@vellumai/assistant 0.8.5 → 0.8.7

package/src/acp/__tests__/prepare-agent-env.test.ts

@@ -5,28 +5,120 @@
  * The route-level test in `runtime/routes/acp-routes.test.ts` covers the same
  * behavior through the HTTP handler; these tests pin the helper in isolation
  * so the contract is clear and a future refactor can't silently break it.
+ *
+ * Credential reads go through the credential broker (`serverUse`), so we
+ * mock the broker and metadata store rather than the raw secure-keys backend.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-// Stub the secure-keys backend BEFORE importing the helper. Bun's
-// `mock.module` is process-global and only takes effect for imports that
-// follow it — the dynamic import below ensures correctness.
-const secureKeyStore = new Map<string, string>();
+// ---------------------------------------------------------------------------
+// Stubs — wired BEFORE importing the helper via dynamic import.
+// ---------------------------------------------------------------------------
+
+/** Simulates the credential metadata store. */
+const metadataStore = new Map<
+  string,
+  { allowedTools: string[]; usageDescription?: string }
+>();
 
-mock.module("../../security/secure-keys.js", () => ({
-  getSecureKeyAsync: async (key: string) => secureKeyStore.get(key),
+mock.module("../../tools/credentials/metadata-store.js", () => ({
+  getCredentialMetadata: (service: string, field: string) => {
+    const key = `${service}/${field}`;
+    const entry = metadataStore.get(key);
+    if (!entry) return undefined;
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: entry.allowedTools,
+      allowedDomains: [],
+      usageDescription: entry.usageDescription,
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+  upsertCredentialMetadata: (
+    service: string,
+    field: string,
+    policy?: { allowedTools?: string[]; usageDescription?: string },
+  ) => {
+    const key = `${service}/${field}`;
+    const existing = metadataStore.get(key);
+    metadataStore.set(key, {
+      allowedTools: policy?.allowedTools ?? existing?.allowedTools ?? [],
+      usageDescription:
+        policy?.usageDescription ?? existing?.usageDescription,
+    });
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: metadataStore.get(key)!.allowedTools,
+      allowedDomains: [],
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+}));
+
+/**
+ * Simulates the credential broker's serverUse method. The vault stores
+ * plaintext values keyed by `service/field`; the broker enforces tool
+ * policy via the metadata store before passing the value to the callback.
+ */
+const vaultStore = new Map<string, string>();
+
+mock.module("../../tools/credentials/broker.js", () => ({
+  credentialBroker: {
+    serverUse: async <T>(request: {
+      service: string;
+      field: string;
+      toolName: string;
+      execute: (value: string) => Promise<T>;
+    }) => {
+      const key = `${request.service}/${request.field}`;
+      const meta = metadataStore.get(key);
+      if (!meta) {
+        return { success: false, reason: `No credential found for ${key}` };
+      }
+      if (!meta.allowedTools.includes(request.toolName)) {
+        return {
+          success: false,
+          reason: `Tool "${request.toolName}" not allowed`,
+        };
+      }
+      const value = vaultStore.get(key);
+      if (!value) {
+        return {
+          success: false,
+          reason: `No stored value for ${key}`,
+        };
+      }
+      const result = await request.execute(value);
+      return { success: true, result };
+    },
+  },
 }));
 
 const { prepareAgentEnv } = await import("../prepare-agent-env.js");
 
 beforeEach(() => {
-  secureKeyStore.clear();
+  metadataStore.clear();
+  vaultStore.clear();
 });
 
+// ---------------------------------------------------------------------------
+// Helper to seed a vault entry (simulates `assistant credentials set`).
+// ---------------------------------------------------------------------------
+
+function seedVaultToken(token: string): void {
+  vaultStore.set("acp/claude_oauth_token", token);
+}
+
 describe("prepareAgentEnv — claude-agent-acp gating", () => {
-  test("injects CLAUDE_CODE_OAUTH_TOKEN from the secure store when agent.env has no override", async () => {
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-AAA");
+  test("injects CLAUDE_CODE_OAUTH_TOKEN from the vault via the broker when agent.env has no override", async () => {
+    seedVaultToken("vault-AAA");
 
     const prepared = await prepareAgentEnv({
       command: "claude-agent-acp",
@@ -36,6 +128,42 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
     expect(prepared.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("vault-AAA");
   });
 
