@code-yeongyu/senpi 2026.10.10-4 → 2026.10.10-5

package/dist/core/extensions/builtin/html-render/tool.js

@@ -0,0 +1,74 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { Type } from "typebox";
+import { defineTool } from "../../types.js";
+import { injectHtmlRenderBootstrap } from "./bootstrap.js";
+import { inlineLocalImages } from "./images.js";
+// The same input limit as the desktop's html_render. Images belong as absolute
+// file paths, which are inlined after the check, so the document itself stays
+// small: it travels in the tool call and again in the result details.
+const MAX_HTML_CHARACTERS = 512_000;
+const Params = Type.Object({
+    html: Type.String({
+        description: "A complete, self-contained HTML document.",
+        minLength: 1,
+        maxLength: MAX_HTML_CHARACTERS,
+    }),
+    title: Type.String({ description: "Short name for the page.", minLength: 1, maxLength: 200 }),
+    height: Type.Optional(Type.Integer({
+        description: "Frame height hint in CSS pixels, 80-2000. Defaults to the page's natural height.",
+    })),
+});
+const OUTPUT_DIR = ".senpi/html-pages";
+const clampHeight = (height) => height === undefined ? undefined : Math.min(2000, Math.max(80, Math.round(height)));
+export const showHtmlPageTool = defineTool({
+    name: "show_html_page",
+    label: "Show HTML Page",
+    description: "Show a finished self-contained HTML page (chart, table, diagram, mockup) to the reader. " +
+        "No network: inline every script, style and image (data: URIs). A <script src>, stylesheet link, font, image " +
+        "or fetch that points at a URL (a CDN included) is refused, and the page comes out blank or broken. " +
+        "Local images written as absolute file paths " +
+        "are inlined automatically after a byte check. In the desktop thread this renders inline above your " +
+        "reply; elsewhere it is written to a file you can open in the desktop.",
+    promptSnippet: "show_html_page: show a self-contained HTML page (chart/table/diagram) to the reader",
+    promptGuidelines: [
+        "No network: inline every script, style and image (data: URIs); a CDN <script src> or remote font is refused and leaves the page blank.",
+        "Absolute-path local images are inlined after a magic-byte check; a renamed non-image is refused.",
+    ],
+    parameters: Params,
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+        const inlined = await inlineLocalImages(params.html);
+        const prepared = injectHtmlRenderBootstrap(inlined.html);
+        const height = clampHeight(params.height);
+        const dir = join(ctx.cwd, OUTPUT_DIR);
+        await mkdir(dir, { recursive: true });
+        const safeName = params.title
+            .replace(/[\\/:*?"<>|\p{Cc}]+/gu, " ")
+            .replace(/\s+/g, " ")
+            .trim()
+            .slice(0, 60) || "page";
+        const path = join(dir, `${safeName}-${Date.now().toString(36)}.html`);
+        await writeFile(path, prepared, "utf8");
+        const missing = inlined.missing.length === 0 ? undefined : inlined.missing;
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Wrote the page to ${path}. Open it in the desktop to see it rendered with your theme. ` +
+                        (missing === undefined
+                            ? "Local images were inlined."
+                            : `Some local images could not be read and were left as written: ${missing.join(", ")}.`),
+                },
+            ],
+            details: {
+                path,
+                title: params.title,
+                height,
+                prepared: true,
+                ...(missing ? { missingImages: missing } : {}),
+                html: params.html,
+            },
+        };
+    },
+});
+//# sourceMappingURL=tool.js.map

package/dist/core/extensions/builtin/index.js

@@ -19,6 +19,7 @@ import helpExtension from "./help/index.js";
 import herdrExtension from "./herdr/index.js";
 import historySearchExtension from "./history-search/index.js";
 import hooksExtension from "./hooks/index.js";
+import htmlRenderExtension from "./html-render/index.js";
 import imageGenExtension from "./imagegen/index.js";
 import importReproExtension from "./import-repro.js";
 import lookAtExtension from "./look-at/index.js";
@@ -103,6 +104,9 @@ export const builtinExtensions = [
     { id: "cache-keepalive", factory: cacheKeepAliveExtension },
     { id: "ttsr", factory: ttsrExtension },
     { id: "btw", factory: btwExtension },
+    // HTML page rendering for standalone senpi (TUI/local); the desktop thread reaches the
+    // same capability through the desktop's MCP server instead.
+    { id: "html-render", factory: htmlRenderExtension },
     // Provider-neutral account listing; sits before the provider lanes so their
     // dedicated commands (claude-account, cursor accounts) keep their own names.
     { id: "account", factory: accountExtension },

