@vellumai/vellum-gateway 0.7.3 → 0.8.1

package/src/ipc/risk-classification-handlers.test.ts

@@ -349,6 +349,82 @@ describe("skill classification", () => {
   });
 });
 
+// ── Credentialed proxied bash ───────────────────────────────────────────────
+
+describe("credentialed proxied bash", () => {
+  test("credentialed proxied bash returns high risk even for simple curl", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "curl https://api.example.com",
+      networkMode: "proxied",
+      credentialRefCount: 1,
+    });
+    expect(result.risk).toBe("high");
+    expect(result.reason).toContain("credential");
+  });
+
+  test("credentialed proxied bash returns high risk for low-risk command", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "ls",
+      networkMode: "proxied",
+      credentialRefCount: 2,
+    });
+    expect(result.risk).toBe("high");
+    expect(result.reason).toContain("credential");
+  });
+
+  test("proxied bash without credential refs keeps existing medium cap for high-risk command", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "rm -rf /",
+      networkMode: "proxied",
+    });
+    // rm -rf / is high risk but gets capped to medium for non-credentialed proxied bash
+    expect(result.risk).toBe("medium");
+  });
+
+  test("proxied bash without credential refs keeps low risk for low-risk command", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "ls",
+      networkMode: "proxied",
+    });
+    expect(result.risk).toBe("low");
+  });
+
+  test("credentialRefCount=0 does not escalate risk", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "ls",
+      networkMode: "proxied",
+      credentialRefCount: 0,
+    });
+    expect(result.risk).toBe("low");
+  });
+
+  test("non-proxied bash with credential refs follows normal risk flow", async () => {
+    const result = await classify({
+      tool: "bash",
+      command: "ls",
+      credentialRefCount: 1,
+    });
+    // Without proxied mode, credential refs don't affect classification
+    expect(result.risk).toBe("low");
+  });
+
+  test("host_bash with proxied + credential refs is not affected (host_bash skips proxied cap)", async () => {
+    const result = await classify({
+      tool: "host_bash",
+      command: "rm -rf /",
+      networkMode: "proxied",
+      credentialRefCount: 1,
+    });
+    // host_bash is never affected by proxied risk logic
+    expect(result.risk).toBe("high");
+  });
+});
+
 // ── Unknown tool fallback ───────────────────────────────────────────────────
 
 describe("unknown tool fallback", () => {

package/src/ipc/risk-classification-handlers.ts

@@ -73,6 +73,8 @@ const ClassifyRiskSchema = z.object({
     .optional(),
   /** Tool registry default risk level for unknown tools. */
   registryDefaultRisk: z.string().optional(),
+  /** Number of credential references attached to this tool invocation. */
+  credentialRefCount: z.number().int().nonnegative().optional(),
 });
 
 type ClassifyRiskParams = z.infer<typeof ClassifyRiskSchema>;
@@ -358,17 +360,26 @@ export async function handleClassifyRisk(
         });
       }
 
-      // Proxied bash risk cap: when running through the credential proxy,
-      // cap High → Medium so proxied commands don't trigger unnecessary prompts.
+      // Proxied bash risk classification:
+      // - When credentials are attached (credentialRefCount > 0), escalate to
+      //   high risk regardless of the underlying assessment. Credentialed
+      //   proxied shell sessions carry elevated risk and must not be
+      //   downgraded by the general proxied-bash cap.
+      // - For non-credentialed proxied bash, cap High → Medium so proxied
+      //   commands don't trigger unnecessary prompts.
       // Only applies to sandboxed "bash" — host_bash runs on the host machine
       // and should not have its risk capped.
       let finalRisk = assessment.riskLevel;
-      if (
-        tool === "bash" &&
-        params.networkMode === "proxied" &&
-        finalRisk === "high"
-      ) {
-        finalRisk = "medium";
+      let finalReason = assessment.reason;
+      const credentialRefCount = params.credentialRefCount ?? 0;
+      if (tool === "bash" && params.networkMode === "proxied") {
+        if (credentialRefCount > 0) {
+          finalRisk = "high";
+          finalReason =
+            "Proxied credential session — shell has access to injected credentials";
+        } else if (finalRisk === "high") {
+          finalRisk = "medium";
+        }
       }
 
