@code-yeongyu/senpi 2026.11.10-1 → 2026.11.10-3

package/dist/core/hand/hook-contract.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The request-hook contract of hosted model-key custody (row CK21; custody design 4.9, round-10 fold section 15).
+ *
+ * `HookRequestInput` is the serializable projection of the fused `before_provider_request` input: the provider payload
+ * and the effective request model, without the request headers or the model's own headers, which can carry a
+ * credential and never leave the side that dials. A step call has this input; an aux call has none. A hand serves
+ * `hook.model_request` by running its user's request hooks on the input, only after the request's placement claim
+ * verified, and replies with the payload they produced, with their failures and the messages and notices they sent.
+ */
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ExecutionScope } from "@earendil-works/pi-agent-core";
+import { type ClaimVerdict } from "../egress/placement-claim.ts";
+import type { HookModelRequest, HookModelRequestReply, ProviderCallErrorCode, ProviderCallKind, WireJson } from "../egress/wire.ts";
+import type { BeforeProviderRequestEvent } from "../extensions/types.ts";
+/** The pinned shape of `HookModelRequestInput` (and of the reply's `output`). */
+export type HookRequestInput = {
+    readonly payload: WireJson;
+    readonly model?: {
+        readonly [key: string]: WireJson;
+    };
+};
+/** The input or output cannot cross the wire: it is not JSON, or not the closed envelope. */
+export declare class HookContractError extends Error {
+    readonly name = "HookContractError";
+}
+/** The request's placement claim did not verify, so no hook ran; `code`/`retryable` are the claim's wire answer. */
+export declare class HookRequestRefusedError extends Error {
+    readonly name = "HookRequestRefusedError";
+    readonly verdict: Exclude<ClaimVerdict, "valid">;
+    readonly code: ProviderCallErrorCode;
+    readonly retryable: boolean;
+    constructor(verdict: Exclude<ClaimVerdict, "valid">);
+}
+/** The projection of a fused `before_provider_request` input. */
+export declare function hookRequestInputOf(event: Omit<BeforeProviderRequestEvent, "type"> & {
+    type?: string;
+}): HookRequestInput;
+/** A step call's hook input; an aux call runs no request hooks on the hand and has none. */
+export declare function hookRequestInputForCall(call: ProviderCallKind, event: Omit<BeforeProviderRequestEvent, "type"> & {
+    type?: string;
+}): HookRequestInput | undefined;
+/** The reply's `output`: the payload the hooks produced, with the model the request carried. */
+export declare function hookRequestOutputOf(input: HookRequestInput, payload: unknown): HookRequestInput;
+/** Reads a wire value back as the closed envelope `{ payload, model? }`; the model never carries headers. */
+export declare function parseHookRequestInput(value: unknown): HookRequestInput;
+/** The effective model a hand hands its hooks, as the loop sent it. */
+export declare function hookModelOf(input: HookRequestInput): Model<Api> | undefined;
+/** What the user's request hooks produced: the reply's `output`, their failures and what they sent. */
+export type HookRequestHooksResult = Omit<HookModelRequestReply, "t" | "sessionId" | "stepId" | "output"> & {
+    readonly output: HookRequestInput;
+};
+export interface HookServePorts {
+    /** The hand's placement-claim check (CK7's verifier with the hand's trust and clock). */
+    verifyClaim(claim: unknown): Promise<ClaimVerdict>;
+    /** Runs the user's request hooks of `sessionId` on `input` and returns what they produced. */
+    runRequestHooks(sessionId: string, input: HookRequestInput): Promise<HookRequestHooksResult>;
+}
+/** Serves one `hook.model_request`: claim first, then the closed input, then the hooks. */
+export declare function serveHookModelRequest(request: HookModelRequest, ports: HookServePorts): Promise<HookModelRequestReply>;
+/**
+ * `runRequestHooks` over a hand's loop-hook runner (`LooplessHand.loopHooks`): the session's hooks run on the runtime of
+ * `scope`, inside a loop-hook call bound to that session, with the loop busy (a model request is mid-turn). The hooks'
+ * failures and what they sent travel with the output, as they do on every loop-hook reply.
+ */
+export declare function loopHookRequestHooks(loopHooks: (event: string, payload: WireJson) => Promise<unknown>, scope: ExecutionScope): HookServePorts["runRequestHooks"];
+//# sourceMappingURL=hook-contract.d.ts.map

