@code-yeongyu/senpi 2026.10.25-1 → 2026.10.25-3

package/dist/modes/rpc/mcp-presenter-control.js

@@ -0,0 +1,330 @@
+import { createPublicKey, randomBytes, randomUUID, verify } from "node:crypto";
+import { createServer } from "node:net";
+import { Duplex, PassThrough, Readable, Writable } from "node:stream";
+import { isRecord } from "../../core/extensions/builtin/mcp/modern/form-schema.js";
+import { attachJsonlLineReader } from "./jsonl.js";
+/** Separate authenticated control endpoint. Ordinary RPC credentials cannot enroll or acquire. */
+export class McpPresenterControl {
+    constructor(writer, path) {
+        this.principals = new Map();
+        this.controls = new Set();
+        this.revokeControls = new Map();
+        this.backendGenerations = new Map();
+        this.successors = new Map();
+        this.writer = writer;
+        this.authority = writer.enableMcpPresenters();
+        this.path = path;
+        this.server = createServer((stream) => this.manage(stream));
+    }
+    listen() {
+        return new Promise((resolve, reject) => {
+            this.server.once("error", reject);
+            this.server.listen(this.path, () => {
+                this.server.off("error", reject);
+                resolve();
+            });
+        });
+    }
+    /** A deferred handover is spawned by the old host, not the CLI that already returned. */
+    successorBootstrap() {
+        const owner = this.launchOwner;
+        if (!owner || owner.stream.destroyed)
+            return undefined;
+        const id = randomUUID();
+        const toChild = new PassThrough();
+        const fromChild = new PassThrough();
+        const endpoint = Duplex.from({ readable: Readable.toWeb(toChild), writable: Writable.toWeb(fromChild) });
+        this.successors.set(id, { stream: owner.stream, write: toChild });
+        const stop = privateFrames(fromChild, (value) => {
+            if (!isRecord(value)) {
+                endpoint.destroy();
+                return;
+            }
+            if (value.type === "challenge") {
+                send(owner.stream, { type: "mcp_presenter_successor_challenge", id, challenge: value });
+            }
+            else if (value.type === "enrolled") {
+                send(owner.stream, { type: "mcp_presenter_successor_enrolled", id, enrollment: value });
+                stop();
+                this.successors.delete(id);
+            }
+            else
+                endpoint.destroy();
+        });
+        endpoint.once("close", () => {
+            stop();
+            this.successors.delete(id);
+            toChild.destroy();
+            fromChild.destroy();
+        });
+        toChild.write(`${JSON.stringify({
+            type: "enroll",
+            publicKey: owner.principal.key.export({ type: "spki", format: "pem" }),
+            backendGeneration: owner.backendGeneration,
+        })}\n`);
+        return endpoint;
+    }
+    /** Only the inherited launch channel may introduce the installation public key. */
+    bootstrap(stream) {
+        let key;
+        let backend;
+        let transcript;
+        const id = randomUUID();
+        const stop = privateFrames(stream, (value) => {
+            if (!key) {
+                if (!isRecord(value) ||
+                    value.type !== "enroll" ||
+                    typeof value.publicKey !== "string" ||
+                    typeof value.backendGeneration !== "string") {
+                    stream.destroy();
+                    return;
+                }
+                try {
+                    key = createPublicKey(value.publicKey);
+                }
+                catch {
+                    stream.destroy();
+                    return;
+                }
+                if (key.asymmetricKeyType !== "ed25519") {
+                    stream.destroy();
+                    return;
+                }
+                backend = value.backendGeneration;
+                transcript = JSON.stringify([
+                    "mcp-presenter-enroll-v1",
+                    this.authority.instance,
+                    backend,
+                    randomBytes(32).toString("hex"),
+                ]);
+                send(stream, { type: "challenge", transcript, hostInstance: this.authority.instance });
+                return;
+            }
+            if (!transcript || !signed(value, transcript, key)) {
+                stream.destroy();
+                return;
+            }
+            this.principals.set(id, { id, key, sessions: new WeakSet() });
+            send(stream, {
+                type: "enrolled",
+                principalId: id,
+                hostInstance: this.authority.instance,
+                backendGeneration: backend,
+                endpoint: this.path,
+            });
+            stop();
+            stream.end();
+        });
+    }
+    dispose() {
+        this.authority.dispose();
+        for (const stream of this.controls)
+            stream.destroy();
