@vellumai/credential-executor 0.10.3-dev.202606292136.ce8bf33 → 0.10.3-dev.202606292252.adea010

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.10.3-dev.202606292136.ce8bf33",
+  "version": "0.10.3-dev.202606292252.adea010",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/managed-main.ts

@@ -122,7 +122,7 @@ function buildHandlers(
   apiKeyRef: ApiKeyRef,
   assistantIdRef: AssistantIdRef,
   secureKeyBackend: SecureKeyBackend,
-): { handlers: RpcHandlerRegistry; temporaryGrantStore: TemporaryGrantStore } {
+): RpcHandlerRegistry {
   // -- Grant stores ----------------------------------------------------------
   const persistentGrantStore = new PersistentGrantStore(
     getCesGrantsDir("managed"),
@@ -411,7 +411,7 @@ function buildHandlers(
     return { results };
   }) as (typeof handlers)[string];
 
-  return { handlers, temporaryGrantStore };
+  return handlers;
 }
 
 // ---------------------------------------------------------------------------
@@ -668,10 +668,12 @@ async function main(): Promise<void> {
   // `unregister` miss a tool registered in an earlier session and orphan its
   // bundle.
   //
-  // The in-memory temporary-grant store is the exception: `allow_once` /
-  // `allow_10m` grants are keyed by proposal hash only (not session), so they
-  // would otherwise leak ephemeral approvals across sessions. It is cleared at
-  // the end of every session below so a reconnecting assistant must re-prompt.
+  // The in-memory temporary-grant store is also process-scoped, and (unlike
+  // before) is NOT cleared between sessions: ephemeral approvals are shared
+  // across all of a daemon's connections for the process lifetime. Its own
+  // semantics keep this safe — `allow_once` is consumed on first use,
+  // `allow_10m` expires by wall-clock TTL, `allow_conversation` is cleared when
+  // its conversation ends (see the serve loop below).
   //
   // The mutable refs carry the handshake-provided API key and assistant ID;
   // handlers read them at call time. These don't vary across a daemon's
@@ -680,7 +682,7 @@ async function main(): Promise<void> {
   // at call time for audit attribution).
   const apiKeyRef: ApiKeyRef = { current: "" };
   const assistantIdRef: AssistantIdRef = { current: "" };
-  const { handlers, temporaryGrantStore } = buildHandlers(
+  const handlers = buildHandlers(
     apiKeyRef,
     assistantIdRef,
     secureKeyBackend,
@@ -780,14 +782,16 @@ async function main(): Promise<void> {
 
     rpcConnected = false;
 
-    // Drop all ephemeral approvals when the session ends. `allow_once` /
-    // `allow_10m` grants are keyed by proposal hash only, so reusing the
-    // store across a reconnect would let a pre-disconnect approval be
-    // consumed by a later session without re-prompting. Clearing here
-    // restores the prior behavior, where the process exited on stream end
-    // and these grants never survived.
-    temporaryGrantStore.clear();
-
+    // Temporary grants are process-shared: they are NOT cleared when a session
+    // ends. CES is moving to a model where the assistant daemon's multiple
+    // processes each hold their own connection, so an ephemeral approval
+    // (`allow_once` / `allow_10m` / `allow_conversation`) granted on one
+    // connection must remain usable by the others rather than being scoped to a
+    // single session. The store's own semantics keep this safe across a
+    // reconnect: `allow_once` is consumed on first use, `allow_10m` is bounded
+    // by its wall-clock TTL, and `allow_conversation` is cleared when its
+    // conversation ends.
+    //
     // A signal-driven end means the process is shutting down; exit the loop.
     // Any other end reason (the assistant disconnected, its stream closed,
     // or the transport errored) means we keep the sidecar up and await a