@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/modes/rpc/mcp-presenter-control.js

@@ -0,0 +1,330 @@
+import { createPublicKey, randomBytes, randomUUID, verify } from "node:crypto";
+import { createServer } from "node:net";
+import { Duplex, PassThrough, Readable, Writable } from "node:stream";
+import { isRecord } from "../../core/extensions/builtin/mcp/modern/form-schema.js";
+import { attachJsonlLineReader } from "./jsonl.js";
+/** Separate authenticated control endpoint. Ordinary RPC credentials cannot enroll or acquire. */
+export class McpPresenterControl {
+    constructor(writer, path) {
+        this.principals = new Map();
+        this.controls = new Set();
+        this.revokeControls = new Map();
+        this.backendGenerations = new Map();
+        this.successors = new Map();
+        this.writer = writer;
+        this.authority = writer.enableMcpPresenters();
+        this.path = path;
+        this.server = createServer((stream) => this.manage(stream));
+    }
+    listen() {
+        return new Promise((resolve, reject) => {
+            this.server.once("error", reject);
+            this.server.listen(this.path, () => {
+                this.server.off("error", reject);
+                resolve();
+            });
+        });
+    }
+    /** A deferred handover is spawned by the old host, not the CLI that already returned. */
+    successorBootstrap() {
+        const owner = this.launchOwner;
+        if (!owner || owner.stream.destroyed)
+            return undefined;
+        const id = randomUUID();
+        const toChild = new PassThrough();
+        const fromChild = new PassThrough();
+        const endpoint = Duplex.from({ readable: Readable.toWeb(toChild), writable: Writable.toWeb(fromChild) });
+        this.successors.set(id, { stream: owner.stream, write: toChild });
+        const stop = privateFrames(fromChild, (value) => {
+            if (!isRecord(value)) {
+                endpoint.destroy();
+                return;
+            }
+            if (value.type === "challenge") {
+                send(owner.stream, { type: "mcp_presenter_successor_challenge", id, challenge: value });
+            }
+            else if (value.type === "enrolled") {
+                send(owner.stream, { type: "mcp_presenter_successor_enrolled", id, enrollment: value });
+                stop();
+                this.successors.delete(id);
+            }
+            else
+                endpoint.destroy();
+        });
+        endpoint.once("close", () => {
+            stop();
+            this.successors.delete(id);
+            toChild.destroy();
+            fromChild.destroy();
+        });
+        toChild.write(`${JSON.stringify({
+            type: "enroll",
+            publicKey: owner.principal.key.export({ type: "spki", format: "pem" }),
+            backendGeneration: owner.backendGeneration,
+        })}\n`);
+        return endpoint;
+    }
+    /** Only the inherited launch channel may introduce the installation public key. */
+    bootstrap(stream) {
+        let key;
+        let backend;
+        let transcript;
+        const id = randomUUID();
+        const stop = privateFrames(stream, (value) => {
+            if (!key) {
+                if (!isRecord(value) ||
+                    value.type !== "enroll" ||
+                    typeof value.publicKey !== "string" ||
+                    typeof value.backendGeneration !== "string") {
+                    stream.destroy();
+                    return;
+                }
+                try {
+                    key = createPublicKey(value.publicKey);
+                }
+                catch {
+                    stream.destroy();
+                    return;
+                }
+                if (key.asymmetricKeyType !== "ed25519") {
+                    stream.destroy();
+                    return;
+                }
+                backend = value.backendGeneration;
+                transcript = JSON.stringify([
+                    "mcp-presenter-enroll-v1",
+                    this.authority.instance,
+                    backend,
+                    randomBytes(32).toString("hex"),
+                ]);
+                send(stream, { type: "challenge", transcript, hostInstance: this.authority.instance });
+                return;
+            }
+            if (!transcript || !signed(value, transcript, key)) {
+                stream.destroy();
+                return;
+            }
+            this.principals.set(id, { id, key, sessions: new WeakSet() });
+            send(stream, {
+                type: "enrolled",
+                principalId: id,
+                hostInstance: this.authority.instance,
+                backendGeneration: backend,
+                endpoint: this.path,
+            });
+            stop();
+            stream.end();
+        });
+    }
+    dispose() {
+        this.authority.dispose();
+        for (const stream of this.controls)
+            stream.destroy();