+        this.controls.clear();
+        for (const successor of this.successors.values())
+            successor.write.destroy();
+        this.successors.clear();
+        this.principals.clear();
+        this.server.close();
+    }
+    manage(stream) {
+        if (this.controls.size >= 64) {
+            stream.destroy();
+            return;
+        }
+        this.controls.add(stream);
+        let principal;
+        let owner;
+        let transcript;
+        let pending;
+        let backendGeneration;
+        let deadline = performance.now() + 30_000;
+        let challengeTimer = setTimeout(() => stream.destroy(), 30_000);
+        const registrations = new Map();
+        const revoke = () => {
+            clearTimeout(challengeTimer);
+            for (const registration of registrations.values())
+                owner?.revoke(registration);
+            registrations.clear();
+            this.controls.delete(stream);
+            this.revokeControls.delete(stream);
+            this.backendGenerations.delete(stream);
+            if (this.launchOwner?.stream === stream)
+                this.launchOwner = undefined;
+            for (const [id, successor] of this.successors)
+                if (successor.stream === stream) {
+                    successor.write.destroy();
+                    this.successors.delete(id);
+                }
+        };
+        this.revokeControls.set(stream, revoke);
+        stream.once("close", revoke);
+        const stop = privateFrames(stream, (value) => {
+            if (!isRecord(value)) {
+                stream.destroy();
+                return;
+            }
+            if (value.type === "mcp_presenter_successor_proof" && typeof value.id === "string") {
+                const successor = this.successors.get(value.id);
+                if (successor?.stream !== stream || typeof value.signature !== "string") {
+                    stream.destroy();
+                    return;
+                }
+                successor.write.write(`${JSON.stringify({ type: "proof", signature: value.signature })}\n`);
+                return;
+            }
+            if (value.type === "challenge") {
+                if (pending ||
+                    typeof value.principalId !== "string" ||
+                    typeof value.backendGeneration !== "string" ||
+                    !isRecord(value.command)) {
+                    stream.destroy();
+                    return;
+                }
+                const requested = this.principals.get(value.principalId);
+                if (!requested || (principal && principal !== requested)) {
+                    stream.destroy();
+                    return;
+                }
+                principal = requested;
+                backendGeneration = value.backendGeneration;
+                pending = value.command;
+                deadline = performance.now() + 30_000;
+                clearTimeout(challengeTimer);
+                challengeTimer = setTimeout(() => stream.destroy(), 30_000);
+                transcript = JSON.stringify([
+                    "mcp-presenter-control-v1",
+                    this.authority.instance,
+                    value.backendGeneration,
+                    randomUUID(),
+                    randomBytes(32).toString("hex"),
+                    pending,
+                ]);
+                send(stream, { type: "challenge", transcript, hostInstance: this.authority.instance });
+                return;
+            }
+            if (!principal ||
+                !pending ||
+                !transcript ||
+                performance.now() >= deadline ||
+                !signed(value, transcript, principal.key)) {
+                stream.destroy();
+                return;
+            }
+            const command = pending;
+            clearTimeout(challengeTimer);
+            pending = undefined;
+            transcript = undefined;
+            owner ??= this.authority.enroll(principal.id);
+            if (backendGeneration === undefined) {
+                stream.destroy();
+                return;
+            }
+            for (const [oldStream, old] of this.backendGenerations) {
+                if (old.principal === principal && old.generation !== backendGeneration) {
+                    this.revokeControls.get(oldStream)?.();
+                    oldStream.destroy();
+                }
+            }
+            this.backendGenerations.set(stream, { principal, generation: backendGeneration });
+            this.launchOwner = { stream, principal, backendGeneration };
+            const id = typeof command.id === "string" ? command.id : undefined;
+            try {
+                switch (command.type) {
+                    case "mcp_presenter_assign": {
+                        const binding = typeof command.sessionId === "string"
+                            ? this.writer.getMcpFormBinding(command.sessionId)
