@vellumai/assistant 0.8.9-staging.2 → 0.8.9-staging.3

package/src/cli/lib/plugin-marketplace.ts

@@ -12,8 +12,12 @@
  * Like the first-party plugin listing, the manifest is fetched from the repo
  * at a git ref (via the GitHub Contents API) rather than bundled into the
  * assistant build — so the whitelist can grow without shipping a new release.
- * Every external source pins an explicit `ref` (tag/SHA/branch): the catalog
- * is curated and the fetched code is version-locked, not a floating branch.
+ * Every external source pins an explicit `ref` that MUST be a full commit SHA:
+ * the fetched code is locked to an immutable revision. Tags and branches are
+ * rejected because they are mutable — an upstream owner could retag/repoint
+ * them to attacker code that the daemon would then `import()` (the install
+ * tree is dynamically loaded). A SHA cannot be repointed, so the reviewed
+ * manifest fully determines what gets executed.
  *
  * Designed for direct programmatic use with an injected `fetch`, mirroring
  * {@link ./search-plugins} and {@link ./install-from-github}.
@@ -39,6 +43,13 @@ const MARKETPLACE_FILE_PATH = "experimental/plugins/marketplace.json";
 const REPO_SLUG_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 /** Install name: a single kebab-case path segment (same rule as the CLI). */
 const PLUGIN_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
+/**
+ * Full Git commit SHA — 40 hex chars (SHA-1) or 64 (SHA-256). External
+ * marketplace refs must be a complete object name so the install is pinned to
+ * an immutable revision; abbreviated SHAs, tags, and branches are all mutable
+ * or ambiguous and are rejected.
+ */
+const COMMIT_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
 
 const githubSourceSchema = z.object({
   /** Discriminator. Only GitHub sources are resolved today. */
@@ -57,10 +68,17 @@ const githubSourceSchema = z.object({
     )
     .optional(),
   /**
-   * Git ref (tag, SHA, or branch) to fetch the plugin from. Required so every
-   * whitelisted external plugin is version-pinned.
+   * Immutable revision to fetch the plugin from. Must be a full commit SHA:
+   * tags and branches are mutable, so allowing them would let an upstream
+   * owner retarget a curated entry at code the daemon later `import()`s (RCE).
+   * A full SHA pins the install to exactly the reviewed bytes.
    */
-  ref: z.string().min(1),
+  ref: z
+    .string()
+    .regex(
+      COMMIT_SHA_RE,
+      "expected a full commit SHA (40 or 64 hex chars); tags and branches are mutable and not allowed",
+    ),
 });
 
 const marketplaceEntrySchema = z.object({

package/src/cli/lib/search-plugins.ts

@@ -200,8 +200,22 @@ export async function loadPluginCatalog(
 
   const matches: PluginSearchMatch[] = [];
   const seen = new Set<string>();
+
+  // Whitelisted external entries own their name. A same-named
+  // `experimental/plugins/<name>/` directory is that plugin's curated adapter
+  // stub (overlaid onto the clone at install time), not a standalone
+  // first-party plugin — so it must surface once, as the external entry.
+  for (const entry of marketplace) {
+    if (seen.has(entry.name)) continue;
+    matches.push(marketplaceMatch(entry));
+    seen.add(entry.name);
+  }
+
+  // First-party plugins are the in-repo directories whose name the marketplace
+  // does not claim.
   for (const entry of entries) {
     if (entry.type !== "dir") continue;
+    if (seen.has(entry.name)) continue;
     matches.push({
       name: entry.name,
       path: entry.path,
@@ -210,14 +224,6 @@ export async function loadPluginCatalog(
     seen.add(entry.name);
   }
 
