@bastani/atomic 0.9.11 → 0.9.12-alpha.1

package/dist/builtin/web-access/index-heavy.ts

@@ -2,7 +2,7 @@ import type { ExtensionAPI } from "@bastani/atomic";
 import { CONFIG_DIR_NAME } from "@bastani/atomic";
 import { appendFileSync } from "node:fs";
 import { getActiveGoogleEmail, isGeminiWebAvailable } from "./gemini-web.js";
-import { isBrowserCookieAccessAllowed } from "./gemini-web-config.js";
+import { isBrowserCookieAccessAllowed } from "./gemini-web-config.ts";
 import { deleteResult, getAllResults } from "./storage.js";
 import { loadConfigForExtensionInit, resolveWorkflow, saveConfig, type WebSearchWorkflow } from "./web-search-config.js";
 

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.11",
+  "version": "0.9.12-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.12-alpha.1] - 2026-08-04
+
+### Added
+
+- Added `keepContext` to the public authoring surface: `import { keepContext } from "@bastani/workflows"`. It wraps prompt text so compaction protects it verbatim regardless of the compression ratio, and is a pure, idempotent string helper rather than a `ctx.*` primitive — no graph node, no side effect, callable anywhere a prompt is assembled. `KEEP_CONTEXT_OPEN_TAG` and `KEEP_CONTEXT_CLOSE_TAG` are exported alongside it. Reserve it for text whose loss silently changes behavior — role constraints, acceptance criteria, explicit prohibitions, and identifiers a stage must not lose — and not for bulk context, since protected lines count against the keep target rather than raising it ([#2172](https://github.com/bastani-inc/atomic/issues/2172)).
+- `<keepContext>` tags also work in the run inputs and steering messages sent through the `workflow` tool, not only in authored stage prompts. Workflows inject inputs into their stage prompts, so a tagged clause in `prompt` or `acceptance_criteria` is inherited and protected by every stage that receives it, and a tagged `send` amendment survives until the stage acts on it instead of competing with the whole transcript for retention. Because `keepContext` is idempotent, an already-tagged input is not double-wrapped by a workflow that protects the same field. The workflow tool description and agent guidance now say so, so an agent can decide per launch or per steering message which clauses to protect ([#2172](https://github.com/bastani-inc/atomic/issues/2172)).
+
+### Fixed
+
+- Builtin workflows protect their own invariants with `keepContext`, so a long-running stage can no longer lose the rules that bound it: the steering propagation contract carried by every builtin stage prompt, the literal objective contract, scope discipline, worktree discipline, ralph's per-run acceptance criteria, ralph's research-only role constraint, and goal's reviewer "inspect and report; do not implement" constraint. Previously a research stage could be compacted past its own prohibition and start implementing, and a stage could lose the checkout it was bound to ([#2172](https://github.com/bastani-inc/atomic/issues/2172)).
+
 ## [0.9.11] - 2026-08-03
 
 ### Added

package/dist/builtin/workflows/README.md

@@ -608,7 +608,7 @@ Raw stage-chat prompt answer replay is live-memory only. `StageSnapshot.promptAn
 ```json
 {
   "name": "workflow",
-  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
+  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
   "parameters": {
     "workflow": "string (optional) — workflow ID or normalized name",
     "inputs": "object (optional) — key/value map of workflow inputs",

package/dist/builtin/workflows/builtin/goal-prompts.ts

@@ -14,6 +14,7 @@ import {
   SCOPE_DISCIPLINE_CONTRACT,
   WORKER_PREFLIGHT_CONTRACT,
   WORKTREE_DISCIPLINE_CONTRACT,
+  keepContext,
   renderE2eQaVideoReviewGuidance,
 } from "./shared-prompts.js";
 import type { GoalLedger } from "./goal-types.js";
@@ -196,7 +197,9 @@ export function renderReviewerPrompt(args: {
       "Lead with the verdict. Keep evidence, decisions, caveats, and next action; omit background and repetition while remaining readable rather than using fragments, arrow chains, or invented shorthand.",
     ].join("\n")],
     ["objective", [
-      "Act as an independent, skeptical, technically fair reviewer. Inspect and report; do not implement. Protect correctness, security, performance, maintainability, and full objective completion without bikeshedding.",
+      keepContext(
+        "Act as an independent, skeptical, technically fair reviewer. Inspect and report; do not implement. Protect correctness, security, performance, maintainability, and full objective completion without bikeshedding.",
+      ),
       args.reviewerRole,
       args.focus,
       "Review the delivered change against the run objective stored in the goal ledger.",

package/dist/builtin/workflows/builtin/ralph-core.ts

@@ -5,6 +5,7 @@ import type { WorkflowTaskResult } from "../src/shared/types.js";
 import { createWorkflowArtifactDirectory } from "../src/shared/workflow-artifacts.js";
 import {
   E2E_VERIFICATION_GUIDANCE,
+  keepContext,
   LITERAL_OBJECTIVE_CONTRACT,
 } from "./shared-prompts.js";
 import type { ReviewDecision, ReviewFinding } from "./ralph-review-gate.js";
@@ -336,7 +337,7 @@ export function renderResearchPromptRefinementPrompt(args: {
   readonly latestReviewReportPath: string | undefined;
 }): string {
   return taggedPrompt([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     args.workflowCwdContext,
     [
@@ -351,7 +352,9 @@ export function renderResearchPromptRefinementPrompt(args: {
     ["objective", `Research the full requested task: ${args.request}`],
     [
       "output",
-      "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.",
+      keepContext(
+        "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.",
+      ),
     ],
     [
       "instruction",
@@ -369,7 +372,7 @@ export function renderResearchPrompt(args: {
   readonly latestReviewReportPath: string | undefined;
 }): string {
   return taggedPrompt([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     args.workflowCwdContext,
     [
@@ -388,7 +391,7 @@ export function renderResearchPrompt(args: {
         "Return the complete research report as your final message. Downstream implementation and review stages read it from there.",
         "Produce a complete Markdown report with codebase and useful online/contextual findings, implementation guidance, relevant files/tests/docs, unresolved-finding analysis, and validation recommendations. Lead with conclusions; keep facts, caveats, and implementation-relevant next steps; drop background and repetition.",
         "Before reporting progress, audit each claim against a tool result from this session. Report only work you can point to evidence for; say so explicitly when something is unverified.",
-        "Do not author an RFC/spec or implement code changes.",
+        keepContext("This stage researches only. Do not author an RFC/spec or implement code changes."),
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-forked-prompts.ts

@@ -1,5 +1,6 @@
 // Forked stages inherit their contracts and receive only the iteration delta.
