@code-yeongyu/senpi 2026.11.6-1 → 2026.11.6-2

package/dist/core/egress/credential-fields.js

@@ -0,0 +1,83 @@
+const API_KEY_CREDENTIAL_FIELDS = {
+    type: "public",
+    key: "sealed",
+    env: "forces-device",
+    loginId: "device-only",
+};
+const OAUTH_CREDENTIAL_FIELDS = {
+    type: "public",
+    access: "sealed",
+    refresh: "device-only",
+    expires: "public",
+    idToken: "device-only",
+    subject: "device-only",
+    email: "device-only",
+    issuer: "device-only",
+    clientId: "device-only",
+    scopes: "device-only",
+    planUsageEnabled: "public",
+    // The ChatGPT sign-in route: a two-value protocol selector ("siwc" | "codex") the request needs, no secret material.
+    route: "public",
+    loginId: "device-only",
+};
+export const CREDENTIAL_SLOT_FIELDS = {
+    name: "public",
+    displayName: "device-only",
+    source: "public",
+    key: "sealed",
+    access: "sealed",
+    refresh: "device-only",
+    expires: "public",
+    // The slot's ChatGPT sign-in route: a two-value protocol selector ("siwc" | "codex"), no secret material.
+    route: "public",
+    env: "forces-device",
+};
+const POOLED_CREDENTIAL_FIELDS = {
+    accounts: CREDENTIAL_SLOT_FIELDS,
+    pinned: "public",
+    order: "public",
+};
+/** A stored credential key outside the declared fields (OAuth flows may add any) keeps the credential on the device. */
+export function classifyCredentialField(type, key) {
+    const table = type === "api_key" ? API_KEY_CREDENTIAL_FIELDS : OAUTH_CREDENTIAL_FIELDS;
+    return (Object.hasOwn(table, key) ? table[key] : undefined) ?? "forces-device";
+}
+function forcesDevice(table, key, value) {
+    const fieldClass = Object.hasOwn(table, key) ? table[key] : undefined;
+    if (fieldClass === undefined)
+        return ["undeclared-field"];
+    if (fieldClass !== "forces-device")
+        return [];
+    return typeof value === "object" && value !== null && Object.keys(value).length === 0 ? [] : ["env"];
+}
+/** Why a stored auth.json credential must be used on the device; empty when sealed custody can compose its requests. */
+export function credentialDeviceReasons(credential) {
+    const reasons = new Set();
+    const typeTable = credential.type === "api_key"
+        ? API_KEY_CREDENTIAL_FIELDS
+        : credential.type === "oauth"
+            ? OAUTH_CREDENTIAL_FIELDS
+            : undefined;
+    if (typeTable === undefined)
+        return ["undeclared-field"];
+    const table = { ...typeTable, ...POOLED_CREDENTIAL_FIELDS };
+    for (const [key, value] of Object.entries(credential)) {
+        for (const reason of forcesDevice(table, key, value))
+            reasons.add(reason);
+    }
+    const accounts = credential.accounts;
+    if (accounts !== undefined && !Array.isArray(accounts))
+        reasons.add("undeclared-field");
+    for (const account of Array.isArray(accounts) ? accounts : []) {
+        if (typeof account !== "object" || account === null) {
+            reasons.add("undeclared-field");
+            continue;
+        }
+        for (const [key, value] of Object.entries(account)) {
+            for (const reason of forcesDevice(CREDENTIAL_SLOT_FIELDS, key, value))
+                reasons.add(reason);
+        }
+    }
+    return [...reasons];
+}
+//# sourceMappingURL=credential-fields.js.map

