fix(goal): preserve interactive human turns

packages/core/agent/README.md

@@ -54,7 +54,7 @@ Turn and step boundaries and the model token stream are durable `session/event`
 
 The handle every plugin programs against:
 
-- `agent.send(content, options?)` — queue a message; starts a turn when idle. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content).
+- `agent.send(content, options?)` — queue a message; starts a turn when idle. Omitting `options.source` attests direct human input as `{ kind: 'user' }` and may authorize policy consumers, so plugins, schedulers, and other non-human producers provide their own source. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content).
 - `agent.steer(content, options?)` — steer a running turn (inject between steps); uses the same owned acceptance boundary and behaves like `send` when idle
 - `agent.inject(content, options?)` — accept detached in-session context without running the model; the next request sees its `context/message`. `options.envelope` defaults to the canonical `<context>` framing and may be `'raw'` when the caller owns a complete familiar frame; `options.meta` persists opaque JSON state without rendering it. While a turn is open it joins that turn, deferring FIFO while the current tool batch executes and draining before turn close if execution is interrupted; while idle it is wrapped in a one-shot `injection` turn and durability checkpoint ([the turn-enclosure invariant](../../../.agents/notes/implemented/architecture/2026-06-15-turn-enclosure-invariant.md)).
 - `agent.cancel(reason?)` — cancel ALL pending work: clears the queued + steering FIFOs, aborts the in-flight step, and drops a turn about to start (the pre-step window) so a queued-but-not-started prompt never runs. A UI/ACP `session/cancel` maps to this. The single public stop primitive. Idle with nothing pending → a safe no-op.

packages/core/agent/src/types.ts

@@ -25,7 +25,10 @@ export interface AgentOptions {
   model?: string
 }
 
-/** Message options; an omitted source resolves to `{ kind: 'user' }`, so plugins must label their own content. */
+/**
+ * Message options. An omitted source attests direct human input as `{ kind: 'user' }`
+ * and may authorize policy consumers, so non-human producers must label their content.
+ */
 export interface SendOptions {
   source?: MessageSource
 }

packages/goal/tool-goal/README.md

@@ -10,12 +10,14 @@ The model-facing control surface for [`ctx.goals`](../goal/README.md): `get_goal
 
 All calls are exclusive, so a model-ordered batch observes earlier mutations and their new revisions. ACP and other clients receive pure generic cards: read for `get_goal`, other for mutations.
 
-A successful mutation that leaves the goal stopped contributes the existing terminal `agent/turn-stop` decision for that physical turn. A later same-turn resume clears the contribution. This avoids an extra model request after pause, block, or completion without changing ordinary loop continuation.
+An autonomous goal round that successfully reports `complete` or `blocked` contributes the existing terminal `agent/turn-stop` decision for that physical turn. Direct-human mutations never contribute this stop: the assistant may acknowledge the change and concurrent human steering remains available to the loop.
 
 ## Authority
 
 Execution requires the exact live `exec.agent`, its inherited `AgentRegistry` initiator, running status, and an open turn. Create, edit, pause, and resume additionally require an accepted `{ kind: 'user' }` message or steering event in a runtime-root agent's current turn. Durable fork lineage does not demote a resumed root; live subagent ownership does.
 
+`{ kind: 'user' }` is a host attestation. `Agent.send()` and `steer()` assign it when their caller omits a source, so plugins, schedulers, and other non-human producers must pass their own source rather than inheriting human authority.
+
 Complete and blocked also accept the exact current goal round: a goal-sourced `user/message` whose id, revision, and round equal the folded current goal. A goal-round blocked call is mechanically rejected until `blockedAfterConsecutiveRounds`; the model judges whether the same condition actually persisted. Direct human authority may stop a goal immediately.
 
