@code-yeongyu/senpi 2026.10.21-1 → 2026.10.21-2

package/dist/modes/rpc/host-status.d.ts

@@ -24,6 +24,7 @@ export interface HostStatusReport {
     readonly lifecycle: "ready" | "stopping" | null;
     readonly socket: string;
     readonly pid: number | null;
+    readonly processStartTime: string | null;
     readonly instanceId: string | null;
     readonly generation: number | null;
     readonly engineVersion: string | null;

package/dist/modes/rpc/host-status.js

@@ -13,6 +13,7 @@
 import { isHostCrash, readHostCrashRecords } from "./host-crash-record.js";
 import { readDaemonEnvKeys } from "./host-daemon-env.js";
 import { createHostDaemonPaths, parseShardSocket } from "./host-daemon-paths.js";
+import { readHostRegistration } from "./host-daemon-registration.js";
 import { pruneDeadGenerations, readGenerationRows } from "./host-generations.js";
 import { OBSERVE_REQUEST_FIELD } from "./host-observe-request.js";
 import { observeProtocolInfo, requestOnSocket } from "./host-probe.js";
@@ -44,6 +45,7 @@ export async function probeHostStatus(options, read = {}) {
         await pruneDeadGenerations(paths);
     const generations = await readGenerationRows(paths, { includeDead: !prune });
     const current = generations.find((row) => row.current && row.alive);
+    const registered = await readHostRegistration(paths);
     const metrics = current ? await readHostProcessMetrics(current.pid) : UNOBSERVED_METRICS;
     // A socket that did not answer who it is will not answer what it holds: asking again would only
     // spend a second budget on a hung endpoint.
@@ -56,6 +58,9 @@ export async function probeHostStatus(options, read = {}) {
         lifecycle: host?.lifecycle ?? null,
         socket: options.socket,
         pid: current?.pid ?? null,
+        processStartTime: registered?.instanceId === current?.instanceId && registered?.record.pid === current?.pid
+            ? (registered?.record.processStartTime ?? null)
+            : null,
         instanceId: host?.instanceId ?? current?.instanceId ?? null,
         generation: host?.generation ?? current?.generation ?? null,
         engineVersion: host?.engineVersion ?? current?.engineVersion ?? null,

package/dist/modes/rpc/host-stop-generation.d.ts

@@ -0,0 +1,22 @@
+import type { RegisteredHost } from "./host-daemon-registration.ts";
+/**
+ * The registration the operator saw and authorized, never a newly resolved target. `processStartTime`
+ * is null where the platform cannot read it (Windows); the key itself is always present.
+ */
+export interface HostStopGeneration {
+    readonly instanceId: string;
+    readonly generation: number;
+    readonly pid: number;
+    readonly processStartTime: string | null;
+}
+export declare function parseHostStopGeneration(text: string): HostStopGeneration | undefined;
+/**
+ * How the current registration compares with the confirmed one:
+ * - `proven`: same generation, and the start times agree; the live process is still checked before signalling.
+ * - `bound_without_start_time`: same pid, instance and generation on a platform that records no start time.
+ * - `stale`: a different generation, pid or start time holds the endpoint now.
+ * - `unprovable`: same generation, but the start time cannot prove the process (`unknown_owner`).
+ */
+export type StopGenerationMatch = "proven" | "bound_without_start_time" | "stale" | "unprovable";
+export declare function compareStopGeneration(registered: RegisteredHost | undefined, expected: HostStopGeneration): StopGenerationMatch;
+//# sourceMappingURL=host-stop-generation.d.ts.map

