@vellumai/assistant 0.8.4 → 0.8.6

package/src/oauth/manual-token-connection.ts

@@ -10,6 +10,7 @@
 
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyResultAsync } from "../security/secure-keys.js";
+import { getTelegramBotUsername } from "../telegram/bot-username.js";
 import { getLogger } from "../util/logger.js";
 import {
   createConnection,
@@ -24,6 +25,44 @@ const log = getLogger("manual-token-connection");
 /** Sentinel client_id used for non-OAuth providers that don't have a real app. */
 const MANUAL_TOKEN_CLIENT_ID = "manual-config";
 
+type ResolvedAccountInfoSource = "provided" | "derived" | "none";
+
+interface ResolvedAccountInfo {
+  value?: string;
+  source: ResolvedAccountInfoSource;
+}
+
+function resolveManualTokenAccountInfo(
+  provider: string,
+  accountInfo?: string,
+): ResolvedAccountInfo {
+  if (accountInfo !== undefined) {
+    return { value: accountInfo, source: "provided" };
+  }
+
+  if (provider === "telegram") {
+    const botUsername = getTelegramBotUsername();
+    if (!botUsername) return { source: "none" };
+    return {
+      value: botUsername.startsWith("@") ? botUsername : `@${botUsername}`,
+      source: "derived",
+    };
+  }
+
+  return { source: "none" };
+}
+
+function accountInfoForManualTokenSync(
+  provider: string,
+  resolved: ResolvedAccountInfo,
+): string | undefined {
+  if (resolved.source !== "derived") return resolved.value;
+
+  const existing = getConnectionByProvider(provider);
+  if (existing?.accountInfo) return undefined;
+  return resolved.value;
+}
+
 /**
  * Ensure an active oauth_connection row exists for the given manual-token
  * provider. Creates the synthetic oauth_app row on first use.
@@ -79,6 +118,15 @@ export async function syncManualTokenConnection(
   provider: string,
   accountInfo?: string,
 ): Promise<void> {
+  const resolvedAccountInfo = resolveManualTokenAccountInfo(
+    provider,
+    accountInfo,
+  );
+  const accountInfoToStore = accountInfoForManualTokenSync(
+    provider,
+    resolvedAccountInfo,
+  );
+
   switch (provider) {
     case "telegram": {
       const botTokenResult = await getSecureKeyResultAsync(
@@ -94,7 +142,7 @@ export async function syncManualTokenConnection(
         return;
       }
       if (botTokenResult.value && webhookSecretResult.value) {
-        await ensureManualTokenConnection(provider, accountInfo);
+        await ensureManualTokenConnection(provider, accountInfoToStore);
       } else {
         removeManualTokenConnection(provider);
       }
@@ -115,7 +163,7 @@ export async function syncManualTokenConnection(
         return;
       }
       if (botTokenResult.value && appTokenResult.value) {
-        await ensureManualTokenConnection(provider, accountInfo);
+        await ensureManualTokenConnection(provider, accountInfoToStore);
       } else {
         removeManualTokenConnection(provider);
       }
@@ -133,7 +181,7 @@ export async function syncManualTokenConnection(
         return;
       }
       if (tokenResult.value) {
-        await ensureManualTokenConnection(provider, accountInfo);
+        await ensureManualTokenConnection(provider, accountInfoToStore);
       } else {
         removeManualTokenConnection(provider);
       }

package/src/oauth/seed-providers.ts

@@ -199,6 +199,9 @@ export const PROVIDER_SEED_DATA: Record<
       },
     ],
     appType: "Public integration",
+    setupNotes: [
+      "Enable Token Rotation on your Notion integration (developer dashboard → your integration → Configuration → Token rotation). Without it, Notion does not issue a refresh token and the connection cannot auto-recover if Notion revokes the access token server-side — you will silently lose access and need to reconnect manually.",
+    ],
     identityUrl: "https://api.notion.com/v1/users/me",
     identityHeaders: { "Notion-Version": "2022-06-28" },
     identityResponsePaths: ["name", "person.email"],

package/src/permissions/approval-policy.test.ts

@@ -334,6 +334,19 @@ describe("no rule — third-party skill tool", () => {
     expect(result.reason).toContain("Skill tool");
   });
 
