@code-yeongyu/senpi 2026.10.25-3 → 2026.10.26-1

package/dist/core/extensions/builtin/permission-system/parsers.d.ts

@@ -7,6 +7,8 @@ export type PermissionRequest = Pick<Request, "permission" | "patterns" | "alway
 };
 /** Parser function that extracts permission requests from tool input */
 export type ToolPermissionParser = (toolName: string, input: Record<string, unknown>, cwd: string) => PermissionRequest[];
+/** Marks a bash request target that no command-specific rule can match: only a `*` rule decides it. */
+export declare const UNPARSED_BASH_PREFIX = "(unparsed) ";
 /** The `eval` class a cell carries on its own, used when its tool-owned parser names anything narrower. */
 export declare function fallbackEvalPermissionRequest(): PermissionRequest;
 /**

package/dist/core/extensions/builtin/permission-system/parsers.js

@@ -2,6 +2,7 @@ import { dirname, resolve } from "node:path";
 import { realpathWithoutOpen } from "../../../../utils/paths.js";
 import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { BashArity } from "../permission-system/arity.js";
+import { analyzeBashCommand, bestEffortCommandLines } from "../permission-system/bash-command-segments.js";
 import { extractExternalPaths, isExternalPath, toParentDirectoryPattern, } from "../permission-system/external-dir.js";
 import { setApprovedMonitorParent } from "../terminal/monitor-permission.js";
 import { urlOriginAlias, widerAlwaysScope } from "./always-scope.js";
@@ -73,6 +74,48 @@ function withExternalDirectoryRequests(requests, paths, cwd, scope) {
         },
     ];
 }
+const uniq = (values) => [...new Set(values)];
+/**
+ * The targets an "Allow always" answer may store. Stored rules are matched as globs, so a target holding
+ * its own `*` or `?` would be remembered as a wildcard that matches other commands; such a target is
+ * allowed once and never stored. Request patterns stay raw, so existing rules match exactly as before.
+ */
+const rememberable = (targets) => targets.filter((target) => !/[*?]/.test(target));
+/** Marks a bash request target that no command-specific rule can match: only a `*` rule decides it. */
+export const UNPARSED_BASH_PREFIX = "(unparsed) ";
+/**
+ * The `bash` requests for one command. Every simple command it runs is decided, so the call is as
+ * strict as its strictest command: one pattern per command (its arity prefix), all of which must be
+ * allowed, and "Allow always" stores exactly those prefixes. A command the lexer cannot parse is one
+ * target only a `*` rule (a preset, a blanket setting) can decide, so no grant for one command can
+ * allow it; its plain words are still checked against deny rules.
+ */
+function bashCommandRequests(command) {
+    const analysis = analyzeBashCommand(command);
+    if (analysis.kind === "unparsed") {
+        const target = `${UNPARSED_BASH_PREFIX}${command}`;
+        const candidates = uniq(bestEffortCommandLines(command)
+            .map((words) => BashArity.prefix(words).join(" "))
+            .filter(Boolean));
+        // The deny-only check runs first, so a denied call is refused before anyone is asked.
+        return [
+            ...(candidates.length === 0
+                ? []
+                : [{ permission: "bash", patterns: candidates, always: [], autoApproveAsk: true }]),
+            { permission: "bash", patterns: [target], always: rememberable([target]) },
+        ];
+    }
+    const prefixes = uniq(analysis.segments.map((words) => BashArity.prefix([...words]).join(" ")).filter(Boolean));
+    if (prefixes.length === 0)
+        return [{ permission: "bash", patterns: [command], always: rememberable([command]) }];
+    return [
+        {
+            permission: "bash",
+            patterns: prefixes,
+            always: rememberable(prefixes).flatMap((prefix) => [prefix, `${prefix} *`]),
+        },
+    ];
+}
 /** The `eval` class a cell carries on its own, used when its tool-owned parser names anything narrower. */
 export function fallbackEvalPermissionRequest() {
     return { permission: "eval", patterns: ["*"], always: ["*"] };
@@ -135,16 +178,7 @@ export function createBuiltinParserRegistry() {
         if (!command) {
             return [fallbackPermissionRequest("bash")];
         }
-        const tokens = command.split(/\s+/).filter(Boolean);
-        const prefix = BashArity.prefix(tokens).join(" ");
-        const always = prefix ? [prefix, `${prefix} *`] : ["*"];
-        const requests = [
-            {
-                permission: "bash",
-                patterns: [prefix || command],
-                always,
-            },
-        ];
+        const requests = bashCommandRequests(command);
         const externalPaths = extractExternalPaths(command, cwd);
         if (externalPaths.length > 0) {
             requests.push({

