@code-yeongyu/senpi 2026.10.25-1 → 2026.10.25-3

package/dist/modes/rpc/session-worker-client.d.ts

@@ -16,6 +16,9 @@ export interface SessionWorkerCallbacks {
     failure: (error: string) => void;
 }
 export declare class SessionWorkerClient {
+    private privateBinding?;
+    private stopPrivateBinding?;
+    private readonly privateOperations;
     /** The worker's own route to the main-thread Bun.WebView service; released when the worker exits. */
     private readonly webviewBroker;
     readonly worker: Worker;

package/dist/modes/rpc/session-worker-client.js

@@ -8,11 +8,13 @@ import { roleConnection } from "./connection-roles.js";
 import { subscriptionLimits } from "../../core/subscription-limits/limit-store.js";
 import { SessionWorkerRequests } from "./session-worker-requests.js";
 import { acknowledge, acknowledgeGrant } from "./session-worker-signals.js";
+import { randomUUID } from "node:crypto";
 const compiledWorkerEntry = typeof SENPI_RPC_SESSION_WORKER_ENTRY === "string"
     ? SENPI_RPC_SESSION_WORKER_ENTRY
     : "./src/modes/rpc/session-worker.ts";
 export class SessionWorkerClient {
     constructor(callbacks) {
+        this.privateOperations = new Map();
         /** The worker's own route to the main-thread Bun.WebView service; released when the worker exits. */
         this.webviewBroker = createWebViewBroker();
         this.worker = new Worker(isBunBinary
@@ -35,6 +37,11 @@ export class SessionWorkerClient {
         this.callbacks = callbacks;
         this.exited = new Promise((resolve, reject) => {
             this.worker.once("exit", () => {
+                this.stopPrivateBinding?.();
+                this.privateBinding?.dispose();
+                for (const operation of this.privateOperations.values())
+                    operation.operation.abort();
+                this.privateOperations.clear();
                 if (!this.stopped && !this.closeTimer)
                     this.fail("session_worker_exited");
                 this.stopped = true;
@@ -111,9 +118,12 @@ export class SessionWorkerClient {
             capabilities: options.capabilities ?? [],
             connection: writer.currentConnection(),
             roles: options.connectionRoles?.rolesOf(roleConnection(writer.currentConnection())),
+            mcpFormsEnforced: writer.mcpPresenters !== undefined,
         });
         return {
             handle: async (command) => {
+                if (writer.handleMcpForm(command))
+                    return;
                 const connection = writer.currentConnection();
                 if ("type" in command &&
                     command.type === "extension_ui_response" &&
@@ -177,6 +187,85 @@ export class SessionWorkerClient {
             return;
         }
         switch (message.type) {
+            case "mcp_form_bind": {
+                this.stopPrivateBinding?.();
+                this.privateBinding?.dispose();
+                const writer = this.writer;
+                const sessionId = this.sessionId;
+                if (!writer?.mcpPresenters || !sessionId) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                const bound = writer.bindMcpForms(sessionId, message.durableId, {}, () => { });
+                if (bound instanceof Promise) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                this.privateBinding = writer.getMcpFormBinding(sessionId);
+                const binding = this.privateBinding;
+                if (!binding) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                const unsubscribe = binding.subscribe?.(() => this.post({
+                    type: "mcp_form_availability",
+                    epoch: binding.epoch,
+                    version: binding.version?.(),
+                }));
+                this.stopPrivateBinding = () => {
+                    unsubscribe?.();
+                    bound?.();
+                };
+                this.post({ type: "mcp_form_bound", id: message.id, epoch: binding.epoch, version: binding.version?.() });
+                return;
+            }
+            case "mcp_form_ready": {
+                const binding = this.privateBinding;
+                this.post({
+                    type: "mcp_form_availability",
+                    id: message.id,
+                    epoch: message.epoch,
+                    version: binding?.epoch === message.epoch ? binding.version?.() : undefined,
+                });
+                return;
+            }
+            case "mcp_form_release":
+                if (this.privateBinding?.epoch === message.epoch)
+                    this.stopPrivateBinding?.();
+                return;
+            case "mcp_form_cancel": {
+                const operation = this.privateOperations.get(message.id);
+                if (operation?.epoch === message.epoch)
+                    operation[message.lifetime].abort();
+                return;
+            }
+            case "mcp_form_create": {
+                const binding = this.privateBinding;
+                const presenter = binding?.epoch === message.epoch && binding.version?.() === message.version
+                    ? binding.capture()
+                    : undefined;
+                const operation = new AbortController();
+                const presentation = new AbortController();
+                this.privateOperations.set(message.id, { operation, presentation, epoch: message.epoch });
+                const fence = new Int32Array(message.operationFence);
+                const result = presenter?.present({
+                    ...message.input,
+                    operationSignal: operation.signal,
+                    presentationSignal: presentation.signal,
+                    operationCurrent: () => Atomics.load(fence, 0) === 0,
+                });
+                void Promise.resolve(result).then((outcome) => {
+                    this.privateOperations.delete(message.id);
+                    this.post({
+                        type: "mcp_form_settlement",
+                        id: message.id,
+                        epoch: message.epoch,
+                        settlementId: randomUUID(),
+                        outcome: outcome ?? { kind: "processing_failure", source: "host_termination", humanAdmission: false },
+                    });
+                });
+                return;
+            }
             case "prepared":
             case "ready":
             case "result": {

