@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-3

package/dist/modes/interactive/interactive-mode.js

@@ -35,6 +35,9 @@ import { configureHttpDispatcher, formatHttpIdleTimeoutMs } from "../../core/htt
 import { KeybindingsManager } from "../../core/keybindings.js";
 import { isManualContinueSubmission } from "../../core/manual-continue.js";
 import { attachMcpGrantPresentation } from "../../core/mcp-grant-presentations.js";
+import { registerMcpMrtrPresentation } from "../../core/mcp-mrtr-presentations.js";
+import { markMcpFormPresented } from "../../core/mcp-form-types.js";
+import { registerLocalMcpPresenter } from "./mcp-local-presenter.js";
 import { createCompactionSummaryMessage, createCustomMessage } from "../../core/messages.js";
 import { defaultModelPerProvider, findExactModelReferenceMatch, resolveModelScope, resolveModelScopeFromModels, resolveModelScopeWithDiagnostics, } from "../../core/model-resolver.js";
 import { CredentialSynchronizationError } from "../../core/model-runtime.js";
@@ -688,6 +691,7 @@ export class InteractiveMode {
         this.onRightClickPaste = () => {
             void this.handleRightClickPaste();
         };
+        this.mcpMrtrPresentationLifetime = new AbortController();
         /**
          * Gracefully shutdown the agent.
          * Stops the TUI before emitting shutdown events so extension UI cleanup cannot
@@ -2010,6 +2014,9 @@ export class InteractiveMode {
         }
     }
     async bindCurrentSessionExtensions() {
+        this.mcpMrtrPresentationLifetime?.abort();
+        this.mcpMrtrPresentationLifetime = new AbortController();
+        this.mcpLocalPresenter = undefined;
         await this.sessionControlHost?.disposeActive();
         this.session.setControlEndpointHost?.(this.sessionControlHost);
         const uiContext = this.createExtensionUIContext();
@@ -2318,7 +2325,12 @@ export class InteractiveMode {
             return false;
         };
     }
-    async withBlockedHostDialog(id, label, show) {
+    async withBlockedHostDialog(id, label, show, opts) {
+        if (opts?.ephemeral) {
+            if (opts.signal?.aborted)
+                return undefined;
+            return await show();
+        }
         this.session.emitExtensionEvent("herdr:blocked", { active: true, label, id });
         try {
             return await show();
@@ -2846,10 +2858,11 @@ export class InteractiveMode {
         };
     }
     createExtensionUIContext() {
-        return {
-            select: (title, options, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionSelector(title, options, opts)),
-            confirm: (title, message, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionConfirm(title, message, opts)),
-            input: (title, placeholder, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionInput(title, placeholder, opts)),
+        this.mcpMrtrPresentationLifetime ??= new AbortController();
+        const context = {
+            select: (title, options, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionSelector(title, options, opts), opts),
+            confirm: async (title, message, opts) => (await this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionConfirm(title, message, opts), opts)) ?? false,
+            input: (title, placeholder, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionInput(title, placeholder, opts), opts),
             // Async answers are delivered by the ask-user extension, not here: the
             // widget only resolves the question, so the model sees exactly one
             // framed user message no matter which surface answered.
@@ -2906,6 +2919,11 @@ export class InteractiveMode {
             getToolsExpanded: () => this.toolOutputExpanded,
             setToolsExpanded: (expanded) => this.setToolsExpanded(expanded),
         };
+        const presenterSession = this.session;
+        const privateForms = this.options?.mcpPresenterEnforcement === true
+            ? (this.mcpLocalPresenter ??= registerLocalMcpPresenter(context, presenterSession.sessionId, this.mcpMrtrPresentationLifetime.signal, () => presenterSession.admitHumanAnswer()))
+            : undefined;
+        return registerMcpMrtrPresentation(context, this.mcpMrtrPresentationLifetime.signal, undefined, privateForms);
     }
     /**
      * Show a selector for extensions.
@@ -2922,7 +2940,8 @@ export class InteractiveMode {
             };
             opts?.signal?.addEventListener("abort", onAbort, { once: true });
             this.extensionSelector = new ExtensionSelectorComponent(title, options, (option) => {
-                this.session.admitHumanAnswer();
+                if (!opts?.ephemeral || !this.options?.mcpPresenterEnforcement)
+                    this.session.admitHumanAnswer();
                 opts?.signal?.removeEventListener("abort", onAbort);
                 this.hideExtensionSelector();
                 resolve(option);
@@ -2939,7 +2958,12 @@ export class InteractiveMode {
             this.editorContainer.clear();
             this.editorContainer.addChild(this.extensionSelector);
             this.ui.setFocus(this.extensionSelector);
-            this.ui.requestRender();
+            if (opts?.ephemeral && this.options?.mcpPresenterEnforcement) {
+                this.ui.renderNow();
+                markMcpFormPresented(opts);
+            }
+            else
+                this.ui.requestRender();
         });
     }
     /**
@@ -2979,7 +3003,8 @@ export class InteractiveMode {
             };
             opts?.signal?.addEventListener("abort", onAbort, { once: true });
             this.extensionInput = new ExtensionInputComponent(title, placeholder, (value) => {
-                this.session.admitHumanAnswer();
+                if (!opts?.ephemeral || !this.options?.mcpPresenterEnforcement)
+                    this.session.admitHumanAnswer();
                 opts?.signal?.removeEventListener("abort", onAbort);
                 this.hideExtensionInput();
                 resolve(value);
@@ -5505,6 +5530,7 @@ export class InteractiveMode {
         if (this.isShuttingDown)
             return;
         this.isShuttingDown = true;
+        this.mcpMrtrPresentationLifetime?.abort();
         // Keep signal handlers registered until terminal cleanup has completed.
         // `signal-exit` checks the listener list during the same SIGTERM/SIGHUP
         // dispatch and re-sends the signal if only its own listeners remain.

