@vellumai/assistant 0.8.7 → 0.8.8-dev.202606052332.17fc8ea

package/src/daemon/orphan-reaper.ts

@@ -0,0 +1,240 @@
+/**
+ * Periodic reaper for orphaned subprocesses that reparent to the daemon.
+ *
+ * Tools run commands in their own process group (`detached: true`) and, on
+ * timeout/abort, group-kill with `process.kill(-pgid, SIGKILL)` (the bash and
+ * host_bash tools, the skill sandbox runner, and the debug-bash route). The
+ * immediate child is reaped by Bun/libuv, but its descendants — e.g. git's
+ * transport helpers or a skill runner's `bun` process — were never spawned by
+ * the daemon, so when the group dies they reparent to PID 1. When the daemon
+ * runs as PID 1 in a container, Bun is not an init: it never calls `waitpid()`
+ * on those reparented orphans, so they accumulate as `<defunct>` entries that
+ * consume PID slots until the container is recycled.
+ *
+ * This reaper scans `/proc` for zombie children of the daemon and reaps each
+ * by **specific PID** with `WNOHANG`. It deliberately does NOT use
+ * `waitpid(-1)`: libuv reaps the children it spawned by specific PID on
+ * `SIGCHLD`, and a blanket `waitpid(-1)` would race libuv and could swallow a
+ * tracked child's exit status — libuv's own source handles the lost race by
+ * dropping the exit callback ("someone else stole the waitpid from us. Handle
+ * this by not handling it at all."). To stay clear of that race we only reap a
+ * zombie after it has survived at least one scan interval: libuv reaps its own
+ * within milliseconds of `SIGCHLD`, so anything still defunct a full interval
+ * later is a genuine orphan libuv is not tracking.
+ *
+ * The reaper is a no-op unless the daemon is PID 1 on Linux. Off PID 1 (local
+ * macOS dev, or if an init such as tini is ever placed above the daemon),
+ * orphans reparent to that init and are reaped there, so there is nothing for
+ * this to do. Because the daemon is PID 1, orphans already reparent to it and
+ * `PR_SET_CHILD_SUBREAPER` is unnecessary. It is additionally gated behind the
+ * `daemon.reapOrphanedSubprocesses` config flag (default off) so the behavior
+ * can be enabled per workspace for validation before becoming the default.
+ *
+ * References:
+ * - libuv reaps its own children by pid on SIGCHLD (`uv__wait_children`):
+ *   https://github.com/nodejs/node/blob/main/deps/uv/src/unix/process.c
+ * - Subreaper reaping pattern for runtimes embedding libuv (specific-pid +
+ *   WNOHANG, never `waitpid(-1)`, grace window for libuv co-existence):
+ *   https://github.com/coopergwrenn/prctl-subreaper
+ * - waitpid(2): https://man7.org/linux/man-pages/man2/waitpid.2.html
+ */
+
+import { readdirSync, readFileSync } from "node:fs";
+import { dlopen, FFIType, ptr } from "bun:ffi";
+
+import { getConfigReadOnly } from "../config/loader.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("orphan-reaper");
+
+/** Linux `WNOHANG` — return immediately if no child has changed state. */
+const WNOHANG = 1;
+
+const SCAN_INTERVAL_MS = 60_000;
