@cjhyy/code-shell-core 0.9.2 → 0.9.4

package/dist/cli/agent-server-stdio.js

@@ -30,10 +30,11 @@
  * bootstrap is invisible to them.
  */
 import { join } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
 import { Engine } from "../engine/engine.js";
 import { EngineRuntime } from "../engine/runtime.js";
 import { ChatSessionManager } from "../protocol/chat-session-manager.js";
-import { SessionManager } from "../session/session-manager.js";
+import { assertSafeSessionId, SessionManager, sessionsRoot } from "../session/session-manager.js";
 import { validateSettings } from "../settings/schema.js";
 import { AgentServer } from "../protocol/server.js";
 import { StdioTransport } from "../protocol/transport.js";
@@ -122,6 +123,29 @@ const composition = compileComposition({ modules: await loadConfiguredAgentModul
 // byte-for-byte.
 const dataRoot = process.env.CODE_SHELL_DATA_ROOT?.trim() || undefined;
 const dataSessionsDir = dataRoot ? join(dataRoot, "sessions") : undefined;
+const notificationSessionsDir = dataSessionsDir ?? sessionsRoot();
+const notificationPersistence = {
+    fileForSession(sessionId) {
+        try {
+            assertSafeSessionId(sessionId);
+            return join(notificationSessionsDir, sessionId, "pending-notifications.json");
+        }
+        catch {
+            return null;
+        }
+    },
+    listSessionIds() {
+        try {
+            return readdirSync(notificationSessionsDir, { withFileTypes: true })
+                .filter((entry) => entry.isDirectory() &&
+                existsSync(join(notificationSessionsDir, entry.name, "pending-notifications.json")))
+                .map((entry) => entry.name);
+        }
+        catch {
+            return [];
+        }
+    },
+};
 // Load settings once to derive llm config for the seed engine.
 // Desktop is a host application: read the full disk hierarchy (incl. the
 // user's ~/.code-shell). The SDK default 'project' would skip user config.
@@ -364,6 +388,7 @@ const agentServer = new AgentServer({
     // Cold background-wakeup rehydrate must read the same sessions store the
     // engines write when the data root is relocated (undefined → default root).
     sessionDiskRoot: dataSessionsDir,
+    notificationPersistence,
     // Config hot-reload (layer 2) reads disk through the SAME closure the
     // engineFactory uses for new sessions, so a reloaded running session and a
     // newly-created session converge on identical disk config (no divergence).

