@code-yeongyu/senpi 2026.11.2-3 → 2026.11.3-2

package/dist/modes/rpc/compact-catalog-families.d.ts

@@ -1,3 +1,4 @@
+import { type FamilyRegistry } from "./compact-catalog-registry.ts";
 import type { CompactContentStore } from "./compact-content-store.ts";
 import type { CatalogComponent } from "./compact-recovery-catalog.ts";
 import type { SettledReader } from "./compact-settled-messages.ts";
@@ -16,8 +17,10 @@ interface CatalogCut {
  * the members it enumerated and never an explicit empty, so a reader can tell "no members" from "not enumerated"
  * (RULING-60 Q1, RULING-61 Q1). Members stream one at a time: a value goes through `walk` into bounded leaves, a
  * collection through `rows`, and each component's leaves are released once the catalog has placed it. The
- * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03).
+ * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03). Its return
+ * value is the registry it emitted as `families/families`, the one source the manifest copies `requiredKinds` from
+ * (RULING-128).
  */
-export declare function checkpointComponents(cut: CatalogCut, valid: () => void): AsyncGenerator<CatalogComponent>;
+export declare function checkpointComponents(cut: CatalogCut, valid: () => void): AsyncGenerator<CatalogComponent, FamilyRegistry>;
 export {};
 //# sourceMappingURL=compact-catalog-families.d.ts.map

package/dist/modes/rpc/compact-catalog-families.js

@@ -18,7 +18,9 @@ const DIALOGS = familyId("dialogs");
  * the members it enumerated and never an explicit empty, so a reader can tell "no members" from "not enumerated"
  * (RULING-60 Q1, RULING-61 Q1). Members stream one at a time: a value goes through `walk` into bounded leaves, a
  * collection through `rows`, and each component's leaves are released once the catalog has placed it. The
- * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03).
+ * completeness gate runs last: a complete producer that emitted nothing refuses the whole catalog (X03). Its return
+ * value is the registry it emitted as `families/families`, the one source the manifest copies `requiredKinds` from
+ * (RULING-128).
  */
 export async function* checkpointComponents(cut, valid) {
     const { store, values, root, settled } = cut;
@@ -26,7 +28,7 @@ export async function* checkpointComponents(cut, valid) {
     if (!current)
         throw new CompactReadError("unavailable");
     const reader = { store, values, valid };
-    const producers = familyProducers(root.transcript, root.refusedCorrelations);
+    const producers = familyProducers(root);
     const registry = familyRegistry(producers);
     yield* textComponent(store, FAMILIES, FAMILIES, JSON.stringify(registry));
     const family = (name) => {
@@ -66,6 +68,7 @@ export async function* checkpointComponents(cut, valid) {
             yield component;
         }
     assertCoverage(registry, emitted);
+    return registry;
 }
 async function* dialogComponents(reader, ref) {
     const dialogs = new CompactComponentRoots(reader.store, () => []);

package/dist/modes/rpc/compact-catalog-registry.d.ts

@@ -26,7 +26,10 @@ export declare const FAMILY_PRODUCERS: FamilyProducers;
  * correlation refused at the protocol depth limit never became the lane's standing one, so `identity` is then
  * `partial` too: its member reports the count (RULING-67 (4)).
  */
-export declare function familyProducers(transcript: TranscriptRoot, refusedCorrelations: number): FamilyProducers;
+export declare function familyProducers(root: {
+    readonly transcript: TranscriptRoot;
+    readonly refusedCorrelations: number;
+}): FamilyProducers;
 /**
  * Every engine source kind (the session file's entry union) and the family that owns its data. The compiler refuses
  * a kind this map misses (TS2741), so a new engine entry type cannot ship uncataloged. A kind outside the union at
@@ -46,6 +49,11 @@ interface RegistryBase {
     readonly format: "senpi-recovery-families";
     readonly version: 1;
     readonly families: readonly FamilyRow[];
+    /**
+     * The families a root built from these producers requires (RULING-128): every `complete` one, in code-unit order,
+     * each once. The manifest carries this exact list, and this component's digest is inside `checkpointDigest`.
+     */
+    readonly requiredKinds: readonly CatalogFamily[];
 }
 /**
  * Set only by `familyRegistry`, which `readFamilyRegistry` decodes through and `completeAssembly` narrows to, so no other