 ## Config
@@ -70,4 +72,5 @@ Schemas are prefix-stable while their definitions and visibility are unchanged.
 - **Semantic intent remains model judgment** — execution can prove direct human provenance, not whether a request is substantial enough to merit a goal.
 - **Same-condition blocking remains model judgment** — the runtime enforces distinct admitted-round count, not semantic equivalence of obstacles; an independent evaluator is deferred.
 - **No scheduling or UI commands** — these tools mutate state only; the same-session driver and human command surfaces are separate stack layers.
+- **Goal-round authority requires a driver** — the autonomous `complete`/`blocked` path is dormant unless a continuation driver admits goal-sourced user turns; mounting this tool package alone does not create them.
 - **Prompt registration is independent of filtering** — a scope may hide the tools while retaining their guidance unless the deployment scopes both registrations together.

packages/goal/tool-goal/src/authority.ts

@@ -62,7 +62,11 @@ export function goalToolExecution(ctx: Context, exec: ToolRunContext): GoalToolE
   return { agent, ...openTurn(agent) }
 }
 
-/** Whether an accepted human message appears in the current root-agent turn. */
+/**
+ * Whether host-attested human input appears in the current root-agent turn.
+ * An omitted `Agent.send()` / `steer()` source resolves to `user`, so non-human
+ * producers must supply their own source rather than inheriting this authority.
+ */
 function hasDirectHumanInput(ctx: Context, execution: GoalToolExecution): boolean {
   if (!ctx.agents.roots().includes(execution.agent)) return false
   return execution.events.some(event =>

packages/goal/tool-goal/src/index.ts

@@ -50,8 +50,8 @@ const CREATE_DESCRIPTION =
   + 'trivial single-turn work. Execution rejects non-human and subagent authority.'
 
 const GET_DESCRIPTION =
-  'Read the current same-session goal, including its exact id/revision, durable phase, admitted '
-  + 'round count, cap, and live process-local activation. Call this before updating a goal.'
+  'Read the current same-session goal, including its exact id/revision, objective, phase, completed '
+  + 'continuation rounds, round limit, and whether another continuation is armed. Call this before updating a goal.'
 
 /** Render policy guidance with its deployment-selected blocked threshold. */
 function guidance(blockedAfter: number): string {
@@ -107,13 +107,14 @@ function present(title: string, kind: 'read' | 'other', rawInput?: unknown): Gen
   return { card: 'generic', title, kind, ...rawInput === undefined ? {} : { rawInput } }
 }
 
