@openviking/dsh-memory-plugin 0.3.0 → 0.3.2

package/README.md

@@ -32,7 +32,7 @@ tree's realpath rather than from the profile.
 
 ## Requirements
 
-- `@deepseek-ai/dsh` `0.1.0-rc.6` or newer in the `0.1.x` release line
+- `@deepseek-ai/dsh` `0.1.0-rc.6`, `0.1.5-rc.1`, or `0.1.5-rc.2`; stable `0.1.x` releases are also admitted by the peer range
 - Node.js `^22.19.0` or `>=24`
 - A reachable OpenViking server
 
@@ -40,17 +40,62 @@ The bundle has no runtime npm dependencies. Its message structures come from
 `createUserMessage` (`@deepseek-ai/dsh-llm`), its tool surface from
 `@deepseek-ai/dsh-mcp-client`, and its skill provider from
 `@deepseek-ai/dsh-skill-filesystem` — peerDependencies that DSH itself already
-installs, so there is nothing extra to add to a profile. The supported peer
-range starts at `0.1.0-rc.6` and stops before `0.2.0`, allowing current DSH
-releases whose core packages resolve to newer release candidates. The local
-devDependencies and `overrides` stay pinned to rc.6 so CI continues to exercise
-the minimum supported contract.
+installs. Keep those packages in the host installation rather than adding
+individual DSH core packages to the profile. DSH initializes profiles with
+`nodeLinker: hoisted` and `autoInstallPeers: false`, then makes the host packages
+available through its module fallback at boot. A missing-peer warning during
+`dsh plugin add` alone does not prove startup is broken.
+
+The peer range is `>=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1`. The second clause
+explicitly admits the `0.1.5` release candidates: semver does not include them
+in the first clause merely because they compare above `0.1.0-rc.6`. Other
+pre-release series need separate verification. Local devDependencies and
+`overrides` stay pinned to rc.6 to exercise the minimum supported contract.
 
 Everything under `shared/` and `skills/` is generated by
 `node examples/memory-plugin-shared/sync.mjs` — edit
 `examples/memory-plugin-shared/lib/` and `examples/skills/`, never the vendored
 copies.
 
+## Troubleshooting startup
+
+If startup reports that `@deepseek-ai/dsh-llm` does not export `assertNever`,
+inspect the affected profile before changing dependencies:
+
+```bash
+dsh --version
+dsh plugin --profile web why @deepseek-ai/dsh-skill
+dsh plugin --profile web why @deepseek-ai/dsh-skill-filesystem
+dsh plugin --profile web why @deepseek-ai/dsh-llm
+```
+
+Replace `web` with the affected profile name. Check its `package.json`,
+`pnpm-lock.yaml`, and `pnpm-workspace.yaml` under
+`${DSH_HOME:-$HOME/.dsh}/profiles/<profile>/`, including dependency overrides.
+`dsh-skill@0.0.1-rc.1` imports `assertNever` from the old location. A profile-local
+copy can shadow the newer host package and break both DSH's own skill loader
+and this plugin. As of 2026-09-14, the skill and skill-filesystem npm `latest`
+tags still point to `0.0.1` release candidates; installing either without a
+version is not an upgrade strategy.
+
+If these old packages are direct profile dependencies added only to satisfy
+this plugin, remove those constraints and let DSH supply its matching packages:
+
+```bash
+dsh plugin --profile web remove @deepseek-ai/dsh-skill @deepseek-ai/dsh-skill-filesystem
+dsh plugin --profile web add @openviking/dsh-memory-plugin@latest
+dsh --profile web
+```
+
+If another plugin requires them, update that plugin's constraints instead of
+removing them blindly. Keep `autoInstallPeers: false` and `nodeLinker: hoisted`
+in the profile's pnpm settings. Do not patch the import in `node_modules`: a
+mixed DSH package family can have other incompatible interfaces. Updating this
+memory plugin alone does not remove conflicting profile-local packages.
+
+Use `dsh --profile <profile>` to start a named profile. `dsh web` is an alias for
+the stock `web` profile, not a subcommand to append after `--profile`.
+
 ## Design notes
 
