@cjhyy/code-shell-core 0.9.5 → 0.9.7

package/dist/engine/run-tooling.js

@@ -126,30 +126,26 @@ export function buildRunPermissionPipeline(args) {
 }
 /** engine.ts L1986-2003 —— MCP 连接(Runtime 池优先,回退 per-Engine)。 */
 export async function connectRunMcp(args) {
-    // Connect MCP servers (if configured and not already connected).
-    // B1: prefer the Runtime-owned MCPManager so all sessions in a
-    // worker share one set of connections. Falling back to a
-    // per-Engine instance keeps the null-runtime path (tests, ad-hoc
-    // scripts) working.
-    const mcpServers = args.mcpServers;
-    const mcpDisabled = args.mcpDisabled;
-    if (!mcpDisabled && Object.keys(mcpServers).length > 0 && !args.getManager()) {
-        if (args.runtimePool) {
-            args.setManager(args.runtimePool);
-        }
-        else {
-            args.setManager(new MCPManager(args.toolRegistry));
-        }
-        await args.getManager().connectAll(mcpServers, args.engineForConnect, (event) => {
-            // Fire-and-forget onto the notification hook: hosts/plugins learn
-            // about MCP availability changes without polling the pool.
-            args.emitNotificationHook({
-                kind: event.type,
-                server: event.server,
-                ...(event.error ? { error: event.error } : {}),
-            });
-        });
+    // A pool may outlive a run and the engine registry may predate discovery.
+    // Refresh scope and the engine's MCP-only view on every run (including cwd
+    // and project changes); identical scopes still share a single transport.
+    const enabledServers = args.mcpDisabled ? {} : args.mcpServers;
+    if (!args.getManager() && Object.keys(enabledServers).length > 0) {
+        args.setManager(args.runtimePool ?? new MCPManager(args.toolRegistry));
     }
+    const manager = args.getManager();
+    if (!manager)
+        return;
+    await manager.connectAll(enabledServers, args.engineForConnect, (event) => {
+        args.emitNotificationHook({
+            kind: event.type,
+            server: event.server,
+            ...(event.error ? { error: event.error } : {}),
+        });
+    }, args.toolContext);
+    manager.syncToolsToRegistry(args.toolRegistry, args.toolContext, new Set(Object.entries(enabledServers)
+        .filter(([, config]) => config.enabled !== false)
+        .map(([name]) => name)));
 }
 /**
  * Build the availability-guard context for a tool surface.
@@ -167,11 +163,15 @@ export async function connectRunMcp(args) {
 export function buildToolVisibility(inputs) {
     return {
         cwd: inputs.cwd,
+        ...(inputs.contextStrategy ? { contextStrategy: inputs.contextStrategy } : {}),
         ...(inputs.workspace ? { workspace: inputs.workspace } : {}),
         hasGoal: inputs.hasGoal,
         ...(inputs.sessionId ? { sessionId: inputs.sessionId } : {}),
         ...(inputs.settingsScope ? { settingsScope: inputs.settingsScope } : {}),
         ...(inputs.host !== undefined ? { host: inputs.host } : {}),
+        ...(inputs.hasBrowserAutomation !== undefined
+            ? { hasBrowserAutomation: inputs.hasBrowserAutomation }
+            : {}),
         ...(inputs.isSubAgent !== undefined ? { isSubAgent: inputs.isSubAgent } : {}),
         ...(inputs.behaviorProfile !== undefined ? { behaviorProfile: inputs.behaviorProfile } : {}),
         ...(inputs.sessionMessageTargets?.length
@@ -188,11 +188,13 @@ export function assembleRunToolDefs(args) {
     const guardCwd = args.guardCwd;
     const toolVisibility = buildToolVisibility({
         cwd: guardCwd,
+        contextStrategy: toolCtx.contextNotes ? toolCtx.contextStrategy : undefined,
         workspace: toolCtx.workspace,
         hasGoal: args.hasRunnableGoal,
         sessionId: toolCtx.sessionId,
         settingsScope: args.settingsScope,
         host: args.builtinToolHost,
+        hasBrowserAutomation: toolCtx.browser !== undefined,
         isSubAgent: args.isSubAgent,
         behaviorProfile: args.behaviorProfileId,
         sessionMessageTargets: toolCtx.sessionMessages?.targets,

