@code-yeongyu/senpi 2026.11.2-3 → 2026.11.3-1

package/dist/core/tools/grep/index.js

@@ -30,9 +30,8 @@ const grepSchema = Type.Object({
 });
 export const grepToolSystemPromptContribution = {
     snippet: "Search file contents (regex/literal) across paths with structured results; respects .gitignore",
-    guidelines: [
-        "Use tool.grep for content search instead of rg/grep in a shell; paginate with skip and narrow with glob/path when a page is full",
-    ],
+    // The eval-only grep guideline (system-prompt.ts getEvalOnlyGrepGuideline) carries the pagination rule once.
+    guidelines: [],
 };
 async function pathStat(path) {
     try {

package/dist/core/tools/powershell.d.ts

@@ -1,7 +1,7 @@
 import { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, type createBashTool, createShellToolDefinition } from "./bash.ts";
 export declare const powershellToolSystemPromptContribution: {
     readonly snippet: "Execute PowerShell commands";
-    readonly guidelines: readonly ["You can inspect PI_* environment variables for current model and session details."];
+    readonly guidelines: readonly ["PI_* env vars = current model + session details."];
 };
 export type PowerShellOperations = BashOperations;
 export type PowerShellSpawnContext = BashSpawnContext;

package/dist/core/tools/powershell.js

@@ -4,7 +4,7 @@ import { wrapToolDefinition } from "./tool-definition-wrapper.js";
 const UTF8_OUTPUT_PREFIX = "try { [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 } catch {}\n";
 export const powershellToolSystemPromptContribution = {
     snippet: "Execute PowerShell commands",
-    guidelines: ["You can inspect PI_* environment variables for current model and session details."],
+    guidelines: ["PI_* env vars = current model + session details."],
 };
 export function createLocalPowerShellOperations() {
     const operations = createLocalShellOperations("PowerShell", getPowerShellConfig);

package/dist/core/tools/read.d.ts

@@ -11,7 +11,7 @@ declare const readSchema: Type.TObject<{
 }>;
 export declare const readToolSystemPromptContribution: {
     readonly snippet: "Read file contents";
-    readonly guidelines: readonly ["Use read to examine files instead of cat or sed."];
+    readonly guidelines: readonly ["Files: read, not cat/sed."];
 };
 export type ReadToolInput = Static<typeof readSchema>;
 export interface ReadToolDetails {

package/dist/core/tools/read.js

@@ -17,7 +17,7 @@ const readSchema = Type.Object({
 });
 export const readToolSystemPromptContribution = {
     snippet: "Read file contents",
-    guidelines: ["Use read to examine files instead of cat or sed."],
+    guidelines: ["Files: read, not cat/sed."],
 };
 const LOCAL_URI_SCHEME = /^local:\/\//i;
 const LOCAL_URI_GUIDANCE = "local:// URIs resolve only inside eval cells via the kernel read()/write() helpers; the read tool takes filesystem paths. Re-read this with the eval read() helper, or retry with the plain absolute file path.";

package/dist/core/tools/write.d.ts

@@ -8,7 +8,7 @@ declare const writeSchema: Type.TObject<{
 }>;
 export declare const writeToolSystemPromptContribution: {
     readonly snippet: "Create or overwrite files";
-    readonly guidelines: readonly ["Use write only for new files or complete rewrites."];
+    readonly guidelines: readonly ["write only for new files or full rewrites."];
 };
 export type WriteToolInput = Static<typeof writeSchema>;
 /**

package/dist/core/tools/write.js

@@ -13,7 +13,7 @@ const writeSchema = Type.Object({
 });
 export const writeToolSystemPromptContribution = {
     snippet: "Create or overwrite files",
-    guidelines: ["Use write only for new files or complete rewrites."],
+    guidelines: ["write only for new files or full rewrites."],
 };
 const defaultWriteOperations = {
     writeFile: (path, content) => fsWriteFile(path, content, "utf-8"),

