@code-yeongyu/senpi 2026.10.10-2 → 2026.10.10-4

package/dist/modes/interactive/session-control-session-commands.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The terminal control endpoint's session controls: a model switch, a thinking level and an interrupt.
+ * Each one runs the pane's own path (`/model`, the thinking-level selector, Esc) through the surface,
+ * so validation, the footer and persistence are the ones the user gets typing it there.
+ */
+import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
+import type { Model } from "@earendil-works/pi-ai";
+import type { AgentSession } from "../../core/agent-session.ts";
+import { type ControlCommand } from "./session-control-server.ts";
+export interface TuiSessionControls {
+    /** The `/model` path: switches, updates the footer and records the default; throws a refusal. */
+    selectModel(model: Model<string>): Promise<{
+        readonly systemPromptName?: string;
+    } | undefined>;
+    /** The thinking-level selector: `remember` is its Ctrl+S (the model's remembered level). */
+    selectThinkingLevel(level: ThinkingLevel, remember: boolean): void;
+    /** Esc on a running turn: queued input returns to the editor, the turn aborts and settles. */
+    interruptTurn(): Promise<void>;
+}
+export declare const SESSION_CONTROL_COMMANDS: readonly ["get_available_models", "get_available_thinking_levels", "set_model", "set_thinking_level", "interrupt"];
+export declare function runSessionControlCommand(session: AgentSession, controls: TuiSessionControls, command: ControlCommand): Promise<object | undefined>;
+//# sourceMappingURL=session-control-session-commands.d.ts.map

package/dist/modes/interactive/session-control-session-commands.js

@@ -0,0 +1,47 @@
+import { availableModelsData, interruptRunningTurn, unsupportedThinkingLevel, } from "../rpc/session-control-actions-data.js";
+import { failure, success } from "./session-control-server.js";
+export const SESSION_CONTROL_COMMANDS = [
+    "get_available_models",
+    "get_available_thinking_levels",
+    "set_model",
+    "set_thinking_level",
+    "interrupt",
+];
+export async function runSessionControlCommand(session, controls, command) {
+    const { id, type } = command;
+    switch (type) {
+        case "get_available_models":
+            return success(id, type, await availableModelsData(session));
+        case "get_available_thinking_levels":
+            return success(id, type, { levels: session.getAvailableThinkingLevels() });
+        case "set_model":
+            return await setModel(session, controls, command);
+        case "set_thinking_level": {
+            const level = session.getAvailableThinkingLevels().find((candidate) => candidate === command.level);
+            if (level === undefined)
+                return failure(id, type, unsupportedThinkingLevel(command.level));
+            controls.selectThinkingLevel(level, command.scope !== "turn");
+            return success(id, type);
+        }
+        case "interrupt":
+            return success(id, type, await interruptRunningTurn(session, command.turnId, () => controls.interruptTurn()));
+        default:
+            return undefined;
+    }
+}
+async function setModel(session, controls, command) {
+    const { id, type } = command;
+    const models = await session.modelRegistry.getAvailable();
+    const model = models.find((candidate) => candidate.provider === command.provider && candidate.id === command.modelId);
+    if (model === undefined) {
+        return failure(id, type, `Model not found: ${String(command.provider)}/${String(command.modelId)}`);
+    }
+    try {
+        const change = await controls.selectModel(model);
+        return success(id, type, { ...model, systemPromptName: change?.systemPromptName });
+    }
+    catch (error) {
+        return failure(id, type, error instanceof Error ? error.message : String(error));
+    }
+}
+//# sourceMappingURL=session-control-session-commands.js.map

package/dist/modes/interactive/stdout-fd-redirect.d.ts

@@ -0,0 +1,12 @@
+import type { StderrFdSyscalls } from "./stderr-fd-redirect.ts";
+type StdoutLike = NodeJS.WriteStream;
+export interface StdoutFdRedirect {
+    restore(): void;
+}
+/**
+ * Point fd 1 at `logPath` (append, 0600) and re-point `stdout` at a duplicate of the terminal.
+ * Returns `undefined`, leaving fd 1 and `stdout` untouched, when any step fails.
+ */
+export declare function redirectStdoutFd(syscalls: StderrFdSyscalls, logPath: string, stdout?: StdoutLike): StdoutFdRedirect | undefined;
+export {};
+//# sourceMappingURL=stdout-fd-redirect.d.ts.map

