@code-yeongyu/senpi 2026.10.25-3 → 2026.10.26-1

package/dist/modes/rpc/host-capabilities.js

@@ -1,7 +1,7 @@
 import { isHostOwnedToolRuntimeCapability, toolRuntimeCapabilities, } from "../../cli/tool-runtime.js";
 import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPABILITY, } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
-import { ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, ENTRIES_TAIL_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, OBSERVE_READS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY } from "./rpc-types.js";
 import { MOVE_SESSION_CAPABILITY, MOVE_SESSION_REVOKE_CAPABILITY } from "./session-move-wire.js";
@@ -20,6 +20,9 @@ export function multiSessionHostCapabilities(options) {
     return [
         ...new Set([
             "multi_session",
+            "snapshot_cursor",
+            "ui_answer_ledger",
+            "dialog_observer",
             ...(options.mcpPresenters ? ["mcp_form_presenter_v1"] : []),
             "session_lifecycle",
             "expected_host_instance",
@@ -44,6 +47,9 @@ export function multiSessionHostCapabilities(options) {
             SESSION_HELD_CAPABILITY,
             RESUME_SESSION_CAPABILITY,
             ATTENDED_CAPABILITY,
+            // `get_state`/`get_entries` marked `observe` never attach, and history reads page backward too (senpi#4267).
+            OBSERVE_READS_CAPABILITY,
+            ENTRIES_TAIL_CAPABILITY,
             // Host capabilities, not client opt-ins: only a multi-session host owns the
             // attachment refcount `open_session.retain_on_disconnect` detaches from, the
             // per-session launch profile `context`/`auto_title` travel on, and the session

package/dist/modes/rpc/host-ensure-start.js

@@ -63,6 +63,7 @@ export async function startHost(paths, socket, options, generation = 0) {
             socket,
             ...(options.owner ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
             ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
+            ...(options.mcpPresenterEnforcement ? ["--mcp-presenter-enforcement"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = testOptions?.spawn ?? testOptions?.launch?.(supervisorArgs) ?? defaultHostLaunch(supervisorArgs);

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -12,6 +12,8 @@ import type { Duplex } from "node:stream";
 export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
     readonly presenterBootstrap?: Duplex;
+    /** Deployment opt-in, never a project setting or proof of enrollment. Defaults off for a new host. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly socket: string;
     readonly agentDir?: string;
     readonly keyRoot?: string;

package/dist/modes/rpc/host-ensure.js

@@ -206,6 +206,7 @@ async function upgradeGeneration(paths, socket, options, attachedPid) {
         agentDir: options.agentDir ?? getAgentDir(),
         hostArgs: options.hostArgs ?? [],
         presenterBootstrap: options.presenterBootstrap,
+        mcpPresenterEnforcement: options.mcpPresenterEnforcement,
         ...(options.env ? { env: options.env } : {}),
         ...(options.policy ? { policy: options.policy } : {}),
         _test: {

package/dist/modes/rpc/host-handoff.d.ts

@@ -7,6 +7,8 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
 export declare const HANDOFF_LOCK_HOLD_MS: number;
 export interface HandoffHostOptions {
     readonly presenterBootstrap?: Duplex;
+    /** Deployment opt-in. An enforcing predecessor never downgrades during replacement. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly socket: string;
     readonly agentDir?: string;
     /** Extra CLI arguments the successor's host child is launched with (provider pinning, extensions). */

package/dist/modes/rpc/host-handover-request.d.ts

@@ -9,5 +9,5 @@ export interface IdleHandoverTerms {
 export declare function idleHandoverOutcome(target: {
     readonly socket: string;
     readonly agentDir: string;
-}, spec: ResolvedHostLaunchSpec, terms: IdleHandoverTerms): Promise<HostOutcome>;
+}, spec: ResolvedHostLaunchSpec, terms: IdleHandoverTerms, mcpPresenterEnforcement?: boolean): Promise<HostOutcome>;
 //# sourceMappingURL=host-handover-request.d.ts.map