package/dist/core/hand/hook-contract.js

@@ -0,0 +1,138 @@
+import { CLAIM_VERDICT_ERRORS } from "../egress/placement-claim.js";
+/** The input or output cannot cross the wire: it is not JSON, or not the closed envelope. */
+export class HookContractError extends Error {
+    constructor() {
+        super(...arguments);
+        this.name = "HookContractError";
+    }
+}
+/** The request's placement claim did not verify, so no hook ran; `code`/`retryable` are the claim's wire answer. */
+export class HookRequestRefusedError extends Error {
+    constructor(verdict) {
+        super(`hook.model_request refused: placement claim ${verdict}`);
+        this.name = "HookRequestRefusedError";
+        this.verdict = verdict;
+        this.code = CLAIM_VERDICT_ERRORS[verdict].code;
+        this.retryable = CLAIM_VERDICT_ERRORS[verdict].retryable;
+    }
+}
+const isPlainObject = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+/** `value` as JSON, exactly; anything JSON would drop, coerce or reject is refused (an `undefined` member is absent). */
+function wireJson(value, at) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (Number.isFinite(value))
+            return value;
+        throw new HookContractError(`${at} is not a finite number`);
+    }
+    if (Array.isArray(value))
+        return value.map((item, index) => wireJson(item, `${at}[${index}]`));
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, member] of Object.entries(value))
+            if (member !== undefined)
+                out[key] = wireJson(member, `${at}.${key}`);
+        return out;
+    }
+    throw new HookContractError(`${at} is not JSON`);
+}
+function wireModel(model) {
+    const { headers: _headers, ...rest } = model;
+    return wireJson(rest, "model");
+}
+/** The projection of a fused `before_provider_request` input. */
+export function hookRequestInputOf(event) {
+    const payload = wireJson(event.payload, "payload");
+    return event.model === undefined ? { payload } : { payload, model: wireModel(event.model) };
+}
+/** A step call's hook input; an aux call runs no request hooks on the hand and has none. */
+export function hookRequestInputForCall(call, event) {
+    return call.kind === "step" ? hookRequestInputOf(event) : undefined;
+}
+/** The reply's `output`: the payload the hooks produced, with the model the request carried. */
+export function hookRequestOutputOf(input, payload) {
+    const out = wireJson(payload, "payload");
+    return input.model === undefined ? { payload: out } : { payload: out, model: input.model };
+}
+const MODEL_STRING_FIELDS = ["id", "name", "api", "provider", "baseUrl"];
+/** Reads a wire value back as the closed envelope `{ payload, model? }`; the model never carries headers. */
+export function parseHookRequestInput(value) {
+    if (!isPlainObject(value) || !("payload" in value))
+        throw new HookContractError("hook input is not an object with a payload");
+    const extra = Object.keys(value).filter((key) => key !== "payload" && key !== "model");
+    if (extra.length > 0)
+        throw new HookContractError(`hook input has unknown members: ${extra.join(", ")}`);
+    const payload = wireJson(value.payload, "payload");
+    if (value.model === undefined)
+        return { payload };
+    const model = value.model;
+    if (!isPlainObject(model) || MODEL_STRING_FIELDS.some((field) => typeof model[field] !== "string"))
+        throw new HookContractError("hook input model is not a model");
+    if ("headers" in model)
+        throw new HookContractError("hook input model carries headers");
+    return { payload, model: wireJson(model, "model") };
+}
+/** The effective model a hand hands its hooks, as the loop sent it. */
+export function hookModelOf(input) {
+    return input.model;
+}
+/** Serves one `hook.model_request`: claim first, then the closed input, then the hooks. */
+export async function serveHookModelRequest(request, ports) {
+    const verdict = await ports.verifyClaim(request.claim);
+    if (verdict !== "valid")
+        throw new HookRequestRefusedError(verdict);
+    const input = parseHookRequestInput(request.input);
+    const produced = await ports.runRequestHooks(request.sessionId, input);
+    return { t: "hook.model_request.reply", sessionId: request.sessionId, stepId: request.stepId, ...produced };
+}
+const isHookFailure = (value) => isPlainObject(value) &&
+    typeof value.extensionPath === "string" &&
+    typeof value.event === "string" &&
+    typeof value.error === "string";
+function hookFailures(value) {
+    if (!Array.isArray(value) || !value.every(isHookFailure))
+        throw new HookContractError("the hand's request-hook reply has malformed errors");
+    return value.map(({ extensionPath, event, error }) => ({ extensionPath, event, error }));
+}
+function wireList(value, at) {
+    if (!Array.isArray(value))
+        throw new HookContractError(`the hand's request-hook reply has malformed ${at}`);
+    return value.map((item, index) => wireJson(item, `${at}[${index}]`));
+}
+function droppedCount(value) {
+    if (typeof value === "number" && Number.isSafeInteger(value) && value > 0)
+        return value;
+    throw new HookContractError("the hand's request-hook reply has a malformed droppedLate");
+}
+/**
+ * `runRequestHooks` over a hand's loop-hook runner (`LooplessHand.loopHooks`): the session's hooks run on the runtime of
+ * `scope`, inside a loop-hook call bound to that session, with the loop busy (a model request is mid-turn). The hooks'
+ * failures and what they sent travel with the output, as they do on every loop-hook reply.
+ */
+export function loopHookRequestHooks(loopHooks, scope) {
+    return async (sessionId, input) => {
+        const reply = await loopHooks("before_provider_request", {
+            scope: { id: scope.id, root: scope.root },
+            sessionId,
+            idle: false,
+            input,
+        });
+        if (!isPlainObject(reply))
+            throw new HookContractError("the hand's request-hook reply is not an object");
+        const { errors, sent, notices, droppedLate } = reply;
+        return {
+            output: parseHookRequestInput(reply.output),
+            ...(errors === undefined ? {} : { errors: hookFailures(errors) }),
+            ...(sent === undefined ? {} : { sent: wireList(sent, "sent") }),
+            ...(notices === undefined ? {} : { notices: wireList(notices, "notices") }),
+            ...(droppedLate === undefined ? {} : { droppedLate: droppedCount(droppedLate) }),
+        };
+    };
+}
+//# sourceMappingURL=hook-contract.js.map

