@code-yeongyu/senpi 2026.11.13 → 2026.11.15-2

package/dist/modes/rpc/method-classes-schema-session.d.ts

@@ -832,6 +832,7 @@ export declare const SESSION_RECORD_SCHEMAS: {
         readonly sessionId: Type.TOptional<Type.TString>;
     } & {
         readonly choice: Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>;
+        readonly expectedCwd: Type.TOptional<Type.TString>;
     }>;
     get_project_settings: Type.TObject<{
         id: Type.TOptional<Type.TString>;
@@ -849,6 +850,7 @@ export declare const SESSION_RECORD_SCHEMAS: {
     } & {
         readonly key: Type.TString;
         readonly value: Type.TUnknown;
+        readonly expectedCwd: Type.TOptional<Type.TString>;
     }>;
     read_project_file: Type.TObject<{
         id: Type.TOptional<Type.TString>;
@@ -869,6 +871,7 @@ export declare const SESSION_RECORD_SCHEMAS: {
         readonly path: Type.TString;
         readonly content: Type.TString;
         readonly ifEtag: Type.TUnion<[Type.TString, Type.TNull]>;
+        readonly expectedCwd: Type.TOptional<Type.TString>;
     }>;
     extension_request: Type.TObject<{
         id: Type.TOptional<Type.TString>;

package/dist/modes/rpc/method-classes-schema-session.js

@@ -194,14 +194,18 @@ const SURFACE_AND_ACCOUNT_SCHEMAS = {
     get_commands: session("get_commands", {}),
     get_loaded_surfaces: session("get_loaded_surfaces", {}),
     get_project_trust: session("get_project_trust", {}),
-    set_project_trust: session("set_project_trust", { choice: literals("trust", "trust_parent", "do_not_trust") }),
+    set_project_trust: session("set_project_trust", {
+        choice: literals("trust", "trust_parent", "do_not_trust"),
+        expectedCwd: OptStr,
+    }),
     get_project_settings: session("get_project_settings", {}),
-    set_project_setting: session("set_project_setting", { key: Id, value: Type.Unknown() }),
+    set_project_setting: session("set_project_setting", { key: Id, value: Type.Unknown(), expectedCwd: OptStr }),
     read_project_file: session("read_project_file", { path: PathStr }),
     write_project_file: session("write_project_file", {
         path: PathStr,
         content: Str,
         ifEtag: Type.Union([Id, Type.Null()]),
+        expectedCwd: OptStr,
     }),
     extension_request: session("extension_request", { name: Id, data: Opt(Type.Unknown()) }),
     "eval_cells.list": session("eval_cells.list", {}),

package/dist/modes/rpc/method-classes-schema.d.ts

@@ -1305,6 +1305,7 @@ export declare const RPC_INBOUND_SCHEMAS: {
         readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
     } & {
         readonly choice: import("typebox").TUnion<[import("typebox").TLiteral<string>, ...import("typebox").TLiteral<string>[]]>;
+        readonly expectedCwd: import("typebox").TOptional<import("typebox").TString>;
     }>;
     readonly get_project_settings: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
@@ -1322,6 +1323,7 @@ export declare const RPC_INBOUND_SCHEMAS: {
     } & {
         readonly key: import("typebox").TString;
         readonly value: import("typebox").TUnknown;
+        readonly expectedCwd: import("typebox").TOptional<import("typebox").TString>;
     }>;
     readonly read_project_file: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
@@ -1342,6 +1344,7 @@ export declare const RPC_INBOUND_SCHEMAS: {
         readonly path: import("typebox").TString;
         readonly content: import("typebox").TString;
         readonly ifEtag: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+        readonly expectedCwd: import("typebox").TOptional<import("typebox").TString>;
     }>;
     readonly extension_request: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;

package/dist/modes/rpc/project-expected-cwd.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A project write may state the folder its caller means (`expectedCwd`). A client that reaches a session by a key that
+ * can since name another session (a remote desktop, through a relay) states it, so the write lands only in the project
+ * it means: when the session's working directory is another folder, the write is refused and nothing is written.
+ * Absent, the write goes as it always has.
+ */
+import { RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_PROJECT_CWD_MISMATCH } from "./rpc-error-types.ts";
+/**
+ * A folder path for comparison. Trailing separators of the path's own style are dropped (only `/` for a POSIX path;
+ * `\\` or `/` for a drive or UNC path), but a bare POSIX or drive root keeps one: `"/"` stays `"/"`, and a bare drive
+ * root becomes `"X:\\"` (`"C:"`, `"C:/"` and `"c:\\"` all become `"C:\\"`). A Windows drive letter is compared
+ * without case (`c:` and `C:` are one drive). Nothing else is folded: the rest of the path is compared as written,
+ * because whether a file system ignores case depends on the volume and cannot be assumed; and nothing is trimmed,
+ * since on POSIX `"/w/app "` and `"/w/app\\"` are other directories.
+ */
+export declare function comparableFolder(path: string): string;
+export interface CwdMismatch {
+    readonly message: string;
+    readonly errorCode: typeof RPC_ERROR_PROJECT_CWD_MISMATCH | typeof RPC_ERROR_INVALID_ARGUMENT;
+}
+/**
+ * The refusal of a project write whose stated folder is not the session's, or whose `expectedCwd` is present but not a
+ * string, or undefined when it may go.
+ */
+export declare function projectCwdMismatch(command: {
+    readonly type: string;
+    readonly expectedCwd?: unknown;
+}, sessionCwd: string): CwdMismatch | undefined;
+//# sourceMappingURL=project-expected-cwd.d.ts.map

