@yeaft/webchat-agent 0.1.804 → 0.1.808

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "0.1.804",
+  "version": "0.1.808",
   "description": "Remote agent for Yeaft WebChat — connects worker machines to the central server",
   "main": "index.js",
   "type": "module",

package/unify/conversation/persist.js

@@ -142,6 +142,33 @@ function serializeMessage(msg) {
     }
   }
 
+  // task-327d: persist Anthropic extended-thinking blocks so the next turn
+  // can echo them back with their server-signed signature. Both fields are
+  // base64'd: thinking is multi-line text, and the signature is opaque
+  // bytes that don't need to be human-readable. Without this round-trip
+  // the next Anthropic request 400s with "content[].thinking in the
+  // thinking mode must be passed back to the API".
+  if (msg.thinkingBlocks && msg.thinkingBlocks.length > 0) {
+    fm.push(`thinkingBlocks:`);
+    for (const tb of msg.thinkingBlocks) {
+      if (!tb || typeof tb.signature !== 'string' || !tb.signature) continue;
+      if (tb.redacted) {
+        if (typeof tb.data !== 'string') continue;
+        const dataB64 = Buffer.from(tb.data, 'utf8').toString('base64');
+        const signatureB64 = Buffer.from(tb.signature, 'utf8').toString('base64');
+        fm.push(`  - redacted: true`);
+        fm.push(`    dataB64: ${dataB64}`);
+        fm.push(`    signatureB64: ${signatureB64}`);
+      } else {
+        if (typeof tb.thinking !== 'string') continue;
+        const thinkingB64 = Buffer.from(tb.thinking, 'utf8').toString('base64');
+        const signatureB64 = Buffer.from(tb.signature, 'utf8').toString('base64');
+        fm.push(`  - thinkingB64: ${thinkingB64}`);
+        fm.push(`    signatureB64: ${signatureB64}`);
+      }
+    }
+  }
+
   fm.push('---');
   fm.push('');
   fm.push(content);
@@ -229,6 +256,44 @@ export function parseMessage(raw) {
     if (toolCalls.length > 0) msg.toolCalls = toolCalls;
   }
 
+  // task-327d: parse thinkingBlocks (mirror of toolCalls parser above)
+  if (frontmatter.includes('thinkingBlocks:')) {
+    const thinkingBlocks = [];
+    const tbMatch = frontmatter.match(/thinkingBlocks:\n((?:\s+-\s+[\s\S]*?)(?=\n\w|$))/);
+    if (tbMatch) {
+      const tbBlock = tbMatch[1];
+      const entries = tbBlock.split(/\n\s+-\s+/).filter(Boolean);
+      for (const entry of entries) {
+        const tb = {};
+        for (const line of entry.split('\n')) {
+          const trimmed = line.trim().replace(/^-\s+/, '');
+          const ci = trimmed.indexOf(':');
+          if (ci === -1) continue;
+          const k = trimmed.slice(0, ci).trim();
+          const v = trimmed.slice(ci + 1).trim();
+          if (k === 'thinkingB64') {
+            tb.thinking = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'dataB64') {
+            tb.data = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'signatureB64') {
+            tb.signature = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'redacted') {
+            tb.redacted = v === 'true';
+          }
+        }
+        // Both fields required — an unsigned block would 400 on replay.
+        if (tb.redacted) {
+          if (typeof tb.data === 'string' && typeof tb.signature === 'string' && tb.signature) {
+            thinkingBlocks.push(tb);
+          }
+        } else if (typeof tb.thinking === 'string' && typeof tb.signature === 'string' && tb.signature) {
+          thinkingBlocks.push(tb);
+        }
+      }
+    }
+    if (thinkingBlocks.length > 0) msg.thinkingBlocks = thinkingBlocks;
+  }
+
   return msg;
 }
 

package/unify/effort.js

@@ -13,7 +13,7 @@
  *   4. null (no effort = adapter/router drops the param)
  *
  * Red lines:
- *   • Never error on unknown scenario — default to 'high'.
+ *   • Never error on unknown scenario — default to 'max'.
  *   • Feature flag UNIFY_THINKING_V1 is enforced at the adapter/router
  *     layer; this module just computes the intended value. If the flag
  *     is off, adapters drop it anyway.
@@ -36,7 +36,8 @@ export const LONG_LOOP_TURN_THRESHOLD = 8;
  * a scenario string before invoking `pickEffort()`.
  *
  * Tiers (6 scenarios per architect spec):
- *   chat          → high   (default interactive pair-programming turn)
+ *   chat          → max    (default interactive pair-programming turn —
+ *                            quality over latency; per user 2026-05-22)
  *   consolidate   → max    (memory compaction — quality matters, runs once)
  *   dream         → max    (memory maintenance — same rationale)
  *   sub_agent     → max    (coordinator spawns + merges)
@@ -47,7 +48,7 @@ export const LONG_LOOP_TURN_THRESHOLD = 8;
  * Unknown scenarios fall through to 'high'.
  */
 export const SCENARIO_EFFORT = Object.freeze({
-  chat: 'high',
+  chat: 'max',
   consolidate: 'max',
   dream: 'max',
   sub_agent: 'max',
@@ -65,7 +66,7 @@ export const SCENARIO_EFFORT = Object.freeze({
  *      `/max` prefix, Settings slider, or API caller.
  *   2. If toolLoopTurns >= LONG_LOOP_TURN_THRESHOLD, upgrade the
  *      base scenario to 'long_loop' (→ 'max').
- *   3. Look up SCENARIO_EFFORT[scenario]; unknown → 'high'.
+ *   3. Look up SCENARIO_EFFORT[scenario]; unknown → 'max'.
  *
  * @param {object} ctx
  * @param {string} [ctx.scenario='chat'] — Scenario tag; see SCENARIO_EFFORT.
@@ -92,7 +93,7 @@ export function pickEffort({ scenario = 'chat', toolLoopTurns = 0, userEffort =
   }
 