-/** Remember whether one successful mutation makes this turn terminal. */
+/** Remember whether one autonomous terminal report should stop this turn. */
 function observeMutation(
   terminalTurns: WeakMap<Agent, number>,
   execution: GoalToolExecution,
   goal: GoalView,
+  autonomousTerminal: boolean,
 ): void {
-  if (goal.phase === 'active' && goal.activation === 'armed') {
+  if (!autonomousTerminal || (goal.phase === 'active' && goal.activation === 'armed')) {
     terminalTurns.delete(execution.agent)
     return
   }
@@ -123,6 +124,8 @@ function observeMutation(
 /** Register the three Codex-shaped goal tools and their shared policy section. */
 export function apply(ctx: Context, config: Config): void {
   const resolved = resolveConfig(config)
+  // A stale entry cannot match a later loop turn because turn numbers increase
+  // monotonically within the agent's fixed session.
   const terminalTurns = new WeakMap<Agent, number>()
   ctx.on('agent/turn-stop', (agent, turn) => {
     if (terminalTurns.get(agent) !== turn) return undefined
@@ -160,7 +163,7 @@ export function apply(ctx: Context, config: Config): void {
       },
       max_goal_rounds: {
         type: 'number',
-        description: 'Optional positive safe-integer cap; omission uses the goal-domain deployment default.',
+        description: 'Optional positive safe-integer limit on automatic continuation rounds.',
       },
     },
     execute(args, exec) {
@@ -170,7 +173,7 @@ export function apply(ctx: Context, config: Config): void {
         objective: args.objective,
         ...args.max_goal_rounds === undefined ? {} : { maxGoalRounds: args.max_goal_rounds },
       })
-      observeMutation(terminalTurns, execution, goal)
+      observeMutation(terminalTurns, execution, goal, false)
       return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
     },
     presentCall: args => present('Create goal', 'other', args.objective),
@@ -179,8 +182,8 @@ export function apply(ctx: Context, config: Config): void {
   ctx.tools.register(defineTool({
     name: 'update_goal',
     description: 'Update the exact current goal revision. edit, pause, and resume require a direct '
-      + 'top-level human turn. complete and blocked additionally accept the exact admitted goal '
-      + 'round. blocked is rejected before the configured minimum round count; the model remains '
+      + 'top-level human request. During an automatic continuation of the current goal, complete '
+      + 'and blocked are also allowed. blocked is rejected before the configured minimum round count; the model remains '
       + 'responsible for judging that the same condition persisted across those rounds.',
     parameters: {
       goal_id: { type: 'string', required: true, description: 'Exact id returned by get_goal.' },
@@ -204,27 +207,33 @@ export function apply(ctx: Context, config: Config): void {
       if (args.action === 'edit') {
         requireDirectHuman(ctx, execution)
         const goal = ctx.goals.edit(execution.agent, ref, replacements)
-        observeMutation(terminalTurns, execution, goal)
+        observeMutation(terminalTurns, execution, goal, false)
         return Promise.resolve([{
           type: 'text',
           text: renderGoal(goal),
         }])
       }
+      if (args.action === 'pause' || args.action === 'resume') {
+        requireDirectHuman(ctx, execution)
+        if (args.objective !== undefined || args.max_goal_rounds !== undefined) {
+          throw new HarnessError(
+            'objective and max_goal_rounds are valid only with action edit',
+            'GOAL_TOOL_INVALID_UPDATE',
+          )
+        }
+        const goal = args.action === 'pause'
+          ? ctx.goals.pause(execution.agent, ref)
+          : ctx.goals.resume(execution.agent, ref)
+        observeMutation(terminalTurns, execution, goal, false)
+        return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
+      }
+      const authority = completionAuthority(ctx, execution)
       if (args.objective !== undefined || args.max_goal_rounds !== undefined) {
         throw new HarnessError(
           'objective and max_goal_rounds are valid only with action edit',
           'GOAL_TOOL_INVALID_UPDATE',
         )
       }
-      if (args.action === 'pause' || args.action === 'resume') {
-        requireDirectHuman(ctx, execution)
-        const goal = args.action === 'pause'
-          ? ctx.goals.pause(execution.agent, ref)
-          : ctx.goals.resume(execution.agent, ref)
-        observeMutation(terminalTurns, execution, goal)
-        return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
-      }
-      const authority = completionAuthority(ctx, execution)
       if (args.action === 'blocked' && authority.kind === 'goal-round'
         && authority.goal.roundsStarted < resolved.blockedAfterConsecutiveRounds) {
         throw new HarnessError(
@@ -236,7 +245,7 @@ export function apply(ctx: Context, config: Config): void {
       const goal = args.action === 'complete'
         ? ctx.goals.complete(execution.agent, ref)
         : ctx.goals.block(execution.agent, ref)
-      observeMutation(terminalTurns, execution, goal)
+      observeMutation(terminalTurns, execution, goal, authority.kind === 'goal-round')
       return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
     },
     presentCall: args => present(

packages/goal/tool-goal/tests/tool-goal.e2e.ts

@@ -101,7 +101,7 @@ describe('goal tools through a real Loader, app, and stdio process', () => {
     expect(stdout).toContain('goal-tools e2e ready.')
     expect(stdout).toContain('GOAL CREATED')
     expect(stdout).toContain(PAUSED_RESULT)
-    expect(stdout).not.toContain('UNEXPECTED CONTINUATION AFTER PAUSE')
+    expect(stdout).toContain('GOAL PAUSED')
 
     const logs = await jsonlFiles(join(workdir as string, '.sessions'))
     expect(logs).toHaveLength(1)

packages/goal/tool-goal/tests/tool-goal.spec.ts

@@ -7,7 +7,7 @@ import GoalService, { GoalId } from '@deepseek-ai/dsh-goal'
 import type { GoalRef } from '@deepseek-ai/dsh-goal'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm'
-import { Session, SessionId } from '@deepseek-ai/dsh-session'
+import { SESSION_FORMAT_VERSION, Session, SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import type { ToolExecutionResult } from '@deepseek-ai/dsh-tools'
@@ -20,8 +20,8 @@ interface StubAgent {
 }
 