 import { taggedPrompt } from "./ralph-core.js";
+import { keepContext } from "./shared-prompts.js";
 
 export function renderForkedResearchPromptRefinementPrompt(args: {
   readonly latestReviewReportPath: string | undefined;
@@ -16,7 +17,9 @@ export function renderForkedResearchPromptRefinementPrompt(args: {
     ],
     [
       "output",
-      "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.",
+      keepContext(
+        "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.",
+      ),
     ],
     [
       "instruction",
@@ -44,7 +47,7 @@ export function renderForkedResearchPrompt(args: {
       [
         "Return the rewritten research report for this iteration as your final message.",
         "Restate the still-applicable findings in full rather than referring back to the previous iteration's artifact; the current artifact and transcript are the authoritative records for this iteration.",
-        "Do not author an RFC/spec or implement code changes.",
+        keepContext("This stage researches only. Do not author an RFC/spec or implement code changes."),
       ].join("\n"),
     ],
     [

package/dist/builtin/workflows/builtin/ralph-reviewer-prompt.ts

@@ -10,6 +10,7 @@ import {
   REVIEWER_OVERIMPLEMENTATION_GUARD,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   WORKTREE_DISCIPLINE_CONTRACT,
+  keepContext,
   renderE2eQaVideoReviewGuidance,
 } from "./shared-prompts.js";
 import { taggedPrompt, type PromptSection } from "./ralph-core.js";
@@ -26,7 +27,7 @@ export function renderRalphReviewerPrompt(args: {
   readonly createPr: boolean;
 }): string {
   return taggedPrompt([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     [
       "review_context",
       [

package/dist/builtin/workflows/builtin/ralph-runner.ts

@@ -11,6 +11,7 @@ import {
   SCOPE_DISCIPLINE_CONTRACT,
   WORKER_PREFLIGHT_CONTRACT,
   WORKTREE_DISCIPLINE_CONTRACT,
+  keepContext,
 } from "./shared-prompts.js";
 import { renderRalphReviewerPrompt } from "./ralph-reviewer-prompt.js";
 import {
@@ -117,7 +118,7 @@ export async function runRalphWorkflow(
     const orchestratorForkOptions = forkContinuationOptions(previousOrchestratorSessionFile);
     const orchestratorPrompt = orchestratorForkOptions.forkFromSessionFile === undefined
       ? taggedPrompt([
-        ["acceptance_criteria", acceptanceCriteria],
+        ["acceptance_criteria", keepContext(acceptanceCriteria)],
         ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
         ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
         ["divergence_audit", CONTRACT_FIDELITY_AUDIT],

package/dist/builtin/workflows/builtin/shared-prompts.ts

@@ -1,3 +1,9 @@
+// Builtin prompts use the same public `keepContext` helper workflow authors do, so the
+// protection semantics cannot drift between builtin and user-authored workflows.
+import { keepContext } from "../src/authoring/keep-context.js";
+
+export { keepContext };
+
 /**
  * Steering propagation is a whole-repository pattern, not a per-workflow
  * option: every builtin stage prompt carries STEERING_PROPAGATION_CONTRACT
@@ -29,10 +35,15 @@ export const STEERING_PROPAGATION_CONTRACT = [
  * section, which carries the strongest positional weight. The contract is
  * inserted immediately before that closing section rather than after it, so a
  * stage's final words remain its instruction.
+ *
+ * The contract is `keepContext`-protected because only the user may amend a run's contract,
+ * and an amendment reaches later stages solely through this restatement duty. Compacted away,
+ * the run silently reverts to the launch contract while the implementer builds to the amended
+ * one — the exact split this pattern exists to prevent.
  */
 export function withSteeringPropagation(prompt: string): string {
   if (prompt.includes("<steering_propagation>")) return prompt;
-  const tagged = `<steering_propagation>\n${STEERING_PROPAGATION_CONTRACT}\n</steering_propagation>`;
+  const tagged = `<steering_propagation>\n${keepContext(STEERING_PROPAGATION_CONTRACT)}\n</steering_propagation>`;
   const instructionAt = prompt.lastIndexOf("\n\n<instruction>");
   if (instructionAt === -1) return `${prompt}\n\n${tagged}`;
   return `${prompt.slice(0, instructionAt)}\n\n${tagged}${prompt.slice(instructionAt)}`;
@@ -69,7 +80,12 @@ export function renderE2eQaVideoReviewGuidance(
   ].join("\n");
 }
 
-export const LITERAL_OBJECTIVE_CONTRACT = [
+/**
+ * `keepContext`-protected: this is the run's immutable contract and its central prohibition
+ * ("You may never widen the contract yourself"). A prohibition deleted from context reads as
+ * permission, so losing it turns scope creep into apparently sanctioned work.