   // 3. Scenario table lookup.
-  return SCENARIO_EFFORT[scenario] || 'high';
+  return SCENARIO_EFFORT[scenario] || 'max';
 }
 
 /**

package/unify/engine.js

@@ -35,7 +35,8 @@ import { runStopHooks } from './stop-hooks.js';
 // pass a real threadId per (groupId, vpId, threadId) engine instance.
 const MAIN_THREAD_ID = 'main';
 import { pickEffort, parseEffortPrefix } from './effort.js';
-import { normalizeEffort, resolveContextWindow } from './models.js';
+import { DEFAULT_CONTEXT_WINDOW, normalizeEffort, resolveContextWindow, resolveModel } from './models.js';
+import { countTurns } from './turn-utils.js';
 import { attachRouterPlan, extractPriorPlan, stripMetaForWire } from './router/continuity.js';
 import { resolveThinking } from './router/thinking.js';
 import { approxTokens } from './memory/budget.js';
@@ -161,6 +162,51 @@ export function estimateMessagesTokens(system, messages) {
   return total;
 }
 
+export const GROUP_CONTEXT_PRESSURE_RATIO = 0.8;
+export const GROUP_MIN_TURNS_FOR_COMPACT = 5;
+
+export function shouldAllowGroupReflection({
+  system = '',
+  messages = [],
+  model = null,
+  config = {},
+  groupId = null,
+} = {}) {
+  if (!groupId) {
+    return {
+      allowed: true,
+      compactAllowed: true,
+      tokenEstimate: estimateMessagesTokens(system, messages),
+      threshold: 0,
+      contextWindow: null,
+      ratio: GROUP_CONTEXT_PRESSURE_RATIO,
+      turnCount: countTurns(messages),
+      usedFallbackContextWindow: false,
+    };
+  }
+  const contextWindow = resolveContextWindow(model, config);
+  const hasRegistryContext = !!resolveModel(model)?.contextWindow;
+  const hasConfigContext = Number.isFinite(config?.maxContextTokens) && config.maxContextTokens > 0;
+  const threshold = Math.floor(contextWindow * GROUP_CONTEXT_PRESSURE_RATIO);
+  const tokenEstimate = estimateMessagesTokens(system, messages);
+  const overThreshold = tokenEstimate >= threshold;
+  const turnCount = countTurns(messages);
+  return {
+    // Group send defaults to no reflection. Trust the model until context
+    // pressure says we are near the model window.
+    allowed: overThreshold,
+    // Durable compact is also protected for tiny histories: fewer than five
+    // turns do not compact unless they already exceed the same 80% threshold.
+    compactAllowed: overThreshold || turnCount >= GROUP_MIN_TURNS_FOR_COMPACT,
+    tokenEstimate,
+    threshold,
+    contextWindow,
+    ratio: GROUP_CONTEXT_PRESSURE_RATIO,
+    turnCount,
+    usedFallbackContextWindow: !hasRegistryContext && !hasConfigContext && contextWindow === DEFAULT_CONTEXT_WINDOW,
+  };
+}
+
 // ─── Engine Events (superset of adapter events) ──────────────────
 
 /**
@@ -1024,10 +1070,30 @@ export class Engine {
     if (!Array.isArray(messages) || messages.length === 0) return null;
 
     const tokenCount = conversationStore.hotTokens();
+    const groupId = messages.find(m => m && typeof m.groupId === 'string' && m.groupId)?.groupId || null;
+    const groupContextGate = shouldAllowGroupReflection({
+      system: '',
+      messages,
+      model: this.#config.model,
+      config: this.#config,
+      groupId,
+    });
+    if (groupId && groupContextGate?.usedFallbackContextWindow) {
+      this.#trace.log?.('group_context_window_fallback', {
+        groupId,
+        model: this.#config.model,
+        contextWindow: groupContextGate.contextWindow,
+        threshold: groupContextGate.threshold,
+      });
+    }
+    if (groupId && !groupContextGate.compactAllowed) return null;
+
     const trig = evaluateCompactTriggers({
       messages,
       tokenCount,
       contextLimit: this.#config.maxContextTokens || 200000,
+      tokenRatio: groupId ? GROUP_CONTEXT_PRESSURE_RATIO : undefined,
+      maxMessages: groupId ? Number.POSITIVE_INFINITY : undefined,
     });
     if (!trig.trigger) return null;
 
@@ -1358,13 +1424,34 @@ export class Engine {
       { role: 'user', content: finalUserContent },
     ];
 
+    const groupReflectionGate = shouldAllowGroupReflection({
+      system: systemPrompt,
+      messages: conversationMessages,
+      model: this.#config.model,
+      config: this.#config,
+      groupId,
+    });
+    const groupReflectionAllowed = groupReflectionGate.allowed === true;
+    if (groupId && groupReflectionGate?.usedFallbackContextWindow) {
+      this.#trace.log?.('group_context_window_fallback', {
+        groupId,
+        model: this.#config.model,
+        contextWindow: groupReflectionGate.contextWindow,
+        threshold: groupReflectionGate.threshold,
+      });
+    }
+
     // PR-L: T2 carry-forward. If a previous query()'s end-of-turn
     // reflection has resolved, rewrite that turn's range in
     // `conversationMessages` to a single assistant reflection message.
     // If still pending, fall back to the exec-log stub — non-blocking,
     // never wait. This runs BEFORE the first adapter.stream so the
-    // upcoming call sees the rewritten history.
-    yield* this.#applyPendingT2Reflections(conversationMessages, prompt);
+    // upcoming call sees the rewritten history. Group send defaults to no
+    // reflection; only high context pressure (>=80% of model window)
+    // enables the carry-forward rewrite.
+    if (groupReflectionAllowed) {
+      yield* this.#applyPendingT2Reflections(conversationMessages, prompt);
+    }
 
