@code-yeongyu/senpi 2026.10.16-3 → 2026.10.16-4

package/dist/core/trust-manager.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import lockfile from "proper-lockfile";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, canonicalizePathStrict, resolvePath } from "../utils/paths.js";
@@ -201,35 +201,66 @@ function withTrustFileLock(path, fn) {
         release();
     }
 }
+/** True when `dir` is the user's home or a folder above it: never a project (#2465). */
+function isHomeOrAboveDir(dir, homeDir) {
+    return dir === homeDir || homeDir.startsWith(dir.endsWith(sep) ? dir : `${dir}${sep}`);
+}
+/** The nearest folder at or above `dir` that holds `.git`, as spelled; undefined outside a repository. */
+function findGitRepoRoot(dir) {
+    let currentDir = dir;
+    while (!existsSync(join(currentDir, ".git"))) {
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir)
+            return undefined;
+        currentDir = parentDir;
+    }
+    return currentDir;
+}
+/**
+ * The project `.agents/skills` directories for `cwd`, nearest first: one per folder from cwd up to
+ * the git root (or the filesystem root), stopping below the user's home. Home and every folder
+ * above it are never a project; `~/.agents/skills` is the user's own global skills. The ONE walk
+ * both the trust check and the loader use, over the same spelling and the same git root (#3420
+ * review): paths stay as spelled (resources are compared as strings), and each folder's real path
+ * decides whether it is home or above, so a symlink can't carry the walk past home either way.
+ */
+export function projectAgentsSkillDirs(cwd) {
+    const homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));
+    const startDir = resolvePath(cwd);
+    const gitRepoRoot = findGitRepoRoot(startDir);
+    const dirs = [];
+    let currentDir = startDir;
+    while (!isHomeOrAboveDir(canonicalizePath(currentDir), homeDir)) {
+        dirs.push(join(currentDir, ".agents", "skills"));
+        if (currentDir === gitRepoRoot)
+            break;
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir)
+            break;
+        currentDir = parentDir;
+    }
+    return dirs;
+}
 /**
  * Returns true when cwd has project-local resources that must be gated by
  * project trust: trust-requiring entries under the project config dir or the
- * legacy cwd/.pi dir (whose resources are also discovered), or .agents/skills in
- * cwd or one of its ancestors. Returns false when no such project resources
- * exist. The user/global ~/.agents/skills directory is always treated as a
- * trusted user resource and is ignored here, even when cwd is $HOME.
+ * legacy cwd/.pi dir (whose resources are also discovered), or a project
+ * `.agents/skills` (`projectAgentsSkillDirs`, the same walk the loader uses).
+ * The user's home and every folder above it are never a project: their config
+ * dirs and .agents/skills are the user's own global resources (#2465).
  */
 export function hasTrustRequiringProjectResources(cwd) {
     const homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));
-    const userAgentsSkillsDir = join(homeDir, ".agents", "skills");
-    let currentDir = canonicalizePath(resolvePath(cwd));
-    const configDirs = [join(currentDir, CONFIG_DIR_NAME), join(currentDir, LEGACY_PROJECT_CONFIG_DIR_NAME)];
-    if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
-        return true;
-    }
-    if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
-        return true;
-    while (true) {
-        const agentsSkillsDir = join(currentDir, ".agents", "skills");
-        if (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {
+    const currentDir = canonicalizePath(resolvePath(cwd));
+    if (!isHomeOrAboveDir(currentDir, homeDir)) {
+        const configDirs = [join(currentDir, CONFIG_DIR_NAME), join(currentDir, LEGACY_PROJECT_CONFIG_DIR_NAME)];
+        if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
             return true;
         }
-        const parentDir = dirname(currentDir);
-        if (parentDir === currentDir) {
-            return false;
-        }
-        currentDir = parentDir;
+        if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
+            return true;
     }
+    return projectAgentsSkillDirs(cwd).some((dir) => existsSync(dir));
 }
 export class ProjectTrustStore {
     constructor(agentDir) {

