@code-yeongyu/senpi 2026.11.10 → 2026.11.11

package/dist/core/extensions/builtin/goal/monitor-continuation.js

@@ -1,4 +1,5 @@
 import { deadlineStopPendingSinceLastTurn } from "../../../turn-deadline.js";
+import { subscribeProviderAccountEvents } from "../anthropic-subscription/account-events.js";
 import { isHumanInputMonitorNotification } from "../monitor-state-event.js";
 import { createGoalCacheWarmScheduleData, estimateCacheWarmMetrics, GOAL_CACHE_WARMUP_ENTRY_TYPE, GOAL_MONITOR_CONTINUATION_FALLBACK_DELAY_MS, resolveGoalBackstopMaxSecondsForCache, resolveGoalMonitorContinuationDelayMs, resolveGoalPromptCacheLifetime, } from "./cache-warm.js";
 import { subscribeGoalChannelState } from "./channel-state-subscriptions.js";
@@ -9,7 +10,7 @@ import { lastAssistantMessage } from "./last-assistant-message.js";
 import { admitAndQueueGoalContinuation, buildCurrentGoalContinuationSignature, isLastTurnStuckOnContextOverflow, lastAssistantText, } from "./lifecycle-helpers.js";
 import { findParkedGoalWait } from "./parked-wait.js";
 import { buildContinuationPrompt, buildGoalStallNotice, buildTruncationRecoveryPrompt } from "./prompt.js";
-import { exhaustedLadderResumeDelayMs, PROVIDER_RETRY_BASE_MS, providerRetryAt, providerRetryDelayMs, } from "./provider-retry.js";
+import { exhaustedLadderResumeDelayMs, GOAL_LIMIT_WAIT_WAKE_LIMIT, isLimitRefusal, limitWaitFloorMs, PROVIDER_RETRY_BASE_MS, providerRetryAt, providerRetryDelayMs, } from "./provider-retry.js";
 import { isStaleExtensionContextError } from "./stale-context.js";
 import { resetContinuationStreak } from "./store.js";
 import { goalStoreRef } from "./store-ref.js";
@@ -22,6 +23,8 @@ export const GOAL_CONTINUATION_SCHEDULED_EVENT = "goal_continuation_scheduled";
 export const GOAL_CONTINUATION_RESUMED_EVENT = "goal_continuation_resumed";
 export const GOAL_CONTINUATION_TIMER_STATE_EVENT = "goal_continuation_timer_state";
 export const GOAL_MONITOR_STALL_EVENT = "goal_monitor_continuation_stall";
+/** A limit outlasted GOAL_LIMIT_WAIT_WAKE_LIMIT re-checks: the goal waits for a sign-in, a block reset or input. */
+const GOAL_LIMIT_WAIT_PARKED_EVENT = "goal_limit_wait_parked";
 /** The one notice a provider-limit park shows: when the goal resumes, in local time and as the exact instant. */
 function providerPauseNotice(retryAt) {
     const local = new Date(retryAt).toLocaleString("en-US", {
@@ -68,12 +71,51 @@ export class MonitorAwareGoalContinuation {
     #pendingProviderRecovery;
     #providerRetryAttempts = 0;
     #providerRetryDelayMs;
+    /** The armed provider retry waits out a usage or rate limit, so its wake spends no continuation budget (senpi#4085). */
+    #limitWait = false;
+    #limitWakes = 0;
+    #limitParked = false;
     constructor(pi, isContinuationPending = () => false, markContinuationPending = () => { }, waitTicker) {
         this.#pi = pi;
         this.#isContinuationPending = isContinuationPending;
         this.#markContinuationPending = markContinuationPending;
         this.#waitTicker = waitTicker;
         this.#subscribeToChannelState();
+        // A login or an explicit block reset can end the wait early: re-check the provider now (senpi#4085).
+        this.#channelStateUnsubscribers.push(subscribeProviderAccountEvents((event) => {
+            if (event.type === "accounts_changed" && event.remedy !== undefined)
+                this.#wakeLimitWait();
+        }));
+    }
+    #wakeLimitWait() {
+        const goal = this.#goal;
+        const waiting = this.#scheduledContinuationKind === "providerRetry" || this.#limitParked;
+        if (!this.#limitWait || !waiting || goal === null)
+            return;
+        this.#limitWakes = 0;
+        this.#limitParked = false;
+        this.#cancelTimer();
+        this.#providerRetryDelayMs = 0;
+        this.#schedule(goal, "providerRetry");
+    }
+    /**
+     * Arms the next re-check of a limit wait, never sooner than the provider backoff. A limit that outlasts
+     * GOAL_LIMIT_WAIT_WAKE_LIMIT re-checks parks the goal, still active, until a sign-in, a block reset or input.
+     */
+    #armLimitWait(goal, delayMs) {
+        this.#limitWait = true;
+        this.#limitWakes += 1;
+        if (this.#limitWakes > GOAL_LIMIT_WAIT_WAKE_LIMIT) {
