@code-yeongyu/senpi 2026.10.24-2 → 2026.10.24-4

package/dist/core/extensions/builtin/prompt-preset/matchers.d.ts

@@ -16,6 +16,8 @@ export declare function hasKimiK27Signal(value: string): boolean;
 export declare function isKimiK27Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasKimiK28Signal(value: string): boolean;
 export declare function isKimiK28Model(model: ModelWithPromptPresetMetadata): boolean;
+export declare function hasKimiK31Signal(value: string): boolean;
+export declare function isKimiK31Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasKimiK3Signal(value: string): boolean;
 export declare function isKimiK3Model(model: ModelWithPromptPresetMetadata): boolean;
 export declare function hasSWE2Signal(value: string): boolean;

package/dist/core/extensions/builtin/prompt-preset/matchers.js

@@ -63,6 +63,15 @@ export function hasKimiK28Signal(value) {
 export function isKimiK28Model(model) {
     return hasKimiK28Signal(model.id) || (model.name !== undefined && hasKimiK28Signal(model.name));
 }
+// Kimi K3.1 ids: `k3.1-pro` / `k3.1-pro-highspeed` on Kimi Code, `kimi-k3.1-pro` / `kimi-k3.1-pro-highspeed` on the
+// Kimi API (kimi.com/code/docs models + platform.kimi.com K3.1 Pro quickstart, checked 2026-10-24), plus the
+// dotless `k3p1` spelling OpenCode-style catalogs use. Checked before K3: every K3.1 id also carries the K3 signal.
+export function hasKimiK31Signal(value) {
+    return /(?:^|[/@._-])(?:kimi-)?k3(?:[._-]|p)1(?:$|[/@._:-])/.test(normalizeModelId(value));
+}
+export function isKimiK31Model(model) {
+    return hasKimiK31Signal(model.id) || (model.name !== undefined && hasKimiK31Signal(model.name));
+}
 export function hasKimiK3Signal(value) {
     const normalized = normalizeModelId(value);
     return normalized === "k3" || /(?:^|[/@._-])kimi-k3(?:$|[/@._:-])/.test(normalized);

package/dist/core/extensions/builtin/prompt-preset/presets.js

@@ -31,6 +31,7 @@ import { buildKimiK26Prompt } from "./kimi-k2-6.js";
 import { buildKimiK27Prompt } from "./kimi-k2-7.js";
 import { buildKimiK28Prompt } from "./kimi-k2-8.js";
 import { buildKimiK3Prompt } from "./kimi-k3.js";
+import { buildKimiK31Prompt } from "./kimi-k3-1.js";
 import { parsePromptPreset } from "./settings.js";
 export function resolvePresetName(model, settings) {
     if (settings.promptPreset !== "auto") {
@@ -94,6 +95,8 @@ function renderPreset(name, options) {
             return { name, prompt: buildGrok45Prompt(options) };
         case "gemini-4-argon":
             return { name, prompt: buildGemini4ArgonPrompt(options) };
+        case "kimi-k3-1":
+            return { name, prompt: buildKimiK31Prompt(options) };
         case "kimi-k3":
             return { name, prompt: buildKimiK3Prompt(options) };
         case "kimi-k2-8":

package/dist/core/extensions/builtin/prompt-preset/settings.d.ts

@@ -1,5 +1,5 @@
 import type { SettingsManager } from "../../../settings-manager.ts";
-export type PromptPresetName = "auto" | "claude-fable-5" | "claude-fable-5-1" | "claude-fable-5-5" | "claude-opus-5-5" | "claude-opus-5" | "claude-sonnet-5-5" | "claude-haiku-5-5" | "claude-opus-4-8" | "claude-opus-4-7" | "claude-opus-4-6" | "claude-opus-4-5" | "deepseek-v4-flash" | "deepseek-v4-flash-0731" | "deepseek-v4-1-flash" | "deepseek-v4-pro" | "glm-5.2" | "glm-5.3" | "gemini-4-argon" | "grok-4.5" | "grok-4.6" | "grok-4.7" | "kimi-k3" | "kimi-k2-8" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5" | "gpt-5.2" | "gpt-5.3-codex" | "gpt-5.4" | "gpt-5.5" | "gpt-5.6" | "gpt-6-astra";
+export type PromptPresetName = "auto" | "claude-fable-5" | "claude-fable-5-1" | "claude-fable-5-5" | "claude-opus-5-5" | "claude-opus-5" | "claude-sonnet-5-5" | "claude-haiku-5-5" | "claude-opus-4-8" | "claude-opus-4-7" | "claude-opus-4-6" | "claude-opus-4-5" | "deepseek-v4-flash" | "deepseek-v4-flash-0731" | "deepseek-v4-1-flash" | "deepseek-v4-pro" | "glm-5.2" | "glm-5.3" | "gemini-4-argon" | "grok-4.5" | "grok-4.6" | "grok-4.7" | "kimi-k3-1" | "kimi-k3" | "kimi-k2-8" | "kimi-k2-7" | "kimi-k2-6" | "gpt-5" | "gpt-5.2" | "gpt-5.3-codex" | "gpt-5.4" | "gpt-5.5" | "gpt-5.6" | "gpt-6-astra";
 export interface PromptPresetSettings {
     promptPreset: PromptPresetName;
 }