+
+let scanTimer: ReturnType<typeof setInterval> | null = null;
+
+/** Zombie child PIDs observed on the previous scan (the grace set). */
+let seenLastScan: Set<number> = new Set();
+
+type WaitpidFn = (pid: number, statusPtr: unknown, options: number) => number;
+
+let waitpid: WaitpidFn | null = null;
+// Held at module scope so the backing buffer is not GC'd while `waitStatusPtr`
+// keeps only a raw pointer into it (waitpid writes the exit status here).
+let waitStatusBuf: Int32Array | null = null;
+let waitStatusPtr: unknown = null;
+
+/**
+ * Bind libc `waitpid` via FFI. Returns false (and disables the reaper) if FFI
+ * is unavailable so daemon startup never fails on this subsystem.
+ */
+function initWaitpid(): boolean {
+  if (waitpid) return true;
+  try {
+    const lib = dlopen("libc.so.6", {
+      waitpid: {
+        args: [FFIType.i32, FFIType.ptr, FFIType.i32],
+        returns: FFIType.i32,
+      },
+    });
+    // Reusable out-param buffer for the wstatus we don't inspect.
+    waitStatusBuf = new Int32Array(1);
+    waitStatusPtr = ptr(waitStatusBuf);
+    waitpid = lib.symbols.waitpid as unknown as WaitpidFn;
+    return true;
+  } catch (err) {
+    log.warn(
+      { err },
+      "Orphan reaper unavailable: failed to bind libc waitpid via FFI",
+    );
+    return false;
+  }
+}
+
+export interface ZombieChild {
+  pid: number;
+  comm: string;
+}
+
+/**
+ * Parse a `/proc/<pid>/stat` line into its leading fields. `comm` (the
+ * executable name) may itself contain spaces and parentheses, so the fixed
+ * fields are read relative to the final `)` rather than by naive splitting.
+ * Returns null if the line is malformed.
+ */
+export function parseProcStat(
+  content: string,
+): { comm: string; state: string; ppid: number } | null {
+  const lparen = content.indexOf("(");
+  const rparen = content.lastIndexOf(")");
+  if (lparen === -1 || rparen === -1 || rparen < lparen) return null;
+  const comm = content.slice(lparen + 1, rparen);
+  const rest = content.slice(rparen + 2).split(" ");
+  const state = rest[0];
+  const ppid = Number(rest[1]);
+  if (!state || !Number.isInteger(ppid)) return null;
+  return { comm, state, ppid };
+}
+
+/**
+ * Given the zombie child PIDs seen this scan and those seen on the previous
+ * scan, decide which to reap now. A zombie is only reaped once it has
+ * survived a full interval (present in `seenLast`), leaving newly-defunct
+ * children for libuv to reap first. Returns the PIDs to reap and the set to
+ * carry into the next scan.
+ */
+export function selectReapable(
+  current: number[],
+  seenLast: Set<number>,
+): { reap: number[]; nextSeen: Set<number> } {
+  const reap = current.filter((pid) => seenLast.has(pid));
+  return { reap, nextSeen: new Set(current) };
+}
+
+/**
+ * Scan `/proc` for zombie (`Z`) processes whose parent is this daemon.
+ * Reparented orphans keep their original process group but their parent
+ * becomes PID 1 (the daemon), so they appear here once defunct.
+ */