     // PR-L: track this query()'s tool-arc for reflection.
     // `turnStartIdx` is where the current user message lives; the arc
@@ -1486,6 +1573,7 @@ export class Engine {
       let ttfbMs = null;  // Time to first token
       let responseText = '';
       const toolCalls = [];
+      const thinkingBlocks = []; // task-327d: collected from adapter for round-trip
       let stopReason = 'end_turn';
       const totalUsage = { inputTokens: 0, outputTokens: 0 };
       // task-344: capture redacted raw request / raw response for debug panel.
@@ -1660,6 +1748,22 @@ export class Engine {
             case 'thinking_delta':
               yield event;
               break;
+            case 'thinking_block_end':
+              // task-327d: collect server-signed thinking block for
+              // round-trip replay. Anthropic 400s the next turn if a
+              // thinking block (regular or redacted) was emitted but not
+              // echoed back with its original signature. Drop blocks
+              // missing a signature — replay-without-sig 400s identically.
+              if (event.signature) {
+                if (event.redacted) {
+                  thinkingBlocks.push({ redacted: true, data: event.data, signature: event.signature });
+                } else {
+                  thinkingBlocks.push({ thinking: event.thinking, signature: event.signature });
+                }
+              } else {
+                console.warn('[Engine] thinking block missing signature — dropping; next turn would 400 on replay');
+              }
+              break;
             case 'tool_call':
               toolCalls.push(event);
               yield event;
@@ -1843,6 +1947,17 @@ export class Engine {
           input: tc.input,
         }));
       }
+      // task-327d: persist thinking blocks for the next turn's replay.
+      // Anthropic requires assistant.thinking blocks to be echoed back
+      // verbatim (text + signature) when the previous turn used extended
+      // thinking — see translateMessages in anthropic.js.
+      if (thinkingBlocks.length > 0) {
+        assistantMsg.thinkingBlocks = thinkingBlocks.map(tb => (
+          tb.redacted
+            ? { redacted: true, data: tb.data, signature: tb.signature }
+            : { thinking: tb.thinking, signature: tb.signature }
+        ));
+      }
       // Phase 8 (DESIGN.md §9.15): carry the router plan back on the
       // assistant message that produced it. Stripped at the wire by
       // stripMetaForWire — pure bookkeeping for priorPlan continuity.
@@ -1994,7 +2109,7 @@ export class Engine {
         // tight-loop retries — but no collapse happened, so T2 should
         // still be allowed to fall back at end_turn. Fowler-review
         // critical finding.
-        if (queryToolCount > TURN_SUMMARY_THRESHOLD && t1CollapsesDone === 0) {
+        if (groupReflectionAllowed && queryToolCount > TURN_SUMMARY_THRESHOLD && t1CollapsesDone === 0) {
           const arcStart = turnStartIdx + 1;
           const arcEnd = conversationMessages.length - 1;
           if (arcEnd > arcStart) {
@@ -2275,7 +2390,7 @@ export class Engine {
       //     batch within the same query gets a distinct entry — without
       //     this the second batch would be silently skipped.
       const t1BatchDue = queryToolCount - lastT1AtToolCount >= TOOL_BATCH_SIZE;
-      if (t1BatchDue && !abortedDuringTools && !signal?.aborted) {
+      if (groupReflectionAllowed && t1BatchDue && !abortedDuringTools && !signal?.aborted) {
         const t1DedupKey = `${queryNumber}:t1:${queryToolCount}`;
         if (this.#reflectedTurns.has(t1DedupKey)) {
           // Defensive: should never hit since t1BatchDue gates re-entry

package/unify/groups/group-config.js

@@ -1,7 +1,7 @@
 /**
- * group-config.js — Per-group configuration overrides.
+ * group-config.js — Per-group selected model state.
  *
- * Each group may carry its own `config.json` at
+ * Each group may carry its header-selected model in `config.json` at
  *   ~/.yeaft/groups/<groupId>/config.json
  *
  * v1 schema (intentionally tiny — extend via additive keys only):
@@ -11,7 +11,7 @@
  *
  * Missing file → empty object. Missing field → fall back to user-level
  * config (`~/.yeaft/config.json` via loadConfig()). Resolution is a
- * shallow overlay (group fields override user fields when truthy).
+ * shallow overlay for send-time effective config.
  *
  * Storage layer only — no engine wiring, no validation of model strings
  * against the provider registry (that's done lazily at resolve time by
@@ -25,7 +25,7 @@ import { groupsRoot, resolveGroupYeaftDir } from './group-crud.js';
 
 const CONFIG_FILE = 'config.json';
 
-/** Whitelist of fields a group may override. Reject everything else. */
+/** Whitelist of persisted group model-state fields. Reject everything else. */
 const ALLOWED_KEYS = new Set(['model']);
 
 export class GroupConfigError extends Error {

package/unify/groups/group-crud.js

@@ -329,7 +329,7 @@ export function updateGroupAnnouncement(yeaftDir, groupId, text) {
 }
 
 /**
- * (A.2.c) Update per-group config overrides (v1: just `model`).
+ * (A.2.c) Persist the model selected in the group conversation header.
  * Returns the persisted config object so the caller can broadcast it.
  *
  * Throws GroupConfigError on validation failure (unknown key, bad type).

