@code-yeongyu/senpi 2026.10.25-1 → 2026.10.25-3

package/dist/cli/args.d.ts

@@ -55,6 +55,8 @@ export interface Args {
     grokNeo?: boolean;
     /** Serve independently routed plain-RPC sessions over one host. */
     multiSession?: boolean;
+    presenterBootstrapFd?: number;
+    mcpPresenterEnforcement?: boolean;
     /**
      * Opt non-interactive app modes (notably RPC) into engine-side session auto-titling.
      * Deprecated for shared hosts: prefer per-session `open_session.auto_title`.

package/dist/cli/args.js

@@ -297,6 +297,15 @@ export function parseArgs(args, options = {}) {
         else if (arg === "--multi-session") {
             result.multiSession = true;
         }
+        else if (arg === "--mcp-presenter-fd") {
+            if (args[++i] === "4")
+                result.presenterBootstrapFd = 4;
+            else
+                result.diagnostics.push({ type: "error", message: "Invalid presenter bootstrap descriptor" });
+        }
+        else if (arg === "--mcp-presenter-enforcement") {
+            result.mcpPresenterEnforcement = true;
+        }
         else if (arg === "--auto-title-sessions") {
             result.autoTitleSessions = true;
         }

package/dist/cli/host-command-args.d.ts

@@ -5,6 +5,7 @@ import { type HostStopGeneration } from "../modes/rpc/host-stop-generation.ts";
 declare const SUBCOMMANDS: readonly ["ensure", "status", "stop", "handoff", "shard-path", "gc"];
 type HostSubcommand = (typeof SUBCOMMANDS)[number];
 export interface ParsedHostArgs {
+    readonly presenterBootstrapFd?: number;
     readonly subcommand: HostSubcommand;
     readonly specPath?: string;
     readonly policy: HostDecisionPolicy;

package/dist/cli/host-command-args.js

@@ -26,11 +26,16 @@ export function parseHostArgs(args) {
     let root;
     let agentDir;
     let keyRoot;
+    let presenterBootstrapFd;
     const handover = {};
     for (let index = 0; index < rest.length; index++) {
         const flag = rest[index];
         const value = rest[index + 1];
-        if (flag === "--rpc-key-root" && value !== undefined && !value.startsWith("--")) {
+        if (flag === "--mcp-presenter-fd" && value === "4" && (subcommand === "ensure" || subcommand === "handoff")) {
+            presenterBootstrapFd = 4;
+            index++;
+        }
+        else if (flag === "--rpc-key-root" && value !== undefined && !value.startsWith("--")) {
             keyRoot = resolve(value);
             index++;
         }
@@ -115,6 +120,7 @@ export function parseHostArgs(args) {
     if (typeof terms === "string")
         return terms;
     return {
+        ...(presenterBootstrapFd === undefined ? {} : { presenterBootstrapFd }),
         subcommand,
         ...(specPath !== undefined && { specPath }),
         policy,

package/dist/cli/host-command.js

@@ -28,6 +28,7 @@ import { DEFAULT_HOST_LAUNCH_SPEC, HostLaunchSpecError, loadHostLaunchSpec, } fr
 import { HOST_EXIT_ERROR, HOST_EXIT_USAGE, runHostRequest, } from "../modes/rpc/host-runner.js";
 import { parseHostArgs } from "./host-command-args.js";
 import { emit } from "./host-emit.js";
+import { presenterBootstrapStream } from "../modes/rpc/mcp-presenter-bootstrap.js";
 export { parseHostArgs } from "./host-command-args.js";
 const USAGE = `usage: ${APP_NAME} host <ensure|status|stop|handoff|shard-path|gc> [options]
 
@@ -55,7 +56,8 @@ export async function runHostCommand(args) {
     }
     try {
         const request = await hostRequest(parsed);
-        const outcome = await runHostRequest(request, parsed.keyRoot === undefined ? {} : { keyRoot: parsed.keyRoot });
+        const presenterBootstrap = parsed.presenterBootstrapFd === undefined ? undefined : presenterBootstrapStream(parsed.presenterBootstrapFd);
+        const outcome = await runHostRequest(request, { keyRoot: parsed.keyRoot, presenterBootstrap }).finally(() => presenterBootstrap?.destroy());
         if (parsed.subcommand === "shard-path" && !parsed.json)
             writeSync(1, `${String(outcome.payload.socket)}\n`);
         else

