@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/modes/interactive/interactive-mode.js

@@ -35,6 +35,9 @@ import { configureHttpDispatcher, formatHttpIdleTimeoutMs } from "../../core/htt
 import { KeybindingsManager } from "../../core/keybindings.js";
 import { isManualContinueSubmission } from "../../core/manual-continue.js";
 import { attachMcpGrantPresentation } from "../../core/mcp-grant-presentations.js";
+import { registerMcpMrtrPresentation } from "../../core/mcp-mrtr-presentations.js";
+import { markMcpFormPresented } from "../../core/mcp-form-types.js";
+import { registerLocalMcpPresenter } from "./mcp-local-presenter.js";
 import { createCompactionSummaryMessage, createCustomMessage } from "../../core/messages.js";
 import { defaultModelPerProvider, findExactModelReferenceMatch, resolveModelScope, resolveModelScopeFromModels, resolveModelScopeWithDiagnostics, } from "../../core/model-resolver.js";
 import { CredentialSynchronizationError } from "../../core/model-runtime.js";
@@ -688,6 +691,7 @@ export class InteractiveMode {
         this.onRightClickPaste = () => {
             void this.handleRightClickPaste();
         };
+        this.mcpMrtrPresentationLifetime = new AbortController();
         /**
          * Gracefully shutdown the agent.
          * Stops the TUI before emitting shutdown events so extension UI cleanup cannot
@@ -2010,6 +2014,9 @@ export class InteractiveMode {
         }
     }
     async bindCurrentSessionExtensions() {
+        this.mcpMrtrPresentationLifetime?.abort();
+        this.mcpMrtrPresentationLifetime = new AbortController();
+        this.mcpLocalPresenter = undefined;
         await this.sessionControlHost?.disposeActive();
         this.session.setControlEndpointHost?.(this.sessionControlHost);
         const uiContext = this.createExtensionUIContext();
@@ -2318,7 +2325,12 @@ export class InteractiveMode {
             return false;
         };
     }
-    async withBlockedHostDialog(id, label, show) {
+    async withBlockedHostDialog(id, label, show, opts) {
+        if (opts?.ephemeral) {
+            if (opts.signal?.aborted)
+                return undefined;
+            return await show();
+        }
         this.session.emitExtensionEvent("herdr:blocked", { active: true, label, id });
         try {
             return await show();
@@ -2846,10 +2858,11 @@ export class InteractiveMode {
         };
     }
     createExtensionUIContext() {
-        return {
-            select: (title, options, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionSelector(title, options, opts)),
-            confirm: (title, message, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionConfirm(title, message, opts)),
-            input: (title, placeholder, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionInput(title, placeholder, opts)),
+        this.mcpMrtrPresentationLifetime ??= new AbortController();
+        const context = {
+            select: (title, options, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionSelector(title, options, opts), opts),
+            confirm: async (title, message, opts) => (await this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionConfirm(title, message, opts), opts)) ?? false,
+            input: (title, placeholder, opts) => this.withBlockedHostDialog(crypto.randomUUID(), title, () => this.showExtensionInput(title, placeholder, opts), opts),
             // Async answers are delivered by the ask-user extension, not here: the
             // widget only resolves the question, so the model sees exactly one
             // framed user message no matter which surface answered.
@@ -2906,6 +2919,11 @@ export class InteractiveMode {
             getToolsExpanded: () => this.toolOutputExpanded,
             setToolsExpanded: (expanded) => this.setToolsExpanded(expanded),
         };
+        const presenterSession = this.session;
+        const privateForms = this.options?.mcpPresenterEnforcement === true
+            ? (this.mcpLocalPresenter ??= registerLocalMcpPresenter(context, presenterSession.sessionId, this.mcpMrtrPresentationLifetime.signal, () => presenterSession.admitHumanAnswer()))
+            : undefined;
+        return registerMcpMrtrPresentation(context, this.mcpMrtrPresentationLifetime.signal, undefined, privateForms);
     }
     /**
      * Show a selector for extensions.
@@ -2922,7 +2940,8 @@ export class InteractiveMode {
             };
             opts?.signal?.addEventListener("abort", onAbort, { once: true });
             this.extensionSelector = new ExtensionSelectorComponent(title, options, (option) => {
-                this.session.admitHumanAnswer();
+                if (!opts?.ephemeral || !this.options?.mcpPresenterEnforcement)
+                    this.session.admitHumanAnswer();
                 opts?.signal?.removeEventListener("abort", onAbort);
                 this.hideExtensionSelector();
                 resolve(option);
@@ -2939,7 +2958,12 @@ export class InteractiveMode {
             this.editorContainer.clear();
             this.editorContainer.addChild(this.extensionSelector);
             this.ui.setFocus(this.extensionSelector);
-            this.ui.requestRender();
+            if (opts?.ephemeral && this.options?.mcpPresenterEnforcement) {
+                this.ui.renderNow();
+                markMcpFormPresented(opts);
+            }
+            else
+                this.ui.requestRender();
         });
     }
     /**
@@ -2979,7 +3003,8 @@ export class InteractiveMode {
             };
             opts?.signal?.addEventListener("abort", onAbort, { once: true });
             this.extensionInput = new ExtensionInputComponent(title, placeholder, (value) => {
-                this.session.admitHumanAnswer();
+                if (!opts?.ephemeral || !this.options?.mcpPresenterEnforcement)
+                    this.session.admitHumanAnswer();
                 opts?.signal?.removeEventListener("abort", onAbort);
                 this.hideExtensionInput();
                 resolve(value);
@@ -5505,6 +5530,7 @@ export class InteractiveMode {
         if (this.isShuttingDown)
             return;
         this.isShuttingDown = true;
+        this.mcpMrtrPresentationLifetime?.abort();
         // Keep signal handlers registered until terminal cleanup has completed.
         // `signal-exit` checks the listener list during the same SIGTERM/SIGHUP
         // dispatch and re-sends the signal if only its own listeners remain.