+  test("auto-registers metadata with acp_spawn in allowedTools when none exists", async () => {
+    seedVaultToken("vault-auto-meta");
+
+    await prepareAgentEnv({ command: "claude-agent-acp", args: [] });
+
+    const meta = metadataStore.get("acp/claude_oauth_token");
+    expect(meta).toBeDefined();
+    expect(meta!.allowedTools).toContain("acp_spawn");
+  });
+
+  test("adds acp_spawn to metadata with empty allowedTools (default provisioning path)", async () => {
+    metadataStore.set("acp/claude_oauth_token", {
+      allowedTools: [],
+    });
+    seedVaultToken("vault-augment");
+
+    await prepareAgentEnv({ command: "claude-agent-acp", args: [] });
+
+    const meta = metadataStore.get("acp/claude_oauth_token");
+    expect(meta!.allowedTools).toContain("acp_spawn");
+  });
+
+  test("respects explicit tool policy that excludes acp_spawn", async () => {
+    metadataStore.set("acp/claude_oauth_token", {
+      allowedTools: ["other_tool"],
+    });
+    seedVaultToken("vault-restricted");
+
+    await expect(
+      prepareAgentEnv({ command: "claude-agent-acp", args: [] }),
+    ).rejects.toThrow("CLAUDE_CODE_OAUTH_TOKEN");
+
+    const meta = metadataStore.get("acp/claude_oauth_token");
+    expect(meta!.allowedTools).toEqual(["other_tool"]);
+  });
+
   test("accepts CLAUDE_CODE_OAUTH_TOKEN from agent.env (config.json override) with no vault entry", async () => {
     const prepared = await prepareAgentEnv({
       command: "claude-agent-acp",
@@ -46,10 +174,8 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
     expect(prepared.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("config-BBB");
   });
 
-  test("agent.env override wins over the secure-store entry (precedence pin)", async () => {
-    // The config-supplied env wins so users can rotate per-workspace without
-    // racing the vault. Mirrors the route-level precedence test.
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-CCC");
+  test("agent.env override wins over the vault entry (precedence pin)", async () => {
+    seedVaultToken("vault-CCC");
 
     const prepared = await prepareAgentEnv({
       command: "claude-agent-acp",
@@ -61,7 +187,7 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
   });
 
   test("preserves unrelated env vars on agent.env when injecting from the vault", async () => {
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-EEE");
+    seedVaultToken("vault-EEE");
 
     const prepared = await prepareAgentEnv({
       command: "claude-agent-acp",
@@ -74,19 +200,13 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
   });
 
   test("throws FailedDependencyError when no token is provided from either route", async () => {
-    // secureKeyStore empty, no agent.env override — the preflight must throw
-    // so callers fail fast instead of spawning a zombie subprocess that the
-    // SDK rejects with 'Authentication required' after the first prompt.
     await expect(
       prepareAgentEnv({ command: "claude-agent-acp", args: [] }),
     ).rejects.toThrow("CLAUDE_CODE_OAUTH_TOKEN");
   });
 
   test("gates on the resolved command BASENAME (alias to /custom/path/claude-agent-acp still gets the token)", async () => {
-    // A user-supplied `acp.agents.my-claude = { command: "/opt/.../claude-agent-acp" }`
-    // is the only realistic path that lands a non-bare basename here. The
-    // helper must still recognize it.
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-FFF");
+    seedVaultToken("vault-FFF");
 
     const prepared = await prepareAgentEnv({
       command: "/opt/bin/claude-agent-acp",
@@ -97,10 +217,7 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
   });
 