+  test("plugin origin → treated as extension-owned (prompt at strict threshold)", () => {
+    // Plugins join skills in the "extension-owned" bucket — both prompt by
+    // default. `isSkillBundled` is irrelevant for plugins (always false).
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "custom_plugin_tool",
+      toolOrigin: "plugin",
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("Skill tool");
+  });
+
   test("no tool origin but hasManifestOverride, strict threshold → prompt (unregistered skill tool)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
@@ -699,16 +712,17 @@ describe("edge cases", () => {
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("hasManifestOverride with toolOrigin set to builtin — falls through (not a skill)", () => {
+  test("hasManifestOverride with toolOrigin=mcp — falls through (not extension-owned)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "manifest_tool",
-      toolOrigin: "builtin",
+      toolOrigin: "mcp",
       hasManifestOverride: true,
     });
-    // toolOrigin is "builtin", so the third-party skill check doesn't trigger.
-    // The hasManifestOverride check requires !toolOrigin, but toolOrigin is set.
-    // Falls through to risk-based: Low → allow (within default "low" threshold).
+    // toolOrigin is "mcp", which is not extension-class (skill/plugin), so
+    // the third-party skill check doesn't trigger. The hasManifestOverride
+    // sub-check requires !toolOrigin, but toolOrigin is set. Falls through
+    // to risk-based: Low → allow (within default "low" threshold).
     expect(result.decision).toBe("allow");
     expect(result.reason).toContain("low risk");
   });

package/src/permissions/approval-policy.ts

@@ -1,3 +1,4 @@
+import type { OwnerKind } from "../tools/types.js";
 import type { TrustRule } from "./types.js";
 import { RiskLevel } from "./types.js";
 
@@ -13,8 +14,13 @@ export interface ApprovalContext {
   matchedRule?: TrustRule;
   isContainerized: boolean;
   isWorkspaceScoped: boolean;
-  /** Where the tool originates from — "skill" for skill-provided tools, "builtin" for core tools. */
-  toolOrigin?: "skill" | "builtin";
+  /**
+   * Owner kind of the tool, as recorded by the tool registry — "skill" /
+   * "plugin" / "mcp" for extension-owned tools, `undefined` for core tools
+   * (and for tools that aren't registered, e.g. unregistered skill tools
+   * matched only via `hasManifestOverride`).
+   */
+  toolOrigin?: OwnerKind;
   /** Whether the tool's owning skill is a first-party bundled skill. */
   isSkillBundled?: boolean;
   /** Whether the tool has a manifest override (unregistered skill tool). */
@@ -173,8 +179,13 @@ export class DefaultApprovalPolicy implements ApprovalPolicy {
 
     // ── 6. No rule + third-party skill tool → prompt (unless threshold covers it)
     if (!matchedRule) {
+      // Plugin- and skill-owned tools are both treated as extension-class
+      // for approval purposes: external by default, prompt unless bundled.
+      // MCP-owned tools fall through to the core risk-based path.
+      const isExtensionOwned =
+        toolOrigin === "skill" || toolOrigin === "plugin";
       const isThirdPartySkill =
-        (toolOrigin === "skill" && !isSkillBundled) ||
+        (isExtensionOwned && !isSkillBundled) ||
         (hasManifestOverride && !toolOrigin);
       if (isThirdPartySkill) {
         if (isRiskWithinThreshold(riskLevel, context.autoApproveUpTo)) {

package/src/permissions/checker.ts

@@ -15,7 +15,8 @@ import {
   looksLikeHostPortShorthand,
   looksLikePathOnlyInput,
 } from "../tools/network/url-safety.js";
-import { getTool } from "../tools/registry.js";
+import { getTool, getToolOwner } from "../tools/registry.js";
+import type { Tool } from "../tools/types.js";
 import {
   getDeprecatedDir,
   getProtectedDir,
@@ -150,6 +151,23 @@ function resolveSkillIdAndHash(
   }
 }
 
