@vellumai/assistant 0.6.3 → 0.6.5

package/src/daemon/message-types/home.ts

@@ -0,0 +1,40 @@
+/**
+ * Home — server → client push messages for the macOS Home page.
+ *
+ * These messages are fire-and-forget notifications; the client reacts
+ * by refetching the authoritative state from the HTTP route
+ * (`GET /v1/home/state`). Payloads stay deliberately tiny — they carry
+ * just enough metadata to invalidate a cache and trigger a refetch.
+ */
+
+/**
+ * Broadcast after the daemon successfully writes a fresh
+ * `relationship-state.json` snapshot to disk. Subscribers should
+ * refetch `GET /v1/home/state` to read the new state.
+ *
+ * Only emitted on the success branch of the writer — if the
+ * underlying `writeFileSync` throws, this event is NOT published.
+ */
+export interface RelationshipStateUpdated {
+  type: "relationship_state_updated";
+  /** ISO-8601 timestamp of the newly-written state's `updatedAt` field. */
+  updatedAt: string;
+}
+
+/**
+ * Broadcast after the daemon successfully writes a fresh home activity
+ * feed snapshot. Subscribers (e.g. `HomeFeedStore` on the client) should
+ * refetch the authoritative feed from its HTTP route.
+ *
+ * Only emitted on the success branch of the feed writer — if the
+ * underlying write fails, this event is NOT published.
+ */
+export interface HomeFeedUpdated {
+  type: "home_feed_updated";
+  /** ISO-8601 timestamp of when the feed was written. */
+  updatedAt: string;
+  /** Count of items with `status === "new"` after this write. */
+  newItemCount: number;
+}
+
+export type _HomeServerMessages = RelationshipStateUpdated | HomeFeedUpdated;

