@akagilnc/pi-workflow-roles 0.1.4035 → 0.1.4062

package/src/gatekeeper-role.ts

@@ -86,18 +86,30 @@ export type GateOfficerSummon = (
    * conclusion (#753 / #756). Hosted as same-ticket resume instruction.
    */
   reask?: string,
+  /**
+   * In-flight parent 交卷 body (tool-call arguments). Production default relays
+   * it verbatim on the officer dialogue content channel (#786 / #879).
+   * Identity-bound at the submit site — never recovered as latest toolCall.
+   */
+  submission?: unknown,
 ) => Promise<PublicSummonResult>;
 
 export type RunGatekeeperOptions = {
   readonly context: ExtensionContext | HostContext;
   readonly subject: GatekeeperSubject;
   readonly signal?: AbortSignal;
-  /** Run directory of the parent role (pointer-only summons, ADR 0079). */
+  /** Run directory of the parent role (binding pointer, ADR 0079 / #879). */
   readonly runDirectory?: string;
   /**
    * Plain-language re-ask for this summon (resume speaker after non-three-state).
    */
   readonly reask?: string;
+  /**
+   * In-flight parent typed payload for this gate turn. Relayed verbatim as
+   * officer dialogue content (#879). Call site passes the current tool args —
+   * code must not scan session latest/mtime to recover it.
+   */
+  readonly submission?: unknown;
   /**
    * Test seam for public-role summons. Production calls the shared public
    * activation path (#675); inject only in offline tracers.
@@ -198,15 +210,26 @@ function projectOfficerDecision(
 }
 
 /**
- * Project a public-role terminal onto the gate queue surface.
- * Host failure stays failure; recorded officer payloads ride beside it (#836 A.3).
- * Multiple recorded payloads are all kept — code does not pick last-wins.
+ * This-court officer payloads for the parent return path (#879).
+ * Only settlement-scoped roleOutcome.payloads (courtAttempt seal) carry this-court
+ * identity. Never guess from undivided submissions — sole row included — history
+ * stays on terminal.submissions (#836 presentation).
  */
-function officerPayloads(terminal: TerminalResult | undefined): readonly unknown[] {
+function thisCourtOfficerPayloads(terminal: TerminalResult | undefined): readonly unknown[] {
   const outcome = terminal?.roleOutcome;
   if (outcome !== undefined && (outcome.kind === "accepted" || outcome.kind === "audit_escalation")) {
-    return outcome.payloads ?? terminal?.submissions ?? [];
+    if (outcome.payloads !== undefined && outcome.payloads.length > 0) return outcome.payloads;
+  }
+  if (outcome?.kind === "failure" && outcome.payloads !== undefined && outcome.payloads.length > 0) {
+    return outcome.payloads;
   }
+  // No sole-row identity guess: undivided submissions are not this-court (#879).
+  return [];
+}
+
+/** Failure/transport channel may still surface every recorded payload beside the failure (#836 A.3). */
+function officerFailurePayloads(terminal: TerminalResult | undefined): readonly unknown[] {
+  const outcome = terminal?.roleOutcome;
   if (outcome?.kind === "failure") return outcome.payloads ?? terminal?.submissions ?? [];
   return terminal?.submissions ?? [];
 }
@@ -219,19 +242,9 @@ function projectOfficerPayloads(
   if (payloads.length === 0) {
     return projectOfficerDecision(officer, undefined, fallbackStatus);
   }
-  // Present every recorded payload; queue only the latest conclusion so a reask
-  // can converge (#836 呈现 ≠ 排队).
-  const queued = projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
-  if (payloads.length === 1) return queued;
-  if (
-    queued.status === "pass"
-    || queued.status === "bounce"
-    || queued.status === "escalate"
-    || queued.status === "needs_reask"
-  ) {
-    return { ...queued, receipt: payloads };
-  }
-  return queued;
+  // This-court multi-submit: queue the latest seal of THIS court only (#836 呈现≠排队).
+  // Single this-court seal is the common path. Never fold history into an array receipt.
+  return projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
 }
 