package/dist/engine-trust/shell-trust.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The trust annotation on agent-shell results (omo#10762, design r13 6.7). Under a fallback generation a
+ * command that exits non-zero carries a trusted status taken from the adopted record and, only when its
+ * output looks like a certificate verification error, an untrusted hint naming the matched catalog pattern.
+ * The output never supplies a reason or an action: any command can print any text, including a forged
+ * Bun footer or trust line (design M16). Like `adopted.ts`, this module does not load the marker parser.
+ */
+import { type EngineTrustActionId } from "./actions.ts";
+import type { ENGINE_TRUST_FALLBACK_REASONS } from "./marker.ts";
+/** Catalog order decides which entry a hint names when several match. */
+declare const SHELL_TRUST_PATTERNS: readonly [readonly ["UNABLE_TO_GET_ISSUER_CERT_LOCALLY", RegExp], readonly ["UNABLE_TO_GET_ISSUER_CERT", RegExp], readonly ["UNABLE_TO_VERIFY_LEAF_SIGNATURE", RegExp], readonly ["SELF_SIGNED_CERT_IN_CHAIN", RegExp], readonly ["DEPTH_ZERO_SELF_SIGNED_CERT", RegExp], readonly ["CERT_UNTRUSTED", RegExp], readonly ["unable-to-verify-the-first-certificate", RegExp], readonly ["unable-to-get-local-issuer-certificate", RegExp], readonly ["unable-to-get-issuer-certificate", RegExp], readonly ["self-signed-certificate-in-certificate-chain", RegExp], readonly ["self-signed-certificate", RegExp], readonly ["certificate-not-trusted", RegExp]];
+export type ShellTrustPatternId = (typeof SHELL_TRUST_PATTERNS)[number][0];
+export type ShellTrust = {
+    readonly status: {
+        readonly code: "trust-import-degraded";
+        readonly reason: (typeof ENGINE_TRUST_FALLBACK_REASONS)[number];
+        readonly action: EngineTrustActionId;
+    };
+    readonly hint?: {
+        readonly code: "tls-verify-text-in-output";
+        readonly heuristic: true;
+        readonly pattern: ShellTrustPatternId;
+    };
+};
+export type ShellTrustAnnotation = {
+    readonly trust: ShellTrust;
+    /** The one fixed line appended for the model, only with a hint; it never echoes output. */
+    readonly text: string | undefined;
+};
+/** Nothing without an adopted fallback generation, on exit 0, or for a command that has no exit code. */
+export declare function annotateShellTrust({ exitCode, output, }: {
+    readonly exitCode: number | null;
+    readonly output: string;
+}): ShellTrustAnnotation | undefined;
+export {};
+//# sourceMappingURL=shell-trust.d.ts.map

package/dist/engine-trust/shell-trust.js

@@ -0,0 +1,44 @@
+/**
+ * The trust annotation on agent-shell results (omo#10762, design r13 6.7). Under a fallback generation a
+ * command that exits non-zero carries a trusted status taken from the adopted record and, only when its
+ * output looks like a certificate verification error, an untrusted hint naming the matched catalog pattern.
+ * The output never supplies a reason or an action: any command can print any text, including a forged
+ * Bun footer or trust line (design M16). Like `adopted.ts`, this module does not load the marker parser.
+ */
+import { engineTrustAction } from "./actions.js";
+import { adoptedEngineTrust } from "./adopted.js";
+/** A verification code (design 6.6) as a whole token, whatever quotes surround it. */
+const token = (code) => new RegExp(`(?<![A-Za-z0-9_])${code}(?![A-Za-z0-9_])`, "u");
+/** Catalog order decides which entry a hint names when several match. */
+const SHELL_TRUST_PATTERNS = [
+    ["UNABLE_TO_GET_ISSUER_CERT_LOCALLY", token("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")],
+    ["UNABLE_TO_GET_ISSUER_CERT", token("UNABLE_TO_GET_ISSUER_CERT")],
+    ["UNABLE_TO_VERIFY_LEAF_SIGNATURE", token("UNABLE_TO_VERIFY_LEAF_SIGNATURE")],
+    ["SELF_SIGNED_CERT_IN_CHAIN", token("SELF_SIGNED_CERT_IN_CHAIN")],
+    ["DEPTH_ZERO_SELF_SIGNED_CERT", token("DEPTH_ZERO_SELF_SIGNED_CERT")],
+    ["CERT_UNTRUSTED", token("CERT_UNTRUSTED")],
+    ["unable-to-verify-the-first-certificate", /unable to verify the first certificate/iu],
+    ["unable-to-get-local-issuer-certificate", /unable to get local issuer certificate/iu],
+    ["unable-to-get-issuer-certificate", /unable to get issuer certificate/iu],
+    ["self-signed-certificate-in-certificate-chain", /self[- ]signed certificate in certificate chain/iu],
+    ["self-signed-certificate", /self[- ]signed certificate/iu],
+    ["certificate-not-trusted", /certificate not trusted/iu],
+];
+/** Nothing without an adopted fallback generation, on exit 0, or for a command that has no exit code. */
+export function annotateShellTrust({ exitCode, output, }) {
+    const marker = adoptedEngineTrust();
+    if (marker?.automatic !== "fallback" || marker.fallbackReason === null || exitCode === null || exitCode === 0) {
+        return undefined;
+    }
+    const reason = marker.fallbackReason;
+    const action = engineTrustAction(reason);
+    const status = { code: "trust-import-degraded", reason, action: action.id };
+    const pattern = SHELL_TRUST_PATTERNS.find(([, matcher]) => matcher.test(output))?.[0];
+    if (pattern === undefined)
+        return { trust: { status }, text: undefined };
+    return {
+        trust: { status, hint: { code: "tls-verify-text-in-output", heuristic: true, pattern } },
+        text: `omo: certificate import is degraded (${reason}), so some TLS connections may fail. This command's output contains text that looks like a certificate verification error; omo has not confirmed the cause. To diagnose: ${action.text}`,
+    };
+}
+//# sourceMappingURL=shell-trust.js.map

