@nowcrew/daemon 0.6.87 → 0.6.88-beta.10

package/README.md

@@ -242,26 +242,26 @@ The stable adapters keep prompts out of provider argv wherever the provider prot
 
 | Runtime | Transport | System/wake input | Native resume |
 | --- | --- | --- | --- |
-| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
-| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
-| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| Hermes | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| OpenCode | `run --format json` | stdin | `--session` |
+| Claude | stream-json CLI | daemon-owned system prompt file + user input | CLI session id; thread-bound: matching native SessionStart proof + SDK initialization |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume`; thread-bound: returned id must match |
+| Kimi | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| Hermes | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| OpenCode | `run --format json` | stdin | unbound: `--session`; thread-bound: cold |
 | DeepSeek Harness | ACP over stdio | `session/prompt` | none (fresh session per execution) |
 
 Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
 the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
-CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+CLI; only unbound executions can carry a saved native session id. Unrelated ACP failures stay failures. The CLI fallback is
 subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
 durable Job Object ownership is available.
 
 Hermes uses only ACP capabilities advertised by the installed CLI. Model and effort choices come from
 a short-lived discovery session; credentials, provider profiles, plugins, and `HERMES_HOME` remain
-machine-local. A missing resumed ACP session is retried once as a fresh session.
+machine-local. For unbound executions, a missing resumed ACP session is retried once as a fresh session.
 
 OpenCode receives the prompt through stdin and runs with both cwd and `PWD` anchored to the Agent
 workspace. Models and variants come from `opencode models --verbose` (with the plain catalog as a
-compatibility fallback). A missing resumed session is retried once without `--session`; malformed,
+compatibility fallback). For unbound executions, a missing resumed session is retried once without `--session`; malformed,
 empty, incomplete, or explicitly failed JSON streams remain failures. NowWork never writes
 `opencode.json` or replaces `OPENCODE_CONFIG_CONTENT`. The daemon advertises OpenCode as executable
 only when `opencode run --help` exposes `--format`, `--dangerously-skip-permissions`, `--dir`,
@@ -291,8 +291,12 @@ uses fresh sessions and committed text; it does not claim resume, images, MCP, r
 or transcript support. Agent environment variables cannot override `DEEPSEEK_*`, `DSH_*`, or
 `NOWCREW_DEEPSEEK_HARNESS_CONFIG`; those values always come from the daemon service environment.
 
-Codex, Kimi, Hermes, and OpenCode sessions use the same bounded per-task persistence and keyed lease as Claude when they
-run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+Unbound Codex, Kimi, Hermes, and OpenCode sessions retain the same configured warm/budget policy and keyed
+lease as Claude through protocol v1. Thread-bound Claude/Codex sessions keep their native session across
+warm-cache expiry, token estimates, and turn counts; verified restoration receives only accepted-cursor
+deltas. New sessions and runtimes without verified restoration receive complete current-thread history
+before the business turn. See the [thread context contract](../docs/thread-scoped-native-context.md).
+A first-progress watchdog covers a provider that accepts a turn but remains
 semantically silent; after the first semantic event, the execution's configured total timeout remains
 authoritative so a legitimate long-running tool is not killed for quiet output.
 DeepSeek Harness is execution-v1-only and intentionally skips native session persistence.
@@ -354,6 +358,15 @@ Runtime launch, which recovers from a missed notification or daemon restart. Ski
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 
+## 目录投影测试的平台范围
+
+`test/directory-projection.test.ts` 在所有平台运行，覆盖路径检查、复制发布、只读权限请求及失败恢复。
+其受控文件系统夹具记录目录 `chmod` 请求，但保留宿主目录的写权限，避免把 macOS 的目录重命名规则当作 Windows 行为。
+生产代码的只读保护不受此夹具影响。
+
+`test/directory-projection.windows.test.ts` 仅在 Windows 上运行，使用真实文件系统验证只读目录发布与文件保护。
+非 Windows 的全量测试会明确跳过该文件，不能据此宣称 Windows 原生行为已验证。
+
 ## Reliability
 
 Protocol-v1 lifecycle is `accepted → started → completed`, followed by a server
@@ -418,6 +431,28 @@ Local policy can reduce server-requested access and limits; it cannot grant more
 Provider credentials and configured environment are prepared locally and never carried in execution
 control frames.
 