 function projectOfficerTerminal(
@@ -240,16 +253,17 @@ function projectOfficerTerminal(
 ): GatekeeperResult {
   const terminal: TerminalResult | undefined = summoned.terminal;
   const outcome = terminal?.roleOutcome;
-  const recorded = officerPayloads(terminal);
+  const thisCourt = thisCourtOfficerPayloads(terminal);
   if (outcome === undefined) {
     const detail = summoned.stderr ?? "";
+    const failurePayloads = officerFailurePayloads(terminal);
     return {
       status: "transport_failure",
       stage: officer,
       reason: detail.length > 0
         ? `${gateSeatLabel(officer)} public summon exit ${summoned.exitCode}: ${detail}`
         : `${gateSeatLabel(officer)} public summon produced no terminal (exit ${summoned.exitCode})`,
-      submission: recorded.length > 0 ? recorded : summoned,
+      submission: failurePayloads.length > 0 ? failurePayloads : summoned,
     };
   }
   if (outcome.kind === "no_receipt") {
@@ -263,30 +277,33 @@ function projectOfficerTerminal(
     };
   }
   if (outcome.kind === "failure") {
+    const failurePayloads = officerFailurePayloads(terminal);
     return {
       status: "transport_failure",
       stage: officer,
       reason: outcome.diagnostic,
-      submission: recorded.length > 0 ? recorded : outcome.decisiveFacts,
+      submission: failurePayloads.length > 0 ? failurePayloads : outcome.decisiveFacts,
     };
   }
   if (outcome.kind === "audit_escalation") {
     return {
       status: "escalate",
       officer,
-      receipt: recorded.length === 1 ? recorded[0] : recorded,
+      // This-court receipt only (#879) — historical rows remain on terminal.submissions.
+      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
     };
   }
   if (outcome.kind === "accepted") {
     // outcome.status is the fixture/compat leaf: production settlement leaves
     // it undefined once payloads are recorded, so this only matters when a
     // caller still supplies status without any recorded payload (#836 hang).
-    return projectOfficerPayloads(officer, recorded, outcome.status);
+    return projectOfficerPayloads(officer, thisCourt, outcome.status);
   }
   return {
     status: "needs_reask",
     officer,
-    receipt: recorded.length > 0 ? recorded : retainedReceipt(outcome),
+    // This-court receipt only (#879).
+    receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
   };
 }
 
@@ -324,13 +341,13 @@ export async function projectGatekeeperRun(
       },
     };
   }
-  // #836: officers receive the whole parent run directory pointer and find the
-  // submission themselves — code no longer picks latest toolCall leaf (A7.1–A7.3).
+  // #879: binding pointer = parent run directory; dialogue content = this-turn
+  // typed payload passed explicitly (never latest-toolCall recovery, A7.1–A7.3).
   let summoned: PublicSummonResult;
   try {
     const summon =
       options.summonOfficer
-      ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask) => {
+      ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask, nextSubmission) => {
         const { summonGateOfficer } = await import("./public-role-summons.ts");
         return summonGateOfficer({
           officer: nextOfficer,
@@ -338,6 +355,7 @@ export async function projectGatekeeperRun(
           cwd: options.context.cwd ?? process.cwd(),
           ...(officerSignal === undefined ? {} : { signal: officerSignal }),
           ...(reask === undefined ? {} : { reask }),
+          ...(nextSubmission === undefined ? {} : { submission: nextSubmission }),
           ...(options.home === undefined ? {} : { home: options.home }),
           ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
           ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
@@ -349,6 +367,7 @@ export async function projectGatekeeperRun(
       runDirectory,
       options.signal,
       options.reask,
+      options.submission,
     );
   } catch (error) {
     return {

package/src/headless-host/description.ts

@@ -22,7 +22,7 @@ export type ClaudePrintHostDescription = HeadlessHostBase & Readonly<{
    * are composed by the adapter from the turn request — not listed here.
    */
   fixedArgs: readonly string[];
-  /** Print-mode flag that takes the user prompt as its value (e.g. `-p`). */
+  /** Print-mode flag (e.g. `-p`); user prompt rides stdin, not this flag's value (#879). */
   promptFlag: string;
   /** CLI flag for the seat model (e.g. `--model`). */
   modelFlag: string;
@@ -76,11 +76,11 @@ export function resolveHeadlessBinary(
 
 /**
  * Build one Claude print-mode argv for a single process turn.
- * Shape: `<promptFlag> <prompt> <fixedArgs…> <system/schema/mcp/model/effort/session…>`.
+ * Shape: `<promptFlag> <fixedArgs…> <system/schema/mcp/model/effort/session…>`.
+ * User dialogue rides stdin, not an argv element (#879 / ARG_MAX).
  */
 export function headlessTurnArgs(options: {
   readonly description: ClaudePrintHostDescription;
-  readonly prompt: string;
   /** Absolute path written by the adapter; paired with `systemPromptFlag`. */
   readonly systemPromptPath: string;
   readonly jsonSchema: Readonly<Record<string, unknown>>;
@@ -94,7 +94,6 @@ export function headlessTurnArgs(options: {
   const { description } = options;
   const args: string[] = [
     description.promptFlag,
-    options.prompt,
     ...description.fixedArgs,
     description.systemPromptFlag,
     options.systemPromptPath,
@@ -388,13 +387,12 @@ function codexMcpConfigArgs(
 