package/dist/modes/rpc/host-handover-request.js

@@ -28,7 +28,7 @@ import { RUNTIME_IDENTITY_HANDOVER_CAPABILITY } from "./runtime-build-id.js";
 const PROBE_TIMEOUT_MS = 10_000;
 /** A host idle at once hands over before answering: its ensure-lock wait plus the handoff itself. */
 const BEGIN_HANDOVER_TIMEOUT_MS = 2 * HANDOFF_LOCK_HOLD_MS + 20_000;
-export async function idleHandoverOutcome(target, spec, terms) {
+export async function idleHandoverOutcome(target, spec, terms, mcpPresenterEnforcement) {
     const { socket } = target;
     if (process.platform === "win32") {
         return refusal("refuse", undefined, { reason: "upgrade_unsupported", socket, operationId: terms.operationId });
@@ -57,7 +57,7 @@ export async function idleHandoverOutcome(target, spec, terms) {
     }
     if (!before.capabilities.includes(RUNTIME_IDENTITY_HANDOVER_CAPABILITY))
         return refuse("handover_unsupported");
-    const reply = await requestOnSocket(socket, beginHandoverCommand(target, spec, terms), BEGIN_HANDOVER_TIMEOUT_MS);
+    const reply = await requestOnSocket(socket, beginHandoverCommand(target, spec, terms, mcpPresenterEnforcement), BEGIN_HANDOVER_TIMEOUT_MS);
     if (!isRecord(reply))
         return reconcileLostReply(target, terms, before);
     if (typeof reply.refused === "string") {
@@ -71,7 +71,7 @@ export async function idleHandoverOutcome(target, spec, terms) {
     }
     return answered(target, "handover_pending", before, terms, reply);
 }
-function beginHandoverCommand(target, spec, terms) {
+function beginHandoverCommand(target, spec, terms, mcpPresenterEnforcement) {
     const env = {};
     for (const [name, value] of Object.entries(daemonEnvironment(process.env, daemonEnvOverrides(process.env, spec.env)))) {
         if (value !== undefined)
@@ -88,6 +88,7 @@ function beginHandoverCommand(target, spec, terms) {
         launch: { command: launch.command, args: launch.args },
         host_args: spec.hostArgs,
         env,
+        ...(mcpPresenterEnforcement === true && { mcp_presenter_enforcement: true }),
         ...(spec.policy !== undefined && { policy: spec.policy }),
     };
 }

package/dist/modes/rpc/host-handover-wire.js

@@ -33,6 +33,10 @@ export function parseBeginHandover(record) {
     }
     const policy = isRecord(record.policy) ? record.policy : undefined;
     const { agent_dir } = record;
+    const mcpPresenterEnforcement = record.mcp_presenter_enforcement;
+    if (mcpPresenterEnforcement !== undefined && typeof mcpPresenterEnforcement !== "boolean") {
+        return "mcp_presenter_enforcement must be a boolean";
+    }
     if (agent_dir !== undefined && (typeof agent_dir !== "string" || agent_dir === "")) {
         return "agent_dir must be a non-empty string";
     }
@@ -44,6 +48,7 @@ export function parseBeginHandover(record) {
         launch: { command: launch.command, args: launch.args },
         hostArgs: host_args,
         env: env,
+        ...(mcpPresenterEnforcement !== undefined && { mcpPresenterEnforcement }),
         ...(policy !== undefined && { policy }),
         ...(agent_dir !== undefined && { agentDir: agent_dir }),
     };
@@ -121,6 +126,7 @@ export async function performIdleHandover(context) {
     Object.assign(env, request.env);
     const result = await handoffHost({
         presenterBootstrap: context.presenterBootstrap,
+        mcpPresenterEnforcement: request.mcpPresenterEnforcement,
         socket,
         agentDir,
         hostArgs: request.hostArgs,

package/dist/modes/rpc/host-idle-handover.d.ts

@@ -36,6 +36,8 @@ export interface HandoverLaunch {
     readonly args: readonly string[];
 }
 export interface IdleHandoverRequest {
+    /** Successor deployment policy only; never enrollment authority. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly operationId: string;
     readonly ifInstanceId: string;
     readonly ifGeneration: number;

