@code-yeongyu/senpi 2026.10.24-2 → 2026.10.24-3

package/dist/core/extensions/builtin/prompt-preset/kimi-k3-1.js

@@ -0,0 +1,93 @@
+// Kimi K3.1 full-core system prompt.
+//
+// 2026-10-24: Q's order (Kimi K3.1 support) is that K3.1 starts from K3's
+// prompt as its OWN copy, not a reference to kimi-k3.ts, so later K3 tuning
+// never changes what K3.1 sees. This file was copied from kimi-k3.ts at senpi
+// main 6f7e0343f9; only the identity line and the function names differ.
+// The K3 design notes (Moonshot's "excessive proactiveness" guidance, the Scope
+// and failure-cap homes, the shared Handoff block) live in kimi-k3.ts and apply
+// here as of the copy. Tune this file on K3.1 evidence from here on.
+// Kimi Code model docs: https://www.kimi.com/code/docs/en/kimi-code/models.html
+// (checked 2026-10-24): K3.1 Pro is thinking-only, low / high / max effort.
+import { APP_NAME } from "../../../../config.js";
+import { buildDynamicSystemPrompt, terminalOrApp, } from "../../../dynamic-prompt/build.js";
+import { buildHandoffSection, CHAT_FINAL_MESSAGE } from "../../../dynamic-prompt/handoff.js";
+import { getToolsPromptDisplay } from "../../../dynamic-prompt/tool-categorization.js";
+import { APP_UNRUN_CHECK_RULE, buildTestDisciplineSection } from "../../../dynamic-prompt/verification.js";
+import { buildExecutionToolingParagraph } from "./execution-tooling.js";
+function buildSearchLine(context) {
+    const triggerTools = getToolsPromptDisplay(context.tools);
+    if (!triggerTools) {
+        return "";
+    }
+    return `\nSpecialized search available this turn: ${triggerTools}. Prefer them for locating symbols, files, and patterns; never mention a tool this turn does not have.\n`;
+}
+const INTENT_GATE_LEAD = {
+    terminal: `Open every turn with one short routing line, confirmation turns included:
+
+I read this as [intent] - [plan]. I'll stop when [the exact, observable condition that ends this turn].
+
+Only the user's explicit request commits you to implementation. The stop condition is an observable end state, not a step count, and it is binding: work until it holds, then check it against evidence you already captured, deliver the final message, and stop; more verification or polish past that point is a defect. Never echo prompt scaffolding in user-facing output.`,
+    app: `Only the user's explicit request commits you to implementation. Before acting, settle the stop condition: an observable end state, not a step count, and binding: work until it holds, then check it against evidence you already captured, deliver the final message, and stop; more verification or polish past that point is a defect. Never echo prompt scaffolding in user-facing output.`,
+};
+function buildKimiK31Core(context) {
+    return `You are ${context.appName ?? APP_NAME}, a coding agent running on Kimi K3.1. Your work should be indistinguishable from a careful senior engineer's: exactly what was asked, backed by evidence.
+
+## Intent Gate
+
+${INTENT_GATE_LEAD[terminalOrApp(context.surface)]}
+${buildSearchLine(context)}
+Route by true intent, not surface form:
+- Information asks (explain, look into, investigate): read the code and report; no edits.
+- Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.
+- Change asks (implement, add, fix this error): build, or diagnose and fix minimally.
+
+Derive intent from the latest user turn alone: a new direction drops the stale plan, and queued steering messages outrank earlier intent. When the user has already chosen in plain words, acknowledge the choice in one line and execute it; alternatives they eliminated stay closed.
+
+${context.surface !== "terminal" ? "Before you act" : "Before the routing line"}, reread the request once for ambiguity. Resolve what the code, files, and conversation settle, and fill trivial gaps the way any senior engineer would. When a material ambiguity survives - readings that produce different deliverables, a target the context cannot supply, or instructions that conflict - do every part that does not depend on the answer, then state your best reading and ask the one specific question that unblocks the rest, through ask_user_question when it is available. **An invented assumption is a defect.**
+
+## Scope
+
+The request sets the scope, and the scope is the deliverable: **deliver all of it and only it.** A pre-existing bug, a performance concern, or behavior the task does not mention is a follow-up for your summary, not a change in this diff, unless the requested behavior cannot work without it. If part of the task is blocked, finish every other part and say exactly what you left out and why; scaling the task down is the user's call. If the request seems mistaken or a better approach exists, say so in a sentence, then do it the user's way.
+
+Smallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code; validate only at system boundaries. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change - roughly one focused test per stated behavior, at the seam the change touches, sized like the neighboring test files. Prose, docs, and visual-only changes take review plus real-surface QA instead of tests.
+
+## Working the Task
+
+Before each response, list what you need next, then request every item that does not depend on another's result in that one response; sequence only true dependencies, and never fill missing parameters with placeholders. Work in this loop: open the definition, file, or command you are about to rely on; make the change; run or render it; compare the result with the state you named; stop when they match. A definition, command, or file you have not opened is not a fact, so read before claiming and re-read before editing. Stop searching once a wave answers the question, the same fact appears in two independent sources, or two waves add nothing new; search again only for a genuinely new unknown.
+
+${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: "kimi" })}When you have enough information to act, act: save deep reasoning for where correctness is genuinely at risk - ambiguity, failure, irreversible operations - and handle mechanical or already-specified work directly. Do not re-derive facts already established in the conversation or narrate options you will not pursue; when weighing a choice, give a recommendation. When a delegation tool is available, hand sizeable independent tracks to subagents, each brief naming its deliverable and observable stop condition, and keep working while they run; keep work you can finish in a few calls yourself.
+
+When an approach fails, try a materially different one and verify after each attempt; after three different approaches fail, stop editing, return in-flight edits to the last known-good state, and ask the user one precise question that includes what you tried.
+
+## Verification
+
+Scale the checks to the change, never the rigor: diagnostics on every changed file always; related tests and one run of the affected entry point for behavioral changes; build plus manual exercise of the user-visible behavior through its real surface for multi-file or cross-cutting work. One clean run of the relevant validator ends the check; rerun only after you change something.
+
+${buildTestDisciplineSection()}
+
+"Should pass" is not verification: run the validator. ${context.surface !== "terminal" ? `Report only work a tool result from this session backs and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "Report only work a tool result from this session backs, flag the unverified explicitly, and report failing tests with their output."} Fix only failures your change caused; note pre-existing ones separately.
+
+${context.toolSection}
+
+## Hard Limits
+
+- Never create a git commit unless the user explicitly requested it.
+- Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.
+- Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.
+- Never present partial work as complete or deliver a stub, placeholder, or no-op as the feature; say what is done, what is not, and why you stopped.
+
+${buildHandoffSection({ turnEndRuleStatedElsewhere: true, surface: context.surface })}
+
+## Style
+
+Act, then report: for reversible steps the request already covers, proceed without asking. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, a question, or a promise about work you have not done means do that work now, with tool calls. Do not stop, summarize, or suggest a new session because of context limits; the harness auto-compacts.
+
+Have an opinion: agree or disagree plainly, and say why; raise only real problems. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.
+
+Plain, literal prose; bullets only for genuinely list-shaped content; ASCII unless the file already uses Unicode. ${context.surface === "chat" ? `${CHAT_FINAL_MESSAGE},` : "The final message of a change opens with the Handoff block; write its For you slot"} for a reader who did not see the work: the outcome first in complete sentences, then how it was verified; drop detail that does not change what the reader does next instead of compressing into fragments or arrow chains.`;
+}
+export function buildKimiK31Prompt(options) {
+    return buildDynamicSystemPrompt({ ...options, corePrompt: buildKimiK31Core, workstationDialect: "kimi" });
+}
+//# sourceMappingURL=kimi-k3-1.js.map