package/dist/modes/rpc/compact-catalog-registry.js

@@ -46,7 +46,8 @@ export const FAMILY_PRODUCERS = {
  * correlation refused at the protocol depth limit never became the lane's standing one, so `identity` is then
  * `partial` too: its member reports the count (RULING-67 (4)).
  */
-export function familyProducers(transcript, refusedCorrelations) {
+export function familyProducers(root) {
+    const { transcript, refusedCorrelations } = root;
     const exact = transcript.unavailable === null;
     const entries = exact
         ? {}
@@ -83,7 +84,11 @@ const COMPLETE = Symbol("complete family registry");
 export function familyRegistry(producers) {
     const families = CATALOG_FAMILIES.map((family) => ({ family, producer: producers[family] }));
     const incomplete = families.filter(({ producer }) => producer !== "complete").map(({ family }) => family);
-    const base = { format: "senpi-recovery-families", version: 1, families };
+    const requiredKinds = families
+        .filter(({ producer }) => producer === "complete")
+        .map(({ family }) => family)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const base = { format: "senpi-recovery-families", version: 1, families, requiredKinds };
     return incomplete.length === 0
         ? { ...base, assembly: "complete", [COMPLETE]: true }
         : { ...base, assembly: "incomplete", incomplete };
@@ -133,6 +138,8 @@ export function readFamilyRegistry(text) {
     const registry = familyRegistry({ ...FAMILY_PRODUCERS, ...producers });
     if (field(value, "assembly") !== registry.assembly)
         throw new RangeError("family registry assembly mismatch");
+    if (JSON.stringify(field(value, "requiredKinds")) !== JSON.stringify(registry.requiredKinds))
+        throw new RangeError("family registry requiredKinds mismatch");
     return registry;
 }
 //# sourceMappingURL=compact-catalog-registry.js.map

package/dist/modes/rpc/compact-recovery-manifest-kinds.d.ts

@@ -0,0 +1,17 @@
+import { type CatalogFamily, type FamilyRegistry } from "./compact-catalog-registry.ts";
+export type RequiredKindsRefusal = "manifest_missing_required_kinds" | "manifest_unknown_required_kind" | "manifest_required_kinds_mismatch";
+export type RequiredKindsRead = {
+    readonly ok: true;
+    readonly requiredKinds: readonly CatalogFamily[];
+} | {
+    readonly ok: false;
+    readonly code: RequiredKindsRefusal;
+};
+/**
+ * The families a client opens for one decoded manifest (RULING-128): its `requiredKinds`, read verbatim and never
+ * replaced by a built-in family list. `registry` is the cut's `families/families` component as `readFamilyRegistry`
+ * decodes it from bytes verified against the root entry that `checkpointDigest` covers. The digest covers that
+ * component, not the manifest field, so the list opens only when it equals the component's complete families.
+ */
+export declare function readRequiredKinds(manifest: unknown, registry: FamilyRegistry): RequiredKindsRead;
+//# sourceMappingURL=compact-recovery-manifest-kinds.d.ts.map

package/dist/modes/rpc/compact-recovery-manifest-kinds.js

@@ -0,0 +1,21 @@
+import { CATALOG_FAMILIES } from "./compact-catalog-registry.js";
+const KNOWN = new Set(CATALOG_FAMILIES);
+const isKnown = (kind) => typeof kind === "string" && KNOWN.has(kind);
+/**
+ * The families a client opens for one decoded manifest (RULING-128): its `requiredKinds`, read verbatim and never
+ * replaced by a built-in family list. `registry` is the cut's `families/families` component as `readFamilyRegistry`
+ * decodes it from bytes verified against the root entry that `checkpointDigest` covers. The digest covers that
+ * component, not the manifest field, so the list opens only when it equals the component's complete families.
+ */
+export function readRequiredKinds(manifest, registry) {
+    const listed = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "requiredKinds") : undefined;
+    if (!Array.isArray(listed))
+        return { ok: false, code: "manifest_missing_required_kinds" };
+    if (!listed.every(isKnown))
+        return { ok: false, code: "manifest_unknown_required_kind" };
+    const complete = registry.requiredKinds;
+    if (listed.length !== complete.length || listed.some((kind, index) => kind !== complete[index]))
+        return { ok: false, code: "manifest_required_kinds_mismatch" };
+    return { ok: true, requiredKinds: complete };
+}
+//# sourceMappingURL=compact-recovery-manifest-kinds.js.map

