@code-yeongyu/senpi 2026.11.13 → 2026.11.15-2

package/dist/core/extensions/loader.js

@@ -55,7 +55,7 @@ import { createLifecycleApi } from "./lifecycle-api.js";
 import { withProviderLoginStart } from "./provider-login-start.js";
 import { createSessionDialogApi } from "./session-dialog-api.js";
 import { StaleExtensionContextError } from "./stale-context-error.js";
-import { DEFAULT_EXTENSION_SESSION_PROFILE, EMPTY_SESSION_CONTEXT } from "./types.js";
+import { DEFAULT_EXTENSION_SESSION_PROFILE, DeviceMachineConflictError, EMPTY_SESSION_CONTEXT } from "./types.js";
 function sessionProfile(options) {
     return {
         sessionKind: options?.sessionKind ?? "interactive",
@@ -209,6 +209,7 @@ export function createExtensionRuntime() {
         }
     };
     const runtime = {
+        deviceMachine: undefined,
         sendMessage: notInitialized,
         sendUserMessage: notInitialized,
         appendEntry: notInitialized,
@@ -349,6 +350,7 @@ function createExtensionAPI(extension, runtime, cwd, eventBus, session) {
         }
         runtime.assertActive();
     };
+    let deviceMachineStaged = false;
     const applyRuntimeChange = (change) => {
         if (state === "loading")
             pendingRuntimeChanges.push(change);
@@ -356,6 +358,7 @@ function createExtensionAPI(extension, runtime, cwd, eventBus, session) {
             change();
     };
     const clearPending = () => {
+        deviceMachineStaged = false;
         pendingFlagValues.clear();
         pendingRuntimeChanges.length = 0;
         loadingUnsubscribers.length = 0;
@@ -423,6 +426,19 @@ function createExtensionAPI(extension, runtime, cwd, eventBus, session) {
                     extension.handlers.delete(event);
             };
         },
+        registerDeviceMachine(machine) {
+            assertActive();
+            if (runtime.deviceMachine !== undefined) {
+                throw new DeviceMachineConflictError(runtime.deviceMachine.extensionPath, extension.path);
+            }
+            if (deviceMachineStaged)
+                throw new DeviceMachineConflictError(extension.path, extension.path);
+            deviceMachineStaged = true;
+            // Staged like provider registrations: a factory that throws after registering leaves no device behind.
+            applyRuntimeChange(() => {
+                runtime.deviceMachine = { machine, extensionPath: extension.path };
+            });
+        },
         registerTool(tool) {
             runtime.assertActive();
             if (tool.name === "tool_search" && extension.sourceInfo.source !== "builtin") {

package/dist/core/extensions/runner.js

@@ -30,6 +30,7 @@ import { QuitDeadline } from "./shutdown-quit-budget.js";
 import { StaleExtensionContextError } from "./stale-context-error.js";
 import { RUNTIME_EXTENSION_PATH } from "./types.js";
 import { servesForwardedHandler, toolEventHandlers, twoSidedExtensions, } from "./two-sided-forwarding.js";
+import { combinedToolCallSignal } from "./tool-call-signal.js";
 const RUNTIME_CONTEXT_MEMBERS = new Set([
     "offload",
     "ui",
@@ -48,6 +49,7 @@ const RUNTIME_CONTEXT_MEMBERS = new Set([
     "getImageSettings",
     "getRegisteredMcpServers",
     "extensionConnectsMcpServers",
+    "signal",
 ]);
 /** Session identity a context of a runner without a session does not have; dispatchers treat its absence as context-free. */
 const SESSION_IDENTITY_MEMBERS = new Set(["sessionManager", "goalStoreFile"]);
@@ -2027,9 +2029,21 @@ export class ExtensionRunner {
     async emitToolCall(event, options = {}) {
         let result;
         for (const { ext, handlers: own } of snapshotEventHandlers(this.extensions, "tool_call")) {
-            const handlers = toolEventHandlers(ext, own, "tool_call", options, (index) => async () => options.forward?.toolCall(ext.path, index, event));
+            const handlers = toolEventHandlers(ext, own, "tool_call", options, 
+            // The forwarder carries the event only, never the call's signal (senpi#6679 L1): a handler served on the
+            // loop side of a forward sees the loop-hook signal, the exception ToolEventDispatchOptions.signal documents.
+            (index) => async () => options.forward?.toolCall(ext.path, index, event));
             for (const handler of handlers) {
-                const hookRun = this.beginToolHookRun(this.createContext(), {
+                const baseContext = this.createContext();
+                if (options.signal !== undefined) {
+                    const callSignal = combinedToolCallSignal(options.signal, baseContext.signal);
+                    Object.defineProperty(baseContext, "signal", {
+                        get: () => callSignal,
+                        configurable: true,
+                        enumerable: true,
+                    });
+                }
+                const hookRun = this.beginToolHookRun(baseContext, {
                     hookName: "PreToolUse",
                     toolName: event.toolName,
                     toolCallId: event.toolCallId,

