@code-yeongyu/senpi 2026.10.4 → 2026.10.5

package/dist/modes/rpc/rpc-client.d.ts

@@ -7,6 +7,7 @@ import type { AgentMessage, ThinkingLevel } from "@earendil-works/pi-agent-core"
 import type { ImageContent } from "@earendil-works/pi-ai";
 import type { PromptDisposition, QueuedInputDisposition, SessionStats } from "../../core/agent-session.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
+import type { BrowserEngine } from "../../core/browser-engine.ts";
 import { type ClientMessageIdentity } from "../../core/client-message-identity.ts";
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
@@ -133,6 +134,8 @@ export declare class RpcClient {
         auto_title?: boolean;
         /** Where this session's replies render; needs the host's `prompt_surface` (`prompt_surface_chat` for `chat`). */
         promptSurface?: PromptSurface;
+        /** Which browser this session's skills drive; needs the host's `browser_engine`. */
+        browserEngine?: BrowserEngine;
     }): Promise<{
         sessionId: string;
         state: RpcSessionState;
@@ -176,6 +179,11 @@ export declare class RpcClient {
         triggerTurn?: boolean;
         deliverAs?: "steer" | "followUp" | "nextTurn";
     }): Promise<void>;
+    /**
+     * Start a turn from the current leaf with no new prompt (#1930), for example after an
+     * edited assistant response. Refused with `streaming` or `nothing_to_continue`.
+     */
+    continueFromLeaf(): Promise<void>;
     /**
      * Queue a steering message to interrupt the agent mid-run.
      */

package/dist/modes/rpc/rpc-client.js

@@ -393,6 +393,14 @@ export class RpcClient {
     async sendCustomMessage(message, options) {
         await this.send({ type: "send_custom_message", ...message, ...options });
     }
+    /**
+     * Start a turn from the current leaf with no new prompt (#1930), for example after an
+     * edited assistant response. Refused with `streaming` or `nothing_to_continue`.
+     */
+    async continueFromLeaf() {
+        const response = await this.send({ type: "continue_from_leaf" });
+        this.getData(response);
+    }
     /**
      * Queue a steering message to interrupt the agent mid-run.
      */

package/dist/modes/rpc/rpc-input-validation.d.ts

@@ -34,6 +34,12 @@ export declare function sessionAutoTitleError(value: unknown): string | undefine
  * for the app or chat prompt must not silently get the routing line.
  */
 export declare function sessionPromptSurfaceError(value: unknown): string | undefined;
+/**
+ * Detail for an `open_session.browserEngine` the host refuses, or undefined when the value is absent
+ * or a known engine. An unknown value is never read as `none`: a client that asked for the user's
+ * own browser must not silently run without one.
+ */
+export declare function sessionBrowserEngineError(value: unknown): string | undefined;
 export declare function rpcCommandShapeError(command: unknown): string | undefined;
 export declare function rpcMessageLengthError(command: unknown): string | undefined;
 //# sourceMappingURL=rpc-input-validation.d.ts.map

package/dist/modes/rpc/rpc-input-validation.js

@@ -1,3 +1,4 @@
+import { isBrowserEngine } from "../../core/browser-engine.js";
 import { clientMessageIdentitySchema } from "../../core/client-message-identity.js";
 export const MAX_RPC_MESSAGE_CHARACTERS = 1_000_000;
 /**
@@ -150,6 +151,16 @@ export function sessionPromptSurfaceError(value) {
         return undefined;
     return `promptSurface must be "terminal", "app" or "chat".`;
 }
+/**
+ * Detail for an `open_session.browserEngine` the host refuses, or undefined when the value is absent
+ * or a known engine. An unknown value is never read as `none`: a client that asked for the user's
+ * own browser must not silently run without one.
+ */
+export function sessionBrowserEngineError(value) {
+    if (value === undefined || isBrowserEngine(value))
+        return undefined;
+    return `browserEngine must be "connected", "builtin" or "none".`;
+}
 export function rpcCommandShapeError(command) {
     if (typeof command !== "object" || command === null || Array.isArray(command)) {
         return "RPC command must be a JSON object.";