package/dist/cli/agent-server-tcp.js

@@ -34,11 +34,39 @@ import { startAutomation } from "../automation/index.js";
 import { CronStore, defaultCronStorePath } from "../automation/store.js";
 import { resolveLLMConfigForTag } from "../engine/resolve-llm-config.js";
 import { randomUUID } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
 import { getApprovalRouter } from "../tool-system/permission.js";
-import { SessionManager } from "../session/session-manager.js";
+import { assertSafeSessionId, SessionManager, sessionsRoot } from "../session/session-manager.js";
+import { notificationQueue } from "../tool-system/builtin/agent-notifications.js";
 const cwd = process.env.AGENT_CWD ?? process.cwd();
 const port = Number(process.env.AGENT_TCP_PORT ?? "4321");
 const host = process.env.AGENT_TCP_HOST ?? "127.0.0.1";
+const dataRoot = process.env.CODE_SHELL_DATA_ROOT?.trim() || undefined;
+const dataSessionsDir = dataRoot ? join(dataRoot, "sessions") : undefined;
+const notificationSessionsDir = dataSessionsDir ?? sessionsRoot();
+notificationQueue.attachPersistence({
+    fileForSession(sessionId) {
+        try {
+            assertSafeSessionId(sessionId);
+            return join(notificationSessionsDir, sessionId, "pending-notifications.json");
+        }
+        catch {
+            return null;
+        }
+    },
+    listSessionIds() {
+        try {
+            return readdirSync(notificationSessionsDir, { withFileTypes: true })
+                .filter((entry) => entry.isDirectory() &&
+                existsSync(join(notificationSessionsDir, entry.name, "pending-notifications.json")))
+                .map((entry) => entry.name);
+        }
+        catch {
+            return [];
+        }
+    },
+});
 const settingsManager = new SettingsManager(cwd, "full");
 // Read once at startup and reuse for every session (see engineFactory below).
 // This is intentional for the TCP host: it's a headless long-running server,
@@ -53,7 +81,12 @@ if (!seedLlm) {
 }
 const llmConfig = seedLlm;
 // ── Shared runtime (same bootstrap as stdio) ─────────────────────
-const seedEngine = new Engine({ llm: llmConfig, cwd, settingsScope: "full" });
+const seedEngine = new Engine({
+    llm: llmConfig,
+    cwd,
+    settingsScope: "full",
+    sessionStorageDir: dataSessionsDir,
+});
 const modelPool = seedEngine.getModelPool();
 const toolRegistry = seedEngine.getRuntimeToolRegistry();
 const resolvedLlmConfig = seedEngine.getConfig().llm;
@@ -92,11 +125,13 @@ const chatManager = new ChatSessionManager({
             ...personalizationFrom(settings.agent),
             maxTurns: slice.maxTurns,
             maxContextTokens: slice.maxContextTokens,
+            sessionStorageDir: slice.sessionStorageDir ?? dataSessionsDir,
             ...(slice.cwd ? { cwd: slice.cwd } : {}),
         });
     },
     maxSessions: 16,
     idleTtlMs: 30 * 60 * 1000,
+    ...(dataRoot ? { dataRoot } : {}),
 });
 chatManager.startIdleSweeper();
 // ── Automation (same module the desktop loads) ──────────────────
@@ -109,23 +144,38 @@ const automationRunManager = createRunManager({
     approvalBackend: new HeadlessApprovalBackend("approve-read-only"),
 });
 const automation = startAutomation({
-    store: new CronStore(defaultCronStorePath()),
+    store: new CronStore(defaultCronStorePath(dataRoot)),
     runManager: automationRunManager,
 });
 // ── Serve over TCP ──────────────────────────────────────────────
 // One AgentServer per accepted connection, all sharing the same chatManager.
 const servers = new Set();
-const goalDiskManager = new SessionManager();
-listenTcp({ port, host }, (transport, socket) => {
-    const server = new AgentServer({
+const goalDiskManager = new SessionManager(dataSessionsDir);
+function createTcpAgentServer(transport, connectionId, ownsBackgroundWakeups) {
+    return new AgentServer({
         chatManager,
         transport,
-        connectionId: randomUUID(),
+        connectionId,
         approvalRouter: getApprovalRouter(),
+        sessionDiskRoot: dataSessionsDir,
+        ownsBackgroundWakeups,
         readActiveGoalFromDisk: (sessionId) => goalDiskManager.readActiveGoal(sessionId),
         updateActiveGoalOnDisk: (sessionId, patch) => goalDiskManager.updateActiveGoal(sessionId, patch)?.goal,
         clearActiveGoalOnDisk: (sessionId, expected) => goalDiskManager.clearActiveGoal(sessionId, expected),
     });
+}
+// Own restoration for the whole TCP process, not for the first client. This
+// wakes pending chats immediately after a headless restart even if nobody has
+// connected a UI yet. Per-connection servers still forward live observations
+// but do not race this owner for mailbox consumption.
+const backgroundWakeTransport = {
+    send() { },
+    onMessage() { },
+    close() { },
+};
+const backgroundWakeServer = createTcpAgentServer(backgroundWakeTransport, "tcp-background-wakeup", true);
+listenTcp({ port, host }, (transport, socket) => {
+    const server = createTcpAgentServer(transport, randomUUID(), false);
     servers.add(server);
     socket.once("close", () => {
         server.disconnect();
@@ -138,6 +188,7 @@ listenTcp({ port, host }, (transport, socket) => {
         automation.stop();
         for (const s of servers)
             s.close();
+        backgroundWakeServer.close();
         void listener.close().then(() => process.exit(0));
     };
     process.on("SIGTERM", shutdown);

package/dist/engine/engine.d.ts

@@ -317,6 +317,14 @@ export declare class Engine {
      * in-process AgentServer to decide whether to wire an interactive askUser.
      */
     isHeadless(): boolean;
+    /**
+     * A background_notification park only makes sense where the Session can be
+     * woken by the completion later (server refuses headless; sub-agent sessions
+     * are not in chatManager) — everywhere else honouring it would end the run
+     * early and orphan the background result. A reply_committed boundary is
+     * synchronous and never suppressed.
+     */
+    private suppressesRunYield;
     get permissionMode(): NonNullable<EngineConfig["permissionMode"]>;
     get planMode(): boolean;
     /**

