Fix workspace context review findings

packages/core/agent-loop/README.md

@@ -59,7 +59,7 @@ forever:
   TURN (error-contained):
     'turn/start'
     each queued: waterfall agent/prompt-submit → allow (→ session('user/message'),
-      inject additionalContext) | block (→ session('prompt/blocked'), drop)
+      inject each additionalContexts entry) | block (→ session('prompt/blocked'), drop)
     if every prompt blocked: 'turn/end'(rejected), no step  ⟵ zero-step turn
     STEP loop:
       drain steering

packages/core/agent-loop/src/loop.ts

@@ -155,7 +155,7 @@ export interface LoopHandle {
  *   wait for queued messages (idle)
  *   TURN (error-contained — a throwing plugin ends the turn, never the loop):
  *     'turn/start'; each queued msg: waterfall agent/prompt-submit    ⟵ durable turn boundary (no agent/* mirror)
- *       allow → session('user/message'…) (+ inject additionalContext) | block → drop
+ *       allow → session('user/message'…) (+ inject additionalContexts) | block → drop
  *     every prompt blocked → 'turn/end'(rejected), 0 steps
  *     STEP loop:
  *       drain steering → session('steering/message')  ⟵ catches late steering
@@ -406,13 +406,14 @@ async function runTurn(
       // `allow.content` REPLACES the prompt bytes (a rewrite); absent keeps them.
       const content = decision.content ?? message.content
       session.append('user/message', { content, source: message.source }, { surfaceOp: 'append' })
-      // `allow.additionalContext` is a SEPARATE context/message the next request
-      // also sees. The turn is open, so inject() appends it into THIS turn.
-      if (decision.additionalContext) {
-        agent.inject(decision.additionalContext.content, {
-          source: decision.additionalContext.source,
-          ...decision.additionalContext.envelope !== undefined ? { envelope: decision.additionalContext.envelope } : {},
-          ...decision.additionalContext.meta !== undefined ? { meta: decision.additionalContext.meta } : {},
+      // Every `allow.additionalContexts` entry is a separate context/message the
+      // next request also sees. The turn is open, so inject() appends each one
+      // into THIS turn without flattening provenance, framing, or metadata.
+      for (const context of decision.additionalContexts ?? []) {
+        agent.inject(context.content, {
+          source: context.source,
+          ...context.envelope !== undefined ? { envelope: context.envelope } : {},
+          ...context.meta !== undefined ? { meta: context.meta } : {},
         })
       }
     }

packages/core/agent-loop/tests/interception.spec.ts

@@ -17,7 +17,7 @@ import { MockAdapter, textResponse, toolCallResponse } from './mock-adapter.ts'
  * The interception seams introduced by the hooks taxonomy: `agent/prompt-submit`,
  * `agent/session-start`, the reshaped `agent/turn-continuation`
  * ({@link ContinuationDecision}), and the `tools/pre-execute` / `tools/post-execute`
- * split with `additionalContext` buffering. These verify the canonical event
+ * split with `additionalContexts` buffering. These verify the canonical event
  * surface a hook bridge (or a native plugin) programs against, WITHOUT any
  * external protocol — a native plugin uses the typed decisions directly.
  */
@@ -91,7 +91,7 @@ describe('agent/prompt-submit', () => {
     expect(JSON.stringify(adapter.requests[0]!.messages)).not.toContain('original')
   })
 
-  it('allow with additionalContext injects a separate context/message into the turn', async () => {
+  it('allow with additionalContexts injects separate context/message events into the turn', async () => {
     const adapter = new MockAdapter([textResponse('ok')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
@@ -100,12 +100,12 @@ describe('agent/prompt-submit', () => {
     ctx.on('agent/prompt-submit', async (): Promise<PromptDecision> =>
       ({
         kind: 'allow',
-        additionalContext: {
+        additionalContexts: [{
           content: [{ type: 'text', text: '<system-reminder>extra ctx</system-reminder>' }],
           source: { kind: 'plugin', plugin: 'test' },
           envelope: 'raw',
           meta,
-        },
+        }],
       }))
 
     send(agent, 'go')
@@ -124,7 +124,7 @@ describe('agent/prompt-submit', () => {
     expect(sent).toContain('extra ctx')
   })
 
-  it('a prompt-submit rewrite + additionalContext is VISIBLE to the agent/pre-step seam (merged ordering)', async () => {
+  it('a prompt-submit rewrite + additionalContexts is VISIBLE to the agent/pre-step seam (merged ordering)', async () => {
     // The merge of the interception seams with master's compaction seam pins one
     // ordering: `agent/prompt-submit` runs (rewriting the prompt and injecting
     // context) BEFORE the step loop, and `agent/pre-step` fires INSIDE the step
@@ -141,7 +141,7 @@ describe('agent/prompt-submit', () => {
       ({
         kind: 'allow',
         content: [{ type: 'text', text: 'REWRITTEN prompt' }],
-        additionalContext: { content: [{ type: 'text', text: 'injected ctx' }], source: { kind: 'plugin', plugin: 'test' } },
+        additionalContexts: [{ content: [{ type: 'text', text: 'injected ctx' }], source: { kind: 'plugin', plugin: 'test' } }],
       }))
 
     // The pre-step seam (where compaction lives) derives the surface it would act

packages/core/agent/README.md

@@ -33,6 +33,8 @@ The lifecycle edges have two important local caveats. `agent/created` runs after
 
 Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the terminal serial fold: it runs after ordinary continuation and steering folding, and a returned stop remains in force through turn close and flush so later steering cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in the [agent-scope runtime-design RFC](../../../docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md#three-execution-boundaries-are-deliberately-one-way).
 
