@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/core/lifecycle-session-binding.js

@@ -8,11 +8,14 @@ import { readLifecycleGoal } from "./lifecycle-goal.js";
 import { lifecycleHistory } from "./lifecycle-history.js";
 import { bindLifecycleHumanInput } from "./lifecycle-human-input.js";
 import { readLifecycleRuntimeFacts } from "./lifecycle-runtime-facts.js";
+import { goalGuardAfter } from "./lifecycle-stop.js";
 import { SessionLifecycleController } from "./session-lifecycle.js";
 import { isRecord } from "./work-custody-record.js";
 /** Attaches durable lifecycle to the real session event/admission boundaries. */
 export class LifecycleSessionBinding {
     constructor(session, host) {
+        /** The run each emitted agent_end belonged to, read when it was emitted, not when its queue reaches it. */
+        this.boundEnds = new WeakMap();
         this.refreshGeneration = 0;
         this.restored = false;
         /** After dispose() nothing the controller decides is written or emitted: the session file is no longer this session's. */
@@ -102,10 +105,20 @@ export class LifecycleSessionBinding {
     }
     startRun() {
         this.lastEnd = undefined;
+        this.lastEndGuard = undefined;
         const origin = this.nextRunOrigin;
         this.nextRunOrigin = undefined;
         this.controller.startRun(origin);
     }
+    deadlineStopped(kind, atMs) {
+        this.controller.deadlineStopped(kind, atMs);
+    }
+    deadlineStopWriteFailed() {
+        this.controller.deadlineStopWriteFailed();
+    }
+    bindTurnEnd(end) {
+        this.boundEnds.set(end, this.controller.ledger.runId);
+    }
     consume(message) {
         return this.write(() => consumeLifecycleDelivery(this.session, this.controller, message));
     }
@@ -115,8 +128,14 @@ export class LifecycleSessionBinding {
         const ticketId = messageTicket(message);
         return ticketId ? this.session.sessionManager.reduceHistory(lifecycleDeliveryEntries).get(ticketId) : undefined;
     }
-    async turnEnded(event) {
+    /** `event` is the extension agent_end, never the session-level stamp; `end` is the core event bound at emission. */
+    async turnEnded(event, end, guardStartLeafId) {
         this.lastEnd = event;
+        this.lastEndRunId = this.boundEnds.get(end);
+        this.lastEndGuard =
+            guardStartLeafId === undefined
+                ? undefined
+                : goalGuardAfter(this.session.sessionManager.getBranch(), guardStartLeafId);
         await this.refreshFacts();
     }
     async refreshFacts(changedGoal) {
@@ -166,7 +185,15 @@ export class LifecycleSessionBinding {
                 deadlineStop: input.deadlineStop || saved.deadlineStop,
                 providerRetryAtMs: input.providerRetryAtMs ?? saved.providerRetryAtMs,
             };
-        this.controller.goalFacts(goal, input);
+        // Stop facts belong to the run that just ended in this process; a restored end carries its recorded stop.
+        const stop = this.lastEnd
+            ? {
+                runId: this.lastEndRunId,
+                guard: this.lastEndGuard,
+                todo: collected?.todoOutcome,
+            }
+            : undefined;
+        this.controller.goalFacts(goal, input, stop);
     }
     async idle() {
         await this.refreshFacts();