+ */
+export const LITERAL_OBJECTIVE_CONTRACT = keepContext([
   "Literal objective contract:",
   "- The objective and acceptance criteria are the sole literal source of required behavior; the run objective must not contradict them.",
   "- Only the user may change the contract. A mid-run user message — steering, a follow-up, or resume text — is authoritative: adopt it as required behavior from that point on, and carry it forward under the steering propagation contract. You may never widen the contract yourself; an improvement you thought of is deferred work, not a new criterion.",
@@ -78,7 +94,7 @@ export const LITERAL_OBJECTIVE_CONTRACT = [
   "- That loud-error preference applies only to enumerated errors. Otherwise accept permissively: do not invent behavior, restrictions, validation errors, required fields, uniqueness/format constraints, or follow-up requirements.",
   "- Produce named types, shapes, and formats exactly; do not substitute proxies, frozen collections, tuples-for-lists, or wrappers unless required because consumers may check identity.",
   "- Where behavior is unspecified, preserve input verbatim rather than normalizing, deduplicating, reordering, or rewriting it.",
-].join("\n");
+].join("\n"));
 
 export const REVIEWER_SPEC_VS_OBJECTIVE_GUARD =
   "External spec/standard conformance alone does not make a wide trigger for an enumerated error defective; classify that spec-vs-objective tension as beyond_objective, not blocking.";
@@ -129,7 +145,12 @@ export const FINDINGS_CONSOLIDATION_CONTRACT = [
   "Defer only a genuinely blocked or contract-contradicting finding, recording the reason in the receipt.",
 ].join("\n");
 
-export const SCOPE_DISCIPLINE_CONTRACT = [
+/**
+ * `keepContext`-protected: every clause here is a prohibition, and prohibitions are the class
+ * compaction erodes first — they are terse, stated once, and low-density next to the objective
+ * they bound. Losing this reads as license to keep going.
+ */
+export const SCOPE_DISCIPLINE_CONTRACT = keepContext([
   "Scope discipline:",
   "- Before writing code, state the goal in one sentence and list the acceptance criteria. That list is the contract. Freeze it.",
   "- Done means the contract, not \"good.\" When all criteria pass, stop. Polish, refactors, and \"while I'm here\" fixes are new work, not this work.",
@@ -139,7 +160,7 @@ export const SCOPE_DISCIPLINE_CONTRACT = [
   "- Watch for the tells. \"It would be cleaner if...\", \"we should also...\", \"this really ought to...\" mean you are about to move the goalpost. Stop and check the contract.",
   "- Prefer the smallest diff that satisfies the contract: fewer files touched, fewer abstractions introduced, no speculative generality for futures nobody asked for.",
   "- Report three things at the end: what the contract was, evidence each criterion passes, and the deferred list. Scope changes belong in the report, never in the diff.",
-].join("\n");
+].join("\n"));
 
 export const EVIDENCE_CLOSURE_POLICY = [
   "Convergence flag (stop_review_loop):",
@@ -149,10 +170,16 @@ export const EVIDENCE_CLOSURE_POLICY = [
   "- If the bounded loop ends first, preserve unresolved findings and remaining work for a human rather than relabeling them.",
 ].join("\n");
 
-export const WORKTREE_DISCIPLINE_CONTRACT = [
+/**
+ * `keepContext`-protected: this binds the stage to a specific checkout, and a checkout is
+ * exactly the kind of identifier a stage must not lose. Compacted away during a long run, an
+ * agent hitting a lock or dirty state invents a second worktree and the delivered delta lands
+ * somewhere the reviewers never look. It is two lines, so protection costs almost nothing.
+ */
+export const WORKTREE_DISCIPLINE_CONTRACT = keepContext([
   "Work in the workflow-designated checkout. Do not create another worktree, clone, or repository copy unless the task requests it; conflicts, locks, dirty state, and failed commands do not authorize one.",
   "Bring required work found elsewhere into this checkout by applying, cherry-picking, or replaying it before continuing.",
-].join("\n");
+].join("\n"));
 
 export const REVIEW_CODE_DELTA_CONTRACT = [
   "Code delta integrity:",

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.11",
+  "version": "0.9.12-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/authoring/keep-context.ts

@@ -0,0 +1,46 @@
+/**
+ * `keepContext` marks prompt text that compaction must never compress.
+ *
+ * This is a pure string transform rather than a `ctx.*` primitive: it creates no graph node,
+ * has no side effect, and needs no durability, so it is safe to call anywhere a prompt is
+ * assembled — including outside a run.
+ */
+
+export const KEEP_CONTEXT_OPEN_TAG = "<keepContext>";
+export const KEEP_CONTEXT_CLOSE_TAG = "</keepContext>";
+
+/**
+ * Wrap text so compaction protects it verbatim.
+ *
+ * Every line of the span, tag lines included, becomes a protected line, and protected lines are
+ * removed from the planner's deletion ranges after it responds, so the span survives regardless
+ * of the compression ratio. Because the tag lines are protected too, the span is re-detected on
+ * each subsequent boundary and stays protected for the life of the session.