package/dist/core/open-timing.d.ts

@@ -1,6 +1,8 @@
 export interface OpenTimer {
     mark(phase: string): void;
 }
+/** Speculative builds have no caller to charge; drop their timing rather than report a misleading open. */
+export declare function withoutOpenTiming<T>(build: () => T): T;
 export declare function openTimingEnabled(): boolean;
 export declare function startOpenTimer(scope: string): OpenTimer;
 //# sourceMappingURL=open-timing.d.ts.map

package/dist/core/open-timing.js

@@ -1,4 +1,5 @@
 import { envValue } from "./brand.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 /**
  * Per-phase timing of a session open (senpi#5707), for naming the await that holds a slow open.
  * Enable with SENPI_OPEN_TIMING=1. Off, every call returns before reading a clock or touching
@@ -11,11 +12,16 @@ import { envValue } from "./brand.js";
  */
 const ENABLED = envValue("OPEN_TIMING") === "1";
 const DISABLED = { mark: () => { } };
+const speculative = new AsyncLocalStorage();
+/** Speculative builds have no caller to charge; drop their timing rather than report a misleading open. */
+export function withoutOpenTiming(build) {
+    return speculative.run(true, build);
+}
 export function openTimingEnabled() {
     return ENABLED;
 }
 export function startOpenTimer(scope) {
-    if (!ENABLED)
+    if (!ENABLED || speculative.getStore())
         return DISABLED;
     let last = performance.now();
     return {