package/dist/core/extensions/tool-call-signal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The signal a nested call's hooks and tool run serve: the call's own signal combined with the turn's
+ * (senpi#6679 M1), so aborting either ends the call — and its permission prompt. A call signal not linked to
+ * the turn must not replace the turn's (the prompt would survive a whole-turn abort); the turn's must not
+ * silence the call's own (#6676). The union never aborts either original controller.
+ */
+export declare function combinedToolCallSignal(callSignal: AbortSignal | undefined, turnSignal: AbortSignal | undefined): AbortSignal | undefined;
+//# sourceMappingURL=tool-call-signal.d.ts.map

package/dist/core/extensions/tool-call-signal.js

@@ -0,0 +1,14 @@
+/**
+ * The signal a nested call's hooks and tool run serve: the call's own signal combined with the turn's
+ * (senpi#6679 M1), so aborting either ends the call — and its permission prompt. A call signal not linked to
+ * the turn must not replace the turn's (the prompt would survive a whole-turn abort); the turn's must not
+ * silence the call's own (#6676). The union never aborts either original controller.
+ */
+export function combinedToolCallSignal(callSignal, turnSignal) {
+    if (callSignal === undefined)
+        return turnSignal;
+    if (turnSignal === undefined || turnSignal === callSignal)
+        return callSignal;
+    return AbortSignal.any([callSignal, turnSignal]);
+}
+//# sourceMappingURL=tool-call-signal.js.map

package/dist/core/extensions/two-sided-forwarding.d.ts

@@ -27,6 +27,12 @@ export interface ToolEventDispatchOptions {
     readonly forward?: ToolEventForwarder;
     /** Where the loop runs: run only this one handler (a forwarded request). */
     readonly only?: ForwardedHandler;
+    /**
+     * The call's own abort signal: a `tool_call` handler's `ctx.signal` for this call, combined with the turn's so
+     * aborting either ends it (senpi#6676, senpi#6679 M1). Forwarded handlers are the exception (senpi#6679 L1): the
+     * forwarder carries the event only, so a handler served on the loop side of a forward sees its loop-hook signal.
+     */
+    readonly signal?: AbortSignal;
 }
 /**
  * The extensions whose undeclared registrations span loop-side events (`loop` or `split` in the event placement) and

