@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/modes/rpc/connection-handler.js

@@ -42,13 +42,13 @@ import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
 import { CONNECTION_ROLE_FIXED, ConnectionRoles, roleConnection } from "./connection-roles.js";
-import { AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
+import { AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, ENTRIES_TAIL_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
 import { runAbort, runGetEffectStatus, runQueuedInputChange, runSetModel, runSetThinkingLevel, } from "./effect-commands.js";
 import { EffectLedger } from "./effect-ledger.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
 import { settleExtensionUiResponse } from "./extension-ui-response.js";
-import { currentResponseByteBudget, endEntryWalk, entryPageBounds, holdEntryWalk, pageEntries, } from "./get-entries-page.js";
+import { answerGetEntries } from "./get-entries-command.js";
 import { runHoldInput } from "./held-input-commands.js";
 import { HostSessionControl } from "./host-session-control.js";
 import { createRpcLoginPromptCallbacks } from "./login-prompts.js";
@@ -57,7 +57,7 @@ import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
 import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
-import { RPC_ERROR_ENTRY_NOT_FOUND, RPC_ERROR_EVAL_CELL_NOT_FOUND, RPC_ERROR_EVAL_CELLS_UNAVAILABLE, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_INVALID_EVAL_CELL_REQUEST, RPC_ERROR_MEDIA_NOT_FOUND, RPC_ERROR_MODEL_NOT_FOUND, RPC_ERROR_RESPONSE_TOO_LARGE, STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY, } from "./rpc-types.js";
+import { RPC_ERROR_EVAL_CELL_NOT_FOUND, RPC_ERROR_EVAL_CELLS_UNAVAILABLE, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_INVALID_EVAL_CELL_REQUEST, RPC_ERROR_MEDIA_NOT_FOUND, RPC_ERROR_MODEL_NOT_FOUND, STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY, } from "./rpc-types.js";
 import { runPauseForRun, runResumeForRun } from "./run-hold-commands.js";
 import { availableModelsData, interruptRunningTurn } from "./session-control-actions-data.js";
 import { SessionExtensionUiRequests, sessionDialogRequests } from "./session-extension-ui-requests.js";
@@ -599,6 +599,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         subscribeExtensionEvents();
     };
     const rebindSession = async (deferRefresh = false) => {
+        unbindMcpForms?.();
+        unbindMcpForms = undefined;
         unsubscribeSecurityNotices?.();
         unsubscribeLoadedSurfaces?.();
         unsubscribeExtensionEvents?.();
@@ -673,8 +675,10 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         // reconstruct the session it is bound to. Installing here also drops the
         // previous session's subscription immediately instead of after the bind.
         installSessionSubscriptions();
+        const extensionUi = createExtensionUIContext();
+        unbindMcpForms = await options.bindMcpForms?.(session, extensionUi);
         const refresh = refreshLoadedSurfacesAfter(() => session.bindExtensions({
-            uiContext: createExtensionUIContext(),
+            uiContext: extensionUi,
             mode: "rpc",
             commandContextActions: {
                 waitForIdle: () => session.agent.waitForIdle(),
@@ -867,6 +871,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 TOOL_BARRIER_CAPABILITY,
                                 USER_ACTIVITY_CAPABILITY,
                                 RESUME_SESSION_CAPABILITY,
+                                ENTRIES_TAIL_CAPABILITY,
                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
                                 // Client flags cannot advertise a host guard this classic binding does not run, nor a tool runtime.
