@code-yeongyu/senpi 2026.10.25-4 → 2026.10.26-2

package/dist/modes/rpc/connection-handler.js

@@ -47,7 +47,7 @@ import { runAbort, runGetEffectStatus, runQueuedInputChange, runSetModel, runSet
 import { EffectLedger } from "./effect-ledger.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
-import { settleExtensionUiResponse } from "./extension-ui-response.js";
+import { answeredUiRequestId, settleExtensionUiResponse } from "./extension-ui-response.js";
 import { answerGetEntries } from "./get-entries-command.js";
 import { runHoldInput } from "./held-input-commands.js";
 import { HostSessionControl } from "./host-session-control.js";
@@ -57,11 +57,14 @@ import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
 import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
+import { getSnapshot } from "./get-snapshot.js";
+import { sessionUiAnswerLedger } from "./ui-answer-ledger.js";
 import { RPC_ERROR_EVAL_CELL_NOT_FOUND, RPC_ERROR_EVAL_CELLS_UNAVAILABLE, RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_INVALID_EVAL_CELL_REQUEST, RPC_ERROR_MEDIA_NOT_FOUND, RPC_ERROR_MODEL_NOT_FOUND, STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY, } from "./rpc-types.js";
 import { runPauseForRun, runResumeForRun } from "./run-hold-commands.js";
 import { availableModelsData, interruptRunningTurn } from "./session-control-actions-data.js";
 import { SessionExtensionUiRequests, sessionDialogRequests } from "./session-extension-ui-requests.js";
 import { subscribeSessionRecords } from "./session-record-stream.js";
+import { subscribeStructuredSessionRecords } from "./structured-session-records.js";
 import { RpcSessionRelocation } from "./session-relocation.js";
 import { answerHostResponse, isHostResponse, relocationChannel, } from "./session-relocation-channel.js";
 export { buildRpcSessionState } from "./rpc-session-state.js";
@@ -188,6 +191,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     // Set by the first command that asks this session for a turn; `set_retry_fallback` is refused after it.
     let turnRequested = false;
     let unsubscribe;
+    let unsubscribeStructured;
     let unsubscribeBackpressure;
     let unsubscribeLoadedSurfaces;
     let unsubscribeExtensionEvents;
@@ -197,7 +201,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     let loadedSurfacesDigest;
     let rpcCommandsDigest;
     let suppressLoadedSurfaceEvents = false;
-    const eventOutput = createRpcEventOutputBuffer(sink.writeRaw, options.eventFlushScheduler);
+    const eventOutput = sink.writeRecord
+        ? undefined
+        : createRpcEventOutputBuffer(sink.writeRaw, options.eventFlushScheduler);
     const effectContext = () => ({
         session,
         by: { connectionId: options.clientInfo?.connectionId() ?? "local" },
@@ -205,10 +211,18 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     });
     const tagSessionRecord = (value) => routingSessionId === undefined ? value : { ...value, sessionId: routingSessionId };
     const output = (obj) => {
-        eventOutput.writeImmediate(tagSessionRecord(obj));
+        const record = tagSessionRecord(obj);
+        if (sink.writeRecord)
+            sink.writeRecord(record);
+        else
+            eventOutput?.writeImmediate(record);
     };
     const outputEvent = (event) => {
-        eventOutput.enqueueEvent(tagSessionRecord(event));
+        const record = tagSessionRecord(event);
+        if (sink.writeRecord)
+            sink.writeRecord(record);
+        else
+            eventOutput?.enqueueEvent(record);
     };
     const currentLoadedSurfaces = () => {
         const extensions = loadedExtensions(session);
@@ -268,7 +282,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         });
     });
     const waitForRpcBackpressure = async () => {
-        eventOutput.flushEvents();
+        eventOutput?.flushEvents();
         await sink.waitForBackpressure();
     };
     const success = (id, command, data) => {
@@ -292,10 +306,15 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         };
     };
     // Pending extension UI requests waiting for response
-    const pendingExtensionRequests = new SessionExtensionUiRequests(() => session.refreshLifecycle());
+    const uiRequestChanged = (change) => {
+        session.refreshLifecycle();
+        if (change && routingSessionId !== undefined)
+            output(change);
+    };
+    const pendingExtensionRequests = new SessionExtensionUiRequests(uiRequestChanged);
     const grantRequests = new Map();
     sessionDialogRequests.set(session, pendingExtensionRequests);
-    const questions = new ConnectionQuestionBridge(output, () => session.refreshLifecycle());
+    const questions = new ConnectionQuestionBridge(output, uiRequestChanged);
     let shutdownRequested = false;
     // In-flight OAuth logins, keyed by provider. login_start registers one; the