 /**
  * Build one `codex exec` / `codex exec resume` argv (#646).
- * New: `exec --approve-for-me … prompt`.
- * Resume: `exec --approve-for-me resume <thread_id> … prompt`.
+ * New: `exec --approve-for-me … -- -` (prompt on stdin).
+ * Resume: `exec --approve-for-me resume <thread_id> … -- -`.
  * Approval stays on the parent command so new and resumed turns use Codex's
  * automatic review with its workspace-write sandbox.
  */
 export function codexTurnArgs(options: {
-  readonly prompt: string;
   /** Absolute path for `-c model_instructions_file=…`. */
   readonly systemPromptPath: string;
   /** Absolute path for `--output-schema` (closed transport schema). */
@@ -455,10 +453,9 @@ export function codexTurnArgs(options: {
     args.push("--skip-git-repo-check");
   }
 
-  // Prompt last as positional. `--` stops option parsing so a leading `-`
-  // (markdown lists, pasted flags, rulings) is not eaten by clap (codex tip:
-  // "use '-- -s'"). Same for new and resume — both end here.
-  args.push("--", options.prompt);
+  // `-` after `--` is Codex's stdin prompt sentinel. `--` still stops option
+  // parsing; the user body itself is not an argv element (#879 / ARG_MAX).
+  args.push("--", "-");
   return args;
 }
 

package/src/headless-host/role-turn-host.ts

@@ -256,6 +256,8 @@ function spawnHeadlessTurn(options: {
   readonly env: NodeJS.ProcessEnv;
   readonly signal?: AbortSignal;
   readonly timeoutMs?: number;
+  /** User dialogue body; omitted from argv so execve cannot E2BIG (#879). */
+  readonly stdin?: string;
   /** Called for each complete stdout line as it arrives (live stream-json). */
   readonly onStdoutLine?: (line: string) => void;
 }): Promise<{ code: number | null; stdout: string; stderr: string; timedOut: boolean }> {
@@ -267,8 +269,20 @@ function spawnHeadlessTurn(options: {
     const child = spawn(options.binary, [...options.args], {
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["pipe", "pipe", "pipe"],
     });
+    if (child.stdin === null) {
+      reject(new Error("headless child stdin pipe was not created"));
+      return;
+    }
+    let stdinDeliveryError: Error | undefined;
+    child.stdin.on("error", (error) => {
+      stdinDeliveryError ??= error;
+    });
+    if (options.stdin !== undefined) {
+      child.stdin.write(options.stdin);
+    }
+    child.stdin.end();
     // Rolling retention only: last result-candidate line for final parse.
     // Live events go to sitian via onStdoutLine — never accumulate the full stream.
     let resultStdout = "";
@@ -318,6 +332,10 @@ function spawnHeadlessTurn(options: {
       settled = true;
       if (timer !== undefined) clearTimeout(timer);
       options.signal?.removeEventListener("abort", onAbort);
+      if (stdinDeliveryError !== undefined) {
+        reject(stdinDeliveryError);
+        return;
+      }
       resolve({ code, stdout: resultStdout, stderr, timedOut });
     };
     const onAbort = (): void => {
@@ -381,7 +399,6 @@ function terminalFromSpawned(
 
