@vellumai/assistant 0.6.6 → 0.7.1

package/src/permissions/secret-prompter.ts

@@ -2,6 +2,8 @@ import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../config/loader.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 
@@ -33,38 +35,22 @@ export interface SecretPrompterChannelContext {
 
 export class SecretPrompter {
   private pending = new Map<string, PendingSecretPrompt>();
-  private sendToClient: (msg: ServerMessage) => void;
-  private broadcastToAllClients?: (msg: ServerMessage) => void;
   private channelContext?: SecretPrompterChannelContext;
 
-  constructor(
-    sendToClient: (msg: ServerMessage) => void,
-    broadcastToAllClients?: (msg: ServerMessage) => void,
-  ) {
-    this.sendToClient = sendToClient;
-    this.broadcastToAllClients = broadcastToAllClients;
-  }
-
-  updateSender(sendToClient: (msg: ServerMessage) => void): void {
-    this.sendToClient = sendToClient;
-  }
-
-  updateBroadcast(broadcastToAllClients?: (msg: ServerMessage) => void): void {
-    this.broadcastToAllClients = broadcastToAllClients;
-  }
-
   setChannelContext(ctx: SecretPrompterChannelContext | undefined): void {
     this.channelContext = ctx;
   }
 
   /**
-   * Send a secret_request to the client and wait for the response.
+   * Broadcast a secret_request to all connected clients and wait for a
+   * response.
    *
-   * When the conversation originates from a channel that cannot render secure
-   * prompts (e.g. Slack), the request is broadcast to all connected clients
-   * via the SSE hub so the desktop app can display it. If no broadcast path
-   * is available and the channel doesn't support dynamic UI, the method
-   * fails fast with an error result rather than hanging until timeout.
+   * The request is always published to the SSE hub via
+   * {@link broadcastMessage} so any connected client (desktop, web) can
+   * display the secure prompt dialog.
+   *
+   * Pending interaction registration is handled by {@link broadcastMessage}
+   * when the secret_request event is published to the hub.
    *
    * SECURITY: Logs only metadata (requestId, service, field) — never the
    * returned secret value. The timeout path also returns a null value
@@ -81,32 +67,23 @@ export class SecretPrompter {
     allowedTools?: string[],
     allowedDomains?: string[],
   ): Promise<SecretPromptResult> {
-    // Determine whether the originating channel can render secure prompts.
-    const channelSupportsPrompt =
-      this.channelContext?.supportsDynamicUi !== false;
-
-    // If the channel cannot render the prompt and there's no broadcast path
-    // to reach a desktop client, fail fast instead of hanging for 5 minutes.
-    if (!channelSupportsPrompt && !this.broadcastToAllClients) {
-      log.warn(
-        { service, field, channel: this.channelContext?.channel },
-        "Secret prompt requested from a channel that cannot render it and no broadcast path is available",
-      );
-      return { value: null, delivery: "store", error: "unsupported_channel" };
-    }
-
     const requestId = uuid();
+    const effectiveConversationId = conversationId ?? "unknown";
 
     return new Promise((resolve, reject) => {
       const timeoutMs = getConfig().timeouts.permissionTimeoutSec * 1000;
       const timer = setTimeout(() => {
         this.pending.delete(requestId);
+        pendingInteractions.resolve(requestId);
         log.warn({ requestId, service, field }, "Secret prompt timed out");
         resolve({ value: null, delivery: "store" });
       }, timeoutMs);
 
       this.pending.set(requestId, { resolve, reject, timer });
 
+      // pendingInteractions.register is now handled by broadcastMessage
+      // when the secret_request event is published to the hub.
+
       const config = getConfig();
       const msg: SecretRequestMessage = {
         type: "secret_request",
@@ -116,21 +93,14 @@ export class SecretPrompter {
         label,
         description,
         placeholder,
-        conversationId,
+        conversationId: effectiveConversationId,
         purpose,
         allowedTools,
         allowedDomains,
         allowOneTimeSend: config.secretDetection.allowOneTimeSend,
       };
 