package/dist/modes/interactive/stdout-fd-redirect.js

@@ -0,0 +1,114 @@
+/**
+ * File-descriptor-level stdout capture for the interactive TUI (#2815).
+ *
+ * The TUI draws on fd 1. Anything else that writes fd 1 directly while the TUI owns the screen (a
+ * `writeSync(1, ...)`, a child spawned with `stdio: "inherit"`, Bun's native `console.log`, a Worker's
+ * console) scrolls the real terminal behind the renderer's back. The renderer's cursor math then goes
+ * stale and the editor is pushed below the visible screen. Mirroring the fd 2 capture
+ * (`stderr-fd-redirect.ts`, #2284): while the TUI owns the screen, fd 1 is pointed at the debug log
+ * with `dup2`, and `process.stdout` (the renderer's only writer) is re-pointed at a duplicate of the
+ * terminal descriptor, so its writes, size and resize events keep coming from the terminal itself.
+ * The original fd 1 is put back before the terminal is released.
+ *
+ * Only the interactive TUI installs this. Print, JSON and RPC modes use stdout as their protocol and
+ * never call it. Windows has no `dup`/`dup2` here (`loadStderrFdSyscalls` returns undefined), so
+ * the JS-level guard stays the only protection there.
+ */
+import { closeSync, createWriteStream, openSync } from "node:fs";
+import { isatty, WriteStream as TtyWriteStream } from "node:tty";
+const STDOUT_FD = 1;
+// One duplicate of the terminal per process: every takeover after a suspend or an external editor
+// reuses it, so a long session does not accumulate descriptors.
+let terminal;
+// Our `write` wrappers, and the `write` that was in place before the first of them. A release can leave
+// an inactive wrapper installed (the renderer's own guard is removed after it); the next takeover wraps
+// the base write instead, so suspend/resume cycles never stack wrappers.
+const ownWrites = new WeakSet();
+let baseWrite;
+function terminalHandle(syscalls) {
+    if (terminal)
+        return terminal;
+    const fd = syscalls.dup(STDOUT_FD);
+    if (fd < 0)
+        return undefined;
+    const stream = isatty(fd) ? new TtyWriteStream(fd) : createWriteStream("", { fd, autoClose: false });
+    terminal = { fd, stream };
+    return terminal;
+}
+/**
+ * Point fd 1 at `logPath` (append, 0600) and re-point `stdout` at a duplicate of the terminal.
+ * Returns `undefined`, leaving fd 1 and `stdout` untouched, when any step fails.
+ */
+export function redirectStdoutFd(syscalls, logPath, stdout = process.stdout) {
+    const handle = terminalHandle(syscalls);
+    if (!handle)
+        return undefined;
+    let target;
+    try {
+        target = openSync(logPath, "a", 0o600);
+    }
+    catch {
+        return undefined;
+    }
+    const moved = syscalls.dup2(target, STDOUT_FD);
+    closeSync(target);
+    if (moved < 0)
+        return undefined;
+    try {
+        return installTerminalWriter(syscalls, handle, stdout);
+    }
+    catch {
+        // Never leave fd 1 pointed at the log without a way back.
+        syscalls.dup2(handle.fd, STDOUT_FD);
+        return undefined;
+    }
+}
+function installTerminalWriter(syscalls, handle, stdout) {
+    let active = true;
+    if (!ownWrites.has(stdout.write))
+        baseWrite = stdout.write;
+    const originalWrite = baseWrite ?? stdout.write;
+    const write = function (...args) {
+        if (!active)
+            return originalWrite.apply(stdout, args);
+        return handle.stream.write.apply(handle.stream, args);
+    };
+    ownWrites.add(write);
+    stdout.write = write;
+    // fd 1 is a file now, so the stream's own size reads would come back empty: read the terminal's.
+    const sizeProperties = ["columns", "rows"];
+    const ownDescriptors = new Map(sizeProperties.map((name) => [name, Object.getOwnPropertyDescriptor(stdout, name)]));
+    for (const name of sizeProperties) {
+        Object.defineProperty(stdout, name, {
+            configurable: true,
+            enumerable: true,
+            get: () => handle.stream[name],
+        });
+    }
+    const onWindowChange = () => {
+        handle.stream._refreshSize?.();
+        stdout.emit("resize");
+    };
+    process.on("SIGWINCH", onWindowChange);
+    return {
+        restore() {
+            if (!active)
+                return;
+            active = false;
+            process.removeListener("SIGWINCH", onWindowChange);
+            syscalls.dup2(handle.fd, STDOUT_FD);
+            // A wrapper installed on top of ours (the renderer's own guard) keeps calling `write`, which
+            // now forwards to the original stdout on the restored fd 1.
+            if (stdout.write === write)
+                stdout.write = originalWrite;
+            for (const name of sizeProperties) {
+                const descriptor = ownDescriptors.get(name);
+                if (descriptor)
+                    Object.defineProperty(stdout, name, descriptor);
+                else
+                    delete stdout[name];
+            }
+        },
+    };
+}
+//# sourceMappingURL=stdout-fd-redirect.js.map