     // login promise clears it on completion; login_cancel aborts it. The flow is
@@ -745,6 +764,10 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             unsubscribe = subscribeSessionRecords(session, outputEvent, (abortSource) => {
                 lastAbortSource = abortSource;
             });
+            unsubscribeStructured?.();
+            unsubscribeStructured = sink.writeStructured
+                ? subscribeStructuredSessionRecords(session, (record) => sink.writeStructured?.(tagSessionRecord(record)))
+                : undefined;
             unsubscribeBackpressure = session.agent.subscribe(async () => {
                 await waitForRpcBackpressure();
             });
@@ -858,6 +881,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                         capabilities: [
                             ...new Set([
                                 "multi_session",
+                                "snapshot_cursor",
+                                "ui_answer_ledger",
                                 "session_lifecycle",
                                 AUTO_TITLE_SESSIONS_CAPABILITY,
                                 MEDIA_PLACEHOLDERS_CAPABILITY,
@@ -1080,6 +1105,18 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                     refreshGrantPresentation();
                 return success(id, "set_client_info");
             }
+            case "get_snapshot": {
+                const snapshot = getSnapshot(session, command, {
+                    lastAbortSource,
+                    enqueue: (markerId) => {
+                        if (routingSessionId !== undefined)
+                            output({ type: "snapshot_marker", markerId });
+                    },
+                });
+                return "error" in snapshot
+                    ? error(id, "get_snapshot", snapshot.error, RPC_ERROR_INVALID_ARGUMENT)
+                    : success(id, "get_snapshot", snapshot.data);
+            }
             case "get_state":
                 return success(id, "get_state", buildRpcSessionState(session, lastAbortSource));
             case "request_self_settle":
@@ -1673,21 +1710,20 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             parsed !== null &&
             "type" in parsed &&
             parsed.type === "extension_ui_response") {
-            if (!options.workerSecurityBridge &&
-                "id" in parsed &&
-                typeof parsed.id === "string" &&
-                grantRequests.has(parsed.id)) {
+            const requestId = answeredUiRequestId(parsed);
+            if (!options.workerSecurityBridge && requestId !== undefined && grantRequests.has(requestId)) {
                 const sender = options.clientInfo?.connectionId();
                 const capable = sender === undefined
                     ? clientCapabilities?.includes("grant_select") === true
                     : options.clientInfo?.hasCapability?.(sender, "grant_select") === true;
-                if (grantRequests.get(parsed.id) !== sender || !capable)
+                if (grantRequests.get(requestId) !== sender || !capable)
                     return;
             }
             const reply = settleExtensionUiResponse(parsed, {
                 questions,
                 dialogs: pendingExtensionRequests,
                 routed: routingSessionId !== undefined,
+                ledger: sessionUiAnswerLedger(session),
                 // An answer is a person's input by its entry point, whatever the connection role.
                 beforeAnswer: () => session.admitHumanAnswer(),
             });
@@ -1719,7 +1755,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     // A single-session connection hears its account's new limit windows as they are reported. A host
     // session's handler (it has a routing `sessionId`) does not: the host broadcasts the record once.
     const stopLimitEvents = options.sessionId === undefined
-        ? subscriptionLimits.subscribe((limits) => eventOutput.enqueueEvent({ type: "subscription_limits", ...limits }))
+        ? subscriptionLimits.subscribe((limits) => outputEvent({ type: "subscription_limits", ...limits }))
         : () => { };
     const dispose = async (disposeOptions = {}) => {
         unbindMcpForms?.();
@@ -1735,10 +1771,12 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         pendingExtensionRequests.close();
         unsubscribeProviderAccountEvents();
         unsubscribe?.();
+        unsubscribeStructured?.();
         unsubscribeBackpressure?.();
         unsubscribeLoadedSurfaces?.();
         unsubscribeExtensionEvents?.();
         unsubscribe = undefined;
+        unsubscribeStructured = undefined;
         unsubscribeBackpressure = undefined;
         unsubscribeLoadedSurfaces = undefined;
         unsubscribeExtensionEvents = undefined;