-      // Use broadcastToAllClients when the originating channel cannot render
-      // secure prompts — this routes the request to the SSE hub where a
-      // connected desktop client can pick it up.
-      if (!channelSupportsPrompt && this.broadcastToAllClients) {
-        this.broadcastToAllClients(msg);
-      } else {
-        this.sendToClient(msg);
-      }
+      broadcastMessage(msg);
     });
   }
 
@@ -157,12 +127,15 @@ export class SecretPrompter {
     }
     clearTimeout(pending.timer);
     this.pending.delete(requestId);
+    // Clean up the global map (may already be removed by approval-routes).
+    pendingInteractions.resolve(requestId);
     pending.resolve({ value: value ?? null, delivery: delivery ?? "store" });
   }
 
   dispose(): void {
-    for (const [, pending] of this.pending) {
+    for (const [requestId, pending] of this.pending) {
       clearTimeout(pending.timer);
+      pendingInteractions.resolve(requestId);
       pending.reject(
         new AssistantError("Prompter disposed", ErrorCode.INTERNAL_ERROR),
       );

package/src/permissions/types.ts

@@ -1,67 +1,70 @@
-import type { TrustRuleBase } from "@vellumai/ces-contracts";
+export type {
+  AllowlistOption,
+  ScopeOption,
+} from "@vellumai/skill-host-contracts";
+export { RiskLevel } from "@vellumai/skill-host-contracts";
 
-/**
- * Re-exported TrustRule type from `@vellumai/ces-contracts`.
- *
- * The contracts package defines `TrustRule` as a discriminated union over tool
- * families (scoped, URL, managed-skill, skill-load, generic). Some variants
- * don't carry `executionTarget`. To maintain backward
- * compatibility with existing callsites that access those fields on any rule,
- * we flatten the union here by intersecting the base with the optional fields.
- */
-export type TrustRule = TrustRuleBase & {
-  scope?: string;
-  executionTarget?: string;
+export type ApprovalMode = "prompted" | "auto" | "blocked" | "unknown";
+
+export type ApprovalReason =
+  | "user_approved"
+  | "user_denied"
+  | "timed_out"
+  | "within_threshold"
+  | "trust_rule_allowed"
+  | "trust_rule_denied"
+  | "sandbox_auto_approve"
+  | "platform_auto_approve"
+  | "no_interactive_client"
+  | "grant_scoped_consumed"
+  | "system_cancelled"
+  | "unknown";
+
+export type RiskThreshold = "none" | "low" | "medium" | "high";
+
+export const RISK_ORDINAL: Record<string, number> = {
+  low: 0,
+  medium: 1,
+  high: 2,
+};
+
+export const THRESHOLD_ORDINAL: Record<string, number> = {
+  none: -1,
+  low: 0,
+  medium: 1,
+  high: 2,
 };
 
-export enum RiskLevel {
-  Low = "low",
-  Medium = "medium",
-  High = "high",
+/** A persistent trust rule stored on disk and used for permission matching. */
+export interface TrustRule {
+  id: string;
+  tool: string;
+  pattern: string;
+  decision: "allow" | "deny" | "ask";
+  priority: number;
+  createdAt: number;
+  scope?: string;
+  executionTarget?: string;
+  userModifiedAt?: number;
 }
 
-export type UserDecision =
-  | "allow"
-  | "allow_10m"
-  | "allow_conversation"
-  | "always_allow"
-  | "deny"
-  | "always_deny"
-  | "temporary_override";
+export type UserDecision = "allow" | "deny";
 
