@vellumai/assistant 0.8.9-staging.2 → 0.8.9-staging.4

package/src/daemon/conversation-runtime-assembly.ts

@@ -13,7 +13,6 @@ import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { stripUserTextBlocksByPrefix } from "../context/strip-injections.js";
-import { createContextSummaryMessage } from "../context/window-manager.js";
 import { getDocumentsForConversation } from "../documents/document-store.js";
 import {
   getApp,
@@ -43,6 +42,7 @@ import {
   type RenderedSlackTranscriptMessage,
   renderSlackTranscriptWithProvenance,
 } from "../messaging/providers/slack/render-transcript.js";
+import { createContextSummaryMessage } from "../plugins/defaults/compaction/window-manager.js";
 import { getInjectorChain } from "../plugins/defaults/memory-retrieval/injector-chain.js";
 import { MEMORY_V3_BLOCK_ID } from "../plugins/defaults/memory-v3-shadow/types.js";
 import type {
@@ -54,8 +54,10 @@ import type { ContentBlock, Message } from "../providers/types.js";
 import {
   type ActorTrustContext,
   isUntrustedTrustClass,
+  resolveActorTrust,
   type TrustClass,
 } from "../runtime/actor-trust-resolver.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { channelStatusToMemberStatus } from "../runtime/routes/inbound-stages/acl-enforcement.js";
 import { getSubagentManager } from "../subagent/index.js";
 import type { SubagentState } from "../subagent/types.js";
@@ -174,6 +176,40 @@ export function inboundActorContextFromTrust(
   };
 }
 
+/**
+ * Resolve the model-facing inbound actor context for a turn from the
+ * conversation's trust context, for the unified `<turn_context>` actor section.
+ *
+ * Returns `null` when there is no trust context and on guardian (owner) turns —
+ * the actor section is suppressed for the owner. When the trust context carries
+ * enough identity to look up member status / policy and the guardian binding,
+ * the unified actor-trust resolver is preferred; otherwise the context is
+ * projected directly. Derives purely from the passed trust context, so callers
+ * self-resolve it from the live conversation rather than threading it.
+ */
+export function resolveTurnInboundActorContext(
+  trustContext: TrustContext | undefined,
+  assistantId: string | undefined,
+): InboundActorContext | null {
+  if (!trustContext) {
+    return null;
+  }
+  let resolved: InboundActorContext;
+  if (trustContext.requesterExternalUserId && trustContext.requesterChatId) {
+    const actorTrust = resolveActorTrust({
+      assistantId: assistantId ?? DAEMON_INTERNAL_ASSISTANT_ID,
+      sourceChannel: trustContext.sourceChannel,
+      conversationExternalId: trustContext.requesterChatId,
+      actorExternalId: trustContext.requesterExternalUserId,
+      actorDisplayName: trustContext.requesterSenderDisplayName,
+    });
+    resolved = inboundActorContextFromTrust(actorTrust);
+  } else {
+    resolved = inboundActorContextFromTrustContext(trustContext);
+  }
+  return resolved.trustClass === "guardian" ? null : resolved;
+}
+
 /** Derive channel capabilities from source channel + interface identifiers. */
 export function resolveChannelCapabilities(
   sourceChannel?: string | null,

package/src/daemon/conversation-surfaces.ts

@@ -1,5 +1,6 @@
 import { v4 as uuid } from "uuid";
 