 ### Why injection uses pre-step user messages, not the system prompt
@@ -85,10 +130,7 @@ change.
 
 Two consequences follow from the proxy being one process per profile:
 
-- **The actor peer is process-level.** Recall, capture, and commit still resolve
-  a peer per session from that session's workspace, but tool calls carry the
-  peer resolved at boot. Set `OPENVIKING_PEER_ID` when one process serves
-  several workspaces and you need tool calls attributed exactly.
+- **The actor peer is process-level.** Recall, capture, and commit still resolve a peer per session from that session's workspace repository, but tool calls carry the peer resolved at boot. Set `OPENVIKING_PEER_ID` when one process serves several repositories and you need tool calls attributed exactly.
 - **`remember` is not session-scoped.** The server's MCP `remember` stores into
   its own short-lived session rather than the live `dsh-<session-id>` stream —
   the same behavior the Claude Code, Codex, and Cursor integrations have.
@@ -100,9 +142,11 @@ lifecycle registration, so a proxy that cannot start holds up nothing above it.
 ### Why the skill gets its own provider
 
 `skills.mjs` registers a second `ctx.skills` provider with
-`includeDefaultRoots: false`, serving only `skills/`. DSH already mounts a
-`filesystem` provider over the project and user skill roots; an isolated
-provider adds the bundle's skill without shadowing or duplicating that catalog.
+`includeDefaultRoots: false` and `bundledSkillDir` pointing at `skills/`. DSH
+reads this host-owned bundle directly rather than asking a workspace filesystem
+to resolve a path outside its root. Its existing `filesystem` provider still
+owns the project and user skill roots; the bundle does not duplicate that
+catalog or override higher-priority project skills.
 
 ## Configuration
 
@@ -121,7 +165,7 @@ Common environment variables:
 | `OPENVIKING_ACCOUNT` | Trusted-mode account |
 | `OPENVIKING_USER` | Trusted-mode user |
 | `OPENVIKING_PEER_ID` | Explicit actor peer |
-| `OPENVIKING_WORKSPACE_PEER` | Derive a peer from each DSH session workspace by default |
+| `OPENVIKING_WORKSPACE_PEER` | Derive a peer from each DSH session workspace's git identity by default; `0` sends no peer |
 | `OPENVIKING_RECALL_PEER_SCOPE` | `all` for cross-workspace recall or `actor` for isolation |
 
 The patch can also carry plugin config:
@@ -153,10 +197,11 @@ The patch can also carry plugin config:
 - `session/event` captures user, assistant, and optionally tool-result messages without scraping a transcript.
 - `turn/end` checks the OpenViking pending-token threshold and commits when required.
 - `skipSubagentSessions: true` excludes sessions marked with `header.origin: subagent` from automatic profile, recall, capture, and commit; it defaults to `false`.
-- Failed writes enter the shared OpenViking pending queue for replay at the next session start.
+- `syncTurns: false` stops every new write: no captured messages, no threshold or shutdown commit. Writes queued while the toggle was on are still replayed by the background drainer once the server recovers — they were captured with the toggle on. Profile injection and recall are unaffected; it defaults to `true`.
+- Failed writes enter the shared OpenViking pending queue. A background drainer (default every 60s, `OPENVIKING_PENDING_DRAIN_INTERVAL_MS`) probes the server health and replays the queue in-process, so a transient write failure recovers without restarting dsh; it does not consume the session-start retry budget. Session-start replays keep consuming retries as before.
 - `tools/pre-execute` blocks DSH filesystem and shell tools from treating `viking://` URIs as local paths, pointing the model at the bridged `mcp__openviking__*` tools instead.
 
