@code-yeongyu/senpi 2026.11.10-1 → 2026.11.10-2

package/dist/core/extensions/builtin/mcp/catalog.js

@@ -3,7 +3,8 @@ import { isModernMcpClient } from "./modern/request.js";
 import { hasSupportedModernToolSchemas } from "./modern/tool-schema.js";
 import { collectAllPages } from "./expose/pagination.js";
 export async function collectToolCatalog(server, connection, config, options = {}) {
-    const result = await collectAllPages((cursor) => listMcpTools(connection.client, cursor === undefined ? {} : { cursor }, { timeout: config.requestTimeoutMs }));
+    const client = connection.client;
+    const result = await collectAllPages((cursor) => listMcpTools(client, cursor === undefined ? {} : { cursor }, { timeout: config.requestTimeoutMs }));
     return result.items.map((tool) => ({
         requestOrigin: options.requestOrigin,
         annotations: tool.annotations,
@@ -17,7 +18,7 @@ export async function collectToolCatalog(server, connection, config, options = {
         requestTimeoutMs: config.requestTimeoutMs,
         schema: tool.inputSchema,
         outputSchema: tool.outputSchema,
-        modern: isModernMcpClient(connection.client),
+        modern: isModernMcpClient(client),
         server,
         tool: tool.name,
     }));

package/dist/core/extensions/builtin/mcp/invocation.js

@@ -61,6 +61,12 @@ export function createMcpInvocationResolver(scope) {
             try {
                 await Promise.race([ready, interrupted]);
             }
+            catch (error) {
+                readySignal.throwIfAborted();
+                if (!scope.isCurrent())
+                    return refuse("unavailable", "MCP session or server configuration was replaced.");
+                throw error;
+            }
             finally {
                 clearTimeout(timeout);
                 readySignal.removeEventListener("abort", abort);

package/dist/core/extensions/builtin/mcp/service-register.js

@@ -3,7 +3,7 @@ import { computeMcpExposurePolicy } from "./expose/policy.js";
 import { registerDirectMcpTools } from "./expose/session.js";
 import { ensureMcpToolCallConnection } from "./health.js";
 import { createMcpInvocationResolver } from "./invocation.js";
-import { connectAndRefreshMcpCatalog } from "./startup-race.js";
+import { connectAndRefreshMcpCatalog, prepareMcpAuthentication } from "./startup-race.js";
 export async function registerMcpServiceDirectTools(pi, config, entries, toolSearchService, options = {}) {
     return await registerDirectMcpTools(pi, config, [...entries].map((entry) => {
         const serverConfig = config.servers[entry.name]?.config;
@@ -18,7 +18,21 @@ export async function registerMcpServiceDirectTools(pi, config, entries, toolSea
             servesSession: options.servesSession,
             isCurrent: () => entry.isCurrent?.() !== false && options.isCurrent?.(entry) !== false,
             ready: async () => {
-                await ensureMcpToolCallConnection(entry.connection, () => entry.authPlan?.refresh?.ensureFresh().then(() => undefined) ?? Promise.resolve());
+                if (!(await prepareMcpAuthentication(entry)))
+                    return;
+                if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)
+                    return;
+                if (entry.credentialsCurrent?.() === false) {
+                    await entry.onCredentialsChanged?.();
+                    return;
+                }
+                await ensureMcpToolCallConnection(entry.connection);
+                if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)
+                    return;
+                if (entry.credentialsCurrent?.() === false) {
+                    await entry.onCredentialsChanged?.();
+                    return;
+                }
                 await connectAndRefreshMcpCatalog(entry, serverConfig);
                 await entry.startupCatalogClaim?.settled();
                 if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)