+/**
+ * Resolve whether the skill that owns this tool is bundled (first-party).
+ * Returns false when the tool has no owning skill or the skill is not in
+ * the catalog. Derived from `loadSkillCatalog()` at check time so the
+ * answer reflects current catalog truth (managed overrides flip the bit
+ * without needing to re-register tools). Owner is looked up from the tool
+ * registry (`getToolOwner(name)`) rather than read from the `Tool` object,
+ * since ownership lives on the registry, not on the tool itself.
+ */
+function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
+  if (!tool) return false;
+  const owner = getToolOwner(tool.name);
+  if (owner?.kind !== "skill") return false;
+  const skill = loadSkillCatalog().find((s) => s.id === owner.id);
+  return skill?.bundled ?? false;
+}
+
 /**
  * Check whether a skill (by id) has parsed inline command expansions.
  * Returns false when the skill is not found in the catalog.
@@ -529,13 +547,8 @@ export async function check(
       risk === RiskLevel.Low
         ? isWorkspaceScopedInvocation(toolName, input, workingDir)
         : false,
-    toolOrigin:
-      tool?.origin === "skill" || tool?.origin === "plugin"
-        ? "skill"
-        : tool
-          ? "builtin"
-          : undefined,
-    isSkillBundled: tool?.ownerSkillBundled ?? false,
+    toolOrigin: getToolOwner(toolName)?.kind,
+    isSkillBundled: isToolOwnerSkillBundled(tool),
     hasManifestOverride: !!manifestOverride,
     autoApproveUpTo: threshold,
     hasSandboxAutoApprove,

package/src/permissions/prompter.ts

@@ -79,7 +79,7 @@ export class PermissionPrompter {
       const timeoutMs = getConfig().timeouts.permissionTimeoutSec * 1000;
 
       const timer = setTimeout(() => {
-        const interaction = pendingInteractions.resolve(requestId);
+        const interaction = pendingInteractions.resolve(requestId, "cancelled");
         this.ownedIds.delete(requestId);
         log.warn(
           { requestId, toolName },
@@ -130,7 +130,7 @@ export class PermissionPrompter {
       if (signal) {
         const onAbort = () => {
           if (this.ownedIds.has(requestId)) {
-            pendingInteractions.resolve(requestId);
+            pendingInteractions.resolve(requestId, "cancelled");
             this.ownedIds.delete(requestId);
             resolve({ decision: "deny", wasAbort: true });
           }
@@ -232,7 +232,7 @@ export class PermissionPrompter {
 
   dispose(): void {
     for (const requestId of [...this.ownedIds]) {
-      const interaction = pendingInteractions.resolve(requestId);
+      const interaction = pendingInteractions.resolve(requestId, "cancelled");
       this.ownedIds.delete(requestId);
       interaction?.rpcReject?.(
         new AssistantError("Prompter disposed", ErrorCode.INTERNAL_ERROR),

package/src/permissions/question-prompter.ts

@@ -223,8 +223,11 @@ export class QuestionPrompter {
           signal.removeEventListener("abort", onAbort);
         }
         // Idempotent: a no-op if the entry was already removed (e.g. by
-        // `removeByConversation`) or by an earlier path.
-        pendingInteractions.resolve(requestId);
+        // `removeByConversation`) or by an earlier path. The route's
+        // success path resolves with "answered" before invoking rpcResolve,
+        // so this fallback only fires for timeout / abort / removeByConversation —
+        // all cancellation-shaped outcomes.
+        pendingInteractions.resolve(requestId, "cancelled");
         fn();
       };
 

