@vellumai/assistant 0.8.8 → 0.8.9-dev.202606091926.ebb2d62

package/src/daemon/disk-pressure-policy.ts

@@ -51,7 +51,6 @@ const BACKGROUND_SOURCES = new Set([
   "heartbeat",
   "memory",
   "notification",
-  "proactive-artifact",
   "reminder",
   "schedule",
   "task",

package/src/daemon/external-plugins-bootstrap.ts

@@ -2,21 +2,22 @@
  * Plugin bootstrap — runs every registered plugin's `init()` hook once during
  * daemon startup.
  *
- * Plugins register themselves via side-effect imports elsewhere in the boot
- * sequence (first-party) or at runtime (hot-reload). By the time
- * {@link bootstrapPlugins} runs, the registry has been fully populated for
- * this boot cycle. This function:
+ * The registry is populated before this runs: first-party defaults are
+ * registered explicitly (step 1 below), user plugins are registered by the
+ * user-plugin loader from the workspace `plugins/` directory, and hot-reload
+ * registers at runtime. By the time {@link bootstrapPlugins} runs, the
+ * registry has been fully populated for this boot cycle. This function:
  *
  * 1. Registers the canonical first-party default plugins via
- *    {@link registerDefaultPlugins} (one per pipeline). Registration is
- *    idempotent so repeat calls (e.g. during integration tests) do not throw.
+ *    {@link registerDefaultPlugins}. Registration is idempotent so repeat
+ *    calls (e.g. during integration tests) do not throw.
  * 2. Walks {@link getRegisteredPlugins} in registration order.
  * 3. For each plugin, consults `manifest.requiresFlag` against
  *    {@link isAssistantFeatureFlagEnabled}. If any listed flag is disabled,
  *    the plugin is skipped wholesale — no `init()`, no tool/route/skill
  *    contributions, no entry in the shutdown hook, and the plugin is also
- *    dropped from the registry via {@link unregisterPlugin} so its middleware
- *    stops participating in pipeline runs. This is the primary mechanism for
+ *    dropped from the registry via {@link unregisterPlugin} so none of its
+ *    hooks participate in the turn lifecycle. This is the primary mechanism for
  *    shipping experimental plugins behind a feature flag.
  * 4. Resolves the plugin's `manifest.requiresCredential` entries via the
  *    credential store helper ({@link getSecureKeyAsync}). In Docker mode
@@ -36,14 +37,15 @@
  *    surface is already wired — useful for plugins that want to attach
  *    metadata, warm caches, or otherwise interact with their own
  *    contributions during initialization.
- * 8. Awaits `plugin.init(ctx)` sequentially. An init failure surfaces as a
- *    {@link PluginExecutionError} naming the offending plugin and aborts
- *    bootstrap — later plugins' `init()` never runs and the daemon fails
- *    startup cleanly rather than coming up in a half-wired state. The
- *    failing plugin's already-registered tools, routes, and skills are
- *    rolled back before the error propagates so the registry never
- *    carries state contributed by a plugin that never finished
- *    initializing.
+ * 8. Awaits `plugin.init(ctx)` sequentially. An init failure is contained to
+ *    the offending plugin: its already-registered tools, routes, and skills
+ *    are rolled back, it is dropped from the registry, the failure is logged,
+ *    and bootstrap continues with the remaining plugins. A single plugin's
+ *    failure never deregisters plugins that already initialized — in
+ *    particular the first-party defaults, which carry core turn behavior
+ *    (memory retrieval, history repair, title generation) — so the daemon
+ *    comes up with the failing plugin absent rather than blacking out the
+ *    whole plugin layer.
  *
  * A single shutdown hook is registered via
  * {@link registerShutdownHook} that walks the plugin list in **reverse
@@ -217,9 +219,10 @@ export async function initializePlugins(): Promise<void> {
  * Run every registered plugin's `init()` hook sequentially and install a
  * reverse-order shutdown hook. See the module docstring for full semantics.
  *
- * Returns once every plugin has finished initialising successfully. Throws a
- * {@link PluginExecutionError} on the first failure — the error message names
- * the offending plugin so operators see which `init()` bailed.
+ * Returns once every plugin has been processed. A plugin whose `init()` throws
+ * is rolled back, dropped from the registry, and logged; bootstrap continues
+ * with the rest, so one failing plugin never blocks the others — or the
+ * first-party defaults — from coming up.
  *
  * Must be called after any custom/third-party plugin registrations have run
  * and before the first conversation is served. First-party defaults are
@@ -258,36 +261,14 @@ export async function bootstrapPlugins(): Promise<void> {
   // onShutdown" invariant.
   const activePlugins: ActivePlugin[] = [];
 