package/src/daemon/message-types/meet.ts

@@ -0,0 +1,143 @@
+/**
+ * Meet — server → client push messages for live meeting state.
+ *
+ * Emitted by the assistant daemon as the Meet-bot progresses through its
+ * lifecycle (joining → joined → left) and as in-meeting state changes
+ * (participants, active speaker, transcript chunks).
+ *
+ * Keep payloads small and client-actionable: these events power the
+ * macOS "In meeting" status panel and the conversation bridge's live
+ * transcript feed. A client that missed an event can always refetch
+ * authoritative state from the daemon's HTTP routes.
+ */
+
+/** A single participant in a meeting. Shape mirrors the wire-level type. */
+export interface MeetParticipant {
+  /** Stable participant identifier (provider-specific). */
+  id: string;
+  /** Display name of the participant. */
+  name: string;
+  /** Whether the participant is the meeting host. */
+  isHost?: boolean;
+  /** Whether the participant is the bot itself. */
+  isSelf?: boolean;
+}
+
+/** The bot has started attempting to join a meeting. */
+export interface MeetJoining {
+  type: "meet.joining";
+  meetingId: string;
+  /** The Meet URL the bot was asked to join. */
+  url: string;
+}
+
+/** The bot has successfully joined and is live in the meeting. */
+export interface MeetJoined {
+  type: "meet.joined";
+  meetingId: string;
+}
+
+/** Participants joined and/or left the meeting since the last snapshot. */
+export interface MeetParticipantChanged {
+  type: "meet.participant_changed";
+  meetingId: string;
+  /** Participants who joined since the last snapshot. */
+  joined: MeetParticipant[];
+  /** Participants who left since the last snapshot. */
+  left: MeetParticipant[];
+}
+
+/** The active speaker in the meeting changed. */
+export interface MeetSpeakerChanged {
+  type: "meet.speaker_changed";
+  meetingId: string;
+  /** Stable speaker identifier for the new active speaker. */
+  speakerId: string;
+  /** Display name of the new active speaker. */
+  speakerName: string;
+}
+
+/**
+ * A finalized chunk of transcribed speech. Interim chunks are filtered
+ * out before publication so clients only render stable text.
+ */
+export interface MeetTranscriptChunk {
+  type: "meet.transcript_chunk";
+  meetingId: string;
+  /** The transcribed text. */
+  text: string;
+  /** Human-readable speaker label, if the ASR provided one. */
+  speakerLabel?: string;
+  /** Stable speaker identifier across the meeting, if available. */
+  speakerId?: string;
+  /** ASR confidence in [0, 1], if available. */
+  confidence?: number;
+}
+
+/** The bot has left the meeting. */
+export interface MeetLeft {
+  type: "meet.left";
+  meetingId: string;
+  /** Free-form reason passed to `leave()` (e.g. "user-requested", "timeout"). */
+  reason: string;
+}
+
+/**
+ * The assistant successfully posted a chat message into the meeting via
+ * the bot's `/send_chat` endpoint. Emitted once per successful send so
+ * SSE-subscribed clients can render the outbound chat without waiting for
+ * the bot to echo it back through the transcript/chat stream.
+ */
+export interface MeetChatSent {
+  type: "meet.chat_sent";
+  meetingId: string;
+  /** The text that was posted into the meeting's chat. */
+  text: string;
+}
+
+/** The bot hit a non-recoverable error (container crash, join failure, etc.). */
+export interface MeetError {
+  type: "meet.error";
+  meetingId: string;
+  /** Human-readable error detail. */
+  detail: string;
+}
+
+/**
+ * The assistant has begun speaking into the meeting via the TTS bridge. Fired
+ * once per {@link MeetSessionManager.speak} invocation immediately before the
+ * synthesis stream starts flowing to the bot's `/play_audio` endpoint. Useful
+ * for clients that want to render a "speaking …" indicator.
+ */
+export interface MeetSpeakingStarted {
+  type: "meet.speaking_started";
+  meetingId: string;
+  /** Opaque stream identifier — matches `meet.speaking_ended.streamId`. */
+  streamId: string;
+}
+
+/**
+ * The assistant has finished (or cancelled) a TTS playback stream. Fired
+ * after the bot-side playback request settles — whether normally, via an
+ * explicit cancel, or due to an upstream error.
+ */
+export interface MeetSpeakingEnded {
+  type: "meet.speaking_ended";
+  meetingId: string;
+  /** Opaque stream identifier — matches `meet.speaking_started.streamId`. */
+  streamId: string;
+  /** Why the stream ended: natural completion, caller-initiated cancel, or an upstream error. */
+  reason: "completed" | "cancelled" | "error";
+}
+
+export type _MeetServerMessages =
+  | MeetJoining
+  | MeetJoined
+  | MeetParticipantChanged
+  | MeetSpeakerChanged
+  | MeetTranscriptChunk
+  | MeetLeft
+  | MeetChatSent
+  | MeetError
+  | MeetSpeakingStarted
+  | MeetSpeakingEnded;

package/src/daemon/message-types/messages.ts

@@ -23,6 +23,10 @@ export interface UserMessage {
   microphonePermissionGranted?: boolean;
   /** Structured command intent — bypasses text parsing when present. */
   commandIntent?: CommandIntent;
+  /** Client-generated correlation nonce for echo dedup. See
+   *  `UserMessageEcho.clientMessageId` — the server echoes this value
+   *  back on the matching `user_message_echo` event. */
+  clientMessageId?: string;
 }
 
 export interface ConfirmationResponse {
@@ -33,7 +37,6 @@ export interface ConfirmationResponse {
     | "allow_10m"
     | "allow_conversation"
     | "always_allow"
-    | "always_allow_high_risk"
     | "deny"
     | "always_deny";
   selectedPattern?: string;
@@ -60,6 +63,18 @@ export interface UserMessageEcho {
   type: "user_message_echo";
   text: string;
   conversationId?: string;
+  /** Database ID of the persisted user message, used by the originating
+   *  client to dedupe its optimistic row. Absent for synthetic echoes
+   *  (e.g. surface-action prompts) where no distinct user row is persisted. */
+  messageId?: string;
+  /** Server-generated request ID for the send. Allows correlation with
+   *  `message_queued` / `message_dequeued` events for the same turn. */
+  requestId?: string;
+  /** Client-generated correlation nonce from the HTTP POST body. Echoed
+   *  back so the originating client can dedupe its optimistic row even
+   *  if the SSE echo beats the 202 response. Absent for synthetic echoes
+   *  (e.g. surface-action prompts) that did not originate from a client POST. */
+  clientMessageId?: string;
 }
 