package/dist/main.js

@@ -47,7 +47,7 @@ import { ModelRuntime } from "./core/model-runtime.js";
 import { markMovedSessions, movedHereSessionToContinue, withMovedSessions } from "./core/moved-sessions.js";
 import { restoreStdout, takeOverStdout } from "./core/output-guard.js";
 import { recordProcessLifetime } from "./core/process-crash-record.js";
-import { resolveProjectTrusted } from "./core/project-trust.js";
+import { presetTrustsProject, resolveProjectTrusted } from "./core/project-trust.js";
 import { resolveResumeTarget } from "./core/resume-target.js";
 import { formatMissingSessionCwdPrompt, getMissingSessionCwdIssue, MissingSessionCwdError, } from "./core/session-cwd.js";
 import { sessionExtensionFlagValues } from "./core/session-extension-flags.js";
@@ -677,13 +677,26 @@ export function createCliRuntimeFactory(configuration, local = {}) {
         const projectTrustDiagnostics = [];
         const cachedProjectTrust = projectTrustByCwd.get(cwd);
         const hasTrustRequiringResources = hasTrustRequiringProjectResources(cwd);
-        const shouldResolveProjectTrust = parsed.projectTrustOverride === undefined && cachedProjectTrust === undefined && hasTrustRequiringResources;
+        // A full-access session trusts its project without asking, for that session only: nothing is
+        // cached here or saved to the trust store, and a saved "do not trust" still wins (#2465).
+        const fullAccessTrust = presetTrustsProject(sessionExtensionFlagValues(parsed.unknownFlags, launchProfile).get("permission-preset"), startupSettingsManager.getGlobalSettings().permissionPreset) && trustStore.get(cwd) !== false;
+        const shouldResolveProjectTrust = parsed.projectTrustOverride === undefined &&
+            cachedProjectTrust === undefined &&
+            !fullAccessTrust &&
+            hasTrustRequiringResources;
         const projectTrusted = shouldResolveProjectTrust
             ? false
             : (cachedProjectTrust ??
                 parsed.projectTrustOverride ??
-                (!hasTrustRequiringResources || trustStore.get(cwd) === true));
-        const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
+                (fullAccessTrust || !hasTrustRequiringResources || trustStore.get(cwd) === true));
+        // Trusted only because of Full access (resources need trust and nothing else granted it): leaving
+        // Full access withdraws it (#3420 review T5).
+        const trustFromFullAccess = fullAccessTrust &&
+            hasTrustRequiringResources &&
+            cachedProjectTrust === undefined &&
+            parsed.projectTrustOverride === undefined &&
+            trustStore.get(cwd) !== true;
+        const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted, trustFromFullAccess });
         // The opener's per-session fallback policy is an in-memory override: never saved, never shared.
         if (launchProfile?.retryFallback)
             applyRetryFallbackProfile(runtimeSettingsManager, launchProfile.retryFallback);
@@ -1194,6 +1207,12 @@ export async function main(args, options) {
         reportDiagnostics([{ type: "warning", message: formatThinkingClampWarning(startupThinkingClamp) }]);
     }
     if (appMode !== "interactive") {
+        reportDiagnostics([...(resourceLoader.getAgentsFiles().diagnostics ?? []), ...resourceLoader.getSkills().diagnostics]
+            .filter((diagnostic) => diagnostic.type === "warning" && diagnostic.category === "size-limit")
+            .map((diagnostic) => ({
+            type: "warning",
+            message: diagnostic.path ? `${diagnostic.path}: ${diagnostic.message}` : diagnostic.message,
+        })));
         reportDiagnostics(collectAuthDiagnostics(services.authStorage, "runtime creation"));
     }
     if (runtime.diagnostics.some((diagnostic) => diagnostic.type === "error")) {

package/dist/modes/interactive/interactive-mode.js

@@ -1952,16 +1952,23 @@ export class InteractiveMode {
             }
         }
         if (showDiagnostics) {
-            const addDiagnosticNotice = (title, diagnostics) => {
+            const addDiagnosticNotice = (title, diagnostics, why = "Conflicting or invalid loaded resources were found.") => {
                 this.loadedResourcesContainer.addChild(buildNoticeBox({
                     title,
                     tone: "warning",
-                    why: "Conflicting or invalid loaded resources were found.",
+                    why,
                     extra: this.formatDiagnostics(diagnostics, sourceInfos),
                 }, { expanded: this.toolOutputExpanded }, theme));
                 this.loadedResourcesContainer.addChild(new Spacer(1));
             };
-            const skillDiagnostics = skillsResult.diagnostics;
+            const contextDiagnostics = [
+                ...(this.session.resourceLoader.getAgentsFiles().diagnostics ?? []),
+                ...skillsResult.diagnostics.filter((diagnostic) => diagnostic.category === "size-limit"),
+            ];
+            if (contextDiagnostics.length > 0) {
+                addDiagnosticNotice("Context size limits", contextDiagnostics, "Context files or skill catalogs were limited to keep requests bounded.");
+            }
+            const skillDiagnostics = skillsResult.diagnostics.filter((diagnostic) => diagnostic.category !== "size-limit");
             if (skillDiagnostics.length > 0) {
                 addDiagnosticNotice("Skill conflicts", skillDiagnostics);
             }