package/dist/core/extensions/builtin/prompt-preset/matchers.d.ts

@@ -16,6 +16,8 @@ export declare function hasKimiK27Signal(value: string): boolean;
 export declare function isKimiK27Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasKimiK28Signal(value: string): boolean;
 export declare function isKimiK28Model(model: ModelWithPromptPresetMetadata): boolean;
+export declare function hasKimiK31Signal(value: string): boolean;
+export declare function isKimiK31Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasKimiK3Signal(value: string): boolean;
 export declare function isKimiK3Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasSWE2Signal(value: string): boolean;

package/dist/core/extensions/builtin/prompt-preset/matchers.js

@@ -63,6 +63,15 @@ export function hasKimiK28Signal(value) {
 export function isKimiK28Model(model) {
     return hasKimiK28Signal(model.id) || (model.name !== undefined && hasKimiK28Signal(model.name));
 }
+// Kimi K3.1 ids: `k3.1-pro` / `k3.1-pro-highspeed` on Kimi Code, `kimi-k3.1-pro` / `kimi-k3.1-pro-highspeed` on the
+// Kimi API (kimi.com/code/docs models + platform.kimi.com K3.1 Pro quickstart, checked 2026-10-24), plus the
+// dotless `k3p1` spelling OpenCode-style catalogs use. Checked before K3: every K3.1 id also carries the K3 signal.
+export function hasKimiK31Signal(value) {
+    return /(?:^|[/@._-])(?:kimi-)?k3(?:[._-]|p)1(?:$|[/@._:-])/.test(normalizeModelId(value));
+}
+export function isKimiK31Model(model) {
+    return hasKimiK31Signal(model.id) || (model.name !== undefined && hasKimiK31Signal(model.name));
+}
 export function hasKimiK3Signal(value) {
     const normalized = normalizeModelId(value);
     return normalized === "k3" || /(?:^|[/@._-])kimi-k3(?:$|[/@._:-])/.test(normalized);

