@code-yeongyu/senpi 2026.10.10-3 → 2026.10.10-5

package/dist/modes/rpc/host-reservations.js

@@ -58,6 +58,7 @@ export function createSessionPathReservations(options) {
     const pid = options.pid ?? process.pid;
     const startTime = readProcessStartTime(pid).then((value) => value ?? null, () => null);
     const held = new Set();
+    const updates = new Map();
     const report = (message) => options.onFailure?.(message);
     const publish = async (sessionPath, attached, stillHeld) => {
         const owner = {
@@ -100,19 +101,24 @@ export function createSessionPathReservations(options) {
             }
             return undefined;
         },
-        release(sessionPath) {
+        async release(sessionPath) {
             if (!held.delete(sessionPath))
                 return;
-            void rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
+            await updates.get(sessionPath);
+            updates.delete(sessionPath);
+            await rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be removed (${errorMessage(cause)})`);
             });
         },
         setAttached(sessionPath, attached) {
             if (!held.has(sessionPath))
                 return;
-            void publish(sessionPath, attached, () => held.has(sessionPath)).catch((cause) => {
+            const update = (updates.get(sessionPath) ?? Promise.resolve())
+                .then(() => publish(sessionPath, attached, () => held.has(sessionPath)))
+                .catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be updated (${errorMessage(cause)})`);
             });
+            updates.set(sessionPath, update);
         },
     };
 }

package/dist/modes/rpc/rpc-types.d.ts

@@ -73,6 +73,10 @@ type RpcSessionCommand = {
 } & ClientMessageIdentity) | {
     id?: string;
     type: "abort";
+} | {
+    id?: string;
+    type: "interrupt";
+    turnId?: string;
 } | {
     id?: string;
     type: "abort_compaction";
@@ -832,6 +836,15 @@ export type RpcResponse = {
     type: "response";
     command: "abort";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "interrupt";
+    success: true;
+    data: {
+        interrupted: boolean;
+        turnId?: string;
+    };
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/session-control-actions-data.d.ts

@@ -0,0 +1,17 @@
+import type { AgentSession } from "../../core/agent-session.ts";
+export declare function availableModelsData(session: AgentSession): Promise<{
+    models: readonly object[];
+}>;
+/** The refusal of a level the active model cannot run; callers match this text. */
+export declare function unsupportedThinkingLevel(level: unknown): string;
+export interface InterruptOutcome {
+    readonly interrupted: boolean;
+    readonly turnId?: string;
+}
+/**
+ * `interrupt { turnId? }`: stops the running turn and only that. An idle session answers
+ * `interrupted: false`; so does a `turnId` naming a turn that is no longer the running one, which
+ * then answers the running turn's id. `stop` resolves once the turn has stopped.
+ */
+export declare function interruptRunningTurn(session: AgentSession, requestedTurnId: unknown, stop: () => Promise<void>): Promise<InterruptOutcome>;
+//# sourceMappingURL=session-control-actions-data.d.ts.map

package/dist/modes/rpc/session-control-actions-data.js

@@ -0,0 +1,38 @@
+/**
+ * The session-control answers a multi-session host and a terminal control endpoint share, so a caller
+ * reads the same shapes from either: the model catalog, the thinking-level refusal, and the
+ * `interrupt` outcome.
+ */
+import { modelSupportsAssistantPrefill } from "@earendil-works/pi-ai";
+import { getSupportedThinkingLevels } from "../../core/thinking-levels.js";
+export async function availableModelsData(session) {
+    const models = await session.modelRegistry.modelRuntime.getAvailable();
+    return {
+        models: models.map((model) => ({
+            ...model,
+            supportedThinkingLevels: getSupportedThinkingLevels(model),
+            supportsAssistantPrefill: modelSupportsAssistantPrefill(model, {
+                thinkingEnabled: session.thinkingLevel !== "off",
+            }),
+        })),
+    };
+}
+/** The refusal of a level the active model cannot run; callers match this text. */
+export function unsupportedThinkingLevel(level) {
+    return `Thinking level ${String(level)} is not supported by the active model.`;
+}
+/**
+ * `interrupt { turnId? }`: stops the running turn and only that. An idle session answers
+ * `interrupted: false`; so does a `turnId` naming a turn that is no longer the running one, which
+ * then answers the running turn's id. `stop` resolves once the turn has stopped.
+ */
+export async function interruptRunningTurn(session, requestedTurnId, stop) {
+    if (!session.isStreaming && session.retryAttempt === 0)
+        return { interrupted: false };
+    const turnId = String(session.externalAdmission.turnEpoch);
+    if (typeof requestedTurnId === "string" && requestedTurnId !== turnId)
+        return { interrupted: false, turnId };
+    await stop();
+    return { interrupted: true, turnId };
+}
+//# sourceMappingURL=session-control-actions-data.js.map

