@code-yeongyu/senpi 2026.10.10-5 → 2026.10.10-6

package/dist/core/extensions/builtin/permission-system/dispatch.js

@@ -0,0 +1,106 @@
+import { DeniedError } from "./types.js";
+const authorizers = new WeakMap();
+// AgentSession passes this validated object unchanged from preflight to execution.
+// Identical calls, including calls with duplicate provider IDs, get distinct objects.
+const approvals = new WeakMap();
+/** Retirement cannot remove the authorizer installed by a newer extension load. */
+export function registerDispatchAuthorizer(session, authorizer) {
+    const previous = authorizers.get(session);
+    const registration = { authorizer, retired: new AbortController() };
+    authorizers.set(session, registration);
+    previous?.retired.abort(new Error("Permission authorizer was retired"));
+    return () => {
+        // Retain the retired registration so required authority cannot become
+        // indistinguishable from a session where enforcement was never loaded.
+        registration.retired.abort(new Error("Permission authorizer was retired"));
+    };
+}
+export function hasDispatchAuthorizer(session) {
+    return authorizers.has(session);
+}
+/** Keep the policy and operation that were actually presented, not their post-reply replacements. */
+export function prepareDispatchApproval(session, request, policy) {
+    const registration = authorizers.get(session);
+    if (!registration)
+        throw new Error("Permission authorizer is unavailable");
+    registration.retired.signal.throwIfAborted();
+    const approval = {
+        registration,
+        toolCallId: request.toolCallId,
+        toolName: request.toolName,
+        input: JSON.stringify(request.input),
+        identity: { ...request.identity },
+        policy: { ...policy },
+    };
+    return () => {
+        registration.retired.signal.throwIfAborted();
+        if (authorizers.get(session) !== registration)
+            throw new Error("Permission authorizer was retired");
+        approvals.set(request.input, approval);
+    };
+}
+export function forgetDispatchApproval(input) {
+    approvals.delete(input);
+}
+function matches(approval, registration, request, policy) {
+    return (approval?.registration === registration &&
+        approval.toolCallId === request.toolCallId &&
+        approval.toolName === request.toolName &&
+        approval.input === JSON.stringify(request.input) &&
+        approval.identity.owner === request.identity.owner &&
+        approval.identity.metadata === request.identity.metadata &&
+        approval.policy.action === policy.action &&
+        approval.policy.fingerprint === policy.fingerprint);
+}
+/** Await only this caller's approval; aborting it does not retire another caller's authority. */
+async function awaitApproval(pending, signal) {
+    if (!signal)
+        return pending;
+    let onAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+    try {
+        await Promise.race([pending, aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+    }
+}
+/**
+ * Resolve live permission after MCP readiness. The returned synchronous fence must
+ * pass immediately before dispatch; a false result requires preparation again.
+ */
+export async function authorizeToolDispatch(session, request, ctx, signal) {
+    signal?.throwIfAborted();
+    const registration = authorizers.get(session);
+    if (!registration)
+        throw new Error("Permission authorizer is unavailable");
+    registration.retired.signal.throwIfAborted();
+    const policy = registration.authorizer.policy(request, ctx);
+    if (policy.action === "deny")
+        throw new DeniedError(["*"]);
+    if (policy.action === "ask" && !matches(approvals.get(request.input), registration, request, policy)) {
+        const approve = prepareDispatchApproval(session, request, policy);
+        const waitSignal = signal === undefined ? registration.retired.signal : AbortSignal.any([signal, registration.retired.signal]);
+        waitSignal.throwIfAborted();
+        await awaitApproval(registration.authorizer.ask(request, ctx, waitSignal), waitSignal);
+        signal?.throwIfAborted();
+        approve();
+    }
+    const approvedInput = JSON.stringify(request.input);
+    return () => {
+        if (signal?.aborted || registration.retired.signal.aborted || authorizers.get(session) !== registration)
+            return false;
+        if (JSON.stringify(request.input) !== approvedInput)
+            return false;
+        const current = registration.authorizer.policy(request, ctx);
+        if (current.action === "deny")
+            return false;
+        return current.action === "allow" || matches(approvals.get(request.input), registration, request, current);
+    };
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/core/extensions/builtin/permission-system/index.js

