@code-yeongyu/senpi 2026.10.25-2 → 2026.10.25-4

package/dist/modes/rpc/session-event-writer.js

@@ -1,4 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { bindPrivateMcpForms } from "../../core/mcp-form-types.js";
+import { McpPresenterAuthority } from "./mcp-presenter-authority.js";
 import { MEDIA_PLACEHOLDERS_CAPABILITY } from "./custom-capability.js";
 import { serializeJsonLine } from "./jsonl.js";
 import { omitInlineMedia } from "./media-placeholders.js";
@@ -58,6 +60,79 @@ function toolUpdateKey(value) {
  * scheduling boundary and violate D9.
  */
 export class SessionEventWriter {
+    /** Deployment switch. Ordinary RPC behavior is unchanged unless the host explicitly enables it. */
+    enableMcpPresenters() {
+        this.presenterAuthority ??= new McpPresenterAuthority();
+        return this.presenterAuthority;
+    }
+    get mcpPresenters() {
+        return this.presenterAuthority;
+    }
+    getMcpPresenterConnection(id) {
+        return this.presenterConnections.get(id);
+    }
+    findMcpPresenterConnection(nonce) {
+        return [...this.presenterConnections.values()].find((connection) => connection.nonce === nonce);
+    }
+    getMcpFormBinding(sessionId) {
+        return this.presenterBindings.get(sessionId);
+    }
+    bindMcpForms(sessionId, durableId, ui, admit) {
+        const authority = this.presenterAuthority;
+        if (!authority)
+            return undefined;
+        const binding = authority.bind(sessionId, durableId, admit);
+        this.presenterBindings.set(sessionId, binding);
+        for (const id of this.fanout.attachedConnections(sessionId)) {
+            const connection = this.presenterConnections.get(id);
+            if (connection)
+                authority.attach(connection, binding);
+        }
+        bindPrivateMcpForms(ui, binding);
+        return () => {
+            binding.dispose();
+            if (this.presenterBindings.get(sessionId) === binding)
+                this.presenterBindings.delete(sessionId);
+        };
+    }
+    /** Private records bypass event queues, snapshots, mirrors, replay, and overflow preview errors. */
+    handleMcpForm(value) {
+        if (!this.presenterAuthority)
+            return false;
+        if (typeof value !== "object" ||
+            value === null ||
+            !("type" in value) ||
+            typeof value.type !== "string" ||
+            (!value.type.startsWith("mcp_form_") && value.type !== "mcp_presenter_context"))
+            return false;
+        const id = this.currentConnection();
+        const sender = id === undefined ? undefined : this.presenterConnections.get(id);
+        const context = value.type === "mcp_presenter_context" && "sessionId" in value && typeof value.sessionId === "string" && sender
+            ? this.presenterAuthority?.connectionContext(sender, value.sessionId)
+            : undefined;
+        const reply = value.type === "mcp_presenter_context"
+            ? context
+                ? { ok: true, context }
+                : { error: "presenter_not_authorized" }
+            : sender && this.presenterAuthority
+                ? this.presenterAuthority.receive(sender, value)
+                : { error: "presenter_not_authorized" };
+        const connection = id === undefined ? undefined : this.fanout.get(id)?.connection;
+        if (connection) {
+            try {
+                connection.writeRaw(serializeJsonLine({
+                    type: "mcp_form_reply",
+                    ...("id" in value && typeof value.id === "string" ? { id: value.id } : {}),
+                    ...reply,
+                }));
+            }
+            catch {
+                if (sender)
+                    this.presenterAuthority?.detach(sender);
+            }
+        }
+        return true;
+    }
     get pendingCloseRecordCount() {
         return this.reservedCloseRecords;
     }
@@ -65,6 +140,8 @@ export class SessionEventWriter {
         return this.reservedCloseBytes;
     }
     constructor(writeRaw, waitOrSchedule, scheduleFlush) {
+        this.presenterConnections = new Map();
+        this.presenterBindings = new Map();
         this.records = new SessionRecordAccounting();
         this.queues = new Map();
         this.fanout = new SessionEventFanout();
@@ -99,7 +176,13 @@ export class SessionEventWriter {
         this.closeOverflowActors = new WeakSet();
         this.reservedCloseRecords = 0;
         this.reservedCloseBytes = 0;