package/dist/core/resource-loader.js

@@ -569,6 +569,8 @@ export class DefaultResourceLoader {
                     cwd: this.cwd,
                     agentDir: this.agentDir,
                     ...this.settingsManager.getSettings().contextFiles,
+                    // senpi#5567: user settings only; a project's settings never redirect the global file.
+                    globalPath: this.settingsManager.getGlobalContextFilePath(),
                 }),
         };
         const resolvedAgentsFiles = this.agentsFilesOverride ? this.agentsFilesOverride(agentsFiles) : agentsFiles;

package/dist/core/retry-fallback/log.d.ts

@@ -6,5 +6,11 @@ export interface FallbackLogger {
 export interface FallbackLoggerOptions {
     maxBytes?: number;
 }
-export declare function createFallbackLogger(agentDir: string, options?: FallbackLoggerOptions): FallbackLogger;
+export interface SettledFallbackLogger extends FallbackLogger {
+    /** Resolves once the one-time removal of earlier log generations has finished and every line logged before it was written. */
+    settled(): Promise<void>;
+}
+/** Resolves once every fallback logger created so far has finished its first-start removal and flushed its queue. */
+export declare function settledFallbackLoggers(): Promise<void>;
+export declare function createFallbackLogger(agentDir: string, options?: FallbackLoggerOptions): SettledFallbackLogger;
 //# sourceMappingURL=log.d.ts.map