package/dist/modes/interactive/mcp-local-presenter.d.ts

@@ -0,0 +1,5 @@
+import type { ExtensionUIContext } from "../../core/extensions/types.ts";
+import type { McpFormBinding } from "../../core/mcp-form-types.ts";
+/** The terminal itself is the principal; an RPC attachment never receives this handle. */
+export declare function registerLocalMcpPresenter(ui: ExtensionUIContext, sessionId: string, lifetime: AbortSignal, admit: () => void): McpFormBinding;
+//# sourceMappingURL=mcp-local-presenter.d.ts.map

package/dist/modes/interactive/mcp-local-presenter.js

@@ -0,0 +1,109 @@
+import { collectMrtrForm } from "../../core/extensions/builtin/mcp/modern/elicitation.js";
+import { queuedForm } from "../../core/extensions/builtin/mcp/modern/consent-queue.js";
+import { McpPresenterAuthority } from "../rpc/mcp-presenter-authority.js";
+/** The terminal itself is the principal; an RPC attachment never receives this handle. */
+export function registerLocalMcpPresenter(ui, sessionId, lifetime, admit) {
+    const authority = new McpPresenterAuthority();
+    const binding = authority.bind(sessionId, sessionId, admit);
+    let activeInput;
+    const drafts = new Map();
+    const sender = authority.connect("local_tui", (frame) => {
+        if (frame.type !== "mcp_form_request") {
+            drafts.get(frame.dialogId)?.abort();
+            drafts.delete(frame.dialogId);
+            return true;
+        }
+        const active = activeInput;
+        if (!active)
+            return false;
+        const { input } = active;
+        const draft = new AbortController();
+        drafts.set(frame.dialogId, draft);
+        const signal = AbortSignal.any([input.operationSignal, input.presentationSignal, lifetime, draft.signal]);
+        const { sessionId, bindingEpoch, attachmentEpoch, grantId, dialogId, dialogToken, formRevision } = frame;
+        const envelope = { sessionId, bindingEpoch, attachmentEpoch, grantId, dialogId, dialogToken, formRevision };
+        void collectMrtrForm({
+            ui,
+            signal,
+            presented: () => authority.receive(sender, { ...envelope, type: "mcp_form_presented" }),
+        }, `${frame.server.label} (${frame.server.source})`, { message: frame.message, requestedSchema: frame.schema }, signal)
+            .then((result) => {
+            if (!signal.aborted)
+                authority.receive(sender, { ...envelope, type: "mcp_form_response", ...result });
+        }, () => active.fail())
+            .finally(() => drafts.delete(frame.dialogId));
+        return true;
+    });
+    authority.attach(sender, binding);
+    const owner = authority.enroll();
+    owner.acquire(owner.register(binding, sender, { kind: "local_tui" }));
+    const dispose = () => {
+        authority.dispose();
+        for (const draft of drafts.values())
+            draft.abort();
+        drafts.clear();
+    };
+    lifetime.addEventListener("abort", dispose, { once: true });
+    const privateForms = {
+        epoch: binding.epoch,
+        signal: binding.signal,
+        capture: () => {
+            const presentation = binding.capture();
+            if (!presentation)
+                return undefined;
+            return {
+                ...presentation,
+                present: async (input) => {
+                    const deadline = performance.now() + input.deadlineMs;
+                    const timeout = new AbortController();
+                    const timer = setTimeout(() => timeout.abort(), Math.max(0, input.deadlineMs));
+                    const signal = AbortSignal.any([
+                        input.operationSignal,
+                        input.presentationSignal,
+                        presentation.signal,
+                        lifetime,
+                        timeout.signal,
+                    ]);
+                    try {
+                        return await queuedForm(binding, signal, async () => {
+                            const failure = new AbortController();
+                            const current = {