@@ -3,6 +3,9 @@ import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { decideAuto } from "./auto-policy.js";
 import { PERMISSION_PRESET_NAMES, parsePermissionFlag, parsePermissionPresetFlag } from "./cli.js";
 import { disabled } from "./config.js";
+import { forgetDispatchApproval, registerDispatchAuthorizer } from "./dispatch.js";
+import { prepareMcpDispatchApproval } from "./dispatch-metadata.js";
+import { createDispatchAuthorizer } from "./dispatch-policy.js";
 import { createEventEmitter } from "./events.js";
 import { INTERNAL_PERMISSION_TOOLS } from "./internal-tools.js";
 import { handleNoUI } from "./non-interactive.js";
@@ -54,6 +57,8 @@ export default function permissionSystemExtension(pi) {
     let setupError = null;
     // The `permission-preset` flag value the rules were last loaded from; absent until session_start.
     let loadedPresetFlag;
+    let loadedPermissionFlag;
+    const retireAuthorizers = new WeakMap();
     const nextRequestID = createRequestIDFactory();
     pi.registerFlag("permission", {
         description: "Set permission rules (format: tool=action or tool:pattern=action)",
@@ -74,12 +79,15 @@ export default function permissionSystemExtension(pi) {
             setupError = getReason(error);
             throw error;
         }
+        retireAuthorizers.get(ctx.sessionManager)?.();
+        retireAuthorizers.set(ctx.sessionManager, registerDispatchAuthorizer(ctx.sessionManager, dispatchAuthorizer));
         applyToolDenials();
     });
     // `sessionApproved` carries this session's "Always" answers, not yet written to disk, across a reload.
     const loadPermissionRules = (cwd, sessionApproved = []) => {
         const settingsManager = SettingsManager.create(cwd);
         const permissionFlag = pi.getFlag("permission");
+        loadedPermissionFlag = permissionFlag;
         const permissionPresetFlag = pi.getFlag("permission-preset");
         loadedPresetFlag = { value: permissionPresetFlag };
         cliRuleset = typeof permissionFlag === "string" ? parsePermissionFlag(permissionFlag) : [];
@@ -107,8 +115,11 @@ export default function permissionSystemExtension(pi) {
     // A host moves a live session to another preset (an attach naming one) by changing the flag;
     // the rules follow from the next tool call on, and a failed reload refuses calls like session_start.
     const followPresetFlag = (cwd) => {
-        if (loadedPresetFlag === undefined || loadedPresetFlag.value === pi.getFlag("permission-preset"))
+        if (loadedPresetFlag === undefined ||
+            (loadedPresetFlag.value === pi.getFlag("permission-preset") &&
+                loadedPermissionFlag === pi.getFlag("permission"))) {
             return;
+        }
         const sessionApproved = service ? service.getApproved().slice(initialApprovedCount) : [];
         setupError = null;
         try {
@@ -120,7 +131,11 @@ export default function permissionSystemExtension(pi) {
         }
         applyToolDenials(true);
     };
-    pi.on("tool_call", async (event, ctx) => {
+    const dispatchAuthorizer = createDispatchAuthorizer(pi, (ctx) => {
+        followPresetFlag(ctx.cwd);
+        return { service, parsers: parserRegistry, preset: activePreset, setupError };
+    }, (event, ctx, signal) => authorizeToolCall(event, ctx, signal));
+    const authorizeToolCall = async (event, ctx, signal) => {
         followPresetFlag(ctx.cwd);
         if (setupError !== null) {
             return { block: true, reason: `Permission setup failed: ${setupError}` };
@@ -143,6 +158,7 @@ export default function permissionSystemExtension(pi) {
             return undefined;
         }
         const sessionID = ctx.sessionManager.getSessionId();
+        const approve = prepareMcpDispatchApproval(pi, event, ctx, dispatchAuthorizer);
         for (const permissionRequest of permissionRequests) {
             const request = {
                 id: nextRequestID(),
@@ -176,7 +192,7 @@ export default function permissionSystemExtension(pi) {
                 continue;
             }
             if (ctx.hasUI) {
-                const reply = await showPermissionPrompt(ctx, request);
+                const reply = await showPermissionPrompt(ctx, request, signal);
                 activeService.reply(reply);
             }
             else {
@@ -194,10 +210,15 @@ export default function permissionSystemExtension(pi) {
                 return { block: true, reason: getReason(askResult.error) };
             }
         }
+        approve?.();
         return undefined;
-    });
+    };
+    pi.on("tool_call", authorizeToolCall);
+    pi.on("tool_result", (event) => forgetDispatchApproval(event.input));
     pi.on("session_shutdown", async (event, ctx) => {
         void event;
+        retireAuthorizers.get(ctx.sessionManager)?.();
+        retireAuthorizers.delete(ctx.sessionManager);
         if (!service) {
             return;
         }

