@code-yeongyu/senpi 2026.10.18-1 → 2026.10.19

package/dist/modes/rpc/rpc-input-validation.js

@@ -119,6 +119,14 @@ export function rpcCommandPayloadError(command) {
         !(typeof value.effectId === "string" && value.effectId.length > 0 && value.effectId.length <= 256)) {
         return "effectId must be a non-empty string of at most 256 characters.";
     }
+    if (value.type === "get_pending_inputs" && value.knownClientMessageIds !== undefined) {
+        const ids = value.knownClientMessageIds;
+        if (!Array.isArray(ids) ||
+            ids.length > 64 ||
+            !ids.every((id) => typeof id === "string" && id.length > 0 && id.length <= 256)) {
+            return "knownClientMessageIds must be an array of at most 64 non-empty strings of at most 256 characters.";
+        }
+    }
     if (value.type === "get_effect_status" && value.sessionPath !== undefined && typeof value.sessionPath !== "string") {
         return "sessionPath must be a string.";
     }

package/dist/modes/rpc/rpc-types.d.ts

@@ -19,6 +19,7 @@ import type { EngineOrdinal } from "../../core/engine-build-identity.ts";
 import type { ServiceTier } from "../../core/extensions/builtin/service-tier.ts";
 import type { ContextUsage, SessionControlAdmission, SessionKind } from "../../core/extensions/types.ts";
 import type { ResolvedMessagePath } from "../../core/message-path-resolution.ts";
+import type { PendingInputSnapshot, PendingInputUpdate } from "../../core/pending-input-session.ts";
 import type { SessionEntry, SessionMessageEntry, SessionTreeNode, UsageTotals } from "../../core/session-manager.ts";
 import type { SourceInfo } from "../../core/source-info.ts";
 import type { ApiKeyVerification } from "../../core/verify-api-key.ts";
@@ -165,6 +166,16 @@ type RpcSessionCommand = {
     type: "get_effect_status";
     effectId: string;
     sessionPath?: string;
+}
+/**
+ * The pending inputs in durable custody (queued, sending, failed) and an explicit outcome for each listed id,
+ * consistent through `throughCursor` (senpi#3549). Subscribe to `pending_input_update` first, then apply this
+ * snapshot and only updates after its cursor. At most 64 ids.
+ */
+ | {
+    id?: string;
+    type: "get_pending_inputs";
+    knownClientMessageIds?: string[];
 } | {
     id?: string;
     type: "set_model";
@@ -689,7 +700,10 @@ export type RpcCommand = (RpcSessionCommand & {
      */
     type: "release_session";
     sessionId: string;
-    reason: "takeover";
+    /** `move` seals the file for a move to another device (`moveId` required); writes are refused here after. */
+    reason: "takeover" | "move";
+    moveId?: string;
+    target?: string;
     interrupt?: boolean;
     force?: boolean;
 } | {
@@ -1202,6 +1216,12 @@ export type RpcResponse = {
         found: false;
         searched: "complete";
     };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_pending_inputs";
+    success: true;
+    data: PendingInputSnapshot;
 } | {
     id?: string;
     type: "response";
@@ -1824,6 +1844,10 @@ export interface RpcHighReasoningWarningEvent {
     provider: string;
     thinkingLevel: ThinkingLevel;
 }
+/** A pending input in durable custody changed; `changes` are complete projections, in cursor order. */
+export type RpcPendingInputUpdateEvent = {
+    type: "pending_input_update";
+} & PendingInputUpdate;
 /** Emitted after explicit skill tokens are expanded for a user-authored request. */
 export interface RpcSkillInvocationEvent {
     type: "skill_invocation";

package/dist/modes/rpc/session-command-activity.js

@@ -2,6 +2,7 @@
 const observations = new Set([
     "get_state",
     "get_effect_status",
+    "get_pending_inputs",
     "get_messages",
     "get_entries",
     "get_tree",

