@code-yeongyu/senpi 2026.10.10-4 → 2026.10.10-6

package/dist/core/extensions/builtin/permission-system/index.js

@@ -3,6 +3,9 @@ import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { decideAuto } from "./auto-policy.js";
 import { PERMISSION_PRESET_NAMES, parsePermissionFlag, parsePermissionPresetFlag } from "./cli.js";
 import { disabled } from "./config.js";
+import { forgetDispatchApproval, registerDispatchAuthorizer } from "./dispatch.js";
+import { prepareMcpDispatchApproval } from "./dispatch-metadata.js";
+import { createDispatchAuthorizer } from "./dispatch-policy.js";
 import { createEventEmitter } from "./events.js";
 import { INTERNAL_PERMISSION_TOOLS } from "./internal-tools.js";
 import { handleNoUI } from "./non-interactive.js";
@@ -52,6 +55,10 @@ export default function permissionSystemExtension(pi) {
     let activePreset = null;
     let initialApprovedCount = 0;
     let setupError = null;
+    // The `permission-preset` flag value the rules were last loaded from; absent until session_start.
+    let loadedPresetFlag;
+    let loadedPermissionFlag;
+    const retireAuthorizers = new WeakMap();
     const nextRequestID = createRequestIDFactory();
     pi.registerFlag("permission", {
         description: "Set permission rules (format: tool=action or tool:pattern=action)",
@@ -72,12 +79,17 @@ export default function permissionSystemExtension(pi) {
             setupError = getReason(error);
             throw error;
         }
+        retireAuthorizers.get(ctx.sessionManager)?.();
+        retireAuthorizers.set(ctx.sessionManager, registerDispatchAuthorizer(ctx.sessionManager, dispatchAuthorizer));
         applyToolDenials();
     });
-    const loadPermissionRules = (cwd) => {
+    // `sessionApproved` carries this session's "Always" answers, not yet written to disk, across a reload.
+    const loadPermissionRules = (cwd, sessionApproved = []) => {
         const settingsManager = SettingsManager.create(cwd);
         const permissionFlag = pi.getFlag("permission");
+        loadedPermissionFlag = permissionFlag;
         const permissionPresetFlag = pi.getFlag("permission-preset");
+        loadedPresetFlag = { value: permissionPresetFlag };
         cliRuleset = typeof permissionFlag === "string" ? parsePermissionFlag(permissionFlag) : [];
         const cliPreset = typeof permissionPresetFlag === "string" ? parsePermissionPresetFlag(permissionPresetFlag) : undefined;
         if (typeof permissionPresetFlag === "string" && !cliPreset) {
@@ -88,22 +100,51 @@ export default function permissionSystemExtension(pi) {
         activePreset = loadedSettings.preset;
         const approved = loadedSettings.approved;
         parserRegistry = createBuiltinParserRegistry();
-        service = new PermissionService(staticRuleset, approved, createEventEmitter(pi));
+        service = new PermissionService(staticRuleset, [...approved, ...sessionApproved], createEventEmitter(pi));
         initialApprovedCount = approved.length;
     };
-    const applyToolDenials = () => {
+    const applyToolDenials = (onlyWhenNarrowed = false) => {
         const allTools = pi.getAllTools().map((tool) => tool.name);
         const disabledTools = disabled(allTools, staticRuleset);
-        const activeTools = pi
-            .getActiveTools()
-            .filter((toolName) => INTERNAL_PERMISSION_TOOLS.has(toolName) || !disabledTools.has(toolName));
+        const currentTools = pi.getActiveTools();
+        const activeTools = currentTools.filter((toolName) => INTERNAL_PERMISSION_TOOLS.has(toolName) || !disabledTools.has(toolName));
+        if (onlyWhenNarrowed && activeTools.length === currentTools.length)
+            return;
         pi.setActiveTools(activeTools);
     };
-    pi.on("tool_call", async (event, ctx) => {
+    // A host moves a live session to another preset (an attach naming one) by changing the flag;
+    // the rules follow from the next tool call on, and a failed reload refuses calls like session_start.
+    const followPresetFlag = (cwd) => {
+        if (loadedPresetFlag === undefined ||
+            (loadedPresetFlag.value === pi.getFlag("permission-preset") &&
+                loadedPermissionFlag === pi.getFlag("permission"))) {
+            return;
+        }
+        const sessionApproved = service ? service.getApproved().slice(initialApprovedCount) : [];
+        setupError = null;
+        try {
+            loadPermissionRules(cwd, sessionApproved);