package/dist/core/extensions/builtin/permission-system/prompt.d.ts

@@ -1,4 +1,4 @@
 import type { ExtensionContext } from "../../types.ts";
 import type { ReplyInput, Request } from "./types.ts";
-export declare function showPermissionPrompt(ctx: ExtensionContext, request: Request): Promise<ReplyInput>;
+export declare function showPermissionPrompt(ctx: ExtensionContext, request: Request, signal?: AbortSignal): Promise<ReplyInput>;
 //# sourceMappingURL=prompt.d.ts.map

package/dist/core/extensions/builtin/permission-system/prompt.js

@@ -1,4 +1,4 @@
-export async function showPermissionPrompt(ctx, request) {
+export async function showPermissionPrompt(ctx, request, signal) {
     const title = `Permission required: ${request.permission}`;
     const message = formatRequestForDisplay(request);
     const displayTitle = `${title}\n\n${message}`;
@@ -11,6 +11,8 @@ export async function showPermissionPrompt(ctx, request) {
             ...(request.tool.parentCallID === undefined ? {} : { parentToolCallId: request.tool.parentCallID }),
         }
         : {};
+    if (signal !== undefined)
+        call.signal = signal;
     const choice = await ctx.ui.select(displayTitle, options, call);
     if (choice === "Deny with feedback") {
         const feedback = await ctx.ui.input("Feedback", "Why are you denying this permission? (optional)", call);

package/dist/core/extensions/builtin/permission-system/service.d.ts

@@ -1,8 +1,13 @@
 import { type PermissionEventEmitter } from "./events.ts";
-import { type ReplyInput, type Request, type Ruleset } from "./types.ts";
+import { type ReplyInput, type Request, type Rule, type Ruleset } from "./types.ts";
 type RequestInput = Omit<Request, "id"> & {
     id?: string;
 };
+interface DecisionOptions {
+    readonly approveBlanketAsk?: boolean;
+    readonly presetBound?: boolean;
+    readonly ruleAliases?: readonly string[] | undefined;
+}
 /** Core service for managing permission requests and rule evaluation */
 export declare class PermissionService {
     private pending;
@@ -24,6 +29,11 @@ export declare class PermissionService {
      * explicit consent for that pattern) can then turn a remaining ask into allow.
      */
     private decide;
+    /** Share the decision and its relevant rules with the final dispatch fence. */
+    dispatchDecision(permission: string, target: string | readonly string[], options?: DecisionOptions): {
+        readonly action: Rule["action"];
+        readonly rules: readonly Rule[];
+    };
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
     ask(request: RequestInput, { autoApproveAsk, approveBlanketAsk, presetBound, ruleAliases, }?: {
         readonly autoApproveAsk?: boolean;

package/dist/core/extensions/builtin/permission-system/service.js

@@ -24,8 +24,14 @@ export class PermissionService {
      * explicit consent for that pattern) can then turn a remaining ask into allow.
      */
     decide(permission, target, options) {
-        if (!options.presetBound)
-            return evaluate(permission, target, this.staticRuleset, this.approved).action;
+        return this.dispatchDecision(permission, target, options).action;
+    }
+    /** Share the decision and its relevant rules with the final dispatch fence. */
+    dispatchDecision(permission, target, options = {}) {
+        if (!options.presetBound) {
+            const rule = evaluate(permission, target, this.staticRuleset, this.approved);
+            return { action: rule.action, rules: [{ ...rule }] };
+        }
         const presetRules = this.staticRuleset.filter((rule) => isPresetRule(rule));
         const userRules = this.staticRuleset.filter((rule) => !isPresetRule(rule));
         const presetRule = evaluate(permission, target, presetRules);
@@ -35,10 +41,14 @@ export class PermissionService {
         const combined = user === undefined || PermissionService.RESTRICTIVENESS[preset] >= PermissionService.RESTRICTIVENESS[user]
             ? preset
             : user;
+        const rules = [presetRule, ...(user === undefined ? [] : [userRule])].map((rule) => ({ ...rule }));
         if (combined !== "ask")
-            return combined;
+            return { action: combined, rules };
         const remembered = evaluate(permission, target, this.approved);
-        return this.approved.includes(remembered) && remembered.action === "allow" ? "allow" : "ask";
+        if (this.approved.includes(remembered) && remembered.action === "allow") {
+            return { action: "allow", rules: [...rules, { ...remembered }] };
+        }
+        return { action: "ask", rules };
     }
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
     async ask(request, { autoApproveAsk = false, approveBlanketAsk = false, presetBound = false, ruleAliases, } = {}) {

package/dist/core/extensions/builtin/ttsr/detectors/collapse-near-duplicates.d.ts