package/dist/modes/rpc/connection-handler.js

@@ -16,7 +16,6 @@
  */
 import * as crypto from "node:crypto";
 import { basename, dirname, extname } from "node:path";
-import { modelSupportsAssistantPrefill } from "@earendil-works/pi-ai";
 import { VERSION } from "../../config.js";
 import { authMethodStatus, buildLoginProviderInfos } from "../../core/auth-providers.js";
 import { ContinueFromLeafError } from "../../core/continue-from-leaf.js";
@@ -27,7 +26,6 @@ import { emitProviderAccountsChanged, subscribeProviderAccountEvents, } from "..
 import { ANTHROPIC_SUBSCRIPTION_PROVIDER_ID } from "../../core/extensions/builtin/anthropic-subscription/account-management.js";
 import { isMcpControlInventoryChanged, MCP_CONTROL_INVENTORY_CHANGED_EVENT, MCP_CONTROL_INVENTORY_REQUEST_EVENT, } from "../../core/extensions/builtin/mcp/control-inventory.js";
 import { applyFastMode, resolveServiceTierMemoryModel, } from "../../core/extensions/builtin/service-tier.js";
-import { getSupportedThinkingLevels } from "../../core/thinking-levels.js";
 import { theme } from "../interactive/theme/theme.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
 import { ClientAdmissions } from "./client-admissions.js";
@@ -45,6 +43,7 @@ import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListD
 import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
 import { RPC_ERROR_MEDIA_NOT_FOUND } from "./rpc-types.js";
+import { availableModelsData, interruptRunningTurn, unsupportedThinkingLevel } from "./session-control-actions-data.js";
 import { SessionExtensionUiRequests } from "./session-extension-ui-requests.js";
 export { buildRpcSessionState } from "./rpc-session-state.js";
 /** The tool call a dialog is about, as wire fields (absent when the dialog is not a permission request). */
@@ -809,6 +808,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 });
                 return success(id, "abort");
             }
+            case "interrupt":
+                return success(id, "interrupt", await interruptRunningTurn(session, command.turnId, () => session.abort()));
             case "abort_compaction": {
                 session.abortCompaction();
                 return success(id, "abort_compaction");
@@ -891,18 +892,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 }
                 return success(id, "cycle_model", result);
             }
-            case "get_available_models": {
-                const models = await session.modelRegistry.modelRuntime.getAvailable();
-                return success(id, "get_available_models", {
-                    models: models.map((model) => ({
-                        ...model,
-                        supportedThinkingLevels: getSupportedThinkingLevels(model),
-                        supportsAssistantPrefill: modelSupportsAssistantPrefill(model, {
-                            thinkingEnabled: session.thinkingLevel !== "off",
-                        }),
-                    })),
-                });
-            }
+            case "get_available_models":
+                return success(id, "get_available_models", await availableModelsData(session));
             // =================================================================
             // Thinking
             // =================================================================
@@ -912,7 +903,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                     // neighbour, so applying first would leave a REJECTED request's clamped level in
                     // place. A failed command must not change session state.
                     if (!session.getAvailableThinkingLevels().includes(command.level)) {
-                        return error(id, "set_thinking_level", `Thinking level ${command.level} is not supported by the active model.`);
+                        return error(id, "set_thinking_level", unsupportedThinkingLevel(command.level));
                     }
                     session.setSessionThinkingLevel(command.level);
                 }

