@code-yeongyu/senpi 2026.10.9 → 2026.10.10-3

package/dist/core/thinking-levels.js

@@ -14,6 +14,43 @@ export function getSupportedThinkingLevels(model) {
     const supportedLevels = getSupportedModelThinkingLevels(model);
     return supportedLevels.length > 0 ? supportedLevels : ["off"];
 }
+/**
+ * Apply the effective `level` to an explicit selection. When it differs from `requested`, the selection keeps
+ * the requested level and the clamp reason instead of reading as if `level` had been chosen.
+ */
+export function clampThinkingSelection(selection, requested, level, model) {
+    if (selection === undefined)
+        return undefined;
+    const { requested: _staleRequested, clampReason: _staleReason, ...base } = selection;
+    if (requested === level || model === undefined)
+        return { ...base, level };
+    const clamped = {
+        ...base,
+        level,
+        requested,
+        clampReason: model.reasoning ? "level-unsupported" : "model-not-reasoning",
+    };
+    return clamped;
+}
+export function getThinkingClampNotice(selection, model) {
+    const clamped = selection;
+    if (model === undefined || clamped?.requested === undefined || clamped.clampReason === undefined)
+        return undefined;
+    return {
+        provider: model.provider,
+        modelId: model.id,
+        requestedLevel: clamped.requested,
+        appliedLevel: clamped.level,
+        reason: clamped.clampReason,
+    };
+}
+export function formatThinkingClampWarning(notice) {
+    const model = `${notice.provider}/${notice.modelId}`;
+    if (notice.reason === "model-not-reasoning") {
+        return `Thinking level "${notice.requestedLevel}" was requested, but ${model} is not marked as a reasoning model, so thinking is "${notice.appliedLevel}". If the model supports reasoning, set "reasoning": true for it in models.json.`;
+    }
+    return `Thinking level "${notice.requestedLevel}" is not available on ${model}; using "${notice.appliedLevel}".`;
+}
 /**
  * Classify a model's reasoning capability purely from `model.reasoning` and its supported thinking
  * levels — never from the model id or thinkingFormat/compat config.

package/dist/core/trust-manager.js

@@ -5,6 +5,7 @@ import lockfile from "proper-lockfile";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, canonicalizePathStrict, resolvePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
+import { bundledBuiltinExtensions } from "./bundled-resources.js";
 const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
     "settings.json",
     "mcp.json",
@@ -16,6 +17,53 @@ const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
     "APPEND_SYSTEM.md",
 ];
 const LEGACY_PROJECT_CONFIG_DIR_NAME = ".pi";
+/**
+ * A project codemode file that sets any setting naming an executable (the codemode package's
+ * `executable-settings.json` list, today `languages.pyInterpreter`) makes the session run that executable at start,
+ * so it asks for a trust decision. A file the check cannot read is treated like a project `mcp.json`, whose mere
+ * presence asks; so is any file when the list itself cannot be read.
+ */
+function projectCodemodeNamesExecutable(configDir) {
+    const path = join(configDir, "codemode.json");
+    if (!existsSync(path))
+        return false;
+    const executableSettings = codemodeExecutableSettings();
+    if (executableSettings === undefined)
+        return true;
+    let parsed;
+    try {
+        parsed = JSON.parse(stripBom(readFileSync(path, "utf8")));
+    }
+    catch {
+        return true;
+    }
+    return executableSettings.some((settingPath) => valueAtPath(parsed, settingPath) !== undefined);
+}
+function codemodeExecutableSettings() {
+    const codemode = bundledBuiltinExtensions.find((extension) => extension.id === "codemode");
+    try {
+        const packageJson = codemode?.resolvePackage();
+        if (packageJson === undefined)
+            return undefined;
+        const list = JSON.parse(readFileSync(join(dirname(packageJson), "src", "config", "executable-settings.json"), "utf8"));
+        if (typeof list !== "object" || list === null)
+            return undefined;
+        const paths = Reflect.get(list, "projectExecutableSettings");
+        return Array.isArray(paths) && paths.every((entry) => typeof entry === "string") ? paths : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function valueAtPath(value, path) {
+    let current = value;
+    for (const key of path.split(".")) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        current = Reflect.get(current, key);
+    }
+    return current;
+}
 function normalizeCwd(cwd) {
     const resolved = resolvePath(cwd);
     try {
@@ -169,6 +217,8 @@ export function hasTrustRequiringProjectResources(cwd) {
     if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
         return true;
     }
+    if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
+        return true;
     while (true) {
         const agentsSkillsDir = join(currentDir, ".agents", "skills");
         if (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {

package/dist/main.js

@@ -29,7 +29,7 @@ import { createProjectTrustContext } from "./cli/project-trust.js";
 import { createStartupLoadingIndicator, pauseIndicatorDuringPrompts, shouldShowStartupLoadingIndicator, } from "./cli/startup-loading-indicator.js";
 import { shouldRunFirstTimeSetup, showFirstTimeSetup, showStartupSelector } from "./cli/startup-ui.js";
 import { APP_NAME, DISPLAY_VERSION, ENV_SESSION_DIR, expandTildePath, getAgentDir, getInstallPackageDir, } from "./config.js";
-import { createAgentSessionRuntime } from "./core/agent-session-runtime.js";
+import { applyRetryFallbackProfile, createAgentSessionRuntime, } from "./core/agent-session-runtime.js";
 import { createAgentSessionFromServices, createAgentSessionServices, } from "./core/agent-session-services.js";
 import { formatNoModelsAvailableMessage } from "./core/auth-guidance.js";
 import { AuthStorage, ReadOnlyAuthStorage } from "./core/auth-storage.js";
@@ -51,6 +51,7 @@ import { assertValidSessionId, SessionManager } from "./core/session-manager.js"
 import { classifySessionRepository, readSessionCwd, rebindSessionFile } from "./core/session-rebind.js";
 import { collectSettingsDiagnosticsWithContext } from "./core/settings-diagnostics.js";
 import { SettingsManager } from "./core/settings-manager.js";
+import { formatThinkingClampWarning } from "./core/thinking-levels.js";
 import { printTimings, recordTiming, resetTimings, time } from "./core/timings.js";
 import { hasTrustRequiringProjectResources, ProjectTrustStore } from "./core/trust-manager.js";
 import { builtInExtensions } from "./extensions/index.js";
@@ -678,17 +679,8 @@ export function createCliRuntimeFactory(configuration, local = {}) {
                 (!hasTrustRequiringResources || trustStore.get(cwd) === true));
         const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
         // The opener's per-session fallback policy is an in-memory override: never saved, never shared.
-        if (launchProfile?.retryFallback) {
-            runtimeSettingsManager.applyOverrides({
-                retry: {
-                    modelFallback: launchProfile.retryFallback.modelFallback,
-                    fallbackChains: Object.fromEntries(Object.entries(launchProfile.retryFallback.fallbackChains).map(([key, entries]) => [
-                        key,
-                        [...entries],
-                    ])),
-                },
-            });
-        }
+        if (launchProfile?.retryFallback)
+            applyRetryFallbackProfile(runtimeSettingsManager, launchProfile.retryFallback);
         const services = await createAgentSessionServices({
             cwd,
             agentDir,
@@ -830,7 +822,9 @@ export function createCliRuntimeFactory(configuration, local = {}) {
         markSwitch("createSession");
         const cliThinkingOverride = runtimeParsed.thinking !== undefined || cliThinkingFromModel;
         if (created.session.model && cliThinkingOverride) {
-            created.session.setThinkingLevel(created.session.thinkingLevel);
+            // senpi#2395: re-apply the level the CLI asked for, so a clamp keeps its requested level and reason.
+            const selection = created.session.thinkingSelection;
+            created.session.setThinkingLevel(selection?.requested ?? created.session.thinkingLevel);
         }
         return {
             ...created,
@@ -1184,6 +1178,11 @@ export async function main(args, options) {
     }
     time("resolveModelScope");
     reportDiagnostics(runtime.diagnostics);
+    // senpi#2395: print/json/RPC runs report a startup thinking clamp on stderr; the TUI shows its own warning.
+    const startupThinkingClamp = runtime.session.startupThinkingClamp;
+    if (appMode !== "interactive" && startupThinkingClamp) {
+        reportDiagnostics([{ type: "warning", message: formatThinkingClampWarning(startupThinkingClamp) }]);
+    }
     if (appMode !== "interactive") {
         reportDiagnostics(collectAuthDiagnostics(services.authStorage, "runtime creation"));
     }