package/dist/modes/rpc/project-expected-cwd.js

@@ -0,0 +1,45 @@
+/**
+ * A project write may state the folder its caller means (`expectedCwd`). A client that reaches a session by a key that
+ * can since name another session (a remote desktop, through a relay) states it, so the write lands only in the project
+ * it means: when the session's working directory is another folder, the write is refused and nothing is written.
+ * Absent, the write goes as it always has.
+ */
+import { RPC_ERROR_INVALID_ARGUMENT, RPC_ERROR_PROJECT_CWD_MISMATCH } from "./rpc-error-types.js";
+/** The project writes that may state the folder they mean. */
+const PROJECT_WRITES = new Set(["set_project_trust", "set_project_setting", "write_project_file"]);
+/**
+ * A folder path for comparison. Trailing separators of the path's own style are dropped (only `/` for a POSIX path;
+ * `\\` or `/` for a drive or UNC path), but a bare POSIX or drive root keeps one: `"/"` stays `"/"`, and a bare drive
+ * root becomes `"X:\\"` (`"C:"`, `"C:/"` and `"c:\\"` all become `"C:\\"`). A Windows drive letter is compared
+ * without case (`c:` and `C:` are one drive). Nothing else is folded: the rest of the path is compared as written,
+ * because whether a file system ignores case depends on the volume and cannot be assumed; and nothing is trimmed,
+ * since on POSIX `"/w/app "` and `"/w/app\\"` are other directories.
+ */
+export function comparableFolder(path) {
+    if (path.startsWith("/"))
+        return path.replace(/\/+$/u, "") || "/";
+    const hasDrive = /^[A-Za-z]:/u.test(path);
+    const folded = hasDrive ? `${path.slice(0, 1).toUpperCase()}${path.slice(1)}` : path;
+    const stripped = folded.replace(/[/\\]+$/u, "");
+    return hasDrive && stripped.length === 2 ? `${stripped}\\` : stripped;
+}
+/**
+ * The refusal of a project write whose stated folder is not the session's, or whose `expectedCwd` is present but not a
+ * string, or undefined when it may go.
+ */
+export function projectCwdMismatch(command, sessionCwd) {
+    if (!PROJECT_WRITES.has(command.type) || command.expectedCwd === undefined)
+        return undefined;
+    if (typeof command.expectedCwd !== "string")
+        return {
+            message: "expectedCwd must be a string: the folder this write is for; nothing was written.",
+            errorCode: RPC_ERROR_INVALID_ARGUMENT,
+        };
+    if (comparableFolder(command.expectedCwd) === comparableFolder(sessionCwd))
+        return undefined;
+    return {
+        message: "This session is in another folder than the one this write is for; nothing was written.",
+        errorCode: RPC_ERROR_PROJECT_CWD_MISMATCH,
+    };
+}
+//# sourceMappingURL=project-expected-cwd.js.map