package/dist/core/egress/custody-sidecar.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The custody sidecar `<agentDir>/custody.json` (custody design 4.1, row CK5).
+ *
+ * It lives beside models.json, never inside it, so fused parsers and older CLIs never see a custody
+ * field. Only the device service writes it (temp file + rename); the fused CLI never reads it.
+ * A read is tri-state so a caller can tell "not enabled" (absent) from "broken" (invalid).
+ */
+import { type Static, Type } from "typebox";
+declare const ProviderCustodySchema: Type.TObject<{
+    custody: Type.TOptional<Type.TUnion<[Type.TLiteral<"sealed">, Type.TLiteral<"device">]>>;
+    apiKeyTtlSeconds: Type.TOptional<Type.TInteger>;
+    headersTtlSeconds: Type.TOptional<Type.TInteger>;
+    sealedCwdHash: Type.TOptional<Type.TString>;
+    secretUrlParts: Type.TOptional<Type.TArray<Type.TString>>;
+}>;
+declare const CustodySidecarSchema: Type.TObject<{
+    v: Type.TLiteral<1>;
+    providers: Type.TRecord<"^.*$", Type.TObject<{
+        custody: Type.TOptional<Type.TUnion<[Type.TLiteral<"sealed">, Type.TLiteral<"device">]>>;
+        apiKeyTtlSeconds: Type.TOptional<Type.TInteger>;
+        headersTtlSeconds: Type.TOptional<Type.TInteger>;
+        sealedCwdHash: Type.TOptional<Type.TString>;
+        secretUrlParts: Type.TOptional<Type.TArray<Type.TString>>;
+    }>>;
+    consent: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+    withdrawal: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+}>;
+export type CustodySidecar = Static<typeof CustodySidecarSchema>;
+export type ProviderCustody = Static<typeof ProviderCustodySchema>;
+export type CustodySidecarRead = {
+    readonly state: "absent";
+} | {
+    readonly state: "ok";
+    readonly sidecar: CustodySidecar;
+} | {
+    readonly state: "invalid";
+    readonly reason: string;
+};
+export declare function custodySidecarPath(agentDir: string): string;
+export declare function readCustodySidecar(path: string): Promise<CustodySidecarRead>;
+/** Writes the whole sidecar atomically: a 0600 temp file in the same directory, fsync, rename, fsync dir. */
+export declare function writeCustodySidecar(path: string, sidecar: CustodySidecar): Promise<void>;
+export {};
+//# sourceMappingURL=custody-sidecar.d.ts.map