+                            : undefined;
+                        if (!binding || binding.epoch !== command.bindingEpoch || command.purpose !== "mcp_form")
+                            throw new Error("presenter_not_authorized");
+                        // Only a signed native-supervisor decision assigns an opened/adopted session.
+                        // Enrollment and ordinary RPC attachment do not imply assignment.
+                        principal.sessions.add(binding);
+                        send(stream, { type: "mcp_presenter_assigned", id, sessionId: command.sessionId });
+                        return;
+                    }
+                    case "mcp_presenter_acquire": {
+                        if (command.hostInstance !== this.authority.instance ||
+                            typeof command.sessionId !== "string" ||
+                            typeof command.bindingEpoch !== "string" ||
+                            typeof command.connectionNonce !== "string" ||
+                            (command.kind !== "desktop" && command.kind !== "gateway"))
+                            throw new Error("presenter_not_authorized");
+                        const binding = this.writer.getMcpFormBinding(command.sessionId);
+                        const connection = this.writer.findMcpPresenterConnection(command.connectionNonce);
+                        if (!binding ||
+                            !principal.sessions.has(binding) ||
+                            binding.epoch !== command.bindingEpoch ||
+                            !connection)
+                            throw new Error("presenter_not_authorized");
+                        const capabilities = this.writer.getConnectionCapabilities(connection.id);
+                        if (!capabilities?.includes("interactive_user") || !capabilities.includes("mcp_form_presenter_v1"))
+                            throw new Error("presenter_not_authorized");
+                        const context = this.authority.connectionContext(connection, command.sessionId);
+                        if (!context ||
+                            command.purpose !== "mcp_form" ||
+                            command.attachmentId !== context.attachmentId ||
+                            command.attachmentEpoch !== context.attachmentEpoch)
+                            throw new Error("presenter_not_authorized");
+                        const registration = owner.register(binding, connection, { kind: command.kind });
+                        const grant = owner.acquire(registration);
+                        registrations.set(registration.id, registration);
+                        send(stream, { type: "mcp_presenter_acquired", id, registrationId: registration.id, ...grant });
+                        return;
+                    }
+                    case "mcp_presenter_revoke": {
+                        const registration = typeof command.registrationId === "string"
+                            ? registrations.get(command.registrationId)
+                            : undefined;
+                        if (!registration)
+                            throw new Error("presenter_not_authorized");
+                        owner.revoke(registration);
+                        registrations.delete(registration.id);
+                        send(stream, { type: "mcp_presenter_revoked", id });
+                        return;
+                    }
+                    default:
+                        throw new Error("presenter_not_authorized");
+                }
+            }
+            catch {
+                send(stream, { type: "mcp_presenter_error", id, error: "presenter_not_authorized" });
+            }
+        }, false);
+        stream.once("close", stop);
+    }
+}
+function signed(value, transcript, key) {
+    if (!isRecord(value) ||
+        value.type !== "proof" ||
+        typeof value.signature !== "string" ||
+        !/^[a-f0-9]{128}$/.test(value.signature))
+        return false;
+    return verify(null, Buffer.from(transcript), key, Buffer.from(value.signature, "hex"));
+}
+function send(stream, value) {
+    if (!stream.write(`${JSON.stringify(value)}\n`))
+        stream.destroy();
+}
+/** Bound before parsing. Neither malformed bodies nor parser exceptions enter diagnostics. */
+function privateFrames(stream, receive, deadline = true) {
+    const timer = deadline ? setTimeout(() => stream.destroy(), 30_000) : undefined;
+    const detach = attachJsonlLineReader(stream, (line) => {
+        try {
+            receive(JSON.parse(line));
+        }
+        catch {
+            stream.destroy();
+        }
+    }, { maxLineLength: 16 * 1024, onOversizedLine: () => stream.destroy() });
+    stream.on("error", () => stream.destroy());
+    stream.once("close", () => {
+        clearTimeout(timer);
+        detach();
+    });
+    return () => {
+        clearTimeout(timer);
+        detach();
+    };
+}
+//# sourceMappingURL=mcp-presenter-control.js.map