package/src/permissions/secret-prompter.ts

@@ -71,7 +71,7 @@ export class SecretPrompter {
       const timeoutMs = getConfig().timeouts.permissionTimeoutSec * 1000;
 
       const timer = setTimeout(() => {
-        pendingInteractions.resolve(requestId);
+        pendingInteractions.resolve(requestId, "cancelled");
         this.ownedIds.delete(requestId);
         log.warn({ requestId, service, field }, "Secret prompt timed out");
         resolve({ value: null, delivery: "store" });
@@ -142,7 +142,7 @@ export class SecretPrompter {
 
   dispose(): void {
     for (const requestId of [...this.ownedIds]) {
-      const interaction = pendingInteractions.resolve(requestId);
+      const interaction = pendingInteractions.resolve(requestId, "cancelled");
       this.ownedIds.delete(requestId);
       interaction?.rpcReject?.(
         new AssistantError("Prompter disposed", ErrorCode.INTERNAL_ERROR),

package/src/platform/client.test.ts

@@ -10,6 +10,7 @@ let mockManagedProxyCtx = {
   assistantApiKey: "",
 };
 let mockAssistantId = "";
+let mockSecureKeys: Record<string, string | null | undefined> = {};
 
 // ---------------------------------------------------------------------------
 // Module mocks
@@ -26,7 +27,7 @@ mock.module("../config/env.js", () => ({
 // Stub the credential-store fallback so tests stay hermetic and do not
 // read real values from the host credential backend.
 mock.module("../security/secure-keys.js", () => ({
-  getSecureKeyAsync: async () => null,
+  getSecureKeyAsync: async (key: string) => mockSecureKeys[key] ?? null,
 }));
 
 mock.module("../security/credential-key.js", () => ({
@@ -54,6 +55,7 @@ describe("VellumPlatformClient", () => {
       assistantApiKey: "sk-test-key",
     };
     mockAssistantId = "asst-123";
+    mockSecureKeys = {};
   });
 
   afterEach(() => {
@@ -94,6 +96,27 @@ describe("VellumPlatformClient", () => {
       const client = await VellumPlatformClient.create();
       expect(client!.baseUrl).toBe("https://platform.example.com");
     });
+
+    test("falls back to credential store values when managed context is not rehydrated", async () => {
+      mockManagedProxyCtx = {
+        enabled: false,
+        platformBaseUrl: "",
+        assistantApiKey: "",
+      };
+      mockAssistantId = "";
+      mockSecureKeys = {
+        "vellum:platform_base_url": "https://stored-platform.example.com/",
+        "vellum:assistant_api_key": "stored-api-key",
+        "vellum:platform_assistant_id": " stored-assistant-id ",
+      };
+
+      const client = await VellumPlatformClient.create();
+
+      expect(client).not.toBeNull();
+      expect(client!.baseUrl).toBe("https://stored-platform.example.com");
+      expect(client!.assistantApiKey).toBe("stored-api-key");
+      expect(client!.platformAssistantId).toBe("stored-assistant-id");
+    });
   });
 
   describe("fetch()", () => {

package/src/platform/client.ts

@@ -10,6 +10,7 @@ import { resolveManagedProxyContext } from "../providers/platform-proxy/context.
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
+import { arePlatformFeaturesEnabled } from "./feature-gate.js";
 
 const log = getLogger("platform-client");
 