package/dist/modes/rpc/rpc-error-types.d.ts

@@ -22,6 +22,12 @@ export declare const RPC_ERROR_RESPONSE_TOO_LARGE = "response_too_large";
  * throwing `toJSON`); `error` names the cause. Sent in place of the reply so the caller is never left waiting (senpi#5702).
  */
 export declare const RPC_ERROR_RESPONSE_UNWRITABLE = "response_unwritable";
+/**
+ * A project write stated the folder its caller means (`expectedCwd`) and the session is in another one: nothing is
+ * written. A client that names a session by a key that may since point at another session states the folder it
+ * means, so a write never lands in the wrong project.
+ */
+export declare const RPC_ERROR_PROJECT_CWD_MISMATCH = "project_cwd_mismatch";
 export declare const RPC_ERROR_OPEN_FAILED = "open_failed";
 export declare const RPC_ERROR_OWNER_CHANGED = "owner_changed";
 export declare const RPC_ERROR_SESSION_NOT_HELD = "session_not_held";
@@ -131,5 +137,5 @@ export declare const RPC_ERROR_RELEASE_FAILED = "release_failed";
 export declare const RPC_ERROR_HOST_DRAINING = "host_draining";
 /** The supervisor has closed admission; a launch-owning caller may ensure a successor. */
 export declare const RPC_ERROR_HOST_STOPPING = "host_stopping";
-export type RpcErrorCode = typeof RPC_ERROR_SESSION_IDENTITY_MISMATCH | typeof RPC_ERROR_SESSION_BUSY_LIFECYCLE | typeof RPC_ERROR_ATTACHED_ELSEWHERE | typeof RPC_ERROR_OWNER_CHANGED | typeof RPC_ERROR_SESSION_NOT_HELD | typeof RPC_ERROR_HOST_STOPPING | typeof RPC_ERROR_UNKNOWN_SESSION | typeof RPC_ERROR_SESSION_NOT_ATTACHED | typeof RPC_ERROR_SESSION_CLOSING | typeof RPC_ERROR_SESSION_PATH_IN_USE | typeof RPC_ERROR_SESSION_HELD | typeof RPC_ERROR_SESSION_RESERVATION_LIMIT | typeof RPC_ERROR_MISSING_SESSION_ID | typeof RPC_ERROR_MULTI_SESSION_DISABLED | typeof RPC_ERROR_INVALID_PATH | typeof RPC_ERROR_OPEN_FAILED | typeof RPC_ERROR_MEDIA_NOT_FOUND | typeof RPC_ERROR_PROJECT_TRUST_LOCKED | typeof RPC_ERROR_PROJECT_TRUST_EXTENSION_DECIDED | typeof RPC_ERROR_PROJECT_SETTINGS_WRITE_FAILED | typeof RPC_ERROR_PROJECT_NOT_TRUSTED | typeof RPC_ERROR_PROJECT_SETTINGS_UNREADABLE | typeof RPC_ERROR_PROJECT_FILE_NOT_ALLOWED | typeof RPC_ERROR_PROJECT_FILE_CONFLICT | typeof RPC_ERROR_PROJECT_FILE_TOO_LARGE | typeof RPC_ERROR_PROJECT_FILE_WRITE_FAILED | typeof RPC_ERROR_INVALID_SESSION_CONTEXT | typeof RPC_ERROR_INVALID_SUBSCRIPTION | typeof RPC_ERROR_UNKNOWN_SUBSCRIPTION | typeof RPC_ERROR_SUBSCRIPTION_LIMIT | typeof RPC_ERROR_UNSUPPORTED_TRANSPORT | typeof RPC_ERROR_INVALID_SESSION_KIND | typeof RPC_ERROR_INVALID_LAUNCH_PROFILE | typeof RPC_ERROR_INVALID_SESSION_ID | typeof RPC_ERROR_SESSION_ID_IN_USE | typeof RPC_ERROR_HOST_MEMORY_PRESSURE | typeof RPC_ERROR_WARM_FAILED | typeof RPC_ERROR_STREAMING | typeof RPC_ERROR_ENTRY_NOT_FOUND | typeof RPC_ERROR_MODEL_NOT_FOUND | typeof RPC_ERROR_EFFECT_ID_CONFLICT | typeof RPC_ERROR_TRANSCRIPT_UNREADABLE | typeof RPC_ERROR_PROVIDER_UNAVAILABLE | typeof RPC_ERROR_PROVIDER_CREDENTIALS_MISSING | typeof RPC_ERROR_PROVIDER_CREDENTIALS_EXPIRED | typeof RPC_ERROR_NO_MODEL_SELECTED | typeof RPC_ERROR_TURN_CONFLICT | typeof RPC_ERROR_CONTEXT_BUDGET | typeof RPC_ERROR_EVAL_CELL_NOT_FOUND | typeof RPC_ERROR_INVALID_EVAL_CELL_REQUEST | typeof RPC_ERROR_EVAL_CELLS_UNAVAILABLE | typeof RPC_ERROR_NOT_ASSISTANT | typeof RPC_ERROR_NOT_USER | typeof RPC_ERROR_EMPTY_TEXT | typeof RPC_ERROR_UNKNOWN_COMMAND | typeof RPC_ERROR_STALE_LEAF | typeof RPC_ERROR_TURN_ACTIVE | typeof RPC_ERROR_SESSION_BUSY | typeof RPC_ERROR_ATTACHED | typeof RPC_ERROR_INVALID_RELEASE_REASON | typeof RPC_ERROR_RELEASE_UNSUPPORTED | typeof RPC_ERROR_RELEASE_FAILED | typeof RPC_ERROR_HOST_DRAINING | typeof RPC_ERROR_RESPONSE_UNWRITABLE;
+export type RpcErrorCode = typeof RPC_ERROR_SESSION_IDENTITY_MISMATCH | typeof RPC_ERROR_SESSION_BUSY_LIFECYCLE | typeof RPC_ERROR_ATTACHED_ELSEWHERE | typeof RPC_ERROR_OWNER_CHANGED | typeof RPC_ERROR_SESSION_NOT_HELD | typeof RPC_ERROR_HOST_STOPPING | typeof RPC_ERROR_UNKNOWN_SESSION | typeof RPC_ERROR_SESSION_NOT_ATTACHED | typeof RPC_ERROR_SESSION_CLOSING | typeof RPC_ERROR_SESSION_PATH_IN_USE | typeof RPC_ERROR_SESSION_HELD | typeof RPC_ERROR_SESSION_RESERVATION_LIMIT | typeof RPC_ERROR_MISSING_SESSION_ID | typeof RPC_ERROR_MULTI_SESSION_DISABLED | typeof RPC_ERROR_INVALID_PATH | typeof RPC_ERROR_OPEN_FAILED | typeof RPC_ERROR_MEDIA_NOT_FOUND | typeof RPC_ERROR_PROJECT_TRUST_LOCKED | typeof RPC_ERROR_PROJECT_TRUST_EXTENSION_DECIDED | typeof RPC_ERROR_PROJECT_SETTINGS_WRITE_FAILED | typeof RPC_ERROR_PROJECT_NOT_TRUSTED | typeof RPC_ERROR_PROJECT_SETTINGS_UNREADABLE | typeof RPC_ERROR_PROJECT_FILE_NOT_ALLOWED | typeof RPC_ERROR_PROJECT_FILE_CONFLICT | typeof RPC_ERROR_PROJECT_FILE_TOO_LARGE | typeof RPC_ERROR_PROJECT_FILE_WRITE_FAILED | typeof RPC_ERROR_INVALID_SESSION_CONTEXT | typeof RPC_ERROR_INVALID_SUBSCRIPTION | typeof RPC_ERROR_UNKNOWN_SUBSCRIPTION | typeof RPC_ERROR_SUBSCRIPTION_LIMIT | typeof RPC_ERROR_UNSUPPORTED_TRANSPORT | typeof RPC_ERROR_INVALID_SESSION_KIND | typeof RPC_ERROR_INVALID_LAUNCH_PROFILE | typeof RPC_ERROR_INVALID_SESSION_ID | typeof RPC_ERROR_SESSION_ID_IN_USE | typeof RPC_ERROR_HOST_MEMORY_PRESSURE | typeof RPC_ERROR_WARM_FAILED | typeof RPC_ERROR_STREAMING | typeof RPC_ERROR_ENTRY_NOT_FOUND | typeof RPC_ERROR_MODEL_NOT_FOUND | typeof RPC_ERROR_EFFECT_ID_CONFLICT | typeof RPC_ERROR_TRANSCRIPT_UNREADABLE | typeof RPC_ERROR_PROVIDER_UNAVAILABLE | typeof RPC_ERROR_PROVIDER_CREDENTIALS_MISSING | typeof RPC_ERROR_PROVIDER_CREDENTIALS_EXPIRED | typeof RPC_ERROR_NO_MODEL_SELECTED | typeof RPC_ERROR_TURN_CONFLICT | typeof RPC_ERROR_CONTEXT_BUDGET | typeof RPC_ERROR_EVAL_CELL_NOT_FOUND | typeof RPC_ERROR_INVALID_EVAL_CELL_REQUEST | typeof RPC_ERROR_EVAL_CELLS_UNAVAILABLE | typeof RPC_ERROR_NOT_ASSISTANT | typeof RPC_ERROR_NOT_USER | typeof RPC_ERROR_EMPTY_TEXT | typeof RPC_ERROR_UNKNOWN_COMMAND | typeof RPC_ERROR_STALE_LEAF | typeof RPC_ERROR_TURN_ACTIVE | typeof RPC_ERROR_SESSION_BUSY | typeof RPC_ERROR_ATTACHED | typeof RPC_ERROR_INVALID_RELEASE_REASON | typeof RPC_ERROR_RELEASE_UNSUPPORTED | typeof RPC_ERROR_RELEASE_FAILED | typeof RPC_ERROR_HOST_DRAINING | typeof RPC_ERROR_RESPONSE_UNWRITABLE | typeof RPC_ERROR_PROJECT_CWD_MISMATCH;
 //# sourceMappingURL=rpc-error-types.d.ts.map