-        this.fanout.onConnectionClosed = (id) => this.securityPresentations.dropConnection(id);
+        this.fanout.onConnectionClosed = (id) => {
+            this.securityPresentations.dropConnection(id);
+            const sender = this.presenterConnections.get(id);
+            if (sender)
+                this.presenterAuthority?.detach(sender);
+            this.presenterConnections.delete(id);
+        };
         this.writeRaw = writeRaw;
         if (waitOrSchedule && scheduleFlush === undefined && waitOrSchedule.length > 0) {
             this.scheduleFlush = waitOrSchedule;
@@ -119,9 +202,33 @@ export class SessionEventWriter {
         return this.sealedSessions.has(sessionId);
     }
     registerConnection(id, connection, options = {}) {
+        const previousPresenter = this.presenterConnections.get(id);
+        if (previousPresenter)
+            this.presenterAuthority?.detach(previousPresenter);
         this.fanout.registerConnection(id, connection, options);
+        if (this.presenterAuthority) {
+            const sender = this.presenterAuthority.connect(id, (frame) => {
+                if (!this.fanout.get(id))
+                    return false;
+                try {
+                    connection.writeRaw(serializeJsonLine(frame));
+                    // A pending drain does not undo an accepted write or drop the next resolution.
+                    void connection.waitForBackpressure().catch(() => this.presenterAuthority?.detach(sender));
+                    return true;
+                }
+                catch {
+                    this.presenterAuthority?.detach(sender);
+                    return false;
+                }
+            });
+            this.presenterConnections.set(id, sender);
+        }
     }
     unregisterConnection(id) {
+        const sender = this.presenterConnections.get(id);
+        if (sender)
+            this.presenterAuthority?.detach(sender);
+        this.presenterConnections.delete(id);
         this.securityPresentations.dropConnection(id);
         this.fanout.unregisterConnection(id);
         this.status.dropConnection(id);
@@ -131,8 +238,16 @@ export class SessionEventWriter {
         this.fanout.attachConnectionToSession(id, sessionId);
         if (this.hasConnection(id))
             this.securityPresentations.attach(id, sessionId);
+        const sender = this.presenterConnections.get(id);
+        const binding = this.presenterBindings.get(sessionId);
+        if (sender && binding)
+            this.presenterAuthority?.attach(sender, binding);
     }
     detachConnectionFromSession(id, sessionId) {
+        const sender = this.presenterConnections.get(id);
+        const binding = this.presenterBindings.get(sessionId);
+        if (sender && binding)
+            this.presenterAuthority?.detach(sender, binding);
         this.fanout.detachConnectionFromSession(id, sessionId);
         this.securityPresentations.detach(id, sessionId);
     }
@@ -142,8 +257,16 @@ export class SessionEventWriter {
     setConnectionCapabilities(id, capabilities) {
         this.fanout.setConnectionCapabilities(id, capabilities);
         this.securityPresentations.capabilitiesChanged(id);
+        if (!capabilities.includes("interactive_user") || !capabilities.includes("mcp_form_presenter_v1")) {
+            const sender = this.presenterConnections.get(id);
+            if (sender)
+                this.presenterAuthority?.withdraw(sender);
+        }
     }
     clearConnectionCapabilities(id) {
+        const sender = this.presenterConnections.get(id);
+        if (sender)
+            this.presenterAuthority?.withdraw(sender);
         this.fanout.clearConnectionCapabilities(id);
         this.securityPresentations.capabilitiesChanged(id);
     }
@@ -459,6 +582,8 @@ export class SessionEventWriter {
      * session's final stdout record.
      */
     closeSession(sessionId, response, reason, sessionPath) {
+        this.presenterBindings.get(sessionId)?.dispose();
+        this.presenterBindings.delete(sessionId);
         if (!this.settleBeforeSeal(sessionId))
             return;
         this.sealedSessions.add(sessionId);
@@ -526,6 +651,8 @@ export class SessionEventWriter {
         });
     }
     sealLifecycle(sessionId, lifecycle, attachedOnly = false) {
+        this.presenterBindings.get(sessionId)?.dispose();
+        this.presenterBindings.delete(sessionId);
         if (!this.settleBeforeSeal(sessionId))
             return;
         this.sealedSessions.add(sessionId);

