@@ -64,6 +64,48 @@ export namespace LLM {
     ])
     const isCodex = provider.id === "openai" && auth?.type === "oauth"
 
+    // altimate_change start — for non-Anthropic models, hoist `<system-reminder>`-wrapped
+    // synthetic text parts out of user messages and into the system array.
+    //
+    // Plan mode (and a few other paths) attaches PROMPT_PLAN as a text part on the latest
+    // user message, wrapped in `<system-reminder>...</system-reminder>` tags — an Anthropic-
+    // Claude convention that Claude is trained to recognize as legitimate system-level
+    // instructions even when it arrives in a user-role message. OpenAI / Google / etc. are
+    // NOT trained on that convention. When GPT-5.x via the altimate gateway sees a user
+    // message that contains a `<system-reminder>` block with aggressive constraint language
+    // (STRICTLY FORBIDDEN, ZERO exceptions, MUST, ABSOLUTE CONSTRAINT), it pattern-matches
+    // it as a prompt-injection attempt and emits a content-policy refusal ("I'm sorry, but
+    // I cannot assist with that request.") — reliably, even on benign requests like
+    // "add a button". GH #887 / AI-6957. Hoisting these parts into actual system-role
+    // messages routes around the misinterpretation.
+    const isAnthropicLike =
+      input.model.providerID === "anthropic" ||
+      input.model.providerID === "google-vertex-anthropic" ||
+      input.model.family === "anthropic" ||
+      input.model.api.npm === "@ai-sdk/anthropic" ||
+      input.model.api.id.includes("anthropic") ||
+      input.model.api.id.includes("claude")
+    const hoistedReminders: string[] = []
+    if (!isAnthropicLike) {
+      input.messages = input.messages.map((m) => {
+        if (m.role !== "user" || !Array.isArray(m.content)) return m
+        const kept: typeof m.content = []
+        for (const part of m.content) {
+          if (part.type === "text" && typeof part.text === "string" && part.text.trimStart().startsWith("<system-reminder>")) {
+            hoistedReminders.push(part.text)
+          } else {
+            kept.push(part)
+          }
+        }
+        return { ...m, content: kept }
+      })
+      // Drop user messages that became empty (had only system-reminder parts).
+      input.messages = input.messages.filter(
+        (m) => !(m.role === "user" && Array.isArray(m.content) && m.content.length === 0),
+      )
+    }
+    // altimate_change end
+
     const system = []
     system.push(
       [
@@ -72,6 +114,10 @@ export namespace LLM {
         ...(input.agent.prompt ? [input.agent.prompt] : isCodex ? [] : SystemPrompt.provider(input.model)),
         // any custom prompt passed into this call
         ...input.system,
+        // altimate_change start — hoisted reminders appended after the base provider
+        // prompt so the model sees them as authoritative session-level instructions.
+        ...hoistedReminders,
+        // altimate_change end
         // any custom prompt from last user message
         ...(input.user.system ? [input.user.system] : []),
       ]
 
@@ -348,10 +348,27 @@ export namespace SessionProcessor {
                   // Users read the text, see no progress, and abandon. Surface a
                   // warning + telemetry so the pattern is measurable and the user
                   // knows to try a different model.
+                  //
+                  // sessionToolCallsMade tracks tool calls in the CURRENT step only
+                  // — SessionProcessor.create() is called per-step by loop() (see
+                  // prompt.ts), so the closure variable resets each step. A multi-
+                  // step plan-mode session (read → grep → read → … → final text)
+                  // would then false-positive on the final text-only step. Also
+                  // scan streamInput.messages for any prior assistant tool-call
+                  // content; if found, the session has used tools and the warning
+                  // should be suppressed.
+                  const sessionHasPriorToolCalls =
+                    sessionToolCallsMade > 0 ||
+                    streamInput.messages.some(
+                      (m) =>
+                        m.role === "assistant" &&
+                        Array.isArray(m.content) &&
+                        m.content.some((p) => p.type === "tool-call"),
+                    )
                   if (
                     input.assistantMessage.agent === "plan" &&
                     value.finishReason === "stop" &&
-                    sessionToolCallsMade === 0 &&
+                    !sessionHasPriorToolCalls &&
                     !planNoToolWarningEmitted
                   ) {
                     planNoToolWarningEmitted = true
 
@@ -474,11 +474,19 @@ describe("plan-agent no-tool-generation detection", () => {
     modelID: string
     providerID: string
     tokensOutput: number
+    /**
+     * Whether the conversation history (streamInput.messages) contains any prior
+     * assistant tool-call content. Mirrors the source check at processor.ts that
+     * compensates for `sessionToolCallsMade` being per-step (SessionProcessor.create
+     * is called per-step by loop()).
+     */
+    priorToolCallsInHistory?: boolean
   }): { event: Telemetry.Event | null; warningEmitted: boolean } {
+    const sessionHasPriorToolCalls = opts.sessionToolCallsMade > 0 || opts.priorToolCallsInHistory === true
     if (
       opts.agent === "plan" &&
       opts.finishReason === "stop" &&
-      opts.sessionToolCallsMade === 0 &&
+      !sessionHasPriorToolCalls &&
       !opts.planNoToolWarningEmitted
     ) {
       return {
@@ -535,6 +543,24 @@ describe("plan-agent no-tool-generation detection", () => {
     expect(result.warningEmitted).toBe(false)
   })
 
+  // Regression guard: SessionProcessor.create() is called per-step by loop(),
+  // so sessionToolCallsMade is per-step in practice (not session-wide as the
+  // 2026-06-04 comment claimed). A multi-step plan-mode session that runs many
+  // tools and then produces a final text-only step would false-positive without
+  // also consulting the conversation history. See processor.ts comment block.
+  test("does not fire on final text-only step when prior steps used tools", () => {
+    const result = simulateFinishStep({
+      ...baseOpts,
+      agent: "plan",
+      finishReason: "stop",
+      sessionToolCallsMade: 0, // resets each step — final text-only step is 0
+      priorToolCallsInHistory: true, // earlier steps populated tool-call parts
+      planNoToolWarningEmitted: false,
+    })
+    expect(result.event).toBeNull()
+    expect(result.warningEmitted).toBe(false)
+  })
+
   test("does not fire when finish_reason is tool-calls", () => {
     const result = simulateFinishStep({
       ...baseOpts,