package/dist/modes/rpc/session-control-actions-data.js

@@ -6,15 +6,24 @@
 import { modelSupportsAssistantPrefill } from "@earendil-works/pi-ai";
 import { getSupportedThinkingLevels } from "../../core/thinking-levels.js";
 export async function availableModelsData(session) {
-    const models = await session.modelRegistry.modelRuntime.getAvailable();
+    const registry = session.modelRegistry;
+    const models = await registry.modelRuntime.getAvailable();
     return {
-        models: models.map((model) => ({
-            ...model,
-            supportedThinkingLevels: getSupportedThinkingLevels(model),
-            supportsAssistantPrefill: modelSupportsAssistantPrefill(model, {
-                thinkingEnabled: session.thinkingLevel !== "off",
-            }),
-        })),
+        models: models.map((model) => {
+            // A models.json or extension definition can declare the priority pairing without putting it on
+            // the Model object; clients must see the values the session itself acts on (#3666).
+            const serviceTier = registry.getServiceTier(model);
+            const upstreamModelId = registry.getUpstreamModelId(model);
+            return {
+                ...model,
+                ...(serviceTier === undefined ? {} : { serviceTier }),
+                ...(upstreamModelId === undefined ? {} : { upstreamModelId }),
+                supportedThinkingLevels: getSupportedThinkingLevels(model),
+                supportsAssistantPrefill: modelSupportsAssistantPrefill(model, {
+                    thinkingEnabled: session.thinkingLevel !== "off",
+                }),
+            };
+        }),
     };
 }
 /** The refusal of a level the active model cannot run; callers match this text. */

package/dist/modes/rpc/session-held.js

@@ -9,6 +9,7 @@ import { RpcSessionRegistryError } from "./session-registry-types.js";
 const READ_ONLY_OR_CONTROL = new Set([
     "get_state",
     "get_effect_status",
+    "get_pending_inputs",
     "get_steering_messages",
     "get_follow_up_messages",
     "get_available_models",

package/dist/modes/rpc/session-release.js

@@ -1,3 +1,4 @@
+import { SessionMovedAwayError } from "../../core/session-move/ownership.js";
 import { isHandoffBusy } from "./handoff-activity.js";
 import { RPC_ERROR_ATTACHED, RPC_ERROR_HOST_DRAINING, RPC_ERROR_INVALID_RELEASE_REASON, RPC_ERROR_RELEASE_FAILED, RPC_ERROR_RELEASE_UNSUPPORTED, RPC_ERROR_SESSION_BUSY, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_TURN_ACTIVE, } from "./rpc-types.js";
 import { abortAndSettle, NOTHING_DROPPED, takeQueuedInput, } from "./session-release-interrupt.js";
@@ -8,7 +9,8 @@ export const RELEASED_ADMISSION_CLOSED = "release_session handed this session to
 /** `errorData.hint` of a refusal whose `busy` names `queued`: only an interrupt hands that input back. */
 export const RELEASE_QUEUED_HINT = "queued user input is still owed a turn; release with interrupt: true to take it out and receive it in dropped.user_messages";
 export async function releaseSession(port, command) {
-    if (command.reason !== "takeover")
+    const validMove = command.reason === "move" && typeof command.moveId === "string" && command.moveId !== "";
+    if (command.reason !== "takeover" && !validMove)
         return refusal(command.id, RPC_ERROR_INVALID_RELEASE_REASON);
     if (port.draining())
         return refusal(command.id, RPC_ERROR_HOST_DRAINING);
@@ -30,6 +32,8 @@ export async function releaseSession(port, command) {
             admission.close(RELEASED_ADMISSION_CLOSED);
             dropped = takeQueuedInput(first.session);
             await abortAndSettle(port, command.sessionId, first.session);
+            // What the clear retired is on disk before `session_released` seals the file (senpi#3549).
+            await first.session.whenQueueClearRecorded();
         }
         // A never-written session gets its file here, before the final check: its `session_released` entry
         // must reach disk, and a header write that fails is this release's failure, never a stray rejection.
@@ -41,6 +45,10 @@ export async function releaseSession(port, command) {
         return answer;
     }
     catch (cause) {
+        if (cause instanceof SessionMovedAwayError) {
+            answer = refusal(command.id, cause.code, { detail: cause.message });
+            return answer;
+        }
         answer = refusal(command.id, RPC_ERROR_RELEASE_FAILED, {
             detail: cause instanceof Error ? cause.message : String(cause),
             ...(interrupted ? { interrupted: true, dropped } : {}),
@@ -78,6 +86,13 @@ async function claimAndRelease(port, command, interrupted, dropped) {
         // On disk or not at all: a failed write leaves no entry a later append could chain onto.
         ready.session.sessionManager.appendCustomEntry(SESSION_RELEASED_ENTRY_TYPE, {
             reason: command.reason,
+            ...(command.reason === "move"
+                ? {
+                    move_id: command.moveId,
+                    target: command.target ?? "",
+                    session_id: ready.session.sessionManager.getSessionId(),
+                }
+                : {}),
             interrupted,
             attachments: ready.attachments,
             host_instance: port.hostInstance ?? null,