package/dist/modes/rpc/connection-question-bridge.d.ts

@@ -1,4 +1,5 @@
 import type { ExtensionUIContext, QuestionRequest, QuestionResponse } from "../../core/extensions/types.ts";
+import type { UiRequestChange } from "./snapshot-types.ts";
 import type { RpcExtensionUIProgress, RpcExtensionUIResponse, RpcQuestionUiRequest } from "./rpc-types.ts";
 type Options = Parameters<NonNullable<ExtensionUIContext["question"]>>[1];
 export declare const sessionQuestionBridges: WeakMap<object, ConnectionQuestionBridge>;
@@ -7,7 +8,7 @@ export declare class ConnectionQuestionBridge {
     private readonly resolved;
     private readonly output;
     private readonly changed;
-    constructor(output: (record: object) => void, changed?: () => void);
+    constructor(output: (record: object) => void, changed?: (change?: UiRequestChange) => void);
     pendingQuestions(): RpcQuestionUiRequest[];
     ask(request: QuestionRequest, opts?: Options): Promise<QuestionResponse>;
     respond(response: RpcExtensionUIResponse, beforeAnswer?: () => void): boolean | "question_incomplete" | "question_already_resolved";

package/dist/modes/rpc/connection-question-bridge.js

@@ -43,7 +43,11 @@ export class ConnectionQuestionBridge {
                 clearTimeout(timer);
                 opts?.signal?.removeEventListener("abort", cancel);
                 this.pending.delete(id);
-                this.changed?.();
+                this.changed?.({
+                    type: "ui_request_settled",
+                    uiRequestId: id,
+                    disposition: status === "answered" || status === "comment-submitted" ? "answered" : "cancelled",
+                });
                 this.resolved.add(id);
                 const result = {
                     status,
@@ -121,7 +125,7 @@ export class ConnectionQuestionBridge {
                 },
             });
             arm();
-            this.changed?.();
+            this.changed?.({ type: "ui_request_pending", uiRequestId: id, method: "question", request: frame });
             this.output(frame);
             opts?.signal?.addEventListener("abort", cancel, { once: true });
             if (opts?.signal?.aborted)

package/dist/modes/rpc/extension-ui-response.d.ts

@@ -1,5 +1,6 @@
 import type { QuestionRequest, QuestionResponse } from "../../core/extensions/types.ts";
 import type { RpcExtensionUIResponse } from "./rpc-types.ts";
+import type { UiAnswerLedger } from "./ui-answer-ledger.ts";
 /**
  * An `extension_ui_response` carries two ids: `id`, the frame's own correlation id that its reply
  * echoes, and `uiRequestId`, the extension UI request it answers. The short form every older client
@@ -23,6 +24,8 @@ export type ExtensionUiResponseReply = {
     readonly id: string;
     readonly type: "response";
     readonly command: "extension_ui_response";
+    /** The answer's outcome for its request; absent when a malformed answer was refused before settling anything. */
+    readonly disposition?: "applied" | "replay" | "already_answered" | "unknown";
 } & ({
     readonly success: true;
 } | {
@@ -37,13 +40,15 @@ type DialogAnswers = {
 };
 /**
  * Settles one response on a host connection and returns its reply, keyed by the frame `id`.
- * `undefined` only on an unrouted (single-session stdio) connection for a response no request here
- * matches: that connection has always ignored such a response, and still does.
+ * `undefined` only on an unrouted (single-session stdio) connection for an unnamed response no
+ * request here matches: that connection has always ignored such a response, and still does. A named
+ * response (`answerId`) asks for a receipt, so every connection answers it.
  */
 export declare function settleExtensionUiResponse(response: RpcExtensionUIResponse, targets: {
     readonly questions: QuestionAnswers;
     readonly dialogs: DialogAnswers;
     readonly routed: boolean;
+    readonly ledger?: UiAnswerLedger;
     readonly beforeAnswer?: () => void;
 }): ExtensionUiResponseReply | undefined;
 export {};