 function buildTurnArgs(options: {
   readonly description: HeadlessHostDescription;
-  readonly prompt: string;
   readonly systemPromptPath: string;
   readonly jsonSchema: Readonly<Record<string, unknown>>;
   readonly mcpServers: readonly Readonly<Record<string, unknown>>[];
@@ -400,7 +417,6 @@ function buildTurnArgs(options: {
     }
     if (options.outputSchemaPath === undefined) throw new Error("codex requires an output schema path");
     return codexTurnArgs({
-      prompt: options.prompt,
       systemPromptPath: options.systemPromptPath,
       outputSchemaPath: options.outputSchemaPath,
       mcpServers: options.mcpServers,
@@ -419,7 +435,6 @@ function buildTurnArgs(options: {
   if (options.mcpConfigPath === undefined) throw new Error("claude print-mode requires an MCP config path");
   return headlessTurnArgs({
     description: options.description,
-    prompt: options.prompt,
     systemPromptPath: options.systemPromptPath,
     jsonSchema: options.jsonSchema,
     mcpConfigPath: options.mcpConfigPath,
@@ -479,7 +494,6 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
             const gitCommonDir = codex ? resolveGitCommonDir(request.cwd) : undefined;
             args = buildTurnArgs({
               description: config.description,
-              prompt,
               systemPromptPath,
               jsonSchema: prepared.jsonSchema,
               mcpServers: prepared.mcpServers,
@@ -508,6 +522,7 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
               args,
               cwd: request.cwd,
               env,
+              stdin: prompt,
               ...(abortSignal === undefined ? {} : { signal: abortSignal }),
               ...(request.timeoutMs === undefined ? {} : { timeoutMs: request.timeoutMs }),
               onStdoutLine(line) {

package/src/host-contracts.ts

@@ -130,7 +130,7 @@ export type RoleTurnActivation =
       /** Required comparison-base revision for the unanchored merge-candidate diff. */
       readonly baseRevision: string;
     }
-  | { readonly role: "inspector" }
+  | { readonly role: "inspector"; readonly sourceRun?: string }
   | { readonly role: "gatekeeper" }
   | { readonly role: "navigator" }
   | { readonly role: "auditor" }
@@ -160,6 +160,11 @@ export type RoleTurnHostTransition = {
   readonly priorNativePaths: readonly string[];
 };
 
+/** Gate review officers (察院 / 符宝郎 / 审刑院). Single authority for seat checks. */
+export function isOfficerReviewSeat(role: string): boolean {
+  return role === "notary" || role === "inspector" || role === "auditor";
+}
+
 /** One main-session turn request over the host-neutral execution seam. */
 export type RoleTurnRequest = {
   readonly principal: DurablePrincipal;
@@ -241,7 +246,21 @@ export interface DurablePrincipalAuthority {
 type HostSessionManager = { getLeafEntry(): HostSessionEntry | undefined; getLeafId(): string | null | undefined; getEntries(): Iterable<HostSessionEntry>; getSessionDir(): string; getSessionFile(): string | undefined; getHeader?(): { readonly type: string; readonly id?: string } | null; setSessionFile?(path: string): void; appendCustomEntry?(customType: string, data?: unknown): unknown; };
 
 /** Context supplied by a host for one activation and its interceptable events. */
-export type HostContext = { cwd: string; mode: string; model: { readonly provider: string } | undefined; sessionManager: HostSessionManager; signal?: AbortSignal | undefined; ui?: { notify?(message: string, type?: "info" | "warning" | "error"): void }; transcript?(): string; abort(): void; };
+export type HostContext = { cwd: string; mode: string; model: { readonly provider: string } | undefined; sessionManager: HostSessionManager; /** Per-turn admitted run directory (#879); never process-global env. */ runDirectory?: string; /** Per-turn court attempt (#879); never process-global env. */ courtAttemptId?: string; signal?: AbortSignal | undefined; ui?: { notify?(message: string, type?: "info" | "warning" | "error"): void }; transcript?(): string; abort(): void; };
+
+/** Per-turn run directory; adapters must project any child-process identity. */
+export function runDirectoryFromHostContext(context: HostContext): string | undefined {
+  return typeof context.runDirectory === "string" && context.runDirectory.trim() !== ""
+    ? context.runDirectory
+    : undefined;
+}
+
+/** Per-turn court attempt; absence never inherits ambient process identity. */
+export function courtAttemptIdFromHostContext(context: HostContext): string | undefined {
+  return typeof context.courtAttemptId === "string" && context.courtAttemptId.trim() !== ""
+    ? context.courtAttemptId
+    : undefined;
+}
 