package/dist/core/extensions/builtin/mcp/service-tools-changed.js

@@ -54,71 +54,78 @@ export async function refreshMcpToolsOnListChanged(entry, targets, config, conne
     // The startup connect that still owns registration registers its refreshed catalog itself.
     if (connectOnly && entry.startupCatalogClaim?.ownsRegistration() === true)
         return;
-    const registeredCatalog = entry.cachedCatalog;
-    if (entry.connection instanceof SharedMcpLease) {
-        const refreshed = await entry.connection.catalog();
-        if (!ownsCatalog())
-            return;
-        entry.cachedCatalog = refreshed;
-    }
-    const catalog = await collectToolCatalog(entry.name, entry.connection, server.config, {
-        agentDir: entry.agentDir,
-        outputGuard: config.settings.outputGuard,
-    });
-    if (!ownsCatalog())
-        return;
-    const newNames = mapMcpCatalogNames(catalog).map(({ name }) => name);
-    // Before the first refresh, the registered names are the catalog the startup pass registered.
-    const knownNames = entry.knownToolNames ??
-        (registeredCatalog === undefined
-            ? newNames
-            : mapMcpCatalogNames(cachedToolsToCatalogEntries(entry.name, registeredCatalog, entry.connection, server.config.requestTimeoutMs, async () => { })).map(({ name }) => name));
-    const diff = diffMcpToolNames(knownNames, newNames);
-    const identity = mcpRegistrationIdentity(catalog, entry.cachedCatalog);
-    const initial = targets();
-    const stale = connectOnly ? initial.filter((target) => target.registeredIdentity() !== identity) : initial;
-    if (stale.length > 0) {
-        // Registration reads entry.cachedCatalog. A shared lease refreshed it above; nothing else
-        // refreshes a non-shared connection's catalog after its startup connect (#2188).
-        if (!(entry.connection instanceof SharedMcpLease)) {
-            const refreshed = await collectServerCatalogForCache(entry.connection, server.config, entry.generationHash ?? entry.configHash, entry.credentialIdentity);
+    try {
+        const registeredCatalog = entry.cachedCatalog;
+        if (entry.connection instanceof SharedMcpLease) {
+            const refreshed = await entry.connection.catalog();
             if (!ownsCatalog())
                 return;
             entry.cachedCatalog = refreshed;
-            await writeMcpCachedServer(entry.agentDir, entry.name, refreshed, ownsCatalog);
         }
+        const catalog = await collectToolCatalog(entry.name, entry.connection, server.config, {
+            agentDir: entry.agentDir,
+            outputGuard: config.settings.outputGuard,
+        });
         if (!ownsCatalog())
             return;
-        // Tombstone removed tools BEFORE re-registration so the subsequent
-        // setActiveTools (which excludes them) leaves the tombstones inactive.
-        const seen = new Set(initial.map((target) => target.pi));
-        const failures = [];
-        let pending = stale;
-        while (pending.length > 0) {
-            for (const target of pending) {
+        const newNames = mapMcpCatalogNames(catalog).map(({ name }) => name);
+        // Before the first refresh, the registered names are the catalog the startup pass registered.
+        const knownNames = entry.knownToolNames ??
+            (registeredCatalog === undefined
+                ? newNames
+                : mapMcpCatalogNames(cachedToolsToCatalogEntries(entry.name, registeredCatalog, entry.connection, server.config.requestTimeoutMs, async () => { })).map(({ name }) => name));
+        const diff = diffMcpToolNames(knownNames, newNames);