package/dist/modes/rpc/extension-ui-response.js

@@ -28,25 +28,45 @@ export function unansweredQuestionIds(questions, answers) {
 }
 /**
  * Settles one response on a host connection and returns its reply, keyed by the frame `id`.
- * `undefined` only on an unrouted (single-session stdio) connection for a response no request here
- * matches: that connection has always ignored such a response, and still does.
+ * `undefined` only on an unrouted (single-session stdio) connection for an unnamed response no
+ * request here matches: that connection has always ignored such a response, and still does. A named
+ * response (`answerId`) asks for a receipt, so every connection answers it.
  */
 export function settleExtensionUiResponse(response, targets) {
+    if (response.answerId !== undefined &&
+        (typeof response.answerId !== "string" || response.answerId.length < 1 || response.answerId.length > 256))
+        return refused(response.id, "invalid_answer_id");
     const requestId = answeredUiRequestId(response) ?? response.id;
+    const receipt = response.answerId === undefined ? undefined : targets.ledger?.lookup(requestId, response.answerId);
+    if (receipt === "replay")
+        return { ...reply(response.id), success: true, disposition: "replay" };
+    if (receipt === "already_answered")
+        return { ...reply(response.id), success: false, error: "already_answered", disposition: receipt };
     const answer = requestId === response.id ? response : { ...response, id: requestId };
     const question = targets.questions.respond(answer, targets.beforeAnswer);
     if (typeof question === "string")
-        return refused(response.id, question);
-    if (question || targets.dialogs.resolve(answer, targets.beforeAnswer))
-        return { ...reply(response.id), success: true };
+        return refused(response.id, response.answerId !== undefined && question === "question_already_resolved"
+            ? "unknown_extension_ui_request"
+            : question);
+    if (question || targets.dialogs.resolve(answer, targets.beforeAnswer)) {
+        targets.ledger?.record(requestId, response.answerId);
+        return { ...reply(response.id), success: true, disposition: "applied" };
+    }
     // A routed binding owns exactly one session's request map: an unmatched response is a protocol
     // error for its sender, never a cross-session match.
-    return targets.routed ? refused(response.id, "unknown_extension_ui_request") : undefined;
+    return targets.routed || response.answerId !== undefined
+        ? refused(response.id, "unknown_extension_ui_request")
+        : undefined;
 }
 function reply(id) {
     return { id, type: "response", command: "extension_ui_response" };
 }
 function refused(id, error) {
-    return { ...reply(id), success: false, error };
+    const disposition = error === "question_already_resolved"
+        ? "already_answered"
+        : error === "unknown_extension_ui_request"
+            ? "unknown"
+            : undefined;
+    return { ...reply(id), success: false, error, ...(disposition === undefined ? {} : { disposition }) };
 }
 //# sourceMappingURL=extension-ui-response.js.map

package/dist/modes/rpc/get-snapshot.d.ts

@@ -0,0 +1,18 @@
+import type { AgentAbortSource } from "../../core/agent-abort-provenance.ts";
+import type { AgentSession } from "../../core/agent-session.ts";
+import type { RpcSnapshot } from "./snapshot-types.ts";
+type SnapshotRequest = {
+    readonly tail?: unknown;
+    readonly maxBytes?: unknown;
+};
+/** Capture and mark on the source loop, before any response-writing await. */
+export declare function getSnapshot(session: AgentSession, request: SnapshotRequest, cursor: {
+    readonly enqueue: (markerId: string) => void;
+    readonly lastAbortSource?: AgentAbortSource;
+}): {
+    readonly data: RpcSnapshot;
+} | {
+    readonly error: string;
+};
+export {};
+//# sourceMappingURL=get-snapshot.d.ts.map

