@code-yeongyu/senpi 2026.10.21-1 → 2026.10.21-2

package/dist/modes/index.d.ts

@@ -11,6 +11,7 @@ export { type HostEndpointEntry, type HostEndpointIdentitySource, listHostEndpoi
 export { createHostDaemonPaths, type EnsuredHost, type EnsureHostOptions, ensureHost, type HostDaemonPaths, type HostUpgradePolicy, PINNED_HOST_CLIENT_CAPABILITIES, } from "./rpc/host-ensure.ts";
 export { gcHostEndpoints, type HostGcOptions, type HostGcResult } from "./rpc/host-gc.ts";
 export { type HandoffHostOptions, type HandoffRefusal, type HandoffResult, handoffHost, } from "./rpc/host-handoff.ts";
+export { describeHostHolder, type HostHolder } from "./rpc/host-holder.ts";
 export { DEFAULT_HOST_LAUNCH_SPEC, type HostLaunchSpec, type HostLaunchSpecCore, HostLaunchSpecError, type HostLaunchSpecRefusal, loadHostLaunchSpec, parseHostLaunchSpec, type ResolvedHostLaunchSpec, } from "./rpc/host-launch-spec.ts";
 export { type ProbeHostOptions, probeHost } from "./rpc/host-probe.ts";
 export { HOST_EXIT_ERROR, HOST_EXIT_FALLBACK, HOST_EXIT_OK, HOST_EXIT_REFUSED, HOST_EXIT_USAGE, type HostOutcome, type HostRequest, type HostTarget, runHostRequest, } from "./rpc/host-runner.ts";

package/dist/modes/index.js

@@ -16,6 +16,7 @@ export { gcHostEndpoints } from "./rpc/host-gc.js";
 // Replacing a running daemon without ending its work: the drain-based generation handoff,
 // the identity probe every decision starts from, and the two ways a generation is ended.
 export { handoffHost, } from "./rpc/host-handoff.js";
+export { describeHostHolder } from "./rpc/host-holder.js";
 // What a client hands `senpi host` to describe the daemon it wants, and the trust boundary it crosses.
 export { DEFAULT_HOST_LAUNCH_SPEC, HostLaunchSpecError, loadHostLaunchSpec, parseHostLaunchSpec, } from "./rpc/host-launch-spec.js";
 export { probeHost } from "./rpc/host-probe.js";

package/dist/modes/interactive/components/footer.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { slotsOfOwnKind } from "@earendil-works/pi-ai/auth/pool/kinds";
 import { applyAccountOrder, rendezvousOrder } from "@earendil-works/pi-ai/auth/pool/select";
-import { accountLabel, listSlots } from "@earendil-works/pi-ai/auth/pool/slots";
+import { accountLabel } from "@earendil-works/pi-ai/auth/pool/slots";
 import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { theme } from "../theme/theme.js";
 import { planFooterLayout } from "./footer-layout.js";
@@ -47,7 +48,8 @@ export function formatTokens(count) {
  */
 export function accountFooterSuffix(credential, sessionId) {
     const pooled = credential;
-    const slots = listSlots(credential);
+    // Only slots the credential can serve with; a mixed pool's other-kind slot never does (senpi#3486).
+    const slots = credential ? slotsOfOwnKind(credential) : [];
     if (slots.length < 2)
         return "";
     const pinned = Object.entries(credential ?? {}).find(([key]) => key === "pinned")?.[1];

package/dist/modes/interactive/interactive-mode.d.ts

@@ -67,6 +67,11 @@ export interface InteractiveModeOptions {
         type: "info" | "warning" | "error";
         message: string;
     }>;
+    /** Credential notices to show once at startup; `markSeen` runs after they are shown (senpi#3486). */
+    authNotices?: {
+        readonly messages: readonly string[];
+        readonly markSeen: () => void;
+    };
     /** Warning message if session model couldn't be restored */
     modelFallbackMessage?: string;
     /** Cwd to trust after reload if it gained a .pi directory during this implicitly trusted session. */