-Each DSH session maps to `dsh-<session-id>` in OpenViking. Workspace-derived actor peers are resolved per session and sent on every session-specific request.
+Each DSH session maps to `dsh-<session-id>` in OpenViking. Workspace-derived actor peers are resolved per session and sent on every session-specific request: the peer is the git identity of the session's workspace — the normalized `origin` URL (`git@github.com:volcengine/OpenViking.git` becomes `github.com-volcengine-openviking`), else the repository root path, that fallback keeping the older rule where every non-letter-or-digit character becomes `-`. Outside a git repository no peer is sent at all, and what is remembered there goes to the user-level space `viking://user/<you>/memories`. One repository therefore keeps one peer across subdirectories, worktrees, clones and machines, while a fork's different origin keeps it separate. DSH does not read workspace `.openviking/config.json` files, so a `peer.id` written there has no effect; pin a peer with `OPENVIKING_PEER_ID` instead. Memories written under the older path-derived peer stay reachable: the default `recallPeerScope: all` sweeps every peer under the user.
 
 ## Tools
 
@@ -184,6 +229,20 @@ npm run check   # syntax check every shipped module + package/PLUGIN_VERSION agr
 npm test        # node --test *.test.mjs — runs in the repo's PR workflow
 ```
 
+The `0.3.2` compatibility check installed the packed bundle through
+`dsh plugin add` in isolated profiles and exercised DSH `0.1.0-rc.6`,
+`0.1.5-rc.1`, and `0.1.5-rc.2` with matching core packages. It covered Web startup
+and browser loading, skill discovery/read, MCP tool calls, profile/recall
+injection, user/assistant capture, resume deduplication, threshold commits, and
+disposal commits. The check used a local HTTP/MCP fixture and a deterministic
+model adapter on macOS with Node.js 26.5.0; it verifies harness integration, not
+real-server memory extraction. The rc.2 CLI also exited cleanly on SIGTERM.
+
+The startup failure from issue #4944 was reproduced by adding the reported
+old skill packages to an rc.2 profile; removing those direct dependencies and
+reinstalling the bundle restored the same integration checks. A clean rc.2
+profile with the published `0.3.0` bundle did not reproduce that import error.
+
 `live-recall.test.mjs` is an opt-in end-to-end gate against a real OpenViking
 server: it stores a sentinel memory through a session commit, waits for
 extraction, and asserts recall returns that sentinel — the property no stub

package/config.mjs

@@ -1,7 +1,7 @@
 import { buildUserAgent, resolveOpenVikingCredentials } from "./shared/credentials.mjs";
 import { resolveEffectivePeerId } from "./shared/workspace-peer.mjs";
 
-export const PLUGIN_VERSION = "0.3.0";
+export const PLUGIN_VERSION = "0.3.2";
 
 /**
  * Namespace for the bridged OpenViking MCP tools. DSH publishes every MCP tool
@@ -18,6 +18,7 @@ const DEFAULT_CONFIG = Object.freeze({
   peerId: "",
   userAgent: "",
   workspacePeer: true,
+  peerSource: "",
   recallPeerScope: "all",
   recallQueryExpansion: "auto",
   recallQueryExpansionConfigured: false,
@@ -55,6 +56,7 @@ export function resolveConfig(input = {}, env = process.env, cwd = process.cwd()
     peerId: explicitPeerId,
     explicitPeerId,
     userAgent: buildUserAgent("dsh", PLUGIN_VERSION),
+    harness: "dsh",
     recallLimitConfigured: Object.prototype.hasOwnProperty.call(input, "recallLimit"),
     recallQueryExpansionConfigured: Object.prototype.hasOwnProperty.call(input, "recallQueryExpansion"),
   };
@@ -79,7 +81,9 @@ export function resolveConfig(input = {}, env = process.env, cwd = process.cwd()
 
   config.endpoint = String(config.endpoint || DEFAULT_CONFIG.endpoint).replace(/\/+$/, "");
   config.workspacePeer = config.workspacePeer !== false;
-  config.peerId = resolveEffectivePeerId({ cfg: config, cwd }).peerId;
+  const effectivePeer = resolveEffectivePeerId({ cfg: config, cwd });