package/dist/modes/rpc/tool-child/admission.d.ts

@@ -0,0 +1,42 @@
+import { type ToolChildMessageOf } from "./protocol.ts";
+/**
+ * The one host-call capacity both sides enforce: `HOST_CALL_ACTIVE` running plus `HOST_CALL_WAITING` queued (264).
+ * The child admits against it before sending, the server admits against it on receipt; there is no second constant.
+ */
+export declare function hostCallCapacity(): number;
+export type HostCallRefusalCode = "host_call_capacity" | "host_call_duplicate";
+export type HostCallDecision = {
+    state: "active";
+} | {
+    state: "waiting";
+} | {
+    state: "refused";
+    frame: ToolChildMessageOf<"host_call_refused">;
+};
+/** Lossless host-call admission: a call is running, queued FIFO, or refused with a frame naming its `callId`. */
+export declare class HostCallAdmission {
+    #private;
+    get active(): number;
+    get waiting(): number;
+    submit(callId: string): HostCallDecision;
+    /** Ends a call (or withdraws a queued one) and returns the call promoted into the freed active slot, if any. */
+    settle(callId: string): string | undefined;
+}
+export type JobRefusalCode = "tool_child_jobs_full" | "tool_child_nested_full" | "tool_child_parent_unknown" | "tool_child_job_duplicate";
+export type JobDecision = {
+    admitted: true;
+} | {
+    admitted: false;
+    frame: ToolChildMessageOf<"job_refused">;
+};
+/**
+ * Per-child job budget. Ordinary jobs are capped at `TOOL_CHILD_LIMITS.jobs`. A nested job (started on behalf of a
+ * running job, e.g. a tool an eval cell calls) is admitted past that cap, so a full child cannot deadlock its own
+ * callers; nested jobs arrive through host calls and are bounded by `hostCallCapacity()`.
+ */
+export declare class JobAdmission {
+    #private;
+    admit(jobId: string, parentJobId?: string): JobDecision;
+    finish(jobId: string): void;
+}
+//# sourceMappingURL=admission.d.ts.map

package/dist/modes/rpc/tool-child/admission.js

@@ -0,0 +1,81 @@
+import { TOOL_CHILD_LIMITS } from "./protocol.js";
+/**
+ * The one host-call capacity both sides enforce: `HOST_CALL_ACTIVE` running plus `HOST_CALL_WAITING` queued (264).
+ * The child admits against it before sending, the server admits against it on receipt; there is no second constant.
+ */
+export function hostCallCapacity() {
+    return TOOL_CHILD_LIMITS.HOST_CALL_ACTIVE + TOOL_CHILD_LIMITS.HOST_CALL_WAITING;
+}
+/** Lossless host-call admission: a call is running, queued FIFO, or refused with a frame naming its `callId`. */
+export class HostCallAdmission {
+    #active = new Set();
+    #waiting = [];
+    get active() {
+        return this.#active.size;
+    }
+    get waiting() {
+        return this.#waiting.length;
+    }
+    submit(callId) {
+        if (this.#active.has(callId) || this.#waiting.includes(callId))
+            return refuse(callId, "host_call_duplicate");
+        if (this.#active.size < TOOL_CHILD_LIMITS.HOST_CALL_ACTIVE && this.#waiting.length === 0) {
+            this.#active.add(callId);
+            return { state: "active" };
+        }
+        if (this.#active.size + this.#waiting.length >= hostCallCapacity())
+            return refuse(callId, "host_call_capacity");
+        this.#waiting.push(callId);
+        return { state: "waiting" };
+    }
+    /** Ends a call (or withdraws a queued one) and returns the call promoted into the freed active slot, if any. */
+    settle(callId) {
+        if (!this.#active.delete(callId)) {
+            const index = this.#waiting.indexOf(callId);
+            if (index >= 0)
+                this.#waiting.splice(index, 1);
+            return undefined;
+        }
+        const next = this.#waiting.shift();
+        if (next !== undefined)
+            this.#active.add(next);
+        return next;
+    }
+}
+function refuse(callId, code) {
+    return { state: "refused", frame: { type: "host_call_refused", callId, code } };
+}
+/**
+ * Per-child job budget. Ordinary jobs are capped at `TOOL_CHILD_LIMITS.jobs`. A nested job (started on behalf of a
+ * running job, e.g. a tool an eval cell calls) is admitted past that cap, so a full child cannot deadlock its own
+ * callers; nested jobs arrive through host calls and are bounded by `hostCallCapacity()`.
+ */
+export class JobAdmission {
+    #ordinary = new Set();
+    #nested = new Map();
+    admit(jobId, parentJobId) {
+        if (this.#ordinary.has(jobId) || this.#nested.has(jobId))
+            return refuseJob(jobId, "tool_child_job_duplicate");
+        if (parentJobId === undefined) {
+            if (this.#ordinary.size >= TOOL_CHILD_LIMITS.jobs)
+                return refuseJob(jobId, "tool_child_jobs_full");
+            this.#ordinary.add(jobId);
+            return { admitted: true };
+        }
+        if (!this.#ordinary.has(parentJobId) && !this.#nested.has(parentJobId)) {
+            return refuseJob(jobId, "tool_child_parent_unknown");
+        }
+        if (this.#nested.size >= hostCallCapacity())
+            return refuseJob(jobId, "tool_child_nested_full");
+        this.#nested.set(jobId, parentJobId);
+        return { admitted: true };
+    }
+    finish(jobId) {
+        this.#ordinary.delete(jobId);
+        this.#nested.delete(jobId);
+    }
+}
+function refuseJob(jobId, code) {
+    return { admitted: false, frame: { type: "job_refused", jobId, code } };
+}
+//# sourceMappingURL=admission.js.map

