@code-yeongyu/senpi 2026.11.6-1 → 2026.11.6-2

package/dist/main.js

@@ -29,7 +29,7 @@ import { printPromptSizes } from "./cli/print-prompt-sizes.js";
 import { pipedStdinOptions } from "./cli/piped-stdin-options.js";
 import { exitAfterOutput, printThenExit } from "./cli/print-then-exit.js";
 import { createProjectTrustContext } from "./cli/project-trust.js";
-import { prepareSessionOpening } from "./cli/session-opening.js";
+import { admitStartupSession, prepareSessionOpening, SESSION_HELD_EXIT_CODE } from "./cli/session-opening.js";
 import { createStartupLoadingIndicator, pauseIndicatorDuringPrompts, shouldShowStartupLoadingIndicator, } from "./cli/startup-loading-indicator.js";
 import { shouldRunFirstTimeSetup, showFirstTimeSetup, showStartupSelector } from "./cli/startup-ui.js";
 import { resolveToolRuntime } from "./cli/tool-runtime.js";
@@ -363,7 +363,21 @@ function validateSessionIdFlags(parsed) {
         process.exit(1);
     }
 }
-function openSessionOrExit(path, sessionDir) {
+/**
+ * Admission of an existing session file before startup loads, migrates, rebinds or runs it: a session another live
+ * process runs must not get a second writer (senpi#5756). Forking only reads its source and is not admitted.
+ */
+async function admitOrExit(sessionFile, appMode) {
+    const admission = await admitStartupSession(sessionFile, {
+        canAsk: appMode === "interactive" && process.stdin.isTTY === true,
+        confirm: promptConfirm,
+        err: (line) => console.error(line),
+    });
+    if (admission !== "open")
+        process.exit(admission === "cancelled" ? 0 : SESSION_HELD_EXIT_CODE);
+}
+async function openSessionOrExit(path, appMode, sessionDir) {
+    await admitOrExit(path, appMode);
     try {
         return SessionManager.open(path, sessionDir);
     }
@@ -383,7 +397,8 @@ function forkSessionOrExit(sourcePath, cwd, sessionDir, sessionId) {
         process.exit(1);
     }
 }
-async function rebindSessionOrExit(sourcePath, cwd, sessionDir) {
+async function rebindSessionOrExit(sourcePath, cwd, appMode, sessionDir) {
+    await admitOrExit(sourcePath, appMode);
     try {
         const reboundPath = await rebindSessionFile(sourcePath, cwd, sessionDir);
         console.log(chalk.dim(`Session moved to ${cwd}`));
@@ -437,24 +452,24 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
         }
         const sessionCwd = resolved.type === "global" ? resolved.cwd : await sessionCwdOrUndefined(resolved.path);
         if (resolved.type === "local" || sessionCwd === undefined || resolvePath(sessionCwd) === resolvePath(cwd)) {
-            return openSessionOrExit(resolved.path, sessionDir);
+            return openSessionOrExit(resolved.path, appMode, sessionDir);
         }
         if ((await classifySessionRepository(resolved.path, sessionCwd, cwd)) === "different") {
             console.error(chalk.red(`Refusing to rebind: ${cwd} is a different git repository than ${sessionCwd}. Use --fork '${parsed.rebind}' to copy the session into this directory instead.`));
             process.exit(1);
         }
-        return rebindSessionOrExit(resolved.path, cwd, sessionDir);
+        return rebindSessionOrExit(resolved.path, cwd, appMode, sessionDir);
     }
     if (parsed.session) {
         const resolved = await resolveSessionPath(parsed.session, cwd, sessionDir);
         switch (resolved.type) {
             case "path":
             case "local":
-                return openSessionOrExit(resolved.path, sessionDir);
+                return openSessionOrExit(resolved.path, appMode, sessionDir);
             case "global": {
                 // Recorded under a folder the OmO desktop moved here: this folder's own session (senpi#2990).
                 if (resolved.cwd !== "" && resolvePath(resolveMovedPath(resolved.cwd)) === resolvePath(cwd))
-                    return openSessionOrExit(resolved.path, sessionDir);
+                    return openSessionOrExit(resolved.path, appMode, sessionDir);
                 // The confirmation blocks on readline, which only an interactive session can
                 // answer. Print, JSON, and RPC runs reach here with a TTY attached
                 // too (`-p` from a terminal), where the question hangs the process or resolves
@@ -470,7 +485,7 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
                     err: (line) => console.error(line),
                 });
                 if (action === "rebind")
-                    return rebindSessionOrExit(resolved.path, cwd, sessionDir);
+                    return rebindSessionOrExit(resolved.path, cwd, appMode, sessionDir);
                 if (action === "fork")
                     return forkSessionOrExit(resolved.path, cwd, sessionDir);
