Prepend the secret scrub and result cap so short-circuiting plugins can't skip them

composeMiddleware wraps outer-to-inner in array order, so a plugin
positioned earlier in buildCorePosixToolPlugins still sees a call's
final result even when a later plugin (ripgrepPlugin) answers
directly without invoking its own next(). Move
toolResultSecretScrubPlugin and resultTruncationPlugin to the front
of the array so both are unconditional outer wrappers around the
entire chain, mirroring how vendor/intx-inference/src/assembly.ts
hardcodes its size-cap transform as the first, mandatory element
rather than trusting every middleware author to call next().

This closes CL-5717: grep output (and anything else a future plugin
answers without delegating) is now capped and scrubbed regardless of
where in the chain it short-circuits.

Author: TheGreatAxios

src/agent/posix-tool-plugins.ts

@@ -35,8 +35,18 @@ export type CorePosixToolPluginsArgs = {
 };
 
 // Middleware order matches docs/ARCHITECTURE.md: path escape through truncation,
-// with shell-guard after permission so blocked commands never spawn. Secret-shaped
-// result scrub runs immediately before truncation so credentials are redacted first.
+// with shell-guard after permission so blocked commands never spawn.
+//
+// The secret scrub and the character cap are prepended unconditionally, ahead
+// of every other plugin, rather than left in call order. composeMiddleware
+// wraps outer-to-inner in array order, so a plugin earlier in this array
+// still observes the final result even when a later plugin (ripgrepPlugin,
+// notably) answers a call directly without invoking its own `next()` and so
+// never reaches whatever sits after it. A mandatory terminal concern like
+// redacting a credential cannot depend on every middleware author remembering
+// to call `next()` — see vendor/intx-inference/src/assembly.ts's
+// sizeCapTransform for the same reasoning upstream. Scrub sits outermost so it
+// runs on the already-capped content, matching the previous in-chain order.
 export function buildCorePosixToolPlugins(args: CorePosixToolPluginsArgs): ToolPlugin[] {
   const {
     cwd,
@@ -47,6 +57,8 @@ export function buildCorePosixToolPlugins(args: CorePosixToolPluginsArgs): ToolP
     shellEnv,
   } = args;
   return [
+    toolResultSecretScrubPlugin(),
+    resultTruncationPlugin(),
     pathEscapePlugin(cwd, createWorktreeRootsProvider(cwd)),
     deleteFilePlugin(cwd),
     toolOutputUriPlugin(),
@@ -65,8 +77,6 @@ export function buildCorePosixToolPlugins(args: CorePosixToolPluginsArgs): ToolP
     editFileDiagnosticsPlugin(),
     lspHintPlugin(),
     createLSPPlugin({ cwd, minSeverity: 1 }),
-    toolResultSecretScrubPlugin(),
-    resultTruncationPlugin(),
     ...extraToolPlugins,
   ];
 }

src/plugins/result-truncation-plugin.ts

@@ -9,9 +9,10 @@ export const MAX_RESULT_CHARS = 80_000;
 // The single primitive for size truncation: callers may pass their own
 // threshold but never invent their own wording, so a result can never carry
 // two differently-worded "truncated" notices. Called directly by runners this
-// middleware does not wrap — the MCP tool runner (src/mcp/plugin.ts), and
-// ripgrep-plugin.ts, which answers grep without calling next and so never
-// reaches this middleware despite sitting earlier in the same plugin array.
+// middleware does not wrap — the MCP tool runner (src/mcp/plugin.ts). The
+// posix chain gets this middleware prepended unconditionally in
+// posix-tool-plugins.ts, so plugins like ripgrepPlugin that answer without
+// calling next() no longer need to apply the cap themselves.
 export function truncateToolResultContent(
   content: string,
   maxChars: number = MAX_RESULT_CHARS,