package/unify/history-compact.js

@@ -26,10 +26,12 @@
  *   4. Keep the last `keepRecent` user→assistant turns intact so the model
  *      has fresh, untransformed context for whatever the user just said.
  *
- * Triggers (any fires, but only above a 30K token soft floor):
- *   - tokens < 30_000 → never compact (cheap chat, no point paying
+ * Triggers:
+ *   - tokens < 12_000 → never compact (cheap chat, no point paying
  *     the summarizer)
- *   - tokens > 40 % of `maxContextTokens` (defaults to 200K → 80K)
+ *   - fewer than 5 turns → do not compact unless context pressure is
+ *     already high
+ *   - tokens > 80 % of `maxContextTokens` (defaults to 200K → 160K)
  *   - tokens > 200,000 hard ceiling
  *
  * The "turn > 20" trigger that an earlier revision used was dropped:
@@ -72,8 +74,10 @@ export const countTurns = countTurnsImpl;
  *     cost; the LLM hasn't started feeling the context yet either),
  *   - otherwise compact if ANY of:
  *       turnCount > 30           (back-stop for chats with many small turns)
- *       tokens > 40 % of `maxContextTokens` (default 200K → 80K)
+ *       tokens > 80 % of `maxContextTokens` (default 200K → 160K)
  *       tokens > 200K hard ceiling
+ *     Fewer than 5 turns are protected from compact unless the token
+ *     threshold is already crossed.
  *
  * Lowered from 30K → 12K and re-enabled a turn-count back-stop because
  * the previous "soft floor of 30K, no turn cap" combination is dead in
@@ -93,11 +97,13 @@ export const countTurns = countTurnsImpl;
 export const DEFAULT_TURN_LIMIT = 30;
 export const DEFAULT_MIN_TOKEN_FLOOR = 12_000;
 export const DEFAULT_MAX_CONTEXT_TOKENS = 200_000;
-export const DEFAULT_TOKEN_FRACTION = 0.4;
+export const DEFAULT_TOKEN_FRACTION = 0.8;
 export const DEFAULT_HARD_TOKEN_CEILING = 200_000;
+export const DEFAULT_MIN_TURNS_FOR_COMPACT = 5;
+export const DEFAULT_KEEP_TOOL_TURNS = 3;
 /**
  * Effective default token trigger when no `maxContextTokens` is provided:
- *   min(40% of 200K, 200K) = 80K. Preserved as `DEFAULT_TOKEN_LIMIT` for
+ *   min(80% of 200K, 200K) = 160K. Preserved as `DEFAULT_TOKEN_LIMIT` for
  *   back-compat with existing tests that import this name.
  */
 export const DEFAULT_TOKEN_LIMIT = Math.min(
@@ -183,12 +189,13 @@ export function estimateMessagesTokens(messages) {
  * Pure trigger evaluator. Decides whether the in-memory history needs
  * compaction. No I/O, no LLM call.
  *
- * Policy (2026-05-01):
- *   1. tokens < `minTokenFloor` (default 30K) → trigger=false (always).
- *   2. otherwise trigger if ANY of:
- *        turnCount > turnLimit (default Infinity → effectively off;
- *           callers can pin a number to re-enable a turn-count trigger)
- *        tokenCount > maxContextTokens*fraction (reason='token_threshold')
+ * Policy (2026-05-22):
+ *   1. tokens < `minTokenFloor` (default 12K) → trigger=false (always).
+ *   2. fewer than `minTurnsForCompact` turns (default 5) → trigger=false
+ *      unless tokenCount already exceeds the fractional context threshold.
+ *   3. otherwise trigger if ANY of:
+ *        turnCount > turnLimit (default 30 back-stop)
+ *        tokenCount > maxContextTokens*fraction (default 80%, reason='token_threshold')
  *        tokenCount > hardTokenCeiling          (reason='token_ceiling')
  *
  * `tokenLimit` is preserved as a back-compat override for callers /
@@ -198,6 +205,7 @@ export function estimateMessagesTokens(messages) {
  * @param {Array<object>} messages
  * @param {{
  *   turnLimit?: number,
+ *   minTurnsForCompact?: number,
  *   tokenLimit?: number,
  *   minTokenFloor?: number,
  *   maxContextTokens?: number,
@@ -206,7 +214,7 @@ export function estimateMessagesTokens(messages) {
  * }} [opts]
  * @returns {{trigger: boolean, reason: 'turn_count'|'token_threshold'|'token_ceiling'|null,
  *            turnCount: number, tokenCount: number,
- *            turnLimit: number, tokenLimit: number,
+ *            turnLimit: number, tokenLimit: number, minTurnsForCompact: number,
  *            minTokenFloor: number, hardTokenCeiling: number}}
  */
 export function shouldCompactHistory(messages, opts = {}) {
@@ -215,6 +223,7 @@ export function shouldCompactHistory(messages, opts = {}) {
   const hardTokenCeiling = opts.hardTokenCeiling ?? DEFAULT_HARD_TOKEN_CEILING;
   const maxContextTokens = opts.maxContextTokens ?? DEFAULT_MAX_CONTEXT_TOKENS;
   const tokenFraction = opts.tokenFraction ?? DEFAULT_TOKEN_FRACTION;
+  const minTurnsForCompact = opts.minTurnsForCompact ?? DEFAULT_MIN_TURNS_FOR_COMPACT;
   // tokenLimit override wins; otherwise compute fractional threshold.
   const tokenLimit =
     opts.tokenLimit
@@ -225,7 +234,9 @@ export function shouldCompactHistory(messages, opts = {}) {
 
   let reason = null;
   // (1) Soft floor: never compact small conversations.
-  if (tokenCount < minTokenFloor) {
+  // (2) Short-history guard: fewer than five turns should not compact unless
+  //     the estimated prompt is already at the context-pressure threshold.
+  if (tokenCount < minTokenFloor || (turnCount < minTurnsForCompact && tokenCount < tokenLimit)) {
     return {
       trigger: false,
       reason: null,
@@ -233,6 +244,7 @@ export function shouldCompactHistory(messages, opts = {}) {
       tokenCount,
       turnLimit,
       tokenLimit,
+      minTurnsForCompact,
       minTokenFloor,
       hardTokenCeiling,
     };
@@ -240,7 +252,7 @@ export function shouldCompactHistory(messages, opts = {}) {
   // (2) Trigger evaluation. Turn check is opt-in (Infinity by default).
   if (Number.isFinite(turnLimit) && turnCount > turnLimit) reason = 'turn_count';
   else if (tokenCount > hardTokenCeiling) reason = 'token_ceiling';
-  else if (tokenCount > tokenLimit) reason = 'token_threshold';
+  else if (tokenCount >= tokenLimit) reason = 'token_threshold';
 
   return {
     trigger: reason !== null,
@@ -249,11 +261,71 @@ export function shouldCompactHistory(messages, opts = {}) {
     tokenCount,
     turnLimit,
     tokenLimit,
+    minTurnsForCompact,
     minTokenFloor,
     hardTokenCeiling,
   };
 }
 