+  config.peerId = effectivePeer.peerId;
+  config.legacyPeerId = effectivePeer.legacyPeerId;
   config.recallPeerScope = config.recallPeerScope === "actor" ? "actor" : "all";
   config.recallQueryExpansion = config.recallQueryExpansion === "off" ? "off" : "auto";
   config.recallLimit = clampInteger(config.recallLimit, 1, 50, DEFAULT_CONFIG.recallLimit);

package/index.mjs

@@ -21,6 +21,14 @@ export function apply(ctx, input = {}) {
     () => () => runtime.disposeAll(),
     "openvikingMemory.disposeAll()",
   );
+  // The pending-queue drainer is the in-process recovery path: without it a
+  // single transient write failure latches capture/commit until the next dsh
+  // restart. Started here so every session shares one single-flight drainer.
+  runtime.startDrainer();
+  ctx.effect(
+    () => () => runtime.stopDrainer(),
+    "openvikingMemory.stopDrainer()",
+  );
 
   ctx.on("agent/session-start", ({ agent }) => {
     if (skipMemory(agent.session)) return false;
@@ -33,13 +41,17 @@ export function apply(ctx, input = {}) {
 
   // prepend: downstream waterfall listeners run first, so this plugin sees
   // the final claimed batch and appends after every other contributor.
+  // Profile + recall are independent after `next()`; run them concurrently so
+  // the agent/pre-step waterfall (which currently gates user/message push in
+  // dsh-agent-loop) spends less wall time (#4515).
   ctx.on("agent/pre-step", async ({ agent, messages, signal }, next) => {
     const decision = await next();
     if (skipMemory(agent.session)) return decision;
     if (decision.kind !== "enter" || signal.aborted) return decision;
-    const profile = await runtime.profileMessage(agent);
-    if (signal.aborted) return decision;
-    const recall = await runtime.recallMessage(agent, decision.messages);
+    const [profile, recall] = await Promise.all([
+      runtime.profileMessage(agent),
+      runtime.recallMessage(agent, decision.messages),
+    ]);
     if (signal.aborted) return decision;
     const additions = [profile, recall].filter(Boolean);
     return additions.length > 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openviking/dsh-memory-plugin",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "OpenViking memory and context bundle for DeepSeek Harness",
   "type": "module",
   "main": "index.mjs",
@@ -35,15 +35,16 @@
     "prepublishOnly": "npm run check && npm test"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6 <0.2.0",
-    "@deepseek-ai/dsh-mcp-client": ">=0.1.0-rc.6 <0.2.0",
-    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.0-rc.6 <0.2.0"
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1",
+    "@deepseek-ai/dsh-mcp-client": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "@deepseek-ai/dsh-mcp-client": "0.1.0-rc.6",
     "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6"
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "semver": "7.8.5"
   },
   "overrides": {
     "@deepseek-ai/dsh-agent": "0.1.0-rc.6",

package/runtime.mjs

@@ -22,23 +22,29 @@ export class OpenVikingRuntime {
     this.config = config;
     this.logger = logger;
     this.states = new Map();
+    this.drainTimer = null;
+    this.drainRunning = false;
+    this.drainPromise = Promise.resolve();
+    this.drainHealth = null;
   }
 
   stateFor(session) {
     let state = this.states.get(session.id);
     if (state) return state;
     const cwd = session.header?.cwd || process.cwd();
-    const peerId = resolveEffectivePeerId({
+    const peer = resolveEffectivePeerId({
       cfg: {
         peerId: this.config.explicitPeerId,
+        peerSource: this.config.peerSource,
         workspacePeer: this.config.workspacePeer,
+        harness: this.config.harness,
       },
       cwd,
-    }).peerId;
+    });
     state = {
       dshSessionId: String(session.id),
       ovSessionId: deriveHarnessSessionId("dsh-", String(session.id)),
-      config: { ...this.config, peerId },