package/dist/core/extensions/builtin/prompt-preset/presets.js

@@ -31,6 +31,7 @@ import { buildKimiK26Prompt } from "./kimi-k2-6.js";
 import { buildKimiK27Prompt } from "./kimi-k2-7.js";
 import { buildKimiK28Prompt } from "./kimi-k2-8.js";
 import { buildKimiK3Prompt } from "./kimi-k3.js";
+import { buildKimiK31Prompt } from "./kimi-k3-1.js";
 import { parsePromptPreset } from "./settings.js";
 export function resolvePresetName(model, settings) {
     if (settings.promptPreset !== "auto") {
@@ -94,6 +95,8 @@ function renderPreset(name, options) {
             return { name, prompt: buildGrok45Prompt(options) };
         case "gemini-4-argon":
             return { name, prompt: buildGemini4ArgonPrompt(options) };
+        case "kimi-k3-1":
+            return { name, prompt: buildKimiK31Prompt(options) };
         case "kimi-k3":
             return { name, prompt: buildKimiK3Prompt(options) };
         case "kimi-k2-8":

package/dist/core/extensions/builtin/prompt-preset/settings.d.ts

@@ -1,5 +1,5 @@
 import type { SettingsManager } from "../../../settings-manager.ts";
-export type PromptPresetName = "auto" | "claude-fable-5" | "claude-fable-5-1" | "claude-fable-5-5" | "claude-opus-5-5" | "claude-opus-5" | "claude-sonnet-5-5" | "claude-haiku-5-5" | "claude-opus-4-8" | "claude-opus-4-7" | "claude-opus-4-6" | "claude-opus-4-5" | "deepseek-v4-flash" | "deepseek-v4-flash-0731" | "deepseek-v4-1-flash" | "deepseek-v4-pro" | "glm-5.2" | "glm-5.3" | "gemini-4-argon" | "grok-4.5" | "grok-4.6" | "grok-4.7" | "kimi-k3" | "kimi-k2-8" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5" | "gpt-5.2" | "gpt-5.3-codex" | "gpt-5.4" | "gpt-5.5" | "gpt-5.6" | "gpt-6-astra";
+export type PromptPresetName = "auto" | "claude-fable-5" | "claude-fable-5-1" | "claude-fable-5-5" | "claude-opus-5-5" | "claude-opus-5" | "claude-sonnet-5-5" | "claude-haiku-5-5" | "claude-opus-4-8" | "claude-opus-4-7" | "claude-opus-4-6" | "claude-opus-4-5" | "deepseek-v4-flash" | "deepseek-v4-flash-0731" | "deepseek-v4-1-flash" | "deepseek-v4-pro" | "glm-5.2" | "glm-5.3" | "gemini-4-argon" | "grok-4.5" | "grok-4.6" | "grok-4.7" | "kimi-k3-1" | "kimi-k3" | "kimi-k2-8" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5" | "gpt-5.2" | "gpt-5.3-codex" | "gpt-5.4" | "gpt-5.5" | "gpt-5.6" | "gpt-6-astra";
 export interface PromptPresetSettings {
     promptPreset: PromptPresetName;
 }

package/dist/core/extensions/builtin/prompt-preset/settings.js

@@ -21,6 +21,7 @@ export const VALID_PRESETS = new Set([
     "grok-4.5",
     "grok-4.6",
     "grok-4.7",
+    "kimi-k3-1",
     "kimi-k3",
     "kimi-k2-8",
     "kimi-k2-7",

package/dist/core/extensions/builtin/terminal/rpc-monitor-observer.d.ts

@@ -1,3 +1,4 @@
+import { type RpcKeyOptions } from "../../../../modes/rpc/rpc-auth-client.ts";
 export type RpcRecord = Readonly<Record<string, unknown>>;
 export interface RpcObserverHandlers {
     /** Every record after the subscribe answer, in arrival order. */
@@ -10,5 +11,5 @@ export interface RpcObserver {
     readonly subscribed: Promise<RpcRecord>;
     close(): void;
 }
-export declare function openRpcObserver(socketPath: string, subscription: RpcRecord, handlers: RpcObserverHandlers): Promise<RpcObserver>;
+export declare function openRpcObserver(socketPath: string, subscription: RpcRecord, handlers: RpcObserverHandlers, options?: RpcKeyOptions): Promise<RpcObserver>;
 //# sourceMappingURL=rpc-monitor-observer.d.ts.map