+function hasContentAfterToolStrip(content) {
+  if (typeof content === 'string') return content.trim().length > 0;
+  if (Array.isArray(content)) return content.length > 0;
+  return content != null;
+}
+
+function stripToolContentParts(content) {
+  if (!Array.isArray(content)) return content;
+  return content.filter(part => {
+    if (!part || typeof part !== 'object') return true;
+    return part.type !== 'tool_use'
+      && part.type !== 'tool_result'
+      && part.type !== 'function_call'
+      && part.type !== 'function_call_output';
+  });
+}
+
+/**
+ * Remove tool-call / tool-result noise from turns older than the recent
+ * lossless window. The last `keepToolTurns` turns keep their full tool
+ * chains; older turns keep user/assistant text but lose `toolCalls`,
+ * Anthropic/OpenAI tool content blocks, and `role:'tool'` messages.
+ *
+ * This is deliberately a wire-history transform, not a summarizer: it
+ * never invents a summary and it never mutates input. Pair-sanitize runs
+ * afterwards so no orphan tool_use/tool_result can survive.
+ *
+ * @param {Array<object>} messages
+ * @param {{ keepToolTurns?: number }} [opts]
+ * @returns {Array<object>}
+ */
+export function stripToolNoiseFromOlderTurns(messages, opts = {}) {
+  if (!Array.isArray(messages) || messages.length === 0) return [];
+  const keepToolTurns = Number.isFinite(opts.keepToolTurns) && opts.keepToolTurns >= 0
+    ? opts.keepToolTurns
+    : DEFAULT_KEEP_TOOL_TURNS;
+  const cutIdx = indexOfNthTurnFromEnd(messages, keepToolTurns);
+  if (cutIdx <= 0) return messages.map(m => ({ ...m }));
+
+  const older = messages.slice(0, cutIdx);
+  const recent = messages.slice(cutIdx);
+  const cleanedOlder = [];
+
+  for (const m of older) {
+    if (!m || typeof m !== 'object') continue;
+    if (m.role === 'tool') continue;
+
+    const next = { ...m };
+    if (Array.isArray(next.toolCalls)) delete next.toolCalls;
+    if (Array.isArray(next.content)) next.content = stripToolContentParts(next.content);
+
+    if (next.role === 'assistant' && !hasContentAfterToolStrip(next.content)) continue;
+    if (next.role === 'user' && Array.isArray(next.content) && next.content.length === 0) continue;
+    cleanedOlder.push(next);
+  }
+
+  return [...cleanedOlder, ...recent.map(m => ({ ...m }))];
+}
+
 /**
  * Strip noise from a message list before sending it to the summarizer:
  *   - drop `role: 'tool'` (raw tool results — too verbose, mostly redundant)
@@ -442,6 +514,7 @@ export async function compactHistory(messages, options) {
     maxContextTokens,
     tokenFraction,
     hardTokenCeiling,
+    minTurnsForCompact: options?.minTurnsForCompact,
   };
   const before = shouldCompactHistory(messages, triggerOpts);
   if (!before.trigger) {
@@ -581,7 +654,7 @@ export async function compactHistory(messages, options) {
  * between trim (per-call) and compact (global) explicit.
  *
  * @param {Array<object>} snapshot
- * @param {{ messageTokenBudget?: number, recentTurnCap?: number }} [opts]
+ * @param {{ messageTokenBudget?: number, recentTurnCap?: number, keepToolTurns?: number }} [opts]
  * @returns {Array<object>}
  */
 export function trimSnapshotForBudget(snapshot, opts = {}) {
@@ -607,6 +680,12 @@ export function trimSnapshotForBudget(snapshot, opts = {}) {
     tokens = estimateMessagesTokens(trimmed);
   }
 
-  // Stage 3: pair-sanitize to drop orphan tool_use/tool_result.
+  // Stage 3: keep only the recent tool chains lossless. Older turns
+  // retain text but drop tool_use/tool_result noise before pair safety.
+  trimmed = stripToolNoiseFromOlderTurns(trimmed, {
+    keepToolTurns: opts.keepToolTurns,
+  });
+
+  // Stage 4: pair-sanitize to drop orphan tool_use/tool_result.
   return pairSanitize(trimmed);
 }

package/unify/llm/adapter.js

@@ -40,20 +40,23 @@
 /**
  * @typedef {{ type: 'text_delta', text: string }} TextDeltaEvent
  * @typedef {{ type: 'thinking_delta', text: string }} ThinkingDeltaEvent
+ * @typedef {{ type: 'thinking_block_end', thinking: string, signature: string }} ThinkingBlockEndEvent
  * @typedef {{ type: 'tool_call', id: string, name: string, input: object }} ToolCallEvent
  * @typedef {{ type: 'usage', inputTokens: number, outputTokens: number, cacheReadTokens?: number, cacheWriteTokens?: number }} UsageEvent
  * @typedef {{ type: 'stop', stopReason: 'end_turn' | 'tool_use' | 'max_tokens' }} StopEvent
  * @typedef {{ type: 'error', error: Error, retryable: boolean }} ErrorEvent
  *
- * @typedef {TextDeltaEvent | ThinkingDeltaEvent | ToolCallEvent | UsageEvent | StopEvent | ErrorEvent} StreamEvent
+ * @typedef {TextDeltaEvent | ThinkingDeltaEvent | ThinkingBlockEndEvent | ToolCallEvent | UsageEvent | StopEvent | ErrorEvent} StreamEvent
  */
 