package/dist/modes/rpc/session-router-routing.js

@@ -69,6 +69,7 @@ export async function dispatch(host, command) {
             warm: host.registry.warm !== undefined,
             toolRuntime: host.defaults.toolRuntime ?? "in-process",
             negotiated: host.connectionOptions?.capabilities ?? [],
+            mcpPresenters: host.writer.mcpPresenters !== undefined,
         });
         return {
             id: command.id,

package/dist/modes/rpc/session-worker-client.d.ts

@@ -16,6 +16,9 @@ export interface SessionWorkerCallbacks {
     failure: (error: string) => void;
 }
 export declare class SessionWorkerClient {
+    private privateBinding?;
+    private stopPrivateBinding?;
+    private readonly privateOperations;
     /** The worker's own route to the main-thread Bun.WebView service; released when the worker exits. */
     private readonly webviewBroker;
     readonly worker: Worker;

package/dist/modes/rpc/session-worker-client.js

@@ -8,11 +8,13 @@ import { roleConnection } from "./connection-roles.js";
 import { subscriptionLimits } from "../../core/subscription-limits/limit-store.js";
 import { SessionWorkerRequests } from "./session-worker-requests.js";
 import { acknowledge, acknowledgeGrant } from "./session-worker-signals.js";
+import { randomUUID } from "node:crypto";
 const compiledWorkerEntry = typeof SENPI_RPC_SESSION_WORKER_ENTRY === "string"
     ? SENPI_RPC_SESSION_WORKER_ENTRY
     : "./src/modes/rpc/session-worker.ts";
 export class SessionWorkerClient {
     constructor(callbacks) {
+        this.privateOperations = new Map();
         /** The worker's own route to the main-thread Bun.WebView service; released when the worker exits. */
         this.webviewBroker = createWebViewBroker();
         this.worker = new Worker(isBunBinary
@@ -35,6 +37,11 @@ export class SessionWorkerClient {
         this.callbacks = callbacks;
         this.exited = new Promise((resolve, reject) => {
             this.worker.once("exit", () => {
+                this.stopPrivateBinding?.();
+                this.privateBinding?.dispose();
+                for (const operation of this.privateOperations.values())
+                    operation.operation.abort();
+                this.privateOperations.clear();
                 if (!this.stopped && !this.closeTimer)
                     this.fail("session_worker_exited");
                 this.stopped = true;
@@ -111,9 +118,12 @@ export class SessionWorkerClient {
             capabilities: options.capabilities ?? [],
             connection: writer.currentConnection(),
             roles: options.connectionRoles?.rolesOf(roleConnection(writer.currentConnection())),
+            mcpFormsEnforced: writer.mcpPresenters !== undefined,
         });
         return {
             handle: async (command) => {
+                if (writer.handleMcpForm(command))
+                    return;
                 const connection = writer.currentConnection();
                 if ("type" in command &&
                     command.type === "extension_ui_response" &&
@@ -177,6 +187,85 @@ export class SessionWorkerClient {
             return;
         }
         switch (message.type) {
+            case "mcp_form_bind": {
+                this.stopPrivateBinding?.();
+                this.privateBinding?.dispose();
+                const writer = this.writer;
+                const sessionId = this.sessionId;
+                if (!writer?.mcpPresenters || !sessionId) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                const bound = writer.bindMcpForms(sessionId, message.durableId, {}, () => { });
+                if (bound instanceof Promise) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                this.privateBinding = writer.getMcpFormBinding(sessionId);
+                const binding = this.privateBinding;
+                if (!binding) {
+                    this.fail("private_form_unavailable");
+                    return;
+                }
+                const unsubscribe = binding.subscribe?.(() => this.post({
+                    type: "mcp_form_availability",
+                    epoch: binding.epoch,
+                    version: binding.version?.(),
+                }));
+                this.stopPrivateBinding = () => {
+                    unsubscribe?.();
+                    bound?.();
+                };
+                this.post({ type: "mcp_form_bound", id: message.id, epoch: binding.epoch, version: binding.version?.() });
+                return;
+            }
+            case "mcp_form_ready": {
+                const binding = this.privateBinding;
+                this.post({
+                    type: "mcp_form_availability",
+                    id: message.id,
+                    epoch: message.epoch,
+                    version: binding?.epoch === message.epoch ? binding.version?.() : undefined,
+                });
+                return;
+            }
+            case "mcp_form_release":
+                if (this.privateBinding?.epoch === message.epoch)
+                    this.stopPrivateBinding?.();
+                return;
+            case "mcp_form_cancel": {
+                const operation = this.privateOperations.get(message.id);
+                if (operation?.epoch === message.epoch)
+                    operation[message.lifetime].abort();
+                return;
+            }
+            case "mcp_form_create": {
+                const binding = this.privateBinding;
+                const presenter = binding?.epoch === message.epoch && binding.version?.() === message.version
+                    ? binding.capture()
+                    : undefined;
+                const operation = new AbortController();
+                const presentation = new AbortController();
+                this.privateOperations.set(message.id, { operation, presentation, epoch: message.epoch });
+                const fence = new Int32Array(message.operationFence);
+                const result = presenter?.present({
+                    ...message.input,
+                    operationSignal: operation.signal,
+                    presentationSignal: presentation.signal,
+                    operationCurrent: () => Atomics.load(fence, 0) === 0,
+                });
+                void Promise.resolve(result).then((outcome) => {
+                    this.privateOperations.delete(message.id);
+                    this.post({
+                        type: "mcp_form_settlement",
+                        id: message.id,
+                        epoch: message.epoch,
+                        settlementId: randomUUID(),
+                        outcome: outcome ?? { kind: "processing_failure", source: "host_termination", humanAdmission: false },
+                    });
+                });
+                return;
+            }
             case "prepared":
             case "ready":
             case "result": {