       // Collect resolved paths for directory-scoped rule enforcement.
@@ -380,7 +391,7 @@ export async function handleClassifyRisk(
 
       return {
         risk: finalRisk,
-        reason: assessment.reason,
+        reason: finalReason,
         scopeOptions: assessment.scopeOptions,
         allowlistOptions: assessment.allowlistOptions,
         actionKeys,

package/src/ipc/server.ts

@@ -10,11 +10,20 @@
  * The preferred socket path is `{workspaceDir}/gateway.sock` on the shared
  * volume. On platforms with strict AF_UNIX path limits, the server falls back
  * to a shorter deterministic path.
+ *
+ * Resilience: a {@link SocketWatchdog} re-binds the listening socket when its
+ * on-disk path entry is removed (e.g. by a tmpfs sweep or rogue cleanup of
+ * `/run/*`). Existing connected sockets survive the re-bind because the
+ * kernel keeps connection inodes alive independently of the listener path;
+ * only new `connect()` calls require the path to exist.
  */
 
-import { existsSync, mkdirSync, unlinkSync } from "node:fs";
+import {
+  SocketWatchdog,
+  ensureSocketDir,
+} from "@vellumai/ipc-server-utils";
+import { existsSync, unlinkSync } from "node:fs";
 import { createServer, type Server, type Socket } from "node:net";
-import { dirname } from "node:path";
 
 import type { z } from "zod";
 
@@ -55,6 +64,15 @@ export type IpcRoute = {
   handler: IpcMethodHandler;
 };
 
+/** Optional configuration for {@link GatewayIpcServer}. */
+export interface GatewayIpcServerOptions {
+  /**
+   * How often the socket-file watchdog stats the listening socket path.
+   * Set to `0` to disable. Defaults to {@link SocketWatchdog}'s 5000ms.
+   */
+  watchdogIntervalMs?: number;
+}
+
 // ---------------------------------------------------------------------------
 // Server
 // ---------------------------------------------------------------------------
@@ -65,8 +83,15 @@ export class GatewayIpcServer {
   private methods = new Map<string, IpcMethodHandler>();
   private schemas = new Map<string, z.ZodType>();
   private socketPath: string;
-
-  constructor(routes?: IpcRoute[]) {
+  private watchdog: SocketWatchdog;
+  /**
+   * Servers whose listener path has been replaced by a re-bind. Kept around
+   * so that already-connected sockets continue to work; closed gracefully
+   * once their accept loops drain.
+   */
+  private legacyServers = new Set<Server>();
+
+  constructor(routes?: IpcRoute[], options?: GatewayIpcServerOptions) {
     const resolution = resolveIpcSocketPath("gateway");
     this.socketPath = resolution.path;
     log.info(
@@ -81,16 +106,33 @@ export class GatewayIpcServer {
         }
       }
     }
+
+    this.watchdog = new SocketWatchdog({
+      socketPath: this.socketPath,
+      intervalMs: options?.watchdogIntervalMs,
+      getServer: () => this.server,
+      createServer: () => this.createListeningServer(),
+      onRebind: (newServer, oldServer) => {
+        this.server = newServer;
+        // Move the previous listener into the legacy set so already-
+        // connected clients keep their accept loop alive. close() stops
+        // accepting new connections (which the kernel already won't route
+        // here anyway after the path moved) but lets in-flight sockets
+        // drain.
+        this.legacyServers.add(oldServer);
+        oldServer.close(() => {
+          this.legacyServers.delete(oldServer);
+        });
+      },
+      log,
+    });
   }
 
   /** Start listening on the Unix domain socket. */
   start(): void {
     // Ensure the parent directory exists — on a fresh hatch the workspace
     // dir may not have been created yet when the IPC server starts.
-    const socketDir = dirname(this.socketPath);
-    if (!existsSync(socketDir)) {
-      mkdirSync(socketDir, { recursive: true });
-    }
+    ensureSocketDir(this.socketPath);
 