package/dist/core/lifecycle-stop.d.ts

@@ -0,0 +1,41 @@
+import type { TodoOwedOutcome } from "./extensions/builtin/goal/todo-owed-backstop.ts";
+import type { TurnEndLivenessInput } from "./extensions/builtin/goal/turn-end-liveness.ts";
+import type { LifecycleStop } from "./session-lifecycle-types.ts";
+import type { TurnDeadlineKind } from "./turn-deadline.ts";
+/** Stop facts the stopping run produced itself, read from that run's own end (senpi#3864). */
+export interface RunStopFacts {
+    /** The run the turn end belonged to when its agent_end was emitted. */
+    readonly runId?: string;
+    readonly guard?: {
+        readonly reason: string;
+        readonly at: number;
+    };
+    readonly todo?: TodoOwedOutcome;
+}
+/** A deadline captured when it fired, before its durable write, for the run it stopped. */
+export interface DeadlineStopCapture {
+    readonly runId: string;
+    readonly kind: TurnDeadlineKind;
+    readonly at: string;
+    readonly persisted?: false;
+}
+type StopDetail = Omit<LifecycleStop, "runId" | "epoch" | "at"> & {
+    readonly at?: string;
+};
+/**
+ * First match wins: the run's own deadline explains its system abort, a guard explains a refused continuation, then
+ * the classified abort, and `no_wake` only for a stall no hold or guard owns. Provider failures keep the failed path.
+ */
+export declare function stopDetail(input: TurnEndLivenessInput | undefined, facts: RunStopFacts | undefined, deadline: DeadlineStopCapture | undefined, stalled: boolean): StopDetail | undefined;
+export declare function sameStop(stop: LifecycleStop, detail: StopDetail): boolean;
+/** The latest guard appended within one bound end's extension-processing window, including legacy entries. */
+export declare function goalGuardAfter(branch: readonly {
+    readonly id: string;
+    readonly type: string;
+    readonly customType?: string;
+    readonly data?: unknown;
+}[], guardStartLeafId: string | null): RunStopFacts["guard"];
+/** Malformed optional detail is dropped; it never invalidates the record that carries it. */
+export declare function readLastStop(value: unknown, runId: unknown): LifecycleStop | undefined;
+export {};
+//# sourceMappingURL=lifecycle-stop.d.ts.map

package/dist/core/lifecycle-stop.js

@@ -0,0 +1,92 @@
+import { isRecord } from "./work-custody-record.js";
+const ABORT_SOURCES = {
+    "user-abort": "user",
+    "system-abort": "system",
+    "provider-abort": "provider",
+    "unknown-abort": null,
+};
+/**
+ * First match wins: the run's own deadline explains its system abort, a guard explains a refused continuation, then
+ * the classified abort, and `no_wake` only for a stall no hold or guard owns. Provider failures keep the failed path.
+ */
+export function stopDetail(input, facts, deadline, stalled) {
+    if (input?.endedBy === "provider-error" || input?.endedBy === "policy-rejection")
+        return undefined;
+    if (deadline)
+        return {
+            cause: "deadline",
+            deadline: deadline.kind,
+            at: deadline.at,
+            ...(deadline.persisted === false ? { persisted: false } : {}),
+        };
+    if (facts?.guard)
+        return { cause: "goal_guard", guard: facts.guard.reason, at: new Date(facts.guard.at).toISOString() };
+    if (facts?.todo === "capped" || facts?.todo === "cap")
+        return { cause: "todo_guard", todo: "cap" };
+    const abortSource = input ? ABORT_SOURCES[input.endedBy] : undefined;
+    if (abortSource !== undefined)
+        return { cause: "aborted", ...(abortSource === null ? {} : { abortSource }) };
+    if (stalled && !input?.deadlineStop && !input?.budgetSpent)
+        return { cause: "no_wake" };
+    return undefined;
+}
+export function sameStop(stop, detail) {
+    return (stop.cause === detail.cause &&
+        stop.deadline === detail.deadline &&
+        stop.guard === detail.guard &&
+        stop.todo === detail.todo &&
+        stop.abortSource === detail.abortSource &&
+        stop.persisted === detail.persisted);
+}
+/** The latest guard appended within one bound end's extension-processing window, including legacy entries. */
+export function goalGuardAfter(branch, guardStartLeafId) {
+    const start = guardStartLeafId === null ? -1 : branch.findIndex((entry) => entry.id === guardStartLeafId);
+    if (guardStartLeafId !== null && start < 0)
+        return undefined;
+    for (let index = branch.length - 1; index > start; index--) {
+        const entry = branch[index];
+        if (entry?.type !== "custom" || entry.customType !== "goal-continuation-stopped" || !isRecord(entry.data))
+            continue;
+        const { reason, at } = entry.data;
+        return typeof reason === "string" && typeof at === "number" ? { reason, at } : undefined;
+    }
+    return undefined;
+}
+/** Malformed optional detail is dropped; it never invalidates the record that carries it. */
+export function readLastStop(value, runId) {
+    if (!isRecord(value) ||
+        typeof value.runId !== "string" ||
+        value.runId !== runId ||
+        typeof value.at !== "string" ||
+        typeof value.epoch !== "number")
+        return undefined;
+    const base = { runId: value.runId, at: value.at, epoch: value.epoch };
+    switch (value.cause) {
+        case "deadline":
+            return value.deadline === "inactivity" || value.deadline === "max_runtime"
+                ? {
+                    ...base,
+                    cause: value.cause,
+                    deadline: value.deadline,
+                    ...(value.persisted === false ? { persisted: false } : {}),
+                }
+                : undefined;
+        case "goal_guard":
+            return { ...base, cause: value.cause, ...(typeof value.guard === "string" ? { guard: value.guard } : {}) };
+        case "todo_guard":
+            return { ...base, cause: value.cause, todo: "cap" };
+        case "aborted":
+            return {
+                ...base,
+                cause: value.cause,
+                ...(value.abortSource === "user" || value.abortSource === "system" || value.abortSource === "provider"
+                    ? { abortSource: value.abortSource }
+                    : {}),
+            };
+        case "no_wake":
+            return { ...base, cause: value.cause };
+        default:
+            return undefined;
+    }
+}
+//# sourceMappingURL=lifecycle-stop.js.map

