@code-yeongyu/senpi 2026.10.5 → 2026.10.7

package/dist/modes/rpc/session-command-router.js

@@ -1,11 +1,11 @@
 import { VERSION } from "../../config.js";
-import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY } from "../../core/extensions/builtin/permission-system/config.js";
+import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPABILITY, } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
 import { buildRpcSessionState } from "./connection-handler.js";
-import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
 import { answerWarm } from "./host-warm.js";
 import { protocolIdentity } from "./protocol-identity.js";
-import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, } from "./rpc-input-validation.js";
+import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { RPC_ERROR_INVALID_LAUNCH_PROFILE, RPC_ERROR_INVALID_SESSION_CONTEXT, RPC_ERROR_INVALID_SESSION_KIND, RPC_ERROR_MISSING_SESSION_ID, RPC_ERROR_OPEN_FAILED, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_UNKNOWN_SESSION, } from "./rpc-types.js";
 import { runWithSessionAttribution } from "./session-attribution.js";
 import { createRpcSessionBinding } from "./session-binding.js";
@@ -213,7 +213,10 @@ export class SessionCommandRouter {
                 PROMPT_SURFACE_CHAT_CAPABILITY,
                 // Each session's tool subprocesses and eval kernel get its own OMO_BROWSER_ENGINE from its launch profile.
                 BROWSER_ENGINE_CAPABILITY,
+                // Each session's fallback chain is its own in-memory settings override, never the host's file.
+                RETRY_FALLBACK_PROFILE_CAPABILITY,
                 ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY,
+                AUTO_PERMISSION_PRESET_CAPABILITY,
                 // Only an in-process runtime shares the loop a warm loads into (senpi#2314).
                 ...(this.registry.warm ? [WARM_CAPABILITY] : []),
                 ...(this.connectionOptions?.capabilities ?? []),
@@ -317,7 +320,7 @@ export class SessionCommandRouter {
     sweepIdleSessions() {
         const now = this.idleNow();
         const idleEvictionMs = this.memoryPressure ? this.idleEvictionMs / 2 : this.idleEvictionMs;
-        const verdicts = selectSweepEvictions(this.registry, now, idleEvictionMs);
+        const verdicts = selectSweepEvictions(this.registry, now, idleEvictionMs, (sessionId) => this.activeRequests.has(sessionId) || (this.bindings.get(sessionId)?.pendingPrompts?.().length ?? 0) > 0);
         for (const sessionId of verdicts.orphaned)
             void this.evictIdleSession(sessionId, "session_dir_removed");
         for (const sessionId of verdicts.idle)
@@ -486,6 +489,9 @@ export class SessionCommandRouter {
         const browserEngineError = sessionBrowserEngineError(command.browserEngine);
         if (browserEngineError)
             return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${browserEngineError}`);
+        const retryFallbackError = sessionRetryFallbackError(command.retryFallback);
+        if (retryFallbackError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${retryFallbackError}`);
         let opened;
         try {
             opened = await this.registry.openSession({
@@ -504,6 +510,7 @@ export class SessionCommandRouter {
                 ...(typeof command.auto_title === "boolean" ? { autoTitle: command.auto_title } : {}),
                 ...(command.promptSurface !== undefined ? { promptSurface: command.promptSurface } : {}),
                 ...(command.browserEngine !== undefined ? { browserEngine: command.browserEngine } : {}),
+                ...(command.retryFallback !== undefined ? { retryFallback: command.retryFallback } : {}),
             }, 
             // Host lifecycle policy, deliberately outside the immutable launch profile.
             { retainOnDisconnect: command.retain_on_disconnect === true });

package/dist/modes/rpc/session-registry-attach.js

@@ -6,6 +6,7 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
     const [handle, entry] = existing;
     const wasParked = entry.retainOnDisconnect === true && entry.attachments === 0;
     entry.attachments += 1;
+    entry.detachedAt = undefined;
     // The claim carries the attachment state another generation decides on: a path this host is
     // actively serving a client on is never reclaimable from it.
     pathReservations?.setAttached(sessionPath, true);

package/dist/modes/rpc/session-registry-types.d.ts

@@ -50,6 +50,13 @@ export interface RpcSessionEntry {
     retainOnDisconnect?: boolean;
     /** Timestamp of the last routed command / observed activity; drives idle eviction. */
     lastCommandAt: number;
+    /**
+     * When the last attachment left (a retained session now standing detached), on the registry's
+     * clock; `undefined` while anyone is attached. A detached observational read does not refresh
+     * `lastCommandAt`, and the early-retirement sweep honors a minimum detach age so a transient
+     * reconnect keeps its runtime instead of re-opening cold.
+     */
+    detachedAt?: number;
     lifecycleMutex: Promise<void>;
     closeCompletion?: Promise<void>;
     closeResolve?: () => void;