+            this.#limitParked = true;
+            this.#publish(GOAL_LIMIT_WAIT_PARKED_EVENT, { goalId: goal.id, wakes: GOAL_LIMIT_WAIT_WAKE_LIMIT });
+            if (this.#ctxHasUI()) {
+                this.#ctx?.ui.notify(`Goal paused: the provider kept refusing for a usage limit through ${GOAL_LIMIT_WAIT_WAKE_LIMIT} re-checks. It resumes after a sign-in, an account block reset, or your next message.`, "warning");
+            }
+            return false;
+        }
+        this.#providerRetryDelayMs = Math.max(delayMs, limitWaitFloorMs(this.#providerRetryAttempts));
+        this.#schedule(goal, "providerRetry");
+        return true;
     }
     start(ctx) {
         this.#cancelTimer();
@@ -91,6 +133,9 @@ export class MonitorAwareGoalContinuation {
         if (options.goal?.id !== this.#goal?.id)
             this.#resetContinuationState();
         this.#providerRetryAttempts = 0;
+        this.#limitWait = false;
+        this.#limitWakes = 0;
+        this.#limitParked = false;
         this.#ctx = options.ctx;
         this.#goal = options.goal;
         this.#lastAgentEndMessages = options.messages;
@@ -214,9 +259,18 @@ export class MonitorAwareGoalContinuation {
             return undefined;
         }
         this.#providerRetryAttempts += 1;
+        this.#limitWait = isLimitRefusal(pendingProvider.messages);
         const now = Date.now();
         const retryAt = providerRetryAt(pendingProvider.messages, now);
         const delayMs = providerRetryDelayMs(this.#providerRetryAttempts, retryAt, now);
+        if (this.#limitWait) {
+            this.#cancelTimer();
+            const armed = this.#armLimitWait(pendingProvider.goal, delayMs);
+            if (armed && retryAt !== undefined && this.#ctxHasUI(pendingProvider.ctx)) {
+                pendingProvider.ctx.ui.notify(providerPauseNotice(retryAt), "info");
+            }
+            return pendingProvider.goal;
+        }
         if (delayMs > 0) {
             this.#cancelTimer();
             this.#providerRetryDelayMs = delayMs;
@@ -230,17 +284,16 @@ export class MonitorAwareGoalContinuation {
     }
     /**
      * senpi#3709: every fallback rung failed, so a continuation now would hit the same limits. Park on
-     * the soonest reset the run named and resume once; with no known reset, stay parked until input.
+     * the soonest reset the run named; with no known reset, re-check on the provider backoff (senpi#4085).
      */
     #parkUntilLadderReset(resumeAt) {
         const goal = this.#goal;
         if (goal?.status !== "active")
             return undefined;
         this.#cancelTimer();
-        if (resumeAt === undefined)
-            return goal;
-        this.#providerRetryDelayMs = exhaustedLadderResumeDelayMs(resumeAt, Date.now());
-        this.#schedule(goal, "providerRetry");
+        this.#providerRetryAttempts += 1;
+        // No failure named a reset: re-check on the provider backoff (15 s doubling to 30 min) rather than wait for input.
+        this.#armLimitWait(goal, resumeAt === undefined ? 0 : exhaustedLadderResumeDelayMs(resumeAt, Date.now()));
         return goal;
     }
     syncGoal(goal) {
@@ -521,7 +574,10 @@ export class MonitorAwareGoalContinuation {
             this.#resetCacheWarmIteration();
     }
     async #admitAndQueue(ctx, goal, path, messages) {
-        const input = this.#buildVerdictInput(ctx, goal, path, messages);
+        const input = {
+            ...this.#buildVerdictInput(ctx, goal, path, messages),
+            ...(path === "providerRecovery" && this.#limitWait ? { limitWait: true } : {}),
+        };
         const verdict = evaluateGoalContinuation({ goal, ...input });
         const admittedGoal = await admitAndQueueGoalContinuation(this.#pi, ctx, goal, {
             input,
@@ -747,6 +803,9 @@ export class MonitorAwareGoalContinuation {
         this.#pendingSystemRecovery = undefined;
         this.#pendingProviderRecovery = undefined;
         this.#providerRetryAttempts = 0;
+        this.#limitWait = false;
+        this.#limitWakes = 0;
+        this.#limitParked = false;
         this.#consecutiveLengthRecoveries.clear();
         this.#recentNormalizedOutputHashes = [];
         this.#recentToolEffects = [];