+      config: { ...this.config, peerId: peer.peerId, legacyPeerId: peer.legacyPeerId },
       ready: false,
       profileBlock: "",
       profileDelivered: false,
@@ -85,10 +91,11 @@ export class OpenVikingRuntime {
       state.initializationRetryable = isRetryableFailure(ensured);
       return state;
     }
-    await replayPending(
-      (path, init) => this.client.fetchJSON(path, init),
-      (stage, data) => this.log(stage, data),
-    );
+    // Replay is a write, so it stays behind the same toggle: a backlog queued
+    // while capture was on waits for a session that still writes.
+    if (state.config.syncTurns) {
+      await this.replayPendingQueue();
+    }
     await this.refreshPendingState(state);
     const profile = await buildProfileBlock(
       (path, init, options) => this.client.fetchJSON(path, init, options),
@@ -128,6 +135,7 @@ export class OpenVikingRuntime {
       query,
       {
         actorPeerId: state.config.peerId,
+        legacyPeerId: state.config.legacyPeerId,
         sessionId: state.ovSessionId,
         log: (stage, data) => this.log(stage, data),
       },
@@ -169,6 +177,7 @@ export class OpenVikingRuntime {
   maybeCommit(session, event) {
     if (event.type !== "turn/end") return;
     const state = this.stateFor(session);
+    if (!state.config.syncTurns) return;
     this.enqueueWrite(state, async () => {
       if (state.hasPendingWrites) return;
       if (!state.ready && !(await this.ensureState(state)).ready) return;
@@ -201,6 +210,7 @@ export class OpenVikingRuntime {
     if (state.disposing) return state.disposing;
     state.disposing = (async () => {
       this.enqueueWrite(state, async () => {
+        if (!state.config.syncTurns) return;
         const commitPayload = {
           keep_recent_count: state.config.commitKeepRecentCount,
         };
@@ -251,7 +261,15 @@ export class OpenVikingRuntime {
     const createdAt = Math.max(Date.now(), state.pendingCreatedAt + 1);
     state.pendingCreatedAt = createdAt;
     const result = await enqueue(type, state.ovSessionId, payload, { createdAt });
-    if (result.ok) state.hasPendingWrites = true;
+    if (result.ok) {
+      // Log the latch transition only: every message that follows while the
+      // latch holds takes the cheap enqueue path, so this fires once per
+      // outage, not once per message.
+      if (!state.hasPendingWrites) {
+        this.log("pending_latched", { sessionId: state.ovSessionId, type });
+      }
+      state.hasPendingWrites = true;
+    }
     if (!result.ok) {
       this.log("pending_enqueue_error", {
         sessionId: state.ovSessionId,
@@ -286,6 +304,7 @@ export class OpenVikingRuntime {
   }
 
   async refreshPendingState(state) {
+    const wasPending = state.hasPendingWrites;
     const pending = (await listPending()).filter(
       item => item.entry?.sessionId === state.ovSessionId,
     );
@@ -294,6 +313,84 @@ export class OpenVikingRuntime {
       (latest, item) => Math.max(latest, Number(item.entry?.createdAt || 0)),
       state.pendingCreatedAt,
     );
+    // Only the flip back to direct sends is logged: the recovery moment that
+    // proves the drainer worked, once per outage.
+    if (wasPending && !state.hasPendingWrites) {
+      this.log("pending_cleared", { sessionId: state.ovSessionId });
+    }
+  }
+
+  /**
+   * Replay the pending queue through this runtime's client. The session-start
+   * path calls it without options and keeps consuming retries; the drainer
+   * passes consumeRetries:false so transient failures stay retryable.
+   */
+  async replayPendingQueue(options = {}) {
+    await replayPending(
+      (path, init) => this.client.fetchJSON(path, init),
+      (stage, data) => this.log(stage, data),
+      options,
+    );
+  }
+
+  /**
+   * One drainer tick, following the session-start replay flow: probe health
+   * first and only replay when the server answers. Replays run without