package/dist/core/session-control-actions.js

@@ -10,8 +10,6 @@ export function createSessionControlActions(deps) {
     let retired = false;
     return {
         registerControlEndpoint: async (options) => {
-            if (process.platform === "win32")
-                return { status: "unsupported", reason: "unsupported_platform" };
             const host = deps.host();
             if (host === undefined)
                 return { status: "unsupported", reason: "unsupported_mode" };

package/dist/modes/interactive/session-control-attach.d.ts

@@ -7,12 +7,19 @@
  *
  * The terminal itself is one attachment; each attached client adds one. A client that only subscribed
  * (mirror included) is not an attachment.
+ *
+ * It also keeps what a host keeps per connection and per session for the drive set (senpi#4267): the roles each
+ * connection declared with `set_client_info`, and the admission receipt of every input sent with a `clientMessageId`,
+ * so a retry is answered from its receipt instead of being delivered twice.
  */
 import type { AgentSession } from "../../core/agent-session.ts";
+import { ConnectionRoles } from "../rpc/connection-roles.ts";
 import { SessionEventWriter } from "../rpc/session-event-writer.ts";
 import type { ControlConnection } from "./session-control-server.ts";
 export declare class ControlAttachments {
     readonly writer: SessionEventWriter;
+    readonly roles: ConnectionRoles;
+    readonly receipts: Map<string, TerminalInputReceipt>;
     private readonly attached;
     private readonly stopRecords;
     private readonly session;
@@ -21,6 +28,8 @@ export declare class ControlAttachments {
     get handle(): string;
     opened(connection: ControlConnection): void;
     closed(connection: ControlConnection): void;
+    /** Drops this connection's attachment (`release_attachment`); false when it was not attached. */
+    detach(connection: ControlConnection): boolean;
     /** Attaches the connection: it is replayed the in-flight snapshot, then receives the session's records. */
     attach(connection: ControlConnection): boolean;
     isAttached(connection: ControlConnection): boolean;
@@ -30,6 +39,17 @@ export declare class ControlAttachments {
     dispose(): void;
     private entryView;
 }
+/** The receipt a terminal answers an input sent with a `clientMessageId` with, and answers again on a retry. */
+export interface TerminalInputReceipt {
+    /** What was sent: a retry with the same id and different content is a conflict, as on a host. */
+    readonly fingerprint: string;
+    readonly disposition: "started" | "queued";
+    readonly admission: {
+        readonly clientMessageId: string;
+        readonly durableSessionId: string;
+        readonly disposition: "started" | "queued";
+    };
+}
 /** The writer's id for one control connection. */
 export declare function keyOf(connection: ControlConnection): string;
 //# sourceMappingURL=session-control-attach.d.ts.map

package/dist/modes/interactive/session-control-attach.js

@@ -1,9 +1,12 @@
+import { ConnectionRoles } from "../rpc/connection-roles.js";
 import { SessionEventWriter } from "../rpc/session-event-writer.js";
 import { subscribeSessionRecords } from "../rpc/session-record-stream.js";
 import { sessionRuntimeView } from "../rpc/session-status-source.js";
 export class ControlAttachments {
     constructor(session, pendingQuestions) {
         this.writer = new SessionEventWriter(() => { });
+        this.roles = new ConnectionRoles();
+        this.receipts = new Map();
         this.attached = new Set();
         this.session = session;
         this.writer.status.setSource({
@@ -29,8 +32,18 @@ export class ControlAttachments {
         const key = keyOf(connection);
         if (this.attached.delete(key))
             this.writer.status.publish(this.handle, "detach", "client");
+        this.roles.release(key);
         this.writer.unregisterConnection(key);
     }
+    /** Drops this connection's attachment (`release_attachment`); false when it was not attached. */
+    detach(connection) {
+        const key = keyOf(connection);
+        if (!this.attached.delete(key))
+            return false;
+        this.writer.detachConnectionFromSession(key, this.handle);
+        this.writer.status.publish(this.handle, "detach", "client");
+        return true;
+    }
     /** Attaches the connection: it is replayed the in-flight snapshot, then receives the session's records. */
     attach(connection) {
         const key = keyOf(connection);