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -1,4 +1,5 @@
 import type { BrowserEngine } from "../../core/browser-engine.ts";
+import type { McpFormInput, McpFormOutcome } from "../../core/mcp-form-types.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { MirroredLimits } from "../../core/subscription-limits/limit-store.ts";
 import type { CliRuntimeConfiguration } from "../../main.ts";
@@ -52,6 +53,23 @@ export type HostToSessionWorker = {
     connection?: string;
     /** Roles the connection explicitly declared on the host (senpi#3811); the isolate adopts them. */
     roles?: readonly string[];
+    mcpFormsEnforced?: boolean;
+} | {
+    type: "mcp_form_bound";
+    id: string;
+    epoch: string;
+    version?: string;
+} | {
+    type: "mcp_form_availability";
+    epoch: string;
+    version?: string;
+    id?: string;
+} | {
+    type: "mcp_form_settlement";
+    id: string;
+    epoch: string;
+    settlementId: string;
+    outcome: McpFormOutcome;
 } | {
     type: "command";
     request: number;
@@ -84,6 +102,29 @@ export type HostToSessionWorker = {
     type: "close";
 };
 export type SessionWorkerToHost = {
+    type: "mcp_form_bind";
+    id: string;
+    durableId: string;
+} | {
+    type: "mcp_form_ready";
+    id: string;
+    epoch: string;
+} | {
+    type: "mcp_form_release";
+    epoch: string;
+} | {
+    type: "mcp_form_cancel";
+    id: string;
+    epoch: string;
+    lifetime: "operation" | "presentation";
+} | {
+    type: "mcp_form_create";
+    id: string;
+    epoch: string;
+    version: string;
+    operationFence: SharedArrayBuffer;
+    input: Omit<McpFormInput, "operationSignal" | "operationCurrent" | "presentationSignal">;
+} | {
     type: "prepared";
     request: number;
     sessionPath: string;

package/dist/modes/rpc/session-worker.js

@@ -23,6 +23,7 @@ import { resolveMovedProfile } from "./session-registry-moved-path.js";
 import { createWorkerCredit } from "./session-worker-credit.js";
 import { SESSION_WORKER_LIMITS, } from "./session-worker-protocol.js";
 import { createSessionWorkerRegistry } from "./session-worker-registry.js";
+import { McpFormWorker } from "./mcp-form-worker.js";
 if (isBunBinary) {
     const { registerBunRuntimeModules } = await import("../../bun/runtime-modules.js");
     registerBunRuntimeModules();
@@ -33,6 +34,8 @@ const port = parentPort;
 if (!port)
     throw new Error("Session worker requires a parent port");
 const send = (message) => port.postMessage(message);
+const privateForms = new McpFormWorker(send);
+let privateFormsEnforced = false;
 function failWorker(error) {
     send({ type: "failure", error });
     process.exit(1);
@@ -41,6 +44,9 @@ const { exchange, installWriteReservation } = createWorkerCredit(send, failWorke
 // The host's key for the same file, so a deleted directory neither throws here nor misses (senpi#2285).
 installWriteReservation(canonicalSessionPath);
 class WorkerEventWriter extends SessionEventWriter {
+    bindMcpForms(_sessionId, durableId, ui, admit) {
+        return privateFormsEnforced ? privateForms.bind(durableId, ui, admit) : undefined;
+    }
     constructor() {
         super(() => { });
         this.workerSecurityBridge = true;
@@ -174,6 +180,7 @@ async function handle(message) {
             if (message.roles !== undefined)
                 connectionRoles.adopt(roleConnection(message.connection), message.roles);
             const bindingEntry = entry;
+            privateFormsEnforced = message.mcpFormsEnforced === true;
             const createBinding = () => createRpcSessionBinding(message.sessionId, bindingEntry, writer, () => send({ type: "request_close" }), {
                 capabilities: message.capabilities,
                 connectionRoles,
@@ -262,6 +269,8 @@ async function handle(message) {
 // A turn in this isolate reports into its own store; the host mirrors it so its clients see it (senpi#3695).
 subscriptionLimits.subscribeMirror((limits) => send({ type: "subscription_limits", limits }));
 port.on("message", (message) => {
+    if (privateForms.receive(message))
+        return;
     void handle(message).catch((cause) => {
         const error = cause instanceof Error ? cause.message : String(cause);
         if (error.startsWith("session_worker_")) {