package/dist/modes/rpc/rpc-error-types.js

@@ -22,6 +22,12 @@ export const RPC_ERROR_RESPONSE_TOO_LARGE = "response_too_large";
  * throwing `toJSON`); `error` names the cause. Sent in place of the reply so the caller is never left waiting (senpi#5702).
  */
 export const RPC_ERROR_RESPONSE_UNWRITABLE = "response_unwritable";
+/**
+ * A project write stated the folder its caller means (`expectedCwd`) and the session is in another one: nothing is
+ * written. A client that names a session by a key that may since point at another session states the folder it
+ * means, so a write never lands in the wrong project.
+ */
+export const RPC_ERROR_PROJECT_CWD_MISMATCH = "project_cwd_mismatch";
 export const RPC_ERROR_OPEN_FAILED = "open_failed";
 export const RPC_ERROR_OWNER_CHANGED = "owner_changed";
 export const RPC_ERROR_SESSION_NOT_HELD = "session_not_held";

package/dist/modes/rpc/rpc-session-command-types.d.ts

@@ -480,6 +480,7 @@ export type RpcSessionCommand = {
     id?: string;
     type: "set_project_trust";
     choice: "trust" | "trust_parent" | "do_not_trust";
+    expectedCwd?: string;
 } | {
     id?: string;
     type: "get_project_settings";
@@ -488,6 +489,7 @@ export type RpcSessionCommand = {
     type: "set_project_setting";
     key: string;
     value: unknown;
+    expectedCwd?: string;
 } | {
     id?: string;
     type: "read_project_file";
@@ -498,6 +500,7 @@ export type RpcSessionCommand = {
     path: string;
     content: string;
     ifEtag: string | null;
+    expectedCwd?: string;
 } | {
     id?: string;
     type: "extension_request";

package/dist/modes/rpc/session-router-close.js

@@ -180,8 +180,13 @@ export async function tearDownReleased(host, sessionId, sessionPath) {
     const binding = host.bindings.get(sessionId);
     binding?.cancelPendingExtensionUiRequests?.();
     forgetSessionOwnership(host, sessionId);
-    if (claim.finalizer)
+    if (claim.finalizer) {
+        // The file is another runtime's now: drop its handover-parked record entry as an explicit close does, or the
+        // next host on this endpoint would reopen it (senpi#6444).
+        if (host.handoverParkedDir !== undefined)
+            await clearRetainedRecord(host, host.registry.peek(sessionId));
         await finalizeClose(host, sessionId, binding, () => host.writer.releaseSession(sessionId, sessionPath));
+    }
     else
         await host.finalizations.get(sessionId)?.promise;
     host.writer.forgetSession(sessionId);

package/dist/modes/rpc/session-router-open.js

@@ -1,3 +1,4 @@
+import { stat } from "node:fs/promises";
 import { compactUpdatesEnabled } from "../../core/engine-socket-flag.js";
 import { startOpenTimer } from "../../core/open-timing.js";
 import { compactOpen } from "./compact-open-admission.js";
@@ -69,6 +70,10 @@ export async function open(host, command, owner, options) {
         // An open that names no folder resumes a session file where its header says, not where this host runs
         // (senpi#6427). Inside the try: a file it cannot read refuses the open, and that refusal is this open's answer.
         const profile = { ...validated, cwd: await openSessionFolder(command, validated.cwd) };
+        // A folder that exists but is a file (or a socket) is refused, typed, before anything is opened or created. A missing
+        // folder, or one this host cannot stat, keeps today's answer from the registry.
+        if ((await stat(profile.cwd).catch(() => undefined))?.isDirectory() === false)
+            return error(command.id, "open_session", "session_cwd_not_directory", { cwd: profile.cwd });
         await assertSessionNotHeld(command.sessionPath);
         timer.mark("held_check");
         options?.signal?.throwIfAborted();

package/dist/modes/rpc/session-status.d.ts

@@ -10,7 +10,7 @@
 import type { SessionKind } from "../../core/extensions/types.ts";
 import type { RpcSessionState } from "./session-registry-types.ts";
 export type SessionStatusValue = "opening" | "idle" | "running" | "waiting_input" | "compacting" | "unloaded" | "closed";
-export type SessionStatusCause = "open" | "prompt" | "agent_end" | "agent_idle" | "abort" | "question" | "compaction" | "set_model" | "queue" | "attach" | "detach" | "replace" | "park" | "close" | "context";
+export type SessionStatusCause = "open" | "prompt" | "agent_end" | "agent_idle" | "abort" | "question" | "compaction" | "set_model" | "queue" | "attach" | "detach" | "replace" | "park" | "close" | "context" | "rename";
 export type SessionStatusActor = "client" | "agent" | "host";
 /** A session's published labels: the open-time context overlaid with every `set_session_context` patch. */
 export type PublishedSessionContext = Readonly<Record<string, string | number | boolean>>;

package/dist/modes/rpc/session-status.js

@@ -85,6 +85,8 @@ export function causeOfRecord(record) {
             return "set_model";
         case "session_replaced":
             return "replace";
+        case "session_info_changed":
+            return "rename";
         case "session_parked":
             return "park";
         case "session_closed":

package/dist/package-manager-cli.d.ts

@@ -1,6 +1,20 @@
+import { type InstallMethod } from "./config.ts";
 import type { InlineExtension } from "./core/extensions/types.ts";
 export type PackageCommand = "install" | "remove" | "update" | "list";
 export declare function cleanupManagedInstall(): void;
+export interface SelfUpdatePlan {
+    packageName: string;
+    installSpec: string;
+    version: string;
+    shouldRun: boolean;
+    note?: string;
+}
+/**
+ * The latest-version lookup failed. A standalone binary cannot update itself in place, and since senpi#6633 its lookup
+ * asks the unauthenticated GitHub API (60 requests per hour per IP), so a failed lookup points it at the download page
+ * instead of failing `update --self`. Every other install still fails, because it would run an install command.
+ */
+export declare function selfUpdatePlanAfterLookupFailure(installMethod: InstallMethod, reason: string): SelfUpdatePlan;
 export interface PackageCommandRuntimeOptions {
     extensionFactories?: InlineExtension[];
 }

