // 60 seconds
 const MAX_TRACKED_TOKENS = 10_000;
 
+// Higher budget for authenticated loopback clients. Loopback means the
+// request originated on the daemon's own host (desktop app, CLI, local
+// scripts) — proxied remote traffic resolves to its forwarded client IP
+// instead (see extractClientIp). Local clients legitimately burst far
+// beyond the remote budget: a cold sidebar load at thousands of
+// conversations pages through hundreds of GETs in a few seconds.
+const LOOPBACK_MAX_REQUESTS = 1200;
+
 // Lower limit for unauthenticated (IP-based) requests to reduce abuse surface.
 const DEFAULT_IP_MAX_REQUESTS = 20;
 const DEFAULT_IP_WINDOW_MS = 60_000;
@@ -186,6 +194,15 @@ export function rateLimitResponse(
 /** Singleton rate limiter for authenticated /v1/* requests (per-client-IP). */
 export const apiRateLimiter = new TokenRateLimiter();
 
+/**
+ * Singleton rate limiter for authenticated requests from loopback clients.
+ * Separate instance (not just a higher cap) so local and remote traffic
+ * never share or evict each other's buckets.
+ */
+export const loopbackApiRateLimiter = new TokenRateLimiter(
+  LOOPBACK_MAX_REQUESTS,
+);
+
 /** Singleton rate limiter for unauthenticated requests (per-IP, lower limits). */
 export const ipRateLimiter = new TokenRateLimiter(
   DEFAULT_IP_MAX_REQUESTS,
@@ -193,6 +210,16 @@ export const ipRateLimiter = new TokenRateLimiter(
   MAX_TRACKED_IPS,
 );
 
+/**
+ * Pick the rate limiter for an authenticated request: loopback client IPs
+ * get the higher local budget, everything else gets the standard one.
+ */
+export function selectAuthenticatedRateLimiter(
+  clientIp: string,
+): TokenRateLimiter {
+  return isLoopbackAddress(clientIp) ? loopbackApiRateLimiter : apiRateLimiter;
+}
+
 /**
  * Extract the client IP from a request. Only trusts proxy headers
  * (X-Forwarded-For, X-Real-IP) when the peer IP is loopback or private,

package/src/runtime/migrations/vbundle-builder.ts

@@ -3,7 +3,7 @@
  *
  * A .vbundle is a gzip-compressed tar archive containing:
  * - manifest.json: metadata with schema_version, checksums, and bundle info
- * - workspace/: the entire ~/.vellum/workspace/ directory tree (DB, config,
+ * - workspace/: the entire $VELLUM_WORKSPACE_DIR/ directory tree (DB, config,
  *   skills, prompts, attachments, etc.) — excluding large/regenerable
  *   dirs (embedding-models/, data/qdrant/)
  */
@@ -668,7 +668,7 @@ export interface BuildExportVBundleOptions {
   /** Whether secrets were stripped from the bundle before archiving. */
   secretsRedacted: boolean;
   /**
-   * Absolute path to the workspace directory (~/.vellum/workspace/).
+   * Absolute path to the workspace directory ($VELLUM_WORKSPACE_DIR/).
    * When provided and exists, the entire directory tree is walked and
    * included in the archive under the "workspace/" prefix, skipping
    * large/regenerable dirs (embedding-models/, data/qdrant/).
@@ -679,8 +679,9 @@ export interface BuildExportVBundleOptions {
    * Optional callback to checkpoint the WAL before reading the database file.
    * In WAL mode, committed rows may live in the -wal file and not yet be
    * flushed to the main .db file. Callers should pass a function that runs
-   * PRAGMA wal_checkpoint(FULL) on the live database connection. (Not
-   * TRUNCATE — see assistant/AGENTS.md "SQLite WAL checkpointing".)
+   * PRAGMA wal_checkpoint(FULL) on the live database connection — FULL
+   * flushes committed frames to the .db file without the extra WAL restart
+   * and truncation that TRUNCATE performs.
    * Called before the workspace walk so the DB file is up to date.
    *
    * May return a Promise — `streamExportVBundle` awaits the result so an
@@ -696,7 +697,7 @@ export interface BuildExportVBundleOptions {
 /**
  * Build a .vbundle archive populated with real assistant data.
  *
- * Walks the entire workspace directory (~/.vellum/workspace/) and includes
+ * Walks the entire workspace directory ($VELLUM_WORKSPACE_DIR/) and includes
  * all files in the archive, skipping only large/regenerable directories
  * (embedding-models/, data/qdrant/). Binary files (SQLite DB, attachments)
  * are included.

package/src/runtime/pending-interactions.ts

@@ -51,7 +51,12 @@ export interface ConfirmationDetails {
 }
 
 export interface PendingInteraction {
-  conversationId: string;
+  /**
+   * Owning conversation, when the interaction was raised inside one. Absent
+   * for interactions raised outside any conversation (e.g. the CLI
+   * `credentials prompt` command), which resolve via {@link rpcResolve}.
+   */
+  conversationId?: string;
   kind:
     | "confirmation"
     | "secret"
@@ -140,6 +145,10 @@ function emitResolved(
     },
     "Pending interaction resolved",
   );
+  // interaction_resolved is conversation-scoped on the wire; a conversation-less
+  // interaction has no conversation for clients to route the event to, so skip
+  // the broadcast.
+  if (interaction.conversationId === undefined) return;
   broadcastMessage({
     type: "interaction_resolved",
     requestId,
@@ -204,6 +213,16 @@ export function removeByConversation(
     ) {
       // resolve() clears the stored timer and detaches abort listeners.
       resolve(requestId, state);
+      // Secret prompts have no abort-signal teardown (unlike questions) and
+      // are not pre-settled by denyAllPendingConfirmations (unlike
+      // confirmations), so removing the entry alone would leave the caller's
+      // Promise — the CLI `credentials prompt` command or the in-conversation
+      // SecretPrompter — hanging until its IPC client times out. Settle it
+      // with a cancelled result, matching the prompt timeout path. rpcResolve
+      // is idempotent, so any later resolveSecret/dispose call is a no-op.
+      if (interaction.kind === "secret") {
+        interaction.rpcResolve?.({ value: null, delivery: "store" });
+      }
     }
   }
 }