package/dist/core/retry-fallback/log.js

@@ -1,19 +1,81 @@
 import { closeSync, fchmodSync, mkdirSync, openSync, writeSync } from "node:fs";
+import { access, mkdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { rotateLogIfNeeded } from "../log-file-rotation.js";
-import { redactSecrets } from "../sensitive-output.js";
+import { redactSecrets, redactSensitiveTokenValues } from "../sensitive-output.js";
 const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
 const MAX_STRING_LENGTH = 200;
+const MAX_QUEUED_LINES = 256;
 const BLOCKED_KEY = /^(?:__proto__|constructor|prototype|headers?|env(?:ironment)?|authorization|credential(?:s)?|password|secret|token|api_?key|client_?secret)$/i;
 const ALLOWED_DATA_KEY = /^(?:selector|candidate|currentSelector|originalSelector|from|to|model|provider|chainKey|reason|skipReason|classification|thinkingLevel|durationMs|retryAfterMs|error|errorMessage|warning|trigger)$/;
 const SENSITIVE_TEXT = /((?:authorization\s*[:=]\s*(?:bearer|basic)\s+)|(?:bearer\s+)|(?:[?&](?:api[_-]?key|token|secret|password|auth(?:orization)?)=))[^\s&,"'}\]]+/gi;
+const unsettledLoggers = new Set();
+/** Resolves once every fallback logger created so far has finished its first-start removal and flushed its queue. */
+export async function settledFallbackLoggers() {
+    await Promise.all([...unsettledLoggers]);
+}
+function errorCode(failure) {
+    if (typeof failure === "object" && failure !== null && "code" in failure && typeof failure.code === "string") {
+        return failure.code;
+    }
+    return "unknown";
+}
 export function createFallbackLogger(agentDir, options = {}) {
     const filePath = join(agentDir, "logs", "fallback.log");
     const maxBytes = validMaxBytes(options.maxBytes);
     let reportedWriteFailure = false;
+    // Lines logged while the earlier generations are still being removed wait here, so the removal can never delete them.
+    // They are redacted before they enter the queue and the queue is bounded: the newest lines win, the drops are counted.
+    let queued = [];
+    let dropped = 0;
+    function write(line) {
+        try {
+            writeLine(filePath, line, maxBytes);
+        }
+        catch (error) {
+            if (!reportedWriteFailure) {
+                reportedWriteFailure = true;
+                console.error("Unable to write retry fallback debug log", error);
+            }
+        }
+    }
+    const settled = retireUnsharedRegistryGenerations(filePath)
+        .then(() => undefined)
+        .catch((error) => {
+        reportedWriteFailure = true;
+        console.error("Unable to remove earlier retry fallback debug log generations", error);
+        return error;
+    })
+        .then((failure) => {
+        const lines = queued ?? [];
+        queued = undefined;
+        for (const line of lines)
+            write(line);
+        if (dropped > 0) {
+            write(formatLine("warn", "queued_lines_dropped", {
+                reason: `${dropped} lines dropped while earlier log generations were removed`,
+            }));
+        }
+        if (failure !== undefined) {
+            // The code only: the error text names the agent dir's absolute path.
+            write(formatLine("warn", "retire_generations_failed", {
+                errorMessage: `removal failed: ${errorCode(failure)}`,
+            }));
+        }
+    });
+    unsettledLoggers.add(settled);
+    void settled.then(() => unsettledLoggers.delete(settled));
     function log(level, event, data) {
         try {
             const line = formatLine(level, event, data);
+            if (queued !== undefined) {
+                queued.push(redactSensitiveTokenValues(line, "[redacted]"));
+                if (queued.length > MAX_QUEUED_LINES) {
+                    queued.shift();
+                    dropped += 1;
+                }
+                return;
+            }
             writeLine(filePath, line, maxBytes);
         }
         catch (error) {
@@ -27,8 +89,23 @@ export function createFallbackLogger(agentDir, options = {}) {
         debug: (event, data) => log("debug", event, data),
         info: (event, data) => log("info", event, data),
         warn: (event, data) => log("warn", event, data),
+        settled: () => settled,
     };
 }
+/**
+ * Generations written before every engine copy in a process shared one resolved-value registry (omo#12965) are
+ * removed once per agent dir, the first time an engine with the shared registry starts on it; the marker makes every
+ * later start leave the logs alone.
+ */
+async function retireUnsharedRegistryGenerations(filePath) {
+    const marker = join(dirname(filePath), ".fallback-log-v2");
+    if (await access(marker).then(() => true, () => false))
+        return;
+    await rm(`${filePath}.1`, { force: true });
+    await rm(filePath, { force: true });
+    await mkdir(dirname(filePath), { recursive: true, mode: 0o700 });
+    await writeFile(marker, "", { mode: 0o600 });
+}
 function validMaxBytes(value) {
     return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : DEFAULT_MAX_BYTES;
 }
@@ -51,7 +128,7 @@ function formatLine(level, event, data) {
 }
 function writeLine(filePath, line, maxBytes) {
     mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
-    const text = `${line}\n`;
+    const text = `${redactSensitiveTokenValues(line, "[redacted]")}\n`;
     rotateLogIfNeeded(filePath, Buffer.byteLength(text), maxBytes);
     const descriptor = openSync(filePath, "a", 0o600);
     try {
@@ -66,13 +143,13 @@ function serializeValue(value, seen) {
     if (typeof value === "string")
         return safeText(value);
     if (typeof value === "bigint")
-        return value.toString();
+        return safeText(value.toString());
     if (typeof value === "number" || typeof value === "boolean" || value === null)
         return value;
     if (typeof value === "undefined")
         return undefined;
     if (typeof value === "function" || typeof value === "symbol")
-        return String(value);
+        return safeText(String(value));
     if (seen.has(value))
         return "[Circular]";
     seen.add(value);
@@ -83,7 +160,7 @@ function serializeValue(value, seen) {
         if (!BLOCKED_KEY.test(key)) {
             const safeValue = serializeValue(item, seen);
             if (safeValue !== undefined)
-                result[key] = safeValue;
+                result[safeText(key)] = safeValue;
         }
     }
     return result;