package/dist/core/agent-session.d.ts

@@ -1708,6 +1708,7 @@ export declare class AgentSession {
     noteAutomaticInput(text: string): boolean;
     private _stopAddedSince;
     private _stopHoldLive;
+    private _resumeCause;
     get pauseView(): {
         pauseSeq: number;
         records: {

package/dist/core/agent-session.js

@@ -56,7 +56,7 @@ import { assertExpectedUserLeaf, buildEditedUserMessage, UserEditError, userText
 import { ENGINE_PAUSED_ENTRY_TYPE, enginePauseSinceLastTurn, settledRepetitiveTurnPause } from "./engine-paused.js";
 import { EngineTurnHold, engineTurnHoldHistory, engineWakeSource } from "./engine-turn-hold.js";
 import { EngineTurnInput } from "./engine-turn-input.js";
-import { ENGINE_TURN_LIMIT_ENTRY_TYPE, ENGINE_TURN_LIMIT_EVENT, ENGINE_TURN_START_ENTRY_TYPE, engineTurnHistory, engineTurnLimitNotice, engineTurnStop, isUserDirectedTurn, } from "./engine-turn-limit.js";
+import { ENGINE_TURN_LIMIT_ENTRY_TYPE, ENGINE_TURN_LIMIT_EVENT, ENGINE_TURN_START_ENTRY_TYPE, engineTurnHistory, engineTurnLimitNotice, engineTurnStop, isUserDirectedTurn, resetsEngineTurnHistory, } from "./engine-turn-limit.js";
 import { EngineTurnRelease } from "./engine-turn-release.js";
 import { environmentContextMessageIfChanged, resolveEnvironmentContext, } from "./environment-context.js";
 import { areExperimentalFeaturesEnabled } from "./experimental.js";
@@ -609,6 +609,9 @@ export class AgentSession {
         this._handleAgentEvent = (event, signal) => {
             if (event.type === "agent_start")
                 this._lifecycleBinding.startRun();
+            // Bound at emission: the core can start the next run before the queue reaches this end (senpi#3864).
+            if (event.type === "agent_end")
+                this._lifecycleBinding.bindTurnEnd(event);
             if (event.type === "message_start") {
                 try {
                     const entryId = this._lifecycleBinding.consume(event.message);
@@ -3113,8 +3116,9 @@ export class AgentSession {
         else if (event.type === "agent_end") {
             const extensionEvent = this._abortProvenance.beginAgentEnd(event.messages, agentEndWillRetry, this._findLastAssistantInMessages(event.messages)?.stopReason === "aborted");
             try {
+                const guardStartLeafId = this.sessionManager.getLeafId();
                 await this._extensionRunner.emit(extensionEvent);
-                await this._lifecycleBinding.turnEnded(extensionEvent);
+                await this._lifecycleBinding.turnEnded(extensionEvent, event, guardStartLeafId);
             }
             finally {
                 this._abortProvenance.endAgentEnd(extensionEvent);
@@ -3538,12 +3542,23 @@ export class AgentSession {
     }
     /** Record a deadline stop durably so the goal engine holds off until admitted user input. */
     _recordDeadlineStop(deadline) {
-        this._emitEntryAppended(this.sessionManager.appendCustomEntry(TURN_DEADLINE_ENTRY_TYPE, {
-            kind: deadline.kind,
-            limitMs: deadline.limitMs,
-            elapsedMs: deadline.elapsedMs,
-            at: Date.now(),
-        }));
+        const at = Date.now();
+        // The lifecycle stop is captured before the write, so a refused write keeps it for this run (senpi#3864).
+        this._lifecycleBinding.deadlineStopped(deadline.kind, at);
+        let entryId;
+        try {
+            entryId = this.sessionManager.appendCustomEntry(TURN_DEADLINE_ENTRY_TYPE, {
+                kind: deadline.kind,
+                limitMs: deadline.limitMs,
+                elapsedMs: deadline.elapsedMs,
+                at,
+            });
+        }
+        catch (error) {
+            this._lifecycleBinding.deadlineStopWriteFailed();
+            throw error;
+        }
+        this._emitEntryAppended(entryId);
     }
     /**
      * Get the names of currently active tools.
@@ -5771,7 +5786,11 @@ export class AgentSession {
             });
         const deliveredNotices = this._engineTurnHold.noticeCount;
         const deliveredHeldInputs = this._heldInputs.pending().length;
-        if (this._stopHoldLive() || this._engineTurnHold.fences.length > 0 || deliveredHeldInputs > 0) {
+        // Payload-free notices (including goals) revalidate through their producer after release.
+        // An interruption must not add a directive-only turn when that work has already completed.
+        const resumeHeldTurn = this._stopHoldLive() &&
+            (this._resumeCause() === "stop" || deliveredNotices === 0 || this._engineTurnHold.messages().length > 0);
+        if (resumeHeldTurn || this._engineTurnHold.fences.length > 0 || deliveredHeldInputs > 0) {
             const { turnStarted, settled } = await this._resumeAfterStop(onQueued);
             return {
                 answer: { resumed: true, pauseSeq, turnStarted, deliveredNotices, deliveredHeldInputs },
@@ -5810,8 +5829,9 @@ export class AgentSession {
      * resume settlement delivered the turn.
      */
     async _resumeAfterStop(onQueued) {
+        const resumeCause = this._resumeCause();
         const sources = this._engineTurnHold.releaseAll("resume_session");
-        const { turnId, delivered } = await this._startResumeTurn(onQueued);