package/dist/modes/rpc/host-idle-handover.js

@@ -40,7 +40,8 @@ export class HostIdleHandover {
                 : { kind: "refused", reason: "operation_conflict", detail: "this operation id names other terms" };
         }
         if (current !== undefined && current.view.state !== "handover_blocked") {
-            return current.request.targetRuntimeBuildId === request.targetRuntimeBuildId
+            return current.request.targetRuntimeBuildId === request.targetRuntimeBuildId &&
+                Boolean(current.request.mcpPresenterEnforcement) === Boolean(request.mcpPresenterEnforcement)
                 ? answer(current)
                 : { kind: "refused", reason: "handover_in_progress", detail: current.view.operationId };
         }
@@ -112,6 +113,7 @@ export class HostIdleHandover {
 }
 function sameTerms(a, b) {
     return (a.targetRuntimeBuildId === b.targetRuntimeBuildId &&
+        Boolean(a.mcpPresenterEnforcement) === Boolean(b.mcpPresenterEnforcement) &&
         a.ifInstanceId === b.ifInstanceId &&
         a.ifGeneration === b.ifGeneration);
 }

package/dist/modes/rpc/host-observe-request.d.ts

@@ -7,7 +7,8 @@
  * itself with `observe: true`; the supervisor classifies a connection by the requests it sends, and
  * only a connection that sends something other than an observing read becomes an attachment.
  *
- * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing): `observe: true` on any other command is ignored
+ * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing; `get_state` and
+ * `get_entries` read a session's state and history, senpi#4267): `observe: true` on any other command is ignored
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).

package/dist/modes/rpc/host-observe-request.js

@@ -7,7 +7,8 @@
  * itself with `observe: true`; the supervisor classifies a connection by the requests it sends, and
  * only a connection that sends something other than an observing read becomes an attachment.
  *
- * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing): `observe: true` on any other command is ignored
+ * Only the side-effect-free reads can observe (`get_effect_status` answers a receipt and changes nothing; `get_state` and
+ * `get_entries` read a session's state and history, senpi#4267): `observe: true` on any other command is ignored
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).
@@ -27,12 +28,15 @@ export const OBSERVE_REQUEST_FIELD = "observe";
 export const ORIGIN_HOST_INSTANCE_FIELD = "origin_host_instance";
 const OBSERVING_COMMANDS = new Set([
     "get_protocol_info",
+    "get_snapshot",
     "list_sessions",
     "subscribe_sessions",
     "unsubscribe_sessions",
     "get_effect_status",
     "get_pending_inputs",
     "get_subscription_limits",
+    "get_state",
+    "get_entries",
 ]);
 export function isObservingRequest(line) {
     let request;

package/dist/modes/rpc/host-runner.d.ts

@@ -52,5 +52,6 @@ export type HostRequest = {
 export declare function runHostRequest(request: HostRequest, options?: {
     readonly keyRoot?: string;
     readonly presenterBootstrap?: Duplex;
+    readonly mcpPresenterEnforcement?: boolean;
 }): Promise<HostOutcome>;
 //# sourceMappingURL=host-runner.d.ts.map