package/dist/engine/run-types.d.ts

@@ -22,10 +22,19 @@ export type RunBehaviorMode = string;
  */
 export interface RunBehaviorProfile {
     id: string;
+    /** Default context policy; explicit Engine/settings choices take precedence. */
+    contextStrategy?: "summary" | "notes";
     /** Appended to the system prompt after config.appendSystemPrompt. */
     systemPromptAppend?: string;
     /** Hard tool allowlist for the run (model visibility + execution gate). */
     allowedToolNames?: ReadonlySet<string>;
+    /**
+     * Positive safe-integer ceiling on model/tool turns. Clamps the existing
+     * resolved config/Goal limit, including during live Goal edits/extensions.
+     * Invalid values are ignored. The existing no-tools final summary may run
+     * once after this ceiling is reached.
+     */
+    maxTurns?: number;
     /** When set, the run's permission mode is locked to this value. */
     forcePermissionMode?: NonNullable<EngineConfig["permissionMode"]>;
     /** When true, per-run planMode requests are ignored. */
@@ -70,6 +79,13 @@ export interface RunBehaviorProfile {
         profileParams: Readonly<Record<string, unknown>>;
         reportResult: (key: string, value: unknown) => void;
     }) => Record<string, unknown>;
+    /**
+     * Called with this run's services after each new steered user message is
+     * persisted, before its injection event and the next model step. Profiles
+     * may invalidate deferred drafts that answered an earlier input revision.
+     * Initial input, queued/revoked steers and duplicate messages do not call it.
+     */
+    onUserInputChanged?: (services: Record<string, unknown>) => void;
     /**
      * Per-run metadata exposed to builtin availability guards / definition
      * rewriters via ToolVisibilityContext.profileMeta.
@@ -98,6 +114,8 @@ export interface EngineRunOptions {
     planMode?: boolean;
     approvalRouter?: ApprovalRouter;
     goal?: string | GoalConfig;
+    /** Run this standalone turn without explicit, persisted, or configured Goal mode. */
+    disableGoal?: boolean;
     injected?: boolean;
     clientMessageId?: string;
     /**
@@ -170,6 +188,8 @@ export type AgentRuntimeProgressEvent = {
     usage: TokenUsage;
 };
 export interface ChildEngineRuntime {
+    /** Release child-local resources after the entire supervised lifetime settles. */
+    dispose?(): void | Promise<void>;
     run(task: string, options?: EngineRunOptions): Promise<EngineResult>;
     setAgentControlStateListener(listener: ((state: LiveChildState) => void) | undefined): void;
     setAgentDirectionsDeliveredListener?(listener: ((envelopeIds: string[]) => void) | undefined): void;

package/dist/engine/run-workspace.js

@@ -54,30 +54,12 @@ export async function resolveRunWorkspace(args) {
         ? await args.sessionManager.resolveSessionWorkspaceForResume(options.sessionId)
         : undefined;
     if (workspaceResume && !workspaceResume.ok) {
-        return {
-            ok: false,
-            result: {
-                text: `ERROR: ${workspaceResume.message}`,
-                reason: "completed",
-                sessionId: options.sessionId,
-                turnCount: 0,
-                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
-            },
-        };
+        return workspaceError(options?.sessionId, workspaceResume.message);
     }
     if (workspaceResume?.ok &&
         workspaceResume.reason === "worktree_missing_branch_gone" &&
         workspaceResume.message) {
-        return {
-            ok: false,
-            result: {
-                text: workspaceResume.message,
-                reason: "completed",
-                sessionId: options.sessionId,
-                turnCount: 0,
-                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
-            },
-        };
+        return workspaceError(options?.sessionId, workspaceResume.message);
     }
     // Existing P1 sessions resolve cwd from SessionWorkspace, even if the host
     // passes a stale cwd. Legacy sessions without workspace keep the historical
@@ -158,7 +140,9 @@ function workspaceError(sessionId, message) {
         ok: false,
         result: {
             text: `ERROR: ${message}`,
-            reason: "completed",
+            // Like other initialization failures, this run never reached a model
+            // turn. Hosts must see a failure rather than report a completed delivery.
+            reason: "model_error",
             sessionId: sessionId ?? "workspace-invalid",
             turnCount: 0,
             usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },

package/dist/engine/subagent-spawner.d.ts

@@ -17,6 +17,9 @@ export declare function resolveChildMcpServers(allowlist: string[] | undefined,
 export declare function wrapChildStream(destination: StreamCallback | undefined, agentId: string): StreamCallback | undefined;
 export interface CreateSubAgentSpawnerDeps {
     parentConfig: EngineConfig;
+    parentSessionId?: string;
+    /** Tool context is assembled before the run session is initialized. */
+    getParentSessionId?: () => string;
     /** Fully resolved sandbox for this parent run, including settings layers. */
     parentSandbox: SandboxConfig;
     presetName: AgentPresetName;

package/dist/engine/subagent-spawner.js

@@ -252,7 +252,11 @@ export function createSubAgentSpawner(deps) {
                 maxContextTokens: deps.parentConfig.maxContextTokens ?? 200_000,
                 sessionStorageDir: deps.parentConfig.sessionStorageDir,
                 headless: deps.parentConfig.headless,
-                readOnlySession: request.readOnlySession,
+                readOnlySession: deps.parentConfig.readOnlySession || request.readOnlySession,
+                projectTrusted: deps.parentConfig.projectTrusted,
+                allowBackgroundShells: deps.parentConfig.allowBackgroundShells,
+                approvalBackend: deps.parentConfig.approvalBackend,
+                approvalRouter: deps.parentConfig.approvalRouter,
                 skillAllowlist: request.skillAllowlist,
                 sandbox: resolveChildSandbox(request.sandboxMode, deps.parentSandbox),
                 mcpServers: resolveChildMcpServers(request.mcpAllowlist, deps.parentConfig.mcpServers),
@@ -261,28 +265,55 @@ export function createSubAgentSpawner(deps) {
             };
             const destination = request.streamOverride ?? deps.parentStream;
             const childSessionId = request.resumeSessionId ?? request.agentId;
-            if (deps.childRunner.createChild && request.runtimeGeneration !== undefined) {
-                const runtime = deps.childRunner.createChild(childConfig);
-                const supervisor = new ChildRunSupervisor(runtime, childSessionId, request.runtimeGeneration);
-                const ownerToken = nanoid();
-                const bound = request.bindLiveControl?.(supervisor, ownerToken);
-                supervisor.setCloseIntake(() => request.closeLiveControl?.(supervisor, bound && bound !== true ? bound : undefined));
-                if (bound === false) {
-                    throw new Error(`child session ${childSessionId} already has a live transcript writer`);
+            const parentSessionId = deps.getParentSessionId?.() ?? deps.parentSessionId;
+            const host = parentSessionId
+                ? deps.parentConfig.createChildHostBindings?.({
+                    parentSessionId,
+                    sessionId: childSessionId,
+                    signal: request.signal,
+                })
+                : undefined;
+            if (host) {
+                childConfig.browserBridge = host.browserBridge;
+                childConfig.askUser = host.askUser;
+                childConfig.injectCredentialToBrowser = host.injectCredentialToBrowser;
+                childConfig.approvalBackend = host.approvalBackend ?? childConfig.approvalBackend;
+            }
+            let runtime;
+            try {
+                if (deps.childRunner.createChild && request.runtimeGeneration !== undefined) {
+                    runtime = deps.childRunner.createChild(childConfig);
+                    const supervisor = new ChildRunSupervisor(runtime, childSessionId, request.runtimeGeneration);
+                    const ownerToken = nanoid();
+                    const bound = request.bindLiveControl?.(supervisor, ownerToken);
+                    supervisor.setCloseIntake(() => request.closeLiveControl?.(supervisor, bound && bound !== true ? bound : undefined));
+                    if (bound === false) {
+                        throw new Error(`child session ${childSessionId} already has a live transcript writer`);
+                    }
+                    host?.activate?.();
+                    return await supervisor.run(request.prompt, {
+                        signal: request.signal,
+                        onStream: wrapChildRuntimeStream(destination, request.agentId, request.onProgressEvent),
+                        sessionId: childSessionId,
+                        onAgentProgress: request.onAgentProgress,
+                    });
                 }
-                return await supervisor.run(request.prompt, {
+                host?.activate?.();
+                const result = await deps.childRunner.runChild(childConfig, request.prompt, {
                     signal: request.signal,
                     onStream: wrapChildRuntimeStream(destination, request.agentId, request.onProgressEvent),
                     sessionId: childSessionId,
-                    onAgentProgress: request.onAgentProgress,
                 });
+                return result;
+            }
+            finally {
+                try {
+                    host?.dispose();
+                }
+                finally {
+                    await runtime?.dispose?.();
+                }
             }
-            const result = await deps.childRunner.runChild(childConfig, request.prompt, {
-                signal: request.signal,
-                onStream: wrapChildRuntimeStream(destination, request.agentId, request.onProgressEvent),
-                sessionId: childSessionId,
-            });
-            return result;
         },
     };
 }