package/dist/core/mcp-form-types.d.ts

@@ -0,0 +1,89 @@
+import type { MrtrInputResponse } from "./extensions/builtin/mcp/modern/elicitation.ts";
+import type { ValidatedMcpFormSchema } from "./extensions/builtin/mcp/modern/form-schema.ts";
+export interface McpFormScope {
+    readonly hostInstance: string;
+    readonly durableSessionId: string;
+    readonly bindingEpoch: string;
+    readonly attachmentId: string;
+    readonly attachmentEpoch: string;
+    readonly connectionId: string;
+    readonly connectionEpoch: string;
+    readonly presenterPrincipalId: string;
+    readonly presenterGeneration: string;
+    readonly presentationBindingId: string;
+    readonly presenterKind: "desktop" | "gateway" | "local_tui";
+    readonly purpose: "mcp_form";
+}
+export interface McpFormEnvelope {
+    readonly sessionId: string;
+    readonly bindingEpoch: string;
+    readonly attachmentEpoch: string;
+    readonly grantId: string;
+    readonly dialogId: string;
+    readonly dialogToken: string;
+    readonly formRevision: string;
+}
+export interface McpFormRequest extends McpFormEnvelope {
+    readonly type: "mcp_form_request";
+    readonly server: {
+        readonly label: string;
+        readonly source: "user" | "project" | "plugin";
+    };
+    readonly message: string;
+    readonly schema: ValidatedMcpFormSchema;
+    readonly deadlineAtMs: number;
+}
+export interface McpFormResolved {
+    readonly type: "mcp_form_resolved";
+    readonly sessionId: string;
+    readonly grantId: string;
+    readonly dialogId: string;
+    readonly reason: "answered" | "declined" | "cancelled" | "processing_failed" | "operation_aborted";
+}
+export type McpFormOutcome = ({
+    readonly kind: "result";
+    readonly result: MrtrInputResponse;
+} | {
+    readonly kind: "processing_failure" | "operation_aborted";
+}) & ({
+    readonly source: "presenter_action";
+    readonly humanAdmission: true;
+} | {
+    readonly source: "host_termination";
+    readonly humanAdmission: false;
+});
+export interface McpFormInput {
+    readonly operationId: string;
+    readonly inputId: string;
+    readonly round: number;
+    readonly server: McpFormRequest["server"];
+    readonly message: string;
+    readonly schema: ValidatedMcpFormSchema;
+    readonly operationSignal: AbortSignal;
+    /** Host reads a worker-owned atomic abort fence at the terminal latch, without an IPC round trip. */
+    readonly operationCurrent?: () => boolean;
+    readonly presentationSignal: AbortSignal;
+    /** Remaining UI budget, measured by the host's monotonic clock. */
+    readonly deadlineMs: number;
+}
+export interface McpFormPresentation {
+    readonly signal: AbortSignal;
+    readonly ready: () => boolean;
+    readonly present: (input: McpFormInput) => Promise<McpFormOutcome>;
+    /** Worker-backed presenters recheck host readiness before each network attempt. */
+    readonly synchronize?: () => Promise<void>;
+}
+export interface McpFormBinding {
+    readonly epoch: string;
+    readonly signal: AbortSignal;
+    readonly capture: () => McpFormPresentation | undefined;
+    readonly dispose: () => void;
+    readonly version?: () => string | undefined;
+    readonly subscribe?: (listener: () => void) => () => void;
+}
+export declare function bindMcpFormPresented(options: object, callback: (() => void) | undefined): void;
+export declare function markMcpFormPresented(options: object | undefined): void;
+/** An enforced binding is part of the host-issued presenter identity, not a UI capability declaration. */
+export declare function bindPrivateMcpForms(ui: object, binding: McpFormBinding): void;
+export declare function privateMcpForms(ui: object): McpFormBinding | undefined;
+//# sourceMappingURL=mcp-form-types.d.ts.map