-  for (const entry of marketplace) {
-    // First-party plugins win a name collision — the curated manifest is
-    // additive, never an override of what ships in-repo.
-    if (seen.has(entry.name)) continue;
-    matches.push(marketplaceMatch(entry));
-    seen.add(entry.name);
-  }
-
   matches.sort((a, b) => a.name.localeCompare(b.name));
 
   return { ref, matches };

package/src/config/acp-defaults.ts

@@ -9,9 +9,9 @@ const FROZEN_EMPTY_ARGS = Object.freeze([] as string[]) as unknown as string[];
 /**
  * Default ACP agent profiles that ship with the assistant.
  *
- * When `acp.enabled: true` and the user has not provided a config entry for an
- * agent id, the resolver falls back to this map so common agents like `claude`
- * and `codex` Just Work without requiring per-user config.
+ * When the user has not provided a config entry for an agent id, the resolver
+ * falls back to this map so common agents like `claude` and `codex` Just Work
+ * without requiring per-user config.
  *
  * Keyed by agent id. Deeply frozen — the outer object, each profile, and the
  * `args` arrays — so mutation throws in strict mode rather than silently

package/src/config/acp-schema.ts

@@ -20,12 +20,6 @@ const AcpAgentConfigSchema = z
 
 export const AcpConfigSchema = z
   .object({
-    enabled: z
-      .boolean()
-      .default(false)
-      .describe(
-        "Whether the Agent Communication Protocol (ACP) system is enabled",
-      ),
     maxConcurrentSessions: z
       .number()
       .int()
@@ -40,7 +34,7 @@ export const AcpConfigSchema = z
       .describe("Map of agent names to their configurations"),
   })
   .describe(
-    "Agent Communication Protocol (ACP) — enables inter-agent communication and delegation",
+    "Agent Communication Protocol (ACP) — inter-agent communication and delegation",
   );
 
 export type AcpConfig = z.infer<typeof AcpConfigSchema>;

package/src/config/bundled-skills/acp/SKILL.md

@@ -26,24 +26,11 @@ Users can refer to agents by natural names: "claude code", "codex cli", "openai
 
 ## First-time setup
 
-When the user first tries to use ACP and it's not enabled, set it up automatically:
+ACP is always available - default profiles for `claude`, `codex`, and `gemini` ship out-of-box, so no config edit is needed to start. First-time setup is just making the adapter binary available, then spawning:
 
-1. **Enable the `acp` feature flag** (the primary enablement path). Either PATCH it via the gateway feature-flags endpoint or direct the user to toggle "ACP Coding Agents" in the client's feature flags UI. Flag changes are hot-refreshed in the assistant - no restart needed.
+1. Install the adapter binary if it's missing. This happens automatically: when `acp_spawn` finds the agent's binary missing from PATH, the assistant installs it once via a sandboxed bun global install and proceeds in the same call (see "Automatic adapter availability" below).
 
-   As a supported alternative, edit the workspace config file to add the `acp` section. Default profiles for `claude`, `codex`, and `gemini` ship out-of-box, so the minimal config is just:
-   ```json
-   {
-     "acp": {
-       "enabled": true,
-       "maxConcurrentSessions": 4
-     }
-   }
-   ```
-   If you go the config route, **wait a few seconds** for the config watcher to pick up the change (it hot-reloads automatically - no restart needed).
-
-2. Then retry the `acp_spawn` call. Do NOT run `vellum sleep && vellum wake` - that kills the conversation.
-
-No manual binary installation is needed first: missing adapter binaries are installed automatically (see below).
+2. Call `acp_spawn`. Do NOT run `vellum sleep && vellum wake` - that kills the conversation.
 
 ## Automatic adapter availability
 
@@ -140,7 +127,7 @@ Then retry the `acp_spawn` call.
 
 ## Discoverability
 
-Use `acp_list_agents` to see what's set up and what's missing. It returns each available agent profile, whether ACP is enabled, whether the agent's binary is on PATH (missing binaries are installed automatically on first spawn), and an install hint if not. This is the right tool to call when deciding between `claude`, `codex`, and `gemini`, or when the user asks "what coding agents do I have?"
+Use `acp_list_agents` to see what's set up and what's missing. It returns each available agent profile, whether the agent's binary is on PATH (missing binaries are installed automatically on first spawn), and an install hint if not. This is the right tool to call when deciding between `claude`, `codex`, and `gemini`, or when the user asks "what coding agents do I have?"
 