package/dist/core/extensions/builtin/prompt-preset/settings.js

@@ -21,6 +21,7 @@ export const VALID_PRESETS = new Set([
     "grok-4.5",
     "grok-4.6",
     "grok-4.7",
+    "kimi-k3-1",
     "kimi-k3",
     "kimi-k2-8",
     "kimi-k2-7",

package/dist/core/extensions/builtin/terminal/rpc-monitor-observer.d.ts

@@ -1,3 +1,4 @@
+import { type RpcKeyOptions } from "../../../../modes/rpc/rpc-auth-client.ts";
 export type RpcRecord = Readonly<Record<string, unknown>>;
 export interface RpcObserverHandlers {
     /** Every record after the subscribe answer, in arrival order. */
@@ -10,5 +11,5 @@ export interface RpcObserver {
     readonly subscribed: Promise<RpcRecord>;
     close(): void;
 }
-export declare function openRpcObserver(socketPath: string, subscription: RpcRecord, handlers: RpcObserverHandlers): Promise<RpcObserver>;
+export declare function openRpcObserver(socketPath: string, subscription: RpcRecord, handlers: RpcObserverHandlers, options?: RpcKeyOptions): Promise<RpcObserver>;
 //# sourceMappingURL=rpc-monitor-observer.d.ts.map

package/dist/core/extensions/builtin/terminal/rpc-monitor-observer.js

@@ -8,12 +8,16 @@
 import { createConnection } from "node:net";
 import { OBSERVE_REQUEST_FIELD } from "../../../../modes/rpc/host-observe-request.js";
 import { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS } from "../../../../modes/rpc/jsonl.js";
+import { connectAuthenticatedRpcSocket } from "../../../../modes/rpc/rpc-auth-client.js";
 import { readSocketSecret, resolveSocketTransportAddress, sendSocketHandshake, socketSecretPath, } from "../../../../modes/rpc/socket-transport.js";
 import { socketNeedsHandshake } from "../../../../modes/rpc/tui-socket.js";
 const SUBSCRIBE_ID = "monitor-subscribe";
-export async function openRpcObserver(socketPath, subscription, handlers) {
+export async function openRpcObserver(socketPath, subscription, handlers, options = {}) {
     const secret = socketNeedsHandshake(socketPath) ? await readSocketSecret(socketSecretPath(socketPath)) : undefined;
-    const socket = createConnection(resolveSocketTransportAddress(socketPath, process.platform, secret));
+    const authenticated = !socketNeedsHandshake(socketPath)
+        ? await connectAuthenticatedRpcSocket(socketPath, undefined, options)
+        : undefined;
+    const socket = authenticated?.socket ?? createConnection(resolveSocketTransportAddress(socketPath, process.platform, secret));
     const answer = Promise.withResolvers();
     let ended = false;
     const end = (reason) => {
@@ -23,14 +27,14 @@ export async function openRpcObserver(socketPath, subscription, handlers) {
         answer.reject(new Error(`rpc monitor: ${socketPath}: ${reason}`));
         handlers.closed(reason);
     };
-    socket.once("connect", () => {
+    const subscribe = () => {
         if (secret !== undefined)
             sendSocketHandshake(socket, secret);
         // Marked observing (senpi#3956): without it the supervisor counts this watch as an attached client, so a
         // watched host never idle-exits and a `children`/`all` watch pins every task shard host on the machine.
         const frame = { ...subscription, [OBSERVE_REQUEST_FIELD]: true, id: SUBSCRIBE_ID, type: "subscribe_sessions" };
         socket.write(`${JSON.stringify(frame)}\n`);
-    });
+    };
     const detach = attachJsonlLineReader(socket, (line) => {
         let record;
         try {
@@ -55,6 +59,10 @@ export async function openRpcObserver(socketPath, subscription, handlers) {
         detach();
         end("connection closed");
     });
+    if (authenticated)
+        subscribe();
+    else
+        socket.once("connect", subscribe);
     return {
         subscribed: answer.promise,
         close: () => socket.destroy(),