 export type HostToolDefinition<S extends TSchema = TSchema, D = unknown, C = HostContext> = { name: string; label: string; description: string; promptSnippet?: string; parameters: S; execute( toolCallId: string, params: Static<S>, signal: AbortSignal | undefined, update: ((result: HostToolResult<D>) => void) | undefined, context: C, ): Promise<HostToolResult<D>>; /**
  * #641 chain② opt-in: when the output params carry the shared infrastructure
@@ -356,7 +375,7 @@ export interface RoleHost {
   getAllTools(): Array<{ name: string; sourceInfo?: { path?: string } }>;
   setActiveTools(names: string[]): void;
   getActiveTools(): string[];
-  requireGatekeeperPass?(options: { context: HostContext; subject: HostGatekeeperSubject; signal?: AbortSignal; hostActions: HostGatekeeperActions; toolCallId: string }): Promise<void>;
+  requireGatekeeperPass?(options: { context: HostContext; subject: HostGatekeeperSubject; signal?: AbortSignal; hostActions: HostGatekeeperActions; toolCallId: string; submission?: unknown }): Promise<void>;
   on(event: "before_agent_start", handler: HostEventHandler<"before_agent_start">): void;
   on(event: "input", handler: HostEventHandler<"input">): void;
   on(event: "tool_call", handler: HostEventHandler<"tool_call">): void;

package/src/inspector-contracts.ts

@@ -6,6 +6,13 @@
 
 export const INSPECTOR_OUTPUT_TOOL_NAME = "ak_inspector_output" as const;
 export const INSPECTOR_ACCEPTED_TEXT = "察院回执已接受";
+export const INSPECTOR_SOURCE_RUN_FLAG = {
+  name: "ak-inspector-source-run",
+  definition: {
+    description: "察院初铸绑定的父 run 绝对路径",
+    type: "string" as const,
+  },
+} as const;
 
 export type InspectorOutput =
   | { readonly status: "pass"; readonly findings?: unknown }

package/src/judge-role.ts

@@ -122,6 +122,8 @@ export function createJudgeRoleRuntime(
               ...(signal === undefined ? {} : { signal }),
               hostActions,
               toolCallId,
+              // #879: this-turn typed payload — identity-bound at submit site.
+              submission: parameters,
             });
             // #756: 审刑院合规路径 — same review-queue law as 符宝郎/察院.
             // pass → accept; bounce|escalate → raw auditor receipt back to judge;
@@ -132,6 +134,8 @@ export function createJudgeRoleRuntime(
               ...(signal === undefined ? {} : { signal }),
               hostActions,
               toolCallId,
+              // #879: same parent payload for 审刑院; not recovered from session latest.
+              submission: parameters,
             });
             return {
               content: [{ type: "text" as const, text: JUDGE_ACCEPTED_TEXT }],

package/src/navigator-work-context.ts

@@ -6,7 +6,7 @@ import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 
 import { loadDoctorCase } from "./doctor-evidence.ts";
-import type { HostContext } from "./host-contracts.ts";
+import { runDirectoryFromHostContext, type HostContext } from "./host-contracts.ts";
 import {
   navigatorSubjectKey,
   navigatorSubjectKeyForInput,
@@ -64,10 +64,9 @@ export async function loadNavigatorWorkContext(
     subjectProvenance = "role_input";
   }
   // Public ak-role run: admitted request is the typed Navigator work-context source.
-  const publicRunDir = process.env.AK_ROLE_RUN_DIR;
+  const publicRunDir = runDirectoryFromHostContext(options.context);
   const currentSessionDir = options.context.sessionManager.getSessionDir();
-  const isBoundPublicRun = typeof publicRunDir === "string"
-    && publicRunDir.trim() !== ""
+  const isBoundPublicRun = publicRunDir !== undefined
     && resolve(currentSessionDir) === resolve(publicRunDir, "session");
   if (
     options.role === "judge" &&

package/src/notary-role.ts

@@ -179,6 +179,7 @@ export function createNotaryRoleRuntime(
         });
         // Evidence assembly only (ADR 0018): soul + bound projection.
         // Ticket value is envelope-admitted at activate — not re-read from flags here.
+        // #879 case dossier freeze→readingMaterial is envelope-owned (shared before_agent_start).
         pi.on("before_agent_start", (event) => {
           if (activation === undefined) {
             throw new Error("符宝郎未激活");

package/src/packaged-role-registry.ts

@@ -174,7 +174,7 @@ export const PUBLIC_ROLE_RECORDS = [
     role: "inspector",
     phases: [null],
     outputTool: INSPECTOR_OUTPUT_TOOL_NAME,
-    inputFlag: undefined,
+    inputFlag: "ak-inspector-source-run",
     phaseFlag: undefined,
     activationStage: "load-and-install",
     sessionMaterials: INSPECTOR_SESSION_MATERIALS,

