@cjhyy/code-shell-core 0.6.0-rc.8 → 0.7.0-beta.1

package/dist/engine/turn-loop.js

@@ -11,12 +11,14 @@ import { ContextLimitError } from "../exceptions.js";
 import { logger } from "../logging/logger.js";
 import { checkTokenBudget, createBudgetTracker } from "./token-budget.js";
 import { StreamingToolQueue } from "./streaming-tool-queue.js";
-import { estimateTokens } from "../context/compaction.js";
+import { downgradeImagePayloadsInHistory, estimateTokens, messageHasBase64ImagePayload, } from "../context/compaction.js";
 import { isTruncatedStop } from "../llm/stop-reason.js";
 import { isAbortError } from "../llm/client-base.js";
 import { crossedReactiveThreshold } from "./reactive-threshold.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "../tool-system/builtin/complete-goal.js";
 import { CANCEL_GOAL_TOOL_NAME } from "../tool-system/builtin/cancel-goal.js";
+import { redactSensitiveToolResultsInMessages, toolResultForDisplay, toolResultTranscriptText, toolResultsForDisplay, } from "../tool-system/tool-result-redaction.js";
+import { addTokenUsage, cacheHitRateFromUsage, cumulativeCacheHitRate, } from "./session-usage.js";
 import { createGoalBudgetTracker, recordGoalUsage, goalBudgetExceeded, applyGoalExtension, limitProximity, GOAL_DEFAULT_MAX_STOP_BLOCKS, } from "./goal.js";
 /**
  * 把一个 ToolResult 映射成发给 LLM 的 tool_result ContentBlock。
@@ -29,7 +31,7 @@ export function toolResultToBlock(result) {
         tool_use_id: result.id,
         content: result.error
             ? `Error: ${result.error}`
-            : result.contentBlocks ?? (result.result ?? "(no output)"),
+            : (result.contentBlocks ?? result.result ?? "(no output)"),
     };
     if (result.isError || result.error)
         block.is_error = true;
@@ -50,6 +52,16 @@ export class TurnLoop {
     currentTurnLog = logger;
     /** Last emitted ctx token estimate; used to skip no-op usage_update events. */
     lastCtxEmit = -1;
+    currentTurnUsage = {
+        promptTokens: 0,
+        completionTokens: 0,
+        totalTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+    };
+    currentCumulativeUsage;
+    sensitiveToolResultRedactions = new Map();
+    pendingImageMessages = new Set();
     /**
      * Consecutive on_stop blocks (Goal mode kept the agent going). Reset to 0
      * on any unblocked completion. When it reaches config.maxStopBlocks the
@@ -145,6 +157,9 @@ export class TurnLoop {
     config) {
         this.deps = deps;
         this.config = config;
+        for (const msg of this.config.freshImageMessages ?? []) {
+            this.pendingImageMessages.add(msg);
+        }
         // Wrap onStream so a single throwing handler can't silently break
         // the channel for the rest of the run. A 2026-05-25 incident saw a
         // sub-agent's events stop reaching the renderer ~23s into its run —
@@ -197,6 +212,52 @@ export class TurnLoop {
             return;
         this.deps.transcript.appendTurnStopped();
     }
+    prepareMessagesForModel(messages) {
+        const preserveMessages = this.pendingImageMessages.size > 0 ? this.pendingImageMessages : undefined;
+        const result = downgradeImagePayloadsInHistory(messages, { preserveMessages });
+        if (result.replacedCount > 0) {
+            this.currentTurnLog.info("context.image_payload_downgrade", {
+                cat: "context",
+                images: result.replacedCount,
+                pendingFresh: this.pendingImageMessages.size,
+            });
+        }
+        return result.messages;
+    }
+    markPendingImagesConsumed(messages) {
+        if (this.pendingImageMessages.size === 0)
+            return messages;
+        const consumedMessages = this.pendingImageMessages.size;
+        this.pendingImageMessages.clear();
+        const result = downgradeImagePayloadsInHistory(messages);
+        if (result.replacedCount > 0) {
+            this.currentTurnLog.info("context.image_payload_consumed", {
+                cat: "context",
+                images: result.replacedCount,
+                messages: consumedMessages,
+            });
+        }
+        return result.messages;
+    }
+    redactConsumedSensitiveToolResults(messages) {
+        if (this.sensitiveToolResultRedactions.size === 0)