+        }
+        catch (error) {
+            setupError = getReason(error);
+            return;
+        }
+        applyToolDenials(true);
+    };
+    const dispatchAuthorizer = createDispatchAuthorizer(pi, (ctx) => {
+        followPresetFlag(ctx.cwd);
+        return { service, parsers: parserRegistry, preset: activePreset, setupError };
+    }, (event, ctx, signal) => authorizeToolCall(event, ctx, signal));
+    const authorizeToolCall = async (event, ctx, signal) => {
+        followPresetFlag(ctx.cwd);
         if (setupError !== null) {
             return { block: true, reason: `Permission setup failed: ${setupError}` };
         }
-        if (!service || !parserRegistry) {
+        // Pinned for this call: a preset change while it waits on a prompt must not move its reply
+        // to another service or its decision to another preset.
+        const activeService = service;
+        const callPreset = activePreset;
+        if (!activeService || !parserRegistry) {
             return undefined;
         }
         const toolOwnedRequests = parserRegistry.has(event.toolName)
@@ -117,6 +158,7 @@ export default function permissionSystemExtension(pi) {
             return undefined;
         }
         const sessionID = ctx.sessionManager.getSessionId();
+        const approve = prepareMcpDispatchApproval(pi, event, ctx, dispatchAuthorizer);
         for (const permissionRequest of permissionRequests) {
             const request = {
                 id: nextRequestID(),
@@ -130,18 +172,18 @@ export default function permissionSystemExtension(pi) {
                     ...(event.parentToolCallId === undefined ? {} : { parentCallID: event.parentToolCallId }),
                 },
             };
-            const auto = activePreset === "auto"
+            const auto = callPreset === "auto"
                 ? await decideAuto(event.toolName, event.input, permissionRequest, ctx.cwd)
                 : undefined;
-            const askResultPromise = service
+            const askResultPromise = activeService
                 .ask(request, {
                 autoApproveAsk: permissionRequest.autoApproveAsk ?? false,
                 approveBlanketAsk: auto?.approveBlanketAsk ?? false,
-                presetBound: activePreset === "auto",
+                presetBound: callPreset === "auto",
                 ...(permissionRequest.ruleAliases ? { ruleAliases: permissionRequest.ruleAliases } : {}),
             })
                 .then(() => ({ ok: true }), (error) => ({ ok: false, error }));
-            const isPending = service.list().some((pendingRequest) => pendingRequest.id === request.id);
+            const isPending = activeService.list().some((pendingRequest) => pendingRequest.id === request.id);
             if (!isPending) {
                 const askResult = await askResultPromise;
                 if (!askResult.ok) {
@@ -150,17 +192,17 @@ export default function permissionSystemExtension(pi) {
                 continue;
             }
             if (ctx.hasUI) {
-                const reply = await showPermissionPrompt(ctx, request);
-                service.reply(reply);
+                const reply = await showPermissionPrompt(ctx, request, signal);
+                activeService.reply(reply);
             }
             else {
-                service.reply(handleNoUI(request, {
+                activeService.reply(handleNoUI(request, {
                     emitEvent: (eventName, data) => {
                         if (eventName !== "permission_asked") {
                             pi.events.emit(eventName, data);
                         }
                     },
-                    presetBound: activePreset === "auto",
+                    presetBound: callPreset === "auto",
                 }));
             }
             const askResult = await askResultPromise;
@@ -168,10 +210,15 @@ export default function permissionSystemExtension(pi) {
                 return { block: true, reason: getReason(askResult.error) };
             }
         }
+        approve?.();
         return undefined;
-    });
+    };
+    pi.on("tool_call", authorizeToolCall);
+    pi.on("tool_result", (event) => forgetDispatchApproval(event.input));
     pi.on("session_shutdown", async (event, ctx) => {
         void event;
+        retireAuthorizers.get(ctx.sessionManager)?.();
+        retireAuthorizers.delete(ctx.sessionManager);
         if (!service) {
             return;
         }