-/** Returns true for any allow-variant decision. Centralizes the check to prevent omissions when new allow variants are added. */
 export function isAllowDecision(decision: UserDecision): boolean {
-  return (
-    decision === "allow" ||
-    decision === "allow_10m" ||
-    decision === "allow_conversation" ||
-    decision === "always_allow" ||
-    decision === "temporary_override"
-  );
+  return decision === "allow";
 }
 
 export interface PermissionCheckResult {
   decision: "allow" | "deny" | "prompt";
   reason: string;
   matchedRule?: TrustRule;
-}
-
-export interface AllowlistOption {
-  label: string;
-  description: string;
-  pattern: string;
-}
-
-export interface ScopeOption {
-  label: string;
-  scope: string;
+  /** True when the decision was taken via the sandbox auto-approve path. */
+  hasSandboxAutoApprove?: boolean;
 }
 
 /** Contextual information passed alongside a permission check for policy decisions. */
 export interface PolicyContext {
   executionTarget?: string;
-  /** Ephemeral rules for task-scoped permissions — checked before persistent trust.json rules. */
-  ephemeralRules?: TrustRule[];
   /**
    * Execution context for per-context threshold resolution.
    * - "conversation": interactive client session (default)

package/src/permissions/workspace-policy.ts

@@ -63,18 +63,11 @@ const HOST_TOOLS = new Set([
   "host_file_read",
   "host_file_write",
   "host_file_edit",
+  "host_file_transfer",
   "host_bash",
   "computer_use_run_applescript",
 ]);
 
-/**
- * Check whether a tool name is a host-level tool that requires the
- * `hostAccess` permission to execute.
- */
-export function isHostTool(toolName: string): boolean {
-  return HOST_TOOLS.has(toolName);
-}
-
 /** Safe local-only tools that are always workspace-scoped. */
 const ALWAYS_SCOPED_TOOLS = new Set([
   "skill_load",

package/src/platform/sync-identity.ts

@@ -119,11 +119,3 @@ function clearRequestedIfLatest(requestSeq: number): void {
     lastRequestedName = lastSyncedName;
   }
 }
-
-/** Reset cached state (for testing). */
-export function _resetSyncState(): void {
-  lastSyncedName = null;
-  lastRequestedName = null;
-  seq = 0;
-  pending = Promise.resolve();
-}

package/src/playbooks/playbook-compiler.ts

@@ -6,7 +6,7 @@
 
 import { and, eq, sql } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { memoryGraphNodes } from "../memory/schema.js";
 import type { Playbook } from "./types.js";
 import { parsePlaybookStatement } from "./types.js";

package/src/plugins/defaults/index.ts

@@ -52,7 +52,7 @@ import { defaultToolResultTruncatePlugin } from "./tool-result-truncate.js";
  * contents are read at call time, after every imported plugin identifier is
  * guaranteed initialized.
  */
-export function getAllDefaultPlugins(): readonly Plugin[] {
+function getAllDefaultPlugins(): readonly Plugin[] {
   return [
     defaultLlmCallPlugin,
     defaultToolExecutePlugin,

package/src/plugins/defaults/injectors.ts

@@ -16,6 +16,7 @@
  * | `unified-turn-context`   | 20    | prepend-user-tail       |
  * | `pkb-context`            | 30    | after-memory-prefix     |
  * | `pkb-reminder`           | 35    | after-memory-prefix     |
+ * | `memory-v2-static`       | 38    | after-memory-prefix     |
  * | `now-md`                 | 40    | after-memory-prefix     |
  * | `subagent-status`        | 50    | append-user-tail        |
  * | `slack-messages`         | 60    | replace-run-messages    |
@@ -44,8 +45,10 @@
 
 import { resolve } from "node:path";
 
+import { getConfig } from "../../config/loader.js";
 import { getInContextPkbPaths } from "../../daemon/pkb-context-tracker.js";
 import { buildPkbReminder } from "../../daemon/pkb-reminder-builder.js";
+import { isMemoryV2ReadActive } from "../../memory/context-search/sources/memory-v2.js";
 import { searchPkbFiles } from "../../memory/pkb/pkb-search.js";
 import { getLogger } from "../../util/logger.js";
 import { registerPlugin } from "../registry.js";
@@ -71,7 +74,7 @@ const PKB_HINT_THRESHOLD = 0.5;
 const PKB_HINT_ARCHIVE_THRESHOLD = 0.7;
 