package/dist/modes/rpc/session-registry-attach.js

@@ -16,8 +16,8 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.retainOnDisconnect = true;
     if (!entry.durableSessionId)
         throw new RpcSessionRegistryError("session_path_in_use");
-    // The surface follows the client that renders the replies: an attach that names one moves
-    // the live session to it; an attach without one keeps what the session has.
+    // The surface, browser engine and permission preset follow the client: an attach that names one
+    // moves the live session to it; an attach without one keeps what the session has.
     if (profile.promptSurface !== undefined && profile.promptSurface !== entry.profile.promptSurface) {
         entry.profile = frozenProfile({ ...entry.profile, promptSurface: profile.promptSurface });
         entry.runtime?.setPromptSurface(profile.promptSurface);
@@ -26,6 +26,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.profile = frozenProfile({ ...entry.profile, browserEngine: profile.browserEngine });
         entry.runtime?.setBrowserEngine(profile.browserEngine);
     }
+    // The preset is applied even when the record already names it: the record is not the live session,
+    // so a resent attach also repairs a session that drifted from it (senpi#2842).
+    if (profile.permissionPreset !== undefined) {
+        entry.profile = frozenProfile({ ...entry.profile, permissionPreset: profile.permissionPreset });
+        entry.runtime?.setPermissionPreset(profile.permissionPreset);
+    }
     entry.lastCommandAt = now;
     if (wasParked) {
         entry.lifecycleMutex = entry.lifecycleMutex.then(() => entry.runtime?.emitAttachmentEvent("session_resumed"));

package/dist/modes/rpc/session-registry.js

@@ -11,7 +11,7 @@ import { attachToOpenSession } from "./session-registry-attach.js";
 import { settleClosingReservation, syncRuntimeMetadata } from "./session-registry-claims.js";
 import { createEntrySwitchSession } from "./session-registry-switch.js";
 import { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry-types.js";
-import { beginSessionClose, closeMarkedSession, closeSession } from "./session-teardown.js";
+import { beginSessionClose, closeMarkedSession, closeSession, releaseWithinGrace, } from "./session-teardown.js";
 export { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry-types.js";
 /** Process-local lifecycle owner for multi-session RPC runtimes. */
 export class RpcSessionRegistry {
@@ -41,9 +41,9 @@ export class RpcSessionRegistry {
                 this.options.onSizeChange?.(this.entries.size);
                 return deleted;
             },
-            releaseReservation: (key) => {
+            releaseReservation: async (key) => {
+                await this.options.pathReservations?.release(key);
                 this.reservations.delete(key);
-                this.options.pathReservations?.release(key);
             },
             markDetached: (key) => this.options.pathReservations?.setAttached(key, false),
             now: () => this.now(),
@@ -174,10 +174,8 @@ export class RpcSessionRegistry {
                 finally {
                     this.entries.delete(handle);
                     this.options.onSizeChange?.(this.entries.size);
-                    if (sessionPath) {
-                        this.reservations.delete(sessionPath);
-                        this.options.pathReservations?.release(sessionPath);
-                    }
+                    if (sessionPath)
+                        await releaseWithinGrace(this.teardownHost, handle, sessionPath);
                 }
             }
             if (error instanceof RpcSessionRegistryError)