+function findZombieChildren(): ZombieChild[] {
+  const selfPid = process.pid;
+  const zombies: ZombieChild[] = [];
+  let entries: string[];
+  try {
+    entries = readdirSync("/proc");
+  } catch {
+    return zombies;
+  }
+  for (const entry of entries) {
+    const pid = Number(entry);
+    if (!Number.isInteger(pid) || pid <= 1) continue;
+    let stat: string;
+    try {
+      stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    } catch {
+      // Process exited between readdir and read — skip.
+      continue;
+    }
+    const parsed = parseProcStat(stat);
+    if (parsed && parsed.state === "Z" && parsed.ppid === selfPid) {
+      zombies.push({ pid, comm: parsed.comm });
+    }
+  }
+  return zombies;
+}
+
+/**
+ * Reap zombie children that have persisted for at least one scan interval,
+ * leaving newly-defunct children for libuv to reap first.
+ */
+function reapScan(): void {
+  if (!waitpid) return;
+  const zombies = findZombieChildren();
+  const byPid = new Map(zombies.map((z) => [z.pid, z]));
+  const { reap, nextSeen } = selectReapable([...byPid.keys()], seenLastScan);
+  const reaped: ZombieChild[] = [];
+  for (const pid of reap) {
+    const rc = waitpid(pid, waitStatusPtr, WNOHANG);
+    // rc > 0: reaped. rc <= 0 (0 = not yet, -1 = ECHILD/raced): leave it.
+    if (rc > 0) reaped.push(byPid.get(pid)!);
+  }
+  seenLastScan = nextSeen;
+  if (reaped.length > 0) {
+    log.info(
+      {
+        count: reaped.length,
+        pids: reaped.map((z) => z.pid),
+        comms: reaped.map((z) => z.comm),
+      },
+      "Reaped orphaned subprocesses reparented to the daemon (PID 1)",
+    );
+  }
+}
+
+/**
+ * Read the opt-in gate from workspace config (`daemon.reapOrphanedSubprocesses`),
+ * tolerating a missing or malformed config so startup never fails on it.
+ */
+function isReaperEnabled(): boolean {
+  try {
+    return getConfigReadOnly().daemon.reapOrphanedSubprocesses;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Start the periodic orphan reaper. No-op unless the daemon is PID 1 on Linux
+ * (otherwise reparented orphans are reaped by the real init) and the
+ * `daemon.reapOrphanedSubprocesses` config gate is enabled.
+ */
+export function startOrphanReaper(): void {
+  if (scanTimer) return;
+  if (process.platform !== "linux" || process.pid !== 1) {
+    log.info(
+      { platform: process.platform, pid: process.pid },
+      "Orphan reaper not started: daemon is not PID 1 on Linux",
+    );
+    return;
+  }
+  if (!isReaperEnabled()) {
+    log.info(
+      "Orphan reaper not started: daemon.reapOrphanedSubprocesses is disabled",
+    );
+    return;
+  }
+  if (!initWaitpid()) return;
+  seenLastScan = new Set();
+  scanTimer = setInterval(reapScan, SCAN_INTERVAL_MS);
+  scanTimer.unref?.();
+  log.info({ intervalMs: SCAN_INTERVAL_MS }, "Orphan reaper started");
+}
+
+export function stopOrphanReaper(): void {
+  if (scanTimer) {
+    clearInterval(scanTimer);
+    scanTimer = null;
+  }
+  seenLastScan = new Set();
+}