+        this.controls.clear();
+        for (const successor of this.successors.values())
+            successor.write.destroy();
+        this.successors.clear();
+        this.principals.clear();
+        this.server.close();
+    }
+    manage(stream) {
+        if (this.controls.size >= 64) {
+            stream.destroy();
+            return;
+        }
+        this.controls.add(stream);
+        let principal;
+        let owner;
+        let transcript;
+        let pending;
+        let backendGeneration;
+        let deadline = performance.now() + 30_000;
+        let challengeTimer = setTimeout(() => stream.destroy(), 30_000);
+        const registrations = new Map();
+        const revoke = () => {
+            clearTimeout(challengeTimer);
+            for (const registration of registrations.values())
+                owner?.revoke(registration);
+            registrations.clear();
+            this.controls.delete(stream);
+            this.revokeControls.delete(stream);
+            this.backendGenerations.delete(stream);
+            if (this.launchOwner?.stream === stream)
+                this.launchOwner = undefined;
+            for (const [id, successor] of this.successors)
+                if (successor.stream === stream) {
+                    successor.write.destroy();
+                    this.successors.delete(id);
+                }
+        };
+        this.revokeControls.set(stream, revoke);
+        stream.once("close", revoke);
+        const stop = privateFrames(stream, (value) => {
+            if (!isRecord(value)) {
+                stream.destroy();
+                return;
+            }
+            if (value.type === "mcp_presenter_successor_proof" && typeof value.id === "string") {
+                const successor = this.successors.get(value.id);
+                if (successor?.stream !== stream || typeof value.signature !== "string") {
+                    stream.destroy();
+                    return;
+                }
+                successor.write.write(`${JSON.stringify({ type: "proof", signature: value.signature })}\n`);
+                return;
+            }
+            if (value.type === "challenge") {
+                if (pending ||
+                    typeof value.principalId !== "string" ||
+                    typeof value.backendGeneration !== "string" ||
+                    !isRecord(value.command)) {
+                    stream.destroy();
+                    return;
+                }
+                const requested = this.principals.get(value.principalId);
+                if (!requested || (principal && principal !== requested)) {
+                    stream.destroy();
+                    return;
+                }
+                principal = requested;
+                backendGeneration = value.backendGeneration;
+                pending = value.command;
+                deadline = performance.now() + 30_000;
+                clearTimeout(challengeTimer);
+                challengeTimer = setTimeout(() => stream.destroy(), 30_000);
+                transcript = JSON.stringify([
+                    "mcp-presenter-control-v1",
+                    this.authority.instance,
+                    value.backendGeneration,
+                    randomUUID(),
+                    randomBytes(32).toString("hex"),
+                    pending,
+                ]);
+                send(stream, { type: "challenge", transcript, hostInstance: this.authority.instance });
+                return;
+            }
+            if (!principal ||
+                !pending ||
+                !transcript ||
+                performance.now() >= deadline ||
+                !signed(value, transcript, principal.key)) {
+                stream.destroy();
+                return;
+            }
+            const command = pending;
+            clearTimeout(challengeTimer);
+            pending = undefined;
+            transcript = undefined;
+            owner ??= this.authority.enroll(principal.id);
+            if (backendGeneration === undefined) {
+                stream.destroy();
+                return;
+            }
+            for (const [oldStream, old] of this.backendGenerations) {
+                if (old.principal === principal && old.generation !== backendGeneration) {
+                    this.revokeControls.get(oldStream)?.();
+                    oldStream.destroy();
+                }
+            }
+            this.backendGenerations.set(stream, { principal, generation: backendGeneration });
+            this.launchOwner = { stream, principal, backendGeneration };
+            const id = typeof command.id === "string" ? command.id : undefined;
+            try {
+                switch (command.type) {
+                    case "mcp_presenter_assign": {
+                        const binding = typeof command.sessionId === "string"
+                            ? this.writer.getMcpFormBinding(command.sessionId)