package/dist/modes/rpc/session-registry-types.js

@@ -14,6 +14,17 @@ export function frozenProfile(profile) {
         ...profile,
         ...(profile.creationModel ? { creationModel: Object.freeze({ ...profile.creationModel }) } : {}),
         ...(profile.sessionContext ? { sessionContext: Object.freeze({ ...profile.sessionContext }) } : {}),
+        ...(profile.retryFallback
+            ? {
+                retryFallback: Object.freeze({
+                    modelFallback: profile.retryFallback.modelFallback,
+                    fallbackChains: Object.freeze(Object.fromEntries(Object.entries(profile.retryFallback.fallbackChains).map(([key, entries]) => [
+                        key,
+                        Object.freeze([...entries]),
+                    ]))),
+                }),
+            }
+            : {}),
     });
 }
 /**

package/dist/modes/rpc/session-registry.js

@@ -5,6 +5,7 @@ import { createAgentSessionRuntime } from "../../core/agent-session-runtime.js";
 import { assertValidSessionId, SessionManager } from "../../core/session-manager.js";
 import { SESSION_PATH_RETRY_AFTER_MS } from "./host-reservations.js";
 import { createRegistryWarm } from "./host-warm.js";
+import { refreshesSessionActivity } from "./session-command-activity.js";
 import { canonicalSessionPath } from "./session-path-key.js";
 import { attachToOpenSession } from "./session-registry-attach.js";
 import { settleClosingReservation, syncRuntimeMetadata } from "./session-registry-claims.js";
@@ -45,6 +46,7 @@ export class RpcSessionRegistry {
                 this.options.pathReservations?.release(key);
             },
             markDetached: (key) => this.options.pathReservations?.setAttached(key, false),
+            now: () => this.now(),
             sync: () => this.syncRuntimeMetadata(),
         };
     }
@@ -202,9 +204,10 @@ export class RpcSessionRegistry {
         }
         if (entry.state !== "open" && entry.state !== "closing")
             throw new RpcSessionRegistryError("unknown_session");
-        // Every routed command counts as activity for idle eviction. Lookups that
-        // must not refresh idleness (sweeps, listing) use peek()/list() instead.
-        entry.lastCommandAt = this.now();
+        // Polling a session nobody holds is observation, not work that needs its runtime;
+        // an attached client's polling keeps its session alive exactly as before.
+        if (entry.attachments > 0 || refreshesSessionActivity(command))
+            entry.lastCommandAt = this.now();
         return entry;
     }
     /**

package/dist/modes/rpc/session-sweep.d.ts

@@ -8,11 +8,21 @@ export interface SweepVerdicts {
      */
     readonly orphaned: readonly string[];
 }
+/**
+ * How long a session must stand detached before the early-retirement branch may
+ * park it: a disconnect that overlaps a sweep is a client about to come back,
+ * and re-opening its runtime cold is the expensive path.
+ */
+export declare const DETACHED_RETIREMENT_GRACE_MS = 5000;
 /**
  * One occupancy sweep's decisions. "Idle" is the COMPLETE session-owned activity contract
  * (`AgentSession.isSessionBusy`: agent run, bash, background terminal jobs and other published
  * wake sources, compaction, barrier-held session work): a busy session restarts its idle clock
- * instead, so work that outlives a turn is never killed. A non-finite window evicts nothing idle.
+ * instead, so work that outlives a turn is never killed. A quiet detached in-process worker
+ * with flushed history can reopen by path and need not keep its runtime for the idle window -
+ * once it has been detached for at least `DETACHED_RETIREMENT_GRACE_MS`, so a transient
+ * reconnect keeps the runtime it already owns.
+ * A non-finite window evicts nothing idle.
  */
-export declare function selectSweepEvictions(registry: Pick<RpcSessionRegistry, "list" | "peek">, now: number, idleEvictionMs: number): SweepVerdicts;
+export declare function selectSweepEvictions(registry: Pick<RpcSessionRegistry, "list" | "peek">, now: number, idleEvictionMs: number, hasPendingRequest?: (sessionId: string) => boolean): SweepVerdicts;
 //# sourceMappingURL=session-sweep.d.ts.map