package/dist/modes/rpc/abort-grace.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The `abort { awaitIdle }` grace window, shared by the host that enforces it and the client that sizes its
+ * request deadline from it (docs/rpc.md `abort`). Kept free of host imports so the client can load it.
+ */
+export declare const ABORT_DEFAULT_GRACE_MS = 10000;
+export declare const ABORT_MAX_GRACE_MS = 60000;
+/** A `graceMs` the host accepts: a whole number of milliseconds from 0 to {@link ABORT_MAX_GRACE_MS}. */
+export declare function isAbortGraceInRange(graceMs: unknown): graceMs is number;
+//# sourceMappingURL=abort-grace.d.ts.map

package/dist/modes/rpc/abort-grace.js

@@ -0,0 +1,11 @@
+/**
+ * The `abort { awaitIdle }` grace window, shared by the host that enforces it and the client that sizes its
+ * request deadline from it (docs/rpc.md `abort`). Kept free of host imports so the client can load it.
+ */
+export const ABORT_DEFAULT_GRACE_MS = 10_000;
+export const ABORT_MAX_GRACE_MS = 60_000;
+/** A `graceMs` the host accepts: a whole number of milliseconds from 0 to {@link ABORT_MAX_GRACE_MS}. */
+export function isAbortGraceInRange(graceMs) {
+    return typeof graceMs === "number" && Number.isInteger(graceMs) && graceMs >= 0 && graceMs <= ABORT_MAX_GRACE_MS;
+}
+//# sourceMappingURL=abort-grace.js.map

package/dist/modes/rpc/effect-commands.d.ts

@@ -18,8 +18,6 @@ export declare function beginEffect(ctx: EffectCommandContext, kind: EffectComma
     readonly effectId: string;
 }): Promise<EffectBegin | RpcResponse>;
 export declare function isEffectBegin(value: EffectBegin | RpcResponse): value is EffectBegin;
-export declare const ABORT_DEFAULT_GRACE_MS = 10000;
-export declare const ABORT_MAX_GRACE_MS = 60000;
 /**
  * `abort`: with `clearQueue` the queued inputs are drained (each gets a `cleared` receipt) before
  * the abort; with `awaitIdle` the answer waits until the session is idle or `graceMs` passes. Without

package/dist/modes/rpc/effect-commands.js

@@ -1,5 +1,6 @@
 import { ModelUsabilityBudgetError } from "../../core/extensions/builtin/compaction/model-usability-budget.js";
 import { ModelSwitchAuthError } from "../../core/model-switch-auth-error.js";
+import { ABORT_DEFAULT_GRACE_MS, ABORT_MAX_GRACE_MS, isAbortGraceInRange } from "./abort-grace.js";
 import { ClientAdmissions } from "./client-admissions.js";
 import { EffectLedger } from "./effect-ledger.js";
 import { contextBudgetOutcome, EFFECT_OUTCOMES, modelSwitchErrorOutcome, providerUnavailableOutcome, unknownModelOutcome, unsupportedThinkingLevelOutcome, } from "./effect-outcome-copy.js";
@@ -45,13 +46,11 @@ function isResponse(value) {
 export function isEffectBegin(value) {
     return !isResponse(value);
 }
-export const ABORT_DEFAULT_GRACE_MS = 10_000;
-export const ABORT_MAX_GRACE_MS = 60_000;
 function invalidGrace(command) {
     const { graceMs } = command;
     if (graceMs === undefined)
         return undefined;
-    if (Number.isInteger(graceMs) && graceMs >= 0 && graceMs <= ABORT_MAX_GRACE_MS)
+    if (isAbortGraceInRange(graceMs))
         return undefined;
     const reason = "invalid_grace_ms";
     const action = `send graceMs as a whole number of milliseconds from 0 to ${ABORT_MAX_GRACE_MS}`;