+## 完整本地记忆读取
+
+运行时注入的 `MEMORY.md` 是有界预览，未命中不代表完整文件没有相关记忆。
+普通 Agent 工作区会在现有 PATH 目录中提供只读 `crew-memory` 工具，无需 Server 凭证：
+
+```bash
+crew-memory search --query '提交前检查'
+crew-memory search --query '提交前检查' --after-line 120
+crew-memory read --offset 2400 --limit 2000
+crew-memory read --file notes/testing.md --offset 0 --limit 2000
+```
+
+命令默认返回 JSON。搜索遍历完整指定文件，返回 `line`、`offset`、命中摘要和
+`nextAfterLine`；读取按 Unicode 字符偏移分页，使用 `nextOffset` 继续直到 `eof=true`。
+后续页可传 `--if-hash <上一页的sha256>`，文件变化时明确停止，不混读不同版本。
+每页 JSON 有 12 KiB 上限，输入文件超过 32 MiB 时明确报错，不将未完成搜索伪装为零命中。
+
+工具仅支持 `MEMORY.md` 和 `notes/` 下明确指定的 Markdown 文件，不遍历 pending，
+不写入或迁移记忆。搜索结果是原始资料定位，读取明细前仍需确认当前有效索引和正文片段。
+这些修改不改变现有 V2 写入上限、候选状态或归档策略，也不提供自动语义召回保证。
+工具随 daemon 包发布；旧 daemon 没有该入口时，Agent 使用原生文件搜索与分段读取回退。
+
 ## Optional TencentDB Agent Memory Bridge
 
 Execution protocol v1 can opt NowWork Agents into the private TencentDB Agent Memory Panel.

package/dist/agent-memory/policy.js

@@ -17,7 +17,9 @@ function truncateUtf8(value, maxBytes) {
     return output;
 }
 export function extractIncomingMessage(wakePrompt) {
-    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew)|$)/su);
+    // Keep legacy wake delimiters while accepting program-delivered-context prompts.
+    // Stop before policy/history blocks; neither is the current user's message.
+    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew|Work directly from this thread's context|直接依据程序交付的本线程上下文|No thread anchor:|没有线程锚点[，,])|$)/su);
     const content = match?.[1]?.trim();
     return content ? content : null;
 }

package/dist/cloud-report-receipt.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const MAX_REPORT_BYTES = 32 * 1024 * 1024;
+export function reportDeliveryContext(executionId, runDir, facts) {
+    return {
+        version: 1,
+        provider: facts.provider,
+        executionId,
+        receiptFile: join(runDir, `.qa-report-delivery-${createHash("sha256").update(executionId).digest("hex")}.json`),
+        ...(facts.ossUploadScript === undefined ? {} : { script: facts.ossUploadScript }),
+    };
+}
+function inside(root, file) {
+    const part = relative(root, file);
+    return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute(part);
+}
+export async function verifiedReportReceipt(input) {
+    if (!input.receiptFile || !input.answer)
+        return false;
+    try {
+        const stat = await lstat(input.receiptFile);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 64 * 1024)
+            return false;
+        const receipt = JSON.parse(await readFile(input.receiptFile, "utf8"));
+        if (!receipt || typeof receipt !== "object")
+            return false;
+        const r = receipt;
+        if (r.version !== 1 || r.executionId !== input.executionId || r.evidenceComplete !== true
+            || !Array.isArray(r.runIds) || r.runIds.length === 0 || r.runIds.length > 100
+            || r.runIds.some(id => typeof id !== "string" || !id || id.length > 256)
+            || typeof r.file !== "string" || !isAbsolute(r.file) || !r.file.endsWith(".html")
+            || typeof r.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.sha256)
+            || typeof r.url !== "string")
+            return false;
+        const url = new URL(r.url);
+        if (url.protocol !== "https:" || url.hostname !== "ai-claw-in.nowcoder.com"
+            || !url.pathname.endsWith(".html") || url.username || url.password || url.search || url.hash)
+            return false;
+        const answerUrls = input.answer.match(/https:\/\/ai-claw-in\.nowcoder\.com\/[^\s<>"')\]]+/g) ?? [];
+        if (!answerUrls.includes(url.href))
+            return false;
+        const file = await realpath(r.file);
+        const roots = await Promise.all([input.root, input.qaReportRoot ?? join(input.root, "qa-report-server-v2")]
+            .map(root => realpath(resolve(root)).catch(() => null)));
+        if (!roots.some(root => root !== null && inside(root, file)))
+            return false;
+        const fileStat = await lstat(file);
+        if (!fileStat.isFile() || fileStat.size > MAX_REPORT_BYTES)
+            return false;
+        const expectedHash = createHash("sha256").update(await readFile(file)).digest("hex");
+        if (expectedHash !== r.sha256)
+            return false;
+        const response = await fetch(url.href, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+        if (!response.ok || !/^text\/html(?:;|$)/i.test(response.headers.get("content-type") ?? "")
+            || /attachment/i.test(response.headers.get("content-disposition") ?? "") || !response.body) {
+            await response.body?.cancel();
+            return false;
+        }
+        const reader = response.body.getReader();
+        const hash = createHash("sha256");
+        let bytes = 0;
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                bytes += chunk.value.byteLength;
+                if (bytes > MAX_REPORT_BYTES)
+                    return false;
+                hash.update(chunk.value);
+            }
+            return bytes === fileStat.size && hash.digest("hex") === expectedHash;
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cloud-report-uploader.js

