Merge remote-tracking branch 'origin/master' into feature/subagent-policy-inheritance

# Conflicts: # .agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml # docs/cordis-catalog/services.md # docs/persistence-catalog.md # examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl # packages/core/session/README.i18n.yaml # packages/subagent/subagent-inprocess/README.i18n.yaml # packages/ui/user-approval/src/index.ts
2026-07-28 11:19:46 +08:00
parent 63183b2f5d bbeaa9fb2e
commit bc3e776225
1141 changed files with 36230 additions and 16667 deletions
--- a/packages/core/session/README.i18n.yaml
+++ b/packages/core/session/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/core/session/README.md
-README.md: 9885cf77c7c3bdb7c863bc8734f75c206e2c9be7
-README.zh.md: d7eb9c7031cfee21052bbb72c30eb5466ce57738
+README.md: 56b5d550b46748bcebc94b33d952cd3937e604df
+README.zh.md: d0d2d858cdb69a361f5b7b0cc72a54618936a2c4
--- a/packages/core/session/README.md
+++ b/packages/core/session/README.md
@@ -64,9 +64,9 @@ Providers stream token-sized deltas, so a raw log stores hundreds of `assistant/

 ### Request-header reconstruction (`request-header.ts`)

-`request/header` records a full canonical snapshot of the non-history request envelope with reason `initial`, `resume`, or `change`. `foldRequestHeader()` selects the latest snapshot; legacy delta events and the removed `fallback` reason are rejected. `messagePrefix` remains separate from derived history. See the [reconstructable-requests Agent Note](../../../.agents/notes/implemented/architecture/2026-07-05-reconstructable-requests.md).
+`request/header` records a full canonical snapshot of the non-history request envelope with reason `initial`, `resume`, or `change`. `foldRequestHeader()` selects the latest snapshot; legacy delta events and the removed `fallback` reason are rejected. See the [reconstructable-requests Agent Note](../../../.agents/notes/implemented/architecture/2026-07-05-reconstructable-requests.md).

-A `user/message` renders its `content` verbatim as a user-role message whether it is a direct human prompt (`user` source), a synthetic injection (`plugin`/`goal` source), or an admitted goal round — `source` is the only channel that tells them apart. It may attach JSON `meta` for replayable plugin state; metadata remains durable but is excluded from `deriveMessages()`. A `user/message` or `steering/message` with prompt-prefix context keeps the exact combined model bytes in `content` and stores a model-hidden `envelope` containing the direct `displayContent` and prefix context source/metadata descriptors. `displayPromptContent()` selects the human-facing prompt without changing derived history.
+A `user/message` renders its `content` verbatim as a user-role message whether it is a direct human prompt, a synthetic injection, or an admitted goal round; its typed `source` is the only channel that tells them apart and carries any domain-specific durable facts. Turn execution remains enclosed by `turn/start` and `turn/end`, while an idle injection may append and flush a `user/message` between turns without running the model.

 `tool/result` persists the model-facing content, optional internal failure identity, and optional presentation metadata. A tool's successful canonical `value` and human-readable canonical failure message remain execution-local; rendered error content is the replay-authoritative message. This preserves the existing event shape and does not change `SESSION_FORMAT_VERSION`.

--- a/packages/core/session/README.zh.md
+++ b/packages/core/session/README.zh.md
@@ -64,9 +64,9 @@

 ### 请求头重建（`request-header.ts`）

-`request/header` 记录非历史请求封装的完整规范快照，其原因为 `initial`、`resume` 或 `change`。`foldRequestHeader()` 选择最新快照；旧版增量事件和已移除的 `fallback` 原因会被拒绝。`messagePrefix` 与派生历史保持分离。详见[可重建请求 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-05-reconstructable-requests.md)。
+`request/header` 记录非历史请求封装的完整规范快照，其原因为 `initial`、`resume` 或 `change`。`foldRequestHeader()` 选择最新快照；旧版增量事件和已移除的 `fallback` 原因会被拒绝。详见[可重建请求 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-05-reconstructable-requests.md)。