package/dist/modes/rpc/host-handover-parked.d.ts

@@ -30,6 +30,12 @@ export interface HandoverParkedEntry {
     readonly sessionContext?: SessionContext;
     readonly autoTitle?: boolean;
     readonly retryFallback?: SessionRetryFallbackProfile;
+    /**
+     * The host instance that wrote the park. Its own reopen watch skips it: the park is for the NEXT
+     * generation, and a host reopening what it just idle-parked races the client's reopen (senpi#3485).
+     * Absent on entries an older generation wrote, which every reader treats as a predecessor's park.
+     */
+    readonly parkedBy?: string;
 }
 export declare function recordHandoverParkedSession(daemonDir: string, entry: HandoverParkedEntry): Promise<void>;
 export declare function readHandoverParkedSessions(daemonDir: string): Promise<readonly HandoverParkedEntry[]>;

package/dist/modes/rpc/host-handover-parked.js

@@ -35,6 +35,7 @@ function isEntry(value) {
         typeof record.retainOnDisconnect === "boolean" &&
         (record.durableSessionId === undefined || typeof record.durableSessionId === "string") &&
         (record.cwd === undefined || typeof record.cwd === "string") &&
+        (record.parkedBy === undefined || typeof record.parkedBy === "string") &&
         (record.thinkingLevel === undefined || typeof record.thinkingLevel === "string") &&
         (record.permissionPreset === undefined ||
             (typeof record.permissionPreset === "string" &&

package/dist/modes/rpc/host-handover-reopen.js

@@ -46,12 +46,12 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
         // it by path with the same durable id.
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
-        const parked = await readHandoverParkedSessions(daemonDir);
+        const parked = await inheritedParks(daemonDir, holder);
         for (const entry of parked) {
             sawAnyPark = true;
             await reopenOne(daemonDir, open, entry, reopenAttempts, heldPolls, holder);
         }
-        const remaining = (await readHandoverParkedSessions(daemonDir)).length;
+        const remaining = (await inheritedParks(daemonDir, holder)).length;
         emptyStreak = remaining === 0 ? emptyStreak + 1 : 0;
         if (sawAnyPark && emptyStreak >= HANDOVER_PARKED_REOPEN_QUIET_STREAK)
             return;
@@ -60,6 +60,15 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
         await new Promise((resolve) => setTimeout(resolve, HANDOVER_PARKED_REOPEN_POLL_MS));
     }
 }
+/**
+ * The parks a PREVIOUS generation left for this one. A park this host wrote itself (its idle sweep
+ * parks retained sessions into the same record) is for its successor: reopening it here would put a
+ * second open of the path in flight against the client reopening it (senpi#3485).
+ */
+async function inheritedParks(daemonDir, holder) {
+    const parked = await readHandoverParkedSessions(daemonDir);
+    return parked.filter((entry) => entry.parkedBy === undefined || entry.parkedBy !== holder?.hostInstance);
+}
 async function reopenOne(daemonDir, open, entry, attempts, heldPolls, holder) {
     await dropHandoverParkedSessionIfFileGone(daemonDir, entry.sessionPath);
     if (!existsSync(entry.sessionPath)) {