 /**
- * Fixed order values for the seven default injectors. Exported so tests —
+ * Fixed order values for the eight default injectors. Exported so tests —
  * and any future integration code — can assert ordering without re-deriving
  * the constants.
  *
@@ -84,6 +87,7 @@ export const DEFAULT_INJECTOR_ORDER = {
   unifiedTurnContext: 20,
   pkbContext: 30,
   pkbReminder: 35,
+  memoryV2Static: 38,
   nowMd: 40,
   subagentStatus: 50,
   slackMessages: 60,
@@ -94,6 +98,18 @@ function readInjectionInputs(ctx: TurnContext): TurnInjectionInputs {
   return ctx.injectionInputs ?? {};
 }
 
+/**
+ * v2 read-side cutover guard. The `pkb-context` injector silences itself
+ * under v2 because the `<knowledge_base>` block surfaces PKB content the v2
+ * activation block already covers. The `pkb-reminder` injector still fires
+ * (its body is generic recall/remember guidance) but skips the hybrid-search
+ * hints — those name PKB paths v2 is moving away from. NOW.md is workspace
+ * state independent of PKB and fires unchanged.
+ */
+function isPkbInjectionSilencedByV2(): boolean {
+  return isMemoryV2ReadActive(getConfig());
+}
+
 /**
  * `workspace-context` injector — order 10, prepend-user-tail.
  *
@@ -105,7 +121,7 @@ function readInjectionInputs(ctx: TurnContext): TurnInjectionInputs {
  *  - `mode === "full"` (skipped in minimal mode).
  *  - `workspaceTopLevelContext` is a non-null, non-empty string.
  */
-export const workspaceContextInjector: Injector = {
+const workspaceContextInjector: Injector = {
   name: "workspace-context",
   order: DEFAULT_INJECTOR_ORDER.workspaceContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -133,7 +149,7 @@ export const workspaceContextInjector: Injector = {
  * Active in both `full` and `minimal` mode — unified turn context is
  * safety-critical grounding that must survive injection downgrade.
  */
-export const unifiedTurnContextInjector: Injector = {
+const unifiedTurnContextInjector: Injector = {
   name: "unified-turn-context",
   order: DEFAULT_INJECTOR_ORDER.unifiedTurnContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -157,22 +173,23 @@ export const unifiedTurnContextInjector: Injector = {
  * yielding `[...memory, <system_reminder>, <knowledge_base>, ...user text]`.
  *
  * Emitting context and reminder as two separate blocks (rather than a single
- * concatenated text) preserves the pre-migration two-ContentBlock shape that
- * the rehydration path in `conversation-lifecycle.ts` recreates — keeping
- * fresh-injection and rehydrated-history structurally identical so
- * Anthropic's prefix cache matches across reloads.
+ * concatenated text) produces the two-ContentBlock shape that the rehydration
+ * path in `conversation-lifecycle.ts` recreates — keeping fresh-injection and
+ * rehydrated-history structurally identical so Anthropic's prefix cache
+ * matches across reloads.
  *
  * Gating:
  *  - `mode === "full"`.
  *  - Non-null, non-empty `pkbContext`.
  */
-export const pkbContextInjector: Injector = {
+const pkbContextInjector: Injector = {
   name: "pkb-context",
   order: DEFAULT_INJECTOR_ORDER.pkbContext,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
     const inputs = readInjectionInputs(ctx);
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
+    if (isPkbInjectionSilencedByV2()) return null;
     if (!inputs.pkbContext) return null;
     return {
       id: "pkb-context",
@@ -189,13 +206,13 @@ export const pkbContextInjector: Injector = {
  * hints) as its own after-memory-prefix splice. Higher `order` than
  * `pkb-context` so the reminder splices second and ends up immediately
  * after the memory prefix, pushing `<knowledge_base>` one slot further
- * down — matching the pre-migration [reminder, context] ordering.
+ * down — producing a [reminder, context] ordering.
  *
  * Gating:
  *  - `mode === "full"`.
  *  - `pkbActive === true`.
  */
-export const pkbReminderInjector: Injector = {
+const pkbReminderInjector: Injector = {
   name: "pkb-reminder",
   order: DEFAULT_INJECTOR_ORDER.pkbReminder,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -203,7 +220,9 @@ export const pkbReminderInjector: Injector = {
     const mode = inputs.mode ?? "full";
     if (mode !== "full") return null;
     if (!inputs.pkbActive) return null;
-    const reminder = await buildPkbReminderWithHints(inputs);
+    const reminder = isPkbInjectionSilencedByV2()
+      ? buildPkbReminder([])
+      : await buildPkbReminderWithHints(inputs);
     return {
       id: "pkb-reminder",
       text: reminder,
@@ -215,9 +234,7 @@ export const pkbReminderInjector: Injector = {
 /**
  * Render the PKB context block — wraps the raw content in
  * `<knowledge_base>...</knowledge_base>` while escaping any closing tags
- * inside the content that would break out of the XML wrapper. Mirrors the
- * body of the pre-migration `injectPkbContext` helper exactly so the emitted
- * bytes match.
+ * inside the content that would break out of the XML wrapper.
  */
 function buildPkbContextBlock(content: string): string {
   const escaped = content.replace(
@@ -298,6 +315,53 @@ async function buildPkbReminderWithHints(
   return buildPkbReminder(hints);
 }
 