package/dist/modes/rpc/tool-child/group-ownership.js

@@ -7,7 +7,7 @@
  * own group. A `detached` entry is never swept; the command explicitly opted out of the child's lifetime.
  */
 import { execFile } from "node:child_process";
-import { processIsLive, processStartTimeMs, readProcessStartTime, sameProcessStartMs, } from "../../../utils/process-identity.js";
+import { processIsRunning, processStartTimeMs, readProcessStartTime, sameProcessStartMs, } from "../../../utils/process-identity.js";
 export async function classifyGroup(group, ownGroup, probes) {
     if (group.lifetime === "detached")
         return "detached";
@@ -70,7 +70,9 @@ function groupHasMembers(pgid) {
 }
 export const defaultGroupProbes = {
     groupHasMembers,
-    isAlive: processIsLive,
+    // An exited, unreaped leader (state Z) has no start identity left to compare, so it must read as exited:
+    // its orphaned members keep the group, and the group is swept (senpi#3020, senpi#4119).
+    isAlive: processIsRunning,
     startOf: (pid) => readProcessStartTime(pid),
     ownGroup: () => processGroupOf(process.pid),
     signalGroup: (pgid, signal) => {

package/dist/utils/process-identity.d.ts

@@ -48,6 +48,13 @@ timeZone?: "UTC"): Promise<ProcessIdentityResult>;
 export declare function stopValidatedPid(pidFile: DaemonPidFile, signal: NodeJS.Signals): Promise<void>;
 export declare function waitForGone(pidFile: DaemonPidFile, timeoutMs: number): Promise<boolean>;
 export declare function readProcessStartTime(pid: number, platform?: NodeJS.Platform, timeoutMs?: number): Promise<string | undefined>;
+/**
+ * `processIsLive` minus processes that have exited but are not reaped yet (state Z): a SIGKILLed host
+ * stays a zombie until its parent's loop, or init, waits on it, and `kill(pid, 0)` still succeeds for it
+ * (senpi#4119). One `ps` snapshot decides; a probe that fails any other way reads as running, so a
+ * starved probe on a live process is never taken for a dead one (#1609).
+ */
+export declare function processIsRunning(pid: number): boolean;
 export declare function processIsLive(pid: number): boolean;
 /**
  * Wait for a spawned pid's process identity.