+import { isActivationSession } from "../memory/activation-session-store.js";
 import {
   addAppConversationId,
   getApp,
@@ -14,6 +15,7 @@ import {
   getMessages,
   updateMessageContent,
 } from "../memory/conversation-crud.js";
+import { recordActivationEvent } from "../memory/onboarding-events-store.js";
 import {
   assistantEventHub,
   broadcastMessage,
@@ -23,10 +25,17 @@ import {
   enforceSameActorOrErrorResult,
   pickSameUserAutoResolve,
 } from "../runtime/auth/same-actor.js";
+import type { AuthContext } from "../runtime/auth/types.js";
 import type {
   InteractiveUiRequest,
   InteractiveUiResult,
 } from "../runtime/interactive-ui-types.js";
+import {
+  activationMomentEmitsAtShow,
+  type ActivationMomentParam,
+  activationStepNameForMomentParam,
+  isActivationMomentParam,
+} from "../telemetry/activation-funnel.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
 import { isPlainObject } from "../util/object.js";
@@ -544,6 +553,12 @@ export interface SurfaceConversationContext {
   readonly assistantId?: string;
   /** Inherited to spawned conversations in the `launch_conversation` action path. */
   readonly trustContext?: TrustContext;
+  /** Verified requester auth context for the active turn. */
+  readonly authContext?: AuthContext;
+  /** Per-turn auth snapshot, preferred for tool dispatch authorization. */
+  readonly currentTurnAuthContext?: AuthContext;
+  /** JWT-verified requester principal for the active turn. */
+  readonly currentTurnSourceActorPrincipalId?: string;
   readonly channelCapabilities?: {
     channel: string;
     supportsDynamicUi: boolean;
@@ -569,6 +584,14 @@ export interface SurfaceConversationContext {
         style?: string;
         data?: Record<string, unknown>;
       }>;
+      /**
+       * Activation-rail telemetry tag (daemon-only). When the model tags a
+       * `ui_show` surface as an activation funnel moment, the token is captured
+       * here so the milestone can be recorded deterministically when the user
+       * commits the surface (`handleSurfaceAction`). Never forwarded to the
+       * client.
+       */
+      activationMoment?: ActivationMomentParam;
     }
   >;
   surfaceUndoStacks: Map<string, string[]>;
@@ -613,6 +636,12 @@ export interface SurfaceConversationContext {
     display?: string;
     persistent?: boolean;
     toolCallId?: string;
+    /**
+     * Commit-timing activation-rail tag (daemon-only). Carried through to the
+     * persisted `ui_surface` history block so it survives a reload — never sent
+     * to the client.
+     */
+    activationMoment?: ActivationMomentParam;
   }>;
   /** Optional proxy for delegating computer-use actions to a connected desktop client. */
   hostCuProxy?: HostCuProxy;
@@ -1250,6 +1279,60 @@ function getRequestedSurfaceCompletionSummary(
   return summary || "Completed";
 }
 
+/**
+ * Best-effort recorder for a single activation-funnel moment. Gated on the
+ * conversation being a marked activation-rail session. Fire-and-forget: never
+ * throws, never blocks or alters the surface-action flow (a failure is logged
+ * and swallowed). Shared by the show-time path (`first_wow_executed`, recorded
+ * when the surface renders) and the commit-time path (the other moments,
+ * recorded when the user commits the surface).
+ */
+function recordActivationMoment(
+  ctx: SurfaceConversationContext,
+  moment: ActivationMomentParam,
+): void {
+  try {
+    if (!isActivationSession(ctx.conversationId)) return;
+    recordActivationEvent({
+      stepName: activationStepNameForMomentParam(moment),
+      sessionId: ctx.conversationId,
+    });
+  } catch (err) {
+    log.warn(
+      { err, conversationId: ctx.conversationId, moment },
+      "Failed to record activation moment",
+    );
+  }
+}
+
+/**
+ * Best-effort activation-funnel emission on a user surface commit.
+ *
+ * When the committed surface carries a commit-timing `activationMoment` tag,
+ * record the corresponding funnel milestone. Show-timing moments
+ * (`first_wow_executed`) are recorded at render time in `surfaceProxyResolver`
+ * and are NOT stored on `surfaceState`, so they never reach this path. The tag
+ * is cleared after the first record so re-entrant or repeated commits on the
+ * same surface do not double-emit (and the deterministic `daemon_event_id`
+ * collapses any cross-surface duplicate downstream anyway).
+ *
+ * Must be called only from terminal-commit paths (user clicked an action /
+ * submitted / selected-and-committed), NOT from intermediate non-terminal
+ * events (`selection_changed` / `content_changed` / `state_update`).
+ */
+function maybeEmitActivationMoment(
+  ctx: SurfaceConversationContext,
+  surfaceId: string,
+): void {
+  const stored = ctx.surfaceState.get(surfaceId);
+  const moment = stored?.activationMoment;
+  if (!moment) return;
+  // Clear the tag first so this can fire at most once per surface even if the
+  // commit path is re-entered.
+  stored.activationMoment = undefined;
+  recordActivationMoment(ctx, moment);
+}
+
 function completeSurfaceFromAction(
   ctx: SurfaceConversationContext,
   surfaceId: string,
@@ -1317,6 +1400,13 @@ export async function handleSurfaceAction(
     });
     markSurfaceCompleted(ctx, surfaceId, summary);
 