 export interface AssistantTextDelta {
@@ -194,6 +209,13 @@ export interface MessageComplete {
   attachmentWarnings?: string[];
   /** Database ID of the persisted assistant message, if any. */
   messageId?: string;
+  /**
+   * Distinguishes a real main-turn completion from auxiliary events such as
+   * call transcripts, call summaries, and watch notifier outputs. Clients
+   * gate turn-completion side effects (e.g. the task_complete sound) on
+   * `source !== "aux"`. Absent is treated as main for backwards compatibility.
+   */
+  source?: "main" | "aux";
 }
 
 export interface ErrorMessage {

package/src/daemon/message-types/schedules.ts

@@ -54,6 +54,15 @@ export interface HeartbeatChecklistWrite {
   content: string;
 }
 
+export interface FilingConfig {
+  type: "filing_config";
+  action: "get";
+}
+
+export interface FilingRunNow {
+  type: "filing_run_now";
+}
+
 // === Server → Client ===
 
 export interface SchedulesListResponse {
@@ -133,6 +142,25 @@ export interface HeartbeatChecklistWriteResponse {
   error?: string;
 }
 
+export interface FilingConfigResponse {
+  type: "filing_config_response";
+  enabled: boolean;
+  intervalMs: number;
+  activeHoursStart: number | null;
+  activeHoursEnd: number | null;
+  nextRunAt: number | null;
+  lastRunAt: number | null;
+  success: boolean;
+  error?: string;
+}
+
+export interface FilingRunNowResponse {
+  type: "filing_run_now_response";
+  success: boolean;
+  ran: boolean;
+  error?: string;
+}
+
 // --- Domain-level union aliases (consumed by the barrel file) ---
 
 export type _SchedulesClientMessages =
@@ -145,7 +173,9 @@ export type _SchedulesClientMessages =
   | HeartbeatRunsList
   | HeartbeatRunNow
   | HeartbeatChecklistRead
-  | HeartbeatChecklistWrite;
+  | HeartbeatChecklistWrite
+  | FilingConfig
+  | FilingRunNow;
 
 export type _SchedulesServerMessages =
   | SchedulesListResponse
@@ -155,4 +185,6 @@ export type _SchedulesServerMessages =
   | HeartbeatRunsListResponse
   | HeartbeatRunNowResponse
   | HeartbeatChecklistResponse
-  | HeartbeatChecklistWriteResponse;
+  | HeartbeatChecklistWriteResponse
+  | FilingConfigResponse
+  | FilingRunNowResponse;

package/src/daemon/message-types/skills.ts

@@ -1,5 +1,10 @@
 // Skill management types.
 
+import type { PartnerAudit } from "../../skills/skillssh-registry.js";
+
+// Re-export so consumers can access the audit types from this module.
+export type { PartnerAudit } from "../../skills/skillssh-registry.js";
+
 // === Client → Server ===
 
 export interface SkillsListRequest {
@@ -98,6 +103,7 @@ interface ClawhubSlimSkill extends SlimSkillBase {
   installs: number;
   reports: number;
   publishedAt?: string;
+  version: string;
 }
 
 interface SkillsshSlimSkill extends SlimSkillBase {
@@ -105,6 +111,7 @@ interface SkillsshSlimSkill extends SlimSkillBase {
   slug: string;
   sourceRepo: string;
   installs: number;
+  audit?: Record<string, PartnerAudit>;
 }
 
 interface CustomSlimSkill extends SlimSkillBase {
@@ -122,6 +129,13 @@ export interface SkillsListResponse {
   skills: SlimSkillResponse[];
 }
 