package/dist/core/extensions/types.d.ts

@@ -8,6 +8,7 @@
  * - Interact with the user via UI primitives
  */
 import type { PromptSizeReport } from "../prompt-size-report.ts";
+import type { ToolMachine } from "../tools/machine.ts";
 import type { InputOrigin } from "../input-origin.ts";
 import type { LifecycleApi } from "../session-lifecycle-types.ts";
 import type { UploadRedaction, UploadRedactionOptions } from "../share/upload-redaction.ts";
@@ -646,7 +647,7 @@ export interface ExtensionContext {
  * `ExtensionRunner` built without a session manager has no `sessionManager` or `goalStoreFile`, and every other
  * member outside this set throws a "loop-side and not bound" error.
  */
-export type ExtensionRuntimeContext = Pick<ExtensionContext, "offload" | "ui" | "mode" | "hasUI" | "cwd" | "agentDir" | "loadedExtensionPaths" | "modelRegistry" | "isProjectTrusted" | "kernelTools" | "evalHandleHost" | "shutdown" | "getLookAtSettings" | "getAskUserSettings" | "getImageSettings" | "getRegisteredMcpServers" | "extensionConnectsMcpServers">;
+export type ExtensionRuntimeContext = Pick<ExtensionContext, "offload" | "ui" | "mode" | "hasUI" | "cwd" | "agentDir" | "loadedExtensionPaths" | "modelRegistry" | "isProjectTrusted" | "kernelTools" | "evalHandleHost" | "shutdown" | "getLookAtSettings" | "getAskUserSettings" | "getImageSettings" | "getRegisteredMcpServers" | "extensionConnectsMcpServers" | "signal">;
 /** Provider request prefix of the next user turn (see `ExtensionContext.getPromptCachePrefixRequest`). */
 export interface PromptCachePrefixRequest {
     readonly model: Model<Api>;
@@ -2253,6 +2254,13 @@ export interface ExtensionAPI {
         description?: string;
         handler: (ctx: ExtensionContext) => Promise<void> | void;
     }): void;
+    /**
+     * Register the operation layer of the device this session's tools run on. Read when a routed tool executes; only
+     * tools named in OMO_TOOLS_VIA_DAEMON use it (today: bash). One registration per session: a second one, from any
+     * extension, throws DeviceMachineConflictError naming the extension that registered first, so two extensions
+     * cannot silently fight over where commands run.
+     */
+    registerDeviceMachine(machine: ToolMachine): void;
     /** Register a CLI flag. */
     registerFlag(name: string, options: {
         description?: string;
@@ -2762,6 +2770,11 @@ export type SetSessionNameHandler = (name: string) => void;
 export type GetSessionNameHandler = () => string | undefined;
 export type ExecuteToolUpdateCallback<T = unknown> = AgentToolUpdateCallback<T>;
 export interface ExecuteToolOptions<TDetails = unknown> {
+    /**
+     * The call's own abort signal: the call's RUN follows it alone, so a detached caller's work survives a
+     * later turn's abort (senpi#6679 review M2). The call's PERMISSION PROMPT runs under its union with the
+     * turn's signal: aborting the turn also ends an unanswered prompt even when this signal is unlinked (senpi#6679).
+     */
     signal?: AbortSignal;
     onUpdate?: ExecuteToolUpdateCallback<TDetails>;
     /**
@@ -2837,6 +2850,11 @@ export type PendingProviderRegistration = ({
  */
 export interface ExtensionRuntimeState {
     flagValues: Map<string, boolean | string>;
+    /** The device the session's tools run on, and the extension that registered it (registerDeviceMachine). */
+    deviceMachine: {
+        readonly machine: ToolMachine;
+        readonly extensionPath: string;
+    } | undefined;
     /** Legacy provider-config registrations queued during extension loading, processed when runner binds. */
     pendingProviderRegistrations: PendingProviderConfigRegistration[];
     /** Native pi-ai provider registrations queued during extension loading, processed when runner binds. */
@@ -3128,4 +3146,11 @@ export interface ExtensionError {
     error: string;
     stack?: string;
 }
+/** A second registerDeviceMachine in one session. */
+export declare class DeviceMachineConflictError extends Error {
+    readonly code: "device_machine_conflict";
+    readonly registeredBy: string;
+    readonly attemptedBy: string;
+    constructor(registeredBy: string, attemptedBy: string);
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/core/extensions/types.js

@@ -98,4 +98,14 @@ export class ExecuteToolError extends Error {
  * background session-title generation.
  */
 export const RUNTIME_EXTENSION_PATH = "<runtime>";
+/** A second registerDeviceMachine in one session. */
+export class DeviceMachineConflictError extends Error {
+    constructor(registeredBy, attemptedBy) {
+        super(`registerDeviceMachine: extension "${attemptedBy}" tried to register a device machine, but extension "${registeredBy}" already registered one for this session`);
+        this.code = "device_machine_conflict";
+        this.name = "DeviceMachineConflictError";
+        this.registeredBy = registeredBy;
+        this.attemptedBy = attemptedBy;
+    }
+}
 //# sourceMappingURL=types.js.map

package/dist/core/reasoning-baseline.d.ts

@@ -1,4 +1,4 @@
-import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
+import type { AgentMessage, ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { SessionEntry } from "./session-manager.ts";
 /**
  * The request-level effort of every request while a session holds a `configuration_update`: the baseline
@@ -6,6 +6,13 @@ import type { SessionEntry } from "./session-manager.ts";
  * (senpi#2094, senpi#4116). Without a valid baseline it is the live level.
  */
 export declare function requestThinkingLevel(baseline: string | undefined, thinkingLevel: ThinkingLevel): ThinkingLevel;
+/**
+ * The request context with the live level in force. On a flagged model the newest `configuration_update` is the
+ * effort a request carries, and a level that arrived without one (a fallback rung's, a favourite cycle's) would
+ * leave an older update in force. The live level rides the request only, never the session file, so a resumed
+ * session keeps the user's level (senpi#6655). It goes before the turn's user message, like a recorded update.
+ */
+export declare function withLiveConfigurationUpdate(messages: AgentMessage[], thinkingLevel: ThinkingLevel, timestamp: number): AgentMessage[];
 /**
  * The baseline a resumed session restores, replaying the rules `AgentSession` applies live: an in-model effort
  * change (a `thinking_level_change` immediately followed by its `configuration_update`) pins the level that was