package/dist/modes/interactive/session-control-commands.js

@@ -2,16 +2,18 @@
  * The terminal control endpoint's command surface. It answers who it is, which one session it holds
  * and that session's state and messages, renames it, streams its feed, wakes its inbox drain, relays
  * an answer to a question the session itself asked, and applies the pane's own session controls (a
- * model, a thinking level, an interrupt - `session-control-session-commands.ts`). Nothing here can
- * prompt, steer, queue a follow-up, open a session or run a command - one delivery authority (the
- * registrant's drain) applies messages, through admission, and only there. Every other command is
- * answered `unsupported` as data; `get_protocol_info` lists the accepted ones in `commands`.
+ * model, a thinking level, an interrupt - `session-control-session-commands.ts`), and serves the host's
+ * observe-and-drive set over its one session (`session-control-rpc-commands.ts`, senpi#3229, senpi#4267). Input
+ * goes through the session's admission and only there. Every other command is answered `unsupported` as data;
+ * `get_protocol_info` lists the accepted ones in `commands`.
  */
 import { VERSION } from "../../config.js";
 import { engineBuildIdentity } from "../../core/engine-build-identity.js";
-import { SESSION_STATUS_CAPABILITY } from "../rpc/custom-capability.js";
+import { ENTRIES_TAIL_CAPABILITY, OBSERVE_READS_CAPABILITY, SESSION_STATUS_CAPABILITY, TUI_OBSERVER_CAPABILITY, } from "../rpc/custom-capability.js";
+import { answerGetEntries } from "../rpc/get-entries-command.js";
 import { answeredUiRequestId, settledQuestionStatus, unansweredQuestionIds } from "../rpc/extension-ui-response.js";
 import { buildRpcSessionState } from "../rpc/rpc-session-state.js";
+import { sessionUiAnswerLedger } from "../rpc/ui-answer-ledger.js";
 import { runTuiRpcCommand, TUI_RPC_COMMANDS } from "./session-control-rpc-commands.js";
 import { failure, success } from "./session-control-server.js";
 import { runSessionControlCommand, SESSION_CONTROL_COMMANDS, } from "./session-control-session-commands.js";
@@ -21,6 +23,7 @@ const TUI_CONTROL_COMMANDS = [
     "list_sessions",
     "get_state",
     "get_messages",
+    "get_entries",
     "set_session_name",
     "subscribe",
     "wake",
@@ -37,7 +40,15 @@ export async function runControlCommand(context, connection, command) {
             return success(id, type, {
                 protocolVersion: 1,
                 serverVersion: VERSION,
-                capabilities: [TUI_CONTROL_CAPABILITY, SESSION_STATUS_CAPABILITY],
+                capabilities: [
+                    TUI_CONTROL_CAPABILITY,
+                    SESSION_STATUS_CAPABILITY,
+                    TUI_OBSERVER_CAPABILITY,
+                    OBSERVE_READS_CAPABILITY,
+                    ENTRIES_TAIL_CAPABILITY,
+                    "snapshot_cursor",
+                    "ui_answer_ledger",
+                ],
                 mode: "tui",
                 endpoint_kind: "tui",
                 instanceId: context.instanceId,
@@ -60,6 +71,8 @@ export async function runControlCommand(context, connection, command) {
             });
         case "get_messages":
             return success(id, type, { messages: session.messages });
+        case "get_entries":
+            return answerGetEntries(session, command);
         case "set_session_name": {
             const name = typeof command.name === "string" ? command.name.trim() : "";
             if (name === "")
@@ -79,7 +92,7 @@ export async function runControlCommand(context, connection, command) {
             return success(id, type, { admitted: result.admitted ?? [] });
         }
         case "extension_ui_response":
-            return answerQuestion(context.surface, command);
+            return answerQuestion(context, command);
         default: {
             const rpc = await runTuiRpcCommand(context, connection, command);
             if (rpc !== undefined)
@@ -111,12 +124,25 @@ function sessionRow(session) {
  * settles by the host's rule (`settledQuestionStatus`), so the same frame reaches the model as the same
  * message on either surface.
  */
-function answerQuestion(surface, command) {
+function answerQuestion(context, command) {
+    const { surface, session } = context;
+    const ledger = sessionUiAnswerLedger(session);
+    const answerId = command.answerId;
+    if (answerId !== undefined && (typeof answerId !== "string" || answerId.length < 1 || answerId.length > 256))
+        return failure(command.id, "extension_ui_response", "invalid_answer_id");
     const frameId = command.id;
     const requestId = answeredUiRequestId(command);
+    const receipt = requestId === undefined || answerId === undefined ? undefined : ledger.lookup(requestId, answerId);
+    if (receipt === "replay")
+        return { ...success(frameId, "extension_ui_response"), disposition: receipt };
+    if (receipt === "already_answered")
+        return { ...failure(frameId, "extension_ui_response", "already_answered"), disposition: receipt };
     const request = requestId === undefined ? undefined : surface.pendingQuestion(requestId);
     if (requestId === undefined || request === undefined) {
-        return failure(frameId, "extension_ui_response", "unknown_request");
+        return {
+            ...failure(frameId, "extension_ui_response", answerId === undefined ? "unknown_request" : "unknown_extension_ui_request"),
+            disposition: "unknown",
+        };
     }
     const response = questionResponse(command, request.questions);
     if (response === "question_incomplete")
@@ -124,7 +150,8 @@ function answerQuestion(surface, command) {
     if (response === undefined || !surface.answerQuestion(requestId, response)) {
         return failure(frameId, "extension_ui_response", "invalid_response");
     }
-    return success(frameId, "extension_ui_response");
+    ledger.record(requestId, answerId);
+    return { ...success(frameId, "extension_ui_response"), disposition: "applied" };
 }
 function questionResponse(command, questions) {
     // Another client's cancel (the desktop's Remove) is the user's; the builtin settles it from its own draft.