@@ -4,6 +4,7 @@ import { extname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { cloudReportUploadFacts } from "./cloud-report-upload.js";
 import { dslog } from "./slog.js";
+import { verifiedReportReceipt } from "./cloud-report-receipt.js";
 const execFileP = promisify(execFile);
 const REPORT_FILENAMES = new Set(["report.md", "result.json"]);
 const MAX_DEPTH = 8;
@@ -13,22 +14,17 @@ const fileFingerprint = async (path) => {
     const stat = await lstat(path);
     return `${stat.size}:${stat.mtimeMs}`;
 };
-function isReportFile(root, path) {
+function isReportFile(root, path, kind) {
     const parts = relative(root, path).split(sep).filter(Boolean);
     const filename = parts.at(-1) ?? "";
-    if (parts[0] === "tasks" && parts.length >= 3) {
-        return REPORT_FILENAMES.has(filename) || extname(filename).toLowerCase() === ".html";
-    }
-    if (parts[0] !== "qa-report-server-v2")
-        return false;
-    if (parts[1] === "static" && parts.length === 3)
-        return extname(filename).toLowerCase() === ".html";
-    if (parts[1] === "qa-results" && parts.length >= 4) {
+    if (kind === "static")
+        return parts.length === 1 && extname(filename).toLowerCase() === ".html";
+    if (parts.length >= 2) {
         return REPORT_FILENAMES.has(filename) || extname(filename).toLowerCase() === ".html";
     }
     return false;
 }
-async function walkReports(root, directory, depth, output) {
+async function walkReports(root, directory, depth, output, kind) {
     if (depth > MAX_DEPTH || output.length >= MAX_FILES)
         return;
     const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
@@ -39,28 +35,26 @@ async function walkReports(root, directory, depth, output) {
             continue;
         const path = join(directory, entry.name);
         if (entry.isDirectory()) {
-            await walkReports(root, path, depth + 1, output);
+            await walkReports(root, path, depth + 1, output, kind);
         }
-        else if (entry.isFile() && isReportFile(root, path)) {
+        else if (entry.isFile() && isReportFile(root, path, kind)) {
             output.push(resolve(path));
         }
     }
 }
-export async function snapshotReportFiles(root) {
+export async function snapshotReportFiles(root, qaReportRoot) {
     const files = [];
     const workspaceRoot = resolve(root);
-    for (const directory of [
-        join(workspaceRoot, "tasks"),
-        join(workspaceRoot, "qa-report-server-v2", "qa-results"),
-        join(workspaceRoot, "qa-report-server-v2", "static"),
-    ]) {
-        await walkReports(workspaceRoot, directory, 0, files);
+    const hub = resolve(qaReportRoot ?? join(workspaceRoot, "qa-report-server-v2"));
+    for (const kind of ["tasks", "qa-results", "static"]) {
+        const directory = join(kind === "tasks" ? workspaceRoot : hub, kind);
+        await walkReports(directory, directory, 0, files, kind);
     }
     const entries = await Promise.all(files.map(async (path) => [path, await fileFingerprint(path)]));
     return new Map(entries);
 }
-export async function discoverReportFiles(root, before) {
-    const after = await snapshotReportFiles(root);
+export async function discoverReportFiles(root, before, qaReportRoot) {
+    const after = await snapshotReportFiles(root, qaReportRoot);
     return [...after.entries()]