package/dist/modes/rpc/compact-recovery-manifest-shape.d.ts

@@ -1,3 +1,4 @@
+import type { CatalogFamily } from "./compact-catalog-registry.ts";
 import type { BoundedId, ContentDigest, ContentRef } from "./compact-recovery-ids.ts";
 import type { RecoveryRouteKind } from "./compact-recovery-types.ts";
 /** A manifest string: inline when it is a bounded protocol id, otherwise a ref to its exact stored value. */
@@ -31,6 +32,12 @@ export interface RecoveryManifest {
     readonly checkpointDigest: ContentDigest;
     readonly catalogRoot: ContentRef;
     readonly catalogRootLength: number;
+    /**
+     * The catalog families this cut's root requires (RULING-128): its complete families only, sorted, each once. It is
+     * the `requiredKinds` of the cut's `families/families` registry, so `checkpointDigest` covers it; a client opens
+     * exactly these and never falls back to a built-in family list.
+     */
+    readonly requiredKinds: readonly CatalogFamily[];
 }
 export declare const TEXT_FIELDS: readonly ["socketEpoch", "admissionId", "session", "sessionEpoch", "token", "leaf", "activeMessage", "turn"];
 export type TextField = (typeof TEXT_FIELDS)[number];

package/dist/modes/rpc/compact-recovery-manifest.js

@@ -128,12 +128,19 @@ export class RecoveryManifests {
                     valid();
                 };
                 const cut = { store, values: new CompactValues(store), root, settled: lane.settledOf(root) };
+                const emitted = {};
                 const components = async function* () {
                     yield* oversized.map(({ component }) => component);
-                    yield* checkpointComponents(cut, check);
+                    emitted.registry = yield* checkpointComponents(cut, check);
                 };
                 const built = await this.catalogs.build(store, ref, components(), check);
-                return await this.assemble(store, token, ref, built, oversized, texts);
+                // The list is the cataloged registry's own (RULING-128): the bytes `checkpointDigest` covers, never a recompute.
+                const requiredKinds = emitted.registry?.requiredKinds;
+                if (!requiredKinds) {
+                    this.catalogs.release(store, built);
+                    throw new CompactReadError("ownership");
+                }
+                return await this.assemble(store, token, ref, built, oversized, texts, requiredKinds);
             }
             finally {
                 for (const { component } of oversized)
@@ -144,7 +151,7 @@ export class RecoveryManifests {
         });
     }
     /** Owns `built` from here: a failure anywhere below releases the tree, so no owner outlives a refused build. */
-    async assemble(store, token, ref, built, oversized, texts) {
+    async assemble(store, token, ref, built, oversized, texts, requiredKinds) {
         try {
             let leftmost = ref;
             for (let level = 1; level < built.depth; level++)
@@ -183,6 +190,7 @@ export class RecoveryManifests {
                 checkpointDigest: built.digest,
                 catalogRoot: ref,
                 catalogRootLength: built.length,
+                requiredKinds,
             };
             return { manifest, root: built, store };
         }

package/dist/modes/rpc/compact-socket-commands.js

@@ -1,11 +1,15 @@
 import { compactUpdatesEnabled } from "../../core/engine-socket-flag.js";
 import { CONNECTION_ROLE_FIXED, roleConnection } from "./connection-roles.js";
+import { remoteOriginDeclaration } from "./remote-origin.js";
 import { error } from "./session-router-errors.js";
 /** Validate the full declaration before committing role, media, recovery or pending state. */
 export function declareSocketClient(host, command) {
     const peer = host.writer.currentConnection();
     const selection = peer === undefined ? undefined : host.writer.compactSelection(peer);
     const role = (caps) => host.connectionRoles.declare(roleConnection(peer), caps);
+    const origin = remoteOriginDeclaration(command.remoteOrigin, (declared) => host.connectionRoles.acceptsOrigin(roleConnection(peer), declared));
+    if ("refusal" in origin)
+        return error(command.id, command.type, origin.refusal);
     const reason = selection
         ? selection.declare(command.capabilities, host.registry.supportsCompact?.() === true, role)
         : command.capabilities !== undefined && !role(command.capabilities)
@@ -23,6 +27,8 @@ export function declareSocketClient(host, command) {
     }
     else if (command.capabilities !== undefined)
         host.writer.setSoleSecretCapabilities(command.capabilities);
+    if (origin.origin !== undefined)
+        host.connectionRoles.declareOrigin(roleConnection(peer), origin.origin);
     return {
         id: command.id,
         type: "response",