+    // Terminal user commit on a standalone surface (submit, not cancel/dismiss)
+    // — record an activation milestone if tagged. Must run before
+    // `cleanupStandaloneSurface` clears the surface state.
+    if (!isCancellation) {
+      maybeEmitActivationMoment(ctx, surfaceId);
+    }
+
     // Cleanup and resolve — order matters: cleanup clears the timer
     // before resolve() unblocks the caller.
     cleanupStandaloneSurface(ctx, surfaceId);
@@ -1403,6 +1493,10 @@ export async function handleSurfaceAction(
       { originConversationId: ctx.conversationId, conversationId, surfaceId },
       "launch_conversation dispatched inline from surface action",
     );
+    // Launching a child conversation is a terminal user commit — record an
+    // activation milestone if tagged. The helper clears the tag after firing,
+    // so the other commit-path call sites below can't double-emit.
+    maybeEmitActivationMoment(ctx, surfaceId);
     return { accepted: true, conversationId };
   }
 
@@ -1557,6 +1651,12 @@ export async function handleSurfaceAction(
       return;
     }
 
+    // Terminal user commit accepted — record the activation milestone if this
+    // surface was tagged (best-effort, no-op otherwise). Deferred until after
+    // the rejection check so a queue-full click doesn't over-report a moment
+    // (and the one-shot tag stays intact for the user's retry).
+    maybeEmitActivationMoment(ctx, surfaceId);
+
     const requestedCompletionSummary =
       getRequestedSurfaceCompletionSummary(mergedData);
     if (requestedCompletionSummary) {
@@ -1796,6 +1896,12 @@ export async function handleSurfaceAction(
     return;
   }
 
+  // Terminal user commit accepted — record the activation milestone if this
+  // surface was tagged (best-effort, no-op otherwise). Deferred until after the
+  // rejection check so a queue-full click doesn't over-report a moment (and the
+  // one-shot tag stays intact for the user's retry).
+  maybeEmitActivationMoment(ctx, surfaceId);
+
   const requestedCompletionSummary =
     getRequestedSurfaceCompletionSummary(mergedData);
 
@@ -2215,7 +2321,10 @@ export async function surfaceProxyResolver(
     // validate at the tool-resolution layer for the same reason. The proxy
     // re-checks same-user (single authoritative gate); using the shared
     // helper keeps log payload and error wording identical at both layers.
-    const sourceActorPrincipalId = ctx.trustContext?.guardianPrincipalId;
+    const sourceActorPrincipalId =
+      ctx.currentTurnSourceActorPrincipalId ??
+      ctx.currentTurnAuthContext?.actorPrincipalId ??
+      ctx.authContext?.actorPrincipalId;
     if (targetClientId != null) {
       const client = assistantEventHub.getClientById(targetClientId);
       if (!client) {
@@ -2321,7 +2430,10 @@ export async function surfaceProxyResolver(
         ? input.target_client_id
         : undefined;
 
-    const sourceActorPrincipalId = ctx.trustContext?.guardianPrincipalId;
+    const sourceActorPrincipalId =
+      ctx.currentTurnSourceActorPrincipalId ??
+      ctx.currentTurnAuthContext?.actorPrincipalId ??
+      ctx.authContext?.actorPrincipalId;
     if (targetClientId != null) {
       const client = assistantEventHub.getClientById(targetClientId);
       if (!client) {
@@ -2504,6 +2616,24 @@ export async function surfaceProxyResolver(
       ...(a.data ? { data: a.data } : {}),
     }));
 