+ *
+ * Tags must sit on their own line, and a span is scoped to one message. User and assistant
+ * messages may both protect, so an agent can pin its own core information as well as its prompt;
+ * tags inside tool results are inert, so file, page, or command output an agent reads cannot
+ * mark itself unreclaimable.
+ *
+ * Reserve it for text whose loss silently changes behavior — role constraints, acceptance
+ * criteria and immutable contracts, explicit prohibitions, and identifiers a stage must not
+ * lose such as a target branch, worktree path, or run ID. Compaction ranks lines individually,
+ * so a terse constraint loses to the verbose objective it qualifies, and a prohibition deleted
+ * from context reads as permission.
+ *
+ * Do not wrap bulk context. Protected lines count against the keep target rather than raising
+ * it, so a large protected span makes the surrounding transcript compress harder; tag the
+ * constraint, not the material it applies to, and pass that through files and `reads`.
+ *
+ * Nesting is flattened rather than rejected: an already-wrapped string is returned unchanged.
+ *
+ * @example
+ * ```ts
+ * const prompt = `${keepContext("Research only. Do not implement code changes.")}\n\n${question}`;
+ * ```
+ */
+export function keepContext(text: string): string {
+	const trimmed = text.trim();
+	if (trimmed.startsWith(KEEP_CONTEXT_OPEN_TAG) && trimmed.endsWith(KEEP_CONTEXT_CLOSE_TAG)) return trimmed;
+	return `${KEEP_CONTEXT_OPEN_TAG}\n${trimmed}\n${KEEP_CONTEXT_CLOSE_TAG}`;
+}

package/dist/builtin/workflows/src/authoring.d.ts

@@ -44,6 +44,17 @@ export interface WorkflowRegistry {
  */
 export declare const runWorkflow: never;
 export declare function workflow<const TInputs extends WorkflowInputSchemaMap = Record<never, never>, const TOutputs extends WorkflowOutputSchemaMap = WorkflowOutputSchemaMap, TActualOutputs extends WorkflowOutputsFromSchemas<TOutputs> = WorkflowOutputsFromSchemas<TOutputs>>(spec: AuthoredWorkflowSpec<TInputs, TOutputs, TActualOutputs>): AuthoredWorkflowDefinition<TInputs, TOutputs>;
+/**
+ * Wrap prompt text so compaction protects it verbatim, regardless of the compression ratio.
+ *
+ * Reserve it for text whose loss silently changes behavior: role constraints, acceptance
+ * criteria and immutable contracts, explicit prohibitions, and identifiers a stage must not
+ * lose. Do not wrap bulk context — protected lines count against the keep target rather than
+ * raising it, so a large span makes the surrounding transcript compress harder.
+ */
+export declare function keepContext(text: string): string;
+export declare const KEEP_CONTEXT_OPEN_TAG: string;
+export declare const KEEP_CONTEXT_CLOSE_TAG: string;
 export declare function createRegistry<TDefinitions extends readonly AnyWorkflowDefinition[] = readonly AnyWorkflowDefinition[]>(initial?: TDefinitions): WorkflowRegistry;
 export declare function normalizeWorkflowName(name: string): string;
 export declare function workflowNamesEqual(a: string, b: string): boolean;

package/dist/builtin/workflows/src/extension/index.bundle.mjs

@@ -53098,6 +53098,18 @@ function workflow(spec) {
   return Object.freeze(branded);
 }
 
+// dist/builtin/workflows/src/authoring/keep-context.ts
+var KEEP_CONTEXT_OPEN_TAG = "<keepContext>";
+var KEEP_CONTEXT_CLOSE_TAG = "</keepContext>";
+function keepContext(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith(KEEP_CONTEXT_OPEN_TAG) && trimmed.endsWith(KEEP_CONTEXT_CLOSE_TAG))
+    return trimmed;
+  return `${KEEP_CONTEXT_OPEN_TAG}
+${trimmed}
+${KEEP_CONTEXT_CLOSE_TAG}`;
+}
+
 // dist/builtin/workflows/builtin/shared-prompts.ts
 var STEERING_PROPAGATION_CONTRACT = [
   "Steering propagation contract:",
@@ -53113,7 +53125,7 @@ function withSteeringPropagation(prompt) {
   if (prompt.includes("<steering_propagation>"))
     return prompt;
   const tagged = `<steering_propagation>
-${STEERING_PROPAGATION_CONTRACT}
+${keepContext(STEERING_PROPAGATION_CONTRACT)}
 </steering_propagation>`;
   const instructionAt = prompt.lastIndexOf(`
 
@@ -53153,7 +53165,7 @@ function renderE2eQaVideoReviewGuidance(knownVideoPath) {
   ].join(`
 `);
 }
-var LITERAL_OBJECTIVE_CONTRACT = [
+var LITERAL_OBJECTIVE_CONTRACT = keepContext([
   "Literal objective contract:",
   "- The objective and acceptance criteria are the sole literal source of required behavior; the run objective must not contradict them.",
   "- Only the user may change the contract. A mid-run user message — steering, a follow-up, or resume text — is authoritative: adopt it as required behavior from that point on, and carry it forward under the steering propagation contract. You may never widen the contract yourself; an improvement you thought of is deferred work, not a new criterion.",
@@ -53163,7 +53175,7 @@ var LITERAL_OBJECTIVE_CONTRACT = [
   "- Produce named types, shapes, and formats exactly; do not substitute proxies, frozen collections, tuples-for-lists, or wrappers unless required because consumers may check identity.",
   "- Where behavior is unspecified, preserve input verbatim rather than normalizing, deduplicating, reordering, or rewriting it."