+`PromptDecision.additionalContexts` is an array so every injected context keeps its own source, envelope, and metadata. A `ContinuationDecision` reason is narrower: it becomes a `steering/message`, not a `context/message`, and therefore carries only content and source.
+
 Turn and step boundaries and the model token stream are durable `session/event` facts rather than mirrored `agent/*` notifications. Consumers read `turn/*`, `step/*`, and `assistant/chunk` from the session feed; tool policy and outcome observation belong to the complete pipeline documented by [`dsh-tools`](../tools/README.md).
 
 ### Agent interface (`types.ts`)

packages/core/agent/src/types.ts

@@ -121,8 +121,8 @@ export type AgentStatus = 'idle' | 'running' | 'disposed'
 /**
  * Model-facing context an interception listener wants the agent to SEE on the
  * next request — the canonical shape behind every "inject extra context"
- * decision ({@link PromptDecision}, {@link PostToolDecision},
- * {@link ContinuationDecision}). It is `agent.inject()`ed as a
+ * decision ({@link PromptDecision}, {@link PostToolDecision}). It is
+ * `agent.inject()`ed as a
  * `context/message`, so it carries a REQUIRED {@link MessageSource}: `inject()`
  * defaults a missing source to `{kind:'user'}`, which would MISLABEL plugin
  * context as a user prompt and corrupt derived history. A bridge sets
@@ -144,8 +144,8 @@ export interface HookContext {
  * the Claude Code `UserPromptSubmit` hook's allow/block + `additionalContext`.
  *
  * - `allow` proceeds with the prompt; optional `content` REPLACES the prompt
- *   bytes (a rewrite), and optional `additionalContext` is `inject()`ed as a
- *   separate `context/message` the next request also sees.
+ *   bytes (a rewrite), and optional `additionalContexts` are each `inject()`ed
+ *   as separate `context/message` events the next request also sees.
  * - `block` drops the prompt (it never becomes a `user/message`); `reason` is
  *   the durable record of why. The loop appends a `prompt/blocked` session event
  *   (carrying the original content, source, and `reason`) in place of the
@@ -156,7 +156,7 @@ export interface HookContext {
  *   hook").
  */
 export type PromptDecision =
-  | { kind: 'allow'; content?: ContentBlock[]; additionalContext?: HookContext }
+  | { kind: 'allow'; content?: ContentBlock[]; additionalContexts?: HookContext[] }
   | { kind: 'block'; reason: string }
 
 /**
@@ -165,14 +165,16 @@ export type PromptDecision =
  * calls or steering was injected, else `stop`); listeners override it to
  * force-continue (`/goal`, `/loop`) or force-stop (budget guards).
  *
- * A `continue` may carry a `reason`: model-facing context recorded as next-STEP
+ * A `continue` may carry a `reason`: model-facing content recorded as next-STEP
  * steering within the SAME turn (the loop enqueues it through the steering
- * channel, so the continued turn's next step sees it). This is the typed twin of
- * the existing "steer from a step/end listener" `/goal` pattern.
+ * channel, so the continued turn's next step sees it). Steering is not a
+ * `context/message`, so raw context envelopes and durable context metadata are
+ * deliberately absent. This is the typed twin of the existing "steer from a
+ * step/end listener" `/goal` pattern.
  */
 export type ContinuationDecision =
   | { action: 'stop' }
-  | { action: 'continue'; reason?: HookContext }
+  | { action: 'continue'; reason?: { content: ContentBlock[]; source: MessageSource } }
 
 /**
  * The terminal subset of {@link ContinuationDecision}. A listener on
@@ -453,7 +455,7 @@ declare module 'cordis' {
     /**
      * Waterfall: decide what happens to ONE drained queued message before it
      * becomes a `user/message` — allow (optionally rewriting the prompt bytes or
-     * attaching `additionalContext`) or block it. Fires inside the already-open
+     * attaching `additionalContexts`) or block it. Fires inside the already-open
      * turn, per drained message. Maps onto Claude Code's `UserPromptSubmit` hook.
      * Call `next()` to delegate to the default (allow unchanged), or return a
      * {@link PromptDecision} without calling `next()` to short-circuit.
@@ -475,7 +477,7 @@ declare module 'cordis' {
      * ALL a listener shapes here: every request is a pure function of the
      * session log (the reconstructability RFC), so model-visible content
      * flows through the log channels — `inject()`, steering, prompt-submit
-     * `additionalContext`, prompt sections via `system-prompt/assemble`, or
+     * `additionalContexts`, prompt sections via `system-prompt/assemble`, or
      * the header-logged session prefix via {@link agent/session-prefix}
      * — never through request mutation, and the loop records whatever config
      * the request actually uses as a `request/header*` event before dispatch.
@@ -525,7 +527,7 @@ declare module 'cordis' {
      * record, so the request stays reconstructable from the log. Content
      * that CHANGES mid-session belongs in the append-only history channels
      * instead — `agent.inject()`, a `tools/post-execute` decision's
-     * `additionalContext`, prompt-submit `additionalContext` — each a
+     * `additionalContexts`, prompt-submit `additionalContexts` — each a
      * durable `context/message` paid once and prefix-cached thereafter.
      *
      * The seed is a frozen empty list; a contributing listener returns a NEW