package/dist/modes/rpc/host-stop-generation.js

@@ -0,0 +1,36 @@
+import { parseJson } from "./host-daemon-state.js";
+import { processStartTimeIsUnreadable } from "./host-stop-start-time.js";
+export function parseHostStopGeneration(text) {
+    const value = parseJson(text);
+    if (!value ||
+        typeof value.instanceId !== "string" ||
+        value.instanceId.length === 0 ||
+        typeof value.generation !== "number" ||
+        !Number.isSafeInteger(value.generation) ||
+        value.generation < 0 ||
+        typeof value.pid !== "number" ||
+        !Number.isSafeInteger(value.pid) ||
+        value.pid <= 0 ||
+        !(value.processStartTime === null ||
+            (typeof value.processStartTime === "string" && value.processStartTime.length > 0)))
+        return undefined;
+    return {
+        instanceId: value.instanceId,
+        generation: value.generation,
+        pid: value.pid,
+        processStartTime: value.processStartTime,
+    };
+}
+export function compareStopGeneration(registered, expected) {
+    if (registered?.instanceId !== expected.instanceId ||
+        registered.generation !== expected.generation ||
+        registered.record.pid !== expected.pid)
+        return "stale";
+    const recorded = registered.record.processStartTime;
+    if (recorded !== null && expected.processStartTime !== null)
+        return recorded === expected.processStartTime ? "proven" : "stale";
+    if (recorded === null && expected.processStartTime === null && processStartTimeIsUnreadable())
+        return "bound_without_start_time";
+    return "unprovable";
+}
+//# sourceMappingURL=host-stop-generation.js.map

package/dist/modes/rpc/host-stop-start-time.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Whether this platform can record a process start time at registration. On Windows the CIM probe often
+ * outlives its 1 s budget while a host starts, so engine hosts record `processStartTime: null` (measured
+ * on a Windows runner) and a generation-bound stop cannot compare start times (omo-desktop-app#3561).
+ */
+export declare function processStartTimeIsUnreadable(): boolean;
+/** The live start time of `pid` now, or undefined when the process is gone. Throws when unreadable. */
+export declare function readLiveStartTime(pid: number): Promise<string | undefined>;
+/**
+ * Proves, without a recorded start time, that `pid` is still the process that wrote `registrationFile`:
+ * that process started before it wrote the file, so a live start time LATER than the file's mtime is a
+ * reused pid. Gone, unreadable or unparseable is not proven.
+ */
+export declare function startedBeforeRegistration(pid: number, registrationFile: string): Promise<boolean>;
+//# sourceMappingURL=host-stop-start-time.d.ts.map

package/dist/modes/rpc/host-stop-start-time.js

@@ -0,0 +1,30 @@
+import { stat } from "node:fs/promises";
+import { processStartTimeMs, readProcessStartTime } from "../../utils/process-identity.js";
+/**
+ * Whether this platform can record a process start time at registration. On Windows the CIM probe often
+ * outlives its 1 s budget while a host starts, so engine hosts record `processStartTime: null` (measured
+ * on a Windows runner) and a generation-bound stop cannot compare start times (omo-desktop-app#3561).
+ */
+export function processStartTimeIsUnreadable() {
+    return process.platform === "win32";
+}
+/** A stop is an operator action: give the start-time probe the budget a loaded Windows host needs. */
+const STOP_START_TIME_BUDGET_MS = 10_000;
+/** The live start time of `pid` now, or undefined when the process is gone. Throws when unreadable. */
+export function readLiveStartTime(pid) {
+    return readProcessStartTime(pid, process.platform, STOP_START_TIME_BUDGET_MS);
+}
+/**
+ * Proves, without a recorded start time, that `pid` is still the process that wrote `registrationFile`:
+ * that process started before it wrote the file, so a live start time LATER than the file's mtime is a
+ * reused pid. Gone, unreadable or unparseable is not proven.
+ */
+export async function startedBeforeRegistration(pid, registrationFile) {
+    const live = await readLiveStartTime(pid).catch(() => undefined);
+    const startedMs = live === undefined ? undefined : processStartTimeMs(live);
+    if (startedMs === undefined)
+        return false;
+    const written = await stat(registrationFile).catch(() => undefined);
+    return written !== undefined && startedMs <= written.mtimeMs;
+}
+//# sourceMappingURL=host-stop-start-time.js.map