package/dist/modes/rpc/connection-handler.js

@@ -45,6 +45,7 @@ import { DURABLE_CLIENT_MESSAGE_ID_CAPABILITY } from "./client-admission-record.
 import { ClientAdmissions } from "./client-admissions.js";
 import { handleClientInput } from "./client-input-handler.js";
 import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } from "./connection-question-bridge.js";
+import { remoteOriginDeclaration, remoteOriginField } from "./remote-origin.js";
 import { advertisedCompactCapabilities, sessionDeclaration } from "./compact-negotiation.js";
 import { ConnectionRoles, roleConnection } from "./connection-roles.js";
 import { AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, ENTRIES_TAIL_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
@@ -339,7 +340,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     const pendingExtensionRequests = new SessionExtensionUiRequests(uiRequestChanged);
     const grantRequests = new Map();
     sessionDialogRequests.set(session, pendingExtensionRequests);
-    const questions = new ConnectionQuestionBridge(output, uiRequestChanged, () => options.clientInfo?.connectionId());
+    const raiserOrigin = () => connectionRoles.originOf(options.clientInfo?.connectionId());
+    const questions = new ConnectionQuestionBridge(output, uiRequestChanged, () => options.clientInfo?.connectionId(), raiserOrigin);
     let secretHandshake = false;
     const secretOwners = new Map();
     const secretCapable = (connection) => connectionRoles.has(connection, INTERACTIVE_USER_CAPABILITY) &&
@@ -381,6 +383,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         if (opts?.signal?.aborted)
             return Promise.resolve(defaultValue);
         const id = crypto.randomUUID();
+        const raised = { ...request, ...remoteOriginField(raiserOrigin()) };
         return new Promise((resolve, reject) => {
             let timeoutId;
             const cleanup = () => {
@@ -403,7 +406,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 }, opts.timeout);
             }
             pendingExtensionRequests.set(id, {
-                frame: { type: "extension_ui_request", id, ...request },
+                frame: { type: "extension_ui_request", id, ...raised },
                 resolve: (response) => {
                     cleanup();
                     resolve(parseResponse(response));
@@ -412,7 +415,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             });
             if (request.grantSelect === true)
                 grantRequests.set(id, options.clientInfo?.connectionId());
-            output({ type: "extension_ui_request", id, ...request });
+            output({ type: "extension_ui_request", id, ...raised });
         });
     }
     const selectGrantDialog = (title, choices, opts) => createDialogPromise(opts, undefined, {
@@ -549,9 +552,17 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
         },
         async editor(title, prefill) {
             const id = crypto.randomUUID();
+            const frame = {
+                type: "extension_ui_request",
+                id,
+                method: "editor",
+                title,
+                prefill,
+                ...remoteOriginField(raiserOrigin()),
+            };
             return new Promise((resolve, reject) => {
                 pendingExtensionRequests.set(id, {
-                    frame: { type: "extension_ui_request", id, method: "editor", title, prefill },
+                    frame,
                     resolve: (response) => {
                         if ("cancelled" in response && response.cancelled) {
                             resolve(undefined);
@@ -565,7 +576,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                     },
                     reject,
                 });
-                output({ type: "extension_ui_request", id, method: "editor", title, prefill });
+                output(frame);
             });
         },
         addAutocompleteProvider() {
@@ -1164,9 +1175,14 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // State
             // =================================================================
             case "set_client_info": {
+                const origin = remoteOriginDeclaration(command.remoteOrigin, (declared) => connectionRoles.acceptsOrigin(currentConnectionId(), declared));
+                if ("refusal" in origin)
+                    return error(id, "set_client_info", origin.refusal);
                 const next = sessionDeclaration(options, command, clientCapabilities, (caps) => connectionRoles.declare(currentConnectionId(), caps), replaceClientCapabilities);
                 if (next.refusal)
                     return error(id, "set_client_info", next.refusal);
+                if (origin.origin !== undefined)
+                    connectionRoles.declareOrigin(currentConnectionId(), origin.origin);
                 clientCapabilities = next.capabilities;
                 if (command.capabilities !== undefined) {
                     secretHandshake = true;
@@ -1689,7 +1705,9 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                         ...(origin === undefined ? {} : { origin }),
                     };
                 });
-                return success(id, "get_auth_providers", { providers });
+                // Read after the rows: building them re-reads a store that failed to load (#4413).
+                const storeError = modelRegistry.authStorage.getLoadError();
+                return success(id, "get_auth_providers", { providers, ...(storeError ? { storeError } : {}) });
             }
             case "login_start": {
                 // Respond IMMEDIATELY: success:true means the flow has started. The