package/dist/modes/rpc/tool-child/admission.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admission.test.d.ts.map

package/dist/modes/rpc/tool-child/admission.test.js

@@ -0,0 +1,166 @@
+import { describe, expect, it } from "vitest";
+import { HostCallAdmission, hostCallCapacity, JobAdmission } from "./admission.js";
+import { encodeFrame, FrameDecoder } from "./codec.js";
+import { isLossy, TraceBudget, WakeAdmission, WakeAdmissionError } from "./flow-control.js";
+import { LOSSY_FRAME_TYPES, TOOL_CHILD_LIMITS } from "./protocol.js";
+import { isToolChildMessage } from "./protocol-guard.js";
+const callId = (index) => `call-${index}`;
+function submitMany(admission, count) {
+    const states = { active: 0, waiting: 0, refused: [] };
+    for (let index = 1; index <= count; index += 1) {
+        const decision = admission.submit(callId(index));
+        if (decision.state === "refused")
+            states.refused.push(decision.frame.callId);
+        else
+            states[decision.state] += 1;
+    }
+    return states;
+}
+/** One loop turn: enough for an already-resolved promise to settle, never a timed wait. */
+const turn = () => new Promise((resolve) => setImmediate(resolve));
+function tracked(promise) {
+    const state = { settled: false };
+    promise.then(() => {
+        state.settled = true;
+    });
+    return state;
+}
+describe("host-call admission", () => {
+    it("has one capacity: 8 active + 256 waiting = 264", () => {
+        expect(hostCallCapacity()).toBe(264);
+        expect(hostCallCapacity()).toBe(TOOL_CHILD_LIMITS.HOST_CALL_ACTIVE + TOOL_CHILD_LIMITS.HOST_CALL_WAITING);
+    });
+    it("264 concurrent submissions -> 8 active, 256 waiting, 0 refused", () => {
+        const admission = new HostCallAdmission();
+        expect(submitMany(admission, 264)).toEqual({ active: 8, waiting: 256, refused: [] });
+        expect(admission.active).toBe(8);
+        expect(admission.waiting).toBe(256);
+    });
+    it("265 -> exactly the 265th is refused with a correlated host_call_refused frame", () => {
+        const admission = new HostCallAdmission();
+        expect(submitMany(admission, 265).refused).toEqual(["call-265"]);
+        const decision = new HostCallAdmission().submit("x");
+        expect(decision.state).toBe("active");
+        const full = new HostCallAdmission();
+        submitMany(full, 264);
+        const refused = full.submit("call-265");
+        if (refused.state !== "refused")
+            throw new Error("expected a refusal");
+        expect(refused.frame).toEqual({ type: "host_call_refused", callId: "call-265", code: "host_call_capacity" });
+        expect(isToolChildMessage(refused.frame)).toBe(true);
+        expect(new FrameDecoder().push(encodeFrame(refused.frame))).toEqual([refused.frame]);
+    });
+    it("promotes waiting calls in FIFO order", () => {
+        const admission = new HostCallAdmission();
+        submitMany(admission, 264);
+        const promoted = [];
+        for (let index = 1; index <= 264; index += 1)
+            promoted.push(admission.settle(callId(index)));
+        expect(promoted.slice(0, 256)).toEqual(Array.from({ length: 256 }, (_, offset) => callId(offset + 9)));
+        expect(promoted.slice(256)).toEqual(Array(8).fill(undefined));
+        expect(admission.active + admission.waiting).toBe(0);
+    });
+    it("child and server share the capacity: the child never forwards a call the server would refuse", () => {
+        const child = new HostCallAdmission();
+        const server = new HostCallAdmission();
+        const refusedByServer = [];
+        for (let index = 1; index <= 300; index += 1) {
+            if (child.submit(callId(index)).state === "refused")
+                continue;
+            const decision = server.submit(callId(index));
+            if (decision.state === "refused")
+                refusedByServer.push(decision.frame.callId);
+        }
+        expect(refusedByServer).toEqual([]);
+        expect(server.active + server.waiting).toBe(hostCallCapacity());
+    });
+    it("refuses a duplicate call id", () => {
+        const admission = new HostCallAdmission();
+        admission.submit("same");
+        const duplicate = admission.submit("same");