package/dist/core/external-admission.d.ts

@@ -60,6 +60,8 @@ export declare class ExternalAdmission {
     }): InputHold;
     onInputsSettled(listener: () => void): () => void;
     onEmitted(listener: (deliveryId: string) => void): () => void;
+    /** Durable custody will replay this delivery: reserve its id before asynchronous recovery or gateway admission. */
+    restoreQueued(deliveryId: string, isOwned: () => boolean): void;
     /**
      * From here on every `admit` throws `reason` and changes nothing: the runtime is being handed to
      * another writer, so the delivery stays with its sender and is delivered there instead.
@@ -82,8 +84,9 @@ export declare class ExternalAdmission {
      * deliveries may be admitted again - unless the file's last write was refused too.
      */
     observeRunSettled(): void;
-    /** The runtime's queues were cleared: queued deliveries are no longer held. */
+    /** Cleared carriers are no longer held; custody not yet enqueued for recovery still owns its delivery. */
     dropQueued(): void;
+    private releaseRestored;
     private endHold;
     private isBusy;
 }

package/dist/core/external-admission.js

@@ -54,6 +54,13 @@ export class ExternalAdmission {
         this.emittedListeners.add(listener);
         return () => this.emittedListeners.delete(listener);
     }
+    /** Durable custody will replay this delivery: reserve its id before asynchronous recovery or gateway admission. */
+    restoreQueued(deliveryId, isOwned) {
+        if (this.pending.has(deliveryId) || this.emitted.has(deliveryId) || this.failed.has(deliveryId))
+            return;
+        // Recovery chooses the payload's queue lane; this reservation only tracks durable ownership.
+        this.pending.set(deliveryId, isOwned);
+    }
     /**
      * From here on every `admit` throws `reason` and changes nothing: the runtime is being handed to
      * another writer, so the delivery stays with its sender and is delivered there instead.
@@ -79,6 +86,7 @@ export class ExternalAdmission {
             throw new Error(this.closedReason);
         const turn_epoch = this.turnEpochValue;
         const id = input.delivery_id;
+        this.releaseRestored();
         if (this.pending.has(id) || this.emitted.has(id) || this.failed.has(id)) {
             return { kind: "already_admitted", turn_epoch };
         }
@@ -112,6 +120,7 @@ export class ExternalAdmission {
         return { kind: "queued", turn_epoch };
     }
     list() {
+        this.releaseRestored();
         const deliveries = { pending: [...this.pending.keys()], emitted: [...this.emitted] };
         if (this.failed.size === 0)
             return deliveries;
@@ -149,10 +158,17 @@ export class ExternalAdmission {
         if (this.fileTakesWrites)
             this.failed.clear();
     }
-    /** The runtime's queues were cleared: queued deliveries are no longer held. */
+    /** Cleared carriers are no longer held; custody not yet enqueued for recovery still owns its delivery. */
     dropQueued() {
+        this.releaseRestored();
+        for (const [id, lane] of this.pending) {
+            if (lane !== "start" && typeof lane !== "function")
+                this.pending.delete(id);
+        }
+    }
+    releaseRestored() {
         for (const [id, lane] of this.pending) {
-            if (lane !== "start")
+            if (typeof lane === "function" && !lane())
                 this.pending.delete(id);
         }
     }

package/dist/core/lifecycle-session-binding.js

@@ -2,6 +2,7 @@ import { collectGoalLifecycleFacts, onGoalLifecycleChange } from "./extensions/b
 import { goalStoreRef } from "./extensions/builtin/goal/store-ref.js";
 import { collectTurnEndLivenessInput } from "./extensions/builtin/goal/turn-end-liveness-report.js";
 import { StaleExtensionContextError } from "./extensions/stale-context-error.js";
+import { deliveryIdOf } from "./external-admission.js";
 import { consumeLifecycleDelivery, lifecycleDeliveryEntries, messageTicket } from "./lifecycle-delivery.js";
 import { readLifecycleGoal } from "./lifecycle-goal.js";
 import { lifecycleHistory } from "./lifecycle-history.js";
@@ -41,6 +42,25 @@ export class LifecycleSessionBinding {
             },
             readRuntime: () => readLifecycleRuntimeFacts(session),
         });
+        // A crashed receiver may have durable custody but no transcript entry yet. Recovery owns that
+        // delivery already; register it before session_start can let the gateway enqueue a second carrier.
+        const deliveryEntries = session.sessionManager.reduceHistory(lifecycleDeliveryEntries);
+        for (const record of this.controller.obligations.active) {
+            if (record.state !== "queued" || !record.payload || !record.ticketId)
+                continue;
+            const ticketId = record.ticketId;
+            const message = { role: "custom", ...record.payload.message, timestamp: 0 };
+            const deliveryId = deliveryIdOf(message);
+            if (deliveryId === undefined)
+                continue;
+            if (deliveryEntries.has(ticketId))
+                session.externalAdmission.observePersisted(message);
+            else
+                session.externalAdmission.restoreQueued(deliveryId, () => 
+                // Consumption writes the entry before message_end observes it in external admission.
+                session.sessionManager.reduceHistory(lifecycleDeliveryEntries).has(ticketId) ||
+                    this.controller.obligations.active.some((current) => current.ticketId === ticketId && current.state === "queued"));
+        }
         this.unsubscribeHuman = bindLifecycleHumanInput(session, (event) => this.controller.humanInput(event.at));
         this.unsubscribeAdmission = session.externalAdmission.onInputsSettled(() => this.controller.admissionSettled());
         this.unsubscribeGoal = onGoalLifecycleChange(session.sessionManager, (goal) => {