package/dist/modes/rpc/host-stop.d.ts

@@ -19,6 +19,7 @@
  * error to a caller that asked for exactly that outcome.
  */
 import { type DrainHostResult } from "./host-stop-drain.ts";
+import { type HostStopGeneration } from "./host-stop-generation.ts";
 export interface StopHostOptions {
     readonly socket: string;
     readonly agentDir?: string;
@@ -33,13 +34,15 @@ export interface StopHostOptions {
     readonly timeoutMs?: number;
     /** Refuse unless the host answers both reads: a caller that judged it idle must not stop it unseen. */
     readonly requireAnswer?: boolean;
+    /** Refuse rather than signal a generation other than the one the operator confirmed. */
+    readonly expectedGeneration?: HostStopGeneration;
 }
 export type StopHostResult = DrainHostResult | {
     readonly action: "stopped";
     readonly pid: number;
 } | {
     readonly action: "refuse";
-    readonly reason: "unknown_owner" | "drain_unsupported" | "sessions_live";
+    readonly reason: "unknown_owner" | "drain_unsupported" | "sessions_live" | "stale_generation";
 };
 /**
  * Ends a running generation. `drain` is always permitted - it ends no work, it only stops the
@@ -47,6 +50,14 @@ export type StopHostResult = DrainHostResult | {
  * operator never silently kills another client's sessions.
  */
 export declare function stopHost(options: StopHostOptions): Promise<StopHostResult>;
+type StopRefusal = Extract<StopHostResult, {
+    action: "refuse";
+}>;
+/**
+ * Refuses a binding the endpoint no longer matches, before any probe or census (desktop#3561 review): a
+ * caller learns its confirmation is stale rather than that the host it no longer names is busy.
+ */
+export declare function staleStopGeneration(socket: string, agentDir: string | undefined, expected: HostStopGeneration): Promise<StopRefusal | undefined>;
 /**
  * Signals a generation whose owner was just proven, and reports whether the signal was delivered.
  *
@@ -56,4 +67,5 @@ export declare function stopHost(options: StopHostOptions): Promise<StopHostResu
  * the request. Any OTHER signalling failure (EPERM against somebody else's process) still throws.
  */
 export declare function signalGeneration(pid: number, signal: NodeJS.Signals): boolean;
+export {};
 //# sourceMappingURL=host-stop.d.ts.map