+                                input: {
+                                    ...input,
+                                    presentationSignal: AbortSignal.any([signal, failure.signal]),
+                                    deadlineMs: Math.max(0, deadline - performance.now()),
+                                },
+                                fail: () => failure.abort(),
+                            };
+                            activeInput = current;
+                            try {
+                                return await presentation.present(current.input);
+                            }
+                            finally {
+                                if (activeInput === current)
+                                    activeInput = undefined;
+                            }
+                        });
+                    }
+                    catch {
+                        return {
+                            kind: input.operationSignal.aborted || binding.signal.aborted || input.operationCurrent?.() === false
+                                ? "operation_aborted"
+                                : "processing_failure",
+                            source: "host_termination",
+                            humanAdmission: false,
+                        };
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                },
+            };
+        },
+        dispose,
+    };
+    if (lifetime.aborted)
+        dispose();
+    return privateForms;
+}
+//# sourceMappingURL=mcp-local-presenter.js.map

package/dist/modes/rpc/connection-handler.d.ts

@@ -34,6 +34,7 @@ export interface RpcConnectionOptions {
         hasCapability?: (connectionId: string, capability: string) => boolean;
     };
     bindSecurityPresentation?: (session: AgentSessionRuntime["session"], ui: ExtensionUIContext) => (() => void) | undefined;
+    bindMcpForms?: (session: AgentSessionRuntime["session"], ui: ExtensionUIContext) => (() => void) | undefined | Promise<(() => void) | undefined>;
     /** A worker's internal bridge is gated by its host's actual socket capabilities. */
     workerSecurityBridge?: boolean;
     grantDialogSettled?: (id: string) => void;

package/dist/modes/rpc/connection-handler.js

@@ -599,6 +599,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         subscribeExtensionEvents();
     };
     const rebindSession = async (deferRefresh = false) => {
+        unbindMcpForms?.();
+        unbindMcpForms = undefined;
         unsubscribeSecurityNotices?.();
         unsubscribeLoadedSurfaces?.();
         unsubscribeExtensionEvents?.();
@@ -673,8 +675,10 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         // reconstruct the session it is bound to. Installing here also drops the
         // previous session's subscription immediately instead of after the bind.
         installSessionSubscriptions();
+        const extensionUi = createExtensionUIContext();
+        unbindMcpForms = await options.bindMcpForms?.(session, extensionUi);
         const refresh = refreshLoadedSurfacesAfter(() => session.bindExtensions({
-            uiContext: createExtensionUIContext(),
+            uiContext: extensionUi,
             mode: "rpc",
             commandContextActions: {
                 waitForIdle: () => session.agent.waitForIdle(),
@@ -1752,6 +1756,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         ? subscriptionLimits.subscribe((limits) => eventOutput.enqueueEvent({ type: "subscription_limits", ...limits }))
         : () => { };
     const dispose = async (disposeOptions = {}) => {
+        unbindMcpForms?.();
         grantPresentationAbort.abort();
         detachGrantPresentation?.();
         unsubscribeSecurityNotices?.();
@@ -1777,6 +1782,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     };
     // Perform the initial bind synchronously-scheduled so the handler is ready
     // as soon as the caller awaits `ready`.
+    let unbindMcpForms;
     const ready = rebindSession();
     return {
         ready,