package/dist/modes/rpc/rpc-types.d.ts

@@ -73,6 +73,10 @@ type RpcSessionCommand = {
 } & ClientMessageIdentity) | {
     id?: string;
     type: "abort";
+} | {
+    id?: string;
+    type: "interrupt";
+    turnId?: string;
 } | {
     id?: string;
     type: "abort_compaction";
@@ -832,6 +836,15 @@ export type RpcResponse = {
     type: "response";
     command: "abort";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "interrupt";
+    success: true;
+    data: {
+        interrupted: boolean;
+        turnId?: string;
+    };
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/session-control-actions-data.d.ts

@@ -0,0 +1,17 @@
+import type { AgentSession } from "../../core/agent-session.ts";
+export declare function availableModelsData(session: AgentSession): Promise<{
+    models: readonly object[];
+}>;
+/** The refusal of a level the active model cannot run; callers match this text. */
+export declare function unsupportedThinkingLevel(level: unknown): string;
+export interface InterruptOutcome {
+    readonly interrupted: boolean;
+    readonly turnId?: string;
+}
+/**
+ * `interrupt { turnId? }`: stops the running turn and only that. An idle session answers
+ * `interrupted: false`; so does a `turnId` naming a turn that is no longer the running one, which
+ * then answers the running turn's id. `stop` resolves once the turn has stopped.
+ */
+export declare function interruptRunningTurn(session: AgentSession, requestedTurnId: unknown, stop: () => Promise<void>): Promise<InterruptOutcome>;
+//# sourceMappingURL=session-control-actions-data.d.ts.map

package/dist/modes/rpc/session-control-actions-data.js

@@ -0,0 +1,38 @@
+/**
+ * The session-control answers a multi-session host and a terminal control endpoint share, so a caller
+ * reads the same shapes from either: the model catalog, the thinking-level refusal, and the
+ * `interrupt` outcome.
+ */
+import { modelSupportsAssistantPrefill } from "@earendil-works/pi-ai";
+import { getSupportedThinkingLevels } from "../../core/thinking-levels.js";
+export async function availableModelsData(session) {
+    const models = await session.modelRegistry.modelRuntime.getAvailable();
+    return {
+        models: models.map((model) => ({
+            ...model,
+            supportedThinkingLevels: getSupportedThinkingLevels(model),
+            supportsAssistantPrefill: modelSupportsAssistantPrefill(model, {
+                thinkingEnabled: session.thinkingLevel !== "off",
+            }),
+        })),
+    };
+}
+/** The refusal of a level the active model cannot run; callers match this text. */
+export function unsupportedThinkingLevel(level) {
+    return `Thinking level ${String(level)} is not supported by the active model.`;
+}
+/**
+ * `interrupt { turnId? }`: stops the running turn and only that. An idle session answers
+ * `interrupted: false`; so does a `turnId` naming a turn that is no longer the running one, which
+ * then answers the running turn's id. `stop` resolves once the turn has stopped.
+ */
+export async function interruptRunningTurn(session, requestedTurnId, stop) {
+    if (!session.isStreaming && session.retryAttempt === 0)
+        return { interrupted: false };
+    const turnId = String(session.externalAdmission.turnEpoch);
+    if (typeof requestedTurnId === "string" && requestedTurnId !== turnId)
+        return { interrupted: false, turnId };
+    await stop();
+    return { interrupted: true, turnId };
+}
+//# sourceMappingURL=session-control-actions-data.js.map