+            return messages;
+        const redacted = redactSensitiveToolResultsInMessages(messages, this.sensitiveToolResultRedactions);
+        this.sensitiveToolResultRedactions.clear();
+        return redacted;
+    }
+    modelCallRecordingOptions() {
+        if (this.sensitiveToolResultRedactions.size === 0)
+            return undefined;
+        return {
+            sensitiveToolResultRedactions: new Map(this.sensitiveToolResultRedactions),
+        };
+    }
+    trackFreshImageMessage(message) {
+        if (messageHasBase64ImagePayload(message)) {
+            this.pendingImageMessages.add(message);
+        }
+    }
     async emitHook(event, data = {}) {
         return this.deps.hooks.emit(event, {
             ...data,
@@ -236,7 +297,16 @@ export class TurnLoop {
         if (ctx === this.lastCtxEmit)
             return;
         this.lastCtxEmit = ctx;
-        this.config.onStream({ type: "usage_update", promptTokens: ctx });
+        this.config.onStream({
+            type: "usage_update",
+            promptTokens: ctx,
+            promptTokensSource: overhead > 0 ? "calibrated_estimate" : "heuristic_estimate",
+            promptTokensConfidence: overhead > 0 ? "medium" : "low",
+        });
+    }
+    recordResponseUsage(usage) {
+        this.currentTurnUsage = addTokenUsage(this.currentTurnUsage, usage);
+        this.currentCumulativeUsage = this.deps.recordCumulativeUsage?.(usage);
     }
     emitCtxFromUsage(usage, messages) {
         if (!this.config.onStream)
@@ -254,29 +324,58 @@ export class TurnLoop {
             derivedOverhead: overhead,
             prev: this.lastCtxEmit,
         });
-        if (promptTokens === this.lastCtxEmit)
-            return;
-        this.lastCtxEmit = promptTokens;
+        const promptChanged = promptTokens !== this.lastCtxEmit;
+        if (promptChanged)
+            this.lastCtxEmit = promptTokens;
         // Forward the provider's cache counts so the UI can show a hit rate. Only
         // attach fields the provider actually reported — a spread keeps them off
         // the event entirely when undefined, so the renderer can tell "no cache
         // info this turn" from "0 cached". Estimate-path emits don't call this and
         // so carry no cache fields (correct: an estimate has no cache reading).
+        const singleTurnCacheHitRate = cacheHitRateFromUsage(this.currentTurnUsage);
+        const cumulative = this.currentCumulativeUsage;
+        const cumulativeHitRate = cumulative ? cumulativeCacheHitRate(cumulative) : undefined;
+        if (!promptChanged && singleTurnCacheHitRate === undefined && cumulativeHitRate === undefined) {
+            return;
+        }
         this.config.onStream({
             type: "usage_update",
             promptTokens,
-            ...(usage.cacheReadTokens !== undefined
-                ? { cacheReadTokens: usage.cacheReadTokens }
-                : {}),
+            promptTokensSource: "provider_usage",
+            promptTokensConfidence: "high",
+            ...(usage.cacheReadTokens !== undefined ? { cacheReadTokens: usage.cacheReadTokens } : {}),
             ...(usage.cacheCreationTokens !== undefined
                 ? { cacheCreationTokens: usage.cacheCreationTokens }
                 : {}),
+            singleTurnPromptTokens: this.currentTurnUsage.promptTokens,
+            singleTurnCacheReadTokens: this.currentTurnUsage.cacheReadTokens ?? 0,
+            singleTurnCacheCreationTokens: this.currentTurnUsage.cacheCreationTokens ?? 0,
+            ...(singleTurnCacheHitRate !== undefined ? { singleTurnCacheHitRate } : {}),
+            ...(cumulative
+                ? {
+                    cumulativePromptTokens: cumulative.cumulativePromptTokens,
+                    cumulativeCacheReadTokens: cumulative.cumulativeCacheReadTokens,
+                    cumulativeCacheCreationTokens: cumulative.cumulativeCacheCreationTokens,
+                    ...(cumulativeHitRate !== undefined
+                        ? { cumulativeCacheHitRate: cumulativeHitRate }
+                        : {}),
+                    // Legacy aliases for existing renderer builds. New UI code reads the
+                    // cumulative* fields above.
