@code-yeongyu/senpi 2026.10.8 → 2026.10.10-2

package/dist/core/retry-fallback/expansion.js

@@ -1,11 +1,17 @@
 import { isValidThinkingLevel } from "../../cli/args.js";
 /**
- * Providers that never receive a bare selector. OpenRouter re-publishes other
+ * Providers that never receive a bare selector. Gateways re-publish other
  * vendors' catalogs under namespaced ids, so family expansion would silently
  * route a shipped default through a third-party reseller the user never chose.
- * An explicit `openrouter/...` selector the user wrote is unaffected.
+ * An explicit provider-qualified selector the user wrote is unaffected.
  */
-const BARE_EXPANSION_DENYLIST = new Set(["cursor", "openrouter", "openrouter-images"]);
+const BARE_EXPANSION_DENYLIST = new Set([
+    "cursor",
+    "openrouter",
+    "openrouter-images",
+    "opengateway",
+    "vercel-ai-gateway",
+]);
 /**
  * Deterministic tie-break inside one auth tier. Earlier wins. Providers absent
  * from the table sort after every listed one, alphabetically.

package/dist/core/sdk.js

@@ -20,7 +20,7 @@ import { mergeProviderAttributionHeaders } from "./provider-attribution.js";
 import { DefaultResourceLoader } from "./resource-loader.js";
 import { getDefaultSessionDir, SessionManager } from "./session-manager.js";
 import { DEFAULT_TOOL_NAMES, SettingsManager } from "./settings-manager.js";
-import { getSupportedThinkingLevels } from "./thinking-levels.js";
+import { clampThinkingSelection, getSupportedThinkingLevels } from "./thinking-levels.js";
 import { time } from "./timings.js";
 import { createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createPowerShellTool, createReadOnlyTools, createReadTool, createWriteTool, withFileMutationQueue, } from "./tools/index.js";
 import { serviceTierForProvider } from "./ultrafast-lanes.js";
@@ -201,25 +201,29 @@ export async function createAgentSession(options = {}) {
     if (thinkingLevel === undefined && model?.defaultThinkingLevel !== undefined) {
         thinkingLevel = model.defaultThinkingLevel;
     }
+    let thinkingFromGlobalDefault = false;
     if (thinkingLevel === undefined) {
         const configuredDefault = settingsManager.getDefaultThinkingLevel();
         if (configuredDefault !== undefined) {
             thinkingLevel = configuredDefault;
             thinkingSelection = { level: configuredDefault, source: "explicit" };
+            thinkingFromGlobalDefault = true;
         }
         else {
             thinkingLevel = DEFAULT_THINKING_LEVEL;
         }
     }
     // Clamp to model capabilities without inventing provenance for a defaulted level.
+    const requestedThinkingLevel = thinkingLevel;
     if (!model) {
         thinkingLevel = "off";
     }
     else {
         thinkingLevel = clampThinkingLevelToModel(thinkingLevel, model);
     }
-    if (thinkingSelection)
-        thinkingSelection = { ...thinkingSelection, level: thinkingLevel };
+    // senpi#2395: an explicit request the clamp changed keeps the requested level and the reason. The global
+    // default is a default, not a request, so its clamp records no requested level and shows no warning.
+    thinkingSelection = clampThinkingSelection(thinkingSelection, thinkingFromGlobalDefault ? thinkingLevel : requestedThinkingLevel, thinkingLevel, model);
     const configuredDefaultToolNames = settingsManager.getDefaultTools();
     const sessionDefaultToolNames = options.tools === undefined && options.noTools === undefined ? configuredDefaultToolNames : undefined;
     const allowedToolNames = options.tools ?? (options.noTools === "all" ? [] : undefined);