-  // Tear down a plugin's contributions AND remove it from the registry. The
-  // two steps always move together on the bootstrap failure path: the former
-  // clears tools/routes/skills (so they stop appearing to the model/HTTP
-  // server), the latter drops the plugin's entry from the Map (so
-  // `getMiddlewaresFor` doesn't re-enter an uninitialized plugin on the next
-  // pipeline invocation).
   // Shutdown context is identical for every plugin in this boot — construct
-  // once and reuse across the bootstrap-failure rollback and the normal
-  // shutdown hook below. Only `assistantVersion` is exposed today; future
-  // additions live on {@link PluginShutdownContext}.
+  // once and reuse across the per-plugin teardown and the normal shutdown
+  // hook below. Only `assistantVersion` is exposed today; future additions
+  // live on {@link PluginShutdownContext}.
   const shutdownContext: PluginShutdownContext = {
     assistantVersion: APP_VERSION,
   };
 
-  async function rollbackPlugin(active: ActivePlugin): Promise<void> {
-    await teardownPlugin(active, "bootstrap-failed", shutdownContext);
-    unregisterPlugin(active.plugin.manifest.name);
-  }
-
-  // If one plugin's init or contribution phase throws, tear down any plugins
-  // that already fully initialized (in reverse registration order) before
-  // re-throwing. Without this, a mid-loop failure would leave earlier plugins
-  // with live tools/routes/skills and no `onShutdown()` call — the shutdown
-  // hook is only registered once the loop completes successfully.
-  async function teardownPartialInit(): Promise<void> {
-    for (let i = activePlugins.length - 1; i >= 0; i--) {
-      await rollbackPlugin(activePlugins[i]!);
-    }
-  }
-
   for (const plugin of plugins) {
     const name = plugin.manifest.name;
     const disabledFlag = getDisabledPluginFlag(plugin, assistantConfig);
@@ -303,9 +284,18 @@ export async function bootstrapPlugins(): Promise<void> {
     try {
       activePlugins.push(await initializePlugin(plugin, assistantConfig));
     } catch (err) {
+      // Contain the failure to this plugin. `initializePlugin` already rolled
+      // back its own partial tool/route/skill contributions, so we just drop
+      // it from the registry and move on. A single plugin's init failure must
+      // never deregister the plugins that already came up — above all the
+      // first-party defaults, which carry core turn behavior. The daemon stays
+      // reachable with the failing plugin absent rather than losing the whole
+      // plugin layer.
       unregisterPlugin(name);
-      await teardownPartialInit();
-      throw err;
+      log.warn(
+        { err, plugin: name },
+        `plugin ${name} failed to initialize — skipping (continuing with remaining plugins)`,
+      );
     }
   }
 