package/dist/modes/rpc/rpc-types.d.ts

@@ -10,6 +10,7 @@ import type { SessionRuntimeKind } from "../../cli/args.ts";
 import type { AgentAbortSource } from "../../core/agent-abort-provenance.ts";
 import type { PromptDisposition, QueuedInput, QueuedInputDisposition, SessionStats } from "../../core/agent-session.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
+import type { BrowserEngine } from "../../core/browser-engine.ts";
 import type { ClientMessageIdentity } from "../../core/client-message-identity.ts";
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
@@ -45,6 +46,9 @@ type RpcSessionCommand = {
     details?: unknown;
     triggerTurn?: boolean;
     deliverAs?: "steer" | "followUp" | "nextTurn";
+} | {
+    id?: string;
+    type: "continue_from_leaf";
 } | {
     id?: string;
     type: "append_user_message";
@@ -491,6 +495,15 @@ export type RpcCommand = (RpcSessionCommand & {
      * Requires the host capability `prompt_surface`. Any other value is refused with `invalid_launch_profile`.
      */
     promptSurface?: PromptSurface;
+    /**
+     * Which browser THIS session's skills drive: `connected` (the user's own browser), `builtin` (the
+     * app's in-app browser) or `none`. Session-scoped, never process-wide: the session's tool
+     * subprocesses and eval kernel see `OMO_BROWSER_ENGINE=<value>`, other sessions on the host do
+     * not, and a session opened without it sees no such variable. A later open that attaches with
+     * another value moves the live session to it; an attach without it keeps the current engine.
+     * Requires the host capability `browser_engine`. Any other value is refused with `invalid_launch_profile`.
+     */
+    browserEngine?: BrowserEngine;
 } | {
     id?: string;
     type: "close_session";
@@ -881,6 +894,11 @@ export type RpcResponse = {
         thinkingLevel: ThinkingLevel;
         isScoped: boolean;
     } | null;
+} | {
+    id?: string;
+    type: "response";
+    command: "continue_from_leaf";
+    success: true;
 } | {
     id?: string;
     type: "response";
@@ -889,6 +907,7 @@ export type RpcResponse = {
     data: {
         models: Array<Model<any> & {
             supportedThinkingLevels: ThinkingLevel[];
+            supportsAssistantPrefill: boolean;
         }>;
     };
 } | {