package/dist/modes/rpc/session-teardown.d.ts

@@ -3,7 +3,7 @@ export interface SessionTeardownHost {
     readonly closeGraceMs: number;
     get(handle: string): RpcSessionEntry | undefined;
     delete(handle: string): void;
-    releaseReservation(key: string): void;
+    releaseReservation(key: string): Promise<void>;
     /** Publishes that this path is retained with no client attached, for the cross-generation claim. */
     markDetached(key: string): void;
     /** The registry's clock, so the detach stamp shares the sweep's timeline. */
@@ -13,6 +13,11 @@ export interface SessionTeardownHost {
 export declare function beginSessionClose(host: SessionTeardownHost, handle: string, onRole?: (finalizer: boolean) => void, options?: {
     detach?: boolean;
 }): RpcSessionEntry;
+/**
+ * Close waits for the claim file to be gone, but a removal that never settles (a wedged mount)
+ * must not hold the close past the grace window: the close completes and the failure is reported.
+ */
+export declare function releaseWithinGrace(host: Pick<SessionTeardownHost, "closeGraceMs" | "releaseReservation">, handle: string, key: string): Promise<void>;
 export declare function closeSession(host: SessionTeardownHost, handle: string): Promise<void>;
 export declare function closeMarkedSession(host: SessionTeardownHost, handle: string): Promise<void>;
 //# sourceMappingURL=session-teardown.d.ts.map

package/dist/modes/rpc/session-teardown.js

@@ -40,6 +40,25 @@ export function beginSessionClose(host, handle, onRole, options) {
     });
     return entry;
 }
+/**
+ * Close waits for the claim file to be gone, but a removal that never settles (a wedged mount)
+ * must not hold the close past the grace window: the close completes and the failure is reported.
+ */
+export async function releaseWithinGrace(host, handle, key) {
+    let timer;
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("late"), host.closeGraceMs);
+    });
+    const removal = host.releaseReservation(key).then(() => "removed", (cause) => {
+        reportDetachedFailure(handle, cause);
+        return "failed";
+    });
+    const outcome = await Promise.race([removal, late]);
+    clearTimeout(timer);
+    if (outcome === "late") {
+        reportDetachedFailure(handle, new Error(`session path reservation was not removed within ${host.closeGraceMs} ms; closing anyway`));
+    }
+}
 export function closeSession(host, handle) {
     const entry = beginSessionClose(host, handle);
     if (entry.state !== "closing")
@@ -80,16 +99,16 @@ export function closeMarkedSession(host, handle) {
         await disposeOnce().catch(() => undefined);
         await entry.scope.close?.();
     };
-    const release = () => {
+    const release = async () => {
         if (released)
             return;
         released = true;
         if (releaseTimer)
             clearTimeout(releaseTimer);
+        if (entry.reservationKey)
+            await releaseWithinGrace(host, handle, entry.reservationKey);
         entry.state = "closed";
         host.delete(handle);
-        if (entry.reservationKey)
-            host.releaseReservation(entry.reservationKey);
     };
     const graceful = (async () => {
         await previousLifecycle;
@@ -119,22 +138,22 @@ export function closeMarkedSession(host, handle) {
         }
     })();
     let settled = false;
-    const finish = () => {
+    const finish = async () => {
         if (settled)
             return;
         settled = true;
-        release();
+        await release();
         entry.closeResolve?.();
     };
     releaseTimer = setTimeout(() => {
         void disposeOnce().catch((cause) => reportDetachedFailure(handle, cause));
         void closeScopeOnce().catch((cause) => reportDetachedFailure(handle, cause));
         void graceful.catch((cause) => reportDetachedFailure(handle, cause));
-        finish();
+        void finish();
     }, host.closeGraceMs);
     void graceful.then(finish, (cause) => {
         reportDetachedFailure(handle, cause);
-        finish();
+        return finish();
     });
     return completion;
 }

package/dist/modes/rpc/session-worker-client.d.ts

@@ -40,6 +40,8 @@ export declare class SessionWorkerClient {
     setPromptSurface(surface: PromptSurface): Promise<void>;
     /** Moves the worker's live session to another browser engine (a later `open_session.browserEngine`). */
     setBrowserEngine(engine: BrowserEngine): Promise<void>;
+    /** Moves the worker's live session to another permission preset (a later `open_session.permissionPreset`). */
+    setPermissionPreset(preset: string): Promise<void>;
     commit(): Promise<WorkerSnapshot>;
     bind(sessionId: string, writer: SessionEventWriter, requestClose: () => void, options: Pick<RpcConnectionOptions, "capabilities" | "clientInfo">): Promise<RpcSessionBinding>;
     get busy(): boolean;

package/dist/modes/rpc/session-worker-client.js

@@ -60,6 +60,12 @@ export class SessionWorkerClient {
         if (result.type !== "result")
             throw new Error("Invalid worker browser_engine response");
     }
+    /** Moves the worker's live session to another permission preset (a later `open_session.permissionPreset`). */
+    async setPermissionPreset(preset) {
+        const result = await this.request({ type: "permission_preset", preset });
+        if (result.type !== "result")
+            throw new Error("Invalid worker permission_preset response");
+    }
     async commit() {
         const result = await this.request({ type: "commit" });
         if (result.type !== "ready")

