@code-yeongyu/senpi 2026.10.5 → 2026.10.6

package/dist/core/tools/diff-render.js

@@ -79,6 +79,19 @@ function renderToolDiffLine(line, filePath, theme, contentOverride) {
     const rendered = `${theme.fg(diffColor, line.sign)}${lineNumber} ${content}`;
     return theme.bg(background, rendered);
 }
+export function countDiffChanges(diffText) {
+    let added = 0;
+    let removed = 0;
+    for (const line of diffText.split("\n")) {
+        if (line.startsWith("+++") || line.startsWith("---"))
+            continue;
+        if (line.startsWith("+"))
+            added++;
+        else if (line.startsWith("-"))
+            removed++;
+    }
+    return { added, removed };
+}
 export function renderToolDiff(diffText, options) {
     const parsedLines = diffText.split("\n").map(parseRenderableDiffLine);
     const rendered = [];

package/dist/core/tools/renderers/edit.js

@@ -6,7 +6,7 @@
  * definition, so the tool's public shape is unchanged.
  */
 import { Box, Container, Spacer, Text } from "@earendil-works/pi-tui";
-import { renderToolDiff } from "../diff-render.js";
+import { countDiffChanges, renderToolDiff } from "../diff-render.js";
 import { computeEditsDiff } from "../edit-diff.js";
 import { renderToolPath, str } from "../render-utils.js";
 function createEditCallRenderComponent() {
@@ -48,9 +48,11 @@ function getRenderablePreviewInput(args) {
     }
     return null;
 }
-function formatEditCall(args, theme, cwd) {
+function formatEditCall(args, theme, cwd, diffText) {
     const pathDisplay = renderToolPath(str(args?.file_path ?? args?.path), theme, cwd);
-    return `${theme.fg("toolTitle", theme.bold("edit"))} ${pathDisplay}`;
+    const counts = diffText === undefined ? undefined : countDiffChanges(diffText);
+    const countTag = counts === undefined ? "" : theme.fg("muted", ` (+${counts.added}/-${counts.removed})`);
+    return `${theme.fg("toolTitle", theme.bold("edit"))} ${pathDisplay}${countTag}`;
 }
 function formatEditResult(args, preview, result, theme, isError) {
     const rawPath = str(args?.file_path ?? args?.path);
@@ -87,7 +89,7 @@ function getEditHeaderBg(preview, settledError, theme) {
 function buildEditCallComponent(component, args, theme, cwd) {
     component.setBgFn(getEditHeaderBg(component.preview, component.settledError, theme));
     component.detachAll();
-    component.addChild(new Text(formatEditCall(args, theme, cwd), 0, 0));
+    component.addChild(new Text(formatEditCall(args, theme, cwd, component.preview && !("error" in component.preview) ? component.preview.diff : undefined), 0, 0));
     if (!component.preview) {
         return component;
     }

package/dist/main.js

@@ -677,6 +677,18 @@ export function createCliRuntimeFactory(configuration, local = {}) {
                 parsed.projectTrustOverride ??
                 (!hasTrustRequiringResources || trustStore.get(cwd) === true));
         const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
+        // The opener's per-session fallback policy is an in-memory override: never saved, never shared.
+        if (launchProfile?.retryFallback) {
+            runtimeSettingsManager.applyOverrides({
+                retry: {
+                    modelFallback: launchProfile.retryFallback.modelFallback,
+                    fallbackChains: Object.fromEntries(Object.entries(launchProfile.retryFallback.fallbackChains).map(([key, entries]) => [
+                        key,
+                        [...entries],
+                    ])),
+                },
+            });
+        }
         const services = await createAgentSessionServices({
             cwd,
             agentDir,

package/dist/modes/interactive/interactive-mode.d.ts

@@ -108,6 +108,7 @@ export declare class InteractiveMode {
     private readonly sessionShownTipIds;
     private shortcutOverlay;
     private lastEditorText;
+    private startupProviderGuidanceShown;
     private lastInputWasPaste;
     private sessionLogger;
     private readonly continuityNotices;