+        const identity = mcpRegistrationIdentity(catalog, entry.cachedCatalog);
+        const initial = targets();
+        const stale = connectOnly ? initial.filter((target) => target.registeredIdentity() !== identity) : initial;
+        if (stale.length > 0) {
+            // Registration reads entry.cachedCatalog. A shared lease refreshed it above; nothing else
+            // refreshes a non-shared connection's catalog after its startup connect (#2188).
+            if (!(entry.connection instanceof SharedMcpLease)) {
+                const refreshed = await collectServerCatalogForCache(entry.connection, server.config, entry.generationHash ?? entry.configHash, entry.credentialIdentity);
                 if (!ownsCatalog())
                     return;
-                try {
-                    for (const removed of diff.removed)
-                        target.pi.registerTool(buildMcpTombstoneDefinition(removed, entry.name));
-                    await target.register();
-                }
-                catch (error) {
-                    failures.push(error);
+                entry.cachedCatalog = refreshed;
+                await writeMcpCachedServer(entry.agentDir, entry.name, refreshed, ownsCatalog);
+            }
+            if (!ownsCatalog())
+                return;
+            // Tombstone removed tools BEFORE re-registration so the subsequent
+            // setActiveTools (which excludes them) leaves the tombstones inactive.
+            const seen = new Set(initial.map((target) => target.pi));
+            const failures = [];
+            let pending = stale;
+            while (pending.length > 0) {
+                for (const target of pending) {
+                    if (!ownsCatalog())
+                        return;
+                    try {
+                        for (const removed of diff.removed)
+                            target.pi.registerTool(buildMcpTombstoneDefinition(removed, entry.name));
+                        await target.register();
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
+                // A session that attached during this refresh registered the catalog cached before it.
+                pending = targets().filter((target) => !seen.has(target.pi));
+                for (const target of pending)
+                    seen.add(target.pi);
+            }
+            if (failures.length > 0) {
+                entry.knownToolNames = newNames;
+                entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
+                throw new AggregateError(failures, `MCP ${entry.name} tool refresh failed in ${failures.length} of ${seen.size} session(s)`);
             }
-            // A session that attached during this refresh registered the catalog cached before it.
-            pending = targets().filter((target) => !seen.has(target.pi));
-            for (const target of pending)
-                seen.add(target.pi);
-        }
-        if (failures.length > 0) {
-            entry.knownToolNames = newNames;
-            entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
-            throw new AggregateError(failures, `MCP ${entry.name} tool refresh failed in ${failures.length} of ${seen.size} session(s)`);
         }
+        entry.knownToolNames = newNames;
+        entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
+    }
+    catch (error) {
+        if (!ownsCatalog())
+            return;
+        throw error;
     }
-    entry.knownToolNames = newNames;
-    entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
 }
 //# sourceMappingURL=service-tools-changed.js.map