package/dist/modes/rpc/connection-question-bridge.d.ts

@@ -1,5 +1,6 @@
 import type { ExtensionUIContext, QuestionRequest, QuestionResponse } from "../../core/extensions/types.ts";
 import type { UiRequestChange } from "./snapshot-types.ts";
+import { type RpcRemoteOrigin } from "./remote-origin.ts";
 import type { RpcExtensionUIProgress, RpcExtensionUIResponse, RpcQuestionUiRequest } from "./rpc-types.ts";
 type Options = Parameters<NonNullable<ExtensionUIContext["question"]>>[1];
 export declare const sessionQuestionBridges: WeakMap<object, ConnectionQuestionBridge>;
@@ -9,7 +10,8 @@ export declare class ConnectionQuestionBridge {
     private readonly output;
     private readonly changed;
     private readonly raiser;
-    constructor(output: (record: object) => void, changed?: (change?: UiRequestChange) => void, raiser?: () => string | undefined);
+    private readonly origin;
+    constructor(output: (record: object) => void, changed?: (change?: UiRequestChange) => void, raiser?: () => string | undefined, origin?: () => RpcRemoteOrigin | undefined);
     pendingQuestions(): RpcQuestionUiRequest[];
     ask(request: QuestionRequest, opts?: Options): Promise<QuestionResponse>;
     respond(response: RpcExtensionUIResponse, beforeAnswer?: () => void): boolean | "question_incomplete" | "question_already_resolved";

package/dist/modes/rpc/connection-question-bridge.js

@@ -1,12 +1,14 @@
 import { settledQuestionStatus, unansweredQuestionIds } from "./extension-ui-response.js";
+import { remoteOriginField } from "./remote-origin.js";
 export const sessionQuestionBridges = new WeakMap();
 export class ConnectionQuestionBridge {
-    constructor(output, changed, raiser = () => undefined) {
+    constructor(output, changed, raiser = () => undefined, origin = () => undefined) {
         this.pending = new Map();
         this.resolved = new Set();
         this.output = output;
         this.changed = changed;
         this.raiser = raiser;
+        this.origin = origin;
     }
     pendingQuestions() {
         return [...this.pending.values()].map(({ frame }) => ({
@@ -27,6 +29,7 @@ export class ConnectionQuestionBridge {
             waitForAnswer: request.waitForAnswer,
             questions: request.questions,
             raisedBy: this.raiser() ?? "agent",
+            ...remoteOriginField(this.origin()),
             timeout,
             askedAtMs,
             deadlineAtMs: askedAtMs + timeout,

package/dist/modes/rpc/connection-roles.d.ts

@@ -1,3 +1,4 @@
+import { type RpcRemoteOrigin } from "./remote-origin.ts";
 /**
  * Connection roles (senpi#3811): the capabilities that say who a connection speaks for, which is what
  * authority checks read. A role belongs to one connection, never to a session: a shared host serves every
@@ -16,12 +17,19 @@ export declare function roleConnection(connectionId: string | undefined): string
 export declare const CONNECTION_ROLE_FIXED = "connection_role_fixed: interactive_user and task_parent cannot change after they are declared";
 export declare class ConnectionRoles {
     private readonly declared;
+    private readonly origins;
     /** Records the roles a `set_client_info` carries; false when this connection already declared other roles. */
     declare(connectionId: string, capabilities: readonly string[]): boolean;
     /** The roles this connection explicitly declared, or undefined while it has declared none (no id = a stdio client). */
     rolesOf(connectionId: string | undefined): readonly string[] | undefined;
     /** Takes a declaration made elsewhere (the host, for a worker isolate) unless this connection already declared. */
     adopt(connectionId: string, roles: readonly string[]): void;
+    /** Whether `origin` may be declared for this connection: none yet, or the same one again (senpi#5475). */
+    acceptsOrigin(connectionId: string, origin: RpcRemoteOrigin): boolean;
+    /** Records the remote device a connection speaks for; call only after `acceptsOrigin` allowed it. */
+    declareOrigin(connectionId: string, origin: RpcRemoteOrigin): void;
+    /** The remote device this connection declared it speaks for, or undefined for a local connection. */
+    originOf(connectionId: string | undefined): RpcRemoteOrigin | undefined;
     has(connectionId: string | undefined, role: string): boolean;
     release(connectionId: string): void;
     /** Forgets every connection, for a worker isolate whose session ends. */