+                            : undefined;
+                        if (!binding || binding.epoch !== command.bindingEpoch || command.purpose !== "mcp_form")
+                            throw new Error("presenter_not_authorized");
+                        // Only a signed native-supervisor decision assigns an opened/adopted session.
+                        // Enrollment and ordinary RPC attachment do not imply assignment.
+                        principal.sessions.add(binding);
+                        send(stream, { type: "mcp_presenter_assigned", id, sessionId: command.sessionId });
+                        return;
+                    }
+                    case "mcp_presenter_acquire": {
+                        if (command.hostInstance !== this.authority.instance ||
+                            typeof command.sessionId !== "string" ||
+                            typeof command.bindingEpoch !== "string" ||
+                            typeof command.connectionNonce !== "string" ||
+                            (command.kind !== "desktop" && command.kind !== "gateway"))
+                            throw new Error("presenter_not_authorized");
+                        const binding = this.writer.getMcpFormBinding(command.sessionId);
+                        const connection = this.writer.findMcpPresenterConnection(command.connectionNonce);
+                        if (!binding ||
+                            !principal.sessions.has(binding) ||
+                            binding.epoch !== command.bindingEpoch ||
+                            !connection)
+                            throw new Error("presenter_not_authorized");
+                        const capabilities = this.writer.getConnectionCapabilities(connection.id);
+                        if (!capabilities?.includes("interactive_user") || !capabilities.includes("mcp_form_presenter_v1"))
+                            throw new Error("presenter_not_authorized");
+                        const context = this.authority.connectionContext(connection, command.sessionId);
+                        if (!context ||
+                            command.purpose !== "mcp_form" ||
+                            command.attachmentId !== context.attachmentId ||
+                            command.attachmentEpoch !== context.attachmentEpoch)
+                            throw new Error("presenter_not_authorized");
+                        const registration = owner.register(binding, connection, { kind: command.kind });
+                        const grant = owner.acquire(registration);
+                        registrations.set(registration.id, registration);
+                        send(stream, { type: "mcp_presenter_acquired", id, registrationId: registration.id, ...grant });
+                        return;
+                    }
+                    case "mcp_presenter_revoke": {
+                        const registration = typeof command.registrationId === "string"
+                            ? registrations.get(command.registrationId)
+                            : undefined;
+                        if (!registration)
+                            throw new Error("presenter_not_authorized");
+                        owner.revoke(registration);
+                        registrations.delete(registration.id);
+                        send(stream, { type: "mcp_presenter_revoked", id });
+                        return;
+                    }
+                    default:
+                        throw new Error("presenter_not_authorized");
+                }
+            }
+            catch {
+                send(stream, { type: "mcp_presenter_error", id, error: "presenter_not_authorized" });
+            }
+        }, false);
+        stream.once("close", stop);
+    }
+}
+function signed(value, transcript, key) {
+    if (!isRecord(value) ||
+        value.type !== "proof" ||
+        typeof value.signature !== "string" ||
+        !/^[a-f0-9]{128}$/.test(value.signature))
+        return false;
+    return verify(null, Buffer.from(transcript), key, Buffer.from(value.signature, "hex"));
+}
+function send(stream, value) {
+    if (!stream.write(`${JSON.stringify(value)}\n`))
+        stream.destroy();
+}
+/** Bound before parsing. Neither malformed bodies nor parser exceptions enter diagnostics. */
+function privateFrames(stream, receive, deadline = true) {
+    const timer = deadline ? setTimeout(() => stream.destroy(), 30_000) : undefined;
+    const detach = attachJsonlLineReader(stream, (line) => {
+        try {
+            receive(JSON.parse(line));
+        }
+        catch {
+            stream.destroy();
+        }
+    }, { maxLineLength: 16 * 1024, onOversizedLine: () => stream.destroy() });
+    stream.on("error", () => stream.destroy());
+    stream.once("close", () => {
+        clearTimeout(timer);
+        detach();
+    });
+    return () => {
+        clearTimeout(timer);
+        detach();
+    };
+}
+//# sourceMappingURL=mcp-presenter-control.js.map