+        const { turnId, delivered } = await this._startResumeTurn(onQueued, resumeCause);
         const settled = (async () => {
             if (!(await delivered)) {
                 this._engineTurnHold.rejectInput();
@@ -5833,7 +5853,7 @@ export class AgentSession {
         return this._resumeSettlement;
     }
     /** The resume turn both resume paths start; held input and notices are consumed only if no newer Stop aborted it. */
-    async _startResumeTurn(onQueued) {
+    async _startResumeTurn(onQueued, resumeCause = "stop") {
         const settlement = Promise.withResolvers();
         this._resumeSettlement = settlement.promise;
         try {
@@ -5864,7 +5884,7 @@ export class AgentSession {
                 }));
                 // The hold is already released: include new or re-held input before sending, and omit withdrawals.
             }
-            const started = await this._startResumeTurnWith(generation, continues, heldInputs, onQueued);
+            const started = await this._startResumeTurnWith(generation, continues, heldInputs, onQueued, resumeCause);
             started.delivered.then(() => settlement.resolve(), () => settlement.resolve());
             return started;
         }
@@ -5873,8 +5893,9 @@ export class AgentSession {
             throw error;
         }
     }
-    _startResumeTurnWith(generation, continues, heldInputs, onQueued) {
+    _startResumeTurnWith(generation, continues, heldInputs, onQueued, resumeCause = "stop") {
         return startRunResumeTurn({
+            resumeCause,
             heldInputs: () => heldInputs,
             continueInputs: () => [...continues],
             heldWakes: () => this._engineTurnHold.messages(),
@@ -5906,7 +5927,7 @@ export class AgentSession {
             return;
         this._releaseExtrasGeneration = this._userAbortGeneration;
         if (this._stopHoldLive())
-            this._releaseExtras.push({ role: "custom", ...stopResumeDirective(), timestamp: Date.now() });
+            this._releaseExtras.push({ role: "custom", ...stopResumeDirective(this._resumeCause()), timestamp: Date.now() });
         const { messages, commands } = this._takeHeldInputs();
         this._releaseExtras.push(...messages);
         // A later capture that finds no commands keeps the run an earlier one (a question answer's) still owes.
@@ -6019,7 +6040,7 @@ export class AgentSession {
         });
     }
     noteAutomaticInput(text) {
-        const userHold = this._engineTurnHold.holds.some((hold) => hold.kind === "session_hold" || hold.kind === "inherited_hold");
+        const userHold = this._engineTurnHold.holds.some((hold) => (hold.kind === "session_hold" && hold.key !== "interrupted-run") || hold.kind === "inherited_hold");
         if (!userHold)
             return false;
         const message = {
@@ -6039,6 +6060,13 @@ export class AgentSession {
     _stopHoldLive() {
         return this._engineTurnHold.holds.some((hold) => hold.kind === "session_hold");
     }
+    _resumeCause() {
+        const holds = this._engineTurnHold.holds;
+        return holds.some((hold) => hold.kind === "session_hold" && hold.key === "interrupted-run") &&
+            !holds.some((hold) => hold.kind === "session_hold" && hold.key !== "interrupted-run")
+            ? "interrupted"
+            : "stop";
+    }
     get pauseView() {
         return {
             pauseSeq: this._engineTurnHold.currentPauseSeq,
@@ -6150,7 +6178,8 @@ export class AgentSession {
     }
     /** Keeps this process's engine-turn record: a user message clears it, a tool call marks the running engine turn. */
     _observeEngineTurnMessage(message) {
-        if (message.role === "user" || (message.role === "custom" && isUserDirectedTurn(message.customType))) {
+        if (message.role === "user" ||
+            (message.role === "custom" && resetsEngineTurnHistory(message.customType, message.details))) {
             this._engineTurnStarts = [];
             this._engineResumeWindow = false;
             this._engineTurnPauseRecorded = false;
@@ -6615,6 +6644,7 @@ export class AgentSession {
     /** A user Stop: hold automatic turns until human input or resume_session, then stop the running turn (senpi#3811). */
     async stop() {
         this._runHolds.stamp();
+        this.refreshLifecycle();
         this._stopInterrupt = { pauseSeq: this._engineTurnHold.currentPauseSeq, at: new Date().toISOString() };
         try {
             await this.abort();
@@ -9211,6 +9241,10 @@ export class AgentSession {
                 this._extensionErrorListener = bindings.onError;
             }
             this._applyExtensionBindings(this._extensionRunner);
+            // Opening a session is not explicit Resume. Install the same hold used by Stop before
+            // session_start producers run, so automatic work waits quietly in notice custody.
+            if (this._lifecycleBinding.controller.requiresHumanContinuation)
+                this._engineTurnHold.addHold("session_hold", { key: "interrupted-run" });
             this._engineTurnHold.start();
             this.syncPromptCacheSafeWaitEnv();
             await this._extensionRunner.emit({