package/dist/core/mcp-form-types.js

@@ -0,0 +1,23 @@
+import { getMcpMrtrPresentation, registerMcpMrtrPresentation } from "./mcp-mrtr-presentations.js";
+const presentedCallbacks = new WeakMap();
+export function bindMcpFormPresented(options, callback) {
+    if (callback)
+        presentedCallbacks.set(options, callback);
+    else
+        presentedCallbacks.delete(options);
+}
+export function markMcpFormPresented(options) {
+    if (!options)
+        return;
+    const callback = presentedCallbacks.get(options);
+    presentedCallbacks.delete(options);
+    callback?.();
+}
+/** An enforced binding is part of the host-issued presenter identity, not a UI capability declaration. */
+export function bindPrivateMcpForms(ui, binding) {
+    registerMcpMrtrPresentation(ui, binding.signal, undefined, binding);
+}
+export function privateMcpForms(ui) {
+    return getMcpMrtrPresentation(ui)?.privateForms;
+}
+//# sourceMappingURL=mcp-form-types.js.map

package/dist/core/mcp-mrtr-presentations.d.ts

@@ -0,0 +1,15 @@
+import type { ExtensionUIContext } from "./extensions/types.ts";
+import type { McpFormBinding } from "./mcp-form-types.ts";
+/** Local host references only. RPC capabilities and serialized UI objects cannot enter this registry. */
+export interface McpMrtrPresentation {
+    readonly ui: Pick<ExtensionUIContext, "select" | "input">;
+    readonly signal: AbortSignal;
+    readonly admit?: () => void;
+    readonly presented?: () => void;
+    readonly privateForms?: McpFormBinding;
+}
+export declare function registerMcpMrtrPresentation(ui: ExtensionUIContext, signal: AbortSignal, admit?: () => void, privateForms?: McpFormBinding): ExtensionUIContext;
+export declare function getMcpMrtrPresentation(ui: object): McpMrtrPresentation | undefined;
+/** Preserve host identity across runner wrapping; private dialogs still use the raw host UI. */
+export declare function inheritMcpMrtrPresentation(source: ExtensionUIContext, wrapper: ExtensionUIContext): ExtensionUIContext;
+//# sourceMappingURL=mcp-mrtr-presentations.d.ts.map

package/dist/core/mcp-mrtr-presentations.js

@@ -0,0 +1,17 @@
+const presentations = new WeakMap();
+export function registerMcpMrtrPresentation(ui, signal, admit, privateForms) {
+    presentations.set(ui, { ui, signal, admit, privateForms });
+    return ui;
+}
+export function getMcpMrtrPresentation(ui) {
+    const presentation = presentations.get(ui);
+    return presentation?.signal.aborted ? undefined : presentation;
+}
+/** Preserve host identity across runner wrapping; private dialogs still use the raw host UI. */
+export function inheritMcpMrtrPresentation(source, wrapper) {
+    const presentation = getMcpMrtrPresentation(source);
+    if (presentation)
+        presentations.set(wrapper, presentation);
+    return wrapper;
+}
+//# sourceMappingURL=mcp-mrtr-presentations.js.map

package/dist/core/session-control-actions.js

@@ -10,8 +10,6 @@ export function createSessionControlActions(deps) {
     let retired = false;
     return {
         registerControlEndpoint: async (options) => {
-            if (process.platform === "win32")
-                return { status: "unsupported", reason: "unsupported_platform" };
             const host = deps.host();
             if (host === undefined)
                 return { status: "unsupported", reason: "unsupported_mode" };