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -1,4 +1,5 @@
 import type { BrowserEngine } from "../../core/browser-engine.ts";
+import type { McpFormInput, McpFormOutcome } from "../../core/mcp-form-types.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { MirroredLimits } from "../../core/subscription-limits/limit-store.ts";
 import type { CliRuntimeConfiguration } from "../../main.ts";
@@ -52,6 +53,23 @@ export type HostToSessionWorker = {
     connection?: string;
     /** Roles the connection explicitly declared on the host (senpi#3811); the isolate adopts them. */
     roles?: readonly string[];
+    mcpFormsEnforced?: boolean;
+} | {
+    type: "mcp_form_bound";
+    id: string;
+    epoch: string;
+    version?: string;
+} | {
+    type: "mcp_form_availability";
+    epoch: string;
+    version?: string;
+    id?: string;
+} | {
+    type: "mcp_form_settlement";
+    id: string;
+    epoch: string;
+    settlementId: string;
+    outcome: McpFormOutcome;
 } | {
     type: "command";
     request: number;
@@ -84,6 +102,29 @@ export type HostToSessionWorker = {
     type: "close";
 };
 export type SessionWorkerToHost = {
+    type: "mcp_form_bind";
+    id: string;
+    durableId: string;
+} | {
+    type: "mcp_form_ready";
+    id: string;
+    epoch: string;
+} | {
+    type: "mcp_form_release";
+    epoch: string;
+} | {
+    type: "mcp_form_cancel";
+    id: string;
+    epoch: string;
+    lifetime: "operation" | "presentation";
+} | {
+    type: "mcp_form_create";
+    id: string;
+    epoch: string;
+    version: string;
+    operationFence: SharedArrayBuffer;
+    input: Omit<McpFormInput, "operationSignal" | "operationCurrent" | "presentationSignal">;
+} | {
     type: "prepared";
     request: number;
     sessionPath: string;