package/dist/modes/interactive/interactive-mode.js

@@ -15,6 +15,7 @@ import { parseSkillBlock, } from "../../core/agent-session.js";
 import { SessionImportFileNotFoundError } from "../../core/agent-session-runtime.js";
 import { formatNoModelsAvailableMessage } from "../../core/auth-guidance.js";
 import { isApiKeyLoginProvider, loginRowStatus } from "../../core/auth-providers.js";
+import { describeCredentialReplacement } from "../../core/auth-storage.js";
 import { markModeCrashHandler } from "../../core/bootstrap-crash-listeners.js";
 import { envValue } from "../../core/brand.js";
 import { CACHE_TTL_MS, collectCacheMisses, computeCacheWaste, detectCacheMiss, } from "../../core/cache-stats.js";
@@ -1327,7 +1328,7 @@ export class InteractiveMode {
             }
         });
         // Show startup warnings
-        const { migratedProviders, legacyPiEditNotice, startupDiagnostics, modelFallbackMessage, initialMessage, initialImages, initialMessages, initialTitlePrompt, } = this.options;
+        const { migratedProviders, legacyPiEditNotice, startupDiagnostics, authNotices, modelFallbackMessage, initialMessage, initialImages, initialMessages, initialTitlePrompt, } = this.options;
         if (migratedProviders && migratedProviders.length > 0) {
             this.showWarning(`Migrated credentials to auth.json: ${migratedProviders.join(", ")}`);
         }
@@ -1340,6 +1341,11 @@ export class InteractiveMode {
             else if (diagnostic.type === "error")
                 this.showError(diagnostic.message);
         }
+        if (authNotices && authNotices.messages.length > 0) {
+            for (const message of authNotices.messages)
+                this.showWarning(message);
+            authNotices.markSeen();
+        }
         const modelsJsonError = this.session.modelRuntime.getError();
         if (modelsJsonError) {
             this.showError(`models.json error: ${modelsJsonError}`);
@@ -7842,11 +7848,17 @@ export class InteractiveMode {
         }
     }
     async loginProvider(dialog, providerId, method) {
+        // A replacement recorded by another login path must not be reported as this one's.
+        this.session.modelRegistry.authStorage.takeReplacement(providerId);
         await this.session.modelRuntime.login(providerId, method, {
             signal: dialog.signal,
             prompt: (prompt) => this.showAuthPrompt(dialog, prompt),
             notify: (event) => this.notifyAuthDialog(dialog, event),
         }, { getDeviceId: () => this.settingsManager.getOrCreateDeviceId() });
+        // A login of the other kind replaced the stored one: say where it went (senpi#3448).
+        const replacement = this.session.modelRegistry.authStorage.takeReplacement(providerId);
+        if (replacement)
+            this.showWarning(describeCredentialReplacement(providerId, replacement));
     }
     async showLoginDialog(providerId, providerName) {
         const previousModel = this.session.model;

package/dist/modes/rpc/client-admission-record.d.ts

@@ -38,6 +38,11 @@ export declare const clientAdmissionRecordSchema: z.ZodDiscriminatedUnion<[z.Zod
             steer: "steer";
         }>;
         enqueueOrder: z.ZodNumber;
+        source: z.ZodOptional<z.ZodEnum<{
+            extension: "extension";
+            interactive: "interactive";
+            rpc: "rpc";
+        }>>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     clientTurnId: z.ZodOptional<z.ZodString>;

package/dist/modes/rpc/client-admission-record.js

@@ -29,6 +29,8 @@ const preparedInputSchema = clientMessageIdentitySchema.extend({
     images: z.array(z.object({ type: z.literal("image"), data: z.string(), mimeType: z.string() })).optional(),
     mode: z.enum(["steer", "followUp"]),
     enqueueOrder: z.number(),
+    // Additive: a record written before this field restores with no source (unknown origin).
+    source: z.enum(["interactive", "rpc", "extension"]).optional(),
 });
 export const clientAdmissionRecordSchema = z.discriminatedUnion("state", [
     admissionIdentitySchema.extend({ state: z.literal("queued"), prepared: preparedInputSchema }),

package/dist/modes/rpc/connection-handler.d.ts

@@ -1,10 +1,13 @@
 import { type ToolRuntimeKind } from "../../cli/tool-runtime.ts";
 import type { AgentSessionRuntime } from "../../core/agent-session-runtime.ts";
+import { ConnectionRoles } from "./connection-roles.ts";
 export { buildRpcSessionState } from "./rpc-session-state.ts";
 /** Additive per-connection options. Absent = classic default (byte-identical). */
 export interface RpcConnectionOptions {
     /** Client capability flags from the handshake (e.g. custom_unsupported opt-in). */
     capabilities?: readonly string[];
+    /** The host's per-connection role registry; a single-connection process keeps its own. */
+    connectionRoles?: ConnectionRoles;
     /** Called instead of requesting process shutdown for a session-owned binding. */
     shutdownHandler?: () => void;
     /** Session registries own runtime disposal themselves. */