package/dist/core/extensions/builtin/goal/persistence.js

@@ -318,8 +318,28 @@ function sanitizeContinuationState(goal) {
         delete next.lastContinuationSignature;
     if (!isNonNegativeSafeInteger(next.continuationStoppedAt))
         delete next.continuationStoppedAt;
+    if (!isValidContinuationStoppedDetail(next.continuationStoppedDetail)) {
+        delete next.continuationStoppedDetail;
+    }
+    // The detail only means something with its claim; never keep a stale payload past the claim.
+    if (next.continuationStoppedAt === undefined)
+        delete next.continuationStoppedDetail;
     return next;
 }
+/** A stop-publication payload is usable only with a known deny reason and non-negative counters. */
+function isValidContinuationStoppedDetail(value) {
+    if (!isRecord(value))
+        return false;
+    return ((value.reason === "cap" ||
+        value.reason === "stale" ||
+        value.reason === "repetition" ||
+        value.reason === "length-exhausted" ||
+        value.reason === "no-progress" ||
+        value.reason === "context-overflow") &&
+        isNonNegativeSafeInteger(value.consecutiveContinuations) &&
+        isNonNegativeSafeInteger(value.unattendedContinuations) &&
+        isNonNegativeSafeInteger(value.noProgressContinuations));
+}
 function isMissingFile(error) {
     return isFileSystemError(error, "ENOENT");
 }

package/dist/core/extensions/builtin/goal/provider-retry.d.ts

@@ -7,6 +7,15 @@ export declare const PROVIDER_RETRY_WAKE_CAP_MS: number;
  * pool guidance falls back to the earliest future ISO instant in the error only.
  */
 export declare function providerRetryAt(messages: readonly AgentMessage[], now: number): number | undefined;
+/** Re-checks of a limit that never clears before the goal parks until a sign-in, a block reset or input (senpi#4085). */
+export declare const GOAL_LIMIT_WAIT_WAKE_LIMIT = 48;
+/** The shortest wait before the `attempt`-th limit re-check: the provider backoff, 15 s doubling to 30 min. */
+export declare function limitWaitFloorMs(attempt: number): number;
+/**
+ * The turn ended on a provider refusing for a usage or rate limit, not on an outage (senpi#4085). An OpenAI-compatible
+ * adapter reports a bare 429 as a status-only diagnostic (`unknown` + 429); that status is still a limit.
+ */
+export declare function isLimitRefusal(messages: readonly AgentMessage[]): boolean;
 /**
  * How long to wait before the `attempt`-th consecutive provider-recovery
  * continuation (senpi#3264). A stated unblock time is the wake; otherwise the

package/dist/core/extensions/builtin/goal/provider-retry.js

@@ -31,6 +31,22 @@ export function providerRetryAt(messages, now) {
         .filter((at) => Number.isFinite(at) && at > now);
     return instants.length === 0 ? undefined : Math.min(...instants);
 }
+/** Re-checks of a limit that never clears before the goal parks until a sign-in, a block reset or input (senpi#4085). */
+export const GOAL_LIMIT_WAIT_WAKE_LIMIT = 48;
+/** The shortest wait before the `attempt`-th limit re-check: the provider backoff, 15 s doubling to 30 min. */
+export function limitWaitFloorMs(attempt) {
+    return Math.min(PROVIDER_RETRY_CAP_MS, PROVIDER_RETRY_BASE_MS * 2 ** (Math.max(1, attempt) - 1));
+}
+/**
+ * The turn ended on a provider refusing for a usage or rate limit, not on an outage (senpi#4085). An OpenAI-compatible
+ * adapter reports a bare 429 as a status-only diagnostic (`unknown` + 429); that status is still a limit.
+ */
+export function isLimitRefusal(messages) {
+    const diagnostic = lastAssistantMessage(messages)?.providerDiagnostic;
+    return (diagnostic?.category === "rate_limit" ||
+        diagnostic?.category === "quota" ||
+        (diagnostic?.category === "unknown" && diagnostic.httpStatus === 429));
+}
 /**
  * How long to wait before the `attempt`-th consecutive provider-recovery
  * continuation (senpi#3264). A stated unblock time is the wake; otherwise the

package/dist/core/extensions/builtin/goal/reload-reengagement.d.ts

@@ -1,5 +1,6 @@
 import type { ExtensionContext } from "../../types.ts";
 import type { MonitorAwareGoalContinuation } from "./monitor-continuation.ts";
+import type { TrailingGoalContinuations } from "./session-start-continuation.ts";
 import type { Goal } from "./types.ts";
 export type ReloadReengagementOutcome = "skipped-inactive" | "backstop-rearmed" | "suppressed-flood" | "continuation-queued";
 /**
@@ -24,7 +25,7 @@ export declare function reengageGoalAfterReload(options: {
     readonly ctx: ExtensionContext;
     readonly goal: Goal;
     readonly monitor: MonitorAwareGoalContinuation;
-    readonly countTrailingContinuations: () => number;
-    readonly queueContinuation: () => Promise<void>;
+    readonly readTrailingContinuations: () => TrailingGoalContinuations;
+    readonly queueContinuation: (limitWait: boolean) => Promise<void>;
 }): Promise<ReloadReengagementOutcome>;
 //# sourceMappingURL=reload-reengagement.d.ts.map