+        expect(duplicate.state === "refused" && duplicate.frame.code).toBe("host_call_duplicate");
+    });
+});
+describe("job admission", () => {
+    it("refuses the 33rd ordinary job while a nested job is still admitted", () => {
+        const jobs = new JobAdmission();
+        for (let index = 1; index <= 32; index += 1)
+            expect(jobs.admit(`job-${index}`)).toEqual({ admitted: true });
+        expect(jobs.admit("job-33")).toEqual({
+            admitted: false,
+            frame: { type: "job_refused", jobId: "job-33", code: "tool_child_jobs_full" },
+        });
+        expect(jobs.admit("nested-1", "job-1")).toEqual({ admitted: true });
+        expect(jobs.admit("nested-2", "missing")).toEqual({
+            admitted: false,
+            frame: { type: "job_refused", jobId: "nested-2", code: "tool_child_parent_unknown" },
+        });
+        jobs.finish("job-2");
+        expect(jobs.admit("job-33")).toEqual({ admitted: true });
+    });
+    it("bounds nested jobs by the host-call capacity, not by a second constant", () => {
+        const jobs = new JobAdmission();
+        jobs.admit("parent");
+        for (let index = 1; index <= hostCallCapacity(); index += 1) {
+            expect(jobs.admit(`nested-${index}`, "parent")).toEqual({ admitted: true });
+        }
+        const over = jobs.admit("nested-over", "parent");
+        expect(over.admitted === false && over.frame.code).toBe("tool_child_nested_full");
+    });
+});
+describe("wake flow control", () => {
+    it("the 65th pending wake waits for wake_ack and is never dropped", async () => {
+        const wakes = new WakeAdmission();
+        for (let index = 1; index <= 64; index += 1)
+            await wakes.send(`w-${index}`, 10);
+        const sixtyFifth = tracked(wakes.send("w-65", 10));
+        const sixtySixth = tracked(wakes.send("w-66", 10));
+        await turn();
+        expect(sixtyFifth.settled).toBe(false);
+        expect(wakes.blocked).toBe(2);
+        expect(wakes.pending).toBe(64);
+        wakes.ack("w-1");
+        await turn();
+        expect(sixtyFifth.settled).toBe(true);
+        expect(sixtySixth.settled).toBe(false);
+        wakes.ack("w-2");
+        await turn();
+        expect(sixtySixth.settled).toBe(true);
+        expect(wakes.pending).toBe(64);
+        expect(wakes.blocked).toBe(0);
+    });
+    it("bounds pending wakes by summed bytes and refuses one larger than the whole budget", async () => {
+        const wakes = new WakeAdmission();
+        const part = 600 * 1024;
+        await wakes.send("a", part);
+        const second = tracked(wakes.send("b", part));
+        await turn();
+        expect(second.settled).toBe(false);
+        wakes.ack("a");
+        await turn();
+        expect(second.settled).toBe(true);
+        await expect(wakes.send("huge", TOOL_CHILD_LIMITS.wakePendingBytes + 1)).rejects.toBeInstanceOf(WakeAdmissionError);
+    });
+});
+describe("trace budget", () => {
+    it("drops and counts the 1,025th trace frame in one second, then admits again in the next", () => {
+        const budget = new TraceBudget();
+        const frame = { type: "trace", atMs: 0, event: "tick" };
+        const admitted = Array.from({ length: 1025 }, () => budget.admit(frame, 5_000));
+        expect(admitted.filter(Boolean)).toHaveLength(1024);
+        expect(admitted.at(-1)).toBe(false);
+        expect(budget.dropped).toBe(1);
+        expect(budget.admit(frame, 6_000)).toBe(true);
+        expect(budget.dropped).toBe(1);
+    });
+    it("trace is the only lossy class; results, proofs and ticks are never lossy", () => {
+        expect([...LOSSY_FRAME_TYPES]).toEqual(["trace"]);
+        expect(isLossy({ type: "trace", atMs: 1, event: "e" })).toBe(true);
+        expect(isLossy({ type: "launch_proof", launchId: "l", ackTick: 1, invokeTick: 2 })).toBe(false);
+        expect(isLossy({ type: "result", jobId: "j", value: 1 })).toBe(false);
+        expect(isLossy({ type: "slot_state", launchId: "l", ackTick: 1, invokeTick: 2, invocations: 1 })).toBe(false);
+        expect(isToolChildMessage({ type: "trace", atMs: 1, event: "e", detail: { invokeTick: 2 } })).toBe(false);
+        expect(isToolChildMessage({ type: "trace", atMs: 1, event: "e", result: 1 })).toBe(false);
+    });
+});
+//# sourceMappingURL=admission.test.js.map