package/docs/extensions.md

@@ -1684,7 +1684,7 @@ runtime's steering or follow-up queue like the user's queued input. The protocol
 |---|---|---|
 | `registerControlEndpoint({ inboxDir, drain, isSessionReferenced? })` | `Promise<SessionControlRegistration>` | POSIX interactive session: binds the `tui` control endpoint and answers `{ status: "registered", socket, dispose }`. On a multi-session host with a public socket it binds nothing and `socket` is the host's. Otherwise `{ status: "unsupported", reason: "unsupported_platform" \| "unsupported_mode" }`, or `{ status: "failed", reason }` when a registration step failed. `drain(event)` runs on every [`session_control_wake`](#session_control_wake) edge and answers `{ admitted: [{ delivery_id, kind }] }`. `inboxDir` is created 0700 and its entry creations and deletions wake the drain. At clean exit a header-only session file is removed unless `isSessionReferenced()` answers `true`. |
 | `admissionGate()` | `{ can_admit, hold_reason?, editor_revision, turn_epoch }` | Read-only pre-check; `hold_reason` is `draft` while the user composes or their submission is still on its way into the runtime. |
-| `admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id? })` | `{ kind, turn_epoch }` | Decides and acts in one synchronous call. `kind` is `started`, `queued`, `steered`, `turn_conflict` (stale epoch, or a steer without one), `held_draft` (nothing enqueued; retry on the next wake) or `already_admitted` (also for a delivery whose entry the file refused, until the run that refused it has settled and the file's last write succeeded). The delivery becomes a `custom` entry `session_control_delivery` whose `details.delivery_id` proves it was applied. Throws once a host started handing the session over (`release_session`). |
+| `admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id?, sender?, display_text? })` | `{ kind, turn_epoch }` | Decides and acts in one synchronous call. `kind` is `started`, `queued`, `steered`, `turn_conflict` (stale epoch, or a steer without one), `held_draft` (nothing enqueued; retry on the next wake) or `already_admitted` (also for a delivery whose entry the file refused, until the run that refused it has settled and the file's last write succeeded). The delivery becomes a `custom` entry `session_control_delivery` whose `details.delivery_id` proves it was applied. Throws once a host started handing the session over (`release_session`). `sender` (`{ kind: "agent", session_id, name? }`, `{ kind: "command_line", user? }` or `{ kind: "external", platform, author? }`) and `display_text` (the message as written) go to the entry's `details`: the terminal labels the message by its sender over `display_text`, while the model reads `text`. |
 | `listAdmittedDeliveries()` | `{ pending, emitted, failed? }` | The process-lifetime ledger: `pending` is held by the runtime, `emitted` has its transcript entry written, `failed` (present only when non-empty, `[{ delivery_id, error }]`) had its entry refused by the session file: no longer held, still with its sender, admissible again once the run that refused it has settled and the file's last write succeeded. |
 | `persistHeaderNow()` | `Promise<void>` | Writes the session header now, so the session id is durable before anything exposes it. |
 

package/docs/models.md

@@ -142,6 +142,10 @@ Set `api` at provider level (default for all models) or model level (override pe
 | `authHeader` | Set `true` to add `Authorization: Bearer <apiKey>` automatically |
 | `models` | Array of model configurations |
 | `modelOverrides` | Per-model overrides for built-in or extension-registered models on this provider |
+| `whitelist` | Model ids to keep; every other model of the provider is removed (see [Hiding Providers and Models](#hiding-providers-and-models)) |
+| `blacklist` | Model ids to remove from the provider |
+| `hideFreeModels` | Set `true` to remove every model of the provider whose input and output cost are both `0` |
+| `disabled` | Set `true` to remove the whole provider |
 
 For providers with `models`, non-built-in provider configs need `baseUrl` and an `api` value at either provider or model level. `apiKey` is not required to load the file: models become available when auth is configured through `/login`/`auth.json`, CLI `--api-key`, or provider `apiKey`. If no auth is configured, the models load but stay unavailable in `/model` and `--list-models`.
 
@@ -510,6 +514,36 @@ Merge semantics:
 - If a custom model `id` matches a built-in model `id`, the custom model replaces that built-in model.
 - If a custom model `id` is new, it is added alongside built-in models.
 