package/dist/modes/rpc/get-snapshot.js

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+import { describeUsageLimitEntry } from "../../core/retry-fallback/usage-limit.js";
+import { currentResponseByteBudget, DEFAULT_ENTRY_PAGE_BYTES } from "./get-entries-page.js";
+import { buildRpcSessionState } from "./rpc-session-state.js";
+/** Capture and mark on the source loop, before any response-writing await. */
+export function getSnapshot(session, request, cursor) {
+    const tail = request.tail === undefined ? 100 : request.tail;
+    const maxBytes = request.maxBytes === undefined ? DEFAULT_ENTRY_PAGE_BYTES : request.maxBytes;
+    if (typeof tail !== "number" || !Number.isSafeInteger(tail) || tail < 0)
+        return { error: "tail must be a non-negative integer" };
+    if (typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+        return { error: "maxBytes must be a positive integer" };
+    const state = buildRpcSessionState(session, cursor.lastAbortSource);
+    const history = session.sessionManager.getEntries();
+    const entries = [];
+    let bytes = 2;
+    for (let i = history.length - 1; i >= 0 && entries.length < tail; i--) {
+        const entry = history[i];
+        if (entry === undefined)
+            break;
+        const projected = describeUsageLimitEntry(entry);
+        const size = Buffer.byteLength(JSON.stringify(projected)) + (entries.length > 0 ? 1 : 0);
+        if (bytes + size > Math.min(maxBytes, currentResponseByteBudget()))
+            break;
+        entries.push(projected);
+        bytes += size;
+    }
+    entries.reverse();
+    const history_truncated = entries.length < history.length;
+    const markerId = randomUUID();
+    // Some state fields and entry payloads are live references: detach them before yielding, too.
+    const data = structuredClone({
+        state,
+        entries,
+        history_truncated,
+        next_before: history_truncated ? (entries[0]?.id ?? null) : null,
+        markerId,
+    });
+    session.releaseFullHistoryView();
+    cursor.enqueue(markerId);
+    return { data };
+}
+//# sourceMappingURL=get-snapshot.js.map

package/dist/modes/rpc/host-capabilities.js

@@ -20,6 +20,9 @@ export function multiSessionHostCapabilities(options) {
     return [
         ...new Set([
             "multi_session",
+            "snapshot_cursor",
+            "ui_answer_ledger",
+            "dialog_observer",
             ...(options.mcpPresenters ? ["mcp_form_presenter_v1"] : []),
             "session_lifecycle",
             "expected_host_instance",

package/dist/modes/rpc/host-ensure-start.js

@@ -16,7 +16,7 @@ import { keepOwnerPipe, OWNER_WATCH_FD } from "./host-lifecycle-launch.js";
 import { pollProtocolInfo } from "./host-readiness.js";
 import { initialHostEnvironment } from "./host-spawn-environment.js";
 import { hostLaunchProfile } from "./protocol-identity.js";
-import { createSocketSecret, socketSecretPath } from "./socket-transport.js";
+import { ensureSocketSecret, socketSecretPath } from "./socket-transport.js";
 import { relayPresenterBootstrap } from "./mcp-presenter-bootstrap.js";
 export const DEFAULT_READINESS_TIMEOUT_MS = 10_000;
 export { DEFAULT_STOP_TIMEOUT_MS };
@@ -38,9 +38,11 @@ export async function startHost(paths, socket, options, generation = 0) {
         reason,
     });
     // The settings file must exist before the supervisor reads it at boot, so it
-    // records the policy before the spawn instead of beside the pidfile.
+    // records the policy before the spawn instead of beside the pidfile. A valid public
+    // secret belongs to the endpoint, not to this start: clients that already read it
+    // derive the pipe name from it, so a start reuses it and never rotates it.
     if (process.platform === "win32")
-        await createSocketSecret(socketSecretPath(socket));
+        await ensureSocketSecret(socketSecretPath(socket));
     await writeHostSettings(paths, {
         socket,
         capabilities: PINNED_HOST_CLIENT_CAPABILITIES,
@@ -63,6 +65,7 @@ export async function startHost(paths, socket, options, generation = 0) {
             socket,
             ...(options.owner ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
             ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
+            ...(options.mcpPresenterEnforcement ? ["--mcp-presenter-enforcement"] : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = testOptions?.spawn ?? testOptions?.launch?.(supervisorArgs) ?? defaultHostLaunch(supervisorArgs);

package/dist/modes/rpc/host-ensure-types.d.ts

@@ -12,6 +12,8 @@ import type { Duplex } from "node:stream";
 export type HostUpgradePolicy = "never" | "if-engine-differs";
 export interface EnsureHostOptions {
     readonly presenterBootstrap?: Duplex;
+    /** Deployment opt-in, never a project setting or proof of enrollment. Defaults off for a new host. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly socket: string;
     readonly agentDir?: string;
     readonly keyRoot?: string;