package/dist/engine/turn-loop.d.ts

@@ -11,6 +11,7 @@ import type { LiveChildState } from "../tool-system/builtin/agent-registry.js";
 import { ModelFacade } from "./model-facade.js";
 import { ToolExecutor } from "../tool-system/executor.js";
 import { ContextManager } from "../context/manager.js";
+import type { SessionContextNotes } from "../context/notes.js";
 import { HookRegistry } from "../hooks/registry.js";
 import type { GoalJudgeRuntimeContext } from "../hooks/goal-stop-hook.js";
 import type { PromptCacheDiagnosticSample } from "./prompt-cache-diagnostics.js";
@@ -34,6 +35,8 @@ export interface TurnLoopConfig {
      * summarized into durable history. Engine uses this for dynamicContext.
      */
     volatileContextMessages?: Iterable<Message>;
+    /** Current instructions and lifecycle hooks, reattached after a notes transition. */
+    retainedContextMessages?: Iterable<Message>;
     /**
      * Fired after each turn boundary is recorded. Lets the engine flush an
      * up-to-date snapshot to state.json mid-run, so a long run doesn't leave
@@ -66,6 +69,7 @@ export interface TurnLoopDeps {
     model: ModelFacade;
     toolExecutor: ToolExecutor;
     contextManager: ContextManager;
+    contextNotes?: SessionContextNotes;
     hooks: HookRegistry;
     transcript: Transcript;
     systemPrompt: string;
@@ -289,12 +293,18 @@ export declare class TurnLoop {
     private stripVolatileContextMessages;
     /**
      * Keep volatile context out of compaction/summarization without moving it on
-     * every model round. If context management is a no-op, return the original
-     * array so the provider sees a strictly append-only prompt. A real rewrite
-     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
-     * a fresh append-only segment with the volatile snapshot at the new tail.
+     * every model round. Normalizing a newly appended tool result must not move
+     * an earlier volatile snapshot and invalidate an otherwise unchanged prefix.
+     * Keep its position when the preceding stable messages remain intact; reset
+     * to the tail when that boundary was rewritten or compaction changed length.
      */
     private restoreVolatileAfterContextManagement;
+    private noteReminderIssued;
+    private readonly retainedHookMessages;
+    private readonly pendingContextReminders;
+    private appendContextReminder;
+    /** Called only before a model step or after every result in a tool batch is recorded. */
+    private applyNotesRollover;
     private manageContextMessages;
     private manageContextMessagesSync;
     private markPendingImagesConsumed;