@@ -1453,43 +1458,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 const messages = session.getUserMessagesForForking();
                 return success(id, "get_fork_messages", { messages });
             }
-            case "get_entries": {
-                const sessionManager = session.sessionManager;
-                let entries = sessionManager.getEntries();
-                if (command.since !== undefined) {
-                    const sinceIndex = entries.findIndex((e) => e.id === command.since);
-                    if (sinceIndex === -1) {
-                        return error(id, "get_entries", `Entry not found: ${command.since}`, RPC_ERROR_ENTRY_NOT_FOUND);
-                    }
-                    entries = entries.slice(sinceIndex + 1);
-                }
-                const bounds = entryPageBounds(command);
-                if (!bounds.ok)
-                    return error(id, "get_entries", bounds.message, RPC_ERROR_INVALID_ARGUMENT);
-                const page = pageEntries(entries, describeUsageLimitEntry, bounds);
-                // A client walking pages asks again at once; holding the view until the last page spares each page a
-                // full re-read of the file. The hold expires on its own, so a walk the client abandons on an idle
-                // session does not pin the whole history; any other answer lets the view go now.
-                if (bounds.paged && page.hasMore)
-                    holdEntryWalk(session, () => session.releaseFullHistoryView());
-                else {
-                    endEntryWalk(session);
-                    session.releaseFullHistoryView();
-                }
-                const budget = currentResponseByteBudget();
-                if (page.firstEntryBytes > budget) {
-                    return error(id, "get_entries", `Entry ${entries[0]?.id ?? ""} alone is larger than one answer can carry (${budget} bytes), so it cannot be sent over RPC.`, RPC_ERROR_RESPONSE_TOO_LARGE);
-                }
-                if (!bounds.paged && page.hasMore) {
-                    return error(id, "get_entries", `The session history is larger than one answer can carry (${budget} bytes). Read it in pages: pass limit or maxBytes, then since: nextSince until hasMore is false.`, RPC_ERROR_RESPONSE_TOO_LARGE);
-                }
-                return success(id, "get_entries", {
-                    entries: page.entries,
-                    leafId: sessionManager.getLeafId(),
-                    ...(bounds.paged ? { hasMore: page.hasMore } : {}),
-                    ...(page.nextSince === undefined ? {} : { nextSince: page.nextSince }),
-                });
-            }
+            case "get_entries":
+                return answerGetEntries(session, command);
             case "get_tree": {
                 const sessionManager = session.sessionManager;
                 const tree = sessionManager.getTree();
@@ -1752,6 +1722,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         ? subscriptionLimits.subscribe((limits) => eventOutput.enqueueEvent({ type: "subscription_limits", ...limits }))
         : () => { };
     const dispose = async (disposeOptions = {}) => {
+        unbindMcpForms?.();
         grantPresentationAbort.abort();
         detachGrantPresentation?.();
         unsubscribeSecurityNotices?.();
@@ -1777,6 +1748,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     };
     // Perform the initial bind synchronously-scheduled so the handler is ready
     // as soon as the caller awaits `ready`.
+    let unbindMcpForms;
     const ready = rebindSession();
     return {
         ready,