package/dist/modes/rpc/host-stop.js

@@ -18,21 +18,46 @@
  * failure ESRCH means "already gone", not "something went wrong", and must never surface as a raw
  * error to a caller that asked for exactly that outcome.
  */
-import { createHostDaemonPaths, generationPaths } from "./host-daemon-paths.js";
+import { createHostDaemonPaths, generationPaths, sameEndpoint } from "./host-daemon-paths.js";
 import { provenOwner, readHostRegistration, releaseGeneration } from "./host-daemon-registration.js";
+import { acquireHostEnsureLock } from "./host-ensure-lock.js";
 import { probeProtocolInfo, probeSessionCount } from "./host-probe.js";
 import { drainHost } from "./host-stop-drain.js";
+import { compareStopGeneration } from "./host-stop-generation.js";
 import { writeStopIntent } from "./host-stop-intent.js";
+import { startedBeforeRegistration } from "./host-stop-start-time.js";
 /**
  * Ends a running generation. `drain` is always permitted - it ends no work, it only stops the
  * host from taking new work - while a hard stop requires either an empty host or `force`, so an
  * operator never silently kills another client's sessions.
  */
 export async function stopHost(options) {
+    // A binding names the generation a HARD stop may signal; a drain targets its own instance and must not hold the lock.
+    if (options.expectedGeneration !== undefined && options.drain === true)
+        throw new TypeError("stopHost: expectedGeneration binds a hard stop and cannot be combined with drain");
+    // GC already holds this lock and uses an unqualified stop. Conditional operator stops acquire it
+    // here so ensure/handoff cannot publish a different generation between the check and signal.
+    if (options.expectedGeneration === undefined)
+        return stopHostLocked(options);
+    const release = await acquireHostEnsureLock(options.socket, 30_000);
+    try {
+        return await stopHostLocked(options);
+    }
+    finally {
+        await release();
+    }
+}
+async function stopHostLocked(options) {
     const paths = createHostDaemonPaths({
         socket: options.socket,
         ...(options.agentDir ? { agentDir: options.agentDir } : {}),
     });
+    const expected = options.expectedGeneration;
+    if (expected !== undefined) {
+        const refusal = generationRefusal(compareStopGeneration(await readHostRegistration(paths), expected));
+        if (refusal !== undefined)
+            return refusal;
+    }
     if (options.drain === true) {
         return drainHost(paths, {
             socket: options.socket,
@@ -41,9 +66,8 @@ export async function stopHost(options) {
             ...(options.timeoutMs !== undefined && { timeoutMs: options.timeoutMs }),
         });
     }
-    const registered = await readHostRegistration(paths);
-    const owner = await provenOwner(registered, options.socket);
-    if (!owner)
+    const owner = expected === undefined ? await provenOwner(await readHostRegistration(paths), options.socket) : undefined;
+    if (expected === undefined && !owner)
         return { action: "refuse", reason: "unknown_owner" };
     const host = await probeProtocolInfo(options.socket, options.timeoutMs ?? 10_000);
     // A hard stop ends whatever the host is doing, including work that belongs to other clients:
@@ -55,19 +79,64 @@ export async function stopHost(options) {
     if (options.requireAnswer === true && (host === undefined || sessions === undefined)) {
         return { action: "refuse", reason: "sessions_live" };
     }
-    await writeStopIntent(generationPaths(paths, owner.instanceId), {
+    const target = expected === undefined ? owner : await recheckedTarget(paths, options.socket, expected, host);
+    if (target === undefined)
+        return { action: "refuse", reason: "unknown_owner" };
+    if ("action" in target)
+        return target;
+    await writeStopIntent(generationPaths(paths, target.instanceId), {
         sender: { pid: process.pid, kind: "stop" },
-        targetPid: owner.pid,
+        targetPid: target.pid,
         reason: "operator_stop",
         signal: "SIGTERM",
         at: new Date().toISOString(),
     });
-    const delivered = signalGeneration(owner.pid, "SIGTERM");
+    const delivered = signalGeneration(target.pid, "SIGTERM");
     // A signal is not an exit: only the supervisor may release ownership after reaping its host.
     // Its circuit breaker deliberately leaves these records intact while the child might be alive.
     if (!delivered)
-        await releaseGeneration(paths, { instanceId: owner.instanceId, pid: owner.pid });
-    return { action: "stopped", pid: owner.pid };
+        await releaseGeneration(paths, { instanceId: target.instanceId, pid: target.pid });
+    return { action: "stopped", pid: target.pid };
+}
+function generationRefusal(match) {
+    if (match === "stale")
+        return { action: "refuse", reason: "stale_generation" };
+    if (match === "unprovable")
+        return { action: "refuse", reason: "unknown_owner" };
+    return undefined;
+}
+/**
+ * Refuses a binding the endpoint no longer matches, before any probe or census (desktop#3561 review): a
+ * caller learns its confirmation is stale rather than that the host it no longer names is busy.
+ */
+export async function staleStopGeneration(socket, agentDir, expected) {
+    const paths = createHostDaemonPaths({ socket, ...(agentDir ? { agentDir } : {}) });
+    return generationRefusal(compareStopGeneration(await readHostRegistration(paths), expected));
+}
+/**
+ * The confirmed generation re-read after the probes, and the only pid/instance the stop may signal: the
+ * expected identity itself, never a registration read that was not compared with it.
+ */
+async function recheckedTarget(paths, socket, expected, host) {
+    const current = await readHostRegistration(paths);
+    const match = compareStopGeneration(current, expected);
+    const refusal = generationRefusal(match);
+    if (refusal !== undefined)
+        return refusal;
+    if (match === "proven" && !(await provenOwner(current, socket)))
+        return undefined;
+    if (match === "bound_without_start_time") {
+        // No start time was recorded (Windows), so prove the same process another way before signalling: this
+        // endpoint, a live process that started before it wrote this registration (a later start is a reused pid),
+        // and, when the host answered, the confirmed instance.
+        if (current?.socket !== undefined && !sameEndpoint(current.socket, socket))
+            return undefined;
+        if (!(await startedBeforeRegistration(expected.pid, generationPaths(paths, expected.instanceId).pidFile)))
+            return undefined;
+        if (host?.instanceId !== undefined && host.instanceId !== expected.instanceId)
+            return { action: "refuse", reason: "stale_generation" };
+    }
+    return { pid: expected.pid, instanceId: expected.instanceId };
 }
 /**
  * Signals a generation whose owner was just proven, and reports whether the signal was delivered.