package/dist/modes/rpc/session-sweep.js

@@ -1,11 +1,21 @@
 import { sessionDirectoryRemoved } from "./session-path-key.js";
+/**
+ * How long a session must stand detached before the early-retirement branch may
+ * park it: a disconnect that overlaps a sweep is a client about to come back,
+ * and re-opening its runtime cold is the expensive path.
+ */
+export const DETACHED_RETIREMENT_GRACE_MS = 5_000;
 /**
  * One occupancy sweep's decisions. "Idle" is the COMPLETE session-owned activity contract
  * (`AgentSession.isSessionBusy`: agent run, bash, background terminal jobs and other published
  * wake sources, compaction, barrier-held session work): a busy session restarts its idle clock
- * instead, so work that outlives a turn is never killed. A non-finite window evicts nothing idle.
+ * instead, so work that outlives a turn is never killed. A quiet detached in-process worker
+ * with flushed history can reopen by path and need not keep its runtime for the idle window -
+ * once it has been detached for at least `DETACHED_RETIREMENT_GRACE_MS`, so a transient
+ * reconnect keeps the runtime it already owns.
+ * A non-finite window evicts nothing idle.
  */
-export function selectSweepEvictions(registry, now, idleEvictionMs) {
+export function selectSweepEvictions(registry, now, idleEvictionMs, hasPendingRequest = () => false) {
     const idle = [];
     const orphaned = [];
     for (const { sessionId, status, sessionPath } of registry.list()) {
@@ -20,10 +30,33 @@ export function selectSweepEvictions(registry, now, idleEvictionMs) {
         }
         if (!Number.isFinite(idleEvictionMs))
             continue;
-        if (entry.worker?.busy || entry.runtime?.session.isSessionBusy) {
+        if (hasPendingRequest(sessionId))
+            continue;
+        const session = entry.runtime?.session;
+        if (entry.worker?.busy || session?.isSessionBusy) {
             entry.lastCommandAt = now;
             continue;
         }
+        if (entry.attachments > 0) {
+            // An attached client holds the live routing handle; only the ordinary deadline applies.
+            if (now - entry.lastCommandAt >= idleEvictionMs)
+                idle.push(sessionId);
+            continue;
+        }
+        if (entry.kind === "worker" && entry.retainOnDisconnect && session?.sessionManager.isTranscriptFlushed()) {
+            // Delivery debt is still owed a turn, even after the ordinary idle deadline.
+            if (session.pendingMessageCount > 0 || session.externalAdmission.list().pending.length > 0)
+                continue;
+            // A just-detached worker is a client about to reconnect; park it only once the
+            // disconnect has stood longer than the grace age. An entry at zero attachments
+            // with no detach stamp was never disconnected, so it keeps its normal window.
+            if (entry.detachedAt !== undefined) {
+                if (now - entry.detachedAt < DETACHED_RETIREMENT_GRACE_MS)
+                    continue;
+                idle.push(sessionId);
+                continue;
+            }
+        }
         if (now - entry.lastCommandAt >= idleEvictionMs)
             idle.push(sessionId);
     }

package/dist/modes/rpc/session-teardown.d.ts

@@ -6,6 +6,8 @@ export interface SessionTeardownHost {
     releaseReservation(key: string): void;
     /** Publishes that this path is retained with no client attached, for the cross-generation claim. */
     markDetached(key: string): void;
+    /** The registry's clock, so the detach stamp shares the sweep's timeline. */
+    now(): number;
     sync(): void;
 }
 export declare function beginSessionClose(host: SessionTeardownHost, handle: string, onRole?: (finalizer: boolean) => void, options?: {

package/dist/modes/rpc/session-teardown.js

@@ -25,6 +25,7 @@ export function beginSessionClose(host, handle, onRole, options) {
     // reservation, and is torn down only by an explicit close or the idle window.
     if (options?.detach && entry.retainOnDisconnect) {
         entry.attachments = 0;
+        entry.detachedAt ??= host.now();
         // A retained session nobody is attached to is what another generation may reclaim the path
         // from (#1893) - but only once nothing is still WRITING it. A session mid-turn keeps its claim
         // until it parks, because reclaiming it would put two writers on one transcript.