package/dist/core/retry-fallback/model-config-error.js

@@ -1,3 +1,4 @@
+import { redactSecrets } from "../sensitive-output.js";
 const EXCERPT_LIMIT = 500;
 /**
  * A model configuration error is never retried or fallen back: another model would answer a request the caller did
@@ -16,7 +17,7 @@ export function createModelConfigErrorReporter(logger, emit) {
             if (reported.has(key))
                 return;
             reported.add(key);
-            const errorMessage = message.errorMessage ?? "";
+            const errorMessage = redactSecrets(message.errorMessage ?? "");
             logger.warn("model_config_error", { model, provider: message.provider, errorMessage });
             emit({
                 type: "model_config_error",

package/dist/core/session-manager.d.ts

@@ -440,6 +440,8 @@ export declare class SessionManager {
     private _transcriptEntryBytes;
     private _serializedFileEntries;
     isPersisted(): boolean;
+    /** Give an unclaimed in-memory session its first file without rebuilding or changing its identity. */
+    enablePersistence(): Promise<void>;
     getCwd(): string;
     getSessionDir(): string;
     usesDefaultSessionDir(): boolean;

package/dist/core/session-manager.js

@@ -1,7 +1,7 @@
 import { getCurrentSystemMessage, normalizeProviderId } from "@earendil-works/pi-ai";
 import { randomBytes, randomUUID } from "crypto";
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readSync, rmSync, statSync, writeFileSync, } from "fs";
-import { appendFile, open, readdir, rm } from "fs/promises";
+import { appendFile, mkdir, open, readdir, rm } from "fs/promises";
 import { basename, join, resolve } from "path";
 import { StringDecoder } from "string_decoder";
 import { APP_NAME, getAgentDir as getDefaultAgentDir, getSessionsDir } from "../config.js";
@@ -1230,6 +1230,20 @@ export class SessionManager {
     isPersisted() {
         return this.persist;
     }
+    /** Give an unclaimed in-memory session its first file without rebuilding or changing its identity. */
+    async enablePersistence() {
+        if (this.persist)
+            return;
+        const dir = getDefaultSessionDirPath(this.cwd);
+        await mkdir(dir, { recursive: true });
+        const header = this.fileEntries[0];
+        const path = join(dir, `${header.timestamp.replace(/[:.]/g, "-")}_${this.sessionId}.jsonl`);
+        reserveSessionWrite(path);
+        this.sessionDir = dir;
+        this.sessionFile = path;
+        this.persist = true;
+        registerSessionWriter(this);
+    }
     getCwd() {
         return this.cwd;
     }

package/dist/core/settings-manager.d.ts

@@ -302,6 +302,12 @@ export declare class SettingsManager {
     getSettings(): Settings;
     getGlobalSettings(): Settings;
     getProjectSettings(): Settings;
+    /**
+     * `contextFiles.globalPath` from the user's own layers only: session overrides, then global
+     * settings. A project's `.senpi/settings.json` never redirects the user's global context file
+     * (senpi#5567), so the project layer is deliberately skipped.
+     */
+    getGlobalContextFilePath(): string | undefined;
     /** The project settings file at `path` as stored: parsed and migrated like a load, but never gated by trust. */
     readProjectSettingsFile(path: string): ProjectSettingsFile;
     /**

package/dist/core/settings-manager.js

@@ -697,6 +697,14 @@ export class SettingsManager {
     getProjectSettings() {
         return structuredClone(this.projectSettings);
     }
+    /**
+     * `contextFiles.globalPath` from the user's own layers only: session overrides, then global
+     * settings. A project's `.senpi/settings.json` never redirects the user's global context file
+     * (senpi#5567), so the project layer is deliberately skipped.
+     */
+    getGlobalContextFilePath() {
+        return this.runtimeOverrides.contextFiles?.globalPath ?? this.globalSettings.contextFiles?.globalPath;
+    }
     /** The project settings file at `path` as stored: parsed and migrated like a load, but never gated by trust. */
     readProjectSettingsFile(path) {
         let content;