package/dist/core/egress/custody-sidecar.js

@@ -0,0 +1,91 @@
+/**
+ * The custody sidecar `<agentDir>/custody.json` (custody design 4.1, row CK5).
+ *
+ * It lives beside models.json, never inside it, so fused parsers and older CLIs never see a custody
+ * field. Only the device service writes it (temp file + rename); the fused CLI never reads it.
+ * A read is tri-state so a caller can tell "not enabled" (absent) from "broken" (invalid).
+ */
+import { randomBytes } from "node:crypto";
+import { open, readFile, rename, rm } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { Type } from "typebox";
+import { Compile } from "typebox/compile";
+const CUSTODY_SIDECAR_FILE = "custody.json";
+const SignedRecordSchema = Type.Record(Type.String(), Type.Unknown());
+const ProviderCustodySchema = Type.Object({
+    custody: Type.Optional(Type.Union([Type.Literal("sealed"), Type.Literal("device")])),
+    apiKeyTtlSeconds: Type.Optional(Type.Integer({ minimum: 1 })),
+    headersTtlSeconds: Type.Optional(Type.Integer({ minimum: 1 })),
+    sealedCwdHash: Type.Optional(Type.String({ minLength: 1 })),
+    secretUrlParts: Type.Optional(Type.Array(Type.String({ pattern: "^(urlPath:(0|[1-9][0-9]*)|urlQuery:.+)$" }), { uniqueItems: true })),
+}, { additionalProperties: false });
+const CustodySidecarSchema = Type.Object({
+    v: Type.Literal(1),
+    providers: Type.Record(Type.String({ minLength: 1 }), ProviderCustodySchema),
+    consent: Type.Optional(SignedRecordSchema),
+    withdrawal: Type.Optional(SignedRecordSchema),
+}, { additionalProperties: false });
+const validateCustodySidecar = Compile(CustodySidecarSchema);
+export function custodySidecarPath(agentDir) {
+    return join(agentDir, CUSTODY_SIDECAR_FILE);
+}
+function parseCustodySidecar(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return { state: "invalid", reason: `not JSON: ${error.message}` };
+        throw error;
+    }
+    if (validateCustodySidecar.Check(value))
+        return { state: "ok", sidecar: value };
+    const first = validateCustodySidecar.Errors(value)[0];
+    return { state: "invalid", reason: first ? `${first.instancePath || "/"} ${first.message}` : "schema mismatch" };
+}
+export async function readCustodySidecar(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isErrnoCode(error, "ENOENT"))
+            return { state: "absent" };
+        throw error;
+    }
+    return parseCustodySidecar(text);
+}
+/** Writes the whole sidecar atomically: a 0600 temp file in the same directory, fsync, rename, fsync dir. */
+export async function writeCustodySidecar(path, sidecar) {
+    if (!validateCustodySidecar.Check(sidecar))
+        throw new TypeError("custody sidecar does not match its schema");
+    const directory = dirname(path);
+    const temp = join(directory, `.${basename(path)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    const file = await open(temp, "wx", 0o600);
+    try {
+        await file.writeFile(`${JSON.stringify(sidecar, null, "\t")}\n`, "utf8");
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    try {
+        await rename(temp, path);
+    }
+    catch (error) {
+        await rm(temp, { force: true });
+        throw error;
+    }
+    const dir = await open(directory, "r");
+    try {
+        await dir.sync();
+    }
+    finally {
+        await dir.close();
+    }
+}
+function isErrnoCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+//# sourceMappingURL=custody-sidecar.js.map

package/dist/core/egress/device-custody.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Why a provider must stay on the device whatever the sidecar asks for (custody gate H1, M1).
+ *
+ * The models.json schema accepts unknown keys at every level, so the walk here applies
+ * `MODELS_JSON_FIELD_CLASSES` to the concrete provider object with whitelist semantics: a key the
+ * table does not name, at any depth, keeps the provider on the device instead of reaching the brain.
+ */
+import type { ModelsJsonProvider } from "../model-config-schema.ts";
+export type DeviceCustodyReason = "undeclared-field" | "extra-body" | "sampling-params" | "unsplittable-base-url" | "model-base-url-secret" | "model-header-collision";
+/** Empty when sealed custody may serve the provider. */
+export declare function deviceCustodyReasons(provider: ModelsJsonProvider): readonly DeviceCustodyReason[];
+//# sourceMappingURL=device-custody.d.ts.map