+                    sessionPromptTokens: cumulative.cumulativePromptTokens,
+                    sessionCacheReadTokens: cumulative.cumulativeCacheReadTokens,
+                    sessionCacheCreationTokens: cumulative.cumulativeCacheCreationTokens,
+                }
+                : {}),
         });
     }
     /**
      * Run the multi-turn agent loop until completion.
      */
     async run(initialMessages) {
+        const result = await this.runUnredacted(initialMessages);
+        return { ...result, messages: this.redactConsumedSensitiveToolResults(result.messages) };
+    }
+    async runUnredacted(initialMessages) {
         let messages = [...initialMessages];
         let finalText = "";
         const budgetTracker = createBudgetTracker();
@@ -300,6 +399,13 @@ export class TurnLoop {
         try {
             while (this.turnCount < this.config.maxTurns) {
                 this.turnCount++;
+                this.currentTurnUsage = {
+                    promptTokens: 0,
+                    completionTokens: 0,
+                    totalTokens: 0,
+                    cacheReadTokens: 0,
+                    cacheCreationTokens: 0,
+                };
                 // Abort fast-path: bail at the loop TOP before doing any per-turn work.
                 // Without this, an aborted child (parent abort, or the 30min per-call
                 // registry timeout) would run a full contextManager.manageAsync (itself
@@ -319,14 +425,7 @@ export class TurnLoop {
                 // they join THIS step's request — no abort, no lost in-flight work. Same
                 // loop-top user-push pattern as turnStartInjection / turn-limit warnings
                 // below. Push to transcript too so they persist + survive resume.
-                const steered = this.deps.consumeSteer?.() ?? [];
-                for (const { id, text } of steered) {
-                    if (!text)
-                        continue;
-                    messages.push({ role: "user", content: text });
-                    this.deps.transcript.appendMessage("user", text);
-                    this.config.onStream?.({ type: "steer_injected", text, id });
-                }
+                this.consumeQueuedSteer(messages, "normal_step");
                 const state = initialTurnState(this.turnCount);
                 // Per-turn correlation ID. Every log written through `tlog` (or any
                 // child derived from it) is stamped with `turn` + `turnId`, so
@@ -335,13 +434,18 @@ export class TurnLoop {
                 // returns; instead, each return-causing branch logs its own terminal
                 // event (model_error, completed, etc.).
                 const turnId = newTurnId();
+                const assistantMessageId = `assistant_${turnId}`;
                 const tlog = logger.child({ turn: this.turnCount, turnId });
                 this.currentTurnLog = tlog;
                 const turnStartedAt = Date.now();
                 tlog.info("turn.start", { cat: "turn", messageCount: messages.length });
                 // Tag downstream tool-exec / permission lines with this turn's IDs.
                 this.deps.toolExecutor.setLogger(tlog);
-                this.config.onStream?.({ type: "stream_request_start", turnNumber: this.turnCount });
+                this.config.onStream?.({
+                    type: "stream_request_start",
+                    turnNumber: this.turnCount,
+                    messageId: assistantMessageId,
+                });
                 const turnStartHook = await this.emitHook("on_turn_start", {
                     turnNumber: this.turnCount,
                 });
@@ -378,15 +482,28 @@ export class TurnLoop {
                 // Goal mode: announce once when nearing EITHER stop ceiling (turns or
                 // stop-blocks) so the UI can offer a "再续" button while still live.
                 this.maybeAnnounceApproachingLimit();
-                // Pre-check: context management (async — may trigger LLM summarization)
-                messages = await this.deps.contextManager.manageAsync(messages);
-                // manageAsync can itself issue an LLM summarization call lasting several
-                // seconds; if the signal aborted during it, stop here rather than
-                // proceeding into the (expensive) main model call. Belt to the loop-top
-                // brace: this catches an abort that landed *inside* context management.
-                if (this.config.signal?.aborted) {
-                    this.markStopped();
-                    return { text: finalText, reason: "aborted_streaming", messages };
+                // Pre-check: downgrade image payloads that have already had their one
+                // model-consumption turn, then run context management. Fresh images in
+                // pendingImageMessages are preserved through this next model request.