+/**
+ * `memory-v2-static` injector — order 38, after-memory-prefix.
+ *
+ * Injects the v2 static memory block (essentials/threads/recent/buffer
+ * concatenated under markdown headings) wrapped in `<memory>...</memory>`
+ * onto the user message. The agent loop only forwards `memoryV2Static` on
+ * full-mode turns (first turn / post-compaction), mirroring the PKB
+ * auto-inject cadence — subsequent turns get `null` and the prior block
+ * stays cached on its original user message.
+ *
+ * Sits between `pkb-reminder` (35) and `now-md` (40) so the rendered order
+ * after the memory prefix is `[pkb-reminder, pkb-context, memory-v2-static,
+ * now-md, ...user text]` when every PKB injector also fires (transitional
+ * state). Once PKB is fully retired under v2 this is the only block
+ * adjacent to the memory prefix.
+ *
+ * Gating:
+ *  - `mode === "full"`.
+ *  - `memoryV2Static` is a non-null, non-empty string.
+ */
+const memoryV2StaticInjector: Injector = {
+  name: "memory-v2-static",
+  order: DEFAULT_INJECTOR_ORDER.memoryV2Static,
+  async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
+    const inputs = readInjectionInputs(ctx);
+    const mode = inputs.mode ?? "full";
+    if (mode !== "full") return null;
+    const content = inputs.memoryV2Static;
+    if (!content) return null;
+    return {
+      id: "memory-v2-static",
+      text: buildMemoryV2StaticBlock(content),
+      placement: "after-memory-prefix",
+    };
+  },
+};
+
+/**
+ * Wrap the static memory content in `<memory>...</memory>`. Escapes any
+ * closing `</memory>` inside the content so authored memory files cannot
+ * accidentally break out of the wrapper.
+ */
+function buildMemoryV2StaticBlock(content: string): string {
+  const escaped = content.replace(/<\/memory\s*>/gi, "&lt;/memory&gt;");
+  return `<memory>\n${escaped}\n</memory>`;
+}
+
 /**
  * `now-md` injector — order 40, after-memory-prefix.
  *
@@ -309,7 +373,7 @@ async function buildPkbReminderWithHints(
  *  - `mode === "full"` (skipped in minimal mode).
  *  - `nowScratchpad` is a non-null, non-empty string.
  */
-export const nowMdInjector: Injector = {
+const nowMdInjector: Injector = {
   name: "now-md",
   order: DEFAULT_INJECTOR_ORDER.nowMd,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -341,7 +405,7 @@ export const nowMdInjector: Injector = {
  *  - `mode === "full"`.
  *  - `subagentStatusBlock` is a non-null, non-empty string.
  */
-export const subagentStatusInjector: Injector = {
+const subagentStatusInjector: Injector = {
   name: "subagent-status",
   order: DEFAULT_INJECTOR_ORDER.subagentStatus,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -364,13 +428,12 @@ export const subagentStatusInjector: Injector = {
  * Swaps the conversation's `runMessages` array with a pre-rendered
  * chronological Slack transcript built from the persisted message rows.
  * Applied to every Slack conversation (channels and DMs alike). The
- * orchestrator builds the transcript via `loadSlackChronologicalMessages`
+ * orchestrator builds the transcript via `loadSlackChronologicalContext`
  * before the chain runs.
  *
- * The injector preserves the pre-migration memory-block prepending
- * behaviour: `extractMemoryPrefixBlocks` is re-applied to the Slack
- * transcript's tail user message inside `applyRuntimeInjections` when the
- * replacement fires.
+ * Memory-block prepending is preserved across the replacement:
+ * `extractMemoryPrefixBlocks` is re-applied to the Slack transcript's tail
+ * user message inside `applyRuntimeInjections` when the replacement fires.
  *
  * Active in both `full` and `minimal` mode — Slack transcript replacement
  * is not a high-token optional block, it's the canonical view of Slack
@@ -380,7 +443,7 @@ export const subagentStatusInjector: Injector = {
  *  - `channelCapabilities.channel === "slack"`.
  *  - `slackChronologicalMessages` has at least one entry.
  */
-export const slackMessagesInjector: Injector = {
+const slackMessagesInjector: Injector = {
   name: "slack-messages",
   order: DEFAULT_INJECTOR_ORDER.slackMessages,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -419,7 +482,7 @@ export const slackMessagesInjector: Injector = {
  *    (non-DM Slack conversation).
  *  - `slackActiveThreadFocusBlock` is a non-empty string.
  */
-export const threadFocusInjector: Injector = {
+const threadFocusInjector: Injector = {
   name: "thread-focus",
   order: DEFAULT_INJECTOR_ORDER.threadFocus,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
@@ -461,6 +524,7 @@ export const defaultInjectorsPlugin: Plugin = {
     unifiedTurnContextInjector,
     pkbContextInjector,
     pkbReminderInjector,
+    memoryV2StaticInjector,
     nowMdInjector,
     subagentStatusInjector,
     slackMessagesInjector,