package/dist/engine/engine.js

@@ -804,6 +804,16 @@ export class Engine {
     isHeadless() {
         return this.config.headless === true;
     }
+    /**
+     * A background_notification park only makes sense where the Session can be
+     * woken by the completion later (server refuses headless; sub-agent sessions
+     * are not in chatManager) — everywhere else honouring it would end the run
+     * early and orphan the background result. A reply_committed boundary is
+     * synchronous and never suppressed.
+     */
+    suppressesRunYield(reason) {
+        return (reason === "background_notification" && (this.isHeadless() || this.config.isSubAgent === true));
+    }
     get permissionMode() {
         return this.permissionController.permissionMode;
     }
@@ -2172,18 +2182,12 @@ export class Engine {
             publishGoalJudgeContext: (context) => {
                 publishGoalJudgeContext(context);
             },
-            // A background_notification yield parks the run until the Session is
-            // woken by the completion notification. Only a top-level interactive
-            // session can be woken (server refuses headless; sub-agent sessions
-            // are not in chatManager) — everywhere else honouring the yield would
-            // end the run early and orphan the background result, so the loop
-            // never sees the request and the model keeps its full turn.
-            ...(this.isHeadless() || this.config.isSubAgent === true
-                ? {}
-                : {
-                    peekToolRunYield: () => toolCtx.runYield?.peek?.(),
-                    consumeToolRunYield: () => toolCtx.runYield?.consume(),
-                }),
+            // A background_notification yield is visible only where the Session
+            // can be woken later. A committed host reply is a synchronous terminal
+            // boundary, so it must remain visible in headless and sub-agent runs.
+            // One predicate serves peek and consume so they can never disagree.
+            peekToolRunYield: (reason) => !this.suppressesRunYield(reason) && toolCtx.runYield?.peek(reason) === true,
+            consumeToolRunYield: (reason) => !this.suppressesRunYield(reason) && toolCtx.runYield?.consume(reason) === true,
             ctxOverheadStore: {
                 get: (s) => this.ctxOverheadBySid.get(s) ?? 0,
                 set: (s, n) => {

package/dist/engine/model-facade.d.ts

@@ -2,11 +2,14 @@
  * Model call facade — wraps LLM client with transcript integration.
  */
 import type { LLMClientBase } from "../llm/client-base.js";
+import type { PromptCacheRequestContext } from "../llm/prompt-cache.js";
 import type { Message, ToolDefinition, LLMResponse, StreamCallback } from "../types.js";
 import { Transcript } from "../session/transcript.js";
 import { type PromptPrefixFingerprint } from "./prompt-cache-diagnostics.js";
 export interface ModelCallRecordingOptions {
     sensitiveToolResultRedactions?: ReadonlyMap<string, string>;
+    /** Cache boundary metadata; scopeId is filled from the active session. */
+    promptCache?: Omit<PromptCacheRequestContext, "scopeId">;
 }
 /**
  * Prompt-cache hit rate for one request, as CC computes it:

package/dist/engine/model-facade.js

@@ -89,6 +89,7 @@ export class ModelFacade {
                     }
                 },
                 signal,
+                promptCache: { scopeId: sid, ...recordingOptions?.promptCache },
             });
         }
         catch (err) {
@@ -144,6 +145,7 @@ export class ModelFacade {
                 tools,
                 stream: false,
                 signal,
+                promptCache: { scopeId: sid, ...recordingOptions?.promptCache },
             });
         }
         catch (err) {