package/dist/modes/rpc/connection-handler.js

@@ -39,6 +39,7 @@ import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.
 import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
+import { CONNECTION_ROLE_FIXED, ConnectionRoles, roleConnection } from "./connection-roles.js";
 import { AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, } from "./custom-capability.js";
 import { runAbort, runGetEffectStatus, runQueuedInputChange, runSetModel, runSetThinkingLevel, } from "./effect-commands.js";
 import { EffectLedger } from "./effect-ledger.js";
@@ -53,7 +54,7 @@ import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
 import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
-import { RPC_ERROR_ENTRY_NOT_FOUND, RPC_ERROR_EVAL_CELL_NOT_FOUND, RPC_ERROR_EVAL_CELLS_UNAVAILABLE, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_INVALID_EVAL_CELL_REQUEST, RPC_ERROR_MEDIA_NOT_FOUND, RPC_ERROR_RESPONSE_TOO_LARGE, STEER_WHEN_IDLE_CAPABILITY, } from "./rpc-types.js";
+import { RPC_ERROR_ENTRY_NOT_FOUND, RPC_ERROR_EVAL_CELL_NOT_FOUND, RPC_ERROR_EVAL_CELLS_UNAVAILABLE, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_INVALID_EVAL_CELL_REQUEST, RPC_ERROR_MEDIA_NOT_FOUND, RPC_ERROR_RESPONSE_TOO_LARGE, STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY, } from "./rpc-types.js";
 import { availableModelsData, interruptRunningTurn } from "./session-control-actions-data.js";
 import { SessionExtensionUiRequests, sessionDialogRequests } from "./session-extension-ui-requests.js";
 import { subscribeSessionRecords } from "./session-record-stream.js";
@@ -162,6 +163,7 @@ function findToolResultMedia(session, toolCallId, contentIndex) {
  */
 export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     let clientCapabilities = options.capabilities;
+    const connectionRoles = options.connectionRoles ?? new ConnectionRoles();
     const routingSessionId = options.sessionId;
     // True only while THIS connection's own command drives a replacement; the issuer
     // already learns the new identity from its command response.
@@ -676,8 +678,11 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         const settled = new AbortController();
         const loginSignal = AbortSignal.any([controller.signal, settled.signal]);
         activeLogins.set(provider, controller);
+        const authStorage = session.modelRegistry.authStorage;
+        // A replacement left by an earlier login is not this login's; drop it so it is never reported here.
+        authStorage.takeReplacement(provider);
         try {
-            await session.modelRegistry.authStorage.login(provider, {
+            await authStorage.login(provider, {
                 onAuth: (info) => {
                     outputEvent({ type: "auth_login_url", provider, url: info.url });
                 },
@@ -691,7 +696,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             session.modelRegistry.refresh();
             if (provider === ANTHROPIC_SUBSCRIPTION_PROVIDER_ID)
                 emitProviderAccountsChanged(provider);
-            outputEvent({ type: "auth_login_end", provider, success: true });
+            // The client shows what this login replaced and where the previous credential is (senpi#3486).
+            const replacement = authStorage.takeReplacement(provider);
+            outputEvent({ type: "auth_login_end", provider, success: true, ...replacement });
         }
         catch (loginError) {
             const message = loginError instanceof Error ? loginError.message : String(loginError);
@@ -751,6 +758,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 EVAL_CELLS_CAPABILITY,
                                 AUTH_KEY_VERIFY_CAPABILITY,
                                 QUEUED_MESSAGE_REVISION_CAPABILITY,
+                                USER_ACTIVITY_CAPABILITY,
                                 RESUME_SESSION_CAPABILITY,
                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
@@ -903,6 +911,10 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // State
             // =================================================================
             case "set_client_info":
+                if (command.capabilities !== undefined) {
+                    if (!connectionRoles.declare(roleConnection(options.clientInfo?.connectionId()), command.capabilities))
+                        return error(id, "set_client_info", CONNECTION_ROLE_FIXED);
+                }
                 if (options.clientInfo && command.capabilities !== undefined) {
                     clientCapabilities = command.capabilities;
                     options.clientInfo.setCapabilities(options.clientInfo.connectionId(), command.capabilities);
@@ -1339,6 +1351,16 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 session.setSessionName(name);
                 return success(id, "set_session_name");
             }
+            case "record_user_activity": {
+                // `prompt` activity is emitted by prompt admission itself; a client may only report a draft.
+                // Read as unknown: the wire value is unchecked, whatever the declared command type says.
+                const kind = command.kind;
+                if (kind !== "draft") {
+                    return error(id, "record_user_activity", `Unsupported activity kind: ${String(kind)}`, RPC_ERROR_INVALID_ARGUMENT);
+                }
+                session.recordUserActivity("draft");
+                return success(id, "record_user_activity");
+            }
             // =================================================================
             // Messages
             // =================================================================
@@ -1427,11 +1449,17 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 return success(id, "login_cancel");
             }
             case "login_api_key": {
-                session.modelRegistry.authStorage.set(command.provider, { type: "api_key", key: command.key });
+                const replacement = session.modelRegistry.authStorage.set(command.provider, {
+                    type: "api_key",
+                    key: command.key,
+                });
+                // The response carries what this key replaced (senpi#3448). Consume the record before the
+                // await below, so no record is pending across it and a concurrent OAuth login keeps its own (#3952).
+                session.modelRegistry.authStorage.takeReplacement(command.provider);
                 // Answer after the registry sees the key: a client re-reading auth status on this
                 // response must not get the pre-login snapshot (#2384).
                 await session.modelRegistry.refresh();
-                return success(id, "login_api_key");
+                return success(id, "login_api_key", replacement);
             }
             case "verify_api_key": {
                 const verification = await verifyApiKey({