package/dist/modes/rpc/connection-roles.js

@@ -1,4 +1,5 @@
 import { INTERACTIVE_USER_CAPABILITY, TASK_PARENT_CAPABILITY } from "./custom-capability.js";
+import { sameRemoteOrigin } from "./remote-origin.js";
 /**
  * Connection roles (senpi#3811): the capabilities that say who a connection speaks for, which is what
  * authority checks read. A role belongs to one connection, never to a session: a shared host serves every
@@ -20,6 +21,7 @@ export const CONNECTION_ROLE_FIXED = "connection_role_fixed: interactive_user an
 export class ConnectionRoles {
     constructor() {
         this.declared = new Map();
+        this.origins = new Map();
     }
     /** Records the roles a `set_client_info` carries; false when this connection already declared other roles. */
     declare(connectionId, capabilities) {
@@ -39,15 +41,31 @@ export class ConnectionRoles {
         if (!this.declared.has(connectionId))
             this.declared.set(connectionId, [...roles]);
     }
+    /** Whether `origin` may be declared for this connection: none yet, or the same one again (senpi#5475). */
+    acceptsOrigin(connectionId, origin) {
+        const prior = this.origins.get(connectionId);
+        return prior === undefined || sameRemoteOrigin(prior, origin);
+    }
+    /** Records the remote device a connection speaks for; call only after `acceptsOrigin` allowed it. */
+    declareOrigin(connectionId, origin) {
+        if (this.acceptsOrigin(connectionId, origin))
+            this.origins.set(connectionId, origin);
+    }
+    /** The remote device this connection declared it speaks for, or undefined for a local connection. */
+    originOf(connectionId) {
+        return this.origins.get(roleConnection(connectionId));
+    }
     has(connectionId, role) {
         return this.declared.get(roleConnection(connectionId))?.includes(role) ?? false;
     }
     release(connectionId) {
         this.declared.delete(connectionId);
+        this.origins.delete(connectionId);
     }
     /** Forgets every connection, for a worker isolate whose session ends. */
     clear() {
         this.declared.clear();
+        this.origins.clear();
     }
 }
 //# sourceMappingURL=connection-roles.js.map

package/dist/modes/rpc/effect-commands.d.ts

@@ -817,6 +817,7 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
     success: true;
     data: {
         providers: import("./rpc-session-state-types.ts").RpcAuthProvider[];
+        storeError?: import("./rpc-session-state-types.ts").RpcAuthStoreError;
     };
 } | {
     id?: string;

package/dist/modes/rpc/loopless-execute-grant.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Who may run tool calls on a loopless runtime (senpi#5413). Until the remote tool executor runs the extensions'
+ * `tool_call`/`tool_result` handlers (permission checks among them) for a tool-execution-only process, nothing in the
+ * product may execute through a loopless runtime: the only allowed caller is the in-process test harness. Closed and
+ * fail-closed: a runtime built without a grant this module issued refuses every call.
+ */
+declare const LOOPLESS_EXECUTE_CALLERS: readonly ["in-process-test-harness"];
+export type LooplessExecuteCaller = (typeof LOOPLESS_EXECUTE_CALLERS)[number];
+export interface LooplessExecuteGrant {
+    readonly caller: LooplessExecuteCaller;
+}
+export declare class LooplessExecuteRefusedError extends Error {
+    constructor(reason: string);
+}
+/** Issues the test harness's grant; anywhere but a Vitest run it refuses. */
+export declare function grantLooplessExecuteToTestHarness(): LooplessExecuteGrant;
+/** True only for a grant this module issued to an allowed caller. */
+export declare function isLooplessExecuteGranted(grant: LooplessExecuteGrant | undefined): boolean;
+export {};
+//# sourceMappingURL=loopless-execute-grant.d.ts.map

package/dist/modes/rpc/loopless-execute-grant.js

@@ -0,0 +1,26 @@
+/**
+ * Who may run tool calls on a loopless runtime (senpi#5413). Until the remote tool executor runs the extensions'
+ * `tool_call`/`tool_result` handlers (permission checks among them) for a tool-execution-only process, nothing in the
+ * product may execute through a loopless runtime: the only allowed caller is the in-process test harness. Closed and
+ * fail-closed: a runtime built without a grant this module issued refuses every call.
+ */
+const LOOPLESS_EXECUTE_CALLERS = ["in-process-test-harness"];
+const issued = new WeakSet();
+export class LooplessExecuteRefusedError extends Error {
+    constructor(reason) {
+        super(`loopless_execute_refused: ${reason}`);
+    }
+}
+/** Issues the test harness's grant; anywhere but a Vitest run it refuses. */
+export function grantLooplessExecuteToTestHarness() {
+    if (process.env.VITEST !== "true")
+        throw new LooplessExecuteRefusedError("only the in-process test harness may execute");
+    const grant = Object.freeze({ caller: "in-process-test-harness" });
+    issued.add(grant);
+    return grant;
+}
+/** True only for a grant this module issued to an allowed caller. */
+export function isLooplessExecuteGranted(grant) {
+    return grant !== undefined && issued.has(grant) && LOOPLESS_EXECUTE_CALLERS.includes(grant.caller);
+}
+//# sourceMappingURL=loopless-execute-grant.js.map