         .filter(([path, fingerprint]) => before.get(path) !== fingerprint)
         .map(([path]) => path)
@@ -97,7 +91,7 @@ async function verifyOssUrl(url) {
     }
 }
 export async function uploadCloudReports(input) {
-    const files = await discoverReportFiles(input.root, input.before);
+    const files = await discoverReportFiles(input.root, input.before, input.qaReportRoot);
     if (files.length === 0)
         return { urls: [], failures: [] };
     const run = input.execFile ?? (async (file, args) => {
@@ -131,10 +125,10 @@ export async function uploadCloudReports(input) {
     }
     return { urls, failures };
 }
-export async function prepareCloudReportSnapshot(facts, root) {
+export async function prepareCloudReportSnapshot(facts, root, qaReportRoot) {
     if (!facts.enabled)
         return null;
-    return snapshotReportFiles(root);
+    return snapshotReportFiles(root, qaReportRoot);
 }
 export async function prepareCloudReportExecution(input) {
     const facts = cloudReportUploadFacts(input.env);
@@ -147,7 +141,7 @@ export async function prepareCloudReportExecution(input) {
         return { facts, snapshot: null };
     }
     try {
-        return { facts, snapshot: await prepareCloudReportSnapshot(facts, input.root) };
+        return { facts, snapshot: await prepareCloudReportSnapshot(facts, input.root, input.qaReportRoot) };
     }
     catch (error) {
         dslog("cloud_report_upload.snapshot_failed", "报告文件快照失败", {
@@ -173,10 +167,19 @@ export async function deliverCloudReports(input) {
     if (!input.facts.enabled || input.facts.ossUploadScript === undefined || input.before === null) {
         return { finalText: input.finalText, externalAnswer: input.externalAnswer };
     }
+    if (input.captureFinal && await verifiedReportReceipt({
+        ...input, answer: input.externalAnswer ?? input.finalText,
+    })) {
+        dslog("cloud_report_upload.already_delivered", "本次执行的 HTML 交付收据及内容已验证，跳过重复上传", {
+            execution_id: input.executionId, agent_handle: input.agentHandle,
+        });
+        return { finalText: input.finalText, externalAnswer: input.externalAnswer };
+    }
     try {
         const result = await (input.upload ?? uploadCloudReports)({
             script: input.facts.ossUploadScript,
             root: input.root,
+            ...(input.qaReportRoot === undefined ? {} : { qaReportRoot: input.qaReportRoot }),
             before: input.before,
         });
         if (result.failures.length > 0) {
@@ -185,6 +188,14 @@ export async function deliverCloudReports(input) {
                 uploaded_count: result.urls.length, failed_count: result.failures.length,
             });
         }
+        else {
+            dslog(result.urls.length === 0 ? "cloud_report_upload.no_files" : "cloud_report_upload.completed", result.urls.length === 0 ? "未发现新增或变化的报告文件" : "报告上传完成", {
+                execution_id: input.executionId, agent_handle: input.agentHandle,
+                uploaded_count: result.urls.length,
+                report_root: input.root,
+                qa_report_root: input.qaReportRoot ?? join(input.root, "qa-report-server-v2"),
+            });
+        }
         return {
             finalText: input.captureFinal && result.urls.length > 0
                 ? appendReportLinks(input.finalText ?? "", result.urls)

