@code-yeongyu/senpi 2026.10.6 → 2026.10.7

package/dist/modes/rpc/host-legacy.js

@@ -96,11 +96,16 @@ async function judgeLegacyHost(paths, probe, platform = process.platform) {
     const sessions = await probeSessionCount(host.socket, LEGACY_PROBE_TIMEOUT_MS);
     if (sessions === 0)
         return { verdict: "idle", host };
-    const held = sessions === undefined ? "an unknown number of sessions" : `${sessions} open session${sessions === 1 ? "" : "s"}`;
-    return {
-        verdict: "held",
-        detail: `${where} holds ${held}; run \`${APP_NAME} host stop --drain --socket ${host.socket}\` to let it finish that work and exit, then retry`,
-    };
+    return { verdict: "held", detail: busyLegacyHostDetail(pid, host.socket, sessions) };
+}
+/** Why a proven legacy host that holds work is left alone, and the command that retires it. */
+export function busyLegacyHostDetail(pid, socket, sessions) {
+    return `pid ${pid} (${socket}) holds ${describeSessions(sessions)}; run \`${APP_NAME} host stop --drain --socket ${socket}\` to let it finish that work and exit, then retry`;
+}
+export function describeSessions(sessions) {
+    return sessions === undefined
+        ? "an unknown number of sessions"
+        : `${sessions} open session${sessions === 1 ? "" : "s"}`;
 }
 /**
  * SIGUSR1, then wait for the proven process to leave. A host that exits before the signal lands has

package/dist/modes/rpc/host-probe.d.ts

@@ -32,6 +32,18 @@ export declare function probeSocketReachable(socketPath: string, timeoutMs: numb
  * does not answer. A stop decision needs the number the host reports, not the one a client remembers.
  */
 export declare function probeSessionCount(socketPath: string, timeoutMs: number): Promise<number | undefined>;
+/**
+ * The session count together with the connection that answered it, kept open so the SAME host can be
+ * asked again after its public path was handed to somebody else: the recount reaches the process that
+ * was counted, never whoever serves the path by then. `undefined` when the host does not answer.
+ */
+export interface HeldSessionCount {
+    readonly sessions: number;
+    /** Asks the counted host again over the held connection; `undefined` when it no longer answers. */
+    recount(timeoutMs: number): Promise<number | undefined>;
+    close(): void;
+}
+export declare function holdSessionCount(socketPath: string, timeoutMs: number): Promise<HeldSessionCount | undefined>;
 /** Sends one command and returns its `data`, or `undefined` for any failure to get a usable answer. */
 export declare function requestOnSocket(socketPath: string, command: Readonly<Record<string, unknown>>, timeoutMs: number): Promise<unknown>;
 //# sourceMappingURL=host-probe.d.ts.map