package/dist/core/engine-turn-limit.d.ts

@@ -27,6 +27,8 @@ export interface EngineTurnStop {
 export declare function engineTurnLimitNotice(stop: EngineTurnStop): string;
 /** A `.` manual continue or a continue-from-leaf is the user's own request, not an automatic turn. */
 export declare function isUserDirectedTurn(customType: string): boolean;
+/** Recovering an interrupted run is not a new message that resets the unattended turn budget. */
+export declare function resetsEngineTurnHistory(customType: string, details?: unknown): boolean;
 /** The session's engine turns since the user's last message, in order: when each started and whether its reply called a tool. */
 export interface EngineTurnHistory {
     readonly starts: EngineTurnStartRecord[];

package/dist/core/engine-turn-limit.js

@@ -23,9 +23,15 @@ export function isUserDirectedTurn(customType) {
         customType === CONTINUE_FROM_LEAF_CUSTOM_TYPE ||
         customType === STOP_RESUME_CUSTOM_TYPE);
 }
+/** Recovering an interrupted run is not a new message that resets the unattended turn budget. */
+export function resetsEngineTurnHistory(customType, details) {
+    return (isUserDirectedTurn(customType) &&
+        !(customType === STOP_RESUME_CUSTOM_TYPE &&
+            details?.resumeCause === "interrupted"));
+}
 function isUserMessage(entry) {
     if (entry.type === "custom_message")
-        return isUserDirectedTurn(entry.customType);
+        return resetsEngineTurnHistory(entry.customType, entry.details);
     return entry.type === "message" && entry.message.role === "user";
 }
 function isEngineTurnStart(entry) {

package/dist/core/extensions/builtin/anthropic-subscription/auth-attempt.js

@@ -24,6 +24,11 @@ async function* closingQueryMessages(query) {
     }
 }
 export async function createAttemptMessages(input, auth) {
+    // Claude Code loads auto memory independently of settingSources. Keep its private
+    // notes out of every subscription session, after all auth and caller overrides.
+    auth.options.env = { ...auth.options.env, CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
+    if (typeof auth.options.settings !== "string")
+        auth.options.settings = { ...auth.options.settings, autoMemoryEnabled: false };
     if (input.createAttempt)
         return recordingLimitWindows(retainedAttemptMessages(await input.createAttempt(auth)), auth);
     const query = input.query({ prompt: input.prompt, options: auth.options });

package/dist/core/extensions/builtin/goal/index.js

@@ -137,6 +137,7 @@ export default function goalExtension(pi) {
             const end = lastAgentEnd ?? restoredEnd;
             return {
                 goal,
+                ...(lastTodoOutcome === undefined ? {} : { todoOutcome: lastTodoOutcome }),
                 ...(end
                     ? {
                         input: collectTurnEndLivenessInput(ctx, end, {