package/dist/core/thinking-levels.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
-import type { Api, Model } from "@earendil-works/pi-ai";
+import type { Api, Model, ModelThinkingLevel, ThinkingSelection } from "@earendil-works/pi-ai";
 /**
  * Tier detection is owned by `packages/ai`, which already treats an explicit `thinkingLevelMap` as
  * authoritative and infers tiers from the model id only when no map is present. These wrappers keep
@@ -8,6 +8,28 @@ import type { Api, Model } from "@earendil-works/pi-ai";
 export declare function supportsXhigh(model: Model<Api>): boolean;
 export declare function supportsMax(model: Model<Api>): boolean;
 export declare function getSupportedThinkingLevels(model: Model<Api>): ThinkingLevel[];
+/** Why an explicit thinking selection runs at a lower level than the one requested (senpi#2395). */
+export type ThinkingClampReason = "model-not-reasoning" | "level-unsupported";
+/** An explicit selection that also records the requested level when a clamp changed it. */
+export interface ClampedThinkingSelection extends ThinkingSelection {
+    readonly requested?: ModelThinkingLevel;
+    readonly clampReason?: ThinkingClampReason;
+}
+/** One clamp of an explicit request, as shown to the user. */
+export interface ThinkingClampNotice {
+    provider: string;
+    modelId: string;
+    requestedLevel: ModelThinkingLevel;
+    appliedLevel: ModelThinkingLevel;
+    reason: ThinkingClampReason;
+}
+/**
+ * Apply the effective `level` to an explicit selection. When it differs from `requested`, the selection keeps
+ * the requested level and the clamp reason instead of reading as if `level` had been chosen.
+ */
+export declare function clampThinkingSelection(selection: ThinkingSelection | undefined, requested: ModelThinkingLevel, level: ModelThinkingLevel, model: Model<Api> | undefined): ThinkingSelection | undefined;
+export declare function getThinkingClampNotice(selection: ThinkingSelection | undefined, model: Model<Api> | undefined): ThinkingClampNotice | undefined;
+export declare function formatThinkingClampWarning(notice: ThinkingClampNotice): string;
 /** Capability classes used by capability-aware reasoning commands. */
 export type ReasoningCapabilityKind = "none" | "always-on" | "on-off" | "graded";
 export interface ReasoningCapability {

package/dist/core/thinking-levels.js

@@ -14,6 +14,43 @@ export function getSupportedThinkingLevels(model) {
     const supportedLevels = getSupportedModelThinkingLevels(model);
     return supportedLevels.length > 0 ? supportedLevels : ["off"];
 }
+/**
+ * Apply the effective `level` to an explicit selection. When it differs from `requested`, the selection keeps
+ * the requested level and the clamp reason instead of reading as if `level` had been chosen.
+ */
+export function clampThinkingSelection(selection, requested, level, model) {
+    if (selection === undefined)
+        return undefined;
+    const { requested: _staleRequested, clampReason: _staleReason, ...base } = selection;
+    if (requested === level || model === undefined)
+        return { ...base, level };
+    const clamped = {
+        ...base,
+        level,
+        requested,
+        clampReason: model.reasoning ? "level-unsupported" : "model-not-reasoning",
+    };
+    return clamped;
+}
+export function getThinkingClampNotice(selection, model) {
+    const clamped = selection;
+    if (model === undefined || clamped?.requested === undefined || clamped.clampReason === undefined)
+        return undefined;
+    return {
+        provider: model.provider,
+        modelId: model.id,
+        requestedLevel: clamped.requested,
+        appliedLevel: clamped.level,
+        reason: clamped.clampReason,
+    };
+}
+export function formatThinkingClampWarning(notice) {
+    const model = `${notice.provider}/${notice.modelId}`;
+    if (notice.reason === "model-not-reasoning") {
+        return `Thinking level "${notice.requestedLevel}" was requested, but ${model} is not marked as a reasoning model, so thinking is "${notice.appliedLevel}". If the model supports reasoning, set "reasoning": true for it in models.json.`;
+    }
+    return `Thinking level "${notice.requestedLevel}" is not available on ${model}; using "${notice.appliedLevel}".`;
+}
 /**
  * Classify a model's reasoning capability purely from `model.reasoning` and its supported thinking
  * levels — never from the model id or thinkingFormat/compat config.