package/dist/modes/interactive/interactive-mode.js

@@ -39,6 +39,7 @@ import { createSessionLogger } from "../../core/session-log.js";
 import { SessionManager, sessionEntryToContextMessages } from "../../core/session-manager.js";
 import { BUILTIN_SLASH_COMMANDS } from "../../core/slash-commands.js";
 import { isInstallTelemetryEnabled } from "../../core/telemetry.js";
+import { formatThinkingClampWarning } from "../../core/thinking-levels.js";
 import { formatTimings, resetTimings, time } from "../../core/timings.js";
 import { withBuiltInRenderers } from "../../core/tools/renderers/index.js";
 import { hasTrustRequiringProjectResources, ProjectTrustStore } from "../../core/trust-manager.js";
@@ -1354,6 +1355,10 @@ export class InteractiveMode {
         for (const warning of this.session.fallbackValidationWarnings) {
             this.showWarning(warning);
         }
+        const startupThinkingClamp = this.session.startupThinkingClamp;
+        if (startupThinkingClamp) {
+            this.showWarning(formatThinkingClampWarning(startupThinkingClamp));
+        }
         this.showRiskyMainModelWarning(this.session.model);
         void this.maybeWarnAboutAnthropicSubscriptionAuth();
         maybeShowRuntimeNotice((spec) => this.showNoticeBox(spec));
@@ -4207,6 +4212,9 @@ export class InteractiveMode {
             case "high_reasoning_warning":
                 this.showHighReasoningWarning(event);
                 break;
+            case "thinking_level_clamped":
+                this.showWarning(formatThinkingClampWarning(event));
+                break;
             case "resume_compaction_required":
                 this.showWarning(event.notice);
                 break;