     // Clean up stale socket file from a previous run
     if (existsSync(this.socketPath)) {
@@ -101,51 +143,18 @@ export class GatewayIpcServer {
       }
     }
 
-    this.server = createServer((socket) => {
-      // The assistant maintains a persistent connection for hot-path RPCs
-      // (classify_risk) alongside short-lived one-shot connections for other
-      // calls. Track all of them so a new one-shot connection does not tear
-      // down the persistent socket and reject its in-flight requests.
-      this.clients.add(socket);
-      log.debug("IPC client connected");
-
-      let buffer = "";
-
-      socket.on("data", (chunk) => {
-        buffer += chunk.toString();
-        // Process complete newline-delimited messages
-        let newlineIdx: number;
-        while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
-          const line = buffer.slice(0, newlineIdx).trim();
-          buffer = buffer.slice(newlineIdx + 1);
-          if (line) {
-            this.handleMessage(socket, line);
-          }
-        }
-      });
-
-      socket.on("close", () => {
-        this.clients.delete(socket);
-        log.debug("IPC client disconnected");
-      });
-
-      socket.on("error", (err) => {
-        log.warn({ err }, "IPC client socket error");
-        this.clients.delete(socket);
-      });
-    });
-
-    this.server.on("error", (err) => {
-      log.error({ err }, "IPC server error");
-    });
-
+    this.server = this.createListeningServer();
     this.server.listen(this.socketPath, () => {
       log.info({ path: this.socketPath }, "IPC server listening");
     });
+
+    this.watchdog.start();
   }
 
   /** Stop the server and disconnect all clients. */
   stop(): void {
+    this.watchdog.stop();
+
     for (const socket of this.clients) {
       if (!socket.destroyed) {
         socket.destroy();
@@ -153,6 +162,11 @@ export class GatewayIpcServer {
     }
     this.clients.clear();
 
+    for (const legacy of this.legacyServers) {
+      legacy.close();
+    }
+    this.legacyServers.clear();
+
     if (this.server) {
       this.server.close();
       this.server = null;
@@ -184,8 +198,61 @@ export class GatewayIpcServer {
     return this.socketPath;
   }
 
+  /**
+   * Re-bind the listening socket if its path entry is missing on disk.
+   *
+   * Public for tests so the watchdog can be exercised deterministically
+   * without waiting for the interval. Returns `true` when a re-bind was
+   * performed, `false` otherwise.
+   */
+  async rebindIfMissing(): Promise<boolean> {
+    return this.watchdog.rebindIfMissing();
+  }
+
   // ── Internal ──────────────────────────────────────────────────────────
 
+  private createListeningServer(): Server {
+    const server = createServer((socket) => this.handleConnection(socket));
+    server.on("error", (err) => {
+      log.error({ err }, "IPC server error");
+    });
+    return server;
+  }
+
+  private handleConnection(socket: Socket): void {
+    // The assistant maintains a persistent connection for hot-path RPCs
+    // (classify_risk) alongside short-lived one-shot connections for other
+    // calls. Track all of them so a new one-shot connection does not tear
+    // down the persistent socket and reject its in-flight requests.
+    this.clients.add(socket);
+    log.debug("IPC client connected");
+
+    let buffer = "";
+
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString();
+      // Process complete newline-delimited messages
+      let newlineIdx: number;
+      while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
+        const line = buffer.slice(0, newlineIdx).trim();
+        buffer = buffer.slice(newlineIdx + 1);
+        if (line) {
+          this.handleMessage(socket, line);
+        }
+      }
+    });
+
+    socket.on("close", () => {
+      this.clients.delete(socket);
+      log.debug("IPC client disconnected");
+    });
+
+    socket.on("error", (err) => {
+      log.warn({ err }, "IPC client socket error");
+      this.clients.delete(socket);
+    });
+  }
+
   private handleMessage(socket: Socket, line: string): void {
     let req: IpcRequest;
     try {

package/src/logger.ts

@@ -7,6 +7,7 @@ import {
 } from "node:fs";
 import { join } from "node:path";
 import pino from "pino";
+import type { PrettyOptions } from "pino-pretty";
 import pinoPretty from "pino-pretty";
 import { logSerializers } from "./log-redact.js";
 
