@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/daemon/conversation-notifiers.ts

@@ -25,6 +25,7 @@ import {
 } from "../persistence/conversation-crud.js";
 import type { Message } from "../providers/types.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 /**
  * Subset of Conversation state that notifier callbacks need to read at
@@ -58,7 +59,14 @@ export function registerConversationNotifiers(
         JSON.stringify([{ type: "text", text: questionText }]),
         {
           metadata: {
-            ...provenanceFromTrustContext(ctx.trustContext),
+            ...provenanceFromTrustContext(
+              // This callback fires after the voice turn has settled: the
+              // per-turn field may still hold that turn's actor (nothing
+              // clears it at release), while voice cleanup has restored the
+              // conversation's resting trust. The owner is the right actor
+              // for a row persisted outside any turn.
+              restingTrust(ctx),
+            ),
             userMessageChannel: "phone",
             assistantMessageChannel: "phone",
             userMessageInterface: "phone",

package/src/daemon/conversation-process.ts

@@ -63,6 +63,7 @@ import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import { buildTransportHints } from "./transport-hints.js";
 import { sameTrustIdentity, type TrustContext } from "./trust-context-types.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveVerificationSessionIntent } from "./verification-session-intent.js";
 
 const log = getLogger("conversation-process");
@@ -823,7 +824,7 @@ async function drainSingleMessage(
   if (slashResult.kind === "unknown") {
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainImageSourcePaths: Record<string, string> = {};
       for (let i = 0; i < next.attachments.length; i++) {
@@ -938,7 +939,7 @@ async function drainSingleMessage(
     let persistedCompactMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -1031,7 +1032,7 @@ async function drainSingleMessage(
     let persistedCleanMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -2024,7 +2025,9 @@ export async function processMessage(
   if (slashResult.kind === "unknown") {
     const pmTurnCtx = conversation.getTurnChannelContext();
     const pmInterfaceCtx = conversation.getTurnInterfaceContext();
-    const pmProvenance = provenanceFromTrustContext(conversation.trustContext);
+    const pmProvenance = provenanceFromTrustContext(
+      turnOrRestingTrust(conversation),
+    );
     const pmImageSourcePaths: Record<string, string> = {};
     for (let i = 0; i < attachments.length; i++) {
       const a = attachments[i];
@@ -2116,7 +2119,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,
@@ -2197,7 +2200,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,

package/src/daemon/conversation-runtime-assembly.ts

@@ -2319,7 +2319,7 @@ export async function applyRuntimeInjections(
   // folded into the summary are excluded.
   const slackActiveThreadFocusBlock = channelCapabilities
     ? loadSlackActiveThreadFocusBlock(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
         slackContextCompactionWatermarkTs:
@@ -2337,7 +2337,7 @@ export async function applyRuntimeInjections(
   // boundary without the orchestrator threading a snapshot in.
   const slackChronologicalMessages = channelCapabilities
     ? loadSlackChronologicalMessages(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextSummary: liveConversation?.contextSummary,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
@@ -2380,8 +2380,7 @@ export async function applyRuntimeInjections(
     turnIndex: options.turnIndex ?? liveConversation?.turnCount ?? 0,
     trust:
       options.trust ??
-      liveConversation?.currentTurnTrustContext ??
-      liveConversation?.trustContext ??
+      liveConversation?.getTurnOrRestingTrust() ??
       fallbackTurnTrust(channelCapabilities),
     callSite: options.callSite ?? liveConversation?.currentCallSite,
     ...injectionInputs,

package/src/daemon/conversation-tool-setup.ts

@@ -389,8 +389,7 @@ export function createToolExecutor(
     // Per-turn trust snapshot: prefer the snapshot captured at turn start so
     // a concurrent owner meta command (/status, /clean) that mutates the live
     // trustContext cannot elevate the in-flight turn to guardian.
-    const turnTrust =
-      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+    const turnTrust = ctx.getTurnOrRestingTrust() ?? FALLBACK_TURN_TRUST;
 
     const toolContext: ToolContext = {
       workingDir: ctx.workingDir,

package/src/daemon/conversation.ts

@@ -2488,6 +2488,54 @@ export class Conversation {
     return this.authContext;
   }
 