package/dist/core/session-lifecycle-types.d.ts

@@ -22,6 +22,20 @@ export interface LifecycleHold {
     readonly kind: "session_hold" | "run_fence" | "inherited_hold" | "unattended";
     readonly since: string;
 }
+/** Why the last run stopped, for that run only (`runId`); cleared when the next lifecycle run starts. */
+export interface LifecycleStop {
+    readonly cause: "deadline" | "goal_guard" | "todo_guard" | "aborted" | "no_wake";
+    readonly runId: string;
+    readonly at: string;
+    readonly epoch: number;
+    readonly deadline?: "inactivity" | "max_runtime";
+    /** The goal guard reason exactly as `goal-continuation-stopped` recorded it. */
+    readonly guard?: string;
+    readonly todo?: "cap";
+    readonly abortSource?: "user" | "system" | "provider";
+    /** Present only when the deadline-stop entry write failed; distinct from the snapshot-level `persisted`. */
+    readonly persisted?: false;
+}
 export interface SpawnedBy {
     readonly parentSessionId: string;
     readonly rootSessionId: string;
@@ -48,6 +62,7 @@ export interface SessionLifecycle {
     readonly taskId?: string;
     readonly waitingOn?: LifecycleWaits;
     readonly holds?: readonly LifecycleHold[];
+    readonly lastStop?: LifecycleStop;
     readonly completion?: {
         readonly kind: "goal" | "run" | "agent" | "reply";
         readonly at: string;

package/dist/core/session-lifecycle.d.ts

@@ -2,8 +2,10 @@ import { type TurnEndLivenessInput } from "./extensions/builtin/goal/turn-end-li
 import type { Goal } from "./extensions/builtin/goal/types.ts";
 import { LifecycleChildren } from "./lifecycle-children.ts";
 import { LifecycleLedger, type LifecyclePersistence } from "./lifecycle-ledger.ts";
+import { type RunStopFacts } from "./lifecycle-stop.ts";
 import type { SessionActivitySnapshot } from "./session-activity.ts";
 import type { ChildLifecycleReport, HumanWait, LifecycleHold, SessionLifecycle } from "./session-lifecycle-types.ts";
+import type { TurnDeadlineKind } from "./turn-deadline.ts";
 import type { WorkCustodyRecord } from "./work-custody-record.ts";
 import { SessionWorkObligations } from "./work-obligations.ts";
 export interface LifecycleRuntimeFacts {
@@ -33,6 +35,10 @@ export declare class SessionLifecycleController {
     private ownTask;
     private evaluating;
     private deferred;
+    private stopFacts;
+    private deadlineStop;
+    /** A run that ended before this process keeps exactly the stop its record carries; none is derived for it. */
+    private readonly restoredRunId;
     constructor(options: SessionLifecycleOptions);
     get snapshot(): SessionLifecycle;
     get lastTurnInput(): TurnEndLivenessInput | undefined;
@@ -45,12 +51,22 @@ export declare class SessionLifecycleController {
     admissionSettled(): void;
     startRun(origin?: "human" | "automatic"): void;
     idle(): void;
-    goalFacts(goal: Goal | null, input?: TurnEndLivenessInput): void;
+    /** The turn deadline fired: captured before its durable write, for the run it stopped only. */
+    deadlineStopped(kind: TurnDeadlineKind, atMs: number): void;
+    /** The deadline-stop entry was refused; the captured stop says so, and the snapshot's `persisted` is untouched. */
+    deadlineStopWriteFailed(): void;
+    goalFacts(goal: Goal | null, input?: TurnEndLivenessInput, stop?: RunStopFacts): void;
     goalChanged(goal: Goal | null): void;
     reportChild(report: ChildLifecycleReport): void;
     requestSelfSettle(): import("./session-lifecycle-types.ts").SelfSettleResult;
     markRunCompleted(runId: string): void;
     recompute(): void;
     private evaluate;
+    /**
+     * Derived only from the current run's own end, bound when its agent_end was emitted: an end processed after a
+     * later run started sets nothing, and so does a fact refresh that carries no bound turn end, even when the goal
+     * collector still returns the previous run's end. An unchanged stop keeps its first `at`.
+     */
+    private lastStop;
 }
 //# sourceMappingURL=session-lifecycle.d.ts.map