package/dist/core/reasoning-baseline.js

@@ -7,6 +7,30 @@ import { isValidThinkingLevel } from "../cli/args.js";
 export function requestThinkingLevel(baseline, thinkingLevel) {
     return baseline !== undefined && isValidThinkingLevel(baseline) ? baseline : thinkingLevel;
 }
+function isConfigurationUpdate(message) {
+    return message.role === "configurationUpdate";
+}
+/**
+ * The request context with the live level in force. On a flagged model the newest `configuration_update` is the
+ * effort a request carries, and a level that arrived without one (a fallback rung's, a favourite cycle's) would
+ * leave an older update in force. The live level rides the request only, never the session file, so a resumed
+ * session keeps the user's level (senpi#6655). It goes before the turn's user message, like a recorded update.
+ */
+export function withLiveConfigurationUpdate(messages, thinkingLevel, timestamp) {
+    const newestIndex = messages.findLastIndex(isConfigurationUpdate);
+    const newest = messages[newestIndex];
+    if (newest === undefined || !isConfigurationUpdate(newest) || newest.effort === thinkingLevel)
+        return messages;
+    const update = {
+        role: "configurationUpdate",
+        content: [],
+        effort: thinkingLevel,
+        timestamp,
+    };
+    const lastUserIndex = messages.findLastIndex((message) => message.role === "user");
+    const at = lastUserIndex > newestIndex ? lastUserIndex : messages.length;
+    return [...messages.slice(0, at), update, ...messages.slice(at)];
+}
 /**
  * The baseline a resumed session restores, replaying the rules `AgentSession` applies live: an in-model effort
  * change (a `thinking_level_change` immediately followed by its `configuration_update`) pins the level that was

package/dist/core/retry-fallback/chains.js

@@ -130,7 +130,11 @@ export function canonicalizeFallbackChains(chains, lookup) {
     const canonical = {};
     const explicitKeys = new Set();
     const tombstones = new Set();
-    const expandEntries = (entries, keySelector, sessionProvider) => entries.flatMap((entry) => {
+    // Two entries can name one rung (`k3` and `kimi-k3` both reach Kimi Code's `k3`); the first keeps its place.
+    const expandEntries = (entries, keySelector, sessionProvider) => [
+        ...new Set(expandEach(entries, keySelector, sessionProvider)),
+    ];
+    const expandEach = (entries, keySelector, sessionProvider) => entries.flatMap((entry) => {
         const bare = parseBareSelector(entry);
         if (bare) {
             return rankFamilyModels(models, bare.family, tiers, { limit: MAX_PROVIDERS_PER_FAMILY, sessionProvider })

package/dist/core/retry-fallback/controller.d.ts

@@ -110,7 +110,12 @@ export declare class RetryFallbackController {
     }, failureObserved?: boolean): Promise<boolean>;
     private walkFallback;
     private applyCandidate;
-    /** The chain governing `current`, when fallback is enabled; a model's own chain wins over an active one. */
+    /**
+     * The chain governing `current`, when fallback is enabled. An active episode's chain wins over the
+     * rung's own chain, so the walk continues down the chain it started on: Opus 5.5 -> Fable 5.2 -> Kimi
+     * never detours through Fable's own chain, and a Fable session that reached Opus 5.5 never takes
+     * Opus 5.5's chain off Anthropic (senpi#6699). Outside an episode the model's own chain governs.
+     */
     private managedChainKey;
     private nextCandidate;
     private switchOrRelease;

package/dist/core/retry-fallback/controller.js

@@ -392,13 +392,21 @@ export class RetryFallbackController {
         this.deps.logger.info("fallback_applied", { from, to, chainKey: candidate.chainKey, reason, ...scope });
         this.deps.emit({ type: "retry_fallback_applied", from, to, chainKey: candidate.chainKey, reason, ...scope });
     }
-    /** The chain governing `current`, when fallback is enabled; a model's own chain wins over an active one. */
+    /**
+     * The chain governing `current`, when fallback is enabled. An active episode's chain wins over the
+     * rung's own chain, so the walk continues down the chain it started on: Opus 5.5 -> Fable 5.2 -> Kimi
+     * never detours through Fable's own chain, and a Fable session that reached Opus 5.5 never takes
+     * Opus 5.5's chain off Anthropic (senpi#6699). Outside an episode the model's own chain governs.
+     */
     managedChainKey(current) {
         if (!this.deps.getSettings().modelFallback)
             return undefined;
         const chains = this.canonicalChains();
-        const chainKey = resolveChainKey(current.model, current.thinkingLevel, chains, fastSiblingOption(this.deps.registry, current.model)) ?? this.state?.chainKey;
-        return chainKey && chains[chainKey] ? chainKey : undefined;
+        const active = this.state?.chainKey;
+        if (active && chains[active])
+            return active;
+        const own = resolveChainKey(current.model, current.thinkingLevel, chains, fastSiblingOption(this.deps.registry, current.model));
+        return own && chains[own] ? own : undefined;
     }
     nextCandidate(reserve = true, logDecision = reserve, refusedProvider) {
         const current = this.deps.getCurrentSelector();