package/dist/modes/rpc/loopless-runtime-settings.d.ts

@@ -0,0 +1,30 @@
+import type { AgentSessionRuntimeDiagnostic } from "../../core/agent-session-services.ts";
+import type { ResourceLoaderReloadOptions } from "../../core/resource-loader.ts";
+import { SettingsManager } from "../../core/settings-manager.ts";
+import type { Args } from "../../cli/args.ts";
+import type { CliRuntimeConfiguration } from "../../main.ts";
+import type { LooplessRuntimeProfile } from "./runtime-factory-loopless.ts";
+export interface LooplessRuntimeSettings {
+    readonly settingsManager: SettingsManager;
+    readonly flagValues: Map<string, boolean | string>;
+    readonly reloadOptions: ResourceLoaderReloadOptions | undefined;
+}
+/**
+ * The project trust a session opened from this configuration would get, decided without a UI: a runtime without a
+ * loop has no one to ask, exactly like an RPC worker today (`createCliRuntimeFactory`, main.ts). A `project_trust`
+ * handler's error is reported to `diagnostics`, as the CLI factory reports it.
+ */
+export declare function resolveLooplessSettings(configuration: CliRuntimeConfiguration, startupSettingsManager: SettingsManager, profile: LooplessRuntimeProfile, diagnostics: AgentSessionRuntimeDiagnostic[]): Promise<LooplessRuntimeSettings>;
+export declare function resolveCliPaths(cwd: string, paths: string[] | undefined): string[] | undefined;
+export interface LooplessToolFilters {
+    readonly defaultToolNames?: ReadonlySet<string>;
+    readonly allowedToolNames?: ReadonlySet<string>;
+    readonly excludedToolNames?: ReadonlySet<string>;
+}
+/**
+ * The CLI's tool filters (`--tools`, `--no-tools`, `--no-builtin-tools`, `--exclude-tools`, settings `defaultTools`),
+ * mapped as `main.ts` maps them and resolved as `createAgentSession` resolves them (sdk.ts), so a loopless runtime
+ * registers exactly the tools a session registers for the same flags and settings.
+ */
+export declare function looplessToolFilters(parsed: Args, settingsManager: SettingsManager): LooplessToolFilters;
+//# sourceMappingURL=loopless-runtime-settings.d.ts.map