package/dist/modes/interactive/interactive-mode.js

@@ -13,6 +13,7 @@ import { spawn, spawnSync } from "child_process";
 import { APP_COMMAND, APP_NAME, APP_TITLE, BRAND, CONFIG_DIR_NAME, DISPLAY_VERSION, expandTildePath, getAgentDir, getAuthPath, getDebugLogPath, getDocsPath, getShareViewerUrl, } from "../../config.js";
 import { parseSkillBlock, } from "../../core/agent-session.js";
 import { SessionImportFileNotFoundError } from "../../core/agent-session-runtime.js";
+import { formatNoModelsAvailableMessage } from "../../core/auth-guidance.js";
 import { isApiKeyLoginProvider } from "../../core/auth-providers.js";
 import { envValue } from "../../core/brand.js";
 import { CACHE_TTL_MS, collectCacheMisses, computeCacheWaste, detectCacheMiss, } from "../../core/cache-stats.js";
@@ -113,7 +114,7 @@ import { buildResourceScopeGroups, formatResourceScopeGroups, getDisplaySourceIn
 import { describeLoginFailure } from "./login-outcome.js";
 import { refreshModelCatalogs } from "./model-catalog-refresh.js";
 import { getModelSearchText } from "./model-search.js";
-import { isNetworkProviderError, isNetworkProviderMessage, ProviderErrorPresentation, } from "./provider-error-presentation.js";
+import { isNetworkProviderError, isNetworkProviderMessage, isRetryableProviderError, ProviderErrorPresentation, } from "./provider-error-presentation.js";
 import { replayAssistantTools } from "./replay-assistant-tools.js";
 import { allScopeSessions, chooseResumePath, currentScopeSessions } from "./resume-rebind.js";
 import { isRiskyMainModel, RISKY_MAIN_MODEL_WARNING } from "./risky-main-model-warning.js";
@@ -554,6 +555,7 @@ export class InteractiveMode {
     constructor(runtimeHost, options = {}) {
         this.sessionShownTipIds = new Set();
         this.lastEditorText = "";
+        this.startupProviderGuidanceShown = false;
         this.lastInputWasPaste = false;
         this.continuityNotices = new ContinuityNoticeTracker();
         this.turnWorkingTip = new WorkingTipCache();
@@ -1323,11 +1325,31 @@ export class InteractiveMode {
         if (modelsJsonError) {
             this.showError(`models.json error: ${modelsJsonError}`);
         }
-        for (const warning of this.session.modelRuntime.getWarnings()) {
-            this.showWarning(warning);
+        const modelRuntimeWarnings = this.session.modelRuntime.getWarnings();
+        // Fold repeated warnings only in quiet startup; a hand-built context without getQuietStartup
+        // is treated as not-quiet so full detail shows (the safe default, and what the old path did).
+        const getQuietStartup = this.settingsManager?.getQuietStartup?.bind(this.settingsManager);
+        const quietStartup = getQuietStartup ? getQuietStartup() : false;
+        if (showsStartupDetails(this.options.verbose, quietStartup)) {
+            for (const warning of modelRuntimeWarnings) {
+                this.showWarning(warning);
+            }
+        }
+        else if (modelRuntimeWarnings.length === 1) {
+            this.showWarning(modelRuntimeWarnings[0]);
+        }
+        else if (modelRuntimeWarnings.length > 1) {
+            this.showNoticeBox({
+                title: `${modelRuntimeWarnings.length} model warnings`,
+                tone: "warning",
+                why: modelRuntimeWarnings[0],
+                extra: modelRuntimeWarnings.slice(1).map((text) => ({ text })),
+            });
         }
         if (modelFallbackMessage) {
             this.showWarning(modelFallbackMessage);
+            if (modelFallbackMessage === formatNoModelsAvailableMessage())
+                this.startupProviderGuidanceShown = true;
         }
         for (const warning of this.session.fallbackValidationWarnings) {
             this.showWarning(warning);
@@ -1805,7 +1827,13 @@ export class InteractiveMode {
             if (options?.sort !== false) {
                 labels.sort((a, b) => a.localeCompare(b));
             }
-            return theme.fg("dim", `  ${labels.join(", ")}`);
+            // A short listing fits on one line and shows in full; a long one (dozens of skills) is
+            // what flooded the first screen on a narrow terminal, so it truncates to a few names
+            // with a +N more hint. The full list is one Ctrl+O away.
+            const shown = labels.length <= 8 ? labels : labels.slice(0, 3);
+            const hidden = labels.length - shown.length;
+            const more = hidden > 0 ? theme.fg("muted", ` +${hidden} more (${keyText("app.tools.expand")})`) : "";
+            return theme.fg("dim", `  ${shown.join(", ")}`) + more;
         };
         // System resources are left out of the compact body; a section with nothing else to show stays
         // hidden until the listing is expanded, where the system group lists them. Bodies are built on
@@ -4185,6 +4213,15 @@ export class InteractiveMode {
             case "resume_context_reduced":
                 this.showWarning(event.notice);
                 break;
+            case "provider_required":
+                // The first notice repeats the startup "No models available" warning (same /login guidance), so it