@@ -25,6 +25,7 @@ export interface NearDuplicateState {
     lineHasContent: boolean;
     lineStartOffset: number;
     lineText: string;
+    lineLastChar: string;
     length: number;
     wordChars: number;
     startOffset: number;

package/dist/core/extensions/builtin/ttsr/detectors/collapse-near-duplicates.js

@@ -11,6 +11,10 @@ export const NEAR_DUPLICATE_TEXT_RETENTION_MAX = 512;
 const SAMPLE_LENGTH = 80;
 const WORD_PATTERN = /[\p{L}\p{N}#]+/gu;
 const FENCE_PATTERN = /^(?:```|~~~)/;
+// An indented line that is not a nested list item (two spaces or a tab, then not `- `, `* `, `+ `, `1. `, `1) `).
+const INDENTED_CODE = /^(?: {2,}|\t)(?![ \t]*(?:[-*+]|\d+[.)])[ \t])/;
+// A line ending in a block, statement or markup delimiter: `{`, `}`, `[`, `]`, `(`, `;`, `,`, `>` (oh-my-pi's set).
+const CODE_LINE_ENDINGS = new Set(["{", "}", "[", "]", "(", ";", ",", ">"]);
 export function createNearDuplicateState() {
     return {
         history: new FixedRing(NEAR_DUPLICATE_LOOKBACK),
@@ -20,6 +24,7 @@ export function createNearDuplicateState() {
         lineHasContent: false,
         lineStartOffset: 0,
         lineText: "",
+        lineLastChar: "",
         length: 0,
         wordChars: 0,
         startOffset: 0,
@@ -113,17 +118,28 @@ function completeParagraph(state) {
         },
     };
 }
+/**
+ * Code and markup repeat one skeleton with different literals, so a run of same-shaped lines (SVG elements, JSON
+ * objects) is not a narration loop. Lines shaped like code are left out of the paragraph, fenced or not, and a
+ * paragraph made only of them is never scored (senpi#2865; oh-my-pi v18.8.0 drops the same line shapes before its loop heuristics).
+ */
+function isCodeShapedLine(state) {
+    return INDENTED_CODE.test(state.lineText) || CODE_LINE_ENDINGS.has(state.lineLastChar);
+}
 function foldLine(state) {
+    const fence = FENCE_PATTERN.test(state.lineText.trimStart());
+    if (state.insideFence || fence)
+        state.fenced = true;
+    if (fence)
+        state.insideFence = !state.insideFence;
+    if (!state.fenced && isCodeShapedLine(state))
+        return;
     if (state.length === 0)
         state.startOffset = state.lineStartOffset;
     state.length += state.lineLength + 1;
     state.wordChars += state.lineWordChars;
-    if (state.insideFence || FENCE_PATTERN.test(state.lineText.trimStart()))
-        state.fenced = true;
     if (state.retained.length < NEAR_DUPLICATE_TEXT_RETENTION_MAX)
         state.retained += `${state.lineText}\n`;
-    if (FENCE_PATTERN.test(state.lineText.trimStart()))
-        state.insideFence = !state.insideFence;
 }
 function resetLine(state, startOffset) {
     state.lineLength = 0;
@@ -131,6 +147,7 @@ function resetLine(state, startOffset) {
     state.lineHasContent = false;
     state.lineStartOffset = startOffset;
     state.lineText = "";
+    state.lineLastChar = "";
 }
 export function updateNearDuplicates(state, entry) {
     if (entry.value.charCodeAt(0) === CharCode.LineFeed) {
@@ -143,8 +160,10 @@ export function updateNearDuplicates(state, entry) {
         return result;
     }
     const codePoint = entry.value.codePointAt(0) ?? 0;
-    if (!isAsciiWhitespace(codePoint))
+    if (!isAsciiWhitespace(codePoint)) {
         state.lineHasContent = true;
+        state.lineLastChar = entry.value;
+    }
     if (isAsciiAlphanumeric(codePoint) || (codePoint > 0x7f && !isBoxDrawing(codePoint)))
         state.lineWordChars += 1;
     state.lineLength += entry.width;