+   * consuming retry budgets, then every session's latch is re-derived from
+   * the queue. An empty queue clears the latches with zero HTTP traffic, so
+   * once a transient write failure recovers, capture and commit resume on
+   * their own without restarting the long-lived dsh process.
+   */
+  async drainTick() {
+    if (this.drainRunning) return;
+    this.drainRunning = true;
+    try {
+      const pending = await listPending();
+      if (pending.length > 0) {
+        const health = await this.client.healthResult();
+        if (!health.ok) {
+          // Only the flip into the outage is logged, not every 60s probe.
+          if (this.drainHealth !== false) {
+            this.log("drain_health_down", { status: health.status || 0 });
+          }
+          this.drainHealth = false;
+        } else {
+          if (this.drainHealth === false) {
+            this.log("drain_health_restored", {});
+          }
+          this.drainHealth = true;
+          await this.replayPendingQueue({ consumeRetries: false });
+        }
+      }
+      for (const state of this.states.values()) {
+        await this.refreshPendingState(state);
+      }
+    } finally {
+      this.drainRunning = false;
+    }
+  }
+
+  /**
+   * Start the background drainer. The interval is fixed per process; each tick
+   * is single-flight, so a slow replay run never overlaps the next one.
+   */
+  startDrainer() {
+    if (this.drainTimer) return this.drainTimer;
+    const parsed = parseInt(process.env.OPENVIKING_PENDING_DRAIN_INTERVAL_MS || "", 10);
+    const intervalMs = Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
+    this.drainTimer = setInterval(() => {
+      this.drainPromise = this.drainTick().catch(error => this.log("drain_error", {
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    }, intervalMs);
+    this.drainTimer.unref?.();
+    return this.drainTimer;
+  }
+
+  stopDrainer() {
+    if (!this.drainTimer) return;
+    clearInterval(this.drainTimer);
+    this.drainTimer = null;
   }
 
   async flush(session) {
@@ -321,7 +418,9 @@ function pluginMessage(content, form) {
 
 function hasStartupProfile(agent) {
   const session = agent.session;
-  const ownEvents = (session?.events || []).slice(session?.header?.seedLength ?? 0);
+  const ownEvents = typeof session?.ownEvents === "function"
+    ? session.ownEvents()
+    : (session?.events || []).slice(session?.header?.seedLength ?? 0);
   const inHistory = ownEvents.some(event => (
     event?.type === "user/message" && isStartupProfile(event.data)
   ));

package/servers/mcp-proxy.mjs

@@ -25,6 +25,10 @@ export function readProxyConfig(env = process.env, cwd = process.cwd()) {
     apiKey: cfg.apiKey,
     account: cfg.account,
     user: cfg.user,
+    // Not gated through `resolveMcpActorPeerId` like the other proxies: DSH's
+    // parent process resolves the peer per session and hands it over in the
+    // child env (`mcp.mjs` `buildMcpConfig`), so this one is not a guess at the
+    // launch directory.
     peerId: cfg.peerId,
     userAgent: cfg.userAgent,
     timeoutMs: cfg.requestTimeoutMs,

package/shared/capture-utils.mjs

@@ -1,4 +1,6 @@
 // GENERATED FROM examples/memory-plugin-shared/lib. DO NOT EDIT.
+import { applyInputFilters, compileInputFilters } from "./input-filters.mjs";
+
 const TEXT_BLOCK_TYPES = new Set(["text", "input_text", "output_text"]);
 const TOOL_CALL_TYPES = new Set([
   "tool_call",
@@ -152,7 +154,7 @@ function toolId(block) {
 
 function toolStatus(block, kind) {
   if (kind === "call") return "running";
-  if (block?.is_error || block?.error || block?.state?.error) return "error";
+  if (block?.is_error || block?.isError || block?.state?.isError || block?.error || block?.state?.error) return "error";
   const status = oneLine(block?.status || block?.state?.status || "");
   return status || "completed";
 }
@@ -354,6 +356,53 @@ export function extractPartsFromPayload(payload, options = {}) {
   return parts;