package/dist/core/turn-origin.d.ts

@@ -1,17 +1,15 @@
-import type { SessionManager } from "./session-manager.ts";
 /**
- * Who started a turn, for the delegated-default permission rule (remote approval-mode work):
- * - `local`: a local connection's or the TUI's own input;
- * - `delegated`: input that arrived on a delegated (remote device) connection;
- * - `peer`: an agent's relayed delivery on a delegated connection the forwarder granted `peer_agent` (senpi#6305): it
- *   runs under the receiving session's own preset, as the session's own work does;
+ * Who started a turn, for the remote approval-mode rule (senpi#6342: a turn follows the permission setting of the machine
+ * it runs on, and no origin outlives the turn it started):
+ * - `local`: this machine's own input, or input from a device the forwarder stated is the same account;
+ * - `delegated`: input from a device the forwarder did not state is the same account, or the one run such a device's
+ *   record started;
  * - `engine`: a turn no client record started (an extension's message, a goal or loop turn, restored input).
  * A steer joins the running turn (`join`) and never changes its origin.
  */
-export type TurnOrigin = "local" | "delegated" | "peer" | "engine";
+export type TurnOrigin = "local" | "delegated" | "engine";
 export type InputTurnMark = TurnOrigin | "join";
 export type ConnectionOrigin = "local" | "delegated";
-type OriginSessionManager = Pick<SessionManager, "getEntries" | "appendCustomEntry">;
 /** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
 export declare function inputTurnMark(input: {
     readonly mode?: "steer" | "followUp";
@@ -23,11 +21,19 @@ export declare function markInputTurnOrigin(message: object, mark: InputTurnMark
 export declare function copyInputTurnMark(from: object, to: object): void;
 /** Whether a message carries an origin mark: a user message always opens a turn's origin, any other only when marked. */
 export declare function hasInputTurnMark(message: object): boolean;
-/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+/** Runs `handle`, and every async task it starts, as the record `origin` describes. */
+export declare function runInRecordScope<T>(origin: ConnectionOrigin, handle: () => Promise<T>): Promise<T>;
+/** Whether the work being created belongs to an open cross-account record's own handling. */
+export declare function recordIsDelegated(): boolean;
+/**
+ * A run starts as engine work, or as delegated work when a cross-account record's own handling starts it; a retry keeps
+ * the turn it continues. The user message that opens a turn sets its origin, a steer keeps it.
+ */
 export declare function noteRunStart(sessionManager: object): void;
+/** A retry or recovery run repeats the turn it continues, so it keeps that turn's origin until the continuation ends. */
+export declare function noteTurnContinuation(sessionManager: object): void;
+export declare function endTurnContinuation(sessionManager: object): void;
 export declare function noteUserMessageStart(sessionManager: object, message: object): void;
-export declare function recordDelegatedOrigin(sessionManager: OriginSessionManager): void;
-/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
-export declare function decidingTurnIsDelegated(sessionManager: Pick<SessionManager, "getEntries">): boolean;
-export {};
+/** Whether the deciding turn counts as delegated-origin: a cross-account device started this turn or this run. */
+export declare function decidingTurnIsDelegated(sessionManager: object): boolean;
 //# sourceMappingURL=turn-origin.d.ts.map