+    // Optional activation-rail telemetry tag. Daemon-only metadata: validated
+    // and ignored if invalid; never forwarded to the client.
+    const activationMoment =
+      typeof input.activation_moment === "string" &&
+      isActivationMomentParam(input.activation_moment)
+        ? input.activation_moment
+        : undefined;
+
+    // Show-timing moments (`first_wow_executed`) record the instant the surface
+    // renders — a display-only result/`work_result` card may never be committed,
+    // so a commit-time emit would never fire. We record now and do NOT store the
+    // tag, so the commit path won't double-emit. Commit-timing moments are
+    // stored and recorded when the user commits the surface (see
+    // `handleSurfaceAction` → `maybeEmitActivationMoment`).
+    const storeTagForCommit =
+      activationMoment !== undefined &&
+      !activationMomentEmitsAtShow(activationMoment);
+
     // Track surface state for ui_update merging (includes actions so we can
     // look up per-action data payloads when the client sends an action back).
     ctx.surfaceState.set(surfaceId, {
@@ -2511,8 +2641,13 @@ export async function surfaceProxyResolver(
       data,
       title,
       actions: mappedActions,
+      ...(storeTagForCommit ? { activationMoment } : {}),
     });
 
+    if (activationMoment !== undefined && !storeTagForCommit) {
+      recordActivationMoment(ctx, activationMoment);
+    }
+
     log.info(
       {
         surfaceId,
@@ -2540,7 +2675,9 @@ export async function surfaceProxyResolver(
       ...(toolUseId ? { toolCallId: toolUseId } : {}),
     } as unknown as UiSurfaceShow);
 
-    // Track surface for persistence with the message
+    // Track surface for persistence with the message. The commit-timing
+    // activation tag rides along (daemon-only) so it survives history restore;
+    // show-timing moments aren't stored here (already recorded at render).
     ctx.currentTurnSurfaces.push({
       surfaceId,
       surfaceType,
@@ -2550,6 +2687,7 @@ export async function surfaceProxyResolver(
       display,
       ...(persistent ? { persistent: true } : {}),
       ...(toolUseId ? { toolCallId: toolUseId } : {}),
+      ...(storeTagForCommit ? { activationMoment } : {}),
     });
 
     if (awaitAction) {

package/src/daemon/conversation.ts

@@ -33,11 +33,6 @@ import {
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite, Speed } from "../config/schemas/llm.js";
-import {
-  type ContextWindowManager,
-  type ContextWindowResult,
-  createContextSummaryMessage,
-} from "../context/window-manager.js";
 import type { CesClient } from "../credential-execution/client.js";
 import { EventBus } from "../events/bus.js";
 import type { AssistantDomainEvents } from "../events/domain-events.js";
@@ -67,8 +62,16 @@ import {
   createContextWindowManager,
   getContextWindowManager,
 } from "../plugins/defaults/compaction/manager-store.js";
+import {
+  type ContextWindowManager,
+  type ContextWindowResult,
+  createContextSummaryMessage,
+} from "../plugins/defaults/compaction/window-manager.js";
 import { repairHistory } from "../plugins/defaults/history-repair/terminal.js";
-import { buildSystemPrompt } from "../prompts/system-prompt.js";
+import {
+  applyBootstrapTemplate,
+  buildSystemPrompt,
+} from "../prompts/system-prompt.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
 import {
@@ -79,6 +82,10 @@ import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../runtime/auth/types.js";
 import type { InteractiveUiResult } from "../runtime/interactive-ui.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
+import {
+  type ActivationMomentParam,
+  isActivationMomentParam,
+} from "../telemetry/activation-funnel.js";
 import { ToolExecutor } from "../tools/executor.js";
 import { getAllToolDefinitions } from "../tools/registry.js";
 import type { ToolLifecycleEvent } from "../tools/types.js";
@@ -266,6 +273,8 @@ export class Conversation {
   /** @internal */ currentTurnOverrideProfile?: string;
   /** @internal */ toolRoutedProfile?: string;
   /** @internal */ authContext?: AuthContext;
+  /** @internal */ currentTurnAuthContext?: AuthContext;
+  /** @internal */ currentTurnSourceActorPrincipalId?: string;
   /** @internal */ loadedHistoryTrustClass?: TrustClass;
   /** @internal */ loadedHistoryPersonalMemoryAllowed?: boolean;
   /** @internal */ voiceCallControlPrompt?: string;
@@ -338,6 +347,12 @@ export class Conversation {
         style?: string;
         data?: Record<string, unknown>;
       }>;
+      /**
+       * Commit-timing activation-rail tag (daemon-only). Rehydrated by
+       * `restoreSurfaceStateFromHistory` so a post-reload commit still records
+       * its funnel milestone. Never sent to the client.
+       */
+      activationMoment?: ActivationMomentParam;
     }
   >();
   /** @internal */ surfaceUndoStacks = new Map<string, string[]>();
@@ -568,6 +583,7 @@ export class Conversation {
               trustContext: this.currentTurnTrustContext,
               channelCapabilities: this.currentTurnChannelCapabilities,
               onboardingContext: this.getOnboardingContext(),
+              conversationId: this.conversationId,
             }),
       };
       if (configuredMaxTokens !== undefined) {
@@ -626,11 +642,11 @@ export class Conversation {
 