package/dist/modes/rpc/worker-session-registry.js

@@ -1,6 +1,7 @@
 import { isAbsolute } from "node:path";
 import { ProviderScope } from "@earendil-works/pi-ai/node/provider-scope";
 import { assertValidSessionId } from "../../core/session-manager.js";
+import { refreshesSessionActivity } from "./session-command-activity.js";
 import { RESERVATION_DENIAL_CODES, SessionPathReservations, } from "./session-path-reservations.js";
 import { frozenProfile, RpcSessionRegistryError, sessionIdentity, } from "./session-registry.js";
 import { SessionWorkerClient } from "./session-worker-client.js";
@@ -139,7 +140,10 @@ export class WorkerSessionRegistry {
             throw new RpcSessionRegistryError("session_closing");
         if (entry.state !== "open" && entry.state !== "closing")
             throw new RpcSessionRegistryError("unknown_session");
-        entry.lastCommandAt = this.now();
+        // Polling a session nobody holds is observation, not work that needs its runtime;
+        // an attached client's polling keeps its session alive exactly as before.
+        if (entry.attachments > 0 || refreshesSessionActivity(command))
+            entry.lastCommandAt = this.now();
         return entry;
     }
     beginClose(handle, onRole, options) {

package/docs/rpc.md

@@ -288,8 +288,9 @@ Two guards decide whether a handoff is attempted at all, and both fail closed:
   handler for it, so a host from before the drain existed is never signalled - `handoffHost` answers
   `{ action: "refuse", reason: "handoff_unsupported" }` and `decideHostAction` reports `upgradeable: false`.
 - The registration must prove which process serves the socket (pid + start time, and the record's `socket`
-  must be this endpoint). An unprovable owner refuses with `unknown_owner` rather than signalling a
-  stranger (I1).
+  must be this endpoint) before that process is signalled. Without such a registration a handoff never
+  signals a stranger (I1): it refuses while that host holds a session, and replaces an idle one without
+  a signal unless a flat pre-layout-2 record proves it (see "Daemon state directory (layout 2)").
 
 On win32 a named pipe can be neither renamed nor drained: `handoffHost` refuses with `upgrade_unsupported`
 and `decideHostAction` never yields `handoff` there. Upgrades apply after `stopHost({ drain: true })` or an
@@ -430,6 +431,13 @@ pid and start time must match the live process, so a recycled pid proves nothing
   its endpoint answers with `generation_handoff` and `list_sessions` (workers included) lists no session.
   Otherwise it refuses `legacy_host`, and the CLI refusal carries `detail`: the pid, its endpoint, how many
   sessions it holds and the `host stop --drain --socket <endpoint>` that retires it.
+- A handoff (`host handoff`, and an ensure's upgrade) on an endpoint no layout-2 record proves counts the
+  running host's sessions over a connection it keeps open. With any session, or no answer, it refuses:
+  `legacy_host` with the same `detail` when a flat record proves the process, `unknown_owner` with the
+  session count otherwise. With none, the successor takes the socket; a proven legacy process is sent the
+  drain only if a recount over that held connection still lists no session, and a host no record proves
+  is never signalled - it drains itself once another generation owns the public entry, and the handoff
+  writes one stderr warning naming the socket, that host's instance and its engine.
 
 `ensureHost` fails with a typed `HostDaemonStateError` naming the directory it could not create or write,
 and starts no host in that case.
@@ -867,6 +875,22 @@ surface, and `new_session` / `switch_session` / `fork` inside the session keep i
 `chat`: a host without it refuses `chat` with `invalid_launch_profile`, so a gateway falls back to `app`. Any value other
 than `terminal`, `app` or `chat` is refused with `invalid_launch_profile`.
 
+#### Fallback chain per session (`retry_fallback_profile`)
+
+`open_session.retryFallback: { modelFallback: boolean, fallbackChains: Record<string, string[]> }` is the fallback
+policy THIS session runs with, e.g. a task child's own chain. It overrides that session's `retry.modelFallback` and
+`retry.fallbackChains` in memory only: it is never written to a settings file, and no other session on the host sees
+it. A session opened without the field keeps the host's settings. It is applied when the open creates the session; an
+attach to a live session keeps the policy that session was created with. Probe `retry_fallback_profile` in
+`get_protocol_info` before sending the field. A malformed profile (a missing `modelFallback`, a chain that is not an
+array of non-empty selectors, a selector longer than 512 characters, more than 32 chains or 32 entries per chain) is
+refused with `invalid_launch_profile` rather than opening a session without the chain its caller asked for; an empty
+chain (`[]`) is accepted and means no fallback for that key. If something inside that session later changes a
+fallback setting through the settings setters, that write follows the setters' own rules (it persists to the global
+settings file) and replaces the session's override for that one key only: a `setFallbackChain` drops the profile's
+chains, while `modelFallback` keeps the profile's value. The policy is not stored with the session, so a client that
+reopens a session after it was closed sends the profile again.
+
 #### Browser engine per session (`browser_engine`)
 
 `open_session.browserEngine: "connected" | "builtin" | "none"` names the browser THIS session's skills drive: the
@@ -1029,7 +1053,7 @@ extensions and contents; neither runtime provides process-fatal OOM containment.
 