package/dist/core/extensions/builtin/goal/lifecycle-facts.d.ts

@@ -1,9 +1,12 @@
 import type { AgentEndEvent } from "../../types.ts";
+import type { TodoOwedOutcome } from "./todo-owed-backstop.ts";
 import type { TurnEndLivenessInput } from "./turn-end-liveness.ts";
 import type { Goal } from "./types.ts";
 export interface GoalLifecycleFacts {
     readonly goal: Goal | null;
     readonly input?: TurnEndLivenessInput;
+    /** What the todo backstop returned at the last turn end; a repeated `cap` emits no event. */
+    readonly todoOutcome?: TodoOwedOutcome;
 }
 type Collector = (restoredEnd?: AgentEndEvent, goal?: Goal | null) => Promise<GoalLifecycleFacts>;
 export declare function onGoalLifecycleChange(owner: object, listener: (goal: Goal | null) => void): () => void;

package/dist/core/extensions/builtin/goal/stop-pause.js

@@ -1,7 +1,8 @@
 export const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
 export function stopHoldLive(ctx) {
-    return ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold") === true;
+    return (ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold" && hold.key !== "interrupted-run") ===
+        true);
 }
 export function markStopPaused(pi, goalId) {
     pi.appendEntry(GOAL_STOP_PAUSED_ENTRY, { goalId });

package/dist/core/extensions/builtin/loop/session-hold.js

@@ -2,6 +2,7 @@ export function sessionHeld(ctx) {
     return ctx.getPauseState?.().holds.some((hold) => hold.kind !== "run_fence") === true;
 }
 export function userStopped(ctx) {
-    return ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold") === true;
+    return (ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold" && hold.key !== "interrupted-run") ===
+        true);
 }
 //# sourceMappingURL=session-hold.js.map

package/dist/core/extensions/builtin/mcp/catalog.d.ts

@@ -5,8 +5,10 @@ import type { ServerConnection } from "./connection.ts";
 import type { McpOutputArtifacts } from "./guard/output-guard.ts";
 import type { McpEnsureFreshAuth } from "./health.ts";
 import type { McpInvocationResolver } from "./invocation.ts";
+import type { McpRequestOrigin } from "./request-origin.ts";
 type ListedTool = Awaited<ReturnType<Client["listTools"]>>["tools"][number];
 export interface McpToolCatalogEntry {
+    requestOrigin?: () => McpRequestOrigin | undefined;
     server: string;
     tool: string;
     schema: ListedTool["inputSchema"];
@@ -21,7 +23,7 @@ export interface McpToolCatalogEntry {
     outputGuard?: McpSettings["outputGuard"];
     invocation?: McpInvocationResolver;
 }
-type McpToolCatalogOptions = Pick<McpToolCatalogEntry, "agentDir" | "artifacts" | "ensureFresh" | "outputGuard" | "invocation">;
+type McpToolCatalogOptions = Pick<McpToolCatalogEntry, "agentDir" | "artifacts" | "ensureFresh" | "outputGuard" | "invocation" | "requestOrigin">;
 export declare function collectToolCatalog(server: string, connection: ServerConnection, config: McpServerDeclaredConfig, options?: McpToolCatalogOptions): Promise<McpToolCatalogEntry[]>;
 /** What registering these tools with this catalog's resources and prompts exposes;
  * equal identities register identical definitions. */

package/dist/core/extensions/builtin/mcp/catalog.js

@@ -2,6 +2,7 @@ import { collectAllPages } from "./expose/pagination.js";
 export async function collectToolCatalog(server, connection, config, options = {}) {
     const result = await collectAllPages((cursor) => connection.client.listTools(cursor === undefined ? {} : { cursor }, { timeout: config.requestTimeoutMs }));
     return result.items.map((tool) => ({
+        requestOrigin: options.requestOrigin,
         annotations: tool.annotations,
         agentDir: options.agentDir,
         artifacts: options.artifacts,
@@ -27,6 +28,7 @@ export function mcpRegistrationIdentity(tools, catalog) {
 }
 export function cachedToolsToCatalogEntries(server, catalog, connection, requestTimeoutMs, ensureConnected, options = {}) {
     return catalog.tools.map((tool) => ({
+        requestOrigin: options.requestOrigin,
         annotations: tool.annotations,
         agentDir: options.agentDir,
         artifacts: options.artifacts,