 /** Build one registry-compatible live agent whose injections append in place. */
-function stubAgent(rawId: string): StubAgent {
-  const session = new Session(SessionId(rawId))
+function stubAgent(rawId: string, supplied?: Session): StubAgent {
+  const session = supplied ?? new Session(SessionId(rawId))
   let status: AgentStatus = 'running'
   const agent: Agent = {
     id: session.id,
@@ -219,6 +219,42 @@ describe('goal tool execution authority', () => {
     expect(childResult.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
   })
 
+  it('rejects stale agent objects and agents outside running status through the executor', async () => {
+    const { ctx, root } = await harness()
+    openTurn(root, { kind: 'user' })
+    const stale = { ...root.agent }
+    const staleResult = await execute(ctx, 'get_goal', {}, stale, stale)
+    expect(staleResult.error?.code).toBe('GOAL_TOOL_DRIVER_REQUIRED')
+
+    root.setStatus('idle')
+    const idleResult = await execute(ctx, 'get_goal', {}, root.agent)
+    expect(idleResult.error?.code).toBe('GOAL_TOOL_DRIVER_REQUIRED')
+  })
+
+  it('treats a fork resumed as a runtime root as direct-human authority', async () => {
+    const { ctx, root } = await harness()
+    const originalTurn = openTurn(root, { kind: 'user' })
+    const created = ctx.goals.create(root.agent, { objective: 'resume the fork' })
+    closeTurn(root, originalTurn)
+    const forkId = SessionId('goal-tool-resumed-fork')
+    const forkSession = new Session(forkId, root.session.events, {
+      version: SESSION_FORMAT_VERSION,
+      id: forkId,
+      createdAt: Date.now(),
+      parentSession: root.session.id,
+      seedLength: root.session.seq,
+    })
+    const fork = stubAgent(forkId, forkSession)
+    ctx.agents.register(fork.agent)
+    expect(ctx.goals.get(fork.agent)).toMatchObject({ id: created.id, activation: 'disarmed' })
+
+    openTurn(fork, { kind: 'user' }, '继续这个目标')
+    const resumed = await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: created.revision, action: 'resume',
+    }, fork.agent)
+    expect(resultGoal(resumed)).toMatchObject({ id: created.id, revision: 2, phase: 'active' })
+  })
+
   it('rejects calls before a turn and after its end boundary', async () => {
     const { ctx, root } = await harness()
     const before = await execute(ctx, 'get_goal', {}, root.agent)
@@ -237,6 +273,10 @@ describe('goal tool execution authority', () => {
       goal_id: 'goal-missing', revision: 1, action: 'complete',
     }, root.agent)
     expect(result.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
+    const malformed = await execute(ctx, 'update_goal', {
+      goal_id: 'goal-missing', revision: 1, action: 'pause', objective: 'probe',
+    }, root.agent)
+    expect(malformed.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
   })
 
   it('accepts direct human steering in a goal-sourced root turn', async () => {
@@ -290,16 +330,29 @@ describe('goal tool state transitions', () => {
     expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toBeUndefined()
   })
 
-  it('stops the current turn after a successful stopped-state mutation', async () => {
+  it('terminal-stops an autonomous completion but leaves a human pause interactive', async () => {
     const { ctx, root } = await harness()
-    openTurn(root, { kind: 'user' })
+    const humanTurn = openTurn(root, { kind: 'user' })
     const created = ctx.goals.create(root.agent, { objective: 'pause cleanly' })
     const paused = await execute(ctx, 'update_goal', {
       goal_id: created.id, revision: created.revision, action: 'pause',
     }, root.agent)
     expect(resultGoal(paused)).toMatchObject({ phase: 'paused' })
-    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toEqual({ action: 'stop' })
-    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toBeUndefined()
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', humanTurn)).toBeUndefined()
+    const resumed = resultGoal(await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: 2, action: 'resume',
+    }, root.agent))
+    closeTurn(root, humanTurn)
+
+    const roundTurn = openTurn(root, {
+      kind: 'goal', goalId: created.id, revision: resumed['revision'] as number, round: 1,
+    })
+    const complete = await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: resumed['revision'], action: 'complete',
+    }, root.agent)
+    expect(resultGoal(complete)).toMatchObject({ phase: 'complete' })
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', roundTurn)).toEqual({ action: 'stop' })
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', roundTurn)).toBeUndefined()
   })
 
   it('rearms a restored active goal only after a new direct human prompt', async () => {