@cjhyy/code-shell-core 0.9.4 → 0.9.6

package/dist/credentials/access.d.ts

@@ -16,6 +16,11 @@ export interface CredentialMetadata {
 }
 export interface CredentialAccess {
     listMasked(cwd: string | undefined, scope: CredentialAccessScope): CredentialMetadata[];
+    /** Optional read diagnostics. False means the list may be incomplete, not that it is empty. */
+    listMaskedWithStatus?(cwd: string | undefined, scope: CredentialAccessScope): {
+        credentials: CredentialMetadata[];
+        readable: boolean;
+    };
     resolveMeta(cwd: string | undefined, id: string, scope: CredentialAccessScope): CredentialMetadata | undefined;
     envExposures(cwd: string | undefined, scope: CredentialAccessScope): Record<string, string>;
     /** Subscribe to host credential snapshot changes (desktop worker uses this to cancel in-flight Links). */
@@ -48,6 +53,9 @@ export interface CredentialSnapshotEntry {
     cwd?: string;
     full: CredentialMetadata[];
     project: CredentialMetadata[];
+    /** Older hosts omit these; their credential-store readability is unknown. */
+    readableFull?: boolean;
+    readableProject?: boolean;
     envFull: Record<string, string>;
     envProject: Record<string, string>;
 }
@@ -59,7 +67,7 @@ export declare function setDefaultCredentialAccess(access: CredentialAccess | nu
 export declare function getCredentialAccess(): CredentialAccess;
 export declare function createIpcCredentialAccess(transport: Pick<Transport, "send" | "onMessage">): CredentialAccess;
 export declare function credentialAccessScope(scope: SettingsScope | undefined): CredentialAccessScope;
-export declare function isCredentialSecretAvailable(secret: string | undefined): secret is string;
+export { isCredentialSecretAvailable } from "./types.js";
 export declare const localCredentialAccess: CredentialAccess;
 export declare function materializeCookieSecret(credentialId: string, secret: string): {
     cookiesFile: string;

package/dist/credentials/access.js

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, rmSync, statSync, writeFileSync } from "node:f
 import { randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { credentialAllowsEnvExposure, credentialSecretHint, } from "./types.js";
+import { credentialAllowsEnvExposure, credentialSecretHint, isCredentialSecretAvailable, } from "./types.js";
 import { CredentialStore } from "./store.js";
 import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
 import { parseOAuthCredentialSecret, isBrowserOAuthLinkCredential, resolveLinkCredentialAccessToken, shouldRefreshOAuthCredential, summarizeOAuthCredentialSecret, } from "./oauth.js";
@@ -77,6 +77,15 @@ export function createIpcCredentialAccess(transport) {
                 return [];
             return scope === "project" ? cloneMetadata(entry.project) : cloneMetadata(entry.full);
         },
+        listMaskedWithStatus(cwd, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return { credentials: [], readable: false };
+            return {
+                credentials: cloneMetadata(scope === "project" ? entry.project : entry.full),
+                readable: (scope === "project" ? entry.readableProject : entry.readableFull) === true,
+            };
+        },
         resolveMeta(cwd, id, scope) {
             const entry = entryFor(cwd);
             if (!entry)
@@ -122,9 +131,7 @@ export function createIpcCredentialAccess(transport) {
 export function credentialAccessScope(scope) {
     return scope === "full" || scope === undefined ? "full" : "project";
 }
-export function isCredentialSecretAvailable(secret) {
-    return typeof secret === "string" && secret.length > 0 && !secret.startsWith("enc:");
-}
+export { isCredentialSecretAvailable } from "./types.js";
 function toMetadata(cred) {
     const secret = cred.secret;
     const available = isCredentialSecretAvailable(secret);
@@ -149,6 +156,10 @@ export const localCredentialAccess = {
     listMasked(cwd, scope) {
         return storeFor(cwd).list(scope).map(toMetadata);
     },
+    listMaskedWithStatus(cwd, scope) {
+        const result = storeFor(cwd).listWithStatus(scope);
+        return { credentials: result.credentials.map(toMetadata), readable: result.readable };
+    },
     resolveMeta(cwd, id, scope) {
         const cred = storeFor(cwd).resolve(id, scope);
         return cred ? toMetadata(cred) : undefined;