+                const hasPendingSensitiveToolResults = this.sensitiveToolResultRedactions.size > 0;
+                messages = this.prepareMessagesForModel(messages);
+                if (hasPendingSensitiveToolResults) {
+                    tlog.info("turn.sensitive_tool_result_context_management_skipped", {
+                        cat: "turn",
+                        count: this.sensitiveToolResultRedactions.size,
+                    });
+                }
+                else {
+                    // Context management (async — may trigger LLM summarization)
+                    messages = await this.deps.contextManager.manageAsync(messages);
+                    // manageAsync can itself issue an LLM summarization call lasting several
+                    // seconds; if the signal aborted during it, stop here rather than
+                    // proceeding into the (expensive) main model call. Belt to the loop-top
+                    // brace: this catches an abort that landed *inside* context management.
+                    if (this.config.signal?.aborted) {
+                        this.markStopped();
+                        return { text: finalText, reason: "aborted_streaming", messages };
+                    }
                 }
                 // No pre-llm ctx emit here: the messages-only estimate would be ~16k
                 // smaller than the real prompt (system + tools not included), making
@@ -400,7 +517,9 @@ export class TurnLoop {
                 // call. Microcompact is lossless (just clearing redundant
                 // tool_results) so we suppress hook emits for it to keep token
                 // overhead down.
-                const pending = this.deps.consumePendingCompactInfo?.();
+                const pending = hasPendingSensitiveToolResults
+                    ? null
+                    : this.deps.consumePendingCompactInfo?.();
                 if (pending && pending.strategy !== "micro") {
                     const compactHook = await this.emitHook("post_compact", {
                         strategy: pending.strategy,
@@ -415,11 +534,12 @@ export class TurnLoop {
                 // Model call (with streaming fallback and max_output_tokens continuation)
                 // Track tool IDs streamed during this turn to avoid duplicate UI events
                 this.streamedToolIds.clear();
-                // Streaming tool queue: start concurrency-safe tools during streaming
+                // Tool queue is created before the call, but enqueue happens only after
+                // the complete LLMResponse is available below.
                 const streamingQueue = new StreamingToolQueue(this.deps.toolExecutor);
                 let response;
                 try {
-                    response = await this.callModelWithFallback(messages);
+                    response = await this.callModelWithFallback(messages, assistantMessageId);
                 }
                 catch (err) {
                     if (err instanceof ContextLimitError) {
@@ -430,13 +550,14 @@ export class TurnLoop {
                             tlog.warn("turn.ptl_recovery", { cat: "turn", retry, roundsToDrop: retry });
                             messages = dropOldestRounds(messages, retry);
                             try {
-                                response = await this.callModelWithFallback(messages);
+                                response = await this.callModelWithFallback(messages, assistantMessageId);
                                 recovered = true;
                                 break;
                             }
                             catch (retryErr) {
                                 if (!(retryErr instanceof ContextLimitError)) {
                                     this.config.onStream?.({ type: "error", error: formatFriendlyError(retryErr) });
+                                    messages = this.redactConsumedSensitiveToolResults(messages);
                                     return { text: finalText, reason: "model_error", messages };
                                 }
                             }
@@ -447,6 +568,7 @@ export class TurnLoop {
                                 type: "error",
                                 error: "Context limit exceeded after 3 recovery attempts",
                             });
+                            messages = this.redactConsumedSensitiveToolResults(messages);
                             return { text: finalText, reason: "prompt_too_long", messages };
                         }
                     }
@@ -460,24 +582,31 @@ export class TurnLoop {
                         // interrupted turn folds behind the process-card header on reload).
                         this.patchOrphanedToolUses(messages);
                         this.markStopped();
+                        messages = this.redactConsumedSensitiveToolResults(messages);
                         return { text: finalText, reason: "aborted_streaming", messages };
                     }
                     else {
                         this.patchOrphanedToolUses(messages);
                         this.config.onStream?.({ type: "error", error: formatFriendlyError(err) });
+                        messages = this.redactConsumedSensitiveToolResults(messages);
                         return { text: finalText, reason: "model_error", messages };
                     }
                 }
-                // UI ctx bar: prefer the provider's authoritative promptTokens.