package/dist/modes/rpc/rpc-client.js

@@ -18,7 +18,7 @@ export class RpcCommandError extends Error {
     }
 }
 import { attachJsonlLineReader, serializeJsonLine } from "./jsonl.js";
-import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_COMPACTION_DEADLINE_MS, REQUEST_DEADLINE_MS, } from "./rpc-request-deadline.js";
+import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_AFTER_QUEUED_DEADLINE_MS, PROMPT_COMPACTION_DEADLINE_MS, promptStalledMessage, REQUEST_DEADLINE_MS, } from "./rpc-request-deadline.js";
 import { RPC_ERROR_UNKNOWN_COMMAND } from "./rpc-types.js";
 import { readSocketSecret, resolveSocketTransportAddress, sendSocketHandshake, socketSecretPath, } from "./socket-transport.js";
 import { socketNeedsHandshake } from "./tui-socket.js";
@@ -960,6 +960,7 @@ export class RpcClient {
         return new Promise((resolve, reject) => {
             const timeoutMessage = () => `Timeout waiting for response to ${command.type}. Stderr: ${this.stderr}`;
             let promptCap;
+            let promptReceived = false;
             const expire = (timeoutError) => {
                 clearTimeout(promptCap);
                 const pending = this.pendingRequests.get(id);
@@ -991,7 +992,18 @@ export class RpcClient {
                 },
                 ...(command.type === "prompt"
                     ? {
-                        onCompaction: (compacting) => deadline.extend(compacting ? PROMPT_COMPACTION_DEADLINE_MS : REQUEST_DEADLINE_MS, timeoutMessage),
+                        onCompaction: (compacting) => compacting
+                            ? deadline.extend(PROMPT_COMPACTION_DEADLINE_MS, timeoutMessage)
+                            : promptReceived
+                                ? deadline.extend(PROMPT_AFTER_QUEUED_DEADLINE_MS, promptStalledMessage)
+                                : deadline.extend(REQUEST_DEADLINE_MS, timeoutMessage),
+                        // The host received the prompt: its preflight may outlive the plain request deadline (senpi#2871).
+                        // A compaction's own wait is longer: the acknowledgement must never shorten it.
+                        onQueued: () => {
+                            promptReceived = true;
+                            if (!this.isCompacting())
+                                deadline.extend(PROMPT_AFTER_QUEUED_DEADLINE_MS, promptStalledMessage);
+                        },
                     }
                     : {}),
                 ...(command.type === "open_session"

package/dist/modes/rpc/rpc-request-deadline.d.ts

@@ -14,6 +14,14 @@ export declare const PROMPT_ACK_MAX_WAIT_MS: number;
  * (senpi#2209).
  */
 export declare const OPEN_AFTER_QUEUED_DEADLINE_MS: number;
+/**
+ * How long a prompt the host acknowledged as received may take to be accepted. Its preflight runs on the
+ * session's loop, which on a starved shared host outlived the 30 s request deadline: the client gave up,
+ * discarded the session, and the host answered into its closed scope (senpi#2871). A lost transport still
+ * rejects at once; this only bounds a host that received the prompt and then went silent.
+ */
+export declare const PROMPT_AFTER_QUEUED_DEADLINE_MS: number;
+export declare function promptStalledMessage(): string;
 export declare function openStalledMessage(position: unknown): string;
 export interface RequestDeadline {
     /** Restarts the wait with a new budget and the message it fails with. */

package/dist/modes/rpc/rpc-request-deadline.js

@@ -15,6 +15,16 @@ export const PROMPT_ACK_MAX_WAIT_MS = PROMPT_COMPACTION_DEADLINE_MS + REQUEST_DE
  * (senpi#2209).
  */
 export const OPEN_AFTER_QUEUED_DEADLINE_MS = 10 * 60_000;
+/**
+ * How long a prompt the host acknowledged as received may take to be accepted. Its preflight runs on the
+ * session's loop, which on a starved shared host outlived the 30 s request deadline: the client gave up,
+ * discarded the session, and the host answered into its closed scope (senpi#2871). A lost transport still
+ * rejects at once; this only bounds a host that received the prompt and then went silent.
+ */
+export const PROMPT_AFTER_QUEUED_DEADLINE_MS = 5 * 60_000;
+export function promptStalledMessage() {
+    return `prompt was received by the host but not accepted within ${PROMPT_AFTER_QUEUED_DEADLINE_MS / 60_000} minutes`;
+}
 export function openStalledMessage(position) {
     const queued = typeof position === "number" ? ` at queue position ${position}` : "";
     const minutes = OPEN_AFTER_QUEUED_DEADLINE_MS / 60_000;