package/dist/core/retry-fallback/expansion.js

@@ -98,20 +98,34 @@ function withoutNamespace(modelId) {
     const cut = Math.max(modelId.lastIndexOf("."), modelId.lastIndexOf("/"));
     return cut === -1 ? modelId : modelId.slice(cut + 1);
 }
+/**
+ * The ids a model answers to as a family. Kimi Code serves the Moonshot models under bare
+ * ids (`k3.1-pro` is Moonshot's `kimi-k3.1-pro`), so a `kimi-` family reaches it too.
+ */
+function familyIds(model) {
+    const id = model.id.toLowerCase();
+    const ids = [id, withoutNamespace(id)];
+    return /^k\d/.test(id) ? [...ids, `kimi-${id}`] : ids;
+}
+/** A model's own id outranks the Kimi Code alias, which outranks a dash-suffixed variant. */
+function exactness(model, family) {
+    const id = model.id.toLowerCase();
+    if (id === family || withoutNamespace(id) === family)
+        return 2;
+    return familyIds(model).includes(family) ? 1 : 0;
+}
 /**
  * Conservative family match. A bare id matches its exact model and dash-suffixed
  * variants (`k3` -> `k3-256k`) but never an arbitrary substring, so `claude-fable-5`
  * cannot capture `not-claude-fable-5`.
  */
 export function matchesFamily(model, family) {
-    const candidates = [model.id.toLowerCase(), withoutNamespace(model.id.toLowerCase())];
-    return candidates.some((id) => id === family || id.startsWith(`${family}-`));
+    return familyIds(model).some((id) => id === family || id.startsWith(`${family}-`));
 }
 /** Exact id wins, then the shortest variant, then alphabetical. */
 function pickVariant(models, family) {
     const ranked = [...models].sort((left, right) => {
-        const exact = Number(withoutNamespace(right.id.toLowerCase()) === family) -
-            Number(withoutNamespace(left.id.toLowerCase()) === family);
+        const exact = exactness(right, family) - exactness(left, family);
         if (exact !== 0)
             return exact;
         if (left.id.length !== right.id.length)

package/dist/core/retry-fallback/settings.d.ts

@@ -33,14 +33,15 @@ export interface ResolvedRetryFallbackSettings {
  * follows Fable 5 whichever provider serves it - the builtin Anthropic provider, the
  * Anthropic Subscription extension, a gateway, or Bedrock.
  *
- * The ladder never leaves Anthropic. The previous shipped default was removed because it
+ * The Fable ladders never leave Anthropic. A previous shipped default was removed because it
  * led with cross-family rungs (`k3`, `kimi-k3`), which moved a Claude session onto another
- * vendor mid-turn and could rank a guaranteed-refusal OAuth lane first; an Anthropic-only
- * ladder carries neither problem. There is still deliberately no wildcard lane.
+ * vendor mid-turn and could rank a guaranteed-refusal OAuth lane first. There is still
+ * deliberately no wildcard lane.
  *
- * Opus 5.5 steps to Fable 5.2 before Opus 5: Anthropic meters Opus on its own quota window,
- * so a rate limit on Opus 5.5 also holds every other Opus rung on that account or gateway
- * pool (senpi#6385).
+ * Opus 5.5 is the one chain that leaves Anthropic, by the owner's order (senpi#6699): Fable 5.2
+ * at medium effort, then Kimi K3.1 Pro at max (its highest level), and nothing after. No Opus
+ * rung follows, since Anthropic meters Opus on its own quota window and a rate limit on
+ * Opus 5.5 also holds every other Opus rung on that account (senpi#6385).
  *
  * Rungs stay on current-generation Opus: a Claude session must never step down to
  * `claude-opus-4-8` or `claude-opus-4-6` (senpi#3727).