-`user/message` 会将其 `content` 原样呈现为 user-role 消息，无论它是直接人类提示词（来源为 `user`）、合成注入（来源为 `plugin`／`goal`），还是已准入的 Goal Round；`source` 是区分三者的唯一通道。它可以附带 JSON `meta`，用于可回放的插件状态；元数据保持持久，但不包含在 `deriveMessages()` 中。带提示词前缀上下文的 `user/message` 或 `steering/message` 会在 `content` 中保留送给模型的精确合并字节，并存储一个模型不可见的 `envelope`，其中包含直接展示用的 `displayContent` 和前缀上下文的来源／元数据描述符。`displayPromptContent()` 选择面向人的提示词，而不改变派生历史。
+`user/message` 会将其 `content` 原样呈现为 user-role 消息，无论它是直接人类提示词、合成注入，还是已准入的 Goal Round；带类型的 `source` 是区分三者的唯一通道，并携带各领域专有的持久事实。轮次执行仍由 `turn/start` 与 `turn/end` 包围，而空闲注入可以在轮次之间追加并刷新一条 `user/message`，无需运行模型。

 `tool/result` 持久保存面向模型的内容、可选内部失败标识和可选呈现元数据。工具成功时的规范 `value` 和便于人类阅读的规范失败消息只存在于执行本地；渲染后的错误内容是回放权威消息。这样会保留现有事件形态，且不改变 `SESSION_FORMAT_VERSION`。

--- a/packages/core/session/src/index.ts
+++ b/packages/core/session/src/index.ts
@@ -11,9 +11,9 @@ import { isAbsolute } from 'node:path'
 import { deepFreeze } from '@deepseek-ai/dsh-llm'
 import { scopeOf, scopeTarget } from '@deepseek-ai/dsh-scope'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
-import type { ContentBlock, Message } from '@deepseek-ai/dsh-llm'
+import type { Message } from '@deepseek-ai/dsh-llm'
 import { SESSION_FORMAT_VERSION, SessionId } from './types.ts'
-import type { CreateSessionOptions, EpochHeader, OutOfBandSessionEventType, PromptMessageData, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SurfaceIntent, SurfaceEventType, TurnTrigger } from './types.ts'
+import type { CreateSessionOptions, EpochHeader, OutOfBandSessionEventType, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SurfaceIntent, SurfaceEventType, TurnTrigger } from './types.ts'
 import { snapshotJsonValue } from './json.ts'
 import { SurfaceManager } from './surface.ts'
 import type { SessionSurface } from './surface.ts'
@@ -29,15 +29,6 @@ export type { SessionSurface, SurfaceFoldReplacement, SurfaceFoldResult } from '
 export { foldSurface, isSurfaceEvent, isSurfaceEligibleType } from './surface.ts'
 export { canonicalHeader, foldRequestHeader, headerEquals } from './request-header.ts'

-/**
- * Return the human-facing prompt blocks from a durable prompt message.
- * @param data - ordinary or steering prompt event data.
- * @returns the effective direct prompt, excluding baked prefix context.
- */
-export function displayPromptContent(data: PromptMessageData): ContentBlock[] {
-  return data.envelope?.displayContent ?? data.content
-}
-
 /**
 * Find the latest closed message-triggered turn, excluding injection and
 * plugin-owned zero-step turns.
@@ -313,6 +304,19 @@ export class Session {
    return this.header.id
  }

+  /**
+   * The first seq appended IN THIS PROCESS: the length of the constructor
+   * seed (0 without one). Events below it entered through construction —
+   * replay, fork, or resume — and were never published on the `session/event`
+   * firehose (constructor seeds do not emit), so consumers that replay the
+   * log as a publication substitute (telemetry adoption) start here. Distinct
+   * from `header.seedLength`, the DURABLE fork-lineage boundary: a resumed
+   * session's constructor seed is its full stored log, while its header keeps
+   * the original fork value — this field is the in-process construction fact
+   * and is deliberately not persisted.
+   */
+  readonly firstLiveSeq: number
+
  constructor(id: SessionId, seed?: readonly SessionEvent[], header?: SessionHeader) {
    if (seed) {
      // Validate the seed to the SAME invariants `append` enforces, so a
@@ -345,6 +349,7 @@ export class Session {
        this.log.push(deepFreeze(snapshot))
      }
    }
+    this.firstLiveSeq = this.log.length
    this.header = snapshotSessionHeader(id, header)
  }