package/dist/core/extensions/builtin/mcp/connection.d.ts

@@ -4,6 +4,7 @@ export type { ServerConnectionOptions, ServerConnectionState, ServerConnectionSt
 export declare class ServerConnection {
     #private;
     readonly serverName: string;
+    get requestLifetimeSignal(): AbortSignal;
     constructor(options: ServerConnectionOptions);
     get state(): ServerConnectionState;
     get declarationIdentity(): string | undefined;

package/dist/core/extensions/builtin/mcp/connection.js

@@ -2,6 +2,8 @@ import { dirname } from "node:path";
 import { resolveServerAuth } from "./auth/context.js";
 import { diagnoseCapturedMcpConnectFailure, diagnoseMcpConnectFailure } from "./diagnose.js";
 import { ConnectError } from "./errors.js";
+import { legacyMcpFormEligible } from "./elicitation.js";
+import { isModernMcpClient, legacyMcpFormsAdvertised } from "./modern/request.js";
 import { subscribeMcpServerLogging } from "./logging.js";
 import { isMcpNeedsAuthError } from "./needs-auth.js";
 import { subscribeMcpListChanged } from "./notifications.js";
@@ -18,12 +20,18 @@ export class ServerConnection {
     #resolveConfig;
     #projectPolicy;
     #policyAbort;
+    #requestLifetime = new AbortController();
+    get requestLifetimeSignal() {
+        return this.#requestLifetime.signal;
+    }
     #startedGrantNames = [];
     #state;
     #generation = 0;
     #connection;
     #pendingConnection;
     #pendingConnect;
+    #renegotiatingForms;
+    #stopFormReadiness;
     #lastError;
     #stateListeners = new Set();
     #toolsListeners = new Set();
@@ -87,9 +95,33 @@ export class ServerConnection {
         return this.#connection?.getRootPid() ?? null;
     }
     connect() {
+        return this.#renegotiatingForms ?? this.#connect();
+    }
+    #legacyFormsChanged(client) {
+        return (this.#elicitationUiProvider?.enforced?.() === true &&
+            !isModernMcpClient(client) &&
+            legacyMcpFormsAdvertised(client) !==
+                legacyMcpFormEligible(this.#elicitationUiProvider, this.#elicitationEnabled !== false));
+    }
+    #refreshLegacyForms() {
+        if (this.#state !== "connected" || this.#renegotiatingForms || !this.#legacyFormsChanged(this.client))
+            return;
+        // Publish the single flight before renewing: connect callers join it while the old transport closes.
+        this.#renegotiatingForms = Promise.resolve()
+            .then(() => this.renew())
+            .finally(() => {
+            this.#renegotiatingForms = undefined;
+        });
+        void this.#renegotiatingForms.catch((error) => {
+            this.markDegraded(error instanceof Error ? error : new Error(String(error)));
+        });
+    }
+    #connect() {
         if (this.#state === "disabled") {
             return Promise.reject(this.#connectError(`MCP server ${this.serverName} is disabled`, "connect"));
         }
+        if (this.#elicitationUiProvider?.enforced?.())
+            this.#stopFormReadiness ??= this.#elicitationUiProvider.subscribe?.(() => this.#refreshLegacyForms());
         if (this.#state === "connected")
             return Promise.resolve(this.client);
         if (this.#pendingConnect)
@@ -153,13 +185,17 @@ export class ServerConnection {
             throw this.#connectError(`MCP server ${this.serverName} is disabled`, "renew");
         }
         this.#policyAbort?.abort();
+        this.#requestLifetime.abort();
+        this.#requestLifetime = new AbortController();
         this.#generation++;
         this.#pendingConnect = undefined;
         this.#setState("idle");
         await this.#disposeOwnedConnections();
-        return this.connect();
+        return this.#connect();
     }
     bumpGeneration() {
+        this.#requestLifetime.abort();
+        this.#requestLifetime = new AbortController();
         this.#policyAbort?.abort();
         this.#generation++;
         this.#pendingConnect = undefined;
@@ -169,6 +205,9 @@ export class ServerConnection {
         return this.#disposeOwnedConnections();
     }
     disable() {
+        this.#stopFormReadiness?.();
+        this.#stopFormReadiness = undefined;
+        this.#requestLifetime.abort();
         this.#policyAbort?.abort();
         this.#generation++;
         this.#pendingConnect = undefined;
@@ -177,6 +216,9 @@ export class ServerConnection {
         return this.#disposeOwnedConnections();
     }
     async dispose() {
+        this.#stopFormReadiness?.();
+        this.#stopFormReadiness = undefined;
+        this.#requestLifetime.abort();
         this.#policyAbort?.abort();
         this.#generation++;
         this.#pendingConnect = undefined;
@@ -320,6 +362,9 @@ export class ServerConnection {
         // Server logging notifications (todo 42): RFC-5424 → the per-server
         // logger, filtered by config.logLevel, burst-capped.
         subscribeMcpServerLogging(connection.client, { logLevel: this.#config.logLevel, logger: this.#logger });
+        // Readiness can change while initialize is in flight; never publish that stale negotiation as connected.
+        if (this.#legacyFormsChanged(connection.client))
+            return this.renew();
         this.#setState("connected");
         this.markToolsChanged("connect");
         return connection.client;