package/dist/engine-trust/transport-failure.d.ts

@@ -0,0 +1,12 @@
+import { type ProviderDiagnostic } from "@earendil-works/pi-ai";
+import { type EngineTrustActionId } from "./actions.ts";
+import type { ENGINE_TRUST_FALLBACK_REASONS } from "./marker.ts";
+type FallbackReason = (typeof ENGINE_TRUST_FALLBACK_REASONS)[number];
+export interface TransportTrustFailure {
+    readonly code: "trust-tls-failed-under-fallback";
+    readonly reason: FallbackReason;
+    readonly action: EngineTrustActionId;
+}
+export declare function transportTrustFailure(diagnostic: ProviderDiagnostic | undefined): TransportTrustFailure | undefined;
+export {};
+//# sourceMappingURL=transport-failure.d.ts.map

package/dist/engine-trust/transport-failure.js

@@ -0,0 +1,48 @@
+/**
+ * The `trust` object a provider failure carries when the request failed TLS chain verification while
+ * this engine runs on a fallback trust generation (omo#10762, design r13 6.6; senpi#5244). The code
+ * comes only from the adapter's structured transport diagnostic, which reads the native error's
+ * `code`, never message text. The object and its diagnostics record name no host, path or certificate.
+ */
+import { appendFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { isTlsChainVerificationCode } from "@earendil-works/pi-ai";
+import { engineTrustAction } from "./actions.js";
+import { adoptedEngineTrust } from "./adopted.js";
+/** Reasons this process already wrote a record for: one record per process and reason. */
+const recordedReasons = new Set();
+export function transportTrustFailure(diagnostic) {
+    if (diagnostic?.evidence !== "structured_transport" || diagnostic.code === undefined)
+        return undefined;
+    if (!isTlsChainVerificationCode(diagnostic.code))
+        return undefined;
+    const trust = adoptedEngineTrust();
+    if (trust?.automatic !== "fallback" || trust.fallbackReason === null)
+        return undefined;
+    const reason = trust.fallbackReason;
+    if (!recordedReasons.has(reason)) {
+        recordedReasons.add(reason);
+        appendDiagnosticsRecord(trust.file, {
+            v: 1,
+            at: new Date().toISOString(),
+            pid: process.pid,
+            generation: trust.sha256,
+            codes: ["trust-tls-failed-under-fallback", reason],
+        });
+    }
+    return { code: "trust-tls-failed-under-fallback", reason, action: engineTrustAction(reason).id };
+}
+/**
+ * One line, in one append, to `diagnostics.jsonl` beside the generation file (design 5.3). The append
+ * is asynchronous because this runs on the RPC session path, which takes no blocking filesystem call
+ * (no-sync-in-session-path). A record that cannot be written costs only the record: the failure still
+ * carries its `trust` object.
+ */
+function appendDiagnosticsRecord(generationFile, record) {
+    appendFile(join(dirname(generationFile), "diagnostics.jsonl"), `${JSON.stringify(record)}\n`, {
+        mode: 0o600,
+    }).catch(() => {
+        // The trust directory may be gone or read-only; the record is diagnostic only.
+    });
+}
+//# sourceMappingURL=transport-failure.js.map