package/dist/credentials/store.d.ts

@@ -70,6 +70,12 @@ export declare class CredentialStore {
      * id 不存在则 no-op。
      */
     patch(scope: CredentialScope, id: string, fields: Partial<Pick<Credential, "label" | "exposeAsEnv" | "autoUseByAI" | "autoInjectByAI" | "meta">>): void;
+    /**
+     * Update an existing record while holding the store lock. The callback sees
+     * the latest decrypted record and may return undefined to decline the write.
+     * Unlike save(), this never recreates a deleted credential.
+     */
+    updateExisting(scope: CredentialScope, id: string, update: (current: Credential) => Credential | undefined): boolean;
     remove(scope: CredentialScope, id: string): void;
     /**
      * List credentials visible to an engine of the given settings scope.
@@ -80,6 +86,11 @@ export declare class CredentialStore {
      *     same host-isolation contract as {@link envExposures} and top-level env.
      */
     list(scope?: "full" | "project"): Credential[];
+    /** Preserve read failures so diagnostics can distinguish unknown state from an empty store. */
+    listWithStatus(scope?: "full" | "project"): {
+        credentials: Credential[];
+        readable: boolean;
+    };
     resolve(id: string, scope?: "full" | "project"): Credential | undefined;
     /**
      * Credentials flagged "expose as env var" → a `{ ENV_NAME: secret }` map for

package/dist/credentials/store.js

@@ -1,7 +1,7 @@
 import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
-import { credentialAllowsEnvExposure, credentialSecretHint, } from "./types.js";
+import { credentialAllowsEnvExposure, credentialSecretHint, isCredentialSecretAvailable, } from "./types.js";
 import { getDefaultCredentialCipher } from "./cipher.js";
 import { logger } from "../logging/logger.js";
 import { summarizeOAuthCredentialSecret } from "./oauth.js";
@@ -329,6 +329,34 @@ export class CredentialStore {
             return true;
         });
     }
+    /**
+     * Update an existing record while holding the store lock. The callback sees
+     * the latest decrypted record and may return undefined to decline the write.
+     * Unlike save(), this never recreates a deleted credential.
+     */
+    updateExisting(scope, id, update) {
+        if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
+            throw new Error("invalid credential id");
+        }
+        let changed = false;
+        this.mutate(scope, (file) => {
+            const idx = file.credentials.findIndex((credential) => credential.id === id);
+            if (idx < 0)
+                return false;
+            const next = update(normalizeCredential(file.credentials[idx], true));
+            if (!next)
+                return false;
+            const normalized = normalizeCredential(next, true);
+            if (normalized.id !== id)
+                throw new Error("credential update cannot change id");
+            file.credentials[idx] = credentialAllowsEnvExposure(normalized.type)
+                ? normalized
+                : { ...normalized, exposeAsEnv: undefined };
+            changed = true;
+            return true;
+        });
+        return changed;
+    }
     remove(scope, id) {
         if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
             throw new Error("invalid credential id");
@@ -350,14 +378,20 @@ export class CredentialStore {
      *     same host-isolation contract as {@link envExposures} and top-level env.
      */
     list(scope = "full") {
+        return this.listWithStatus(scope).credentials;
+    }
+    /** Preserve read failures so diagnostics can distinguish unknown state from an empty store. */
+    listWithStatus(scope = "full") {
         const byId = new Map();
-        if (scope === "full") {
-            for (const c of this.read("user").credentials)
-                byId.set(c.id, c);
+        let readable = true;
+        const scopes = scope === "full" ? ["user", "project"] : ["project"];
+        for (const layer of scopes) {
+            const result = this.readGuarded(layer);
+            readable = readable && result.readable;
+            for (const credential of result.file.credentials)
+                byId.set(credential.id, credential);
         }
-        for (const c of this.read("project").credentials)
-            byId.set(c.id, c); // project wins
-        return [...byId.values()];
+        return { credentials: [...byId.values()], readable };
     }
     resolve(id, scope = "full") {
         return this.list(scope).find((c) => c.id === id);
@@ -397,11 +431,12 @@ export class CredentialStore {
     listMasked(scope = "full") {
         return this.list(scope).map((c) => {
             const { secret, ...rest } = c;
+            const available = isCredentialSecretAvailable(secret);
             return {
                 ...rest,
                 ...(credentialAllowsEnvExposure(c.type) ? {} : { exposeAsEnv: undefined }),
-                hasSecret: typeof secret === "string" && secret.length > 0,
-                secretHint: credentialSecretHint(c.type, secret),
+                hasSecret: available,
+                secretHint: available ? credentialSecretHint(c.type, secret) : undefined,
                 ...(c.type === "oauth" || isBrowserOAuthLinkCredential(c)
                     ? { oauthStatus: summarizeOAuthCredentialSecret(secret) }
                     : {}),