   test("does NOT mutate the caller's agentConfig", async () => {
-    // Callers pass `resolved.agent` which is shared state from the resolver's
-    // config cache. The helper must clone before mutating, otherwise repeated
-    // spawns would race on the same object.
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-GGG");
+    seedVaultToken("vault-GGG");
     const original = {
       command: "claude-agent-acp",
       args: [],
@@ -119,10 +236,6 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
 
 describe("prepareAgentEnv — non-claude commands", () => {
   test("returns the config unchanged for codex-acp (no required env vars today)", async () => {
-    // codex-acp inherits auth from the underlying `codex` CLI binary
-    // (codex login / CODEX_API_KEY / OPENAI_API_KEY in process.env) — no
-    // ACP-level env injection. Pin that contract so a future change has
-    // to update this test explicitly.
     const prepared = await prepareAgentEnv({
       command: "codex-acp",
       args: [],
@@ -132,7 +245,7 @@ describe("prepareAgentEnv — non-claude commands", () => {
   });
 
   test("returns the config unchanged for an unrecognized command basename", async () => {
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-HHH");
+    seedVaultToken("vault-HHH");
 
     const prepared = await prepareAgentEnv({
       command: "some-future-adapter",
@@ -140,7 +253,6 @@ describe("prepareAgentEnv — non-claude commands", () => {
       env: { FOO: "bar" },
     });
 
-    // No injection — basename gate skipped.
     expect(prepared.env).toEqual({ FOO: "bar" });
   });
 });

package/src/acp/prepare-agent-env.ts

@@ -13,15 +13,54 @@
  *
  * The fix: have this single helper own injection + preflight, and have
  * every caller route through it before calling `manager.spawn`.
+ *
+ * Credential reads go through the credential broker (`serverUse`) so they
+ * are policy-gated (tool allowlist) and audit-logged. This keeps
+ * `prepare-agent-env.ts` off the secure-keys import allowlist — the broker
+ * owns the plaintext read boundary.
  */
 
 import { basename } from "node:path";
 
 import { FailedDependencyError } from "../runtime/routes/errors.js";
-import { credentialKey } from "../security/credential-key.js";
-import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { credentialBroker } from "../tools/credentials/broker.js";
+import {
+  getCredentialMetadata,
+  upsertCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
 import type { AcpAgentConfig } from "./types.js";
 
+const ACP_SPAWN_TOOL = "acp_spawn";
+
+/**
+ * Ensure the `acp/claude_oauth_token` credential has metadata that allows
+ * the `acp_spawn` tool to read it, but only for legacy/unmanaged cases:
+ *
+ * - No metadata at all → create with `allowedTools: ["acp_spawn"]`.
+ * - Metadata exists with an empty `allowedTools` → default provisioning
+ *   path (user ran `credentials set` without `--allowed-tools`), add it.
+ * - Metadata exists with a non-empty `allowedTools` → explicit policy set
+ *   by the user/admin. Respect it even if `acp_spawn` is absent — the
+ *   broker will deny the read and the preflight will throw.
+ */
+function ensureAcpTokenPolicy(): void {
+  const meta = getCredentialMetadata("acp", "claude_oauth_token");
+  if (!meta) {
+    upsertCredentialMetadata("acp", "claude_oauth_token", {
+      allowedTools: [ACP_SPAWN_TOOL],
+      usageDescription:
+        "Claude OAuth token for ACP agent authentication",
+    });
+    return;
+  }
+  const tools = meta.allowedTools ?? [];
+  if (tools.length === 0) {
+    upsertCredentialMetadata("acp", "claude_oauth_token", {
+      allowedTools: [ACP_SPAWN_TOOL],
+    });
+  }
+}
+
 /**
  * Returns a NEW config with any required credentials merged into `env`.
  * Does NOT mutate the input. Throws `FailedDependencyError` if a required
@@ -39,9 +78,8 @@ import type { AcpAgentConfig } from "./types.js";
  *   1. `acp.agents.<id>.env.CLAUDE_CODE_OAUTH_TOKEN` in `config.json` —
  *      the user-supplied env override on the resolved agent config.
  *   2. Secure store via CLI: `assistant credentials set --service acp \
- *        --field claude_oauth_token <token>` — written to the canonical
- *      `credential/{service}/{field}` key built by `credentialKey()`,
- *      used as fallback when (1) is unset.
+ *        --field claude_oauth_token <token>` — read through the
+ *      credential broker for policy enforcement and audit logging.
  * After resolution, this asserts the token is present (from either route)
  * before spawning. The "fail-fast" throw is symmetric with the existing
  * `binary_not_found` preflight in `resolveAcpAgent` and strictly better
@@ -58,12 +96,15 @@ export async function prepareAgentEnv(
 