package/dist/modes/interactive/interactive-mode.js

@@ -46,6 +46,7 @@ import { defaultModelPerProvider, findExactModelReferenceMatch, resolveModelScop
 import { CredentialSynchronizationError } from "../../core/model-runtime.js";
 import { formatProviderFailure } from "../../core/provider-failure.js";
 import { failureAlreadyDescribed, headNoticeShownElsewhere } from "./provider-error-description.js";
+import { describeFallbackExhaustion } from "../../core/retry-fallback/exhaustion.js";
 import { usageLimitCause } from "../../core/retry-fallback/usage-limit.js";
 import { formatMissingSessionCwdPrompt, MissingSessionCwdError } from "../../core/session-cwd.js";
 import { createSessionLogger } from "../../core/session-log.js";
@@ -4864,19 +4865,24 @@ export class InteractiveMode {
                 });
                 this.setExtensionStatus(FALLBACK_STATUS_KEY, undefined);
                 break;
-            case "retry_fallback_exhausted":
-                if (isRetryableProviderError(event.lastError)) {
+            case "retry_fallback_exhausted": {
+                // A walk that started on another failure must lead with it, not the last rung's (senpi#4084).
+                const startedElsewhere = (event.failures?.length ?? 0) > 1;
+                if (isRetryableProviderError(event.lastError) && !startedElsewhere) {
                     this.getProviderErrors().finish(event.lastError);
                     this.setExtensionStatus(FALLBACK_STATUS_KEY, undefined);
                     break;
                 }
+                if (isRetryableProviderError(event.lastError))
+                    this.getProviderErrors().clear();
                 this.showNoticeBox({
                     title: `✕ Fallback chain exhausted · ${event.chainKey}`,
                     tone: "error",
-                    why: event.lastError,
+                    why: describeFallbackExhaustion(event),
                 });
                 this.setExtensionStatus(FALLBACK_STATUS_KEY, undefined);
                 break;
+            }
             case "server_fallback_aborted":
                 this.showNoticeBox({
                     title: `⚠ Server fallback aborted · ${event.from} → ${event.to}`,

package/dist/modes/print-mode.js

@@ -7,6 +7,7 @@
  */
 import { describeProviderFailureForUser, stripTurnRetrySuppressionPrefix, } from "@earendil-works/pi-ai";
 import { flushRawStdout, waitForRawStdoutBackpressure, writeRawStdout } from "../core/output-guard.js";
+import { describeFallbackExhaustion } from "../core/retry-fallback/exhaustion.js";
 import { usageLimitCause, usageLimitScope } from "../core/retry-fallback/usage-limit.js";
 import { killTrackedDetachedChildren } from "../utils/shell.js";
 import { toJsonEvent } from "./json-event.js";
@@ -107,7 +108,7 @@ export async function runPrintMode(runtimeHost, options) {
                 console.error(`Model fallback: ${event.from} -> ${event.to} (${usageLimitCause(event.from, event.limit) ?? event.reason})`);
             }
             else if (event.type === "retry_fallback_exhausted") {
-                console.error(`Model fallback exhausted: ${event.chainKey} (${event.lastError})`);
+                console.error(`Model fallback exhausted: ${event.chainKey} (${describeFallbackExhaustion(event).replaceAll("\n", "; ")})`);
             }
             else if (event.type === "retry_fallback_reverted") {
                 const cause = event.cause === "fallback-unusable" ? ` (${event.from} cannot serve right now)` : "";

package/dist/modes/rpc/compact-catalog-families.d.ts

@@ -1,3 +1,4 @@
+import { type FamilyRegistry } from "./compact-catalog-registry.ts";
 import type { CompactContentStore } from "./compact-content-store.ts";
 import type { CatalogComponent } from "./compact-recovery-catalog.ts";
 import type { SettledReader } from "./compact-settled-messages.ts";
@@ -16,8 +17,10 @@ interface CatalogCut {
  * the members it enumerated and never an explicit empty, so a reader can tell "no members" from "not enumerated"
  * (RULING-60 Q1, RULING-61 Q1). Members stream one at a time: a value goes through `walk` into bounded leaves, a
  * collection through `rows`, and each component's leaves are released once the catalog has placed it. The
- * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03).
+ * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03). Its return
+ * value is the registry it emitted as `families/families`, the one source the manifest copies `requiredKinds` from
+ * (RULING-128).
  */
-export declare function checkpointComponents(cut: CatalogCut, valid: () => void): AsyncGenerator<CatalogComponent>;
+export declare function checkpointComponents(cut: CatalogCut, valid: () => void): AsyncGenerator<CatalogComponent, FamilyRegistry>;
 export {};
 //# sourceMappingURL=compact-catalog-families.d.ts.map