package/dist/core/trust-manager.js

@@ -5,6 +5,7 @@ import lockfile from "proper-lockfile";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, canonicalizePathStrict, resolvePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
+import { bundledBuiltinExtensions } from "./bundled-resources.js";
 const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
     "settings.json",
     "mcp.json",
@@ -16,6 +17,53 @@ const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
     "APPEND_SYSTEM.md",
 ];
 const LEGACY_PROJECT_CONFIG_DIR_NAME = ".pi";
+/**
+ * A project codemode file that sets any setting naming an executable (the codemode package's
+ * `executable-settings.json` list, today `languages.pyInterpreter`) makes the session run that executable at start,
+ * so it asks for a trust decision. A file the check cannot read is treated like a project `mcp.json`, whose mere
+ * presence asks; so is any file when the list itself cannot be read.
+ */
+function projectCodemodeNamesExecutable(configDir) {
+    const path = join(configDir, "codemode.json");
+    if (!existsSync(path))
+        return false;
+    const executableSettings = codemodeExecutableSettings();
+    if (executableSettings === undefined)
+        return true;
+    let parsed;
+    try {
+        parsed = JSON.parse(stripBom(readFileSync(path, "utf8")));
+    }
+    catch {
+        return true;
+    }
+    return executableSettings.some((settingPath) => valueAtPath(parsed, settingPath) !== undefined);
+}
+function codemodeExecutableSettings() {
+    const codemode = bundledBuiltinExtensions.find((extension) => extension.id === "codemode");
+    try {
+        const packageJson = codemode?.resolvePackage();
+        if (packageJson === undefined)
+            return undefined;
+        const list = JSON.parse(readFileSync(join(dirname(packageJson), "src", "config", "executable-settings.json"), "utf8"));
+        if (typeof list !== "object" || list === null)
+            return undefined;
+        const paths = Reflect.get(list, "projectExecutableSettings");
+        return Array.isArray(paths) && paths.every((entry) => typeof entry === "string") ? paths : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function valueAtPath(value, path) {
+    let current = value;
+    for (const key of path.split(".")) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        current = Reflect.get(current, key);
+    }
+    return current;
+}
 function normalizeCwd(cwd) {
     const resolved = resolvePath(cwd);
     try {
@@ -169,6 +217,8 @@ export function hasTrustRequiringProjectResources(cwd) {
     if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
         return true;
     }
+    if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
+        return true;
     while (true) {
         const agentsSkillsDir = join(currentDir, ".agents", "skills");
         if (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {

package/dist/main.js

@@ -29,7 +29,7 @@ import { createProjectTrustContext } from "./cli/project-trust.js";
 import { createStartupLoadingIndicator, pauseIndicatorDuringPrompts, shouldShowStartupLoadingIndicator, } from "./cli/startup-loading-indicator.js";
 import { shouldRunFirstTimeSetup, showFirstTimeSetup, showStartupSelector } from "./cli/startup-ui.js";
 import { APP_NAME, DISPLAY_VERSION, ENV_SESSION_DIR, expandTildePath, getAgentDir, getInstallPackageDir, } from "./config.js";
-import { createAgentSessionRuntime } from "./core/agent-session-runtime.js";
+import { applyRetryFallbackProfile, createAgentSessionRuntime, } from "./core/agent-session-runtime.js";
 import { createAgentSessionFromServices, createAgentSessionServices, } from "./core/agent-session-services.js";
 import { formatNoModelsAvailableMessage } from "./core/auth-guidance.js";
 import { AuthStorage, ReadOnlyAuthStorage } from "./core/auth-storage.js";
@@ -51,6 +51,7 @@ import { assertValidSessionId, SessionManager } from "./core/session-manager.js"
 import { classifySessionRepository, readSessionCwd, rebindSessionFile } from "./core/session-rebind.js";
 import { collectSettingsDiagnosticsWithContext } from "./core/settings-diagnostics.js";
 import { SettingsManager } from "./core/settings-manager.js";
+import { formatThinkingClampWarning } from "./core/thinking-levels.js";
 import { printTimings, recordTiming, resetTimings, time } from "./core/timings.js";
 import { hasTrustRequiringProjectResources, ProjectTrustStore } from "./core/trust-manager.js";
 import { builtInExtensions } from "./extensions/index.js";
@@ -678,17 +679,8 @@ export function createCliRuntimeFactory(configuration, local = {}) {
                 (!hasTrustRequiringResources || trustStore.get(cwd) === true));
         const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
         // The opener's per-session fallback policy is an in-memory override: never saved, never shared.
-        if (launchProfile?.retryFallback) {
-            runtimeSettingsManager.applyOverrides({
-                retry: {
-                    modelFallback: launchProfile.retryFallback.modelFallback,
-                    fallbackChains: Object.fromEntries(Object.entries(launchProfile.retryFallback.fallbackChains).map(([key, entries]) => [
-                        key,
-                        [...entries],
-                    ])),
-                },
-            });
-        }
+        if (launchProfile?.retryFallback)
+            applyRetryFallbackProfile(runtimeSettingsManager, launchProfile.retryFallback);
         const services = await createAgentSessionServices({
             cwd,
             agentDir,
@@ -830,7 +822,9 @@ export function createCliRuntimeFactory(configuration, local = {}) {
         markSwitch("createSession");
         const cliThinkingOverride = runtimeParsed.thinking !== undefined || cliThinkingFromModel;
         if (created.session.model && cliThinkingOverride) {
-            created.session.setThinkingLevel(created.session.thinkingLevel);
+            // senpi#2395: re-apply the level the CLI asked for, so a clamp keeps its requested level and reason.
+            const selection = created.session.thinkingSelection;
+            created.session.setThinkingLevel(selection?.requested ?? created.session.thinkingLevel);
         }
         return {
             ...created,
@@ -1184,6 +1178,11 @@ export async function main(args, options) {
     }
     time("resolveModelScope");
     reportDiagnostics(runtime.diagnostics);
+    // senpi#2395: print/json/RPC runs report a startup thinking clamp on stderr; the TUI shows its own warning.
+    const startupThinkingClamp = runtime.session.startupThinkingClamp;
+    if (appMode !== "interactive" && startupThinkingClamp) {
+        reportDiagnostics([{ type: "warning", message: formatThinkingClampWarning(startupThinkingClamp) }]);
+    }
     if (appMode !== "interactive") {
         reportDiagnostics(collectAuthDiagnostics(services.authStorage, "runtime creation"));
     }