@@ -43,6 +44,13 @@ export class VellumPlatformClient {
    * should check `platformAssistantId` themselves.
    */
   static async create(): Promise<VellumPlatformClient | null> {
+    if (!arePlatformFeaturesEnabled()) {
+      log.debug(
+        "platform-features-in-local-mode is disabled — returning null",
+      );
+      return null;
+    }
+
     const ctx = await resolveManagedProxyContext();
 
     let baseUrl = ctx.enabled ? ctx.platformBaseUrl : "";

package/src/platform/feature-gate.ts

@@ -0,0 +1,15 @@
+import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
+import { getIsPlatform } from "../config/env-registry.js";
+import type { AssistantConfig } from "../config/schema.js";
+
+const FLAG_KEY = "platform-features-in-local-mode" as const;
+
+export function arePlatformFeaturesEnabled(
+  config?: AssistantConfig,
+): boolean {
+  if (getIsPlatform()) return true;
+  return isAssistantFeatureFlagEnabled(
+    FLAG_KEY,
+    (config ?? {}) as AssistantConfig,
+  );
+}

package/src/plugin-api/index.ts

@@ -25,6 +25,8 @@
  * - {@link UserPromptSubmitContext} — passed to `user-prompt-submit` hook,
  *   fired immediately before the agent loop receives a user's prompt
  * - {@link PluginLogger} — pino-compatible logger shape on the contexts
+ * - {@link ToolDefinition} — author-facing tool spec (default-export shape
+ *   for both plugin tool files and workspace tool files)
  * - {@link ToolContext} — passed to a plugin tool's `execute` method
  * - {@link ToolExecutionResult} — return shape of a plugin tool's `execute`
  *
@@ -41,6 +43,8 @@ export type {
   PluginLogger,
   PluginShutdownContext,
   ToolContext,
+  ToolDefinition,
   ToolExecutionResult,
   UserPromptSubmitContext,
 } from "./types.js";
+export { RiskLevel } from "./types.js";

package/src/plugin-api/types.ts

@@ -1,43 +1,17 @@
 /**
- * Public plugin-API types.
- *
- * This module is the entry point plugin authors land on when they import
- * from `@vellumai/plugin-api`. The shapes here are the canonical public
- * contract — anything exported is part of the surface that semver gates.
- *
- * ## Tool-execution types
- *
- * `ToolContext` and `ToolExecutionResult` are re-exports of the narrow,
- * stable bases defined alongside their daemon-internal counterparts in
- * `assistant/src/tools/types.ts`. The daemon-internal `ToolContext` /
- * `ToolExecutionResult` (with CES, trust classification, lifecycle
- * events, sensitive-output bindings, risk metadata, etc.) `extends`
- * the public bases, so the runtime can hand plugins the full value
- * without a manual cast and tsc enforces the structural relationship.
- * Plugin tools see the narrow surface only — they MUST NOT set fields
- * that belong to the daemon-internal extension.
- *
- * ## Hook contexts
- *
- * The init / shutdown hook contexts are owned by this module directly.
- * They have no daemon-internal extension today (the daemon constructs
- * and hands them straight through), so there's nothing to inherit from.
- *
- * ## Compatibility
- *
- * Adding fields to any public shape is non-breaking. Renaming or
- * removing fields is breaking and gated on a major bump of
- * `@vellumai/plugin-api`.
+ * Public plugin-API types — the canonical contract for
+ * `@vellumai/plugin-api`. Adding fields is non-breaking; renaming /
+ * removing is breaking and gated on a major bump.
  */
 
 import type { Message } from "../providers/types.js";
 
-// ─── Tool-execution types (re-exported from daemon source-of-truth) ──────────
-
 export type {
-  PluginToolContext as ToolContext,
-  PluginToolExecutionResult as ToolExecutionResult,
+  ToolContext,
+  ToolDefinition,
+  ToolExecutionResult,
 } from "../tools/types.js";
+export { RiskLevel } from "../tools/types.js";
 
