@code-yeongyu/senpi 2026.10.18 → 2026.10.19

package/dist/core/keybindings.d.ts

@@ -51,7 +51,7 @@ export interface AppKeybindings {
     "app.tree.filter.cycleBackward": true;
 }
 export type AppKeybinding = keyof AppKeybindings;
-export declare function useWindowsKeybindings(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
+export declare function useWindowsKeybindings(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, procVersionPath?: string): boolean;
 declare module "@earendil-works/pi-tui" {
     interface Keybindings extends AppKeybindings {
     }

package/dist/core/keybindings.js

@@ -3,8 +3,9 @@ import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 import { getAgentDir } from "../config.js";
 import { stripBom } from "../utils/text.js";
-export function useWindowsKeybindings(platform = process.platform, env = process.env) {
-    return platform === "win32" || (platform === "linux" && Boolean(env.WSL_DISTRO_NAME || env.WSL_INTEROP));
+import { isWSL } from "../utils/wsl.js";
+export function useWindowsKeybindings(platform = process.platform, env = process.env, procVersionPath) {
+    return platform === "win32" || (platform === "linux" && isWSL(env, procVersionPath));
 }
 const windowsKeybindings = useWindowsKeybindings();
 export const QUESTION_ANSWER_PRIMARY_KEY = "alt+up";

package/dist/core/model-resolver.js

@@ -11,7 +11,7 @@ import { ultrafastSelectionWarning } from "./ultrafast-lanes.js";
 /** Default model IDs for each known provider */
 export const defaultModelPerProvider = {
     "alibaba-token-plan": "qwen3.7-max",
-    "amazon-bedrock": "us.anthropic.claude-opus-4-6-v1",
+    "amazon-bedrock": "us.anthropic.claude-opus-5-5",
     "ant-ling": "Ring-2.6-1T",
     "anthropic-subscription": "claude-opus-5-5",
     anthropic: "claude-opus-5-5",

package/dist/core/pending-input-journal.d.ts

@@ -24,8 +24,13 @@ export declare class SessionPendingInputJournal implements PendingInputJournal {
      * its directory are synced before this returns.
      */
     append(record: PendingInputJournalRecord): Promise<void>;
-    private refuseCorruptTransitionLines;
     read(): Promise<readonly PendingInputJournalRecord[]>;
+    /**
+     * A persisted session's transitions come from one streaming pass over its file, never from `getEntries()`:
+     * on a trimmed session that would materialize and keep the whole history (senpi#3519, #3535). An in-memory
+     * session has no file, so its entries are the journal.
+     */
+    private transitionEntries;
 }
 export declare class PendingInputJournalCorruptError extends Error {
     readonly code = "pending_input_journal_corrupt";