package/src/daemon/handlers/config-channels.ts

@@ -31,6 +31,7 @@ import {
 } from "../../runtime/channel-verification-service.js";
 import {
   cancelOutbound,
+  deliverVerificationEmail,
   deliverVerificationSlack,
   deliverVerificationTelegram,
   DESTINATION_RATE_WINDOW_MS,
@@ -555,7 +556,11 @@ export async function handleChannelVerificationSession(
           const { userId, text, assistantId: aid } = result._pendingSlackDm;
           deliverVerificationSlack(userId, text, aid);
         }
-        const { _pendingSlackDm: _, ...publicResult } = result;
+        if (result._pendingEmail) {
+          const { to, text, subject, assistantId: aid } = result._pendingEmail;
+          deliverVerificationEmail(to, text, subject, aid);
+        }
+        const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
         broadcastMessage({
           type: "channel_verification_session_response",
           ...publicResult,
@@ -600,7 +605,11 @@ export async function handleChannelVerificationSession(
         const { userId, text, assistantId: aid } = result._pendingSlackDm;
         deliverVerificationSlack(userId, text, aid);
       }
-      const { _pendingSlackDm: _, ...publicResult } = result;
+      if (result._pendingEmail) {
+        const { to, text, subject, assistantId: aid } = result._pendingEmail;
+        deliverVerificationEmail(to, text, subject, aid);
+      }
+      const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
       broadcastMessage({
         type: "channel_verification_session_response",
         ...publicResult,

package/src/daemon/handlers/conversations.ts

@@ -8,9 +8,11 @@ import { createAbortReason } from "../../util/abort-reasons.js";
 import { truncate } from "../../util/truncate.js";
 import { regenerate } from "../conversation-history.js";
 import {
-  clearAllActiveConversations,
   conversationEntries,
   findConversation,
+} from "../conversation-registry.js";
+import {
+  clearAllActiveConversations,
   getOrCreateConversation,
   touchConversation,
 } from "../conversation-store.js";

package/src/daemon/handlers/shared.ts

@@ -428,7 +428,15 @@ export function renderHistoryContent(
       finalizeSegment();
       thinkingSegments.push(block.thinking);
       contentOrder.push(`thinking:${thinkingSegments.length - 1}`);
-      contentBlocks.push({ type: "thinking", thinking: block.thinking });
+      const thinkingBlock: Extract<
+        ConversationContentBlock,
+        { type: "thinking" }
+      > = { type: "thinking", thinking: block.thinking };
+      if (typeof block._startedAt === "number")
+        thinkingBlock.startedAt = block._startedAt;
+      if (typeof block._completedAt === "number")
+        thinkingBlock.completedAt = block._completedAt;
+      contentBlocks.push(thinkingBlock);
       continue;
     }
 

package/src/daemon/handlers/skills.ts

@@ -31,7 +31,10 @@ import {
   isTextMimeType as isTextMime,
   MAX_INLINE_TEXT_SIZE,
 } from "../../runtime/routes/workspace-utils.js";
-import { getCachedCatalogSync, getCatalog } from "../../skills/catalog-cache.js";
+import {
+  getCachedCatalogSync,
+  getCatalog,
+} from "../../skills/catalog-cache.js";
 import type { SkillFileEntry } from "../../skills/catalog-files.js";
 import {
   catalogSkillToSlim,

package/src/daemon/host-app-control-proxy.ts

@@ -12,11 +12,12 @@
  * translation on top.
  *
  * **Session lock.** Only one conversation may hold an active app-control
- * session at a time, and that session is bound to a specific target app.
+ * session at a time, and that session is bound to a specific target app
+ * on a specific client.
  * The lock is module-level (`activeAppControlSession`) because the session
  * targets the user's actual desktop application, which is a host-wide
  * resource. It is acquired optimistically when `app_control_start` is
- * dispatched (storing `(conversationId, app)`) so that the synchronous
+ * dispatched (storing `(conversationId, app, targetClientId)`) so that the synchronous
  * guard and the asynchronous host round-trip cannot race. A separate
  * `confirmedAppControlSession` tracks the last session the host reported
  * `running`; the rollback path on a failed `start` restores from the
@@ -32,7 +33,7 @@
  * user's medium-risk approval at start time is the consent boundary. All
  * other tools (observe / press / combo / sequence / type / click / drag)
  * require the calling conversation to own an active session targeting the
- * same `app`; otherwise the call is rejected before any host dispatch.
+ * same `app` and client; otherwise the call is rejected before any host dispatch.
  * This prevents prompt-injected tool calls from sending raw input to
  * arbitrary apps without the user having approved control of that
  * specific app.
@@ -78,9 +79,9 @@ const STUCK_REPEAT_THRESHOLD = 4;
 // ---------------------------------------------------------------------------
 