 // ─── Unified Message Types ─────────────────────────────────────
 
 /**
+ * @typedef {{ thinking: string, signature: string }} ThinkingBlock
+ *
  * @typedef {{ role: 'system', content: string }} SystemMessage
  * @typedef {{ role: 'user', content: string }} UserMessage
- * @typedef {{ role: 'assistant', content: string, toolCalls?: UnifiedToolCall[] }} AssistantMessage
+ * @typedef {{ role: 'assistant', content: string, toolCalls?: UnifiedToolCall[], thinkingBlocks?: ThinkingBlock[] }} AssistantMessage
  * @typedef {{ role: 'tool', toolCallId: string, content: string, isError?: boolean }} ToolMessage
  *
  * @typedef {SystemMessage | UserMessage | AssistantMessage | ToolMessage} UnifiedMessage

package/unify/llm/anthropic.js

@@ -73,6 +73,24 @@ export class AnthropicAdapter extends LLMAdapter {
         result.push({ role: 'user', content: msg.content });
       } else if (msg.role === 'assistant') {
         const content = [];
+        // task-327d: Anthropic requires thinking blocks to appear BEFORE
+        // any text / tool_use in the content array on echo-back. When the
+        // previous turn produced thinking blocks (with server-signed
+        // signature), we MUST replay them verbatim or the next request
+        // 400s with "content[].thinking in the thinking mode must be
+        // passed back to the API". Order is mandatory.
+        if (Array.isArray(msg.thinkingBlocks)) {
+          for (const tb of msg.thinkingBlocks) {
+            if (!tb || typeof tb.signature !== 'string' || !tb.signature) continue;
+            if (tb.redacted) {
+              if (typeof tb.data !== 'string') continue;
+              content.push({ type: 'redacted_thinking', data: tb.data, signature: tb.signature });
+            } else {
+              if (typeof tb.thinking !== 'string') continue;
+              content.push({ type: 'thinking', thinking: tb.thinking, signature: tb.signature });
+            }
+          }
+        }
         if (msg.content) {
           content.push({ type: 'text', text: msg.content });
         }
@@ -216,9 +234,16 @@ export class AnthropicAdapter extends LLMAdapter {
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
     let buffer = '';
-    let currentToolCallId = null;
-    let currentToolName = null;
-    let currentToolInput = '';
+    // task-327d: index-keyed per-block state. Anthropic streams content
+    // blocks sequentially today, but the protocol exposes `event.index`
+    // precisely because that's not guaranteed. Dispatch in
+    // content_block_stop must look up by index, never "whichever scalar
+    // happens to still be set." States by kind: 'tool_use', 'thinking',
+    // 'redacted_thinking'. Redacted blocks carry opaque `data` instead
+    // of `thinking` text but share the same echo-back rule (drop without
+    // signature → next turn 400s identically).
+    /** @type {Map<number, { kind: string, [k: string]: any }>} */
+    const blockByIndex = new Map();
     // Accumulate raw SSE body verbatim for the debug panel. No truncation:
     // see `redactRawRequest` in adapter.js for the verbatim-design rationale.
     // Push-then-join keeps allocation bounded for multi-MiB payloads (avoids
@@ -254,38 +279,90 @@ export class AnthropicAdapter extends LLMAdapter {
 
           if (type === 'content_block_start') {
             const block = event.content_block;
+            const idx = event.index;
             if (block?.type === 'tool_use') {
-              currentToolCallId = block.id;
-              currentToolName = block.name;
-              currentToolInput = '';
+              blockByIndex.set(idx, {
+                kind: 'tool_use',
+                id: block.id,
+                name: block.name,
+                input: '',
+              });
+            } else if (block?.type === 'thinking') {
+              blockByIndex.set(idx, {
+                kind: 'thinking',
+                thinking: typeof block.thinking === 'string' ? block.thinking : '',
+                signature: typeof block.signature === 'string' ? block.signature : '',
+              });
+            } else if (block?.type === 'redacted_thinking') {
+              // task-327d: API-redacted thinking. Body is opaque `data`
+              // (server-encrypted, not user-readable); we still need to
+              // echo it back with signature on the next turn or the API
+              // 400s with the same "must be passed back" error.
+              blockByIndex.set(idx, {
+                kind: 'redacted_thinking',
+                data: typeof block.data === 'string' ? block.data : '',
+                signature: typeof block.signature === 'string' ? block.signature : '',
+              });
             }
           } else if (type === 'content_block_delta') {
             const delta = event.delta;
+            const idx = event.index;
+            const st = blockByIndex.get(idx);
             if (delta?.type === 'text_delta') {
               yield { type: 'text_delta', text: delta.text };
             } else if (delta?.type === 'thinking_delta') {
+              // Forward delta for live UI; ALSO accumulate for round-trip.
+              if (st && st.kind === 'thinking') st.thinking += delta.thinking || '';
               yield { type: 'thinking_delta', text: delta.thinking };
+            } else if (delta?.type === 'signature_delta') {
+              // Anthropic typically sends signature in one delta near the
+              // end of the (redacted_)thinking block. Accumulate defensively.
+              if (st && (st.kind === 'thinking' || st.kind === 'redacted_thinking')) {
+                st.signature += delta.signature || '';
+              }
             } else if (delta?.type === 'input_json_delta') {
-              currentToolInput += delta.partial_json;
+              if (st && st.kind === 'tool_use') st.input += delta.partial_json;
             }
           } else if (type === 'content_block_stop') {
-            if (currentToolCallId) {
+            const idx = event.index;
+            const st = blockByIndex.get(idx);
+            if (!st) {
+              // Unknown / unhandled block kind (e.g. text — we don't track
+              // text state because text_delta is forwarded immediately).
+            } else if (st.kind === 'tool_use') {
               let parsedInput = {};
               try {
-                parsedInput = currentToolInput ? JSON.parse(currentToolInput) : {};
+                parsedInput = st.input ? JSON.parse(st.input) : {};
               } catch {
                 parsedInput = {};
               }
               yield {
                 type: 'tool_call',
-                id: currentToolCallId,
-                name: currentToolName,
+                id: st.id,
+                name: st.name,
                 input: parsedInput,
               };
-              currentToolCallId = null;
-              currentToolName = null;
-              currentToolInput = '';
+            } else if (st.kind === 'thinking' || st.kind === 'redacted_thinking') {
+              // task-327d: emit ONE end-of-block event with the assembled
+              // payload + signature. Engine collects these for replay.
+              // We emit even when signature is empty so engine can
+              // warn-and-drop; replaying without signature would 400.
+              if (st.kind === 'thinking') {
+                yield {
+                  type: 'thinking_block_end',
+                  thinking: st.thinking,
+                  signature: st.signature,
+                };
+              } else {
+                yield {
+                  type: 'thinking_block_end',
+                  redacted: true,
+                  data: st.data,
+                  signature: st.signature,
+                };
+              }
             }
+            blockByIndex.delete(idx);
           } else if (type === 'message_delta') {
             const stopReason = event.delta?.stop_reason;
             if (stopReason) {