package/dist/core/pending-input-journal.js

@@ -1,5 +1,6 @@
-import { open, readFile } from "node:fs/promises";
+import { open } from "node:fs/promises";
 import { dirname } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { PENDING_INPUT_TRANSITION, } from "./pending-input-store.js";
 /** On Windows a directory handle cannot be flushed (EPERM); the file sync is all the platform offers there. */
 export function fsJournalDurability(platform = process.platform) {
@@ -46,26 +47,8 @@ export class SessionPendingInputJournal {
             throw new PendingInputAppendUncertainError(record.cursor, error);
         }
     }
-    async refuseCorruptTransitionLines() {
-        const file = this.session.isPersisted() ? this.session.getSessionFile() : undefined;
-        if (file === undefined)
-            return;
-        const corrupt = await corruptTransitionLine(file).catch((error) => {
-            if (error instanceof Error && "code" in error && error.code === "ENOENT")
-                return undefined;
-            throw error;
-        });
-        if (corrupt !== undefined)
-            throw new PendingInputJournalCorruptError(corrupt);
-    }
     async read() {
-        await this.refuseCorruptTransitionLines();
-        const records = [];
-        for (const entry of this.session.getEntries()) {
-            if (entry.type !== "custom" || entry.customType !== PENDING_INPUT_TRANSITION)
-                continue;
-            records.push(parseRecord(entry.data, entry.id));
-        }
+        const records = (await this.transitionEntries()).map((entry) => parseRecord(entry.data, entry.id));
         records.sort((a, b) => a.cursor - b.cursor);
         // The session loader skips a line that does not parse, so a lost transition shows only as a cursor gap.
         records.forEach((record, index) => {
@@ -74,6 +57,27 @@ export class SessionPendingInputJournal {
         });
         return records;
     }
+    /**
+     * A persisted session's transitions come from one streaming pass over its file, never from `getEntries()`:
+     * on a trimmed session that would materialize and keep the whole history (senpi#3519, #3535). An in-memory
+     * session has no file, so its entries are the journal.
+     */
+    async transitionEntries() {
+        // A session whose file is not written yet (a branch with no message so far) holds its transitions only in
+        // memory; it was never trimmed, so reading its entries costs nothing (#3586 review H1).
+        const file = this.session.isPersisted() && this.session.isTranscriptFlushed() ? this.session.getSessionFile() : undefined;
+        if (file === undefined)
+            return this.session
+                .getEntries()
+                .flatMap((entry) => entry.type === "custom" && entry.customType === PENDING_INPUT_TRANSITION
+                ? [{ data: entry.data, id: entry.id }]
+                : []);
+        return scanTransitions(file).catch((error) => {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return [];
+            throw error;
+        });
+    }
 }
 /**
  * The session loader skips a line that does not parse, so a corrupt transition would vanish with no cursor gap.
@@ -81,23 +85,71 @@ export class SessionPendingInputJournal {
  * corrupt and refused, the last line included. A final segment with no newline is a tail torn by a crash: it was
  * never committed, the loader drops it, and the next append cuts it back, so it is tolerated. A torn line keeps
  * its prefix, and `appendCustomEntry` writes `type` and `customType` first, so the marker survives a tear.
+ * Only lines naming a transition are parsed, so the pass holds one line at a time, never the transcript.
  */
-async function corruptTransitionLine(file) {
-    const segments = (await readFile(file, "utf8")).split("\n");
-    // After the last newline: "" for a complete file, or the torn tail of a crash.
-    segments.pop();
-    for (let index = 0; index < segments.length; index++) {
-        const line = segments[index] ?? "";
-        if (!line.includes(PENDING_INPUT_TRANSITION))
-            continue;
-        try {
-            JSON.parse(line);
-        }
-        catch {
-            return index + 1;
+async function scanTransitions(file) {
+    const handle = await open(file, "r");
+    try {
+        const decoder = new StringDecoder("utf8");
+        const buffer = Buffer.allocUnsafe(1024 * 1024);
+        const entries = [];
+        let pending = "";
+        let lineNumber = 0;
+        while (true) {
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+            if (bytesRead === 0)
+                break;
+            pending += decoder.write(buffer.subarray(0, bytesRead));
+            let start = 0;
+            let newline = pending.indexOf("\n", start);
+            while (newline !== -1) {
+                lineNumber += 1;
+                const entry = transitionOf(pending.slice(start, newline), lineNumber);
+                if (entry !== undefined)
+                    entries.push(entry);
+                start = newline + 1;
+                newline = pending.indexOf("\n", start);
+            }
+            pending = pending.slice(start);
         }
+        // After the last newline is the torn tail of a crash, or nothing. A final line that parses was written whole
+        // (a writer outside senpi that omits the newline); the loader keeps it, so it is read too (#3586 review L1).
+        const tail = finalSegmentTransition(pending, lineNumber + 1);
+        if (tail !== undefined)
+            entries.push(tail);
+        return entries;
+    }
+    finally {
+        await handle.close();
     }
-    return undefined;
+}
+function finalSegmentTransition(segment, lineNumber) {
+    if (!segment.includes(PENDING_INPUT_TRANSITION))
+        return undefined;
+    try {
+        JSON.parse(segment);
+    }
+    catch {
+        return undefined;
+    }
+    return transitionOf(segment, lineNumber);
+}
+function transitionOf(line, lineNumber) {
+    if (!line.includes(PENDING_INPUT_TRANSITION))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        throw new PendingInputJournalCorruptError(lineNumber);
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        !("type" in parsed && parsed.type === "custom") ||
+        !("customType" in parsed && parsed.customType === PENDING_INPUT_TRANSITION))
+        return undefined;
+    return { data: "data" in parsed ? parsed.data : undefined, id: "id" in parsed ? String(parsed.id) : "" };
 }
 export class PendingInputJournalCorruptError extends Error {
     constructor(lineNumber) {
@@ -157,11 +209,15 @@ function parseRecord(data, entryId) {
     const result = "result" in data ? data.result : undefined;
     if (result !== undefined && !isOperationResult(result))
         throw new PendingInputJournalError(entryId);
+    const batch = "batch" in data ? data.batch : undefined;
+    if (batch !== undefined && !(Array.isArray(batch) && batch.every(isPendingInput)))
+        throw new PendingInputJournalError(entryId);
     return {
         type: PENDING_INPUT_TRANSITION,
         cursor: data.cursor,
         input: data.input,
         ...(result === undefined ? {} : { result }),
+        ...(batch === undefined ? {} : { batch }),
     };
 }
 function isOperationResult(value) {