package/dist/core/sdk.js

@@ -315,6 +315,7 @@ export async function createAgentSession(options = {}) {
             const serviceTier = serviceTierForProvider(model.provider, options?.serviceTier ?? resolveRequestServiceTier(model));
             return modelRuntime.streamSimple(model, context, {
                 ...options,
+                cwd,
                 serviceTier,
                 timeoutMs,
                 websocketConnectTimeoutMs,

package/dist/core/session-spawned-by.d.ts

@@ -0,0 +1,4 @@
+import type { SpawnedBy } from "./session-lifecycle-types.ts";
+/** The shared CLI / open_session boundary contract; IDs are opaque, non-empty strings. */
+export declare function isSpawnedBy(value: unknown): value is SpawnedBy;
+//# sourceMappingURL=session-spawned-by.d.ts.map

package/dist/core/session-spawned-by.js

@@ -0,0 +1,16 @@
+/** The shared CLI / open_session boundary contract; IDs are opaque, non-empty strings. */
+export function isSpawnedBy(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        "parentSessionId" in value &&
+        typeof value.parentSessionId === "string" &&
+        value.parentSessionId.length > 0 &&
+        "rootSessionId" in value &&
+        typeof value.rootSessionId === "string" &&
+        value.rootSessionId.length > 0 &&
+        "taskId" in value &&
+        typeof value.taskId === "string" &&
+        value.taskId.length > 0);
+}
+//# sourceMappingURL=session-spawned-by.js.map

package/dist/main.js

@@ -401,8 +401,11 @@ async function sessionCwdOrUndefined(sessionFile) {
     }
 }
 export async function createSessionManager(parsed, cwd, sessionDir, settingsManager, appMode) {
+    if (parsed.spawnedBy && (parsed.session || parsed.resume || parsed.continue || parsed.fork || parsed.rebind)) {
+        console.error(chalk.yellow("Warning: --spawned-by is ignored when resuming or forking a session."));
+    }
     if (parsed.noSession || parsed.help || parsed.listModels !== undefined || parsed.listTips) {
-        return SessionManager.inMemory(cwd, parsed.sessionId !== undefined ? { id: parsed.sessionId } : undefined);
+        return SessionManager.inMemory(cwd, { id: parsed.sessionId, spawnedBy: parsed.spawnedBy });
     }
     if (parsed.fork) {
         if (parsed.sessionId) {
@@ -533,11 +536,13 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
     if (parsed.sessionId) {
         const existingSession = await findLocalSessionByExactId(parsed.sessionId, cwd, sessionDir);
         if (existingSession) {
+            if (parsed.spawnedBy)
+                console.error(chalk.yellow("Warning: --spawned-by is ignored when resuming an existing session."));
             return SessionManager.open(existingSession.path, sessionDir);
         }
         console.error(chalk.yellow(`Warning: No project session found with id '${parsed.sessionId}'; creating a new session with that id.`));
     }
-    return SessionManager.create(cwd, sessionDir, { id: parsed.sessionId });
+    return SessionManager.create(cwd, sessionDir, { id: parsed.sessionId, spawnedBy: parsed.spawnedBy });
 }
 function buildSessionOptions(parsed, scopedModels, hasExistingSession, modelRuntime, settingsManager) {
     const options = {};

package/dist/modes/rpc/host-admission-proxy.d.ts

@@ -1,10 +1,11 @@
 import type { Socket } from "node:net";
 import type { Duplex } from "node:stream";
 import { type HostAdmission } from "./host-admission.ts";
+import type { PublicRpcConnection } from "./rpc-public-auth.ts";
 /**
  * Requests are size-bounded; each direction awaits downstream socket backpressure.
  * Opens remain concurrent with control commands. Stop refuses every pending open,
  * while other commands retain their wire order and child-owned semantics.
  */
-export declare function proxyWithAdmission(client: Socket, internal: Duplex | undefined, admission: HostAdmission): void;
+export declare function proxyWithAdmission(client: Socket, internal: Duplex | undefined, admission: HostAdmission, auth?: PublicRpcConnection): void;
 //# sourceMappingURL=host-admission-proxy.d.ts.map