package/dist/modes/rpc/custom-capability.d.ts

@@ -60,6 +60,12 @@ export declare const DETACH_CONNECTION_CAPABILITY = "detach_connection";
  * client's own `set_client_info` and fixed at that first declaration (see `connection-roles.ts`).
  */
 export declare const INTERACTIVE_USER_CAPABILITY = "interactive_user";
+/** `get_state` and `get_entries` accept `observe: true` and then never count as an attachment (senpi#4267). */
+export declare const OBSERVE_READS_CAPABILITY = "observe_reads";
+/** `get_entries` accepts `before` and `tail` and answers `next_before` (senpi#4267). */
+export declare const ENTRIES_TAIL_CAPABILITY = "entries_tail";
+/** A terminal control endpoint serves the host's observe-and-drive command set (senpi#4267). */
+export declare const TUI_OBSERVER_CAPABILITY = "tui_observer";
 /** The connection owns this session as a task child; only it may pause or resume the session for its run (senpi#3811). */
 export declare const TASK_PARENT_CAPABILITY = "task_parent";
 /**

package/dist/modes/rpc/custom-capability.js

@@ -60,6 +60,12 @@ export const DETACH_CONNECTION_CAPABILITY = "detach_connection";
  * client's own `set_client_info` and fixed at that first declaration (see `connection-roles.ts`).
  */
 export const INTERACTIVE_USER_CAPABILITY = "interactive_user";
+/** `get_state` and `get_entries` accept `observe: true` and then never count as an attachment (senpi#4267). */
+export const OBSERVE_READS_CAPABILITY = "observe_reads";
+/** `get_entries` accepts `before` and `tail` and answers `next_before` (senpi#4267). */
+export const ENTRIES_TAIL_CAPABILITY = "entries_tail";
+/** A terminal control endpoint serves the host's observe-and-drive command set (senpi#4267). */
+export const TUI_OBSERVER_CAPABILITY = "tui_observer";
 /** The connection owns this session as a task child; only it may pause or resume the session for its run (senpi#3811). */
 export const TASK_PARENT_CAPABILITY = "task_parent";
 /**

package/dist/modes/rpc/get-entries-command.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The one `get_entries` answer: a host connection and a terminal control endpoint both read history through it, so
+ * the range rules (`since`, `before`), the forward (`limit`) and backward (`tail`, senpi#4267) pages and the byte
+ * budget (senpi#3534) are the same on every surface.
+ */
+import type { AgentSession } from "../../core/agent-session.ts";
+import { type RpcCommand, type RpcResponse } from "./rpc-types.ts";
+type GetEntries = Extract<RpcCommand, {
+    type: "get_entries";
+}>;
+export declare function answerGetEntries(session: AgentSession, command: GetEntries): RpcResponse;
+export {};
+//# sourceMappingURL=get-entries-command.d.ts.map

package/dist/modes/rpc/get-entries-command.js

@@ -0,0 +1,61 @@
+import { describeUsageLimitEntry } from "../../core/retry-fallback/usage-limit.js";
+import { currentResponseByteBudget, endEntryWalk, entryPageBounds, holdEntryWalk, pageEntries, pageEntriesFromEnd, } from "./get-entries-page.js";
+import { RPC_ERROR_ENTRY_NOT_FOUND, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_RESPONSE_TOO_LARGE, } from "./rpc-types.js";
+function refuse(id, message, errorCode) {
+    return { id, type: "response", command: "get_entries", success: false, error: message, errorCode };
+}
+export function answerGetEntries(session, command) {
+    const { id } = command;
+    const sessionManager = session.sessionManager;
+    let entries = sessionManager.getEntries();
+    if (command.before !== undefined) {
+        const beforeIndex = entries.findIndex((e) => e.id === command.before);
+        if (beforeIndex === -1)
+            return refuse(id, `Entry not found: ${command.before}`, RPC_ERROR_ENTRY_NOT_FOUND);
+        entries = entries.slice(0, beforeIndex);
+    }
+    if (command.since !== undefined) {
+        const sinceIndex = sessionManager.getEntries().findIndex((e) => e.id === command.since);
+        if (sinceIndex === -1)
+            return refuse(id, `Entry not found: ${command.since}`, RPC_ERROR_ENTRY_NOT_FOUND);
+        entries = entries.slice(sinceIndex + 1);
+    }
+    const bounds = entryPageBounds(command);
+    if (!bounds.ok)
+        return refuse(id, bounds.message, RPC_ERROR_INVALID_ARGUMENT);
+    const backward = bounds.tail !== undefined;
+    const page = backward
+        ? pageEntriesFromEnd(entries, describeUsageLimitEntry, bounds)
+        : pageEntries(entries, describeUsageLimitEntry, bounds);
+    // A client walking pages asks again at once; holding the view until the last page spares each page a
+    // full re-read of the file. The hold expires on its own, so a walk the client abandons on an idle
+    // session does not pin the whole history; any other answer lets the view go now.
+    if (bounds.paged && page.hasMore)
+        holdEntryWalk(session, () => session.releaseFullHistoryView());
+    else {
+        endEntryWalk(session);
+        session.releaseFullHistoryView();
+    }
+    const budget = currentResponseByteBudget();
+    if (page.firstEntryBytes > budget) {
+        const entry = backward ? entries.at(-1) : entries[0];
+        return refuse(id, `Entry ${entry?.id ?? ""} alone is larger than one answer can carry (${budget} bytes), so it cannot be sent over RPC.`, RPC_ERROR_RESPONSE_TOO_LARGE);
+    }
+    if (!bounds.paged && page.hasMore) {
+        return refuse(id, `The session history is larger than one answer can carry (${budget} bytes). Read it in pages: pass limit or maxBytes, then since: nextSince until hasMore is false.`, RPC_ERROR_RESPONSE_TOO_LARGE);
+    }
+    return {
+        id,
+        type: "response",
+        command: "get_entries",
+        success: true,
+        data: {
+            entries: page.entries,
+            leafId: sessionManager.getLeafId(),
+            ...(bounds.paged ? { hasMore: page.hasMore } : {}),
+            ...("nextSince" in page && page.nextSince !== undefined ? { nextSince: page.nextSince } : {}),
+            ...("nextBefore" in page && page.nextBefore !== undefined ? { next_before: page.nextBefore } : {}),
+        },
+    };
+}
+//# sourceMappingURL=get-entries-command.js.map