 ## Working directory
 

package/src/config/bundled-skills/acp/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "acp_spawn",
-      "description": "Spawn an external coding agent (e.g. Claude Code, Codex, Gemini) via ACP to work on a task. Default profiles ship for `claude` (`claude-agent-acp`), `codex` (`codex-acp`), and `gemini` (`gemini --acp`); the assistant resolves the agent id to the right binary. The agent runs as a subprocess and streams results back. Use this when you want to delegate a coding task to an external agent that has its own tools, file editing, and terminal access. If a default agent's binary is missing, the assistant installs it once via a sandboxed bun global install and proceeds in the same call; if that fails (e.g. bun unavailable), an actionable install hint is returned - do NOT alter `agents.<id>.command` to swap binaries. If ACP is disabled, follow the setup instructions in SKILL.md.",
+      "description": "Spawn an external coding agent (e.g. Claude Code, Codex, Gemini) via ACP to work on a task. Default profiles ship for `claude` (`claude-agent-acp`), `codex` (`codex-acp`), and `gemini` (`gemini --acp`); the assistant resolves the agent id to the right binary. The agent runs as a subprocess and streams results back. Use this when you want to delegate a coding task to an external agent that has its own tools, file editing, and terminal access. If a default agent's binary is missing, the assistant installs it once via a sandboxed bun global install and proceeds in the same call; if that fails (e.g. bun unavailable), an actionable install hint is returned - do NOT alter `agents.<id>.command` to swap binaries.",
       "category": "orchestration",
       "risk": "high",
       "input_schema": {
@@ -87,7 +87,7 @@
     },
     {
       "name": "acp_list_agents",
-      "description": "Lists ACP coding agents available to spawn. Each entry includes whether ACP is enabled, whether the agent's binary is on PATH (missing binaries are installed automatically on first spawn), and an install command if not. Use this to decide between 'claude', 'codex', and 'gemini' or to surface setup steps to the user.",
+      "description": "Lists ACP coding agents available to spawn. Each entry includes whether the agent's binary is on PATH (missing binaries are installed automatically on first spawn), and an install command if not. Use this to decide between 'claude', 'codex', and 'gemini' or to surface setup steps to the user.",
       "category": "orchestration",
       "risk": "low",
       "input_schema": {

package/src/config/feature-flag-registry.json

@@ -39,8 +39,9 @@
       "scope": "client",
       "key": "experiment-activation-flow-2026-06-03",
       "label": "Activation Flow Experiment 2026-06-03",
-      "description": "Route allowlisted users to the activation-rail bootstrap template after pre-chat. Off by default and targeted through LaunchDarkly.",
-      "defaultEnabled": false
+      "description": "Multivariate activation-flow experiment. control = standard flow; variant-a = activation rail. Targeted via LaunchDarkly.",
+      "defaultEnabled": "control",
+      "values": ["control", "variant-a"]
     },
     {
       "id": "local-docker-enabled",
@@ -481,22 +482,6 @@
       "label": "Self-intro first message",
       "description": "On the first conversation, send a natural self-introduction (e.g. \"Hi Vela, I'm alex. Nice to meet you.\") on the user's behalf and route it through real LLM inference, instead of serving the canned first greeting. Names come from the onboarding context; falls back to the canned greeting when no name is known. Exposed to clients so pre-hatch onboarding can compute the source-of-truth initial message, and to the assistant so older clients can still be gated server-side. See assistant/src/daemon/first-greeting.ts (buildSelfIntroMessage).",
       "defaultEnabled": false
-    },
-    {
-      "id": "provider-first-profile-creation",
-      "scope": "client",
-      "key": "provider-first-profile-creation",
-      "label": "Provider-First Profile Creation",
-      "description": "New profile creation flow: pick (or inline-create) a provider first, then a model, with pre-filled provider and profile name/key, plus a quick-add \"+\" in the chat composer's Model Profile menu. When off, profile creation uses the previous field order and there is no composer quick-add.",
-      "defaultEnabled": false
-    },
-    {
-      "id": "acp",
-      "scope": "assistant",
-      "key": "acp",
-      "label": "ACP Coding Agents",
-      "description": "Enable spawning and steering external coding agents (Claude Code, Codex, Gemini) via the Agent Client Protocol. Alternative gate to the acp.enabled workspace config field; either enables the subsystem.",
-      "defaultEnabled": false
     }
   ]
 }

package/src/context/post-turn-tool-result-truncation.ts

@@ -22,6 +22,34 @@ export const TOOL_RESULT_DIR = ".tool-results";
 /** Marker used to detect already-truncated results (idempotency guard). */
 export const TRUNCATION_MARKER = "\u2014 full result:";
 