+                // is absorbed by it; the session emits again only after a turn was admitted in between.
+                if (this.startupProviderGuidanceShown) {
+                    this.startupProviderGuidanceShown = false;
+                    break;
+                }
+                this.showWarning(event.notice);
+                break;
             case "settings_source_selected":
                 this.showSettingsSourceSelected(event);
                 break;
@@ -4475,6 +4512,9 @@ export class InteractiveMode {
                     }
                 }
                 else if (event.result) {
+                    // A successful compaction ends the retry episode: no finish is owed, so a later
+                    // never-retried terminal failure must not reopen the banner.
+                    this.providerErrors?.clear();
                     // Compaction event consumers in the fork are session-backed and do not
                     // necessarily expose InteractiveMode's SessionManager convenience getter.
                     // Keep the structural fallback for focused handler consumers while using
@@ -4520,7 +4560,11 @@ export class InteractiveMode {
                 }
                 else if (event.errorMessage) {
                     const errorMessage = sanitizeTerminalLabel(event.errorMessage);
-                    if (isNetworkProviderError(errorMessage)) {
+                    // The quiet provider-retry banner's finish() closes out a retry recorded in the CURRENT
+                    // episode. A terminal compaction failure after an episode that already finished (or one
+                    // that never retried) must always surface as an error, even when its message looks
+                    // transient ("timeout", "truncated generator").
+                    if (isRetryableProviderError(errorMessage) && this.providerErrors?.awaitingRetryFinish === true) {
                         this.getProviderErrors().finish(errorMessage);
                     }
                     else if (event.reason === "manual") {
@@ -4632,7 +4676,7 @@ export class InteractiveMode {
                 this.setExtensionStatus(FALLBACK_STATUS_KEY, undefined);
                 break;
             case "retry_fallback_exhausted":
-                if (isNetworkProviderError(event.lastError)) {
+                if (isRetryableProviderError(event.lastError)) {
                     this.getProviderErrors().finish(event.lastError);
                     this.setExtensionStatus(FALLBACK_STATUS_KEY, undefined);
                     break;
@@ -4654,7 +4698,7 @@ export class InteractiveMode {
                 });
                 break;
             case "auto_retry_start": {
-                if (isNetworkProviderError(event.errorMessage)) {
+                if (isRetryableProviderError(event.errorMessage)) {
                     this.getProviderErrors().retrying(event.errorMessage, this.toolOutputExpanded);
                 }
                 // During retry waits, isStreaming flips false between attempts. The main Esc handler
@@ -4694,7 +4738,7 @@ export class InteractiveMode {
                 if (event.success || event.finalError === "Retry cancelled") {
                     this.providerErrors?.clear();
                 }
-                else if (isNetworkProviderError(event.finalError)) {
+                else if (isRetryableProviderError(event.finalError)) {
                     this.getProviderErrors().finish(event.finalError, event.attempt);
                 }
                 else {
@@ -4704,7 +4748,7 @@ export class InteractiveMode {
                 break;
             }
             case "summarization_retry_scheduled": {
-                if (isNetworkProviderError(event.errorMessage)) {
+                if (isRetryableProviderError(event.errorMessage)) {
                     this.getProviderErrors().retrying(event.errorMessage, this.toolOutputExpanded);
                 }
                 else {
@@ -4725,7 +4769,7 @@ export class InteractiveMode {
                 break;
             }
             case "summarization_retry_finished": {
-                this.providerErrors?.clear();
+                this.providerErrors?.clearTransient();
                 this.clearStatusIndicator("retry");
                 this.ui.requestRender();
                 break;
@@ -4760,7 +4804,7 @@ export class InteractiveMode {
     showRetryStatusIndicatorWithCadence(event) {
         const refreshIntervalMs = largeSessionWorkingStatusInterval(this.sessionManager.getEntryCount(), DEFAULT_RETRY_STATUS_REFRESH_INTERVAL_MS, LARGE_SESSION_RETRY_STATUS_REFRESH_INTERVAL_MS);
         const indicator = refreshIntervalMs === DEFAULT_RETRY_STATUS_REFRESH_INTERVAL_MS ? undefined : { intervalMs: refreshIntervalMs };
-        this.showStatusIndicator(new RetryStatusIndicator(this.ui, event.attempt, event.maxAttempts, event.delayMs, indicator, isNetworkProviderError(event.errorMessage)));
+        this.showStatusIndicator(new RetryStatusIndicator(this.ui, event.attempt, event.maxAttempts, event.delayMs, indicator, isRetryableProviderError(event.errorMessage)));
         this.ui.requestRender();
     }
     /** Extract text content from a user message */