package/dist/modes/rpc/loopless-runtime-settings.js

@@ -0,0 +1,69 @@
+import { presetTrustsProject, resolveProjectTrusted } from "../../core/project-trust.js";
+import { sessionExtensionFlagValues } from "../../core/session-extension-flags.js";
+import { SettingsManager } from "../../core/settings-manager.js";
+import { getSavedProjectTrust, hasTrustRequiringProjectResources, ProjectTrustStore, } from "../../core/trust-manager.js";
+import { createProjectTrustContext } from "../../cli/project-trust.js";
+import { isLocalPath, resolvePath } from "../../utils/paths.js";
+/**
+ * The project trust a session opened from this configuration would get, decided without a UI: a runtime without a
+ * loop has no one to ask, exactly like an RPC worker today (`createCliRuntimeFactory`, main.ts). A `project_trust`
+ * handler's error is reported to `diagnostics`, as the CLI factory reports it.
+ */
+export async function resolveLooplessSettings(configuration, startupSettingsManager, profile, diagnostics) {
+    const { parsed, agentDir, appMode } = configuration;
+    const { cwd, launchProfile } = profile;
+    const trustStore = new ProjectTrustStore(agentDir);
+    const flagValues = sessionExtensionFlagValues(parsed.unknownFlags, launchProfile);
+    const hasTrustRequiringResources = hasTrustRequiringProjectResources(cwd);
+    const savedProjectTrust = await getSavedProjectTrust(trustStore, cwd);
+    const globalPreset = startupSettingsManager.getGlobalSettings()
+        .permissionPreset;
+    const fullAccessTrust = presetTrustsProject(flagValues.get("permission-preset"), globalPreset) && savedProjectTrust !== false;
+    const shouldResolveProjectTrust = parsed.projectTrustOverride === undefined && !fullAccessTrust && hasTrustRequiringResources;
+    const projectTrusted = shouldResolveProjectTrust
+        ? false
+        : (parsed.projectTrustOverride ?? (fullAccessTrust || !hasTrustRequiringResources || savedProjectTrust === true));
+    const trustFromFullAccess = fullAccessTrust &&
+        hasTrustRequiringResources &&
+        parsed.projectTrustOverride === undefined &&
+        savedProjectTrust !== true;
+    const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted, trustFromFullAccess });
+    const reloadOptions = shouldResolveProjectTrust
+        ? {
+            resolveProjectTrust: ({ extensionsResult }) => resolveProjectTrusted({
+                cwd,
+                trustStore,
+                trustOverride: parsed.projectTrustOverride,
+                defaultProjectTrust: startupSettingsManager.getDefaultProjectTrust(),
+                extensionsResult,
+                projectTrustContext: createProjectTrustContext({
+                    cwd,
+                    mode: appMode,
+                    settingsManager: startupSettingsManager,
+                    hasUI: false,
+                }),
+                onExtensionError: (message) => diagnostics.push({ type: "warning", message }),
+            }),
+        }
+        : undefined;
+    return { settingsManager, flagValues, reloadOptions };
+}
+export function resolveCliPaths(cwd, paths) {
+    return paths?.map((value) => (isLocalPath(value) ? resolvePath(value, cwd) : value));
+}
+/**
+ * The CLI's tool filters (`--tools`, `--no-tools`, `--no-builtin-tools`, `--exclude-tools`, settings `defaultTools`),
+ * mapped as `main.ts` maps them and resolved as `createAgentSession` resolves them (sdk.ts), so a loopless runtime
+ * registers exactly the tools a session registers for the same flags and settings.
+ */
+export function looplessToolFilters(parsed, settingsManager) {
+    const noTools = parsed.noTools ? "all" : parsed.noBuiltinTools ? "builtin" : undefined;
+    const defaultToolNames = parsed.tools === undefined && noTools === undefined ? settingsManager.getDefaultTools() : undefined;
+    const allowedToolNames = parsed.tools ?? (noTools === "all" ? [] : undefined);
+    return {
+        ...(defaultToolNames === undefined ? {} : { defaultToolNames: new Set(defaultToolNames) }),
+        ...(allowedToolNames === undefined ? {} : { allowedToolNames: new Set(allowedToolNames) }),
+        ...(parsed.excludeTools === undefined ? {} : { excludedToolNames: new Set(parsed.excludeTools) }),
+    };
+}
+//# sourceMappingURL=loopless-runtime-settings.js.map

package/dist/modes/rpc/loopless-tool-call.d.ts

@@ -0,0 +1,12 @@
+import type { AgentTool, AgentToolResult } from "@earendil-works/pi-agent-core";
+/**
+ * Runs one tool call the way the agent loop runs a model-issued one up to its hooks (`runToolCall`, agent-loop.ts):
+ * argument preparation and schema validation, then the tool. Invalid arguments and a failing tool come back as an
+ * `isError` result, never a rejection (senpi#5413).
+ */
+export declare function runLooplessToolCall(tool: AgentTool, call: {
+    readonly toolCallId: string;
+    readonly params: unknown;
+    readonly signal?: AbortSignal;
+}): Promise<AgentToolResult<unknown>>;
+//# sourceMappingURL=loopless-tool-call.d.ts.map

package/dist/modes/rpc/loopless-tool-call.js

@@ -0,0 +1,22 @@
+import { validateToolArguments } from "@earendil-works/pi-ai";
+function errorResult(message) {
+    return { content: [{ type: "text", text: message }], details: undefined, isError: true };
+}
+/**
+ * Runs one tool call the way the agent loop runs a model-issued one up to its hooks (`runToolCall`, agent-loop.ts):
+ * argument preparation and schema validation, then the tool. Invalid arguments and a failing tool come back as an
+ * `isError` result, never a rejection (senpi#5413).
+ */
+export async function runLooplessToolCall(tool, call) {
+    const { toolCallId, signal } = call;
+    try {
+        const prepared = tool.prepareArguments ? tool.prepareArguments(call.params) : call.params;
+        const toolCall = { type: "toolCall", id: toolCallId, name: tool.name, arguments: prepared };
+        const args = validateToolArguments(tool, toolCall);
+        return await tool.execute(toolCallId, args, signal, undefined);
+    }
+    catch (error) {
+        return errorResult(error instanceof Error ? error.message : String(error));
+    }
+}
+//# sourceMappingURL=loopless-tool-call.js.map