+/**
+ * Tools whose results carry durable operating instructions the model relies on
+ * across later turns rather than one-off data it only needs in the moment.
+ * Their results must never be middle-truncated: paging out the middle silently
+ * strips the workflow (e.g. a `skill_load` body losing its "## Available Tools"
+ * section), leaving the model to fall back to generic priors. Skill bodies are
+ * bounded and authored to live in context, so exempting them is safe.
+ */
+export const TRUNCATION_EXEMPT_TOOLS = new Set<string>(["skill_load"]);
+
+/**
+ * Build a map of tool_use_id -> originating tool name by walking the tool_use
+ * blocks in assistant messages. A tool_result only carries `tool_use_id`, so
+ * this is the only way to recover which tool produced a given result.
+ */
+function buildToolNameById(messages: Message[]): Map<string, string> {
+  const byId = new Map<string, string>();
+  for (const msg of messages) {
+    if (msg.role !== "assistant") continue;
+    for (const block of msg.content) {
+      if (block.type !== "tool_use") continue;
+      const tu = block as ToolUseContent;
+      byId.set(tu.id, tu.name);
+    }
+  }
+  return byId;
+}
+
 /**
  * Deterministic file path for a tool result's full content on disk.
  * Uses the first 12 hex chars of the SHA-256 of the tool_use_id.
@@ -59,7 +87,8 @@ export function buildTruncatedContent(
  * - The in-context content is replaced with a prefix/suffix stub.
  *
  * Results are skipped if they are below threshold, are error results,
- * or have already been truncated (contain `TRUNCATION_MARKER`).
+ * have already been truncated (contain `TRUNCATION_MARKER`), or were produced
+ * by a tool in `TRUNCATION_EXEMPT_TOOLS` (durable instructions like skill bodies).
  *
  * Returns a shallow-copied messages array (only modified messages are cloned)
  * and the count of results that were truncated.
@@ -70,6 +99,8 @@ export function postTurnTruncateToolResults(
 ): { messages: Message[]; truncatedCount: number } {
   let truncatedCount = 0;
 
+  const toolNameById = buildToolNameById(messages);
+
   const mapped = messages.map((msg) => {
     let changed = false;
     const nextContent: ContentBlock[] = msg.content.map((block) => {
@@ -82,6 +113,13 @@ export function postTurnTruncateToolResults(
       // Skip error results.
       if (tr.is_error) return block;
 
+      // Skip results from tools whose output is durable operating instructions
+      // (e.g. skill_load); middle-truncating them strips the workflow.
+      const toolName = toolNameById.get(tr.tool_use_id);
+      if (toolName !== undefined && TRUNCATION_EXEMPT_TOOLS.has(toolName)) {
+        return block;
+      }
+
       // Skip already-truncated results (idempotency).
       if (tr.content.includes(TRUNCATION_MARKER)) return block;
 

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -17,7 +17,6 @@ import type {
 import { getConfig } from "../config/loader.js";
 import { recordEstimate } from "../context/estimator-calibration.js";
 import { getCalibrationProviderKey } from "../context/token-estimator.js";
-import type { ContextWindowResult } from "../context/window-manager.js";
 import { projectAssistantMessage } from "../memory/conversation-attention-store.js";
 import {
   deleteMessageById,
@@ -46,6 +45,7 @@ import {
   type SlackMessageMetadata,
   writeSlackMetadata,
 } from "../messaging/providers/slack/message-metadata.js";
+import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
 import type {
   ContentBlock,
   ImageContent,
@@ -1482,6 +1482,13 @@ function annotatePersistedAssistantMessage(
         display: surface.display,
         ...(surface.persistent ? { persistent: true } : {}),
         ...(surface.toolCallId ? { toolCallId: surface.toolCallId } : {}),
+        // Daemon-only commit-timing activation tag, persisted so
+        // restoreSurfaceStateFromHistory can rehydrate it after a reload. This
+        // block lives only in server-side conversation history, never in the
+        // client `ui_surface_show` message.
+        ...(surface.activationMoment
+          ? { activationMoment: surface.activationMoment }
+          : {}),
       } as unknown as ContentBlock);
     }
     modified = true;

package/src/daemon/conversation-agent-loop.ts

@@ -9,7 +9,6 @@
 
 import { v4 as uuid } from "uuid";
 