package/dist/core/extensions/builtin/mcp/startup-race.d.ts

@@ -43,6 +43,8 @@ export declare class McpDeferredAttach {
 }
 export declare function raceMcpStartupConnect(options: RaceMcpStartupConnectOptions): Promise<void>;
 export declare function connectAndRefreshMcpCatalog(entry: McpConnectionEntry, serverConfig: ResolvedMcpServer["config"]): Promise<void>;
+/** Reconcile the grant before health recovery without attempting a transport connection. */
+export declare function prepareMcpAuthentication(entry: McpConnectionEntry): Promise<boolean>;
 export declare function ignoreStartupNeedsAuth(entry: McpConnectionEntry, connect: Promise<void>): Promise<void>;
 export declare function waitForMcpStartupRace(connect: Promise<void>, deadlineMs?: number): Promise<McpStartupRaceResult>;
 export declare function shouldRaceMcpStartup(lifecycle: "lazy" | "eager" | "keep-alive"): boolean;

package/dist/core/extensions/builtin/mcp/startup-race.js

@@ -91,15 +91,16 @@ export function connectAndRefreshMcpCatalog(entry, serverConfig) {
     void refresh.then(finish, finish);
     return refresh;
 }
-async function refreshConnectedMcpCatalog(entry, serverConfig) {
-    if (serverConfig === undefined || entry.isCurrent?.() === false)
-        return;
+/** Reconcile the grant before health recovery without attempting a transport connection. */
+export async function prepareMcpAuthentication(entry) {
+    if (entry.isCurrent?.() === false)
+        return false;
     try {
         await entry.authPlan?.refresh?.ensureFresh();
     }
     catch (error) {
-        if (entry.connection.state === "disabled")
-            return;
+        if (entry.isCurrent?.() === false || entry.connection.state === "disabled")
+            return false;
         const authError = markMcpConnectionNeedsAuth(entry.connection, error);
         if (authError !== undefined) {
             entry.logger.warn(authError.message);
@@ -107,10 +108,17 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
         }
         throw error;
     }
+    if (entry.isCurrent?.() === false)
+        return false;
     if (entry.credentialsCurrent?.() === false) {
         await entry.onCredentialsChanged?.();
-        return;
+        return false;
     }
+    return true;
+}
+async function refreshConnectedMcpCatalog(entry, serverConfig) {
+    if (serverConfig === undefined || !(await prepareMcpAuthentication(entry)))
+        return;
     await connectMcpServer(entry.connection, entry.logger);
     if (entry.connection.state !== "connected" || entry.isCurrent?.() === false)
         return;
@@ -120,7 +128,15 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
         entry.connection.state === "connected" &&
         entry.connection.generation === generation;
     if (entry.connection instanceof SharedMcpLease) {
-        const catalog = await entry.connection.catalog();
+        let catalog;
+        try {
+            catalog = await entry.connection.catalog();
+        }
+        catch (error) {
+            if (!ownsCatalog())
+                return;
+            throw error;
+        }
         if (!ownsCatalog()) {
             if (entry.credentialsCurrent?.() === false)
                 await entry.onCredentialsChanged?.();
@@ -150,6 +166,8 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
             await ensureMcpResourceSubscriptions(entry.connection.client, catalog.resources ?? []);
     }
     catch (error) {
+        if (!ownsCatalog())
+            return;
         entry.logger.warn("Failed to refresh MCP catalog cache", {
             error: error instanceof Error ? error.message : String(error),
         });

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-2.js

@@ -16,10 +16,10 @@
 //   retries after a busy tool from nearly all tries to four in ten. "Blind
 //   retries" becomes the exact action it meant, repeating a failure that has not
 //   been diagnosed, so it no longer collides with "wait and retry".
-// - Scope, structure ("Say who owns the code"): with no ownership statement 5.2
-//   repeats existing code instead of reusing it. The user owns the code here, so
-//   the guide's ownership sentence stays out (it invites unrequested changes);
-//   the smallest-change rule says to build on the code that already does the job.
+// - Scope, structure ("Say who owns the code"): the guide's ownership sentence
+//   opens the structure paragraph and replaces the smallest-change sentence
+//   (owner order). Without it, 5.2 acts as a guest: parallel code, duplicates
+//   left in place, and nearby bugs only mentioned.
 // - Working the Task, delegation ("Set expectations for subagents"): the 5.1
 //   sentence was a standing invitation to delegate, which the guide says to
 //   review first. It now states the cost before the invitation, what a brief
@@ -29,7 +29,7 @@
 //   mannered-prose sentence. 5.2 reports run dense, so the rule asks for plain
 //   words, mostly short one-idea sentences, one word per thing, and no names
 //   made up during the work, for a reader switching in from something else.
-// Deliberately absent: the ownership sentence; "answer directly" or think-less
+// Deliberately absent: "answer directly" or think-less
 // lines (the guide: no effect at medium effort and above, lower the effort
 // instead); a token budget; the "treat that answer as done" lines; hard
 // sentence-length limits; any instruction to write reasoning in the reply (a
@@ -77,7 +77,7 @@ The request sets the scope, and the scope is the deliverable: deliver all of it
 
 Errors, timeouts, locked files, empty results, and failing tools are ordinary obstacles, not blockers: diagnose them, then work through them with the access you have (wait and retry a call that is safe to repeat, fix the request, use another tool or source) without asking first. A file marked not to be touched, withheld access, or a safety guardrail is a deliberate blocker: leave it alone and look for another safe way to finish. If part of the task stays blocked, finish every other part and say exactly what you left out and why.
 