package/dist/core/extensions/builtin/permission-system/index.js

@@ -52,6 +52,8 @@ export default function permissionSystemExtension(pi) {
     let activePreset = null;
     let initialApprovedCount = 0;
     let setupError = null;
+    // The `permission-preset` flag value the rules were last loaded from; absent until session_start.
+    let loadedPresetFlag;
     const nextRequestID = createRequestIDFactory();
     pi.registerFlag("permission", {
         description: "Set permission rules (format: tool=action or tool:pattern=action)",
@@ -74,10 +76,12 @@ export default function permissionSystemExtension(pi) {
         }
         applyToolDenials();
     });
-    const loadPermissionRules = (cwd) => {
+    // `sessionApproved` carries this session's "Always" answers, not yet written to disk, across a reload.
+    const loadPermissionRules = (cwd, sessionApproved = []) => {
         const settingsManager = SettingsManager.create(cwd);
         const permissionFlag = pi.getFlag("permission");
         const permissionPresetFlag = pi.getFlag("permission-preset");
+        loadedPresetFlag = { value: permissionPresetFlag };
         cliRuleset = typeof permissionFlag === "string" ? parsePermissionFlag(permissionFlag) : [];
         const cliPreset = typeof permissionPresetFlag === "string" ? parsePermissionPresetFlag(permissionPresetFlag) : undefined;
         if (typeof permissionPresetFlag === "string" && !cliPreset) {
@@ -88,22 +92,44 @@ export default function permissionSystemExtension(pi) {
         activePreset = loadedSettings.preset;
         const approved = loadedSettings.approved;
         parserRegistry = createBuiltinParserRegistry();
-        service = new PermissionService(staticRuleset, approved, createEventEmitter(pi));
+        service = new PermissionService(staticRuleset, [...approved, ...sessionApproved], createEventEmitter(pi));
         initialApprovedCount = approved.length;
     };
-    const applyToolDenials = () => {
+    const applyToolDenials = (onlyWhenNarrowed = false) => {
         const allTools = pi.getAllTools().map((tool) => tool.name);
         const disabledTools = disabled(allTools, staticRuleset);
-        const activeTools = pi
-            .getActiveTools()
-            .filter((toolName) => INTERNAL_PERMISSION_TOOLS.has(toolName) || !disabledTools.has(toolName));
+        const currentTools = pi.getActiveTools();
+        const activeTools = currentTools.filter((toolName) => INTERNAL_PERMISSION_TOOLS.has(toolName) || !disabledTools.has(toolName));
+        if (onlyWhenNarrowed && activeTools.length === currentTools.length)
+            return;
         pi.setActiveTools(activeTools);
     };
+    // A host moves a live session to another preset (an attach naming one) by changing the flag;
+    // the rules follow from the next tool call on, and a failed reload refuses calls like session_start.
+    const followPresetFlag = (cwd) => {
+        if (loadedPresetFlag === undefined || loadedPresetFlag.value === pi.getFlag("permission-preset"))
+            return;
+        const sessionApproved = service ? service.getApproved().slice(initialApprovedCount) : [];
+        setupError = null;
+        try {
+            loadPermissionRules(cwd, sessionApproved);
+        }
+        catch (error) {
+            setupError = getReason(error);
+            return;
+        }
+        applyToolDenials(true);
+    };
     pi.on("tool_call", async (event, ctx) => {
+        followPresetFlag(ctx.cwd);
         if (setupError !== null) {
             return { block: true, reason: `Permission setup failed: ${setupError}` };
         }
-        if (!service || !parserRegistry) {
+        // Pinned for this call: a preset change while it waits on a prompt must not move its reply
+        // to another service or its decision to another preset.
+        const activeService = service;
+        const callPreset = activePreset;
+        if (!activeService || !parserRegistry) {
             return undefined;
         }
         const toolOwnedRequests = parserRegistry.has(event.toolName)
@@ -130,18 +156,18 @@ export default function permissionSystemExtension(pi) {
                     ...(event.parentToolCallId === undefined ? {} : { parentCallID: event.parentToolCallId }),
                 },
             };
-            const auto = activePreset === "auto"
+            const auto = callPreset === "auto"
                 ? await decideAuto(event.toolName, event.input, permissionRequest, ctx.cwd)
                 : undefined;
-            const askResultPromise = service
+            const askResultPromise = activeService
                 .ask(request, {
                 autoApproveAsk: permissionRequest.autoApproveAsk ?? false,
                 approveBlanketAsk: auto?.approveBlanketAsk ?? false,
-                presetBound: activePreset === "auto",
+                presetBound: callPreset === "auto",
                 ...(permissionRequest.ruleAliases ? { ruleAliases: permissionRequest.ruleAliases } : {}),
             })
                 .then(() => ({ ok: true }), (error) => ({ ok: false, error }));
-            const isPending = service.list().some((pendingRequest) => pendingRequest.id === request.id);
+            const isPending = activeService.list().some((pendingRequest) => pendingRequest.id === request.id);
             if (!isPending) {
                 const askResult = await askResultPromise;
                 if (!askResult.ok) {
@@ -151,16 +177,16 @@ export default function permissionSystemExtension(pi) {
             }
             if (ctx.hasUI) {
                 const reply = await showPermissionPrompt(ctx, request);
-                service.reply(reply);
+                activeService.reply(reply);
             }
             else {
-                service.reply(handleNoUI(request, {
+                activeService.reply(handleNoUI(request, {
                     emitEvent: (eventName, data) => {
                         if (eventName !== "permission_asked") {
                             pi.events.emit(eventName, data);
                         }
                     },
-                    presetBound: activePreset === "auto",
+                    presetBound: callPreset === "auto",
                 }));
             }
             const askResult = await askResultPromise;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { sanitizeTerminalLabel } from "@earendil-works/pi-tui";
+export { sanitizeTerminalLabel, visibleWidth } from "@earendil-works/pi-tui";
 export { type Args, parseArgs } from "./cli/args.ts";
 export { runHostCommand } from "./cli/host-command.ts";
 export { CONFIG_DIR_NAME, getAgentDir, getDocsPath, getExamplesPath, getPackageDir, getReadmePath, VERSION, } from "./config.ts";