@@ -15,10 +16,34 @@ export type LogFileConfig = {
   retentionDays: number;
 };
 
+/**
+ * Common pino-pretty options. Inlines [module] into the message prefix so the
+ * formatted line reads `[runtime-proxy] Upstream returned error` instead of
+ * dumping the module field separately. Mirrors the assistant logger so files
+ * are human-readable on both sides.
+ */
+function prettyOpts(extra?: PrettyOptions): PrettyOptions {
+  return {
+    messageFormat: "[{module}] {msg}",
+    ignore: "module",
+    ...extra,
+  };
+}
+
 const LOG_FILE_PREFIX = "gateway-";
 const LOG_FILE_SUFFIX = ".log";
+const LOG_FILE_JSON_SUFFIX = ".jsonl";
+
+/** Matches the human-readable pretty log file (default tail target). */
 export const LOG_FILE_PATTERN = /^gateway-(\d{4}-\d{2}-\d{2})\.log$/;
 
+/**
+ * Matches the structured JSON-lines sidecar used by `gateway/logs/tail` for
+ * server-side level/module filtering. Walking pretty multi-line entries is
+ * fragile, so we keep a parallel JSONL file solely for that consumer.
+ */
+export const LOG_FILE_JSON_PATTERN = /^gateway-(\d{4}-\d{2}-\d{2})\.jsonl$/;
+
 function formatDate(date: Date): string {
   const y = date.getUTCFullYear();
   const m = String(date.getUTCMonth() + 1).padStart(2, "0");
@@ -30,6 +55,13 @@ function logFilePathForDate(dir: string, date: Date): string {
   return join(dir, `${LOG_FILE_PREFIX}${formatDate(date)}${LOG_FILE_SUFFIX}`);
 }
 
+function jsonLogFilePathForDate(dir: string, date: Date): string {
+  return join(
+    dir,
+    `${LOG_FILE_PREFIX}${formatDate(date)}${LOG_FILE_JSON_SUFFIX}`,
+  );
+}
+
 export function pruneOldLogFiles(dir: string, retentionDays: number): number {
   if (!existsSync(dir)) return 0;
 
@@ -39,7 +71,8 @@ export function pruneOldLogFiles(dir: string, retentionDays: number): number {
 
   let removed = 0;
   for (const name of readdirSync(dir)) {
-    const match = LOG_FILE_PATTERN.exec(name);
+    const match =
+      LOG_FILE_PATTERN.exec(name) ?? LOG_FILE_JSON_PATTERN.exec(name);
     if (!match) continue;
     const fileDate = new Date(match[1] + "T00:00:00Z");
     if (fileDate < cutoff) {
@@ -58,11 +91,28 @@ let rootLogger: pino.Logger | null = null;
 let activeLogDate: string | null = null;
 let activeConfig: LogFileConfig | null = null;
 
+function openSecureDestination(filePath: string): pino.DestinationStream {
+  const dest = pino.destination({
+    dest: filePath,
+    sync: true,
+    mkdir: true,
+    mode: 0o600,
+  });
+  // Tighten permissions on pre-existing log files that may have been created
+  // with looser modes.
+  try {
+    chmodSync(filePath, 0o600);
+  } catch {
+    /* best-effort */
+  }
+  return dest;
+}
+
 function buildLogger(config: LogFileConfig | null): pino.Logger {
   if (!config?.dir) {
     return pino(
       { name: "gateway", serializers: logSerializers },
-      pinoPretty({ destination: 1 }),
+      pinoPretty(prettyOpts({ destination: 1 })),
     );
   }
 