package/dist/modes/rpc/get-entries-page.d.ts

@@ -14,6 +14,8 @@ export declare function currentResponseByteBudget(): number;
 export declare function setResponseByteBudgetForTesting(bytes: number): () => void;
 export interface EntryPageRequest {
     readonly limit?: number;
+    /** The newest `tail` entries of the range, read backwards (senpi#4267); never combined with `limit`. */
+    readonly tail?: number;
     readonly maxBytes?: number;
 }
 export interface EntryPage<T> {
@@ -27,6 +29,7 @@ export type EntryPageBounds = {
     readonly ok: true;
     readonly paged: boolean;
     readonly limit?: number;
+    readonly tail?: number;
     readonly maxBytes: number;
 } | {
     readonly ok: false;
@@ -44,6 +47,25 @@ export declare function pageEntries<S extends {
     readonly limit?: number;
     readonly maxBytes: number;
 }): EntryPage<T>;
+export interface TailEntryPage<T> {
+    /** In append order: the oldest of the page first. */
+    readonly entries: T[];
+    readonly hasMore: boolean;
+    /** The oldest entry id the page returned, while older entries remain: pass it as the next `before`. */
+    readonly nextBefore?: string;
+    /** Serialized size of the page's newest entry (0 for an empty page). */
+    readonly firstEntryBytes: number;
+}
+/**
+ * The newest entries first, until the count or the byte size would pass the bounds, answered in append order. The
+ * newest entry is always taken, so a backward walk always moves even when one entry alone is larger than `maxBytes`.
+ */
+export declare function pageEntriesFromEnd<S extends {
+    readonly id: string;
+}, T>(entries: readonly S[], project: (entry: S) => T, bounds: {
+    readonly tail?: number;
+    readonly maxBytes: number;
+}): TailEntryPage<T>;
 /**
  * Keeps a page walk's full-history view for the next page, and lets it go after `ENTRY_WALK_HOLD_MS` without
  * one: a client that stops mid-walk must not pin the whole history of a session that is already idle.