package/dist/modes/rpc/host-ensure.js

@@ -206,6 +206,7 @@ async function upgradeGeneration(paths, socket, options, attachedPid) {
         agentDir: options.agentDir ?? getAgentDir(),
         hostArgs: options.hostArgs ?? [],
         presenterBootstrap: options.presenterBootstrap,
+        mcpPresenterEnforcement: options.mcpPresenterEnforcement,
         ...(options.env ? { env: options.env } : {}),
         ...(options.policy ? { policy: options.policy } : {}),
         _test: {

package/dist/modes/rpc/host-handoff.d.ts

@@ -7,6 +7,8 @@ import type { HostLifecyclePolicyInput } from "./host-lifecycle.ts";
 export declare const HANDOFF_LOCK_HOLD_MS: number;
 export interface HandoffHostOptions {
     readonly presenterBootstrap?: Duplex;
+    /** Deployment opt-in. An enforcing predecessor never downgrades during replacement. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly socket: string;
     readonly agentDir?: string;
     /** Extra CLI arguments the successor's host child is launched with (provider pinning, extensions). */

package/dist/modes/rpc/host-handover-request.d.ts

@@ -9,5 +9,5 @@ export interface IdleHandoverTerms {
 export declare function idleHandoverOutcome(target: {
     readonly socket: string;
     readonly agentDir: string;
-}, spec: ResolvedHostLaunchSpec, terms: IdleHandoverTerms): Promise<HostOutcome>;
+}, spec: ResolvedHostLaunchSpec, terms: IdleHandoverTerms, mcpPresenterEnforcement?: boolean): Promise<HostOutcome>;
 //# sourceMappingURL=host-handover-request.d.ts.map

package/dist/modes/rpc/host-handover-request.js

@@ -28,7 +28,7 @@ import { RUNTIME_IDENTITY_HANDOVER_CAPABILITY } from "./runtime-build-id.js";
 const PROBE_TIMEOUT_MS = 10_000;
 /** A host idle at once hands over before answering: its ensure-lock wait plus the handoff itself. */
 const BEGIN_HANDOVER_TIMEOUT_MS = 2 * HANDOFF_LOCK_HOLD_MS + 20_000;
-export async function idleHandoverOutcome(target, spec, terms) {
+export async function idleHandoverOutcome(target, spec, terms, mcpPresenterEnforcement) {
     const { socket } = target;
     if (process.platform === "win32") {
         return refusal("refuse", undefined, { reason: "upgrade_unsupported", socket, operationId: terms.operationId });
@@ -57,7 +57,7 @@ export async function idleHandoverOutcome(target, spec, terms) {
     }
     if (!before.capabilities.includes(RUNTIME_IDENTITY_HANDOVER_CAPABILITY))
         return refuse("handover_unsupported");
-    const reply = await requestOnSocket(socket, beginHandoverCommand(target, spec, terms), BEGIN_HANDOVER_TIMEOUT_MS);
+    const reply = await requestOnSocket(socket, beginHandoverCommand(target, spec, terms, mcpPresenterEnforcement), BEGIN_HANDOVER_TIMEOUT_MS);
     if (!isRecord(reply))
         return reconcileLostReply(target, terms, before);
     if (typeof reply.refused === "string") {
@@ -71,7 +71,7 @@ export async function idleHandoverOutcome(target, spec, terms) {
     }
     return answered(target, "handover_pending", before, terms, reply);
 }
-function beginHandoverCommand(target, spec, terms) {
+function beginHandoverCommand(target, spec, terms, mcpPresenterEnforcement) {
     const env = {};
     for (const [name, value] of Object.entries(daemonEnvironment(process.env, daemonEnvOverrides(process.env, spec.env)))) {
         if (value !== undefined)
@@ -88,6 +88,7 @@ function beginHandoverCommand(target, spec, terms) {
         launch: { command: launch.command, args: launch.args },
         host_args: spec.hostArgs,
         env,
+        ...(mcpPresenterEnforcement === true && { mcp_presenter_enforcement: true }),
         ...(spec.policy !== undefined && { policy: spec.policy }),
     };
 }