package/dist/core/extensions/builtin/terminal/rpc-monitor-observer.js

@@ -8,12 +8,16 @@
 import { createConnection } from "node:net";
 import { OBSERVE_REQUEST_FIELD } from "../../../../modes/rpc/host-observe-request.js";
 import { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS } from "../../../../modes/rpc/jsonl.js";
+import { connectAuthenticatedRpcSocket } from "../../../../modes/rpc/rpc-auth-client.js";
 import { readSocketSecret, resolveSocketTransportAddress, sendSocketHandshake, socketSecretPath, } from "../../../../modes/rpc/socket-transport.js";
 import { socketNeedsHandshake } from "../../../../modes/rpc/tui-socket.js";
 const SUBSCRIBE_ID = "monitor-subscribe";
-export async function openRpcObserver(socketPath, subscription, handlers) {
+export async function openRpcObserver(socketPath, subscription, handlers, options = {}) {
     const secret = socketNeedsHandshake(socketPath) ? await readSocketSecret(socketSecretPath(socketPath)) : undefined;
-    const socket = createConnection(resolveSocketTransportAddress(socketPath, process.platform, secret));
+    const authenticated = !socketNeedsHandshake(socketPath)
+        ? await connectAuthenticatedRpcSocket(socketPath, undefined, options)
+        : undefined;
+    const socket = authenticated?.socket ?? createConnection(resolveSocketTransportAddress(socketPath, process.platform, secret));
     const answer = Promise.withResolvers();
     let ended = false;
     const end = (reason) => {
@@ -23,14 +27,14 @@ export async function openRpcObserver(socketPath, subscription, handlers) {
         answer.reject(new Error(`rpc monitor: ${socketPath}: ${reason}`));
         handlers.closed(reason);
     };
-    socket.once("connect", () => {
+    const subscribe = () => {
         if (secret !== undefined)
             sendSocketHandshake(socket, secret);
         // Marked observing (senpi#3956): without it the supervisor counts this watch as an attached client, so a
         // watched host never idle-exits and a `children`/`all` watch pins every task shard host on the machine.
         const frame = { ...subscription, [OBSERVE_REQUEST_FIELD]: true, id: SUBSCRIBE_ID, type: "subscribe_sessions" };
         socket.write(`${JSON.stringify(frame)}\n`);
-    });
+    };
     const detach = attachJsonlLineReader(socket, (line) => {
         let record;
         try {
@@ -55,6 +59,10 @@ export async function openRpcObserver(socketPath, subscription, handlers) {
         detach();
         end("connection closed");
     });
+    if (authenticated)
+        subscribe();
+    else
+        socket.once("connect", subscribe);
     return {
         subscribed: answer.promise,
         close: () => socket.destroy(),

package/dist/modes/rpc/host-admission-proxy.d.ts

@@ -1,10 +1,11 @@
 import type { Socket } from "node:net";
 import type { Duplex } from "node:stream";
 import { type HostAdmission } from "./host-admission.ts";
+import type { PublicRpcConnection } from "./rpc-public-auth.ts";
 /**
  * Requests are size-bounded; each direction awaits downstream socket backpressure.
  * Opens remain concurrent with control commands. Stop refuses every pending open,
  * while other commands retain their wire order and child-owned semantics.
  */
-export declare function proxyWithAdmission(client: Socket, internal: Duplex | undefined, admission: HostAdmission): void;
+export declare function proxyWithAdmission(client: Socket, internal: Duplex | undefined, admission: HostAdmission, auth?: PublicRpcConnection): void;
 //# sourceMappingURL=host-admission-proxy.d.ts.map