package/dist/modes/interactive/mcp-local-presenter.d.ts

@@ -0,0 +1,5 @@
+import type { ExtensionUIContext } from "../../core/extensions/types.ts";
+import type { McpFormBinding } from "../../core/mcp-form-types.ts";
+/** The terminal itself is the principal; an RPC attachment never receives this handle. */
+export declare function registerLocalMcpPresenter(ui: ExtensionUIContext, sessionId: string, lifetime: AbortSignal, admit: () => void): McpFormBinding;
+//# sourceMappingURL=mcp-local-presenter.d.ts.map

package/dist/modes/interactive/mcp-local-presenter.js

@@ -0,0 +1,109 @@
+import { collectMrtrForm } from "../../core/extensions/builtin/mcp/modern/elicitation.js";
+import { queuedForm } from "../../core/extensions/builtin/mcp/modern/consent-queue.js";
+import { McpPresenterAuthority } from "../rpc/mcp-presenter-authority.js";
+/** The terminal itself is the principal; an RPC attachment never receives this handle. */
+export function registerLocalMcpPresenter(ui, sessionId, lifetime, admit) {
+    const authority = new McpPresenterAuthority();
+    const binding = authority.bind(sessionId, sessionId, admit);
+    let activeInput;
+    const drafts = new Map();
+    const sender = authority.connect("local_tui", (frame) => {
+        if (frame.type !== "mcp_form_request") {
+            drafts.get(frame.dialogId)?.abort();
+            drafts.delete(frame.dialogId);
+            return true;
+        }
+        const active = activeInput;
+        if (!active)
+            return false;
+        const { input } = active;
+        const draft = new AbortController();
+        drafts.set(frame.dialogId, draft);
+        const signal = AbortSignal.any([input.operationSignal, input.presentationSignal, lifetime, draft.signal]);
+        const { sessionId, bindingEpoch, attachmentEpoch, grantId, dialogId, dialogToken, formRevision } = frame;
+        const envelope = { sessionId, bindingEpoch, attachmentEpoch, grantId, dialogId, dialogToken, formRevision };
+        void collectMrtrForm({
+            ui,
+            signal,
+            presented: () => authority.receive(sender, { ...envelope, type: "mcp_form_presented" }),
+        }, `${frame.server.label} (${frame.server.source})`, { message: frame.message, requestedSchema: frame.schema }, signal)
+            .then((result) => {
+            if (!signal.aborted)
+                authority.receive(sender, { ...envelope, type: "mcp_form_response", ...result });
+        }, () => active.fail())
+            .finally(() => drafts.delete(frame.dialogId));
+        return true;
+    });
+    authority.attach(sender, binding);
+    const owner = authority.enroll();
+    owner.acquire(owner.register(binding, sender, { kind: "local_tui" }));
+    const dispose = () => {
+        authority.dispose();
+        for (const draft of drafts.values())
+            draft.abort();
+        drafts.clear();
+    };
+    lifetime.addEventListener("abort", dispose, { once: true });
+    const privateForms = {
+        epoch: binding.epoch,
+        signal: binding.signal,
+        capture: () => {
+            const presentation = binding.capture();
+            if (!presentation)
+                return undefined;
+            return {
+                ...presentation,
+                present: async (input) => {
+                    const deadline = performance.now() + input.deadlineMs;
+                    const timeout = new AbortController();
+                    const timer = setTimeout(() => timeout.abort(), Math.max(0, input.deadlineMs));
+                    const signal = AbortSignal.any([
+                        input.operationSignal,
+                        input.presentationSignal,
+                        presentation.signal,
+                        lifetime,
+                        timeout.signal,
+                    ]);
+                    try {
+                        return await queuedForm(binding, signal, async () => {
+                            const failure = new AbortController();
+                            const current = {