+                messages = this.redactConsumedSensitiveToolResults(messages);
+                // Record the response once into current-turn and whole-session counters.
                 if (response.usage?.promptTokens !== undefined) {
+                    this.recordResponseUsage(response.usage);
                     this.emitCtxFromUsage(response.usage, messages);
                 }
                 // Feed actual token usage back to the context manager so subsequent
                 // compaction decisions use hybrid (actual + delta) estimation rather than
                 // pure heuristics. Without this the manager falls back to char/4 estimates.
                 if (response.usage?.promptTokens !== undefined) {
-                    this.deps.contextManager.recordActualUsage(response.usage.promptTokens, messages.length);
+                    const anchor = this.deps.contextManager.recordActualUsage(response.usage.promptTokens, messages.length, messages);
+                    if (anchor)
+                        this.deps.recordContextUsageAnchor?.(anchor);
                 }
+                messages = this.markPendingImagesConsumed(messages);
                 // Truncation that cut off a TOOL CALL: the model overflowed
                 // max_output_tokens mid tool-call, so the arg JSON is incomplete (e.g. a
                 // Write whose `content` was clipped, leaving file_path unset). Executing
@@ -506,6 +635,7 @@ export class TurnLoop {
                     response.toolCalls.length === 0 &&
                     response.text) {
                     let combinedText = response.text;
+                    let continuedResponse = false;
                     for (let retry = 0; retry < 3; retry++) {
                         // Don't fire another continuation call if the user cancelled — without
                         // this an abort during a truncated response could still issue up to 3
@@ -522,7 +652,11 @@ export class TurnLoop {
                             },
                         ];
                         try {
-                            const contResponse = await this.deps.model.call(this.deps.systemPrompt, contMessages, this.deps.tools, this.config.onStream, this.config.signal);
+                            const contResponse = await this.deps.model.call(this.deps.systemPrompt, this.prepareMessagesForModel(contMessages), this.deps.tools, this.config.onStream, this.config.signal);
+                            if (contResponse.usage?.promptTokens !== undefined) {
+                                this.recordResponseUsage(contResponse.usage);
+                                continuedResponse = true;
+                            }
                             combinedText += contResponse.text;
                             if (!isTruncatedStop(contResponse.stopReason) || contResponse.toolCalls.length > 0) {
                                 response = { ...contResponse, text: combinedText };
@@ -534,10 +668,9 @@ export class TurnLoop {
                         }
                     }
                     response = { ...response, text: combinedText };
-                }
-                // After any continuation, send latest usage so ctx bar reflects real context
-                if (response.usage?.promptTokens !== undefined) {
-                    this.emitCtxFromUsage(response.usage, messages);
+                    if (continuedResponse && response.usage?.promptTokens !== undefined) {
+                        this.emitCtxFromUsage(response.usage, messages);
+                    }
                 }
                 // Goal-mode run-scoped accounting: add this turn's total token usage
                 // (prompt + completion) to the running total. Done after continuation so
@@ -568,6 +701,7 @@ export class TurnLoop {
                     });
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: {
                             role: "assistant",
                             content: "（Goal 预算已耗尽，强制停止。）",
@@ -580,6 +714,7 @@ export class TurnLoop {
                     // No tool use — final answer
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: { role: "assistant", content: finalText },
                     });
                     await this.emitHook("on_turn_end", {
@@ -587,6 +722,9 @@ export class TurnLoop {
                         hasToolUse: false,
                     });
                     messages.push({ role: "assistant", content: finalText });
+                    if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        continue;
+                    }
                     // on_stop seam: the model wants to stop. Give handlers (Goal mode)
                     // a chance to BLOCK termination and keep the agent working. A
                     // handler returning continueSession=true injects its messages and
@@ -652,6 +790,7 @@ export class TurnLoop {
                         });
                         this.config.onStream?.({
                             type: "assistant_message",
+                            messageId: assistantMessageId,
                             message: {
                                 role: "assistant",
                                 content: `（Goal 续跑已达 ${maxStopBlocks} 次上限，先停下。）`,