package/dist/modes/interactive/session-control-registry.d.ts

@@ -3,7 +3,8 @@ import { type HostDaemonPaths } from "../rpc/host-daemon-paths.ts";
  * `<agentDir>/rpc/tui/t-<16hex>.sock`, or - when the agent directory is too deep for `sun_path` -
  * the same name under `/tmp/senpi-rpc-<sha256(agentDir)[:8]>/tui/`. The fallback root is
  * predictable, so it is used only when it is a real directory owned by this user with no group or
- * other access; anything else fails the registration instead of binding into it.
+ * other access; anything else fails the registration instead of binding into it. On win32 the path is only the
+ * logical address (the listener binds a named pipe hashed from it), so it never moves (senpi#4267).
  */
 export declare function resolveTuiSocket(agentDir: string, instanceId: string): Promise<string>;
 export interface TuiRegistryEntry {

package/dist/modes/interactive/session-control-registry.js

@@ -27,12 +27,13 @@ const REGISTRY_LOCK_WAIT_MS = 5_000;
  * `<agentDir>/rpc/tui/t-<16hex>.sock`, or - when the agent directory is too deep for `sun_path` -
  * the same name under `/tmp/senpi-rpc-<sha256(agentDir)[:8]>/tui/`. The fallback root is
  * predictable, so it is used only when it is a real directory owned by this user with no group or
- * other access; anything else fails the registration instead of binding into it.
+ * other access; anything else fails the registration instead of binding into it. On win32 the path is only the
+ * logical address (the listener binds a named pipe hashed from it), so it never moves (senpi#4267).
  */
 export async function resolveTuiSocket(agentDir, instanceId) {
     const name = tuiSocketName(instanceId);
     const primary = join(agentDir, "rpc", "tui", name);
-    if (Buffer.byteLength(primary) <= MAX_SOCKET_PATH_BYTES) {
+    if (process.platform === "win32" || Buffer.byteLength(primary) <= MAX_SOCKET_PATH_BYTES) {
         await makePrivateDirectory(dirname(primary));
         return primary;
     }