 /**
- * Active app-control session: the conversation that owns the lock and the
- * `app` it was approved against. Set on a successful `app_control_start`;
- * cleared by the owning proxy's `dispose()`.
+ * Active app-control session: the conversation that owns the lock, the
+ * `app` and client it was approved against. Set on a successful
+ * `app_control_start`; cleared by the owning proxy's `dispose()`.
  */
 export interface ActiveAppControlSession {
   conversationId: string;
@@ -90,6 +91,11 @@ export interface ActiveAppControlSession {
    * the `app` of subsequent non-start tool calls.
    */
   app: string;
+  /**
+   * The client selected for `app_control_start`. Undefined when the start
+   * was untargeted; subsequent calls must match the same value.
+   */
+  targetClientId?: string;
   /**
    * Strictly monotonic counter assigned when the session is created (in
    * `request()` for a `start`). Used by {@link promoteStartIfCurrent} to
@@ -153,11 +159,13 @@ export function _resetActiveAppControlSession(): void {
 export function _setActiveAppControlSession(session: {
   conversationId: string;
   app: string;
+  targetClientId?: string;
   dispatchedAt?: number;
 }): void {
   const full: ActiveAppControlSession = {
     conversationId: session.conversationId,
     app: session.app,
+    targetClientId: session.targetClientId,
     dispatchedAt: session.dispatchedAt ?? nextDispatchedAt++,
   };
   activeAppControlSession = full;
@@ -177,6 +185,7 @@ export function _setActiveAppControlSession(session: {
 function checkNonStartAuthorization(
   input: HostAppControlInput,
   conversationId: string,
+  targetClientId: string | undefined,
 ): ToolExecutionResult | null {
   if (activeAppControlSession == null) {
     return {
@@ -219,6 +228,16 @@ function checkNonStartAuthorization(
       isError: true,
     };
   }
+  if (activeAppControlSession.targetClientId !== targetClientId) {
+    return {
+      content:
+        `Active app-control session targets client ` +
+        `${activeAppControlSession.targetClientId ?? "<default>"}; cannot ` +
+        `send actions to client ${targetClientId ?? "<default>"}. Call ` +
+        `app_control_stop and app_control_start to switch clients.`,
+      isError: true,
+    };
+  }
   return null;
 }
 
@@ -284,11 +303,53 @@ export class HostAppControlProxy extends HostProxyBase<
       return { content: "Aborted", isError: true };
     }
 
+    // Resolve target client and enforce same-actor BEFORE acquiring the
+    // session lock. This way early-exit errors don't need rollback, and
+    // the resolved client id can be stored in the session.
+    let resolvedTargetClientId = targetClientId;
+    if (resolvedTargetClientId == null) {
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_app_control",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return {
+          content:
+            "Multiple host_app_control clients are connected for this user. Specify target_client_id to disambiguate.",
+          isError: true,
+        };
+      }
+      if (resolved.kind === "match") {
+        resolvedTargetClientId = resolved.clientId;
+      } else if (
+        assistantEventHub.listClientsByCapability("host_app_control").length > 0
+      ) {
+        return {
+          content:
+            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
+          isError: true,
+        };
+      }
+    }
+
+    if (resolvedTargetClientId != null) {
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId: resolvedTargetClientId,
+        op: "host_app_control",
+      });
+      if (rejection) {
+        return rejection;
+      }
+    }
+
     // Authorization gate. `start` acquires the session lock (the user's
     // medium-risk approval is the consent boundary); all other tools must
-    // belong to the active session and target the same `app`. Without this
-    // gate, prompt-injected calls would bypass the start-time approval and
-    // send raw input to arbitrary apps.
+    // belong to the active session and target the same `app` and client.
+    // Without this gate, prompt-injected calls would bypass the start-time
+    // approval and send raw input to arbitrary apps or clients.
     let attemptedSession: ActiveAppControlSession | undefined;
     if (input.tool === "start") {
       if (
@@ -314,6 +375,7 @@ export class HostAppControlProxy extends HostProxyBase<
       attemptedSession = {
         conversationId: this.conversationId,
         app: input.app,
+        targetClientId: resolvedTargetClientId,
         dispatchedAt: nextDispatchedAt++,
       };
       activeAppControlSession = attemptedSession;
@@ -321,60 +383,13 @@ export class HostAppControlProxy extends HostProxyBase<
       const sessionError = checkNonStartAuthorization(
         input,
         this.conversationId,
+        resolvedTargetClientId,
       );
       if (sessionError != null) {
         return sessionError;
       }
     }
 