package/dist/index.js

@@ -1,5 +1,5 @@
 // Core session management
-export { sanitizeTerminalLabel } from "@earendil-works/pi-tui";
+export { sanitizeTerminalLabel, visibleWidth } from "@earendil-works/pi-tui";
 export { parseArgs } from "./cli/args.js";
 // The shared-daemon command surface: one JSON line, one exit code, for launchers without a shell
 export { runHostCommand } from "./cli/host-command.js";

package/dist/modes/interactive/interactive-mode.js

@@ -4123,6 +4123,11 @@ export class InteractiveMode {
         switch (event.type) {
             case "agent_start":
                 this.agentIdle = false;
+                // Keep a scrolled-up reader in place for this turn: rows re-laid out above the viewport are not
+                // replayed until the next key press (#2836). No catch-up here: a turn nobody typed (auto-retry,
+                // an extension's triggerTurn) can start while the reader is still scrolled up, and a turn the user
+                // started already caught up on their Enter key.
+                this.ui.setScrollbackReplayHold(true);
                 this.transcriptWriteNoticeShown = false;
                 this.clearPendingTools();
                 this.clearActiveToolExecutionStatus();
@@ -4411,6 +4416,8 @@ export class InteractiveMode {
                 if (this.settingsManager.getShowTerminalProgress() && this.ui.terminal) {
                     this.ui.terminal.setProgress(false);
                 }
+                // Keep holding until the next key press: a replay at turn end would snap a reader who is scrolled up.
+                this.ui.setScrollbackReplayHold("until-input");
                 this.clearActiveToolExecutionStatus();
                 this.clearToolHookStatuses();
                 this.streamingReveal.stop();
@@ -4850,8 +4857,13 @@ export class InteractiveMode {
      */
     showStatus(message) {
         const children = this.chatContainer.children;
-        const last = children.length > 0 ? children[children.length - 1] : undefined;
-        const secondLast = children.length > 1 ? children[children.length - 2] : undefined;
+        // While a turn streams, a notice goes above the live message, like a custom entry does. Appended
+        // after it, a notice taller than the screen pushed the live output above the viewport, and every
+        // streamed delta then replayed the whole scrollback: the view kept jumping to the top (#2836).
+        const streamingIndex = this.streamingComponent ? children.indexOf(this.streamingComponent) : -1;
+        const end = streamingIndex >= 0 ? streamingIndex : children.length;
+        const last = end > 0 ? children[end - 1] : undefined;
+        const secondLast = end > 1 ? children[end - 2] : undefined;
         if (last && secondLast && last === this.lastStatusText && secondLast === this.lastStatusSpacer) {
             this.lastStatusMessage = message;
             this.lastStatusText.invalidate();
@@ -4861,8 +4873,13 @@ export class InteractiveMode {
         const spacer = new Spacer(1);
         this.lastStatusMessage = message;
         const text = new ThemedText(() => theme.fg("dim", this.lastStatusMessage), 1, 0);
-        this.chatContainer.addChild(spacer);
-        this.chatContainer.addChild(text);
+        if (streamingIndex >= 0) {
+            children.splice(streamingIndex, 0, spacer, text);
+        }
+        else {
+            this.chatContainer.addChild(spacer);
+            this.chatContainer.addChild(text);
+        }
         this.lastStatusSpacer = spacer;
         this.lastStatusText = text;
         this.ui.requestRender();