package/dist/modes/rpc/host-probe.js

@@ -59,10 +59,58 @@ export async function probeSocketReachable(socketPath, timeoutMs) {
  * does not answer. A stop decision needs the number the host reports, not the one a client remembers.
  */
 export async function probeSessionCount(socketPath, timeoutMs) {
-    const reply = await requestOnSocket(socketPath, { type: "list_sessions", include_workers: true }, timeoutMs);
-    if (!isRecord(reply) || !Array.isArray(reply.sessions))
+    return sessionCountOf(await requestOnSocket(socketPath, { type: "list_sessions", include_workers: true }, timeoutMs));
+}
+export async function holdSessionCount(socketPath, timeoutMs) {
+    const outcome = await connectAndAsk(socketPath, { id: PROBE_REQUEST_ID, type: "list_sessions", include_workers: true }, timeoutMs, true);
+    const kept = outcome.kept;
+    if (kept === undefined)
+        return undefined;
+    const sessions = sessionCountOf(outcome.answer);
+    if (sessions === undefined) {
+        kept.destroy();
         return undefined;
-    return reply.sessions.length;
+    }
+    let asked = 0;
+    return {
+        sessions,
+        recount: (recountTimeoutMs) => askAgain(kept, `${PROBE_REQUEST_ID}-recount-${++asked}`, recountTimeoutMs),
+        close: () => kept.destroy(),
+    };
+}
+function askAgain(socket, id, timeoutMs) {
+    return new Promise((resolveCount) => {
+        let buffer = "";
+        const finish = (count) => {
+            clearTimeout(timeout);
+            socket.off("data", onData);
+            socket.off("close", onClose);
+            resolveCount(count);
+        };
+        const onClose = () => finish(undefined);
+        const onData = (chunk) => {
+            buffer += chunk.toString("utf8");
+            for (let newline = buffer.indexOf("\n"); newline !== -1; newline = buffer.indexOf("\n")) {
+                const answer = readAnswer(buffer.slice(0, newline), id);
+                buffer = buffer.slice(newline + 1);
+                if (answer !== undefined) {
+                    finish(sessionCountOf(answer));
+                    return;
+                }
+            }
+        };
+        const timeout = setTimeout(() => finish(undefined), timeoutMs);
+        if (socket.destroyed) {
+            finish(undefined);
+            return;
+        }
+        socket.on("data", onData);
+        socket.once("close", onClose);
+        socket.write(`${JSON.stringify({ id, type: "list_sessions", include_workers: true })}\n`);
+    });
+}
+function sessionCountOf(reply) {
+    return isRecord(reply) && Array.isArray(reply.sessions) ? reply.sessions.length : undefined;
 }
 /** Sends one command and returns its `data`, or `undefined` for any failure to get a usable answer. */
 export async function requestOnSocket(socketPath, command, timeoutMs) {
@@ -125,7 +173,7 @@ async function connectAndAsk(socketPath, request, timeoutMs, keep = false) {
             sendSocketHandshake(socket, secret);
     });
 }
-function readAnswer(text) {
+function readAnswer(text, id = PROBE_REQUEST_ID) {
     let parsed;
     try {
         parsed = JSON.parse(text);
@@ -133,7 +181,7 @@ function readAnswer(text) {
     catch {
         return undefined;
     }
-    if (!isRecord(parsed) || parsed.id !== PROBE_REQUEST_ID || parsed.success !== true)
+    if (!isRecord(parsed) || parsed.id !== id || parsed.success !== true)
         return undefined;
     return parsed.data ?? {};
 }

package/dist/modes/rpc/host-runner.js

@@ -164,7 +164,7 @@ async function handoffOutcome(target, spec) {
         return refusal("refuse", before, {
             reason: upgradeRefusal(result.reason),
             socket: target.socket,
-            detail: result.reason,
+            detail: result.detail ?? result.reason,
             upgradeable: result.upgradeable,
         });
     }

package/dist/modes/rpc/host-successor.d.ts

@@ -7,10 +7,11 @@ export declare function startSuccessor(context: {
     options: HandoffHostOptions;
     paths: HostDaemonPaths;
     host: HostProtocolInfo;
+    /** The predecessor's proven identity; `undefined` when nothing proves it, and then it is never signalled. */
     owner: {
-        pid: number;
-        processStartTime: string;
-        instanceId: string;
-    };
+        readonly pid: number;
+    } | undefined;
+    /** Asked once the successor owns the socket: the drain request is sent only when it answers true. */
+    drainGate?: () => Promise<boolean>;
 }): Promise<HandoffResult>;
 //# sourceMappingURL=host-successor.d.ts.map