   /**
    * The conversation's {@link ContextWindowManager}, owned by the compaction
-   * module's per-conversation store. The constructor registers it there; this
-   * accessor resolves it on demand so the conversation holds no separate
-   * handle. Present for the conversation's whole in-memory lifetime (registered
-   * at construction, released on teardown), so a live conversation always
-   * resolves an instance.
+   * module's per-conversation store. The constructor builds and registers it
+   * there; this accessor resolves it on demand so the conversation holds no
+   * separate handle. Present for the conversation's whole in-memory lifetime
+   * (registered at construction, released on teardown), so a live conversation
+   * always resolves an instance.
    */
   /** @internal */ get contextWindowManager(): ContextWindowManager {
     const manager = getContextWindowManager(this.conversationId);
@@ -646,6 +662,13 @@ export class Conversation {
 
   setOnboardingContext(ctx: OnboardingContext): void {
     this.onboardingContext = ctx;
+    // Reseed BOOTSTRAP.md and mark the activation session at the earliest point
+    // the conversation knows its bootstrap selection — before the first turn's
+    // tool resolution, which `buildSystemPrompt` is too late for. See
+    // `applyBootstrapTemplate`.
+    if (ctx.bootstrapTemplate) {
+      applyBootstrapTemplate(ctx.bootstrapTemplate, this.conversationId);
+    }
   }
 
   getOnboardingContext(): OnboardingContext | undefined {
@@ -687,6 +710,7 @@ export class Conversation {
           trustContext: this.currentTurnTrustContext,
           channelCapabilities: this.currentTurnChannelCapabilities,
           onboardingContext: this.getOnboardingContext(),
+          conversationId: this.conversationId,
         });
     const tools = getAllToolDefinitions();
     const provider = this.provider;
@@ -990,6 +1014,14 @@ export class Conversation {
       for (const block of msg.content) {
         const b = block as unknown as Record<string, unknown>;
         if (b.type === "ui_surface" && typeof b.surfaceId === "string") {
+          // Rehydrate the daemon-only commit-timing activation tag so a commit
+          // after reload still records its funnel milestone. Validated and
+          // dropped if malformed; this field never reaches the client.
+          const activationMoment =
+            typeof b.activationMoment === "string" &&
+            isActivationMomentParam(b.activationMoment)
+              ? b.activationMoment
+              : undefined;
           this.surfaceState.set(b.surfaceId, {
             surfaceType: (b.surfaceType ?? "dynamic_page") as SurfaceType,
             data: (b.data ?? {}) as SurfaceData,
@@ -1002,6 +1034,7 @@ export class Conversation {
                   data?: Record<string, unknown>;
                 }>)
               : undefined,
+            ...(activationMoment ? { activationMoment } : {}),
           });
         }
       }
@@ -1330,7 +1363,9 @@ export class Conversation {
 
   ensureHostProxiesForTurn(
     sourceInterface: import("../channels/types.js").InterfaceId | undefined,
-    sourceActorPrincipalId = this.trustContext?.guardianPrincipalId,
+    sourceActorPrincipalId = this.currentTurnSourceActorPrincipalId ??
+      this.currentTurnAuthContext?.actorPrincipalId ??
+      this.authContext?.actorPrincipalId,
   ): void {
     if (
       shouldAttachHostProxyForCapability(
@@ -1438,7 +1473,7 @@ export class Conversation {
     const messagesToCompact =
       slackChronologicalContext?.messages ?? this.messages;
     const result = await defaultCompact({
-      manager: this.contextWindowManager,
+      conversationId: this.conversationId,
       messages: messagesToCompact,
       signal: this.abortController?.signal ?? undefined,
       force: true,