package/dist/modes/rpc/multi-session-host.d.ts

@@ -7,6 +7,9 @@ import { type HostIdleOverrides } from "./host-idle-policy.ts";
 import { type RpcBindingFactory, SessionCommandRouter } from "./session-command-router.ts";
 import { SessionEventWriter } from "./session-event-writer.ts";
 export interface MultiSessionHostOptions {
+    /** Host deployment policy; never derived from client capabilities or project settings. */
+    mcpPresenterEnforcement?: boolean;
+    presenterBootstrapFd?: number;
     agentDir: string;
     createRuntime: CreateAgentSessionRuntimeFactory;
     workerConfiguration?: CliRuntimeConfiguration;

package/dist/modes/rpc/multi-session-host.js

@@ -1,4 +1,6 @@
 import { createServer } from "node:net";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { envValue } from "../../core/brand.js";
 import { HostMcpRegistry } from "../../core/extensions/builtin/mcp/host-registry.js";
@@ -36,6 +38,8 @@ import { formatSocketAddress, listen, resolveSocketPath } from "./host-socket-bi
 import { socketSink } from "./socket-sink.js";
 import { ensureSocketSecret, SOCKET_SECRET_FILE_ENV, socketSecretPath } from "./socket-transport.js";
 import { WorkerSessionRegistry } from "./worker-session-registry.js";
+import { McpPresenterControl } from "./mcp-presenter-control.js";
+import { presenterBootstrapStream } from "./mcp-presenter-bootstrap.js";
 export { DEFAULT_HOST_EMPTY_EXIT_MS, DEFAULT_SESSION_IDLE_EVICTION_MS, RPC_HOST_EMPTY_EXIT_MS_ENV, RPC_SESSION_IDLE_EVICTION_MS_ENV, resolveHostIdlePolicy, } from "./host-idle-policy.js";
 /** Win32 named-pipe close can leave libuv's server callback pending after handles are destroyed. */
 const WINDOWS_SHUTDOWN_HARD_EXIT_MS = 2_000;
@@ -58,6 +62,8 @@ export async function runMultiSessionHost(options) {
         : runSocketHost(options, resolveSocketPath(options.listen, options.agentDir)));
 }
 export function createHostCore(options, writer, capabilities = parseClientCapabilities(envValue("RPC_CLIENT_CAPABILITIES")), idle = {}, hostContext, hooks = {}) {
+    if (options.mcpPresenterEnforcement === true)
+        writer.enableMcpPresenters();
     const policy = resolveHostIdlePolicy(process.env, idle);
     const endpointSocket = publicEndpointSocket(options);
     const pathReservations = createEndpointReservations({
@@ -126,9 +132,11 @@ export function createHostCore(options, writer, capabilities = parseClientCapabi
             parsed = JSON.parse(line);
         }
         catch (cause) {
-            await writer.enqueueControl(parseError(`Failed to parse command: ${errorMessage(cause)}`));
+            await writer.enqueueControl(parseError(writer.mcpPresenters ? "Invalid command" : `Failed to parse command: ${errorMessage(cause)}`));
             return;
         }
+        if (writer.handleMcpForm(parsed))
+            return;
         if (await gate.intercept(parsed, (answer) => writer.enqueueControl(answer)))
             return;
         const shapeError = rpcCommandShapeError(parsed);
@@ -248,6 +256,7 @@ async function runSocketHost(options, socketPath) {
                     runtimeBuildId,
                 }),
                 perform: (request) => performIdleHandover({
+                    presenterBootstrap: presenterControl?.successorBootstrap(),
                     request,
                     socket: hostWatchdogBinding()?.publicSocket ?? socketPath,
                     agentDir: options.agentDir,
@@ -256,6 +265,29 @@ async function runSocketHost(options, socketPath) {
             },
         }),
     });
+    let presenterDir;
+    let presenterControl;
+    if (options.presenterBootstrapFd !== undefined) {
+        const bootstrap = presenterBootstrapStream(options.presenterBootstrapFd);
+        try {
+            if (bootstrap && options.mcpPresenterEnforcement === true) {
+                if (process.platform !== "win32")
+                    presenterDir = await mkdtemp(join(tmpdir(), "senpi-presenter-"));
+                presenterControl = new McpPresenterControl(writer, presenterDir
+                    ? join(presenterDir, "control.sock")
+                    : `\\\\.\\pipe\\senpi-presenter-${writer.mcpPresenters?.instance}`);
+                await presenterControl.listen();
+                presenterControl.bootstrap(bootstrap);
+            }
+            else
+                bootstrap?.destroy();
+        }
+        catch {
+            bootstrap?.destroy();
+            presenterControl?.dispose();
+            presenterControl = undefined;
+        }
+    }
     const observers = startHostObservers(router, writer, {
         trim,
         // The shape #1893 measured: gigabytes resident with `sessions.total 0`. Say it once, and when
@@ -363,6 +395,9 @@ async function runSocketHost(options, socketPath) {
         shuttingDown = true;
         observers.stop();
         handover?.dispose();
+        presenterControl?.dispose();
+        if (presenterDir)
+            await rm(presenterDir, { recursive: true, force: true });
         stopChildReaper();
         // A handover that completed at once drains this host; its caller still gets the answer.
         await handoverAnswered();

