@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/modes/rpc/host-runner.js

@@ -37,9 +37,9 @@ import { hostRequestKeyRoot } from "./host-request-key-root.js";
 import { withRpcKeyRoot } from "./rpc-auth-client.js";
 const PROBE_TIMEOUT_MS = 10_000;
 export async function runHostRequest(request, options = {}) {
-    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request));
+    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap));
 }
-async function runHostRequestInKeyRoot(request) {
+async function runHostRequestInKeyRoot(request, presenterBootstrap) {
     if (request.action === "ensure" || request.action === "handoff" || request.action === "stop") {
         const { socket, agentDir } = request.target;
         if ((await endpointKindOfSocket(socket, agentDir)) === "tui") {
@@ -48,7 +48,7 @@ async function runHostRequestInKeyRoot(request) {
     }
     switch (request.action) {
         case "ensure":
-            return ensureOutcome(request.target, request.spec, request.policy);
+            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap);
         case "status":
             return request.all === true
                 ? statusAllOutcome(request.target, request.includeWorkers)
@@ -57,7 +57,7 @@ async function runHostRequestInKeyRoot(request) {
             return stopOutcome(request);
         case "handoff":
             return request.handover === undefined
-                ? handoffOutcome(request.target, request.spec)
+                ? handoffOutcome(request.target, request.spec, presenterBootstrap)
                 : idleHandoverOutcome(request.target, request.spec, request.handover);
         case "shard_path":
             return shardPathOutcome(request.kind, request.owner, request.root);
@@ -70,7 +70,7 @@ async function runHostRequestInKeyRoot(request) {
             return assertNever(request);
     }
 }
-async function ensureOutcome(target, spec, policy) {
+async function ensureOutcome(target, spec, policy, presenterBootstrap) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     if (policy === "fallback") {
         // `fallback` is the caller saying it can live without a host. The decision is made HERE
@@ -84,6 +84,7 @@ async function ensureOutcome(target, spec, policy) {
     try {
         ensured = await ensureHost({
             socket: target.socket,
+            presenterBootstrap,
             agentDir: target.agentDir,
             hostArgs: spec.hostArgs,
             env: daemonEnvOverrides(process.env, spec.env),
@@ -181,10 +182,11 @@ async function stopOutcome(request) {
         },
     };
 }
-async function handoffOutcome(target, spec) {
+async function handoffOutcome(target, spec, presenterBootstrap) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     const result = await handoffHost({
         socket: target.socket,
+        presenterBootstrap,
         agentDir: target.agentDir,
         hostArgs: spec.hostArgs,
         env: daemonEnvOverrides(process.env, spec.env),

package/dist/modes/rpc/host-successor.js

@@ -28,6 +28,7 @@ import { defaultHostLaunch, PINNED_HOST_CLIENT_CAPABILITIES } from "./host-launc
 import { DEFAULT_HOST_IDLE_EXIT_MS } from "./host-lifecycle.js";
 import { keepOwnerPipe, OWNER_WATCH_FD } from "./host-lifecycle-launch.js";
 import { probeProtocolInfo } from "./host-probe.js";
+import { relayPresenterBootstrap } from "./mcp-presenter-bootstrap.js";
 import { successorHostEnvironment } from "./host-spawn-environment.js";
 import { signalGeneration } from "./host-stop.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
@@ -81,6 +82,7 @@ export async function startSuccessor(context) {
             "--replace",
             `${replaced.dev}:${replaced.ino}`,
             ...(inheritOwnerPipe ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
+            ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = (options._test?.launch ?? options.launch)?.(argv) ?? defaultHostLaunch(argv);
@@ -96,8 +98,15 @@ export async function startSuccessor(context) {
                 generation,
                 instanceId,
             }),
-            stdio: inheritOwnerPipe ? ["ignore", "ignore", stderr.fd, "pipe"] : ["ignore", "ignore", stderr.fd],
+            stdio: options.presenterBootstrap
+                ? ["ignore", "ignore", stderr.fd, inheritOwnerPipe ? "pipe" : "ignore", "pipe"]
+                : inheritOwnerPipe
+                    ? ["ignore", "ignore", stderr.fd, "pipe"]
+                    : ["ignore", "ignore", stderr.fd],
         });
+        const presenterEnrollment = options.presenterBootstrap
+            ? relayPresenterBootstrap(options.presenterBootstrap, spawned)
+            : undefined;
         child = spawned;
         exited = new Promise((resolve) => spawned.once("exit", () => resolve()));
         await stderr.close();
@@ -135,6 +144,7 @@ export async function startSuccessor(context) {
         // clients reach is still the predecessor, and the pointer has to name whoever owns the socket.
         await options._test?.beforeRegistration?.();
         await writeHostRegistration(paths, { ...registration, ...successorBuild(answer) });
+        await presenterEnrollment;
         child.unref();
         // The successor owns the socket now: the predecessor may drain. SIGUSR1 is sent only here,
         // to a pid the record proved and a host that advertised it can survive the signal. A