package/dist/modes/rpc/host-admission-proxy.js

@@ -6,7 +6,8 @@ import { MAX_RPC_LINE_CHARACTERS, serializeJsonLine } from "./jsonl.js";
  * Opens remain concurrent with control commands. Stop refuses every pending open,
  * while other commands retain their wire order and child-owned semantics.
  */
-export function proxyWithAdmission(client, internal, admission) {
+export function proxyWithAdmission(client, internal, admission, auth) {
+    const reply = (chunk) => write(client, auth ? auth.response(chunk.toString()) : chunk);
     const pending = [];
     const refused = new Set();
     let protocols = 0;
@@ -21,7 +22,7 @@ export function proxyWithAdmission(client, internal, admission) {
             refused.add(id);
         try {
             for (const id of ids)
-                await write(client, serializeJsonLine(hostStoppingResponse(id, "open_session", admission)));
+                await reply(serializeJsonLine(hostStoppingResponse(id, "open_session", admission)));
         }
         catch {
             fail();
@@ -50,9 +51,9 @@ export function proxyWithAdmission(client, internal, admission) {
                 fail();
         });
     async function requests() {
-        for await (const line of lines(client, MAX_RPC_LINE_CHARACTERS)) {
+        for await (const line of lines(auth?.input ?? client, MAX_RPC_LINE_CHARACTERS)) {
             if (line === undefined) {
-                await write(client, serializeJsonLine({
+                await reply(serializeJsonLine({
                     type: "response",
                     command: "parse",
                     success: false,
@@ -62,7 +63,7 @@ export function proxyWithAdmission(client, internal, admission) {
             }
             const request = record(line);
             if (admission.stopping && request?.type === "get_protocol_info") {
-                await write(client, serializeJsonLine({
+                await reply(serializeJsonLine({
                     id: request.id,
                     type: "response",
                     command: request.type,
@@ -71,7 +72,7 @@ export function proxyWithAdmission(client, internal, admission) {
                 }));
             }
             else if (admission.stopping && (request?.type === "open_session" || !internal)) {
-                await write(client, serializeJsonLine(hostStoppingResponse(request?.id, String(request?.type ?? "parse"), admission)));
+                await reply(serializeJsonLine(hostStoppingResponse(request?.id, String(request?.type ?? "parse"), admission)));
             }
             else if (internal) {
                 // Record admission before writing: a child response can arrive immediately.
@@ -95,7 +96,7 @@ export function proxyWithAdmission(client, internal, admission) {
                 continue;
             }
             const complete = chunk.subarray(0, newline + 1);
-            if (pending.length === 0 && protocols === 0 && refused.size === 0) {
+            if (!auth && pending.length === 0 && protocols === 0 && refused.size === 0) {
                 // Queue the entire record batch synchronously, without copying split buffers.
                 client.cork();
                 let written;
@@ -111,12 +112,12 @@ export function proxyWithAdmission(client, internal, admission) {
             }
             else {
                 const batch = fragments.length > 0 ? Buffer.concat([...fragments, complete]) : complete;
-                await write(client, filterReplies(batch));
+                await reply(filterReplies(batch));
             }
             fragments = newline + 1 < chunk.length ? [chunk.subarray(newline + 1)] : [];
         }
         if (fragments.length > 0)
-            await write(client, filterReplies(Buffer.concat(fragments)));
+            await reply(filterReplies(Buffer.concat(fragments)));
         await refusals;
         client.end(() => client.destroy());
     }

package/dist/modes/rpc/host-cli-entry.d.ts

@@ -1,3 +1,5 @@
+/** Whether this source module is the process entry, including a symlinked argv path. */
+export declare function isCliModuleEntry(moduleUrl: string): boolean;
 /**
  * Resolves the committed CLI entry this supervisor wraps (source tree or built dist).
  * Exported for tests, which pass the module path and layout of a bundled install.

package/dist/modes/rpc/host-cli-entry.js

@@ -3,11 +3,23 @@
  * runtime snapshot's declared bin). Split out of `host-lifecycle-launch.ts` (senpi#2566); it stays in
  * this directory so `import.meta.url` resolves relative paths exactly as before.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { access, readFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isBundledNode } from "../../config.js";
+/** Whether this source module is the process entry, including a symlinked argv path. */
+export function isCliModuleEntry(moduleUrl) {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return fileURLToPath(moduleUrl) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Resolves the committed CLI entry this supervisor wraps (source tree or built dist).
  * Exported for tests, which pass the module path and layout of a bundled install.

package/dist/modes/rpc/host-ensure-client.d.ts

@@ -1,5 +1,9 @@
-import { type HostDecisionClient, type HostProtocolInfo } from "./host-decision.ts";
+import { type HostDecision, type HostDecisionClient, type HostProtocolInfo } from "./host-decision.ts";
 import type { EnsureHostOptions } from "./host-ensure-types.ts";
+/** An ensure must produce a host; an unavailable upgrade falls back to a compatible attachment. */
+export declare function decideEnsureAction(options: EnsureHostOptions, startedByUs: boolean, protocol: HostProtocolInfo | undefined): Exclude<HostDecision, {
+    action: "fallback";
+}>;
 /** This build as a client: which protocol it speaks, what it needs from a host, and which build it is. */
 export declare function ensureClient(options: EnsureHostOptions, startedByUs: boolean): HostDecisionClient;
 /**

package/dist/modes/rpc/host-ensure-client.js

@@ -2,7 +2,15 @@
 import { isToolRuntimeKind, toolRuntimeCapability } from "../../cli/tool-runtime.js";
 import { engineBuildIdentity } from "../../core/engine-build-identity.js";
 import { decideHostAction, HOST_PROTOCOL_VERSION, REQUIRED_HOST_CAPABILITIES, } from "./host-decision.js";
+import { isHostGenerationProcess } from "./host-process-role.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
+/** An ensure must produce a host; an unavailable upgrade falls back to a compatible attachment. */
+export function decideEnsureAction(options, startedByUs, protocol) {
+    if (options.upgrade !== "if-engine-differs" || isHostGenerationProcess())
+        return decideHostAction(ensureClient(options, startedByUs), protocol, "never");
+    const decision = decideHostAction(ensureClient(options, startedByUs), protocol, "upgrade");
+    return decision.action === "fallback" ? { action: "reuse", reason: "compatible", upgradeable: false } : decision;
+}
 /** This build as a client: which protocol it speaks, what it needs from a host, and which build it is. */
 export function ensureClient(options, startedByUs) {
     return {

