fix: harden replay and pi-ai request boundaries

packages/core/agent-loop/src/loop.ts

@@ -6,7 +6,7 @@
  */
 
 import type { Context } from 'cordis'
-import type { FinishReason, GenerateOptions, LlmCallConfig, Message } from '@deepseek-ai/dsh-llm'
+import type { ContentBlock, FinishReason, GenerateOptions, LlmCallConfig, Message } from '@deepseek-ai/dsh-llm'
 import { isDeepStrictEqual } from 'node:util'
 import { BlockAssembler, HarnessError, deepFreeze } from '@deepseek-ai/dsh-llm'
 import { agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent'
@@ -529,20 +529,22 @@ async function runStep(
 
   if (assembler.finish.kind === 'max-tokens') {
     const assembled = assembler.message()
+    const assembledContent = structuredClone(assembled.content)
     let message: Message = withoutToolCalls(assembled)
     message = withoutToolCalls(await events.waterfall('agent/step-result', turn, step, message, () => Promise.resolve(message)))
     // Preserve usage even when max-token truncation produced no content.
-    recordAssistantMessage(session, turn, step, header.config, assembled, message, assembler, chunkSeqs)
+    recordAssistantMessage(session, turn, step, header.config, assembledContent, message, assembler, chunkSeqs)
     return { hadToolCalls: false, finish: assembler.finish }
   }
 
   // Record the post-waterfall message that tool dispatch uses.
   const assembled = assembler.message()
+  const assembledContent = structuredClone(assembled.content)
   let message: Message = assembled
   message = await events.waterfall('agent/step-result', turn, step, message, () => Promise.resolve(message))
 
   // Empty messages exist only to carry usage; the helper also omits empty chunk provenance.
-  recordAssistantMessage(session, turn, step, header.config, assembled, message, assembler, chunkSeqs)
+  recordAssistantMessage(session, turn, step, header.config, assembledContent, message, assembler, chunkSeqs)
 
   // Tool execution stays sequential; recheck abort around each normalized result.
   const toolCalls = message.content.filter(block => block.type === 'tool-call')
@@ -600,7 +602,7 @@ function recordAssistantMessage(
   turn: number,
   step: number,
   config: LlmCallConfig,
-  assembled: Message,
+  assembledContent: ContentBlock[],
   message: Message,
   assembler: BlockAssembler,
   chunkSeqs: number[],
@@ -615,7 +617,7 @@ function recordAssistantMessage(
       provenance: assistantProvenance(
         config,
         assembler.replayState,
-        isDeepStrictEqual(message.content, assembled.content),
+        isDeepStrictEqual(message.content, assembledContent),
       ),
       ...assembler.usage === undefined ? {} : { usage: assembler.usage },
     },

packages/core/agent-loop/tests/contract-regressions.spec.ts

@@ -110,6 +110,26 @@ describe('session log records what agent/step-result actually produced', () => {
       provider: 'mock', model: 'next-model', replayState,
     })
   })
+
+  it('drops adapter replay state when step-result mutates assembled content in place', async () => {
+    const response = textResponse('original')
+    response[response.length - 1] = { type: 'finish', reason: { kind: 'stop' }, replayState: { private: 'state' } }
+    const adapter = new MockAdapter([response])
+    const ctx = await harness(adapter)
+    ctx.on('agent/step-result', async (_agent, _turn, _step, message) => {
+      const block = message.content[0]
+      if (block?.type === 'text') block.text = 'mutated'
+      return message
+    })
+    const agent = ctx.agentLoop.create(AgentId('mutated-replay-state'), { provider: 'mock', model: 'next-model' })
+
+    send(agent, 'go')
+    await waitForIdle(ctx, agent)
+
+    const recorded = agent.session.events.find(event => event.type === 'assistant/message')
+    expect(recorded?.type === 'assistant/message' && recorded.data.content).toEqual([{ type: 'text', text: 'mutated' }])
+    expect(recorded?.type === 'assistant/message' && recorded.data.provenance.replayState).toBeUndefined()
+  })
 })
 
 describe('abort during tool execution ends the turn', () => {