package/dist/core/extensions/builtin/goal/reload-reengagement.js

@@ -30,12 +30,12 @@ export async function reengageGoalAfterReload(options) {
         monitor.rearmMonitorBackstop(goal);
         return "backstop-rearmed";
     }
-    const trailingContinuations = options.countTrailingContinuations();
-    if (trailingContinuations >= GOAL_CONTINUATION_CAP) {
-        ctx.ui.notify(`Goal auto-continuation suppressed for this resumed session (${trailingContinuations} historical continuations). Send a message to resume.`, "info");
+    const trailing = options.readTrailingContinuations();
+    if (trailing.counted >= GOAL_CONTINUATION_CAP) {
+        ctx.ui.notify(`Goal auto-continuation suppressed for this resumed session (${trailing.counted} historical continuations). Send a message to resume.`, "info");
         return "suppressed-flood";
     }
-    await options.queueContinuation();
+    await options.queueContinuation(trailing.waitingOutLimit);
     return "continuation-queued";
 }
 //# sourceMappingURL=reload-reengagement.js.map

package/dist/core/extensions/builtin/goal/session-start-continuation.d.ts

@@ -0,0 +1,28 @@
+import type { SessionEntry } from "../../../session-manager.ts";
+import type { ExtensionAPI, ExtensionContext } from "../../types.ts";
+import type { Goal } from "./types.ts";
+export type TrailingGoalContinuations = {
+    /** Continuations whose turn ran: the unattended loop the load-time flood guard bounds. */
+    readonly counted: number;
+    /** The newest continuation was refused for a usage or rate limit, so the goal was waiting that limit out. */
+    readonly waitingOutLimit: boolean;
+};
+export type SessionStartContinuationOptions = {
+    readonly continuationPending: boolean;
+    readonly markContinuationPending: () => void;
+    /** The session opened in the middle of a limit wait, so this wake re-checks that limit (senpi#4085). */
+    readonly limitWait?: boolean;
+};
+/**
+ * Reads the goal continuations queued since the most recent real user message in the branch (mirrors the
+ * todo-gate / todo-bridge backward branch read). A real user message is the only reset: the assistant turns in
+ * between are exactly the unattended loop the load-time admission guard exists to stop.
+ *
+ * A continuation the provider refused for a usage or rate limit ran no model turn, so it is not part of that
+ * loop (senpi#4085). A goal that waited a limit out for more wakes than the cap is therefore not a flood, and it
+ * resumes after a restart or a config reload.
+ */
+export declare function readTrailingGoalContinuations(entries: readonly SessionEntry[]): TrailingGoalContinuations;
+/** Routes startup and resume continuations through the same verdict and delivery accounting as agent-end paths. */
+export declare function queueGoalContinuation(pi: ExtensionAPI, ctx: ExtensionContext, goal: Goal, options: SessionStartContinuationOptions): Promise<Goal | null>;
+//# sourceMappingURL=session-start-continuation.d.ts.map