package/dist/modes/rpc/session-command-router.js

@@ -2,10 +2,10 @@ import { VERSION } from "../../config.js";
 import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
 import { buildRpcSessionState } from "./connection-handler.js";
-import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { answerWarm } from "./host-warm.js";
 import { protocolIdentity } from "./protocol-identity.js";
-import { sessionAutoTitleError, sessionContextError, sessionKindError, sessionPromptSurfaceError, } from "./rpc-input-validation.js";
+import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, } from "./rpc-input-validation.js";
 import { RPC_ERROR_INVALID_LAUNCH_PROFILE, RPC_ERROR_INVALID_SESSION_CONTEXT, RPC_ERROR_INVALID_SESSION_KIND, RPC_ERROR_MISSING_SESSION_ID, RPC_ERROR_OPEN_FAILED, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_UNKNOWN_SESSION, } from "./rpc-types.js";
 import { runWithSessionAttribution } from "./session-attribution.js";
 import { createRpcSessionBinding } from "./session-binding.js";
@@ -13,6 +13,7 @@ import { readDrainVerdicts } from "./session-drain.js";
 import { RpcSessionRegistryError } from "./session-registry.js";
 import { releaseSession } from "./session-release.js";
 import { selectSweepEvictions } from "./session-sweep.js";
+import { liveToolMediaScope, toolMediaPersister } from "./tool-media-store.js";
 /** How often a draining host re-checks whether the work it is waiting for has settled. */
 const DRAIN_SWEEP_MS = 50;
 function error(id, command, code, data) {
@@ -195,6 +196,7 @@ export class SessionCommandRouter {
                 AUTO_TITLE_SESSIONS_CAPABILITY,
                 MEDIA_PLACEHOLDERS_CAPABILITY,
                 DURABLE_CLIENT_MESSAGE_ID_CAPABILITY,
+                CONTINUE_FROM_LEAF_CAPABILITY,
                 // Host capabilities, not client opt-ins: only a multi-session host owns the
                 // attachment refcount `open_session.retain_on_disconnect` detaches from, the
                 // per-session launch profile `context`/`auto_title` travel on, and the session
@@ -209,6 +211,8 @@ export class SessionCommandRouter {
                 // Every session's prompt is built from its own launch profile, so one host serves both surfaces.
                 PROMPT_SURFACE_CAPABILITY,
                 PROMPT_SURFACE_CHAT_CAPABILITY,
+                // Each session's tool subprocesses and eval kernel get its own OMO_BROWSER_ENGINE from its launch profile.
+                BROWSER_ENGINE_CAPABILITY,
                 ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY,
                 // Only an in-process runtime shares the loop a warm loads into (senpi#2314).
                 ...(this.registry.warm ? [WARM_CAPABILITY] : []),
@@ -479,6 +483,9 @@ export class SessionCommandRouter {
         const promptSurfaceError = sessionPromptSurfaceError(command.promptSurface);
         if (promptSurfaceError)
             return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${promptSurfaceError}`);
+        const browserEngineError = sessionBrowserEngineError(command.browserEngine);
+        if (browserEngineError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${browserEngineError}`);
         let opened;
         try {
             opened = await this.registry.openSession({
@@ -496,12 +503,14 @@ export class SessionCommandRouter {
                 ...(command.durableSessionId !== undefined ? { durableSessionId: command.durableSessionId } : {}),
                 ...(typeof command.auto_title === "boolean" ? { autoTitle: command.auto_title } : {}),
                 ...(command.promptSurface !== undefined ? { promptSurface: command.promptSurface } : {}),
+                ...(command.browserEngine !== undefined ? { browserEngine: command.browserEngine } : {}),
             }, 
             // Host lifecycle policy, deliberately outside the immutable launch profile.
             { retainOnDisconnect: command.retain_on_disconnect === true });
             const openedSession = opened;
             const entry = this.registry.getForCommand(openedSession.sessionId, "open_session");
             this.writer.setSessionKind(openedSession.sessionId, entry.kind);
+            this.writer.setSessionMedia(openedSession.sessionId, toolMediaPersister(() => liveToolMediaScope(entry)));
             if (owner !== undefined) {
                 if (!this.writer.hasRegisteredConnectionCapabilities(owner))
                     this.writer.setConnectionCapabilities(owner, this.pendingCapabilities.get(owner) ?? this.connectionOptions?.capabilities ?? []);

package/dist/modes/rpc/session-event-writer.d.ts

@@ -1,4 +1,5 @@
 import type { SessionKind } from "../../core/extensions/types.ts";
+import { type MediaPersister } from "./media-placeholders.ts";
 import type { RpcHostLifecycleEvent, RpcOpenQueuedEvent, RpcSessionClosedReason } from "./rpc-types.ts";
 import { type SessionEventWriterConnection } from "./session-event-fanout.ts";
 export type { SessionEventWriterConnection } from "./session-event-fanout.ts";
@@ -26,6 +27,8 @@ export declare class SessionEventWriter {
     /** Sessions whose lifecycle records stay on their attached connections (`kind: "worker"`). */
     private readonly workerSessions;
     private readonly openTurns;
+    /** Per-session image persisters: bytes reach disk before the placeholder that names them is emitted. */
+    private readonly mediaPersisters;
     private readonly writeRaw;
     private readonly waitForBackpressure?;
     private readonly scheduleFlush;
@@ -61,6 +64,7 @@ export declare class SessionEventWriter {
      * instead of broadcast; an interactive session keeps the broadcast every client (the
      * desktop mirror, the supervisor's idle observer) relies on.
      */
+    setSessionMedia(sessionId: string, persister: MediaPersister | undefined): void;
     setSessionKind(sessionId: string, kind: SessionKind): void;
     /** Drain just this connection before closing it after its last handoff park. */
     flushConnection(id: string): Promise<void>;