package/dist/modes/rpc/rpc-client.d.ts

@@ -22,7 +22,7 @@ export declare class RpcCommandError extends Error {
 }
 import type { SessionEntry, SessionTreeNode } from "../../core/session-manager.ts";
 import type { JsonAgentSessionEvent } from "../json-event.ts";
-import type { EditAssistantMessageResult, EditUserMessageResult, RpcAccountFailoverEvent, RpcAuthAccountsChangedEvent, RpcCommand, RpcEvalCell, RpcEvalCellSnapshot, RpcExtensionEvent, RpcExtensionUIProgress, RpcExtensionUIRequest, RpcExtensionUIResponse, RpcOpenQueuedEvent, RpcProviderAccount, RpcSessionModelEntry, RpcSessionParkedEvent, RpcSessionReplacedEvent, RpcSessionState, RpcSlashCommand, RpcUnloadAnswer } from "./rpc-types.ts";
+import type { EditAssistantMessageResult, EditUserMessageResult, RpcAccountFailoverEvent, RpcAuthAccountsChangedEvent, RpcCommand, RpcEvalCell, RpcEvalCellSnapshot, RpcExtensionEvent, RpcExtensionUIProgress, RpcExtensionUIRequest, RpcExtensionUIResponse, RpcOpenQueuedEvent, RpcProviderAccount, RpcResponse, RpcSessionModelEntry, RpcSessionParkedEvent, RpcSessionReplacedEvent, RpcSessionState, RpcSlashCommand, RpcUnloadAnswer } from "./rpc-types.ts";
 export interface RpcClientOptions {
     /** Connect to an existing multi-session Unix socket instead of spawning a child. */
     socketPath?: string;
@@ -72,6 +72,20 @@ export declare class RpcTransportGoneError extends Error {
     constructor(message?: string);
 }
 export declare function isTransportGoneError(error: unknown): error is RpcTransportGoneError;
+/** The options of a typed `abort` (see `docs/rpc.md`, `abort`). */
+export type RpcAbortOptions = Omit<Extract<RpcCommand, {
+    type: "abort";
+}>, "type" | "id" | "sessionId">;
+/** The host's answer to a typed `abort`; an older host answers with no data. */
+export type RpcAbortAnswer = Extract<RpcResponse, {
+    command: "abort";
+    success: true;
+}>["data"];
+/** `get_effect_status`: the receipt, or proof the whole transcript holds none. */
+export type RpcEffectStatusAnswer = Extract<RpcResponse, {
+    command: "get_effect_status";
+    success: true;
+}>["data"];
 export declare class RpcClientOpenInFlightError extends Error {
     readonly code: "open_session_in_flight";
     constructor();
@@ -222,9 +236,21 @@ export declare class RpcClient {
         enqueueOrder?: number;
     }): Promise<QueuedInputDisposition>;
     /**
-     * Abort current operation.
+     * Abort current operation. With no options this is the fire-and-forget abort it always was (transport
+     * loss resolves). With options it is the typed abort: `effectId` records a receipt, `awaitIdle` answers
+     * once the turn stopped (or `graceMs` passed), `clearQueue` drains queued input first; the host's
+     * answer (`effectId`, `state`, `effect`, `stopped`, `idle`, `cleared`) is returned.
      */
     abort(): Promise<void>;
+    abort(options: RpcAbortOptions): Promise<RpcAbortAnswer>;
+    abort(options?: RpcAbortOptions): Promise<RpcAbortAnswer | undefined>;
+    /**
+     * The newest receipt of one effect (`get_effect_status`, capability `effect_ledger`). With `sessionPath`
+     * the host reads that transcript from disk, so a session no host holds is answered without loading it.
+     */
+    getEffectStatus(effectId: string, options?: {
+        readonly sessionPath?: string;
+    }): Promise<RpcEffectStatusAnswer>;
     /** Abort with host refusals and transport loss surfaced to machine callers. */
     abortStrict(): Promise<void>;
     abortCompaction(): Promise<void>;