package/src/daemon/overflow-reduction-loop.ts

@@ -0,0 +1,230 @@
+import type { ContextWindowConfig } from "../config/schemas/inference.js";
+import type {
+  ContextWindowCompactOptions,
+  ContextWindowResult,
+} from "../context/window-manager.js";
+import type { Message } from "../providers/types.js";
+import {
+  createInitialReducerState,
+  reduceContextOverflow,
+  type ReducerState,
+} from "./context-overflow-reducer.js";
+import type { InjectionMode } from "./conversation-runtime-assembly.js";
+
+/**
+ * Input to the overflow-reduction loop. Captures everything the reducer
+ * tier loop needs, including the message history, reducer configuration,
+ * and side-effect callbacks that bridge the loop back to the orchestrator's
+ * mutable per-turn state (context-window manager, activity emitter, runtime
+ * injection reassembly, memory reinjection).
+ *
+ * The callbacks are supplied by the orchestrator because the reducer loop
+ * needs to coordinate with state that lives on the `AgentLoopConversationContext`
+ * (message mutation, compaction event emission, circuit breaker tracking,
+ * injection block reassembly). Keeping them as explicit callbacks keeps the
+ * loop free of any dependency on the agent-loop context object.
+ */
+export interface OverflowReduceArgs {
+  /** Bare persisted message history (the reducer applies results to a copy
+   *  of this array). */
+  readonly messages: Message[];
+  /** Current run-time message array with runtime injections applied. */
+  readonly runMessages: Message[];
+  /** System prompt used for post-step token estimation. */
+  readonly systemPrompt: string;
+  /** Provider name used for token estimation (calibration provider key). */
+  readonly providerName: string;
+  /** Context window config (drives compaction behavior). */
+  readonly contextWindow: ContextWindowConfig;
+  /** Token budget the reducer must get below (preflight budget). */
+  readonly preflightBudget: number;
+  /** Tool-token overhead included in every estimation call. */
+  readonly toolTokenBudget?: number;
+  /** Maximum reducer iterations before the loop exits unconditionally. */
+  readonly maxAttempts: number;
+  /** Abort signal threaded through compaction calls. */
+  readonly abortSignal?: AbortSignal;
+  /**
+   * Compaction callback — the loop never owns the ContextWindowManager
+   * instance. The orchestrator supplies this closure so the loop can
+   * delegate the forced-compaction tier without crossing the infra
+   * boundary on its own.
+   */
+  readonly compactFn: (
+    messages: Message[],
+    signal: AbortSignal | undefined,
+    options: unknown,
+  ) => Promise<ContextWindowResult>;
+  /**
+   * Invoked before each reducer iteration to emit the `context_compacting`
+   * activity state. The orchestrator owns activity emission because the
+   * signal is trust/channel aware.
+   */
+  readonly emitActivityState: () => void;
+  /**
+   * Invoked after each reducer step that produced a successful compaction.
+   * Handles circuit-breaker tracking, event emission, and context mutation.
+   */
+  readonly onCompactionResult: (
+    result: ContextWindowResult,
+    compactedBasis?: Message[],
+  ) => void | Promise<void>;
+  /**
+   * Invoked after each step to rebuild `runMessages` from the step's
+   * reduced history with the requested injection mode. The orchestrator
+   * owns this helper so the full per-turn injection options object doesn't
+   * leak into the loop. The current reduced messages array is passed
+   * explicitly so the orchestrator doesn't need to read mutable shared
+   * state. Returns the new `runMessages`.
+   *
+   * Two distinct "did compact" signals are passed so the orchestrator can
+   * apply the correct per-iteration vs sticky gating:
+   * - `stepCompacted` — whether THIS iteration's reducer step produced a
+   *   fresh compaction. Gates PKB / NOW re-injection: compaction strips the
+   *   existing blocks, so only iterations that just compacted need the
+   *   content re-threaded. Iterations that only truncated tool results or
+   *   downgraded injections must NOT force a re-injection or the token
+   *   count grows each round.
+   * - `accumulatedCompacted` — whether ANY iteration in this invocation has
+   *   compacted. Gates `slackChronologicalMessages` suppression: once
+   *   compaction has run, the captured Slack transcript snapshot would
+   *   overwrite the compacted history, so it must stay suppressed for every
+   *   subsequent iteration even if that iteration didn't re-compact.
+   */
+  readonly reinjectForMode: (
+    messages: Message[],
+    mode: InjectionMode,
+    stepCompacted: boolean,
+    accumulatedCompacted: boolean,
+  ) => Promise<Message[]>;
+  /**
+   * Invoked after each step to post-estimate the rebuilt `runMessages`.
+   * Pulled out so the orchestrator controls how estimation is performed
+   * (and which fields feed it) without the loop reimplementing it.
+   */
+  readonly estimatePostInjection: (runMessages: Message[]) => number;
+}
+