package/dist/engine/run-tooling.js

@@ -10,7 +10,7 @@ import { applyDynamicToolDef } from "./dynamic-tool-defs.js";
 /** engine.ts L1485-1522 —— ToolContext 组装(spawner、agentDefinitions、base 由调用方传入)。 */
 export function buildRunToolContext(args) {
     const { options, profile, profileParams } = args;
-    let pendingRunYield;
+    const pendingRunYield = new Set();
     // sessionId is filled in after the session bundle is resolved below
     // (the session may be cold-started or resumed). Until then this is
     // intentionally shaped as a mutable local; we treat it as immutable
@@ -40,16 +40,16 @@ export function buildRunToolContext(args) {
             toolCtx.cwd = nextCwd;
         },
         runYield: {
+            // Reasons accumulate independently — a batch may both commit a host
+            // reply and launch background work; the turn loop decides precedence.
             request(reason) {
-                pendingRunYield ??= reason;
+                pendingRunYield.add(reason);
             },
-            peek() {
-                return pendingRunYield;
+            peek(reason) {
+                return pendingRunYield.has(reason);
             },
-            consume() {
-                const reason = pendingRunYield;
-                pendingRunYield = undefined;
-                return reason;
+            consume(reason) {
+                return pendingRunYield.delete(reason);
             },
         },
         skillAllowlist: options?.skillAllowlist !== undefined

package/dist/engine/streaming-tool-queue.d.ts

@@ -17,12 +17,15 @@ import type { ToolCall, ToolResult } from "../types.js";
 import type { ToolExecutor } from "../tool-system/executor.js";
 export declare class StreamingToolQueue {
     private readonly executor;
+    private readonly pendingUnsafeSkipReason?;
     private readonly pending;
     private readonly unsafeQueue;
     private readonly callOrder;
     private readonly toolNameById;
     private draining;
-    constructor(executor: ToolExecutor);
+    constructor(executor: ToolExecutor, options?: {
+        pendingUnsafeSkipReason?: () => string | undefined;
+    });
     /**
      * Enqueue a tool from the completed response. Concurrency-safe tools start
      * immediately within this post-response phase; unsafe tools are queued for

package/dist/engine/streaming-tool-queue.js

@@ -15,13 +15,15 @@
  */
 export class StreamingToolQueue {
     executor;
+    pendingUnsafeSkipReason;
     pending = new Map();
     unsafeQueue = [];
     callOrder = [];
     toolNameById = new Map();
     draining = false;
-    constructor(executor) {
+    constructor(executor, options) {
         this.executor = executor;
+        this.pendingUnsafeSkipReason = options?.pendingUnsafeSkipReason;
     }
     /**
      * Enqueue a tool from the completed response. Concurrency-safe tools start
@@ -62,8 +64,21 @@ export class StreamingToolQueue {
         this.draining = true;
         const resultMap = new Map();
         // Execute unsafe tools sequentially. A rejection here must not stop the
-        // remaining unsafe tools from running.
+        // remaining unsafe tools from running. A trusted terminal boundary may,
+        // however, skip calls that have not started yet. We still synthesize one
+        // result per call so tool_use/tool_result history remains structurally
+        // complete even though the run will stop after this batch.
         for (const call of this.unsafeQueue) {
+            const skipReason = this.pendingUnsafeSkipReason?.();
+            if (skipReason) {
+                resultMap.set(call.id, {
+                    id: call.id,
+                    toolName: call.toolName,
+                    error: `Tool execution skipped: ${skipReason}`,
+                    isError: true,
+                });
+                continue;
+            }
             const p = this.executor.executeSingle(call);
             this.pending.set(call.id, p);
             resultMap.set(call.id, await this.toResult(call.id, call.toolName, p));

package/dist/engine/turn-loop.d.ts

@@ -150,10 +150,10 @@ export interface TurnLoopDeps {
      * built-in judge closure; it is never added to the public on_stop context.
      */
     publishGoalJudgeContext?: (context: GoalJudgeRuntimeContext) => void;
-    /** Inspect a trusted tool's pending run yield without clearing it. */
-    peekToolRunYield?: () => import("../tool-system/context.js").ToolRunYieldReason | undefined;
-    /** Consume a trusted tool's request to yield until an async notification. */
-    consumeToolRunYield?: () => import("../tool-system/context.js").ToolRunYieldReason | undefined;
+    /** Whether a trusted tool has a specific run boundary pending (not cleared). */
+    peekToolRunYield?: (reason: import("../tool-system/context.js").ToolRunYieldReason) => boolean;
+    /** Consume a specific pending run boundary; true if it was pending. */
+    consumeToolRunYield?: (reason: import("../tool-system/context.js").ToolRunYieldReason) => boolean;
 }
 export interface TurnLoopResult {
     text: string;
@@ -287,7 +287,16 @@ export declare class TurnLoop {
     private finalizeModelTurn;
     private prepareMessagesForModel;
     private stripVolatileContextMessages;
-    private appendVolatileContextMessages;
+    /**
+     * Keep volatile context out of compaction/summarization without moving it on
+     * every model round. If context management is a no-op, return the original
+     * array so the provider sees a strictly append-only prompt. A real rewrite
+     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
+     * a fresh append-only segment with the volatile snapshot at the new tail.
+     */
+    private restoreVolatileAfterContextManagement;
+    private manageContextMessages;
+    private manageContextMessagesSync;
     private markPendingImagesConsumed;
     private redactConsumedSensitiveToolResults;
     private modelCallRecordingOptions;