package/unify/turn-utils.js

@@ -45,6 +45,17 @@ export function stripVpMentionPrefix(content) {
   return content.replace(/^@vp-[A-Za-z0-9_-]+\s+/, '');
 }
 
+function canonicalUserTurnContent(content) {
+  if (typeof content === 'string') return stripVpMentionPrefix(content);
+  if (!Array.isArray(content)) return null;
+  const text = content
+    .filter(part => part && typeof part === 'object' && part.type === 'text')
+    .map(part => typeof part.text === 'string' ? part.text : '')
+    .join('\n')
+    .trim();
+  return text ? stripVpMentionPrefix(text) : null;
+}
+
 /**
  * Count "turns" — distinct user prompts after `@vp-X` collapsing.
  *
@@ -62,7 +73,8 @@ export function countTurns(messages) {
   let prev = null;
   for (const m of messages) {
     if (!m || m.role !== 'user') continue;
-    const canonical = stripVpMentionPrefix(m.content || '');
+    const canonical = canonicalUserTurnContent(m.content);
+    if (canonical == null) continue;
     if (canonical !== prev) {
       n++;
       prev = canonical;
@@ -101,7 +113,8 @@ export function indexOfNthTurnFromEnd(messages, n) {
   let candidate = -1;
   for (let i = messages.length - 1; i >= 0; i--) {
     if (!messages[i] || messages[i].role !== 'user') continue;
-    const canonical = stripVpMentionPrefix(messages[i].content || '');
+    const canonical = canonicalUserTurnContent(messages[i].content);
+    if (canonical == null) continue;
     if (canonical !== openCanonical) {
       // Boundary: a new (older) turn starts here.
       turnsFromEnd++;

package/unify/vp/seed-topup.js

@@ -3,17 +3,17 @@
  *
  * Problem: `seedDefaultVps` is first-run-only — once the library has any VP
  * in it, that function never runs again. When we expanded the default roster
- * from 12 to 32 (philosophy, psychology, strategy, history, investing,
- * business, writing, science, arts), existing installs would never see the
- * 20 new VPs without either (a) the user manually deleting their library or
+ * from 12 to 33 (philosophy, psychology, strategy, history, investing,
+ * business, writing, science, arts, Omni), existing installs would never see the
+ * new VPs without either (a) the user manually deleting their library or
  * (b) a forced overwrite that would clobber their hand edits.
  *
  * This module runs on every agent start alongside `seedDefaultVps` and does
  * two minimal, additive things:
  *
- *   1. **Top-up missing default VPs**. If a vpId from `DEFAULT_VPS` is not
- *      on disk AND the user has not explicitly deleted it before (tracked
- *      via `<libDir>/.seeded-versions.json`), `createVp()` it.
+ *   1. **Top-up missing stock VPs**. If a vpId from `DEFAULT_VPS` is not
+ *      on disk, `createVp()` it. This keeps product-owned defaults such as
+ *      Omni and the expanded role roster visible in group/member pickers.
  *
  *   2. **Backfill the `area` frontmatter line** on existing seeded VPs whose
  *      role.md predates the area field. The body is left BYTE-IDENTICAL —
@@ -24,9 +24,9 @@
  * Hard rules:
  *   - **Never** overwrite a VP that is on disk. The user might have edited
  *     persona/role/traits; that is their truth, not ours.
- *   - **Never** recreate a VP the user has deleted. The seed-versions file
- *     remembers "we have seeded this before" — if it's gone now, the user
- *     wants it gone.
+ *   - **Keep stock defaults available.** If a shipped stock VP is missing,
+ *     recreate it, but never overwrite an on-disk VP. The group/member picker
+ *     depends on these product-owned defaults being present.
  *   - Best-effort: any failure is logged, never thrown.
  *
  * Pre-ledger deletion caveat: on the very first top-up against an existing
@@ -34,8 +34,8 @@
  * deleted VP X before the expansion landed" from "X was never seeded." The
  * bootstrap records only on-disk ids as `legacy`; an id the user had deleted
  * BEFORE this code shipped looks identical to a brand-new default and will
- * be recreated once. After that single bootstrap event the ledger is
- * authoritative — any subsequent delete is permanent.
+ * be recreated once. Stock defaults remain authoritative product entries and
+ * may be recreated later if missing; existing files are still never overwritten.
  *
  * Sidecar file: `<libDir>/.seeded-versions.json`
  *
@@ -56,6 +56,7 @@ import { join } from 'path';
 import { createVp, VpCrudError } from './vp-crud.js';
 import { DEFAULT_VP_LIB_DIR, personaHash } from './vp-store.js';
 import { DEFAULT_VPS } from './seed-defaults.js';
+import { STOCK_VP_IDS } from './stock-ids.js';
 
 const SEEDED_VERSIONS_FILE = '.seeded-versions.json';
 const SEEDED_VERSIONS_VERSION = 1;
@@ -319,13 +320,17 @@ export function topUpDefaultVps(libDir = DEFAULT_VP_LIB_DIR) {
       continue;
     }
 