package/dist/modes/rpc/session-worker.js

@@ -23,6 +23,7 @@ import { resolveMovedProfile } from "./session-registry-moved-path.js";
 import { createWorkerCredit } from "./session-worker-credit.js";
 import { SESSION_WORKER_LIMITS, } from "./session-worker-protocol.js";
 import { createSessionWorkerRegistry } from "./session-worker-registry.js";
+import { McpFormWorker } from "./mcp-form-worker.js";
 if (isBunBinary) {
     const { registerBunRuntimeModules } = await import("../../bun/runtime-modules.js");
     registerBunRuntimeModules();
@@ -33,6 +34,8 @@ const port = parentPort;
 if (!port)
     throw new Error("Session worker requires a parent port");
 const send = (message) => port.postMessage(message);
+const privateForms = new McpFormWorker(send);
+let privateFormsEnforced = false;
 function failWorker(error) {
     send({ type: "failure", error });
     process.exit(1);
@@ -41,6 +44,9 @@ const { exchange, installWriteReservation } = createWorkerCredit(send, failWorke
 // The host's key for the same file, so a deleted directory neither throws here nor misses (senpi#2285).
 installWriteReservation(canonicalSessionPath);
 class WorkerEventWriter extends SessionEventWriter {
+    bindMcpForms(_sessionId, durableId, ui, admit) {
+        return privateFormsEnforced ? privateForms.bind(durableId, ui, admit) : undefined;
+    }
     constructor() {
         super(() => { });
         this.workerSecurityBridge = true;
@@ -174,6 +180,7 @@ async function handle(message) {
             if (message.roles !== undefined)
                 connectionRoles.adopt(roleConnection(message.connection), message.roles);
             const bindingEntry = entry;
+            privateFormsEnforced = message.mcpFormsEnforced === true;
             const createBinding = () => createRpcSessionBinding(message.sessionId, bindingEntry, writer, () => send({ type: "request_close" }), {
                 capabilities: message.capabilities,
                 connectionRoles,
@@ -262,6 +269,8 @@ async function handle(message) {
 // A turn in this isolate reports into its own store; the host mirrors it so its clients see it (senpi#3695).
 subscriptionLimits.subscribeMirror((limits) => send({ type: "subscription_limits", limits }));
 port.on("message", (message) => {
+    if (privateForms.receive(message))
+        return;
     void handle(message).catch((cause) => {
         const error = cause instanceof Error ? cause.message : String(cause);
         if (error.startsWith("session_worker_")) {

package/docs/extensions.md

@@ -3507,6 +3507,11 @@ if (confirmed) {
 
 #### Manual Dismissal with AbortSignal
 
+Local terminal `select`, `confirm`, and `input` dialogs also accept
+`ephemeral: true`. Their visible contents remain local; they emit no generic
+blocked events, replacement labels, identifiers, or pending markers. This option is
+not an RPC field or permission to present MCP input on another session.
+
 For more control (e.g., to distinguish timeout from user cancel), use `AbortSignal`:
 
 ```typescript

package/docs/mcp.md

@@ -393,9 +393,26 @@ above.
   notice.
 - Every server prompt registers as `/mcp:<server>:<prompt>`; invoking it
   collects the prompt's arguments and drops the rendered text into the editor.
-- Servers may ask questions mid-call (elicitation, form mode): senpi walks the
-  requested fields through input dialogs; in non-interactive runs the request
-  is declined cleanly.
+- Legacy servers may ask form questions mid-call through the existing terminal
+  or RPC dialog channel.
+- On MCP 2026-07-28 connections, `tools/call`, `resources/read`, and `prompts/get`
+  can return `input_required`. Senpi collects form input privately in the
+  originating terminal session, lets you review and edit it, and continues the
+  operation with a new request ID. Only the final result reaches the model or editor.
+  Continue does not submit a form: even empty forms require Submit. Decline is
+  an explicit human refusal; dismissal of a presented form is Cancel.
+- RPC, print, and other runs without an originating terminal presenter do not
+  advertise modern elicitation. An unsolicited input request terminates the
+  operation locally without fabricating an answer or retrying incomplete input.
+  State-only continuations need no human and remain supported.
+- Each operation allows eight input rounds and five minutes of total consent
+  time, including queueing. The overall deadline also includes network time
+  and cannot be extended by progress. Caller cancellation, session closure,
+  or observed authorization invalidation dismisses pending input without a retry.
+  Authorization uses the same observed-revocation boundary as ordinary MCP
+  requests. Unsupported client features terminate locally.
+- Continuation state and drafts are not persisted or resumed after restart.
+  MRTR does not enable the Tasks extension.
 
 ## Auth