package/dist/utils/process-identity.js

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 const WINDOWS_FILETIME_EPOCH = 116444736000000000n;
 export const PROCESS_START_TOLERANCE_MS = 3_000;
 /** FILETIME and C/localized lstart/ISO identities share one millisecond representation. */
@@ -80,7 +80,7 @@ export class ProcessIdentityUnreadableError extends Error {
  * probe is retried within a bounded budget and only then surfaces as
  * ProcessIdentityUnreadableError. It never leaks the raw probe error as a verdict.
  */
-export async function processMatchesPidFile(pidFile, readStartTime = readProcessStartTime, isLive = processIsLive, retry = {}) {
+export async function processMatchesPidFile(pidFile, readStartTime = readProcessStartTime, isLive = processIsRunning, retry = {}) {
     // A record without an identity guard answers only the liveness half of the question: a pid
     // that is gone is gone, and a live one stays unknown so it is never claimed or signalled.
     if (pidFile.processStartTime === null) {
@@ -129,7 +129,9 @@ timeZone) {
                 `$process = Get-CimInstance Win32_Process -Filter "ProcessId=${String(pid)}" -ErrorAction Stop; if ($null -eq $process) { Write-Output '__SENPI_ABSENT__'; exit 0 }; $process.CreationDate.ToFileTimeUtc().ToString("D", [Globalization.CultureInfo]::InvariantCulture)`,
             ],
         }
-        : { executable: "ps", args: ["-o", "lstart=", "-p", String(pid)] };
+        : // State and start time from ONE snapshot: an exited, unreaped process (state Z) keeps its start
+            // time but runs nothing, so it has no identity to match (senpi#4119).
+            { executable: "ps", args: ["-o", "stat=,lstart=", "-p", String(pid)] };
     return new Promise((resolve) => {
         const effectiveTimeoutMs = timeoutMs ?? (platform === "win32" ? 1_000 : undefined);
         execFile(command.executable, command.args, {
@@ -151,9 +153,13 @@ timeZone) {
                 resolve({ kind: "error", error });
                 return;
             }
-            const output = stdout.trim();
-            if (output === "__SENPI_ABSENT__")
+            const snapshot = stdout.trim();
+            if (snapshot === "__SENPI_ABSENT__")
                 return resolve({ kind: "absent" });
+            const state = platform === "win32" ? "" : (snapshot.split(/\s+/, 1)[0] ?? "");
+            if (state.startsWith("Z"))
+                return resolve({ kind: "absent" });
+            const output = platform === "win32" ? snapshot : snapshot.slice(state.length).trim();
             if (!output || (platform === "win32" && !/^\d+$/.test(output)))
                 return resolve({ kind: "error", error: new Error("invalid process identity output") });
             resolve({ kind: "present", identity: timeZone && platform !== "win32" ? `${output} UTC` : output });
@@ -191,6 +197,27 @@ export async function readProcessStartTime(pid, platform = process.platform, tim
         return result.kind === "present" ? result.identity : undefined;
     });
 }
+/**
+ * `processIsLive` minus processes that have exited but are not reaped yet (state Z): a SIGKILLed host
+ * stays a zombie until its parent's loop, or init, waits on it, and `kill(pid, 0)` still succeeds for it
+ * (senpi#4119). One `ps` snapshot decides; a probe that fails any other way reads as running, so a
+ * starved probe on a live process is never taken for a dead one (#1609).
+ */
+export function processIsRunning(pid) {
+    if (!processIsLive(pid))
+        return false;
+    if (process.platform === "win32")
+        return true;
+    try {
+        const state = execFileSync("ps", ["-o", "stat=", "-p", String(pid)], { encoding: "utf8", timeout: 2_000 });
+        return !state.trim().startsWith("Z");
+    }
+    catch (error) {
+        if (error instanceof Error && "status" in error && error.status === 1)
+            return false;
+        return true;
+    }
+}
 export function processIsLive(pid) {
     try {
         process.kill(pid, 0);