package/dist/engine/turn-loop.js

@@ -342,25 +342,114 @@ export class TurnLoop {
     }
     /**
      * Keep volatile context out of compaction/summarization without moving it on
-     * every model round. If context management is a no-op, return the original
-     * array so the provider sees a strictly append-only prompt. A real rewrite
-     * (dedupe/compaction/truncation) already invalidates the old prefix, so start
-     * a fresh append-only segment with the volatile snapshot at the new tail.
+     * every model round. Normalizing a newly appended tool result must not move
+     * an earlier volatile snapshot and invalidate an otherwise unchanged prefix.
+     * Keep its position when the preceding stable messages remain intact; reset
+     * to the tail when that boundary was rewritten or compaction changed length.
      */
     restoreVolatileAfterContextManagement(original, stableInput, managedStable) {
-        const unchanged = stableInput.length === managedStable.length &&
-            stableInput.every((message, index) => managedStable[index] === message);
-        if (unchanged)
-            return original;
+        if (stableInput.length === managedStable.length) {
+            // Some cleanup passes copy messages even when their final content is
+            // unchanged. Object identity is only a fast path, not a cache boundary.
+            const firstChangedIndex = stableInput.findIndex((message, index) => managedStable[index] !== message &&
+                JSON.stringify(managedStable[index]) !== JSON.stringify(message));
+            if (firstChangedIndex === -1)
+                return original;
+            let stableIndex = 0;
+            let lastVolatileBoundary = 0;
+            for (const message of original) {
+                if (this.volatileContextMessages.has(message)) {
+                    lastVolatileBoundary = stableIndex;
+                }
+                else {
+                    stableIndex++;
+                }
+            }
+            if (firstChangedIndex >= lastVolatileBoundary) {
+                // Apply the managed tail in place, including its persisted/truncated
+                // results. Never restore old payloads just to preserve cache hits.
+                stableIndex = 0;
+                return original.map((message) => this.volatileContextMessages.has(message) ? message : managedStable[stableIndex++]);
+            }
+        }
         const volatile = original.filter((message) => this.volatileContextMessages.has(message));
         return [...managedStable, ...volatile];
     }
+    noteReminderIssued = false;
+    retainedHookMessages = new Map();
+    pendingContextReminders = new Map();
+    appendContextReminder(messages, message, retainForRun = false) {
+        messages.push(message);
+        if (!this.deps.contextNotes)
+            return;
+        const target = retainForRun ? this.retainedHookMessages : this.pendingContextReminders;
+        target.set(JSON.stringify(message), message);
+    }
+    /** Called only before a model step or after every result in a tool batch is recorded. */
+    applyNotesRollover(messages) {
+        const notes = this.deps.contextNotes;
+        if (!notes ||
+            !notes.hasPendingRollover() ||
+            this.pendingImageMessages.size > 0 ||
+            this.sensitiveToolResultRedactions.size > 0) {
+            return messages;
+        }
+        if (this.config.signal?.aborted || this.goalControlStopRequested)
+            return messages;
+        const stable = this.stripVolatileContextMessages(messages);
+        const liveContent = new Set(stable.map((message) => JSON.stringify(message)));
+        for (const key of this.retainedHookMessages.keys()) {
+            if (!liveContent.has(key))
+                this.retainedHookMessages.delete(key);
+        }
+        const retainedByContent = new Map([
+            ...(this.config.retainedContextMessages ?? []),
+            ...this.retainedHookMessages.values(),
+            ...this.pendingContextReminders.values(),
+        ].map((message) => [JSON.stringify(message), message]));
+        const retained = [...retainedByContent.values()];
+        const checkpoint = notes.applyRollover(stable, retained);
+        if (!checkpoint)
+            return messages;
+        const managed = [...retained, ...checkpoint];
+        this.deps.contextManager.recordNotesCompaction(stable, managed);
+        this.noteReminderIssued = false;
+        return this.restoreVolatileAfterContextManagement(messages, stable, managed);
+    }
     async manageContextMessages(messages) {
-        if (this.volatileContextMessages.size === 0) {
-            return this.deps.contextManager.manageAsync(messages, this.config.signal);
+        messages = this.applyNotesRollover(messages);
+        const notes = this.deps.contextNotes;
+        if (notes) {
+            const stable = this.stripVolatileContextMessages(messages);
+            const limits = this.deps.contextManager.checkLimits(stable);
+            if (limits.needsCompact) {
+                try {
+                    notes.requestRollover();
+                    messages = this.applyNotesRollover(messages);
+                }
+                catch {
+                    // No usable note (or it was already consumed): existing summary is the fallback.
+                }
+            }