package/dist/modes/rpc/get-entries-page.js

@@ -22,17 +22,22 @@ export function setResponseByteBudgetForTesting(bytes) {
     };
 }
 export function entryPageBounds(request) {
-    const { limit, maxBytes } = request;
+    const { limit, tail, maxBytes } = request;
     if (limit !== undefined && !(Number.isInteger(limit) && limit > 0))
         return { ok: false, message: "limit must be a positive integer" };
+    if (tail !== undefined && !(Number.isInteger(tail) && tail > 0))
+        return { ok: false, message: "tail must be a positive integer" };
+    if (limit !== undefined && tail !== undefined)
+        return { ok: false, message: "limit and tail cannot be combined: limit pages forward, tail backward" };
     if (maxBytes !== undefined && !(Number.isInteger(maxBytes) && maxBytes > 0))
         return { ok: false, message: "maxBytes must be a positive integer" };
-    if (limit === undefined && maxBytes === undefined)
+    if (limit === undefined && tail === undefined && maxBytes === undefined)
         return { ok: true, paged: false, maxBytes: responseByteBudget };
     return {
         ok: true,
         paged: true,
         ...(limit === undefined ? {} : { limit }),
+        ...(tail === undefined ? {} : { tail }),
         maxBytes: Math.min(maxBytes ?? DEFAULT_ENTRY_PAGE_BYTES, responseByteBudget),
     };
 }
@@ -68,6 +73,40 @@ export function pageEntries(entries, project, bounds) {
         firstEntryBytes,
     };
 }
+/**
+ * The newest entries first, until the count or the byte size would pass the bounds, answered in append order. The
+ * newest entry is always taken, so a backward walk always moves even when one entry alone is larger than `maxBytes`.
+ */
+export function pageEntriesFromEnd(entries, project, bounds) {
+    const page = [];
+    let bytes = 0;
+    let firstEntryBytes = 0;
+    let index = entries.length - 1;
+    for (; index >= 0; index--) {
+        if (bounds.tail !== undefined && page.length >= bounds.tail)
+            break;
+        const entry = entries[index];
+        if (entry === undefined)
+            break;
+        const projected = project(entry);
+        const size = Buffer.byteLength(JSON.stringify(projected)) + 1;
+        if (page.length > 0 && bytes + size > bounds.maxBytes)
+            break;
+        if (page.length === 0)
+            firstEntryBytes = size;
+        page.push(projected);
+        bytes += size;
+    }
+    page.reverse();
+    const oldest = entries[index + 1];
+    const hasMore = index >= 0;
+    return {
+        entries: page,
+        hasMore,
+        ...(hasMore && oldest !== undefined ? { nextBefore: oldest.id } : {}),
+        firstEntryBytes,
+    };
+}
 const heldWalks = new WeakMap();
 /**
  * Keeps a page walk's full-history view for the next page, and lets it go after `ENTRY_WALK_HOLD_MS` without

package/dist/modes/rpc/host-capabilities.d.ts

@@ -14,5 +14,6 @@ export declare function multiSessionHostCapabilities(options: {
     readonly warm: boolean;
     readonly toolRuntime: ToolRuntimeKind;
     readonly negotiated: readonly string[];
+    readonly mcpPresenters?: boolean;
 }): string[];
 //# sourceMappingURL=host-capabilities.d.ts.map

package/dist/modes/rpc/host-capabilities.js

@@ -1,7 +1,7 @@
 import { isHostOwnedToolRuntimeCapability, toolRuntimeCapabilities, } from "../../cli/tool-runtime.js";
 import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPABILITY, } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
-import { ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, ENTRIES_TAIL_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, OBSERVE_READS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY } from "./rpc-types.js";
 import { MOVE_SESSION_CAPABILITY, MOVE_SESSION_REVOKE_CAPABILITY } from "./session-move-wire.js";
@@ -20,6 +20,7 @@ export function multiSessionHostCapabilities(options) {
     return [
         ...new Set([
             "multi_session",
+            ...(options.mcpPresenters ? ["mcp_form_presenter_v1"] : []),
             "session_lifecycle",
             "expected_host_instance",
             "attach_session",
@@ -43,6 +44,9 @@ export function multiSessionHostCapabilities(options) {
             SESSION_HELD_CAPABILITY,
             RESUME_SESSION_CAPABILITY,
             ATTENDED_CAPABILITY,
+            // `get_state`/`get_entries` marked `observe` never attach, and history reads page backward too (senpi#4267).
+            OBSERVE_READS_CAPABILITY,
+            ENTRIES_TAIL_CAPABILITY,
             // Host capabilities, not client opt-ins: only a multi-session host owns the
             // attachment refcount `open_session.retain_on_disconnect` detaches from, the
             // per-session launch profile `context`/`auto_title` travel on, and the session
@@ -80,7 +84,7 @@ export function multiSessionHostCapabilities(options) {
             ...(options.warm ? [WARM_CAPABILITY] : []),
             ...toolRuntimeCapabilities(options.toolRuntime),
             // The host alone says where tool work runs; a negotiated copy would make two answers.
-            ...options.negotiated.filter((capability) => !isHostOwnedToolRuntimeCapability(capability)),
+            ...options.negotiated.filter((capability) => capability !== "mcp_form_presenter_v1" && !isHostOwnedToolRuntimeCapability(capability)),
         ]),
     ];
 }