package/dist/modes/rpc/host-handover-wire.js

@@ -33,6 +33,10 @@ export function parseBeginHandover(record) {
     }
     const policy = isRecord(record.policy) ? record.policy : undefined;
     const { agent_dir } = record;
+    const mcpPresenterEnforcement = record.mcp_presenter_enforcement;
+    if (mcpPresenterEnforcement !== undefined && typeof mcpPresenterEnforcement !== "boolean") {
+        return "mcp_presenter_enforcement must be a boolean";
+    }
     if (agent_dir !== undefined && (typeof agent_dir !== "string" || agent_dir === "")) {
         return "agent_dir must be a non-empty string";
     }
@@ -44,6 +48,7 @@ export function parseBeginHandover(record) {
         launch: { command: launch.command, args: launch.args },
         hostArgs: host_args,
         env: env,
+        ...(mcpPresenterEnforcement !== undefined && { mcpPresenterEnforcement }),
         ...(policy !== undefined && { policy }),
         ...(agent_dir !== undefined && { agentDir: agent_dir }),
     };
@@ -121,6 +126,7 @@ export async function performIdleHandover(context) {
     Object.assign(env, request.env);
     const result = await handoffHost({
         presenterBootstrap: context.presenterBootstrap,
+        mcpPresenterEnforcement: request.mcpPresenterEnforcement,
         socket,
         agentDir,
         hostArgs: request.hostArgs,

package/dist/modes/rpc/host-idle-handover.d.ts

@@ -36,6 +36,8 @@ export interface HandoverLaunch {
     readonly args: readonly string[];
 }
 export interface IdleHandoverRequest {
+    /** Successor deployment policy only; never enrollment authority. */
+    readonly mcpPresenterEnforcement?: boolean;
     readonly operationId: string;
     readonly ifInstanceId: string;
     readonly ifGeneration: number;

package/dist/modes/rpc/host-idle-handover.js

@@ -40,7 +40,8 @@ export class HostIdleHandover {
                 : { kind: "refused", reason: "operation_conflict", detail: "this operation id names other terms" };
         }
         if (current !== undefined && current.view.state !== "handover_blocked") {
-            return current.request.targetRuntimeBuildId === request.targetRuntimeBuildId
+            return current.request.targetRuntimeBuildId === request.targetRuntimeBuildId &&
+                Boolean(current.request.mcpPresenterEnforcement) === Boolean(request.mcpPresenterEnforcement)
                 ? answer(current)
                 : { kind: "refused", reason: "handover_in_progress", detail: current.view.operationId };
         }
@@ -112,6 +113,7 @@ export class HostIdleHandover {
 }
 function sameTerms(a, b) {
     return (a.targetRuntimeBuildId === b.targetRuntimeBuildId &&
+        Boolean(a.mcpPresenterEnforcement) === Boolean(b.mcpPresenterEnforcement) &&
         a.ifInstanceId === b.ifInstanceId &&
         a.ifGeneration === b.ifGeneration);
 }

package/dist/modes/rpc/host-observe-request.js

@@ -28,6 +28,7 @@ export const OBSERVE_REQUEST_FIELD = "observe";
 export const ORIGIN_HOST_INSTANCE_FIELD = "origin_host_instance";
 const OBSERVING_COMMANDS = new Set([
     "get_protocol_info",
+    "get_snapshot",
     "list_sessions",
     "subscribe_sessions",
     "unsubscribe_sessions",

package/dist/modes/rpc/host-runner.d.ts

@@ -52,5 +52,6 @@ export type HostRequest = {
 export declare function runHostRequest(request: HostRequest, options?: {
     readonly keyRoot?: string;
     readonly presenterBootstrap?: Duplex;
+    readonly mcpPresenterEnforcement?: boolean;
 }): Promise<HostOutcome>;
 //# sourceMappingURL=host-runner.d.ts.map