package/dist/modes/rpc/host-reservations.d.ts

@@ -14,7 +14,7 @@ export interface SessionPathReservations {
     /** Records this host as the holder of `sessionPath`, or reports the holder whose claim stands. */
     claim(sessionPath: string, attached?: boolean): Promise<SessionPathOwner | undefined>;
     /** Drops this host's claim. A claim made by another generation is never touched. */
-    release(sessionPath: string): void;
+    release(sessionPath: string): Promise<void>;
     /** Republishes this host's claim with the attachment state that session now has. */
     setAttached(sessionPath: string, attached: boolean): void;
 }

package/dist/modes/rpc/host-reservations.js

@@ -58,6 +58,7 @@ export function createSessionPathReservations(options) {
     const pid = options.pid ?? process.pid;
     const startTime = readProcessStartTime(pid).then((value) => value ?? null, () => null);
     const held = new Set();
+    const updates = new Map();
     const report = (message) => options.onFailure?.(message);
     const publish = async (sessionPath, attached, stillHeld) => {
         const owner = {
@@ -100,19 +101,24 @@ export function createSessionPathReservations(options) {
             }
             return undefined;
         },
-        release(sessionPath) {
+        async release(sessionPath) {
             if (!held.delete(sessionPath))
                 return;
-            void rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
+            await updates.get(sessionPath);
+            updates.delete(sessionPath);
+            await rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be removed (${errorMessage(cause)})`);
             });
         },
         setAttached(sessionPath, attached) {
             if (!held.has(sessionPath))
                 return;
-            void publish(sessionPath, attached, () => held.has(sessionPath)).catch((cause) => {
+            const update = (updates.get(sessionPath) ?? Promise.resolve())
+                .then(() => publish(sessionPath, attached, () => held.has(sessionPath)))
+                .catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be updated (${errorMessage(cause)})`);
             });
+            updates.set(sessionPath, update);
         },
     };
 }

package/dist/modes/rpc/session-registry-attach.js

@@ -16,8 +16,8 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.retainOnDisconnect = true;
     if (!entry.durableSessionId)
         throw new RpcSessionRegistryError("session_path_in_use");
-    // The surface follows the client that renders the replies: an attach that names one moves
-    // the live session to it; an attach without one keeps what the session has.
+    // The surface, browser engine and permission preset follow the client: an attach that names one
+    // moves the live session to it; an attach without one keeps what the session has.
     if (profile.promptSurface !== undefined && profile.promptSurface !== entry.profile.promptSurface) {
         entry.profile = frozenProfile({ ...entry.profile, promptSurface: profile.promptSurface });
         entry.runtime?.setPromptSurface(profile.promptSurface);
@@ -26,6 +26,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.profile = frozenProfile({ ...entry.profile, browserEngine: profile.browserEngine });
         entry.runtime?.setBrowserEngine(profile.browserEngine);
     }
+    // The preset is applied even when the record already names it: the record is not the live session,
+    // so a resent attach also repairs a session that drifted from it (senpi#2842).
+    if (profile.permissionPreset !== undefined) {
+        entry.profile = frozenProfile({ ...entry.profile, permissionPreset: profile.permissionPreset });
+        entry.runtime?.setPermissionPreset(profile.permissionPreset);
+    }
     entry.lastCommandAt = now;
     if (wasParked) {
         entry.lifecycleMutex = entry.lifecycleMutex.then(() => entry.runtime?.emitAttachmentEvent("session_resumed"));