package/dist/credentials/types.d.ts

@@ -10,6 +10,8 @@ export type CredentialType = "token" | "link" | "cookie" | "oauth";
  * values and must remain behind the credential resolver boundary.
  */
 export declare function credentialAllowsEnvExposure(type: CredentialType): boolean;
+/** An unreadable encrypted value is preserved on disk, but is not a usable secret. */
+export declare function isCredentialSecretAvailable(secret: string | undefined): secret is string;
 /** Build a renderer-safe hint without deriving bytes from structured JSON. */
 export declare function credentialSecretHint(type: CredentialType, secret: string | undefined): string | undefined;
 export interface OAuthCredentialSecret {
@@ -112,6 +114,8 @@ export interface Credential {
         domain?: string;
         scope?: "domain" | "all";
         switchMode?: "clear" | "merge";
+        /** Opt in to writing browser-side cookie rotations back to this saved credential. */
+        autoRefreshFromBrowser?: boolean;
         /** Link provider id for credentials owned by a local/server app connection. */
         linkProvider?: string;
         /** Provider-specific connection method, e.g. fine-grained-pat or github-app. */

package/dist/credentials/types.js

@@ -6,6 +6,10 @@
 export function credentialAllowsEnvExposure(type) {
     return type === "token" || type === "link";
 }
+/** An unreadable encrypted value is preserved on disk, but is not a usable secret. */
+export function isCredentialSecretAvailable(secret) {
+    return typeof secret === "string" && secret.length > 0 && !secret.startsWith("enc:");
+}
 /** Build a renderer-safe hint without deriving bytes from structured JSON. */
 export function credentialSecretHint(type, secret) {
     if (!secret)

package/dist/credentials/use-credential-tool.js

@@ -23,7 +23,10 @@ const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cooki
     "or manually exporting credentials. Before `--cookies-from-browser` or retrying an " +
     "authentication failure, check stored credentials here. If `Currently available` names a " +
     "matching id, fetch it directly; otherwise call with NO arguments first to list available " +
-    "credentials (id + label + type), then call again with `id`. Token/link credentials return their secret " +
+    "credentials (id + label + type), then call again with `id`. Provider-owned Link connections " +
+    "and existing CLI sessions are not listed here. Call LinkAction with provider only to check " +
+    "those before concluding " +
+    "a service is disconnected or asking the user to log in. Exposable token credentials return their secret " +
     "value; cookie credentials are materialized to a temporary Netscape cookies.txt file " +
     "(use it as `yt-dlp --cookies <cookiesFile>` / `curl -b <cookiesFile>`). " +
     "Each use is gated by a quick user approval unless auto-approve is on.";
@@ -125,7 +128,14 @@ export async function useCredentialTool(args, ctx) {
             .listMasked(cwd, scope)
             .filter(isAgentExposableCredential)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
-        return json({ kind: "list", credentials });
+        return json({
+            kind: "list",
+            credentials,
+            notice: "This list excludes provider-owned Link credentials and CLI login sessions. " +
+                'Call LinkAction with provider only, for example LinkAction({provider: "github"}), ' +
+                "to check saved connections and current CLI authentication; " +
+                "an absent credential here does not mean the service is signed out.",
+        });
     }
     const cred = access.resolveMeta(cwd, id, scope);
     if (!cred) {