package/dist/modes/rpc/rpc-types.d.ts

@@ -1595,7 +1595,10 @@ export interface RpcAuthAccountsChangedEvent {
 /**
  * Sent to ONE opener the moment its `open_session` is accepted, before the open enters the
  * session loop. The in-process host serves opens one at a time, so a burst queues; without this
- * the client's only signal is a deadline it cannot explain (senpi#1844).
+ * the client's only signal is a deadline it cannot explain (senpi#1844). A multi-session host sends
+ * the same record for a session-routed `prompt` the moment it is received, before its preflight runs
+ * on the session's loop, so a client waits out a slow preflight instead of discarding the session at
+ * its plain request deadline (senpi#2871).
  *
  * `for_request` carries the opener's request id deliberately, NOT the response-id field: a client
  * settles pending requests by response id, and a queued record wearing the open's id would be
@@ -1603,11 +1606,11 @@ export interface RpcAuthAccountsChangedEvent {
  */
 export interface RpcOpenQueuedEvent {
     type: "queued";
-    /** The `open_session` request this position belongs to. */
+    /** The `open_session` or `prompt` request this position belongs to. */
     for_request: string;
-    /** 1-based place in the open queue at the moment of acceptance. */
+    /** 1-based place in the open queue at acceptance; for a `prompt`, its place among that session's requests in flight. */
     position: number;
-    /** Opens already in flight when this one arrived; `position` is this plus one. */
+    /** Opens (for a `prompt`, that session's requests) already in flight when this one arrived; `position` is this plus one. */
     in_flight: number;
 }
 /** Emitted when the SDK failover engine advances to a different account slot. */

package/dist/modes/rpc/session-binding.js

@@ -42,9 +42,23 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
             return typeof value === "function" ? value.bind(runtime) : value;
         },
     });
+    // A reply can be written after its session closed: a prompt's preflight that outlived the client's
+    // deadline answers once the client already discarded the session. That record has no reader left, so it
+    // is dropped with one line naming the session instead of throwing "Provider scope is closed" out of
+    // an unawaited prompt (senpi#2871).
+    let droppedAfterClose = false;
     const handler = await runWithProviderScope(entry.scope, async () => {
+        const writeInScope = bindToProviderScope(enqueueRecords);
         const taggedSink = {
-            writeRaw: bindToProviderScope(enqueueRecords),
+            writeRaw: (chunk) => {
+                if (entry.scope.state === "closed") {
+                    if (!droppedAfterClose)
+                        process.stderr.write(`senpi rpc host: dropped a record for closed session ${sessionId} at ${new Date().toISOString()}\n`);
+                    droppedAfterClose = true;
+                    return;
+                }
+                writeInScope(chunk);
+            },
             waitForBackpressure: bindToProviderScope(async () => { }),
         };
         return createRpcConnectionHandler(runtimeHost, taggedSink, {

package/dist/modes/rpc/session-command-router.d.ts

@@ -140,6 +140,7 @@ export declare class SessionCommandRouter {
     /** Drops per-connection records for a handle the host closed on its own. */
     private forgetSessionOwnership;
     private stopSweep;
+    private acknowledgePrompt;
     private openWithBarrier;
     private open;
     /**

package/dist/modes/rpc/session-command-router.js

@@ -283,6 +283,10 @@ export class SessionCommandRouter {
             const binding = this.bindings.get(command.sessionId);
             if (!binding)
                 return error(command.id, command.type, RPC_ERROR_UNKNOWN_SESSION);
+            // A prompt's preflight runs on the session's loop and can outlive the client's request deadline on a
+            // starved host; acknowledging receipt first lets the client wait it out (senpi#2871).
+            if (command.type === "prompt")
+                this.acknowledgePrompt(command.id, command.sessionId);
             await binding.handle(command);
             return undefined;
         }
@@ -438,6 +442,18 @@ export class SessionCommandRouter {
         clearInterval(this.sweepTimer);
         this.sweepTimer = undefined;
     }
+    acknowledgePrompt(id, sessionId) {
+        const connection = this.writer.currentConnection();
+        if (id === undefined || connection === undefined)
+            return;
+        const inFlight = Math.max(0, (this.activeRequests.get(sessionId) ?? 1) - 1);
+        this.writer.sendOpenQueued(connection, {
+            type: "queued",
+            for_request: id,
+            position: inFlight + 1,
+            in_flight: inFlight,
+        });
+    }
     openWithBarrier(command) {
         const owner = this.writer.currentConnection();
         if (owner === undefined)