@@ -71,19 +121,19 @@ function buildLogger(config: LogFileConfig | null): pino.Logger {
   }
 
   const today = formatDate(new Date());
-  const filePath = logFilePathForDate(config.dir, new Date());
-  const fileStream = pino.destination({
-    dest: filePath,
-    sync: true,
-    mkdir: true,
-    mode: 0o600,
-  });
-  // Tighten permissions on pre-existing log files that may have been created with looser modes
-  try {
-    chmodSync(filePath, 0o600);
-  } catch {
-    /* best-effort */
-  }
+  const now = new Date();
+
+  // Pretty file: human-readable, default tail target. Mirrors assistant.
+  const prettyDest = openSecureDestination(logFilePathForDate(config.dir, now));
+  const prettyFileStream = pinoPretty(
+    prettyOpts({ destination: prettyDest, colorize: false }),
+  );
+
+  // JSONL sidecar: machine-readable, consumed by `gateway/logs/tail` for
+  // server-side level/module filtering. Same content, raw pino records.
+  const jsonFileStream = openSecureDestination(
+    jsonLogFilePathForDate(config.dir, now),
+  );
 
   activeLogDate = today;
   activeConfig = config;
@@ -91,8 +141,12 @@ function buildLogger(config: LogFileConfig | null): pino.Logger {
   return pino(
     { name: "gateway", serializers: logSerializers },
     pino.multistream([
-      { stream: fileStream, level: "info" as const },
-      { stream: pinoPretty({ destination: 1 }), level: "info" as const },
+      { stream: prettyFileStream, level: "info" as const },
+      { stream: jsonFileStream, level: "info" as const },
+      {
+        stream: pinoPretty(prettyOpts({ destination: 1 })),
+        level: "info" as const,
+      },
     ]),
   );
 }

package/src/post-assistant-ready.ts

@@ -18,7 +18,10 @@ import type { Database } from "bun:sqlite";
 import { ensureVellumGuardianBinding } from "./auth/guardian-bootstrap.js";
 import { getGatewayDb, type GatewayDb } from "./db/connection.js";
 import { runDataMigrations } from "./db/data-migrations/index.js";
-import { ipcCallAssistant } from "./ipc/assistant-client.js";
+import {
+  IpcTransportError,
+  ipcCallAssistant,
+} from "./ipc/assistant-client.js";
 import { getLogger } from "./logger.js";
 
 const log = getLogger("post-assistant-ready");
@@ -34,10 +37,13 @@ export async function waitForAssistant(): Promise<boolean> {
   const deadline = Date.now() + MAX_WAIT_MS;
 
   while (Date.now() < deadline) {
-    const result = await ipcCallAssistant("health");
-    if (result !== undefined) {
+    try {
+      await ipcCallAssistant("health");
       log.info("Assistant is ready");
       return true;
+    } catch (err) {
+      if (!(err instanceof IpcTransportError)) throw err;
+      // Transport error during startup is expected — keep polling.
     }
 
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));

package/src/risk/bash-risk-classifier.test.ts

@@ -995,6 +995,30 @@ describe("assistant subcommand classification", () => {
     expect(result.riskLevel).toBe("medium");
   });
 
+  test("assistant inference session open balanced --ttl 30m → low", async () => {
+    const result = await classifier.classify({
+      command: "assistant inference session open balanced --ttl 30m",
+      toolName: "bash",
+    });
+    expect(result.riskLevel).toBe("low");
+  });
+
+  test("assistant inference session close → low", async () => {
+    const result = await classifier.classify({
+      command: "assistant inference session close",
+      toolName: "bash",
+    });
+    expect(result.riskLevel).toBe("low");
+  });
+
+  test("assistant inference session list → low", async () => {
+    const result = await classifier.classify({
+      command: "assistant inference session list",
+      toolName: "bash",
+    });
+    expect(result.riskLevel).toBe("low");
+  });
+
   test("assistant bash ls → high", async () => {
     const result = await classifier.classify({
       command: "assistant bash ls",
@@ -1609,6 +1633,88 @@ describe("generateScopeOptions with parseArgs", () => {
   });
 });
 