package/dist/engine/engine-workspace-authority.js

@@ -104,7 +104,8 @@ export function createAuthorizedSessionMessageService(options) {
     const targets = catalog.filter((target) => target.sessionId !== sourceSessionId);
     return {
         targets,
-        send: async ({ targetSessionId, message }) => {
+        send: async ({ targetSessionId, message, signal }) => {
+            signal?.throwIfAborted();
             const target = targets.find((candidate) => candidate.sessionId === targetSessionId);
             if (!target)
                 throw new Error("target Session is not in the host-authorized project list");
@@ -112,8 +113,14 @@ export function createAuthorizedSessionMessageService(options) {
                 throw new Error("message is required");
             if (message.length > 48_000)
                 throw new Error("message exceeds 48000 characters");
-            await router({ sourceSessionId, target, message, catalog });
-            return target;
+            const receipt = await router({
+                sourceSessionId,
+                target,
+                message,
+                catalog,
+                ...(signal ? { signal } : {}),
+            });
+            return receipt ? { ...target, receipt } : target;
         },
     };
 }

package/dist/engine/engine.d.ts

@@ -158,6 +158,8 @@ export declare class Engine {
      * running goal's turn/budget ceilings mid-run (TODO 3.1). Null when idle.
      */
     private activeTurnLoop;
+    /** Frozen behavior-profile ceiling for the live run's Goal controls. */
+    private activeProfileMaxTurns;
     /**
      * The goal-stop hook of the in-flight goal run, exposed so clearGoal() can
      * unregister it mid-run (the closure holds the now-cleared goal and would
@@ -459,6 +461,7 @@ export declare class Engine {
      * published through the `publishGoalJudgeContext` callback.
      */
     private buildTurnLoop;
+    private resolveRunMaxTurns;
     private buildSummarizeFn;
     private resolveAuxClient;
     private runMemoryPipeline;