@@ -549,9 +554,7 @@ export class Session {
    switch (event.type) {
      // Ordinary prompts, injected context, and mid-turn steering project
      // identically in user role: the event's model-facing content stays
-      // verbatim. A prompt envelope is model-hidden display metadata; its
-      // prefix bytes are already present in content. The message's `source`/`meta`
-      // and steering's `turn` are also log-only. Do NOT
+      // verbatim. The message's `source` and steering's `turn` are log-only. Do NOT
      // re-add per-type framing (e.g. `<context>`/`<steering>`) here: framing is
      // caller-owned — a producer bakes it into `content`, as workspace-context
      // does with `<system-reminder>` — or, if reintroduced, must be driven by
--- a/packages/core/session/src/invariant.ts
+++ b/packages/core/session/src/invariant.ts
@@ -66,8 +66,8 @@ function validateEvent(
  let nextStep = trace.nextStep
  let pendingCalls: SessionTraceTransition['pendingCalls'] = { kind: 'none' }

-  // SessionEventMap is merge-extensible, so the default enforces turn
-  // enclosure for package-added events as well as the built-in variants.
+  // Model input may be appended between turns without running the model.
+  // Merge-extensible package events remain turn-enclosed by default.
  switch (event.type) {
    case 'turn/start': {
      if (trace.openTurn !== null) {
@@ -141,6 +141,8 @@ function validateEvent(
      pendingCalls = { kind: 'delete', callId: event.data.callId }
      break
    }
+    case 'user/message':
+      break
    default: {
      if (trace.openTurn === null) {
        fail(`${event.type} appended outside any open turn (every event must be turn-enclosed)`)
--- a/packages/core/session/src/request-header.ts
+++ b/packages/core/session/src/request-header.ts
@@ -8,13 +8,13 @@
 */

 import { callConfigEquals } from '@deepseek-ai/dsh-llm'
-import type { Message, ToolSchema } from '@deepseek-ai/dsh-llm'
+import type { ToolSchema } from '@deepseek-ai/dsh-llm'
 import type { EpochHeader, SessionEvent } from './types.ts'

 /**
- * Normalize a header to canonical form: an empty system prompt, an empty tool
- * list, and an empty session prefix become absent fields, matching how requests
- * are built. Logging, folding, and comparison use this one representation.
+ * Normalize a header to canonical form: an empty system prompt and empty tool
+ * list become absent fields, matching how requests are built. Logging, folding,
+ * and comparison use this one representation.
 * @param header - the header to normalize (not mutated).
 * @returns the canonical header.
 */
@@ -23,7 +23,6 @@ export function canonicalHeader(header: EpochHeader): EpochHeader {
    config: header.config,
    ...header.system !== undefined && header.system.length > 0 ? { system: header.system } : {},
    ...header.tools !== undefined && header.tools.length > 0 ? { tools: header.tools } : {},
-    ...header.messagePrefix !== undefined && header.messagePrefix.length > 0 ? { messagePrefix: header.messagePrefix } : {},
  }
 }

@@ -32,21 +31,14 @@ function sameSchema(a: ToolSchema, b: ToolSchema): boolean {
  return JSON.stringify(a) === JSON.stringify(b)
 }