+            const nearBudget = this.deps.contextManager.shouldPrepareNote(this.stripVolatileContextMessages(messages));
+            if (!nearBudget)
+                this.noteReminderIssued = false;
+            const canSaveNotes = this.deps.tools.some((tool) => tool.name === "SaveContextNote");
+            if (nearBudget && !this.noteReminderIssued && canSaveNotes) {
+                messages = [
+                    ...messages,
+                    {
+                        role: "user",
+                        content: "<system-reminder>Context budget is running low. Use SaveContextNote to preserve the current goal, latest corrections, decisions, verified work, pending questions and next steps. Then call NewContext in a separate tool batch and continue the same task. Original history remains available through SearchHistory.</system-reminder>",
+                    },
+                ];
+                this.noteReminderIssued = true;
+            }
         }
         const stable = this.stripVolatileContextMessages(messages);
-        const managed = await this.deps.contextManager.manageAsync(stable, this.config.signal);
+        const managed = await this.deps.contextManager.manageAsync(stable, this.config.signal, {
+            preferNotes: notes !== undefined,
+        });
         return this.restoreVolatileAfterContextManagement(messages, stable, managed);
     }
     manageContextMessagesSync(messages) {
@@ -647,7 +736,7 @@ export class TurnLoop {
                 });
                 const turnStartInjection = wrapHookMessages(turnStartHook.messages);
                 if (turnStartInjection) {
-                    messages.push(turnStartInjection);
+                    this.appendContextReminder(messages, turnStartInjection, true);
                 }
                 if (this.goalControlStopRequested) {
                     messages = this.redactConsumedSensitiveToolResults(messages);
@@ -659,21 +748,21 @@ export class TurnLoop {
                 // cap, the limit a re-blocked goal actually hits first.)
                 const turnsRemaining = this.config.maxTurns - this.turnCount;
                 if (turnsRemaining === 2) {
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>Warning: you have only 2 turns remaining before the turn limit is reached. " +
                             "Start wrapping up your work and prepare a summary of what you've accomplished and what remains to be done.</system-reminder>",
                     });
                 }
                 else if (turnsRemaining === 1) {
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>Warning: you have only 1 turn remaining before the turn limit is reached. " +
                             "Wrap up your work now — your next turn will be your last.</system-reminder>",
                     });
                 }
                 else if (turnsRemaining === 0) {
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>This is your LAST turn. You MUST respond with a final text summary now. " +
                             "Do NOT call any tools. Summarize what you have accomplished and list any remaining work.</system-reminder>",
@@ -732,7 +821,7 @@ export class TurnLoop {
                     });
                     const compactInjection = wrapHookMessages(compactHook.messages);
                     if (compactInjection) {
-                        messages.push(compactInjection);
+                        this.appendContextReminder(messages, compactInjection, true);
                     }
                 }
                 if (this.goalControlStopRequested) {
@@ -760,6 +849,7 @@ export class TurnLoop {
                 });
                 let response;
                 try {
+                    this.deps.contextNotes?.markModelBoundary();
                     response = await this.callModelWithFallback(messages, assistantMessageId);
                 }
                 catch (err) {
@@ -846,6 +936,7 @@ export class TurnLoop {
                     if (anchor)
                         this.deps.recordContextUsageAnchor?.(anchor);
                 }
+                this.pendingContextReminders.clear();
                 messages = this.markPendingImagesConsumed(messages);
                 // stopBlockCount guards only the no-tool final-answer loop evaluated by
                 // on_stop (text -> block -> text -> block). A response that structurally
@@ -889,7 +980,7 @@ export class TurnLoop {
                             },
                         });
                     }
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>Your previous response was truncated by the max output token limit before the tool call finished, so its arguments are incomplete. Do not assume it ran. Either retry with a smaller/more focused tool call (e.g. write the file in sections via Edit), or raise this model's maxOutputTokens.</system-reminder>",
                     });
@@ -1133,13 +1224,13 @@ export class TurnLoop {
                         this.maybeAnnounceApproachingLimit();
                         const injection = wrapHookMessages(stopHook.messages);
                         if (injection) {
-                            messages.push(injection);
+                            this.appendContextReminder(messages, injection, true);
                         }
                         else {
                             // No guidance from the handler — inject a generic nudge so the
