feat(core): stream Code Mode output to the chat within one 64 KiB budget

[nickruigrok]

Fourth PR of the GRA-349 stack, on top of #389. It adds bounded output and output that streams before the tool completes (section 21.1, step 5).

What changes

• One output budget: 64 KiB of UTF-8, shared by logs, streamed progress, result and error.
  • 1 KiB is kept for how the run ended, so a flood of logs never hides the error.
  • Cut text ends with an explicit marker: … (cut: over 65536 bytes of output).
  • This replaces the 32 K-character model view.
  • Text is cut with TextEncoder.encodeInto, so a cut never lands inside a character.
• Streaming:
  • The harness sends each logged line to core's callback in order, one after another, and waits for every line to arrive before a call returns. The code never sees the callback.
  • The callback is handed to verify and to run separately, because an RPC stub only works in the call that brought it.
  • Core checks each line like the run's result (a string, bounded) and drops it once the run has ended.
  • Each line becomes a Pi tool update (onUpdate; Pi ignores updates after the step settles). The turn hands it to the Workspace DO.
  • The DO takes a line only while the run's lease is open. It counts and bounds the lines itself (1,000 lines, 128 KiB of raw text a run), whatever the harness claims.
  • A line is shown only after a read of revocations that began after the line arrived finds none. Those reads happen at most once a second a run and fail closed. So nothing logged after a revocation is ever shown, even if the code makes no further call.
  • The shown text is the whole output redacted at once, then cut at the budget less the reserve, so a credential split across lines is caught. Watchers get it through ChatUpdate.output, which grows incrementally like partial and is left out when unchanged.
  • The output stays until the step's result is stored, so it doesn't flicker away first. A revocation, or the end of the turn, drops it at once.
• Redaction. Bearer and basic credentials, sk-/pk-/rk- keys, JWTs, PEM private keys and AWS access keys become [redacted]. This applies to every streamed line and to what the model reads and the transcript stores. A run holds no secret of its own; this guards against an outside system's data carrying one.
• Correlation. The tool result's details now carry the run ID along with the status, tying the transcript to the run's record.
• Web.
  • ChatView.output holds the running step's output, built with applyOutput.
  • The code step shows an "Output" section while it runs, replaced by its result.
  • Translations are added for nl, de, fr and es.

Evidence

New tests in apps/core/test/agent.test.ts ("chat agent code output"), through the real DO watch, Loader and Pi loop:

• Streaming:
  • before the step's result message reaches the watcher, it has seen first\nkey [redacted] and then …\nafter the wait;
  • the output goes back to null once the step ends;
  • the model's text is redacted the same way;
  • a line sent through codeRunOutput after the run closed shows nowhere.
• Budget: a flood of 5,000 lines of two-byte characters followed by a throw:
  • the final text is at most 64 KiB, is cut with the marker and still ends with Error (threw): Error: the end;
  • the streamed output never passes 64 KiB less the 1 KiB reserve.
• Pure helpers: byte cuts with é and emoji, and the redaction patterns.
• Updated tests: the existing flood and forged-prototype tests now check the 64 KiB budget and the new marker.

In apps/web/src/chat/follow-chat.test.ts: the output grows, starts afresh for another step, and drops when no step runs.

Commands:

• vp check: passes.
• vp test run test/agent.test.ts test/chats.test.ts test/run-fixes.test.ts test/agent-connections.test.ts: 90 passed.
• vp test run -c vite.screens.config.ts test/agent-builds.test.ts test/agent-apps.test.ts: 32 passed.
• In apps/web, vp test run src/chat/follow-chat.test.ts src/locales/locales.test.ts: 12 passed.
• vp build (web, React Compiler): passes.

Restacked on the #387 and #389 review fixes (daf0cb4)

• The harness's streaming is merged into the hardened harness. The output callback, captured Promise.prototype.then and Promise.resolve, and the in-order delivery are unchanged, and every outcome is still returned rather than thrown.
• A lease closed by a revocation drops output that no watcher has had yet. The model gets no logs of a revoked run (feat(core): record every Code Mode run, and close its lease on revocation #389, M2).