+## Hiding Providers and Models
+
+Hidden models and providers disappear from the catalog everywhere it is read: `--list-models`, `/model`, Ctrl+P cycling, startup selection, and `enabledModels` / `favoriteModels` resolution.
+
+```json
+{
+  "disabledProviders": ["openrouter"],
+  "providers": {
+    "anthropic": { "whitelist": ["claude-sonnet-4-5"] },
+    "openai": { "blacklist": ["gpt-5.4"] },
+    "opencode": { "hideFreeModels": true }
+  }
+}
+```
+
+| Key | Where | Effect |
+|-----|-------|--------|
+| `disabledProviders` | Top level, array of provider ids | Removes each listed provider and all of its models. `providers.<id>.disabled: true` does the same for one provider. |
+| `whitelist` | Provider block, array of model ids | Keeps only the listed ids. |
+| `blacklist` | Provider block, array of model ids | Removes the listed ids. |
+| `hideFreeModels` | Provider block, boolean | Removes every model of that provider whose `cost.input` and `cost.output` are both `0`. |
+
+Behavior notes:
+- `whitelist` and `blacklist` match whole model ids exactly and case-sensitively; there are no globs. When both are set, a model must be in `whitelist` and not in `blacklist`.
+- All three provider filters run after custom `models` are merged in, and before `modelOverrides`. They also apply to the provider's custom `models` entries.
+- `hideFreeModels` is per provider. Other providers are unaffected, so a local provider whose models cost `0` (Ollama, LM Studio, vLLM) stays listed unless that provider sets the flag itself.
+- `hideFreeModels` also hides a custom `models` entry that omits `cost`, because an omitted `cost` is `0`. Give such a model a nonzero `cost`, or leave the flag off for that provider.
+- `hideFreeModels` reads the catalog `cost` (or the custom model's own `cost`). A `cost` set in `modelOverrides` is not considered.
+- A provider block that sets only `whitelist`, `blacklist`, or `hideFreeModels` is valid; no `baseUrl` or `models` is needed.
+
 ## Per-model Overrides
 
 Use `modelOverrides` to customize built-in models and matching extension-registered models without replacing the provider's full model list.