 ].join(`
-`);
+`));
 var REVIEWER_SPEC_VS_OBJECTIVE_GUARD = "External spec/standard conformance alone does not make a wide trigger for an enumerated error defective; classify that spec-vs-objective tension as beyond_objective, not blocking.";
 var REVIEWER_OVERIMPLEMENTATION_GUARD = "Treat unrequired validation errors, required fields, uniqueness/format constraints, immutability wrappers, and normalization as required_by_objective defects when they reject permitted inputs or change permitted shapes. Probe at least one contract-permitted input absent from implementation-authored tests.";
 var ACCEPTANCE_MATRIX_CONTRACT = [
@@ -53209,7 +53221,7 @@ var FINDINGS_CONSOLIDATION_CONTRACT = [
   "Defer only a genuinely blocked or contract-contradicting finding, recording the reason in the receipt."
 ].join(`
 `);
-var SCOPE_DISCIPLINE_CONTRACT = [
+var SCOPE_DISCIPLINE_CONTRACT = keepContext([
   "Scope discipline:",
   "- Before writing code, state the goal in one sentence and list the acceptance criteria. That list is the contract. Freeze it.",
   `- Done means the contract, not "good." When all criteria pass, stop. Polish, refactors, and "while I'm here" fixes are new work, not this work.`,
@@ -53220,7 +53232,7 @@ var SCOPE_DISCIPLINE_CONTRACT = [
   "- Prefer the smallest diff that satisfies the contract: fewer files touched, fewer abstractions introduced, no speculative generality for futures nobody asked for.",
   "- Report three things at the end: what the contract was, evidence each criterion passes, and the deferred list. Scope changes belong in the report, never in the diff."
 ].join(`
-`);
+`));
 var EVIDENCE_CLOSURE_POLICY = [
   "Convergence flag (stop_review_loop):",
   "- stop_review_loop is the single authoritative convergence signal; the harness trusts it without recomputing approval from findings, priorities, or requirements_traceability.",
@@ -53229,11 +53241,11 @@ var EVIDENCE_CLOSURE_POLICY = [
   "- If the bounded loop ends first, preserve unresolved findings and remaining work for a human rather than relabeling them."
 ].join(`
 `);
-var WORKTREE_DISCIPLINE_CONTRACT = [
+var WORKTREE_DISCIPLINE_CONTRACT = keepContext([
   "Work in the workflow-designated checkout. Do not create another worktree, clone, or repository copy unless the task requests it; conflicts, locks, dirty state, and failed commands do not authorize one.",
   "Bring required work found elsewhere into this checkout by applying, cherry-picking, or replaying it before continuing."
 ].join(`
-`);
+`));
 var REVIEW_CODE_DELTA_CONTRACT = [
   "Code delta integrity:",
   "- Inspect the delivered checkout with version-control tooling (for git: `git worktree list`, `git status --short`, baseline diff, staged diff, and untracked files) and prove an objective-related delta exists before trusting receipts.",
@@ -54948,7 +54960,7 @@ function renderReviewerPrompt(args) {
     ].join(`
 `)],
     ["objective", [
-      "Act as an independent, skeptical, technically fair reviewer. Inspect and report; do not implement. Protect correctness, security, performance, maintainability, and full objective completion without bikeshedding.",
+      keepContext("Act as an independent, skeptical, technically fair reviewer. Inspect and report; do not implement. Protect correctness, security, performance, maintainability, and full objective completion without bikeshedding."),
       args.reviewerRole,
       args.focus,
       "Review the delivered change against the run objective stored in the goal ledger.",
@@ -57037,7 +57049,7 @@ function forkContinuationOptions3(sessionFile) {
 }
 function renderResearchPromptRefinementPrompt(args) {
   return taggedPrompt4([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     args.workflowCwdContext,
     [
@@ -57051,7 +57063,7 @@ function renderResearchPromptRefinementPrompt(args) {
     ["objective", `Research the full requested task: ${args.request}`],
     [
       "output",
-      "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec."
+      keepContext("Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.")
     ],
     [
       "instruction",
@@ -57061,7 +57073,7 @@ function renderResearchPromptRefinementPrompt(args) {
 }
 function renderResearchPrompt(args) {
   return taggedPrompt4([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     args.workflowCwdContext,
     [
@@ -57079,7 +57091,7 @@ function renderResearchPrompt(args) {
         "Return the complete research report as your final message. Downstream implementation and review stages read it from there.",
         "Produce a complete Markdown report with codebase and useful online/contextual findings, implementation guidance, relevant files/tests/docs, unresolved-finding analysis, and validation recommendations. Lead with conclusions; keep facts, caveats, and implementation-relevant next steps; drop background and repetition.",
         "Before reporting progress, audit each claim against a tool result from this session. Report only work you can point to evidence for; say so explicitly when something is unverified.",
-        "Do not author an RFC/spec or implement code changes."
+        keepContext("This stage researches only. Do not author an RFC/spec or implement code changes.")
       ].join(`
 `)
     ],
@@ -57097,7 +57109,7 @@ import { join as join18, resolve as resolve3 } from "node:path";
 // dist/builtin/workflows/builtin/ralph-reviewer-prompt.ts
 function renderRalphReviewerPrompt(args) {
   return taggedPrompt4([
-    ["acceptance_criteria", args.acceptanceCriteria],
+    ["acceptance_criteria", keepContext(args.acceptanceCriteria)],
     [
       "review_context",
       [
@@ -57183,7 +57195,7 @@ function renderForkedResearchPromptRefinementPrompt(args) {
     ],
     [
       "output",
-      "Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec."