package/dist/execution-protocol.js

@@ -200,7 +200,7 @@ export const ExecutionStartSchema = z.object({
         language: z.enum(["zh", "en"]),
         systemPrompt: z.string(),
         wakePrompt: z.string(),
-        maintenancePurpose: z.literal("self_training").optional(),
+        maintenancePurpose: z.enum(["self_training", "memory_prune"]).optional(),
     }).strict(),
     runtime: z.object({
         name: RuntimeSchema,

package/dist/execution-runner.js

@@ -834,13 +834,17 @@ export async function runExecution(config, input, dependencies) {
             ...(selfTraining ? { isolateLocalMemory: true } : {}),
             collaborationTools: config.codexCollaborationTools && spec.runtime.name === "codex",
         });
-        const boundedSystemPrompt = (context) => appendAgentMemoryContext(typeof systemPromptWithLocalFacts === "string"
-            ? systemPromptWithLocalFacts
-            : systemPromptWithLocalFacts(context), recalledMemory, baseSystemPromptBudget);
+        const boundedSystemPrompt = (context) => {
+            const base = typeof systemPromptWithLocalFacts === "string"
+                ? systemPromptWithLocalFacts
+                : systemPromptWithLocalFacts(context);
+            return appendAgentMemoryContext(base, recalledMemory, Math.max(Buffer.byteLength(base, "utf8"), baseSystemPromptBudget - (context.reservedPromptBytes ?? 0)));
+        };
         const localInput = {
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,
+            ...(spec.context.threadId === undefined ? {} : { threadId: spec.context.threadId }),
             keyMode: "opaque",
             taskKey: spec.workspace.taskKey,
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
@@ -882,13 +886,13 @@ export async function runExecution(config, input, dependencies) {
                 } : {}),
             },
             session: {
-                enabled: selfTraining ? false : config.resume,
+                enabled: spec.instructions.maintenancePurpose !== undefined ? false : config.resume,
                 warmMs: config.resumeWarmMs,
                 budgetTokens: config.sessionBudgetTokens,
                 softTokens: config.sessionSoftTokens,
                 maxTurns: config.sessionMaxTurns,
             },
-            ...(selfTraining ? { maintenancePurpose: "self_training" } : {}),
+            ...(spec.instructions.maintenancePurpose === undefined ? {} : { maintenancePurpose: spec.instructions.maintenancePurpose }),
             localMemoryV2Enabled,
         };
         const result = await Promise.race([

package/dist/list-models.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
+import { augmentedPath } from "./runtime-path.js";
 import { listClaudeModels } from "./runtimes/claude-models.js";
 import { listHermesModels } from "./runtimes/hermes-models.js";
 const execFileRaw = promisify(execFile);
@@ -8,6 +9,7 @@ const MODEL_PROBE_TIMEOUT_MS = 8_000;
 const MODEL_PROBE_MAX_BUFFER_BYTES = 1024 * 1024;
 // win32 上 npm CLI 是 .cmd shim,execFile 需 shell 才能执行;参数全是固定字面量,无注入面。
 const execFileP = (bin, args) => execFileRaw(bin, args, {
+    env: { ...process.env, PATH: augmentedPath() },
     shell: isWin(),
     timeout: MODEL_PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL",