package/dist/core/pending-input-public.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The public pending-input lifecycle (senpi#3549), exported as `@code-yeongyu/senpi/pending-input`: the one
+ * reducer, its projection and closed types, and the store over an injected journal. Other owners (the desktop
+ * server for native providers, the omo child prelaunch queue) embed this exact module instead of reimplementing
+ * it. Re-exports only.
+ */
+export { reducePendingInput } from "./pending-input.ts";
+export { type PendingInputAction, type PendingInputProjection, type PendingInputState, type PendingInputStatusCode, projectPendingInput, } from "./pending-input-projection.ts";
+export { PENDING_INPUT_TRANSITION, type PendingInputJournal, type PendingInputJournalRecord, type PendingInputListener, type PendingInputRead, PendingInputStore, type PendingInputStoreOptions, PendingInputStoreUnavailableError, type PendingInputTransaction, type StopItem, type StopReceipt, } from "./pending-input-store.ts";
+export type * from "./pending-input-types.ts";
+//# sourceMappingURL=pending-input-public.d.ts.map

package/dist/core/pending-input-public.js

@@ -0,0 +1,10 @@
+/**
+ * The public pending-input lifecycle (senpi#3549), exported as `@code-yeongyu/senpi/pending-input`: the one
+ * reducer, its projection and closed types, and the store over an injected journal. Other owners (the desktop
+ * server for native providers, the omo child prelaunch queue) embed this exact module instead of reimplementing
+ * it. Re-exports only.
+ */
+export { reducePendingInput } from "./pending-input.js";
+export { projectPendingInput, } from "./pending-input-projection.js";
+export { PENDING_INPUT_TRANSITION, PendingInputStore, PendingInputStoreUnavailableError, } from "./pending-input-store.js";
+//# sourceMappingURL=pending-input-public.js.map

package/dist/core/pending-input-session-port.d.ts

@@ -0,0 +1,15 @@
+import type { QueuedInputPort } from "@earendil-works/pi-agent-core";
+import type { PendingInputStore } from "./pending-input-store.ts";
+export interface SessionQueuedInputPortOptions {
+    readonly store: PendingInputStore;
+    readonly ownerId: string;
+    readonly writerGeneration: number;
+    readonly nextAttemptId: () => string;
+}
+/**
+ * The session's side of the agent queues (senpi#3549). Every drain reserves the identified inputs it hands to a
+ * turn, every consumption commits them, and every give-back releases them, each under the store's gate together
+ * with the native buffer change. Input the store never admitted (no client id, or a legacy id) passes through.
+ */
+export declare function createSessionQueuedInputPort(options: SessionQueuedInputPortOptions): QueuedInputPort;
+//# sourceMappingURL=pending-input-session-port.d.ts.map