 }
 
+/**
+ * Prune blank text parts and run `cfg.captureFilters` over the ones that remain.
+ *
+ * One drop verdict is taken per turn, on the aggregate of its text parts; the
+ * individual parts are then rewritten with the substitutions only, so a rule can
+ * never both keep and drop the same turn. Tool call/result parts are carried
+ * through untouched — filters match conversation text, not tool payloads — but a
+ * turn dropped on its text takes its tool parts with it.
+ */
+export function filterCaptureParts(parts, role, cfg = {}) {
+  const kept = [];
+  for (const part of parts || []) {
+    if (!part) continue;
+    if (part.type !== "text") {
+      kept.push(part);
+      continue;
+    }
+    const text = typeof part.text === "string" ? part.text.trim() : "";
+    if (!text) continue;
+    kept.push(text === part.text ? part : { ...part, text });
+  }
+
+  const blank = { parts: kept, dropped: false };
+  const compiled = compileInputFilters(cfg?.captureFilters);
+  if (!compiled.rules.length || kept.length === 0) return blank;
+
+  const textParts = kept.filter((part) => part.type === "text");
+  if (textParts.length === 0) return blank;
+
+  const verdict = applyInputFilters(textParts.map((part) => part.text).join("\n\n"), compiled.rules, {
+    role,
+  });
+  if (verdict.dropped) return { parts: [], dropped: true };
+
+  const out = [];
+  for (const part of kept) {
+    if (part.type !== "text") {
+      out.push(part);
+      continue;
+    }
+    const shaped = applyInputFilters(part.text, compiled.rules, { role, substituteOnly: true });
+    if (!shaped.text) continue;
+    out.push(shaped.text === part.text ? part : { ...part, text: shaped.text });
+  }
+  return { parts: out, dropped: out.length === 0 };
+}
+
 export function extractCaptureTurns(rolloutEntries, cfg = {}) {
   const toolNameById = collectToolNamesByIdFromEntries(rolloutEntries);
   const turns = [];
@@ -371,10 +420,15 @@ export function extractCaptureTurns(rolloutEntries, cfg = {}) {
       toolMaxChars: cfg.captureToolMaxChars,
       toolNameById,
     });
-    const decision = shouldCaptureText(rawText, role, cfg);
-    if (!decision.shouldCapture && parts.length === 0) continue;
+    const shaped = filterCaptureParts(parts, role, cfg);
+    if (shaped.dropped) continue;
+    // With parts on the wire the drop decision was already taken above, so the
+    // text path only runs the filters for the `content` fallback. That also
+    // keeps `turn.text` faithful for callers that scan it for trigger words.
+    const decision = shouldCaptureText(rawText, role, cfg, { filters: shaped.parts.length === 0 });
+    if (!decision.shouldCapture && shaped.parts.length === 0) continue;
     const text = decision.shouldCapture ? decision.text : "";
-    turns.push({ role, text, parts });
+    turns.push({ role, text, parts: shaped.parts });
   }
   return turns;
 }
@@ -486,12 +540,21 @@ function isPunctuationOnly(text) {
   return !/[a-z0-9\u3400-\u9fff]/i.test(text);
 }
 
-export function shouldCaptureText(text, role, cfg = {}) {
+export function shouldCaptureText(text, role, cfg = {}, { filters = true } = {}) {
   const maxLength = cfg.captureMaxLength || 24000;
   const sanitized = sanitizeCapturedText(text);
   if (!sanitized) return { shouldCapture: false, reason: "empty", text: "" };
 
-  const capped = truncateCaptureText(sanitized, maxLength);
+  let capped = truncateCaptureText(sanitized, maxLength);
+  if (filters) {
+    const compiled = compileInputFilters(cfg?.captureFilters);
+    if (compiled.rules.length) {
+      const verdict = applyInputFilters(capped, compiled.rules, { role });
+      if (verdict.dropped) return { shouldCapture: false, reason: "filtered", text: "" };
+      capped = verdict.text;
+      if (!capped) return { shouldCapture: false, reason: "empty", text: "" };
+    }
+  }
   const compact = oneLine(capped);
   const isToolSummary = /^\[tool-(?:call|result)\b/i.test(compact);