+                                input: {
+                                    ...input,
+                                    presentationSignal: AbortSignal.any([signal, failure.signal]),
+                                    deadlineMs: Math.max(0, deadline - performance.now()),
+                                },
+                                fail: () => failure.abort(),
+                            };
+                            activeInput = current;
+                            try {
+                                return await presentation.present(current.input);
+                            }
+                            finally {
+                                if (activeInput === current)
+                                    activeInput = undefined;
+                            }
+                        });
+                    }
+                    catch {
+                        return {
+                            kind: input.operationSignal.aborted || binding.signal.aborted || input.operationCurrent?.() === false
+                                ? "operation_aborted"
+                                : "processing_failure",
+                            source: "host_termination",
+                            humanAdmission: false,
+                        };
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                },
+            };
+        },
+        dispose,
+    };
+    if (lifetime.aborted)
+        dispose();
+    return privateForms;
+}
+//# sourceMappingURL=mcp-local-presenter.js.map

package/dist/modes/interactive/session-control-attach.d.ts

@@ -7,12 +7,19 @@
  *
  * The terminal itself is one attachment; each attached client adds one. A client that only subscribed
  * (mirror included) is not an attachment.
+ *
+ * It also keeps what a host keeps per connection and per session for the drive set (senpi#4267): the roles each
+ * connection declared with `set_client_info`, and the admission receipt of every input sent with a `clientMessageId`,
+ * so a retry is answered from its receipt instead of being delivered twice.
  */
 import type { AgentSession } from "../../core/agent-session.ts";
+import { ConnectionRoles } from "../rpc/connection-roles.ts";
 import { SessionEventWriter } from "../rpc/session-event-writer.ts";
 import type { ControlConnection } from "./session-control-server.ts";
 export declare class ControlAttachments {
     readonly writer: SessionEventWriter;
+    readonly roles: ConnectionRoles;
+    readonly receipts: Map<string, TerminalInputReceipt>;
     private readonly attached;
     private readonly stopRecords;
     private readonly session;
@@ -21,6 +28,8 @@ export declare class ControlAttachments {
     get handle(): string;
     opened(connection: ControlConnection): void;
     closed(connection: ControlConnection): void;
+    /** Drops this connection's attachment (`release_attachment`); false when it was not attached. */
+    detach(connection: ControlConnection): boolean;
     /** Attaches the connection: it is replayed the in-flight snapshot, then receives the session's records. */
     attach(connection: ControlConnection): boolean;
     isAttached(connection: ControlConnection): boolean;
@@ -30,6 +39,17 @@ export declare class ControlAttachments {
     dispose(): void;
     private entryView;
 }
+/** The receipt a terminal answers an input sent with a `clientMessageId` with, and answers again on a retry. */
+export interface TerminalInputReceipt {
+    /** What was sent: a retry with the same id and different content is a conflict, as on a host. */
+    readonly fingerprint: string;
+    readonly disposition: "started" | "queued";
+    readonly admission: {
+        readonly clientMessageId: string;
+        readonly durableSessionId: string;
+        readonly disposition: "started" | "queued";
+    };
+}
 /** The writer's id for one control connection. */
 export declare function keyOf(connection: ControlConnection): string;
 //# sourceMappingURL=session-control-attach.d.ts.map