package/dist/modes/interactive/interactive-mode.js

@@ -39,6 +39,7 @@ import { createSessionLogger } from "../../core/session-log.js";
 import { SessionManager, sessionEntryToContextMessages } from "../../core/session-manager.js";
 import { BUILTIN_SLASH_COMMANDS } from "../../core/slash-commands.js";
 import { isInstallTelemetryEnabled } from "../../core/telemetry.js";
+import { formatThinkingClampWarning } from "../../core/thinking-levels.js";
 import { formatTimings, resetTimings, time } from "../../core/timings.js";
 import { withBuiltInRenderers } from "../../core/tools/renderers/index.js";
 import { hasTrustRequiringProjectResources, ProjectTrustStore } from "../../core/trust-manager.js";
@@ -1354,6 +1355,10 @@ export class InteractiveMode {
         for (const warning of this.session.fallbackValidationWarnings) {
             this.showWarning(warning);
         }
+        const startupThinkingClamp = this.session.startupThinkingClamp;
+        if (startupThinkingClamp) {
+            this.showWarning(formatThinkingClampWarning(startupThinkingClamp));
+        }
         this.showRiskyMainModelWarning(this.session.model);
         void this.maybeWarnAboutAnthropicSubscriptionAuth();
         maybeShowRuntimeNotice((spec) => this.showNoticeBox(spec));
@@ -4207,6 +4212,9 @@ export class InteractiveMode {
             case "high_reasoning_warning":
                 this.showHighReasoningWarning(event);
                 break;
+            case "thinking_level_clamped":
+                this.showWarning(formatThinkingClampWarning(event));
+                break;
             case "resume_compaction_required":
                 this.showWarning(event.notice);
                 break;