                 if (action === "abort")
@@ -491,6 +506,8 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
                 console.log(chalk.dim("No session selected"));
                 process.exit(0);
             }
+            // The resume target may be rebound (moved and rewritten) below, so the picked file is admitted first.
+            await admitOrExit(selectedPath, appMode);
             const target = await resolveResumeTarget({
                 sessionPath: selectedPath,
                 cwd,
@@ -520,8 +537,14 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
         // A shared session dir matches sessions the OmO desktop moved here in continueRecent. In the default per-folder
         // layout they sit in the old folder's dir: continue the newest of those and the folder's own, in place (senpi#2990).
         const movedHere = sessionDir === undefined ? await movedHereSessionToContinue(cwd) : undefined;
-        if (movedHere !== undefined)
+        if (movedHere !== undefined) {
+            await admitOrExit(movedHere, appMode);
             return SessionManager.open(movedHere, sessionDir);
+        }
+        // Loading the recent session can migrate and rewrite it, so its file is admitted before it is loaded.
+        const recentPath = SessionManager.recentSessionFile(cwd, sessionDir);
+        if (recentPath !== null && existsSync(recentPath))
+            await admitOrExit(recentPath, appMode);
         const recent = SessionManager.continueRecent(cwd, sessionDir);
         const recentFile = recent.getSessionFile();
         if (recentFile !== undefined && existsSync(recentFile))
@@ -534,13 +557,14 @@ export async function createSessionManager(parsed, cwd, sessionDir, settingsMana
             out: (line) => console.log(line),
             err: (line) => console.error(line),
         });
-        return movedChoice === undefined ? recent : rebindSessionOrExit(movedChoice, cwd, sessionDir);
+        return movedChoice === undefined ? recent : rebindSessionOrExit(movedChoice, cwd, appMode, sessionDir);
     }
     if (parsed.sessionId) {
         const existingSession = await findLocalSessionByExactId(parsed.sessionId, cwd, sessionDir);
         if (existingSession) {
             if (parsed.spawnedBy)
                 console.error(chalk.yellow("Warning: --spawned-by is ignored when resuming an existing session."));
+            await admitOrExit(existingSession.path, appMode);
             return SessionManager.open(existingSession.path, sessionDir);
         }
         console.error(chalk.yellow(`Warning: No project session found with id '${parsed.sessionId}'; creating a new session with that id.`));
@@ -692,10 +716,12 @@ export function createCliRuntimeFactory(configuration, local = {}) {
     const createServices = async ({ cwd, agentDir, projectTrustContext, launchProfile, mcpRegistry, isInitialRuntime, }) => {
         const timer = startOpenTimer("runtime-services");
         const projectTrustDiagnostics = [];
-        const cachedProjectTrust = projectTrustByCwd.get(cwd);
         const hasTrustRequiringResources = hasTrustRequiringProjectResources(cwd);
         // The saved decision, including the one a linked git worktree inherits from its main checkout (senpi#4388).
         const savedProjectTrust = await getSavedProjectTrust(trustStore, cwd);
+        // The memo stands in for an unsaved answer only: a decision saved since (an RPC `set_project_trust`, senpi#6176)
+        // is what a fresh process would read, so it outranks what an earlier session of this process resolved.
+        const cachedProjectTrust = savedProjectTrust === null ? projectTrustByCwd.get(cwd) : undefined;
         timer.mark("project_trust");
         // A full-access session trusts its project without asking, for that session only: nothing is
         // cached here or saved to the trust store, and a saved "do not trust" still wins (#2465).
@@ -716,7 +742,11 @@ export function createCliRuntimeFactory(configuration, local = {}) {
             cachedProjectTrust === undefined &&
             parsed.projectTrustOverride === undefined &&
             savedProjectTrust !== true;
-        const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted, trustFromFullAccess });
+        const runtimeSettingsManager = SettingsManager.create(cwd, agentDir, {
+            projectTrusted,
+            trustFromFullAccess,
+            projectTrustLocked: parsed.projectTrustOverride !== undefined,
+        });
         // The opener's per-session fallback policy is an in-memory override: never saved, never shared.
         if (launchProfile?.retryFallback)
             applyRetryFallbackProfile(runtimeSettingsManager, launchProfile.retryFallback);