-/** Canonical JSON equality over session-prefix arrays; absence equals empty. */
-function sameMessages(a: readonly Message[] | undefined, b: readonly Message[] | undefined): boolean {
-  return JSON.stringify(a ?? []) === JSON.stringify(b ?? [])
-}
-
 /**
- * Field-wise equality over canonical headers. Tool schemas compare in order;
- * the session prefix compares as canonical JSON.
+ * Field-wise equality over canonical headers. Tool schemas compare in order.
 * @param a - one canonical header.
 * @param b - the other.
- * @returns whether config, system, tools, and session prefix all match.
+ * @returns whether config, system, and tools all match.
 */
 export function headerEquals(a: EpochHeader, b: EpochHeader): boolean {
  if (!callConfigEquals(a.config, b.config) || a.system !== b.system) return false
-  if (!sameMessages(a.messagePrefix, b.messagePrefix)) return false
  const at = a.tools ?? []
  const bt = b.tools ?? []
  return at.length === bt.length && at.every((tool, i) => sameSchema(tool, bt[i] as ToolSchema))
--- a/packages/core/session/src/types.ts
+++ b/packages/core/session/src/types.ts
@@ -1,5 +1,5 @@
 import type { Branded } from '@deepseek-ai/dsh-brand'
-import type { AssistantProvenance, CallId, ContentBlock, LlmCallConfig, LlmFailure, Message, MessageSource, StreamChunk, TokenUsage, ToolSchema } from '@deepseek-ai/dsh-llm'
+import type { AssistantProvenance, CallId, ContentBlock, LlmCallConfig, LlmFailure, MessageSource, StreamChunk, TokenUsage, ToolSchema } from '@deepseek-ai/dsh-llm'
 import type { JsonValue } from './json.ts'

 /** Identifies one session in the store (and its persistence artifacts). */
@@ -102,14 +102,12 @@ export interface CreateSessionOptions {
 */
 export interface TurnTriggerMap {
  message: { kind: 'message'; source: MessageSource }
+  /** Recovery turn reopened over the repaired current session log. */
+  retry: { kind: 'retry' }
  /**
-   * An out-of-band context injection (`agent.inject()`) made while the agent
-   * was idle. The loop wraps the injected `user/message` (a non-`user` source,
-   * plugin by default) in a one-shot turn (`turn/start` → `user/message` →
-   * `turn/end`) so every event in the log stays turn-enclosed — the
-   * durability/replay boundary is the turn, and a bare event between turns would
-   * otherwise be indistinguishable from a crash tail on reload. The trigger's
-   * `source` mirrors that message's producer.
+   * An out-of-band producer explicitly enclosed injected context in a one-shot
+   * turn. `Agent.inject()` appends idle context directly and does not use this
+   * trigger; the source mirrors the producer of the enclosed `user/message`.
   */
  injection: { kind: 'injection'; source: MessageSource }
 }
@@ -129,7 +127,8 @@ export interface TurnEndReasonMap {
   * step number the failure occurred on (the operational error's location — the
   * single durable record of an in-turn failure; live diagnostics also fire via
   * `agent/error`). Final model-request failures retain their normalized facts
-   * as one `failure`; other turn failures retain their live Error message/code.
+   * as one `failure`; other thrown values retain their rendered message and a
+   * real `HarnessError` code when present.
   */
  error: { kind: 'error'; step: number } & (
    | { failure: LlmFailure; message?: never; code?: never }
@@ -138,11 +137,6 @@ export interface TurnEndReasonMap {
  disposed: { kind: 'disposed' }
  /** At least one step reached its output-token ceiling, even if a plugin continued the turn. */
  'max-tokens': { kind: 'max-tokens' }
-  /**
-   * Policy blocked the turn's claimed prompt before the first step. The
-   * zero-step turn still records a balanced durable boundary and veto reason.
-   */
-  rejected: { kind: 'rejected'; reason: string }
  /**
   * A persistence backend closed a crash-orphaned turn on reload. The loop never
   * emits this marker, and the events recorded before the crash remain intact.
@@ -171,9 +165,9 @@ export interface TodoItem {
 }

 /**
- * Logged request state outside derived history: call config, system prompt,
- * tools, and prefix. The latest full `request/header` snapshot reconstructs it;
- * canonical empty optional fields are absent.
+ * Logged request state outside derived history: call config, system prompt, and
+ * tools. The latest full `request/header` snapshot reconstructs it; canonical
+ * empty optional fields are absent.
 */
 export interface EpochHeader {
  /** The conversation's call configuration (provider, model, reasoning effort, and sampling scalars). */
@@ -182,14 +176,6 @@ export interface EpochHeader {
  system?: string
  /** Assembled tool schemas; absent for a tool-less request. */
  tools?: ToolSchema[]
-  /**
-   * The session prefix: request-only messages sent BEFORE the entire derived
-   * history (the `agent/session-prefix` waterfall's product, composed once
-   * per loop instance and reused for every request it sends). Not session
-   * history — `deriveMessages()` never returns it — so the header is its
-   * only durable record; absent when the instance composed none.
-   */
-  messagePrefix?: Message[]
 }