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -12,6 +12,7 @@ export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
     readonly socket: string;
     readonly agentDir?: string;
+    readonly keyRoot?: string;
     /** Opt in to this caller process's lifetime. Attach holds remain independently releasable. */
     readonly owner?: "caller";
     /** Host lifecycle policy recorded in settings.json (env overrides win at runtime). */

package/dist/modes/rpc/host-ensure.js

@@ -5,8 +5,8 @@ import { processIsLive, readProcessStartTime } from "../../utils/process-identit
 import { createDaemonDirectories, createHostDaemonPaths, ensureEndpointIdentity, generationPaths, sameEndpoint, } from "./host-daemon-paths.js";
 import { clearHostRegistration, readHostRegistration, writtenByThisProcess, } from "./host-daemon-registration.js";
 import { claimHostOwner } from "./host-daemon-state.js";
-import { decideHostAction, HostEnsureRefusedError } from "./host-decision.js";
-import { ensureClient } from "./host-ensure-client.js";
+import { HostEnsureRefusedError } from "./host-decision.js";
+import { decideEnsureAction as decide } from "./host-ensure-client.js";
 import { refuseIfForeignHeld, refuseIfStalled, unregisteredEndpointHeld } from "./host-ensure-liveness.js";
 import { hostEnsureLockOptions, hostEnsureLockTarget } from "./host-ensure-lock.js";
 import { appendStderr, DEFAULT_READINESS_TIMEOUT_MS, DEFAULT_STOP_TIMEOUT_MS, startHost } from "./host-ensure-start.js";
@@ -16,9 +16,9 @@ import { HANDOFF_LOCK_HOLD_MS, handoffHostLocked } from "./host-handoff.js";
 import { reapOrphanedInternalHostDirs } from "./host-internal-dir-reaper.js";
 import { retireIdleLegacyHost } from "./host-legacy.js";
 import { holdProtocolInfo, probeSocketReachable } from "./host-probe.js";
-import { isHostGenerationProcess } from "./host-process-role.js";
 import { hostChildAlive } from "./host-stalled-evidence.js";
 import { acquireOwnershipSafeLock } from "./ownership-safe-lock.js";
+import { rpcKeyRoot, withRpcKeyRoot } from "./rpc-auth-client.js";
 export { createHostDaemonPaths, daemonDirectoryName, HostDaemonStateError, } from "./host-daemon-paths.js";
 export { hostEnsureLockTarget } from "./host-ensure-lock.js";
 export { defaultHostLaunch, PINNED_HOST_CLIENT_CAPABILITIES } from "./host-launch.js";
@@ -39,6 +39,9 @@ const ENSURE_LOCK_WAIT_MS = EXISTING_HOST_PROBE_TIMEOUT_MS +
     10_000;
 const lockOptions = hostEnsureLockOptions(ENSURE_LOCK_WAIT_MS);
 export async function ensureHost(options) {
+    return withRpcKeyRoot(rpcKeyRoot(options, options.agentDir), () => ensureHostInKeyRoot(options));
+}
+async function ensureHostInKeyRoot(options) {
     const socket = normalizeSocketPath(options.socket);
     const paths = createHostDaemonPaths({ socket, ...(options.agentDir ? { agentDir: options.agentDir } : {}) });
     await createDaemonDirectories(paths);
@@ -193,14 +196,6 @@ async function ensureHostLocked(paths, socket, options, stopDeadline = Date.now(
         await clearHostRegistration(paths);
     return startHost(paths, socket, options);
 }
-/** `fallback` belongs to clients that can live without a host; an ensure must produce one or fail. */
-function decide(options, startedByUs, protocol) {
-    if (options.upgrade !== "if-engine-differs" || isHostGenerationProcess()) {
-        return decideHostAction(ensureClient(options, startedByUs), protocol, "never");
-    }
-    const decision = decideHostAction(ensureClient(options, startedByUs), protocol, "upgrade");
-    return decision.action === "fallback" ? { action: "reuse", reason: "compatible", upgradeable: false } : decision;
-}
 /**
  * The upgrade, when the decision allows one: a new generation takes the socket and the running
  * host drains. A refused handoff ATTACHES - an upgrade that cannot happen must never become a stop.