package/dist/modes/rpc/host-capabilities.d.ts

@@ -14,5 +14,6 @@ export declare function multiSessionHostCapabilities(options: {
     readonly warm: boolean;
     readonly toolRuntime: ToolRuntimeKind;
     readonly negotiated: readonly string[];
+    readonly mcpPresenters?: boolean;
 }): string[];
 //# sourceMappingURL=host-capabilities.d.ts.map

package/dist/modes/rpc/host-capabilities.js

@@ -20,6 +20,7 @@ export function multiSessionHostCapabilities(options) {
     return [
         ...new Set([
             "multi_session",
+            ...(options.mcpPresenters ? ["mcp_form_presenter_v1"] : []),
             "session_lifecycle",
             "expected_host_instance",
             "attach_session",
@@ -80,7 +81,7 @@ export function multiSessionHostCapabilities(options) {
             ...(options.warm ? [WARM_CAPABILITY] : []),
             ...toolRuntimeCapabilities(options.toolRuntime),
             // The host alone says where tool work runs; a negotiated copy would make two answers.
-            ...options.negotiated.filter((capability) => !isHostOwnedToolRuntimeCapability(capability)),
+            ...options.negotiated.filter((capability) => capability !== "mcp_form_presenter_v1" && !isHostOwnedToolRuntimeCapability(capability)),
         ]),
     ];
 }

package/dist/modes/rpc/host-ensure-start.js

@@ -17,6 +17,7 @@ import { pollProtocolInfo } from "./host-readiness.js";
 import { initialHostEnvironment } from "./host-spawn-environment.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
 import { createSocketSecret, socketSecretPath } from "./socket-transport.js";
+import { relayPresenterBootstrap } from "./mcp-presenter-bootstrap.js";
 export const DEFAULT_READINESS_TIMEOUT_MS = 10_000;
 export { DEFAULT_STOP_TIMEOUT_MS };
 /**
@@ -55,11 +56,13 @@ export async function startHost(paths, socket, options, generation = 0) {
     let child;
     let exitedEarly;
     let childExit;
+    let presenterEnrollment;
     try {
         const supervisorArgs = [
             "--socket",
             socket,
             ...(options.owner ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
+            ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = testOptions?.spawn ?? testOptions?.launch?.(supervisorArgs) ?? defaultHostLaunch(supervisorArgs);
@@ -73,8 +76,14 @@ export async function startHost(paths, socket, options, generation = 0) {
                 instanceId,
                 generation,
             }),
-            stdio: options.owner ? ["ignore", "ignore", stderr.fd, "pipe"] : ["ignore", "ignore", stderr.fd],
+            stdio: options.presenterBootstrap
+                ? ["ignore", "ignore", stderr.fd, options.owner ? "pipe" : "ignore", "pipe"]
+                : options.owner
+                    ? ["ignore", "ignore", stderr.fd, "pipe"]
+                    : ["ignore", "ignore", stderr.fd],
         });
+        if (options.presenterBootstrap)
+            presenterEnrollment = relayPresenterBootstrap(options.presenterBootstrap, child);
         childExit = new Promise((resolveExit) => {
             child.once("exit", (code, signal) => {
                 exitedEarly = { code, signal };
@@ -140,8 +149,10 @@ export async function startHost(paths, socket, options, generation = 0) {
     }
     const readinessTimeoutMs = testOptions?.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS;
     const result = await pollProtocolInfo(socket, readinessTimeoutMs, isCompatible, childExit);
-    if (result.ready)
+    if (result.ready) {
+        await presenterEnrollment;
         return { pid: pidFile.pid, socket, reused: false, release: result.hold.release };
+    }
     await testOptions?.beforeReadinessTeardown?.();
     // Teardown runs for the diagnostic's sake, so it must never replace it: a stop failure here
     // (unreadable identity, a host that outlives SIGKILL) would otherwise propagate instead of the