 // ─── Logger ──────────────────────────────────────────────────────────────────
 

package/src/plugins/defaults/index.ts

@@ -24,6 +24,7 @@
  * chain) does not trip a TDZ.
  */
 
+import { memoryV3ShadowPlugin } from "../../memory/v3/shadow-middleware.js";
 import { registerPlugin, resetPluginRegistryForTests } from "../registry.js";
 import { type Plugin, PluginExecutionError } from "../types.js";
 import { defaultCircuitBreakerPlugin } from "./circuit-breaker.js";
@@ -60,6 +61,11 @@ function getAllDefaultPlugins(): readonly Plugin[] {
     defaultEmptyResponsePlugin,
     defaultToolErrorPlugin,
     defaultMemoryRetrievalPlugin,
+    // Live-shadow v3 retrieval. Always registered; inert unless both
+    // `memory.v3.enabled` and `memory.v3.shadow` are on (gated inside the
+    // middleware). Ordered after the default so the default terminal still
+    // produces the injected (v2) `MemoryResult`.
+    memoryV3ShadowPlugin,
     defaultInjectorsPlugin,
     defaultTokenEstimatePlugin,
     defaultOverflowReducePlugin,

package/src/plugins/defaults/injectors.ts

@@ -48,7 +48,6 @@
 
 import { resolve } from "node:path";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfig } from "../../config/loader.js";
 import { getInContextPkbPaths } from "../../daemon/pkb-context-tracker.js";
 import { buildPkbReminder } from "../../daemon/pkb-reminder-builder.js";
@@ -107,24 +106,19 @@ function readInjectionInputs(ctx: TurnContext): TurnInjectionInputs {
 }
 
 export const DISK_PRESSURE_WARNING_PROMPT = `<disk_pressure_warning>
-Disk usage is critically low: this assistant is in storage cleanup mode because the workspace volume is at least 95% full.
+Disk usage is critically low: this assistant is in storage cleanup mode because the workspace volume is critically full.
 
 In your first paragraph, warn the user that storage is critically low and that normal work is suspended until space is freed.
 
 Then help the user clean up storage. Prefer safe inspection steps first, such as checking available space and finding large directories. Ask before deleting files or caches unless the user has already clearly approved the specific cleanup action.
 
-Do not work on unrelated tasks until disk usage drops below the critical threshold or the user explicitly overrides the lock. Background processes and messages from trusted contacts are blocked while this cleanup mode is active.
+Do not work on unrelated tasks until enough space is freed to clear the lock or the user explicitly overrides it. Background processes and messages from trusted contacts are blocked while this cleanup mode is active.
 </disk_pressure_warning>`;
 
-function isSafeStorageLimitsEnabled(): boolean {
-  return isAssistantFeatureFlagEnabled("safe-storage-limits", getConfig());
-}
-
 const diskPressureWarningInjector: Injector = {
   name: "disk-pressure-warning",
   order: DEFAULT_INJECTOR_ORDER.diskPressureWarning,
   async produce(ctx: TurnContext): Promise<InjectionBlock | null> {
-    if (!isSafeStorageLimitsEnabled()) return null;
     const inputs = readInjectionInputs(ctx);
     if (!inputs.diskPressureContext?.cleanupModeActive) return null;
     return {
@@ -387,17 +381,20 @@ async function buildPkbReminderWithHints(
  * `memory-v2-static` injector — order 38, after-memory-prefix.
  *
  * Injects the v2 static memory block (essentials/threads/recent/buffer
- * concatenated under markdown headings) wrapped in `<memory>...</memory>`
+ * concatenated under markdown headings) wrapped in `<info>...</info>`
  * onto the user message. The agent loop only forwards `memoryV2Static` on
  * full-mode turns (first turn / post-compaction), mirroring the PKB
  * auto-inject cadence — subsequent turns get `null` and the prior block
  * stays cached on its original user message.
  *
- * Sits between `pkb-reminder` (35) and `now-md` (40) so the rendered order
- * after the memory prefix is `[pkb-reminder, pkb-context, memory-v2-static,
- * now-md, ...user text]` when every PKB injector also fires (transitional
- * state). Once PKB is fully retired under v2 this is the only block
- * adjacent to the memory prefix.
+ * Sits between `pkb-reminder` (35) and `now-md` (40). Because every
+ * after-memory-prefix splice lands at the memory-prefix boundary in
+ * ascending `order`, higher-order blocks end up closer to the memory
+ * prefix. The rendered layout is therefore `[<memory>dynamic</memory>,
+ * <info>memory-v2-static</info>, <NOW.md>, <system_reminder>,
+ * <knowledge_base>, ...user text]` when every PKB injector also fires.
+ * `countMemoryPrefixBlocks` treats the `<info>` static block as part of
+ * the memory prefix so `now-md` (40) splices after it.
  *
  * Gating:
  *  - `mode === "full"`.
@@ -420,14 +417,18 @@ const memoryV2StaticInjector: Injector = {
   },
 };
 