package/dist/package-manager-cli.js

@@ -576,6 +576,19 @@ function printSelfUpdateNote(note) {
     }
     console.log();
 }
+/**
+ * The latest-version lookup failed. A standalone binary cannot update itself in place, and since senpi#6633 its lookup
+ * asks the unauthenticated GitHub API (60 requests per hour per IP), so a failed lookup points it at the download page
+ * instead of failing `update --self`. Every other install still fails, because it would run an install command.
+ */
+export function selfUpdatePlanAfterLookupFailure(installMethod, reason) {
+    if (installMethod !== "bun-binary") {
+        throw new Error(`Could not determine latest ${APP_NAME} version${reason ? `: ${reason}` : "."}`);
+    }
+    console.log(chalk.yellow(`Could not check the latest ${APP_NAME} release${reason ? ` (${reason})` : ""}.`));
+    console.log(chalk.cyan("Download from: https://github.com/code-yeongyu/senpi/releases/latest"));
+    return { packageName: PACKAGE_NAME, installSpec: PACKAGE_NAME, version: VERSION, shouldRun: false };
+}
 async function getSelfUpdatePlan(force) {
     const brandUpdate = brandProfile()?.update;
     if (brandUpdate) {
@@ -593,12 +606,15 @@ async function getSelfUpdatePlan(force) {
         latestRelease = await getLatestPiRelease(VERSION, { retry: true });
     }
     catch (error) {
-        throw new Error(`Could not determine latest ${APP_NAME} version: ${formatVersionCheckError(error)}`, {
-            cause: error,
-        });
+        try {
+            return selfUpdatePlanAfterLookupFailure(detectInstallMethod(), formatVersionCheckError(error));
+        }
+        catch (planError) {
+            throw planError instanceof Error ? Object.assign(planError, { cause: error }) : planError;
+        }
     }
     if (!latestRelease) {
-        throw new Error(`Could not determine latest ${APP_NAME} version.`);
+        return selfUpdatePlanAfterLookupFailure(detectInstallMethod(), "");
     }
     const packageName = latestRelease.packageName ?? PACKAGE_NAME;
     const installSpec = `${packageName}@${latestRelease.version}`;

package/dist/utils/version-check.d.ts

@@ -1,4 +1,7 @@
+import { type InstallMethod } from "../config.ts";
 import { type BrandUpdateChannel } from "../core/brand.ts";
+/** Version of the latest GitHub Release, from its tag; drafts and prereleases are not installable. */
+export declare function readLatestReleaseVersion(payload: unknown): string | undefined;
 /** Reads the available version out of whichever registry document was fetched. */
 export declare function readAvailableVersion(payload: unknown, channel: BrandUpdateChannel | undefined): string | undefined;
 export interface LatestPiRelease {
@@ -11,13 +14,13 @@ export declare function formatVersionCheckError(error: unknown): string;
 export declare function comparePackageVersions(leftVersion: string, rightVersion: string): number | undefined;
 export declare function isNewerPackageVersion(candidateVersion: string, currentVersion: string): boolean;
 export declare function getReleaseChangelogUrl(version: string): string;
-export declare function getLatestPiRelease(currentVersion: string, options?: {
+export interface VersionCheckOptions {
     timeoutMs?: number;
     retry?: boolean;
-}): Promise<LatestPiRelease | undefined>;
-export declare function getLatestPiVersion(currentVersion: string, options?: {
-    timeoutMs?: number;
-    retry?: boolean;
-}): Promise<string | undefined>;
-export declare function checkForNewPiVersion(currentVersion: string): Promise<LatestPiRelease | undefined>;
+    /** Defaults to the running install; tests pass it explicitly. */
+    installMethod?: InstallMethod;
+}
+export declare function getLatestPiRelease(currentVersion: string, options?: VersionCheckOptions): Promise<LatestPiRelease | undefined>;
+export declare function getLatestPiVersion(currentVersion: string, options?: VersionCheckOptions): Promise<string | undefined>;
+export declare function checkForNewPiVersion(currentVersion: string, options?: Pick<VersionCheckOptions, "installMethod">): Promise<LatestPiRelease | undefined>;
 //# sourceMappingURL=version-check.d.ts.map