package/dist/modes/rpc/host-admission-proxy.js

@@ -6,7 +6,8 @@ import { MAX_RPC_LINE_CHARACTERS, serializeJsonLine } from "./jsonl.js";
  * Opens remain concurrent with control commands. Stop refuses every pending open,
  * while other commands retain their wire order and child-owned semantics.
  */
-export function proxyWithAdmission(client, internal, admission) {
+export function proxyWithAdmission(client, internal, admission, auth) {
+    const reply = (chunk) => write(client, auth ? auth.response(chunk.toString()) : chunk);
     const pending = [];
     const refused = new Set();
     let protocols = 0;
@@ -21,7 +22,7 @@ export function proxyWithAdmission(client, internal, admission) {
             refused.add(id);
         try {
             for (const id of ids)
-                await write(client, serializeJsonLine(hostStoppingResponse(id, "open_session", admission)));
+                await reply(serializeJsonLine(hostStoppingResponse(id, "open_session", admission)));
         }
         catch {
             fail();
@@ -50,9 +51,9 @@ export function proxyWithAdmission(client, internal, admission) {
                 fail();
         });
     async function requests() {
-        for await (const line of lines(client, MAX_RPC_LINE_CHARACTERS)) {
+        for await (const line of lines(auth?.input ?? client, MAX_RPC_LINE_CHARACTERS)) {
             if (line === undefined) {
-                await write(client, serializeJsonLine({
+                await reply(serializeJsonLine({
                     type: "response",
                     command: "parse",
                     success: false,
@@ -62,7 +63,7 @@ export function proxyWithAdmission(client, internal, admission) {
             }
             const request = record(line);
             if (admission.stopping && request?.type === "get_protocol_info") {
-                await write(client, serializeJsonLine({
+                await reply(serializeJsonLine({
                     id: request.id,
                     type: "response",
                     command: request.type,
@@ -71,7 +72,7 @@ export function proxyWithAdmission(client, internal, admission) {
                 }));
             }
             else if (admission.stopping && (request?.type === "open_session" || !internal)) {
-                await write(client, serializeJsonLine(hostStoppingResponse(request?.id, String(request?.type ?? "parse"), admission)));
+                await reply(serializeJsonLine(hostStoppingResponse(request?.id, String(request?.type ?? "parse"), admission)));
             }
             else if (internal) {
                 // Record admission before writing: a child response can arrive immediately.
@@ -95,7 +96,7 @@ export function proxyWithAdmission(client, internal, admission) {
                 continue;
             }
             const complete = chunk.subarray(0, newline + 1);
-            if (pending.length === 0 && protocols === 0 && refused.size === 0) {
+            if (!auth && pending.length === 0 && protocols === 0 && refused.size === 0) {
                 // Queue the entire record batch synchronously, without copying split buffers.
                 client.cork();
                 let written;
@@ -111,12 +112,12 @@ export function proxyWithAdmission(client, internal, admission) {
             }
             else {
                 const batch = fragments.length > 0 ? Buffer.concat([...fragments, complete]) : complete;
-                await write(client, filterReplies(batch));
+                await reply(filterReplies(batch));
             }
             fragments = newline + 1 < chunk.length ? [chunk.subarray(newline + 1)] : [];
         }
         if (fragments.length > 0)
-            await write(client, filterReplies(Buffer.concat(fragments)));
+            await reply(filterReplies(Buffer.concat(fragments)));
         await refusals;
         client.end(() => client.destroy());
     }

package/dist/modes/rpc/host-cli-entry.d.ts

@@ -1,3 +1,5 @@
+/** Whether this source module is the process entry, including a symlinked argv path. */
+export declare function isCliModuleEntry(moduleUrl: string): boolean;
 /**
  * Resolves the committed CLI entry this supervisor wraps (source tree or built dist).
  * Exported for tests, which pass the module path and layout of a bundled install.

package/dist/modes/rpc/host-cli-entry.js

@@ -3,11 +3,23 @@
  * runtime snapshot's declared bin). Split out of `host-lifecycle-launch.ts` (senpi#2566); it stays in
  * this directory so `import.meta.url` resolves relative paths exactly as before.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { access, readFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isBundledNode } from "../../config.js";
+/** Whether this source module is the process entry, including a symlinked argv path. */
+export function isCliModuleEntry(moduleUrl) {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return fileURLToPath(moduleUrl) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Resolves the committed CLI entry this supervisor wraps (source tree or built dist).
  * Exported for tests, which pass the module path and layout of a bundled install.