package/src/plugins/defaults/llm-call.ts

@@ -1,6 +1,6 @@
 /**
- * Default `llmCall` plugin — a true passthrough that declares the pipeline
- * surface and always yields to downstream middleware.
+ * Default `llmCall` plugin — a passthrough that declares the pipeline
+ * surface and yields to downstream middleware.
  *
  * The plugin system wraps every LLM request in the `llmCall` pipeline. The
  * actual call to {@link Provider.sendMessage} lives in the `runPipeline`
@@ -8,13 +8,10 @@
  * contribute the manifest (`provides.llmCall: "v1"`) so other plugins can
  * negotiate against the pipeline surface.
  *
- * Because this plugin is registered at module load — BEFORE user plugins are
- * loaded by `bootstrapPlugins()` — it sits at the outermost layer in
- * `composeMiddleware`'s onion ordering. If its middleware called
- * `provider.sendMessage` directly (instead of `next(args)`) it would
- * short-circuit the chain and silently disable every user-registered
- * `llmCall` middleware in production. The middleware therefore just forwards
- * to `next(args)`.
+ * This plugin registers at module load — before user plugins are loaded by
+ * `bootstrapPlugins()` — so it sits at the outermost layer in
+ * `composeMiddleware`'s onion ordering. To keep user-registered middleware
+ * reachable, the middleware forwards unconditionally via `next(args)`.
  *
  * Registered from `daemon/external-plugins-bootstrap.ts` via a side-effect
  * import so the plugin is present in the registry before

package/src/plugins/defaults/memory-retrieval.ts

@@ -121,15 +121,10 @@ export async function runDefaultMemoryRetrieval(
     };
   }
 