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -1,5 +1,6 @@
 /** The options and result of `ensureHost`, kept apart so the ensure's helpers can name them without a cycle. */
 import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
+import type { Duplex } from "node:stream";
 /**
  * What an ensure may do to a host that is already running.
  *
@@ -10,6 +11,7 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
  */
 export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
+    readonly presenterBootstrap?: Duplex;
     readonly socket: string;
     readonly agentDir?: string;
     readonly keyRoot?: string;

package/dist/modes/rpc/host-ensure.js

@@ -205,6 +205,7 @@ async function upgradeGeneration(paths, socket, options, attachedPid) {
         socket,
         agentDir: options.agentDir ?? getAgentDir(),
         hostArgs: options.hostArgs ?? [],
+        presenterBootstrap: options.presenterBootstrap,
         ...(options.env ? { env: options.env } : {}),
         ...(options.policy ? { policy: options.policy } : {}),
         _test: {

package/dist/modes/rpc/host-handoff.d.ts

@@ -1,3 +1,4 @@
+import type { Duplex } from "node:stream";
 import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
 /**
  * The longest a handoff holds the ensure lock: its probe of the running host, the two session counts
@@ -5,6 +6,7 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
  */
 export declare const HANDOFF_LOCK_HOLD_MS: number;
 export interface HandoffHostOptions {
+    readonly presenterBootstrap?: Duplex;
     readonly socket: string;
     readonly agentDir?: string;
     /** Extra CLI arguments the successor's host child is launched with (provider pinning, extensions). */

package/dist/modes/rpc/host-handover-wire.d.ts

@@ -9,6 +9,7 @@
 import type { HandoverAnswer, HandoverOutcome, HandoverView, IdleHandoverRequest } from "./host-idle-handover.ts";
 import type { RpcResponse } from "./rpc-types.ts";
 import type { RpcSessionRegistry } from "./session-registry.ts";
+import type { Duplex } from "node:stream";
 export declare const BEGIN_HANDOVER_COMMAND = "begin_handover";
 export declare function parseBeginHandover(record: Readonly<Record<string, unknown>>): IdleHandoverRequest | string;
 export declare function beginHandoverResponse(id: unknown, answer: HandoverAnswer | string): Record<string, unknown>;
@@ -37,5 +38,6 @@ export declare function performIdleHandover(context: {
     readonly request: IdleHandoverRequest;
     readonly socket: string;
     readonly agentDir: string;
+    readonly presenterBootstrap?: Duplex;
 }): Promise<HandoverOutcome>;
 //# sourceMappingURL=host-handover-wire.d.ts.map

package/dist/modes/rpc/host-handover-wire.js

@@ -120,6 +120,7 @@ export async function performIdleHandover(context) {
         env[name] = null;
     Object.assign(env, request.env);
     const result = await handoffHost({
+        presenterBootstrap: context.presenterBootstrap,
         socket,
         agentDir,
         hostArgs: request.hostArgs,

package/dist/modes/rpc/host-lifecycle-launch.d.ts

@@ -6,6 +6,7 @@
 import { type ChildProcess } from "node:child_process";
 import type { SocketFileIdentity } from "./socket-ownership.ts";
 export interface SupervisorLaunch {
+    readonly presenterBootstrapFd?: number;
     readonly socket: string;
     readonly hostArgs: readonly string[];
     /** Optional runtime command used by rebranded/bundled callers. */