 What the host does enforce are lifecycle windows, and they only ever return memory from work nobody is doing:
 
-- **Idle eviction**: a session with no routed command and no session-owned work for
+- **Idle eviction**: a session with no activity-refreshing command and no session-owned work for
   `SENPI_RPC_SESSION_IDLE_EVICTION_MS` (default 30 minutes) is closed through the exact `close_session` sequence
   (abort → waitForIdle → dispose, all attachments drained, path reservation released) and every attached connection
   receives that handle's `session_closed { reason: "idle_evicted" }` broadcast plus a final `close_session` response
@@ -1048,6 +1072,21 @@ What the host does enforce are lifecycle windows, and they only ever return memo
   background terminal jobs and any other published wake source (terminal monitors, loop-guard holds), compaction,
   and barrier-held session work all defer eviction, and the idle clock restarts when that work settles. An evicted
   session resumes like any other: the next `open_session` with the same `sessionPath` reopens it.
+- **Observational reads**: session state, history, model/auth inventory, loaded surfaces, and `memory_report`
+  do not restart the idle clock of a **detached** session in either runtime. With any client still attached,
+  these reads keep refreshing activity as before: an attached client polling `get_state` keeps the same live
+  routing handle and runtime. An attached session receiving no commands can still idle-evict as before.
+  Commands that change the session restart the clock even when detached. An in-flight request or prompt
+  preflight prevents ordinary idle parking while the request is running; directory-removal teardown is separate.
+- **Completed detached workers**: on the in-process runtime, a retained `kind: "worker"` session with zero
+  attachments is parked on the next occupancy sweep once its transcript is flushed and it has no session-owned
+  work, queued input, admitted unwritten delivery, pending prompt, or in-flight request - provided the disconnect
+  has already stood for at least five seconds (a short grace age, so a transient reconnect keeps the live runtime
+  instead of re-opening cold). It does not wait out the normal idle window. This releases its runtime and eval
+  kernels, not its durable history: reopen its
+  `sessionPath` to continue under a new routing handle. Active monitors and other wake sources still prevent
+  early parking. Unflushed workers, worker-isolate runtimes, and interactive sessions keep their normal window.
+  A zero-attachment worker without a recorded disconnect time also keeps its normal idle deadline.
 - **Worker capacity** (worker runtime ONLY - a stdio host, `--listen stdio://`, an embedder, or a socket host that
   passed `--session-runtime worker` explicitly): at most 20 workers may be preparing, open, closing, or quarantined
   together, because each one is an isolate the host must keep alive. Admission beyond this bound fails explicitly
@@ -1064,7 +1103,8 @@ What the host does enforce are lifecycle windows, and they only ever return memo
   `open_session` with that `sessionPath` — from any connection — attaches to the same routing handle and returns
   `attached: true`. Retention never outranks an explicit teardown: a `close_session` from an attached connection still
   reaches zero attachments and closes the session, host shutdown closes it, and the idle-eviction window above still
-  parks it — announced as `session_parked { sessionId, sessionPath }`, after which the file reopens by path like any
+  parks it (or the completed-detached-worker rule above parks it sooner) — announced as
+  `session_parked { sessionId, sessionPath }`, after which the file reopens by path like any
   evicted session, and the parked session counts as gone for the empty-host exit below. It is also bounded by the empty-host exit
   and the supervisor's idle-exit window below: retention survives a client, not the host. Any attach may turn retention
   on for a live session; no attach turns it off for clients that already rely on it. Omitting the flag is byte-identical
@@ -1427,12 +1467,14 @@ Hosts that support `open_session.permissionPreset: "accept-edits"` advertise
 `permission_preset_accept_edits`. This preset allows project read/list/grep/edit
 and asks for bash, external_directory and other tools. Clients without that
 capability must use `ask`, never `workspace`, for an edit-only approval promise.
-Explicit permission rules and remembered approvals retain their existing precedence.
+Hosts that support `permissionPreset: "auto"` advertise `permission_preset_auto`;
+clients without it must not send `auto`.
+Explicit permission rules and remembered approvals retain their existing precedence, except under `auto`: there settings and CLI rules can only narrow the preset (the more restrictive decision wins), and an "Always" answer (saved in `.senpi/permissions-approved.jsonl`, from this or an earlier session) still allows its pattern.
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |
 | `get_protocol_info` | - | `{ protocolVersion: 1, serverVersion: string, capabilities: string[], mode: "classic"\|"multi", instanceId: string, generation: number, engineVersion: string, engineOrdinal: [y, m, d, n, epoch], launch_profile: { profile_id, core }, memory_pressure?: boolean }` | Answered in BOTH modes; side-effect-free; the capability probe. Multi-session hosts include `multi_session`, `retain_on_disconnect`, `session_kind`, `session_context`, `auto_title_per_session`, `durable_session_id`, `prompt_surface` and `prompt_surface_chat` plus the negotiated launch capabilities. Those are HOST capabilities (a client never sends them) and are advertised only in multi-session mode, where the host owns the attachment refcount and the per-session launch profile. The identity fields are described under "Host identity" above; compatibility is decided from `protocolVersion`, `capabilities` and `engineOrdinal`, NEVER from `serverVersion`. |
-| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?`, `retain_on_disconnect?`, `kind?`, `context?`, `auto_title?`, `durableSessionId?`, `promptSurface?`, `browserEngine?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. Idle sessions past the eviction window are closed by the host itself. `retain_on_disconnect: true` (default false) makes a dropped connection DETACH from this session instead of closing it — see "Retained sessions" below. `kind` (default `interactive`) and the opaque `context` map are described under "Session kind and context" above; both are stored frozen for the session's life and never influence auth, model or resource resolution. |
+| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?`, `retain_on_disconnect?`, `kind?`, `context?`, `auto_title?`, `durableSessionId?`, `promptSurface?`, `browserEngine?`, `retryFallback?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. Idle sessions past the eviction window are closed by the host itself. `retain_on_disconnect: true` (default false) makes a dropped connection DETACH from this session instead of closing it — see "Retained sessions" below. `kind` (default `interactive`) and the opaque `context` map are described under "Session kind and context" above; both are stored frozen for the session's life and never influence auth, model or resource resolution. |
 | `close_session` | `sessionId` | `{}` | Refused with `unknown_session` when the requesting connection never attached to that handle (a close releases the CALLER's attachment, and `list_sessions` publishes every handle). Otherwise aborts active work, awaits agent idle + settled persistence for up to the host grace window (default 10s), then quarantines any worker that has not exited without releasing its path reservation; its response is the LAST record tagged with that handle for the first closer — no events after (test-pinned). An admitted concurrent close joins the same teardown and receives its own successful response; output saturation rejects admission with the bounded close-overflow/resync notice described above. |
 | `list_sessions` | `include_workers?` (default false) | `{ sessions: [{ sessionId, durableSessionId, sessionPath, cwd, name, status, attachments, kind, context? }] }` | Includes `opening`/`closing` entries. Internally quarantined workers remain externally `closing` until exit. `attachments` is the session's live client attachment count; `0` on an `open` row is a retained session with no client attached. Every row carries `kind`. Rows with `kind: "worker"` are omitted unless `include_workers: true`, and `context` is published ONLY on that listing — a default listing carries no `context` at all. |
 | `release_session` | `sessionId`, `reason: "takeover"`, `interrupt?`, `force?` | `{ released: true, session_path, attachments }` | Hands the session to a runtime outside this host. See "Handing a session over (`release_session`)" below. |
@@ -1465,7 +1507,7 @@ In the response `error` field, machine-matchable:
 - `open_failed: <detail>`
 - `invalid_session_context: <detail>` (`open_session.context` past a documented cap: more than 32 keys, a key that does not match `^[a-z][a-z0-9_]*$`, a non-string or >16 KiB value, or more than 32 KiB of JSON in total; the detail names the cap and its byte budget)
 - `invalid_session_kind: <detail>` (`open_session.kind` other than `interactive` or `worker`)
-- `invalid_launch_profile: <detail>` (`open_session.auto_title` present but not a boolean, `open_session.promptSurface` other than `terminal`, `app` or `chat`, or `open_session.browserEngine` other than `connected`, `builtin` or `none`)
+- `invalid_launch_profile: <detail>` (`open_session.auto_title` present but not a boolean, `open_session.promptSurface` other than `terminal`, `app` or `chat`, `open_session.browserEngine` other than `connected`, `builtin` or `none`, or a malformed `open_session.retryFallback`)
 - `host_memory_pressure` (sent only by hosts released before #2207, which declined to CREATE a `kind: "worker"` session above `SENPI_RPC_HOST_RSS_REFUSE_MB`; `errorData { rssMb, retry_after_ms }` says when to ask again. Current hosts never refuse an open for memory; a client talking to an older generation waits and retries, it never starts a second host or a per-child process)
 - `warm_failed: <detail>` (`warm` could not load its profile, for example a `cwd` that does not exist; not remembered, so a retry loads again)
 - `media_not_found` (`get_media` for an unknown `toolCallId`, or a `contentIndex` that does not point at an image block)