package/dist/modes/rpc/multi-session-host.d.ts

@@ -7,6 +7,9 @@ import { type HostIdleOverrides } from "./host-idle-policy.ts";
 import { type RpcBindingFactory, SessionCommandRouter } from "./session-command-router.ts";
 import { SessionEventWriter } from "./session-event-writer.ts";
 export interface MultiSessionHostOptions {
+    /** Host deployment policy; never derived from client capabilities or project settings. */
+    mcpPresenterEnforcement?: boolean;
+    presenterBootstrapFd?: number;
     agentDir: string;
     createRuntime: CreateAgentSessionRuntimeFactory;
     workerConfiguration?: CliRuntimeConfiguration;

package/dist/modes/rpc/multi-session-host.js

@@ -1,4 +1,6 @@
 import { createServer } from "node:net";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { envValue } from "../../core/brand.js";
 import { HostMcpRegistry } from "../../core/extensions/builtin/mcp/host-registry.js";
@@ -36,6 +38,8 @@ import { formatSocketAddress, listen, resolveSocketPath } from "./host-socket-bi
 import { socketSink } from "./socket-sink.js";
 import { ensureSocketSecret, SOCKET_SECRET_FILE_ENV, socketSecretPath } from "./socket-transport.js";
 import { WorkerSessionRegistry } from "./worker-session-registry.js";
+import { McpPresenterControl } from "./mcp-presenter-control.js";
+import { presenterBootstrapStream } from "./mcp-presenter-bootstrap.js";
 export { DEFAULT_HOST_EMPTY_EXIT_MS, DEFAULT_SESSION_IDLE_EVICTION_MS, RPC_HOST_EMPTY_EXIT_MS_ENV, RPC_SESSION_IDLE_EVICTION_MS_ENV, resolveHostIdlePolicy, } from "./host-idle-policy.js";
 /** Win32 named-pipe close can leave libuv's server callback pending after handles are destroyed. */
 const WINDOWS_SHUTDOWN_HARD_EXIT_MS = 2_000;
@@ -58,6 +62,8 @@ export async function runMultiSessionHost(options) {
         : runSocketHost(options, resolveSocketPath(options.listen, options.agentDir)));
 }
 export function createHostCore(options, writer, capabilities = parseClientCapabilities(envValue("RPC_CLIENT_CAPABILITIES")), idle = {}, hostContext, hooks = {}) {
+    if (options.mcpPresenterEnforcement === true)
+        writer.enableMcpPresenters();
     const policy = resolveHostIdlePolicy(process.env, idle);
     const endpointSocket = publicEndpointSocket(options);
     const pathReservations = createEndpointReservations({
@@ -126,9 +132,11 @@ export function createHostCore(options, writer, capabilities = parseClientCapabi
             parsed = JSON.parse(line);
         }
         catch (cause) {
-            await writer.enqueueControl(parseError(`Failed to parse command: ${errorMessage(cause)}`));
+            await writer.enqueueControl(parseError(writer.mcpPresenters ? "Invalid command" : `Failed to parse command: ${errorMessage(cause)}`));
             return;
         }
+        if (writer.handleMcpForm(parsed))
+            return;
         if (await gate.intercept(parsed, (answer) => writer.enqueueControl(answer)))
             return;
         const shapeError = rpcCommandShapeError(parsed);
@@ -248,6 +256,7 @@ async function runSocketHost(options, socketPath) {
                     runtimeBuildId,
                 }),
                 perform: (request) => performIdleHandover({
+                    presenterBootstrap: presenterControl?.successorBootstrap(),
                     request,
                     socket: hostWatchdogBinding()?.publicSocket ?? socketPath,
                     agentDir: options.agentDir,
@@ -256,6 +265,29 @@ async function runSocketHost(options, socketPath) {
             },
         }),
     });
+    let presenterDir;
+    let presenterControl;
+    if (options.presenterBootstrapFd !== undefined) {
+        const bootstrap = presenterBootstrapStream(options.presenterBootstrapFd);
+        try {
+            if (bootstrap && options.mcpPresenterEnforcement === true) {
+                if (process.platform !== "win32")
+                    presenterDir = await mkdtemp(join(tmpdir(), "senpi-presenter-"));
+                presenterControl = new McpPresenterControl(writer, presenterDir
+                    ? join(presenterDir, "control.sock")
+                    : `\\\\.\\pipe\\senpi-presenter-${writer.mcpPresenters?.instance}`);
+                await presenterControl.listen();
+                presenterControl.bootstrap(bootstrap);
+            }
+            else
+                bootstrap?.destroy();
+        }
+        catch {
+            bootstrap?.destroy();
+            presenterControl?.dispose();
+            presenterControl = undefined;
+        }
+    }
     const observers = startHostObservers(router, writer, {
         trim,
         // The shape #1893 measured: gigabytes resident with `sessions.total 0`. Say it once, and when
@@ -363,6 +395,9 @@ async function runSocketHost(options, socketPath) {
         shuttingDown = true;
         observers.stop();
         handover?.dispose();
+        presenterControl?.dispose();
+        if (presenterDir)
+            await rm(presenterDir, { recursive: true, force: true });
         stopChildReaper();
         // A handover that completed at once drains this host; its caller still gets the answer.
         await handoverAnswered();