@@ -668,10 +807,17 @@ export class TurnLoop {
                         });
                     }
                     this.stopBlockCount = 0;
+                    if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        continue;
+                    }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 // Tool execution phase
-                tlog.info("turn.tool_use", { cat: "turn", tools: response.toolCalls.map((t) => t.toolName) });
+                tlog.info("turn.tool_use", {
+                    cat: "turn",
+                    tools: response.toolCalls.map((t) => t.toolName),
+                });
                 const toolCalls = response.toolCalls.slice(0, this.config.maxToolCallsPerTurn);
                 // Per-turn cap: any calls beyond maxToolCallsPerTurn are NOT executed and
                 // NOT added to the assistant message below, so the model never sees a
@@ -709,8 +855,13 @@ export class TurnLoop {
                 const resultBlocks = [];
                 for (const result of results) {
                     resultBlocks.push(toolResultToBlock(result));
-                    this.deps.transcript.appendToolResult(result.id, result.toolName, result.result, result.error);
-                    this.config.onStream?.({ type: "tool_result", result });
+                    const streamResult = toolResultForDisplay(result);
+                    const transcriptResult = toolResultTranscriptText(result);
+                    if (result.sensitive && transcriptResult !== undefined) {
+                        this.sensitiveToolResultRedactions.set(result.id, transcriptResult);
+                    }
+                    this.deps.transcript.appendToolResult(result.id, result.toolName, transcriptResult, result.error, result.sensitive ? undefined : result.contentBlocks);
+                    this.config.onStream?.({ type: "tool_result", result: streamResult });
                 }
                 // Fire-and-forget tool use summary (non-blocking). The whole chain is
                 // best-effort observability — a thrown onStream handler, a failed dynamic
@@ -721,9 +872,13 @@ export class TurnLoop {
                         .then(({ generateToolUseSummary }) => {
                         if (!this.deps.model.summarize)
                             return;
-                        return generateToolUseSummary(toolCalls, results, this.deps.model.summarize).then((summary) => {
+                        return generateToolUseSummary(toolCalls, toolResultsForDisplay(results), this.deps.model.summarize).then((summary) => {
                             if (summary) {
-                                this.config.onStream?.({ type: "tool_summary", summary });
+                                this.config.onStream?.({
+                                    type: "tool_summary",
+                                    summary,
+                                    toolCallIds: toolCalls.map((toolCall) => toolCall.id),
+                                });
                             }
                         });
                     })
@@ -734,7 +889,9 @@ export class TurnLoop {
                         });
                     });
                 }
-                messages.push({ role: "user", content: resultBlocks });
+                const toolResultMessage = { role: "user", content: resultBlocks };
+                messages.push(toolResultMessage);
+                this.trackFreshImageMessage(toolResultMessage);
                 // B-3: tell the model which of its requested tool calls were dropped by
                 // the per-turn cap so it can re-issue them, instead of silently assuming
                 // they ran. Appended to the same user message that carries the results.
@@ -773,6 +930,10 @@ export class TurnLoop {
                     tlog.info("turn.goal_self_reported_complete", { cat: "goal" });
                     this.stopBlockCount = 0;
                     this.deps.clearPersistedGoal?.();
+                    if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        continue;
+                    }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 // Goal mode: user-initiated cancellation. cancel_goal is the "strong
@@ -785,6 +946,9 @@ export class TurnLoop {
                     tlog.info("turn.goal_user_cancelled", { cat: "goal" });
                     this.stopBlockCount = 0;
                     this.deps.clearPersistedGoal?.();
+                    if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        continue;
+                    }
                     return { text: finalText, reason: "completed", messages };
                 }
                 // Token budget check
@@ -798,9 +962,14 @@ export class TurnLoop {
                     });
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: { role: "assistant", content: finalText },
                     });
                     messages.push({ role: "assistant", content: finalText });
+                    if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        continue;
+                    }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 if (budgetDecision === "nudge") {
@@ -861,6 +1030,7 @@ export class TurnLoop {
             // no error event, so the UI shows only the "你停止了本轮" line.