+/** Output of the overflow-reduction loop. */
+export interface OverflowReduceResult {
+  /** Final reduced `ctx.messages` value. */
+  readonly messages: Message[];
+  /** Final `runMessages` with re-applied runtime injections. */
+  readonly runMessages: Message[];
+  /** Final injection mode (may be `"minimal"` if the downgrade tier fired). */
+  readonly injectionMode: InjectionMode;
+  /** Accumulated reducer state at exit. */
+  readonly reducerState: ReducerState;
+  /** True if any step successfully compacted history. */
+  readonly reducerCompacted: boolean;
+  /** How many iterations of the tier loop executed. */
+  readonly attempts: number;
+}
+
+/**
+ * Run the context-overflow reducer tier loop — forced compaction, tool-result
+ * truncation, media stubbing, injection downgrade — plus the post-step
+ * re-injection / re-estimation convergence check.
+ *
+ * The forced-compaction tier is delegated through `args.compactFn`; the other
+ * tiers mutate the message array directly. After each step the orchestrator
+ * rebuilds `runMessages` via `args.reinjectForMode` and the loop re-estimates
+ * the post-injection token count, exiting once it fits the preflight budget,
+ * the reducer is exhausted, or `maxAttempts` is reached.
+ */
+export async function runOverflowReductionLoop(
+  args: OverflowReduceArgs,
+): Promise<OverflowReduceResult> {
+  let messages = args.messages;
+  let runMessages = args.runMessages;
+  let injectionMode: "full" | "minimal" = "full";
+  let reducerState: ReducerState = createInitialReducerState();
+  let reducerCompacted = false;
+  let attempts = 0;
+
+  while (attempts < args.maxAttempts && !reducerState.exhausted) {
+    // Abort check at the top of every iteration. When the caller aborts
+    // externally, this check lets us bail out BETWEEN iterations rather
+    // than letting another round of compaction / re-injection mutate
+    // `ctx.messages` after the turn has already failed. Individual
+    // `reduceContextOverflow` calls also honor the signal, but without this
+    // gate a fresh iteration could still start after the signal fires,
+    // since the previous one returned normally before the abort propagated.
+    args.abortSignal?.throwIfAborted();
+
+    attempts++;
+    args.emitActivityState();
+
+    const basisMessages = messages;
+    const step = await reduceContextOverflow(
+      basisMessages,
+      {
+        providerName: args.providerName,
+        systemPrompt: args.systemPrompt,
+        contextWindow: args.contextWindow,
+        targetTokens: args.preflightBudget,
+        toolTokenBudget: args.toolTokenBudget,
+      },
+      reducerState,
+      (msgs, signal, opts: ContextWindowCompactOptions) =>
+        args.compactFn(msgs, signal, opts),
+      args.abortSignal,
+    );
+
+    reducerState = step.state;
+    messages = step.messages;
+    injectionMode = step.state.injectionMode;
+
+    // Per-iteration compaction flag: whether THIS step just produced a
+    // fresh compaction. PKB / NOW re-injection is gated on this — see the
+    // reinjectForMode JSDoc for why the two signals differ.
+    const stepCompacted = step.compactionResult?.compacted === true;
+
+    // Let the orchestrator apply compaction side effects (circuit-breaker
+    // tracking, event emission, ctx mutation) before we re-inject.
+    if (step.compactionResult) {
+      await args.onCompactionResult(step.compactionResult, basisMessages);
+      if (stepCompacted) {
+        reducerCompacted = true;
+      }
+    }
+
+    // Second abort gate — if the side effects or the step itself took us
+    // past the deadline, don't rebuild runMessages or iterate again.
+    args.abortSignal?.throwIfAborted();
+
+    // Rebuild runMessages via the orchestrator-supplied helper (which
+    // re-runs `applyRuntimeInjections` with potentially downgraded mode
+    // and freshly re-hydrated PKB/NOW blocks after compaction). We pass
+    // the current reduced `messages` explicitly so the orchestrator never
+    // has to read from mutable shared state to rebuild runMessages — a
+    // tier that doesn't trigger compaction (tool-result truncation, media
+    // stubbing) won't update `ctx.messages` on its own.
+    //
+    // `stepCompacted` and `reducerCompacted` are both passed so the
+    // orchestrator can gate PKB / NOW re-injection per-iteration while
+    // keeping `slackChronologicalMessages` suppressed once any iteration
+    // has compacted.
+    runMessages = await args.reinjectForMode(
+      messages,
+      injectionMode,
+      stepCompacted,
+      reducerCompacted,
+    );
+
+    // Re-estimate with injections included — `step.estimatedTokens` was
+    // computed on bare history and doesn't account for tokens added by
+    // runtime injections.
+    const postInjectionTokens = args.estimatePostInjection(runMessages);
+    if (postInjectionTokens <= args.preflightBudget) break;
+  }
+
+  return {
+    messages,
+    runMessages,
+    injectionMode,
+    reducerState,
+    reducerCompacted,
+    attempts,
+  };
+}