   if (commandBasename === "claude-agent-acp") {
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
-      const claudeToken = await getSecureKeyAsync(
-        credentialKey("acp", "claude_oauth_token"),
-      );
-      if (claudeToken) {
-        env.CLAUDE_CODE_OAUTH_TOKEN = claudeToken;
-      }
+      ensureAcpTokenPolicy();
+      await credentialBroker.serverUse<void>({
+        service: "acp",
+        field: "claude_oauth_token",
+        toolName: ACP_SPAWN_TOOL,
+        execute: async (token) => {
+          env.CLAUDE_CODE_OAUTH_TOKEN = token;
+        },
+      });
     }
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
       throw new FailedDependencyError(

package/src/acp/session-manager.ts

@@ -460,14 +460,13 @@ export class AcpSessionManager {
             current.parentConversationId,
           );
           if (parentConversation) {
-            const enqueueResult = parentConversation.enqueueMessage(
-              notifyMessage,
-              [],
-            );
+            const enqueueResult = parentConversation.enqueueMessage({
+              content: notifyMessage,
+            });
             if (!enqueueResult.queued && !enqueueResult.rejected) {
               parentConversation
-                .persistUserMessage(notifyMessage, [])
-                .then((messageId) =>
+                .persistUserMessage({ content: notifyMessage })
+                .then(({ id: messageId }) =>
                   parentConversation.runAgentLoop(notifyMessage, messageId),
                 )
                 .catch((err) => {