-    let resolvedTargetClientId = targetClientId;
-    if (resolvedTargetClientId == null) {
-      const resolved = pickSameUserAutoResolve({
-        hub: assistantEventHub,
-        capability: "host_app_control",
-        sourceActorPrincipalId,
-      });
-      if (resolved.kind === "ambiguous") {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return {
-          content:
-            "Multiple host_app_control clients are connected for this user. Specify target_client_id to disambiguate.",
-          isError: true,
-        };
-      }
-      if (resolved.kind === "match") {
-        resolvedTargetClientId = resolved.clientId;
-      } else if (
-        assistantEventHub.listClientsByCapability("host_app_control").length > 0
-      ) {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return {
-          content:
-            "App control is not available for the current actor. Connect a host_app_control-capable client as the same user.",
-          isError: true,
-        };
-      }
-    }
-
-    if (resolvedTargetClientId != null) {
-      const rejection = enforceSameActorOrErrorResult({
-        hub: assistantEventHub,
-        sourceActorPrincipalId,
-        targetClientId: resolvedTargetClientId,
-        op: "host_app_control",
-      });
-      if (rejection) {
-        if (input.tool === "start") {
-          this.rollbackStartIfCurrent(attemptedSession);
-        }
-        return rejection;
-      }
-    }
-
     try {
       const payload = await this.dispatchRequest(
         toolName,

package/src/daemon/host-proxy-preactivation.ts

@@ -34,9 +34,7 @@ import { getLogger } from "../util/logger.js";
 const log = getLogger("host-proxy-preactivation");
 
 /**
- * Subset of Conversation/ProcessConversationContext that
- * `preactivateHostProxySkills` needs. Both `Conversation` and
- * `ProcessConversationContext` satisfy this structurally.
+ * Subset of `Conversation` that `preactivateHostProxySkills` needs.
  */
 export interface HostProxyPreactivationTarget {
   readonly conversationId: string;

package/src/daemon/lifecycle.ts

@@ -60,7 +60,6 @@ import { sweepConceptPageFrontmatter } from "../memory/v2/frontmatter-sweep.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
-import { backfillGuardIfNeeded } from "../proactive-artifact/index.js";
 import { ensurePromptFiles } from "../prompts/system-prompt.js";
 import { runProviderConnectionsBackfill } from "../providers/inference/backfill.js";
 import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
@@ -98,6 +97,7 @@ import {
   updateWorkItem,
 } from "../work-items/work-item-store.js";
 import { WorkspaceHeartbeatService } from "../workspace/heartbeat-service.js";
+import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/migrations/097-enable-adaptive-thinking-managed-profiles.js";
 import { WORKSPACE_MIGRATIONS } from "../workspace/migrations/registry.js";
 import { runWorkspaceMigrations } from "../workspace/migrations/runner.js";
 import {
@@ -589,6 +589,26 @@ export async function runDaemon(): Promise<void> {
       );
     }
 