+      keepContext("Return only one concise, complete codebase and online research question. Do not implement code changes or write an RFC/spec.")
     ],
     [
       "instruction",
@@ -57206,7 +57218,7 @@ function renderForkedResearchPrompt(args) {
       [
         "Return the rewritten research report for this iteration as your final message.",
         "Restate the still-applicable findings in full rather than referring back to the previous iteration's artifact; the current artifact and transcript are the authoritative records for this iteration.",
-        "Do not author an RFC/spec or implement code changes."
+        keepContext("This stage researches only. Do not author an RFC/spec or implement code changes.")
       ].join(`
 `)
     ],
@@ -57482,7 +57494,7 @@ async function runRalphWorkflow(ctx, options) {
     const orchestratorReportPath = join18(artifactDir, "orchestrator-report.md");
     const orchestratorForkOptions = forkContinuationOptions3(previousOrchestratorSessionFile);
     const orchestratorPrompt = orchestratorForkOptions.forkFromSessionFile === undefined ? taggedPrompt4([
-      ["acceptance_criteria", acceptanceCriteria],
+      ["acceptance_criteria", keepContext(acceptanceCriteria)],
       ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
       ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
       ["divergence_audit", CONTRACT_FIDELITY_AUDIT],
@@ -58147,11 +58159,14 @@ __export(exports_sdk_surface, {
   run: () => run,
   resolveInputs: () => resolveInputs,
   normalizeWorkflowName: () => normalizeWorkflowName,
+  keepContext: () => keepContext,
   createStore: () => createStore,
   createRegistry: () => createRegistry,
   createCancellationRegistry: () => createCancellationRegistry,
   cancellationRegistry: () => cancellationRegistry,
   NON_INTERACTIVE_WORKFLOW_POLICY: () => NON_INTERACTIVE_WORKFLOW_POLICY,
+  KEEP_CONTEXT_OPEN_TAG: () => KEEP_CONTEXT_OPEN_TAG,
+  KEEP_CONTEXT_CLOSE_TAG: () => KEEP_CONTEXT_CLOSE_TAG,
   INTERACTIVE_WORKFLOW_POLICY: () => INTERACTIVE_WORKFLOW_POLICY,
   GraphFrontierTracker: () => GraphFrontierTracker
 });
@@ -75441,7 +75456,7 @@ function renderResult(result, opts) {
 }
 
 // dist/builtin/workflows/src/extension/workflow-prompts.ts
-var WORKFLOW_TOOL_DESCRIPTION = "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; " + "when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; " + "discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, " + "send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. " + "For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. " + "For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, " + "quote the exact path without rewriting separators (Windows backslashes are valid), " + "then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. " + "Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. " + "When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.";
+var WORKFLOW_TOOL_DESCRIPTION = "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; " + "when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; after successfully creating and reloading a newly authored custom workflow, report the folder containing its generated code as 'Custom workflow created. You can inspect its code at: <workflow-folder-path>'; do this only for newly created custom workflows, never builtin or pre-existing workflows; " + "discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, " + "send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. " + "For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. " + "Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. " + "For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, " + "quote the exact path without rewriting separators (Windows backslashes are valid), " + "then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. " + "Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. " + "When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.";
 var DEFAULT_PROMPT_GUIDANCE = [
   `**Workflows**: Treat workflows as the default execution path for any non-trivial task and for any request that has inherent structure plus an objective you can make verifiable. Use the \`workflow\` tool for existing named workflows; when the task needs a graph that is not installed, author a custom TypeScript \`workflow({...})\` inline with normal coding tools, reload workflow resources, and run it.
   - Workflow fit check: prefer a workflow for implementation, build, debug/diagnosis, bug-fix, migration, new-feature, scoped multi-file, or docs/code changes with validation; and whenever there are multiple steps, dependencies, handoffs, uncertainty, review/validation needs, long-running work, measurable done criteria, or an outcome that needs evidence.
@@ -75469,6 +75484,8 @@ var DEFAULT_PROMPT_GUIDANCE = [
   - Only skip workflows for tiny, deterministic, low-risk answers or direct edits where stage tracking clearly costs more than it adds, typically a single-file/no-test/no-review change or a simple answer.`,
   `**Workflow discovery and lifecycle**:
   - For unfamiliar named workflows, discover with \`action: "list"\`, inspect with \`action: "get"\` or \`action: "inputs"\`, and run with \`action: "run"\`, \`workflow\`, and validated \`inputs\`; do not invent workflow names or input keys.
+  - Wrap critical parts of the \`inputs\` you pass — objective, prompt, acceptance criteria — in \`<keepContext>\` / \`</keepContext>\`. Tagged text survives compaction verbatim regardless of the compression ratio, and stages inherit it because workflows inject your inputs into their prompts. A long stage is compacted repeatedly, and compaction ranks lines individually: a verbose restated objective outlives the one line that bounds it, so a stage can end up executing a coherent but unbounded version of what you asked for. Decide this per launch rather than tagging everything — tag role constraints, prohibitions, must-hold criteria, and identifiers such as a target branch, worktree path, or issue number; leave background, quoted issue text, and reference material untagged and pass bulk through files and \`reads\`. Protected lines count against the keep target rather than raising it, so an over-tagged input makes the evidence stages need compress harder.
+  - Tag steering the same way. A \`send\` amendment is authoritative and stages must carry it forward, but it arrives late in an already-long session and is exactly one short message competing with the whole transcript; \`<keepContext>\` around the requirement keeps it from being compacted away before the stage acts on it.