package/docs/extensions.md

@@ -3507,6 +3507,11 @@ if (confirmed) {
 
 #### Manual Dismissal with AbortSignal
 
+Local terminal `select`, `confirm`, and `input` dialogs also accept
+`ephemeral: true`. Their visible contents remain local; they emit no generic
+blocked events, replacement labels, identifiers, or pending markers. This option is
+not an RPC field or permission to present MCP input on another session.
+
 For more control (e.g., to distinguish timeout from user cancel), use `AbortSignal`:
 
 ```typescript

package/docs/mcp.md

@@ -393,9 +393,26 @@ above.
   notice.
 - Every server prompt registers as `/mcp:<server>:<prompt>`; invoking it
   collects the prompt's arguments and drops the rendered text into the editor.
-- Servers may ask questions mid-call (elicitation, form mode): senpi walks the
-  requested fields through input dialogs; in non-interactive runs the request
-  is declined cleanly.
+- Legacy servers may ask form questions mid-call through the existing terminal
+  or RPC dialog channel.
+- On MCP 2026-07-28 connections, `tools/call`, `resources/read`, and `prompts/get`
+  can return `input_required`. Senpi collects form input privately in the
+  originating terminal session, lets you review and edit it, and continues the
+  operation with a new request ID. Only the final result reaches the model or editor.
+  Continue does not submit a form: even empty forms require Submit. Decline is
+  an explicit human refusal; dismissal of a presented form is Cancel.
+- RPC, print, and other runs without an originating terminal presenter do not
+  advertise modern elicitation. An unsolicited input request terminates the
+  operation locally without fabricating an answer or retrying incomplete input.
+  State-only continuations need no human and remain supported.
+- Each operation allows eight input rounds and five minutes of total consent
+  time, including queueing. The overall deadline also includes network time
+  and cannot be extended by progress. Caller cancellation, session closure,
+  or observed authorization invalidation dismisses pending input without a retry.
+  Authorization uses the same observed-revocation boundary as ordinary MCP
+  requests. Unsupported client features terminate locally.
+- Continuation state and drafts are not persisted or resumed after restart.
+  MRTR does not enable the Tasks extension.
 
 ## Auth
 

package/docs/rpc.md

@@ -159,6 +159,17 @@ The shared `SessionLifecycle` type is exported by `@code-yeongyu/senpi`:
   with reason `provider_error`, `tool_error`, `task_error`, `lost`, or `interrupted`.
 - A standing agent self-settle intent adds `settleDecision: { decisionId }` to the
   persisted `done` seal, independently of the completion label.
+- Optional `lastStop: { cause, runId, at, epoch, deadline?, guard?, todo?, abortSource?, persisted? }`
+  says why the run `runId` stopped. `cause` is `deadline`, `goal_guard`, `todo_guard`, `aborted`,
+  or `no_wake`; `deadline` is `inactivity` or `max_runtime`, `guard` is the goal guard reason as
+  recorded, `todo` is `cap`, and `abortSource` is `user`, `system`, or `provider`. `persisted: false`
+  appears only when the deadline-stop entry could not be written and is independent of the
+  snapshot's `persisted`. `lastStop` describes the last run's historical stop, so a `no_wake`
+  stop remains even if a wake source later appears. It is cleared when the next run starts
+  and never names a later run. A fact refresh with no bound turn end never sets `lastStop`;
+  between runs, a refresh while the last end is still bound may set or update that run's stop.
+  Goal guards are captured during their bound end's own processing, never inherited from
+  another run. Provider errors and policy rejections carry no `lastStop`, even if a deadline fired.
 
 Clients must not notify or settle while `restoring` is true or `persisted` is false.
 Use `completionId` to deduplicate root completion/failure, not `agent_settled` or
@@ -5425,6 +5436,106 @@ A provider holds logins of one kind. If it had an OAuth login, the key replaces
 
 ## Extension UI Protocol
 
+Without presenter enforcement, MCP 2026-07-28 multi-round-trip form answering is terminal-only in v1.
+RPC-originated modern requests advertise no elicitation and terminate locally
+if input is required; they never fabricate a decline or retry incomplete input.
+Client roles and capability declarations do not enable this form channel.
+Existing legacy MCP dialogs and their RPC request/response shapes remain unchanged.
+
+### Opt-in private MCP forms
+
+A multi-session RPC host or interactive terminal can opt in with `--mcp-presenter-enforcement`. This is a
+deployment option, not a project setting. It defaults to off; existing desktop and
+gateway clients keep their current behavior until they implement the private
+presenter protocol. Without this option, terminal forms retain their existing queue,
+legacy origin rules, and legacy stderr diagnostics. Enforced terminal forms also
+queue, and a collector failure ends only its own form, not the terminal's grant.
+All UI contexts in one terminal session binding share its presenter authority.
+Without enforcement, each real select/input answer retains its existing human
+admission timing; the form collector does not add a second final admission.
+Ephemeral selects also keep the scheduled `requestRender()` path without enforcement.
+With enforcement, only the authority's winning whole-form action admits once.
+The host advertises `mcp_form_presenter_v1` only when enforcement is enabled;
+the capability reports protocol support, not authority to present or answer a form.
+
+The native launch owner enrolls an Ed25519 public key through an inherited private
+bootstrap channel. Descriptor 4 is reserved for this channel; descriptor 3 remains
+the separate owner-lifetime channel. Enrollment and management proofs sign the
+host's exact returned transcript. No secret is passed in an argument, environment
+variable, launch specification, or session state. Reusing a host does not enroll the
+caller, and a successor requires fresh enrollment and fresh grants.
+An invalid or lost bootstrap channel leaves the host without a presenter; it does
+not terminate the shared daemon or its lifetime channel. The helper remains lazy