-Smallest correct change wins: build on the code that already does the job instead of adding a parallel copy, with no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, and no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
+This codebase is yours: what it's for and how it's built are your call, and you'll keep building on it. Add no helpers or abstractions for hypothetical needs and no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
 
 ## Working the Task
 

package/dist/core/open-timing.d.ts

@@ -1,6 +1,8 @@
 export interface OpenTimer {
     mark(phase: string): void;
 }
+/** Speculative builds have no caller to charge; drop their timing rather than report a misleading open. */
+export declare function withoutOpenTiming<T>(build: () => T): T;
 export declare function openTimingEnabled(): boolean;
 export declare function startOpenTimer(scope: string): OpenTimer;
 //# sourceMappingURL=open-timing.d.ts.map

package/dist/core/open-timing.js

@@ -1,4 +1,5 @@
 import { envValue } from "./brand.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 /**
  * Per-phase timing of a session open (senpi#5707), for naming the await that holds a slow open.
  * Enable with SENPI_OPEN_TIMING=1. Off, every call returns before reading a clock or touching
@@ -11,11 +12,16 @@ import { envValue } from "./brand.js";
  */
 const ENABLED = envValue("OPEN_TIMING") === "1";
 const DISABLED = { mark: () => { } };
+const speculative = new AsyncLocalStorage();
+/** Speculative builds have no caller to charge; drop their timing rather than report a misleading open. */
+export function withoutOpenTiming(build) {
+    return speculative.run(true, build);
+}
 export function openTimingEnabled() {
     return ENABLED;
 }
 export function startOpenTimer(scope) {
-    if (!ENABLED)
+    if (!ENABLED || speculative.getStore())
         return DISABLED;
     let last = performance.now();
     return {

package/dist/core/session-manager.d.ts

@@ -440,6 +440,8 @@ export declare class SessionManager {
     private _transcriptEntryBytes;
     private _serializedFileEntries;
     isPersisted(): boolean;
+    /** Give an unclaimed in-memory session its first file without rebuilding or changing its identity. */
+    enablePersistence(): Promise<void>;
     getCwd(): string;
     getSessionDir(): string;
     usesDefaultSessionDir(): boolean;

package/dist/core/session-manager.js

@@ -1,7 +1,7 @@
 import { getCurrentSystemMessage, normalizeProviderId } from "@earendil-works/pi-ai";
 import { randomBytes, randomUUID } from "crypto";
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readSync, rmSync, statSync, writeFileSync, } from "fs";
-import { appendFile, open, readdir, rm } from "fs/promises";
+import { appendFile, mkdir, open, readdir, rm } from "fs/promises";
 import { basename, join, resolve } from "path";
 import { StringDecoder } from "string_decoder";
 import { APP_NAME, getAgentDir as getDefaultAgentDir, getSessionsDir } from "../config.js";
@@ -1230,6 +1230,20 @@ export class SessionManager {
     isPersisted() {
         return this.persist;
     }
+    /** Give an unclaimed in-memory session its first file without rebuilding or changing its identity. */
+    async enablePersistence() {
+        if (this.persist)
+            return;
+        const dir = getDefaultSessionDirPath(this.cwd);
+        await mkdir(dir, { recursive: true });
+        const header = this.fileEntries[0];
+        const path = join(dir, `${header.timestamp.replace(/[:.]/g, "-")}_${this.sessionId}.jsonl`);
+        reserveSessionWrite(path);
+        this.sessionDir = dir;
+        this.sessionFile = path;
+        this.persist = true;
+        registerSessionWriter(this);
+    }
     getCwd() {
         return this.cwd;
     }

package/dist/modes/interactive/session-control-rpc-commands.d.ts

@@ -1,7 +1,7 @@
 import type { AgentSession } from "../../core/agent-session.ts";
 import { type ControlAttachments } from "./session-control-attach.ts";
 import { type ControlCommand, type ControlConnection } from "./session-control-server.ts";
-export declare const TUI_RPC_COMMANDS: readonly ["open_session", "get_snapshot", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "admit_external_message", "get_effect_status", "set_client_info", "attach_session", "release_attachment", "abort", "mcp_presenter_context", "mcp_form_presented", "mcp_form_response", "mcp_form_sync", "mcp_presenter_secret_answer"];
+export declare const TUI_RPC_COMMANDS: readonly ["open_session", "park_session", "claim_session", "get_snapshot", "subscribe_sessions", "unsubscribe_sessions", "steer", "follow_up", "prompt", "admit_external_message", "get_effect_status", "set_client_info", "attach_session", "release_attachment", "abort", "mcp_presenter_context", "mcp_form_presented", "mcp_form_response", "mcp_form_sync", "mcp_presenter_secret_answer"];
 export interface RpcCommandContext {
     /** This endpoint's instance id: the `expectedHostInstance` an `attach_session` may name. */
     readonly instanceId: string;