   - In interactive chat, named workflow launches run in the background. Run \`/workflow connect <run>\` to see agents working and chat with and steer each stage. Inspection and control calls (\`status\`, \`stages\`, \`stage\`, \`transcript\`, \`send\`, \`pause\`, \`resume\`, \`interrupt\`, \`quit\`) remain available while work runs.
   - \`workflow send\` is nonterminal-only: once the authoritative root run has completed, failed, skipped, been cancelled or killed, or ended terminal-blocked, start a new workflow if tracked work remains. Proceed inline only when the remaining task is small, deterministic, and low risk. Use explicit \`/workflow attach <run> <stage>\` for user-driven post-mortem chat; it does not resume or modify workflow execution.
   - Natural-language instructions to create or use a worktree do not enable runner isolation. A named workflow must declare and implement any worktree and feature-branch inputs it supports; inspect its inputs and pass a distinct path and branch for each concurrent item. Reusable \`baseBranch\` binding creates a missing target as a detached checkout from that base or reuses an existing same-repository worktree as-is; neither case checks out a separate feature-branch input.
@@ -75487,6 +75504,7 @@ var DEFAULT_PROMPT_GUIDANCE = [
   - Every workflow invocation automatically receives one stable, non-default Intercom group. Intercom-capable stages inherit it, nested workflows keep the top-level invocation group, and subagents inherit their launching stage's group. Do not mint or thread group names through ordinary workflow definitions. Use an explicit \`group\` only for an intentional override: a named group or \`group: true\` creates a subgroup, while \`group: "default"\` opts into the shared default group. Stages without Intercom access receive no group, and \`contact_supervisor\` still crosses group boundaries for authorized escalation.
   - Prefer \`ctx.tool(name, args, fn)\` for workflow-owned TypeScript operations with side effects, such as filesystem writes, network mutations, and external API actions. It creates a tracked, non-attachable durable graph node before invoking \`fn\`; it may be used before, between, after, or without model stages. A completed \`ctx.tool\` call is durably checkpointed with its serializable result, so resume replays that result without rerunning \`fn\`. For checks that may fail during a bounded repair loop, opt into \`failureMode: "return"\`, branch on the typed outcome, and pass only the needed error fields to the repair stage or artifact yourself; Atomic does not inject failure evidence into later prompts. Cancellation and storage faults still throw. Keep pure computation and side-effect-free transformations as ordinary TypeScript. Do not wrap agent-stage internals or every function call indiscriminately; this rule applies to side effects orchestrated directly by the workflow definition.
   - Pass large stage context through files/artifacts and \`reads\` with an explicit \`Read the file at <path>...\` prompt rather than large \`previous\` payloads or injected session history.
+  - Wrap critical stage-prompt content in \`<keepContext>\` / \`</keepContext>\`. Tagged content survives compression verbatim regardless of the compression ratio, and every line of the span including the tag lines is protected. A long-running stage will be compacted, and compaction ranks lines individually: an objective is verbose and restated while the constraint that narrows it is usually one line, so the constraint is the cheaper deletion and what survives reads as broader permission than intended. Tag role constraints that bound a stage to part of the work, acceptance criteria and immutable contracts, explicit prohibitions, and identifiers a stage must not lose such as a target branch, worktree path, or run ID. Do not tag bulk context: protected lines count against the keep target rather than raising it, so a large protected span makes the surrounding transcript compress harder — tag the constraint, not the material it applies to.
   - Separate implementation/review acceptance from explicitly authorized final actions such as PR/MR/review creation, release tagging, deployment, or publication. Stop implementation loops once acceptance is proven and carry a remaining final action separately.
   - A model stage sees its local prompt, artifacts, tools, and reads, not the graph name or surrounding implementation. State the concrete action, evidence, and success criteria directly.`
 ];

package/dist/builtin/workflows/src/extension/workflow-prompts.ts

@@ -4,6 +4,7 @@ export const WORKFLOW_TOOL_DESCRIPTION =
 	"discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, " +
 	"send prompt answers or steering only while the root workflow is nonterminal, pause/resume/interrupt/quit runs, and reload workflow resources. " +
 	"For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. " +
+	"Wrap critical parts of run inputs and steering messages in <keepContext>...</keepContext> so compaction preserves them verbatim in the stages that inherit them; tag role constraints, prohibitions, must-hold criteria, and identifiers, not background or bulk reference material. " +
 	"For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, " +
 	"quote the exact path without rewriting separators (Windows backslashes are valid), " +
 	"then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. " +
@@ -37,6 +38,8 @@ export const DEFAULT_PROMPT_GUIDANCE: string[] = [
   - Only skip workflows for tiny, deterministic, low-risk answers or direct edits where stage tracking clearly costs more than it adds, typically a single-file/no-test/no-review change or a simple answer.`,
 	`**Workflow discovery and lifecycle**:
   - For unfamiliar named workflows, discover with \`action: "list"\`, inspect with \`action: "get"\` or \`action: "inputs"\`, and run with \`action: "run"\`, \`workflow\`, and validated \`inputs\`; do not invent workflow names or input keys.