+// ── generateScopeOptions with synthetic segments (parse-recovery) ────────────
+
+describe("generateScopeOptions with synthetic segments", () => {
+  test("parse-recovery from unquoted parens in path: no wildcards, exact match uses original command", async () => {
+    // Bug: tree-sitter splits `cat /a/(b)/c.txt` into multiple sibling
+    // statements with no separator (parse-recovery). Without the synthetic
+    // filter we'd surface bogus wildcards like `app *` or `/c.txt *`.
+    const parsed = await cachedParse("cat /a/(b)/c.txt");
+    const options = generateScopeOptions(parsed, DEFAULT_COMMAND_REGISTRY);
+    const labels = options.map((o) => o.label);
+
+    // Exact match must be the literal user input — segment reconstruction
+    // would produce something like "cat /a/(b) /c.txt" (extra space).
+    expect(labels[0]).toBe("cat /a/(b)/c.txt");
+
+    // No per-program wildcards should be emitted from the recovery
+    // fragments — they're not real top-level commands.
+    expect(labels).not.toContain("cat *");
+    expect(labels).not.toContain("/c.txt *");
+    // Only the exact match should remain.
+    expect(options).toHaveLength(1);
+  });
+
+  test("parse-recovery in iPhone bug repro: only exact match, no synthetic wildcards", async () => {
+    // The exact command from the user's screenshot. The synthetic-filter
+    // regression: pre-fix, `app *` and `/admin/organizations/[id]/page.tsx *`
+    // both leaked into the trust-rule editor's "Apply to" list.
+    const cmd =
+      "cat /workspace/vellum-assistant-platform/web/src/app/(app)/admin/organizations/[id]/page.tsx | grep -A 30 -B 5 \"credit\\|Credit\" | head -80";
+    const parsed = await cachedParse(cmd);
+    const options = generateScopeOptions(parsed, DEFAULT_COMMAND_REGISTRY);
+    const labels = options.map((o) => o.label);
+
+    expect(labels[0]).toBe(cmd);
+    expect(labels).not.toContain("app *");
+    expect(labels).not.toContain("/admin/organizations/[id]/page.tsx *");
+    // Even legitimate-looking programs that happened to be inside the
+    // recovery fragments (cat/grep/head) are filtered — the parse can't
+    // be trusted to know what was a real top-level command.
+    expect(labels).not.toContain("cat *");
+    expect(labels).not.toContain("grep *");
+    expect(labels).not.toContain("head *");
+    expect(options).toHaveLength(1);
+  });
+
+  test("legitimate pipeline still emits per-program wildcards", async () => {
+    // Regression check: filtering synthetic must not break the common
+    // case of a real pipeline.
+    const parsed = await cachedParse("ls -la | grep foo");
+    const options = generateScopeOptions(parsed, DEFAULT_COMMAND_REGISTRY);
+    const labels = options.map((o) => o.label);
+
+    expect(labels[0]).toBe("ls -la | grep foo");
+    expect(labels).toContain("ls *");
+    expect(labels).toContain("grep *");
+  });
+
+  test("legitimate ;-separated commands: exact match preserves the `;`", async () => {
+    // Pre-fix: `parts.join(" ")` produced "ls rm -rf /tmp/foo" (no `;`).
+    // With originalCommand the exact-match label is the verbatim input.
+    const parsed = await cachedParse("ls; rm -rf /tmp/foo");
+    const options = generateScopeOptions(parsed, DEFAULT_COMMAND_REGISTRY);
+    const labels = options.map((o) => o.label);
+
+    expect(labels[0]).toBe("ls; rm -rf /tmp/foo");
+    expect(labels).toContain("ls *");
+    expect(labels).toContain("rm *");
+  });
+
+  test("subshell content is not surfaced as a top-level wildcard", async () => {
+    // (cd /tmp && ls) — segments are synthetic (nested context), so
+    // per-program wildcards must be filtered out. Only exact match remains.
+    const parsed = await cachedParse("(cd /tmp && ls)");
+    const options = generateScopeOptions(parsed, DEFAULT_COMMAND_REGISTRY);
+    const labels = options.map((o) => o.label);
+
+    expect(labels[0]).toBe("(cd /tmp && ls)");
+    expect(labels).not.toContain("cd *");
+    expect(labels).not.toContain("ls *");
+  });
+});
+
 // ── scopeOptionsToAllowlistOptions ───────────────────────────────────────────
 
 describe("scopeOptionsToAllowlistOptions", () => {