package/src/agent/compaction-circuit.ts

@@ -0,0 +1,140 @@
+import type { TrustContext } from "../daemon/trust-context.js";
+import { FALLBACK_TURN_TRUST } from "../daemon/trust-context.js";
+import { DEFAULT_TIMEOUTS, runPipeline } from "../plugins/pipeline.js";
+import { getMiddlewaresFor } from "../plugins/registry.js";
+import type {
+  CircuitBreakerArgs,
+  CircuitBreakerResult,
+  CompactionCircuitEvent,
+  TurnContext,
+} from "../plugins/types.js";
+
+/**
+ * Turn-scoped identifiers the circuit pipeline runner needs to populate its
+ * log records and plugin attribution. They are supplied per call because they
+ * belong to the active turn, not to the circuit's durable state — non-turn
+ * callers (e.g. `Conversation.forceCompact`) leave the optional fields unset
+ * and fall back to stable placeholders.
+ */
+export interface CircuitTurnInfo {
+  currentRequestId?: string;
+  currentTurnTrustContext?: TrustContext;
+  trustContext?: TrustContext;
+  turnCount: number;
+}
+
+/**
+ * Per-conversation compaction circuit breaker: three consecutive summary-LLM
+ * failures trip a one-hour cooldown during which auto-compaction is skipped;
+ * any successful compaction resets the counter. State is in-memory only —
+ * resets on process restart, the intended "one free retry after restart"
+ * behavior.
+ *
+ * The breaker's threshold/cooldown semantics live in the `circuitBreaker`
+ * plugin (`plugins/defaults/circuit-breaker/register.ts`), which mutates this
+ * object in place via the `CircuitBreakerArgs.state` container. This class is
+ * that container plus the methods the rest of the daemon uses to query and
+ * update it, so the dev-only playground routes can read and write the same
+ * fields directly.
+ */
+export class CompactionCircuit {
+  readonly conversationId: string;
+  consecutiveCompactionFailures = 0;
+  compactionCircuitOpenUntil: number | null = null;
+
+  constructor(conversationId: string) {
+    this.conversationId = conversationId;
+  }
+
+  /**
+   * Update the breaker with the outcome of a `maybeCompact` call and emit any
+   * transition event. Callers must only invoke this when the summary LLM
+   * actually ran (`summaryFailed !== undefined`) so early-return paths don't
+   * silently reset the 3-strike counter.
+   */
+  async recordOutcome(
+    turn: CircuitTurnInfo,
+    summaryFailed: boolean,
+    onEvent: (msg: CompactionCircuitEvent) => void,
+  ): Promise<void> {
+    await this.run(turn, {
+      outcome: summaryFailed ? "failure" : "success",
+      onEvent,
+    });
+  }
+
+  /**
+   * Query-only: is the breaker currently open? Auto-compaction paths gate on
+   * `!isOpen(...)`; forced paths admit regardless of the decision.
+   */
+  async isOpen(turn: CircuitTurnInfo): Promise<boolean> {
+    const decision = await this.run(turn, {});
+    return decision.open;
+  }
+
+  /**
+   * Clear the breaker: zero the failure counter and close the circuit,
+   * emitting `compaction_circuit_closed` on the open→closed transition.
+   * Equivalent to recording a successful outcome.
+   */
+  async reset(
+    turn: CircuitTurnInfo,
+    onEvent?: (msg: CompactionCircuitEvent) => void,
+  ): Promise<void> {
+    await this.run(turn, {
+      outcome: "success",
+      ...(onEvent ? { onEvent } : {}),
+    });
+  }
+
+  private async run(
+    turn: CircuitTurnInfo,
+    args: {
+      outcome?: "success" | "failure";
+      onEvent?: (msg: CompactionCircuitEvent) => void;
+    },
+  ): Promise<CircuitBreakerResult> {
+    const turnContext = this.buildTurnContext(turn);
+    return runPipeline<CircuitBreakerArgs, CircuitBreakerResult>(
+      "circuitBreaker",
+      getMiddlewaresFor("circuitBreaker"),
+      async (terminalArgs) => {
+        // No plugin in the chain produced a decision. This should be
+        // unreachable in production because the default plugin registers a
+        // `circuitBreaker` middleware that always returns a decision, but we
+        // defensively derive the state here so test setups that intentionally
+        // omit the default plugin still get a sensible response.
+        const openUntil = terminalArgs.state.compactionCircuitOpenUntil;
+        const now = Date.now();
+        if (openUntil !== null && now < openUntil) {
+          return { open: true, cooldownRemainingMs: openUntil - now };
+        }
+        return { open: false };
+      },
+      {
+        key: `compaction:${this.conversationId}`,
+        // Pass this circuit as the mutable state container. The
+        // `CircuitBreakerArgs.state` shape matches its `conversationId` /
+        // `consecutiveCompactionFailures` / `compactionCircuitOpenUntil`
+        // fields so plugins mutate the same object the playground routes read.
+        state: this,
+        ...(args.outcome !== undefined ? { outcome: args.outcome } : {}),
+        ...(args.onEvent ? { onEvent: args.onEvent } : {}),
+      },
+      turnContext,
+      DEFAULT_TIMEOUTS.circuitBreaker,
+    );
+  }
+
+  private buildTurnContext(turn: CircuitTurnInfo): TurnContext {
+    return {
+      requestId: turn.currentRequestId ?? "circuit-breaker",
+      conversationId: this.conversationId,
+      turnIndex: turn.turnCount,
+      trust:
+        turn.currentTurnTrustContext ??
+        turn.trustContext ??
+        FALLBACK_TURN_TRUST,
+    };
+  }
+}