package/dist/engine/engine.js

@@ -232,6 +232,8 @@ export class Engine {
      * running goal's turn/budget ceilings mid-run (TODO 3.1). Null when idle.
      */
     activeTurnLoop = null;
+    /** Frozen behavior-profile ceiling for the live run's Goal controls. */
+    activeProfileMaxTurns;
     /**
      * The goal-stop hook of the in-flight goal run, exposed so clearGoal() can
      * unregister it mid-run (the closure holds the now-cleared goal and would
@@ -1251,6 +1253,11 @@ export class Engine {
                 task,
                 cwd,
                 options,
+                profileMaxTurns: typeof profile?.maxTurns === "number" &&
+                    Number.isSafeInteger(profile.maxTurns) &&
+                    profile.maxTurns > 0
+                    ? profile.maxTurns
+                    : undefined,
                 toolCtx,
                 toolExecutor,
                 contextManager,
@@ -1285,8 +1292,10 @@ export class Engine {
                     this.activeRuntimeGoal = null;
                     this.activePersistedRunGoal = null;
                 }
-                if (this.activeTurnLoop === turnLoop)
+                if (this.activeTurnLoop === turnLoop) {
                     this.activeTurnLoop = null;
+                    this.activeProfileMaxTurns = undefined;
+                }
                 if (this.activeRunSession === session)
                     this.activeRunSession = null;
                 // Run-scoped too: this handler is re-registered every run(), so it must be
@@ -1714,7 +1723,7 @@ export class Engine {
      * phases consume cross back out.
      */
     async wireRunLoop(args) {
-        const { session, sid, task, cwd, options, toolCtx, toolExecutor, contextManager, llmClient, auxSummaryClient, fullSystemPrompt, toolDefs, claimClientMessageId, releaseClientMessageId, freshImageMessage, dynamicContextMsg, } = args;
+        const { session, sid, task, cwd, options, profileMaxTurns, toolCtx, toolExecutor, contextManager, llmClient, auxSummaryClient, fullSystemPrompt, toolDefs, claimClientMessageId, releaseClientMessageId, freshImageMessage, dynamicContextMsg, } = args;
         // eslint-disable-next-line prefer-const
         let turnLoop;
         const accounting = createRunUsageAccounting({
@@ -1827,6 +1836,7 @@ export class Engine {
             toolDefs,
             sid,
             options,
+            profileMaxTurns,
             cwd,
             claimClientMessageId,
             releaseClientMessageId,
@@ -1846,8 +1856,10 @@ export class Engine {
         toolCtx.recordBilledUsage = recordExternalBilledUsage;
         // Expose this run's loop for mid-run extension (TODO 3.1). Top-level only —
         // a sub-agent's loop is its own concern and isn't user-extendable.
-        if (this.config.isSubAgent !== true)
+        if (this.config.isSubAgent !== true) {
             this.activeTurnLoop = turnLoop;
+            this.activeProfileMaxTurns = profileMaxTurns;
+        }
         // Expose this run's session bundle so a mid-run clearGoal() wipes the goal
         // on the very instance this loop keeps saving (see field doc). Top-level
         // only — sub-agents don't carry user-clearable persistent goals.
@@ -2082,7 +2094,7 @@ export class Engine {
      * published through the `publishGoalJudgeContext` callback.
      */
     buildTurnLoop(args) {
-        const { modelFacade, toolExecutor, contextManager, session, fullSystemPrompt, toolDefs, sid, options, cwd, claimClientMessageId, releaseClientMessageId, toolCtx, persistedRunGoal, goalHookHandler, normalizedGoal, freshImageMessage, dynamicContextMsg, usageBaseline, getRunUsage, recordCumulativeUsage, publishGoalJudgeContext, } = args;
+        const { modelFacade, toolExecutor, contextManager, session, fullSystemPrompt, toolDefs, sid, options, profileMaxTurns, cwd, claimClientMessageId, releaseClientMessageId, toolCtx, persistedRunGoal, goalHookHandler, normalizedGoal, freshImageMessage, dynamicContextMsg, usageBaseline, getRunUsage, recordCumulativeUsage, publishGoalJudgeContext, } = args;
         // Surface compaction events to the UI so the user knows when context was trimmed.
         // Buffer the most recent event so TurnLoop can drain it and emit the
         // post_compact hook on the next turn (ContextManager itself doesn't
@@ -2146,6 +2158,9 @@ export class Engine {
             releaseClientMessageId,
             setOriginClientMessageId: (clientMessageId) => {
                 toolCtx.originClientMessageId = clientMessageId;
+                const profileId = toolCtx.toolVisibility?.behaviorProfile;
+                const profile = profileId ? this.behaviorProfiles.get(profileId) : undefined;
+                profile?.onUserInputChanged?.(toolCtx.runScopedServices ?? {});
             },
             recordCumulativeUsage,
             onAgentUsage: (usage) => options?.onAgentProgress?.({ type: "usage", usage }),
@@ -2199,7 +2214,7 @@ export class Engine {
             // getting re-blocked by the stop-hook until it's done, and the 100
             // interactive default would silently truncate a long objective. The
             // real backstops are the goal token/time budgets + maxStopBlocks.
-            maxTurns: resolveMaxTurns(this.config.maxTurns, normalizedGoal),
+            maxTurns: this.resolveRunMaxTurns(normalizedGoal, profileMaxTurns),
             // Consecutive stop-block cap: config override > goal.maxStopBlocks >
             // GOAL_DEFAULT_MAX_STOP_BLOCKS(25). The old hardcoded 8 was too tight
             // for complex goals that legitimately get re-blocked while advancing.
@@ -2253,6 +2268,10 @@ export class Engine {
         });
         return turnLoop;
     }
+    resolveRunMaxTurns(goal, profileMaxTurns) {
+        const resolved = resolveMaxTurns(this.config.maxTurns, goal);
+        return profileMaxTurns === undefined ? resolved : Math.min(resolved, profileMaxTurns);
+    }
     buildSummarizeFn(auxSummaryClient, recordCumulativeUsage) {
         return this.auxiliaryPipeline.buildSummarizeFn(auxSummaryClient, recordCumulativeUsage);
     }
@@ -2717,7 +2736,7 @@ export class Engine {
                     : resumed
                         ? `目标已恢复：${next.objective}`
                         : undefined, {
-                    maxTurns: resolveMaxTurns(this.config.maxTurns, next),
+                    maxTurns: this.resolveRunMaxTurns(next, this.activeProfileMaxTurns),
                     maxStopBlocks: resolveMaxStopBlocks(this.config.maxStopBlocks, next),
                 });
                 if (this.activeGoalHook && !this.activeGoalHookAttached) {
@@ -3134,6 +3153,19 @@ export class Engine {
     extendGoalRun(opts) {
         if (!this.activeTurnLoop)
             return null;
+        if (this.activeProfileMaxTurns !== undefined &&
+            typeof opts.addTurns === "number" &&
+            Number.isFinite(opts.addTurns) &&
+            opts.addTurns > 0 &&
+            opts.addTurns <= Number.MAX_SAFE_INTEGER) {
+            // An empty extension is a no-op that returns the live ceilings. Goal
+            // budgets may still grow, but a behavior-profile ceiling cannot.
+            const currentMaxTurns = this.activeTurnLoop.extend({}).maxTurns;
+            return this.activeTurnLoop.extend({
+                ...opts,
+                addTurns: Math.min(opts.addTurns, this.activeProfileMaxTurns - currentMaxTurns),
+            });
+        }
         return this.activeTurnLoop.extend(opts);
     }
     /**