package/dist/modes/rpc/compact-catalog-families.js

@@ -18,7 +18,9 @@ const DIALOGS = familyId("dialogs");
  * the members it enumerated and never an explicit empty, so a reader can tell "no members" from "not enumerated"
  * (RULING-60 Q1, RULING-61 Q1). Members stream one at a time: a value goes through `walk` into bounded leaves, a
  * collection through `rows`, and each component's leaves are released once the catalog has placed it. The
- * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03).
+ * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03). Its return
+ * value is the registry it emitted as `families/families`, the one source the manifest copies `requiredKinds` from
+ * (RULING-128).
  */
 export async function* checkpointComponents(cut, valid) {
     const { store, values, root, settled } = cut;
@@ -26,7 +28,7 @@ export async function* checkpointComponents(cut, valid) {
     if (!current)
         throw new CompactReadError("unavailable");
     const reader = { store, values, valid };
-    const producers = familyProducers(root.transcript, root.refusedCorrelations);
+    const producers = familyProducers(root);
     const registry = familyRegistry(producers);
     yield* textComponent(store, FAMILIES, FAMILIES, JSON.stringify(registry));
     const family = (name) => {
@@ -66,6 +68,7 @@ export async function* checkpointComponents(cut, valid) {
             yield component;
         }
     assertCoverage(registry, emitted);
+    return registry;
 }
 async function* dialogComponents(reader, ref) {
     const dialogs = new CompactComponentRoots(reader.store, () => []);

package/dist/modes/rpc/compact-catalog-registry.d.ts

@@ -26,7 +26,10 @@ export declare const FAMILY_PRODUCERS: FamilyProducers;
  * correlation refused at the protocol depth limit never became the lane's standing one, so `identity` is then
  * `partial` too: its member reports the count (RULING-67 (4)).
  */
-export declare function familyProducers(transcript: TranscriptRoot, refusedCorrelations: number): FamilyProducers;
+export declare function familyProducers(root: {
+    readonly transcript: TranscriptRoot;
+    readonly refusedCorrelations: number;
+}): FamilyProducers;
 /**
  * Every engine source kind (the session file's entry union) and the family that owns its data. The compiler refuses
  * a kind this map misses (TS2741), so a new engine entry type cannot ship uncataloged. A kind outside the union at
@@ -46,6 +49,11 @@ interface RegistryBase {
     readonly format: "senpi-recovery-families";
     readonly version: 1;
     readonly families: readonly FamilyRow[];
+    /**
+     * The families a root built from these producers requires (RULING-128): every `complete` one, in code-unit order,
+     * each once. The manifest carries this exact list, and this component's digest is inside `checkpointDigest`.
+     */
+    readonly requiredKinds: readonly CatalogFamily[];
 }
 /**
  * Set only by `familyRegistry`, which `readFamilyRegistry` decodes through and `completeAssembly` narrows to, so no other

package/dist/modes/rpc/compact-catalog-registry.js

@@ -46,7 +46,8 @@ export const FAMILY_PRODUCERS = {
  * correlation refused at the protocol depth limit never became the lane's standing one, so `identity` is then
  * `partial` too: its member reports the count (RULING-67 (4)).
  */
-export function familyProducers(transcript, refusedCorrelations) {
+export function familyProducers(root) {
+    const { transcript, refusedCorrelations } = root;
     const exact = transcript.unavailable === null;
     const entries = exact
         ? {}
@@ -83,7 +84,11 @@ const COMPLETE = Symbol("complete family registry");
 export function familyRegistry(producers) {
     const families = CATALOG_FAMILIES.map((family) => ({ family, producer: producers[family] }));
     const incomplete = families.filter(({ producer }) => producer !== "complete").map(({ family }) => family);
-    const base = { format: "senpi-recovery-families", version: 1, families };
+    const requiredKinds = families
+        .filter(({ producer }) => producer === "complete")
+        .map(({ family }) => family)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const base = { format: "senpi-recovery-families", version: 1, families, requiredKinds };
     return incomplete.length === 0
         ? { ...base, assembly: "complete", [COMPLETE]: true }
         : { ...base, assembly: "incomplete", incomplete };
@@ -133,6 +138,8 @@ export function readFamilyRegistry(text) {
     const registry = familyRegistry({ ...FAMILY_PRODUCERS, ...producers });
     if (field(value, "assembly") !== registry.assembly)
         throw new RangeError("family registry assembly mismatch");
+    if (JSON.stringify(field(value, "requiredKinds")) !== JSON.stringify(registry.requiredKinds))
+        throw new RangeError("family registry requiredKinds mismatch");
     return registry;
 }
 //# sourceMappingURL=compact-catalog-registry.js.map