package/dist/core/extensions/builtin/permission-system/prompt.d.ts

@@ -1,4 +1,4 @@
 import type { ExtensionContext } from "../../types.ts";
 import type { ReplyInput, Request } from "./types.ts";
-export declare function showPermissionPrompt(ctx: ExtensionContext, request: Request): Promise<ReplyInput>;
+export declare function showPermissionPrompt(ctx: ExtensionContext, request: Request, signal?: AbortSignal): Promise<ReplyInput>;
 //# sourceMappingURL=prompt.d.ts.map

package/dist/core/extensions/builtin/permission-system/prompt.js

@@ -1,4 +1,4 @@
-export async function showPermissionPrompt(ctx, request) {
+export async function showPermissionPrompt(ctx, request, signal) {
     const title = `Permission required: ${request.permission}`;
     const message = formatRequestForDisplay(request);
     const displayTitle = `${title}\n\n${message}`;
@@ -11,6 +11,8 @@ export async function showPermissionPrompt(ctx, request) {
             ...(request.tool.parentCallID === undefined ? {} : { parentToolCallId: request.tool.parentCallID }),
         }
         : {};
+    if (signal !== undefined)
+        call.signal = signal;
     const choice = await ctx.ui.select(displayTitle, options, call);
     if (choice === "Deny with feedback") {
         const feedback = await ctx.ui.input("Feedback", "Why are you denying this permission? (optional)", call);

package/dist/core/extensions/builtin/permission-system/service.d.ts

@@ -1,8 +1,13 @@
 import { type PermissionEventEmitter } from "./events.ts";
-import { type ReplyInput, type Request, type Ruleset } from "./types.ts";
+import { type ReplyInput, type Request, type Rule, type Ruleset } from "./types.ts";
 type RequestInput = Omit<Request, "id"> & {
     id?: string;
 };
+interface DecisionOptions {
+    readonly approveBlanketAsk?: boolean;
+    readonly presetBound?: boolean;
+    readonly ruleAliases?: readonly string[] | undefined;
+}
 /** Core service for managing permission requests and rule evaluation */
 export declare class PermissionService {
     private pending;
@@ -24,6 +29,11 @@ export declare class PermissionService {
      * explicit consent for that pattern) can then turn a remaining ask into allow.
      */
     private decide;
+    /** Share the decision and its relevant rules with the final dispatch fence. */
+    dispatchDecision(permission: string, target: string | readonly string[], options?: DecisionOptions): {
+        readonly action: Rule["action"];
+        readonly rules: readonly Rule[];
+    };
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
     ask(request: RequestInput, { autoApproveAsk, approveBlanketAsk, presetBound, ruleAliases, }?: {
         readonly autoApproveAsk?: boolean;

package/dist/core/extensions/builtin/permission-system/service.js

@@ -24,8 +24,14 @@ export class PermissionService {
      * explicit consent for that pattern) can then turn a remaining ask into allow.
      */
     decide(permission, target, options) {
-        if (!options.presetBound)
-            return evaluate(permission, target, this.staticRuleset, this.approved).action;
+        return this.dispatchDecision(permission, target, options).action;
+    }
+    /** Share the decision and its relevant rules with the final dispatch fence. */
+    dispatchDecision(permission, target, options = {}) {
+        if (!options.presetBound) {
+            const rule = evaluate(permission, target, this.staticRuleset, this.approved);
+            return { action: rule.action, rules: [{ ...rule }] };
+        }
         const presetRules = this.staticRuleset.filter((rule) => isPresetRule(rule));
         const userRules = this.staticRuleset.filter((rule) => !isPresetRule(rule));
         const presetRule = evaluate(permission, target, presetRules);
@@ -35,10 +41,14 @@ export class PermissionService {
         const combined = user === undefined || PermissionService.RESTRICTIVENESS[preset] >= PermissionService.RESTRICTIVENESS[user]
             ? preset
             : user;
+        const rules = [presetRule, ...(user === undefined ? [] : [userRule])].map((rule) => ({ ...rule }));
         if (combined !== "ask")
-            return combined;
+            return { action: combined, rules };
         const remembered = evaluate(permission, target, this.approved);
-        return this.approved.includes(remembered) && remembered.action === "allow" ? "allow" : "ask";
+        if (this.approved.includes(remembered) && remembered.action === "allow") {
+            return { action: "allow", rules: [...rules, { ...remembered }] };
+        }
+        return { action: "ask", rules };
     }
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
     async ask(request, { autoApproveAsk = false, approveBlanketAsk = false, presetBound = false, ruleAliases, } = {}) {

package/dist/core/extensions/builtin/ttsr/detectors/collapse-near-duplicates.d.ts