package/dist/core/egress/device-custody.js

@@ -0,0 +1,82 @@
+/**
+ * Why a provider must stay on the device whatever the sidecar asks for (custody gate H1, M1).
+ *
+ * The models.json schema accepts unknown keys at every level, so the walk here applies
+ * `MODELS_JSON_FIELD_CLASSES` to the concrete provider object with whitelist semantics: a key the
+ * table does not name, at any depth, keeps the provider on the device instead of reaching the brain.
+ */
+import { classifyModelsJsonField, MODELS_JSON_FIELD_CLASSES, MODELS_JSON_TYPE_ONLY_FIELDS, } from "./classify.js";
+import { splitEndpoint } from "./endpoint.js";
+const STOPS_WALK = new Set(["sealed", "device-only"]);
+/** Every path in the tables plus each of its ancestors (`a.b[].c` -> `a`, `a.b`, `a.b[]`, `a.b[].c`). */
+const KNOWN_PATHS = new Set([...Object.keys(MODELS_JSON_FIELD_CLASSES), ...Object.keys(MODELS_JSON_TYPE_ONLY_FIELDS)].flatMap((path) => [
+    ...[...path.matchAll(/[.[]/g)].map((boundary) => path.slice(0, boundary.index)),
+    path,
+]));
+/** A property name that would read as path syntax (`a.b`, `m[]`, `*`, `{key}`) is never a declared field. */
+const PATH_SYNTAX = /[.[\]*{}]/;
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function walk(value, path, reasons) {
+    const fieldClass = classifyModelsJsonField(path);
+    if (fieldClass === "forces-device") {
+        const sampling = path.endsWith("samplingParams.*");
+        if (!sampling)
+            reasons.add("extra-body");
+        else if (typeof value === "string" || (typeof value === "object" && value !== null))
+            reasons.add("sampling-params");
+        return;
+    }
+    if (fieldClass !== undefined && STOPS_WALK.has(fieldClass))
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walk(item, `${path}[]`, reasons);
+        return;
+    }
+    if (!isPlainObject(value)) {
+        if (fieldClass === undefined)
+            reasons.add("undeclared-field");
+        return;
+    }
+    const isRecord = classifyModelsJsonField(`${path}.{key}`) !== undefined;
+    for (const [key, child] of Object.entries(value)) {
+        const childPath = isRecord ? `${path}.*` : `${path}.${key}`;
+        if ((isRecord || !PATH_SYNTAX.test(key)) && KNOWN_PATHS.has(childPath))
+            walk(child, childPath, reasons);
+        else
+            reasons.add("undeclared-field");
+    }
+}
+function hasModelHeaderCollision(provider) {
+    return (provider.models ?? []).some((model) => {
+        const override = Object.hasOwn(provider.modelOverrides ?? {}, model.id)
+            ? provider.modelOverrides?.[model.id]?.headers
+            : undefined;
+        if (override === undefined)
+            return false;
+        const overrideNames = new Set(Object.keys(override).map((name) => name.toLowerCase()));
+        return Object.keys(model.headers ?? {}).some((name) => overrideNames.has(name.toLowerCase()));
+    });
+}
+/** Empty when sealed custody may serve the provider. */
+export function deviceCustodyReasons(provider) {
+    const reasons = new Set();
+    walk(provider, "providers.*", reasons);
+    if (provider.baseUrl !== undefined && !splitEndpoint(provider.baseUrl).ok)
+        reasons.add("unsplittable-base-url");
+    for (const model of provider.models ?? []) {
+        if (model.baseUrl === undefined)
+            continue;
+        const split = splitEndpoint(model.baseUrl);
+        if (!split.ok)
+            reasons.add("unsplittable-base-url");
+        else if (split.secrets.size > 0)
+            reasons.add("model-base-url-secret");
+    }
+    if (hasModelHeaderCollision(provider))
+        reasons.add("model-header-collision");
+    return [...reasons];
+}
+//# sourceMappingURL=device-custody.js.map

package/dist/core/egress/endpoint.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `Endpoint` split and the URL secret marking rule (custody design 4.1, row CK5).
+ *
+ * A provider `baseUrl` is split into its public parts, which travel as plain config, and its
+ * secret parts, which are sealed one field each. Secret iff: `userinfo` (always); a path segment
+ * or query value that is templated (`!command` or a `$VAR` reference, senpi's own template
+ * syntax); a part the user listed in `secretUrlParts`; or a query value whose NAME is key-ish.
+ * The key-ish list decides what is sealed, never the source digest.
+ */
+export type UrlSecretField = "urlUserinfo" | `urlPath:${number}` | `urlQuery:${string}`;
+export type MarkableUrlPart = `urlPath:${number}` | `urlQuery:${string}`;
+export interface SecretUrlPart {
+    readonly secret: true;
+}
+export interface Endpoint {
+    readonly scheme: "http" | "https";
+    readonly host: string;
+    readonly port?: number;
+    readonly path: readonly (string | SecretUrlPart)[];
+    readonly query?: Readonly<Record<string, string | SecretUrlPart>>;
+    readonly userinfo?: true;
+}
+export type EndpointSplit = {
+    readonly ok: true;
+    readonly endpoint: Endpoint;
+    readonly secrets: ReadonlyMap<UrlSecretField, string>;
+} | {
+    readonly ok: false;
+    readonly reason: "unparseable" | "scheme" | "fragment" | "duplicate-query" | "valueless-query";
+};
+export declare function splitEndpoint(baseUrl: string, secretUrlParts?: readonly MarkableUrlPart[]): EndpointSplit;
+export declare function composeEndpointUrl(endpoint: Endpoint, secret: (field: UrlSecretField) => string): string;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/core/egress/endpoint.js