package/dist/modes/rpc/rpc-client.d.ts

@@ -179,6 +179,11 @@ export declare class RpcClient {
     }>, "type" | "id" | "sessionId"> & {
         readonly sessionId?: string;
     }): Promise<RpcUnloadAnswer>;
+    /**
+     * Patch the context the attached session publishes (`set_session_context`); `null` deletes a key.
+     * Rejects with {@link RpcCommandError} carrying the host's code (`session_not_attached`, `invalid_session_context`).
+     */
+    setSessionContext(patch: Record<string, string | number | boolean | null>, sessionId?: string | undefined): Promise<void>;
     closeSession(sessionId?: string | undefined): Promise<void>;
     /**
      * Drop this connection's session attachments and wait until the host confirms they are gone (senpi#3238).
@@ -523,6 +528,10 @@ export declare class RpcClient {
      * Set the session display name.
      */
     setSessionName(name: string): Promise<void>;
+    /**
+     * Report that the user started typing a draft, so a first-activity prompt-cache prewarm can run (senpi#3859).
+     */
+    recordDraftActivity(): Promise<void>;
     importJsonl(inputPath: string, cwdOverride?: string): Promise<{
         cancelled: boolean;
     }>;

package/dist/modes/rpc/rpc-client.js

@@ -341,6 +341,15 @@ export class RpcClient {
             throw new Error("unload_session needs a session");
         return this.getData(await this.send({ ...options, type: "unload_session", sessionId }, false));
     }
+    /**
+     * Patch the context the attached session publishes (`set_session_context`); `null` deletes a key.
+     * Rejects with {@link RpcCommandError} carrying the host's code (`session_not_attached`, `invalid_session_context`).
+     */
+    async setSessionContext(patch, sessionId = this.sessionId) {
+        if (!sessionId)
+            throw new Error("set_session_context needs a session");
+        this.getData(await this.send({ type: "set_session_context", sessionId, patch }, false));
+    }
     async closeSession(sessionId = this.sessionId) {
         if (!sessionId)
             return;
@@ -807,6 +816,12 @@ export class RpcClient {
     async setSessionName(name) {
         await this.send({ type: "set_session_name", name });
     }
+    /**
+     * Report that the user started typing a draft, so a first-activity prompt-cache prewarm can run (senpi#3859).
+     */
+    async recordDraftActivity() {
+        await this.send({ type: "record_user_activity", kind: "draft" });
+    }
     async importJsonl(inputPath, cwdOverride) {
         const response = await this.send({ type: "import_jsonl", inputPath, cwdOverride });
         return this.getData(response);