package/dist/modes/interactive/provider-error-presentation.d.ts

@@ -2,6 +2,15 @@ import type { AssistantMessage } from "@earendil-works/pi-ai";
 import { type Container } from "@earendil-works/pi-tui";
 /** Presentation classification only. Retry eligibility remains owned by AgentSession. */
 export declare function isNetworkProviderError(raw: string | undefined, envelopeOnly?: boolean): boolean;
+/**
+ * True when a provider failure should take the quiet presentation path (one banner, a
+ * status-line countdown while retrying, raw JSON only on expand): any transient failure,
+ * which is a network drop, a 429 rate-limit, or a 5xx. Hard quota/auth/billing failures
+ * classify non-retryable here and stay verbose, because they need a credential or plan
+ * change, not a wait. Delegates to the shared classifier so the transcript decision and
+ * the retry engine never disagree about what is transient.
+ */
+export declare function isRetryableProviderError(raw: string | undefined): boolean;
 export declare function isNetworkProviderMessage(message: AssistantMessage): boolean;
 /** Owns one display episode, not session messages or retry/fallback policy. */
 export declare class ProviderErrorPresentation {
@@ -11,7 +20,23 @@ export declare class ProviderErrorPresentation {
     constructor(chat: Container);
     record(raw: string, expanded?: boolean): void;
     retrying(raw: string, expanded: boolean): void;
+    /** A success or cleanup ends the episode: no finish is owed afterward. */
     clear(): void;
+    /**
+     * The retry engine finishing (summarization_retry_finished): clears the transient row but keeps
+     * the episode marker, because the terminal compaction_end that follows still closes the
+     * exhausted episode out via finish().
+     */
+    clearTransient(): void;
+    /** True while a retry episode is active (a retry was recorded and not yet finished/cleared). */
+    get hasActiveRetry(): boolean;
+    /**
+     * True only while a retry has been recorded in the CURRENT episode and not yet closed out by
+     * finish(). A fresh terminal failure after an episode that already finished returns false, so
+     * it surfaces as a plain error instead of reopening the stale banner.
+     */
+    get awaitingRetryFinish(): boolean;
+    private retryAwaitingFinish;
     finish(raw?: string, attempts?: number): void;
     newTurn(): void;
 }