package/dist/modes/rpc/connection-roles.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Connection roles (senpi#3811): the capabilities that say who a connection speaks for, which is what
+ * authority checks read. A role belongs to one connection, never to a session: a shared host serves every
+ * connection attached to a session through one binding. Only the client's own `set_client_info` declares a
+ * role; launch defaults (`SENPI_RPC_CLIENT_CAPABILITIES`, a host's connection options) never do, so a client
+ * can still declare after it attached. Once a connection declared, a different declaration is refused.
+ */
+export declare const CONNECTION_ROLE_CAPABILITIES: readonly string[];
+/** The one connection of a single-session `--mode rpc` process. */
+export declare const SOLE_CONNECTION = "sole-connection";
+/**
+ * The key a connection's roles are kept under. A stdio host (and a worker isolate serving it) reads lines
+ * with no connection id; its one client is the sole connection, so the role is still declared once and fixed.
+ */
+export declare function roleConnection(connectionId: string | undefined): string;
+export declare const CONNECTION_ROLE_FIXED = "connection_role_fixed: interactive_user cannot change after it is declared";
+export declare class ConnectionRoles {
+    private readonly declared;
+    /** Records the roles a `set_client_info` carries; false when this connection already declared other roles. */
+    declare(connectionId: string, capabilities: readonly string[]): boolean;
+    /** The roles this connection explicitly declared, or undefined while it has declared none (no id = a stdio client). */
+    rolesOf(connectionId: string | undefined): readonly string[] | undefined;
+    /** Takes a declaration made elsewhere (the host, for a worker isolate) unless this connection already declared. */
+    adopt(connectionId: string, roles: readonly string[]): void;
+    has(connectionId: string | undefined, role: string): boolean;
+    release(connectionId: string): void;
+    /** Forgets every connection, for a worker isolate whose session ends. */
+    clear(): void;
+}
+//# sourceMappingURL=connection-roles.d.ts.map

package/dist/modes/rpc/connection-roles.js

@@ -0,0 +1,53 @@
+import { INTERACTIVE_USER_CAPABILITY } from "./custom-capability.js";
+/**
+ * Connection roles (senpi#3811): the capabilities that say who a connection speaks for, which is what
+ * authority checks read. A role belongs to one connection, never to a session: a shared host serves every
+ * connection attached to a session through one binding. Only the client's own `set_client_info` declares a
+ * role; launch defaults (`SENPI_RPC_CLIENT_CAPABILITIES`, a host's connection options) never do, so a client
+ * can still declare after it attached. Once a connection declared, a different declaration is refused.
+ */
+export const CONNECTION_ROLE_CAPABILITIES = [INTERACTIVE_USER_CAPABILITY];
+/** The one connection of a single-session `--mode rpc` process. */
+export const SOLE_CONNECTION = "sole-connection";
+/**
+ * The key a connection's roles are kept under. A stdio host (and a worker isolate serving it) reads lines
+ * with no connection id; its one client is the sole connection, so the role is still declared once and fixed.
+ */
+export function roleConnection(connectionId) {
+    return connectionId ?? SOLE_CONNECTION;
+}
+export const CONNECTION_ROLE_FIXED = "connection_role_fixed: interactive_user cannot change after it is declared";
+export class ConnectionRoles {
+    constructor() {
+        this.declared = new Map();
+    }
+    /** Records the roles a `set_client_info` carries; false when this connection already declared other roles. */
+    declare(connectionId, capabilities) {
+        const roles = CONNECTION_ROLE_CAPABILITIES.filter((role) => capabilities.includes(role));
+        const prior = this.declared.get(connectionId);
+        if (prior !== undefined)
+            return prior.length === roles.length && prior.every((role) => roles.includes(role));
+        this.declared.set(connectionId, roles);
+        return true;
+    }
+    /** The roles this connection explicitly declared, or undefined while it has declared none (no id = a stdio client). */
+    rolesOf(connectionId) {
+        return this.declared.get(roleConnection(connectionId));
+    }
+    /** Takes a declaration made elsewhere (the host, for a worker isolate) unless this connection already declared. */
+    adopt(connectionId, roles) {
+        if (!this.declared.has(connectionId))
+            this.declared.set(connectionId, [...roles]);
+    }
+    has(connectionId, role) {
+        return this.declared.get(roleConnection(connectionId))?.includes(role) ?? false;
+    }
+    release(connectionId) {
+        this.declared.delete(connectionId);
+    }
+    /** Forgets every connection, for a worker isolate whose session ends. */
+    clear() {
+        this.declared.clear();
+    }
+}
+//# sourceMappingURL=connection-roles.js.map