package/dist/modes/interactive/session-control-rpc-commands.d.ts

@@ -1,8 +1,10 @@
 import type { AgentSession } from "../../core/agent-session.ts";
 import { type ControlAttachments } from "./session-control-attach.ts";
-import type { ControlCommand, ControlConnection } from "./session-control-server.ts";
-export declare const TUI_RPC_COMMANDS: readonly ["open_session", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "get_effect_status"];
+import { type ControlCommand, type ControlConnection } from "./session-control-server.ts";
+export declare const TUI_RPC_COMMANDS: readonly ["open_session", "get_snapshot", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "get_effect_status", "set_client_info", "attach_session", "release_attachment", "abort"];
 export interface RpcCommandContext {
+    /** This endpoint's instance id: the `expectedHostInstance` an `attach_session` may name. */
+    readonly instanceId: string;
     readonly session: AgentSession;
     readonly attachments: ControlAttachments;
 }

package/dist/modes/interactive/session-control-rpc-commands.js

@@ -3,28 +3,60 @@
  * attaches by path or id, `subscribe_sessions`/`unsubscribe_sessions` run the host's status stream over
  * this one session, `steer`/`follow_up`/`prompt` go through the session's external admission (the
  * terminal's one delivery authority, so the user's draft still holds them) with the host's `whenIdle`
- * meaning, and `get_effect_status` reads the same effect ledger. A frame this file does not own answers
+ * meaning, and `get_effect_status` reads the same effect ledger. The rest of the host's drive set answers with the
+ * host's contract (senpi#4267): `set_client_info` declares the connection's roles, `attach_session` and
+ * `release_attachment` take and drop a live attachment on the session's identity, `abort` runs the host's effect
+ * path and its role rule (a Stop needs `interactive_user`), and input sent with a `clientMessageId` is answered
+ * with an admission receipt that a retry gets again, marked `replayed`. A frame this file does not own answers
  * `undefined` and falls through to the endpoint's other commands.
  */
 import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
-import { runGetEffectStatus } from "../rpc/effect-commands.js";
+import { CONNECTION_ROLE_FIXED } from "../rpc/connection-roles.js";
+import { INTERACTIVE_USER_CAPABILITY } from "../rpc/custom-capability.js";
+import { runAbort, runGetEffectStatus } from "../rpc/effect-commands.js";
 import { buildRpcSessionState } from "../rpc/rpc-session-state.js";
+import { getSnapshot } from "../rpc/get-snapshot.js";
 import { answerSubscribeSessions, answerUnsubscribeSessions, refusal } from "../rpc/session-status-commands.js";
 import { keyOf } from "./session-control-attach.js";
+import { failure, success } from "./session-control-server.js";
 export const TUI_RPC_COMMANDS = [
     "open_session",
+    "get_snapshot",
     "subscribe_sessions",
     "unsubscribe_sessions",
     "steer",
     "follow_up",
     "prompt",
     "get_effect_status",
+    "set_client_info",
+    "attach_session",
+    "release_attachment",
+    "abort",
 ];
+/** The host's answer to a Stop from a connection that never declared the user's role (senpi#3811). */
+const STOP_REQUIRES_INTERACTIVE_CLIENT = "stop_requires_interactive_client: declare interactive_user with set_client_info first";
 /** `null` = answered on the writer already; `undefined` = not a command this file owns. */
 export async function runTuiRpcCommand(context, connection, command) {
     switch (command.type) {
+        case "get_snapshot": {
+            const { attachments, session } = context;
+            if (command.sessionId !== undefined && command.sessionId !== attachments.handle)
+                return {
+                    id: command.id,
+                    type: "response",
+                    command: command.type,
+                    success: false,
+                    error: "unknown_session",
+                };
+            const snapshot = getSnapshot(session, { tail: command.tail, maxBytes: command.maxBytes }, {
+                enqueue: (markerId) => attachments.run(connection, () => attachments.writer.enqueue(attachments.handle, { type: "snapshot_marker", markerId })),
+            });
+            return "error" in snapshot
+                ? { id: command.id, type: "response", command: command.type, success: false, error: snapshot.error }
+                : answered(idOf(command), command.type, snapshot.data);
+        }
         case "open_session":
             return openSession(context, connection, command);
         case "subscribe_sessions":
@@ -36,6 +68,14 @@ export async function runTuiRpcCommand(context, connection, command) {
             return admitInput(context, command, command.type === "steer" ? "steer" : "followUp", command.whenIdle);
         case "prompt":
             return admitPrompt(context, command);
+        case "set_client_info":
+            return setClientInfo(context, connection, command);
+        case "attach_session":
+            return attachSession(context, connection, command);
+        case "release_attachment":
+            return releaseAttachment(context, connection, command);
+        case "abort":
+            return abort(context, connection, frame(command));
         case "get_effect_status":
             return runGetEffectStatus({
                 session: context.session,
@@ -74,6 +114,68 @@ function openSession(context, connection, command) {
     });
     return null;
 }
+/** Declares this connection's roles, fixed once declared, exactly as on a host; the other fields change nothing here. */
+function setClientInfo(context, connection, command) {
+    const capabilities = command.capabilities;
+    if (capabilities === undefined)
+        return success(command.id, "set_client_info");
+    if (!Array.isArray(capabilities) || !capabilities.every((entry) => typeof entry === "string"))