package/dist/core/pending-input-session-port.js

@@ -0,0 +1,93 @@
+/**
+ * The session's side of the agent queues (senpi#3549). Every drain reserves the identified inputs it hands to a
+ * turn, every consumption commits them, and every give-back releases them, each under the store's gate together
+ * with the native buffer change. Input the store never admitted (no client id, or a legacy id) passes through.
+ */
+export function createSessionQueuedInputPort(options) {
+    const attempts = new Map();
+    const reserve = async (tx, message) => {
+        const clientMessageId = clientMessageIdOf(message);
+        const input = clientMessageId === undefined ? undefined : tx.current(clientMessageId);
+        if (clientMessageId === undefined || input === undefined)
+            return true;
+        const token = {
+            ownerId: options.ownerId,
+            writerGeneration: options.writerGeneration,
+            lifetimeId: input.handle.lifetimeId,
+            attemptId: options.nextAttemptId(),
+            clientMessageId,
+        };
+        await tx.apply(clientMessageId, { type: "reserve", token });
+        if (tx.current(clientMessageId)?.attempt?.attemptId !== token.attemptId)
+            return false;
+        attempts.set(message, token);
+        return true;
+    };
+    // One journal record for the whole batch: a failed write leaves every input as it was, never half delivered.
+    const settle = async (tx, messages, type) => {
+        const tokens = messages.flatMap((message) => {
+            const token = attempts.get(message);
+            return token === undefined ? [] : [token];
+        });
+        if (tokens.length === 0)
+            return tokens;
+        await tx.applyAll(tokens.map((token) => ({ clientMessageId: token.clientMessageId, event: { type, token } })));
+        for (const message of messages)
+            attempts.delete(message);
+        return tokens;
+    };
+    // Consumption was never committed, so no consumer can hold these: removing them is fenced (senpi#3549).
+    const cancelOf = (clientMessageId) => ({
+        clientMessageId,
+        event: { type: "cancel", cause: "stop", consumerFenced: true },
+    });
+    const cancelClaims = async (tx, messages) => {
+        const ids = messages.flatMap((message) => {
+            const token = attempts.get(message);
+            attempts.delete(message);
+            return token === undefined ? [] : [token.clientMessageId];
+        });
+        if (ids.length > 0)
+            await tx.applyAll(ids.map(cancelOf));
+    };
+    const cancelReleased = async (tx, messages) => {
+        const ids = messages.flatMap((message) => {
+            const clientMessageId = clientMessageIdOf(message);
+            return clientMessageId === undefined || tx.current(clientMessageId) === undefined ? [] : [clientMessageId];
+        });
+        if (ids.length > 0)
+            await tx.applyAll(ids.map(cancelOf));
+    };
+    return {
+        claim: (_queue, drain) => options.store.transaction(async (tx) => {
+            const claimed = [];
+            // A copy the store no longer authorizes (removed, delivered, failed) is stale and is not delivered.
+            for (const message of drain())
+                if (await reserve(tx, message))
+                    claimed.push(message);
+            return claimed;
+        }),
+        commitConsumption: (_queue, messages) => options.store.transaction(async (tx) => {
+            await settle(tx, messages, "consumed");
+        }),
+        // Journal first: if the release cannot be recorded the input stays `sending` (uncertain on reopen) and is
+        // not put back natively, so it can never be delivered twice. A clear that won keeps the messages out of the
+        // queue and their records removed, in one record. Only a clear landing during the release's own append
+        // needs the second, removing record.
+        release: (_queue, messages, giveBack) => options.store.transaction(async (tx) => {
+            if (!giveBack.restorable()) {
+                await cancelClaims(tx, messages);
+                return;
+            }
+            await settle(tx, messages, "release");
+            if (!giveBack.restore())
+                await cancelReleased(tx, messages);
+        }),
+    };
+}
+function clientMessageIdOf(message) {
+    if (message.role !== "user" || !("clientMessageId" in message))
+        return undefined;
+    return typeof message.clientMessageId === "string" ? message.clientMessageId : undefined;
+}
+//# sourceMappingURL=pending-input-session-port.js.map