package/dist/modes/interactive/interactive-mode.js

@@ -5672,7 +5672,7 @@ export class InteractiveMode {
             // which the stdout/stderr error handler turns into emergencyTerminalExit;
             // the render loop is already idle, so this cannot hot-spin (see #4144).
             await this.sessionControlHost?.disposeActive();
-            await this.runtimeHost.dispose({ processExit: true });
+            await this.runtimeHost.dispose({ processExit: true, endActiveRun: true });
             this.themeController.disableAutoSync();
             await this.ui.terminal.drainInput(1000);
             this.stop();
@@ -5688,7 +5688,7 @@ export class InteractiveMode {
         this.stop({ restoreStderr: false });
         try {
             await this.sessionControlHost?.disposeActive();
-            await this.runtimeHost.dispose({ processExit: true });
+            await this.runtimeHost.dispose({ processExit: true, endActiveRun: true });
         }
         finally {
             restoreInteractiveStderr();

package/dist/modes/interactive/session-control-commands.js

@@ -12,6 +12,7 @@ import { engineBuildIdentity } from "../../core/engine-build-identity.js";
 import { ENTRIES_TAIL_CAPABILITY, OBSERVE_READS_CAPABILITY, SESSION_STATUS_CAPABILITY, TUI_OBSERVER_CAPABILITY, } from "../rpc/custom-capability.js";
 import { answerGetEntries } from "../rpc/get-entries-command.js";
 import { answeredUiRequestId, settledQuestionStatus, unansweredQuestionIds } from "../rpc/extension-ui-response.js";
+import { describeRpcMethodClasses } from "../rpc/method-classes.js";
 import { buildRpcSessionState } from "../rpc/rpc-session-state.js";
 import { sessionUiAnswerLedger } from "../rpc/ui-answer-ledger.js";
 import { runTuiRpcCommand, TUI_RPC_COMMANDS } from "./session-control-rpc-commands.js";
@@ -56,6 +57,7 @@ export async function runControlCommand(context, connection, command) {
                 engineVersion: build.text,
                 engineOrdinal: build.ordinal,
                 commands: TUI_CONTROL_COMMANDS,
+                method_classes: describeRpcMethodClasses(),
             });
         }
         case "list_sessions":

package/dist/modes/rpc/connection-handler.js

@@ -67,6 +67,7 @@ import { runHoldInput } from "./held-input-commands.js";
 import { HostSessionControl } from "./host-session-control.js";
 import { createRpcLoginPromptCallbacks } from "./login-prompts.js";
 import { answerMemoryReport } from "./memory-report-command.js";
+import { readProjectSettings, readProjectTrust, writeProjectSetting, writeProjectTrust, } from "./project-workspace-commands.js";
 import { protocolIdentity } from "./protocol-identity.js";
 import { buildRpcCommandsForSession, createCommandsChangedEvent, rpcCommandListDigest } from "./rpc-command-surface.js";
 import { rpcCommandPayloadError, rpcCommandShapeError, rpcMessageLengthError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
@@ -1708,6 +1709,22 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 await requestMcpWireStatus();
                 return success(id, "get_loaded_surfaces", currentLoadedSurfaces().data);
             }
+            case "get_project_trust":
+                return success(id, "get_project_trust", await readProjectTrust(session));
+            case "set_project_trust": {
+                const result = await writeProjectTrust(session, command.choice, (task) => runtimeHost.runInProjectTrustChangeOrder(task));
+                return result.ok
+                    ? success(id, "set_project_trust", result.data)
+                    : error(id, "set_project_trust", result.message, result.errorCode);
+            }
+            case "get_project_settings":
+                return success(id, "get_project_settings", readProjectSettings(session));
+            case "set_project_setting": {
+                const result = await writeProjectSetting(session, command.key, command.value);
+                return result.ok
+                    ? success(id, "set_project_setting", result.data)
+                    : error(id, "set_project_setting", result.message, result.errorCode);
+            }
             case "extension_request":
             case "eval_cells.list":
             case "eval_cells.peek":