package/dist/modes/interactive/session-control-endpoint.js

@@ -3,12 +3,16 @@
  * registers one (the interactive host imports it lazily), so a plain TUI pays nothing.
  *
  * Order matters and each step is undone on failure, so a failed bind leaves no half-registered
- * directory: the session header is made durable, dead `tui` endpoints are reaped, the socket is
- * bound (secret 0600, directory 0700), and only then is the endpoint registered - a visible
- * endpoint is one that answers. Wakes come from edges only (see `session-control-wake.ts`).
+ * directory: the socket is bound (secret 0600, directory 0700) while the session header is made
+ * durable, and only once both are done is the endpoint registered - a visible endpoint is one that
+ * answers, and its session id is already on disk. Nothing a sender needs waits on work it does not
+ * need: the writer stamp's process lookup starts at entry, the inbox watch arms after registration
+ * returned, and dead `tui` endpoints of other terminals are reaped after activation. Wakes come
+ * from edges only (see `session-control-wake.ts`).
  */
 import { randomUUID } from "node:crypto";
 import { rm } from "node:fs/promises";
+import { thisProcessStartTime } from "../rpc/host-daemon-registration.js";
 import { gcHostEndpoints } from "../rpc/host-gc.js";
 import { createSocketSecret, socketSecretPath } from "../rpc/socket-transport.js";
 import { runControlCommand } from "./session-control-commands.js";
@@ -33,8 +37,12 @@ export async function registerSessionControlEndpoint(context, options) {
 }
 async function openEndpoint(context, options, cleanups) {
     const { session, agentDir, surface } = context;
-    await session.sessionManager.persistHeaderNow();
-    await gcHostEndpoints(agentDir, { kinds: ["tui"] });
+    // The writer stamp's `ps` lookup is a process constant: started here, it overlaps the header write
+    // and the bind instead of running inside the registry lock.
+    void thisProcessStartTime();
+    // Bound while the header is written, awaited before the endpoint is registered.
+    const headerDurable = session.sessionManager.persistHeaderNow();
+    headerDurable.catch(() => undefined);
     const instanceId = randomUUID();
     const socket = await resolveTuiSocket(agentDir, instanceId);
     cleanups.push(() => rm(socket, { force: true }), () => rm(socketSecretPath(socket), { force: true }));
@@ -59,12 +67,29 @@ async function openEndpoint(context, options, cleanups) {
         listenerError: (error) => surface.notice(`control endpoint listener failed: ${error.message}`),
     });
     cleanups.push(() => server.close());
+    await headerDurable;
     const entry = await registerTuiEndpoint({ agentDir, socket, instanceId });
     cleanups.push(() => unregisterTuiEndpoint(entry));
-    const stopInbox = await watchInbox(options.inboxDir, () => void wake("inbox"), (error) => surface.notice(`control endpoint inbox watch failed: ${errorText(error)}`));
-    const endpoint = activateControlEndpoint({ context, options, entry, server, scheduler, feed, stopInbox, wake });
-    // Anything that reached the inbox before the watch was armed is picked up by this first pass.
+    const inbox = await watchInbox(options.inboxDir, () => void wake("inbox"), (error) => surface.notice(`control endpoint inbox watch failed: ${errorText(error)}`));
+    cleanups.push(() => inbox.stop());
+    const endpoint = activateControlEndpoint({
+        context,
+        options,
+        entry,
+        server,
+        scheduler,
+        feed,
+        stopInbox: inbox.stop,
+        wake,
+    });
+    // Anything that reached the inbox before this point is picked up by this first pass, and anything
+    // written after it but before the watch was armed (no event for it) by the pass once arming settled.
     endpoint.wake("inbox");
+    void inbox.armed.then(() => endpoint.wake("inbox"));
+    // Other terminals' dead records are nothing a sender reads: reaped after activation, off the path.
+    setImmediate(() => {
+        gcHostEndpoints(agentDir, { kinds: ["tui"] }).catch((error) => surface.notice(`control endpoint gc of dead terminals failed: ${errorText(error)}`));
+    });
     return endpoint;
 }
 function errorText(error) {

package/dist/modes/interactive/session-control-registry.js

@@ -5,6 +5,8 @@
  * Registration runs under the endpoint's ensure lock (the lock `host gc` takes) and writes the
  * generation record BEFORE `endpoint.json`: a reader that can see the endpoint can always see a
  * live generation behind it, so the endpoint is never judged `dead` while it is being registered.
+ * The directory is named by a socket built from a fresh instance id, so it never holds an earlier
+ * generation and the registration skips the dead-generation prune a host's directory needs.
  * A TUI endpoint has nothing to reattach to, so a clean exit removes its whole directory.
  */
 import { createHash } from "node:crypto";
@@ -66,7 +68,7 @@ export async function registerTuiEndpoint(options) {
             generation: 0,
             launchProfileId: "tui",
             build: engineBuildIdentity(),
-        });
+        }, { fresh: true });
         await createDaemonDirectories(paths, { kind: "tui" });
     }
     finally {