-import { optimizeImageForTransport } from "../agent/image-optimize.js";
 import type {
   AgentEvent,
   AgentLoopExitReason,
@@ -43,7 +42,6 @@ import {
   estimatePromptTokens,
   getCalibrationProviderKey,
 } from "../context/token-estimator.js";
-import type { ContextWindowCompactOptions } from "../context/window-manager.js";
 import { writeRelationshipState } from "../home/relationship-state-writer.js";
 import {
   clearSentryConversationContext,
@@ -81,6 +79,7 @@ import {
   reduceContextOverflow,
   type ReducerState,
 } from "../plugins/defaults/compaction/context-overflow-reducer.js";
+import type { ContextWindowCompactOptions } from "../plugins/defaults/compaction/window-manager.js";
 import { deepRepairHistory } from "../plugins/defaults/history-repair/terminal.js";
 import userPromptSubmitMemoryRetrieval, {
   type MemoryRetrievalHookContext,
@@ -88,13 +87,11 @@ import userPromptSubmitMemoryRetrieval, {
 import { runHook } from "../plugins/pipeline.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
-import {
-  isUntrustedTrustClass,
-  resolveActorTrust,
-} from "../runtime/actor-trust-resolver.js";
+import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
+import type { ActivationMomentParam } from "../telemetry/activation-funnel.js";
 import type { UsageActor } from "../usage/actors.js";
 import { getLogger } from "../util/logger.js";
 import { timeAgo } from "../util/time.js";
@@ -122,16 +119,12 @@ import {
   isUserCancellation,
 } from "./conversation-error.js";
 import { raceWithTimeout } from "./conversation-media-retry.js";
-import type {
-  InboundActorContext,
-  InjectionMode,
-} from "./conversation-runtime-assembly.js";
+import type { InjectionMode } from "./conversation-runtime-assembly.js";
 import {
   applyRuntimeInjections,
   getSlackCompactionWatermarkForPrefix,
-  inboundActorContextFromTrust,
-  inboundActorContextFromTrustContext,
   loadSlackChronologicalContext,
+  resolveTurnInboundActorContext,
   type SlackChronologicalContext,
   stripInjectionsForCompaction,
 } from "./conversation-runtime-assembly.js";
@@ -148,8 +141,8 @@ import type {
 } from "./message-protocol.js";
 import { parseActualTokensFromError } from "./parse-actual-tokens-from-error.js";
 import {
+  oversizedImageReplacement,
   persistUnsendableImageDowngrades,
-  UNSENDABLE_IMAGE_NOTE,
 } from "./persist-unsendable-image.js";
 import { resolveTrustClass, type TrustContext } from "./trust-context.js";
 
@@ -176,6 +169,34 @@ function formatDiskPressureBlockedMessage(): string {
   return "Storage is critically low, so background processes are paused and remote messages are ignored until the guardian frees enough space. Remote senders should try again later.";
 }
 
+// ── Image-recovery helpers ───────────────────────────────────────────
+
+/**
+ * True when a message's content holds an image the provider may have rejected
+ * for being oversized — either a top-level image block (user upload) or one
+ * nested inside a tool_result's contentBlocks (e.g. a browser screenshot).
+ */
+function messageHasImageBlock(content: ContentBlock[]): boolean {
+  return content.some(
+    (b) =>
+      b.type === "image" ||
+      (b.type === "tool_result" &&
+        (b.contentBlocks?.some((cb) => cb.type === "image") ?? false)),
+  );
+}
+
+/**
+ * Replace an oversized image with its downscaled form or an unsendable note,
+ * leaving still-sendable images untouched. Delegates to the shared
+ * {@link oversizedImageReplacement} so the in-memory recovery and the durable
+ * persist pass apply the identical provider-cap gate.
+ */
+function recoverImageBlock(
+  block: Extract<ContentBlock, { type: "image" }>,
+): ContentBlock {
+  return oversizedImageReplacement(block) ?? block;
+}
+
 // ── Plugin pipeline helpers ──────────────────────────────────────────
 