package/dist/core/turn-origin.js

@@ -1,13 +1,16 @@
-const DELEGATED_ORIGIN_ENTRY = "delegated_origin";
+import { AsyncLocalStorage } from "node:async_hooks";
 const inputMarks = new WeakMap();
 const currentOrigins = new WeakMap();
-const delegatedSessions = new WeakSet();
+const recordScopes = new AsyncLocalStorage();
+const continuingTurns = new WeakSet();
 /** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
 export function inputTurnMark(input) {
     if (input.mode === "steer")
         return "join";
     if (input.connectionOrigin !== undefined)
         return input.connectionOrigin;
+    if (recordIsDelegated())
+        return "delegated";
     return input.source === undefined || input.source === "interactive" ? "local" : "engine";
 }
 export function markInputTurnOrigin(message, mark) {
@@ -23,9 +26,34 @@ export function copyInputTurnMark(from, to) {
 export function hasInputTurnMark(message) {
     return inputMarks.has(message);
 }
-/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+/** Runs `handle`, and every async task it starts, as the record `origin` describes. */
+export function runInRecordScope(origin, handle) {
+    return recordScopes.run({ origin, open: true }, handle);
+}
+/** Whether the work being created belongs to an open cross-account record's own handling. */
+export function recordIsDelegated() {
+    const scope = recordScopes.getStore();
+    return scope?.open === true && scope.origin === "delegated";
+}
+/**
+ * A run starts as engine work, or as delegated work when a cross-account record's own handling starts it; a retry keeps
+ * the turn it continues. The user message that opens a turn sets its origin, a steer keeps it.
+ */
 export function noteRunStart(sessionManager) {
-    currentOrigins.set(sessionManager, "engine");
+    if (continuingTurns.has(sessionManager))
+        return;
+    const delegated = recordIsDelegated();
+    const scope = recordScopes.getStore();
+    if (scope !== undefined)
+        scope.open = false;
+    currentOrigins.set(sessionManager, delegated ? "delegated" : "engine");
+}
+/** A retry or recovery run repeats the turn it continues, so it keeps that turn's origin until the continuation ends. */
+export function noteTurnContinuation(sessionManager) {
+    continuingTurns.add(sessionManager);
+}
+export function endTurnContinuation(sessionManager) {
+    continuingTurns.delete(sessionManager);
 }
 export function noteUserMessageStart(sessionManager, message) {
     const mark = inputMarks.get(message);
@@ -33,32 +61,8 @@ export function noteUserMessageStart(sessionManager, message) {
         return;
     currentOrigins.set(sessionManager, mark ?? "engine");
 }
-export function recordDelegatedOrigin(sessionManager) {
-    if (delegatedOriginOf(sessionManager))
-        return;
-    delegatedSessions.add(sessionManager);
-    sessionManager.appendCustomEntry(DELEGATED_ORIGIN_ENTRY, { delegatedOrigin: true }, { startupBookkeeping: true });
-}
-// How many entries a session's scan has already found free of the marker: each gated decision reads only new entries.
-const scannedEntries = new WeakMap();
-function delegatedOriginOf(sessionManager) {
-    if (delegatedSessions.has(sessionManager))
-        return true;
-    const entries = sessionManager.getEntries();
-    const persisted = entries
-        .slice(scannedEntries.get(sessionManager) ?? 0)
-        .some((entry) => entry.type === "custom" && entry.customType === DELEGATED_ORIGIN_ENTRY);
-    if (persisted)
-        delegatedSessions.add(sessionManager);
-    else
-        scannedEntries.set(sessionManager, entries.length);
-    return persisted;
-}
-/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
+/** Whether the deciding turn counts as delegated-origin: a cross-account device started this turn or this run. */
 export function decidingTurnIsDelegated(sessionManager) {
-    const origin = currentOrigins.get(sessionManager) ?? "engine";
-    if (origin === "delegated")
-        return true;
-    return origin === "engine" && delegatedOriginOf(sessionManager);
+    return currentOrigins.get(sessionManager) === "delegated";
 }
 //# sourceMappingURL=turn-origin.js.map

package/dist/core/ultrafast-lanes.d.ts

@@ -4,5 +4,6 @@ export declare function serviceTierForProvider(provider: string | undefined, ser
 export declare function ultrafastSelectionWarning(model: {
     readonly provider: string;
     readonly id: string;
+    readonly upstreamModelId?: string;
 }, serviceTier: ServiceTier | undefined): string | undefined;
 //# sourceMappingURL=ultrafast-lanes.d.ts.map