package/dist/modes/rpc/host-lifecycle-launch.js

@@ -56,10 +56,16 @@ export function parseSupervisorArgs(argv) {
     let childArgs;
     let agentDir;
     let ownerFd;
+    let presenterBootstrapFd;
     let bindSocket;
     let replaceIdentity;
     for (let index = 0; index < argv.length; index++) {
         const arg = argv[index];
+        if (arg === "--mcp-presenter-fd" && argv[index + 1] === "4") {
+            presenterBootstrapFd = 4;
+            index++;
+            continue;
+        }
         if (arg === "--owner-fd" && index + 1 < argv.length) {
             ownerFd = Number(argv[++index]);
             if (!Number.isSafeInteger(ownerFd) || ownerFd < 3)
@@ -101,7 +107,19 @@ export function parseSupervisorArgs(argv) {
     }
     return socket === undefined
         ? undefined
-        : { socket, hostArgs, childCommand, childArgs, agentDir, ownerFd, bindSocket, replaceIdentity };
+        : ownerFd === presenterBootstrapFd && ownerFd !== undefined
+            ? undefined
+            : {
+                socket,
+                hostArgs,
+                childCommand,
+                childArgs,
+                agentDir,
+                ownerFd,
+                bindSocket,
+                replaceIdentity,
+                presenterBootstrapFd,
+            };
 }
 export const OWNER_WATCH_FD = 3;
 // Strongly retain the write end until that supervisor exits, but never keep the caller alive.
@@ -188,6 +206,10 @@ export const HOST_CHILD_WATCH_FD = 3;
 export function spawnHostChild(options) {
     const { launch, internalSocket, internal, internalSecret, publicSocket } = options;
     const childLaunch = spawnableChildLaunch(resolveHostChildLaunch(launch, internalSocket));
+    // A shell wrapper cannot prove preservation of the private inherited handle.
+    const bootstrap = launch.presenterBootstrapFd !== undefined && !childLaunch.shell;
+    if (bootstrap)
+        childLaunch.args.push("--mcp-presenter-fd", "4");
     const child = spawn(childLaunch.command, childLaunch.args, {
         env: {
             ...process.env,
@@ -210,13 +232,32 @@ export function spawnHostChild(options) {
         // Slot 3 is the lifetime pipe: "pipe" gives the child a read end it can
         // wait on and keeps the write end owned by this process alone.
         shell: childLaunch.shell,
-        stdio: [process.platform === "win32" ? "ignore" : "pipe", "ignore", "inherit", "pipe"],
+        stdio: [
+            process.platform === "win32" ? "ignore" : "pipe",
+            "ignore",
+            "inherit",
+            "pipe",
+            ...(bootstrap ? ["pipe"] : []),
+        ],
         // The supervisor is spawned detached, so on win32 it owns no console. A
         // console-subsystem child started from it would allocate a fresh one,
         // which Windows Terminal renders as an empty window that takes focus.
         // CREATE_NO_WINDOW gives the child a console with no window instead.
         windowsHide: true,
     });
+    if (launch.presenterBootstrapFd !== undefined) {
+        const fd = launch.presenterBootstrapFd;
+        // The opt-in helper stays outside the supervisor's fixed startup import budget.
+        void import("./mcp-presenter-bootstrap.js")
+            .then(({ presenterBootstrapStream, relayPresenterBootstrap }) => {
+            const upstream = presenterBootstrapStream(fd);
+            if (upstream && bootstrap)
+                return relayPresenterBootstrap(upstream, child);
+            upstream?.destroy();
+            child.stdio[4]?.destroy();
+        })
+            .catch(() => child.stdio[4]?.destroy());
+    }
     if (options.internalKey) {
         child.stdin?.on("error", () => { });
         // One write only. Keep its write end alive until this supervisor exits.

package/dist/modes/rpc/host-runner.d.ts

@@ -5,6 +5,7 @@ import type { ResolvedHostLaunchSpec } from "./host-launch-spec.ts";
 import { type HostOutcome } from "./host-outcome.ts";
 import type { HostStopGeneration } from "./host-stop-generation.ts";
 export { HOST_EXIT_ERROR, HOST_EXIT_FALLBACK, HOST_EXIT_OK, HOST_EXIT_REFUSED, HOST_EXIT_USAGE, type HostOutcome, } from "./host-outcome.ts";
+import type { Duplex } from "node:stream";
 /** Which daemon a request is about: the endpoint, and the agent directory holding its state. */
 export interface HostTarget {
     readonly socket: string;
@@ -50,5 +51,6 @@ export type HostRequest = {
 };
 export declare function runHostRequest(request: HostRequest, options?: {
     readonly keyRoot?: string;
+    readonly presenterBootstrap?: Duplex;
 }): Promise<HostOutcome>;
 //# sourceMappingURL=host-runner.d.ts.map