package/dist/modes/interactive/provider-error-presentation.js

@@ -1,3 +1,4 @@
+import { isRetryableErrorMessage } from "@earendil-works/pi-ai";
 import { Text } from "@earendil-works/pi-tui";
 import { z } from "zod";
 import { keyText } from "./components/keybinding-hints.js";
@@ -25,6 +26,21 @@ export function isNetworkProviderError(raw, envelopeOnly = false) {
         throw error;
     }
 }
+/**
+ * True when a provider failure should take the quiet presentation path (one banner, a
+ * status-line countdown while retrying, raw JSON only on expand): any transient failure,
+ * which is a network drop, a 429 rate-limit, or a 5xx. Hard quota/auth/billing failures
+ * classify non-retryable here and stay verbose, because they need a credential or plan
+ * change, not a wait. Delegates to the shared classifier so the transcript decision and
+ * the retry engine never disagree about what is transient.
+ */
+export function isRetryableProviderError(raw) {
+    if (!raw)
+        return false;
+    if (isNetworkProviderError(raw))
+        return true;
+    return isRetryableErrorMessage(raw);
+}
 export function isNetworkProviderMessage(message) {
     return ((message.stopReason === "error" || message.stopReason === "aborted") &&
         isNetworkProviderError(message.errorMessage));
@@ -62,10 +78,12 @@ class ProviderFailureNotice {
 export class ProviderErrorPresentation {
     constructor(chat) {
         this.pending = false;
+        this.retryAwaitingFinish = false;
         this.chat = chat;
     }
     record(raw, expanded = false) {
         this.pending = true;
+        this.retryAwaitingFinish = true;
         if (!this.notice) {
             this.notice = new ProviderFailureNotice();
             this.notice.setExpanded(expanded);
@@ -78,17 +96,41 @@ export class ProviderErrorPresentation {
         // RetryStatusIndicator owns the single visible transient row.
         this.notice?.setSummary(undefined);
     }
+    /** A success or cleanup ends the episode: no finish is owed afterward. */
     clear() {
         this.pending = false;
+        this.retryAwaitingFinish = false;
         // Keep diagnostics reachable through the existing expansion affordance.
         this.notice?.setSummary(undefined);
     }
+    /**
+     * The retry engine finishing (summarization_retry_finished): clears the transient row but keeps
+     * the episode marker, because the terminal compaction_end that follows still closes the
+     * exhausted episode out via finish().
+     */
+    clearTransient() {
+        this.pending = false;
+        this.notice?.setSummary(undefined);
+    }
+    /** True while a retry episode is active (a retry was recorded and not yet finished/cleared). */
+    get hasActiveRetry() {
+        return this.pending;
+    }
+    /**
+     * True only while a retry has been recorded in the CURRENT episode and not yet closed out by
+     * finish(). A fresh terminal failure after an episode that already finished returns false, so
+     * it surfaces as a plain error instead of reopening the stale banner.
+     */
+    get awaitingRetryFinish() {
+        return this.retryAwaitingFinish;
+    }
     finish(raw, attempts) {
         if (raw)
             this.record(raw);
         if (!this.pending)
             return;
         this.pending = false;
+        this.retryAwaitingFinish = false;
         const count = attempts === undefined ? "" : ` after ${attempts} retries`;
         this.notice?.setSummary(`The model provider could not complete the request${count}. Try again or choose another model with /model.`);
     }

package/dist/modes/interactive/theme/dark.json

@@ -34,9 +34,9 @@
 		"customMessageBg": "okhsl(295 42% 24%)",
 		"customMessageText": "muted",
 		"customMessageLabel": "violet",
-		"toolPendingBg": "okhsl(229 5% 24%)",
-		"toolSuccessBg": "okhsl(158 46% 25%)",
-		"toolErrorBg": "okhsl(19 54% 25%)",
+		"toolPendingBg": "okhsl(229 5% 13%)",
+		"toolSuccessBg": "okhsl(158 26% 13%)",
+		"toolErrorBg": "okhsl(19 28% 14%)",
 		"toolTitle": "text",
 		"toolOutput": "muted",
 		"mdHeading": "yellow",
@@ -49,8 +49,8 @@
 		"mdQuoteBorder": "muted",
 		"mdHr": "muted",
 		"mdListBullet": "violet",
-		"toolDiffAdded": "green",
-		"toolDiffRemoved": "red",
+		"toolDiffAdded": "okhsl(159 58% 76%)",
+		"toolDiffRemoved": "okhsl(20 70% 77%)",
 		"toolDiffContext": "muted",
 		"syntaxComment": "muted",
 		"syntaxKeyword": "blue",

package/dist/modes/interactive/theme/light.json

@@ -34,9 +34,9 @@
 		"customMessageBg": "okhsl(295 25% 91%)",
 		"customMessageText": "muted",
 		"customMessageLabel": "violet",
-		"toolPendingBg": "okhsl(248 3% 91%)",
-		"toolSuccessBg": "okhsl(156 21% 91%)",
-		"toolErrorBg": "okhsl(24 23% 91%)",
+		"toolPendingBg": "okhsl(248 3% 93%)",
+		"toolSuccessBg": "okhsl(156 25% 91%)",
+		"toolErrorBg": "okhsl(24 28% 91%)",
 		"toolTitle": "text",
 		"toolOutput": "muted",
 		"mdHeading": "yellow",
@@ -49,8 +49,8 @@
 		"mdQuoteBorder": "muted",
 		"mdHr": "muted",
 		"mdListBullet": "violet",
-		"toolDiffAdded": "green",
-		"toolDiffRemoved": "red",
+		"toolDiffAdded": "okhsl(159 85% 28%)",
+		"toolDiffRemoved": "okhsl(20 100% 30%)",
 		"toolDiffContext": "muted",
 		"syntaxComment": "muted",
 		"syntaxKeyword": "blue",