package/dist/modes/interactive/session-control-wake.d.ts

@@ -14,17 +14,23 @@ export declare class WakeScheduler {
 }
 /** Prefix of the engine's own entries in an inbox; a registrant never treats them as deliveries. */
 export declare const INBOX_ENGINE_ENTRY_PREFIX = ".senpi-";
+/** A live inbox watch. `armed` settles once arming did: the watch confirmed, the bounded retry ran out, or it was stopped. */
+export interface InboxWatch {
+    readonly armed: Promise<void>;
+    stop(): void;
+}
 /**
  * One watch on the inbox directory. Creation and teardown run on the shared watch worker (FSEvents
  * and inotify setup/teardown block the calling thread), so neither ever stalls the terminal.
  *
  * The worker arms the watch asynchronously, and an entry written before it is armed produces no
- * event. So registration returns only once a sentinel entry's own event has come back - the
- * sentinel is re-touched until then, bounded, which is the only timer here and runs only while
- * arming (an unconfirmed arm is reported through `onError`). Anything created before that point is
- * picked up by the pass the endpoint requests right after registration.
+ * event. Arming is confirmed by a sentinel entry's own event coming back - the sentinel is re-touched
+ * until then, bounded, which is the only timer here and runs only while arming (an unconfirmed arm is
+ * reported through `onError`). Nothing waits on that confirmation: the watch is returned at once and
+ * `armed` settles when arming did, so the caller can request the pass that picks up anything created
+ * before the watch could see it.
  */
-export declare function watchInbox(inboxDir: string, onChange: () => void, onError: (error: unknown) => void): Promise<() => void>;
+export declare function watchInbox(inboxDir: string, onChange: () => void, onError: (error: unknown) => void): Promise<InboxWatch>;
 /**
  * A continue after any stop (`^Z` or an external SIGSTOP) wakes the drain once the terminal has been
  * restored: the listener is persistent, so every stop/continue cycle is covered, and it defers past

package/dist/modes/interactive/session-control-wake.js

@@ -87,33 +87,55 @@ const INBOX_ARM_ATTEMPT_MS = 200;
  * and inotify setup/teardown block the calling thread), so neither ever stalls the terminal.
  *
  * The worker arms the watch asynchronously, and an entry written before it is armed produces no
- * event. So registration returns only once a sentinel entry's own event has come back - the
- * sentinel is re-touched until then, bounded, which is the only timer here and runs only while
- * arming (an unconfirmed arm is reported through `onError`). Anything created before that point is
- * picked up by the pass the endpoint requests right after registration.
+ * event. Arming is confirmed by a sentinel entry's own event coming back - the sentinel is re-touched
+ * until then, bounded, which is the only timer here and runs only while arming (an unconfirmed arm is
+ * reported through `onError`). Nothing waits on that confirmation: the watch is returned at once and
+ * `armed` settles when arming did, so the caller can request the pass that picks up anything created
+ * before the watch could see it.
  */
 export async function watchInbox(inboxDir, onChange, onError) {
     await mkdir(inboxDir, { recursive: true, mode: 0o700 });
     const sentinel = `${INBOX_ENGINE_ENTRY_PREFIX}armed-${randomUUID()}`;
-    const armed = Promise.withResolvers();
+    const confirmation = Promise.withResolvers();
+    let stopped = false;
     const unsubscribe = createFsWatchEventSource((error) => onError(error))(inboxDir, (_eventType, filename) => {
         if (filename === sentinel)
-            armed.resolve(true);
+            confirmation.resolve(true);
         else if (!filename?.startsWith(INBOX_ENGINE_ENTRY_PREFIX))
             onChange();
     }, { recursive: false });
-    let confirmed = false;
-    for (let attempt = 0; attempt < INBOX_ARM_ATTEMPTS && !confirmed; attempt++) {
-        await writeFile(join(inboxDir, sentinel), String(attempt), { mode: 0o600 });
-        confirmed = await Promise.race([armed.promise, delay(INBOX_ARM_ATTEMPT_MS, false)]);
-    }
-    await rm(join(inboxDir, sentinel), { force: true });
-    if (!confirmed)
-        onError(new Error(`inbox watch on ${inboxDir} was not confirmed`));
-    return () => {
-        void Promise.resolve(unsubscribe()).catch(onError);
+    const arming = confirmArm(join(inboxDir, sentinel), confirmation.promise, () => stopped).then((confirmed) => {
+        if (!confirmed && !stopped)
+            onError(new Error(`inbox watch on ${inboxDir} was not confirmed`));
+    }, (error) => {
+        if (!stopped)
+            onError(error);
+    });
+    // Settles on the sentinel's own event, before any later event of the same watch is delivered, so a
+    // pass requested on it runs ahead of the passes those events cause; otherwise when arming ended.
+    const armed = Promise.race([confirmation.promise.then((confirmed) => (confirmed ? undefined : arming)), arming]);
+    return {
+        armed,
+        stop: () => {
+            stopped = true;
+            confirmation.resolve(false);
+            void Promise.resolve(unsubscribe()).catch(onError);
+        },
     };
 }
+async function confirmArm(sentinelPath, confirmed, stopped) {
+    let seen = false;
+    try {
+        for (let attempt = 0; attempt < INBOX_ARM_ATTEMPTS && !seen && !stopped(); attempt++) {
+            await writeFile(sentinelPath, String(attempt), { mode: 0o600 });
+            seen = await Promise.race([confirmed, delay(INBOX_ARM_ATTEMPT_MS, false)]);
+        }
+    }
+    finally {
+        await rm(sentinelPath, { force: true });
+    }
+    return seen;
+}
 /**
  * A continue after any stop (`^Z` or an external SIGSTOP) wakes the drain once the terminal has been
  * restored: the listener is persistent, so every stop/continue cycle is covered, and it defers past