package/dist/modes/rpc/host-ensure-start.js

@@ -17,6 +17,7 @@ import { pollProtocolInfo } from "./host-readiness.js";
 import { initialHostEnvironment } from "./host-spawn-environment.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
 import { createSocketSecret, socketSecretPath } from "./socket-transport.js";
+import { relayPresenterBootstrap } from "./mcp-presenter-bootstrap.js";
 export const DEFAULT_READINESS_TIMEOUT_MS = 10_000;
 export { DEFAULT_STOP_TIMEOUT_MS };
 /**
@@ -55,11 +56,13 @@ export async function startHost(paths, socket, options, generation = 0) {
     let child;
     let exitedEarly;
     let childExit;
+    let presenterEnrollment;
     try {
         const supervisorArgs = [
             "--socket",
             socket,
             ...(options.owner ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
+            ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = testOptions?.spawn ?? testOptions?.launch?.(supervisorArgs) ?? defaultHostLaunch(supervisorArgs);
@@ -73,8 +76,14 @@ export async function startHost(paths, socket, options, generation = 0) {
                 instanceId,
                 generation,
             }),
-            stdio: options.owner ? ["ignore", "ignore", stderr.fd, "pipe"] : ["ignore", "ignore", stderr.fd],
+            stdio: options.presenterBootstrap
+                ? ["ignore", "ignore", stderr.fd, options.owner ? "pipe" : "ignore", "pipe"]
+                : options.owner
+                    ? ["ignore", "ignore", stderr.fd, "pipe"]
+                    : ["ignore", "ignore", stderr.fd],
         });
+        if (options.presenterBootstrap)
+            presenterEnrollment = relayPresenterBootstrap(options.presenterBootstrap, child);
         childExit = new Promise((resolveExit) => {
             child.once("exit", (code, signal) => {
                 exitedEarly = { code, signal };
@@ -140,8 +149,10 @@ export async function startHost(paths, socket, options, generation = 0) {
     }
     const readinessTimeoutMs = testOptions?.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS;
     const result = await pollProtocolInfo(socket, readinessTimeoutMs, isCompatible, childExit);
-    if (result.ready)
+    if (result.ready) {
+        await presenterEnrollment;
         return { pid: pidFile.pid, socket, reused: false, release: result.hold.release };
+    }
     await testOptions?.beforeReadinessTeardown?.();
     // Teardown runs for the diagnostic's sake, so it must never replace it: a stop failure here
     // (unreadable identity, a host that outlives SIGKILL) would otherwise propagate instead of the

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -1,5 +1,6 @@
 /** The options and result of `ensureHost`, kept apart so the ensure's helpers can name them without a cycle. */
 import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
+import type { Duplex } from "node:stream";
 /**
  * What an ensure may do to a host that is already running.
  *
@@ -10,6 +11,7 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
  */
 export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
+    readonly presenterBootstrap?: Duplex;
     readonly socket: string;
     readonly agentDir?: string;
     readonly keyRoot?: string;

package/dist/modes/rpc/host-ensure.js

@@ -205,6 +205,7 @@ async function upgradeGeneration(paths, socket, options, attachedPid) {
         socket,
         agentDir: options.agentDir ?? getAgentDir(),
         hostArgs: options.hostArgs ?? [],
+        presenterBootstrap: options.presenterBootstrap,
         ...(options.env ? { env: options.env } : {}),
         ...(options.policy ? { policy: options.policy } : {}),
         _test: {

package/dist/modes/rpc/host-handoff.d.ts

@@ -1,3 +1,4 @@
+import type { Duplex } from "node:stream";
 import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
 /**
  * The longest a handoff holds the ensure lock: its probe of the running host, the two session counts
@@ -5,6 +6,7 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
  */
 export declare const HANDOFF_LOCK_HOLD_MS: number;
 export interface HandoffHostOptions {
+    readonly presenterBootstrap?: Duplex;
     readonly socket: string;
     readonly agentDir?: string;
     /** Extra CLI arguments the successor's host child is launched with (provider pinning, extensions). */