package/dist/modes/rpc/host-ensure-client.d.ts

@@ -1,5 +1,9 @@
-import { type HostDecisionClient, type HostProtocolInfo } from "./host-decision.ts";
+import { type HostDecision, type HostDecisionClient, type HostProtocolInfo } from "./host-decision.ts";
 import type { EnsureHostOptions } from "./host-ensure-types.ts";
+/** An ensure must produce a host; an unavailable upgrade falls back to a compatible attachment. */
+export declare function decideEnsureAction(options: EnsureHostOptions, startedByUs: boolean, protocol: HostProtocolInfo | undefined): Exclude<HostDecision, {
+    action: "fallback";
+}>;
 /** This build as a client: which protocol it speaks, what it needs from a host, and which build it is. */
 export declare function ensureClient(options: EnsureHostOptions, startedByUs: boolean): HostDecisionClient;
 /**

package/dist/modes/rpc/host-ensure-client.js

@@ -2,7 +2,15 @@
 import { isToolRuntimeKind, toolRuntimeCapability } from "../../cli/tool-runtime.js";
 import { engineBuildIdentity } from "../../core/engine-build-identity.js";
 import { decideHostAction, HOST_PROTOCOL_VERSION, REQUIRED_HOST_CAPABILITIES, } from "./host-decision.js";
+import { isHostGenerationProcess } from "./host-process-role.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
+/** An ensure must produce a host; an unavailable upgrade falls back to a compatible attachment. */
+export function decideEnsureAction(options, startedByUs, protocol) {
+    if (options.upgrade !== "if-engine-differs" || isHostGenerationProcess())
+        return decideHostAction(ensureClient(options, startedByUs), protocol, "never");
+    const decision = decideHostAction(ensureClient(options, startedByUs), protocol, "upgrade");
+    return decision.action === "fallback" ? { action: "reuse", reason: "compatible", upgradeable: false } : decision;
+}
 /** This build as a client: which protocol it speaks, what it needs from a host, and which build it is. */
 export function ensureClient(options, startedByUs) {
     return {

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -12,6 +12,7 @@ export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
     readonly socket: string;
     readonly agentDir?: string;
+    readonly keyRoot?: string;
     /** Opt in to this caller process's lifetime. Attach holds remain independently releasable. */
     readonly owner?: "caller";
     /** Host lifecycle policy recorded in settings.json (env overrides win at runtime). */

package/dist/modes/rpc/host-ensure.js

@@ -5,8 +5,8 @@ import { processIsLive, readProcessStartTime } from "../../utils/process-identit
 import { createDaemonDirectories, createHostDaemonPaths, ensureEndpointIdentity, generationPaths, sameEndpoint, } from "./host-daemon-paths.js";
 import { clearHostRegistration, readHostRegistration, writtenByThisProcess, } from "./host-daemon-registration.js";
 import { claimHostOwner } from "./host-daemon-state.js";
-import { decideHostAction, HostEnsureRefusedError } from "./host-decision.js";
-import { ensureClient } from "./host-ensure-client.js";
+import { HostEnsureRefusedError } from "./host-decision.js";
+import { decideEnsureAction as decide } from "./host-ensure-client.js";
 import { refuseIfForeignHeld, refuseIfStalled, unregisteredEndpointHeld } from "./host-ensure-liveness.js";
 import { hostEnsureLockOptions, hostEnsureLockTarget } from "./host-ensure-lock.js";
 import { appendStderr, DEFAULT_READINESS_TIMEOUT_MS, DEFAULT_STOP_TIMEOUT_MS, startHost } from "./host-ensure-start.js";
@@ -16,9 +16,9 @@ import { HANDOFF_LOCK_HOLD_MS, handoffHostLocked } from "./host-handoff.js";
 import { reapOrphanedInternalHostDirs } from "./host-internal-dir-reaper.js";
 import { retireIdleLegacyHost } from "./host-legacy.js";
 import { holdProtocolInfo, probeSocketReachable } from "./host-probe.js";
-import { isHostGenerationProcess } from "./host-process-role.js";
 import { hostChildAlive } from "./host-stalled-evidence.js";
 import { acquireOwnershipSafeLock } from "./ownership-safe-lock.js";
+import { rpcKeyRoot, withRpcKeyRoot } from "./rpc-auth-client.js";
 export { createHostDaemonPaths, daemonDirectoryName, HostDaemonStateError, } from "./host-daemon-paths.js";
 export { hostEnsureLockTarget } from "./host-ensure-lock.js";
 export { defaultHostLaunch, PINNED_HOST_CLIENT_CAPABILITIES } from "./host-launch.js";
@@ -39,6 +39,9 @@ const ENSURE_LOCK_WAIT_MS = EXISTING_HOST_PROBE_TIMEOUT_MS +
     10_000;
 const lockOptions = hostEnsureLockOptions(ENSURE_LOCK_WAIT_MS);
 export async function ensureHost(options) {
+    return withRpcKeyRoot(rpcKeyRoot(options, options.agentDir), () => ensureHostInKeyRoot(options));
+}
+async function ensureHostInKeyRoot(options) {
     const socket = normalizeSocketPath(options.socket);
     const paths = createHostDaemonPaths({ socket, ...(options.agentDir ? { agentDir: options.agentDir } : {}) });
     await createDaemonDirectories(paths);
@@ -193,14 +196,6 @@ async function ensureHostLocked(paths, socket, options, stopDeadline = Date.now(
         await clearHostRegistration(paths);
     return startHost(paths, socket, options);
 }
-/** `fallback` belongs to clients that can live without a host; an ensure must produce one or fail. */
-function decide(options, startedByUs, protocol) {
-    if (options.upgrade !== "if-engine-differs" || isHostGenerationProcess()) {
-        return decideHostAction(ensureClient(options, startedByUs), protocol, "never");
-    }
-    const decision = decideHostAction(ensureClient(options, startedByUs), protocol, "upgrade");
-    return decision.action === "fallback" ? { action: "reuse", reason: "compatible", upgradeable: false } : decision;
-}
 /**
  * The upgrade, when the decision allows one: a new generation takes the socket and the running
  * host drains. A refused handoff ATTACHES - an upgrade that cannot happen must never become a stop.