+  /**
+   * Trust the in-flight turn is executing under.
+   *
+   * Use this for authorization and for routing a reply to the requester:
+   * cases where substituting the conversation's owner would be wrong rather
+   * than approximate. Provenance is not such a case; see
+   * {@link getTurnOrRestingTrust} and `docs/architecture/turn-actor.md`.
+   *
+   * `undefined` when no turn recorded one, which is a gap in the entry point
+   * rather than an answer. Deliberately does not fall back to the
+   * conversation's trust: a caller that can accept the conversation's owner
+   * instead spells `?? getTrustContext()`, so the substitution is visible
+   * where it happens.
+   */
+  getTurnTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext;
+  }
+
+  /**
+   * Trust of the actor the conversation belongs to, independent of any turn.
+   *
+   * Use this where there is no turn to speak of: routes reporting on a
+   * conversation, hydration, and persisting conversation-level options. A
+   * caller that wants the conversation's owner *rather than* whoever is
+   * currently acting should be obviously doing so; if it is not obvious,
+   * {@link getTurnTrust} is probably the one meant.
+   */
+  getTrustContext(): TrustContext | undefined {
+    return this.trustContext;
+  }
+
+  /**
+   * Trust of the in-flight turn, or the conversation's owner when the turn
+   * recorded none. The substitution is in the name: callers that can accept
+   * the owner as a stand-in ask this, including provenance stamping, whose
+   * readers treat an absent trust class as more trusted than `"unknown"`.
+   * Callers for which the owner would be wrong rather than approximate call
+   * {@link getTurnTrust} and handle `undefined`.
+   *
+   * The fallback half is load-bearing, not transitional politeness: a
+   * deferred wake fires with no inbound actor, and refusing it an answer
+   * denies every sensitive tool in the resumed turn (LUM-2929). It becomes
+   * removable in one place when every entry point records a turn actor.
+   */
+  getTurnOrRestingTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext ?? this.trustContext;
+  }
+
   /**
    * The actor principal that owns the current turn, for host-proxy routing.
    * Prefers the in-flight turn's actor over the conversation's resting

package/src/daemon/mcp-reload-service.ts

@@ -6,6 +6,10 @@
  */
 
 import { getConfig, invalidateConfigCache } from "../config/loader.js";
+import {
+  buildEffectiveMcpConfig,
+  pluginMcpServersChangedSinceLastBuild,
+} from "../mcp/effective-config.js";
 import { getMcpServerManager } from "../mcp/manager.js";
 import { migrateLegacyMcpHeaders } from "../mcp/mcp-header-store.js";
 import { createMcpToolsFromServer } from "../tools/mcp/mcp-tool-factory.js";
@@ -52,6 +56,29 @@ export function reloadMcpServers(): Promise<McpReloadResult> {
   return reloadInProgress;
 }
 
+/**
+ * Reload MCP servers if — and only if — the plugin-declared set moved.
+ *
+ * Called by the plugin source reconcile, which every install / uninstall /
+ * upgrade / enable / disable already funnels through, so a plugin's MCP
+ * tools come up and go down with the plugin instead of lingering until an
+ * explicit reload, a config edit, or a restart.
+ *
+ * The guard matters: a reconcile also fires for plugin edits that touch no
+ * `mcp.json` at all, and an unconditional reload would tear down every
+ * healthy workspace connection to re-establish it for nothing.
+ *
+ * Never throws — the reconcile is best-effort and must not fail an install
+ * whose files already landed on disk.
+ */
+export async function reconcilePluginMcpServers(): Promise<void> {
+  if (!pluginMcpServersChangedSinceLastBuild()) {
+    return;
+  }
+  log.info("Plugin-declared MCP servers changed; reloading");
+  await reloadMcpServers();
+}
+
 async function doReload(): Promise<McpReloadResult> {
   try {
     const manager = getMcpServerManager();
@@ -74,17 +101,20 @@ async function doReload(): Promise<McpReloadResult> {
     // 2. Stop existing MCP servers + unregister their tools
     await manager.stop();
     unregisterAllMcpTools();
-    const serverIds = config.mcp?.servers
-      ? Object.keys(config.mcp.servers)
-      : [];
+
+    // Plugins are re-read here too: installing or removing one changes the
+    // server set exactly like editing config.json does, and both arrive
+    // through this same reload.
+    const mcpConfig = buildEffectiveMcpConfig(config.mcp);
+    const serverIds = Object.keys(mcpConfig.servers);
 