@@ -0,0 +1,115 @@
+/**
+ * `Endpoint` split and the URL secret marking rule (custody design 4.1, row CK5).
+ *
+ * A provider `baseUrl` is split into its public parts, which travel as plain config, and its
+ * secret parts, which are sealed one field each. Secret iff: `userinfo` (always); a path segment
+ * or query value that is templated (`!command` or a `$VAR` reference, senpi's own template
+ * syntax); a part the user listed in `secretUrlParts`; or a query value whose NAME is key-ish.
+ * The key-ish list decides what is sealed, never the source digest.
+ */
+import { getConfigValueEnvVarNames, isCommandConfigValue } from "../resolve-config-value.js";
+/** Query parameter names whose value is sealed whatever it looks like (compared case-insensitively). */
+const KEYISH_QUERY_NAMES = [
+    "key",
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "sig",
+    "signature",
+    "sv",
+    "client_secret",
+    "secret",
+    "password",
+    "auth",
+    "authorization",
+    "auth_token",
+    "access-token",
+    "subscription-key",
+    "x-api-key",
+];
+const SECRET = { secret: true };
+const URL_SHAPE = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)(\/[^?#]*)?(?:\?([^#]*))?(#.*)?$/i;
+const HOST_PORT = /^([^@/?#:[\]]+|\[[^\]]+\])(?::(\d+))?$/;
+function isTemplatedUrlPart(raw) {
+    return isCommandConfigValue(raw) || getConfigValueEnvVarNames(raw).length > 0;
+}
+function isKeyishQueryName(name) {
+    return KEYISH_QUERY_NAMES.includes(name.toLowerCase());
+}
+export function splitEndpoint(baseUrl, secretUrlParts = []) {
+    const match = URL_SHAPE.exec(baseUrl);
+    if (!match)
+        return { ok: false, reason: "unparseable" };
+    const [, rawScheme, authority = "", rawPath, rawQuery, fragment] = match;
+    const at = authority.lastIndexOf("@");
+    const userinfo = at === -1 ? undefined : authority.slice(0, at);
+    const hostPort = HOST_PORT.exec(at === -1 ? authority : authority.slice(at + 1));
+    const host = hostPort?.[1];
+    const port = hostPort?.[2];
+    if (rawScheme === undefined || host === undefined)
+        return { ok: false, reason: "unparseable" };
+    if (fragment !== undefined)
+        return { ok: false, reason: "fragment" };
+    const scheme = rawScheme.toLowerCase();
+    if (scheme !== "http" && scheme !== "https")
+        return { ok: false, reason: "scheme" };
+    const marked = new Set(secretUrlParts);
+    const secrets = new Map();
+    if (userinfo !== undefined)
+        secrets.set("urlUserinfo", userinfo);
+    const path = (rawPath ?? "").split("/").slice(1);
+    const publicPath = path.map((segment, index) => {
+        const field = `urlPath:${index}`;
+        if (!isTemplatedUrlPart(segment) && !marked.has(field))
+            return segment;
+        secrets.set(field, segment);
+        return SECRET;
+    });
+    let query;
+    if (rawQuery !== undefined) {
+        query = {};
+        for (const pair of rawQuery.length > 0 ? rawQuery.split("&") : []) {
+            const separator = pair.indexOf("=");
+            if (separator < 1)
+                return { ok: false, reason: "valueless-query" };
+            const name = pair.slice(0, separator);
+            const value = pair.slice(separator + 1);
+            if (Object.hasOwn(query, name))
+                return { ok: false, reason: "duplicate-query" };
+            const field = `urlQuery:${name}`;
+            if (isKeyishQueryName(name) || isTemplatedUrlPart(value) || marked.has(field)) {
+                secrets.set(field, value);
+                query[name] = SECRET;
+            }
+            else {
+                query[name] = value;
+            }
+        }
+    }
+    const endpoint = {
+        scheme,
+        host,
+        ...(port !== undefined ? { port: Number(port) } : {}),
+        path: publicPath,
+        ...(query !== undefined ? { query } : {}),
+        ...(userinfo !== undefined ? { userinfo: true } : {}),
+    };
+    return { ok: true, endpoint, secrets };
+}
+export function composeEndpointUrl(endpoint, secret) {
+    const userinfo = endpoint.userinfo ? `${secret("urlUserinfo")}@` : "";
+    const port = endpoint.port !== undefined ? `:${endpoint.port}` : "";
+    const path = endpoint.path
+        .map((segment, index) => (typeof segment === "string" ? segment : secret(`urlPath:${index}`)))
+        .map((segment) => `/${segment}`)
+        .join("");
+    const query = endpoint.query === undefined
+        ? ""
+        : `?${Object.entries(endpoint.query)
+            .map(([name, value]) => `${name}=${typeof value === "string" ? value : secret(`urlQuery:${name}`)}`)
+            .join("&")}`;
+    return `${endpoint.scheme}://${userinfo}${endpoint.host}${port}${path}${query}`;
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/core/execute-tool-on-host.d.ts