package/dist/modes/interactive/session-control-attach.js

@@ -1,9 +1,12 @@
+import { ConnectionRoles } from "../rpc/connection-roles.js";
 import { SessionEventWriter } from "../rpc/session-event-writer.js";
 import { subscribeSessionRecords } from "../rpc/session-record-stream.js";
 import { sessionRuntimeView } from "../rpc/session-status-source.js";
 export class ControlAttachments {
     constructor(session, pendingQuestions) {
         this.writer = new SessionEventWriter(() => { });
+        this.roles = new ConnectionRoles();
+        this.receipts = new Map();
         this.attached = new Set();
         this.session = session;
         this.writer.status.setSource({
@@ -29,8 +32,18 @@ export class ControlAttachments {
         const key = keyOf(connection);
         if (this.attached.delete(key))
             this.writer.status.publish(this.handle, "detach", "client");
+        this.roles.release(key);
         this.writer.unregisterConnection(key);
     }
+    /** Drops this connection's attachment (`release_attachment`); false when it was not attached. */
+    detach(connection) {
+        const key = keyOf(connection);
+        if (!this.attached.delete(key))
+            return false;
+        this.writer.detachConnectionFromSession(key, this.handle);
+        this.writer.status.publish(this.handle, "detach", "client");
+        return true;
+    }
     /** Attaches the connection: it is replayed the in-flight snapshot, then receives the session's records. */
     attach(connection) {
         const key = keyOf(connection);