package/src/daemon/external-plugins-bootstrap.ts

@@ -65,6 +65,7 @@ import { getConfig } from "../config/loader.js";
 import type { AssistantConfig } from "../config/schema.js";
 import { HOOKS } from "../plugin-api/constants.js";
 import { registerDefaultPlugins } from "../plugins/defaults/index.js";
+import { installPluginRuntime } from "../plugins/external-api.js";
 import { buildExternalPlugin } from "../plugins/external-plugin-loader.js";
 import {
   registerPluginSkills,
@@ -186,17 +187,21 @@ function getDisabledPluginFlag(
  * Bring the plugin layer up during daemon startup. Runs the full sequence in
  * the one order the rest of the system depends on:
  *
- * 1. Register the first-party defaults so their middleware composes innermost,
+ * 1. Install the `globalThis.__vellumPluginRuntime` bridge so plugins can touch
+ *    it from their module body (see `plugins/external-api.ts` — compiled-binary
+ *    module identity).
+ * 2. Register the first-party defaults so their middleware composes innermost,
  *    ahead of any user plugins.
- * 2. Load user plugins from `<workspaceDir>/plugins/*`. A failing user plugin is
+ * 3. Load user plugins from `<workspaceDir>/plugins/*`. A failing user plugin is
  *    logged and skipped; `loadUserPlugins()` closes the registration window
  *    when it returns, so the defaults must already be registered by then.
- * 3. Run every registered plugin's `init()` via {@link bootstrapPlugins}.
+ * 4. Run every registered plugin's `init()` via {@link bootstrapPlugins}.
  *
  * Plugin bootstrap is wrapped so a failing plugin cannot block daemon startup —
  * the daemon comes up with degraded plugin functionality instead.
  */
 export async function initializePlugins(): Promise<void> {
+  installPluginRuntime();
   registerDefaultPlugins();
   await loadUserPlugins();
   try {

package/src/daemon/persist-unsendable-image.ts

@@ -6,8 +6,9 @@
  * retries. That transformation is transient — the stored message row keeps the
  * full-size image block, so the rejected image is rehydrated on every later
  * turn and keeps re-entering the model's context. This module makes the
- * downgrade durable for images that can *never* be transmitted, so a rejected
- * upload cannot resurface after the user re-uploads a smaller version.
+ * downgrade durable: the oversized block is rewritten to its downscaled form,
+ * or to a text note when it cannot be shrunk on this host, so a rejected image
+ * cannot resurface and re-reject on every later turn.
  */
 
 import { optimizeImageForTransport } from "../agent/image-optimize.js";
@@ -40,19 +41,25 @@ export const UNSENDABLE_IMAGE_NOTE =
   "(An image was attached but could not be sent — its dimensions exceed the provider limit and automatic resize was not available. Please resize the image and try again.)";
 
 /**
- * True when a stored image block can never be transmitted to the provider: it
- * violates a provider hard limit (per-side pixel cap or payload size) and
- * cannot be shrunk to fit (re-optimization is a no-op).
+ * Replacement for an image that violates a provider hard limit (per-side pixel
+ * cap or payload size), or null when the image is within limits and should be
+ * left untouched. Gating on the provider hard caps is what keeps still-sendable
+ * images intact: a normally sized image is left alone rather than being noted or
+ * needlessly rewritten.
  *
- * Stored blocks are already post-optimization, so a block that is still
- * oversized here only stays oversized because resizing is unavailable on this
- * host (e.g. `sips` is absent off macOS, or the format is unsupported). A
- * downscalable image would have been reduced at upload time and would not reach
- * this predicate, so it is left untouched.
+ * An oversized image that can be shrunk is rewritten to its downscaled form; one
+ * that cannot be shrunk on this host (resize is a no-op, e.g. `sips` is absent
+ * off macOS or the format is unsupported) is replaced with a text note.
+ *
+ * Shared by the in-memory recovery transform and this durable persist pass so
+ * both apply the identical rule. Persisting the downscaled form is what lets a
+ * poisoned conversation durably self-heal — the latest tool-result media is kept
+ * in context, so without it the original oversized block rehydrates and
+ * re-rejects on every later turn.
  */
-function isImagePermanentlyUnsendable(
+export function oversizedImageReplacement(
   block: Extract<ContentBlock, { type: "image" }>,
-): boolean {
+): ContentBlock | null {
   const payloadBytes = block.source.data.length;
   const dims = parseImageDimensions(block.source.data, block.source.media_type);
   const exceedsDimensionCap =
@@ -60,24 +67,35 @@ function isImagePermanentlyUnsendable(
     (dims.width > PROVIDER_MAX_IMAGE_DIMENSION ||
       dims.height > PROVIDER_MAX_IMAGE_DIMENSION);
   const exceedsPayloadCap = payloadBytes > PROVIDER_MAX_IMAGE_PAYLOAD_BYTES;
-  if (!exceedsDimensionCap && !exceedsPayloadCap) return false;
+  if (!exceedsDimensionCap && !exceedsPayloadCap) return null;
 