package/dist/engine/prompt-cache-diagnostics.js

@@ -4,6 +4,12 @@ const DEFAULT_MAX_SESSIONS = 256;
 const DROP_MIN_PREVIOUS_TOKENS = 100;
 const DROP_MAX_CURRENT_TOKENS = 64;
 const DROP_RATIO = 0.1;
+// Partial cache invalidation can leave thousands of tokens cached. Require
+// both a halving and a meaningful absolute loss to avoid reporting small
+// fluctuations. Compare cache reads, not hit rates: appending uncached input
+// can lower the hit rate while the reusable prefix remains fully cached.
+const PARTIAL_DROP_MAX_RETAINED_RATIO = 0.5;
+const PARTIAL_DROP_MIN_LOST_TOKENS = 4096;
 /**
  * Session stickiness audit. Semantic, capability, and security switches must
  * take effect on the next request even when they invalidate a cache prefix.
@@ -150,7 +156,10 @@ export class PromptCacheDiagnosticRecorder {
         if (previous.cacheReadTokens < DROP_MIN_PREVIOUS_TOKENS)
             return { kind: "updated" };
         const dropRatio = previous.cacheReadTokens > 0 ? cacheReadTokens / previous.cacheReadTokens : 1;
-        if (cacheReadTokens > DROP_MAX_CURRENT_TOKENS || dropRatio > DROP_RATIO) {
+        const nearColdDrop = cacheReadTokens <= DROP_MAX_CURRENT_TOKENS && dropRatio <= DROP_RATIO;
+        const partialDrop = dropRatio <= PARTIAL_DROP_MAX_RETAINED_RATIO &&
+            previous.cacheReadTokens - cacheReadTokens >= PARTIAL_DROP_MIN_LOST_TOKENS;
+        if (!nearColdDrop && !partialDrop) {
             return { kind: "updated" };
         }
         return {