-    if (inLedger) {
-      // We seeded this before, user has since deleted it — respect that.
+    if (inLedger && !STOCK_VP_IDS.has(vpId)) {
+      // We seeded this custom/default VP before, user has since deleted it — respect that.
+      // Stock/default personas are product-owned roster entries and must remain
+      // available in group creation/member pickers after migrations. Recreate
+      // them below without overwriting anything that exists on disk.
       respectedDeletes.push(vpId);
       continue;
     }
 
-    // Missing on disk and never seeded — create it.
+    // Missing on disk and never seeded — or a missing stock VP that must remain available.
+
     try {
       createVp(vp, { libDir });
       versions.seeded[vpId] = personaHash(vp.persona);

package/unify/web-bridge.js

@@ -1416,12 +1416,12 @@ export function handleUnifyUpdateGroup(msg) {
 }
 
 /**
- * Update per-group config overrides (v1: `model`). Cache invalidation:
+ * Persist the model selected in the group conversation header. Cache invalidation:
  * drop every cached Engine whose key starts with `${groupId}::` so the
  * next turn picks up the new model. The group meta itself is untouched.
  *
  * Payload: { groupId, requestId, config: { model?: string|null } }
- *  - `model: ''` or `null` clears the override (group falls back to user default).
+ *  - `model: ''` or `null` clears the selected group model (falls back to user default).
  */
 export function handleUnifyUpdateGroupConfig(msg) {
   const requestId = msg && msg.requestId;
@@ -1651,7 +1651,7 @@ function maybeTransitionVpStatus(hctx, state) {
  * todos, debug cards, and persistence all share the same boundary.
  *
  * @param {object} event — engine event (text_delta / tool_call / …)
- * @param {{assistantTextParts:string[], toolCallsAccum:Array, toolResultsAccum:Array, resetQueryTimer:Function, groupId?:string, vpId?:string, turnId?:string}} hctx
+ * @param {{assistantTextParts:string[], toolCallsAccum:Array, toolResultsAccum:Array, thinkingBlocksAccum?:Array, resetQueryTimer:Function, groupId?:string, vpId?:string, turnId?:string}} hctx
  */
 function handleEngineEvent(event, hctx) {
   hctx.resetQueryTimer();
@@ -1679,6 +1679,30 @@ function handleEngineEvent(event, hctx) {
       sendUnifyEvent({ type: 'thinking_delta', text: event.text }, envelope);
       break;
 
+    case 'thinking_block_end':
+      // task-327d: capture the assembled thinking block (with server-
+      // signed signature) so the group history we hand to subsequent
+      // turns / VPs includes it. Without this echo Anthropic 400s the
+      // next request with "content[].thinking in the thinking mode must
+      // be passed back to the API". The signature stays server-side
+      // only — wire serializers (stripMetaForWire / sendUnifyOutput)
+      // never reference thinkingBlocks, so it cannot leak to the UI.
+      if (hctx.thinkingBlocksAccum && event.signature) {
+        if (event.redacted) {
+          hctx.thinkingBlocksAccum.push({
+            redacted: true,
+            data: event.data,
+            signature: event.signature,
+          });
+        } else {
+          hctx.thinkingBlocksAccum.push({
+            thinking: event.thinking,
+            signature: event.signature,
+          });
+        }
+      }
+      break;
+
     case 'tool_call':
       // Capture tool_call for the assistant message's toolCalls array so
       // the next turn's history pairs `tool_calls` with `role:'tool'`
@@ -2534,6 +2558,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
       const assistantTextParts = [];
       const toolCallsAccum = [];
       const toolResultsAccum = [];
+      const thinkingBlocksAccum = []; // task-327d: round-trip to next turn
       const appendedUserPrompts = [];
       let vpEngine = null;
 
@@ -2559,6 +2584,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
         assistantTextParts,
         toolCallsAccum,
         toolResultsAccum,
+        thinkingBlocksAccum,
         resetQueryTimer,
         groupId,
         vpId,
@@ -2599,7 +2625,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
       }
 
       // Turn completed — atomically append this VP's output to shared history.
-      appendTurnToGroupHistory(groupId, threadId, [prompt, ...appendedUserPrompts], assistantTextParts, toolCallsAccum, toolResultsAccum);
+      appendTurnToGroupHistory(groupId, threadId, [prompt, ...appendedUserPrompts], assistantTextParts, toolCallsAccum, toolResultsAccum, thinkingBlocksAccum);
 
       sendUnifyOutput({
         type: 'assistant',
@@ -2705,7 +2731,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
  * a session, this in-memory tape carries the un-collapsed form — which
  * is fine because each VP turn's `engine.query` re-collapses on the fly.
  */
-function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts, toolCallsAccum, toolResultsAccum) {
+function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts, toolCallsAccum, toolResultsAccum, thinkingBlocksAccum) {
   if (!groupId) return;
   const history = getOrCreateGroupHistory(groupId);
   const promptList = Array.isArray(prompts) ? prompts : [prompts];
@@ -2725,6 +2751,18 @@ function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts
         input: tc.input,
       }));
     }
+    // task-327d: carry thinking blocks across turns. Anthropic protocol
+    // requires us to echo them back on the next request or the API
+    // returns "content[].thinking in the thinking mode must be passed
+    // back to the API". The signature is server-private — it stays in
+    // this in-memory history and in agent-side persistence only.
+    if (Array.isArray(thinkingBlocksAccum) && thinkingBlocksAccum.length > 0) {
+      assistantMsg.thinkingBlocks = thinkingBlocksAccum.map(tb => (
+        tb.redacted
+          ? { redacted: true, data: tb.data, signature: tb.signature }
+          : { thinking: tb.thinking, signature: tb.signature }
+      ));
+    }
     history.push(assistantMsg);
 
     for (const tr of toolResultsAccum) {