package/dist/modes/rpc/connection-question-bridge.js

@@ -95,6 +95,10 @@ export class ConnectionQuestionBridge {
                 frame,
                 cancel,
                 progress: (draft) => {
+                    // A claimed question already has its winner: a draft that lands while that answer is being admitted
+                    // must not overwrite the selections it settles with (senpi#5960).
+                    if (claimed)
+                        return "question_already_resolved";
                     if (draft.answers !== undefined)
                         answers = draft.answers;
                     if (draft.comment !== undefined)
@@ -108,6 +112,7 @@ export class ConnectionQuestionBridge {
                             deadlineAtMs: frame.deadlineAtMs,
                             remainingMs: Math.max(0, frame.deadlineAtMs - Date.now()),
                         });
+                    return "applied";
                 },
                 respond: (response, beforeAnswer) => {
                     // The first answer wins: one that arrives while the winner's `beforeAnswer` runs settles nothing.
@@ -162,10 +167,8 @@ export class ConnectionQuestionBridge {
     /** Hands a draft to its pending question; reports whether one took it, or why none did (senpi#5761). */
     progress(draft) {
         const pending = this.pending.get(draft.id);
-        if (pending) {
-            pending.progress(draft);
-            return "applied";
-        }
+        if (pending)
+            return pending.progress(draft);
         return this.resolved.has(draft.id) ? "question_already_resolved" : "unknown_extension_ui_request";
     }
     cancelAll() {

package/dist/modes/rpc/effect-commands.d.ts

@@ -402,6 +402,18 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
     type: "response";
     command: "set_steering_mode";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_project_trust";
+    success: true;
+    data: import("./project-workspace-commands.ts").RpcProjectTrust;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_project_setting";
+    success: true;
+    data: import("./project-workspace-commands.ts").RpcProjectSettings;
 } | {
     id?: string;
     type: "response";
@@ -841,6 +853,18 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
         extensions: import("./rpc-session-state-types.ts").RpcLoadedExtension[];
         mcpServers: import("./rpc-session-state-types.ts").RpcLoadedMcpServer[];
     };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_project_trust";
+    success: true;
+    data: import("./project-workspace-commands.ts").RpcProjectTrust;
+} | {
+    id?: string;
+    type: "response";
+    command: "get_project_settings";
+    success: true;
+    data: import("./project-workspace-commands.ts").RpcProjectSettings;
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/host-boot-extensions.d.ts

@@ -0,0 +1,4 @@
+import type { HostWarm, HostWarmProfile } from "./host-warm.ts";
+/** Starts the boot load and returns at once: it never delays the listener, and a failure is only logged. */
+export declare function warmAtBootForPrivateFds(warm: HostWarm | undefined, profile: HostWarmProfile, log: (message: string) => void): void;
+//# sourceMappingURL=host-boot-extensions.d.ts.map

package/dist/modes/rpc/host-boot-extensions.js

@@ -0,0 +1,17 @@
+/**
+ * A multi-session host loads its extensions per `open_session` or `warm`. A launch that hands it a
+ * private descriptor table expects an extension to claim its channel with no session open (the omo
+ * desktop waits for that channel's first frame before it opens one), so such a host runs the warm of
+ * its default profile once at boot (senpi#6147). It is that exact warm: a client's `warm` of the same
+ * profile joins it or answers `already_warm`, so the factories never run twice for it. Without a table nothing changes.
+ */
+import { privateTablePresent } from "../../private-fds.js";
+/** Starts the boot load and returns at once: it never delays the listener, and a failure is only logged. */
+export function warmAtBootForPrivateFds(warm, profile, log) {
+    if (warm === undefined || !privateTablePresent())
+        return;
+    warm(profile).catch((cause) => {
+        log(`boot extension load failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+    });
+}
+//# sourceMappingURL=host-boot-extensions.js.map

package/dist/modes/rpc/host-lifecycle-shutdown.js

@@ -131,8 +131,17 @@ async function stopChild(context, reason) {
     catch (cause) {
         // Metadata/watch failures must not leave a child behind. A fired exit breaker is already
         // the final bound: never restart it or enlarge the normal caller's shutdown budget.
-        if (!killAttempted)
-            await reapChildAfterFailure(child, termAttempted);
+        if (!killAttempted) {
+            try {
+                await reapChildAfterFailure(child, termAttempted);
+            }
+            catch (reapCause) {
+                // Log only the recovery error here: performShutdown logs the original
+                // failure once when this rethrow reaches it, so logging it here too
+                // would print the same line twice (#6144 review).
+                supervisorLog(`shutdown recovery failed for host child pid ${pid ?? "unknown"}: ${errorMessage(reapCause)}`);
+            }
+        }
         throw cause;
     }
 }