package/src/pi/adapter.ts

@@ -21,6 +21,7 @@ import type {
 import { createOAuthKeepalive, type OAuthKeepaliveOptions } from "../oauth-keepalive.ts";
 import { createRoleRuntimeExtension, type RoleRuntimeDependencies } from "../role-runtime.ts";
 import { renderAgentStartMaterials } from "../agent-start-materials.ts";
+import { readUserDialogueStdin } from "../user-dialogue-stdin.ts";
 
 
 export type PiRoleHostAdapter = RoleEnvelopeHost;
@@ -45,6 +46,12 @@ function projectPiContext(context: ExtensionContext, transcriptFromContext?: (co
     cwd: context.cwd,
     mode: context.mode,
     model: context.model === undefined ? undefined : { provider: context.model.provider },
+    ...(typeof process.env.AK_ROLE_RUN_DIR === "string" && process.env.AK_ROLE_RUN_DIR.trim() !== ""
+      ? { runDirectory: process.env.AK_ROLE_RUN_DIR }
+      : {}),
+    ...(typeof process.env.AK_ROLE_COURT_ATTEMPT === "string" && process.env.AK_ROLE_COURT_ATTEMPT.trim() !== ""
+      ? { courtAttemptId: process.env.AK_ROLE_COURT_ATTEMPT }
+      : {}),
     sessionManager: {
       getLeafEntry: () => context.sessionManager.getLeafEntry(),
       getLeafId: () => context.sessionManager.getLeafId(),
@@ -78,6 +85,7 @@ function requirePiGatekeeperPass(options: {
   signal?: AbortSignal;
   hostActions: HostGatekeeperActions;
   toolCallId: string;
+  submission?: unknown;
 }): Promise<void> {
   return requireGatekeeperPass({
     context: options.context,
@@ -90,6 +98,7 @@ function requirePiGatekeeperPass(options: {
       bindSubmissionNonPass: options.hostActions.bindSubmissionNonPass,
     },
     toolCallId: options.toolCallId,
+    ...(options.submission === undefined ? {} : { submission: options.submission }),
   });
 }
 
@@ -99,13 +108,13 @@ function toPiResult<D>(result: HostToolResult<D>): HostToolResult<D> {
 
 /** Fold a host before_agent_start return: push readingMaterial into the provider-visible
  * systemPrompt via the shared renderer and strip the typed field before Pi sees it. */
-function foldBeforeAgentStartReturn(result: unknown): BeforeAgentStartEventResult | void {
+function foldBeforeAgentStartReturn(result: unknown, currentSystemPrompt: string): BeforeAgentStartEventResult | void {
   if (result === undefined || result === null || typeof result !== "object") return undefined;
   const record = result as { systemPrompt?: string; readingMaterial?: unknown };
   const { systemPrompt, readingMaterial } = record;
   const folded = readingMaterial === undefined
     ? systemPrompt
-    : renderAgentStartMaterials(systemPrompt ?? "", [readingMaterial]);
+    : renderAgentStartMaterials(systemPrompt ?? currentSystemPrompt, [readingMaterial]);
   return folded === undefined ? {} : { systemPrompt: folded };
 }
 
@@ -136,6 +145,12 @@ export function createPiRoleHostAdapter(
   options: { transcriptFromContext?: (context: ExtensionContext) => string; oauthKeepalive?: OAuthKeepaliveOptions } = {},
 ): PiRoleHostAdapter {
   const keepalive = createOAuthKeepalive(options.oauthKeepalive);
+  // Decode transport exactly once before Pi's native handler chain. Pi retains
+  // its own transform/image propagation and per-handler error isolation.
+  pi.on("input", (value) => {
+    const text = readUserDialogueStdin(value.text);
+    return text === value.text ? { action: "continue" } : { action: "transform", text };
+  });
   const host: RoleHost = {
     deliverSubmissionRejection(_rejection) {
       // #836 删 1/A4.5: no package-authored non-sole resume sentence.
@@ -185,8 +200,8 @@ export function createPiRoleHostAdapter(
         const [, handler] = registration;
         pi.on("before_agent_start", (value, ctx) => {
           const result = handler({ prompt: value.prompt, systemPrompt: value.systemPrompt, systemPromptOptions: value.systemPromptOptions }, context(ctx));
-          if (result instanceof Promise) return result.then(foldBeforeAgentStartReturn);
-          return foldBeforeAgentStartReturn(result);
+          if (result instanceof Promise) return result.then((settled) => foldBeforeAgentStartReturn(settled, value.systemPrompt));
+          return foldBeforeAgentStartReturn(result, value.systemPrompt);
         });
       } else if (registration[0] === "input") {
         const [, handler] = registration;