package/dist/modes/rpc/mcp-form-dialog.d.ts

@@ -0,0 +1,45 @@
+import type { McpFormInput, McpFormOutcome, McpFormRequest, McpFormResolved } from "../../core/mcp-form-types.ts";
+export interface McpFormClock {
+    now(): number;
+    schedule(callback: () => void, delay: number): object;
+    cancel(timer: object): void;
+}
+export declare const mcpFormClock: McpFormClock;
+type Termination = "presentation_lost" | "presentation_timeout" | "operation_aborted";
+export type McpPresenterReply = {
+    readonly ok: true;
+    readonly form?: McpFormRequest;
+} | {
+    readonly error: "presenter_not_authorized" | "invalid_form_response" | "form_stale" | "form_expired";
+};
+/** One private entry. Lifecycle closures retain this object even after its grant is removed. */
+export declare class McpFormDialog {
+    readonly result: Promise<McpFormOutcome>;
+    readonly deadline: number;
+    private stage;
+    private request;
+    private readonly token;
+    private readonly cleanups;
+    private resolve;
+    private readonly input;
+    private readonly context;
+    constructor(input: McpFormInput, context: {
+        readonly clock: McpFormClock;
+        readonly envelope: Omit<McpFormRequest, "type" | "server" | "message" | "schema" | "deadlineAtMs" | "dialogToken">;
+        readonly current: () => boolean;
+        readonly remove: () => void;
+        readonly admit: () => void;
+        readonly send: (frame: McpFormRequest | McpFormResolved) => boolean;
+    });
+    start(): void;
+    sync(): McpFormRequest | undefined;
+    matches(token: string, revision: string): boolean;
+    presented(): McpPresenterReply;
+    respond(action: string, content: unknown): McpPresenterReply;
+    /** Internal-only: never called with a cause or entry reference decoded from RPC. */
+    terminate(cause: Termination): void;
+    private live;
+    private commit;
+}
+export {};
+//# sourceMappingURL=mcp-form-dialog.d.ts.map