package/dist/core/extensions/builtin/mcp/elicitation.d.ts

@@ -9,7 +9,11 @@ export declare function mcpClientCapabilities(elicitationEnabled?: boolean): {
 };
 export declare const MCP_ELICITATION_TIMEOUT_MS: number;
 type ElicitationUi = Pick<ExtensionUIContext, "input" | "select">;
-export type McpElicitationUiProvider = () => ElicitationUi | undefined;
+export type McpElicitationUiProvider = (() => ElicitationUi | undefined) & {
+    readonly eligible?: () => boolean;
+    readonly enforced?: () => boolean;
+    readonly subscribe?: (listener: () => void) => () => void;
+};
 export interface McpElicitationUiOwner {
     getMcpElicitationUi(): ElicitationUi | undefined;
 }
@@ -26,6 +30,7 @@ interface ElicitProperty {
 }
 /** Legacy classic-session seam. Session-owned services pass themselves directly. */
 export declare function setMcpElicitationUiProvider(provider: McpElicitationUiProvider | undefined): void;
+export declare function legacyMcpFormEligible(provider: McpElicitationUiProvider | undefined, enabled: boolean): boolean;
 /**
  * Wire the elicitation/create handler onto a fresh client. Async because the
  * request schema comes from the lazily loaded SDK; the caller (`buildMcpClient`