 /**
@@ -200,50 +186,18 @@ export interface EpochHeader {
 */
 export type RequestHeaderReason = 'initial' | 'resume' | 'change'

-/** Durable model-hidden annotation for one context baked into a prompt message. */
-export interface PromptPrefixContext {
-  /** Producer provenance retained for transcript presentation and inspection. */
-  source: MessageSource
-  /** Opaque JSON state retained in the session event but hidden from the model. */
-  meta?: JsonValue
-}
-
 /**
- * Human-facing view of a prompt whose exact model content includes prefixed
- * context. `content` on the owning event remains the reconstructable model
- * input; this envelope prevents transcript, title, and re-reference consumers
- * from treating the baked context as direct human text.
- */
-export interface PromptMessageEnvelope {
-  /** Effective user prompt after interception rewrites, without baked context. */
-  displayContent: ContentBlock[]
-  /** Ordered descriptors for contexts already baked into the event content. */
-  prefixContexts: PromptPrefixContext[]
-}
-
-/**
- * Shared payload for user, injected-context, and steering prompt messages. A
+ * Shared payload for user, injected-context, and steering messages. A
 * direct human prompt, a synthetic `agent.inject()` context, and mid-turn
 * steering all project into the model transcript as verbatim user-role content;
 * they are told apart by `source` (a non-`user` kind marks injected context),
- * not by event type. `meta` carries durable model-hidden producer state.
+ * not by event type.
 */
-export interface PromptMessageData {
-  /** Exact model-facing blocks, including any baked prompt-prefix contexts. */
+export interface UserMessageData {
+  /** Exact model-facing blocks. */
  content: ContentBlock[]
-  /** Producer provenance for the direct prompt. */
+  /** Producer provenance. */
  source: MessageSource
-  /** Present only when prompt-prefix contexts were baked into `content`. */
-  envelope?: PromptMessageEnvelope
-  /**
-   * Opaque durable JSON state retained on the event but hidden from the model
-   * projection. It is the intended channel for a future framing directive (a
-   * producer declares the frame, a dedicated renderer applies it — see the
-   * deferred note in
-   * ../../../../.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md),
-   * so the surface keeps projecting `content` verbatim rather than wrapping it.
-   */
-  meta?: JsonValue
 }

 /**
@@ -254,10 +208,7 @@ export interface PromptMessageData {
 */
 export interface SessionEventMap {
  /**
-   * Opens turn `turn`. `trigger` records what started it — one claimed queued
-   * message or an idle-time injection. The turn is the durability/replay
-   * boundary: every event sits between a `turn/start` and its matching
-   * `turn/end` (the turn-enclosure invariant).
+   * Opens turn `turn`. `trigger` records what started the model loop.
   */
  'turn/start': { turn: number; trigger: TurnTrigger }
  /**
@@ -276,16 +227,10 @@ export interface SessionEventMap {
   * (the queued message claimed for this turn), a synthetic `agent.inject()`
   * context (file-change notices, subdir AGENTS.md, skill content, cron
   * notifications, …), or an admitted goal continuation round. All three
-   * project their `content` verbatim; `source` (with a non-`user` kind marking
-   * injected context) is the only channel that tells them apart. An idle
-   * injection wraps this event in a one-shot turn so the log stays turn-enclosed.
+   * project their `content` verbatim; `source` tells them apart. An idle
+   * injection may append this event between turns without running the model.
   */
-  'user/message': PromptMessageData
-  /**
-   * Durable record of a prompt veto and its reason. It is log-only: the blocked
-   * prompt never enters the model-visible surface, and its turn runs zero steps.
-   */
-  'prompt/blocked': { content: ContentBlock[]; source: MessageSource; reason: string }
+  'user/message': UserMessageData
  /** Raw stream chunk — token-level replay fidelity. */
  'assistant/chunk': { turn: number; step: number; chunk: StreamChunk }
  /**
@@ -322,7 +267,7 @@ export interface SessionEventMap {
    meta?: JsonValue
  }
  /** Steering content injected between steps of a running turn. */
-  'steering/message': PromptMessageData & { turn: number }
+  'steering/message': UserMessageData & { turn: number }
  /** Whole-list snapshot; latest write wins on replay. Log-only UI state; never derived history. */
  'todo/write': { todos: TodoItem[] }
  /**
--- a/packages/core/session/tests/invariant.spec.ts
+++ b/packages/core/session/tests/invariant.spec.ts
@@ -102,7 +102,7 @@ describe('session-log invariants', () => {
    } as never) }).toThrow(/seq must strictly increase/)
  })