package/docs/settings.md

@@ -27,7 +27,7 @@ Senpi includes a built-in permission system for tool calls. It evaluates a prese
 
 | Setting | Type | Default | Description |
 |---------|------|---------|-------------|
-| `permissionPreset` | string | `"full-access"` | Permission preset: `"full-access"`, `"workspace"`, `"read-only"`, or `"ask"` |
+| `permissionPreset` | string | `"full-access"` | Permission preset: `"full-access"`, `"workspace"`, `"accept-edits"`, `"auto"`, `"read-only"`, or `"ask"` |
 | `permission` | object | - | Explicit permission rules that override the selected preset |
 
 Presets:
@@ -36,6 +36,8 @@ Presets:
 |--------|----------|
 | `full-access` | Allow all permission checks without prompting |
 | `workspace` | Allow `read`, `list`, `grep`, `edit`, and `bash`; ask for `external_directory` |
+| `accept-edits` | Allow project `read`, `list`, `grep`, and `edit`; ask for `bash`, `external_directory`, and other tools |
+| `auto` | Asks for everything except what it can prove stays inside the project, judged on the exact file the tool will open (the tool's own path resolution, symlinks followed): reads, listings and writes of project files through the file tools (`read`, `ls`, `find`, `write`, `edit`), `apply_patch` adding, changing or moving project files (a delete asks), a content search of one or more project files, and a small set of read-only shell commands (`ls cat head tail wc diff stat file cut grep rg echo pwd true which`, read-only git) with plain in-project arguments. Files count only when they land inside the project with no hidden component (except repository and formatter files such as `.gitignore`, `.github/`) and no credential-shaped name. Everything else asks: anything outside the project, `.env` and other dotfiles, `.git/`, `.vscode/`, keys, directory-wide content searches, any shell command with quotes, pipes, redirects, `cd` or a write (`cp`, `mv`, `rm`, `mkdir`), `git show`, text sent to a running process (`bash_input`), test runners, builds, installs and network tools. A session rooted at `/`, your home directory, any directory above it, or inside a hidden directory (such as `~/.config`) asks for everything. Each call is decided as the more restrictive of `auto`'s decision and your own rules' decision (deny over ask over allow), whatever order or layer (settings, CLI, RPC) your rules come from: your rules can narrow `auto`, never widen it. <br>`auto` prevents accidents; it is not a sandbox. Credential detection is by name, so a secret in a plainly named project file (for example `secrets.yml`, `terraform.tfvars`) can be read. A path the judge approved can be swapped for a symlink before the tool runs. An "Always" answer you gave (saved in `.senpi/permissions-approved.jsonl`, from this or an earlier session) still allows its pattern. |
 | `read-only` | Allow `read`, `list`, and `grep`; ask for `edit`, `bash`, and `external_directory` |
 | `ask` | Restore prompt-on-unknown behavior |
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.5",
+	"version": "2026.10.7",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.5",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.5",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.5",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.7",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.7",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.7",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.288",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.5",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.5",
+		"@code-yeongyu/senpi-codemode": "2026.10.7",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.7",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",