package/dist/core/retry-fallback/settings.js

@@ -4,24 +4,25 @@
  * follows Fable 5 whichever provider serves it - the builtin Anthropic provider, the
  * Anthropic Subscription extension, a gateway, or Bedrock.
  *
- * The ladder never leaves Anthropic. The previous shipped default was removed because it
+ * The Fable ladders never leave Anthropic. A previous shipped default was removed because it
  * led with cross-family rungs (`k3`, `kimi-k3`), which moved a Claude session onto another
- * vendor mid-turn and could rank a guaranteed-refusal OAuth lane first; an Anthropic-only
- * ladder carries neither problem. There is still deliberately no wildcard lane.
+ * vendor mid-turn and could rank a guaranteed-refusal OAuth lane first. There is still
+ * deliberately no wildcard lane.
  *
- * Opus 5.5 steps to Fable 5.2 before Opus 5: Anthropic meters Opus on its own quota window,
- * so a rate limit on Opus 5.5 also holds every other Opus rung on that account or gateway
- * pool (senpi#6385).
+ * Opus 5.5 is the one chain that leaves Anthropic, by the owner's order (senpi#6699): Fable 5.2
+ * at medium effort, then Kimi K3.1 Pro at max (its highest level), and nothing after. No Opus
+ * rung follows, since Anthropic meters Opus on its own quota window and a rate limit on
+ * Opus 5.5 also holds every other Opus rung on that account (senpi#6385).
  *
  * Rungs stay on current-generation Opus: a Claude session must never step down to
  * `claude-opus-4-8` or `claude-opus-4-6` (senpi#3727).
  */
 export const DEFAULT_FALLBACK_CHAINS = {
-    // Rungs carry no explicit level so fallback inherits the session's current thinking effort (senpi#4103).
+    // Fable rungs carry no explicit level so fallback inherits the session's current thinking effort (senpi#4103).
     "claude-fable-5-2": ["claude-opus-5-5", "claude-opus-5"],
     "claude-fable-5-1": ["claude-opus-5-5", "claude-opus-5"],
     "claude-fable-5": ["claude-opus-5-5", "claude-opus-5"],
-    "claude-opus-5-5": ["claude-fable-5-2", "claude-opus-5"],
+    "claude-opus-5-5": ["claude-fable-5-2:medium", "kimi-k3.1-pro:max"],
 };
 function cloneDefaultFallbackChains() {
     const chains = {};

package/dist/core/runtime/bootstrap.d.ts

@@ -6,6 +6,7 @@ import type { SessionManager } from "../session-manager.ts";
 import type { SettingsManager } from "../settings-manager.ts";
 import { type SourceInfo } from "../source-info.ts";
 import type { ToolDispatcher } from "../tool-dispatch/tool-dispatcher.ts";
+import type { ToolMachine } from "../tools/machine.ts";
 export interface ToolDefinitionEntry {
     definition: ToolDefinition;
     sourceInfo: SourceInfo;
@@ -24,6 +25,8 @@ export interface RuntimeBootstrapOptions {
     sessionManager?: SessionManager;
     /** Routes the core bash tool's process work; absent means the tool's own local operations. */
     toolDispatcher?: ToolDispatcher;
+    /** The device this session works on (slice 1a seam; supplied by the relay transport in slice 1b). */
+    deviceMachine?: ToolMachine;
     /** Used instead of the built-in tools when set. */
     baseToolsOverride?: Record<string, AgentTool>;
     /** Extension flag values applied to the shared extension runtime before the runner is created. */

package/dist/core/runtime/bootstrap.js

@@ -33,6 +33,7 @@ export function bootstrapRuntime(options) {
                 shellPath,
                 ...(sessionless ? { exposeSessionEnvironment: false } : {}),
                 ...(options.toolDispatcher ? { operations: options.toolDispatcher.bashOperations({ shellPath }) } : {}),
+                deviceMachine: () => options.deviceMachine ?? extensionsResult.runtime.deviceMachine?.machine,
             },
             write: { filesystemPolicy },
             edit: { filesystemPolicy },

package/dist/core/session-cwd.d.ts

@@ -14,6 +14,20 @@ export declare class MissingSessionCwdError extends Error {
     readonly issue: SessionCwdIssue;
     constructor(issue: SessionCwdIssue);
 }
-export declare function assertSessionCwdExists(sessionManager: SessionCwdSource, fallbackCwd: string): void;
+/** A session cwd that exists but is not a folder (a file, a socket): its tools could not run there. */
+export interface SessionCwdNotDirectoryIssue {
+    sessionFile?: string;
+    sessionCwd: string;
+}
+export declare class SessionCwdNotDirectoryError extends Error {
+    readonly issue: SessionCwdNotDirectoryIssue;
+    constructor(issue: SessionCwdNotDirectoryIssue);
+}
+/**
+ * Async on purpose: the RPC session path may not reach a synchronous filesystem call
+ * (test/suite/no-sync-in-session-path.test.ts), so the directory probe is awaited here rather
+ * than taken with statSync.
+ */
+export declare function assertSessionCwdExists(sessionManager: SessionCwdSource, fallbackCwd: string): Promise<void>;
 export {};
 //# sourceMappingURL=session-cwd.d.ts.map