package/dist/modes/rpc/host-gc-pass.js

@@ -25,6 +25,7 @@ import { createHostDaemonPaths, sameEndpoint } from "./host-daemon-paths.js";
 import { listHostEndpoints } from "./host-endpoints.js";
 import { gcEndpoint } from "./host-gc.js";
 import { nextSkip, readHostGcPassMarker, writeHostGcPassMarker, } from "./host-gc-pass-marker.js";
+import { gcRpcPublicKeys } from "./rpc-public-key.js";
 export const OPPORTUNISTIC_GC_BUDGET = { budgetMs: 1_500, maxEndpoints: 32, minIntervalMs: 300_000 };
 export async function gcHostEndpointsOpportunistically(options) {
     const now = options.now ?? Date.now;
@@ -35,6 +36,8 @@ export async function gcHostEndpointsOpportunistically(options) {
     const startedAt = now();
     if (previous !== undefined && startedAt - previous.completedAt < minIntervalMs)
         return { ran: false };
+    if (process.platform !== "win32")
+        await gcRpcPublicKeys(options.agentDir, { deadline: startedAt + budgetMs, maxRecords: maxEndpoints });
     const candidates = await gcCandidates(options);
     const present = new Set(candidates.map((endpoint) => endpoint.name));
     const skip = {};

package/dist/modes/rpc/host-gc.js

@@ -46,9 +46,12 @@ import { acquireHostEnsureLock } from "./host-ensure-lock.js";
 import { endpointInUse, socketSiblings } from "./host-gc-evidence.js";
 import { judgeStaleEngine } from "./host-stale-engine.js";
 import { stopHost } from "./host-stop.js";
+import { gcRpcPublicKeys } from "./rpc-public-key.js";
 /** 2 s, the budget a concurrent ensure's critical section gets before gc reports `locked`. */
 const GC_LOCK_WAIT_MS = 2_000;
 export async function gcHostEndpoints(agentDir, options = {}) {
+    if (process.platform !== "win32")
+        await gcRpcPublicKeys(agentDir);
     const removed = [];
     const stopped = [];
     const kept = [];

package/dist/modes/rpc/host-internal-transport.d.ts

@@ -1,15 +1,26 @@
 /**
  * The engine side of the supervisor's private hop (senpi#3795): the stdin-delivered key and lifetime descriptor
- * from the bootstrap, and how each accepted internal connection is admitted. Split out of multi-session-host.ts.
+ * from the bootstrap, and how each accepted connection is admitted. Split out of multi-session-host.ts.
  */
 import type { Socket } from "node:net";
 import type { Duplex } from "node:stream";
-import type { HostWatchdogConfig } from "./host-watchdog.ts";
+import { type HostWatchdogConfig } from "./host-watchdog.ts";
+/**
+ * The supervisor binding, read once per process. The watch variables are removed as they are read (senpi#3815 review
+ * L4), so no tool, shell or nested host this host starts inherits a binding to a supervisor that is not its own.
+ */
+export declare function hostWatchdogBinding(): HostWatchdogConfig | undefined;
 export interface InternalHostTransport {
-    /** The supervisor's watchdog binding, plus the reopened stdin lifetime descriptor when the bootstrap has one. */
     readonly watchdogConfig: HostWatchdogConfig | undefined;
-    /** Authenticates and seals (POSIX key), authenticates (Windows secret), or accepts as is (no supervisor). */
+    /** Authenticates and seals (POSIX key), authenticates (Windows secret), filters (public), or accepts as is. */
     admit(socket: Socket, accept: (socket?: Duplex) => void): void;
+    /** Publishes the public endpoint's key record after listening; a failure is logged and `onFailure` ends the host. */
+    publish(onFailure: () => Promise<void>): Promise<void>;
+    dispose(): Promise<void>;
 }
-export declare function internalHostTransport(configured: HostWatchdogConfig | undefined, secret: Uint8Array | undefined): InternalHostTransport;
+export declare function internalHostTransport(configured: HostWatchdogConfig | undefined, secret: Uint8Array | undefined, endpoint?: {
+    readonly agentDir: string;
+    readonly socket: string;
+    readonly log: (message: string) => void;
+}): InternalHostTransport;
 //# sourceMappingURL=host-internal-transport.d.ts.map