package/dist/utils/version-check.js

@@ -1,5 +1,5 @@
 import { compare, valid } from "semver";
-import { PACKAGE_NAME } from "../config.js";
+import { detectInstallMethod, PACKAGE_NAME } from "../config.js";
 import { brandProfile, envValue } from "../core/brand.js";
 import { fetchWithRetry } from "./management-http.js";
 import { getPiUserAgent } from "./pi-user-agent.js";
@@ -11,6 +11,20 @@ function latestVersionUrl(channel) {
         ? `${REGISTRY_BASE_URL}/-/package/${encodeURIComponent(channel.packageName)}/dist-tags`
         : LATEST_VERSION_URL;
 }
+// A standalone binary can only be updated from a GitHub Release ("Download from: .../releases/latest" in config.ts),
+// and npm can publish before that release exists (senpi#6633), so a binary reads the latest release, never npm.
+const LATEST_RELEASE_URL = "https://api.github.com/repos/code-yeongyu/senpi/releases/latest";
+/** Version of the latest GitHub Release, from its tag; drafts and prereleases are not installable. */
+export function readLatestReleaseVersion(payload) {
+    if (typeof payload !== "object" || payload === null)
+        return undefined;
+    const release = payload;
+    if (release.draft === true || release.prerelease === true)
+        return undefined;
+    const tag = typeof release.tag_name === "string" ? release.tag_name.trim() : "";
+    const version = tag.startsWith("v") ? tag.slice(1) : tag;
+    return version || undefined;
+}
 /** Reads the available version out of whichever registry document was fetched. */
 export function readAvailableVersion(payload, channel) {
     if (typeof payload !== "object" || payload === null)
@@ -96,10 +110,11 @@ export async function getLatestPiRelease(currentVersion, options = {}) {
         // advertising them would send the user after an update they cannot apply.
         return undefined;
     }
-    const response = await fetchWithRetry(latestVersionUrl(channel), {
+    const fromRelease = !channel && (options.installMethod ?? detectInstallMethod()) === "bun-binary";
+    const response = await fetchWithRetry(fromRelease ? LATEST_RELEASE_URL : latestVersionUrl(channel), {
         headers: {
             "User-Agent": getPiUserAgent(currentVersion),
-            accept: "application/json",
+            accept: fromRelease ? "application/vnd.github+json" : "application/json",
         },
     }, {
         maxRetries: options.retry ? 2 : 0,
@@ -107,6 +122,10 @@ export async function getLatestPiRelease(currentVersion, options = {}) {
     });
     if (!response.ok)
         return undefined;
+    if (fromRelease) {
+        const releaseVersion = readLatestReleaseVersion(await response.json());
+        return releaseVersion ? { version: releaseVersion } : undefined;
+    }
     const data = (await response.json());
     const availableVersion = readAvailableVersion(data, channel);
     if (!availableVersion) {
@@ -122,11 +141,11 @@ export async function getLatestPiRelease(currentVersion, options = {}) {
 export async function getLatestPiVersion(currentVersion, options = {}) {
     return (await getLatestPiRelease(currentVersion, options))?.version;
 }
-export async function checkForNewPiVersion(currentVersion) {
+export async function checkForNewPiVersion(currentVersion, options = {}) {
     if (envValue("SKIP_VERSION_CHECK"))
         return undefined;
     try {
-        const latestRelease = await getLatestPiRelease(currentVersion);
+        const latestRelease = await getLatestPiRelease(currentVersion, options);
         if (latestRelease && isNewerPackageVersion(latestRelease.version, currentVersion)) {
             return latestRelease;
         }

package/docs/extensions.md

@@ -2569,6 +2569,18 @@ pi.registerShortcut("ctrl+shift+p", {
 });
 ```
 
+### pi.registerDeviceMachine(machine)
+
+Register the operation layer of the device this session's tools run on (a `ToolMachine`, for example from `createToolMachine({ ops })`). Only tools named in `OMO_TOOLS_VIA_DAEMON` use it, today `bash`, and the bash tool reads it when a command runs. With the flag on and no machine registered, bash fails with `DeviceUnavailableError` and never runs locally.
+
+One registration per session: a second one, from any extension, throws `DeviceMachineConflictError` (`code: "device_machine_conflict"`, with `registeredBy` and `attemptedBy`). A registration made by an extension whose factory then throws is discarded with the rest of that load.
+
+```typescript
+import { createToolMachine } from "@code-yeongyu/senpi";
+
+pi.registerDeviceMachine(createToolMachine({ ops: myDeviceOps }));
+```
+
 ### pi.registerFlag(name, options)
 
 Register a CLI flag.

package/docs/rpc.md

@@ -2624,7 +2624,7 @@ A connection without an attachment receives `errorCode: "session_not_attached"`
 ```
 
 - `status`: `opening`, `idle`, `running`, `waiting_input` (a question is pending), `compacting`, `unloaded` (the routing handle ended and the session reopens by `sessionPath`; `reason` is `idle`, `unload_session` or `handoff`), or `closed` (`reason` is the `session_closed.reason`). After an abort ends a run, `idle` carries `reason: "aborted"`.
-- `lastChange.cause`: `open`, `prompt`, `agent_end`, `agent_idle`, `abort`, `question`, `compaction`, `set_model`, `queue`, `attach`, `detach`, `replace`, `park`, `close` or `context`; `by` is `client`, `agent` or `host`.
+- `lastChange.cause`: `open`, `prompt`, `agent_end`, `agent_idle`, `abort`, `question`, `compaction`, `set_model`, `queue`, `attach`, `detach`, `replace`, `park`, `close`, `context` or `rename` (the session's name changed: `set_session_name` or a generated title); `by` is `client`, `agent` or `host`.
 - `context` is present only with `include_context`. `lastEffect: { effectId, kind, state }` names the session's most recent effect receipt (an input with a `clientMessageId`, an abort, a model or thinking-level switch) and is absent on hosts without the `effect_ledger` capability or before the session's first effect.
 - On `new_session`, `switch_session` or `fork` the routing id stays; the record carries the new `durableSessionId` and `sessionPath` with cause `replace`.
 
@@ -3403,10 +3403,11 @@ What the host does enforce are lifecycle windows, and they only ever return memo
   endpoint's daemon directory (`handover-parked/`, one entry per session path, the same record a handoff park writes)
   as soon as its open succeeds; the entry follows the session's `set_session_context` patches and its park, and a
   transcript switch (`new_session`, `switch_session`, a fork) moves it to the new file, so only the transcript the
-  session is on comes back. An explicit `close_session` or a reclaim removes every key the session was recorded
-  under. While the session is open the entry names the process that holds it; a park drops that, and a host never
-  reopens an entry whose holding process is still alive. So during a generation handoff the successor does not open
-  a session its draining predecessor still has loaded, idle and detached ones included: it reopens the predecessor's
+  session is on comes back. An explicit `close_session`, a `release_session` (the file is another runtime's then) or
+  a reclaim removes every key the session was recorded under. While the session is open the entry names the process
+  that holds it; a park drops that, and a host never reopens an entry whose holding process is still alive. So during
+  a generation handoff the successor does not open a session its draining predecessor still has loaded, idle and
+  detached ones included: it reopens the predecessor's
   park once the drain writes it (or the entry, if the predecessor dies without parking). A host
   that starts on the same socket and agent dir - after a handoff, a clean stop, a crash, or a kill in the middle of a
   turn - reopens, in the background right after it binds, every entry an earlier process wrote, replaying the
@@ -4023,7 +4024,7 @@ names a valid preset.
 