package/dist/modes/rpc/host-runner.js

@@ -37,9 +37,9 @@ import { hostRequestKeyRoot } from "./host-request-key-root.js";
 import { withRpcKeyRoot } from "./rpc-auth-client.js";
 const PROBE_TIMEOUT_MS = 10_000;
 export async function runHostRequest(request, options = {}) {
-    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap));
+    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap, options.mcpPresenterEnforcement));
 }
-async function runHostRequestInKeyRoot(request, presenterBootstrap) {
+async function runHostRequestInKeyRoot(request, presenterBootstrap, mcpPresenterEnforcement) {
     if (request.action === "ensure" || request.action === "handoff" || request.action === "stop") {
         const { socket, agentDir } = request.target;
         if ((await endpointKindOfSocket(socket, agentDir)) === "tui") {
@@ -48,7 +48,7 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
     }
     switch (request.action) {
         case "ensure":
-            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap);
+            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap, mcpPresenterEnforcement);
         case "status":
             return request.all === true
                 ? statusAllOutcome(request.target, request.includeWorkers)
@@ -57,8 +57,8 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
             return stopOutcome(request);
         case "handoff":
             return request.handover === undefined
-                ? handoffOutcome(request.target, request.spec, presenterBootstrap)
-                : idleHandoverOutcome(request.target, request.spec, request.handover);
+                ? handoffOutcome(request.target, request.spec, presenterBootstrap, mcpPresenterEnforcement)
+                : idleHandoverOutcome(request.target, request.spec, request.handover, mcpPresenterEnforcement);
         case "shard_path":
             return shardPathOutcome(request.kind, request.owner, request.root);
         case "gc":
@@ -70,7 +70,7 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
             return assertNever(request);
     }
 }
-async function ensureOutcome(target, spec, policy, presenterBootstrap) {
+async function ensureOutcome(target, spec, policy, presenterBootstrap, mcpPresenterEnforcement) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     if (policy === "fallback") {
         // `fallback` is the caller saying it can live without a host. The decision is made HERE
@@ -85,6 +85,7 @@ async function ensureOutcome(target, spec, policy, presenterBootstrap) {
         ensured = await ensureHost({
             socket: target.socket,
             presenterBootstrap,
+            mcpPresenterEnforcement,
             agentDir: target.agentDir,
             hostArgs: spec.hostArgs,
             env: daemonEnvOverrides(process.env, spec.env),
@@ -182,11 +183,12 @@ async function stopOutcome(request) {
         },
     };
 }
-async function handoffOutcome(target, spec, presenterBootstrap) {
+async function handoffOutcome(target, spec, presenterBootstrap, mcpPresenterEnforcement) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     const result = await handoffHost({
         socket: target.socket,
         presenterBootstrap,
+        mcpPresenterEnforcement,
         agentDir: target.agentDir,
         hostArgs: spec.hostArgs,
         env: daemonEnvOverrides(process.env, spec.env),

package/dist/modes/rpc/host-successor.js

@@ -83,6 +83,10 @@ export async function startSuccessor(context) {
             `${replaced.dev}:${replaced.ino}`,
             ...(inheritOwnerPipe ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
             ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
+            // Preserve the running host's policy even when an older caller omits the deployment option.
+            ...(options.mcpPresenterEnforcement || host.capabilities.includes("mcp_form_presenter_v1")
+                ? ["--mcp-presenter-enforcement"]
+                : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = (options._test?.launch ?? options.launch)?.(argv) ?? defaultHostLaunch(argv);

package/dist/modes/rpc/json-normal-value.d.ts

@@ -0,0 +1,6 @@
+/** JSON.stringify's value semantics, without serializing or parsing a record. */
+export declare function normalizeJsonValue(input: unknown): {
+    value: unknown;
+    changed: boolean;
+};
+//# sourceMappingURL=json-normal-value.d.ts.map

package/dist/modes/rpc/json-normal-value.js

@@ -0,0 +1,100 @@
+import { isBigIntObject, isBooleanObject, isNumberObject, isStringObject } from "node:util/types";
+/** JSON.stringify's value semantics, without serializing or parsing a record. */
+export function normalizeJsonValue(input) {
+    const ancestors = new Set();
+    let changed = false;
+    const visit = (input, key) => {
+        let value = input;
+        if ((typeof value === "object" && value !== null) || typeof value === "function" || typeof value === "bigint") {
+            const toJSON = value.toJSON;
+            if (typeof toJSON === "function") {
+                value = toJSON.call(value, key);
+                changed = true;
+            }
+        }
+        if (typeof value === "object" && value !== null) {
+            if (isNumberObject(value)) {
+                value = +value;
+                changed = true;
+            }
+            else if (isStringObject(value)) {
+                value = String(value);
+                changed = true;
+            }
+            else if (isBooleanObject(value)) {
+                value = Boolean.prototype.valueOf.call(value);
+                changed = true;
+            }
+            else if (isBigIntObject(value)) {
+                throw new TypeError("Do not know how to serialize a BigInt");
+            }
+        }
+        if (typeof value === "bigint")
+            throw new TypeError("Do not know how to serialize a BigInt");
+        if (typeof value === "number") {
+            const normalized = Number.isFinite(value) ? (Object.is(value, -0) ? 0 : value) : null;
+            if (!Object.is(normalized, value))
+                changed = true;
+            return normalized;
+        }
+        if (typeof value === "undefined" || typeof value === "function" || typeof value === "symbol") {
+            changed = true;
+            return undefined;
+        }
+        if (typeof value !== "object" || value === null)
+            return value;
+        if (ancestors.has(value))
+            throw new TypeError("Converting circular structure to JSON");
+        ancestors.add(value);
+        try {
+            // A non-callable toJSON getter must not be read again by later serialization.
+            if ("toJSON" in value)
+                changed = true;
+            if (Array.isArray(value)) {
+                const array = [];
+                const length = value.length;
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    if (!descriptor || descriptor.get)
+                        changed = true;
+                    array.push(visit(value[index], String(index)) ?? null);
+                }
+                return array;
+            }
+            const result = {};
+            const names = Object.keys(value);
+            if (Object.getPrototypeOf(value) !== Object.prototype || Reflect.ownKeys(value).length !== names.length)
+                changed = true;
+            for (const name of names) {
+                if (Object.getOwnPropertyDescriptor(value, name)?.get)
+                    changed = true;
+                const child = visit(value[name], name);
+                if (child !== undefined)
+                    Object.defineProperty(result, name, {
+                        value: child,
+                        enumerable: true,
+                        configurable: true,
+                        writable: true,
+                    });
+            }
+            return result;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    };
+    let value;
+    try {
+        value = visit(input, "");
+    }
+    catch (error) {
+        // The recursive walk overflows the stack before native JSON does; let native JSON decide.
+        if (!(error instanceof RangeError))
+            throw error;
+        return { value: JSON.parse(JSON.stringify(input)), changed: true };
+    }
+    if (value === undefined)
+        throw new SyntaxError("JSON input has no representation");
+    return { value, changed };
+}
+//# sourceMappingURL=json-normal-value.js.map