-  it('enforces turn numbering and enclosure', async () => {
+  it('enforces turn numbering and encloses events other than idle context', async () => {
    const first = await setup()
    const open = first.ctx.sessions.create()
    open.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -119,9 +119,9 @@ describe('session-log invariants', () => {

    const outside = (await setup()).ctx.sessions.create()
    expect(() => outside.append('user/message', {
-      content: [{ type: 'text', text: 'hi' }],
-      source: { kind: 'user' },
-    }, { surfaceOp: 'append' })).toThrow(/outside any open turn/)
+      content: [{ type: 'text', text: 'idle context' }],
+      source: { kind: 'plugin', plugin: 'test' },
+    }, { surfaceOp: 'append' })).not.toThrow()
    expect(() => outside.append('steering/message', {
      turn: 1,
      content: [{ type: 'text', text: 'go' }],
--- a/packages/core/session/tests/request-header.spec.ts
+++ b/packages/core/session/tests/request-header.spec.ts
@@ -3,7 +3,7 @@
 import { describe, expect, it } from 'vitest'
 import { Session, SessionId, canonicalHeader, foldRequestHeader, headerEquals } from '@deepseek-ai/dsh-session'
 import type { EpochHeader, SessionEvent } from '@deepseek-ai/dsh-session'
-import type { Message, ToolSchema } from '@deepseek-ai/dsh-llm'
+import type { ToolSchema } from '@deepseek-ai/dsh-llm'
 import { ReasoningEffortId } from '@deepseek-ai/dsh-llm'

 const CONFIG = { provider: 'mock', model: 'm' }
@@ -12,20 +12,16 @@ function tool(name: string, description = 'd'): ToolSchema {
  return { name, description, parameters: { type: 'object' } }
 }

-function msg(text: string): Message {
-  return { role: 'user', content: [{ type: 'text', text }] }
-}
-
 describe('canonicalHeader', () => {
  it('normalizes empty optional fields to absence and preserves populated fields', () => {
-    expect(canonicalHeader({ config: CONFIG, system: '', tools: [], messagePrefix: [] })).toEqual({ config: CONFIG })
-    const full = canonicalHeader({ config: CONFIG, system: 's', tools: [tool('a')], messagePrefix: [msg('p')] })
-    expect(full).toEqual({ config: CONFIG, system: 's', tools: [tool('a')], messagePrefix: [msg('p')] })
+    expect(canonicalHeader({ config: CONFIG, system: '', tools: [] })).toEqual({ config: CONFIG })
+    const full = canonicalHeader({ config: CONFIG, system: 's', tools: [tool('a')] })
+    expect(full).toEqual({ config: CONFIG, system: 's', tools: [tool('a')] })
  })
 })

 describe('headerEquals', () => {
-  const base = canonicalHeader({ config: CONFIG, system: 's', tools: [tool('a')], messagePrefix: [msg('p')] })
+  const base = canonicalHeader({ config: CONFIG, system: 's', tools: [tool('a')] })

  it('compares every canonical field and preserves tool order', () => {
    expect(headerEquals(base, structuredClone(base))).toBe(true)
@@ -35,14 +31,13 @@ describe('headerEquals', () => {
      config: { ...base.config, reasoningEffort: ReasoningEffortId('high') },
    })).toBe(false)
    expect(headerEquals(base, { ...base, system: 'other' })).toBe(false)
-    expect(headerEquals(base, { ...base, messagePrefix: [msg('other')] })).toBe(false)
    expect(headerEquals(base, { ...base, tools: [] })).toBe(false)
    expect(headerEquals(base, { ...base, tools: [tool('a', 'changed')] })).toBe(false)
    expect(headerEquals({ config: CONFIG, tools: [tool('a'), tool('b')] }, { config: CONFIG, tools: [tool('b'), tool('a')] })).toBe(false)
  })