package/dist/modes/rpc/session-binding.js

@@ -74,6 +74,7 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
             workerSecurityBridge: writer.workerSecurityBridge,
             grantDialogSettled: (id) => writer.settleGrantDialog(sessionId, id),
             bindSecurityPresentation: (session, ui) => writer.bindSecurityPresentations(sessionId, session.sessionId, session.securityNotices, ui),
+            bindMcpForms: (session, ui) => writer.bindMcpForms(sessionId, session.sessionId, ui, () => session.admitHumanAnswer()),
             clientInfo: options.clientInfo === undefined
                 ? undefined
                 : {
@@ -84,7 +85,11 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
     });
     await handler.ready;
     return {
-        handle: (command) => runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command))),
+        handle: (command) => {
+            if (writer.handleMcpForm(command))
+                return Promise.resolve();
+            return runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command)));
+        },
         cancelPendingExtensionUiRequests: () => runWithProviderScope(entry.scope, () => handler.cancelPendingExtensionUiRequests()),
         pendingPrompts: () => handler.pendingPrompts(),
         connectionDetached: (connectionId) => runWithProviderScope(entry.scope, () => handler.connectionDetached(connectionId)),

package/dist/modes/rpc/session-event-writer.d.ts

@@ -1,4 +1,6 @@
 import type { ExtensionUIContext, SessionKind } from "../../core/extensions/types.ts";
+import { type McpFormBinding } from "../../core/mcp-form-types.ts";
+import { McpPresenterAuthority, type McpPresenterConnection } from "./mcp-presenter-authority.ts";
 import type { SecurityNoticeSnapshot, SecurityNoticeState } from "../../core/security-notices.ts";
 import { type MediaPersister } from "./media-placeholders.ts";
 import type { RpcHostLifecycleEvent, RpcOpenQueuedEvent, RpcSessionClosedEvent, RpcSessionClosedReason, RpcSessionParkedEvent } from "./rpc-types.ts";
@@ -21,6 +23,18 @@ export declare const MAX_SHARED_STDIO_QUEUE_RECORDS = 4096;
  * scheduling boundary and violate D9.
  */
 export declare class SessionEventWriter {
+    private presenterAuthority?;
+    private readonly presenterConnections;
+    private readonly presenterBindings;
+    /** Deployment switch. Ordinary RPC behavior is unchanged unless the host explicitly enables it. */
+    enableMcpPresenters(): McpPresenterAuthority;
+    get mcpPresenters(): McpPresenterAuthority | undefined;
+    getMcpPresenterConnection(id: string): McpPresenterConnection | undefined;
+    findMcpPresenterConnection(nonce: string): McpPresenterConnection | undefined;
+    getMcpFormBinding(sessionId: string): McpFormBinding | undefined;
+    bindMcpForms(sessionId: string, durableId: string, ui: object, admit: () => void): (() => void) | undefined | Promise<(() => void) | undefined>;
+    /** Private records bypass event queues, snapshots, mirrors, replay, and overflow preview errors. */
+    handleMcpForm(value: unknown): boolean;
     private readonly records;
     private readonly queues;
     private readonly fanout;