     // 3. Restart MCP servers
     let serverCount = 0;
     let toolCount = 0;
     const servers: McpReloadServerResult[] = [];
 
-    if (config.mcp?.servers && Object.keys(config.mcp.servers).length > 0) {
-      const serverToolInfos = await manager.start(config.mcp);
+    if (serverIds.length > 0) {
+      const serverToolInfos = await manager.start(mcpConfig);
       for (const { serverId, serverConfig, tools } of serverToolInfos) {
         const mcpTools = createMcpToolsFromServer(
           tools,
@@ -105,7 +135,7 @@ async function doReload(): Promise<McpReloadResult> {
       // Include servers that were configured but failed to connect or are disabled
       for (const id of serverIds) {
         if (!servers.some((s) => s.id === id)) {
-          const serverConfig = config.mcp!.servers![id];
+          const serverConfig = mcpConfig.servers[id];
           const isDisabled = serverConfig?.enabled === false;
           servers.push({
             id,

package/src/daemon/process-message.ts

@@ -71,6 +71,7 @@ import {
   shouldAttachHostProxyForCapability,
 } from "./host-proxy-preactivation.js";
 import type { SubagentToolGateMode } from "./tool-setup-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("process-message");
 
@@ -455,7 +456,10 @@ export async function processMessage(
   if (slashResult.kind === "unknown") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const imageSourcePaths: Record<string, string> = {};
     for (let i = 0; i < attachments.length; i++) {
@@ -557,7 +561,10 @@ export async function processMessage(
   if (slashResult.kind === "compact") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const compactChannelMeta = {
       ...serverProvenance,
@@ -612,7 +619,10 @@ export async function processMessage(
   if (slashResult.kind === "clean") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const cleanChannelMeta = {
       ...serverProvenance,

package/src/daemon/providers-setup.ts

@@ -1,6 +1,7 @@
 import { maybeDefaultSpeechToManaged } from "../config/managed-speech-defaults.js";
 import { rehydratePlatformCredentials } from "../config/platform-rehydration.js";
 import type { AssistantConfig } from "../config/types.js";
+import { buildEffectiveMcpConfig } from "../mcp/effective-config.js";
 import { getMcpServerManager } from "../mcp/manager.js";
 import { gmailMessagingProvider } from "../messaging/providers/gmail/adapter.js";
 import { outlookMessagingProvider } from "../messaging/providers/outlook/adapter.js";
@@ -61,11 +62,13 @@ export async function initializeProvidersAndTools(
     );
   }
 
-  // Start MCP servers and register their tools
-  if (config.mcp?.servers && Object.keys(config.mcp.servers).length > 0) {
+  // Start MCP servers — workspace-configured and plugin-declared alike —
+  // and register their tools.
+  const mcpConfig = buildEffectiveMcpConfig(config.mcp);
+  if (Object.keys(mcpConfig.servers).length > 0) {
     const manager = getMcpServerManager();
     try {
-      const serverToolInfos = await manager.start(config.mcp);
+      const serverToolInfos = await manager.start(mcpConfig);
       for (const { serverId, serverConfig, tools } of serverToolInfos) {
         const mcpTools = createMcpToolsFromServer(
           tools,