package/dist/modes/interactive/session-control-rpc-commands.js

@@ -26,6 +26,8 @@ import { failure, success } from "./session-control-server.js";
 import { TERMINAL_PRESENTER_COMMANDS } from "./terminal-presenter-surface.js";
 export const TUI_RPC_COMMANDS = [
     "open_session",
+    "park_session",
+    "claim_session",
     "get_snapshot",
     "subscribe_sessions",
     "unsubscribe_sessions",
@@ -64,6 +66,9 @@ export async function runTuiRpcCommand(context, connection, command) {
         }
         case "open_session":
             return openSession(context, connection, command);
+        case "park_session":
+        case "claim_session":
+            return failure(idOf(command), command.type, "multi_session_disabled");
         case "subscribe_sessions":
             return subscribe(context, connection, frame(command));
         case "unsubscribe_sessions":

package/dist/modes/rpc/compact-admission-validation.js

@@ -22,7 +22,10 @@ export function unknownCompactAdmission(host, command) {
     if (!host.admissions || command.admissionId === undefined)
         return undefined;
     // These commands introduce client IDs; their bounded attempt index owns retry/conflict/retirement.
-    if (command.type === "open_session" || command.type === "attach_session" || command.type === "subscribe_sessions")
+    if (command.type === "open_session" ||
+        command.type === "claim_session" ||
+        command.type === "attach_session" ||
+        command.type === "subscribe_sessions")
         return undefined;
     // RULING-96: recovery IDs select token/lease authority, not the ordinary attempt ledger.
     if (command.type === "get_recovery_page" || command.type === "release_recovery")

package/dist/modes/rpc/connection-handler.d.ts

@@ -73,6 +73,8 @@ export interface RpcConnectionHandler {
      * extension UI context is installed (used by tests that drive ctx.ui directly).
      */
     readonly ready: Promise<void>;
+    /** Complete a prebuilt binding with the capabilities its opener supplied. */
+    setClientCapabilities(capabilities: readonly string[]): void;
     /** Feed one inbound JSONL line (command or extension_ui_response). */
     handleInputLine(line: string): Promise<void>;
     /**

package/dist/modes/rpc/connection-handler.js

@@ -1047,7 +1047,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
                                 // Client flags cannot advertise a host guard this classic binding does not run, nor a tool runtime.
-                                ...advertisedCompactCapabilities(options.capabilities ?? [], false).filter((capability) => capability !== SESSION_HELD_CAPABILITY && !isHostOwnedToolRuntimeCapability(capability)),
+                                ...advertisedCompactCapabilities(options.capabilities ?? [], false).filter((capability) => capability !== SESSION_HELD_CAPABILITY &&
+                                    capability !== "park_claim" &&
+                                    !isHostOwnedToolRuntimeCapability(capability)),
                             ]),
                         ],
                         mode: "classic",
@@ -1055,7 +1057,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                     },
                 };
             case "open_session":
-                return error(id, "open_session", "multi_session_disabled");
+            case "park_session":
+            case "claim_session":
+                return error(id, command.type, "multi_session_disabled");
             // =================================================================
             // Prompting
             // =================================================================
@@ -2052,6 +2056,10 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         pendingPrompts() {
             return [...promptCalls];
         },
+        setClientCapabilities(capabilities) {
+            replaceClientCapabilities([...capabilities]);
+            refreshGrantPresentation();
+        },
         isShutdownRequested() {
             return shutdownRequested;
         },