package/dist/modes/rpc/mcp-form-dialog.js

@@ -0,0 +1,159 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { validMcpFormContent } from "../../core/extensions/builtin/mcp/modern/form-schema.js";
+export const mcpFormClock = {
+    now: () => performance.now(),
+    schedule: (callback, delay) => setTimeout(callback, delay),
+    cancel: (timer) => {
+        if ("close" in timer && typeof timer.close === "function")
+            timer.close();
+    },
+};
+/** One private entry. Lifecycle closures retain this object even after its grant is removed. */
+export class McpFormDialog {
+    constructor(input, context) {
+        this.stage = "prepared";
+        this.token = randomBytes(32);
+        this.cleanups = [];
+        this.resolve = () => { };
+        this.input = input;
+        this.context = context;
+        this.deadline = context.clock.now() + Math.max(0, input.deadlineMs);
+        this.result = new Promise((resolve) => {
+            this.resolve = resolve;
+        });
+        this.request = {
+            ...context.envelope,
+            type: "mcp_form_request",
+            dialogToken: this.token.toString("hex"),
+            server: structuredClone(input.server),
+            message: input.message,
+            schema: structuredClone(input.schema),
+            deadlineAtMs: Date.now() + Math.max(0, input.deadlineMs),
+        };
+    }
+    start() {
+        const watch = (signal, cause) => {
+            const stop = () => this.terminate(cause);
+            signal.addEventListener("abort", stop, { once: true });
+            this.cleanups.push(() => signal.removeEventListener("abort", stop));
+            if (signal.aborted)
+                stop();
+        };
+        watch(this.input.operationSignal, "operation_aborted");
+        watch(this.input.presentationSignal, "presentation_lost");
+        if (this.stage === "settled") {
+            for (const cleanup of this.cleanups.splice(0))
+                cleanup();
+            return;
+        }
+        const timer = this.context.clock.schedule(() => this.terminate("presentation_timeout"), this.input.deadlineMs);
+        this.cleanups.push(() => this.context.clock.cancel(timer));
+        if (!this.context.current() || !this.request || !this.context.send(this.request))
+            this.terminate("presentation_lost");
+    }
+    sync() {
+        if (!this.live())
+            return undefined;
+        return this.request === undefined ? undefined : structuredClone(this.request);
+    }
+    matches(token, revision) {
+        return (this.request?.formRevision === revision &&
+            /^[a-f0-9]{64}$/.test(token) &&
+            timingSafeEqual(this.token, Buffer.from(token, "hex")));
+    }
+    presented() {
+        if (!this.live())
+            return { error: "form_expired" };
+        this.stage = "presented";
+        return { ok: true };
+    }
+    respond(action, content) {
+        if (!this.live())
+            return { error: "form_expired" };
+        if (this.stage !== "presented" || !this.request)
+            return { error: "invalid_form_response" };
+        let result;
+        switch (action) {
+            case "accept":
+                if (!validMcpFormContent(this.request.schema, content) ||
+                    Buffer.byteLength(JSON.stringify(content)) > 1024 * 1024)
+                    return { error: "invalid_form_response" };
+                result = { action, content: structuredClone(content) };
+                break;
+            case "decline":
+            case "cancel":
+                if (content !== undefined)
+                    return { error: "invalid_form_response" };
+                result = { action };
+                break;
+            default:
+                return { error: "invalid_form_response" };
+        }
+        if (!this.live())
+            return { error: "form_expired" };
+        this.commit({ kind: "result", result, source: "presenter_action", humanAdmission: true });
+        return { ok: true };
+    }
+    /** Internal-only: never called with a cause or entry reference decoded from RPC. */
+    terminate(cause) {
+        const provenance = { source: "host_termination", humanAdmission: false };
+        if (cause === "operation_aborted" ||
+            this.input.operationSignal.aborted ||
+            this.input.operationCurrent?.() === false) {
+            this.commit({ kind: "operation_aborted", ...provenance });
+        }
+        else if (this.stage === "presented") {
+            this.commit({ kind: "result", result: { action: "cancel" }, ...provenance });
+        }
+        else {
+            this.commit({ kind: "processing_failure", ...provenance });
+        }
+    }
+    live() {
+        if (this.stage === "settled")
+            return false;
+        if (this.input.operationSignal.aborted || this.input.operationCurrent?.() === false) {
+            this.terminate("operation_aborted");
+            return false;
+        }
+        if (this.context.clock.now() >= this.deadline || !this.context.current()) {
+            this.terminate("presentation_timeout");
+            return false;
+        }
+        return true;
+    }
+    commit(outcome) {
+        if (this.stage === "settled")
+            return;
+        this.stage = "settled";
+        const request = this.request;
+        this.request = undefined;
+        this.token.fill(0);
+        this.context.remove();
+        for (const cleanup of this.cleanups.splice(0))
+            cleanup();
+        // No callback, promise resolution or admission precedes the synchronous terminal claim.
+        if (outcome.humanAdmission)
+            this.context.admit();
+        this.resolve(outcome);
+        if (request && this.context.current()) {
+            const reason = outcome.kind === "result"
+                ? outcome.result.action === "accept"
+                    ? "answered"
+                    : outcome.result.action === "decline"
+                        ? "declined"
+                        : "cancelled"
+                : outcome.kind === "operation_aborted"
+                    ? "operation_aborted"
+                    : "processing_failed";
+            this.context.send({
+                type: "mcp_form_resolved",
+                sessionId: request.sessionId,
+                grantId: request.grantId,
+                dialogId: request.dialogId,
+                reason,
+            });
+        }
+    }
+}
+//# sourceMappingURL=mcp-form-dialog.js.map