package/dist/modes/rpc/host-runner.js

@@ -37,9 +37,9 @@ import { hostRequestKeyRoot } from "./host-request-key-root.js";
 import { withRpcKeyRoot } from "./rpc-auth-client.js";
 const PROBE_TIMEOUT_MS = 10_000;
 export async function runHostRequest(request, options = {}) {
-    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request));
+    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap));
 }
-async function runHostRequestInKeyRoot(request) {
+async function runHostRequestInKeyRoot(request, presenterBootstrap) {
     if (request.action === "ensure" || request.action === "handoff" || request.action === "stop") {
         const { socket, agentDir } = request.target;
         if ((await endpointKindOfSocket(socket, agentDir)) === "tui") {
@@ -48,7 +48,7 @@ async function runHostRequestInKeyRoot(request) {
     }
     switch (request.action) {
         case "ensure":
-            return ensureOutcome(request.target, request.spec, request.policy);
+            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap);
         case "status":
             return request.all === true
                 ? statusAllOutcome(request.target, request.includeWorkers)
@@ -57,7 +57,7 @@ async function runHostRequestInKeyRoot(request) {
             return stopOutcome(request);
         case "handoff":
             return request.handover === undefined
-                ? handoffOutcome(request.target, request.spec)
+                ? handoffOutcome(request.target, request.spec, presenterBootstrap)
                 : idleHandoverOutcome(request.target, request.spec, request.handover);
         case "shard_path":
             return shardPathOutcome(request.kind, request.owner, request.root);
@@ -70,7 +70,7 @@ async function runHostRequestInKeyRoot(request) {
             return assertNever(request);
     }
 }
-async function ensureOutcome(target, spec, policy) {
+async function ensureOutcome(target, spec, policy, presenterBootstrap) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     if (policy === "fallback") {
         // `fallback` is the caller saying it can live without a host. The decision is made HERE
@@ -84,6 +84,7 @@ async function ensureOutcome(target, spec, policy) {
     try {
         ensured = await ensureHost({
             socket: target.socket,
+            presenterBootstrap,
             agentDir: target.agentDir,
             hostArgs: spec.hostArgs,
             env: daemonEnvOverrides(process.env, spec.env),
@@ -181,10 +182,11 @@ async function stopOutcome(request) {
         },
     };
 }
-async function handoffOutcome(target, spec) {
+async function handoffOutcome(target, spec, presenterBootstrap) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     const result = await handoffHost({
         socket: target.socket,
+        presenterBootstrap,
         agentDir: target.agentDir,
         hostArgs: spec.hostArgs,
         env: daemonEnvOverrides(process.env, spec.env),

package/dist/modes/rpc/host-successor.js

@@ -28,6 +28,7 @@ import { defaultHostLaunch, PINNED_HOST_CLIENT_CAPABILITIES } from "./host-launc
 import { DEFAULT_HOST_IDLE_EXIT_MS } from "./host-lifecycle.js";
 import { keepOwnerPipe, OWNER_WATCH_FD } from "./host-lifecycle-launch.js";
 import { probeProtocolInfo } from "./host-probe.js";
+import { relayPresenterBootstrap } from "./mcp-presenter-bootstrap.js";
 import { successorHostEnvironment } from "./host-spawn-environment.js";
 import { signalGeneration } from "./host-stop.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
@@ -81,6 +82,7 @@ export async function startSuccessor(context) {
             "--replace",
             `${replaced.dev}:${replaced.ino}`,
             ...(inheritOwnerPipe ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
+            ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = (options._test?.launch ?? options.launch)?.(argv) ?? defaultHostLaunch(argv);
@@ -96,8 +98,15 @@ export async function startSuccessor(context) {
                 generation,
                 instanceId,
             }),
-            stdio: inheritOwnerPipe ? ["ignore", "ignore", stderr.fd, "pipe"] : ["ignore", "ignore", stderr.fd],
+            stdio: options.presenterBootstrap
+                ? ["ignore", "ignore", stderr.fd, inheritOwnerPipe ? "pipe" : "ignore", "pipe"]
+                : inheritOwnerPipe
+                    ? ["ignore", "ignore", stderr.fd, "pipe"]
+                    : ["ignore", "ignore", stderr.fd],
         });
+        const presenterEnrollment = options.presenterBootstrap
+            ? relayPresenterBootstrap(options.presenterBootstrap, spawned)
+            : undefined;
         child = spawned;
         exited = new Promise((resolve) => spawned.once("exit", () => resolve()));
         await stderr.close();
@@ -135,6 +144,7 @@ export async function startSuccessor(context) {
         // clients reach is still the predecessor, and the pointer has to name whoever owns the socket.
         await options._test?.beforeRegistration?.();
         await writeHostRegistration(paths, { ...registration, ...successorBuild(answer) });
+        await presenterEnrollment;
         child.unref();
         // The successor owns the socket now: the predecessor may drain. SIGUSR1 is sent only here,
         // to a pid the record proved and a host that advertised it can survive the signal. A