package/dist/modes/rpc/custom-capability.d.ts

@@ -117,6 +117,8 @@ export declare const AUTO_TITLE_PER_SESSION_CAPABILITY = "auto_title_per_session
  * cwd, kind and context needs without opening a session. Advertised only by an in-process runtime.
  */
 export declare const WARM_CAPABILITY = "warm";
+/** HOST capability: invisible speculative sessions and single-use claim, in-process registries only. */
+export declare const PARK_CLAIM_CAPABILITY = "park_claim";
 /**
  * HOST capability: this host honors `open_session.durableSessionId`, so a caller that already
  * owns a stable record id for the conversation can CREATE the session under that id and keep

package/dist/modes/rpc/custom-capability.js

@@ -117,6 +117,8 @@ export const AUTO_TITLE_PER_SESSION_CAPABILITY = "auto_title_per_session";
  * cwd, kind and context needs without opening a session. Advertised only by an in-process runtime.
  */
 export const WARM_CAPABILITY = "warm";
+/** HOST capability: invisible speculative sessions and single-use claim, in-process registries only. */
+export const PARK_CLAIM_CAPABILITY = "park_claim";
 /**
  * HOST capability: this host honors `open_session.durableSessionId`, so a caller that already
  * owns a stable record id for the conversation can CREATE the session under that id and keep

package/dist/modes/rpc/effect-commands.d.ts

@@ -66,6 +66,27 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
         readonly reclaimed: true;
         readonly sessionId: string;
     };
+} | {
+    id?: string;
+    type: "response";
+    command: "park_session";
+    success: true;
+    data: {
+        state: "parked" | "already_parked" | "full";
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "claim_session";
+    success: true;
+    data: {
+        claimed: false;
+    } | {
+        sessionId: string;
+        state: import("./rpc-session-state-types.ts").RpcSessionState;
+        attached?: boolean;
+        presence?: import("./rpc-host-response-types.ts").RpcSessionPresence;
+    };
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/host-capabilities.d.ts

@@ -14,6 +14,7 @@ export declare const SET_PERMISSION_PRESET_CAPABILITY = "set_permission_preset_v
  */
 export declare function multiSessionHostCapabilities(options: {
     readonly warm: boolean;
+    readonly parkClaim?: boolean;
     readonly toolRuntime: ToolRuntimeKind;
     readonly negotiated: readonly string[];
     readonly mcpPresenters?: boolean;

package/dist/modes/rpc/host-capabilities.js

@@ -2,7 +2,7 @@ import { compactUpdatesEnabled } from "../../core/engine-socket-flag.js";
 import { isHostOwnedToolRuntimeCapability, toolRuntimeCapabilities, } from "../../cli/tool-runtime.js";
 import { ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY, AUTO_PERMISSION_PRESET_CAPABILITY, } from "../../core/extensions/builtin/permission-system/config.js";
 import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.js";
-import { ACCOUNT_RESET_CAPABILITY, ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DELEGATED_CONNECTION_CAPABILITY, DELEGATION_ROLES_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, PEER_AGENT_ROLE_CAPABILITY, ENTRIES_TAIL_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, OBSERVE_READS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_ENV_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, } from "./custom-capability.js";
+import { ACCOUNT_RESET_CAPABILITY, ATTENDED_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, BROWSER_ENGINE_CAPABILITY, CONTINUE_FROM_LEAF_CAPABILITY, DELEGATED_CONNECTION_CAPABILITY, DELEGATION_ROLES_CAPABILITY, DETACH_CONNECTION_CAPABILITY, DURABLE_SESSION_ID_CAPABILITY, PEER_AGENT_ROLE_CAPABILITY, ENTRIES_TAIL_CAPABILITY, EVAL_CELLS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, MOVED_PATH_GUARD_CAPABILITY, OBSERVE_READS_CAPABILITY, PROMPT_SURFACE_CAPABILITY, PROMPT_SURFACE_CHAT_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, RETRY_FALLBACK_PROFILE_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_ENV_CAPABILITY, SESSION_HELD_CAPABILITY, SESSION_KIND_CAPABILITY, SESSION_RELOCATION_CAPABILITY, SESSION_STATUS_CAPABILITY, TOOL_BARRIER_CAPABILITY, WARM_CAPABILITY, PARK_CLAIM_CAPABILITY, } from "./custom-capability.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { SESSION_MODEL_SCOPE_CAPABILITY } from "./rpc-session-command-types.js";
 import { STEER_WHEN_IDLE_CAPABILITY, USER_ACTIVITY_CAPABILITY } from "./rpc-types.js";
@@ -103,9 +103,11 @@ export function multiSessionHostCapabilities(options) {
             AUTO_PERMISSION_PRESET_CAPABILITY,
             // Only an in-process runtime shares the loop a warm loads into (senpi#2314).
             ...(options.warm ? [WARM_CAPABILITY] : []),
+            ...(options.parkClaim ? [PARK_CLAIM_CAPABILITY] : []),
             ...toolRuntimeCapabilities(options.toolRuntime),
             // The host alone says where tool work runs; a negotiated copy would make two answers.
             ...options.negotiated.filter((capability) => capability !== "mcp_form_presenter_v1" &&
+                capability !== PARK_CLAIM_CAPABILITY &&
                 // RULING-111 (LEAK-E): only the compact negotiation owns these names; flag off echoes them as main does.
                 (!compactUpdatesEnabled() ||
                     (capability !== "compact_message_updates_v1" && capability !== "compact_events")) &&