package/src/daemon/trust-context-types.ts

@@ -106,3 +106,32 @@ export function sameTrustIdentity(
     a.guardianPrincipalId === b.guardianPrincipalId
   );
 }
+
+/** The two trust fields a conversation-shaped value carries. */
+export interface TrustCarrier {
+  currentTurnTrustContext?: TrustContext;
+  trustContext?: TrustContext;
+}
+
+/**
+ * The acting turn's trust, else the owner's. Structural counterpart of
+ * `Conversation.getTurnOrRestingTrust` for call sites handed a
+ * conversation-shaped context rather than the class, so a partial test double
+ * needs only the fields it already has.
+ */
+export function turnOrRestingTrust(
+  carrier: TrustCarrier | undefined,
+): TrustContext | undefined {
+  return carrier?.currentTurnTrustContext ?? carrier?.trustContext;
+}
+
+/**
+ * The owner's trust, independent of any turn. Structural counterpart of
+ * `Conversation.getTrustContext`; see `docs/architecture/turn-actor.md` for
+ * when the owner is the right actor.
+ */
+export function restingTrust(
+  carrier: Pick<TrustCarrier, "trustContext"> | undefined,
+): TrustContext | undefined {
+  return carrier?.trustContext;
+}

package/src/daemon/wake-conversation-ops.ts

@@ -32,6 +32,7 @@ import type {
   SubagentToolGateMode,
   WakeToolContextPin,
 } from "./tool-setup-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("wake-conversation-ops");
 
@@ -222,7 +223,7 @@ export async function persistWakeTailMessage(
   const turnChannelCtx = conversation.getTurnChannelContext();
   const turnInterfaceCtx = conversation.getTurnInterfaceContext();
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(conversation.trustContext),
+    ...provenanceFromTrustContext(restingTrust(conversation)),
     userMessageChannel: turnChannelCtx?.userMessageChannel ?? "vellum",
     assistantMessageChannel:
       turnChannelCtx?.assistantMessageChannel ?? "vellum",
@@ -301,7 +302,7 @@ export async function persistWakeTriggerMessage(
   const turnChannelCtx = conversation.getTurnChannelContext();
   const turnInterfaceCtx = conversation.getTurnInterfaceContext();
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(conversation.trustContext),
+    ...provenanceFromTrustContext(restingTrust(conversation)),
     userMessageChannel: turnChannelCtx?.userMessageChannel ?? "vellum",
     assistantMessageChannel:
       turnChannelCtx?.assistantMessageChannel ?? "vellum",