package/dist/modes/rpc/connection-handler.d.ts

@@ -28,6 +28,11 @@ export interface RpcConnectionOptions {
     eventFlushScheduler?: (flush: () => void) => void;
     /** Multi-session routing handle. Absent preserves classic wire output exactly. */
     sessionId?: string;
+    /**
+     * A single-session `--mode rpc` process: it accepts `set_retry_fallback` and advertises it. A host's
+     * session connection leaves it off; a host session takes its chain from `open_session.retryFallback`.
+     */
+    retryFallbackCommand?: boolean;
     /**
      * Shared-session capability registry. A `set_client_info` carrying `capabilities`
      * registers them for the connection that sent it; absent on a classic connection.

package/dist/modes/rpc/connection-handler.js

@@ -34,7 +34,7 @@ import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ClientMessageEvents } from "./client-message-events.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
-import { AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EXTENSION_EVENTS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, } from "./custom-capability.js";
+import { AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EXTENSION_EVENTS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, } from "./custom-capability.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
 import { settleExtensionUiResponse } from "./extension-ui-response.js";
 import { HostSessionControl } from "./host-session-control.js";
@@ -42,11 +42,20 @@ import { createRpcLoginPromptCallbacks } from "./login-prompts.js";
 import { answerMemoryReport } from "./memory-report-command.js";
 import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
-import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError } from "./rpc-input-validation.js";
+import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
 import { RPC_ERROR_MEDIA_NOT_FOUND } from "./rpc-types.js";
 import { SessionExtensionUiRequests } from "./session-extension-ui-requests.js";
 export { buildRpcSessionState } from "./rpc-session-state.js";
+/** The tool call a dialog is about, as wire fields (absent when the dialog is not a permission request). */
+function dialogCall(opts) {
+    if (opts?.toolCallId === undefined)
+        return {};
+    return {
+        toolCallId: opts.toolCallId,
+        ...(opts.parentToolCallId === undefined ? {} : { parentToolCallId: opts.parentToolCallId }),
+    };
+}
 function loadedExtensionName(path) {
     const synthetic = /^<(?:builtin|inline):([^>]+)>$/.exec(path);
     if (synthetic)
@@ -149,6 +158,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     let session = runtimeHost.session;
     let sessionControl;
     const promptCalls = new Set();
+    // Set by the first command that asks this session for a turn; `set_retry_fallback` is refused after it.
+    let turnRequested = false;
     let unsubscribe;
     let unsubscribeBackpressure;
     let unsubscribeLoadedSurfaces;
@@ -292,9 +303,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         question: (request, opts) => clientCapabilities?.includes(QUESTION_CAPABILITY)
             ? questions.ask(request, opts)
             : degradeQuestion(createExtensionUIContext(), request, opts),
-        select: (title, options, opts) => createDialogPromise(opts, undefined, { method: "select", title, options, timeout: opts?.timeout }, (r) => "cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined),
+        select: (title, options, opts) => createDialogPromise(opts, undefined, { method: "select", title, options, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
         confirm: (title, message, opts) => createDialogPromise(opts, false, { method: "confirm", title, message, timeout: opts?.timeout }, (r) => "cancelled" in r && r.cancelled ? false : "confirmed" in r ? r.confirmed : false),
-        input: (title, placeholder, opts) => createDialogPromise(opts, undefined, { method: "input", title, placeholder, timeout: opts?.timeout }, (r) => "cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined),
+        input: (title, placeholder, opts) => createDialogPromise(opts, undefined, { method: "input", title, placeholder, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
         notify(message, type) {
             // Fire and forget - no response needed