@@ -0,0 +1,26 @@
+import { type Agent, type AgentToolResult, type AgentToolUpdateCallback, type PreparedAgentToolCall } from "@earendil-works/pi-agent-core";
+type HostAgent = Pick<Agent, "batchStoreFactory" | "executionScope" | "getExecutionScope" | "onExecutionPipeline">;
+export interface ExecuteToolHookResult {
+    readonly content?: AgentToolResult<unknown>["content"];
+    readonly details?: unknown;
+}
+export interface ExecuteToolHostSession {
+    readonly agent: HostAgent;
+    afterHooks(prepared: PreparedAgentToolCall, result: AgentToolResult<unknown>, isError: boolean): Promise<ExecuteToolHookResult | undefined>;
+}
+export interface ExecuteToolHostOptions {
+    readonly signal?: AbortSignal;
+    readonly onUpdate?: AgentToolUpdateCallback<unknown>;
+}
+export interface ExecuteToolHostOutcome {
+    readonly result: AgentToolResult<unknown>;
+    readonly hook: ExecuteToolHookResult | undefined;
+}
+/**
+ * Runs a call `executeTool()` already prepared and preflighted on the in-process prepared ToolHost (S19a). The host
+ * freezes the preflighted arguments; the caller's own signal and `onUpdate` reach the body, since `executeTool()` never
+ * raced an abort.
+ */
+export declare function runExecuteToolOnHost(session: ExecuteToolHostSession, prepared: PreparedAgentToolCall, options: ExecuteToolHostOptions): Promise<ExecuteToolHostOutcome>;
+export {};
+//# sourceMappingURL=execute-tool-on-host.d.ts.map