package/dist/bundle/chunks/chunk-K3BXFPWZ.js

@@ -1,2 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); { const __piWorkerThreads = require("node:worker_threads"); if (typeof __piWorkerThreads.markAsUncloneable !== "function") { __piWorkerThreads.markAsUncloneable = () => {}; } }
-import{HOST_GENERATION_ENV,HOST_INSTANCE_ID_ENV}from"./chunk-CIRZTP7W.js";import{engineBuildIdentity}from"./chunk-XYDZ3LIE.js";import{parseArgs,resolveSessionRuntime}from"./chunk-MH2BFYGN.js";import*as crypto from"node:crypto";var CUSTOM_UNSUPPORTED_CAPABILITY="custom_unsupported",EXTENSION_EVENTS_CAPABILITY="extension_events",AUTO_TITLE_SESSIONS_CAPABILITY="auto_title_sessions",CONTINUE_FROM_LEAF_CAPABILITY="continue_from_leaf",MEDIA_PLACEHOLDERS_CAPABILITY="media_placeholders",QUESTION_CAPABILITY="question",RETAIN_ON_DISCONNECT_CAPABILITY="retain_on_disconnect",SESSION_CONTEXT_CAPABILITY="session_context",SESSION_KIND_CAPABILITY="session_kind",AUTO_TITLE_PER_SESSION_CAPABILITY="auto_title_per_session",WARM_CAPABILITY="warm",DURABLE_SESSION_ID_CAPABILITY="durable_session_id",PROMPT_SURFACE_CAPABILITY="prompt_surface",BROWSER_ENGINE_CAPABILITY="browser_engine",PROMPT_SURFACE_CHAT_CAPABILITY="prompt_surface_chat",RPC_CLIENT_CAPABILITIES_ENV="SENPI_RPC_CLIENT_CAPABILITIES";function parseClientCapabilities(value){return value?value.split(",").map(part=>part.trim()).filter(part=>part.length>0):[]}var DEFAULT_CUSTOM_EXTENSION_LABEL="custom UI component";function buildCustomUnsupportedRequest(capabilities,extensionName){if(!capabilities?.includes(CUSTOM_UNSUPPORTED_CAPABILITY))return;let name=extensionName.trim()||DEFAULT_CUSTOM_EXTENSION_LABEL;return{type:"extension_ui_request",id:crypto.randomUUID(),method:"custom_unsupported",extensionName:name}}import{createHash,randomUUID as randomUUID2}from"node:crypto";import{resolve}from"node:path";var INSTANCE_ID=resolveInstanceId(process.env[HOST_INSTANCE_ID_ENV]);function resolveInstanceId(value){return value!==void 0&&value.trim()!==""?value:randomUUID2()}function hostInstanceId(){return INSTANCE_ID}var cachedProfile;function hostGeneration(env){let value=env[HOST_GENERATION_ENV];return value!==void 0&&/^\d+$/.test(value)?Number(value):0}function hostLaunchProfile(argv,cwd){let parsed=parseArgs([...argv],{grokNeoEnabled:!1}),core={extensions:[...new Set((parsed.extensions??[]).map(path=>resolve(cwd,path)))].sort(),multi_session:parsed.multiSession===!0,session_runtime:resolveSessionRuntime(parsed)},canonical=JSON.stringify({extensions:core.extensions,multi_session:core.multi_session,session_runtime:core.session_runtime});return{profile_id:createHash("sha256").update(canonical).digest("hex"),core}}function socketHostLaunchProfile(hostArgs,cwd){return hostLaunchProfile(["--mode","rpc","--multi-session","--listen","unix://",...hostArgs],cwd)}function protocolIdentity(){cachedProfile??=hostLaunchProfile(process.argv.slice(2),process.cwd());let build=engineBuildIdentity();return{instanceId:INSTANCE_ID,generation:hostGeneration(process.env),engineVersion:build.text,engineOrdinal:build.ordinal,launch_profile:cachedProfile}}export{CUSTOM_UNSUPPORTED_CAPABILITY,EXTENSION_EVENTS_CAPABILITY,AUTO_TITLE_SESSIONS_CAPABILITY,CONTINUE_FROM_LEAF_CAPABILITY,MEDIA_PLACEHOLDERS_CAPABILITY,QUESTION_CAPABILITY,RETAIN_ON_DISCONNECT_CAPABILITY,SESSION_CONTEXT_CAPABILITY,SESSION_KIND_CAPABILITY,AUTO_TITLE_PER_SESSION_CAPABILITY,WARM_CAPABILITY,DURABLE_SESSION_ID_CAPABILITY,PROMPT_SURFACE_CAPABILITY,BROWSER_ENGINE_CAPABILITY,PROMPT_SURFACE_CHAT_CAPABILITY,RPC_CLIENT_CAPABILITIES_ENV,parseClientCapabilities,DEFAULT_CUSTOM_EXTENSION_LABEL,buildCustomUnsupportedRequest,hostInstanceId,hostGeneration,hostLaunchProfile,socketHostLaunchProfile,protocolIdentity};