package/dist/core/extensions/builtin/goal/session-start-continuation.js

@@ -0,0 +1,75 @@
+import { GOAL_CONTINUATION_MESSAGE_TYPE } from "../../../messages.js";
+import { admitAndQueueGoalContinuation, buildCurrentGoalContinuationSignature, isLastTurnStuckOnContextOverflow, lastAssistantText, } from "./lifecycle-helpers.js";
+import { buildContinuationPrompt } from "./prompt.js";
+import { isLimitRefusal } from "./provider-retry.js";
+/**
+ * Reads the goal continuations queued since the most recent real user message in the branch (mirrors the
+ * todo-gate / todo-bridge backward branch read). A real user message is the only reset: the assistant turns in
+ * between are exactly the unattended loop the load-time admission guard exists to stop.
+ *
+ * A continuation the provider refused for a usage or rate limit ran no model turn, so it is not part of that
+ * loop (senpi#4085). A goal that waited a limit out for more wakes than the cap is therefore not a flood, and it
+ * resumes after a restart or a config reload.
+ */
+export function readTrailingGoalContinuations(entries) {
+    let counted = 0;
+    let waitingOutLimit;
+    let turn = [];
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type === "message") {
+            if (entry.message.role === "user")
+                break;
+            if (entry.message.role === "assistant")
+                turn.push(entry.message);
+            continue;
+        }
+        if (entry?.type !== "custom_message" || entry.customType !== GOAL_CONTINUATION_MESSAGE_TYPE)
+            continue;
+        const refused = wasRefusedForLimit(turn);
+        waitingOutLimit ??= refused;
+        if (!refused)
+            counted += 1;
+        turn = [];
+    }
+    return { counted, waitingOutLimit: waitingOutLimit ?? false };
+}
+function wasRefusedForLimit(turn) {
+    return (turn.length > 0 &&
+        turn.every((message) => message.stopReason === "error") &&
+        turn.some((message) => isLimitRefusal([message])));
+}
+/** Routes startup and resume continuations through the same verdict and delivery accounting as agent-end paths. */
+export async function queueGoalContinuation(pi, ctx, goal, options) {
+    const lastAssistant = lastAssistantFromEntries(ctx.sessionManager.getBranch());
+    const signature = buildCurrentGoalContinuationSignature(ctx, goal, lastAssistant === undefined ? "" : lastAssistantText([lastAssistant]));
+    return admitAndQueueGoalContinuation(pi, ctx, goal, {
+        input: {
+            isIdle: ctx.isIdle(),
+            hasPendingMessages: ctx.hasPendingMessages(),
+            path: "sessionStart",
+            lastStopReason: undefined,
+            lastTurnWasMalformedToolUse: false,
+            consecutiveContinuations: goal.consecutiveContinuations ?? 0,
+            lastContinuationSignature: goal.lastContinuationSignature,
+            currentSignature: signature,
+            consecutiveLengthRecoveries: 0,
+            recentNormalizedOutputHashes: [],
+            toollessContinuationStreak: 0,
+            continuationPending: options.continuationPending,
+            lastTurnStuckOnContextOverflow: isLastTurnStuckOnContextOverflow(ctx, lastAssistant),
+            ...(options.limitWait === true ? { limitWait: true } : {}),
+        },
+        content: () => buildContinuationPrompt(goal, { modelId: ctx.model?.id }),
+        markContinuationPending: options.markContinuationPending,
+    });
+}
+function lastAssistantFromEntries(entries) {
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type === "message" && entry.message.role === "assistant")
+            return entry.message;
+    }
+    return undefined;
+}
+//# sourceMappingURL=session-start-continuation.js.map

package/dist/core/extensions/builtin/goal/store.d.ts

@@ -1,5 +1,5 @@
 import { goalFilePath } from "./persistence.ts";
-import type { Goal, GoalAccountingMode, GoalStoreRef, GoalUpdate, GoalUpdateSource, TokenUsageSnapshot } from "./types.ts";
+import type { Goal, GoalAccountingMode, GoalContinuationStoppedDetail, GoalStoreRef, GoalUpdate, GoalUpdateSource, TokenUsageSnapshot } from "./types.ts";
 export { goalFilePath };
 export declare function goalHistoryFilePath(ref: GoalStoreRef): string;
 export declare function objectiveFullTextFileName(ref: GoalStoreRef): string;
@@ -15,13 +15,14 @@ export declare function clearGoal(ref: GoalStoreRef): Promise<boolean>;
 export declare function accountGoalUsage(ref: GoalStoreRef, usage: TokenUsageSnapshot, elapsedSeconds: number, mode?: GoalAccountingMode, expectedGoalId?: string): Promise<Goal | null>;
 export declare function recordContinuationDelivered(ref: GoalStoreRef, signature: string, expectedGoalId?: string, options?: {
     countUnattended?: boolean;
+    countStreak?: boolean;
 }): Promise<Goal | null>;
 export declare function resetContinuationStreak(ref: GoalStoreRef, options?: {
     unattended?: boolean;
     progress?: boolean;
 }): Promise<Goal | null>;
 /** Claims one denial under the same lock as input/reset, so evaluation retries cannot append another stop. */
-export declare function recordGoalContinuationStopped(ref: GoalStoreRef, expected: Goal, at: number, blockedReason: string | undefined): Promise<{
+export declare function recordGoalContinuationStopped(ref: GoalStoreRef, expected: Goal, at: number, blockedReason: string | undefined, detail: GoalContinuationStoppedDetail): Promise<{
     goal: Goal | null;
     recorded: boolean;
 }>;