package/dist/modes/interactive/session-control-endpoint.js

@@ -3,12 +3,16 @@
  * registers one (the interactive host imports it lazily), so a plain TUI pays nothing.
  *
  * Order matters and each step is undone on failure, so a failed bind leaves no half-registered
- * directory: the session header is made durable, dead `tui` endpoints are reaped, the socket is
- * bound (secret 0600, directory 0700), and only then is the endpoint registered - a visible
- * endpoint is one that answers. Wakes come from edges only (see `session-control-wake.ts`).
+ * directory: the socket is bound (secret 0600, directory 0700) while the session header is made
+ * durable, and only once both are done is the endpoint registered - a visible endpoint is one that
+ * answers, and its session id is already on disk. Nothing a sender needs waits on work it does not
+ * need: the writer stamp's process lookup starts at entry, the inbox watch arms after registration
+ * returned, and dead `tui` endpoints of other terminals are reaped after activation. Wakes come
+ * from edges only (see `session-control-wake.ts`).
  */
 import { randomUUID } from "node:crypto";
 import { rm } from "node:fs/promises";
+import { thisProcessStartTime } from "../rpc/host-daemon-registration.js";
 import { gcHostEndpoints } from "../rpc/host-gc.js";
 import { createSocketSecret, socketSecretPath } from "../rpc/socket-transport.js";
 import { runControlCommand } from "./session-control-commands.js";
@@ -33,8 +37,12 @@ export async function registerSessionControlEndpoint(context, options) {
 }
 async function openEndpoint(context, options, cleanups) {
     const { session, agentDir, surface } = context;
-    await session.sessionManager.persistHeaderNow();
-    await gcHostEndpoints(agentDir, { kinds: ["tui"] });
+    // The writer stamp's `ps` lookup is a process constant: started here, it overlaps the header write
+    // and the bind instead of running inside the registry lock.
+    void thisProcessStartTime();
+    // Bound while the header is written, awaited before the endpoint is registered.
+    const headerDurable = session.sessionManager.persistHeaderNow();
+    headerDurable.catch(() => undefined);
     const instanceId = randomUUID();
     const socket = await resolveTuiSocket(agentDir, instanceId);
     cleanups.push(() => rm(socket, { force: true }), () => rm(socketSecretPath(socket), { force: true }));
@@ -59,12 +67,29 @@ async function openEndpoint(context, options, cleanups) {
         listenerError: (error) => surface.notice(`control endpoint listener failed: ${error.message}`),
     });
     cleanups.push(() => server.close());
+    await headerDurable;
     const entry = await registerTuiEndpoint({ agentDir, socket, instanceId });
     cleanups.push(() => unregisterTuiEndpoint(entry));
-    const stopInbox = await watchInbox(options.inboxDir, () => void wake("inbox"), (error) => surface.notice(`control endpoint inbox watch failed: ${errorText(error)}`));
-    const endpoint = activateControlEndpoint({ context, options, entry, server, scheduler, feed, stopInbox, wake });
-    // Anything that reached the inbox before the watch was armed is picked up by this first pass.
+    const inbox = await watchInbox(options.inboxDir, () => void wake("inbox"), (error) => surface.notice(`control endpoint inbox watch failed: ${errorText(error)}`));
+    cleanups.push(() => inbox.stop());
+    const endpoint = activateControlEndpoint({
+        context,
+        options,
+        entry,
+        server,
+        scheduler,
+        feed,
+        stopInbox: inbox.stop,
+        wake,
+    });
+    // Anything that reached the inbox before this point is picked up by this first pass, and anything
+    // written after it but before the watch was armed (no event for it) by the pass once arming settled.
     endpoint.wake("inbox");
+    void inbox.armed.then(() => endpoint.wake("inbox"));
+    // Other terminals' dead records are nothing a sender reads: reaped after activation, off the path.
+    setImmediate(() => {
+        gcHostEndpoints(agentDir, { kinds: ["tui"] }).catch((error) => surface.notice(`control endpoint gc of dead terminals failed: ${errorText(error)}`));
+    });
     return endpoint;
 }
 function errorText(error) {

package/dist/modes/interactive/session-control-registry.js

@@ -5,6 +5,8 @@
  * Registration runs under the endpoint's ensure lock (the lock `host gc` takes) and writes the
  * generation record BEFORE `endpoint.json`: a reader that can see the endpoint can always see a
  * live generation behind it, so the endpoint is never judged `dead` while it is being registered.
+ * The directory is named by a socket built from a fresh instance id, so it never holds an earlier
+ * generation and the registration skips the dead-generation prune a host's directory needs.
  * A TUI endpoint has nothing to reattach to, so a clean exit removes its whole directory.
  */
 import { createHash } from "node:crypto";
@@ -66,7 +68,7 @@ export async function registerTuiEndpoint(options) {
             generation: 0,
             launchProfileId: "tui",
             build: engineBuildIdentity(),
-        });
+        }, { fresh: true });
         await createDaemonDirectories(paths, { kind: "tui" });
     }
     finally {

package/dist/modes/interactive/session-control-wake.d.ts

@@ -14,17 +14,23 @@ export declare class WakeScheduler {
 }
 /** Prefix of the engine's own entries in an inbox; a registrant never treats them as deliveries. */
 export declare const INBOX_ENGINE_ENTRY_PREFIX = ".senpi-";
+/** A live inbox watch. `armed` settles once arming did: the watch confirmed, the bounded retry ran out, or it was stopped. */
+export interface InboxWatch {
+    readonly armed: Promise<void>;
+    stop(): void;
+}
 /**
  * One watch on the inbox directory. Creation and teardown run on the shared watch worker (FSEvents
  * and inotify setup/teardown block the calling thread), so neither ever stalls the terminal.
  *
  * The worker arms the watch asynchronously, and an entry written before it is armed produces no
- * event. So registration returns only once a sentinel entry's own event has come back - the
- * sentinel is re-touched until then, bounded, which is the only timer here and runs only while
- * arming (an unconfirmed arm is reported through `onError`). Anything created before that point is
- * picked up by the pass the endpoint requests right after registration.
+ * event. Arming is confirmed by a sentinel entry's own event coming back - the sentinel is re-touched
+ * until then, bounded, which is the only timer here and runs only while arming (an unconfirmed arm is
+ * reported through `onError`). Nothing waits on that confirmation: the watch is returned at once and
+ * `armed` settles when arming did, so the caller can request the pass that picks up anything created
+ * before the watch could see it.
  */
-export declare function watchInbox(inboxDir: string, onChange: () => void, onError: (error: unknown) => void): Promise<() => void>;
+export declare function watchInbox(inboxDir: string, onChange: () => void, onError: (error: unknown) => void): Promise<InboxWatch>;
 /**
  * A continue after any stop (`^Z` or an external SIGSTOP) wakes the drain once the terminal has been
  * restored: the listener is persistent, so every stop/continue cycle is covered, and it defers past