package/dist/modes/rpc/custom-capability.d.ts

@@ -74,6 +74,12 @@ export declare const PROMPT_SURFACE_CAPABILITY = "prompt_surface";
  * value reaches every consumer, so a client may rely on it the moment it sees this name.
  */
 export declare const BROWSER_ENGINE_CAPABILITY = "browser_engine";
+/**
+ * HOST capability: this host honors `open_session.retryFallback` (`{ modelFallback, fallbackChains }`). The
+ * policy is that session's own: it is applied as an in-memory settings override for that session only,
+ * never written to a settings file and never seen by another session on the host.
+ */
+export declare const RETRY_FALLBACK_PROFILE_CAPABILITY = "retry_fallback_profile";
 /**
  * HOST capability: `open_session.promptSurface` also accepts `chat` (a chat bridge: no routing line,
  * no handoff block, no todo cues). A host without it refuses `chat` with `invalid_launch_profile`,

package/dist/modes/rpc/custom-capability.js

@@ -74,6 +74,12 @@ export const PROMPT_SURFACE_CAPABILITY = "prompt_surface";
  * value reaches every consumer, so a client may rely on it the moment it sees this name.
  */
 export const BROWSER_ENGINE_CAPABILITY = "browser_engine";
+/**
+ * HOST capability: this host honors `open_session.retryFallback` (`{ modelFallback, fallbackChains }`). The
+ * policy is that session's own: it is applied as an in-memory settings override for that session only,
+ * never written to a settings file and never seen by another session on the host.
+ */
+export const RETRY_FALLBACK_PROFILE_CAPABILITY = "retry_fallback_profile";
 /**
  * HOST capability: `open_session.promptSurface` also accepts `chat` (a chat bridge: no routing line,
  * no handoff block, no todo cues). A host without it refuses `chat` with `invalid_launch_profile`,

package/dist/modes/rpc/rpc-client.d.ts

@@ -6,6 +6,7 @@
 import type { AgentMessage, ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ImageContent } from "@earendil-works/pi-ai";
 import type { PromptDisposition, QueuedInputDisposition, SessionStats } from "../../core/agent-session.ts";
+import type { SessionRetryFallbackProfile } from "../../core/agent-session-runtime.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
 import type { BrowserEngine } from "../../core/browser-engine.ts";
 import { type ClientMessageIdentity } from "../../core/client-message-identity.ts";
@@ -136,6 +137,8 @@ export declare class RpcClient {
         promptSurface?: PromptSurface;
         /** Which browser this session's skills drive; needs the host's `browser_engine`. */
         browserEngine?: BrowserEngine;
+        /** This session's own fallback policy, in memory only; needs the host's `retry_fallback_profile`. */
+        retryFallback?: SessionRetryFallbackProfile;
     }): Promise<{
         sessionId: string;
         state: RpcSessionState;

package/dist/modes/rpc/rpc-input-validation.d.ts

@@ -40,6 +40,13 @@ export declare function sessionPromptSurfaceError(value: unknown): string | unde
  * own browser must not silently run without one.
  */
 export declare function sessionBrowserEngineError(value: unknown): string | undefined;
+/**
+ * Detail for an `open_session.retryFallback` the host refuses, or undefined when it is absent or well
+ * formed: `{ modelFallback: boolean, fallbackChains: Record<string, string[]> }`, at most 32 chains of at
+ * most 32 non-empty selectors. A malformed profile is refused rather than ignored, so a caller that asked
+ * for a chain never runs without one unknowingly.
+ */
+export declare function sessionRetryFallbackError(value: unknown): string | undefined;
 export declare function rpcCommandShapeError(command: unknown): string | undefined;
 export declare function rpcMessageLengthError(command: unknown): string | undefined;
 //# sourceMappingURL=rpc-input-validation.d.ts.map