package/dist/modes/rpc/compact-recovery-manifest-kinds.d.ts

@@ -0,0 +1,17 @@
+import { type CatalogFamily, type FamilyRegistry } from "./compact-catalog-registry.ts";
+export type RequiredKindsRefusal = "manifest_missing_required_kinds" | "manifest_unknown_required_kind" | "manifest_required_kinds_mismatch";
+export type RequiredKindsRead = {
+    readonly ok: true;
+    readonly requiredKinds: readonly CatalogFamily[];
+} | {
+    readonly ok: false;
+    readonly code: RequiredKindsRefusal;
+};
+/**
+ * The families a client opens for one decoded manifest (RULING-128): its `requiredKinds`, read verbatim and never
+ * replaced by a built-in family list. `registry` is the cut's `families/families` component as `readFamilyRegistry`
+ * decodes it from bytes verified against the root entry that `checkpointDigest` covers. The digest covers that
+ * component, not the manifest field, so the list opens only when it equals the component's complete families.
+ */
+export declare function readRequiredKinds(manifest: unknown, registry: FamilyRegistry): RequiredKindsRead;
+//# sourceMappingURL=compact-recovery-manifest-kinds.d.ts.map

package/dist/modes/rpc/compact-recovery-manifest-kinds.js

@@ -0,0 +1,21 @@
+import { CATALOG_FAMILIES } from "./compact-catalog-registry.js";
+const KNOWN = new Set(CATALOG_FAMILIES);
+const isKnown = (kind) => typeof kind === "string" && KNOWN.has(kind);
+/**
+ * The families a client opens for one decoded manifest (RULING-128): its `requiredKinds`, read verbatim and never
+ * replaced by a built-in family list. `registry` is the cut's `families/families` component as `readFamilyRegistry`
+ * decodes it from bytes verified against the root entry that `checkpointDigest` covers. The digest covers that
+ * component, not the manifest field, so the list opens only when it equals the component's complete families.
+ */
+export function readRequiredKinds(manifest, registry) {
+    const listed = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "requiredKinds") : undefined;
+    if (!Array.isArray(listed))
+        return { ok: false, code: "manifest_missing_required_kinds" };
+    if (!listed.every(isKnown))
+        return { ok: false, code: "manifest_unknown_required_kind" };
+    const complete = registry.requiredKinds;
+    if (listed.length !== complete.length || listed.some((kind, index) => kind !== complete[index]))
+        return { ok: false, code: "manifest_required_kinds_mismatch" };
+    return { ok: true, requiredKinds: complete };
+}
+//# sourceMappingURL=compact-recovery-manifest-kinds.js.map

package/dist/modes/rpc/compact-recovery-manifest-shape.d.ts

@@ -1,3 +1,4 @@
+import type { CatalogFamily } from "./compact-catalog-registry.ts";
 import type { BoundedId, ContentDigest, ContentRef } from "./compact-recovery-ids.ts";
 import type { RecoveryRouteKind } from "./compact-recovery-types.ts";
 /** A manifest string: inline when it is a bounded protocol id, otherwise a ref to its exact stored value. */
@@ -31,6 +32,12 @@ export interface RecoveryManifest {
     readonly checkpointDigest: ContentDigest;
     readonly catalogRoot: ContentRef;
     readonly catalogRootLength: number;
+    /**
+     * The catalog families this cut's root requires (RULING-128): its complete families only, sorted, each once. It is
+     * the `requiredKinds` of the cut's `families/families` registry, so `checkpointDigest` covers it; a client opens
+     * exactly these and never falls back to a built-in family list.
+     */
+    readonly requiredKinds: readonly CatalogFamily[];
 }
 export declare const TEXT_FIELDS: readonly ["socketEpoch", "admissionId", "session", "sessionEpoch", "token", "leaf", "activeMessage", "turn"];
 export type TextField = (typeof TEXT_FIELDS)[number];