package/dist/modes/rpc/session-event-writer.js

@@ -67,6 +67,8 @@ export class SessionEventWriter {
         /** Sessions whose lifecycle records stay on their attached connections (`kind: "worker"`). */
         this.workerSessions = new Set();
         this.openTurns = new SessionOpenTurns();
+        /** Per-session image persisters: bytes reach disk before the placeholder that names them is emitted. */
+        this.mediaPersisters = new Map();
         this.flushScheduled = false;
         this.controlOverflowReported = false;
         this.closeOverflowReported = false;
@@ -129,6 +131,12 @@ export class SessionEventWriter {
      * instead of broadcast; an interactive session keeps the broadcast every client (the
      * desktop mirror, the supervisor's idle observer) relies on.
      */
+    setSessionMedia(sessionId, persister) {
+        if (persister === undefined)
+            this.mediaPersisters.delete(sessionId);
+        else
+            this.mediaPersisters.set(sessionId, persister);
+    }
     setSessionKind(sessionId, kind) {
         if (kind === "worker")
             this.workerSessions.add(sessionId);
@@ -175,7 +183,7 @@ export class SessionEventWriter {
         // A record is only walked and re-serialized when a target asked for placeholders;
         // otherwise this is byte-for-byte today's path, with serializeJsonLine called once.
         const hasPlaceholderTarget = targets.some((target) => this.fanout.connectionHas(target, MEDIA_PLACEHOLDERS_CAPABILITY));
-        const redacted = hasPlaceholderTarget ? omitInlineMedia(tagged) : tagged;
+        const redacted = hasPlaceholderTarget ? omitInlineMedia(tagged, this.mediaPersisters.get(sessionId)) : tagged;
         const placeholderLine = redacted === tagged ? undefined : serializeJsonLine(redacted);
         if (!isTargeted)
             this.fanout.rememberSnapshot(sessionId, tagged, line, placeholderLine, tagged);
@@ -337,6 +345,7 @@ export class SessionEventWriter {
             return;
         this.sealedSessions.add(sessionId);
         this.fanout.forgetSession(sessionId);
+        this.mediaPersisters.delete(sessionId);
         const targetId = this.connectionContext.getStore();
         // `reason` tells an attached client WHY the handle ended, so a park it can reopen by path is
         // not read as a session that is gone. Absent unless the caller names one; clients tolerate that.
@@ -388,6 +397,7 @@ export class SessionEventWriter {
             return;
         this.sealedSessions.add(sessionId);
         this.fanout.forgetSession(sessionId);
+        this.mediaPersisters.delete(sessionId);
         if (this.fanout.isEmpty())
             this.appendSessionRecord(sessionId, lifecycle);
         else if (this.workerSessions.has(sessionId))
@@ -491,6 +501,7 @@ export class SessionEventWriter {
         this.openTurns.take(sessionId);
         this.workerSessions.delete(sessionId);
         this.fanout.forgetSession(sessionId);
+        this.mediaPersisters.delete(sessionId);
     }
     /** Drain every retained lane and the current in-flight record. */
     flush() {

package/dist/modes/rpc/session-registry-attach.js

@@ -21,6 +21,10 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
         entry.profile = frozenProfile({ ...entry.profile, promptSurface: profile.promptSurface });
         entry.runtime?.setPromptSurface(profile.promptSurface);
     }
+    if (profile.browserEngine !== undefined && profile.browserEngine !== entry.profile.browserEngine) {
+        entry.profile = frozenProfile({ ...entry.profile, browserEngine: profile.browserEngine });
+        entry.runtime?.setBrowserEngine(profile.browserEngine);
+    }
     entry.lastCommandAt = now;
     if (wasParked) {
         entry.lifecycleMutex = entry.lifecycleMutex.then(() => entry.runtime?.emitAttachmentEvent("session_resumed"));