package/dist/modes/rpc/session-registry.js

@@ -11,7 +11,7 @@ import { attachToOpenSession } from "./session-registry-attach.js";
 import { settleClosingReservation, syncRuntimeMetadata } from "./session-registry-claims.js";
 import { createEntrySwitchSession } from "./session-registry-switch.js";
 import { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry-types.js";
-import { beginSessionClose, closeMarkedSession, closeSession } from "./session-teardown.js";
+import { beginSessionClose, closeMarkedSession, closeSession, releaseWithinGrace, } from "./session-teardown.js";
 export { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry-types.js";
 /** Process-local lifecycle owner for multi-session RPC runtimes. */
 export class RpcSessionRegistry {
@@ -41,9 +41,9 @@ export class RpcSessionRegistry {
                 this.options.onSizeChange?.(this.entries.size);
                 return deleted;
             },
-            releaseReservation: (key) => {
+            releaseReservation: async (key) => {
+                await this.options.pathReservations?.release(key);
                 this.reservations.delete(key);
-                this.options.pathReservations?.release(key);
             },
             markDetached: (key) => this.options.pathReservations?.setAttached(key, false),
             now: () => this.now(),
@@ -174,10 +174,8 @@ export class RpcSessionRegistry {
                 finally {
                     this.entries.delete(handle);
                     this.options.onSizeChange?.(this.entries.size);
-                    if (sessionPath) {
-                        this.reservations.delete(sessionPath);
-                        this.options.pathReservations?.release(sessionPath);
-                    }
+                    if (sessionPath)
+                        await releaseWithinGrace(this.teardownHost, handle, sessionPath);
                 }
             }
             if (error instanceof RpcSessionRegistryError)

package/dist/modes/rpc/session-teardown.d.ts

@@ -3,7 +3,7 @@ export interface SessionTeardownHost {
     readonly closeGraceMs: number;
     get(handle: string): RpcSessionEntry | undefined;
     delete(handle: string): void;
-    releaseReservation(key: string): void;
+    releaseReservation(key: string): Promise<void>;
     /** Publishes that this path is retained with no client attached, for the cross-generation claim. */
     markDetached(key: string): void;
     /** The registry's clock, so the detach stamp shares the sweep's timeline. */
@@ -13,6 +13,11 @@ export interface SessionTeardownHost {
 export declare function beginSessionClose(host: SessionTeardownHost, handle: string, onRole?: (finalizer: boolean) => void, options?: {
     detach?: boolean;
 }): RpcSessionEntry;
+/**
+ * Close waits for the claim file to be gone, but a removal that never settles (a wedged mount)
+ * must not hold the close past the grace window: the close completes and the failure is reported.
+ */
+export declare function releaseWithinGrace(host: Pick<SessionTeardownHost, "closeGraceMs" | "releaseReservation">, handle: string, key: string): Promise<void>;
 export declare function closeSession(host: SessionTeardownHost, handle: string): Promise<void>;
 export declare function closeMarkedSession(host: SessionTeardownHost, handle: string): Promise<void>;
 //# sourceMappingURL=session-teardown.d.ts.map