package/dist/modes/rpc/rpc-input-validation.js

@@ -161,6 +161,43 @@ export function sessionBrowserEngineError(value) {
         return undefined;
     return `browserEngine must be "connected", "builtin" or "none".`;
 }
+const MAX_RETRY_FALLBACK_CHAINS = 32;
+const MAX_RETRY_FALLBACK_ENTRIES = 32;
+const MAX_RETRY_FALLBACK_SELECTOR_LENGTH = 512;
+/**
+ * Detail for an `open_session.retryFallback` the host refuses, or undefined when it is absent or well
+ * formed: `{ modelFallback: boolean, fallbackChains: Record<string, string[]> }`, at most 32 chains of at
+ * most 32 non-empty selectors. A malformed profile is refused rather than ignored, so a caller that asked
+ * for a chain never runs without one unknowingly.
+ */
+export function sessionRetryFallbackError(value) {
+    if (value === undefined)
+        return undefined;
+    const shape = "retryFallback must be { modelFallback: boolean, fallbackChains: Record<string, string[]> }.";
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return shape;
+    const record = value;
+    if (typeof record.modelFallback !== "boolean")
+        return shape;
+    const chains = record.fallbackChains;
+    if (typeof chains !== "object" || chains === null || Array.isArray(chains))
+        return shape;
+    const entries = Object.entries(chains);
+    if (entries.length > MAX_RETRY_FALLBACK_CHAINS)
+        return `retryFallback allows at most ${MAX_RETRY_FALLBACK_CHAINS} chains.`;
+    for (const [key, selectors] of entries) {
+        if (!isSelector(key))
+            return shape;
+        if (!Array.isArray(selectors) || !selectors.every(isSelector))
+            return shape;
+        if (selectors.length > MAX_RETRY_FALLBACK_ENTRIES)
+            return `retryFallback allows at most ${MAX_RETRY_FALLBACK_ENTRIES} entries per chain.`;
+    }
+    return undefined;
+}
+function isSelector(value) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_RETRY_FALLBACK_SELECTOR_LENGTH;
+}
 export function rpcCommandShapeError(command) {
     if (typeof command !== "object" || command === null || Array.isArray(command)) {
         return "RPC command must be a JSON object.";

package/dist/modes/rpc/rpc-types.d.ts

@@ -9,6 +9,7 @@ import type { ImageContent, Model, ProviderDiagnostic, ThinkingSelection } from
 import type { SessionRuntimeKind } from "../../cli/args.ts";
 import type { AgentAbortSource } from "../../core/agent-abort-provenance.ts";
 import type { PromptDisposition, QueuedInput, QueuedInputDisposition, SessionStats } from "../../core/agent-session.ts";
+import type { SessionRetryFallbackProfile } from "../../core/agent-session-runtime.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
 import type { BrowserEngine } from "../../core/browser-engine.ts";
 import type { ClientMessageIdentity } from "../../core/client-message-identity.ts";
@@ -504,6 +505,14 @@ export type RpcCommand = (RpcSessionCommand & {
      * Requires the host capability `browser_engine`. Any other value is refused with `invalid_launch_profile`.
      */
     browserEngine?: BrowserEngine;
+    /**
+     * The fallback policy THIS session runs with (e.g. a task child's own chain): applied as an
+     * in-memory override of this session's `retry.modelFallback` / `retry.fallbackChains`, never written
+     * to a settings file and never seen by another session. Requires the host capability
+     * `retry_fallback_profile`; a malformed value is refused with `invalid_launch_profile`. Applied
+     * when the open creates the session; an attach keeps the session's existing policy.
+     */
+    retryFallback?: SessionRetryFallbackProfile;
 } | {
     id?: string;
     type: "close_session";

package/dist/modes/rpc/session-command-activity.d.ts

@@ -0,0 +1,2 @@
+export declare function refreshesSessionActivity(command: string): boolean;
+//# sourceMappingURL=session-command-activity.d.ts.map

package/dist/modes/rpc/session-command-activity.js

@@ -0,0 +1,25 @@
+/** Whether the command itself refreshes activity, apart from attached-client keepalives. */
+const observations = new Set([
+    "get_state",
+    "get_messages",
+    "get_entries",
+    "get_tree",
+    "get_fork_messages",
+    "get_last_assistant_text",
+    "get_session_stats",
+    "get_steering_messages",
+    "get_follow_up_messages",
+    "get_available_models",
+    "get_available_thinking_levels",
+    "get_fast_mode",
+    "get_commands",
+    "get_loaded_surfaces",
+    "get_media",
+    "get_auth_providers",
+    "get_provider_accounts",
+    "memory_report",
+]);
+export function refreshesSessionActivity(command) {
+    return !observations.has(command);
+}
+//# sourceMappingURL=session-command-activity.js.map