package/dist/core/session-lifecycle.js

@@ -1,6 +1,7 @@
 import { effectiveWakes } from "./extensions/builtin/goal/turn-end-liveness.js";
 import { LifecycleChildren } from "./lifecycle-children.js";
 import { LifecycleLedger } from "./lifecycle-ledger.js";
+import { sameStop, stopDetail } from "./lifecycle-stop.js";
 import { lifecycleState, lifecycleTerminal } from "./session-lifecycle-reducer.js";
 import { SessionWorkObligations } from "./work-obligations.js";
 /** One event-driven reducer per session, shared by every client surface. */
@@ -21,6 +22,7 @@ export class SessionLifecycleController {
                 options.append(record);
             },
         });
+        this.restoredRunId = this.ledger.runId;
         if (this.ledger.lastTurnEnd)
             this.liveness = {
                 ...this.ledger.lastTurnEnd,
@@ -94,6 +96,8 @@ export class SessionLifecycleController {
         this.runAdmitted = false;
         this.idleBoundaryPassed = false;
         this.liveness = undefined;
+        this.stopFacts = undefined;
+        this.deadlineStop = undefined;
         const interruptedRun = this.ledger.interrupted ? this.ledger.runId : undefined;
         this.ledger.interrupted = false;
         this.ledger.startRun(origin ?? (this.pendingHuman ? "human" : "automatic"));
@@ -115,8 +119,20 @@ export class SessionLifecycleController {
         if (seq > 0 && this.ledger.snapshot.seq === seq)
             this.ledger.checkpoint();
     }
-    goalFacts(goal, input) {
+    /** The turn deadline fired: captured before its durable write, for the run it stopped only. */
+    deadlineStopped(kind, atMs) {
+        const runId = this.ledger.runId;
+        if (this.ledger.runActive && runId)
+            this.deadlineStop = { runId, kind, at: new Date(atMs).toISOString() };
+    }
+    /** The deadline-stop entry was refused; the captured stop says so, and the snapshot's `persisted` is untouched. */
+    deadlineStopWriteFailed() {
+        if (this.deadlineStop)
+            this.deadlineStop = { ...this.deadlineStop, persisted: false };
+    }
+    goalFacts(goal, input, stop) {
         this.liveness = input;
+        this.stopFacts = stop;
         if (input)
             this.ledger.lastTurnEnd = {
                 endedBy: input.endedBy,
@@ -282,6 +298,7 @@ export class SessionLifecycleController {
                 }
                 : undefined;
         const waits = { children, background, human };
+        const lastStop = this.lastStop(input, synthetic.some((wait) => wait.kind === "stalled"));
         const state = lifecycleState({
             role: this.ledger.snapshot.role,
             terminal: this.ownTask?.terminal,
@@ -296,7 +313,28 @@ export class SessionLifecycleController {
             this.ownTask?.terminal === undefined &&
             (!this.idleBoundaryPassed || active.length > 0))
             return;
-        this.ledger.update({ state, waits, holds: runtime.holds, failure });
+        this.ledger.update({ state, waits, holds: runtime.holds, failure, lastStop });
+    }
+    /**
+     * Derived only from the current run's own end, bound when its agent_end was emitted: an end processed after a
+     * later run started sets nothing, and so does a fact refresh that carries no bound turn end, even when the goal
+     * collector still returns the previous run's end. An unchanged stop keeps its first `at`.
+     */
+    lastStop(input, stalled) {
+        const existing = this.ledger.snapshot.lastStop;
+        const runId = this.ledger.runId;
+        if (!runId || runId === this.restoredRunId)
+            return existing;
+        if (this.stopFacts?.runId !== runId)
+            return existing;
+        const deadline = input && this.deadlineStop?.runId === runId ? this.deadlineStop : undefined;
+        const detail = stopDetail(input, this.stopFacts, deadline, stalled);
+        if (!detail)
+            return existing;
+        if (existing && sameStop(existing, detail))
+            return existing;
+        const { at, ...cause } = detail;
+        return { ...cause, runId, epoch: this.ledger.snapshot.epoch, at: at ?? new Date().toISOString() };
     }
 }
 //# sourceMappingURL=session-lifecycle.js.map