package/dist/modes/rpc/rpc-client.js

@@ -20,7 +20,7 @@ export class RpcCommandError extends Error {
     }
 }
 import { attachJsonlLineReader, serializeJsonLine } from "./jsonl.js";
-import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_AFTER_QUEUED_DEADLINE_MS, PROMPT_COMPACTION_DEADLINE_MS, promptStalledMessage, REQUEST_DEADLINE_MS, RpcRequestTimeoutError, } from "./rpc-request-deadline.js";
+import { armRequestDeadline, OPEN_AFTER_QUEUED_DEADLINE_MS, openStalledMessage, PROMPT_ACK_MAX_WAIT_MS, PROMPT_AFTER_QUEUED_DEADLINE_MS, PROMPT_COMPACTION_DEADLINE_MS, promptStalledMessage, REQUEST_DEADLINE_MS, RpcRequestTimeoutError, requestDeadlineMs, } from "./rpc-request-deadline.js";
 import { RPC_ERROR_UNKNOWN_COMMAND } from "./rpc-types.js";
 import { readSocketSecret, resolveSocketTransportAddress, sendSocketHandshake, socketSecretPath, } from "./socket-transport.js";
 import { socketNeedsHandshake } from "./tui-socket.js";
@@ -455,17 +455,30 @@ export class RpcClient {
         // Older hosts omit the disposition; degrade like prompt() so clients render only canonical events.
         return this.getData(response)?.disposition ?? "handled";
     }
+    async abort(options) {
+        if (options === undefined) {
+            try {
+                await this.send({ type: "abort" });
+            }
+            catch (error) {
+                if (!isTransportGoneError(error))
+                    throw error;
+            }
+            return;
+        }
+        return this.getData(await this.send({ ...options, type: "abort" }));
+    }
     /**
-     * Abort current operation.
+     * The newest receipt of one effect (`get_effect_status`, capability `effect_ledger`). With `sessionPath`
+     * the host reads that transcript from disk, so a session no host holds is answered without loading it.
      */
-    async abort() {
-        try {
-            await this.send({ type: "abort" });
-        }
-        catch (error) {
-            if (!isTransportGoneError(error))
-                throw error;
-        }
+    async getEffectStatus(effectId, options = {}) {
+        const command = {
+            type: "get_effect_status",
+            effectId,
+            ...(options.sessionPath === undefined ? {} : { sessionPath: options.sessionPath }),
+        };
+        return this.getData(await this.send(command, options.sessionPath === undefined));
     }
     /** Abort with host refusals and transport loss surfaced to machine callers. */
     async abortStrict() {
@@ -1018,7 +1031,7 @@ export class RpcClient {
             };
             const deadline = armRequestDeadline(command.type === "prompt" && sessionId === this.sessionId && this.isCompacting()
                 ? PROMPT_COMPACTION_DEADLINE_MS
-                : REQUEST_DEADLINE_MS, timeoutMessage, expire);
+                : requestDeadlineMs(command), timeoutMessage, expire);
             // Compaction events extend a prompt's wait, but never past this cap from when it was sent.
             if (command.type === "prompt") {
                 promptCap = setTimeout(() => {

package/dist/modes/rpc/rpc-request-deadline.d.ts

@@ -1,5 +1,17 @@
 /** How long any request waits for the host's answer - for an open, for its `queued` acknowledgement. */
 export declare const REQUEST_DEADLINE_MS = 30000;
+/**
+ * How long one request may wait for its answer before the client gives up. An awaited abort answers only
+ * after the turn stopped or its `graceMs` ran out (up to 60 s), so its wait is that grace plus the
+ * ordinary allowance; every other command keeps the plain request deadline. A `graceMs` the host would
+ * refuse (out of range, fractional, NaN, Infinity) gets the plain deadline too: the host answers it at once
+ * with `invalid_argument`, and the client must still be listening for that refusal.
+ */
+export declare function requestDeadlineMs(command: {
+    readonly type: string;
+    readonly awaitIdle?: unknown;
+    readonly graceMs?: unknown;
+}): number;
 /** Remote compaction may exhaust its budget before a local summary uses its maximum override. */
 export declare const PROMPT_COMPACTION_DEADLINE_MS: number;
 /**

package/dist/modes/rpc/rpc-request-deadline.js

@@ -1,6 +1,21 @@
 import { SUMMARIZATION_MAX_DURATION_CAP_MS, SUMMARIZATION_TOTAL_BUDGET_MS, } from "../../core/compaction/stream-watchdog.js";
+import { ABORT_DEFAULT_GRACE_MS, isAbortGraceInRange } from "./abort-grace.js";
 /** How long any request waits for the host's answer - for an open, for its `queued` acknowledgement. */
 export const REQUEST_DEADLINE_MS = 30_000;
+/**
+ * How long one request may wait for its answer before the client gives up. An awaited abort answers only
+ * after the turn stopped or its `graceMs` ran out (up to 60 s), so its wait is that grace plus the
+ * ordinary allowance; every other command keeps the plain request deadline. A `graceMs` the host would
+ * refuse (out of range, fractional, NaN, Infinity) gets the plain deadline too: the host answers it at once
+ * with `invalid_argument`, and the client must still be listening for that refusal.
+ */
+export function requestDeadlineMs(command) {
+    if (command.type !== "abort" || command.awaitIdle !== true)
+        return REQUEST_DEADLINE_MS;
+    if (command.graceMs === undefined)
+        return ABORT_DEFAULT_GRACE_MS + REQUEST_DEADLINE_MS;
+    return isAbortGraceInRange(command.graceMs) ? command.graceMs + REQUEST_DEADLINE_MS : REQUEST_DEADLINE_MS;
+}
 /** Remote compaction may exhaust its budget before a local summary uses its maximum override. */
 export const PROMPT_COMPACTION_DEADLINE_MS = SUMMARIZATION_TOTAL_BUDGET_MS + SUMMARIZATION_MAX_DURATION_CAP_MS + REQUEST_DEADLINE_MS;
 /**