package/dist/modes/rpc/compact-recovery-manifest.js

@@ -128,12 +128,19 @@ export class RecoveryManifests {
                     valid();
                 };
                 const cut = { store, values: new CompactValues(store), root, settled: lane.settledOf(root) };
+                const emitted = {};
                 const components = async function* () {
                     yield* oversized.map(({ component }) => component);
-                    yield* checkpointComponents(cut, check);
+                    emitted.registry = yield* checkpointComponents(cut, check);
                 };
                 const built = await this.catalogs.build(store, ref, components(), check);
-                return await this.assemble(store, token, ref, built, oversized, texts);
+                // The list is the cataloged registry's own (RULING-128): the bytes `checkpointDigest` covers, never a recompute.
+                const requiredKinds = emitted.registry?.requiredKinds;
+                if (!requiredKinds) {
+                    this.catalogs.release(store, built);
+                    throw new CompactReadError("ownership");
+                }
+                return await this.assemble(store, token, ref, built, oversized, texts, requiredKinds);
             }
             finally {
                 for (const { component } of oversized)
@@ -144,7 +151,7 @@ export class RecoveryManifests {
         });
     }
     /** Owns `built` from here: a failure anywhere below releases the tree, so no owner outlives a refused build. */
-    async assemble(store, token, ref, built, oversized, texts) {
+    async assemble(store, token, ref, built, oversized, texts, requiredKinds) {
         try {
             let leftmost = ref;
             for (let level = 1; level < built.depth; level++)
@@ -183,6 +190,7 @@ export class RecoveryManifests {
                 checkpointDigest: built.digest,
                 catalogRoot: ref,
                 catalogRootLength: built.length,
+                requiredKinds,
             };
             return { manifest, root: built, store };
         }

package/dist/modes/rpc/compact-socket-commands.js

@@ -1,11 +1,15 @@
 import { compactUpdatesEnabled } from "../../core/engine-socket-flag.js";
 import { CONNECTION_ROLE_FIXED, roleConnection } from "./connection-roles.js";
+import { remoteOriginDeclaration } from "./remote-origin.js";
 import { error } from "./session-router-errors.js";
 /** Validate the full declaration before committing role, media, recovery or pending state. */
 export function declareSocketClient(host, command) {
     const peer = host.writer.currentConnection();
     const selection = peer === undefined ? undefined : host.writer.compactSelection(peer);
     const role = (caps) => host.connectionRoles.declare(roleConnection(peer), caps);
+    const origin = remoteOriginDeclaration(command.remoteOrigin, (declared) => host.connectionRoles.acceptsOrigin(roleConnection(peer), declared));
+    if ("refusal" in origin)
+        return error(command.id, command.type, origin.refusal);
     const reason = selection
         ? selection.declare(command.capabilities, host.registry.supportsCompact?.() === true, role)
         : command.capabilities !== undefined && !role(command.capabilities)
@@ -23,6 +27,8 @@ export function declareSocketClient(host, command) {
     }
     else if (command.capabilities !== undefined)
         host.writer.setSoleSecretCapabilities(command.capabilities);
+    if (origin.origin !== undefined)
+        host.connectionRoles.declareOrigin(roleConnection(peer), origin.origin);
     return {
         id: command.id,
         type: "response",