package/dist/modes/rpc/tool-child/codec.d.ts

@@ -0,0 +1,21 @@
+import { type ToolChildMessage } from "./protocol.ts";
+export type ToolChildCodecErrorCode = "tool_child_frame_too_large" | "tool_child_truncated" | "tool_child_malformed" | "tool_child_encode_invalid";
+export declare class ToolChildCodecError extends Error {
+    readonly code: ToolChildCodecErrorCode;
+    constructor(code: ToolChildCodecErrorCode, message: string);
+}
+/** A frame is a 4-byte big-endian body length followed by that many bytes of UTF-8 JSON. No delimiter, no NDJSON. */
+export declare const FRAME_HEADER_BYTES = 4;
+export declare function encodeFrame(message: ToolChildMessage): Uint8Array;
+/**
+ * Incremental decoder for one channel direction. A length header above the cap is refused as soon as its four bytes
+ * arrive, before any body buffer exists. Any codec error is terminal: the stream is never resynchronized, so nothing
+ * after a bad frame can be silently skipped.
+ */
+export declare class FrameDecoder {
+    #private;
+    get bufferedBytes(): number;
+    push(chunk: Uint8Array): ToolChildMessage[];
+    end(): void;
+}
+//# sourceMappingURL=codec.d.ts.map

package/dist/modes/rpc/tool-child/codec.js

@@ -0,0 +1,137 @@
+import { TOOL_CHILD_LIMITS } from "./protocol.js";
+import { isToolChildMessage } from "./protocol-guard.js";
+export class ToolChildCodecError extends Error {
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = "ToolChildCodecError";
+        this.code = code;
+    }
+}
+/** A frame is a 4-byte big-endian body length followed by that many bytes of UTF-8 JSON. No delimiter, no NDJSON. */
+export const FRAME_HEADER_BYTES = 4;
+const tooLarge = (bytes) => new ToolChildCodecError("tool_child_frame_too_large", `${bytes} bytes exceeds ${TOOL_CHILD_LIMITS.frameBytes}`);
+export function encodeFrame(message) {
+    // JSON.stringify drops undefined-valued properties (what optional fields rely on) and natively serializes
+    // NaN/Infinity as null on BOTH the inline and the ref path, so payload contents encode identically either way.
+    // The one case JSON cannot represent is a REQUIRED json field that is undefined (today only result.value - a
+    // tool returning undefined); it becomes an explicit null the guard takes. The round-trip with the decoder's own
+    // predicate refuses anything else unsendable HERE - a typed per-message error, never a channel-killing frame
+    // (senpi#3569 delta review: optional undefined must keep stringify's default drop).
+    const normalized = message.type === "result" && message.value === undefined ? { ...message, value: null } : message;
+    const json = JSON.stringify(normalized);
+    const bodyBytes = Buffer.byteLength(json, "utf8");
+    if (bodyBytes > TOOL_CHILD_LIMITS.frameBytes)
+        throw tooLarge(bodyBytes);
+    if (!isToolChildMessage(JSON.parse(json))) {
+        throw new ToolChildCodecError("tool_child_encode_invalid", "the message serializes to a frame the peer's guard rejects");
+    }
+    return frameFromBody(json, bodyBytes);
+}
+function frameFromBody(json, bodyBytes) {
+    const frame = Buffer.allocUnsafe(FRAME_HEADER_BYTES + bodyBytes);
+    frame.writeUInt32BE(bodyBytes, 0);
+    frame.write(json, FRAME_HEADER_BYTES, "utf8");
+    return frame;
+}
+function parseBody(body) {
+    let value;
+    try {
+        value = JSON.parse(body.toString("utf8"));
+    }
+    catch {
+        throw new ToolChildCodecError("tool_child_malformed", "frame body is not JSON");