             output({
@@ -728,6 +739,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 MEDIA_PLACEHOLDERS_CAPABILITY,
                                 DURABLE_CLIENT_MESSAGE_ID_CAPABILITY,
                                 CONTINUE_FROM_LEAF_CAPABILITY,
+                                ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.capabilities ?? []),
                             ]),
                         ],
@@ -741,6 +753,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // Prompting
             // =================================================================
             case "prompt": {
+                turnRequested = true;
                 const admission = handleClientInput(session, command, { output, promptCalls });
                 promptCalls.add(admission);
                 void admission.finally(() => promptCalls.delete(admission));
@@ -760,6 +773,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 return success(id, "append_session_entry");
             }
             case "continue_from_leaf": {
+                turnRequested = true;
                 try {
                     await session.continueFromLeaf();
                     return success(id, "continue_from_leaf");
@@ -771,6 +785,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 }
             }
             case "send_custom_message": {
+                // A context message that asks for no turn does not block a launch-time chain, like an extension's.
+                if (command.triggerTurn === true)
+                    turnRequested = true;
                 await session.sendCustomMessage({
                     customType: command.customType,
                     content: command.content,
@@ -781,6 +798,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             }
             case "steer":
             case "follow_up": {
+                turnRequested = true;
                 await handleClientInput(session, command, { output, promptCalls });
                 return undefined;
             }
@@ -874,7 +892,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 return success(id, "cycle_model", result);
             }
             case "get_available_models": {
-                const models = await session.modelRegistry.getAvailable();
+                const models = await session.modelRegistry.modelRuntime.getAvailable();
                 return success(id, "get_available_models", {
                     models: models.map((model) => ({
                         ...model,
@@ -980,6 +998,24 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 session.abortRetry();
                 return success(id, "abort_retry");
             }
+            case "set_retry_fallback": {
+                if (!options.retryFallbackCommand) {
+                    return error(id, "set_retry_fallback", "set_retry_fallback is for a single-session rpc process; a host session takes open_session.retryFallback.");
+                }
+                const profileError = sessionRetryFallbackError(command.retryFallback);
+                if (profileError !== undefined || command.retryFallback === undefined) {
+                    return error(id, "set_retry_fallback", profileError ?? "set_retry_fallback needs retryFallback.");
+                }
+                // A launch-time setting: refused once this connection asked for a turn (even one not started yet), while
+                // any turn runs, or once the session holds turn history, so a chain never changes under a turn or a
+                // retry already in flight. Extension context messages (`custom`, e.g. one a component adds on
+                // session_start) are not a turn and do not count.
+                if (turnRequested || session.isStreaming || session.messages.some((message) => message.role !== "custom")) {
+                    return error(id, "set_retry_fallback", "set_retry_fallback must arrive before the session's first turn.");
+                }
+                runtimeHost.setRetryFallback(command.retryFallback);
+                return success(id, "set_retry_fallback");
+            }
             // =================================================================
             // Bash
             // =================================================================