+export interface SkillsListFilteredResponse {
+  type: "skills_list_response";
+  skills: SlimSkillResponse[];
+  categoryCounts: Record<string, number>;
+  totalCount: number;
+}
+
 export interface SkillStateChanged {
   type: "skills_state_changed";
   name: string;
@@ -159,6 +173,7 @@ interface ClawhubSkillDetail extends SkillDetailBase {
   installs: number;
   reports: number;
   publishedAt?: string;
+  version: string;
   // Enrichment fields (from clawhubInspect):
   owner?: { handle: string; displayName: string; image?: string } | null;
   stats?: {
@@ -177,6 +192,7 @@ interface SkillsshSkillDetail extends SkillDetailBase {
   slug: string;
   sourceRepo: string;
   installs: number;
+  audit?: Record<string, PartnerAudit>;
 }
 
 interface CustomSkillDetail extends SkillDetailBase {

package/src/daemon/message-types/surfaces.ts

@@ -184,6 +184,8 @@ interface UiSurfaceShowBase {
   display?: "inline" | "panel";
   /** The message ID that this surface belongs to (for history loading). */
   messageId?: string;
+  /** When `true`, clicking an action does not dismiss the surface — the client keeps the card visible and only marks the clicked `actionId` as spent so siblings remain clickable. */
+  persistent?: boolean;
 }
 
 export interface UiSurfaceShowCard extends UiSurfaceShowBase {

package/src/daemon/message-types/trust.ts

@@ -8,8 +8,6 @@ export interface AddTrustRule {
   pattern: string;
   scope: string;
   decision: "allow" | "deny" | "ask";
-  /** When true, the rule also covers high-risk invocations. */
-  allowHighRisk?: boolean;
   /** Execution target override for this rule. */
   executionTarget?: "host" | "sandbox";
 }

package/src/daemon/parse-actual-tokens-from-error.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
-import { parseActualTokensFromError } from "./conversation-agent-loop.js";
+import { ContextOverflowError } from "../providers/types.js";
+import { parseActualTokensFromError } from "./parse-actual-tokens-from-error.js";
 
 describe("parseActualTokensFromError", () => {
   test("returns null for null input", () => {
@@ -68,4 +69,59 @@ describe("parseActualTokensFromError", () => {
   test("returns null when no numeric pattern matches", () => {
     expect(parseActualTokensFromError("context window exceeded")).toBeNull();
   });
+
+  // ── Typed-error branch ─────────────────────────────────────────────
+
+  test("prefers ContextOverflowError.actualTokens over string-regex match", () => {
+    // Message would regex-parse to 999999, but typed field wins.
+    const err = new ContextOverflowError(
+      "Anthropic API error (400): prompt is too long: 999999 tokens > 200000 maximum",
+      "anthropic",
+      {
+        actualTokens: 242201,
+        maxTokens: 200000,
+      },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("falls back to regex when ContextOverflowError has no actualTokens", () => {
+    const err = new ContextOverflowError(
+      "OpenAI API error (400): too many input tokens: 150000 > 128000",
+      "openai",
+      {},
+    );
+    expect(parseActualTokensFromError(err)).toBe(150000);
+  });
+
+  test("returns null when ContextOverflowError has neither typed field nor matching message", () => {
+    const err = new ContextOverflowError("context window exceeded", "openai");
+    expect(parseActualTokensFromError(err)).toBeNull();
+  });
+
+  test("typed-error parsing takes precedence over string regex even when both present", () => {
+    // String has 999999 tokens > 200000; typed field says 242201.
+    // The typed field MUST win — this is the core contract.
+    const err = new ContextOverflowError(
+      "prompt is too long: 999999 tokens > 200000 maximum",
+      "anthropic",
+      { actualTokens: 242201 },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("accepts an untyped Error instance and parses its message", () => {
+    const err = new Error("prompt is too long: 242201 tokens > 200000 maximum");
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
+
+  test("ignores non-numeric/invalid actualTokens on typed error", () => {
+    // actualTokens of 0 should fall through (typed check requires > 0).
+    const err = new ContextOverflowError(
+      "prompt is too long: 242201 tokens > 200000 maximum",
+      "anthropic",
+      { actualTokens: 0 },
+    );
+    expect(parseActualTokensFromError(err)).toBe(242201);
+  });
 });