package/dist/modes/interactive/session-control-wake.js

@@ -87,33 +87,55 @@ const INBOX_ARM_ATTEMPT_MS = 200;
  * and inotify setup/teardown block the calling thread), so neither ever stalls the terminal.
  *
  * The worker arms the watch asynchronously, and an entry written before it is armed produces no
- * event. So registration returns only once a sentinel entry's own event has come back - the
- * sentinel is re-touched until then, bounded, which is the only timer here and runs only while
- * arming (an unconfirmed arm is reported through `onError`). Anything created before that point is
- * picked up by the pass the endpoint requests right after registration.
+ * event. Arming is confirmed by a sentinel entry's own event coming back - the sentinel is re-touched
+ * until then, bounded, which is the only timer here and runs only while arming (an unconfirmed arm is
+ * reported through `onError`). Nothing waits on that confirmation: the watch is returned at once and
+ * `armed` settles when arming did, so the caller can request the pass that picks up anything created
+ * before the watch could see it.
  */
 export async function watchInbox(inboxDir, onChange, onError) {
     await mkdir(inboxDir, { recursive: true, mode: 0o700 });
     const sentinel = `${INBOX_ENGINE_ENTRY_PREFIX}armed-${randomUUID()}`;
-    const armed = Promise.withResolvers();
+    const confirmation = Promise.withResolvers();
+    let stopped = false;
     const unsubscribe = createFsWatchEventSource((error) => onError(error))(inboxDir, (_eventType, filename) => {
         if (filename === sentinel)
-            armed.resolve(true);
+            confirmation.resolve(true);
         else if (!filename?.startsWith(INBOX_ENGINE_ENTRY_PREFIX))
             onChange();
     }, { recursive: false });
-    let confirmed = false;
-    for (let attempt = 0; attempt < INBOX_ARM_ATTEMPTS && !confirmed; attempt++) {
-        await writeFile(join(inboxDir, sentinel), String(attempt), { mode: 0o600 });
-        confirmed = await Promise.race([armed.promise, delay(INBOX_ARM_ATTEMPT_MS, false)]);
-    }
-    await rm(join(inboxDir, sentinel), { force: true });
-    if (!confirmed)
-        onError(new Error(`inbox watch on ${inboxDir} was not confirmed`));
-    return () => {
-        void Promise.resolve(unsubscribe()).catch(onError);
+    const arming = confirmArm(join(inboxDir, sentinel), confirmation.promise, () => stopped).then((confirmed) => {
+        if (!confirmed && !stopped)
+            onError(new Error(`inbox watch on ${inboxDir} was not confirmed`));
+    }, (error) => {
+        if (!stopped)
+            onError(error);
+    });
+    // Settles on the sentinel's own event, before any later event of the same watch is delivered, so a
+    // pass requested on it runs ahead of the passes those events cause; otherwise when arming ended.
+    const armed = Promise.race([confirmation.promise.then((confirmed) => (confirmed ? undefined : arming)), arming]);
+    return {
+        armed,
+        stop: () => {
+            stopped = true;
+            confirmation.resolve(false);
+            void Promise.resolve(unsubscribe()).catch(onError);
+        },
     };
 }
+async function confirmArm(sentinelPath, confirmed, stopped) {
+    let seen = false;
+    try {
+        for (let attempt = 0; attempt < INBOX_ARM_ATTEMPTS && !seen && !stopped(); attempt++) {
+            await writeFile(sentinelPath, String(attempt), { mode: 0o600 });
+            seen = await Promise.race([confirmed, delay(INBOX_ARM_ATTEMPT_MS, false)]);
+        }
+    }
+    finally {
+        await rm(sentinelPath, { force: true });
+    }
+    return seen;
+}
 /**
  * A continue after any stop (`^Z` or an external SIGSTOP) wakes the drain once the terminal has been
  * restored: the listener is persistent, so every stop/continue cycle is covered, and it defers past