+const INFO_CLOSE_TAG_RE = /<\/info\s*>/gi;
+
 /**
- * Wrap the static memory content in `<memory>...</memory>`. Escapes any
- * closing `</memory>` inside the content so authored memory files cannot
- * accidentally break out of the wrapper.
+ * Wrap the static memory content in `<info>...</info>`. Escapes any
+ * closing `</info>` inside the content so authored memory files cannot
+ * accidentally break out of the wrapper. Distinct from the dynamic
+ * activation block (which uses `<memory>...</memory>`) so downstream
+ * logic can address the two differently.
  */
 function buildMemoryV2StaticBlock(content: string): string {
-  const escaped = content.replace(/<\/memory\s*>/gi, "&lt;/memory&gt;");
-  return `<memory>\n${escaped}\n</memory>`;
+  const escaped = content.replace(INFO_CLOSE_TAG_RE, "&lt;/info&gt;");
+  return `<info>\n${escaped}\n</info>`;
 }
 
 /**

package/src/plugins/defaults/persistence.ts

@@ -15,12 +15,17 @@
  *
  * The terminal dispatches on the discriminated {@link PersistArgs.op} field:
  *
- * - `add`    → {@link addMessage}, optionally followed by
- *              {@link syncMessageToDisk} when `args.syncToDisk` is true.
- * - `update` → {@link updateMessageMetadata} (returns `void`, wrapped as
- *              `{ op: "update" }`).
- * - `delete` → {@link deleteMessageById} (returns the segment/summary IDs
- *              the caller must clean up out-of-band).
+ * - `add`           → {@link addMessage}, optionally followed by
+ *                     {@link syncMessageToDisk} when `args.syncToDisk` is true.
+ * - `reserve`       → {@link reserveMessage} — pre-allocates an empty row
+ *                     for assistant anchor stamping.
+ * - `updateContent` → {@link updateMessageContent} — overwrites an existing
+ *                     row's content (returns `void`, wrapped as
+ *                     `{ op: "updateContent" }`).
+ * - `update`        → {@link updateMessageMetadata} (returns `void`, wrapped
+ *                     as `{ op: "update" }`).
+ * - `delete`        → {@link deleteMessageById} (returns the segment/summary
+ *                     IDs the caller must clean up out-of-band).
  *
  * Manifest declares `provides.persistence: "v1"` so other plugins can
  * negotiate against the pipeline surface and `requires.pluginRuntime: "v1"`
@@ -36,6 +41,8 @@
 import {
   addMessage,
   deleteMessageById,
+  reserveMessage,
+  updateMessageContent,
   updateMessageMetadata,
 } from "../../memory/conversation-crud.js";
 import { syncMessageToDisk } from "../../memory/conversation-disk-view.js";
@@ -74,6 +81,18 @@ export async function defaultPersistenceTerminal(
       }
       return { op: "add", message };
     }
+    case "reserve": {
+      const message = await reserveMessage(
+        args.conversationId,
+        args.role,
+        args.metadata,
+      );
+      return { op: "reserve", message };
+    }
+    case "updateContent": {
+      updateMessageContent(args.messageId, args.content);
+      return { op: "updateContent" };
+    }
     case "update": {
       updateMessageMetadata(args.messageId, args.updates);
       return { op: "update" };