package/dist/core/pending-input-session.d.ts

@@ -0,0 +1,108 @@
+import type { QueuedInputPort } from "@earendil-works/pi-agent-core";
+import type { ImageContent } from "@earendil-works/pi-ai";
+import { SessionPendingInputJournal } from "./pending-input-journal.ts";
+import type { PendingInputProjection } from "./pending-input-projection.ts";
+import { type PendingInputJournal } from "./pending-input-store.ts";
+import type { PendingInputMode, PendingInputOperationResult } from "./pending-input-types.ts";
+export interface IdentifiedInput {
+    readonly clientMessageId: string;
+    readonly text: string;
+    readonly images?: readonly ImageContent[];
+    readonly mode: PendingInputMode;
+}
+export interface SessionPendingInputsOptions {
+    readonly sessionManager: ConstructorParameters<typeof SessionPendingInputJournal>[0];
+    /** The session's own queue-id counter, so a store handle and the session's queued record share one id. */
+    readonly nextQueuedId: () => string;
+    /** Receives every committed change, in cursor order. */
+    readonly onChange?: (update: PendingInputUpdate) => void;
+    /** Defaults to the session JSONL; injectable so tests can fail an append. */
+    readonly journal?: PendingInputJournal;
+}
+export interface PendingInputUpdate {
+    readonly lifetimeId: string;
+    readonly cursor: number;
+    readonly changes: readonly PendingInputProjection[];
+}
+/** Every input that still needs an outcome, plus an explicit answer for each id the caller already knows. */
+export interface PendingInputSnapshot {
+    readonly lifetimeId: string;
+    readonly throughCursor: number;
+    readonly inputs: readonly PendingInputProjection[];
+    readonly outcomes: readonly ({
+        readonly clientMessageId: string;
+        readonly status: "admitted";
+        readonly projection: PendingInputProjection;
+    } | {
+        readonly clientMessageId: string;
+        readonly status: "not_admitted";
+    })[];
+}
+/** The legacy answers of `dequeue_message` / `edit_queued_message`. */
+export type QueuedInputChangeOutcome = "removed" | "edited" | "already_delivered" | "not_found" | "conflict";
+export interface QueuedInputChangeRequest {
+    readonly clientMessageId: string;
+    /** Undefined removes the input; a string replaces its text. */
+    readonly text: string | undefined;
+    readonly expectedRevision?: number;
+    readonly effectId?: string;
+}
+export declare class ClientMessageIdConflictError extends Error {
+    readonly code = "client_message_id_conflict";
+    readonly clientMessageId: string;
+    constructor(clientMessageId: string);
+}
+/**
+ * The pending inputs of one AgentSession (senpi#3549): the store, opened on the first identified input, and the
+ * agent queue port over it. Input without a client id never touches the store and keeps the legacy queue path.
+ */
+export declare class SessionPendingInputs {
+    readonly lifetimeId: `${string}-${string}-${string}-${string}-${string}`;
+    private readonly options;
+    private storeOpening;
+    private port;
+    private attempts;
+    /** Bumped synchronously by every clear, so a change can tell a clear it raced from a real divergence. */
+    private clears;
+    constructor(options: SessionPendingInputsOptions);
+    /**
+     * How a restored input (from the RPC admission ledger after a reopen) re-enters the native queue: under the
+     * store's rebound queue id while it is still queued; not at all once the store retired it (delivered, removed,
+     * failed); `undefined` when the store never held it, so the caller restores it as before.
+     */
+    restoreHandle(clientMessageId: string): Promise<{
+        readonly queuedId: string;
+    } | "retired" | undefined>;
+    /**
+     * Admits an identified input and, only when it is newly admitted, puts its native copy in the agent queue
+     * inside the same gated step, so no drain, edit or removal can run between the two. A repeated submit of the
+     * same input is answered from the record (`replayed`) and enqueues nothing.
+     */
+    admit(input: IdentifiedInput, enqueue: (queuedId: string) => void): Promise<PendingInputOperationResult | undefined>;
+    /**
+     * Edits or removes an identified input: the store transition is journaled first, and only when it answers
+     * `edited`/`removed` does `applyNative` change the native queue, inside the same gated step, so no drain
+     * can see one without the other. Returns undefined when the store never admitted this input.
+     */
+    change(request: QueuedInputChangeRequest, applyNative: () => QueuedInputChangeOutcome): Promise<QueuedInputChangeOutcome | undefined>;
+    /**
+     * Records an explicit clear (Stop, `clear_queue`, unload with clearQueue) of identified inputs that just left the
+     * native queue: each still-queued one is removed by `stop`, so a reopen never queues it again.
+     */
+    recordCleared(clientMessageIds: readonly string[]): Promise<void>;
+    /**
+     * Pending inputs (queued, sending, failed) and the outcome of each known id, consistent through
+     * `throughCursor`: apply it, then only updates with a later cursor. Absence from `inputs` is never an outcome.
+     */
+    snapshot(knownClientMessageIds?: readonly string[]): Promise<PendingInputSnapshot>;
+    /** The agent's queue port. Before the store opens nothing identified is queued, so it drains natively. */
+    queuedInputPort(): QueuedInputPort;
+    private store;
+    private openPort;
+}
+/** The store changed an input that the native queue no longer held: the two views disagree and must not be hidden. */
+export declare class PendingInputDivergenceError extends Error {
+    readonly code = "pending_input_divergence";
+    constructor(clientMessageId: string, recorded: string, native: string);
+}
+//# sourceMappingURL=pending-input-session.d.ts.map