package/dist/core/execute-tool-on-host.js

@@ -0,0 +1,96 @@
+import { BatchStoreMissingError, createPreparedToolHost, } from "@earendil-works/pi-agent-core";
+import { Type } from "typebox";
+import { carryPreflightFacts } from "./execution/preflight-carry.js";
+const PREFLIGHTED_ARGUMENTS = Type.Unknown();
+function issuingMessage(prepared) {
+    return {
+        role: "assistant",
+        content: [prepared.toolCall],
+        api: "execute-tool",
+        provider: "senpi",
+        model: "execute-tool",
+        usage: {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            totalTokens: 0,
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+        },
+        stopReason: "toolUse",
+        timestamp: Date.now(),
+    };
+}
+function thrownResult(error) {
+    return {
+        content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+        details: { isError: true },
+    };
+}
+/**
+ * Runs a call `executeTool()` already prepared and preflighted on the in-process prepared ToolHost (S19a). The host
+ * freezes the preflighted arguments; the caller's own signal and `onUpdate` reach the body, since `executeTool()` never
+ * raced an abort.
+ */
+export async function runExecuteToolOnHost(session, prepared, options) {
+    const openStore = session.agent.batchStoreFactory;
+    if (openStore === undefined)
+        throw new BatchStoreMissingError();
+    const tool = prepared.tool;
+    let failure;
+    let settled;
+    let threw = false;
+    const body = Object.create(tool, {
+        prepareArguments: { value: undefined },
+        // The `tool_call` chain may rewrite the arguments, and its contract is that they are not validated again.
+        parameters: { value: PREFLIGHTED_ARGUMENTS },
+        execute: {
+            value: async (toolCallId, args) => {
+                try {
+                    return await tool.execute(toolCallId, args, options.signal, options.onUpdate);
+                }
+                catch (error) {
+                    threw = true;
+                    return thrownResult(error);
+                }
+            },
+        },
+    });
+    const host = createPreparedToolHost({
+        afterToolFreeze: carryPreflightFacts,
+        beforeToolCall: async ({ args }) => {
+            carryPreflightFacts(prepared.args, args);
+            return undefined;
+        },
+        afterToolCall: async ({ result, isError }) => {
+            try {
+                settled = { result, hook: await session.afterHooks(prepared, result, isError || threw) };
+            }
+            catch (error) {
+                failure = { error };
+            }
+            return undefined;
+        },
+        removedToolHints: {},
+    }, openStore);
+    const agent = session.agent;
+    await host.execute({
+        scope: agent.getExecutionScope?.() ?? agent.executionScope,
+        calls: [{ ...prepared.toolCall, arguments: prepared.args }],
+        mode: "sequential",
+    }, {
+        emit: () => undefined,
+        ...(agent.onExecutionPipeline === undefined ? {} : { recordWitness: agent.onExecutionPipeline }),
+        local: {
+            context: { systemPrompt: "", messages: [], tools: [body] },
+            assistantMessage: issuingMessage(prepared),
+        },
+    });
+    if (failure !== undefined)
+        throw failure.error;
+    if (settled === undefined) {
+        throw new Error(`executeTool: the prepared host settled no result for ${prepared.toolCall.name}`);
+    }
+    return settled;
+}
+//# sourceMappingURL=execute-tool-on-host.js.map

package/dist/core/extensions/builtin/compaction/retained-message-safety.js

@@ -137,6 +137,15 @@ function hasSafeToolResultEnvelope(message) {
         (message.addedToolNames === undefined ||
             (Array.isArray(message.addedToolNames) && message.addedToolNames.every((name) => typeof name === "string"))));
 }
+/** Reasoning-effort values a `configuration_update` entry can carry: the producer (`appendConfigurationUpdate`) writes a ThinkingLevel. */
+const CONFIGURATION_UPDATE_EFFORTS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+function hasSafeConfigurationUpdate(message) {
+    return (typeof message.effort === "string" &&
+        CONFIGURATION_UPDATE_EFFORTS.has(message.effort) &&
+        Array.isArray(message.content) &&
+        message.content.length === 0 &&
+        isFiniteNumber(message.timestamp));
+}
 /** Reject any retained message that cannot be safely replayed through normalized provider conversion. */
 export function hasUnsafeRetainedContent(messages) {
     for (const value of messages) {
@@ -155,6 +164,12 @@ export function hasUnsafeRetainedContent(messages) {
                 if (!hasSafeToolResultEnvelope(value))
                     return true;
                 break;
+            case "configurationUpdate":
+                // A reasoning-effort change is a valid runtime message: normal request
+                // conversion accepts it, so a bounded one is replay-safe (senpi#8566).
+                if (!hasSafeConfigurationUpdate(value))
+                    return true;
+                break;
             case "custom":
                 if (typeof value.customType !== "string" ||
                     typeof value.display !== "boolean" ||