package/dist/modes/rpc/loopless-runtime-settings.js

@@ -27,7 +27,11 @@ export async function resolveLooplessSettings(configuration, startupSettingsMana
         hasTrustRequiringResources &&
         parsed.projectTrustOverride === undefined &&
         savedProjectTrust !== true;
-    const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted, trustFromFullAccess });
+    const settingsManager = SettingsManager.create(cwd, agentDir, {
+        projectTrusted,
+        trustFromFullAccess,
+        projectTrustLocked: parsed.projectTrustOverride !== undefined,
+    });
     const reloadOptions = shouldResolveProjectTrust
         ? {
             resolveProjectTrust: ({ extensionsResult }) => resolveProjectTrusted({

package/dist/modes/rpc/method-classes-schema-session.d.ts

@@ -781,6 +781,39 @@ export declare const SESSION_RECORD_SCHEMAS: {
     } & {
         readonly sessionId: Type.TOptional<Type.TString>;
     }>;
+    get_project_trust: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"get_project_trust">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    }>;
+    set_project_trust: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"set_project_trust">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly choice: Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>;
+    }>;
+    get_project_settings: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"get_project_settings">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    }>;
+    set_project_setting: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"set_project_setting">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly key: Type.TString;
+        readonly value: Type.TUnknown;
+    }>;
     extension_request: Type.TObject<{
         id: Type.TOptional<Type.TString>;
         admissionId: Type.TOptional<Type.TString>;

package/dist/modes/rpc/method-classes-schema-session.js

@@ -191,6 +191,10 @@ const BASH_AND_TREE_SCHEMAS = {
 const SURFACE_AND_ACCOUNT_SCHEMAS = {
     get_commands: session("get_commands", {}),
     get_loaded_surfaces: session("get_loaded_surfaces", {}),
+    get_project_trust: session("get_project_trust", {}),
+    set_project_trust: session("set_project_trust", { choice: literals("trust", "trust_parent", "do_not_trust") }),
+    get_project_settings: session("get_project_settings", {}),
+    set_project_setting: session("set_project_setting", { key: Id, value: Type.Unknown() }),
     extension_request: session("extension_request", { name: Id, data: Opt(Type.Unknown()) }),
     "eval_cells.list": session("eval_cells.list", {}),
     "eval_cells.peek": session("eval_cells.peek", { cellId: Id, tailBytes: OptNum }),

package/dist/modes/rpc/method-classes-schema.d.ts

@@ -1155,6 +1155,39 @@ export declare const RPC_INBOUND_SCHEMAS: {
     } & {
         readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
     }>;
+    readonly get_project_trust: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"get_project_trust">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    readonly set_project_trust: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"set_project_trust">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    } & {
+        readonly choice: import("typebox").TUnion<[import("typebox").TLiteral<string>, ...import("typebox").TLiteral<string>[]]>;
+    }>;
+    readonly get_project_settings: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"get_project_settings">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+    readonly set_project_setting: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"set_project_setting">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    } & {
+        readonly key: import("typebox").TString;
+        readonly value: import("typebox").TUnknown;
+    }>;
     readonly extension_request: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
         admissionId: import("typebox").TOptional<import("typebox").TString>;

package/dist/modes/rpc/method-classes.d.ts

@@ -93,6 +93,7 @@ export declare const RPC_METHOD_CLASS: {
     readonly get_steering_messages: "observe";
     readonly get_commands: "observe";
     readonly get_loaded_surfaces: "observe";
+    readonly get_project_trust: "observe";
     readonly get_available_models: "observe";
     readonly get_available_thinking_levels: "observe";
     readonly get_model_thinking_level: "observe";
@@ -196,6 +197,9 @@ export declare const RPC_METHOD_CLASS: {
     readonly set_steering_mode: "device_admin";
     readonly set_follow_up_mode: "device_admin";
     readonly set_auto_retry: "device_admin";
+    readonly set_project_trust: "device_admin";
+    readonly get_project_settings: "device_admin";
+    readonly set_project_setting: "device_admin";
     readonly edit_assistant_message: "device_admin";
     readonly send_custom_message: "device_admin";
     readonly switch_session: "device_admin";