package/dist/engine/run-goal.js

@@ -10,9 +10,13 @@ import { logger } from "../logging/logger.js";
 /** engine.ts:explicit/stored/fallback 归一化 + 持久化 + goal_set 事件。 */
 export function resolveRunGoal(args) {
     const { options, session, sessionManager, configGoal, isSubAgent, sid, onStream } = args;
-    const explicitGoal = normalizeGoal(options?.goal);
+    const goalDisabled = options?.disableGoal === true;
+    const explicitGoal = goalDisabled ? undefined : normalizeGoal(options?.goal);
     const storedLifecycle = session.state.goalLifecycle;
-    const storedGoal = isSubAgent !== true && storedLifecycle && isGoalLifecycleCurrent(storedLifecycle)
+    const storedGoal = !goalDisabled &&
+        isSubAgent !== true &&
+        storedLifecycle &&
+        isGoalLifecycleCurrent(storedLifecycle)
         ? goalConfigFromLifecycle(storedLifecycle)
         : undefined;
     if (storedGoal &&
@@ -48,7 +52,7 @@ export function resolveRunGoal(args) {
             replaced,
         });
     }
-    const fallbackGoal = normalizeGoal(configGoal);
+    const fallbackGoal = goalDisabled ? undefined : normalizeGoal(configGoal);
     if (fallbackGoal && !fallbackGoal.goalId)
         fallbackGoal.goalId = randomUUID();
     if (fallbackGoal && !fallbackGoal.revision)

package/dist/engine/run-types.d.ts

@@ -26,6 +26,13 @@ export interface RunBehaviorProfile {
     systemPromptAppend?: string;
     /** Hard tool allowlist for the run (model visibility + execution gate). */
     allowedToolNames?: ReadonlySet<string>;
+    /**
+     * Positive safe-integer ceiling on model/tool turns. Clamps the existing
+     * resolved config/Goal limit, including during live Goal edits/extensions.
+     * Invalid values are ignored. The existing no-tools final summary may run
+     * once after this ceiling is reached.
+     */
+    maxTurns?: number;
     /** When set, the run's permission mode is locked to this value. */
     forcePermissionMode?: NonNullable<EngineConfig["permissionMode"]>;
     /** When true, per-run planMode requests are ignored. */
@@ -70,6 +77,13 @@ export interface RunBehaviorProfile {
         profileParams: Readonly<Record<string, unknown>>;
         reportResult: (key: string, value: unknown) => void;
     }) => Record<string, unknown>;
+    /**
+     * Called with this run's services after each new steered user message is
+     * persisted, before its injection event and the next model step. Profiles
+     * may invalidate deferred drafts that answered an earlier input revision.
+     * Initial input, queued/revoked steers and duplicate messages do not call it.
+     */
+    onUserInputChanged?: (services: Record<string, unknown>) => void;
     /**
      * Per-run metadata exposed to builtin availability guards / definition
      * rewriters via ToolVisibilityContext.profileMeta.
@@ -98,6 +112,8 @@ export interface EngineRunOptions {
     planMode?: boolean;
     approvalRouter?: ApprovalRouter;
     goal?: string | GoalConfig;
+    /** Run this standalone turn without explicit, persisted, or configured Goal mode. */
+    disableGoal?: boolean;
     injected?: boolean;
     clientMessageId?: string;
     /**

package/dist/engine/run-workspace.js

@@ -54,30 +54,12 @@ export async function resolveRunWorkspace(args) {
         ? await args.sessionManager.resolveSessionWorkspaceForResume(options.sessionId)
         : undefined;
     if (workspaceResume && !workspaceResume.ok) {
-        return {
-            ok: false,
-            result: {
-                text: `ERROR: ${workspaceResume.message}`,
-                reason: "completed",
-                sessionId: options.sessionId,
-                turnCount: 0,
-                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
-            },
-        };
+        return workspaceError(options?.sessionId, workspaceResume.message);
     }
     if (workspaceResume?.ok &&
         workspaceResume.reason === "worktree_missing_branch_gone" &&
         workspaceResume.message) {
-        return {
-            ok: false,
-            result: {
-                text: workspaceResume.message,
-                reason: "completed",
-                sessionId: options.sessionId,
-                turnCount: 0,
-                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
-            },
-        };
+        return workspaceError(options?.sessionId, workspaceResume.message);
     }
     // Existing P1 sessions resolve cwd from SessionWorkspace, even if the host
     // passes a stale cwd. Legacy sessions without workspace keep the historical
@@ -158,7 +140,9 @@ function workspaceError(sessionId, message) {
         ok: false,
         result: {
             text: `ERROR: ${message}`,
-            reason: "completed",
+            // Like other initialization failures, this run never reached a model
+            // turn. Hosts must see a failure rather than report a completed delivery.
+            reason: "model_error",
             sessionId: sessionId ?? "workspace-invalid",
             turnCount: 0,
             usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },

package/dist/engine/turn-loop.d.ts

@@ -289,10 +289,10 @@ export declare class TurnLoop {
     private stripVolatileContextMessages;
     /**
      * Keep volatile context out of compaction/summarization without moving it on
-     * every model round. If context management is a no-op, return the original
-     * array so the provider sees a strictly append-only prompt. A real rewrite
-     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
-     * a fresh append-only segment with the volatile snapshot at the new tail.
+     * every model round. Normalizing a newly appended tool result must not move
+     * an earlier volatile snapshot and invalidate an otherwise unchanged prefix.
+     * Keep its position when the preceding stable messages remain intact; reset
+     * to the tail when that boundary was rewritten or compaction changed length.
      */
     private restoreVolatileAfterContextManagement;
     private manageContextMessages;

package/dist/engine/turn-loop.js

@@ -342,16 +342,36 @@ export class TurnLoop {
     }
     /**
      * Keep volatile context out of compaction/summarization without moving it on
-     * every model round. If context management is a no-op, return the original
-     * array so the provider sees a strictly append-only prompt. A real rewrite
-     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
-     * a fresh append-only segment with the volatile snapshot at the new tail.
+     * every model round. Normalizing a newly appended tool result must not move
+     * an earlier volatile snapshot and invalidate an otherwise unchanged prefix.
+     * Keep its position when the preceding stable messages remain intact; reset
+     * to the tail when that boundary was rewritten or compaction changed length.
      */
     restoreVolatileAfterContextManagement(original, stableInput, managedStable) {
-        const unchanged = stableInput.length === managedStable.length &&
-            stableInput.every((message, index) => managedStable[index] === message);
-        if (unchanged)
-            return original;
+        if (stableInput.length === managedStable.length) {
+            // Some cleanup passes copy messages even when their final content is
+            // unchanged. Object identity is only a fast path, not a cache boundary.
+            const firstChangedIndex = stableInput.findIndex((message, index) => managedStable[index] !== message &&
+                JSON.stringify(managedStable[index]) !== JSON.stringify(message));
+            if (firstChangedIndex === -1)
+                return original;
+            let stableIndex = 0;
+            let lastVolatileBoundary = 0;
+            for (const message of original) {
+                if (this.volatileContextMessages.has(message)) {
+                    lastVolatileBoundary = stableIndex;
+                }
+                else {
+                    stableIndex++;
+                }
+            }
+            if (firstChangedIndex >= lastVolatileBoundary) {
+                // Apply the managed tail in place, including its persisted/truncated
+                // results. Never restore old payloads just to preserve cache hits.
+                stableIndex = 0;
+                return original.map((message) => this.volatileContextMessages.has(message) ? message : managedStable[stableIndex++]);
+            }
+        }
         const volatile = original.filter((message) => this.volatileContextMessages.has(message));
         return [...managedStable, ...volatile];
     }
@@ -1754,11 +1774,11 @@ export class TurnLoop {
                 break;
             }
             consumed = true;
-            this.deps.setOriginClientMessageId?.(clientMessageId);
             const message = { role: "user", content };
             messages.push(message);
             this.trackFreshImageMessage(message);
             this.deps.transcript.appendMessage("user", content, { steerId: id, clientMessageId });
+            this.deps.setOriginClientMessageId?.(clientMessageId);
             this.config.onStream?.({ type: "steer_injected", text, id });
         }
         return consumed;