package/dist/modes/interactive/session-control-commands.js

@@ -2,14 +2,15 @@
  * The terminal control endpoint's command surface. It answers who it is, which one session it holds
  * and that session's state and messages, renames it, streams its feed, wakes its inbox drain, relays
  * an answer to a question the session itself asked, and applies the pane's own session controls (a
- * model, a thinking level, an interrupt - `session-control-session-commands.ts`). Nothing here can
- * prompt, steer, queue a follow-up, open a session or run a command - one delivery authority (the
- * registrant's drain) applies messages, through admission, and only there. Every other command is
- * answered `unsupported` as data; `get_protocol_info` lists the accepted ones in `commands`.
+ * model, a thinking level, an interrupt - `session-control-session-commands.ts`), and serves the host's
+ * observe-and-drive set over its one session (`session-control-rpc-commands.ts`, senpi#3229, senpi#4267). Input
+ * goes through the session's admission and only there. Every other command is answered `unsupported` as data;
+ * `get_protocol_info` lists the accepted ones in `commands`.
  */
 import { VERSION } from "../../config.js";
 import { engineBuildIdentity } from "../../core/engine-build-identity.js";
-import { SESSION_STATUS_CAPABILITY } from "../rpc/custom-capability.js";
+import { ENTRIES_TAIL_CAPABILITY, OBSERVE_READS_CAPABILITY, SESSION_STATUS_CAPABILITY, TUI_OBSERVER_CAPABILITY, } from "../rpc/custom-capability.js";
+import { answerGetEntries } from "../rpc/get-entries-command.js";
 import { answeredUiRequestId, settledQuestionStatus, unansweredQuestionIds } from "../rpc/extension-ui-response.js";
 import { buildRpcSessionState } from "../rpc/rpc-session-state.js";
 import { runTuiRpcCommand, TUI_RPC_COMMANDS } from "./session-control-rpc-commands.js";
@@ -21,6 +22,7 @@ const TUI_CONTROL_COMMANDS = [
     "list_sessions",
     "get_state",
     "get_messages",
+    "get_entries",
     "set_session_name",
     "subscribe",
     "wake",
@@ -37,7 +39,13 @@ export async function runControlCommand(context, connection, command) {
             return success(id, type, {
                 protocolVersion: 1,
                 serverVersion: VERSION,
-                capabilities: [TUI_CONTROL_CAPABILITY, SESSION_STATUS_CAPABILITY],
+                capabilities: [
+                    TUI_CONTROL_CAPABILITY,
+                    SESSION_STATUS_CAPABILITY,
+                    TUI_OBSERVER_CAPABILITY,
+                    OBSERVE_READS_CAPABILITY,
+                    ENTRIES_TAIL_CAPABILITY,
+                ],
                 mode: "tui",
                 endpoint_kind: "tui",
                 instanceId: context.instanceId,
@@ -60,6 +68,8 @@ export async function runControlCommand(context, connection, command) {
             });
         case "get_messages":
             return success(id, type, { messages: session.messages });
+        case "get_entries":
+            return answerGetEntries(session, command);
         case "set_session_name": {
             const name = typeof command.name === "string" ? command.name.trim() : "";
             if (name === "")

package/dist/modes/interactive/session-control-registry.d.ts

@@ -3,7 +3,8 @@ import { type HostDaemonPaths } from "../rpc/host-daemon-paths.ts";
  * `<agentDir>/rpc/tui/t-<16hex>.sock`, or - when the agent directory is too deep for `sun_path` -
  * the same name under `/tmp/senpi-rpc-<sha256(agentDir)[:8]>/tui/`. The fallback root is
  * predictable, so it is used only when it is a real directory owned by this user with no group or
- * other access; anything else fails the registration instead of binding into it.
+ * other access; anything else fails the registration instead of binding into it. On win32 the path is only the
+ * logical address (the listener binds a named pipe hashed from it), so it never moves (senpi#4267).
  */
 export declare function resolveTuiSocket(agentDir: string, instanceId: string): Promise<string>;
 export interface TuiRegistryEntry {

package/dist/modes/interactive/session-control-registry.js

@@ -27,12 +27,13 @@ const REGISTRY_LOCK_WAIT_MS = 5_000;
  * `<agentDir>/rpc/tui/t-<16hex>.sock`, or - when the agent directory is too deep for `sun_path` -
  * the same name under `/tmp/senpi-rpc-<sha256(agentDir)[:8]>/tui/`. The fallback root is
  * predictable, so it is used only when it is a real directory owned by this user with no group or
- * other access; anything else fails the registration instead of binding into it.
+ * other access; anything else fails the registration instead of binding into it. On win32 the path is only the
+ * logical address (the listener binds a named pipe hashed from it), so it never moves (senpi#4267).
  */
 export async function resolveTuiSocket(agentDir, instanceId) {
     const name = tuiSocketName(instanceId);
     const primary = join(agentDir, "rpc", "tui", name);
-    if (Buffer.byteLength(primary) <= MAX_SOCKET_PATH_BYTES) {
+    if (process.platform === "win32" || Buffer.byteLength(primary) <= MAX_SOCKET_PATH_BYTES) {
         await makePrivateDirectory(dirname(primary));
         return primary;
     }