package/dist/modes/rpc/session-command-router.js

@@ -476,10 +476,13 @@ export class SessionCommandRouter {
             parkedPath !== undefined &&
             retained?.retainOnDisconnect === true &&
             retained.sessionPath !== undefined) {
-            await recordHandoverParkedSession(this.handoverParkedDir, parkedEntryFromProfile({
-                sessionPath: retained.sessionPath,
-                ...(retained.durableSessionId !== undefined ? { durableSessionId: retained.durableSessionId } : {}),
-            }, retained.profile, Object.keys(this.defaults.hostContext ?? {}))).catch((cause) => {
+            await recordHandoverParkedSession(this.handoverParkedDir, {
+                ...parkedEntryFromProfile({
+                    sessionPath: retained.sessionPath,
+                    ...(retained.durableSessionId !== undefined ? { durableSessionId: retained.durableSessionId } : {}),
+                }, retained.profile, Object.keys(this.defaults.hostContext ?? {})),
+                parkedBy: this.defaults.hostContext?.host_instance ?? hostInstanceId(),
+            }).catch((cause) => {
                 process.stderr.write(`senpi rpc handover park record ${sessionId} failed: ${String(cause)}\n`);
             });
         }

package/dist/modes/rpc/session-registry-attach.js

@@ -72,7 +72,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
             }
             return attachToOpenSession(entries, sessionPath, profile, options, pathReservations, now);
         }
-        throw new RpcSessionRegistryError("session_path_in_use");
+        // The path is still reserved by a session that is not serving (a teardown past its grace
+        // window): never a bare refusal, so the caller knows to retry (senpi#3485).
+        throw new RpcSessionRegistryError("session_path_in_use", "the session is still being released", {
+            reason: "path_still_held",
+            retry_after_ms: OPEN_IN_PROGRESS_WAIT_RETRY_MS,
+        });
     }
     const [handle, entry] = existing;
     const wasParked = entry.retainOnDisconnect === true && entry.attachments === 0;

package/dist/modes/rpc/session-registry-claims.d.ts

@@ -2,8 +2,28 @@
  * The registry's path claims: the in-process reservation set and the cross-generation claim
  * (`host-reservations.ts`) follow whatever file each entry's runtime is actually writing.
  */
-import type { SessionPathReservations } from "./host-reservations.ts";
-import type { RpcSessionEntry } from "./session-registry-types.ts";
+import { type SessionPathReservations } from "./host-reservations.ts";
+import { type RpcSessionEntry } from "./session-registry-types.ts";
+/** Opens between their in-process reservation and their entry, by path: their cross-generation claim is in flight. */
+export type PendingClaims = Map<string, Promise<void>>;
+/**
+ * Marks `sessionPath` as mid-claim. The returned settle is called once the open has either recorded
+ * its entry or given the reservation back, so a waiter that wakes always finds one or the other.
+ */
+export declare function beginPendingClaim(pending: PendingClaims, sessionPath: string): () => void;
+/**
+ * Takes the cross-generation claim for an open that already holds the in-process reservation, and
+ * returns the settle `beginPendingClaim` handed out: the caller settles it once its entry is recorded.
+ * A live claim another generation holds gives the reservation back and refuses with the owner.
+ */
+export declare function takeCrossGenerationClaim(reservations: Set<string>, pending: PendingClaims, pathReservations: SessionPathReservations, sessionPath: string): Promise<() => void>;
+/**
+ * Waits out another open of this path that is still taking its claim (senpi#3485). Without the wait
+ * the path looked reserved by no session at all and a reopen was refused for a session about to be
+ * served. Bounded by the close grace window: a claim that never settles (a wedged daemon directory)
+ * ends this open with a retryable `session_path_in_use { reason: "claim_in_progress" }`.
+ */
+export declare function settlePendingClaim(pending: ReadonlyMap<string, Promise<void>>, sessionPath: string, graceMs: number): Promise<void>;
 /** Reconcile path and durable identity after runtime replacement. */
 export declare function syncRuntimeMetadata(entries: Iterable<RpcSessionEntry>, reservations: Set<string>, pathReservations: SessionPathReservations | undefined): void;
 /**