+        return failure(command.id, "set_client_info", "capabilities must be an array of strings");
+    if (!context.attachments.roles.declare(keyOf(connection), capabilities))
+        return failure(command.id, "set_client_info", CONNECTION_ROLE_FIXED);
+    return success(command.id, "set_client_info");
+}
+/**
+ * A live attachment on the session's identity, as on a host: `sessionId` is this terminal's routing handle,
+ * `durableSessionId` its session id, and `expectedHostInstance`, when sent, this endpoint's instance id. The answer
+ * follows the replay of the in-flight snapshot, then the session's records reach the connection.
+ */
+function attachSession(context, connection, command) {
+    const { session, attachments } = context;
+    const id = idOf(command);
+    if (command.sessionId !== attachments.handle)
+        return refusal(id, "attach_session", "unknown_session", {
+            reason: "this terminal hosts one session and the request names another",
+            action: "attach with this terminal's sessionId from list_sessions",
+        });
+    const instanceMatches = command.expectedHostInstance === undefined || command.expectedHostInstance === context.instanceId;
+    if (command.durableSessionId !== session.sessionId || !instanceMatches)
+        return refusal(id, "attach_session", "session_identity_mismatch", {
+            reason: "durableSessionId or expectedHostInstance does not name this terminal's session",
+            action: "read list_sessions and get_protocol_info again, then attach with their ids",
+        });
+    attachments.run(connection, () => {
+        attachments.attach(connection);
+        attachments.writer.enqueue(attachments.handle, {
+            id: command.id,
+            type: "response",
+            command: "attach_session",
+            success: true,
+            data: { sessionId: attachments.handle, attached: true },
+        });
+    });
+    return null;
+}
+function releaseAttachment(context, connection, command) {
+    if (command.sessionId !== context.attachments.handle || !context.attachments.detach(connection))
+        return refusal(idOf(command), "release_attachment", "session_not_attached", {
+            reason: "this connection is not attached to that session",
+            action: "attach first with attach_session or open_session",
+        });
+    // Nothing outlives the terminal's own attachment, so a release is never deferred.
+    return success(command.id, "release_attachment", { deferred: false });
+}
+/** The host's `abort`: the same effect receipts, and a Stop only from a connection that declared `interactive_user`. */
+async function abort(context, connection, command) {
+    const key = keyOf(connection);
+    if (command.intent === "stop" && !context.attachments.roles.has(key, INTERACTIVE_USER_CAPABILITY))
+        return failure(command.id, "abort", STOP_REQUIRES_INTERACTIVE_CLIENT);
+    const { session } = context;
+    return runAbort({ session, by: { connectionId: key }, sessionId: context.attachments.handle }, command, () => (command.intent === "stop" ? session.stop() : session.abort()).catch((cause) => {
+        // Reported out of band, as on a host; the answer never waits on it.
+        connection.send({ type: "rpc_error", error: String(cause) });
+    }));
+}
 function subscribe(context, connection, command) {
     const { writer } = context.attachments;
     const key = keyOf(connection);
@@ -145,6 +247,22 @@ function admitInput(context, command, deliverAs, whenIdle) {
         });
     const admission = context.session.externalAdmission;
     const clientMessageId = typeof command.clientMessageId === "string" ? command.clientMessageId : undefined;
+    const fingerprint = JSON.stringify([command.type, message, deliverAs, whenIdle ?? null]);
+    const prior = clientMessageId === undefined ? undefined : context.attachments.receipts.get(clientMessageId);
+    if (prior !== undefined) {
+        if (prior.fingerprint !== fingerprint)
+            return refusal(id, command.type, "client_message_id_conflict", {
+                reason: `clientMessageId ${clientMessageId} was already used for different input`,
+                action: "send new input with a new clientMessageId",
+            });
+        return answered(id, command.type, {
+            disposition: prior.disposition,
+            clientMessageId,
+            replayed: true,
+            duplicate: true,
+            admission: prior.admission,
+        });
+    }
     const expected = typeof command.expected_turn_id === "number" ? command.expected_turn_id : admission.turnEpoch;
     const result = admission.admit({
         delivery_id: clientMessageId ?? `tui-rpc-${randomUUID()}`,
@@ -155,12 +273,23 @@ function admitInput(context, command, deliverAs, whenIdle) {
         whenIdle: whenIdle === "start" ? "start" : "queue",
     });
     const identity = clientMessageId === undefined ? {} : { clientMessageId };
+    const admitted = (disposition) => {
+        if (clientMessageId === undefined)
+            return answered(id, command.type, { disposition });
+        const receipt = {
+            fingerprint,
+            disposition,
+            admission: { clientMessageId, durableSessionId: context.session.sessionId, disposition },
+        };
+        context.attachments.receipts.set(clientMessageId, receipt);
+        return answered(id, command.type, { disposition, clientMessageId, admission: receipt.admission });
+    };
     switch (result.kind) {
         case "started":
-            return answered(id, command.type, { disposition: "started", ...identity });
+            return admitted("started");
         case "steered":
         case "queued":
-            return answered(id, command.type, { disposition: "queued", ...identity });
+            return admitted("queued");
         case "already_admitted":
             return answered(id, command.type, { disposition: "queued", duplicate: true, ...identity });
         case "held_draft":