             if (isAbortError(err) || this.config.signal?.aborted) {
                 this.markStopped();
+                messages = this.redactConsumedSensitiveToolResults(messages);
                 return { text: finalText, reason: "aborted_streaming", messages };
             }
             this.currentTurnLog.error("turn.unhandled_error", {
@@ -869,6 +1039,7 @@ export class TurnLoop {
                 stack: err.stack?.split("\n").slice(0, 4).join("\n"),
             });
             this.config.onStream?.({ type: "error", error: formatFriendlyError(err) });
+            messages = this.redactConsumedSensitiveToolResults(messages);
             return { text: finalText, reason: "model_error", messages };
         }
         // Max turns reached — do one final summarization call (no tools)
@@ -877,15 +1048,28 @@ export class TurnLoop {
             maxTurns: this.config.maxTurns,
             turnCount: this.turnCount,
         });
-        messages = this.deps.contextManager.manage(messages);
+        this.consumeQueuedSteer(messages, "finalize_backfill");
+        const hasPendingSensitiveToolResults = this.sensitiveToolResultRedactions.size > 0;
+        messages = this.prepareMessagesForModel(messages);
+        if (hasPendingSensitiveToolResults) {
+            logger.info("turn.sensitive_tool_result_context_management_skipped", {
+                cat: "turn",
+                count: this.sensitiveToolResultRedactions.size,
+                phase: "max_turns_summary",
+            });
+        }
+        else {
+            messages = this.deps.contextManager.manage(messages);
+        }
         messages.push({
             role: "user",
             content: "<system-reminder>Turn limit reached. Provide a final summary of what you accomplished and what remains to be done. Do NOT call any tools.</system-reminder>",
         });
         this.emitCtxFromMessages(messages);
         try {
-            const summaryResponse = await this.deps.model.call(this.deps.systemPrompt, messages, [], // No tools available for summary turn
-            this.config.onStream, this.config.signal);
+            const summaryResponse = await this.deps.model.call(this.deps.systemPrompt, this.prepareMessagesForModel(messages), [], // No tools available for summary turn
+            this.config.onStream, this.config.signal, this.modelCallRecordingOptions());
+            messages = this.markPendingImagesConsumed(messages);
             if (summaryResponse.text) {
                 finalText = summaryResponse.text;
             }
@@ -901,14 +1085,14 @@ export class TurnLoop {
             });
             messages.push({ role: "assistant", content: finalText });
         }
-        this.config.onStream?.({ type: "turn_complete", reason: "max_turns" });
+        messages = this.redactConsumedSensitiveToolResults(messages);
         return { text: finalText, reason: "max_turns", messages };
     }
     /**
      * Call model with streaming fallback.
      * If streaming fails, emit tombstone and retry non-streaming.
      */
-    async callModelWithFallback(messages) {
+    async callModelWithFallback(messages, assistantMessageId) {
         // Wrap stream callback to track tool_use_start events and reactive compaction
         let streamingResponseTokens = 0;
         let reactiveBucket = -1;
@@ -940,7 +1124,7 @@ export class TurnLoop {
             }
             : undefined;
         try {
-            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal);
+            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal, this.modelCallRecordingOptions());
         }
         catch (err) {
             // If it's a context or rate limit error, don't fallback — propagate
@@ -960,19 +1144,52 @@ export class TurnLoop {
             // really just a cancel. The signal is the authoritative cancel source.
             if (isAbortError(err) || this.config.signal?.aborted)
                 throw err;
+            // Sensitive tool results are model-facing exactly once. A streaming
+            // fallback would re-send the same pending plaintext in a second request,
+            // so fail the turn and let the unified exit redact returned history.
+            if (this.sensitiveToolResultRedactions.size > 0) {
+                this.config.onStream?.({ type: "tombstone", messageId: assistantMessageId });
+                this.currentTurnLog.warn("turn.streaming_fallback_skipped_sensitive", {
+                    cat: "turn",
+                    error: err.message,
+                });
+                throw err;
+            }
             // Streaming might have partially emitted — send tombstone to revoke
-            this.config.onStream?.({ type: "tombstone", messageId: `turn_${this.turnCount}` });
+            this.config.onStream?.({ type: "tombstone", messageId: assistantMessageId });
             this.currentTurnLog.warn("turn.streaming_fallback", {
                 cat: "turn",
                 error: err.message,
             });
             // Retry without streaming
-            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal);
+            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal, this.modelCallRecordingOptions());
         }
     }
     get currentTurn() {
         return this.turnCount;
     }
+    consumeQueuedSteer(messages, source) {
+        const steered = this.deps.consumeSteer?.(source) ?? [];
+        let consumed = false;
+        for (const { id, text, clientMessageId } of steered) {
+            if (!text)
+                continue;
+            if (clientMessageId && this.deps.claimClientMessageId?.(clientMessageId, "steer") === false) {
+                logger.info("steer.submit.duplicate_ignored", {
+                    clientMessageId,
+                    steerId: id,
+                    sessionId: this.deps.sessionId,
+                    source,
+                });
+                continue;
+            }
+            consumed = true;
+            messages.push({ role: "user", content: text });
+            this.deps.transcript.appendMessage("user", text, { steerId: id, clientMessageId });
+            this.config.onStream?.({ type: "steer_injected", text, id });
+        }
+        return consumed;
+    }
     /**
      * Generate synthetic error tool_results for any dangling tool_use blocks
      * that never received results (e.g. because the API call failed).