package/dist/engine/turn-loop.js

@@ -340,10 +340,36 @@ export class TurnLoop {
         });
         return changed ? stripped : messages;
     }
-    appendVolatileContextMessages(messages) {
-        if (this.volatileContextMessages.size === 0)
-            return messages;
-        return [...this.stripVolatileContextMessages(messages), ...this.volatileContextMessages];
+    /**
+     * Keep volatile context out of compaction/summarization without moving it on
+     * every model round. If context management is a no-op, return the original
+     * array so the provider sees a strictly append-only prompt. A real rewrite
+     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
+     * a fresh append-only segment with the volatile snapshot at the new tail.
+     */
+    restoreVolatileAfterContextManagement(original, stableInput, managedStable) {
+        const unchanged = stableInput.length === managedStable.length &&
+            stableInput.every((message, index) => managedStable[index] === message);
+        if (unchanged)
+            return original;
+        const volatile = original.filter((message) => this.volatileContextMessages.has(message));
+        return [...managedStable, ...volatile];
+    }
+    async manageContextMessages(messages) {
+        if (this.volatileContextMessages.size === 0) {
+            return this.deps.contextManager.manageAsync(messages, this.config.signal);
+        }
+        const stable = this.stripVolatileContextMessages(messages);
+        const managed = await this.deps.contextManager.manageAsync(stable, this.config.signal);
+        return this.restoreVolatileAfterContextManagement(messages, stable, managed);
+    }
+    manageContextMessagesSync(messages) {
+        if (this.volatileContextMessages.size === 0) {
+            return this.deps.contextManager.manage(messages);
+        }
+        const stable = this.stripVolatileContextMessages(messages);
+        const managed = this.deps.contextManager.manage(stable);
+        return this.restoreVolatileAfterContextManagement(messages, stable, managed);
     }
     markPendingImagesConsumed(messages) {
         if (this.pendingImageMessages.size === 0)
@@ -367,11 +393,15 @@ export class TurnLoop {
         this.sensitiveToolResultRedactions.clear();
         return redacted;
     }
-    modelCallRecordingOptions() {
-        if (this.sensitiveToolResultRedactions.size === 0)
-            return undefined;
+    modelCallRecordingOptions(messages) {
+        const volatileIndex = messages.findIndex((message) => this.volatileContextMessages.has(message));
         return {
-            sensitiveToolResultRedactions: new Map(this.sensitiveToolResultRedactions),
+            ...(this.sensitiveToolResultRedactions.size > 0
+                ? { sensitiveToolResultRedactions: new Map(this.sensitiveToolResultRedactions) }
+                : {}),
+            promptCache: {
+                stablePrefixMessageCount: volatileIndex >= 0 ? volatileIndex : messages.length,
+            },
         };
     }
     trackFreshImageMessage(message) {
@@ -657,7 +687,6 @@ export class TurnLoop {
                 // pendingImageMessages are preserved through this next model request.
                 const hasPendingSensitiveToolResults = this.sensitiveToolResultRedactions.size > 0;
                 messages = this.prepareMessagesForModel(messages);
-                messages = this.stripVolatileContextMessages(messages);
                 if (hasPendingSensitiveToolResults) {
                     tlog.info("turn.sensitive_tool_result_context_management_skipped", {
                         cat: "turn",
@@ -666,7 +695,7 @@ export class TurnLoop {
                 }
                 else {
                     // Context management (async — may trigger LLM summarization)
-                    messages = await this.deps.contextManager.manageAsync(messages, this.config.signal);
+                    messages = await this.manageContextMessages(messages);
                     // manageAsync can itself issue an LLM summarization call lasting several
                     // seconds; if the signal aborted during it, stop here rather than
                     // proceeding into the (expensive) main model call. Belt to the loop-top
@@ -710,7 +739,6 @@ export class TurnLoop {
                     messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
-                messages = this.appendVolatileContextMessages(messages);
                 // Model call (with streaming fallback and max_output_tokens continuation)
                 this.config.onStream?.({
                     type: "stream_request_start",
@@ -721,7 +749,15 @@ export class TurnLoop {
                 this.streamedToolIds.clear();
                 // Tool queue is created before the call, but enqueue happens only after
                 // the complete LLMResponse is available below.
-                const streamingQueue = new StreamingToolQueue(this.deps.toolExecutor);
+                const streamingQueue = new StreamingToolQueue(this.deps.toolExecutor, {