package/dist/modes/interactive/session-control-server.js

@@ -3,13 +3,17 @@
  * (`authenticateSocket`, the handshake every RPC transport shares); a wrong secret is disconnected
  * before a single JSONL line is read. After that it is the RPC framing: one LF-terminated JSON
  * object per request, one response per request carrying its `id`, plus pushed feed events.
+ *
+ * The socket path is the endpoint's logical address on every platform (its secret lives beside it); on win32 the
+ * listener binds the named pipe the host transport derives from that path and the secret (senpi#4267), which is
+ * the address every client already connects to.
  */
 import { chmod } from "node:fs/promises";
 import { createServer } from "node:net";
 import { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS, serializeJsonLine } from "../rpc/jsonl.js";
 import { rpcCommandShapeError } from "../rpc/rpc-input-validation.js";
 import { socketSink } from "../rpc/socket-sink.js";
-import { authenticateSocket } from "../rpc/socket-transport.js";
+import { authenticateSocket, resolveSocketTransportAddress } from "../rpc/socket-transport.js";
 export async function listenControlSocket(socketPath, secret, handlers) {
     const clients = new Set();
     let nextConnection = 0;
@@ -21,13 +25,15 @@ export async function listenControlSocket(socketPath, secret, handlers) {
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
-        server.listen(socketPath, () => {
+        server.listen(resolveSocketTransportAddress(socketPath, process.platform, secret), () => {
             server.off("error", reject);
             resolve();
         });
     });
     server.on("error", (error) => handlers.listenerError(error));
-    await chmod(socketPath, 0o600);
+    // A named pipe has no file to restrict: the secret, 0600 beside the logical path, is its gate.
+    if (process.platform !== "win32")
+        await chmod(socketPath, 0o600);
     return { close: () => closeServer(server, clients) };
 }
 function acceptConnection(socket, id, handlers) {