package/dist/modes/rpc/session-registry-claims.js

@@ -1,4 +1,72 @@
+/**
+ * The registry's path claims: the in-process reservation set and the cross-generation claim
+ * (`host-reservations.ts`) follow whatever file each entry's runtime is actually writing.
+ */
+import { SESSION_PATH_RETRY_AFTER_MS } from "./host-reservations.js";
 import { canonicalSessionPath } from "./session-path-key.js";
+import { RpcSessionRegistryError } from "./session-registry-types.js";
+/**
+ * Marks `sessionPath` as mid-claim. The returned settle is called once the open has either recorded
+ * its entry or given the reservation back, so a waiter that wakes always finds one or the other.
+ */
+export function beginPendingClaim(pending, sessionPath) {
+    const settled = Promise.withResolvers();
+    pending.set(sessionPath, settled.promise);
+    return () => {
+        if (pending.get(sessionPath) === settled.promise)
+            pending.delete(sessionPath);
+        settled.resolve();
+    };
+}
+/**
+ * Takes the cross-generation claim for an open that already holds the in-process reservation, and
+ * returns the settle `beginPendingClaim` handed out: the caller settles it once its entry is recorded.
+ * A live claim another generation holds gives the reservation back and refuses with the owner.
+ */
+export async function takeCrossGenerationClaim(reservations, pending, pathReservations, sessionPath) {
+    const settle = beginPendingClaim(pending, sessionPath);
+    let holder;
+    try {
+        holder = await pathReservations.claim(sessionPath);
+    }
+    catch (cause) {
+        reservations.delete(sessionPath);
+        settle();
+        throw cause;
+    }
+    if (holder === undefined)
+        return settle;
+    reservations.delete(sessionPath);
+    settle();
+    throw new RpcSessionRegistryError("session_path_in_use", undefined, {
+        owner: holder,
+        retry_after_ms: SESSION_PATH_RETRY_AFTER_MS,
+    });
+}
+/**
+ * Waits out another open of this path that is still taking its claim (senpi#3485). Without the wait
+ * the path looked reserved by no session at all and a reopen was refused for a session about to be
+ * served. Bounded by the close grace window: a claim that never settles (a wedged daemon directory)
+ * ends this open with a retryable `session_path_in_use { reason: "claim_in_progress" }`.
+ */
+export async function settlePendingClaim(pending, sessionPath, graceMs) {
+    let timer;
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("late"), graceMs);
+    });
+    try {
+        for (let claim = pending.get(sessionPath); claim !== undefined; claim = pending.get(sessionPath)) {
+            if ((await Promise.race([claim.then(() => "settled"), late])) === "late")
+                throw new RpcSessionRegistryError("session_path_in_use", "another open of this path is still taking its claim", {
+                    reason: "claim_in_progress",
+                    retry_after_ms: SESSION_PATH_RETRY_AFTER_MS,
+                });
+        }
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** Reconcile path and durable identity after runtime replacement. */
 export function syncRuntimeMetadata(entries, reservations, pathReservations) {
     for (const entry of entries) {

package/dist/modes/rpc/session-registry-opening.d.ts

@@ -0,0 +1,23 @@
+import type { SessionStartEvent } from "../../core/extensions/types.ts";
+import type { PreparableRuntimeFactory } from "./host-warm.ts";
+import { type RpcSessionEntry, type RpcSessionLaunchProfile, type RpcSessionOpenOptions } from "./session-registry-types.ts";
+export interface OpeningEntry {
+    readonly entry: RpcSessionEntry;
+    readonly storedProfile: RpcSessionLaunchProfile;
+    readonly runtimeProfile: RpcSessionLaunchProfile;
+    readonly sessionStartEvent: SessionStartEvent | undefined;
+    readonly settleOpen: {
+        readonly resolve: () => void;
+        readonly reject: (cause: unknown) => void;
+    };
+}
+export declare function buildOpeningEntry(input: {
+    readonly profile: RpcSessionLaunchProfile;
+    readonly sessionPath: string | undefined;
+    readonly requestedDurableId: string | undefined;
+    readonly options: RpcSessionOpenOptions | undefined;
+    readonly now: number;
+    readonly createRuntime: PreparableRuntimeFactory;
+    readonly sync: () => void;
+}): OpeningEntry;
+//# sourceMappingURL=session-registry-opening.d.ts.map