package/dist/modes/interactive/session-control-rpc-commands.d.ts

@@ -1,8 +1,10 @@
 import type { AgentSession } from "../../core/agent-session.ts";
 import { type ControlAttachments } from "./session-control-attach.ts";
-import type { ControlCommand, ControlConnection } from "./session-control-server.ts";
-export declare const TUI_RPC_COMMANDS: readonly ["open_session", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "get_effect_status"];
+import { type ControlCommand, type ControlConnection } from "./session-control-server.ts";
+export declare const TUI_RPC_COMMANDS: readonly ["open_session", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "get_effect_status", "set_client_info", "attach_session", "release_attachment", "abort"];
 export interface RpcCommandContext {
+    /** This endpoint's instance id: the `expectedHostInstance` an `attach_session` may name. */
+    readonly instanceId: string;
     readonly session: AgentSession;
     readonly attachments: ControlAttachments;
 }

package/dist/modes/interactive/session-control-rpc-commands.js

@@ -3,16 +3,23 @@
  * attaches by path or id, `subscribe_sessions`/`unsubscribe_sessions` run the host's status stream over
  * this one session, `steer`/`follow_up`/`prompt` go through the session's external admission (the
  * terminal's one delivery authority, so the user's draft still holds them) with the host's `whenIdle`
- * meaning, and `get_effect_status` reads the same effect ledger. A frame this file does not own answers
+ * meaning, and `get_effect_status` reads the same effect ledger. The rest of the host's drive set answers with the
+ * host's contract (senpi#4267): `set_client_info` declares the connection's roles, `attach_session` and
+ * `release_attachment` take and drop a live attachment on the session's identity, `abort` runs the host's effect
+ * path and its role rule (a Stop needs `interactive_user`), and input sent with a `clientMessageId` is answered
+ * with an admission receipt that a retry gets again, marked `replayed`. A frame this file does not own answers
  * `undefined` and falls through to the endpoint's other commands.
  */
 import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
-import { runGetEffectStatus } from "../rpc/effect-commands.js";
+import { CONNECTION_ROLE_FIXED } from "../rpc/connection-roles.js";
+import { INTERACTIVE_USER_CAPABILITY } from "../rpc/custom-capability.js";
+import { runAbort, runGetEffectStatus } from "../rpc/effect-commands.js";
 import { buildRpcSessionState } from "../rpc/rpc-session-state.js";
 import { answerSubscribeSessions, answerUnsubscribeSessions, refusal } from "../rpc/session-status-commands.js";
 import { keyOf } from "./session-control-attach.js";
+import { failure, success } from "./session-control-server.js";
 export const TUI_RPC_COMMANDS = [
     "open_session",
     "subscribe_sessions",
@@ -21,7 +28,13 @@ export const TUI_RPC_COMMANDS = [
     "follow_up",
     "prompt",
     "get_effect_status",
+    "set_client_info",
+    "attach_session",
+    "release_attachment",
+    "abort",
 ];
+/** The host's answer to a Stop from a connection that never declared the user's role (senpi#3811). */
+const STOP_REQUIRES_INTERACTIVE_CLIENT = "stop_requires_interactive_client: declare interactive_user with set_client_info first";
 /** `null` = answered on the writer already; `undefined` = not a command this file owns. */
 export async function runTuiRpcCommand(context, connection, command) {
     switch (command.type) {
@@ -36,6 +49,14 @@ export async function runTuiRpcCommand(context, connection, command) {
             return admitInput(context, command, command.type === "steer" ? "steer" : "followUp", command.whenIdle);
         case "prompt":
             return admitPrompt(context, command);
+        case "set_client_info":
+            return setClientInfo(context, connection, command);
+        case "attach_session":
+            return attachSession(context, connection, command);
+        case "release_attachment":
+            return releaseAttachment(context, connection, command);
+        case "abort":
+            return abort(context, connection, frame(command));
         case "get_effect_status":
             return runGetEffectStatus({
                 session: context.session,
@@ -74,6 +95,68 @@ function openSession(context, connection, command) {
     });
     return null;
 }
+/** Declares this connection's roles, fixed once declared, exactly as on a host; the other fields change nothing here. */
+function setClientInfo(context, connection, command) {
+    const capabilities = command.capabilities;
+    if (capabilities === undefined)
+        return success(command.id, "set_client_info");
+    if (!Array.isArray(capabilities) || !capabilities.every((entry) => typeof entry === "string"))
+        return failure(command.id, "set_client_info", "capabilities must be an array of strings");
+    if (!context.attachments.roles.declare(keyOf(connection), capabilities))
+        return failure(command.id, "set_client_info", CONNECTION_ROLE_FIXED);
+    return success(command.id, "set_client_info");
+}
+/**
+ * A live attachment on the session's identity, as on a host: `sessionId` is this terminal's routing handle,
+ * `durableSessionId` its session id, and `expectedHostInstance`, when sent, this endpoint's instance id. The answer
+ * follows the replay of the in-flight snapshot, then the session's records reach the connection.