@@ -25,6 +25,7 @@ export interface NearDuplicateState {
     lineHasContent: boolean;
     lineStartOffset: number;
     lineText: string;
+    lineLastChar: string;
     length: number;
     wordChars: number;
     startOffset: number;

package/dist/core/extensions/builtin/ttsr/detectors/collapse-near-duplicates.js

@@ -11,6 +11,10 @@ export const NEAR_DUPLICATE_TEXT_RETENTION_MAX = 512;
 const SAMPLE_LENGTH = 80;
 const WORD_PATTERN = /[\p{L}\p{N}#]+/gu;
 const FENCE_PATTERN = /^(?:```|~~~)/;
+// An indented line that is not a nested list item (two spaces or a tab, then not `- `, `* `, `+ `, `1. `, `1) `).
+const INDENTED_CODE = /^(?: {2,}|\t)(?![ \t]*(?:[-*+]|\d+[.)])[ \t])/;
+// A line ending in a block, statement or markup delimiter: `{`, `}`, `[`, `]`, `(`, `;`, `,`, `>` (oh-my-pi's set).
+const CODE_LINE_ENDINGS = new Set(["{", "}", "[", "]", "(", ";", ",", ">"]);
 export function createNearDuplicateState() {
     return {
         history: new FixedRing(NEAR_DUPLICATE_LOOKBACK),
@@ -20,6 +24,7 @@ export function createNearDuplicateState() {
         lineHasContent: false,
         lineStartOffset: 0,
         lineText: "",
+        lineLastChar: "",
         length: 0,
         wordChars: 0,
         startOffset: 0,
@@ -113,17 +118,28 @@ function completeParagraph(state) {
         },
     };
 }
+/**
+ * Code and markup repeat one skeleton with different literals, so a run of same-shaped lines (SVG elements, JSON
+ * objects) is not a narration loop. Lines shaped like code are left out of the paragraph, fenced or not, and a
+ * paragraph made only of them is never scored (senpi#2865; oh-my-pi v18.8.0 drops the same line shapes before its loop heuristics).
+ */
+function isCodeShapedLine(state) {
+    return INDENTED_CODE.test(state.lineText) || CODE_LINE_ENDINGS.has(state.lineLastChar);
+}
 function foldLine(state) {
+    const fence = FENCE_PATTERN.test(state.lineText.trimStart());
+    if (state.insideFence || fence)
+        state.fenced = true;
+    if (fence)
+        state.insideFence = !state.insideFence;
+    if (!state.fenced && isCodeShapedLine(state))
+        return;
     if (state.length === 0)
         state.startOffset = state.lineStartOffset;
     state.length += state.lineLength + 1;
     state.wordChars += state.lineWordChars;
-    if (state.insideFence || FENCE_PATTERN.test(state.lineText.trimStart()))
-        state.fenced = true;
     if (state.retained.length < NEAR_DUPLICATE_TEXT_RETENTION_MAX)
         state.retained += `${state.lineText}\n`;
-    if (FENCE_PATTERN.test(state.lineText.trimStart()))
-        state.insideFence = !state.insideFence;
 }
 function resetLine(state, startOffset) {
     state.lineLength = 0;
@@ -131,6 +147,7 @@ function resetLine(state, startOffset) {
     state.lineHasContent = false;
     state.lineStartOffset = startOffset;
     state.lineText = "";
+    state.lineLastChar = "";
 }
 export function updateNearDuplicates(state, entry) {
     if (entry.value.charCodeAt(0) === CharCode.LineFeed) {
@@ -143,8 +160,10 @@ export function updateNearDuplicates(state, entry) {
         return result;
     }
     const codePoint = entry.value.codePointAt(0) ?? 0;
-    if (!isAsciiWhitespace(codePoint))
+    if (!isAsciiWhitespace(codePoint)) {
         state.lineHasContent = true;
+        state.lineLastChar = entry.value;
+    }
     if (isAsciiAlphanumeric(codePoint) || (codePoint > 0x7f && !isBoxDrawing(codePoint)))
         state.lineWordChars += 1;
     state.lineLength += entry.width;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { sanitizeTerminalLabel } from "@earendil-works/pi-tui";
+export { sanitizeTerminalLabel, visibleWidth } from "@earendil-works/pi-tui";
 export { type Args, parseArgs } from "./cli/args.ts";
 export { runHostCommand } from "./cli/host-command.ts";
 export { CONFIG_DIR_NAME, getAgentDir, getDocsPath, getExamplesPath, getPackageDir, getReadmePath, VERSION, } from "./config.ts";