package/dist/modes/rpc/session-worker-client.d.ts

@@ -1,4 +1,5 @@
 import { Worker } from "node:worker_threads";
+import type { BrowserEngine } from "../../core/browser-engine.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { CliRuntimeConfiguration } from "../../main.ts";
 import type { RpcConnectionOptions } from "./connection-handler.ts";
@@ -37,6 +38,8 @@ export declare class SessionWorkerClient {
     prepare(configuration: CliRuntimeConfiguration, profile: RpcSessionLaunchProfile): Promise<string>;
     /** Moves the worker's live session to another prompt surface (a later `open_session.promptSurface`). */
     setPromptSurface(surface: PromptSurface): Promise<void>;
+    /** Moves the worker's live session to another browser engine (a later `open_session.browserEngine`). */
+    setBrowserEngine(engine: BrowserEngine): Promise<void>;
     commit(): Promise<WorkerSnapshot>;
     bind(sessionId: string, writer: SessionEventWriter, requestClose: () => void, options: Pick<RpcConnectionOptions, "capabilities" | "clientInfo">): Promise<RpcSessionBinding>;
     get busy(): boolean;

package/dist/modes/rpc/session-worker-client.js

@@ -54,6 +54,12 @@ export class SessionWorkerClient {
         if (result.type !== "result")
             throw new Error("Invalid worker prompt_surface response");
     }
+    /** Moves the worker's live session to another browser engine (a later `open_session.browserEngine`). */
+    async setBrowserEngine(engine) {
+        const result = await this.request({ type: "browser_engine", engine });
+        if (result.type !== "result")
+            throw new Error("Invalid worker browser_engine response");
+    }
     async commit() {
         const result = await this.request({ type: "commit" });
         if (result.type !== "ready")

package/dist/modes/rpc/session-worker-protocol.d.ts

@@ -1,3 +1,4 @@
+import type { BrowserEngine } from "../../core/browser-engine.ts";
 import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { CliRuntimeConfiguration } from "../../main.ts";
 import type { RpcSessionState } from "./rpc-types.ts";
@@ -55,6 +56,10 @@ export type HostToSessionWorker = {
     type: "prompt_surface";
     request: number;
     surface: PromptSurface;
+} | {
+    type: "browser_engine";
+    request: number;
+    engine: BrowserEngine;
 } | {
     type: "cancel_ui";
 } | {

package/dist/modes/rpc/session-worker.js

@@ -177,6 +177,12 @@ async function handle(message) {
             entry.runtime.setPromptSurface(message.surface);
             send({ type: "result", request: message.request });
             return;
+        case "browser_engine":
+            if (!entry?.runtime)
+                throw new Error("session_closing");
+            entry.runtime.setBrowserEngine(message.engine);
+            send({ type: "result", request: message.request });
+            return;
         case "cancel_ui":
             binding?.cancelPendingExtensionUiRequests?.();
             send({ type: "control_done", control: "cancel_ui" });