package/dist/modes/rpc/custom-capability.d.ts

@@ -47,6 +47,12 @@ export declare const RETAIN_ON_DISCONNECT_CAPABILITY = "retain_on_disconnect";
  * no other connection will still see it attached (senpi#3238).
  */
 export declare const DETACH_CONNECTION_CAPABILITY = "detach_connection";
+/**
+ * Connection role (senpi#3811): the connection may exercise a person's authority (Stop with intent, release a
+ * pause). It does not decide input origin; that comes from the entry point. Declared per connection by the
+ * client's own `set_client_info` and fixed at that first declaration (see `connection-roles.ts`).
+ */
+export declare const INTERACTIVE_USER_CAPABILITY = "interactive_user";
 /**
  * HOST capability: this host accepts `open_session.context`, hands it to that session's
  * extensions as `pi.sessionContext`, and republishes it on `list_sessions { include_workers: true }`.

package/dist/modes/rpc/custom-capability.js

@@ -47,6 +47,12 @@ export const RETAIN_ON_DISCONNECT_CAPABILITY = "retain_on_disconnect";
  * no other connection will still see it attached (senpi#3238).
  */
 export const DETACH_CONNECTION_CAPABILITY = "detach_connection";
+/**
+ * Connection role (senpi#3811): the connection may exercise a person's authority (Stop with intent, release a
+ * pause). It does not decide input origin; that comes from the entry point. Declared per connection by the
+ * client's own `set_client_info` and fixed at that first declaration (see `connection-roles.ts`).
+ */
+export const INTERACTIVE_USER_CAPABILITY = "interactive_user";
 /**
  * HOST capability: this host accepts `open_session.context`, hands it to that session's
  * extensions as `pi.sessionContext`, and republishes it on `list_sessions { include_workers: true }`.

package/dist/modes/rpc/host-capabilities.js

@@ -3,7 +3,7 @@ import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPAB
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
 import { ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_STATUS_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
-import { STEER_WHEN_IDLE_CAPABILITY } from "./rpc-types.js";
+import { STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY } from "./rpc-types.js";
 /** `unload_session` and `session_parked.reason` (senpi#3225). */
 export const UNLOAD_SESSION_CAPABILITY = "unload_session";
 /** `get_subscription_limits` and the `subscription_limits` host record (senpi#3370). */
@@ -31,6 +31,7 @@ export function multiSessionHostCapabilities(options) {
             EVAL_CELLS_CAPABILITY,
             AUTH_KEY_VERIFY_CAPABILITY,
             QUEUED_MESSAGE_REVISION_CAPABILITY,
+            USER_ACTIVITY_CAPABILITY,
             // Both shared runtimes dispatch through the active session-writing holder guard.
             SESSION_HELD_CAPABILITY,
             RESUME_SESSION_CAPABILITY,

package/dist/modes/rpc/host-decision.d.ts

@@ -19,6 +19,7 @@
  * and says so instead.
  */
 import { type EngineBuildIdentity } from "../../core/engine-build-identity.ts";
+import { type HostHolder } from "./host-holder.ts";
 import type { HostProtocolInfo } from "./host-protocol-info.ts";
 import type { RpcLaunchProfile } from "./rpc-types.ts";
 export { type HostProtocolInfo, parseHostProtocolInfo } from "./host-protocol-info.ts";
@@ -96,7 +97,9 @@ export declare class HostEnsureRefusedError extends Error {
     readonly reason: HostRefusalReason;
     /** What only the caller knows: which process is in the way, and how to clear it. */
     readonly detail: string | undefined;
-    constructor(socket: string, reason: HostRefusalReason, host: HostProtocolInfo | undefined, detail?: string);
+    /** The generation in the way, when its registration names one (`foreign_writer`). */
+    readonly holder: HostHolder | undefined;
+    constructor(socket: string, reason: HostRefusalReason, host: HostProtocolInfo | undefined, detail?: string, holder?: HostHolder);
 }
 export declare function decideHostAction(client: HostDecisionClient, host: HostProtocolInfo | undefined, policy: "never"): AttachOnlyDecision;
 export declare function decideHostAction(client: HostDecisionClient, host: HostProtocolInfo | undefined, policy: HostDecisionPolicy): HostDecision;