package/dist/modes/rpc/host-internal-transport.js

@@ -1,18 +1,33 @@
 import { VERSION } from "../../config.js";
-import { HOST_WATCH_LIFETIME_FIFO_ENV } from "./host-lifetime-binding.js";
+import { consumeHostWatchdogEnv, scrubHostWatchdogEnv } from "./host-watchdog.js";
 import { getInternalHostBootstrap } from "./internal-bootstrap.js";
 import { acceptInternalConnection } from "./internal-channel.js";
+import { PublicRpcConnection } from "./rpc-public-auth.js";
+import { RpcPublicEndpoint } from "./rpc-public-key.js";
 import { authenticateSocket } from "./socket-transport.js";
-export function internalHostTransport(configured, secret) {
+let binding;
+/**
+ * The supervisor binding, read once per process. The watch variables are removed as they are read (senpi#3815 review
+ * L4), so no tool, shell or nested host this host starts inherits a binding to a supervisor that is not its own.
+ */
+export function hostWatchdogBinding() {
+    binding ??= { config: consumeHostWatchdogEnv() };
+    return binding.config;
+}
+export function internalHostTransport(configured, secret, endpoint) {
     const bootstrap = getInternalHostBootstrap();
-    // The FIFO path is the host's alone: it is in `configured` now, so no tool or shell the host runs inherits it and
-    // could open the FIFO for writing to hold off shutdown (senpi#3816 review).
-    delete process.env[HOST_WATCH_LIFETIME_FIFO_ENV];
+    scrubHostWatchdogEnv();
+    const watchdogConfig = configured && {
+        ...configured,
+        ...(bootstrap?.lifetimeFd === undefined ? {} : { lifetimeFd: bootstrap.lifetimeFd }),
+    };
+    // Supervised means holding the internal key, which only the launching supervisor can hand over and no descendant
+    // inherits; a host without it is a public endpoint whatever its environment says (senpi#3815 review L4).
+    const publicEndpoint = endpoint !== undefined && process.platform !== "win32" && bootstrap === undefined
+        ? new RpcPublicEndpoint(endpoint.agentDir, endpoint.socket)
+        : undefined;
     return {
-        watchdogConfig: configured && {
-            ...configured,
-            ...(bootstrap?.lifetimeFd === undefined ? {} : { lifetimeFd: bootstrap.lifetimeFd }),
-        },
+        watchdogConfig,
         admit(socket, accept) {
             if (bootstrap)
                 void acceptInternalConnection(socket, bootstrap.key, { protocolVersion: 1, serverVersion: VERSION })
@@ -24,9 +39,25 @@ export function internalHostTransport(configured, secret) {
                 });
             else if (secret)
                 authenticateSocket(socket, secret, () => accept());
+            else if (publicEndpoint)
+                accept(new PublicRpcConnection(socket, publicEndpoint).stream);
             else
                 accept();
         },
+        async publish(onFailure) {
+            try {
+                await publicEndpoint?.publish();
+            }
+            catch (cause) {
+                endpoint?.log(cause instanceof Error ? cause.message : String(cause));
+                await onFailure();
+            }
+        },
+        async dispose() {
+            await publicEndpoint?.dispose().catch((cause) => {
+                endpoint?.log(`endpoint key cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+            });
+        },
     };
 }
 //# sourceMappingURL=host-internal-transport.js.map

package/dist/modes/rpc/host-lifecycle-proxy.d.ts

@@ -1,12 +1,15 @@
 import { type Server } from "node:net";
 import type { HostAdmission } from "./host-admission.ts";
 import type { ClientOccupancy } from "./host-client-occupancy.ts";
-import { type ListenerState, type SocketFileIdentity } from "./socket-ownership.ts";
+import type { RpcPublicEndpoint } from "./rpc-public-key.ts";
+import { type ListenerState } from "./socket-ownership.ts";
+export { adoptPublicSocket } from "./socket-ownership.ts";
 export interface PublicProxyOptions {
     readonly internalSocket: string;
     readonly internalSecret?: Buffer;
     readonly internalKey?: Buffer;
     readonly publicSecret?: Buffer;
+    readonly publicEndpoint?: RpcPublicEndpoint;
     readonly clients: ClientOccupancy;
     /** Shared authority for stopping, protocol replies and new-session admission. */
     readonly admission: HostAdmission;
@@ -16,13 +19,6 @@ export interface PublicProxyOptions {
     readonly onAdmit?: () => void;
 }
 export declare function createPublicProxy(options: PublicProxyOptions): Server;
-/**
- * Takes the public name over with a rename, once - and only while - that name still refers to the
- * entry this handoff was decided against. A socket that changed underneath belongs to another
- * process now: replacing it would unlink an endpoint this generation cannot prove it owns, so the
- * successor aborts instead and leaves both the intruder's socket and its own bind entry alone.
- */
-export declare function adoptPublicSocket(bindSocket: string, publicSocket: string, expected: SocketFileIdentity | undefined): Promise<void>;
 /**
  * Reuses an existing valid secret - including one ensureHost() just wrote - and
  * creates one (with its parent directories, mode 0600) when it is missing or