package/src/daemon/persist-unsendable-image.ts

@@ -0,0 +1,117 @@
+/**
+ * Persistence for the image-too-large recovery path.
+ *
+ * When the provider rejects a turn because an attached image exceeds its
+ * limits, the agent loop downgrades the offending image blocks in memory and
+ * retries. That transformation is transient — the stored message row keeps the
+ * full-size image block, so the rejected image is rehydrated on every later
+ * turn and keeps re-entering the model's context. This module makes the
+ * downgrade durable for images that can *never* be transmitted, so a rejected
+ * upload cannot resurface after the user re-uploads a smaller version.
+ */
+
+import { optimizeImageForTransport } from "../agent/image-optimize.js";
+import { parseImageDimensions } from "../context/image-dimensions.js";
+import {
+  getMessages,
+  updateMessageContent,
+} from "../memory/conversation-crud.js";
+import type { ContentBlock } from "../providers/types.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("persist-unsendable-image");
+
+// Anthropic rejects any image whose longest side exceeds this many pixels,
+// regardless of payload size. Mirrors the user-facing message surfaced by
+// `classifyConversationError` for the IMAGE_TOO_LARGE code.
+// https://docs.anthropic.com/en/docs/build-with-claude/vision#image-size
+const PROVIDER_MAX_IMAGE_DIMENSION = 8000;
+
+// Anthropic rejects any single image whose base64 payload exceeds 5 MB.
+// https://docs.anthropic.com/en/docs/build-with-claude/vision#image-size
+const PROVIDER_MAX_IMAGE_PAYLOAD_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Note left in place of an image that cannot be sent to the provider. Shared
+ * with the in-memory recovery path so the persisted history matches what the
+ * model saw on the turn the image was rejected.
+ */
+export const UNSENDABLE_IMAGE_NOTE =
+  "(An image was attached but could not be sent — its dimensions exceed the provider limit and automatic resize was not available. Please resize the image and try again.)";
+
+/**
+ * True when a stored image block can never be transmitted to the provider: it
+ * violates a provider hard limit (per-side pixel cap or payload size) and
+ * cannot be shrunk to fit (re-optimization is a no-op).
+ *
+ * Stored blocks are already post-optimization, so a block that is still
+ * oversized here only stays oversized because resizing is unavailable on this
+ * host (e.g. `sips` is absent off macOS, or the format is unsupported). A
+ * downscalable image would have been reduced at upload time and would not reach
+ * this predicate, so it is left untouched.
+ */
+function isImagePermanentlyUnsendable(
+  block: Extract<ContentBlock, { type: "image" }>,
+): boolean {
+  const payloadBytes = block.source.data.length;
+  const dims = parseImageDimensions(block.source.data, block.source.media_type);
+  const exceedsDimensionCap =
+    dims != null &&
+    (dims.width > PROVIDER_MAX_IMAGE_DIMENSION ||
+      dims.height > PROVIDER_MAX_IMAGE_DIMENSION);
+  const exceedsPayloadCap = payloadBytes > PROVIDER_MAX_IMAGE_PAYLOAD_BYTES;
+  if (!exceedsDimensionCap && !exceedsPayloadCap) return false;
+
+  const optimized = optimizeImageForTransport(
+    block.source.data,
+    block.source.media_type,
+  );
+  return optimized.data === block.source.data;
+}
+
+/**
+ * Rewrite every stored message in a conversation that holds a permanently
+ * unsendable image, replacing those image blocks with {@link
+ * UNSENDABLE_IMAGE_NOTE}. Reads stored content directly (not the in-memory,
+ * injection-enriched copy) so injected prefixes and hydrated source paths are
+ * never written back.
+ *
+ * Idempotent: once an image is replaced by the note there is no image block
+ * left to match, so re-running is a no-op. Returns the number of rewritten
+ * messages.
+ */
+export function persistUnsendableImageDowngrades(
+  conversationId: string,
+): number {
+  let rewritten = 0;
+  for (const row of getMessages(conversationId)) {
+    // Cheap prefilter — JSON.stringify emits no spaces, so an image block
+    // always serializes with this exact substring.
+    if (!row.content.includes('"type":"image"')) continue;
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(row.content);
+    } catch {
+      continue;
+    }
+    if (!Array.isArray(parsed)) continue;
+
+    let changed = false;
+    const next = (parsed as ContentBlock[]).map((block): ContentBlock => {
+      if (block.type !== "image") return block;
+      if (!isImagePermanentlyUnsendable(block)) return block;
+      changed = true;
+      return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
+    });
+    if (!changed) continue;
+
+    updateMessageContent(row.id, JSON.stringify(next));
+    rewritten++;
+    log.info(
+      { conversationId, messageId: row.id },
+      "Persisted unsendable-image downgrade so it cannot resurface on later turns",
+    );
+  }
+  return rewritten;
+}