package/dist/index.js

@@ -1,5 +1,5 @@
 // Core session management
-export { sanitizeTerminalLabel } from "@earendil-works/pi-tui";
+export { sanitizeTerminalLabel, visibleWidth } from "@earendil-works/pi-tui";
 export { parseArgs } from "./cli/args.js";
 // The shared-daemon command surface: one JSON line, one exit code, for launchers without a shell
 export { runHostCommand } from "./cli/host-command.js";

package/dist/modes/interactive/interactive-mode.js

@@ -4123,6 +4123,11 @@ export class InteractiveMode {
         switch (event.type) {
             case "agent_start":
                 this.agentIdle = false;
+                // Keep a scrolled-up reader in place for this turn: rows re-laid out above the viewport are not
+                // replayed until the next key press (#2836). No catch-up here: a turn nobody typed (auto-retry,
+                // an extension's triggerTurn) can start while the reader is still scrolled up, and a turn the user
+                // started already caught up on their Enter key.
+                this.ui.setScrollbackReplayHold(true);
                 this.transcriptWriteNoticeShown = false;
                 this.clearPendingTools();
                 this.clearActiveToolExecutionStatus();
@@ -4411,6 +4416,8 @@ export class InteractiveMode {
                 if (this.settingsManager.getShowTerminalProgress() && this.ui.terminal) {
                     this.ui.terminal.setProgress(false);
                 }
+                // Keep holding until the next key press: a replay at turn end would snap a reader who is scrolled up.
+                this.ui.setScrollbackReplayHold("until-input");
                 this.clearActiveToolExecutionStatus();
                 this.clearToolHookStatuses();
                 this.streamingReveal.stop();
@@ -4850,8 +4857,13 @@ export class InteractiveMode {
      */
     showStatus(message) {
         const children = this.chatContainer.children;
-        const last = children.length > 0 ? children[children.length - 1] : undefined;
-        const secondLast = children.length > 1 ? children[children.length - 2] : undefined;
+        // While a turn streams, a notice goes above the live message, like a custom entry does. Appended
+        // after it, a notice taller than the screen pushed the live output above the viewport, and every
+        // streamed delta then replayed the whole scrollback: the view kept jumping to the top (#2836).
+        const streamingIndex = this.streamingComponent ? children.indexOf(this.streamingComponent) : -1;
+        const end = streamingIndex >= 0 ? streamingIndex : children.length;
+        const last = end > 0 ? children[end - 1] : undefined;
+        const secondLast = end > 1 ? children[end - 2] : undefined;
         if (last && secondLast && last === this.lastStatusText && secondLast === this.lastStatusSpacer) {
             this.lastStatusMessage = message;
             this.lastStatusText.invalidate();
@@ -4861,8 +4873,13 @@ export class InteractiveMode {
         const spacer = new Spacer(1);
         this.lastStatusMessage = message;
         const text = new ThemedText(() => theme.fg("dim", this.lastStatusMessage), 1, 0);
-        this.chatContainer.addChild(spacer);
-        this.chatContainer.addChild(text);
+        if (streamingIndex >= 0) {
+            children.splice(streamingIndex, 0, spacer, text);
+        }
+        else {
+            this.chatContainer.addChild(spacer);
+            this.chatContainer.addChild(text);
+        }
         this.lastStatusSpacer = spacer;
         this.lastStatusText = text;
         this.ui.requestRender();