package/dist/modes/rpc/host-successor.js

@@ -21,7 +21,7 @@ import { randomUUID } from "node:crypto";
 import { open, rm, writeFile } from "node:fs/promises";
 import { waitForStartTime } from "../app-server/daemon/process.js";
 import { generationPaths, HOST_STATE_FILE_MODE } from "./host-daemon-paths.js";
-import { releaseGeneration, writeGenerationRecord, writeHostRegistration } from "./host-daemon-registration.js";
+import { releaseGeneration, writeGenerationRecord, writeHostRegistration, } from "./host-daemon-registration.js";
 import { readFileOrUndefined, readHostSettings, writeHostSettings } from "./host-daemon-state.js";
 import { defaultHostLaunch, PINNED_HOST_CLIENT_CAPABILITIES } from "./host-launch.js";
 import { DEFAULT_HOST_IDLE_EXIT_MS } from "./host-lifecycle.js";
@@ -37,7 +37,7 @@ const SUCCESSOR_EXIT_WAIT_MS = 5_000;
 /** The longest `startSuccessor` runs: its start-time read, the readiness window, one last probe and a refusal's exit wait. */
 export const SUCCESSOR_START_BUDGET_MS = 10_000 + DEFAULT_HANDOFF_READINESS_MS + 2_000 + SUCCESSOR_EXIT_WAIT_MS;
 export async function startSuccessor(context) {
-    const { options, paths, host, owner } = context;
+    const { options, paths, host, owner, drainGate } = context;
     const generation = (host.generation ?? 0) + 1;
     // The successor's identity, chosen here so its generation directory holds its settings before it
     // boots and the pointer can name it the instant it answers on the public socket.
@@ -119,13 +119,14 @@ export async function startSuccessor(context) {
         // The pointer moves to the successor only now: until the rename landed, the generation the
         // clients reach is still the predecessor, and the pointer has to name whoever owns the socket.
         await options._test?.beforeRegistration?.();
-        await writeHostRegistration(paths, registration);
+        await writeHostRegistration(paths, { ...registration, ...successorBuild(answer) });
         child.unref();
         // The successor owns the socket now: the predecessor may drain. SIGUSR1 is sent only here,
         // to a pid the record proved and a host that advertised it can survive the signal. A
         // predecessor that exited on its own in the meantime is already drained, and the handoff it
         // was being asked to make room for has already happened.
-        signalGeneration(owner.pid, "SIGUSR1");
+        if (owner !== undefined && (drainGate === undefined || (await drainGate())))
+            signalGeneration(owner.pid, "SIGUSR1");
         return {
             action: "handoff",
             pid: child.pid,
@@ -185,6 +186,12 @@ async function exitedWithin(exited, ms) {
         clearTimeout(timer);
     }
 }
+/** The successor's build as the successor itself reported it on the socket; never this process's build. */
+function successorBuild(answer) {
+    if (answer.engineVersion === undefined || answer.engineOrdinal === undefined)
+        return {};
+    return { build: { text: answer.engineVersion, ordinal: answer.engineOrdinal } };
+}
 /**
  * The successor's own answer on the PUBLIC socket is the only proof the rename landed: it
  * reports a different `instanceId` than the generation being replaced. An exit instead means

package/docs/rpc.md

@@ -288,8 +288,9 @@ Two guards decide whether a handoff is attempted at all, and both fail closed:
   handler for it, so a host from before the drain existed is never signalled - `handoffHost` answers
   `{ action: "refuse", reason: "handoff_unsupported" }` and `decideHostAction` reports `upgradeable: false`.
 - The registration must prove which process serves the socket (pid + start time, and the record's `socket`
-  must be this endpoint). An unprovable owner refuses with `unknown_owner` rather than signalling a
-  stranger (I1).
+  must be this endpoint) before that process is signalled. Without such a registration a handoff never
+  signals a stranger (I1): it refuses while that host holds a session, and replaces an idle one without
+  a signal unless a flat pre-layout-2 record proves it (see "Daemon state directory (layout 2)").
 
 On win32 a named pipe can be neither renamed nor drained: `handoffHost` refuses with `upgrade_unsupported`
 and `decideHostAction` never yields `handoff` there. Upgrades apply after `stopHost({ drain: true })` or an
@@ -430,6 +431,13 @@ pid and start time must match the live process, so a recycled pid proves nothing
   its endpoint answers with `generation_handoff` and `list_sessions` (workers included) lists no session.
   Otherwise it refuses `legacy_host`, and the CLI refusal carries `detail`: the pid, its endpoint, how many
   sessions it holds and the `host stop --drain --socket <endpoint>` that retires it.
+- A handoff (`host handoff`, and an ensure's upgrade) on an endpoint no layout-2 record proves counts the
+  running host's sessions over a connection it keeps open. With any session, or no answer, it refuses:
+  `legacy_host` with the same `detail` when a flat record proves the process, `unknown_owner` with the
+  session count otherwise. With none, the successor takes the socket; a proven legacy process is sent the
+  drain only if a recount over that held connection still lists no session, and a host no record proves
+  is never signalled - it drains itself once another generation owns the public entry, and the handoff
+  writes one stderr warning naming the socket, that host's instance and its engine.
 
 `ensureHost` fails with a typed `HostDaemonStateError` naming the directory it could not create or write,
 and starts no host in that case.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.10.6",
+	"version": "2026.10.7",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -57,9 +57,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.6",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.6",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.6",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.10.7",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.7",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.10.7",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "6.0.0",
 		"cross-spawn": "7.0.6",
@@ -78,8 +78,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.288",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.10.6",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.6",
+		"@code-yeongyu/senpi-codemode": "2026.10.7",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.10.7",
 		"@modelcontextprotocol/sdk": "1.30.0",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",