package/src/daemon/parse-actual-tokens-from-error.ts

@@ -0,0 +1,66 @@
+import { isContextOverflowError } from "../providers/types.js";
+
+/**
+ * Parse the actual token count reported by the provider for a
+ * context-too-large failure.
+ *
+ * Prefers the typed `ContextOverflowError.actualTokens` field when the
+ * thrown error is one. Falls back to regex-parsing the message for patterns
+ * like:
+ *   "prompt is too long: 242201 tokens > 200000 maximum"   (Anthropic)
+ *   "too many input tokens: 242201 > 200000"                (OpenAI)
+ *
+ * The regex path remains a safety net for provider-adapter paths (e.g.
+ * managed-proxy rewrappers) that surface untyped errors.
+ *
+ * Accepts a raw error object, an `Error` instance, or a plain string.
+ * Returns the actual token count, or `null` when it cannot be determined.
+ */
+export function parseActualTokensFromError(
+  errorOrMessage: unknown,
+): number | null {
+  // Typed path — the provider client wrapped a matching upstream error as
+  // ContextOverflowError. Use the parsed field directly when available.
+  if (isContextOverflowError(errorOrMessage)) {
+    const actual = errorOrMessage.actualTokens;
+    if (typeof actual === "number" && actual > 0) return actual;
+    // Typed error without `actualTokens` — fall through to regex-parse the
+    // underlying message in case the upstream body carries it in text form.
+    return parseFromMessage(errorOrMessage.message ?? null);
+  }
+
+  // Untyped path — accept either an Error or a string.
+  if (errorOrMessage == null) return null;
+  if (typeof errorOrMessage === "string") {
+    return parseFromMessage(errorOrMessage);
+  }
+  if (typeof errorOrMessage === "object" && "message" in errorOrMessage) {
+    const msg = (errorOrMessage as { message?: unknown }).message;
+    if (typeof msg === "string") return parseFromMessage(msg);
+  }
+  return null;
+}
+
+function parseFromMessage(errorMessage: string | null): number | null {
+  if (!errorMessage) return null;
+
+  // Match patterns like "242201 tokens > 200000" or "242201 > 200000 maximum"
+  const match = errorMessage.match(
+    /(\d[\d,]*)\s*tokens?\s*[>≥]|:\s*(\d[\d,]*)\s*[>≥]/i,
+  );
+  if (match) {
+    const raw = (match[1] || match[2]).replace(/,/g, "");
+    const parsed = parseInt(raw, 10);
+    if (!isNaN(parsed) && parsed > 0) return parsed;
+  }
+
+  // Fallback: match "too many input tokens: N > M"
+  const fallback = errorMessage.match(/(\d[\d,]*)\s*[>≥]\s*\d/);
+  if (fallback) {
+    const raw = fallback[1].replace(/,/g, "");
+    const parsed = parseInt(raw, 10);
+    if (!isNaN(parsed) && parsed > 0) return parsed;
+  }
+
+  return null;
+}