+                    // Once a trusted reply tool commits the authoritative host response,
+                    // later sequential calls from the same model batch must not execute.
+                    // Concurrency-safe calls may already be running; drain still awaits
+                    // those so the transcript remains complete.
+                    pendingUnsafeSkipReason: () => this.deps.peekToolRunYield?.("reply_committed")
+                        ? "an authoritative host reply was already committed"
+                        : undefined,
+                });
                 let response;
                 try {
                     response = await this.callModelWithFallback(messages, assistantMessageId);
@@ -891,7 +927,8 @@ export class TurnLoop {
                             },
                         ];
                         try {
-                            const contResponse = await this.deps.model.call(this.deps.systemPrompt, this.prepareMessagesForModel(contMessages), this.deps.tools, this.config.onStream, this.config.signal);
+                            const preparedContinuationMessages = this.prepareMessagesForModel(contMessages);
+                            const contResponse = await this.deps.model.call(this.deps.systemPrompt, preparedContinuationMessages, this.deps.tools, this.config.onStream, this.config.signal, this.modelCallRecordingOptions(preparedContinuationMessages));
                             // Continuations are separate provider responses, so preserve the
                             // same structural tool_use invariant before processing this one.
                             if (contResponse.toolCalls.length > 0) {
@@ -995,7 +1032,7 @@ export class TurnLoop {
                     // answered before parking the run. Keep the tool's yield request
                     // pending across that extra model round, then park once the model
                     // has replied and there is still no background result to consume.
-                    if (this.deps.consumeToolRunYield?.() === "background_notification") {
+                    if (this.deps.consumeToolRunYield?.("background_notification")) {
                         tlog.info("turn.background_notification_wait_after_steer", { cat: "turn" });
                         messages = this.redactConsumedSensitiveToolResults(messages);
                         return {
@@ -1272,30 +1309,47 @@ export class TurnLoop {
                 // Tool results just pushed; recompute ctx so the bar updates *before*
                 // the next model round-trip — large tool outputs can move it sharply.
                 this.emitCtxFromMessages(messages);
-                // A trusted tool launched asynchronous work whose completion is routed
-                // back into this Session. End this run at the tool boundary instead of
-                // asking the model for another step with no new evidence; the queued
-                // completion notification will wake the Session and continue normally.
-                // This precedes complete_goal so a single batch cannot launch unfinished
-                // background work and simultaneously claim the enclosing Goal is done.
-                if (this.deps.peekToolRunYield?.() === "background_notification") {
+                // A trusted tool marked a run boundary. reply_committed: the
+                // authoritative user-facing reply is recorded — another model request
+                // could only produce duplicate tools or stray assistant text.
+                // background_notification: async work was launched whose completion
+                // notification will wake this Session, so the run parks instead of
+                // asking the model for another step with no new evidence. One batch
+                // may pend both; the park wins so the completion finds a parked run.
+                const replyCommitted = this.deps.peekToolRunYield?.("reply_committed") === true;
+                const backgroundWait = this.deps.peekToolRunYield?.("background_notification") === true;
+                if (replyCommitted || backgroundWait) {
                     // Close the current model turn before a queued steer re-drives it;
                     // interrupt-and-redrive swaps the turn signal at this boundary.
                     this.finalizeModelTurn();
                     if (await this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        // A user message arrived while the batch was executing. The
+                        // committed reply answered the previous content only — lift the
+                        // reply barrier so the re-driven round can answer the new message
+                        // (the host itself rejects duplicate authoritative replies), and
+                        // keep any background park pending across the extra round.
+                        if (replyCommitted)
+                            this.deps.consumeToolRunYield?.("reply_committed");
                         continue;