                             // model knows it must keep going rather than re-emitting the
                             // same final answer.
-                            messages.push({
+                            this.appendContextReminder(messages, {
                                 role: "user",
                                 content: "<system-reminder>The goal is not yet complete. Continue working toward it.</system-reminder>",
                             });
@@ -1284,6 +1375,7 @@ export class TurnLoop {
                 const toolResultMessage = { role: "user", content: resultBlocks };
                 messages.push(toolResultMessage);
                 this.trackFreshImageMessage(toolResultMessage);
+                messages = this.applyNotesRollover(messages);
                 // B-3: tell the model which of its requested tool calls were dropped by
                 // the per-turn cap so it can re-issue them, instead of silently assuming
                 // they ran. Appended to the same user message that carries the results.
@@ -1298,7 +1390,7 @@ export class TurnLoop {
                     // Separate user message (not folded into the tool_result blocks) so the
                     // OpenAI converter — which lifts tool_results into standalone role:tool
                     // messages — keeps the reminder as a plain user turn after them.
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: `<system-reminder>Only the first ${toolCalls.length} of your ${response.toolCalls.length} ` +
                             `tool calls ran this turn (per-turn limit is ${this.config.maxToolCallsPerTurn}). ` +
@@ -1383,7 +1475,7 @@ export class TurnLoop {
                         return { text: finalText, reason: "completed", messages };
                     }
                     tlog.warn("turn.goal_self_reported_complete_persist_failed", { cat: "goal" });
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>complete_goal 未能持久化完成状态；目标仍处于活动状态。请不要宣称已经结束，并在会话状态恢复可写后重试。</system-reminder>",
                     });
@@ -1419,7 +1511,7 @@ export class TurnLoop {
                         };
                     }
                     tlog.warn("turn.goal_user_cancelled_persist_failed", { cat: "goal" });
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>cancel_goal 未能持久化删除状态；目标仍处于活动状态。请在会话状态恢复可写后重试。</system-reminder>",
                     });
@@ -1452,7 +1544,7 @@ export class TurnLoop {
                     };
                 }
                 if (budgetDecision === "nudge") {
-                    messages.push({
+                    this.appendContextReminder(messages, {
                         role: "user",
                         content: "<system-reminder>You are approaching the token budget limit. Please start wrapping up your work and provide a summary.</system-reminder>",
                     });
@@ -1465,7 +1557,7 @@ export class TurnLoop {
                     guard.noteText(response.text);
                     const turnReminder = guard.turnEnded(this.turnCount);
                     if (turnReminder) {
-                        messages.push({ role: "user", content: turnReminder });
+                        this.appendContextReminder(messages, { role: "user", content: turnReminder });
                         tlog.info("guard.silent_turn", { cat: "guard", turn: this.turnCount });
                     }
                 }
@@ -1477,7 +1569,7 @@ export class TurnLoop {
                 if (taskGuard) {
                     const taskReminder = taskGuard.turnEnded(this.turnCount);
                     if (taskReminder) {
-                        messages.push({ role: "user", content: taskReminder });
+                        this.appendContextReminder(messages, { role: "user", content: taskReminder });
                         tlog.info("guard.stale_task", { cat: "guard", turn: this.turnCount });
                     }
                 }
@@ -1556,7 +1648,7 @@ export class TurnLoop {
             messages = this.redactConsumedSensitiveToolResults(messages);
             return { text: finalText, reason: "completed", messages };
         }
-        messages.push({
+        this.appendContextReminder(messages, {
             role: "user",
             content: "<system-reminder>Turn limit reached. Provide a final summary of what you accomplished and what remains to be done. Do NOT call any tools.</system-reminder>",
         });
@@ -1754,11 +1846,11 @@ export class TurnLoop {
                 break;
             }
             consumed = true;
-            this.deps.setOriginClientMessageId?.(clientMessageId);
             const message = { role: "user", content };
             messages.push(message);
             this.trackFreshImageMessage(message);
             this.deps.transcript.appendMessage("user", content, { steerId: id, clientMessageId });
+            this.deps.setOriginClientMessageId?.(clientMessageId);
             this.config.onStream?.({ type: "steer_injected", text, id });
         }
         return consumed;
@@ -1796,7 +1888,7 @@ export class TurnLoop {
         this.deps.onAgentDirectionsDelivered?.(envelopeIds);
         const hookInjection = wrapHookMessages(hook.messages);
         if (hookInjection)
-            messages.push(hookInjection);
+            this.appendContextReminder(messages, hookInjection, true);
         return true;
     }
     /**