package/dist/modes/rpc/host-runner.js

@@ -37,9 +37,9 @@ import { hostRequestKeyRoot } from "./host-request-key-root.js";
 import { withRpcKeyRoot } from "./rpc-auth-client.js";
 const PROBE_TIMEOUT_MS = 10_000;
 export async function runHostRequest(request, options = {}) {
-    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap));
+    return withRpcKeyRoot(hostRequestKeyRoot(request, options.keyRoot), () => runHostRequestInKeyRoot(request, options.presenterBootstrap, options.mcpPresenterEnforcement));
 }
-async function runHostRequestInKeyRoot(request, presenterBootstrap) {
+async function runHostRequestInKeyRoot(request, presenterBootstrap, mcpPresenterEnforcement) {
     if (request.action === "ensure" || request.action === "handoff" || request.action === "stop") {
         const { socket, agentDir } = request.target;
         if ((await endpointKindOfSocket(socket, agentDir)) === "tui") {
@@ -48,7 +48,7 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
     }
     switch (request.action) {
         case "ensure":
-            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap);
+            return ensureOutcome(request.target, request.spec, request.policy, presenterBootstrap, mcpPresenterEnforcement);
         case "status":
             return request.all === true
                 ? statusAllOutcome(request.target, request.includeWorkers)
@@ -57,8 +57,8 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
             return stopOutcome(request);
         case "handoff":
             return request.handover === undefined
-                ? handoffOutcome(request.target, request.spec, presenterBootstrap)
-                : idleHandoverOutcome(request.target, request.spec, request.handover);
+                ? handoffOutcome(request.target, request.spec, presenterBootstrap, mcpPresenterEnforcement)
+                : idleHandoverOutcome(request.target, request.spec, request.handover, mcpPresenterEnforcement);
         case "shard_path":
             return shardPathOutcome(request.kind, request.owner, request.root);
         case "gc":
@@ -70,7 +70,7 @@ async function runHostRequestInKeyRoot(request, presenterBootstrap) {
             return assertNever(request);
     }
 }
-async function ensureOutcome(target, spec, policy, presenterBootstrap) {
+async function ensureOutcome(target, spec, policy, presenterBootstrap, mcpPresenterEnforcement) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     if (policy === "fallback") {
         // `fallback` is the caller saying it can live without a host. The decision is made HERE
@@ -85,6 +85,7 @@ async function ensureOutcome(target, spec, policy, presenterBootstrap) {
         ensured = await ensureHost({
             socket: target.socket,
             presenterBootstrap,
+            mcpPresenterEnforcement,
             agentDir: target.agentDir,
             hostArgs: spec.hostArgs,
             env: daemonEnvOverrides(process.env, spec.env),
@@ -182,11 +183,12 @@ async function stopOutcome(request) {
         },
     };
 }
-async function handoffOutcome(target, spec, presenterBootstrap) {
+async function handoffOutcome(target, spec, presenterBootstrap, mcpPresenterEnforcement) {
     const before = await probeProtocolInfo(target.socket, PROBE_TIMEOUT_MS);
     const result = await handoffHost({
         socket: target.socket,
         presenterBootstrap,
+        mcpPresenterEnforcement,
         agentDir: target.agentDir,
         hostArgs: spec.hostArgs,
         env: daemonEnvOverrides(process.env, spec.env),

package/dist/modes/rpc/host-successor.js

@@ -83,6 +83,10 @@ export async function startSuccessor(context) {
             `${replaced.dev}:${replaced.ino}`,
             ...(inheritOwnerPipe ? ["--owner-fd", String(OWNER_WATCH_FD)] : []),
             ...(options.presenterBootstrap ? ["--mcp-presenter-fd", "4"] : []),
+            // Preserve the running host's policy even when an older caller omits the deployment option.
+            ...(options.mcpPresenterEnforcement || host.capabilities.includes("mcp_form_presenter_v1")
+                ? ["--mcp-presenter-enforcement"]
+                : []),
             ...(options.hostArgs ?? []),
         ];
         const launch = (options._test?.launch ?? options.launch)?.(argv) ?? defaultHostLaunch(argv);

package/dist/modes/rpc/json-normal-value.d.ts

@@ -0,0 +1,6 @@
+/** JSON.stringify's value semantics, without serializing or parsing a record. */
+export declare function normalizeJsonValue(input: unknown): {
+    value: unknown;
+    changed: boolean;
+};
+//# sourceMappingURL=json-normal-value.d.ts.map