 ### The folder an open_session works in
 
-`open_session.cwd` is the folder the session works in: its tools run there and its project files are read from there. An open that names one works in it. An open that names none and a `sessionPath` at which a session file exists works in the folder that file's header names, as `--session` does; the host maps a folder the desktop moved to where it lives now. A header folder that is not on this host refuses the open with `open_failed` (`Stored session working directory does not exist: <folder>`): the session is never opened in the host's own folder instead. Name a `cwd` to open it somewhere else. Any other open without `cwd` (no `sessionPath`, a `sessionPath` no file is at yet, or a file whose header names no folder) works in the folder the host was started in. An open that attaches to a session this host already holds leaves its folder as it is.
+`open_session.cwd` is the folder the session works in: its tools run there and its project files are read from there. An open that names one works in it. An open that names none and a `sessionPath` at which a session file exists works in the folder that file's header names, as `--session` does; the host maps a folder the desktop moved to where it lives now. A header folder that is not on this host refuses the open with `open_failed` (`Stored session working directory does not exist: <folder>`): the session is never opened in the host's own folder instead. A folder that exists but is not a directory (a file, a socket), named or taken from a header, refuses the open with `session_cwd_not_directory` (`errorData { cwd }`) before any session is opened or created. Name a `cwd` to open it somewhere else. Any other open without `cwd` (no `sessionPath`, a `sessionPath` no file is at yet, or a file whose header names no folder) works in the folder the host was started in. An open that attaches to a session this host already holds leaves its folder as it is.
 
 An open that names no folder never falls back to the host's own for a session file it could not read: a file that exists but cannot be read, and a moved-path probe whose step timed out, refuse the open (`open_failed`) instead. A `cwd` of `null` means no folder was named, as the host's launch profile already reads it.
 
@@ -4231,6 +4232,7 @@ codes or code prefixes in `error`:
 - `release_unsupported` (`release_session` for a session this host cannot hand over; `errorData.detail` is `worker_runtime` - a worker isolate owns the runtime - or `no_session_file`)
 - `release_failed` (`release_session` whose hand-over failed after it began - the release entry could not be written or the teardown threw; `errorData.detail` is the error message, plus `interrupted`/`dropped` after an interrupt)
 - `invalid_path` (relative `sessionPath`/`cwd`)
+- `session_cwd_not_directory` (`open_session` whose `cwd`, named or taken from a session file's header, exists but is not a directory; `errorData { cwd }`; nothing is opened or created)
 - `open_failed: <detail>`. `open_failed: model_unavailable: <reason>` means the open named a model (`provider`/`modelId`) that could not be resolved, for example an unknown provider; the session is not opened, rather than running on the default model. The in-process runtime adds `errorData { reason: "model_unavailable", requestedModel }`; a worker runtime relays the same error text, so match on the prefix
 - `invalid_session_context: <detail>` (`open_session.context` past a documented cap: more than 32 keys, a key that does not match `^[a-z][a-z0-9_]*$`, a non-string or >16 KiB value, or more than 32 KiB of JSON in total; the detail names the cap and its byte budget)
 - `invalid_subscription: <reason>` (`subscribe_sessions` with a malformed `sessions`, `mirror` or flag; `errorData { reason, action }`)
@@ -6287,12 +6289,12 @@ as they would on `reload`, and the next session opened in the folder gets the sa
 implied by `open_session` or by a permission preset; only this explicit request saves a decision.
 
 ```json
-{"type": "set_project_trust", "choice": "trust"}
+{"type": "set_project_trust", "choice": "trust", "expectedCwd": "/home/me/project"}
 ```
 
-`choice` is `trust` (this folder), `trust_parent` (the parent folder; clears this folder's own entry, as `/trust`
+`expectedCwd` is optional, as on every project write: see [The folder a project write is for](#the-folder-a-project-write-is-for). `choice` is `trust` (this folder), `trust_parent` (the parent folder; clears this folder's own entry, as `/trust`
 does) or `do_not_trust`. The response carries the same `data` as `get_project_trust`, read after the change.
-Errors: `invalid_argument` for an unknown choice, `project_trust_locked` when the launch named the trust, and
+Errors: `invalid_argument` for an unknown choice or an `expectedCwd` that is not a string, `project_cwd_mismatch` when `expectedCwd` names another folder than the session's (nothing is saved or applied), `project_trust_locked` when the launch named the trust, and
 `project_trust_extension_decided` when a `project_trust` handler of an extension loaded before trust (never a
 project extension) decides the other way: such a handler decides before any saved choice when a session opens, so
 the request is refused and nothing is saved or applied. A folder with nothing trust gates stays trusted whatever is
@@ -6332,11 +6334,12 @@ the file: values the session reads when it starts (default model and thinking le
 modes) apply after `reload` or in the next session.
 
 ```json
-{"type": "set_project_setting", "key": "defaultThinkingLevel", "value": "high"}
+{"type": "set_project_setting", "key": "defaultThinkingLevel", "value": "high", "expectedCwd": "/home/me/project"}
 ```
 
 The response carries the same `data` as `get_project_settings`, read after the write. Errors:
-`invalid_argument` when `key` is not an identifier (`[A-Za-z][A-Za-z0-9_]*`) or `value` is missing,
+`invalid_argument` when `key` is not an identifier (`[A-Za-z][A-Za-z0-9_]*`), `value` is missing or `expectedCwd` is
+not a string, `project_cwd_mismatch` when `expectedCwd` names another folder (nothing is written),
 `project_not_trusted` while the project is untrusted (trust it first), `project_settings_unreadable` when the
 existing file does not parse (nothing is written), and `project_settings_write_failed` when writing the file fails
 (permissions, a held lock).
@@ -6377,19 +6380,31 @@ Errors: `invalid_argument` when `path` is not a string, `project_file_not_allowe
 other path, or when a folder on the way or the file itself is a symlink or not a regular file and folder, and
 `project_file_too_large` (`errorData: { limitBytes }`) for a stored file over 512 KiB.
 