package/dist/modes/rpc/host-decision.js

@@ -20,6 +20,7 @@
  */
 import { compareEngineOrdinal, } from "../../core/engine-build-identity.js";
 import { EXTENSION_EVENTS_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, } from "./custom-capability.js";
+import { describeHostHolder } from "./host-holder.js";
 export { parseHostProtocolInfo } from "./host-protocol-info.js";
 /** The wire protocol this build speaks. A host answering with any other number is refused, not replaced. */
 export const HOST_PROTOCOL_VERSION = 1;
@@ -41,12 +42,14 @@ export const REQUIRED_HOST_CAPABILITIES = [
  * endpoint another process already owns is exactly the failure the refusal exists to prevent.
  */
 export class HostEnsureRefusedError extends Error {
-    constructor(socket, reason, host, detail) {
-        super(`RPC socket ${socket} refused: ${reason} - ${refusalDetail(reason, host)}${detail ? `: ${detail}` : ""}`);
+    constructor(socket, reason, host, detail, holder) {
+        const heldBy = holder ? ` (held by ${describeHostHolder(holder)})` : "";
+        super(`RPC socket ${socket} refused: ${reason} - ${refusalDetail(reason, host)}${detail ? `: ${detail}` : ""}${heldBy}`);
         this.name = "HostEnsureRefusedError";
         this.socket = socket;
         this.reason = reason;
         this.detail = detail;
+        this.holder = holder;
     }
 }
 function refusalDetail(reason, host) {
@@ -58,7 +61,7 @@ function refusalDetail(reason, host) {
             return `the running host is missing ${JSON.stringify(missing)}; it owns the socket, so no second host is started`;
         }
         case "foreign_writer":
-            return "its pidfile was written by another process, so this one may not signal it; stop that host explicitly instead";
+            return "another process registered the host on this socket; it accepts connections but did not answer as a host, and this one may not signal it - stop that host explicitly (host stop --force), then ensure again";
         case "legacy_host":
             return "a host from before the per-socket daemon directory is still running; it is drained and replaced only while it holds no session, and no second host is started beside it";
         case "host_busy":

package/dist/modes/rpc/host-ensure-liveness.d.ts

@@ -4,12 +4,23 @@
  * out of `host-ensure.ts`; neither check ever signals anything.
  */
 import { type HostDaemonPaths } from "./host-daemon-paths.ts";
+import type { RegisteredHost } from "./host-daemon-registration.ts";
 import { type HostProtocolInfo } from "./host-decision.ts";
+import type { HostHolder } from "./host-holder.ts";
 /**
  * IS-5: a generation nothing can reach whose loop is measurably stalled is still serving its sessions, so
  * it is neither stopped nor stranded beside a new generation: no signal, no successor, registration intact.
  */
 export declare function refuseIfStalled(paths: HostDaemonPaths, instanceId: string, socket: string, protocol: HostProtocolInfo | undefined): Promise<void>;
+/**
+ * I1 for a record another process wrote: while something still accepts at the public path, the generation
+ * it names may own the endpoint, so the ensure refuses `foreign_writer` - and the refusal names that
+ * generation, so every client can say WHO is in the way instead of only that something is
+ * (omo-desktop-app#3561). An endpoint nothing accepts at is left to the caller's stranded start (#1936).
+ */
+export declare function refuseIfForeignHeld(paths: HostDaemonPaths, registered: RegisteredHost, socket: string, protocol: HostProtocolInfo | undefined): Promise<void>;
+/** The registration's own account of the generation: its record also stores the build and launch profile. */
+export declare function readHostHolder(paths: HostDaemonPaths, registered: RegisteredHost): Promise<HostHolder>;
 /**
  * Whether SOMETHING still accepts connections at the public path - the one fact that says a
  * registered process may still own the endpoint. A missing entry and an entry nobody listens