package/dist/modes/rpc/session-teardown.js

@@ -40,6 +40,25 @@ export function beginSessionClose(host, handle, onRole, options) {
     });
     return entry;
 }
+/**
+ * Close waits for the claim file to be gone, but a removal that never settles (a wedged mount)
+ * must not hold the close past the grace window: the close completes and the failure is reported.
+ */
+export async function releaseWithinGrace(host, handle, key) {
+    let timer;
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("late"), host.closeGraceMs);
+    });
+    const removal = host.releaseReservation(key).then(() => "removed", (cause) => {
+        reportDetachedFailure(handle, cause);
+        return "failed";
+    });
+    const outcome = await Promise.race([removal, late]);
+    clearTimeout(timer);
+    if (outcome === "late") {
+        reportDetachedFailure(handle, new Error(`session path reservation was not removed within ${host.closeGraceMs} ms; closing anyway`));
+    }
+}
 export function closeSession(host, handle) {
     const entry = beginSessionClose(host, handle);
     if (entry.state !== "closing")
@@ -80,16 +99,16 @@ export function closeMarkedSession(host, handle) {
         await disposeOnce().catch(() => undefined);
         await entry.scope.close?.();
     };
-    const release = () => {
+    const release = async () => {
         if (released)
             return;
         released = true;
         if (releaseTimer)
             clearTimeout(releaseTimer);
+        if (entry.reservationKey)
+            await releaseWithinGrace(host, handle, entry.reservationKey);
         entry.state = "closed";
         host.delete(handle);
-        if (entry.reservationKey)
-            host.releaseReservation(entry.reservationKey);
     };
     const graceful = (async () => {
         await previousLifecycle;
@@ -119,22 +138,22 @@ export function closeMarkedSession(host, handle) {
         }
     })();
     let settled = false;
-    const finish = () => {
+    const finish = async () => {
         if (settled)
             return;
         settled = true;
-        release();
+        await release();
         entry.closeResolve?.();
     };
     releaseTimer = setTimeout(() => {
         void disposeOnce().catch((cause) => reportDetachedFailure(handle, cause));
         void closeScopeOnce().catch((cause) => reportDetachedFailure(handle, cause));
         void graceful.catch((cause) => reportDetachedFailure(handle, cause));
-        finish();
+        void finish();
     }, host.closeGraceMs);
     void graceful.then(finish, (cause) => {
         reportDetachedFailure(handle, cause);
-        finish();
+        return finish();
     });
     return completion;
 }

package/dist/modes/rpc/session-worker-client.d.ts

@@ -40,6 +40,8 @@ export declare class SessionWorkerClient {
     setPromptSurface(surface: PromptSurface): Promise<void>;
     /** Moves the worker's live session to another browser engine (a later `open_session.browserEngine`). */
     setBrowserEngine(engine: BrowserEngine): Promise<void>;
+    /** Moves the worker's live session to another permission preset (a later `open_session.permissionPreset`). */
+    setPermissionPreset(preset: string): Promise<void>;
     commit(): Promise<WorkerSnapshot>;
     bind(sessionId: string, writer: SessionEventWriter, requestClose: () => void, options: Pick<RpcConnectionOptions, "capabilities" | "clientInfo">): Promise<RpcSessionBinding>;
     get busy(): boolean;

package/dist/modes/rpc/session-worker-client.js

@@ -60,6 +60,12 @@ export class SessionWorkerClient {
         if (result.type !== "result")
             throw new Error("Invalid worker browser_engine response");
     }
+    /** Moves the worker's live session to another permission preset (a later `open_session.permissionPreset`). */
+    async setPermissionPreset(preset) {
+        const result = await this.request({ type: "permission_preset", preset });
+        if (result.type !== "result")
+            throw new Error("Invalid worker permission_preset response");
+    }
     async commit() {
         const result = await this.request({ type: "commit" });
         if (result.type !== "ready")

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -60,6 +60,10 @@ export type HostToSessionWorker = {
     type: "browser_engine";
     request: number;
     engine: BrowserEngine;
+} | {
+    type: "permission_preset";
+    request: number;
+    preset: string;
 } | {
     type: "cancel_ui";
 } | {

package/dist/modes/rpc/session-worker.js

@@ -183,6 +183,12 @@ async function handle(message) {
             entry.runtime.setBrowserEngine(message.engine);
             send({ type: "result", request: message.request });
             return;
+        case "permission_preset":
+            if (!entry?.runtime)
+                throw new Error("session_closing");
+            entry.runtime.setPermissionPreset(message.preset);
+            send({ type: "result", request: message.request });
+            return;
         case "cancel_ui":
             binding?.cancelPendingExtensionUiRequests?.();
             send({ type: "control_done", control: "cancel_ui" });