package/dist/modes/rpc/tool-media-store.d.ts

@@ -0,0 +1,59 @@
+import { type MediaPersister, type PersistedMedia } from "./media-placeholders.ts";
+/**
+ * Where a session keeps the images its tools produced.
+ *
+ * A `media_placeholders` client never receives the bytes on the socket. The host writes them
+ * here, once, BEFORE the placeholder that names the file is emitted, so a client can render the
+ * picture from the path whenever it likes: after a disconnect, an idle shutdown or a generation
+ * handover, because the files outlive every connection. The directory sits next to the session
+ * files, never under the user's project, and is removed with the durable session.
+ */
+export interface ToolMediaScope {
+    readonly sessionDir: string;
+    readonly durableSessionId: string;
+}
+export declare const MAX_TOOL_IMAGE_BYTES: number;
+export declare const MAX_SESSION_MEDIA_BYTES: number;
+export interface ToolMediaLimits {
+    readonly perImage: number;
+    readonly perSession: number;
+}
+export interface LiveSessionSource {
+    readonly runtime?: {
+        readonly session: {
+            readonly sessionManager: {
+                getSessionFile(): string | undefined;
+                getSessionId(): string;
+            };
+        };
+    };
+    readonly worker?: {
+        readonly snapshot?: {
+            readonly state: {
+                readonly sessionFile?: string;
+                readonly sessionId: string;
+            };
+        };
+    };
+}
+export declare function liveToolMediaScope(entry: LiveSessionSource): ToolMediaScope | undefined;
+export declare function toolMediaRoot(scope: ToolMediaScope): string;
+/**
+ * Persist one tool-result image and report where it lives, or why it does not.
+ *
+ * Layout: `<sessionDir>/media/<durableSessionId>/<sha256(toolCallId)>/<contentIndex>-<sha256(bytes)>.<ext>`.
+ * The content hash makes a file immutable and a repeat a no-op; the per-image and per-session
+ * limits reject new storage and never evict a file a transcript may still reference.
+ */
+export declare function persistToolImage(scope: ToolMediaScope, ref: {
+    readonly toolCallId: string;
+    readonly contentIndex: number;
+}, block: {
+    readonly data: string;
+    readonly mimeType?: string;
+}, limits?: ToolMediaLimits): PersistedMedia;
+export declare function toolMediaPersister(scope: () => ToolMediaScope | undefined): MediaPersister;
+export declare function removeToolMedia(scope: ToolMediaScope): void;
+/** The media scope of the session stored in `sessionFile`; a file with no readable header has none. */
+export declare function toolMediaScopeOfSessionFile(sessionFile: string): Promise<ToolMediaScope | undefined>;
+//# sourceMappingURL=tool-media-store.d.ts.map