package/dist/modes/rpc/host-ensure-liveness.js

@@ -4,6 +4,7 @@
  * out of `host-ensure.ts`; neither check ever signals anything.
  */
 import { generationPaths } from "./host-daemon-paths.js";
+import { parseJson, readFileOrUndefined } from "./host-daemon-state.js";
 import { HostEnsureRefusedError } from "./host-decision.js";
 import { probeSocketReachable } from "./host-probe.js";
 import { hostChildAlive, hostLoopStalled, stallRefusalWindowMs } from "./host-stalled-evidence.js";
@@ -24,6 +25,31 @@ export async function refuseIfStalled(paths, instanceId, socket, protocol) {
         throw new HostEnsureRefusedError(socket, "host_stalled", protocol);
     }
 }
+/**
+ * I1 for a record another process wrote: while something still accepts at the public path, the generation
+ * it names may own the endpoint, so the ensure refuses `foreign_writer` - and the refusal names that
+ * generation, so every client can say WHO is in the way instead of only that something is
+ * (omo-desktop-app#3561). An endpoint nothing accepts at is left to the caller's stranded start (#1936).
+ */
+export async function refuseIfForeignHeld(paths, registered, socket, protocol) {
+    if (!(await publicEndpointAccepts(socket)))
+        return;
+    const holder = await readHostHolder(paths, registered);
+    throw new HostEnsureRefusedError(socket, "foreign_writer", protocol, undefined, holder);
+}
+/** The registration's own account of the generation: its record also stores the build and launch profile. */
+export async function readHostHolder(paths, registered) {
+    const record = parseJson(await readFileOrUndefined(generationPaths(paths, registered.instanceId).pidFile)) ?? {};
+    return {
+        pid: registered.record.pid,
+        instanceId: registered.instanceId,
+        generation: registered.generation,
+        processStartTime: registered.record.processStartTime,
+        engineVersion: typeof record.engineVersion === "string" ? record.engineVersion : null,
+        launchProfileId: typeof record.launchProfileId === "string" ? record.launchProfileId : null,
+        writerPid: registered.writer?.pid ?? null,
+    };
+}
 /**
  * Only the connect matters here, never an answer: the kernel completes it from the listen backlog
  * without the host's event loop, so a live owner under load still accepts within this budget.

package/dist/modes/rpc/host-ensure.js

@@ -7,7 +7,7 @@ import { clearHostRegistration, readHostRegistration, writtenByThisProcess, } fr
 import { claimHostOwner } from "./host-daemon-state.js";
 import { decideHostAction, HostEnsureRefusedError } from "./host-decision.js";
 import { ensureClient } from "./host-ensure-client.js";
-import { publicEndpointAccepts, refuseIfStalled, unregisteredEndpointHeld } from "./host-ensure-liveness.js";
+import { refuseIfForeignHeld, refuseIfStalled, unregisteredEndpointHeld } from "./host-ensure-liveness.js";
 import { hostEnsureLockOptions, hostEnsureLockTarget } from "./host-ensure-lock.js";
 import { appendStderr, DEFAULT_READINESS_TIMEOUT_MS, DEFAULT_STOP_TIMEOUT_MS, startHost } from "./host-ensure-start.js";
 import { delay, ensureSender, matchesPidFileOrUnknown, resolvePidFileOwnership, STOP_WAIT_BUDGET_MS, stopManagedHost, } from "./host-ensure-stop.js";
@@ -148,8 +148,7 @@ async function ensureHostLocked(paths, socket, options, stopDeadline = Date.now(
         if (!startedByUs) {
             // I1: the socket is silent, but the process behind it is alive. Only the process that WROTE
             // this record may end it - anyone else refuses rather than signalling somebody else's host.
-            if (await publicEndpointAccepts(socket))
-                throw new HostEnsureRefusedError(socket, "foreign_writer", protocol);
+            await refuseIfForeignHeld(paths, registered, socket, protocol);
             await refuseIfStalled(paths, registered.instanceId, socket, protocol);
             // A foreign record whose public endpoint accepts NOTHING names a generation nobody can reach:
             // its entry was replaced (so it is already draining, #1893) or removed, or a dead listener

package/dist/modes/rpc/host-holder.d.ts

@@ -0,0 +1,27 @@
+/**
+ * WHO holds an endpoint an ensure refused to touch (omo-desktop-app#3561).
+ *
+ * A `foreign_writer` refusal is final by I1: the registered generation was written by another process,
+ * it still accepts at the public path, and it did not answer as a host. The refusal used to carry only
+ * its reason, so every client - TUI, CLI, desktop - could say that something was in the way but not
+ * what. The generation's own record already names it; this is that record as the refusal reports it.
+ *
+ * A leaf on purpose: `host-decision.ts` words refusals with it and sits in the supervisor's import graph.
+ */
+/** The generation a refusal left standing, as its registration records it. */
+export interface HostHolder {
+    /** The process serving the endpoint (the generation's supervisor). */
+    readonly pid: number;
+    readonly instanceId: string;
+    readonly generation: number;
+    readonly processStartTime: string | null;
+    /** The engine build the generation recorded at start; `null` for a record that predates the field. */
+    readonly engineVersion: string | null;
+    /** The launch profile the generation was started with; `null` when it recorded none. */
+    readonly launchProfileId: string | null;
+    /** The process that registered the generation (the client whose ensure started it). */
+    readonly writerPid: number | null;
+}
+/** The holder in one clause: `pid 4242, engine 2026.10.16, launch profile cli-profile`. */
+export declare function describeHostHolder(holder: HostHolder): string;
+//# sourceMappingURL=host-holder.d.ts.map