package/dist/modes/rpc/session-event-writer.js

@@ -1,4 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { bindPrivateMcpForms } from "../../core/mcp-form-types.js";
+import { McpPresenterAuthority } from "./mcp-presenter-authority.js";
 import { MEDIA_PLACEHOLDERS_CAPABILITY } from "./custom-capability.js";
 import { serializeJsonLine } from "./jsonl.js";
 import { omitInlineMedia } from "./media-placeholders.js";
@@ -58,6 +60,79 @@ function toolUpdateKey(value) {
  * scheduling boundary and violate D9.
  */
 export class SessionEventWriter {
+    /** Deployment switch. Ordinary RPC behavior is unchanged unless the host explicitly enables it. */
+    enableMcpPresenters() {
+        this.presenterAuthority ??= new McpPresenterAuthority();
+        return this.presenterAuthority;
+    }
+    get mcpPresenters() {
+        return this.presenterAuthority;
+    }
+    getMcpPresenterConnection(id) {
+        return this.presenterConnections.get(id);
+    }
+    findMcpPresenterConnection(nonce) {
+        return [...this.presenterConnections.values()].find((connection) => connection.nonce === nonce);
+    }
+    getMcpFormBinding(sessionId) {
+        return this.presenterBindings.get(sessionId);
+    }
+    bindMcpForms(sessionId, durableId, ui, admit) {
+        const authority = this.presenterAuthority;
+        if (!authority)
+            return undefined;
+        const binding = authority.bind(sessionId, durableId, admit);
+        this.presenterBindings.set(sessionId, binding);
+        for (const id of this.fanout.attachedConnections(sessionId)) {
+            const connection = this.presenterConnections.get(id);
+            if (connection)
+                authority.attach(connection, binding);
+        }
+        bindPrivateMcpForms(ui, binding);
+        return () => {
+            binding.dispose();
+            if (this.presenterBindings.get(sessionId) === binding)
+                this.presenterBindings.delete(sessionId);
+        };
+    }
+    /** Private records bypass event queues, snapshots, mirrors, replay, and overflow preview errors. */
+    handleMcpForm(value) {
+        if (!this.presenterAuthority)
+            return false;
+        if (typeof value !== "object" ||
+            value === null ||
+            !("type" in value) ||
+            typeof value.type !== "string" ||
+            (!value.type.startsWith("mcp_form_") && value.type !== "mcp_presenter_context"))
+            return false;
+        const id = this.currentConnection();
+        const sender = id === undefined ? undefined : this.presenterConnections.get(id);
+        const context = value.type === "mcp_presenter_context" && "sessionId" in value && typeof value.sessionId === "string" && sender
+            ? this.presenterAuthority?.connectionContext(sender, value.sessionId)
+            : undefined;
+        const reply = value.type === "mcp_presenter_context"
+            ? context
+                ? { ok: true, context }
+                : { error: "presenter_not_authorized" }
+            : sender && this.presenterAuthority
+                ? this.presenterAuthority.receive(sender, value)
+                : { error: "presenter_not_authorized" };
+        const connection = id === undefined ? undefined : this.fanout.get(id)?.connection;
+        if (connection) {
+            try {
+                connection.writeRaw(serializeJsonLine({
+                    type: "mcp_form_reply",
+                    ...("id" in value && typeof value.id === "string" ? { id: value.id } : {}),
+                    ...reply,
+                }));
+            }
+            catch {
+                if (sender)
+                    this.presenterAuthority?.detach(sender);
+            }
+        }
+        return true;
+    }
     get pendingCloseRecordCount() {
         return this.reservedCloseRecords;
     }
@@ -65,6 +140,8 @@ export class SessionEventWriter {
         return this.reservedCloseBytes;
     }
     constructor(writeRaw, waitOrSchedule, scheduleFlush) {
+        this.presenterConnections = new Map();
+        this.presenterBindings = new Map();
         this.records = new SessionRecordAccounting();
         this.queues = new Map();
         this.fanout = new SessionEventFanout();
@@ -99,7 +176,13 @@ export class SessionEventWriter {
         this.closeOverflowActors = new WeakSet();
         this.reservedCloseRecords = 0;
         this.reservedCloseBytes = 0;
-        this.fanout.onConnectionClosed = (id) => this.securityPresentations.dropConnection(id);
+        this.fanout.onConnectionClosed = (id) => {
+            this.securityPresentations.dropConnection(id);
+            const sender = this.presenterConnections.get(id);