 /**
@@ -223,6 +244,14 @@ export interface AssistantSurface {
   persistent?: boolean;
   /** Id of the tool call that produced this surface (the `ui_show` proxy tool). Persisted so app previews can gate on the tool result's arrival rather than whole-turn streaming state. */
   toolCallId?: string;
+  /**
+   * Commit-timing activation-rail tag (daemon-only). Persisted into the
+   * server-side `ui_surface` history block — NOT the client `ui_surface_show`
+   * message — so `restoreSurfaceStateFromHistory` can rehydrate the tag and a
+   * post-reload commit still records its funnel milestone. Show-timing moments
+   * record at render and are never stored here.
+   */
+  activationMoment?: ActivationMomentParam;
 }
 
 // ── runAgentLoop ─────────────────────────────────────────────────────
@@ -771,41 +800,16 @@ export async function runAgentLoopImpl(
       hostTimeZone,
     });
 
-    // Resolve the inbound actor context for the unified <turn_context> block.
-    // When the conversation carries enough identity info, use the unified
-    // actor trust resolver so member status/policy and guardian binding details
-    // are fresh for this turn. The conversation runtime context remains the source
-    // for policy gating; this block is model-facing grounding metadata.
-    let resolvedInboundActorContext: InboundActorContext | null = null;
-    if (ctx.trustContext) {
-      const gc = ctx.trustContext;
-      if (gc.requesterExternalUserId && gc.requesterChatId) {
-        const actorTrust = resolveActorTrust({
-          assistantId: ctx.assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
-          sourceChannel: gc.sourceChannel,
-          conversationExternalId: gc.requesterChatId,
-          actorExternalId: gc.requesterExternalUserId,
-          actorDisplayName: gc.requesterSenderDisplayName,
-        });
-        resolvedInboundActorContext = inboundActorContextFromTrust(actorTrust);
-      } else {
-        resolvedInboundActorContext = inboundActorContextFromTrustContext(gc);
-      }
-    }
-
-    // Resolve the guardian flag for this turn. It derives only from the
-    // resolved actor trust class — never from retrieval — so it settles before
-    // context assembly.
-    const isGuardian =
-      resolvedInboundActorContext?.trustClass === "guardian" ||
-      !resolvedInboundActorContext;
-
-    // Unified `<turn_context>` actor input, included only for non-guardian
-    // turns. Resolved once at turn start and threaded per call site (like
-    // `modelProfile`) so post-compaction re-injection receives it as an
-    // explicit hook input rather than re-deriving it from live state that can
-    // flip mid-turn.
-    const actorContext = isGuardian ? null : resolvedInboundActorContext;
+    // Unified `<turn_context>` actor input for this turn (model-facing grounding
+    // metadata; the conversation runtime context remains the source for policy
+    // gating). Resolved once at turn start and threaded per call site (like
+    // `modelProfile`) so post-compaction re-injection receives it as an explicit
+    // hook input rather than re-deriving it from live state that can flip
+    // mid-turn.
+    const actorContext = resolveTurnInboundActorContext(
+      ctx.trustContext,
+      ctx.assistantId,
+    );
 
     // Surface long gaps between user messages so the model can acknowledge
     // the absence naturally. Gated at >12h to avoid noisy injection during
@@ -873,10 +877,9 @@ export async function runAgentLoopImpl(
     // `user-prompt-submit-temp` hook handler but invoked directly for now,
     // separate from the canonical late `user-prompt-submit` hook (history
     // repair, title) that fires just before the loop.
-    // The injection inputs (`mode`, `isNonInteractive`, `modelProfile`,
-    // `actorContext`) are resolved once at turn start and threaded in so
-    // post-compaction re-injection reuses the same snapshot rather than live
-    // state that can flip mid-turn.
+    // The injection inputs (`isNonInteractive`, `modelProfile`) are resolved
+    // once at turn start and threaded in so post-compaction re-injection reuses
+    // the same snapshot rather than live state that can flip mid-turn.
     const isTrustedActor = resolveTrustClass(ctx.trustContext) === "guardian";
     let currentInjectionMode: InjectionMode = "full";
     const memoryCtx: MemoryRetrievalHookContext = {
@@ -886,10 +889,8 @@ export async function runAgentLoopImpl(
       logger: rlog,
       latestMessages: ctx.messages,
       requestId: reqId,
-      mode: currentInjectionMode,
       isNonInteractive,
       modelProfile: modelProfileStr,
-      actorContext,
     };
     await userPromptSubmitMemoryRetrieval(memoryCtx);
 