+ */
+function attachSession(context, connection, command) {
+    const { session, attachments } = context;
+    const id = idOf(command);
+    if (command.sessionId !== attachments.handle)
+        return refusal(id, "attach_session", "unknown_session", {
+            reason: "this terminal hosts one session and the request names another",
+            action: "attach with this terminal's sessionId from list_sessions",
+        });
+    const instanceMatches = command.expectedHostInstance === undefined || command.expectedHostInstance === context.instanceId;
+    if (command.durableSessionId !== session.sessionId || !instanceMatches)
+        return refusal(id, "attach_session", "session_identity_mismatch", {
+            reason: "durableSessionId or expectedHostInstance does not name this terminal's session",
+            action: "read list_sessions and get_protocol_info again, then attach with their ids",
+        });
+    attachments.run(connection, () => {
+        attachments.attach(connection);
+        attachments.writer.enqueue(attachments.handle, {
+            id: command.id,
+            type: "response",
+            command: "attach_session",
+            success: true,
+            data: { sessionId: attachments.handle, attached: true },
+        });
+    });
+    return null;
+}
+function releaseAttachment(context, connection, command) {
+    if (command.sessionId !== context.attachments.handle || !context.attachments.detach(connection))
+        return refusal(idOf(command), "release_attachment", "session_not_attached", {
+            reason: "this connection is not attached to that session",
+            action: "attach first with attach_session or open_session",
+        });
+    // Nothing outlives the terminal's own attachment, so a release is never deferred.
+    return success(command.id, "release_attachment", { deferred: false });
+}
+/** The host's `abort`: the same effect receipts, and a Stop only from a connection that declared `interactive_user`. */
+async function abort(context, connection, command) {
+    const key = keyOf(connection);
+    if (command.intent === "stop" && !context.attachments.roles.has(key, INTERACTIVE_USER_CAPABILITY))
+        return failure(command.id, "abort", STOP_REQUIRES_INTERACTIVE_CLIENT);
+    const { session } = context;
+    return runAbort({ session, by: { connectionId: key }, sessionId: context.attachments.handle }, command, () => (command.intent === "stop" ? session.stop() : session.abort()).catch((cause) => {
+        // Reported out of band, as on a host; the answer never waits on it.
+        connection.send({ type: "rpc_error", error: String(cause) });
+    }));
+}
 function subscribe(context, connection, command) {
     const { writer } = context.attachments;
     const key = keyOf(connection);
@@ -145,6 +228,22 @@ function admitInput(context, command, deliverAs, whenIdle) {
         });
     const admission = context.session.externalAdmission;
     const clientMessageId = typeof command.clientMessageId === "string" ? command.clientMessageId : undefined;
+    const fingerprint = JSON.stringify([command.type, message, deliverAs, whenIdle ?? null]);
+    const prior = clientMessageId === undefined ? undefined : context.attachments.receipts.get(clientMessageId);
+    if (prior !== undefined) {
+        if (prior.fingerprint !== fingerprint)
+            return refusal(id, command.type, "client_message_id_conflict", {
+                reason: `clientMessageId ${clientMessageId} was already used for different input`,
+                action: "send new input with a new clientMessageId",
+            });
+        return answered(id, command.type, {
+            disposition: prior.disposition,
+            clientMessageId,
+            replayed: true,
+            duplicate: true,
+            admission: prior.admission,
+        });
+    }
     const expected = typeof command.expected_turn_id === "number" ? command.expected_turn_id : admission.turnEpoch;
     const result = admission.admit({
         delivery_id: clientMessageId ?? `tui-rpc-${randomUUID()}`,
@@ -155,12 +254,23 @@ function admitInput(context, command, deliverAs, whenIdle) {
         whenIdle: whenIdle === "start" ? "start" : "queue",
     });
     const identity = clientMessageId === undefined ? {} : { clientMessageId };
+    const admitted = (disposition) => {
+        if (clientMessageId === undefined)
+            return answered(id, command.type, { disposition });
+        const receipt = {
+            fingerprint,
+            disposition,
+            admission: { clientMessageId, durableSessionId: context.session.sessionId, disposition },
+        };
+        context.attachments.receipts.set(clientMessageId, receipt);
+        return answered(id, command.type, { disposition, clientMessageId, admission: receipt.admission });
+    };
     switch (result.kind) {
         case "started":
-            return answered(id, command.type, { disposition: "started", ...identity });
+            return admitted("started");
         case "steered":
         case "queued":
-            return answered(id, command.type, { disposition: "queued", ...identity });
+            return admitted("queued");
         case "already_admitted":
             return answered(id, command.type, { disposition: "queued", duplicate: true, ...identity });
         case "held_draft":