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -60,6 +60,10 @@ export type HostToSessionWorker = {
     type: "browser_engine";
     request: number;
     engine: BrowserEngine;
+} | {
+    type: "permission_preset";
+    request: number;
+    preset: string;
 } | {
     type: "cancel_ui";
 } | {

package/dist/modes/rpc/session-worker.js

@@ -183,6 +183,12 @@ async function handle(message) {
             entry.runtime.setBrowserEngine(message.engine);
             send({ type: "result", request: message.request });
             return;
+        case "permission_preset":
+            if (!entry?.runtime)
+                throw new Error("session_closing");
+            entry.runtime.setPermissionPreset(message.preset);
+            send({ type: "result", request: message.request });
+            return;
         case "cancel_ui":
             binding?.cancelPendingExtensionUiRequests?.();
             send({ type: "control_done", control: "cancel_ui" });

package/dist/modes/rpc/worker-session-registry.js

@@ -233,7 +233,7 @@ export class WorkerSessionRegistry {
         return undefined;
     }
     async attach(owner, path, options, requested = { cwd: "" }) {
-        const { promptSurface, browserEngine } = requested;
+        const { promptSurface, browserEngine, permissionPreset } = requested;
         const entry = this.entries.get(owner);
         if (entry?.state !== "open" || !entry.worker?.bindingReady || entry.worker.snapshot?.sessionPath !== path)
             throw new RpcSessionRegistryError("session_path_in_use");
@@ -246,6 +246,11 @@ export class WorkerSessionRegistry {
             entry.profile = frozenProfile({ ...entry.profile, browserEngine });
             await entry.worker.setBrowserEngine(browserEngine);
         }
+        // Sent even when the record already names it: only the worker sees its live session (senpi#2842).
+        if (permissionPreset !== undefined) {
+            entry.profile = frozenProfile({ ...entry.profile, permissionPreset });
+            await entry.worker.setPermissionPreset(permissionPreset);
+        }
         const result = this.openResult(owner, entry);
         entry.attachments++;
         // Retention is a property of the live session: any attach may ask for it, and

package/docs/extensions.md

@@ -1684,7 +1684,7 @@ runtime's steering or follow-up queue like the user's queued input. The protocol
 |---|---|---|
 | `registerControlEndpoint({ inboxDir, drain, isSessionReferenced? })` | `Promise<SessionControlRegistration>` | POSIX interactive session: binds the `tui` control endpoint and answers `{ status: "registered", socket, dispose }`. On a multi-session host with a public socket it binds nothing and `socket` is the host's. Otherwise `{ status: "unsupported", reason: "unsupported_platform" \| "unsupported_mode" }`, or `{ status: "failed", reason }` when a registration step failed. `drain(event)` runs on every [`session_control_wake`](#session_control_wake) edge and answers `{ admitted: [{ delivery_id, kind }] }`. `inboxDir` is created 0700 and its entry creations and deletions wake the drain. At clean exit a header-only session file is removed unless `isSessionReferenced()` answers `true`. |
 | `admissionGate()` | `{ can_admit, hold_reason?, editor_revision, turn_epoch }` | Read-only pre-check; `hold_reason` is `draft` while the user composes or their submission is still on its way into the runtime. |
-| `admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id? })` | `{ kind, turn_epoch }` | Decides and acts in one synchronous call. `kind` is `started`, `queued`, `steered`, `turn_conflict` (stale epoch, or a steer without one), `held_draft` (nothing enqueued; retry on the next wake) or `already_admitted` (also for a delivery whose entry the file refused, until the run that refused it has settled and the file's last write succeeded). The delivery becomes a `custom` entry `session_control_delivery` whose `details.delivery_id` proves it was applied. Throws once a host started handing the session over (`release_session`). |
+| `admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id?, sender?, display_text? })` | `{ kind, turn_epoch }` | Decides and acts in one synchronous call. `kind` is `started`, `queued`, `steered`, `turn_conflict` (stale epoch, or a steer without one), `held_draft` (nothing enqueued; retry on the next wake) or `already_admitted` (also for a delivery whose entry the file refused, until the run that refused it has settled and the file's last write succeeded). The delivery becomes a `custom` entry `session_control_delivery` whose `details.delivery_id` proves it was applied. Throws once a host started handing the session over (`release_session`). `sender` (`{ kind: "agent", session_id, name? }`, `{ kind: "command_line", user? }` or `{ kind: "external", platform, author? }`) and `display_text` (the message as written) go to the entry's `details`: the terminal labels the message by its sender over `display_text`, while the model reads `text`. |
 | `listAdmittedDeliveries()` | `{ pending, emitted, failed? }` | The process-lifetime ledger: `pending` is held by the runtime, `emitted` has its transcript entry written, `failed` (present only when non-empty, `[{ delivery_id, error }]`) had its entry refused by the session file: no longer held, still with its sender, admissible again once the run that refused it has settled and the file's last write succeeded. |
 | `persistHeaderNow()` | `Promise<void>` | Writes the session header now, so the session id is durable before anything exposes it. |
 