package/dist/modes/rpc/worker-session-registry.js

@@ -233,7 +233,7 @@ export class WorkerSessionRegistry {
         return undefined;
     }
     async attach(owner, path, options, requested = { cwd: "" }) {
-        const { promptSurface, browserEngine } = requested;
+        const { promptSurface, browserEngine, permissionPreset } = requested;
         const entry = this.entries.get(owner);
         if (entry?.state !== "open" || !entry.worker?.bindingReady || entry.worker.snapshot?.sessionPath !== path)
             throw new RpcSessionRegistryError("session_path_in_use");
@@ -246,6 +246,11 @@ export class WorkerSessionRegistry {
             entry.profile = frozenProfile({ ...entry.profile, browserEngine });
             await entry.worker.setBrowserEngine(browserEngine);
         }
+        // Sent even when the record already names it: only the worker sees its live session (senpi#2842).
+        if (permissionPreset !== undefined) {
+            entry.profile = frozenProfile({ ...entry.profile, permissionPreset });
+            await entry.worker.setPermissionPreset(permissionPreset);
+        }
         const result = this.openResult(owner, entry);
         entry.attachments++;
         // Retention is a property of the live session: any attach may ask for it, and

package/docs/rpc.md

@@ -870,7 +870,8 @@ session's prompt for the named surface, so one host serves a terminal client and
 uses the host process's `SENPI_PROMPT_SURFACE` (`app` or `chat` selects that surface; unset or any other value is `terminal`),
 which remains the only switch for a single-process `--mode rpc` client. A later `open_session` that attaches to a live
 session with another `promptSurface` rebuilds that session's prompt; an attach without the field keeps the current
-surface, and `new_session` / `switch_session` / `fork` inside the session keep it too. Probe `prompt_surface` in
+surface, and `new_session` / `switch_session` / `fork` inside the session keep it too, also when the attach lands while
+one of them is still building the replacement. Probe `prompt_surface` in
 `get_protocol_info` before sending the field; an older host ignores it. Probe `prompt_surface_chat` before sending
 `chat`: a host without it refuses `chat` with `invalid_launch_profile`, so a gateway falls back to `app`. Any value other
 than `terminal`, `app` or `chat` is refused with `invalid_launch_profile`.
@@ -900,9 +901,10 @@ subprocesses (the bash tool and everything it spawns) and its eval kernels, incl
 variable, even when the host process itself exports one (a daemon never inherits it from the process that ensured it).
 `BSK_HOME` and `BSK_BIN` are per install, not per session: they pass from the host environment to every session
 unchanged. A later `open_session` that attaches to a live session with another `browserEngine` moves that session to
-it, and an attach without the field keeps the current engine; `new_session` / `switch_session` / `fork` keep it too.
-Probe `browser_engine` in `get_protocol_info` before sending the field; the capability is advertised only because the
-value reaches every consumer above. Any other value is refused with `invalid_launch_profile`.
+it, and an attach without the field keeps the current engine; `new_session` / `switch_session` / `fork` keep it too,
+also when the attach lands while one of them is still building the replacement. Probe `browser_engine` in
+`get_protocol_info` before sending the field; the capability is advertised only because the value reaches every
+consumer above. Any other value is refused with `invalid_launch_profile`.
 
 A skill that must tell the client what the browser is doing publishes it as that session's own event: an extension
 registers a tool that calls `pi.rpc.emit(name, data)`, an eval cell reaches it as `tool.<name>(...)`, and the host adds
@@ -1486,6 +1488,14 @@ capability must use `ask`, never `workspace`, for an edit-only approval promise.
 Hosts that support `permissionPreset: "auto"` advertise `permission_preset_auto`;
 clients without it must not send `auto`.
 Explicit permission rules and remembered approvals retain their existing precedence, except under `auto`: there settings and CLI rules can only narrow the preset (the more restrictive decision wins), and an "Always" answer (saved in `.senpi/permissions-approved.jsonl`, from this or an earlier session) still allows its pattern.
+An `open_session` that attaches to a live session with another `permissionPreset` moves that session to it: the next
+tool call is decided under the new preset, in either direction, and `new_session` / `switch_session` / `fork` keep it,
+also when the attach lands while one of them or a `reload` (or two overlapping reloads) is still rebuilding the
+session. An attach that names a preset is applied even when the session was opened or last attached with the same one.
+An attach without the field keeps the current preset. An attach accepts exactly the values `open_session` accepts and
+treats them the same way: an unknown preset name is applied like one given to `open_session`, so the session's next
+tool call is refused with `Permission setup failed: Invalid --permission-preset "<name>". ...` until a later attach
+names a valid preset.
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.10-4",
+	"version": "2026.10.10-5",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-4",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-4",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-5",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-5",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-5",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.289",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.10-4",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-4",
+		"@code-yeongyu/senpi-codemode": "2026.10.10-5",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-5",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",