package/dist/modes/rpc/host-handover-wire.d.ts

@@ -9,6 +9,7 @@
 import type { HandoverAnswer, HandoverOutcome, HandoverView, IdleHandoverRequest } from "./host-idle-handover.ts";
 import type { RpcResponse } from "./rpc-types.ts";
 import type { RpcSessionRegistry } from "./session-registry.ts";
+import type { Duplex } from "node:stream";
 export declare const BEGIN_HANDOVER_COMMAND = "begin_handover";
 export declare function parseBeginHandover(record: Readonly<Record<string, unknown>>): IdleHandoverRequest | string;
 export declare function beginHandoverResponse(id: unknown, answer: HandoverAnswer | string): Record<string, unknown>;
@@ -37,5 +38,6 @@ export declare function performIdleHandover(context: {
     readonly request: IdleHandoverRequest;
     readonly socket: string;
     readonly agentDir: string;
+    readonly presenterBootstrap?: Duplex;
 }): Promise<HandoverOutcome>;
 //# sourceMappingURL=host-handover-wire.d.ts.map

package/dist/modes/rpc/host-handover-wire.js

@@ -120,6 +120,7 @@ export async function performIdleHandover(context) {
         env[name] = null;
     Object.assign(env, request.env);
     const result = await handoffHost({
+        presenterBootstrap: context.presenterBootstrap,
         socket,
         agentDir,
         hostArgs: request.hostArgs,

package/dist/modes/rpc/host-lifecycle-launch.d.ts

@@ -6,6 +6,7 @@
 import { type ChildProcess } from "node:child_process";
 import type { SocketFileIdentity } from "./socket-ownership.ts";
 export interface SupervisorLaunch {
+    readonly presenterBootstrapFd?: number;
     readonly socket: string;
     readonly hostArgs: readonly string[];
     /** Optional runtime command used by rebranded/bundled callers. */

package/dist/modes/rpc/host-lifecycle-launch.js

@@ -56,10 +56,16 @@ export function parseSupervisorArgs(argv) {
     let childArgs;
     let agentDir;
     let ownerFd;
+    let presenterBootstrapFd;
     let bindSocket;
     let replaceIdentity;
     for (let index = 0; index < argv.length; index++) {
         const arg = argv[index];
+        if (arg === "--mcp-presenter-fd" && argv[index + 1] === "4") {
+            presenterBootstrapFd = 4;
+            index++;
+            continue;
+        }
         if (arg === "--owner-fd" && index + 1 < argv.length) {
             ownerFd = Number(argv[++index]);
             if (!Number.isSafeInteger(ownerFd) || ownerFd < 3)
@@ -101,7 +107,19 @@ export function parseSupervisorArgs(argv) {
     }
     return socket === undefined
         ? undefined
-        : { socket, hostArgs, childCommand, childArgs, agentDir, ownerFd, bindSocket, replaceIdentity };
+        : ownerFd === presenterBootstrapFd && ownerFd !== undefined
+            ? undefined
+            : {
+                socket,
+                hostArgs,
+                childCommand,
+                childArgs,
+                agentDir,
+                ownerFd,
+                bindSocket,
+                replaceIdentity,
+                presenterBootstrapFd,
+            };
 }
 export const OWNER_WATCH_FD = 3;
 // Strongly retain the write end until that supervisor exits, but never keep the caller alive.
@@ -188,6 +206,10 @@ export const HOST_CHILD_WATCH_FD = 3;
 export function spawnHostChild(options) {
     const { launch, internalSocket, internal, internalSecret, publicSocket } = options;
     const childLaunch = spawnableChildLaunch(resolveHostChildLaunch(launch, internalSocket));
+    // A shell wrapper cannot prove preservation of the private inherited handle.
+    const bootstrap = launch.presenterBootstrapFd !== undefined && !childLaunch.shell;
+    if (bootstrap)
+        childLaunch.args.push("--mcp-presenter-fd", "4");
     const child = spawn(childLaunch.command, childLaunch.args, {
         env: {
             ...process.env,
@@ -210,13 +232,32 @@ export function spawnHostChild(options) {
         // Slot 3 is the lifetime pipe: "pipe" gives the child a read end it can
         // wait on and keeps the write end owned by this process alone.
         shell: childLaunch.shell,
-        stdio: [process.platform === "win32" ? "ignore" : "pipe", "ignore", "inherit", "pipe"],
+        stdio: [
+            process.platform === "win32" ? "ignore" : "pipe",
+            "ignore",
+            "inherit",
+            "pipe",
+            ...(bootstrap ? ["pipe"] : []),
+        ],
         // The supervisor is spawned detached, so on win32 it owns no console. A
         // console-subsystem child started from it would allocate a fresh one,
         // which Windows Terminal renders as an empty window that takes focus.
         // CREATE_NO_WINDOW gives the child a console with no window instead.
         windowsHide: true,
     });
+    if (launch.presenterBootstrapFd !== undefined) {
+        const fd = launch.presenterBootstrapFd;
+        // The opt-in helper stays outside the supervisor's fixed startup import budget.
+        void import("./mcp-presenter-bootstrap.js")
+            .then(({ presenterBootstrapStream, relayPresenterBootstrap }) => {
+            const upstream = presenterBootstrapStream(fd);
+            if (upstream && bootstrap)
+                return relayPresenterBootstrap(upstream, child);
+            upstream?.destroy();
+            child.stdio[4]?.destroy();
+        })
+            .catch(() => child.stdio[4]?.destroy());
+    }
     if (options.internalKey) {
         child.stdin?.on("error", () => { });
         // One write only. Keep its write end alive until this supervisor exits.