package/dist/modes/rpc/mcp-form-worker.d.ts

@@ -0,0 +1,14 @@
+import type { HostToSessionWorker, SessionWorkerToHost } from "./session-worker-protocol.ts";
+/** Private worker messages never pass through WorkerEventWriter.enqueue or a snapshot. */
+export declare class McpFormWorker {
+    private readonly send;
+    private readonly binds;
+    private readonly ready;
+    private readonly settlements;
+    private readonly bindings;
+    private readonly entries;
+    constructor(send: (message: SessionWorkerToHost) => void);
+    bind(durableId: string, ui: object, admit: () => void): Promise<() => void>;
+    receive(message: HostToSessionWorker): boolean;
+}
+//# sourceMappingURL=mcp-form-worker.d.ts.map

package/dist/modes/rpc/mcp-form-worker.js

@@ -0,0 +1,167 @@
+import { randomUUID } from "node:crypto";
+import { bindPrivateMcpForms } from "../../core/mcp-form-types.js";
+/** Private worker messages never pass through WorkerEventWriter.enqueue or a snapshot. */
+export class McpFormWorker {
+    constructor(send) {
+        this.binds = new Map();
+        this.ready = new Map();
+        this.settlements = new Set();
+        this.bindings = new Map();
+        this.entries = new Map();
+        this.send = send;
+    }
+    async bind(durableId, ui, admit) {
+        const id = randomUUID();
+        const bound = Promise.withResolvers();
+        this.binds.set(id, bound.resolve);
+        const timer = setTimeout(() => bound.reject(new Error("private_form_unavailable")), 5_000);
+        timer.unref();
+        let message;
+        try {
+            this.send({ type: "mcp_form_bind", id, durableId });
+            message = await bound.promise;
+        }
+        finally {
+            clearTimeout(timer);
+            this.binds.delete(id);
+        }
+        const lifetime = new AbortController();
+        const state = { version: message.version, active: true, admit, listeners: new Set() };
+        this.bindings.set(message.epoch, state);
+        const binding = {
+            epoch: message.epoch,
+            signal: lifetime.signal,
+            subscribe: (listener) => {
+                state.listeners.add(listener);
+                return () => {
+                    state.listeners.delete(listener);
+                };
+            },
+            capture: () => {
+                const version = state.version;
+                if (!state.active || version === undefined)
+                    return undefined;
+                return {
+                    signal: new AbortController().signal,
+                    ready: () => state.active && state.version === version,
+                    synchronize: () => {
+                        const request = randomUUID();
+                        const answer = new Promise((resolve) => this.ready.set(request, resolve));
+                        this.send({ type: "mcp_form_ready", id: request, epoch: message.epoch });
+                        return answer;
+                    },
+                    present: (input) => new Promise((resolve) => {
+                        const request = randomUUID();
+                        const operationFence = new SharedArrayBuffer(4);
+                        const fence = new Int32Array(operationFence);
+                        const cancelOperation = () => {
+                            Atomics.store(fence, 0, 1);
+                            this.send({
+                                type: "mcp_form_cancel",
+                                id: request,
+                                epoch: message.epoch,
+                                lifetime: "operation",
+                            });
+                        };
+                        const cancelPresentation = () => this.send({
+                            type: "mcp_form_cancel",
+                            id: request,
+                            epoch: message.epoch,
+                            lifetime: "presentation",
+                        });
+                        input.operationSignal.addEventListener("abort", cancelOperation, { once: true });
+                        input.presentationSignal.addEventListener("abort", cancelPresentation, { once: true });
+                        this.entries.set(request, {
+                            epoch: message.epoch,
+                            resolve,
+                            fence,
+                            cleanup: () => {
+                                input.operationSignal.removeEventListener("abort", cancelOperation);
+                                input.presentationSignal.removeEventListener("abort", cancelPresentation);
+                            },
+                        });
+                        const { operationSignal, presentationSignal, operationCurrent: _current, ...wire } = input;
+                        if (operationSignal.aborted)
+                            Atomics.store(fence, 0, 1);
+                        this.send({
+                            type: "mcp_form_create",
+                            id: request,
+                            epoch: message.epoch,
+                            version,
+                            operationFence,
+                            input: wire,
+                        });
+                        if (operationSignal.aborted)
+                            cancelOperation();
+                        if (presentationSignal.aborted)
+                            cancelPresentation();
+                    }),
+                };
+            },
+            dispose: () => {
+                lifetime.abort();
+                state.active = false;
+                for (const entry of this.entries.values())
+                    if (entry.epoch === message.epoch)
+                        Atomics.store(entry.fence, 0, 1);
+                this.bindings.delete(message.epoch);
+                state.listeners.clear();
+                this.send({ type: "mcp_form_release", epoch: message.epoch });
+            },
+        };
+        bindPrivateMcpForms(ui, binding);
+        return binding.dispose;
+    }
+    receive(message) {
+        switch (message.type) {
+            case "mcp_form_bound": {
+                const resolve = this.binds.get(message.id);
+                if (resolve)
+                    resolve(message);
+                else
+                    this.send({ type: "mcp_form_release", epoch: message.epoch });
+                this.binds.delete(message.id);
+                return true;
+            }
+            case "mcp_form_availability": {
+                const binding = this.bindings.get(message.epoch);
+                if (binding && binding.version !== message.version) {
+                    binding.version = message.version;
+                    for (const listener of binding.listeners)
+                        listener();
+                }
+                if (message.id) {
+                    this.ready.get(message.id)?.();
+                    this.ready.delete(message.id);
+                }
+                return true;
+            }
+            case "mcp_form_settlement": {
+                const entry = this.entries.get(message.id);
+                if (!entry || entry.epoch !== message.epoch || this.settlements.has(message.settlementId))
+                    return true;
+                this.settlements.add(message.settlementId);
+                if (this.settlements.size > 256) {
+                    const oldest = this.settlements.values().next().value;
+                    if (oldest !== undefined)
+                        this.settlements.delete(oldest);
+                }
+                this.entries.delete(message.id);
+                entry.cleanup();
+                const binding = this.bindings.get(message.epoch);
+                if (!binding?.active) {
+                    entry.resolve({ kind: "operation_aborted", source: "host_termination", humanAdmission: false });
+                    return true;
+                }
+                // Host-only union provenance, never inferred from cancel/decline/accept alone.
+                if (message.outcome.source === "presenter_action" && message.outcome.humanAdmission)
+                    binding.admit();
+                entry.resolve(message.outcome);
+                return true;
+            }
+            default:
+                return false;
+        }
+    }
+}
+//# sourceMappingURL=mcp-form-worker.js.map