package/src/daemon/process-message.ts

@@ -437,9 +437,7 @@ export async function processMessage(
     conversation.getMessages().push(cleanMsg);
 
     conversation.emitActivityState("thinking", "context_compacting");
-    const result = await conversation.forceCompact({
-      targetInputTokensOverride: slashResult.targetInputTokensOverride,
-    });
+    const result = await conversation.forceCompact();
     const responseText = formatCompactResult(result);
     const assistantMsg = createAssistantMessage(responseText);
     const persistedAssistant = await addMessage(

package/src/daemon/server.ts

@@ -39,6 +39,8 @@ import {
   conversationEntries,
   deleteConversation,
   getConversationMap,
+} from "./conversation-registry.js";
+import {
   getOrCreateConversation as getOrCreateActiveConversation,
   initConversationLifecycle,
   setCesClientPromise,

package/src/daemon/trace-emitter.ts

@@ -1,14 +1,16 @@
 import { v4 as uuid } from "uuid";
 
+import type {
+  TraceEvent,
+  TraceEventKind,
+  TraceEventStatus,
+} from "../api/events/trace-event.js";
 import {
   getMaxSequence,
   persistTraceEvent,
 } from "../memory/trace-event-store.js";
 import { getLogger } from "../util/logger.js";
-import type { ServerMessage, TraceEventKind } from "./message-protocol.js";
-import type { TraceEvent } from "./message-types/messages.js";
-
-export type TraceEventStatus = "info" | "success" | "warning" | "error";
+import type { ServerMessage } from "./message-protocol.js";
 
 const log = getLogger("trace-emitter");
 

package/src/daemon/trust-context.ts

@@ -5,6 +5,8 @@
  * imports (memory/conversation-crud → daemon/conversation-runtime-assembly).
  */
 import type { ChannelId } from "../channels/types.js";
+import { isHttpAuthDisabled } from "../config/env.js";
+import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 
 export interface TrustContext {
   /** Channel through which the inbound message arrived. */
@@ -62,3 +64,20 @@ export const FALLBACK_TURN_TRUST: TrustContext = {
   sourceChannel: "vellum",
   trustClass: "unknown",
 };
+
+/**
+ * Resolve the effective trust class for an actor.
+ *
+ * When HTTP auth is disabled (dev bypass), always returns `'guardian'`
+ * so that control-plane gates don't block local development.
+ *
+ * When no trust context is available (e.g. desktop-only conversations that
+ * don't go through channel trust resolution), defaults to `'unknown'`
+ * to fail-closed.
+ */
+export function resolveTrustClass(
+  trustContext: TrustContext | undefined,
+): TrustClass {
+  if (isHttpAuthDisabled()) return "guardian";
+  return trustContext?.trustClass ?? "unknown";
+}

package/src/daemon/wake-target-adapter.ts

@@ -140,6 +140,8 @@ function translateAgentEventToServerMessage(
     case "context_compacting":
     case "compaction_circuit_open":
     case "compaction_circuit_closed":
+    case "compaction_completed":
+    case "history_stripped":
     case "agent_loop_exit":
       return null;
     case "llm_call_started":
@@ -192,7 +194,7 @@ export function conversationToWakeTarget(
     },
     isProcessing: () => conversation.isProcessing(),
     markProcessing: (on) => {
-      conversation.processing = on;
+      conversation.setProcessing(on);
     },
     setTrustContext: (ctx) => conversation.setTrustContext(ctx),
     setWakeAllowedTools: (tools) => {