package/dist/modes/rpc/connection-handler.js

@@ -45,6 +45,7 @@ import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.
 import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
+import { remoteOriginDeclaration, remoteOriginField } from "./remote-origin.js";
 import { advertisedCompactCapabilities, sessionDeclaration } from "./compact-negotiation.js";
 import { ConnectionRoles, roleConnection } from "./connection-roles.js";
 import { AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, ENTRIES_TAIL_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
@@ -339,7 +340,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     const pendingExtensionRequests = new SessionExtensionUiRequests(uiRequestChanged);
     const grantRequests = new Map();
     sessionDialogRequests.set(session, pendingExtensionRequests);
-    const questions = new ConnectionQuestionBridge(output, uiRequestChanged, () => options.clientInfo?.connectionId());
+    const raiserOrigin = () => connectionRoles.originOf(options.clientInfo?.connectionId());
+    const questions = new ConnectionQuestionBridge(output, uiRequestChanged, () => options.clientInfo?.connectionId(), raiserOrigin);
     let secretHandshake = false;
     const secretOwners = new Map();
     const secretCapable = (connection) => connectionRoles.has(connection, INTERACTIVE_USER_CAPABILITY) &&
@@ -381,6 +383,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         if (opts?.signal?.aborted)
             return Promise.resolve(defaultValue);
         const id = crypto.randomUUID();
+        const raised = { ...request, ...remoteOriginField(raiserOrigin()) };
         return new Promise((resolve, reject) => {
             let timeoutId;
             const cleanup = () => {
@@ -403,7 +406,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 }, opts.timeout);
             }
             pendingExtensionRequests.set(id, {
-                frame: { type: "extension_ui_request", id, ...request },
+                frame: { type: "extension_ui_request", id, ...raised },
                 resolve: (response) => {
                     cleanup();
                     resolve(parseResponse(response));
@@ -412,7 +415,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             });
             if (request.grantSelect === true)
                 grantRequests.set(id, options.clientInfo?.connectionId());
-            output({ type: "extension_ui_request", id, ...request });
+            output({ type: "extension_ui_request", id, ...raised });
         });
     }
     const selectGrantDialog = (title, choices, opts) => createDialogPromise(opts, undefined, {
@@ -549,9 +552,17 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         },
         async editor(title, prefill) {
             const id = crypto.randomUUID();
+            const frame = {
+                type: "extension_ui_request",
+                id,
+                method: "editor",
+                title,
+                prefill,
+                ...remoteOriginField(raiserOrigin()),
+            };
             return new Promise((resolve, reject) => {
                 pendingExtensionRequests.set(id, {
-                    frame: { type: "extension_ui_request", id, method: "editor", title, prefill },
+                    frame,
                     resolve: (response) => {
                         if ("cancelled" in response && response.cancelled) {
                             resolve(undefined);
@@ -565,7 +576,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                     },
                     reject,
                 });
-                output({ type: "extension_ui_request", id, method: "editor", title, prefill });
+                output(frame);
             });
         },
         addAutocompleteProvider() {
@@ -1164,9 +1175,14 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // State
             // =================================================================
             case "set_client_info": {
+                const origin = remoteOriginDeclaration(command.remoteOrigin, (declared) => connectionRoles.acceptsOrigin(currentConnectionId(), declared));
+                if ("refusal" in origin)
+                    return error(id, "set_client_info", origin.refusal);
                 const next = sessionDeclaration(options, command, clientCapabilities, (caps) => connectionRoles.declare(currentConnectionId(), caps), replaceClientCapabilities);
                 if (next.refusal)
                     return error(id, "set_client_info", next.refusal);
+                if (origin.origin !== undefined)
+                    connectionRoles.declareOrigin(currentConnectionId(), origin.origin);
                 clientCapabilities = next.capabilities;
                 if (command.capabilities !== undefined) {
                     secretHandshake = true;

package/dist/modes/rpc/connection-question-bridge.d.ts

@@ -1,5 +1,6 @@
 import type { ExtensionUIContext, QuestionRequest, QuestionResponse } from "../../core/extensions/types.ts";
 import type { UiRequestChange } from "./snapshot-types.ts";
+import { type RpcRemoteOrigin } from "./remote-origin.ts";
 import type { RpcExtensionUIProgress, RpcExtensionUIResponse, RpcQuestionUiRequest } from "./rpc-types.ts";
 type Options = Parameters<NonNullable<ExtensionUIContext["question"]>>[1];
 export declare const sessionQuestionBridges: WeakMap<object, ConnectionQuestionBridge>;
@@ -9,7 +10,8 @@ export declare class ConnectionQuestionBridge {
     private readonly output;
     private readonly changed;
     private readonly raiser;
-    constructor(output: (record: object) => void, changed?: (change?: UiRequestChange) => void, raiser?: () => string | undefined);
+    private readonly origin;
+    constructor(output: (record: object) => void, changed?: (change?: UiRequestChange) => void, raiser?: () => string | undefined, origin?: () => RpcRemoteOrigin | undefined);
     pendingQuestions(): RpcQuestionUiRequest[];
     ask(request: QuestionRequest, opts?: Options): Promise<QuestionResponse>;
     respond(response: RpcExtensionUIResponse, beforeAnswer?: () => void): boolean | "question_incomplete" | "question_already_resolved";

package/dist/modes/rpc/connection-question-bridge.js

@@ -1,12 +1,14 @@
 import { settledQuestionStatus, unansweredQuestionIds } from "./extension-ui-response.js";
+import { remoteOriginField } from "./remote-origin.js";
 export const sessionQuestionBridges = new WeakMap();
 export class ConnectionQuestionBridge {
-    constructor(output, changed, raiser = () => undefined) {
+    constructor(output, changed, raiser = () => undefined, origin = () => undefined) {
         this.pending = new Map();
         this.resolved = new Set();
         this.output = output;
         this.changed = changed;
         this.raiser = raiser;
+        this.origin = origin;
     }
     pendingQuestions() {
         return [...this.pending.values()].map(({ frame }) => ({
@@ -27,6 +29,7 @@ export class ConnectionQuestionBridge {
             waitForAnswer: request.waitForAnswer,
             questions: request.questions,
             raisedBy: this.raiser() ?? "agent",
+            ...remoteOriginField(this.origin()),
             timeout,
             askedAtMs,
             deadlineAtMs: askedAtMs + timeout,