package/dist/modes/rpc/host-reservations.d.ts

@@ -14,7 +14,7 @@ export interface SessionPathReservations {
     /** Records this host as the holder of `sessionPath`, or reports the holder whose claim stands. */
     claim(sessionPath: string, attached?: boolean): Promise<SessionPathOwner | undefined>;
     /** Drops this host's claim. A claim made by another generation is never touched. */
-    release(sessionPath: string): void;
+    release(sessionPath: string): Promise<void>;
     /** Republishes this host's claim with the attachment state that session now has. */
     setAttached(sessionPath: string, attached: boolean): void;
 }

package/dist/modes/rpc/host-reservations.js

@@ -58,6 +58,7 @@ export function createSessionPathReservations(options) {
     const pid = options.pid ?? process.pid;
     const startTime = readProcessStartTime(pid).then((value) => value ?? null, () => null);
     const held = new Set();
+    const updates = new Map();
     const report = (message) => options.onFailure?.(message);
     const publish = async (sessionPath, attached, stillHeld) => {
         const owner = {
@@ -100,19 +101,24 @@ export function createSessionPathReservations(options) {
             }
             return undefined;
         },
-        release(sessionPath) {
+        async release(sessionPath) {
             if (!held.delete(sessionPath))
                 return;
-            void rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
+            await updates.get(sessionPath);
+            updates.delete(sessionPath);
+            await rm(reservationFile(dir, sessionPath), { force: true }).catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be removed (${errorMessage(cause)})`);
             });
         },
         setAttached(sessionPath, attached) {
             if (!held.has(sessionPath))
                 return;
-            void publish(sessionPath, attached, () => held.has(sessionPath)).catch((cause) => {
+            const update = (updates.get(sessionPath) ?? Promise.resolve())
+                .then(() => publish(sessionPath, attached, () => held.has(sessionPath)))
+                .catch((cause) => {
                 report(`session path reservation for ${sessionPath} could not be updated (${errorMessage(cause)})`);
             });
+            updates.set(sessionPath, update);
         },
     };
 }

package/dist/modes/rpc/rpc-client.js

@@ -18,7 +18,7 @@ export class RpcCommandError extends Error {
     }
 }
 import { attachJsonlLineReader, serializeJsonLine } from "./jsonl.js";
-import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_COMPACTION_DEADLINE_MS, REQUEST_DEADLINE_MS, } from "./rpc-request-deadline.js";
+import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_AFTER_QUEUED_DEADLINE_MS, PROMPT_COMPACTION_DEADLINE_MS, promptStalledMessage, REQUEST_DEADLINE_MS, } from "./rpc-request-deadline.js";
 import { RPC_ERROR_UNKNOWN_COMMAND } from "./rpc-types.js";
 import { readSocketSecret, resolveSocketTransportAddress, sendSocketHandshake, socketSecretPath, } from "./socket-transport.js";
 import { socketNeedsHandshake } from "./tui-socket.js";
@@ -960,6 +960,7 @@ export class RpcClient {
         return new Promise((resolve, reject) => {
             const timeoutMessage = () => `Timeout waiting for response to ${command.type}. Stderr: ${this.stderr}`;
             let promptCap;
+            let promptReceived = false;
             const expire = (timeoutError) => {
                 clearTimeout(promptCap);
                 const pending = this.pendingRequests.get(id);
@@ -991,7 +992,18 @@ export class RpcClient {
                 },
                 ...(command.type === "prompt"
                     ? {
-                        onCompaction: (compacting) => deadline.extend(compacting ? PROMPT_COMPACTION_DEADLINE_MS : REQUEST_DEADLINE_MS, timeoutMessage),
+                        onCompaction: (compacting) => compacting
+                            ? deadline.extend(PROMPT_COMPACTION_DEADLINE_MS, timeoutMessage)
+                            : promptReceived
+                                ? deadline.extend(PROMPT_AFTER_QUEUED_DEADLINE_MS, promptStalledMessage)
+                                : deadline.extend(REQUEST_DEADLINE_MS, timeoutMessage),
+                        // The host received the prompt: its preflight may outlive the plain request deadline (senpi#2871).
+                        // A compaction's own wait is longer: the acknowledgement must never shorten it.
+                        onQueued: () => {
+                            promptReceived = true;
+                            if (!this.isCompacting())
+                                deadline.extend(PROMPT_AFTER_QUEUED_DEADLINE_MS, promptStalledMessage);
+                        },
                     }
                     : {}),
                 ...(command.type === "open_session"