package/dist/core/extensions/builtin/goal/store.js

@@ -111,6 +111,7 @@ export async function updateGoal(ref, update, source = "model") {
             next.noProgressContinuations = 0;
             delete next.lastContinuationSignature;
             delete next.continuationStoppedAt;
+            delete next.continuationStoppedDetail;
         }
         if (source === "user" && requestedStatus === "active") {
             next.consecutiveContinuations = 0;
@@ -118,6 +119,7 @@ export async function updateGoal(ref, update, source = "model") {
             next.noProgressContinuations = 0;
             delete next.lastContinuationSignature;
             delete next.continuationStoppedAt;
+            delete next.continuationStoppedDetail;
             next.lastStartedAt ??= nowSeconds();
         }
         if (tokenBudget === undefined)
@@ -175,12 +177,13 @@ export async function recordContinuationDelivered(ref, signature, expectedGoalId
         const counted = options.countUnattended === false ? 0 : 1;
         const next = {
             ...goal,
-            consecutiveContinuations: (goal.consecutiveContinuations ?? 0) + 1,
+            consecutiveContinuations: (goal.consecutiveContinuations ?? 0) + (options.countStreak === false ? 0 : 1),
             unattendedContinuations: (goal.unattendedContinuations ?? 0) + counted,
             noProgressContinuations: (goal.noProgressContinuations ?? 0) + counted,
             lastContinuationSignature: signature,
         };
         delete next.continuationStoppedAt;
+        delete next.continuationStoppedDetail;
         if (next.status === "active")
             next.lastStartedAt ??= nowSeconds();
         await held.write(next);
@@ -199,6 +202,7 @@ export async function resetContinuationStreak(ref, options = {}) {
             next.noProgressContinuations = 0;
         delete next.lastContinuationSignature;
         delete next.continuationStoppedAt;
+        delete next.continuationStoppedDetail;
         if (options.unattended === true && next.status === "active")
             next.lastStartedAt ??= nowSeconds();
         await held.write(next);
@@ -206,7 +210,7 @@ export async function resetContinuationStreak(ref, options = {}) {
     });
 }
 /** Claims one denial under the same lock as input/reset, so evaluation retries cannot append another stop. */
-export async function recordGoalContinuationStopped(ref, expected, at, blockedReason) {
+export async function recordGoalContinuationStopped(ref, expected, at, blockedReason, detail) {
     return withGoalFileLock(ref, async (held) => {
         const current = await readGoalFile(ref);
         if (current?.id !== expected.id ||
@@ -230,6 +234,9 @@ export async function recordGoalContinuationStopped(ref, expected, at, blockedRe
         }
         delete next.lastStartedAt;
         next.continuationStoppedAt = at;
+        // The claim alone cannot rebuild the session entries; keep the denied payload with it so a later
+        // session start can re-append exactly the entries a crash swallowed (senpi#3015).
+        next.continuationStoppedDetail = detail;
         await held.write(next);
         return { goal: next, recorded: true };
     });

package/dist/core/extensions/builtin/goal/types.d.ts

@@ -8,6 +8,13 @@ export type GoalStoreRef = {
 };
 export type GoalAccountingMode = "active" | "activeOrBlocked" | "activeOrComplete";
 export type GoalUpdateSource = "model" | "user";
+/** Deny reason + counters captured with a stop claim, so a later session start can re-append the stop entries if the process died between the claim and the append (senpi#3015). */
+export type GoalContinuationStoppedDetail = {
+    reason: "cap" | "stale" | "repetition" | "length-exhausted" | "no-progress" | "context-overflow";
+    consecutiveContinuations: number;
+    unattendedContinuations: number;
+    noProgressContinuations: number;
+};
 export type Goal = {
     id: string;
     threadId: string;
@@ -22,6 +29,8 @@ export type Goal = {
     lastContinuationSignature?: string;
     /** Durable claim for a stopped continuation; cleared by input, resume, or a delivered continuation. */
     continuationStoppedAt?: number;
+    /** Stop-publication payload captured with the claim; cleared together with it. */
+    continuationStoppedDetail?: GoalContinuationStoppedDetail;
     createdAt: number;
     updatedAt: number;
     lastStartedAt?: number;