package/dist/modes/rpc/connection-handler.d.ts

@@ -28,6 +28,11 @@ export interface RpcConnectionOptions {
     eventFlushScheduler?: (flush: () => void) => void;
     /** Multi-session routing handle. Absent preserves classic wire output exactly. */
     sessionId?: string;
+    /**
+     * A single-session `--mode rpc` process: it accepts `set_retry_fallback` and advertises it. A host's
+     * session connection leaves it off; a host session takes its chain from `open_session.retryFallback`.
+     */
+    retryFallbackCommand?: boolean;
     /**
      * Shared-session capability registry. A `set_client_info` carrying `capabilities`
      * registers them for the connection that sent it; absent on a classic connection.

package/dist/modes/rpc/connection-handler.js

@@ -34,7 +34,7 @@ import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ClientMessageEvents } from "./client-message-events.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
-import { AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EXTENSION_EVENTS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, } from "./custom-capability.js";
+import { AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EXTENSION_EVENTS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, QUESTION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, } from "./custom-capability.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
 import { settleExtensionUiResponse } from "./extension-ui-response.js";
 import { HostSessionControl } from "./host-session-control.js";
@@ -42,7 +42,7 @@ import { createRpcLoginPromptCallbacks } from "./login-prompts.js";
 import { answerMemoryReport } from "./memory-report-command.js";
 import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
-import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError } from "./rpc-input-validation.js";
+import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { buildRpcSessionState } from "./rpc-session-state.js";
 import { RPC_ERROR_MEDIA_NOT_FOUND } from "./rpc-types.js";
 import { SessionExtensionUiRequests } from "./session-extension-ui-requests.js";
@@ -158,6 +158,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     let session = runtimeHost.session;
     let sessionControl;
     const promptCalls = new Set();
+    // Set by the first command that asks this session for a turn; `set_retry_fallback` is refused after it.
+    let turnRequested = false;
     let unsubscribe;
     let unsubscribeBackpressure;
     let unsubscribeLoadedSurfaces;
@@ -737,6 +739,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 MEDIA_PLACEHOLDERS_CAPABILITY,
                                 DURABLE_CLIENT_MESSAGE_ID_CAPABILITY,
                                 CONTINUE_FROM_LEAF_CAPABILITY,
+                                ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.capabilities ?? []),
                             ]),
                         ],
@@ -750,6 +753,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // Prompting
             // =================================================================
             case "prompt": {
+                turnRequested = true;
                 const admission = handleClientInput(session, command, { output, promptCalls });
                 promptCalls.add(admission);
                 void admission.finally(() => promptCalls.delete(admission));
@@ -769,6 +773,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 return success(id, "append_session_entry");
             }
             case "continue_from_leaf": {
+                turnRequested = true;
                 try {
                     await session.continueFromLeaf();
                     return success(id, "continue_from_leaf");
@@ -780,6 +785,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 }
             }
             case "send_custom_message": {
+                // A context message that asks for no turn does not block a launch-time chain, like an extension's.
+                if (command.triggerTurn === true)
+                    turnRequested = true;
                 await session.sendCustomMessage({
                     customType: command.customType,
                     content: command.content,
@@ -790,6 +798,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             }
             case "steer":
             case "follow_up": {
+                turnRequested = true;
                 await handleClientInput(session, command, { output, promptCalls });
                 return undefined;
             }
@@ -883,7 +892,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 return success(id, "cycle_model", result);
             }
             case "get_available_models": {
-                const models = await session.modelRegistry.getAvailable();
+                const models = await session.modelRegistry.modelRuntime.getAvailable();
                 return success(id, "get_available_models", {
                     models: models.map((model) => ({
                         ...model,
@@ -989,6 +998,24 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 session.abortRetry();
                 return success(id, "abort_retry");
             }
+            case "set_retry_fallback": {
+                if (!options.retryFallbackCommand) {
+                    return error(id, "set_retry_fallback", "set_retry_fallback is for a single-session rpc process; a host session takes open_session.retryFallback.");
+                }
+                const profileError = sessionRetryFallbackError(command.retryFallback);
+                if (profileError !== undefined || command.retryFallback === undefined) {
+                    return error(id, "set_retry_fallback", profileError ?? "set_retry_fallback needs retryFallback.");
+                }
+                // A launch-time setting: refused once this connection asked for a turn (even one not started yet), while
+                // any turn runs, or once the session holds turn history, so a chain never changes under a turn or a
+                // retry already in flight. Extension context messages (`custom`, e.g. one a component adds on
+                // session_start) are not a turn and do not count.
+                if (turnRequested || session.isStreaming || session.messages.some((message) => message.role !== "custom")) {
+                    return error(id, "set_retry_fallback", "set_retry_fallback must arrive before the session's first turn.");
+                }
+                runtimeHost.setRetryFallback(command.retryFallback);
+                return success(id, "set_retry_fallback");
+            }
             // =================================================================
             // Bash
             // =================================================================