package/dist/modes/rpc/rpc-request-deadline.d.ts

@@ -14,6 +14,14 @@ export declare const PROMPT_ACK_MAX_WAIT_MS: number;
  * (senpi#2209).
  */
 export declare const OPEN_AFTER_QUEUED_DEADLINE_MS: number;
+/**
+ * How long a prompt the host acknowledged as received may take to be accepted. Its preflight runs on the
+ * session's loop, which on a starved shared host outlived the 30 s request deadline: the client gave up,
+ * discarded the session, and the host answered into its closed scope (senpi#2871). A lost transport still
+ * rejects at once; this only bounds a host that received the prompt and then went silent.
+ */
+export declare const PROMPT_AFTER_QUEUED_DEADLINE_MS: number;
+export declare function promptStalledMessage(): string;
 export declare function openStalledMessage(position: unknown): string;
 export interface RequestDeadline {
     /** Restarts the wait with a new budget and the message it fails with. */

package/dist/modes/rpc/rpc-request-deadline.js

@@ -15,6 +15,16 @@ export const PROMPT_ACK_MAX_WAIT_MS = PROMPT_COMPACTION_DEADLINE_MS + REQUEST_DE
  * (senpi#2209).
  */
 export const OPEN_AFTER_QUEUED_DEADLINE_MS = 10 * 60_000;
+/**
+ * How long a prompt the host acknowledged as received may take to be accepted. Its preflight runs on the
+ * session's loop, which on a starved shared host outlived the 30 s request deadline: the client gave up,
+ * discarded the session, and the host answered into its closed scope (senpi#2871). A lost transport still
+ * rejects at once; this only bounds a host that received the prompt and then went silent.
+ */
+export const PROMPT_AFTER_QUEUED_DEADLINE_MS = 5 * 60_000;
+export function promptStalledMessage() {
+    return `prompt was received by the host but not accepted within ${PROMPT_AFTER_QUEUED_DEADLINE_MS / 60_000} minutes`;
+}
 export function openStalledMessage(position) {
     const queued = typeof position === "number" ? ` at queue position ${position}` : "";
     const minutes = OPEN_AFTER_QUEUED_DEADLINE_MS / 60_000;

package/dist/modes/rpc/rpc-types.d.ts

@@ -1595,7 +1595,10 @@ export interface RpcAuthAccountsChangedEvent {
 /**
  * Sent to ONE opener the moment its `open_session` is accepted, before the open enters the
  * session loop. The in-process host serves opens one at a time, so a burst queues; without this
- * the client's only signal is a deadline it cannot explain (senpi#1844).
+ * the client's only signal is a deadline it cannot explain (senpi#1844). A multi-session host sends
+ * the same record for a session-routed `prompt` the moment it is received, before its preflight runs
+ * on the session's loop, so a client waits out a slow preflight instead of discarding the session at
+ * its plain request deadline (senpi#2871).
  *
  * `for_request` carries the opener's request id deliberately, NOT the response-id field: a client
  * settles pending requests by response id, and a queued record wearing the open's id would be
@@ -1603,11 +1606,11 @@ export interface RpcAuthAccountsChangedEvent {
  */
 export interface RpcOpenQueuedEvent {
     type: "queued";
-    /** The `open_session` request this position belongs to. */
+    /** The `open_session` or `prompt` request this position belongs to. */
     for_request: string;
-    /** 1-based place in the open queue at the moment of acceptance. */
+    /** 1-based place in the open queue at acceptance; for a `prompt`, its place among that session's requests in flight. */
     position: number;
-    /** Opens already in flight when this one arrived; `position` is this plus one. */
+    /** Opens (for a `prompt`, that session's requests) already in flight when this one arrived; `position` is this plus one. */
     in_flight: number;
 }
 /** Emitted when the SDK failover engine advances to a different account slot. */