+  - Wrap critical parts of the \`inputs\` you pass — objective, prompt, acceptance criteria — in \`<keepContext>\` / \`</keepContext>\`. Tagged text survives compaction verbatim regardless of the compression ratio, and stages inherit it because workflows inject your inputs into their prompts. A long stage is compacted repeatedly, and compaction ranks lines individually: a verbose restated objective outlives the one line that bounds it, so a stage can end up executing a coherent but unbounded version of what you asked for. Decide this per launch rather than tagging everything — tag role constraints, prohibitions, must-hold criteria, and identifiers such as a target branch, worktree path, or issue number; leave background, quoted issue text, and reference material untagged and pass bulk through files and \`reads\`. Protected lines count against the keep target rather than raising it, so an over-tagged input makes the evidence stages need compress harder.
+  - Tag steering the same way. A \`send\` amendment is authoritative and stages must carry it forward, but it arrives late in an already-long session and is exactly one short message competing with the whole transcript; \`<keepContext>\` around the requirement keeps it from being compacted away before the stage acts on it.
   - In interactive chat, named workflow launches run in the background. Run \`/workflow connect <run>\` to see agents working and chat with and steer each stage. Inspection and control calls (\`status\`, \`stages\`, \`stage\`, \`transcript\`, \`send\`, \`pause\`, \`resume\`, \`interrupt\`, \`quit\`) remain available while work runs.
   - \`workflow send\` is nonterminal-only: once the authoritative root run has completed, failed, skipped, been cancelled or killed, or ended terminal-blocked, start a new workflow if tracked work remains. Proceed inline only when the remaining task is small, deterministic, and low risk. Use explicit \`/workflow attach <run> <stage>\` for user-driven post-mortem chat; it does not resume or modify workflow execution.
   - Natural-language instructions to create or use a worktree do not enable runner isolation. A named workflow must declare and implement any worktree and feature-branch inputs it supports; inspect its inputs and pass a distinct path and branch for each concurrent item. Reusable \`baseBranch\` binding creates a missing target as a detached checkout from that base or reuses an existing same-repository worktree as-is; neither case checks out a separate feature-branch input.
@@ -55,6 +58,7 @@ export const DEFAULT_PROMPT_GUIDANCE: string[] = [
   - Every workflow invocation automatically receives one stable, non-default Intercom group. Intercom-capable stages inherit it, nested workflows keep the top-level invocation group, and subagents inherit their launching stage's group. Do not mint or thread group names through ordinary workflow definitions. Use an explicit \`group\` only for an intentional override: a named group or \`group: true\` creates a subgroup, while \`group: "default"\` opts into the shared default group. Stages without Intercom access receive no group, and \`contact_supervisor\` still crosses group boundaries for authorized escalation.
   - Prefer \`ctx.tool(name, args, fn)\` for workflow-owned TypeScript operations with side effects, such as filesystem writes, network mutations, and external API actions. It creates a tracked, non-attachable durable graph node before invoking \`fn\`; it may be used before, between, after, or without model stages. A completed \`ctx.tool\` call is durably checkpointed with its serializable result, so resume replays that result without rerunning \`fn\`. For checks that may fail during a bounded repair loop, opt into \`failureMode: "return"\`, branch on the typed outcome, and pass only the needed error fields to the repair stage or artifact yourself; Atomic does not inject failure evidence into later prompts. Cancellation and storage faults still throw. Keep pure computation and side-effect-free transformations as ordinary TypeScript. Do not wrap agent-stage internals or every function call indiscriminately; this rule applies to side effects orchestrated directly by the workflow definition.
   - Pass large stage context through files/artifacts and \`reads\` with an explicit \`Read the file at <path>...\` prompt rather than large \`previous\` payloads or injected session history.
+  - Wrap critical stage-prompt content in \`<keepContext>\` / \`</keepContext>\`. Tagged content survives compression verbatim regardless of the compression ratio, and every line of the span including the tag lines is protected. A long-running stage will be compacted, and compaction ranks lines individually: an objective is verbose and restated while the constraint that narrows it is usually one line, so the constraint is the cheaper deletion and what survives reads as broader permission than intended. Tag role constraints that bound a stage to part of the work, acceptance criteria and immutable contracts, explicit prohibitions, and identifiers a stage must not lose such as a target branch, worktree path, or run ID. Do not tag bulk context: protected lines count against the keep target rather than raising it, so a large protected span makes the surrounding transcript compress harder — tag the constraint, not the material it applies to.
   - Separate implementation/review acceptance from explicitly authorized final actions such as PR/MR/review creation, release tagging, deployment, or publication. Stop implementation loops once acceptance is proven and carry a remaining final action separately.
   - A model stage sees its local prompt, artifacts, tools, and reads, not the graph name or surrounding implementation. State the concrete action, evidence, and success criteria directly.`,
 ];

package/dist/builtin/workflows/src/sdk-surface.ts

@@ -6,6 +6,7 @@
  */
 
 export type { Static, TSchema } from "typebox";
+export { KEEP_CONTEXT_CLOSE_TAG, KEEP_CONTEXT_OPEN_TAG, keepContext } from "./authoring/keep-context.js";
 export { workflow } from "./authoring/workflow.js";
 
 const REMOVED_RUN_WORKFLOW_MESSAGE =

package/dist/core/agent-session-methods.d.ts

@@ -12,7 +12,7 @@ import type { ModelRuntime } from "./model-runtime.ts";
 import type { PathMetadata } from "./package-manager.ts";
 import type { PromptTemplate } from "./prompt-templates.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
-import type { BranchSummaryEntry, SessionManager } from "./session-manager.js";
+import type { BranchSummaryEntry, SessionManager } from "./session-manager.ts";
 import type { SettingsManager } from "./settings-manager.ts";
 import type { BuildSystemPromptOptions } from "./system-prompt.ts";
 import type { BashOperations } from "./tools/bash.ts";