-  it('treats absent and empty prefix/tool arrays as equivalent canonical absence', () => {
-    expect(headerEquals({ config: CONFIG }, { config: CONFIG, tools: [], messagePrefix: [] })).toBe(true)
+  it('treats absent and empty tool arrays as equivalent canonical absence', () => {
+    expect(headerEquals({ config: CONFIG }, { config: CONFIG, tools: [] })).toBe(true)
  })
 })

--- a/packages/core/session/tests/session.spec.ts
+++ b/packages/core/session/tests/session.spec.ts
@@ -2,7 +2,6 @@ import { describe, expect, expectTypeOf, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import { CallId, ReasoningEffortId } from '@deepseek-ai/dsh-llm'
 import SessionStore, {
-  displayPromptContent,
  findLastMessageTurnEnd,
  SESSION_FORMAT_VERSION,
  Session,
@@ -118,11 +117,6 @@ describe('Session', () => {
  })

  it('renders injected-context and steering messages as plain user content', () => {
-    expect(displayPromptContent({
-      content: [{ type: 'text', text: 'plain prompt' }],
-      source: { kind: 'user' },
-    })).toEqual([{ type: 'text', text: 'plain prompt' }])
-
    const session = new Session(SessionId('s2'))
    session.append('user/message', {
      content: [{ type: 'text', text: 'file changed: a.ts' }],
@@ -141,46 +135,11 @@ describe('Session', () => {
    expect(steeringMessage!.content).toEqual([{ type: 'text', text: 'focus on tests' }])
  })

-  it('derives baked prompt context while exposing only the direct prompt for display', () => {
-    const session = new Session(SessionId('prompt-envelope'))
-    const event = session.append('user/message', {
-      content: [
-        { type: 'text', text: 'background' },
-        { type: 'text', text: '\n\n## My request:\n' },
-        { type: 'text', text: 'question' },
-      ],
-      source: { kind: 'user' },
-      envelope: {
-        displayContent: [{ type: 'text', text: 'question' }],
-        prefixContexts: [{ source: { kind: 'plugin', plugin: 'reference' }, meta: { kind: 'card' } }],
-      },
-    }, { surfaceOp: 'append' })
-
-    expect(session.deriveMessages()).toEqual([{
-      role: 'user',
-      content: [
-        { type: 'text', text: 'background' },
-        { type: 'text', text: '\n\n## My request:\n' },
-        { type: 'text', text: 'question' },
-      ],
-    }])
-    expect(displayPromptContent(event.data)).toEqual([{ type: 'text', text: 'question' }])
-    expect(Object.isFrozen(event.data.envelope?.displayContent)).toBe(true)
-    expect(new Session(SessionId('prompt-envelope-replay'), session.events).deriveMessages())
-      .toEqual(session.deriveMessages())
-  })
-
-  it('keeps context meta durable in the event while hiding it from the projection', () => {
+  it('keeps context source durable in the event while hiding it from the projection', () => {
    const session = new Session(SessionId('s2-raw'))
-    const meta = {
-      kind: 'workspace-instructions',
-      version: 1,
-      changes: [{ action: 'set', scope: 'pkg', path: 'pkg/AGENTS.md', digest: 'abc123' }],
-    }
    session.append('user/message', {
      content: [{ type: 'text', text: '<system-reminder>Additional instructions from: pkg/AGENTS.md</system-reminder>' }],
      source: { kind: 'plugin', plugin: 'workspace-context' },
-      meta,
    }, { surfaceOp: 'append' })

    expect(session.deriveMessages()).toEqual([{
@@ -188,7 +147,7 @@ describe('Session', () => {
      content: [{ type: 'text', text: '<system-reminder>Additional instructions from: pkg/AGENTS.md</system-reminder>' }],
    }])
    const event = session.events[0]
-    expect(event?.type === 'user/message' && event.data.meta).toEqual(meta)
+    expect(event?.type === 'user/message' && event.data.source).toEqual({ kind: 'plugin', plugin: 'workspace-context' })
  })

  it('replays identically from a seeded event log', () => {