package/dist/core/session-cwd.js

@@ -1,4 +1,5 @@
 import { existsSync } from "node:fs";
+import { stat } from "node:fs/promises";
 export function getMissingSessionCwdIssue(sessionManager, fallbackCwd) {
     const sessionFile = sessionManager.getSessionFile();
     if (!sessionFile) {
@@ -28,10 +29,30 @@ export class MissingSessionCwdError extends Error {
         this.issue = issue;
     }
 }
-export function assertSessionCwdExists(sessionManager, fallbackCwd) {
+export class SessionCwdNotDirectoryError extends Error {
+    constructor(issue) {
+        const sessionFile = issue.sessionFile ? `\nSession file: ${issue.sessionFile}` : "";
+        super(`Session working directory is not a directory: ${issue.sessionCwd}${sessionFile}`);
+        this.name = "SessionCwdNotDirectoryError";
+        this.issue = issue;
+    }
+}
+/**
+ * Async on purpose: the RPC session path may not reach a synchronous filesystem call
+ * (test/suite/no-sync-in-session-path.test.ts), so the directory probe is awaited here rather
+ * than taken with statSync.
+ */
+export async function assertSessionCwdExists(sessionManager, fallbackCwd) {
     const issue = getMissingSessionCwdIssue(sessionManager, fallbackCwd);
     if (issue) {
         throw new MissingSessionCwdError(issue);
     }
+    const sessionCwd = sessionManager.getCwd();
+    // A missing cwd is the case above (or a session with no file, which keeps today's behaviour); one that exists must be a folder.
+    const stats = sessionCwd ? await stat(sessionCwd).catch(() => undefined) : undefined;
+    if (sessionCwd && stats !== undefined && !stats.isDirectory()) {
+        const sessionFile = sessionManager.getSessionFile();
+        throw new SessionCwdNotDirectoryError({ ...(sessionFile ? { sessionFile } : {}), sessionCwd });
+    }
 }
 //# sourceMappingURL=session-cwd.js.map

package/dist/core/tools/bash.d.ts

@@ -70,6 +70,12 @@ export declare function createLocalBashOperations(options?: {
     shellPath?: string;
     machine?: ToolMachine;
 }): BashOperations;
+/** A tool routed to the session's device by OMO_TOOLS_VIA_DAEMON found no device to run on; it never falls back to local. */
+export declare class DeviceUnavailableError extends Error {
+    readonly code: "device_unavailable";
+    readonly tool: string;
+    constructor(tool: string);
+}
 export interface BashSpawnContext {
     command: string;
     cwd: string;
@@ -91,6 +97,12 @@ export interface BashToolOptions {
     spawnHook?: BashSpawnHook;
     /** Operation layer and policy gate. Default: the process-wide local machine. */
     machine?: ToolMachine;
+    /**
+     * The operation layer of the device this session works on. Slice 1a of the tools-via-daemon plan: an executor seam
+     * only, NOT yet via the daemon; the relay transport that supplies it is slice 1b. Used only when OMO_TOOLS_VIA_DAEMON
+     * names "bash"; with the flag on and no device machine, a call fails with DeviceUnavailableError and never runs locally.
+     */
+    deviceMachine?: ToolMachine | (() => ToolMachine | undefined);
 }
 export type BashRenderState = {
     startedAt: number | undefined;