package/docs/providers.md

@@ -54,7 +54,7 @@ The `anthropic-subscription` provider routes LLM calls through the official [Cla
 - Settings (`anthropicSubscriptionProvider`):
   - `systemPromptMode` — controls how the system prompt is delivered. **`full`** (default) sends senpi's composed system prompt verbatim; the lane no longer rebuilds from the SDK `claude_code` preset, so all prompt regions (project rules, response-language instructions, etc.) reach the model. **`preset-append`** is the previous behaviour (deprecated, kept for one release; emits a one-time warning). **`override`** loads the system prompt from a file (`systemPromptFile`). The legacy `appendSystemPrompt` key still works: `false` → `preset-append`, `true`/unset → `full`; setting both keys makes `systemPromptMode` win and warns.
   - In `full` and `override` modes, `settingSources` defaults to `[]` on every lane because senpi's prompt already carries project context — loading the SDK's own CLAUDE.md would double-inject it. The CLI always prepends its own `"You are a Claude agent, built on Anthropic's Claude Agent SDK."` block, which senpi cannot suppress; `full` means the prompt is delivered intact, not that it is the only system-prompt text.
-  - `settingSources` (filesystem settings load only in the ambient lane, so they cannot override your selected account), `strictMcpConfig`, `pinnedAccount`, `tokenInjection` (`oauth-slots` | `config-dir` | `ambient`), `resumeMode` (`auto` default | `off` restores per-turn sessions), `systemPromptFile`, `enabled` (default `false`; gates the ambient lane only).
+  - `settingSources` (filesystem settings load only in the ambient lane, so they cannot override your selected account), `strictMcpConfig`, `pinnedAccount`, `tokenInjection` (`oauth-slots` | `config-dir` | `ambient`), `resumeMode` (`auto` default | `off` restores per-turn sessions), `compactionOwner` (`senpi` default | `sdk` hands compaction to Claude Code's native auto-compact), `systemPromptFile`, `enabled` (default `false`; gates the ambient lane only).
 - **Environment overrides** (precedence: `env > project settings > global settings > default`; no new CLI flags):
 
   | Variable | Purpose |
@@ -66,9 +66,10 @@ The `anthropic-subscription` provider routes LLM calls through the official [Cla
   | `SENPI_CLAUDE_SDK_OAUTH_TOKEN_INJECTION` | `oauth-slots` \| `config-dir` \| `ambient` |
   | `SENPI_CLAUDE_SDK_OAUTH_SETTING_SOURCES` | Overrides `settingSources` |
   | `SENPI_CLAUDE_SDK_OAUTH_PINNED_ACCOUNT` | Overrides `pinnedAccount` |
+  | `SENPI_CLAUDE_SDK_OAUTH_COMPACTION_OWNER` | Overrides `compactionOwner` (`senpi` \| `sdk`) |
 
   Every `SENPI_*` variable is stripped from the Claude Code subprocess environment on all three lanes; other inherited variables are preserved.
-- **Native compaction.** This lane pins the SDK's session-scoped `autoCompactEnabled: true`, overriding the user's global Claude Code preference because native compaction is part of the lane contract. It does not set `autoCompactWindow`. With `resumeMode: "auto"`, the resident Claude Code session owns compaction; `resumeMode: "off"` restores per-turn sessions and returns compaction ownership to senpi.
+- **Compaction.** senpi owns compaction on this lane by default: speculative and idle compaction, restoration, degradation recovery and per-model thresholds apply, the summary is written by the session's own model unless `compaction.model` is set, and an accepted compaction cold-seeds a fresh resident session from the compacted branch. So that only one side compacts, the lane pins the SDK's session-scoped `autoCompactEnabled: false` (overriding the user's global Claude Code preference) and sets `CLAUDE_CODE_TOTAL_TOKENS_REMINDER=off` for the Claude Code subprocess, whose per-turn token reminder otherwise defeats prompt-cache reuse; at the hard limit Claude Code rejects the turn and senpi's overflow recovery compacts and retries it. If that compaction fails, the turn ends with the error instead of Claude Code compacting natively. Set `compactionOwner: "sdk"` (or `SENPI_CLAUDE_SDK_OAUTH_COMPACTION_OWNER=sdk`) to let the resident Claude Code session compact instead: the lane pins `autoCompactEnabled: true`, does not set `autoCompactWindow`, and senpi stands down its automatic compaction (manual `/compact` stays senpi's). The owner is fixed into the resident Claude Code process when it starts, so changing it mid-session restarts that process on the next turn. Under either owner senpi never rewrites a message the resident session already received, so its per-turn context reduction stays off on this lane. `resumeMode: "off"` restores per-turn sessions, where senpi always owns compaction.
 - **Session reuse.** By default one long-lived SDK query spans the entire senpi session instead of a fresh one per turn, so conversations continue with only the new delta sent. An accepted senpi compaction rewrites the transcript and forks to a fresh resident session; a rejected compaction leaves continuity unchanged. Reuse also fails closed on branch/fork navigation, account failover, an aborted turn, or any configuration change. Idle sessions retire after 30 minutes (max 32 resident); a session with an in-flight turn is never evicted. After a senpi process restart the lane always starts fresh. Set `resumeMode: "off"` (or `SENPI_CLAUDE_SDK_OAUTH_RESUME=off`) to restore the old per-turn behaviour. Accepted values are `"auto"` (default) and `"off"`; any other value is silently ignored.
 - Account state is exposed to desktop/automation clients: RPC `get_provider_accounts`, `account_pin`, `account_remove` and the `auth_accounts_changed` / `account_failover` events, mirrored through the app-server protocol. Token material is never included.
 