package/dist/modes/rpc/method-classes.js

@@ -148,6 +148,8 @@ export const RPC_METHOD_CLASS = {
     get_steering_messages: "observe",
     get_commands: "observe",
     get_loaded_surfaces: "observe",
+    // the session's own effective trust and saved decision, as get_state already shows projectTrusted
+    get_project_trust: "observe",
     get_available_models: "observe",
     get_available_thinking_levels: "observe",
     get_model_thinking_level: "observe",
@@ -243,6 +245,11 @@ export const RPC_METHOD_CLASS = {
     set_steering_mode: "device_admin",
     set_follow_up_mode: "device_admin",
     set_auto_retry: "device_admin",
+    // a consent decision saved in the device's trust store: it decides whether project code runs on the device
+    set_project_trust: "device_admin",
+    // reads a file from the session's cwd; writes one into it
+    get_project_settings: "device_admin",
+    set_project_setting: "device_admin",
     // switch_session opens (and appends to) the named session file; import_jsonl reads any host file into a session
     // both write what the model reads as engine work: an assistant reply it never gave, a custom context message
     // (append_session_entry classes the same entries appended directly as device_admin)

package/dist/modes/rpc/multi-session-host.d.ts

@@ -64,6 +64,8 @@ export declare function createHostCore(options: MultiSessionHostOptions, writer:
     handle: (line: string) => Promise<void>;
     handover: import("./host-idle-handover.ts").HostIdleHandover | undefined;
     handoverAnswered: () => Promise<void>;
+    /** The in-process registry's `warm`; the worker registry has none. */
+    warm: import("./host-warm.ts").HostWarm | undefined;
     /**
      * A session's live registry entry by its routing id. Only in-process test fixtures read it today, in place of
      * spying on the registry prototype (senpi#5802); the host itself never calls it.

package/dist/modes/rpc/multi-session-host.js

@@ -7,6 +7,7 @@ import { HostMcpRegistry } from "../../core/extensions/builtin/mcp/host-registry
 import { flushRawStdout, takeOverStdout, waitForRawStdoutBackpressure, writeRawStdout, } from "../../core/output-guard.js";
 import { killTrackedDetachedChildren } from "../../utils/shell.js";
 import { startHostChildReaper } from "./child-reaper.js";
+import { warmAtBootForPrivateFds } from "./host-boot-extensions.js";
 import { CommandAuthority, commandAuthority, takeRelayExec } from "./command-authority.js";
 import { answerDelegation, relayExecRefusal } from "./delegated-answer.js";
 import { parseClientCapabilities } from "./custom-capability.js";
@@ -190,6 +191,8 @@ export function createHostCore(options, writer, capabilities = parseClientCapabi
         handle,
         handover: gate.handover,
         handoverAnswered: () => gate.answered(),
+        /** The in-process registry's `warm`; the worker registry has none. */
+        warm: "warm" in registry ? registry.warm : undefined,
         /**
          * A session's live registry entry by its routing id. Only in-process test fixtures read it today, in place of
          * spying on the registry prototype (senpi#5802); the host itself never calls it.
@@ -206,7 +209,7 @@ async function runStdioHost(options) {
     // forever: exit through the normal shutdown path once the window elapses.
     const runtimeBuildId = await startupRuntimeBuildId();
     const trim = createZeroSessionTrim(writer, () => router.sessionCount);
-    const { router, handle } = createHostCore(options, writer, undefined, { onEmptyExit: () => void shutdown(0) }, undefined, {
+    const { router, handle, warm } = createHostCore(options, writer, undefined, { onEmptyExit: () => void shutdown(0) }, undefined, {
         ...(runtimeBuildId === undefined ? {} : { runtimeBuildId }),
         onSessionCountChange: (size) => trim.observe(size),
     });
@@ -237,6 +240,7 @@ async function runStdioHost(options) {
         process.stdin.off("end", onEnd);
     };
     registerShutdownSignals(shutdown);
+    warmAtBootForPrivateFds(warm, { cwd: options.cwd }, hostLog);
     return new Promise(() => { });
 }
 async function runSocketHost(options, socketPath) {
@@ -260,7 +264,7 @@ async function runSocketHost(options, socketPath) {
     }
     const canHandOver = runtimeBuildId !== undefined && process.platform !== "win32";
     const trim = createZeroSessionTrim(writer, () => router.sessionCount);
-    const { router, handle, handover, handoverAnswered } = createHostCore(options, writer, [
+    const { router, handle, handover, handoverAnswered, warm } = createHostCore(options, writer, [
         ...parseClientCapabilities(envValue("RPC_CLIENT_CAPABILITIES")),
         // A socket host installs the SIGUSR1 drain below, so it can be handed off to a newer
         // generation instead of being killed. A host that does not advertise this is never
@@ -555,6 +559,7 @@ async function runSocketHost(options, socketPath) {
         supervisorPublicIdentity = await waitForSocketIdentityFile(supervisorPublicOwnerFile);
     }
     process.stderr.write(`senpi rpc listening on ${formatSocketAddress(socketPath)}\n`);
+    warmAtBootForPrivateFds(warm, { cwd: options.cwd, sessionContext: hostContext }, hostLog);
     // Opt-in only: set by the lifecycle supervisor so this host can never outlive
     // it, including when the supervisor is SIGKILLed and runs no handler at all.
     return new Promise(() => { });