                     }
-                }
-                if (this.deps.peekToolRunYield?.() === "background_notification" &&
-                    this.deps.consumeToolRunYield?.() === "background_notification") {
-                    tlog.info("turn.background_notification_wait", { cat: "turn" });
-                    messages = this.redactConsumedSensitiveToolResults(messages);
-                    return {
-                        text: finalText,
-                        reason: "completed",
-                        messages,
-                        completionKind: "background_wait",
-                    };
+                    // Park before complete_goal so a single batch cannot launch
+                    // unfinished background work and simultaneously claim the enclosing
+                    // Goal is done.
+                    if (backgroundWait && this.deps.consumeToolRunYield?.("background_notification")) {
+                        tlog.info("turn.background_notification_wait", { cat: "turn" });
+                        messages = this.redactConsumedSensitiveToolResults(messages);
+                        return {
+                            text: finalText,
+                            reason: "completed",
+                            messages,
+                            completionKind: "background_wait",
+                        };
+                    }
+                    if (replyCommitted && this.deps.consumeToolRunYield?.("reply_committed")) {
+                        tlog.info("turn.reply_committed_stop", { cat: "turn" });
+                        messages = this.redactConsumedSensitiveToolResults(messages);
+                        return { text: finalText, reason: "completed", messages };
+                    }
                 }
                 // Goal mode P0: explicit completion. If the model called complete_goal,
                 // it has DECLARED the goal done — short-circuit to "completed" WITHOUT
@@ -1496,7 +1550,7 @@ export class TurnLoop {
             });
         }
         else {
-            messages = this.deps.contextManager.manage(messages);
+            messages = this.manageContextMessagesSync(messages);
         }
         if (this.goalControlStopRequested) {
             messages = this.redactConsumedSensitiveToolResults(messages);
@@ -1512,8 +1566,9 @@ export class TurnLoop {
                 messages = this.redactConsumedSensitiveToolResults(messages);
                 return { text: finalText, reason: "completed", messages };
             }
-            const summaryResponse = await this.deps.model.call(this.deps.systemPrompt, this.prepareMessagesForModel(messages), [], // No tools available for summary turn
-            this.config.onStream, this.config.signal, this.modelCallRecordingOptions());
+            const summaryMessages = this.prepareMessagesForModel(messages);
+            const summaryResponse = await this.deps.model.call(this.deps.systemPrompt, summaryMessages, [], // No tools available for summary turn
+            this.config.onStream, this.config.signal, this.modelCallRecordingOptions(summaryMessages));
             if (summaryResponse.usage?.promptTokens !== undefined) {
                 this.recordResponseUsage(summaryResponse.usage, "primary", false);
             }
@@ -1591,7 +1646,7 @@ export class TurnLoop {
             }
             : undefined;
         try {
-            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal, this.modelCallRecordingOptions());
+            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal, this.modelCallRecordingOptions(messages));
         }
         catch (err) {
             // If it's a context or rate limit error, don't fallback — propagate
@@ -1637,7 +1692,7 @@ export class TurnLoop {
                 error: err.message,
             });
             // Retry without streaming
-            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal, this.modelCallRecordingOptions());
+            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal, this.modelCallRecordingOptions(messages));
         }
     }
     get currentTurn() {

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.9.2";
+export declare const VERSION = "0.9.4";
 export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionKind, SessionWorkspace, SessionProjectBinding, SessionForkLineage, ContextUsageAnchor, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, TurnCompletionKind, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export type { GoalConfig, GoalLifecycleConfig, GoalLifecyclePhase, GoalLifecycleTerminalReason, GoalLifecycleV1, } from "./goal/lifecycle.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, CompositionError, SandboxUnavailableError, } from "./exceptions.js";

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.9.2";
+export const VERSION = "0.9.4";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, CompositionError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Composition (AgentModule / ResolvedComposition) ─────────────