package/dist/modes/rpc/mcp-presenter-authority.d.ts

@@ -0,0 +1,53 @@
+import type { McpFormBinding, McpFormRequest, McpFormResolved, McpFormScope } from "../../core/mcp-form-types.ts";
+import { type McpFormClock, type McpPresenterReply } from "./mcp-form-dialog.ts";
+type Sender = (frame: McpFormRequest | McpFormResolved) => boolean;
+export interface McpPresenterConnection {
+    readonly id: string;
+    readonly epoch: string;
+    readonly nonce: string;
+}
+export interface McpPresenterRegistration {
+    readonly id: string;
+}
+/** Host-owned only. No public session command can call enrollment or install a registration. */
+export declare class McpPresenterAuthority {
+    readonly instance: `${string}-${string}-${string}-${string}-${string}`;
+    private readonly clock;
+    private readonly connections;
+    private readonly bindings;
+    private readonly registrations;
+    constructor(options?: {
+        readonly clock?: McpFormClock;
+    });
+    dispose(): void;
+    connect(id: string, send: Sender): McpPresenterConnection;
+    attach(sender: McpPresenterConnection, handle: McpFormBinding): void;
+    connectionContext(sender: McpPresenterConnection, sessionId: string): {
+        hostInstance: string;
+        connectionNonce: string;
+        bindingEpoch: string;
+        attachmentId: string;
+        attachmentEpoch: string;
+    } | undefined;
+    detach(sender: McpPresenterConnection, handle?: McpFormBinding): void;
+    withdraw(sender: McpPresenterConnection): void;
+    bind(sessionId: string, durableId: string, admit: () => void): McpFormBinding;
+    /** Called only after the protected bootstrap has pinned and authenticated its launch principal. */
+    enroll(principal?: string): {
+        register: (handle: McpFormBinding, sender: McpPresenterConnection, options: {
+            readonly kind: McpFormScope["presenterKind"];
+        }) => McpPresenterRegistration;
+        acquire: (handle: McpPresenterRegistration) => {
+            readonly grantId: string;
+            readonly scope: McpFormScope;
+        };
+        revoke: (handle: McpPresenterRegistration) => void;
+    };
+    receive(sender: McpPresenterConnection, value: unknown): McpPresenterReply;
+    private current;
+    private revoke;
+    private presentation;
+    private present;
+}
+export {};
+//# sourceMappingURL=mcp-presenter-authority.d.ts.map