+            if (sender)
+                this.presenterAuthority?.detach(sender);
+            this.presenterConnections.delete(id);
+        };
         this.writeRaw = writeRaw;
         if (waitOrSchedule && scheduleFlush === undefined && waitOrSchedule.length > 0) {
             this.scheduleFlush = waitOrSchedule;
@@ -119,9 +202,33 @@ export class SessionEventWriter {
         return this.sealedSessions.has(sessionId);
     }
     registerConnection(id, connection, options = {}) {
+        const previousPresenter = this.presenterConnections.get(id);
+        if (previousPresenter)
+            this.presenterAuthority?.detach(previousPresenter);
         this.fanout.registerConnection(id, connection, options);
+        if (this.presenterAuthority) {
+            const sender = this.presenterAuthority.connect(id, (frame) => {
+                if (!this.fanout.get(id))
+                    return false;
+                try {
+                    connection.writeRaw(serializeJsonLine(frame));
+                    // A pending drain does not undo an accepted write or drop the next resolution.
+                    void connection.waitForBackpressure().catch(() => this.presenterAuthority?.detach(sender));
+                    return true;
+                }
+                catch {
+                    this.presenterAuthority?.detach(sender);
+                    return false;
+                }
+            });
+            this.presenterConnections.set(id, sender);
+        }
     }
     unregisterConnection(id) {
+        const sender = this.presenterConnections.get(id);
+        if (sender)
+            this.presenterAuthority?.detach(sender);
+        this.presenterConnections.delete(id);
         this.securityPresentations.dropConnection(id);
         this.fanout.unregisterConnection(id);
         this.status.dropConnection(id);
@@ -131,8 +238,16 @@ export class SessionEventWriter {
         this.fanout.attachConnectionToSession(id, sessionId);
         if (this.hasConnection(id))
             this.securityPresentations.attach(id, sessionId);
+        const sender = this.presenterConnections.get(id);
+        const binding = this.presenterBindings.get(sessionId);
+        if (sender && binding)
+            this.presenterAuthority?.attach(sender, binding);
     }
     detachConnectionFromSession(id, sessionId) {
+        const sender = this.presenterConnections.get(id);
+        const binding = this.presenterBindings.get(sessionId);
+        if (sender && binding)
+            this.presenterAuthority?.detach(sender, binding);
         this.fanout.detachConnectionFromSession(id, sessionId);
         this.securityPresentations.detach(id, sessionId);
     }
@@ -142,8 +257,16 @@ export class SessionEventWriter {
     setConnectionCapabilities(id, capabilities) {
         this.fanout.setConnectionCapabilities(id, capabilities);
         this.securityPresentations.capabilitiesChanged(id);
+        if (!capabilities.includes("interactive_user") || !capabilities.includes("mcp_form_presenter_v1")) {
+            const sender = this.presenterConnections.get(id);
+            if (sender)
+                this.presenterAuthority?.withdraw(sender);
+        }
     }
     clearConnectionCapabilities(id) {
+        const sender = this.presenterConnections.get(id);
+        if (sender)
+            this.presenterAuthority?.withdraw(sender);
         this.fanout.clearConnectionCapabilities(id);
         this.securityPresentations.capabilitiesChanged(id);
     }
@@ -459,6 +582,8 @@ export class SessionEventWriter {
      * session's final stdout record.
      */
     closeSession(sessionId, response, reason, sessionPath) {
+        this.presenterBindings.get(sessionId)?.dispose();
+        this.presenterBindings.delete(sessionId);
         if (!this.settleBeforeSeal(sessionId))
             return;
         this.sealedSessions.add(sessionId);
@@ -526,6 +651,8 @@ export class SessionEventWriter {
         });
     }
     sealLifecycle(sessionId, lifecycle, attachedOnly = false) {
+        this.presenterBindings.get(sessionId)?.dispose();
+        this.presenterBindings.delete(sessionId);
         if (!this.settleBeforeSeal(sessionId))
             return;
         this.sealedSessions.add(sessionId);

package/dist/modes/rpc/session-router-routing.js

@@ -69,6 +69,7 @@ export async function dispatch(host, command) {
             warm: host.registry.warm !== undefined,
             toolRuntime: host.defaults.toolRuntime ?? "in-process",
             negotiated: host.connectionOptions?.capabilities ?? [],
+            mcpPresenters: host.writer.mcpPresenters !== undefined,
         });
         return {
             id: command.id,