package/dist/modes/rpc/host-observe-request.d.ts

@@ -12,6 +12,8 @@
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).
+ * `park_session` likewise holds no client attachment: its speculative runtime is discarded at host exit.
+ * `claim_session` takes an ordinary opener attachment and is never observing.
  * Hosts that predate the field ignore it (commands are parsed by `type`), so a marked read works
  * against every generation.
  *

package/dist/modes/rpc/host-observe-request.js

@@ -12,6 +12,8 @@
  * and the connection attaches, so a client cannot hold a session while its host idles out under it.
  * `warm` never attaches, marked or not: it opens nothing, so a host that only received it idles out
  * on its normal deadline (senpi#2314).
+ * `park_session` likewise holds no client attachment: its speculative runtime is discarded at host exit.
+ * `claim_session` takes an ordinary opener attachment and is never observing.
  * Hosts that predate the field ignore it (commands are parsed by `type`), so a marked read works
  * against every generation.
  *
@@ -59,7 +61,10 @@ export function isObservingRequest(line) {
     if (typeof request !== "object" || request === null || Array.isArray(request))
         return false;
     const record = request;
-    if (record.type === "warm" || record.type === "authenticate" || record.type === RPC_LAUNCH_PROOF_RECORD)
+    if (record.type === "warm" ||
+        record.type === "park_session" ||
+        record.type === "authenticate" ||
+        record.type === RPC_LAUNCH_PROOF_RECORD)
         return true;
     return record[OBSERVE_REQUEST_FIELD] === true && OBSERVING_COMMANDS.has(record.type);
 }

package/dist/modes/rpc/host-park-ledger.d.ts

@@ -0,0 +1,19 @@
+import type { OpenRpcSession } from "./session-registry.ts";
+/** Owns both in-flight builds and ready parks, including the races with claim, expiry and shutdown. */
+export declare class HostParkLedger {
+    private readonly parks;
+    private readonly replacements;
+    private stopped;
+    private readonly close;
+    constructor(close: (opened: OpenRpcSession) => Promise<void>);
+    get size(): number;
+    park(key: string, build: () => Promise<OpenRpcSession>): Promise<"parked" | "already_parked" | "full">;
+    /** A claim never waits for a build, and consumes the ready park synchronously. */
+    take(key: string): OpenRpcSession | undefined;
+    finish(key: string): void;
+    replace(key: string, build: () => Promise<OpenRpcSession>): void;
+    /** Fences new builds synchronously; every build already accepted is closed when it finishes. */
+    stop(): Promise<void>;
+    private retire;
+}
+//# sourceMappingURL=host-park-ledger.d.ts.map