package/dist/modes/rpc/rpc-types.d.ts

@@ -372,6 +372,12 @@ type RpcSessionCommand = {
     id?: string;
     type: "set_session_name";
     name: string;
+}
+/** The user started typing a draft in this session's composer (senpi#3859). Only `draft` is accepted. */
+ | {
+    id?: string;
+    type: "record_user_activity";
+    kind: "draft";
 } | {
     id?: string;
     type: "import_jsonl";
@@ -572,6 +578,8 @@ export interface RpcAbortQuiesce {
 }
 /** Capability: `steer`/`follow_up` accept `whenIdle: "start"`. */
 export declare const STEER_WHEN_IDLE_CAPABILITY = "steer_when_idle";
+/** Capability: `record_user_activity` reports composer draft activity (senpi#3859). */
+export declare const USER_ACTIVITY_CAPABILITY = "user_activity";
 /** What `steer`/`follow_up` do on an idle session: queue (default) or start a turn. */
 export type RpcWhenIdle = "queue" | "start";
 /** What `dequeue_message` / `edit_queued_message` did; anything but removed/edited carries reason + action. */
@@ -1509,6 +1517,11 @@ export type RpcResponse = {
     type: "response";
     command: "set_session_name";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "record_user_activity";
+    success: true;
 } | {
     id?: string;
     type: "response";
@@ -1593,6 +1606,11 @@ export type RpcResponse = {
     type: "response";
     command: "login_api_key";
     success: true;
+    /** Present when the key replaced a login of the other kind; `backupPath` holds the previous file (senpi#3448). */
+    data?: {
+        replaced: "oauth" | "api_key";
+        backupPath?: string;
+    };
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/rpc-types.js

@@ -105,4 +105,6 @@ export const RPC_ERROR_HOST_DRAINING = "host_draining";
 export const RPC_ERROR_HOST_STOPPING = "host_stopping";
 /** Capability: `steer`/`follow_up` accept `whenIdle: "start"`. */
 export const STEER_WHEN_IDLE_CAPABILITY = "steer_when_idle";
+/** Capability: `record_user_activity` reports composer draft activity (senpi#3859). */
+export const USER_ACTIVITY_CAPABILITY = "user_activity";
 //# sourceMappingURL=rpc-types.js.map

package/dist/modes/rpc/session-binding.d.ts

@@ -13,5 +13,5 @@ export interface RpcSessionBinding {
  * Creates the extension UI bridge and subscriptions within the entry's provider
  * scope. The classic handler remains the single source of command semantics.
  */
-export declare function createRpcSessionBinding(sessionId: string, entry: RpcSessionEntry, writer: SessionEventWriter, requestClose: () => void, options?: Pick<RpcConnectionOptions, "capabilities" | "clientInfo">): Promise<RpcSessionBinding>;
+export declare function createRpcSessionBinding(sessionId: string, entry: RpcSessionEntry, writer: SessionEventWriter, requestClose: () => void, options?: Pick<RpcConnectionOptions, "capabilities" | "clientInfo" | "connectionRoles">): Promise<RpcSessionBinding>;
 //# sourceMappingURL=session-binding.d.ts.map

package/dist/modes/rpc/session-command-router.d.ts

@@ -61,6 +61,7 @@ export declare class SessionCommandRouter {
     private readonly createBinding;
     private readonly connectionOptions;
     private readonly pendingCapabilities;
+    private readonly connectionRoles;
     private readonly finalizations;
     private readonly idleNow;
     private readonly idleEvictionMs;