package/dist/modes/rpc/compact-content-store.d.ts

@@ -0,0 +1,96 @@
+import { type CompactStorageFailure, type CompactStorageIo } from "./compact-storage-io.ts";
+/**
+ * Owned bounded leaves for compact current state (senpi#4272, R3.C6.4 / R3.C2.4).
+ *
+ * Acceptance never waits here: a leaf is created synchronously in RAM, and a spill only relocates
+ * that immutable value. Its RAM copy is released only after the whole file was written and closed;
+ * a failed write keeps the bytes resident, halts further spilling and is reported through
+ * `status()`, never dropped. All storage work runs as one serial asynchronous job chain.
+ */
+/** 32,768 UTF-16 code units (64 KiB as UTF-16LE), so a split surrogate survives a leaf boundary exactly. */
+export declare const COMPACT_LEAF_CODE_UNITS = 32768;
+export type LeafId = number;
+export interface CompactStorageStatus {
+    readonly residentPayloadBytes: number;
+    readonly pendingIoCopyBytes: number;
+    readonly pinnedOnlyBytes: number;
+    readonly spilledLiveBytes: number;
+    readonly spillBytesWritten: number;
+    readonly reclaimDebtBytes: number;
+    /** Resident bytes above the spill target that a halted spool keeps in RAM (ruling 08 condition 1). */
+    readonly spillFailureRetainedBytes: number;
+    readonly spillHalted: boolean;
+    readonly failures: readonly CompactStorageFailure[];
+}
+export interface CompactContentStoreOptions {
+    /** Private epoch spool directory the store creates itself (0700, never an existing one; files 0600). Not a transcript. */
+    readonly dir: string;
+    readonly io?: CompactStorageIo;
+    /** Spilling starts above this many resident leaf bytes and stops at the target. */
+    readonly spillAboveBytes?: number;
+    readonly spillTargetBytes?: number;
+}
+export declare class CompactContentStore {
+    readonly dir: string;
+    private readonly io;
+    private readonly spillAboveBytes;
+    private readonly spillTargetBytes;
+    private readonly leaves;
+    /** Resident leaves in creation order, so each spill takes the oldest without rescanning committed ones. */
+    private readonly ramLeaves;
+    private readonly failures;
+    private nextLeafId;
+    private nextFile;
+    private dirReady;
+    private spoolToken;
+    private chain;
+    private queued;
+    private spillQueued;
+    private halted;
+    private retired;
+    private residentPayloadBytes;
+    private pendingIoCopyBytes;
+    private pinnedOnlyBytes;
+    private spilledLiveBytes;
+    private spillBytesWritten;
+    private reclaimDebtBytes;
+    constructor(options: CompactContentStoreOptions);
+    /** Takes ownership of an immutable value with one live reference. */
+    createLeaf(text: string): LeafId;
+    /** Moves live and cut-pin references; the last reference drops RAM or reclaims the file. */
+    adjust(id: LeafId, live: number, pins: number): void;
+    /** Reads a leaf the caller still references, from RAM or its committed file. */
+    readLeaf(id: LeafId): Promise<string>;
+    /** Resolves once every queued storage job, including the ones they queued, has completed. */
+    idle(): Promise<void>;
+    /**
+     * Invalidates spilling, joins owned I/O, then removes the epoch directory only when this store
+     * created it and it still passes the ownership checks; otherwise rejects with `CompactSpoolRefusedError`.
+     */
+    retire(): Promise<void>;
+    status(): CompactStorageStatus;
+    /** Reads a committed file and rejects a missing, unreadable or short one. */
+    private readFile;
+    /** Writes one new spool file; undefined means the write failed, was reported, and spilling halted. */
+    private writeFile;
+    /**
+     * An unreferenced (or partially written) spool file: reclamation debt until its unlink completes or
+     * finds it gone. Files dropped after retirement started belong to the directory retirement removes.
+     */
+    private discard;
+    /** A failed unlink keeps its debt and is retried with bounded backoff outside the job chain. */
+    private reclaim;
+    private get spillAllowed();
+    /** True while a storage failure or unreclaimed debt above the work allowance holds spilling back. */
+    private get spillStopped();
+    private enqueue;
+    private scheduleSpill;
+    /** Spills one oldest resident leaf per job, so other storage work interleaves fairly. */
+    private spillNext;
+    /** Creates the private epoch directory once; a refusal or failure halts spilling and is reported. */
+    private ensureDir;
+    private readFailure;
+    private fail;
+    private record;
+}
+//# sourceMappingURL=compact-content-store.d.ts.map