package/dist/modes/rpc/rpc-read-response-types.d.ts

@@ -120,6 +120,8 @@ export type RpcReadResponse = {
         leafId: string | null;
         hasMore?: boolean;
         nextSince?: string;
+        /** A `tail` page's oldest entry id while older entries remain (senpi#4267). */
+        next_before?: string;
     };
 } | {
     id?: string;

package/dist/modes/rpc/rpc-session-command-types.d.ts

@@ -388,11 +388,18 @@ export type RpcSessionCommand = {
 } | {
     id?: string;
     type: "get_fork_messages";
-} | {
+}
+/**
+ * `since`/`before` bound the range (strictly after / strictly before an entry id); `limit` pages it forward from
+ * its start, `tail` backward from its end (`next_before` names the next page, senpi#4267).
+ */
+ | {
     id?: string;
     type: "get_entries";
     since?: string;
+    before?: string;
     limit?: number;
+    tail?: number;
     maxBytes?: number;
 } | {
     id?: string;

package/dist/modes/rpc/session-binding.js

@@ -74,6 +74,7 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
             workerSecurityBridge: writer.workerSecurityBridge,
             grantDialogSettled: (id) => writer.settleGrantDialog(sessionId, id),
             bindSecurityPresentation: (session, ui) => writer.bindSecurityPresentations(sessionId, session.sessionId, session.securityNotices, ui),
+            bindMcpForms: (session, ui) => writer.bindMcpForms(sessionId, session.sessionId, ui, () => session.admitHumanAnswer()),
             clientInfo: options.clientInfo === undefined
                 ? undefined
                 : {
@@ -84,7 +85,11 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
     });
     await handler.ready;
     return {
-        handle: (command) => runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command))),
+        handle: (command) => {
+            if (writer.handleMcpForm(command))
+                return Promise.resolve();
+            return runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command)));
+        },
         cancelPendingExtensionUiRequests: () => runWithProviderScope(entry.scope, () => handler.cancelPendingExtensionUiRequests()),
         pendingPrompts: () => handler.pendingPrompts(),
         connectionDetached: (connectionId) => runWithProviderScope(entry.scope, () => handler.connectionDetached(connectionId)),

package/dist/modes/rpc/session-event-writer.d.ts

@@ -1,4 +1,6 @@
 import type { ExtensionUIContext, SessionKind } from "../../core/extensions/types.ts";
+import { type McpFormBinding } from "../../core/mcp-form-types.ts";
+import { McpPresenterAuthority, type McpPresenterConnection } from "./mcp-presenter-authority.ts";
 import type { SecurityNoticeSnapshot, SecurityNoticeState } from "../../core/security-notices.ts";
 import { type MediaPersister } from "./media-placeholders.ts";
 import type { RpcHostLifecycleEvent, RpcOpenQueuedEvent, RpcSessionClosedEvent, RpcSessionClosedReason, RpcSessionParkedEvent } from "./rpc-types.ts";
@@ -21,6 +23,18 @@ export declare const MAX_SHARED_STDIO_QUEUE_RECORDS = 4096;
  * scheduling boundary and violate D9.
  */
 export declare class SessionEventWriter {
+    private presenterAuthority?;
+    private readonly presenterConnections;
+    private readonly presenterBindings;
+    /** Deployment switch. Ordinary RPC behavior is unchanged unless the host explicitly enables it. */
+    enableMcpPresenters(): McpPresenterAuthority;
+    get mcpPresenters(): McpPresenterAuthority | undefined;
+    getMcpPresenterConnection(id: string): McpPresenterConnection | undefined;
+    findMcpPresenterConnection(nonce: string): McpPresenterConnection | undefined;
+    getMcpFormBinding(sessionId: string): McpFormBinding | undefined;
+    bindMcpForms(sessionId: string, durableId: string, ui: object, admit: () => void): (() => void) | undefined | Promise<(() => void) | undefined>;
+    /** Private records bypass event queues, snapshots, mirrors, replay, and overflow preview errors. */
+    handleMcpForm(value: unknown): boolean;
     private readonly records;
     private readonly queues;
     private readonly fanout;