package/docs/rpc.md

@@ -870,7 +870,8 @@ session's prompt for the named surface, so one host serves a terminal client and
 uses the host process's `SENPI_PROMPT_SURFACE` (`app` or `chat` selects that surface; unset or any other value is `terminal`),
 which remains the only switch for a single-process `--mode rpc` client. A later `open_session` that attaches to a live
 session with another `promptSurface` rebuilds that session's prompt; an attach without the field keeps the current
-surface, and `new_session` / `switch_session` / `fork` inside the session keep it too. Probe `prompt_surface` in
+surface, and `new_session` / `switch_session` / `fork` inside the session keep it too, also when the attach lands while
+one of them is still building the replacement. Probe `prompt_surface` in
 `get_protocol_info` before sending the field; an older host ignores it. Probe `prompt_surface_chat` before sending
 `chat`: a host without it refuses `chat` with `invalid_launch_profile`, so a gateway falls back to `app`. Any value other
 than `terminal`, `app` or `chat` is refused with `invalid_launch_profile`.
@@ -900,9 +901,10 @@ subprocesses (the bash tool and everything it spawns) and its eval kernels, incl
 variable, even when the host process itself exports one (a daemon never inherits it from the process that ensured it).
 `BSK_HOME` and `BSK_BIN` are per install, not per session: they pass from the host environment to every session
 unchanged. A later `open_session` that attaches to a live session with another `browserEngine` moves that session to
-it, and an attach without the field keeps the current engine; `new_session` / `switch_session` / `fork` keep it too.
-Probe `browser_engine` in `get_protocol_info` before sending the field; the capability is advertised only because the
-value reaches every consumer above. Any other value is refused with `invalid_launch_profile`.
+it, and an attach without the field keeps the current engine; `new_session` / `switch_session` / `fork` keep it too,
+also when the attach lands while one of them is still building the replacement. Probe `browser_engine` in
+`get_protocol_info` before sending the field; the capability is advertised only because the value reaches every
+consumer above. Any other value is refused with `invalid_launch_profile`.
 