+#### The folder a project write is for
+
+`set_project_trust`, `set_project_setting` and `write_project_file` take an optional `expectedCwd`: the folder the
+caller means. A client that reaches a session by a key that can since name another session (a remote desktop, through
+a relay) states it, so the write lands only in that folder's project. When it is given and the session's working
+directory is another folder, the write is refused with `project_cwd_mismatch` and nothing is written or applied. Both
+paths are compared with only trailing separators of the path's own style dropped (`/` for a POSIX path; `\` or `/`
+for a drive or UNC path) and a Windows drive letter in either case; nothing is trimmed and the rest of the path is
+compared as written. A present `expectedCwd` that is not a string is refused with `invalid_argument`. Without it, a
+write behaves as before.
+
 #### write_project_file
 
 Replaces (or creates) one of the files `read_project_file` reads, naming the version it replaces.
 
 ```json
-{"type": "write_project_file", "path": "AGENTS.md", "content": "# Project rules\n", "ifEtag": "sha256-…"}
+{"type": "write_project_file", "path": "AGENTS.md", "content": "# Project rules\n", "ifEtag": "sha256-…", "expectedCwd": "/home/me/project"}
 ```
 
 `ifEtag` is required: the `etag` last read, or `null` to create a file that must not exist yet. Missing parent
 folders are created. The file lands by a temporary file and a rename, so a reader never sees a partial write, and
 writes to one file are applied one at a time. The response carries the same `data` as `read_project_file`, read
 after the write. The session reads its instruction files when they are next loaded (a new session or `reload`).
-Errors: `invalid_argument` when `content` is not a string or `ifEtag` is neither a string nor `null`,
+Errors: `invalid_argument` when `content` is not a string, `ifEtag` is neither a string nor `null`, or `expectedCwd` is
+not a string, `project_cwd_mismatch` when `expectedCwd` names another folder (nothing is written),
 `project_not_trusted` while the project is untrusted, `project_file_not_allowed` as for `read_project_file`,
 `project_file_too_large` (`errorData: { limitBytes }`) for content over 512 KiB or a stored file over 512 KiB (its
 version cannot be checked without reading it), `project_file_conflict` when

package/docs/settings.md

@@ -332,7 +332,7 @@ Keep `retry.provider.maxRetries` at `0` unless provider-level retries are explic
 
 #### Model fallback chains
 
-`retry.fallbackChains` maps a primary-model selector to an ordered list of fallback selectors. A selector is `provider/model` with an optional `:thinking-level` suffix, or a bare `model` id that applies to that model vendor's own providers - for example `anthropic-subscription` and `anthropic` for Claude, `chatgpt-subscription` and `openai` for GPT, `google` and `google-vertex` for Gemini. A bare selector never expands onto a reseller, gateway, cloud re-host or custom provider that also serves the model; name one as `provider/model` to use it. A bare id from a vendor senpi does not know stays on the provider the session is already using. Within the vendor's providers, those holding an OAuth credential are preferred, then a fixed precedence order. Senpi ships bare default chains for `claude-fable-5-2`, `claude-fable-5-1` and `claude-fable-5` - `claude-opus-5-5`, then `claude-opus-5` - and for `claude-opus-5-5` - `claude-fable-5-2`, then `claude-opus-5`, because a rate limit on one Opus model holds the whole Opus quota - with no thinking level of their own, so a shipped rung inherits the session's thinking level (clamped to what the model supports), so Fable 5.2, Fable 5.1, Fable 5 and Opus 5.5 keep a fallback chain whichever provider serves them, and a fallback never leaves the Anthropic family; set a key to `[]` to opt out entirely, or set one `provider/claude-fable-5-1` key to override just that provider. For example, this switches Fable 5.1 to Kimi K3 at `max` thinking when an eligible failure occurs:
+`retry.fallbackChains` maps a primary-model selector to an ordered list of fallback selectors. A selector is `provider/model` with an optional `:thinking-level` suffix, or a bare `model` id that applies to that model vendor's own providers - for example `anthropic-subscription` and `anthropic` for Claude, `chatgpt-subscription` and `openai` for GPT, `google` and `google-vertex` for Gemini. A bare selector never expands onto a reseller, gateway, cloud re-host or custom provider that also serves the model; name one as `provider/model` to use it. A bare id from a vendor senpi does not know stays on the provider the session is already using. Within the vendor's providers, those holding an OAuth credential are preferred, then a fixed precedence order. Senpi ships bare default chains for `claude-fable-5-2`, `claude-fable-5-1` and `claude-fable-5` - `claude-opus-5-5`, then `claude-opus-5`, with no thinking level of their own, so those rungs inherit the session's thinking level (clamped to what the model supports) and a Fable fallback never leaves the Anthropic family - and for `claude-opus-5-5` - `claude-fable-5-2:medium`, then `kimi-k3.1-pro:max`, and nothing else: each of those rungs runs at its own level whatever level the Opus 5.5 session was on, and no Opus rung follows because a rate limit on one Opus model holds the whole Opus quota. The bare `kimi-k3.1-pro` rung reaches Kimi Code (which serves it as `k3.1-pro`) and Moonshot. A fallback keeps walking the chain it started on, so a session that stepped from Opus 5.5 to Fable 5.2 moves on to Kimi K3.1 Pro rather than to Fable's own chain. These chains apply whichever provider serves the model; set a key to `[]` to opt out entirely, or set one `provider/claude-fable-5-1` key to override just that provider. For example, this switches Fable 5.1 to Kimi K3 at `max` thinking when an eligible failure occurs:
 
 ```json
 {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.11.13",
+	"version": "2026.11.15-2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -92,10 +92,10 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.11.13",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.11.13",
-		"@earendil-works/pi-realm-registry": "npm:@code-yeongyu/senpi-realm-registry@2026.11.13",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.11.13",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.11.15-2",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.11.15-2",
+		"@earendil-works/pi-realm-registry": "npm:@code-yeongyu/senpi-realm-registry@2026.11.15-2",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.11.15-2",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"ajv": "8.20.0",
 		"chalk": "6.0.0",
@@ -116,8 +116,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.321",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.11.13",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.11.13",
+		"@code-yeongyu/senpi-codemode": "2026.11.15-2",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.11.15-2",
 		"@modelcontextprotocol/sdk": "1.32.1",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",