package/dist/modes/rpc/mcp-presenter-bootstrap.js

@@ -11,6 +11,11 @@ export function presenterBootstrapStream(fd) {
         const stat = fstatSync(fd);
         if (!stat.isSocket() && !stat.isFIFO())
             return undefined;
+        // Node's fs read blocks a worker until peer EOF, even after destroy(), and process.exit()
+        // joins that worker. A socket handle can cancel the pending read after enrollment.
+        // Bun does not support inherited net.Socket fds; it retains the file-stream adapter below.
+        if (stat.isSocket() && !process.versions.bun)
+            return new Socket({ fd, readable: true, writable: true });
     }
     catch {
         // Bootstrap is optional authority, never a reason to terminate the shared host.

package/dist/modes/rpc/media-placeholders.d.ts

@@ -11,17 +11,18 @@
  * `SessionEventWriter.enqueue`.
  *
  * Two hard rules:
- * - Type-gate FIRST. `message_update` is the hot path (one record per token) and must
- *   never be walked.
+ * - Type-gate the media walk. JSON-value normalization is shared with writer
+ *   acceptance; media projection itself never walks `message_update` partials.
  * - Copy-on-write. Responses hand out live agent state by reference
  *   (`success(id, "get_messages", { messages: session.messages })`), so the input graph
- *   is never mutated and unchanged sub-trees keep their identity. When nothing changed
+ *   is never mutated and unchanged JSON sub-trees keep their identity. When nothing changed
  *   the SAME record reference comes back, which lets the caller reuse the line it
  *   already serialized.
  *
  * User-authored images (`prompt.images`) stay intact: they are bounded by the client
  * that sent them; the fan-out hazard is tool output.
  */
+type RpcRecord = Record<string, unknown>;
 /** Why a host could not keep a tool image on disk for the client to read. */
 export type MediaUnavailableReason = "image_too_large" | "session_limit" | "storage_error";
 /** Where a persisted image lives (absolute), or why there is no file. */
@@ -61,6 +62,8 @@ export interface ImageRefBlock {
  * omitting it.
  */
 export declare function base64ByteLength(data: string): number;
+/** True when this record type can carry a tool result at all (cheap gate). */
+export declare function carriesMedia(record: RpcRecord): boolean;
 /**
  * Replace inline tool-result images with `image_ref` placeholders.
  *
@@ -68,4 +71,7 @@ export declare function base64ByteLength(data: string): number;
  * serialization entirely.
  */
 export declare function omitInlineMedia<T extends object>(record: T, persist?: MediaPersister): T;
+/** `omitInlineMedia` for a value that is already JSON-normal: type gate first, no normalization walk. */
+export declare function omitNormalInlineMedia<T extends object>(record: T, persist?: MediaPersister): T;
+export {};
 //# sourceMappingURL=media-placeholders.d.ts.map