package/dist/modes/rpc/session-binding.js

@@ -42,9 +42,23 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
             return typeof value === "function" ? value.bind(runtime) : value;
         },
     });
+    // A reply can be written after its session closed: a prompt's preflight that outlived the client's
+    // deadline answers once the client already discarded the session. That record has no reader left, so it
+    // is dropped with one line naming the session instead of throwing "Provider scope is closed" out of
+    // an unawaited prompt (senpi#2871).
+    let droppedAfterClose = false;
     const handler = await runWithProviderScope(entry.scope, async () => {
+        const writeInScope = bindToProviderScope(enqueueRecords);
         const taggedSink = {
-            writeRaw: bindToProviderScope(enqueueRecords),
+            writeRaw: (chunk) => {
+                if (entry.scope.state === "closed") {
+                    if (!droppedAfterClose)
+                        process.stderr.write(`senpi rpc host: dropped a record for closed session ${sessionId} at ${new Date().toISOString()}\n`);
+                    droppedAfterClose = true;
+                    return;
+                }
+                writeInScope(chunk);
+            },
             waitForBackpressure: bindToProviderScope(async () => { }),
         };
         return createRpcConnectionHandler(runtimeHost, taggedSink, {

package/dist/modes/rpc/session-command-router.d.ts

@@ -140,6 +140,7 @@ export declare class SessionCommandRouter {
     /** Drops per-connection records for a handle the host closed on its own. */
     private forgetSessionOwnership;
     private stopSweep;
+    private acknowledgePrompt;
     private openWithBarrier;
     private open;
     /**

package/dist/modes/rpc/session-command-router.js

@@ -283,6 +283,10 @@ export class SessionCommandRouter {
             const binding = this.bindings.get(command.sessionId);
             if (!binding)
                 return error(command.id, command.type, RPC_ERROR_UNKNOWN_SESSION);
+            // A prompt's preflight runs on the session's loop and can outlive the client's request deadline on a
+            // starved host; acknowledging receipt first lets the client wait it out (senpi#2871).
+            if (command.type === "prompt")
+                this.acknowledgePrompt(command.id, command.sessionId);
             await binding.handle(command);
             return undefined;
         }
@@ -438,6 +442,18 @@ export class SessionCommandRouter {
         clearInterval(this.sweepTimer);
         this.sweepTimer = undefined;
     }
+    acknowledgePrompt(id, sessionId) {
+        const connection = this.writer.currentConnection();
+        if (id === undefined || connection === undefined)
+            return;
+        const inFlight = Math.max(0, (this.activeRequests.get(sessionId) ?? 1) - 1);
+        this.writer.sendOpenQueued(connection, {
+            type: "queued",
+            for_request: id,
+            position: inFlight + 1,
+            in_flight: inFlight,
+        });
+    }
     openWithBarrier(command) {
         const owner = this.writer.currentConnection();
         if (owner === undefined)

package/dist/modes/rpc/session-registry-attach.js

@@ -16,8 +16,8 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.retainOnDisconnect = true;
     if (!entry.durableSessionId)
         throw new RpcSessionRegistryError("session_path_in_use");
-    // The surface follows the client that renders the replies: an attach that names one moves
-    // the live session to it; an attach without one keeps what the session has.
+    // The surface, browser engine and permission preset follow the client: an attach that names one
+    // moves the live session to it; an attach without one keeps what the session has.
     if (profile.promptSurface !== undefined && profile.promptSurface !== entry.profile.promptSurface) {
         entry.profile = frozenProfile({ ...entry.profile, promptSurface: profile.promptSurface });
         entry.runtime?.setPromptSurface(profile.promptSurface);
@@ -26,6 +26,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.profile = frozenProfile({ ...entry.profile, browserEngine: profile.browserEngine });
         entry.runtime?.setBrowserEngine(profile.browserEngine);
     }
+    // The preset is applied even when the record already names it: the record is not the live session,
+    // so a resent attach also repairs a session that drifted from it (senpi#2842).
+    if (profile.permissionPreset !== undefined) {
+        entry.profile = frozenProfile({ ...entry.profile, permissionPreset: profile.permissionPreset });
+        entry.runtime?.setPermissionPreset(profile.permissionPreset);
+    }
     entry.lastCommandAt = now;
     if (wasParked) {
         entry.lifecycleMutex = entry.lifecycleMutex.then(() => entry.runtime?.emitAttachmentEvent("session_resumed"));