package/dist/modes/rpc/host-holder.js

@@ -0,0 +1,18 @@
+/**
+ * WHO holds an endpoint an ensure refused to touch (omo-desktop-app#3561).
+ *
+ * A `foreign_writer` refusal is final by I1: the registered generation was written by another process,
+ * it still accepts at the public path, and it did not answer as a host. The refusal used to carry only
+ * its reason, so every client - TUI, CLI, desktop - could say that something was in the way but not
+ * what. The generation's own record already names it; this is that record as the refusal reports it.
+ *
+ * A leaf on purpose: `host-decision.ts` words refusals with it and sits in the supervisor's import graph.
+ */
+/** The holder in one clause: `pid 4242, engine 2026.10.16, launch profile cli-profile`. */
+export function describeHostHolder(holder) {
+    const engine = holder.engineVersion === null ? "an unrecorded engine" : `engine ${holder.engineVersion}`;
+    const profile = holder.launchProfileId === null ? "" : `, launch profile ${holder.launchProfileId}`;
+    const writer = holder.writerPid === null || holder.writerPid === holder.pid ? "" : `, started by pid ${holder.writerPid}`;
+    return `pid ${holder.pid}, ${engine}${profile}${writer}`;
+}
+//# sourceMappingURL=host-holder.js.map

package/dist/modes/rpc/host-runner.d.ts

@@ -3,6 +3,7 @@ import { type HostDecisionPolicy } from "./host-decision.ts";
 import { type IdleHandoverTerms } from "./host-handover-request.ts";
 import type { ResolvedHostLaunchSpec } from "./host-launch-spec.ts";
 import { type HostOutcome } from "./host-outcome.ts";
+import type { HostStopGeneration } from "./host-stop-generation.ts";
 export { HOST_EXIT_ERROR, HOST_EXIT_FALLBACK, HOST_EXIT_OK, HOST_EXIT_REFUSED, HOST_EXIT_USAGE, type HostOutcome, } from "./host-outcome.ts";
 /** Which daemon a request is about: the endpoint, and the agent directory holding its state. */
 export interface HostTarget {
@@ -25,6 +26,7 @@ export type HostRequest = {
     readonly target: HostTarget;
     readonly drain: boolean;
     readonly force: boolean;
+    readonly expectedGeneration?: HostStopGeneration;
     /** With `drain`: the generation to drain, by instance id (senpi#3653). */
     readonly instanceId?: string;
     /** With `drain`: wait up to this long for that generation to exit. */

package/dist/modes/rpc/host-runner.js

@@ -31,7 +31,7 @@ import { clientRuntimeBuildId, decisionClient, HOST_EXIT_OK, HOST_EXIT_REFUSED,
 import { probeProtocolInfo } from "./host-probe.js";
 import { readHostStatus, readSessionCounts } from "./host-status.js";
 import { readAllHostStatus } from "./host-status-all.js";
-import { stopHost } from "./host-stop.js";
+import { staleStopGeneration, stopHost } from "./host-stop.js";
 export { HOST_EXIT_ERROR, HOST_EXIT_FALLBACK, HOST_EXIT_OK, HOST_EXIT_REFUSED, HOST_EXIT_USAGE, } from "./host-outcome.js";
 const PROBE_TIMEOUT_MS = 10_000;
 export async function runHostRequest(request) {
@@ -93,6 +93,7 @@ async function ensureOutcome(target, spec, policy) {
             reason: error.reason,
             socket: target.socket,
             ...(error.detail !== undefined && { detail: error.detail }),
+            ...(error.holder !== undefined && { holder: error.holder }),
         });
     }
     const host = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS).finally(ensured.release);
@@ -140,6 +141,11 @@ function shardPathOutcome(kind, owner, root) {
  */
 async function stopOutcome(request) {
     const { target, drain, force, instanceId, waitMs } = request;
+    if (request.expectedGeneration !== undefined) {
+        const stale = await staleStopGeneration(target.socket, target.agentDir, request.expectedGeneration);
+        if (stale !== undefined)
+            return refusal("refuse", undefined, { reason: stale.reason, socket: target.socket });
+    }
     const host = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     const sessions = await readSessionCounts(target.socket, true);
     const occupied = sessions.foreign_attached + sessions.foreign_retained > 0;
@@ -151,6 +157,7 @@ async function stopOutcome(request) {
         agentDir: target.agentDir,
         drain,
         force,
+        ...(request.expectedGeneration !== undefined && { expectedGeneration: request.expectedGeneration }),
         ...(instanceId !== undefined && { instanceId }),
         ...(waitMs !== undefined && { waitMs }),
     });

package/dist/modes/rpc/host-status-all.js

@@ -96,6 +96,7 @@ async function unaddressableStatus(dir) {
         reachable: false,
         lifecycle: null,
         pid: null,
+        processStartTime: null,
         instanceId: null,
         generation: null,
         engineVersion: null,