package/dist/modes/rpc/host-observe-request.d.ts

@@ -7,7 +7,8 @@
  * itself with `observe: true`; the supervisor classifies a connection by the requests it sends, and
  * only a connection that sends something other than an observing read becomes an attachment.
  *
- * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing): `observe: true` on any other command is ignored
+ * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing; `get_state` and
+ * `get_entries` read a session's state and history, senpi#4267): `observe: true` on any other command is ignored
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).

package/dist/modes/rpc/host-observe-request.js

@@ -7,7 +7,8 @@
  * itself with `observe: true`; the supervisor classifies a connection by the requests it sends, and
  * only a connection that sends something other than an observing read becomes an attachment.
  *
- * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing): `observe: true` on any other command is ignored
+ * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing; `get_state` and
+ * `get_entries` read a session's state and history, senpi#4267): `observe: true` on any other command is ignored
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).
@@ -33,6 +34,8 @@ const OBSERVING_COMMANDS = new Set([
     "get_effect_status",
     "get_pending_inputs",
     "get_subscription_limits",
+    "get_state",
+    "get_entries",
 ]);
 export function isObservingRequest(line) {
     let request;

package/dist/modes/rpc/host-runner.d.ts

@@ -5,6 +5,7 @@ import type { ResolvedHostLaunchSpec } from "./host-launch-spec.ts";
 import { type HostOutcome } from "./host-outcome.ts";
 import type { HostStopGeneration } from "./host-stop-generation.ts";
 export { HOST_EXIT_ERROR, HOST_EXIT_FALLBACK, HOST_EXIT_OK, HOST_EXIT_REFUSED, HOST_EXIT_USAGE, type HostOutcome, } from "./host-outcome.ts";
+import type { Duplex } from "node:stream";
 /** Which daemon a request is about: the endpoint, and the agent directory holding its state. */
 export interface HostTarget {
     readonly socket: string;
@@ -50,5 +51,6 @@ export type HostRequest = {
 };
 export declare function runHostRequest(request: HostRequest, options?: {
     readonly keyRoot?: string;
+    readonly presenterBootstrap?: Duplex;
 }): Promise<HostOutcome>;
 //# sourceMappingURL=host-runner.d.ts.map