package/src/daemon/pkb-context-tracker.test.ts

@@ -0,0 +1,169 @@
+import path from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import type { ContentBlock, Message } from "../providers/types.js";
+import type { Conversation } from "./conversation.js";
+import { getInContextPkbPaths } from "./pkb-context-tracker.js";
+
+const WORKING_DIR = path.resolve("/tmp/test-pkb-root");
+const PKB_ROOT = path.join(WORKING_DIR, "pkb");
+
+// The helper only reads `conversation.messages`. Constructing a real
+// `Conversation` instance would require a full daemon setup; casting a
+// minimal object through `unknown` keeps the test isolated and pure while
+// still exercising the public type.
+function makeConversation(messages: Message[]): Conversation {
+  return { messages } as unknown as Conversation;
+}
+
+function fileReadToolUse(filePath: string): ContentBlock {
+  return {
+    type: "tool_use",
+    id: `toolu_${Math.random().toString(36).slice(2, 10)}`,
+    name: "file_read",
+    input: { path: filePath },
+  };
+}
+
+function assistantMessageWithBlocks(blocks: ContentBlock[]): Message {
+  return { role: "assistant", content: blocks };
+}
+
+describe("getInContextPkbPaths", () => {
+  test("auto-inject paths are always present (even with empty conversation)", () => {
+    const conversation = makeConversation([]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["notes/index.md", "journal/2026-04-18.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([
+        path.join(PKB_ROOT, "notes/index.md"),
+        path.join(PKB_ROOT, "journal/2026-04-18.md"),
+      ]),
+    );
+  });
+
+  test("includes a file_read tool_use with a path inside pkbRoot", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/thoughts.md");
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse(insidePath)]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set([insidePath]));
+  });
+
+  test("excludes a file_read tool_use whose path is outside pkbRoot", () => {
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse("/etc/hosts")]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("excludes a non-file_read tool_use with a PKB-like path", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/thoughts.md");
+    const bogus: ContentBlock = {
+      type: "tool_use",
+      id: "toolu_bogus",
+      name: "file_write",
+      input: { path: insidePath },
+    };
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([bogus]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("post-compaction context-summary user message returns only auto-inject paths", () => {
+    // After compaction, the structured tool_use blocks have been serialized
+    // away and the conversation is just a user-role text message containing
+    // the summary.
+    const summaryMessage: Message = {
+      role: "user",
+      content: [
+        {
+          type: "text",
+          text: "[Context summary] Previously you read notes/thoughts.md and journal/2026-04-18.md...",
+        },
+      ],
+    };
+    const conversation = makeConversation([summaryMessage]);
+    const autoInject = ["profile/identity.md"];
+    const result = getInContextPkbPaths(
+      conversation,
+      autoInject,
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([path.join(PKB_ROOT, "profile/identity.md")]),
+    );
+  });
+
+  test("path-traversal attempt via ../../etc/passwd is excluded", () => {
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([
+        fileReadToolUse("../../etc/passwd"),
+        fileReadToolUse("notes/../../../etc/shadow"),
+      ]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("relative file_read path outside pkbRoot is excluded", () => {
+    // These are resolved against `workingDir` (matching `file_read`'s own
+    // rule), land outside `pkbRoot`, and are correctly ignored.
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([
+        fileReadToolUse("notes.md"),
+        fileReadToolUse("./deep/subdir/file.md"),
+      ]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set());
+  });
+
+  test("workspace-relative file_read path inside pkb/ is recognized", () => {
+    // The model emits workspace-relative paths like `pkb/threads.md`.
+    // The tracker resolves them against `workingDir` (matching `file_read`'s
+    // own rule) and verifies the result falls inside `pkbRoot`.
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse("pkb/threads.md")]),
+    ]);
+    const result = getInContextPkbPaths(conversation, [], PKB_ROOT, WORKING_DIR);
+    expect(result).toEqual(new Set([path.join(PKB_ROOT, "threads.md")]));
+  });
+
+  test("resolves relative auto-inject paths against pkbRoot", () => {
+    const conversation = makeConversation([]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["./notes/relative.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result).toEqual(
+      new Set([path.join(PKB_ROOT, "notes/relative.md")]),
+    );
+  });
+
+  test("auto-inject and file_read paths union (no duplicates)", () => {
+    const insidePath = path.join(PKB_ROOT, "notes/shared.md");
+    const conversation = makeConversation([
+      assistantMessageWithBlocks([fileReadToolUse(insidePath)]),
+    ]);
+    const result = getInContextPkbPaths(
+      conversation,
+      ["notes/shared.md"],
+      PKB_ROOT,
+      WORKING_DIR,
+    );
+    expect(result.size).toBe(1);
+    expect(result.has(insidePath)).toBe(true);
+  });
+});