package/src/documents/document-store.ts

@@ -798,12 +798,125 @@ export function replaceInDocument(
   }
 }
 
+// ---------------------------------------------------------------------------
+// Append idempotency
+// ---------------------------------------------------------------------------
+
+/** A blank-line-delimited block of markdown, located in its source string. */
+interface MarkdownBlock {
+  /** Whitespace-trimmed block text, the unit duplicate detection compares. */
+  text: string;
+  /** Offset of the block's first character in the source string. */
+  start: number;
+}
+
+/**
+ * Split markdown into blank-line-delimited blocks, dropping empty ones but
+ * keeping each surviving block's offset so a suffix of the source can be
+ * recovered verbatim.
+ */
+function splitIntoBlocks(content: string): MarkdownBlock[] {
+  const blocks: MarkdownBlock[] = [];
+  const separator = /\n[^\S\n]*\n/g;
+  let cursor = 0;
+  let match: RegExpExecArray | null;
+  const push = (start: number, end: number): void => {
+    const text = content.slice(start, end).trim();
+    if (text.length > 0) {
+      blocks.push({ text, start });
+    }
+  };
+  while ((match = separator.exec(content)) !== null) {
+    push(cursor, match.index);
+    cursor = match.index + match[0].length;
+  }
+  push(cursor, content.length);
+  return blocks;
+}
+
+/**
+ * An append has to repeat at least this many characters of the document's tail
+ * before the repetition is treated as an accident.
+ *
+ * The floor is what keeps legitimate repetition intact. A document can honestly
+ * repeat a heading, a refrain, a table row, or a bare "TODO" back to back, and
+ * those are all short. Only a substantial restatement (an opening paragraph
+ * passed to both `document_create` and the first append) clears the bar.
+ */
+const MIN_DUPLICATE_APPEND_CHARS = 40;
+
+/**
+ * Drop a leading run of blocks from `markdown` that exactly repeats the tail of
+ * `existing`, so an append that restates content already committed does not
+ * write it a second time.
+ *
+ * The guard is deliberately narrow: the repeated run must be an exact,
+ * block-aligned match, it must sit at the very start of the append and the very
+ * end of the document, and it must be at least
+ * {@link MIN_DUPLICATE_APPEND_CHARS} long. Anything else, including the same
+ * text reappearing further down the append, is passed through untouched.
+ */
+function stripDuplicateLeadingBlocks(
+  existing: string,
+  markdown: string,
+): string {
+  const existingBlocks = splitIntoBlocks(existing);
+  const incomingBlocks = splitIntoBlocks(markdown);
+  const maxOverlap = Math.min(existingBlocks.length, incomingBlocks.length);
+
+  let overlap = 0;
+  for (let candidate = maxOverlap; candidate >= 1; candidate--) {
+    const offset = existingBlocks.length - candidate;
+    let matches = true;
+    for (let i = 0; i < candidate; i++) {
+      if (existingBlocks[offset + i].text !== incomingBlocks[i].text) {
+        matches = false;
+        break;
+      }
+    }
+    if (matches) {
+      overlap = candidate;
+      break;
+    }
+  }
+  if (overlap === 0) {
+    return markdown;
+  }
+
+  const duplicatedChars = incomingBlocks
+    .slice(0, overlap)
+    .reduce((total, block) => total + block.text.length, 0);
+  if (duplicatedChars < MIN_DUPLICATE_APPEND_CHARS) {
+    return markdown;
+  }
+
+  if (overlap === incomingBlocks.length) {
+    return "";
+  }
+  return markdown
+    .slice(incomingBlocks[overlap].start)
+    .replace(/^(?:[^\S\n]*\n)+/, "");
+}
+
+/** Outcome of a successful {@link updateDocumentContent} call. */
+export interface DocumentContentUpdated {
+  success: true;
+  /**
+   * The markdown that actually landed. Equals the submitted markdown except
+   * when an append's leading blocks duplicated the document's tail, in which
+   * case it is the remainder. Clients render this so their view matches the row.
+   */
+  appliedMarkdown: string;
+  /** True when a duplicated leading run was dropped from an append. */
+  duplicateLeadingContentSkipped: boolean;
+}
+
 /** Update persisted document content (append or replace). */
 export function updateDocumentContent(
   surfaceId: string,
   markdown: string,
   mode: string,
-): { success: true } | { success: false; error: string } {
+): DocumentContentUpdated | { success: false; error: string } {
   try {
     const existing = rawGet<{ content: string }>(
       "documents:updateDocumentContent:get",
@@ -814,9 +927,19 @@ export function updateDocumentContent(
       log.info({ surfaceId }, "No persisted document to update");
       return { success: false, error: "Document not found" };
     }
-    const sep = mode === "append" && existing.content.length > 0 ? "\n\n" : "";
-    const newContent =
-      mode === "append" ? existing.content + sep + markdown : markdown;
+    const appending = mode === "append";
+    const appliedMarkdown = appending
+      ? stripDuplicateLeadingBlocks(existing.content, markdown)
+      : markdown;
+    const duplicateLeadingContentSkipped =
+      appending && appliedMarkdown !== markdown;
+    const sep =
+      appending && existing.content.length > 0 && appliedMarkdown.length > 0
+        ? "\n\n"
+        : "";
+    const newContent = appending
+      ? existing.content + sep + appliedMarkdown
+      : appliedMarkdown;
     writeThroughToWorkspaceFile(surfaceId, newContent);
     const wordCount = countWords(newContent);
     rawRun(
@@ -827,8 +950,18 @@ export function updateDocumentContent(
       Date.now(),
       surfaceId,
     );
+    if (duplicateLeadingContentSkipped) {
+      log.info(
+        { surfaceId, skippedChars: markdown.length - appliedMarkdown.length },
+        "Skipped append content duplicating the document tail",
+      );
+    }
     log.info({ surfaceId, mode }, "Updated document content");
-    return { success: true };
+    return {
+      success: true,
+      appliedMarkdown,
+      duplicateLeadingContentSkipped,
+    };
   } catch (error) {
     log.error({ err: error, surfaceId }, "Document content update error");
     return {