-  // `prepareMemory` requires a non-optional signal. In production the agent
-  // loop always threads one via `args.signal`; the fallback `AbortController`
-  // keeps direct callers (e.g. tests that skip the pipeline) working without
-  // forcing every call site to synthesize a dummy signal.
-  const abortSignal = args.signal ?? new AbortController().signal;
   const graphResult = await deps.graphMemory.prepareMemory(
     deps.messages,
     deps.config,
-    abortSignal,
+    args.signal,
     deps.onEvent,
   );
 

package/src/plugins/defaults/overflow-reduce.ts

@@ -12,11 +12,15 @@
  * callbacks carried on {@link OverflowReduceArgs}; the plugin itself has no
  * access to the agent-loop context object.
  *
- * Internal calls to `ContextWindowManager` remain direct — pipeline layering
- * ends at the top of the reducer, not within the forced-compaction tier.
- * The supplied `compactFn` delegates straight into the context window
- * manager, so only the tier-loop orchestration goes through the pipeline
- * runner.
+ * The forced-compaction tier runs through the orchestrator-supplied
+ * `compactFn`, which routes into the `compaction` plugin pipeline so
+ * registered compaction middleware observes reducer-initiated invocations
+ * alongside the orchestrator-owned call sites. Non-compaction tiers
+ * (tool-result truncation, media stubbing, injection downgrade) remain
+ * in-process: they mutate message arrays directly without crossing a
+ * pipeline boundary. The reducer itself runs under the `overflowReduce`
+ * pipeline, so the full layering is `overflowReduce` → reducer tier loop
+ * → (for the forced-compaction tier only) nested `compaction` pipeline.
  */
 
 import type { ContextWindowCompactOptions } from "../../context/window-manager.js";
@@ -70,8 +74,9 @@ export const defaultOverflowReduceMiddleware: Middleware<
     attempts++;
     args.emitActivityState();
 
+    const basisMessages = messages;
     const step = await reduceContextOverflow(
-      messages,
+      basisMessages,
       {
         providerName: args.providerName,
         systemPrompt: args.systemPrompt,
@@ -97,7 +102,7 @@ export const defaultOverflowReduceMiddleware: Middleware<
     // Let the orchestrator apply compaction side effects (circuit-breaker
     // tracking, event emission, ctx mutation) before we re-inject.
     if (step.compactionResult) {
-      await args.onCompactionResult(step.compactionResult);
+      await args.onCompactionResult(step.compactionResult, basisMessages);
       if (stepCompacted) {
         reducerCompacted = true;
       }

package/src/plugins/defaults/token-estimate.ts

@@ -17,9 +17,8 @@
  * {@link import("../../context/token-estimator.js").estimatePromptTokens estimatePromptTokens},
  * which applies the EWMA calibration correction recorded from past provider
  * responses. Preflight + mid-loop checks must use the calibrated estimate —
- * before this pipeline existed, both call sites invoked `estimatePromptTokens`
- * directly, and the calibrated estimate is what keeps the overflow gate
- * consistent with the convergence path in the reducer. The pre-send
+ * the calibrated value keeps the overflow gate consistent with the
+ * convergence path in the reducer. The pre-send
  * calibration capture in `agent/loop.ts` still uses `estimatePromptTokensRaw`
  * on purpose — the calibrator must learn against the raw estimate so the EWMA
  * converges against provider ground truth rather than chasing its own