package/dist/modes/rpc/session-command-router.js

@@ -1,11 +1,11 @@
 import { VERSION } from "../../config.js";
-import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY } from "../../core/extensions/builtin/permission-system/config.js";
+import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPABILITY, } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
 import { buildRpcSessionState } from "./connection-handler.js";
-import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { answerWarm } from "./host-warm.js";
 import { protocolIdentity } from "./protocol-identity.js";
-import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, } from "./rpc-input-validation.js";
+import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { RPC_ERROR_INVALID_LAUNCH_PROFILE, RPC_ERROR_INVALID_SESSION_CONTEXT, RPC_ERROR_INVALID_SESSION_KIND, RPC_ERROR_MISSING_SESSION_ID, RPC_ERROR_OPEN_FAILED, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_UNKNOWN_SESSION, } from "./rpc-types.js";
 import { runWithSessionAttribution } from "./session-attribution.js";
 import { createRpcSessionBinding } from "./session-binding.js";
@@ -213,7 +213,10 @@ export class SessionCommandRouter {
                 PROMPT_SURFACE_CHAT_CAPABILITY,
                 // Each session's tool subprocesses and eval kernel get its own OMO_BROWSER_ENGINE from its launch profile.
                 BROWSER_ENGINE_CAPABILITY,
+                // Each session's fallback chain is its own in-memory settings override, never the host's file.
+                RETRY_FALLBACK_PROFILE_CAPABILITY,
                 ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY,
+                AUTO_PERMISSION_PRESET_CAPABILITY,
                 // Only an in-process runtime shares the loop a warm loads into (senpi#2314).
                 ...(this.registry.warm ? [WARM_CAPABILITY] : []),
                 ...(this.connectionOptions?.capabilities ?? []),
@@ -317,7 +320,7 @@ export class SessionCommandRouter {
     sweepIdleSessions() {
         const now = this.idleNow();
         const idleEvictionMs = this.memoryPressure ? this.idleEvictionMs / 2 : this.idleEvictionMs;
-        const verdicts = selectSweepEvictions(this.registry, now, idleEvictionMs);
+        const verdicts = selectSweepEvictions(this.registry, now, idleEvictionMs, (sessionId) => this.activeRequests.has(sessionId) || (this.bindings.get(sessionId)?.pendingPrompts?.().length ?? 0) > 0);
         for (const sessionId of verdicts.orphaned)
             void this.evictIdleSession(sessionId, "session_dir_removed");
         for (const sessionId of verdicts.idle)
@@ -486,6 +489,9 @@ export class SessionCommandRouter {
         const browserEngineError = sessionBrowserEngineError(command.browserEngine);
         if (browserEngineError)
             return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${browserEngineError}`);
+        const retryFallbackError = sessionRetryFallbackError(command.retryFallback);
+        if (retryFallbackError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${retryFallbackError}`);
         let opened;
         try {
             opened = await this.registry.openSession({
@@ -504,6 +510,7 @@ export class SessionCommandRouter {
                 ...(typeof command.auto_title === "boolean" ? { autoTitle: command.auto_title } : {}),
                 ...(command.promptSurface !== undefined ? { promptSurface: command.promptSurface } : {}),
                 ...(command.browserEngine !== undefined ? { browserEngine: command.browserEngine } : {}),
+                ...(command.retryFallback !== undefined ? { retryFallback: command.retryFallback } : {}),
             }, 
             // Host lifecycle policy, deliberately outside the immutable launch profile.
             { retainOnDisconnect: command.retain_on_disconnect === true });

package/dist/modes/rpc/session-registry-attach.js

@@ -6,6 +6,7 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
     const [handle, entry] = existing;
     const wasParked = entry.retainOnDisconnect === true && entry.attachments === 0;
     entry.attachments += 1;
+    entry.detachedAt = undefined;
     // The claim carries the attachment state another generation decides on: a path this host is
     // actively serving a client on is never reclaimable from it.
     pathReservations?.setAttached(sessionPath, true);