package/dist/core/tools/bash.js

@@ -152,6 +152,19 @@ export function createLocalShellOperations(shellName, resolveShellConfig, machin
 export function createLocalBashOperations(options) {
     return createLocalShellOperations("bash", () => getShellConfig(options?.shellPath), options?.machine);
 }
+/** A tool routed to the session's device by OMO_TOOLS_VIA_DAEMON found no device to run on; it never falls back to local. */
+export class DeviceUnavailableError extends Error {
+    constructor(tool) {
+        super(`${tool}: the session's device is unavailable, and OMO_TOOLS_VIA_DAEMON routes ${tool} there, so it does not run locally`);
+        this.code = "device_unavailable";
+        this.name = "DeviceUnavailableError";
+        this.tool = tool;
+    }
+}
+const toolsViaDaemon = (tool, env = process.env) => (env.OMO_TOOLS_VIA_DAEMON ?? "")
+    .split(",")
+    .map((name) => name.trim())
+    .includes(tool);
 function resolveSpawnContext(command, cwd, spawnHook, exposeSessionEnvironment, ctx) {
     const env = { ...getShellEnv() };
     delete env.PI_SESSION_ID;
@@ -186,7 +199,23 @@ function resolveSpawnContext(command, cwd, spawnHook, exposeSessionEnvironment,
 }
 export function createShellToolDefinition(cwd, config, options) {
     const machine = options?.machine ?? defaultToolMachine();
-    const ops = options?.operations ?? createLocalBashOperations({ shellPath: options?.shellPath, machine });
+    // OMO_TOOLS_VIA_DAEMON=bash (default off): run on the session's device, never on this machine. The flag decides even
+    // when the session injects its dispatcher's operations (bootstrap.ts always does), so the promise holds in a real session.
+    // Only the bash tool: powershell shares this definition with its own local operations and stays on them.
+    const viaDevice = config.name === "bash" && toolsViaDaemon("bash");
+    const deviceMachine = options?.deviceMachine;
+    // Resolved when the command runs, not when the tool is built: an extension may register the device later.
+    const resolveDevice = typeof deviceMachine === "function" ? deviceMachine : () => deviceMachine;
+    const ops = viaDevice
+        ? {
+            exec: (command, execCwd, execOptions) => {
+                const device = resolveDevice();
+                if (device === undefined)
+                    throw new DeviceUnavailableError(config.name);
+                return createLocalBashOperations({ shellPath: options?.shellPath, machine: device }).exec(command, execCwd, execOptions);
+            },
+        }
+        : (options?.operations ?? createLocalBashOperations({ shellPath: options?.shellPath, machine }));
     const commandPrefix = options?.commandPrefix;
     const exposeSessionEnvironment = options?.exposeSessionEnvironment ?? true;
     const spawnHook = options?.spawnHook;

package/dist/index.d.ts

@@ -40,6 +40,10 @@ export { type CompactionModelOverride, type CompactionSettings, type DefaultProj
 export { formatSkillsForPrompt, type LoadSkillsFromDirOptions, type LoadSkillsResult, loadSkills, loadSkillsFromDir, type Skill, type SkillFrontmatter, } from "./core/skills.ts";
 export { createSyntheticSourceInfo } from "./core/source-info.ts";
 export { type EditDiffResult, generateDiffString, generateUnifiedPatch } from "./core/tools/edit-diff.ts";
+export type { ExecRequest as MachineExecRequest, ExecResult as MachineExecResult, MachineOps, OpContext, } from "../vendor/senpi-machine-ops/index.js";
+export { DeviceMachineConflictError } from "./core/extensions/types.ts";
+export { DeviceUnavailableError } from "./core/tools/bash.ts";
+export { createToolMachine, type ToolMachine, type ToolPathPolicy } from "./core/tools/machine.ts";
 export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
 export { type CompactReadClassification, classifyRead, type ReadClassifier, registerReadClassifier, } from "./core/tools/read-classifiers.ts";
 export { registerRpcRemoteSource, type RpcRemoteHandlers, type RpcRemoteOpenOptions, type RpcRemoteSettledTurn, type RpcRemoteSource, type RpcRemoteState, type RpcRemoteSubscription, type RpcRemoteTarget, } from "./core/extensions/builtin/terminal/rpc-remote-source.ts";

package/dist/index.js

@@ -47,6 +47,9 @@ export { SettingsManager, } from "./core/settings-manager.js";
 export { formatSkillsForPrompt, loadSkills, loadSkillsFromDir, } from "./core/skills.js";
 export { createSyntheticSourceInfo } from "./core/source-info.js";
 export { generateDiffString, generateUnifiedPatch } from "./core/tools/edit-diff.js";
+export { DeviceMachineConflictError } from "./core/extensions/types.js";
+export { DeviceUnavailableError } from "./core/tools/bash.js";
+export { createToolMachine } from "./core/tools/machine.js";
 // Tools
 export { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead, truncateLine, truncateTail, withFileMutationQueue, } from "./core/tools/index.js";
 export { classifyRead, registerReadClassifier, } from "./core/tools/read-classifiers.js";

package/dist/modes/rpc/connection-handler.js

@@ -1,3 +1,4 @@
+import { projectCwdMismatch } from "./project-expected-cwd.js";
 import { isHostOwnedToolRuntimeCapability, toolRuntimeCapabilities, } from "../../cli/tool-runtime.js";
 import { messagePathProjectRoot, resolveMessagePath } from "../../core/message-path-resolution.js";
 import { startOpenTimer } from "../../core/open-timing.js";
@@ -1013,6 +1014,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     // Handle a single command
     const handleCommand = async (command, requestContext) => {
         const id = command.id;
+        const cwdMismatch = projectCwdMismatch(command, session.sessionManager.getCwd());
+        if (cwdMismatch !== undefined)
+            return error(id, command.type, cwdMismatch.message, cwdMismatch.errorCode);
         switch (command.type) {
             case "get_protocol_info":
                 return {