package/dist/modes/rpc/host-gc-pass.js

@@ -25,6 +25,7 @@ import { createHostDaemonPaths, sameEndpoint } from "./host-daemon-paths.js";
 import { listHostEndpoints } from "./host-endpoints.js";
 import { gcEndpoint } from "./host-gc.js";
 import { nextSkip, readHostGcPassMarker, writeHostGcPassMarker, } from "./host-gc-pass-marker.js";
+import { gcRpcPublicKeys } from "./rpc-public-key.js";
 export const OPPORTUNISTIC_GC_BUDGET = { budgetMs: 1_500, maxEndpoints: 32, minIntervalMs: 300_000 };
 export async function gcHostEndpointsOpportunistically(options) {
     const now = options.now ?? Date.now;
@@ -35,6 +36,8 @@ export async function gcHostEndpointsOpportunistically(options) {
     const startedAt = now();
     if (previous !== undefined && startedAt - previous.completedAt < minIntervalMs)
         return { ran: false };
+    if (process.platform !== "win32")
+        await gcRpcPublicKeys(options.agentDir, { deadline: startedAt + budgetMs, maxRecords: maxEndpoints });
     const candidates = await gcCandidates(options);
     const present = new Set(candidates.map((endpoint) => endpoint.name));
     const skip = {};

package/dist/modes/rpc/host-gc.js

@@ -46,9 +46,12 @@ import { acquireHostEnsureLock } from "./host-ensure-lock.js";
 import { endpointInUse, socketSiblings } from "./host-gc-evidence.js";
 import { judgeStaleEngine } from "./host-stale-engine.js";
 import { stopHost } from "./host-stop.js";
+import { gcRpcPublicKeys } from "./rpc-public-key.js";
 /** 2 s, the budget a concurrent ensure's critical section gets before gc reports `locked`. */
 const GC_LOCK_WAIT_MS = 2_000;
 export async function gcHostEndpoints(agentDir, options = {}) {
+    if (process.platform !== "win32")
+        await gcRpcPublicKeys(agentDir);
     const removed = [];
     const stopped = [];
     const kept = [];