package/dist/modes/rpc/session-command-router.js

@@ -2,6 +2,7 @@ import { VERSION } from "../../config.js";
 import { subscriptionLimits } from "../../core/subscription-limits/limit-store.js";
 import { detachConnection } from "./connection-detach.js";
 import { buildRpcSessionState } from "./connection-handler.js";
+import { CONNECTION_ROLE_FIXED, ConnectionRoles, roleConnection } from "./connection-roles.js";
 import { answerEffectFromTranscript } from "./effect-commands.js";
 import { latestSessionEffect } from "./effect-ledger.js";
 import { multiSessionHostCapabilities } from "./host-capabilities.js";
@@ -49,6 +50,7 @@ export class SessionCommandRouter {
         /** Connections whose socket has already been detached. */
         this.releasedConnections = new Set();
         this.pendingCapabilities = new Map();
+        this.connectionRoles = new ConnectionRoles();
         this.finalizations = new Map();
         this.draining = false;
         this.handoffParks = 0;
@@ -320,6 +322,15 @@ export class SessionCommandRouter {
         }
         if (command.type === "set_client_info" && !command.sessionId) {
             const connection = this.writer.currentConnection();
+            if (command.capabilities !== undefined &&
+                !this.connectionRoles.declare(roleConnection(connection), command.capabilities))
+                return {
+                    id: command.id,
+                    type: "response",
+                    command: "set_client_info",
+                    success: false,
+                    error: CONNECTION_ROLE_FIXED,
+                };
             if (connection !== undefined) {
                 this.pendingCapabilities.set(connection, command.capabilities ?? []);
                 this.writer.setConnectionCapabilities(connection, command.capabilities ?? []);
@@ -766,6 +777,7 @@ export class SessionCommandRouter {
                     capabilities: owner !== undefined
                         ? (this.pendingCapabilities.get(owner) ?? this.connectionOptions?.capabilities ?? [])
                         : this.connectionOptions?.capabilities,
+                    connectionRoles: this.connectionRoles,
                     clientInfo: {
                         setCapabilities: (connectionId, capabilities) => {
                             if (connectionId !== undefined) {
@@ -872,6 +884,7 @@ export class SessionCommandRouter {
     async releaseConnection(connectionId) {
         this.releasedConnections.add(connectionId);
         this.writer.clearConnectionCapabilities(connectionId);
+        this.connectionRoles.release(connectionId);
         for (const sessionId of this.sessionsByConnection.get(connectionId)?.keys() ?? [])
             this.writer.detachConnectionFromSession(connectionId, sessionId);
         const opens = this.opensByConnection.get(connectionId);

package/dist/modes/rpc/session-worker-client.d.ts

@@ -43,7 +43,7 @@ export declare class SessionWorkerClient {
     /** Moves the worker's live session to another permission preset (a later `open_session.permissionPreset`). */
     setPermissionPreset(preset: string): Promise<void>;
     commit(): Promise<WorkerSnapshot>;
-    bind(sessionId: string, writer: SessionEventWriter, requestClose: () => void, options: Pick<RpcConnectionOptions, "capabilities" | "clientInfo">): Promise<RpcSessionBinding>;
+    bind(sessionId: string, writer: SessionEventWriter, requestClose: () => void, options: Pick<RpcConnectionOptions, "capabilities" | "clientInfo" | "connectionRoles">): Promise<RpcSessionBinding>;
     get busy(): boolean;
     get handoffBusy(): boolean;
     subscribeSettled(listener: () => void): () => void;