package/dist/core/extensions/builtin/goal/index.js

@@ -16,7 +16,7 @@ import { GOAL_CONTINUATION_SCHEDULED_EVENT, MonitorAwareGoalContinuation } from
 import { reengageGoalAfterReload } from "./reload-reengagement.js";
 import { registerGoalFireNowRequest } from "./rpc-wait-surface.js";
 import { isStaleExtensionContextError } from "./stale-context.js";
-import { markStopPaused, markStopResumed, pausedByStop, stopHoldLive } from "./stop-pause.js";
+import { interruptedRunHeld, markStopPaused, markStopResumed, pausedByStop, stopHoldLive } from "./stop-pause.js";
 import { accountGoalUsage, migrateLegacyGoal, readGoal, updateGoal } from "./store.js";
 import { GOAL_STORE_CHANGED_EVENT, isGoalStoreChangedEvent } from "./store-changed-event.js";
 import { goalStoreRef as buildGoalStoreRef } from "./store-ref.js";
@@ -155,7 +155,19 @@ export default function goalExtension(pi) {
         todoOwedBackstop.resetChain();
         const ref = goalStoreRef(ctx);
         await migrateLegacyGoal(ref);
-        const goal = await readGoal(goalStoreRef(ctx));
+        let goal = await readGoal(goalStoreRef(ctx));
+        // A process that died mid-turn never ran the quit-time abort that stops an active goal (senpi#5753). Stop it the
+        // same way here, so the resume prompt below asks before any continuation runs (senpi#5755). Opening that session
+        // at launch (`--continue`, `--session`) is the same resume, so it asks too.
+        let stoppedInterruptedGoal = false;
+        if ((event.reason === "resume" || event.reason === "startup") &&
+            ctx.hasUI &&
+            goal?.status === "active" &&
+            goal.continuationStoppedAt === undefined &&
+            interruptedRunHeld(ctx)) {
+            goal = await pauseOrBlockOnUserAbort(ctx, goal.id);
+            stoppedInterruptedGoal = true;
+        }
         if (goal?.status === "active") {
             beginAgentGoalAccounting(goal);
         }
@@ -172,7 +184,7 @@ export default function goalExtension(pi) {
                 ctx.ui.notify(GOAL_STALE_STOP_NOTICE, "info");
             return;
         }
-        if (await maybePromptResumeStoppedGoal(pi, ctx, event.reason, goal)) {
+        if (await maybePromptResumeStoppedGoal(pi, ctx, stoppedInterruptedGoal ? "resume" : event.reason, goal)) {
             return;
         }
         if (goal && event.reason === "reload") {

package/dist/core/extensions/builtin/goal/stop-pause.d.ts

@@ -2,6 +2,8 @@ import type { ExtensionAPI, ExtensionContext } from "../../types.ts";
 export declare const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export declare const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
 export declare function stopHoldLive(ctx: ExtensionContext): boolean;
+/** The session reopened over a run that never finished: its process died mid-turn (senpi#4683, senpi#5755). */
+export declare function interruptedRunHeld(ctx: ExtensionContext): boolean;
 export declare function markStopPaused(pi: Pick<ExtensionAPI, "appendEntry">, goalId: string): void;
 export declare function markStopResumed(pi: Pick<ExtensionAPI, "appendEntry">, goalId: string): void;
 /** A goal the user's Stop paused (not `/goal pause`) resumes with the session (senpi#3811). */