Review fixes (c7d3cdd)

Must-fix: output kept streaming after a mid-run revocation. A line is now shown only once a read of revocations begun after it arrived finds none. Those reads run at most once a second a run, through the same revokedSince read, and fail closed. A revocation found there:

• closes the lease as revoked;
• drops the output, shown or pending;
• records one agent.run_revoked (method: output);
• streams nothing more.

Should-fix:

• Redaction now also covers Stripe sk_/pk_/rk_ live and test keys, GitHub ghp_/gho_/ghs_/ghu_/ghr_/github_pat_, Slack xox[abpr]-, Google AIza, and the value of api_key, apikey, token, secret, password or authorization written as name=value or name: value. The docstring lists exactly what is covered and says it is a net, not a guarantee.
• The stream redacts like the model view: core keeps each run's lines and redacts all of them as one text.
• Core counts lines and raw bytes itself, and doesn't trust the harness's totals.

Nits:

• The output stays until the step's result is stored (no flicker).
• output is left out of an update when it didn't change (applyOutput keeps what was shown).
• aria-live is dropped.

New tests:

• Revocation with no call: the code logs, waits and logs again with no call; the admin revokes in between. No line logged after the revoke ever reaches the chat, and the run ends revoked.
  • Mutation check: with the stream's revocation read disabled, this test fails.
• Clearing when a call finds the revocation (revokeCodeRun): the shown output goes to null before the step's result.
• A PEM private key logged line by line never shows its body in any streamed text, and the model reads Logs:\n[redacted]\ndone.
• 1,500 lines sent straight to codeRunOutput show as 1,000.
• The redaction table covers the new shapes. The token-shaped fixtures are put together at runtime, so secretlint finds no token in the repository.

Evidence (top of the stack):

• vp check: passes.
• Core: 230 passed.
• Screen-config tests: 47 passed.
• Web: 12 passed, and the web build passes.

Delta review fix (2815b1e)

Must-fix: quadratic JWT redaction. The pattern started at \b, and a flood like eyJ-eyJ-… has a word boundary at every step. Redacting about 128K characters of that took about 4 s, inside the Workspace object, which re-redacts output about once a second.

• The pattern now starts at (?<![\w-]). A real JWT still matches.
• A new test redacts floods of about 128K characters for every credential shape, each with tails of "", "x", "-" and ".". All must finish within 250 ms.
• With the old pattern, that test fails (13.8 s). With the fix, it passes. No other pattern was slow under the same floods.

Nits:

• A revocation read that fails is now recorded with its own reason, agent.revocation_read_failed, both by the output check and at the end of a run.
• New tests for the output check:
  • Failed read: nothing is shown, the run ends revoked, and one agent.revocation_read_failed is recorded.
  • Slow read: the read takes 3 s, longer than the run, so the line is never shown before the step's result, which shows it.

Evidence: vp check passes; vp test run test/agent.test.ts test/chats.test.ts passes (103).

[nickruigrok]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the latest changes address the previous findings without an established new failure.

Summary

The PR streams Code Mode logs into chat, bounds output by UTF-8 bytes, and redacts credentials before showing or saving results.

• Code logs appear in the chat before the step finishes.
• Code output fits one UTF-8 budget and hides credential-shaped text.

Diagram

sequenceDiagram
  participant Code as Code run
  participant Core as Core
  participant Watch as Chat watcher
  participant Page as Chat page
  Code->>Core: Logged line
  Core->>Core: Keep bounded text
  Core->>Core: Read revocations after arrival
  alt Run still allowed
    Core->>Core: Redact and cut whole output
    Core->>Watch: Output change
    Watch->>Page: Add or replace text
  else Revoked or read fails
    Core->>Watch: Clear output
  end
  Core->>Watch: Stored result and cleared output

Loading

_{Reviews (2) · Last reviewed commit: "fix(core): redact whole credential value..." · Reviewed by Greptile}

[nickruigrok]

@greptileai review