package/dist/core/extensions/builtin/mcp/elicitation.js

@@ -9,6 +9,9 @@
 // The whole form is bounded by a timeout that resolves to cancel so a wedged
 // dialog can never wedge the tool-call pipeline. URL mode is deliberately not
 // implemented in v1.
+import { privateMcpForms } from "../../../mcp-form-types.js";
+import { legacyMcpOperation } from "./request-origin.js";
+import { isRecord, validateMrtrForm } from "./modern/form-schema.js";
 import { createMcpLogger } from "./log.js";
 import { loadMcpSdkTypes } from "./sdk.lazy.js";
 import { safeTimer } from "./wrap.js";
@@ -27,6 +30,48 @@ async function rejectElicitation() {
     const { ErrorCode, McpError } = await loadMcpSdkTypes();
     throw new McpError(ErrorCode.InternalError, "Elicitation cannot be processed");
 }
+export function legacyMcpFormEligible(provider, enabled) {
+    if (!enabled)
+        return false;
+    if (provider?.eligible)
+        return provider.eligible();
+    const ui = provider?.();
+    const binding = ui === undefined ? undefined : privateMcpForms(ui);
+    return binding === undefined || binding.capture()?.ready() === true;
+}
+async function rejectPrivateElicitation() {
+    const { ErrorCode, McpError } = await loadMcpSdkTypes();
+    throw new McpError(ErrorCode.InternalError, "Elicitation processing unavailable");
+}
+async function privateElicitation(client, params, signal, requestId, timeoutMs) {
+    const operation = legacyMcpOperation(client);
+    if (operation === "ambiguous") {
+        const { ErrorCode, McpError } = await loadMcpSdkTypes();
+        throw new McpError(ErrorCode.InternalError, "Elicitation cannot be processed: ambiguous origin from concurrent legacy tools/call requests. Run these calls sequentially or use an MRTR server.", { reason: "ambiguous_legacy_origin" });
+    }
+    const presenter = operation?.origin.privateForm;
+    if (!isRecord(params) ||
+        typeof params.message !== "string" ||
+        (params.mode !== undefined && params.mode !== "form") ||
+        !operation ||
+        !presenter?.ready() ||
+        !validateMrtrForm(params.requestedSchema))
+        return rejectPrivateElicitation();
+    const outcome = await presenter.present({
+        operationId: String(requestId),
+        inputId: String(requestId),
+        round: 0,
+        server: { label: operation.origin.serverLabel, source: operation.origin.serverSource ?? "user" },
+        message: params.message,
+        schema: params.requestedSchema,
+        operationSignal: AbortSignal.any([operation.signal, signal]),
+        presentationSignal: presenter.signal,
+        deadlineMs: timeoutMs,
+    });
+    if (outcome.kind !== "result" || operation.signal.aborted || !operation.origin.isCurrent())
+        return rejectPrivateElicitation();
+    return outcome.result;
+}
 /**
  * Wire the elicitation/create handler onto a fresh client. Async because the
  * request schema comes from the lazily loaded SDK; the caller (`buildMcpClient`
@@ -40,18 +85,27 @@ export async function configureMcpElicitation(client, owner = legacyUiProvider,
         const { ErrorCode, McpError } = await loadMcpSdkTypes();
         client.fallbackRequestHandler = async (request) => {
             if (request.method === "elicitation/create")
-                return rejectElicitation();
+                return typeof owner === "function" && owner.enforced?.() ? rejectPrivateElicitation() : rejectElicitation();
             throw new McpError(ErrorCode.MethodNotFound, "Method not found");
         };
         return;
     }
     const { ElicitRequestSchema } = await loadMcpSdkTypes();
-    client.setRequestHandler(ElicitRequestSchema, async (request) => {
+    if (typeof owner === "function" && owner.enforced?.()) {
+        // Private validation prevents SDK error.data from echoing malformed form bodies.
+        client.setRequestHandler(ElicitRequestSchema.omit({ params: true }).passthrough(), (request, extra) => privateElicitation(client, request.params, extra.signal, extra.requestId, timeoutMs));
+        return;
+    }
+    client.setRequestHandler(ElicitRequestSchema, async (request, extra) => {
         const params = request.params;
         // URL mode is deliberately unsupported in v1 (form mode only).
         if (!("requestedSchema" in params))
             return rejectElicitation();
         const ui = typeof owner === "function" ? owner() : owner?.getMcpElicitationUi();
+        const enforced = (typeof owner === "function" && owner.enforced?.()) || (ui !== undefined && privateMcpForms(ui) !== undefined);
+        if (enforced) {
+            return privateElicitation(client, params, extra.signal, extra.requestId, timeoutMs);
+        }
         if (ui === undefined)
             return rejectElicitation();
         return await runElicitationForm(ui, params.message, params.requestedSchema, timeoutMs);

package/dist/core/extensions/builtin/mcp/expose/call.js

@@ -2,6 +2,8 @@ import { redactResolvedReferenceData, redactResolvedReferenceValues } from "../.
 import { ToolExecError } from "../errors.js";
 import { ensureMcpToolCallConnection, withMcpRetriableFailedSendRetry, withMcpSessionExpiryRetry } from "../health.js";
 import { runMcpConnectionLifecycleCall } from "../idle.js";
+import { mcpRequestOptions } from "../request-origin.js";
+import { McpMrtrError } from "../modern/errors.js";
 export async function callMcpTool(entry, args, signal, onUpdate, label, invocation) {
     try {
         return await runMcpConnectionLifecycleCall(entry.connection, () => withMcpSessionExpiryRetry(entry.connection, async () => {
@@ -29,7 +31,7 @@ export async function callMcpTool(entry, args, signal, onUpdate, label, invocati
                     if (prepared !== undefined && !prepared.isCurrent())
                         continue;
                     const current = prepared?.entry ?? entry;
-                    const result = await current.connection.client.callTool({ name: current.tool, arguments: args }, undefined, {
+                    const result = await current.connection.client.callTool({ name: current.tool, arguments: args }, undefined, mcpRequestOptions(current.requestOrigin?.(), {
                         onprogress: (progress) => {
                             onUpdate?.(redactResolvedReferenceData({
                                 content: [{ type: "text", text: formatProgress(label, progress) }],
@@ -38,13 +40,15 @@ export async function callMcpTool(entry, args, signal, onUpdate, label, invocati
                         },
                         signal,
                         timeout: current.requestTimeoutMs,
-                    });
+                    }));
                     return { kind: "called", entry: current, result };
                 }
             });
         }));
     }
     catch (error) {
+        if (error instanceof McpMrtrError)
+            throw error;
         const label = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
         throw new ToolExecError(redactResolvedReferenceValues(`ToolExecError: ${label}`), {
             cause: error,