   const optimized = optimizeImageForTransport(
     block.source.data,
     block.source.media_type,
   );
-  return optimized.data === block.source.data;
+  if (optimized.data !== block.source.data) {
+    return {
+      type: "image",
+      source: {
+        type: "base64",
+        media_type: optimized.mediaType,
+        data: optimized.data,
+      },
+    };
+  }
+  return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
 }
 
 /**
- * Rewrite every stored message in a conversation that holds a permanently
- * unsendable image, replacing those image blocks with {@link
- * UNSENDABLE_IMAGE_NOTE}. Reads stored content directly (not the in-memory,
- * injection-enriched copy) so injected prefixes and hydrated source paths are
- * never written back.
+ * Rewrite every stored message in a conversation that holds an oversized image
+ * the provider rejects — whether a top-level block or one nested in a
+ * tool_result's contentBlocks — replacing it with its downscaled form, or with
+ * {@link UNSENDABLE_IMAGE_NOTE} when it cannot be shrunk on this host. Reads
+ * stored content directly (not the in-memory, injection-enriched copy) so
+ * injected prefixes and hydrated source paths are never written back.
  *
- * Idempotent: once an image is replaced by the note there is no image block
- * left to match, so re-running is a no-op. Returns the number of rewritten
+ * Idempotent: a downscaled image is within limits and a note is no longer an
+ * image, so neither matches on a second run. Returns the number of rewritten
  * messages.
  */
 export function persistUnsendableImageDowngrades(
@@ -99,10 +117,29 @@ export function persistUnsendableImageDowngrades(
 
     let changed = false;
     const next = (parsed as ContentBlock[]).map((block): ContentBlock => {
-      if (block.type !== "image") return block;
-      if (!isImagePermanentlyUnsendable(block)) return block;
-      changed = true;
-      return { type: "text", text: UNSENDABLE_IMAGE_NOTE };
+      if (block.type === "image") {
+        const replacement = oversizedImageReplacement(block);
+        if (!replacement) return block;
+        changed = true;
+        return replacement;
+      }
+      // Images returned by a tool (e.g. browser_screenshot) live inside the
+      // tool_result's contentBlocks, not as top-level blocks. Downgrade them
+      // in place so the tool_use/tool_result pairing stays intact.
+      if (block.type === "tool_result" && block.contentBlocks?.length) {
+        let nestedChanged = false;
+        const contentBlocks = block.contentBlocks.map((cb): ContentBlock => {
+          if (cb.type !== "image") return cb;
+          const replacement = oversizedImageReplacement(cb);
+          if (!replacement) return cb;
+          nestedChanged = true;
+          return replacement;
+        });
+        if (!nestedChanged) return block;
+        changed = true;
+        return { ...block, contentBlocks };
+      }
+      return block;
     });
     if (!changed) continue;
 

package/src/daemon/process-message.ts

@@ -195,7 +195,7 @@ async function prepareConversationForMessage(
         "wiring in conversation-routes.ts into a shared helper.",
     );
   }
-  const sourceActorPrincipalId = conversation.trustContext?.guardianPrincipalId;
+  const sourceActorPrincipalId = conversation.authContext?.actorPrincipalId;
   // CU is per-conversation (owns step count, AX tree history, loop detection).
   if (
     shouldAttachHostProxyForCapability(