package/docs/rpc.md

@@ -1308,6 +1308,12 @@ REPORT: nothing here aborts a turn, kills a session, or refuses an `open_session
 - **Event-loop stalls**: a 200 ms timer measures how late it is actually invoked; that lateness is the time the loop
   could serve nobody. Drift above `SENPI_RPC_LOOP_LAG_WARN_MS` (default 500) writes one stderr line per 10 seconds,
   `senpi rpc host stall: event loop blocked <drift>ms (sessionId=<handle> tool=<tool>)`. Drift above
+  `SENPI_RPC_LOOP_LAG_ERROR_MS` (default 5000) additionally broadcasts a `host_stalled` record
+  (`{ type, driftMs, sessionId?, tool?, processCpuMs?, heapDeltaMb? }`) to every connection, like the other content-free lifecycle records.
+  `processCpuMs` is the process CPU time spent during the stalled window and `heapDeltaMb` the JS heap change across it, so a
+  stall explains itself: CPU close to `driftMs` means the host was busy (a large heap drop in the same window points at a
+  collection), and CPU close to zero means the process did not run at all (the machine starved it, or it sat in a blocking
+  wait). The stderr line carries the same two numbers as `cpu=<ms> heap=<+/-MB>`.
 - On accepting an `open_session`, the host sends that connection a `queued` record
   (`{ type, for_request, position, in_flight }`) before the open enters the session loop.
   `position` is 1-based and `in_flight` counts opens already accepted across the whole host,
@@ -1317,12 +1323,12 @@ REPORT: nothing here aborts a turn, kills a session, or refuses an `open_session
   acknowledged open waits up to 10 minutes for its response instead of the 30 s request
   deadline (a busy host was measured answering after 57 s), and a timeout after it names the
   queue position instead of a bare deadline. A lost transport still rejects at once.
-  `SENPI_RPC_LOOP_LAG_ERROR_MS` (default 5000) additionally broadcasts a `host_stalled` record
-  (`{ type, driftMs, sessionId?, tool?, processCpuMs?, heapDeltaMb? }`) to every connection, like the other content-free lifecycle records.
-  `processCpuMs` is the process CPU time spent during the stalled window and `heapDeltaMb` the JS heap change across it, so a
-  stall explains itself: CPU close to `driftMs` means the host was busy (a large heap drop in the same window points at a
-  collection), and CPU close to zero means the process did not run at all (the machine starved it, or it sat in a blocking
-  wait). The stderr line carries the same two numbers as `cpu=<ms> heap=<+/-MB>`.
+- A multi-session host sends the same `queued` record for a session-routed `prompt` the moment it receives it,
+  before the prompt's preflight runs on the session's loop (`position` counts that session's requests in flight).
+  The bundled `RpcClient` then waits up to 5 minutes for the prompt to be accepted instead of the 30 s request
+  deadline (a compaction's longer wait is never shortened by it), and a timeout after it says the host received the prompt. A prompt the host never acknowledged still
+  fails at the request deadline. A reply written for a session that already closed is dropped, with one stderr
+  line naming the session.
 - **Stall attribution**: each routed command is dispatched inside an `AsyncLocalStorage` scope carrying its routing
   `sessionId`, and an in-process session's tool executions open a span carrying `{ sessionId, tool }` for as long as
   the tool runs. A stall is blamed on the synchronous work that finished inside the measured window, or on the tool

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.10-5",
+	"version": "2026.10.10-6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-5",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-5",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-5",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.10-6",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-6",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.10-6",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.289",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.10-5",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-5",
+		"@code-yeongyu/senpi-codemode": "2026.10.10-6",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.10-6",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",