package/dist/modes/rpc/host-internal-transport.d.ts

@@ -1,15 +1,26 @@
 /**
  * The engine side of the supervisor's private hop (senpi#3795): the stdin-delivered key and lifetime descriptor
- * from the bootstrap, and how each accepted internal connection is admitted. Split out of multi-session-host.ts.
+ * from the bootstrap, and how each accepted connection is admitted. Split out of multi-session-host.ts.
  */
 import type { Socket } from "node:net";
 import type { Duplex } from "node:stream";
-import type { HostWatchdogConfig } from "./host-watchdog.ts";
+import { type HostWatchdogConfig } from "./host-watchdog.ts";
+/**
+ * The supervisor binding, read once per process. The watch variables are removed as they are read (senpi#3815 review
+ * L4), so no tool, shell or nested host this host starts inherits a binding to a supervisor that is not its own.
+ */
+export declare function hostWatchdogBinding(): HostWatchdogConfig | undefined;
 export interface InternalHostTransport {
-    /** The supervisor's watchdog binding, plus the reopened stdin lifetime descriptor when the bootstrap has one. */
     readonly watchdogConfig: HostWatchdogConfig | undefined;
-    /** Authenticates and seals (POSIX key), authenticates (Windows secret), or accepts as is (no supervisor). */
+    /** Authenticates and seals (POSIX key), authenticates (Windows secret), filters (public), or accepts as is. */
     admit(socket: Socket, accept: (socket?: Duplex) => void): void;
+    /** Publishes the public endpoint's key record after listening; a failure is logged and `onFailure` ends the host. */
+    publish(onFailure: () => Promise<void>): Promise<void>;
+    dispose(): Promise<void>;
 }
-export declare function internalHostTransport(configured: HostWatchdogConfig | undefined, secret: Uint8Array | undefined): InternalHostTransport;
+export declare function internalHostTransport(configured: HostWatchdogConfig | undefined, secret: Uint8Array | undefined, endpoint?: {
+    readonly agentDir: string;
+    readonly socket: string;
+    readonly log: (message: string) => void;
+}): InternalHostTransport;
 //# sourceMappingURL=host-internal-transport.d.ts.map

package/dist/modes/rpc/host-internal-transport.js

@@ -1,18 +1,33 @@
 import { VERSION } from "../../config.js";
-import { HOST_WATCH_LIFETIME_FIFO_ENV } from "./host-lifetime-binding.js";
+import { consumeHostWatchdogEnv, scrubHostWatchdogEnv } from "./host-watchdog.js";
 import { getInternalHostBootstrap } from "./internal-bootstrap.js";
 import { acceptInternalConnection } from "./internal-channel.js";
+import { PublicRpcConnection } from "./rpc-public-auth.js";
+import { RpcPublicEndpoint } from "./rpc-public-key.js";
 import { authenticateSocket } from "./socket-transport.js";
-export function internalHostTransport(configured, secret) {
+let binding;
+/**
+ * The supervisor binding, read once per process. The watch variables are removed as they are read (senpi#3815 review
+ * L4), so no tool, shell or nested host this host starts inherits a binding to a supervisor that is not its own.
+ */
+export function hostWatchdogBinding() {
+    binding ??= { config: consumeHostWatchdogEnv() };
+    return binding.config;
+}
+export function internalHostTransport(configured, secret, endpoint) {
     const bootstrap = getInternalHostBootstrap();
-    // The FIFO path is the host's alone: it is in `configured` now, so no tool or shell the host runs inherits it and
-    // could open the FIFO for writing to hold off shutdown (senpi#3816 review).
-    delete process.env[HOST_WATCH_LIFETIME_FIFO_ENV];
+    scrubHostWatchdogEnv();
+    const watchdogConfig = configured && {
+        ...configured,
+        ...(bootstrap?.lifetimeFd === undefined ? {} : { lifetimeFd: bootstrap.lifetimeFd }),
+    };
+    // Supervised means holding the internal key, which only the launching supervisor can hand over and no descendant
+    // inherits; a host without it is a public endpoint whatever its environment says (senpi#3815 review L4).
+    const publicEndpoint = endpoint !== undefined && process.platform !== "win32" && bootstrap === undefined
+        ? new RpcPublicEndpoint(endpoint.agentDir, endpoint.socket)
+        : undefined;
     return {
-        watchdogConfig: configured && {
-            ...configured,
-            ...(bootstrap?.lifetimeFd === undefined ? {} : { lifetimeFd: bootstrap.lifetimeFd }),
-        },
+        watchdogConfig,
         admit(socket, accept) {
             if (bootstrap)
                 void acceptInternalConnection(socket, bootstrap.key, { protocolVersion: 1, serverVersion: VERSION })
@@ -24,9 +39,25 @@ export function internalHostTransport(configured, secret) {
                 });
             else if (secret)
                 authenticateSocket(socket, secret, () => accept());
+            else if (publicEndpoint)
+                accept(new PublicRpcConnection(socket, publicEndpoint).stream);
             else
                 accept();
         },
+        async publish(onFailure) {
+            try {
+                await publicEndpoint?.publish();
+            }
+            catch (cause) {
+                endpoint?.log(cause instanceof Error ? cause.message : String(cause));
+                await onFailure();
+            }
+        },
+        async dispose() {
+            await publicEndpoint?.dispose().catch((cause) => {
+                endpoint?.log(`endpoint key cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+            });
+        },
     };
 }
 //# sourceMappingURL=host-internal-transport.js.map