package/dist/modes/rpc/project-workspace-commands.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The session workspace's project trust and project-scope settings over RPC (senpi#6176).
+ *
+ * Trust: the choices are exactly the ones `/trust` offers (`getProjectTrustOptions` without the session-only
+ * entries), and choosing one saves exactly what that choice saves in `trust.json`. It is never implied: only an
+ * explicit `set_project_trust` writes, and a launch that named the trust (`--approve`/`--no-approve`) refuses it, because
+ * that flag outranks every saved decision. Then, in the order `resolveProjectTrusted` decides a session's trust, a folder
+ * with nothing trust gates stays trusted, and a `project_trust` handler of the extensions loaded before trust (never a
+ * project extension) decides before any saved choice: a choice it decides against is refused, with nothing saved and
+ * nothing applied. Otherwise the session takes the decision the way a Full access change does
+ * (`applyProjectTrustChange`), in line with the runtime's own trust changes: project settings, skills, prompts,
+ * extensions and MCP servers load or unload at once.
+ *
+ * Settings: the project settings file is read as stored (reading runs nothing, so trust does not gate it) and written
+ * one top-level key at a time through `SettingsManager`'s own project write path, which refuses an untrusted project.
+ */
+import type { AgentSession } from "../../core/agent-session.ts";
+import { type ProjectSettingsFile } from "../../core/settings-manager.ts";
+/** Runs a trust change after every trust change the session's runtime already started (Full access syncs). */
+export type InTrustChangeOrder = <T>(task: () => Promise<T>) => Promise<T>;
+export type ProjectTrustChoice = "trust" | "trust_parent" | "do_not_trust";
+export interface RpcProjectTrustChoice {
+    choice: ProjectTrustChoice;
+    label: string;
+    trusted: boolean;
+    /** The folder the choice saves its decision for. */
+    path: string;
+}
+export interface RpcProjectTrust {
+    cwd: string;
+    /** Whether this session runs with the project trusted now. */
+    projectTrusted: boolean;
+    /** Whether the folder has anything trust gates; without it the project counts as trusted. */
+    requiresTrust: boolean;
+    /** The nearest saved decision at or above the folder, as `/trust` shows it. */
+    saved: {
+        path: string;
+        trusted: boolean;
+    } | null;
+    /** The launch named the trust (`--approve`/`--no-approve`); `set_project_trust` is refused. */
+    locked: boolean;
+    choices: RpcProjectTrustChoice[];
+}
+export type ProjectCommandResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    message: string;
+    errorCode: string;
+};
+export declare function readProjectTrust(session: AgentSession): Promise<RpcProjectTrust>;
+export declare function writeProjectTrust(session: AgentSession, choice: unknown, inTrustChangeOrder: InTrustChangeOrder): Promise<ProjectCommandResult<RpcProjectTrust>>;
+export interface RpcProjectSettings extends ProjectSettingsFile {
+    cwd: string;
+    projectTrusted: boolean;
+}
+export declare function readProjectSettings(session: AgentSession): RpcProjectSettings;
+export declare function writeProjectSetting(session: AgentSession, key: unknown, value: unknown): Promise<ProjectCommandResult<RpcProjectSettings>>;
+//# sourceMappingURL=project-workspace-commands.d.ts.map