package/dist/modes/rpc/tool-media-store.js

@@ -0,0 +1,190 @@
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { open } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { assertValidSessionId } from "../../core/session-manager.js";
+import { base64ByteLength } from "./media-placeholders.js";
+export const MAX_TOOL_IMAGE_BYTES = 20 * 1024 * 1024;
+export const MAX_SESSION_MEDIA_BYTES = 256 * 1024 * 1024;
+const DEFAULT_LIMITS = { perImage: MAX_TOOL_IMAGE_BYTES, perSession: MAX_SESSION_MEDIA_BYTES };
+const MEDIA_DIRECTORY = "media";
+const EXTENSIONS = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/gif": "gif",
+    "image/webp": "webp",
+};
+/** Bytes already stored per media root: the reservation every concurrent write is checked against. */
+const reserved = new Map();
+const SIGNATURES = {
+    "image/png": (bytes) => bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])),
+    "image/jpeg": (bytes) => bytes.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff])),
+    "image/gif": (bytes) => bytes.subarray(0, 4).toString("latin1") === "GIF8",
+    "image/webp": (bytes) => bytes.subarray(0, 4).toString("latin1") === "RIFF" && bytes.subarray(8, 12).toString("latin1") === "WEBP",
+};
+function assertRealDirectoryChain(root, callDirectory) {
+    for (const path of [dirname(root), root, callDirectory]) {
+        let stat;
+        try {
+            stat = lstatSync(path);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isDirectory())
+            throw new Error(`not a real directory: ${path}`);
+    }
+}
+/** Outcomes per live image block, so re-emitting a record (`get_messages`, `turn_end`) never rehashes it. */
+const outcomes = new WeakMap();
+export function liveToolMediaScope(entry) {
+    const manager = entry.runtime?.session.sessionManager;
+    const sessionFile = manager?.getSessionFile() ?? entry.worker?.snapshot?.state.sessionFile;
+    const durableSessionId = manager?.getSessionId() ?? entry.worker?.snapshot?.state.sessionId;
+    return sessionFile === undefined || durableSessionId === undefined
+        ? undefined
+        : { sessionDir: dirname(sessionFile), durableSessionId };
+}
+export function toolMediaRoot(scope) {
+    assertValidSessionId(scope.durableSessionId);
+    return join(scope.sessionDir, MEDIA_DIRECTORY, scope.durableSessionId);
+}
+function directoryBytes(directory) {
+    let total = 0;
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const path = join(directory, entry.name);
+        total += entry.isDirectory() ? directoryBytes(path) : statSync(path).size;
+    }
+    return total;
+}
+function storedBytes(root) {
+    const known = reserved.get(root);
+    if (known !== undefined)
+        return known;
+    const scanned = existsSync(root) ? directoryBytes(root) : 0;
+    reserved.set(root, scanned);
+    return scanned;
+}
+const unavailable = (reason) => ({
+    unavailableReason: reason,
+});
+function writeImage(root, path, bytes) {
+    const callDirectory = dirname(path);
+    mkdirSync(callDirectory, { recursive: true, mode: 0o700 });
+    assertRealDirectoryChain(root, callDirectory);
+    const staging = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(staging, bytes, { mode: 0o600, flag: "wx" });
+        renameSync(staging, path);
+        chmodSync(path, 0o400);
+    }
+    catch (cause) {
+        rmSync(staging, { force: true });
+        throw cause;
+    }
+}
+/**
+ * Persist one tool-result image and report where it lives, or why it does not.
+ *
+ * Layout: `<sessionDir>/media/<durableSessionId>/<sha256(toolCallId)>/<contentIndex>-<sha256(bytes)>.<ext>`.
+ * The content hash makes a file immutable and a repeat a no-op; the per-image and per-session
+ * limits reject new storage and never evict a file a transcript may still reference.
+ */
+export function persistToolImage(scope, ref, block, limits = DEFAULT_LIMITS) {
+    const known = outcomes.get(block);
+    if (known !== undefined)
+        return known;
+    const outcome = store(scope, ref, block, limits);
+    if (!("unavailableReason" in outcome) || outcome.unavailableReason !== "storage_error")
+        outcomes.set(block, outcome);
+    return outcome;
+}
+function store(scope, ref, block, limits) {
+    const extension = EXTENSIONS[(block.mimeType ?? "").toLowerCase()];
+    if (extension === undefined)
+        return unavailable("storage_error");
+    if (base64ByteLength(block.data) > limits.perImage)
+        return unavailable("image_too_large");
+    const bytes = Buffer.from(block.data, "base64");
+    if (bytes.length > limits.perImage)
+        return unavailable("image_too_large");
+    if (SIGNATURES[(block.mimeType ?? "").toLowerCase()]?.(bytes) !== true)
+        return unavailable("storage_error");
+    try {
+        const root = toolMediaRoot(scope);
+        const callDirectory = createHash("sha256").update(ref.toolCallId).digest("hex");
+        const digest = createHash("sha256").update(bytes).digest("hex");
+        const path = resolve(root, callDirectory, `${ref.contentIndex}-${digest}.${extension}`);
+        assertRealDirectoryChain(root, dirname(path));
+        if (existsSync(path))
+            return { path };
+        const used = storedBytes(root);
+        if (used + bytes.length > limits.perSession)
+            return unavailable("session_limit");
+        reserved.set(root, used + bytes.length);
+        try {
+            writeImage(root, path, bytes);
+        }
+        catch (cause) {
+            reserved.set(root, storedBytes(root) - bytes.length);
+            throw cause;
+        }
+        return { path };
+    }
+    catch {
+        return unavailable("storage_error");
+    }
+}
+export function toolMediaPersister(scope) {
+    return (ref, block) => {
+        const current = scope();
+        return current === undefined ? undefined : persistToolImage(current, ref, block);
+    };
+}
+export function removeToolMedia(scope) {
+    const root = toolMediaRoot(scope);
+    reserved.delete(root);
+    makeTreeWritable(root);
+    rmSync(root, { recursive: true, force: true });
+}
+function makeTreeWritable(path) {
+    let entries;
+    try {
+        if (!lstatSync(path).isDirectory())
+            return;
+        chmodSync(path, 0o700);
+        entries = readdirSync(path, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const child = join(path, entry.name);
+        if (entry.isDirectory())
+            makeTreeWritable(child);
+        else if (entry.isFile())
+            try {
+                chmodSync(child, 0o600);
+            }
+            catch { }
+    }
+}
+/** The media scope of the session stored in `sessionFile`; a file with no readable header has none. */
+export async function toolMediaScopeOfSessionFile(sessionFile) {
+    try {
+        const handle = await open(sessionFile, "r");
+        try {
+            const { buffer, bytesRead } = await handle.read(Buffer.alloc(4096), 0, 4096, 0);
+            const firstLine = buffer.subarray(0, bytesRead).toString("utf8").split("\n", 1)[0] ?? "";
+            const id = JSON.parse(firstLine).id;
+            return typeof id === "string" ? { sessionDir: dirname(sessionFile), durableSessionId: id } : undefined;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=tool-media-store.js.map