package/dist/modes/rpc/custom-capability.d.ts

@@ -80,6 +80,12 @@ export declare const BROWSER_ENGINE_CAPABILITY = "browser_engine";
  * never written to a settings file and never seen by another session on the host.
  */
 export declare const RETRY_FALLBACK_PROFILE_CAPABILITY = "retry_fallback_profile";
+/**
+ * SINGLE-SESSION capability: this `--mode rpc` process accepts `set_retry_fallback` (the
+ * `open_session.retryFallback` shape) before its first turn, so a caller that spawns one process per
+ * session can give it its own fallback chain without a settings file.
+ */
+export declare const RETRY_FALLBACK_COMMAND_CAPABILITY = "retry_fallback_command";
 /**
  * HOST capability: `open_session.promptSurface` also accepts `chat` (a chat bridge: no routing line,
  * no handoff block, no todo cues). A host without it refuses `chat` with `invalid_launch_profile`,

package/dist/modes/rpc/custom-capability.js

@@ -80,6 +80,12 @@ export const BROWSER_ENGINE_CAPABILITY = "browser_engine";
  * never written to a settings file and never seen by another session on the host.
  */
 export const RETRY_FALLBACK_PROFILE_CAPABILITY = "retry_fallback_profile";
+/**
+ * SINGLE-SESSION capability: this `--mode rpc` process accepts `set_retry_fallback` (the
+ * `open_session.retryFallback` shape) before its first turn, so a caller that spawns one process per
+ * session can give it its own fallback chain without a settings file.
+ */
+export const RETRY_FALLBACK_COMMAND_CAPABILITY = "retry_fallback_command";
 /**
  * HOST capability: `open_session.promptSurface` also accepts `chat` (a chat bridge: no routing line,
  * no handoff block, no todo cues). A host without it refuses `chat` with `invalid_launch_profile`,

package/dist/modes/rpc/host-daemon-paths.d.ts

@@ -101,10 +101,11 @@ export declare class HostDaemonStateError extends Error {
     constructor(path: string, cause: unknown);
 }
 /**
- * Creates this endpoint's directories and publishes the flat marker. The modes are set explicitly
- * rather than left to `mkdir`, because a directory that already exists keeps whatever mode it was
- * created with - and this one holds the evidence that decides who may signal the daemon. A `tui`
- * registrant passes its kind; everything else is an `rpc_host`.
+ * Creates this endpoint's directories and publishes the flat marker. A directory that already exists
+ * keeps whatever mode it was created with - and this one holds the evidence that decides who may
+ * signal the daemon - so an existing one is re-moded explicitly; one `mkdir` just created already
+ * has the mode. The siblings inside the endpoint directory and the marker are written concurrently.
+ * A `tui` registrant passes its kind; everything else is an `rpc_host`.
  */
 export declare function createDaemonDirectories(paths: HostDaemonPaths, identity?: {
     readonly kind?: EndpointKind;