+    // Re-run the adaptive thinking repair after overlay merge + profile seeding.
+    // Workspace migration 097 enables adaptive thinking on managed profiles, but
+    // it runs before mergeDefaultWorkspaceConfig() which can overwrite the fix
+    // with overlay profiles that have thinking disabled or absent. On-platform
+    // instances where the overlay supplies "balanced" / "quality-optimized"
+    // profiles without thinking enabled would be stuck permanently because the
+    // migration is already checkpointed as completed. This idempotent repair
+    // ensures thinking is enabled regardless of overlay ordering.
+    if (defaultConfigMerge.hadOverlay) {
+      try {
+        repairAdaptiveThinkingOnManagedProfiles(getWorkspaceDir());
+        log.info("Post-overlay adaptive thinking repair complete");
+      } catch (err) {
+        log.warn(
+          { err },
+          "Post-overlay adaptive thinking repair failed — continuing startup",
+        );
+      }
+    }
+
     log.info("Daemon startup: loading config");
     const config = loadConfig();
 
@@ -1276,12 +1296,6 @@ export async function runDaemon(): Promise<void> {
       "Heartbeat service configured",
     );
 
-    try {
-      backfillGuardIfNeeded();
-    } catch (err) {
-      log.warn({ err }, "Proactive artifact backfill failed");
-    }
-
     // Filing yields to the memory v2 consolidation job when v2 is enabled —
     // both serve the same role (periodic background memory processing) and
     // running both is redundant. The consolidation job runs through the

package/src/daemon/persist-unsendable-image.ts

@@ -6,8 +6,9 @@
  * retries. That transformation is transient — the stored message row keeps the
  * full-size image block, so the rejected image is rehydrated on every later
  * turn and keeps re-entering the model's context. This module makes the
- * downgrade durable for images that can *never* be transmitted, so a rejected
- * upload cannot resurface after the user re-uploads a smaller version.
+ * downgrade durable: the oversized block is rewritten to its downscaled form,
+ * or to a text note when it cannot be shrunk on this host, so a rejected image
+ * cannot resurface and re-reject on every later turn.
  */
 
 import { optimizeImageForTransport } from "../agent/image-optimize.js";
@@ -40,19 +41,25 @@ export const UNSENDABLE_IMAGE_NOTE =
   "(An image was attached but could not be sent — its dimensions exceed the provider limit and automatic resize was not available. Please resize the image and try again.)";
 
 /**
- * True when a stored image block can never be transmitted to the provider: it
- * violates a provider hard limit (per-side pixel cap or payload size) and
- * cannot be shrunk to fit (re-optimization is a no-op).
+ * Replacement for an image that violates a provider hard limit (per-side pixel
+ * cap or payload size), or null when the image is within limits and should be
+ * left untouched. Gating on the provider hard caps is what keeps still-sendable
+ * images intact: a normally sized image is left alone rather than being noted or
+ * needlessly rewritten.
  *
- * Stored blocks are already post-optimization, so a block that is still
- * oversized here only stays oversized because resizing is unavailable on this
- * host (e.g. `sips` is absent off macOS, or the format is unsupported). A
- * downscalable image would have been reduced at upload time and would not reach
- * this predicate, so it is left untouched.
+ * An oversized image that can be shrunk is rewritten to its downscaled form; one
+ * that cannot be shrunk on this host (resize is a no-op, e.g. `sips` is absent
+ * off macOS or the format is unsupported) is replaced with a text note.
+ *
+ * Shared by the in-memory recovery transform and this durable persist pass so
+ * both apply the identical rule. Persisting the downscaled form is what lets a
+ * poisoned conversation durably self-heal — the latest tool-result media is kept
+ * in context, so without it the original oversized block rehydrates and
+ * re-rejects on every later turn.
  */
-function isImagePermanentlyUnsendable(
+export function oversizedImageReplacement(
   block: Extract<ContentBlock, { type: "image" }>,
-): boolean {
+): ContentBlock | null {
   const payloadBytes = block.source.data.length;
   const dims = parseImageDimensions(block.source.data, block.source.media_type);
   const exceedsDimensionCap =
@@ -60,24 +67,35 @@ function isImagePermanentlyUnsendable(
     (dims.width > PROVIDER_MAX_IMAGE_DIMENSION ||
       dims.height > PROVIDER_MAX_IMAGE_DIMENSION);
   const exceedsPayloadCap = payloadBytes > PROVIDER_MAX_IMAGE_PAYLOAD_BYTES;
-  if (!exceedsDimensionCap && !exceedsPayloadCap) return false;
+  if (!exceedsDimensionCap && !exceedsPayloadCap) return null;
 