package/dist/main.js

@@ -1067,7 +1067,8 @@ export async function main(args, options) {
     if (appMode === "rpc" && parsed.multiSession) {
         if (options?.extensionFactories?.length)
             throw new Error("Shared RPC workers require file-backed extensions; inline factories cannot cross isolates");
-        const runtimeConfiguration = { parsed, cwd, agentDir, appMode, toolRuntime };
+        const { presenterBootstrapFd, mcpPresenterEnforcement, ...sessionArgs } = parsed;
+        const runtimeConfiguration = { parsed: sessionArgs, cwd, agentDir, appMode, toolRuntime };
         // Socket hosts (the machine-wide daemon) run every session IN this process:
         // createHostCore selects the worker registry only when a workerConfiguration
         // is passed, so withholding it is what selects the uncapped in-process registry.
@@ -1098,6 +1099,8 @@ export async function main(args, options) {
         }
         printTimings();
         await runMultiSessionHost({
+            presenterBootstrapFd,
+            mcpPresenterEnforcement,
             agentDir,
             createRuntime: createCliRuntimeFactory(runtimeConfiguration, {
                 ...(hostModelRuntime === undefined ? {} : { modelRuntime: hostModelRuntime }),
@@ -1292,6 +1295,7 @@ export async function main(args, options) {
         // mode seam: interactive startup still loads the same module before first use.
         const { InteractiveMode } = await import("./modes/interactive/interactive-mode.js");
         const interactiveMode = new InteractiveMode(runtime, {
+            mcpPresenterEnforcement: parsed.mcpPresenterEnforcement,
             migratedProviders,
             authNotices: interactiveAuthNotices(services.authStorage),
             legacyPiEditNotice: legacyPiEditStartupNotice(),

package/dist/modes/interactive/components/extension-selector.d.ts

@@ -21,6 +21,7 @@ export declare class ExtensionSelectorComponent extends Container {
     private countdown;
     private onToggleToolsExpanded;
     private maxVisibleOptions;
+    private answerSettled;
     constructor(title: string, options: string[], onSelect: (option: string) => void, onCancel: () => void, opts?: ExtensionSelectorOptions);
     private updateList;
     handleInput(keyData: string): void;

package/dist/modes/interactive/components/extension-selector.js

@@ -12,6 +12,7 @@ export class ExtensionSelectorComponent extends Container {
     constructor(title, options, onSelect, onCancel, opts) {
         super();
         this.selectedIndex = 0;
+        this.answerSettled = false;
         this.options = options;
         this.onSelectCallback = onSelect;
         this.onCancelCallback = onCancel;
@@ -67,6 +68,8 @@ export class ExtensionSelectorComponent extends Container {
         }
     }
     handleInput(keyData) {
+        if (this.answerSettled)
+            return;
         const kb = getKeybindings();
         if (kb.matches(keyData, "app.tools.expand")) {
             this.onToggleToolsExpanded?.();
@@ -89,6 +92,7 @@ export class ExtensionSelectorComponent extends Container {
         }
     }
     dispose() {
+        this.answerSettled = true;
         this.countdown?.dispose();
     }
 }

package/dist/modes/interactive/interactive-mode.d.ts

@@ -56,6 +56,8 @@ interface InteractiveUserInput {
  * Options for InteractiveMode initialization.
  */
 export interface InteractiveModeOptions {
+    /** Opt in to host-issued MCP form authority; ordinary terminal forms remain the default. */
+    mcpPresenterEnforcement?: boolean;
     /** Renderer mode for the interactive terminal. */
     uiMode?: TuiMode;
     /** Providers that were migrated to auth.json (shows warning) */
@@ -327,6 +329,8 @@ export declare class InteractiveMode {
      */
     private unsubscribeSecurityNotices?;
     private detachMcpGrantPresentation?;
+    private mcpMrtrPresentationLifetime;
+    private mcpLocalPresenter?;
     private bindCurrentSessionExtensions;
     private applyFullscreenScrollbarSetting;
     private applyRuntimeSettings;