package/dist/modes/rpc/media-placeholders.js

@@ -11,17 +11,18 @@
  * `SessionEventWriter.enqueue`.
  *
  * Two hard rules:
- * - Type-gate FIRST. `message_update` is the hot path (one record per token) and must
- *   never be walked.
+ * - Type-gate the media walk. JSON-value normalization is shared with writer
+ *   acceptance; media projection itself never walks `message_update` partials.
  * - Copy-on-write. Responses hand out live agent state by reference
  *   (`success(id, "get_messages", { messages: session.messages })`), so the input graph
- *   is never mutated and unchanged sub-trees keep their identity. When nothing changed
+ *   is never mutated and unchanged JSON sub-trees keep their identity. When nothing changed
  *   the SAME record reference comes back, which lets the caller reuse the line it
  *   already serialized.
  *
  * User-authored images (`prompt.images`) stay intact: they are bounded by the client
  * that sent them; the fan-out hazard is tool output.
  */
+import { normalizeJsonValue } from "./json-normal-value.js";
 /** Record types that can carry a tool result somewhere in their payload. */
 const MEDIA_BEARING_RECORD_TYPES = new Set([
     "tool_execution_end",
@@ -128,7 +129,7 @@ function omitToolExecutionEndImages(record, persist) {
     return omitted === result.content ? record : { ...record, result: { ...result, content: omitted } };
 }
 /** True when this record type can carry a tool result at all (cheap gate). */
-function carriesMedia(record) {
+export function carriesMedia(record) {
     if (typeof record.type !== "string")
         return false;
     if (MEDIA_BEARING_RECORD_TYPES.has(record.type))
@@ -144,6 +145,13 @@ function carriesMedia(record) {
  * serialization entirely.
  */
 export function omitInlineMedia(record, persist) {
+    const { value, changed } = normalizeJsonValue(record);
+    if (!changed)
+        return omitNormalInlineMedia(record, persist);
+    return omitNormalInlineMedia(value, persist);
+}
+/** `omitInlineMedia` for a value that is already JSON-normal: type gate first, no normalization walk. */
+export function omitNormalInlineMedia(record, persist) {
     const typed = record;
     if (!carriesMedia(typed))
         return record;

package/dist/modes/rpc/rpc-host-command-types.d.ts

@@ -192,6 +192,8 @@ export type RpcCommand = RpcAttachmentCommand | (RpcSessionCommand & {
      * caused the transition (default: true for `childrenOf`, false otherwise).
      */
     effects?: boolean;
+    /** Observe dialog registration and settlement without receiving command replies. */
+    dialogs?: boolean;
     /** Also deliver these content record types of matched sessions (default `"none"`); opt-in, never an attachment. */
     mirror?: "none" | "all" | string[];
     /** Mark the request activity-neutral for the supervisor's idle exit, as on `list_sessions`. */

package/dist/modes/rpc/rpc-question-types.d.ts

@@ -116,6 +116,7 @@ export type RpcExtensionUIResponseFrame = {
     type: "extension_ui_response";
     id: string;
     uiRequestId?: string;
+    answerId?: string;
 };
 export type RpcExtensionUIResponse = (RpcExtensionUIResponseFrame & {
     value: string;

package/dist/modes/rpc/rpc-read-response-types.d.ts

@@ -10,7 +10,14 @@ import type { EffectStatus } from "./effect-record.ts";
 import type { RpcSlashCommand } from "./rpc-command-surface.ts";
 import type { RpcEvalCell, RpcEvalCellSnapshot } from "./rpc-result-types.ts";
 import type { RpcAuthProvider, RpcLoadedExtension, RpcLoadedMcpServer, RpcProviderAccount, RpcSessionState } from "./rpc-session-state-types.ts";
+import type { RpcSnapshot } from "./snapshot-types.ts";
 export type RpcReadResponse = {
+    id?: string;
+    type: "response";
+    command: "get_snapshot";
+    success: true;
+    data: RpcSnapshot;
+} | {
     id?: string;
     type: "response";
     command: "get_state";
@@ -120,6 +127,8 @@ export type RpcReadResponse = {
         leafId: string | null;
         hasMore?: boolean;
         nextSince?: string;
+        /** A `tail` page's oldest entry id while older entries remain (senpi#4267). */
+        next_before?: string;
     };
 } | {
     id?: string;