package/dist/modes/rpc/session-worker-client.js

@@ -3,6 +3,7 @@ import { Worker } from "node:worker_threads";
 import { isBunBinary } from "../../config.js";
 import { ownProcessStartedAtMs } from "../../core/extensions/builtin/terminal/process-identity.js";
 import { createWebViewBroker } from "../../core/webview/webview-broker.js";
+import { roleConnection } from "./connection-roles.js";
 import { SessionWorkerRequests } from "./session-worker-requests.js";
 import { acknowledge, acknowledgeGrant } from "./session-worker-signals.js";
 const compiledWorkerEntry = typeof SENPI_RPC_SESSION_WORKER_ENTRY === "string"
@@ -95,10 +96,17 @@ export class SessionWorkerClient {
             sessionId,
             capabilities: options.capabilities ?? [],
             connection: writer.currentConnection(),
+            roles: options.connectionRoles?.rolesOf(roleConnection(writer.currentConnection())),
         });
         return {
             handle: async (command) => {
-                await this.request({ type: "command", command, connection: writer.currentConnection() });
+                const connection = writer.currentConnection();
+                await this.request({
+                    type: "command",
+                    command,
+                    connection,
+                    roles: options.connectionRoles?.rolesOf(roleConnection(connection)),
+                });
             },
             cancelPendingExtensionUiRequests: () => this.post({ type: "cancel_ui" }),
             dispose: async () => {
@@ -208,6 +216,9 @@ export class SessionWorkerClient {
                 return;
             }
             case "capabilities":
+                // The isolate already refused a changed role; a refusal here means the two registries drifted.
+                if (this.options.connectionRoles?.declare(roleConnection(message.connection), message.capabilities) === false)
+                    process.stderr.write(`senpi rpc worker role drift: connection ${roleConnection(message.connection)} declared a changed role\n`);
                 this.options.clientInfo?.setCapabilities(message.connection, message.capabilities);
                 acknowledge(message.signal, true);
                 return;

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -47,11 +47,14 @@ export type HostToSessionWorker = {
     sessionId: string;
     capabilities: readonly string[];
     connection?: string;
+    /** Roles the connection explicitly declared on the host (senpi#3811); the isolate adopts them. */
+    roles?: readonly string[];
 } | {
     type: "command";
     request: number;
     command: object;
     connection?: string;
+    roles?: readonly string[];
 } | {
     type: "prompt_surface";
     request: number;

package/dist/modes/rpc/session-worker.js

@@ -12,6 +12,7 @@ import { registerWebViewBroker } from "../../core/webview/webview-broker.js";
 import { createCliRuntimeFactory } from "../../main.js";
 import { initTheme } from "../interactive/theme/theme.js";
 import { buildRpcSessionState } from "./connection-handler.js";
+import { ConnectionRoles, roleConnection } from "./connection-roles.js";
 import { isHandoffBusy } from "./handoff-activity.js";
 import { createRpcSessionBinding } from "./session-binding.js";
 import { SessionEventWriter } from "./session-event-writer.js";
@@ -84,6 +85,8 @@ class WorkerEventWriter extends SessionEventWriter {
     }
 }
 const writer = new WorkerEventWriter();
+// One session per isolate: the roles of the connections it serves, adopted from the host before each command.
+const connectionRoles = new ConnectionRoles();
 let prepared;
 let registry;
 let entry;
@@ -150,9 +153,12 @@ async function handle(message) {
         case "bind": {
             if (!entry || binding)
                 throw new Error("Invalid session binding");
+            if (message.roles !== undefined)
+                connectionRoles.adopt(roleConnection(message.connection), message.roles);
             const bindingEntry = entry;
             const createBinding = () => createRpcSessionBinding(message.sessionId, bindingEntry, writer, () => send({ type: "request_close" }), {
                 capabilities: message.capabilities,
+                connectionRoles,
                 clientInfo: {
                     connectionId: () => writer.currentConnection(),
                     setCapabilities: (connection, capabilities) => exchange((signal) => ({ type: "capabilities", connection, capabilities, signal }), "session_worker_capabilities_denied"),
@@ -177,6 +183,8 @@ async function handle(message) {
                 ["abort", "abort_bash", "extension_ui_response", "extension_ui_progress"].includes(String(message.command.type));
             if (!binding || (closing && !privileged))
                 throw new Error("session_closing");
+            if (message.roles !== undefined)
+                connectionRoles.adopt(roleConnection(message.connection), message.roles);
             const activeBinding = binding;
             await (message.connection === undefined
                 ? activeBinding.handle(message.command)
@@ -212,6 +220,7 @@ async function handle(message) {
             unsubscribe?.();
             unsubscribeWake?.();
             await binding?.dispose();
+            connectionRoles.clear();
             if (entry?.runtime) {
                 const current = entry;
                 await runWithProviderScope(current.scope, async () => {