package/dist/modes/rpc/worker-session-registry.js

@@ -51,7 +51,7 @@ export class WorkerSessionRegistry {
             const key = this.knownReservationKey(profile.sessionPath);
             const owner = key ? this.reservations.owner(key) : undefined;
             if (key && owner)
-                return this.attach(owner, key, options, profile.promptSurface);
+                return this.attach(owner, key, options, profile);
         }
         if (this.size >= SESSION_WORKER_LIMITS.workers)
             throw new Error("too_many_sessions");
@@ -99,7 +99,7 @@ export class WorkerSessionRegistry {
             const path = await worker.prepare(this.options.configuration, profile);
             const owner = this.reservations.owner(path);
             if (owner) {
-                const attached = await this.attach(owner, path, options, profile.promptSurface);
+                const attached = await this.attach(owner, path, options, profile);
                 entry.state = "quarantined";
                 worker.quarantine();
                 return attached;
@@ -228,7 +228,8 @@ export class WorkerSessionRegistry {
         }
         return undefined;
     }
-    async attach(owner, path, options, promptSurface) {
+    async attach(owner, path, options, requested = { cwd: "" }) {
+        const { promptSurface, browserEngine } = requested;
         const entry = this.entries.get(owner);
         if (entry?.state !== "open" || !entry.worker?.bindingReady || entry.worker.snapshot?.sessionPath !== path)
             throw new RpcSessionRegistryError("session_path_in_use");
@@ -237,6 +238,10 @@ export class WorkerSessionRegistry {
             entry.profile = frozenProfile({ ...entry.profile, promptSurface });
             await entry.worker.setPromptSurface(promptSurface);
         }
+        if (browserEngine !== undefined && browserEngine !== entry.profile.browserEngine) {
+            entry.profile = frozenProfile({ ...entry.profile, browserEngine });
+            await entry.worker.setBrowserEngine(browserEngine);
+        }
         const result = this.openResult(owner, entry);
         entry.attachments++;
         // Retention is a property of the live session: any attach may ask for it, and

package/docs/environment-variables.md

@@ -30,6 +30,7 @@ Commands run by the `bash` and `powershell` tools receive the current Pi session
 | `PI_PROVIDER` | Currently selected model provider |
 | `PI_MODEL` | Currently selected model ID |
 | `PI_REASONING_LEVEL` | Current effective reasoning level: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, or `max` |
+| `OMO_BROWSER_ENGINE` | Browser the opener chose for this session: `connected` (the user's own browser), `builtin` (the app's in-app browser) or `none`. Set only for a session opened with `open_session.browserEngine`; a session that chose none never sees the variable, even if the host process has one |
 
 The values are resolved when each command starts. Switching models or changing the reasoning level therefore affects the next shell command without restarting Pi. `PI_PROVIDER` and `PI_MODEL` identify the selected Pi model, not a different upstream model that a router may choose internally.