+to preserve the supervisor's startup import budget, with import and relay failures
+contained at that boundary. Conditional idle handover
+is owned by the running host after the CLI returns: that host relays the successor's
+fresh challenge over the existing authenticated launch-owner channel. The CLI's
+bootstrap stream is never serialized into `begin_handover`.
+
+`mcp_presenter_context` returns the caller's current connection nonce and attachment
+context. These identifiers confer no authority. Acquisition and revocation use the
+separate authenticated management endpoint, with a fresh challenge for each
+`mcp_presenter_assign`, `mcp_presenter_acquire`, or `mcp_presenter_revoke` command.
+Enrollment alone assigns no sessions. Before acquisition, the trusted native
+supervisor signs `mcp_presenter_assign` with `sessionId`, the current `bindingEpoch`,
+and `purpose: "mcp_form"` for a session it opened, or one the user explicitly adopted
+through the trusted host-owner UI. Ordinary RPC attachment cannot assign a session.
+Assignment belongs only to that enrolled principal and live binding; re-enrollment
+or binding replacement requires a new assignment. It is not persisted.
+An acquisition also requires the connection's `interactive_user` and
+`mcp_form_presenter_v1` capabilities, and binds the
+current host, session, binding epoch, connection nonce, attachment ID and epoch, and
+`purpose: "mcp_form"`. Only one holder is active for a session binding.
+Concurrent forms, including worker-origin forms, wait in the host's abort-aware
+FIFO for that holder. Waiting consumes the original deadline; timeout, cancellation,
+or revocation before display never fabricates a human response.
+Enforced legacy connections observe presenter readiness and reconnect when their
+negotiated form capability becomes stale, including a grant issued after connect.
+Revoking the last ready holder removes the capability on the new connection.
+A shared physical connection advertises forms when at least one attached owner is
+ready; each request still requires its own origin's grant. An ungranted owner cannot
+borrow another owner's presenter. Readiness changes during initialization are
+rechecked before the connection is published. Modern MRTR connections do not
+reconnect for this purpose because their capability metadata is per request.
+
+Legacy elicitation has no reliable parent tool-call identifier in the received SDK
+handler metadata. With multiple `tools/call` operations in flight on one physical
+legacy client, enforced elicitation fails closed with JSON-RPC `-32603` and
+`data.reason: "ambiguous_legacy_origin"`. The error explains that concurrent legacy
+calls make the origin ambiguous and recommends sequential calls or an MRTR server.
+No form is displayed and no human answer is admitted. Without enforcement, legacy
+clients keep the SDK request method, origin handling, and concurrent-call behavior.
+
+Worker binding waits at most five seconds for the host's acknowledgement; expiry
+fails with `private_form_unavailable`, removes the pending waiter, and releases any
+late host binding. Worker readiness events feed the same legacy renegotiation path.
+Under enforcement, server stderr remains available as redacted diagnostic records
+with allowlisted system error codes. Arbitrary text is omitted because a server can
+echo private messages, schema labels, or answers; ordinary legacy stderr is unchanged.
+
+The granted connection receives `mcp_form_request` privately. Its envelope contains
+`sessionId`, `bindingEpoch`, `attachmentEpoch`, `grantId`, `dialogId`, `dialogToken`,
+and `formRevision`; the request also carries `server` (`label` and `source`),
+`message`, `schema`, and `deadlineAtMs`. The presenter returns that exact envelope
+with `mcp_form_presented` only after rendering, then `mcp_form_response` with
+`action: "accept" | "decline" | "cancel"` and accepted `content` when applicable.
+`mcp_form_sync` uses the current session, binding epoch, attachment epoch, and grant
+to recover the holder's still-live form. It is not a public replay API.
+
+Unknown and stolen-dialog submissions from a non-holder both return
+`presenter_not_authorized` before private dialog lookup. The host validates a whole
+form before admitting a human answer, and a synchronous terminal latch accepts only
+one outcome. `mcp_form_resolved` carries the session, grant, dialog, and a reason:
+`answered`, `declined`, `cancelled`, `processing_failed`, or `operation_aborted`.
+
+No presenter, or loss before actual presentation, is a processing failure. Only
+explicit human refusal produces decline. Dismissal after presentation is cancel;
+host timeout or presentation loss after presentation also cancels, without human
+admission. Operation abort terminates the operation. Private records, schemas,
+tokens, drafts, and answers never enter general extension UI events, session
+snapshots, replay, or ordinary output queues. Native desktop registration, WSL
+relay, and a gateway form page require separate client implementation.
+
 Extensions can request user interaction via `ctx.ui.select()`, `ctx.ui.confirm()`, etc. In RPC mode, these are translated into a request/response sub-protocol on top of the base command/event flow.
 
 There are two categories of extension UI methods:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.25-1",
+	"version": "2026.10.25-3",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -71,9 +71,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.25-1",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.25-1",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.25-1",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.25-3",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.25-3",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.25-3",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -92,8 +92,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.306",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.25-1",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.25-1",
+		"@code-yeongyu/senpi-codemode": "2026.10.25-3",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.25-3",
 		"@modelcontextprotocol/sdk": "1.32.1",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",