package/dist/local-execution-prompt.js

@@ -34,45 +34,39 @@ export function truncateUtf8(value, maxBytes) {
     }
     return value.slice(0, end);
 }
-function takeCompletePromptSections(sections, maxBytes) {
-    return sections.reduce((state, section) => {
-        if (!state.full)
-            return state;
-        const sectionBytes = Buffer.byteLength(section, "utf8");
-        if (state.bytes + sectionBytes > maxBytes)
-            return { ...state, full: false };
-        return { value: `${state.value}${section}`, bytes: state.bytes + sectionBytes, full: true };
-    }, { value: "", bytes: 0, full: true }).value;
-}
 /** v1 server instructions opt in to daemon-owned paths and bounded local workspace context. */
 export function withLocalExecutionFacts(serverPrompt, maxBytes, options = {}) {
-    return ({ workspace, resuming, projectContext, trainingProjectContext }) => {
-        const memory = options.isolateLocalMemory ? "" : capMemoryForInject(workspace.memory);
+    return ({ workspace, resuming, projectContext, trainingProjectContext, reservedPromptBytes = 0 }) => {
         const workLog = resuming ? "" : capWorkLogForInject(workspace.workLog);
         const collaborationPrompt = options.collaborationTools === true ? buildCollaborationToolsPrompt() : "";
         const mandatoryWorkspacePrompt = `${buildRuntimeWorkspacePrompt(projectContext)}${buildTrainingGitProjectPrompt(trainingProjectContext)}`;
         const crewHome = options.isolateLocalMemory ? workspace.runDir : workspace.dir;
-        const localFactSections = [`\n\n## Local execution facts
+        const localFacts = `\n\n## Local execution facts
 - $CREW_HOME: ${crewHome}
-- $CREW_TASK_LOG: ${workspace.workLogPath}`,
-            ...(memory ? [`\n\n## Injected MEMORY.md (bounded local context)\n${memory}`] : []),
-            ...(workLog ? [`\n\n## Injected work-log (bounded local context)\n${workLog}`] : []),
-        ];
+- $CREW_TASK_LOG: ${workspace.workLogPath}`;
         const serverPromptBytes = Buffer.byteLength(serverPrompt, "utf8");
         const collaborationBytes = Buffer.byteLength(collaborationPrompt, "utf8");
         const mandatoryBytes = Buffer.byteLength(mandatoryWorkspacePrompt, "utf8");
         const requiredBytes = serverPromptBytes + collaborationBytes + mandatoryBytes;
-        // 必需预算与 projectContext 无关:协作段落永远参与;无协作时与旧实现逐字节等价。
+        // 先保留全部必需内容,再按实际剩余字节一次性构造预览。
         if (collaborationPrompt !== "" && requiredBytes > maxBytes) {
             throw new Error("collaboration_tools_prompt_budget_exceeded");
         }
-        if (mandatoryWorkspacePrompt !== "") {
-            if (requiredBytes > maxBytes)
-                throw new Error("project_workspace_prompt_budget_exceeded");
-            const optionalFacts = takeCompletePromptSections(localFactSections, maxBytes - requiredBytes);
-            return `${serverPrompt}${collaborationPrompt}${optionalFacts}${mandatoryWorkspacePrompt}`;
+        if (mandatoryWorkspacePrompt !== "" && requiredBytes > maxBytes) {
+            throw new Error("project_workspace_prompt_budget_exceeded");
         }
-        const remaining = maxBytes - requiredBytes;
-        return `${serverPrompt}${collaborationPrompt}${truncateUtf8(localFactSections.join(""), remaining)}`;
+        const remaining = maxBytes - requiredBytes - Math.max(0, reservedPromptBytes);
+        const factsBytes = Buffer.byteLength(localFacts, "utf8");
+        if (factsBytes > remaining)
+            return `${serverPrompt}${collaborationPrompt}${mandatoryWorkspacePrompt}`;
+        const memoryHeading = "\n\n## Injected MEMORY.md (bounded local context)\n";
+        const memory = options.isolateLocalMemory ? "" : capMemoryForInject(workspace.memory, undefined, remaining - factsBytes - Buffer.byteLength(memoryHeading, "utf8"));
+        const memorySection = memory === "" ? "" : memoryHeading + memory;
+        const workLogSection = workLog === "" ? "" : `\n\n## Injected work-log (bounded local context)\n${workLog}`;
+        const workLogBudget = remaining - factsBytes - Buffer.byteLength(memorySection, "utf8");
+        const boundedWorkLog = mandatoryWorkspacePrompt === ""
+            ? truncateUtf8(workLogSection, workLogBudget)
+            : Buffer.byteLength(workLogSection, "utf8") <= workLogBudget ? workLogSection : "";
+        return `${serverPrompt}${collaborationPrompt}${localFacts}${memorySection}${boundedWorkLog}${mandatoryWorkspacePrompt}`;
     };
 }