package/dist/core/extensions/builtin/handoff-hint/index.js

@@ -5,6 +5,7 @@ import { readGoal } from "../goal/store.js";
 import { goalStoreRef } from "../goal/store-ref.js";
 import { buildHandoffBrief } from "./brief.js";
 import { estimateHandoff, hintText } from "./estimate.js";
+import { createReplacementRelay } from "./replacement-relay.js";
 export const HANDOFF_HINT_ENTRY_TYPE = "handoff-hint";
 export const HANDOFF_BRIEF_MESSAGE_TYPE = "handoff-brief";
 export const HANDOFF_HINT_EVENT = "handoff_hint";
@@ -51,6 +52,7 @@ const readActiveGoal = (ctx) => readGoal(goalStoreRef(ctx.sessionManager, ctx.cw
 export function createHandoffHintExtension(dependencies = {}) {
     const now = dependencies.now ?? Date.now;
     const goalOf = dependencies.readGoal ?? readActiveGoal;
+    const acceptances = createReplacementRelay();
     return (pi) => {
         let ctx;
         let timer;
@@ -168,22 +170,21 @@ export function createHandoffHintExtension(dependencies = {}) {
                 previousSessionFile: current.sessionManager.getSessionFile(),
                 contextTokens: usage?.tokens ?? estimate?.contextTokens ?? 0,
             });
-            const accepted = estimate === undefined ? undefined : hintEvent("accepted", current, estimate);
             const sessionId = current.sessionManager.getSessionId();
+            const previousSessionFile = current.sessionManager.getSessionFile();
+            // The replacement's session_start emits it through the new generation's pi (senpi#4051).
+            if (estimate !== undefined)
+                acceptances.hold(previousSessionFile, hintEvent("accepted", current, estimate));
             hide(current);
-            const result = await current.newSession({
-                parentSession: current.sessionManager.getSessionFile(),
+            const switching = current.newSession({
+                parentSession: previousSessionFile,
                 withSession: async (next) => {
                     await next.sendMessage({ customType: HANDOFF_BRIEF_MESSAGE_TYPE, content: brief, display: true }, { triggerTurn: false });
                 },
             });
-            if (result.cancelled) {
-                if (estimate !== undefined && current.sessionManager.getSessionId() === sessionId)
-                    render(current, estimate);
-                return;
-            }
-            if (accepted !== undefined)
-                pi.events?.emit(HANDOFF_HINT_EVENT, accepted);
+            const result = await switching.finally(() => acceptances.release(previousSessionFile));
+            if (result.cancelled && estimate !== undefined && current.sessionManager.getSessionId() === sessionId)
+                render(current, estimate);
         }
         pi.registerCommand(HANDOFF_COMMAND, {
             description: "Start a fresh session seeded with a short handoff brief (`/handoff keep` hides the hint)",
@@ -207,8 +208,11 @@ export function createHandoffHintExtension(dependencies = {}) {
                 await startFresh(current);
             },
         });
-        pi.on("session_start", (_event, next) => {
+        pi.on("session_start", (event, next) => {
             ctx = next;
+            const accepted = event.reason === "new" ? acceptances.take(event.previousSessionFile) : undefined;
+            if (accepted !== undefined)
+                pi.events?.emit(HANDOFF_HINT_EVENT, accepted);
             disarm();
             visible = undefined;
             shownThisCrossing = false;

package/dist/core/extensions/builtin/handoff-hint/replacement-relay.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Carries a value from a session to the session that replaces it (senpi#4051).
+ *
+ * `newSession()` retires the old extension generation before the replacement starts, so a captured `pi` cannot emit
+ * after the switch, and emitting before it would report a switch that `session_before_switch` may still cancel. The
+ * builtin factory outlives both generations in one process, so the value waits here, keyed by the session being
+ * replaced, until the replacement's `session_start` takes it through its own live `pi`. The holder releases its key
+ * once `newSession()` settles, so a cancelled or failed switch delivers nothing.
+ */
+export interface ReplacementRelay<T> {
+    hold(previousSessionFile: string | undefined, value: T): void;
+    take(previousSessionFile: string | undefined): T | undefined;
+    release(previousSessionFile: string | undefined): void;
+}
+export declare function createReplacementRelay<T>(): ReplacementRelay<T>;
+//# sourceMappingURL=replacement-relay.d.ts.map

package/dist/core/extensions/builtin/handoff-hint/replacement-relay.js

@@ -0,0 +1,17 @@
+export function createReplacementRelay() {
+    const pending = new Map();
+    return {
+        hold: (previousSessionFile, value) => {
+            pending.set(previousSessionFile, value);
+        },
+        take: (previousSessionFile) => {
+            const value = pending.get(previousSessionFile);
+            pending.delete(previousSessionFile);
+            return value;
+        },
+        release: (previousSessionFile) => {
+            pending.delete(previousSessionFile);
+        },
+    };
+}
+//# sourceMappingURL=replacement-relay.js.map