package/dist/modes/rpc/host-daemon-paths.js

@@ -159,27 +159,35 @@ export class HostDaemonStateError extends Error {
     }
 }
 /**
- * Creates this endpoint's directories and publishes the flat marker. The modes are set explicitly
- * rather than left to `mkdir`, because a directory that already exists keeps whatever mode it was
- * created with - and this one holds the evidence that decides who may signal the daemon. A `tui`
- * registrant passes its kind; everything else is an `rpc_host`.
+ * Creates this endpoint's directories and publishes the flat marker. A directory that already exists
+ * keeps whatever mode it was created with - and this one holds the evidence that decides who may
+ * signal the daemon - so an existing one is re-moded explicitly; one `mkdir` just created already
+ * has the mode. The siblings inside the endpoint directory and the marker are written concurrently.
+ * A `tui` registrant passes its kind; everything else is an `rpc_host`.
  */
 export async function createDaemonDirectories(paths, identity = {}) {
     try {
         // The flat directory may predate this layout and may hold a legacy host's files: it is created
         // when missing and never re-moded, so a legacy host keeps whatever it set up for itself.
         await mkdir(paths.flatDir, { recursive: true, mode: DIRECTORY_MODE });
-        for (const directory of [paths.dir, paths.generationsDir, paths.reservationsDir]) {
-            await mkdir(directory, { recursive: true, mode: DIRECTORY_MODE });
-            await chmod(directory, DIRECTORY_MODE);
-        }
-        await writeFile(paths.layoutMarker, `${JSON.stringify({ layout: HOST_DAEMON_LAYOUT, dir: basename(paths.dir) })}\n`, { mode: HOST_STATE_FILE_MODE });
+        await makePrivateDirectory(paths.dir);
+        await Promise.all([
+            makePrivateDirectory(paths.generationsDir),
+            makePrivateDirectory(paths.reservationsDir),
+            writeFile(paths.layoutMarker, `${JSON.stringify({ layout: HOST_DAEMON_LAYOUT, dir: basename(paths.dir) })}\n`, { mode: HOST_STATE_FILE_MODE }),
+        ]);
     }
     catch (cause) {
         throw new HostDaemonStateError(paths.dir, cause);
     }
     await ensureEndpointIdentity(paths, paths.socket, identity);
 }
+/** `mkdir` names the directory it created; only one that already existed needs its mode set. */
+async function makePrivateDirectory(directory) {
+    const created = await mkdir(directory, { recursive: true, mode: DIRECTORY_MODE });
+    if (created === undefined)
+        await chmod(directory, DIRECTORY_MODE);
+}
 /**
  * Writes `endpoint.json` when it is absent and never rewrites a valid one: the first writer's
  * `created_at` is the endpoint's birth. The file is written whole to a temporary name and LINKED

package/dist/modes/rpc/host-daemon-registration.d.ts

@@ -40,8 +40,13 @@ export declare function readHostRegistration(paths: HostDaemonPaths): Promise<Re
  * Registers a generation and points the daemon directory at it, under this process's writer stamp.
  * The stamp is what authorizes a later stop: only the process that wrote a record may signal the
  * host it names, and the recorded start time keeps a recycled pid from inheriting that right.
+ *
+ * `fresh` says the directory cannot hold an earlier generation (a terminal's endpoint, named by a
+ * socket built from a new instance id), so there is nothing to prune.
  */
-export declare function writeHostRegistration(paths: HostDaemonPaths, registration: HostRegistration): Promise<void>;
+export declare function writeHostRegistration(paths: HostDaemonPaths, registration: HostRegistration, options?: {
+    readonly fresh?: boolean;
+}): Promise<void>;
 /**
  * Records ONE generation's process in its own directory without moving the pointer. A handoff writes
  * this the moment its successor is spawned: until the rename lands the pointer must keep naming the