 A skill that must tell the client what the browser is doing publishes it as that session's own event: an extension
 registers a tool that calls `pi.rpc.emit(name, data)`, an eval cell reaches it as `tool.<name>(...)`, and the host adds
@@ -1147,10 +1149,11 @@ registrant opens no socket and writes no registry directory.
   `endpoint_kind: "tui"`, `owner` and `alive`, probing it for at most 1.5 s. `senpi host gc` reaps a dead one on
   the same evidence as a host. `ensure`, `handoff` and `stop` refuse it with `unsupported_endpoint_kind` (exit 3)
   before connecting, because a terminal endpoint is owned by its terminal process.
-- **Commands.** The command set is read-mostly. Anything not listed below is answered `unsupported` as data. No
-  command can prompt, steer, queue a follow-up, open a session, run a command or change a model.
-  - `get_protocol_info`: `mode: "tui"`, `capabilities: ["tui_control"]`, `generation: 0` and the endpoint's
-    `instanceId`.
+- **Commands.** Anything not listed below is answered `unsupported` as data. No command can prompt, steer, queue a
+  follow-up, open a session or run a command.
+  - `get_protocol_info`: `mode: "tui"`, `capabilities: ["tui_control"]`, `generation: 0`, the endpoint's
+    `instanceId`, and `commands`: every command this endpoint accepts. A terminal from before the session
+    controls below lists no `commands`.
   - `list_sessions`: exactly one row, `kind: "interactive"`, `surface: "tui"`, `attachments: 1`.
   - `get_state`: the RPC session state plus `turn_epoch`, `blocking_question`, `compacting`,
     `editor_has_draft` and `state_version`.
@@ -1166,6 +1169,21 @@ registrant opens no socket and writes no registry directory.
     question (a pending question id from the `question` feed); without it, `id` does. The answer settles by
     the host's rule (see `question`) and the reply carries the frame's `id`, as on a host (see "Extension
     UI Responses").
+  - The session controls run the pane's own paths, so validation, the footer and persistence are the ones the
+    user gets doing it in that terminal:
+    - `get_available_models` and `get_available_thinking_levels`: the same answers as a host's.
+    - `set_model { provider, modelId }`: the `/model` switch (the footer, the remembered default model, the
+      pane's status line). An unknown model is refused `Model not found: <provider>/<modelId>`; a switch the
+      session refuses answers its reason. Success answers the model, as on a host.
+    - `set_thinking_level { level, scope? }`: the thinking-level selector. `scope: "turn"` sets this session's
+      level; otherwise the level is also remembered for the model (the selector's Ctrl+S). A level the active
+      model cannot run is refused `Thinking level <level> is not supported by the active model.` and nothing
+      changes, for either scope. A host refuses it only for `scope: "turn"`; for the default scope a host clamps it
+      to a level the model runs.
+    - `interrupt { turnId? }`: Esc on a running turn - queued input returns to the editor, the turn aborts and
+      settles before the answer. Answers `{ interrupted: true, turnId }` with the `turn_epoch` it stopped. An idle
+      session answers `{ interrupted: false }`; a `turnId` that is not the running turn answers
+      `{ interrupted: false, turnId }` with the running one and leaves it alone. The session stays open.
   - `prompt`, `steer` and `follow_up` are `unsupported`.
 - **Admission.** A message from another session enters only through the registrant's drain, which calls
   `pi.session.admitExternalMessage({ delivery_id, text, deliverAs, expected_turn_id? })`. One synchronous call
@@ -1470,6 +1488,14 @@ capability must use `ask`, never `workspace`, for an edit-only approval promise.
 Hosts that support `permissionPreset: "auto"` advertise `permission_preset_auto`;
 clients without it must not send `auto`.
 Explicit permission rules and remembered approvals retain their existing precedence, except under `auto`: there settings and CLI rules can only narrow the preset (the more restrictive decision wins), and an "Always" answer (saved in `.senpi/permissions-approved.jsonl`, from this or an earlier session) still allows its pattern.
+An `open_session` that attaches to a live session with another `permissionPreset` moves that session to it: the next
+tool call is decided under the new preset, in either direction, and `new_session` / `switch_session` / `fork` keep it,
+also when the attach lands while one of them or a `reload` (or two overlapping reloads) is still rebuilding the
+session. An attach that names a preset is applied even when the session was opened or last attached with the same one.
+An attach without the field keeps the current preset. An attach accepts exactly the values `open_session` accepts and
+treats them the same way: an unknown preset name is applied like one given to `open_session`, so the session's next
+tool call is refused with `Permission setup failed: Invalid --permission-preset "<name>". ...` until a later attach
+names a valid preset.
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |
@@ -1726,6 +1752,24 @@ Response:
 {"type": "response", "command": "abort", "success": true}
 ```
 
+
+#### interrupt
+
+Stop the running turn and only that one, with the terminal control endpoint's contract (see "Interactive sessions
+expose a control endpoint"). `turnId` (the `turn_epoch` of `get_state`) is optional.
+
+```json
+{"type": "interrupt", "turnId": "3"}
+```
+
+Response: `{ interrupted: true, turnId }` once the turn has stopped; `{ interrupted: false }` when the session is
+idle; `{ interrupted: false, turnId }` (the running turn) when `turnId` names another turn. Unlike `abort`, it
+answers after the turn settled.
+
+```json
+{"type": "response", "command": "interrupt", "success": true, "data": {"interrupted": true, "turnId": "3"}}
+```
+
 #### clear_queue
 
 Remove queued steering and follow-up messages and return their text.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.10-3",
+	"version": "2026.10.10-5",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-3",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-3",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-3",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-5",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-5",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-5",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.289",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.10-3",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-3",
+		"@code-yeongyu/senpi-codemode": "2026.10.10-5",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-5",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",