package/dist/modes/rpc/rpc-session-command-types.d.ts

@@ -182,6 +182,12 @@ export type RpcSessionCommand = {
 } | {
     id?: string;
     type: "get_state";
+} | {
+    id?: string;
+    type: "get_snapshot";
+    tail?: number;
+    maxBytes?: number;
+    observe?: boolean;
 } | {
     id?: string;
     type: "request_self_settle";
@@ -388,11 +394,18 @@ export type RpcSessionCommand = {
 } | {
     id?: string;
     type: "get_fork_messages";
-} | {
+}
+/**
+ * `since`/`before` bound the range (strictly after / strictly before an entry id); `limit` pages it forward from
+ * its start, `tail` backward from its end (`next_before` names the next page, senpi#4267).
+ */
+ | {
     id?: string;
     type: "get_entries";
     since?: string;
+    before?: string;
     limit?: number;
+    tail?: number;
     maxBytes?: number;
 } | {
     id?: string;

package/dist/modes/rpc/rpc-session-state-types.d.ts

@@ -9,6 +9,7 @@ import type { SessionEntry, UsageTotals } from "../../core/session-manager.ts";
 import type { ThinkingLevelSource } from "../../core/session-thinking-memory.ts";
 import type { SourceInfo } from "../../core/source-info.ts";
 import type { RpcExtensionUIRequest, RpcQuestionUiRequest } from "./rpc-question-types.ts";
+import type { UiAnswerReceipt } from "./ui-answer-ledger.ts";
 /** One provider row for the /login and /logout selectors. */
 export interface RpcAuthProvider {
     /** Provider id (e.g. "anthropic", "openai"). */
@@ -61,6 +62,8 @@ export interface RpcSessionModelEntry {
     serviceTier?: ServiceTier;
 }
 export interface RpcSessionState {
+    /** Latest 64 UI-answer receipts in this session generation, oldest first. */
+    answeredUiRequests?: UiAnswerReceipt[];
     paused: boolean;
     pausedNoticeCount: number;
     holds: {

package/dist/modes/rpc/rpc-session-state.js

@@ -7,6 +7,7 @@ import { sanitizeProviderDiagnostic } from "@earendil-works/pi-ai";
 import { ProjectTrustStore } from "../../core/trust-manager.js";
 import { clientFacingIdentity } from "./client-admission-record.js";
 import { sessionQuestionBridges } from "./connection-question-bridge.js";
+import { sessionUiAnswerLedger } from "./ui-answer-ledger.js";
 import { sessionDialogRequests } from "./session-extension-ui-requests.js";
 /**
  * Project one session into the wire state shape.
@@ -29,6 +30,7 @@ export function buildRpcSessionState(session, lastAbortSource) {
     const projectTrusted = new ProjectTrustStore(session.agentDir).get(cwd) === true;
     const lastProviderDiagnostic = sanitizeProviderDiagnostic(session.agent.state.providerDiagnostic);
     return {
+        answeredUiRequests: sessionUiAnswerLedger(session).snapshot(),
         paused: session.paused ?? false,
         pausedNoticeCount: session.pausedNoticeCount ?? 0,
         holds: session.holds ?? [],

package/dist/modes/rpc/rpc-types.d.ts

@@ -1,4 +1,5 @@
 /** Public RPC protocol surface. Definitions are grouped by responsibility. */
+export type { RpcSnapshot, RpcSnapshotMarker, RpcUiRequestEvent } from "./snapshot-types.ts";
 export type { SessionContext, SessionKind } from "../../core/extensions/types.ts";
 export type { RpcCommandInvocationEvent } from "./rpc-command-invocation.ts";
 export type { RpcCommandsChangedEvent, RpcSlashCommand } from "./rpc-command-surface.ts";

package/dist/modes/rpc/session-attachment-gate.js

@@ -13,6 +13,7 @@ export const ATTACH_GATE_EXEMPT = new Set([
     "reclaim_session",
     "get_effect_status",
     "get_state",
+    "get_snapshot",
     "get_messages",
     "get_entries",
     "get_tree",