package/src/hooks/hook-loader.ts

@@ -39,9 +39,9 @@
  * registry, so the next read re-resolves fresh.
  *
  * Plugin *discovery* (which plugin directories exist, in what order) lives in
- * `../plugins/mtime-cache.ts`; the orchestrator there passes the discovered
- * directories into {@link collectUserHookEntries}. Keeping discovery out of
- * this module lets it sit below the plugin cache with no import cycle.
+ * `../plugins/mtime-cache.ts`; hook lookup in `./registry.ts` passes the
+ * discovered names into {@link collectUserHookEntries}. Keeping discovery out
+ * of this module lets it sit below the plugin cache with no import cycle.
  */
 
 import {

package/src/hooks/registry.ts

@@ -6,20 +6,22 @@
  * hook-chain ordering.
  *
  * User-land hooks (from the filesystem) are owned by
- * {@link ./hook-loader.ts} and surfaced through `getUserHooksFor` in
- * `plugins/mtime-cache.ts`. This module owns only the in-process hooks that
- * default plugins register at boot.
+ * {@link ./hook-loader.ts} and surfaced through {@link getUserHooksFor}.
+ * This module owns the in-process hooks that default plugins register at
+ * boot, plus the user-land lookup that walks discovered plugin names from
+ * the plugin cache.
  *
  * {@link getHooksFor} combines both sources: in-process hooks from this
  * registry (filtered by `isPluginDisabled` at read time) and user-land hooks
  * from the plugin cache. The read-time filtering is what makes `assistant
- * plugins disable default-*` take effect immediately in a running assistant
- * — the hooks stay registered but are filtered out on the next turn.
+ * plugins disable default-*` take effect immediately in a running assistant:
+ * the hooks stay registered but are filtered out on the next turn.
  */
 
 import { isPluginDisabled } from "../plugins/disabled-state.js";
-import { getUserHookEntriesFor } from "../plugins/mtime-cache.js";
+import { getDiscoveredUserPluginNames } from "../plugins/mtime-cache.js";
 import type { HookEntry, HookFunction } from "../plugins/types.js";
+import { collectUserHookEntries } from "./hook-loader.js";
 
 // ─── Internal state ──────────────────────────────────────────────────────────
 
@@ -75,6 +77,48 @@ export function unregisterPluginHooks(pluginName: string): void {
 
 // ─── Queries ─────────────────────────────────────────────────────────────────
 
+/**
+ * Get all hooks for a given event name from user plugins and standalone
+ * workspace hooks, from the hook loader's in-memory cache. Plugin hooks run
+ * in install-date order, the workspace hook runs last.
+ *
+ * This is a pure cache read: it never scans disk, activates a plugin, or
+ * runs `init`. Activation happens only at boot (`populateCacheAtBoot`)
+ * and through the imperative install/uninstall poke
+ * (`reconcilePluginSourcesNow`), both main-daemon paths, so a
+ * sidecar process that dispatches hooks (a worker running conversation
+ * turns) can never bring a plugin up in its own process.
+ *
+ * `effectiveEnabledPlugins` carries the per-chat plugin scope: when non-null,
+ * user plugins outside the set are skipped (standalone workspace hooks always
+ * run). `null`/omitted means no per-chat restriction.
+ */
+export async function getUserHookEntriesFor<TCtx = unknown>(
+  hookName: string,
+  effectiveEnabledPlugins?: Set<string> | null,
+): Promise<HookEntry<TCtx>[]> {
+  return collectUserHookEntries<TCtx>(
+    hookName,
+    getDiscoveredUserPluginNames(),
+    effectiveEnabledPlugins,
+  );
+}
+
+/**
+ * {@link getUserHookEntriesFor} without owner attribution. Returns just the
+ * hook functions in the same order.
+ */
+export async function getUserHooksFor<TCtx = unknown>(
+  hookName: string,
+  effectiveEnabledPlugins?: Set<string> | null,
+): Promise<HookFunction<TCtx>[]> {
+  const entries = await getUserHookEntriesFor<TCtx>(
+    hookName,
+    effectiveEnabledPlugins,
+  );
+  return entries.map((e) => e.fn);
+}
+
 /**
  * Collect every registered hook for the given name, in registration order.
  * Plugins that don't declare a hook for `name` are skipped. Used by the