package/dist/modes/interactive/session-control-server.js

@@ -3,13 +3,17 @@
  * (`authenticateSocket`, the handshake every RPC transport shares); a wrong secret is disconnected
  * before a single JSONL line is read. After that it is the RPC framing: one LF-terminated JSON
  * object per request, one response per request carrying its `id`, plus pushed feed events.
+ *
+ * The socket path is the endpoint's logical address on every platform (its secret lives beside it); on win32 the
+ * listener binds the named pipe the host transport derives from that path and the secret (senpi#4267), which is
+ * the address every client already connects to.
  */
 import { chmod } from "node:fs/promises";
 import { createServer } from "node:net";
 import { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS, serializeJsonLine } from "../rpc/jsonl.js";
 import { rpcCommandShapeError } from "../rpc/rpc-input-validation.js";
 import { socketSink } from "../rpc/socket-sink.js";
-import { authenticateSocket } from "../rpc/socket-transport.js";
+import { authenticateSocket, resolveSocketTransportAddress } from "../rpc/socket-transport.js";
 export async function listenControlSocket(socketPath, secret, handlers) {
     const clients = new Set();
     let nextConnection = 0;
@@ -21,13 +25,15 @@ export async function listenControlSocket(socketPath, secret, handlers) {
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
-        server.listen(socketPath, () => {
+        server.listen(resolveSocketTransportAddress(socketPath, process.platform, secret), () => {
             server.off("error", reject);
             resolve();
         });
     });
     server.on("error", (error) => handlers.listenerError(error));
-    await chmod(socketPath, 0o600);
+    // A named pipe has no file to restrict: the secret, 0600 beside the logical path, is its gate.
+    if (process.platform !== "win32")
+        await chmod(socketPath, 0o600);
     return { close: () => closeServer(server, clients) };
 }
 function acceptConnection(socket, id, handlers) {

package/dist/modes/rpc/connection-handler.d.ts

@@ -34,6 +34,7 @@ export interface RpcConnectionOptions {
         hasCapability?: (connectionId: string, capability: string) => boolean;
     };
     bindSecurityPresentation?: (session: AgentSessionRuntime["session"], ui: ExtensionUIContext) => (() => void) | undefined;
+    bindMcpForms?: (session: AgentSessionRuntime["session"], ui: ExtensionUIContext) => (() => void) | undefined | Promise<(() => void) | undefined>;
     /** A worker's internal bridge is gated by its host's actual socket capabilities. */
     workerSecurityBridge?: boolean;
     grantDialogSettled?: (id: string) => void;