package/docs/rpc.md

@@ -1147,10 +1147,11 @@ registrant opens no socket and writes no registry directory.
   `endpoint_kind: "tui"`, `owner` and `alive`, probing it for at most 1.5 s. `senpi host gc` reaps a dead one on
   the same evidence as a host. `ensure`, `handoff` and `stop` refuse it with `unsupported_endpoint_kind` (exit 3)
   before connecting, because a terminal endpoint is owned by its terminal process.
-- **Commands.** The command set is read-mostly. Anything not listed below is answered `unsupported` as data. No
-  command can prompt, steer, queue a follow-up, open a session, run a command or change a model.
-  - `get_protocol_info`: `mode: "tui"`, `capabilities: ["tui_control"]`, `generation: 0` and the endpoint's
-    `instanceId`.
+- **Commands.** Anything not listed below is answered `unsupported` as data. No command can prompt, steer, queue a
+  follow-up, open a session or run a command.
+  - `get_protocol_info`: `mode: "tui"`, `capabilities: ["tui_control"]`, `generation: 0`, the endpoint's
+    `instanceId`, and `commands`: every command this endpoint accepts. A terminal from before the session
+    controls below lists no `commands`.
   - `list_sessions`: exactly one row, `kind: "interactive"`, `surface: "tui"`, `attachments: 1`.
   - `get_state`: the RPC session state plus `turn_epoch`, `blocking_question`, `compacting`,
     `editor_has_draft` and `state_version`.
@@ -1166,6 +1167,21 @@ registrant opens no socket and writes no registry directory.
     question (a pending question id from the `question` feed); without it, `id` does. The answer settles by
     the host's rule (see `question`) and the reply carries the frame's `id`, as on a host (see "Extension
     UI Responses").
+  - The session controls run the pane's own paths, so validation, the footer and persistence are the ones the
+    user gets doing it in that terminal:
+    - `get_available_models` and `get_available_thinking_levels`: the same answers as a host's.
+    - `set_model { provider, modelId }`: the `/model` switch (the footer, the remembered default model, the
+      pane's status line). An unknown model is refused `Model not found: <provider>/<modelId>`; a switch the
+      session refuses answers its reason. Success answers the model, as on a host.
+    - `set_thinking_level { level, scope? }`: the thinking-level selector. `scope: "turn"` sets this session's
+      level; otherwise the level is also remembered for the model (the selector's Ctrl+S). A level the active
+      model cannot run is refused `Thinking level <level> is not supported by the active model.` and nothing
+      changes, for either scope. A host refuses it only for `scope: "turn"`; for the default scope a host clamps it
+      to a level the model runs.
+    - `interrupt { turnId? }`: Esc on a running turn - queued input returns to the editor, the turn aborts and
+      settles before the answer. Answers `{ interrupted: true, turnId }` with the `turn_epoch` it stopped. An idle
+      session answers `{ interrupted: false }`; a `turnId` that is not the running turn answers
+      `{ interrupted: false, turnId }` with the running one and leaves it alone. The session stays open.
   - `prompt`, `steer` and `follow_up` are `unsupported`.
 - **Admission.** A message from another session enters only through the registrant's drain, which calls
   `pi.session.admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id? })`. One synchronous call
@@ -1726,6 +1742,24 @@ Response:
 {"type": "response", "command": "abort", "success": true}
 ```
 
+
+#### interrupt
+
+Stop the running turn and only that one, with the terminal control endpoint's contract (see "Interactive sessions
+expose a control endpoint"). `turnId` (the `turn_epoch` of `get_state`) is optional.
+
+```json
+{"type": "interrupt", "turnId": "3"}
+```
+
+Response: `{ interrupted: true, turnId }` once the turn has stopped; `{ interrupted: false }` when the session is
+idle; `{ interrupted: false, turnId }` (the running turn) when `turnId` names another turn. Unlike `abort`, it
+answers after the turn settled.
+
+```json
+{"type": "response", "command": "interrupt", "success": true, "data": {"interrupted": true, "turnId": "3"}}
+```
+
 #### clear_queue
 
 Remove queued steering and follow-up messages and return their text.

package/docs/web-search.md

@@ -75,7 +75,9 @@ A config file replaces the free default completely: senpi uses only the provider
 | `nativeModel` | The model native search runs on; see [Choosing the model native search runs on](#choosing-the-model-native-search-runs-on). |
 | `providers[]` | The providers to use. Each entry takes `provider`, and optionally `id`, `apiKey`, `baseUrl`, `maxResults`, `timeoutMs`, `priority`, `weight`, `allowedDomains` or `blockedDomains`. |
 
-Free engines you can list without a key: `duckduckgo-html`, `exa-mcp`, `startpage`, `mojeek`, `ecosia`, `google-html`, and `searxng`. Providers that need `apiKey`: `exa`, `tavily`, `brave`, `serper`, `serpdive`, `kagi`, `perplexity`, `z-ai`, `xai`, `kimi`, `deepseek`, `anthropic`, `openai` (plus `searchEngineId` for `google-cse`). `chatgpt-subscription` and `google` use your senpi login when `apiKey` is omitted; see [Listing login-based routes](#listing-login-based-routes).
+Free engines you can list without a key: `duckduckgo-html`, `exa-mcp`, `startpage`, `mojeek`, `ecosia`, `google-html`, `searxng`, and `keenable`. Providers that need `apiKey`: `exa`, `tavily`, `brave`, `serper`, `serpdive`, `kagi`, `perplexity`, `z-ai`, `xai`, `kimi`, `deepseek`, `anthropic`, `openai` (plus `searchEngineId` for `google-cse`). `chatgpt-subscription` and `google` use your senpi login when `apiKey` is omitted; see [Listing login-based routes](#listing-login-based-routes).
+
+`keenable` ([Keenable](https://keenable.ai)) takes an `apiKey` but also works without one: a keyed entry posts to `https://api.keenable.ai/v1/search` with `X-API-Key`, while a keyless entry uses the shared public tier at `/v1/search/public` and identifies itself with an `X-Keenable-Title` app header instead of a credential. Because the public tier is a per-IP pool, `keenable` is never in the no-config default chain — list it explicitly in `websearch.json`. A single `allowedDomains` entry maps to Keenable's native `site` filter; multiple or blocked domains stay `site:`/`-site:` terms in the query.
 
 ## Limit or turn off the free engines
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.10-2",
+	"version": "2026.10.10-4",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-2",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-2",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-2",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-4",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-4",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-4",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.289",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.10-2",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-2",
+		"@code-yeongyu/senpi-codemode": "2026.10.10-4",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-4",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",