package/dist/core/extensions/builtin/html-render/tool.js

@@ -1,6 +1,7 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Type } from "typebox";
+import { resolvePromptSurface } from "../../../dynamic-prompt/build.js";
 import { defineTool } from "../../types.js";
 import { injectHtmlRenderBootstrap } from "./bootstrap.js";
 import { inlineLocalImages } from "./images.js";
@@ -36,6 +37,13 @@ function assertWithinInputLimit(html) {
     throw new Error(`The page is ${html.length} characters; show_html_page accepts at most ${MAX_HTML_CHARACTERS} characters.${advice}`);
 }
 const clampHeight = (height) => height === undefined ? undefined : Math.min(2000, Math.max(80, Math.round(height)));
+/**
+ * Whether this session's host shows the page. The OmO desktop opens every session it renders with
+ * `open_session.promptSurface: "app"` and publishes a completed call from its details; every other
+ * surface (terminal, chat bridge, or none named) only gets the file. The result states which happened,
+ * because the model trusts it in later turns too (senpi#6273).
+ */
+const hostRendersPage = (ctx) => (ctx.getSystemPromptOptions?.().surface ?? resolvePromptSurface(process.env)) === "app";
 export const showHtmlPageTool = defineTool({
     name: "show_html_page",
     label: "Show HTML Page",
@@ -46,8 +54,8 @@ export const showHtmlPageTool = defineTool({
         "Local images written as absolute file paths " +
         "are inlined automatically after a magic-byte check (a renamed non-image is refused); pass screenshots " +
         "that way, never as base64 data: URIs, since the page is limited to 512000 characters before images are " +
-        "inlined. In the desktop thread this renders inline above your " +
-        "reply; elsewhere it is written to a file you can open in the desktop.",
+        "inlined. In the OmO desktop thread the page renders inline above your reply; elsewhere it is only " +
+        "saved to a file and not displayed. The result says which happened.",
     exposure: "search",
     allowLazyActivation: true,
     searchKeywords: ["html", "chart", "table", "diagram", "visualize", "render page", "mockup"],
@@ -71,7 +79,9 @@ export const showHtmlPageTool = defineTool({
             content: [
                 {
                     type: "text",
-                    text: `Wrote the page to ${path}. Open it in the desktop to see it rendered with your theme. ` +
+                    text: (hostRendersPage(ctx)
+                        ? `The page was shown to the reader inline above your reply. A copy is saved at ${path}. `
+                        : `Wrote the page to ${path}. It was not displayed in this interface. `) +
                         (missing === undefined
                             ? "Local images were inlined."
                             : `Some local images could not be read and were left as written: ${missing.join(", ")}.`),

package/dist/core/extensions/builtin/imagegen/skill/SKILL.md

@@ -12,7 +12,7 @@ How to get the image right the first time, and how to fix it fast when it is not
 When image generation tooling is present in your tool set, pick the surface that actually exists right now:
 
 - If a native `image_generation` server tool is available, use it. The provider runs generation server-side and returns the image in the response stream.
-- Otherwise, call the `generate_image` tool. It sends your prompt and optional reference images to the configured OpenAI-compatible endpoint and saves the result as a png, jpeg, or webp file. The model, quality, size, background, and format controls below apply to `generate_image`, not to the native server tool.
+- Otherwise, call `generate_image`. It is eval-only, like `bash`: when an `eval` tool exists it is not in your direct tool list, so run it inside an eval cell as `tool.generate_image({ prompt: "..." })` (js) or `tool.generate_image(prompt="...")` (py); `tool_schema("generate_image")` lists every parameter. Without an eval tool it is an ordinary direct tool. It sends your prompt and optional reference images to the configured OpenAI-compatible endpoint and saves the result as a png, jpeg, or webp file. The model, quality, size, background, and format controls below apply to `generate_image`, not to the native server tool.
 
 Check your current tool set before choosing. Tool state can change mid-session (model switch, credential change), so trust the tools you can see over what this page said at startup. If both surfaces ever appear, prefer the native server tool. When the request is clear, generate directly instead of asking for confirmation; ask only when a required reference image is missing.
 

package/dist/core/extensions/builtin/imagegen/tool.js

@@ -22,20 +22,10 @@ export const generateImageTool = defineTool({
     label: "Generate Image",
     description: "Generate or edit an image with OpenAI gpt-image-2.6 (Sunburst by default, the most capable; Flare when speed matters more than quality; an endpoint without 2.6 falls back to 2.5) and save it as a png, jpeg, or webp file, optionally with a transparent background. Pass reference_image_paths to edit or reference existing images. Generate directly when the request is clear instead of asking for confirmation. Returns the saved file paths.",
     promptSnippet: "Generate or edit images from prompts and optional reference images, saving them as png/jpeg/webp files.",
-    // Deferred: the schema costs ~1K prompt tokens on every request and the bundled imagegen skill
-    // names the tool, so a by-name call activates it on first use instead of shipping it resident.
-    exposure: "search",
-    searchGroup: "imagegen",
-    searchKeywords: [
-        "generate image",
-        "image generation",
-        "edit image",
-        "create a picture",
-        "illustration",
-        "mockup",
-        "gpt-image",
-        "transparent png",
-    ],
+    // Eval-only, like bash (senpi#6269): whenever an eval tool is registered the model never sees
+    // this ~1K-token schema and calls `tool.generate_image({ prompt: "..." })` inside a cell instead;
+    // without an eval tool it is an ordinary direct tool. The bundled imagegen skill explains the call.
+    exposure: "eval",
     parameters: Params,
     async execute(toolCallId, params, signal, _onUpdate, ctx) {
         const size = params.size ?? "auto";