+    }
+    if (!isToolChildMessage(value))
+        throw new ToolChildCodecError("tool_child_malformed", "frame is not a protocol message");
+    return value;
+}
+/**
+ * Incremental decoder for one channel direction. A length header above the cap is refused as soon as its four bytes
+ * arrive, before any body buffer exists. Any codec error is terminal: the stream is never resynchronized, so nothing
+ * after a bad frame can be silently skipped.
+ */
+export class FrameDecoder {
+    #chunks = [];
+    #buffered = 0;
+    #bodyBytes;
+    #failure;
+    get bufferedBytes() {
+        return this.#buffered;
+    }
+    push(chunk) {
+        if (this.#failure)
+            throw this.#failure;
+        if (chunk.length > 0) {
+            this.#chunks.push(Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+            this.#buffered += chunk.length;
+        }
+        const messages = [];
+        try {
+            for (;;) {
+                if (this.#bodyBytes === undefined) {
+                    if (this.#buffered < FRAME_HEADER_BYTES)
+                        break;
+                    const length = this.#take(FRAME_HEADER_BYTES).readUInt32BE(0);
+                    if (length > TOOL_CHILD_LIMITS.frameBytes)
+                        throw tooLarge(length);
+                    this.#bodyBytes = length;
+                }
+                if (this.#buffered < this.#bodyBytes)
+                    break;
+                const body = this.#take(this.#bodyBytes);
+                this.#bodyBytes = undefined;
+                messages.push(parseBody(body));
+            }
+        }
+        catch (error) {
+            if (error instanceof ToolChildCodecError)
+                this.#fail(error);
+            throw error;
+        }
+        return messages;
+    }
+    end() {
+        if (this.#failure)
+            throw this.#failure;
+        if (this.#buffered === 0 && this.#bodyBytes === undefined)
+            return;
+        const truncated = new ToolChildCodecError("tool_child_truncated", `stream ended inside a frame (${this.#buffered} of ${this.#bodyBytes ?? FRAME_HEADER_BYTES} bytes)`);
+        this.#fail(truncated);
+        throw truncated;
+    }
+    #fail(error) {
+        this.#failure = error;
+        this.#chunks = [];
+        this.#buffered = 0;
+        this.#bodyBytes = undefined;
+    }
+    #take(bytes) {
+        const first = this.#chunks[0];
+        if (first !== undefined && first.length >= bytes) {
+            const taken = first.subarray(0, bytes);
+            if (first.length === bytes)
+                this.#chunks.shift();
+            else
+                this.#chunks[0] = first.subarray(bytes);
+            this.#buffered -= bytes;
+            return taken;
+        }
+        const out = Buffer.allocUnsafe(bytes);
+        let filled = 0;
+        while (filled < bytes) {
+            const chunk = this.#chunks[0];
+            if (chunk === undefined)
+                break;
+            const count = Math.min(chunk.length, bytes - filled);
+            chunk.copy(out, filled, 0, count);
+            filled += count;
+            if (count === chunk.length)
+                this.#chunks.shift();
+            else
+                this.#chunks[0] = chunk.subarray(count);
+        }
+        this.#buffered -= bytes;
+        return out;
+    }
+}
+//# sourceMappingURL=codec.js.map

package/dist/modes/rpc/tool-child/codec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=codec.test.d.ts.map