   const optimized = optimizeImageForTransport(
     block.source.data,
     block.source.media_type,
   );
-  return optimized.data === block.source.data;
+  if (optimized.data !== block.source.data) {
+    return {
+      type: "image",
+      source: {
+        type: "base64",
+        media_type: optimized.mediaType,
+        data: optimized.data,
+      },
+    };
+  }
+  return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
 }
 
 /**
- * Rewrite every stored message in a conversation that holds a permanently
- * unsendable image, replacing those image blocks with {@link
- * UNSENDABLE_IMAGE_NOTE}. Reads stored content directly (not the in-memory,
- * injection-enriched copy) so injected prefixes and hydrated source paths are
- * never written back.
+ * Rewrite every stored message in a conversation that holds an oversized image
+ * the provider rejects — whether a top-level block or one nested in a
+ * tool_result's contentBlocks — replacing it with its downscaled form, or with
+ * {@link UNSENDABLE_IMAGE_NOTE} when it cannot be shrunk on this host. Reads
+ * stored content directly (not the in-memory, injection-enriched copy) so
+ * injected prefixes and hydrated source paths are never written back.
  *
- * Idempotent: once an image is replaced by the note there is no image block
- * left to match, so re-running is a no-op. Returns the number of rewritten
+ * Idempotent: a downscaled image is within limits and a note is no longer an
+ * image, so neither matches on a second run. Returns the number of rewritten
  * messages.
  */
 export function persistUnsendableImageDowngrades(
@@ -99,10 +117,29 @@ export function persistUnsendableImageDowngrades(
 
     let changed = false;
     const next = (parsed as ContentBlock[]).map((block): ContentBlock => {
-      if (block.type !== "image") return block;
-      if (!isImagePermanentlyUnsendable(block)) return block;
-      changed = true;
-      return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
+      if (block.type === "image") {
+        const replacement = oversizedImageReplacement(block);
+        if (!replacement) return block;
+        changed = true;
+        return replacement;
+      }
+      // Images returned by a tool (e.g. browser_screenshot) live inside the
+      // tool_result's contentBlocks, not as top-level blocks. Downgrade them
+      // in place so the tool_use/tool_result pairing stays intact.
+      if (block.type === "tool_result" && block.contentBlocks?.length) {
+        let nestedChanged = false;
+        const contentBlocks = block.contentBlocks.map((cb): ContentBlock => {
+          if (cb.type !== "image") return cb;
+          const replacement = oversizedImageReplacement(cb);
+          if (!replacement) return cb;
+          nestedChanged = true;
+          return replacement;
+        });
+        if (!nestedChanged) return block;
+        changed = true;
+        return { ...block, contentBlocks };
+      }
+      return block;
     });
     if (!changed) continue;
 

package/src/daemon/process-message.ts

@@ -195,7 +195,7 @@ async function prepareConversationForMessage(
         "wiring in conversation-routes.ts into a shared helper.",
     );
   }
-  const sourceActorPrincipalId = conversation.trustContext?.guardianPrincipalId;
+  const sourceActorPrincipalId = conversation.authContext?.actorPrincipalId;
   // CU is per-conversation (owns step count, AX tree history, loop detection).
   if (
     shouldAttachHostProxyForCapability(

package/src/daemon/server.ts

@@ -39,6 +39,8 @@ import {
   conversationEntries,
   deleteConversation,
   getConversationMap,
+} from "./conversation-registry.js";
+import {
   getOrCreateConversation as getOrCreateActiveConversation,
   initConversationLifecycle,
   setCesClientPromise,