@@ -913,6 +914,8 @@ export async function runAgentLoopImpl(
     // `AgentLoopRunResult.newMessages`, which is what persistence consumes.
     const userPromptCtx: UserPromptSubmitContext = {
       conversationId: ctx.conversationId,
+      userMessageId,
+      requestId: reqId,
       prompt: options?.titleText ?? content,
       originalMessages: ctx.messages,
       latestMessages: runMessages,
@@ -1076,44 +1079,41 @@ export async function runAgentLoopImpl(
 
     // ── Image-dimension overflow recovery ──────────────────────────
     // When the provider rejects because an image block exceeds its pixel
-    // cap, strip every image block from ctx.messages and retry once.
-    // optimizeImageForTransport already ran at upload time; if sips was
-    // unavailable (non-macOS) it returns the same bytes unchanged.  In
-    // that case we swap the block for a text note so the model can tell
-    // the user what happened instead of hard-failing with a red banner.
+    // or payload cap, recover every oversized image in ctx.messages and
+    // retry once. recoverImageBlock downscales an oversized image, or swaps
+    // it for a text note when resize is a no-op (e.g. sips unavailable
+    // off macOS), while leaving still-sendable images untouched. This covers
+    // both top-level image blocks (user uploads) and images nested inside a
+    // tool_result's contentBlocks (e.g. a browser screenshot), which is where
+    // the rejected block usually lives.
     if (state.imageTooLargeDetected) {
       state.imageTooLargeDetected = false;
       rlog.warn(
         { phase: "image-recovery" },
-        "Image too large — stripping oversized image blocks and retrying",
+        "Image too large — recovering oversized image blocks and retrying",
       );
       ctx.messages = ctx.messages.map((msg) => {
         if (!Array.isArray(msg.content)) return msg;
-        if (!msg.content.some((b) => b.type === "image")) return msg;
+        if (!messageHasImageBlock(msg.content)) return msg;
         return {
           ...msg,
           content: msg.content.flatMap((b): ContentBlock[] => {
-            if (b.type !== "image") return [b];
-            const resized = optimizeImageForTransport(
-              b.source.data,
-              b.source.media_type,
-            );
-            if (resized.data !== b.source.data) {
-              // sips managed to downscale — use the smaller version
+            if (b.type === "image") return [recoverImageBlock(b)];
+            // Images returned by a tool (e.g. browser_screenshot) live in
+            // the tool_result's contentBlocks, not as top-level blocks.
+            // Recover them in place so the tool_use/tool_result pairing
+            // stays intact rather than dropping the whole tool_result.
+            if (b.type === "tool_result" && b.contentBlocks?.length) {
               return [
                 {
                   ...b,
-                  source: {
-                    type: "base64" as const,
-                    media_type: resized.mediaType,
-                    data: resized.data,
-                  },
+                  contentBlocks: b.contentBlocks.map((cb) =>
+                    cb.type === "image" ? recoverImageBlock(cb) : cb,
+                  ),
                 },
               ];
             }
-            // Can't resize — replace with a text annotation so the model
-            // can explain the situation rather than silently dropping context
-            return [{ type: "text" as const, text: UNSENDABLE_IMAGE_NOTE }];
+            return [b];
           }),
         };
       });
@@ -1302,7 +1302,7 @@ export async function runAgentLoopImpl(
           reducerState,
           (msgs, signal, opts) =>
             defaultCompact({
-              manager: ctx.contextWindowManager,
+              conversationId: ctx.conversationId,
               messages: msgs,
               signal,
               ...((opts ?? {}) as ContextWindowCompactOptions),
@@ -1399,7 +1399,7 @@ export async function runAgentLoopImpl(
             requestId: reqId,
           });
           const emergencyCompact = await defaultCompact({
-            manager: ctx.contextWindowManager,
+            conversationId: ctx.conversationId,
             messages: ctx.messages,
             signal: abortController.signal,
             force: true,