@code-yeongyu/senpi 2026.11.6-2 → 2026.11.6-3

package/dist/core/extensions/builtin/ask-user/tool.js

@@ -1,5 +1,6 @@
 import { releaseQuestionInput } from "../../../question-input.js";
 import { WAKE_SOURCE_STATE_EVENT } from "../monitor-state-event.js";
+import { AskUserEscapeResidueError, escapeResidueNote, findEscapeResidue, refuseEscapeResidue, } from "./escape-residue.js";
 import { TOOL_NAMES } from "./family.js";
 import { formatGatedCancellation, formatModelAnswer, formatResultDetails, formatUserMessage, showsPartialAnswers, } from "./format.js";
 import { ASK_USER_ASKED_EVENT, ASK_USER_QUESTION_ENTRY, ASK_USER_SETTLEMENT_ENTRY, emitAskUserClosed, emitAskUserNotification, } from "./notify.js";
@@ -329,6 +330,13 @@ export function createAskUserTool(variant, pi, state) {
                 emitAskUserClosed(pi, request.requestId, unavailable);
                 return result(variant, unavailable, request);
             }
+            const residue = findEscapeResidue(request.questions);
+            if (refuseEscapeResidue(state.escapeResidue, residue.length > 0)) {
+                emitAskUserClosed(pi, request.requestId, unavailable);
+                throw new AskUserEscapeResidueError(residue);
+            }
+            if (residue.length > 0)
+                ctx.ui.notify(escapeResidueNote(residue), "warning");
             const completion = startQuestion(pi, ctx, request, signal, state, variant);
             if (!request.waitForAnswer)
                 return {

package/dist/core/extensions/builtin/goal/index.js

@@ -175,6 +175,13 @@ export default function goalExtension(pi) {
             clearAgentGoalAccounting();
         }
         refreshGoalUi(ctx, goal);
+        // A session reopened under a live Stop keeps its goal paused until the Stop is released.
+        if (await pauseGoalWithHeldSession(ctx))
+            return;
+        // A goal a live Stop paused (a crashed run included) resumes with the session once the Stop is released, so the
+        // resume prompt would only restart its counter under the hold.
+        if (goal?.status === "paused" && stopHoldLive(ctx) && pausedByStop(ctx, goal.id))
+            return;
         // Opening the session earns one reminder; renders and extension reloads do not.
         // Stale stops retain active status, unlike user-paused or blocking stops.
         if ((event.reason === "startup" || event.reason === "resume") &&
@@ -218,6 +225,13 @@ export default function goalExtension(pi) {
             }
         }
     });
+    // A Stop that lands while no turn runs emits no `session_abort`, so the goal pauses and resumes with the session here.
+    pi.on("session_hold_changed", async (event, ctx) => {
+        if (event.change === "paused")
+            await pauseGoalWithHeldSession(ctx);
+        else
+            await resumeGoalWithReleasedSession(ctx);
+    });
     pi.on("held_wakes_released", async (event, ctx) => {
         if (!event.sources.goal)
             return;
@@ -303,6 +317,11 @@ export default function goalExtension(pi) {
         if (event.aborted === true && event.abortSource === "user" && goal?.status === "active") {
             goal = await pauseOrBlockOnUserAbort(ctx, goal.id);
         }
+        else if (goal?.status === "active" && goal.continuationStoppedAt === undefined && stopHoldLive(ctx)) {
+            // A Stop that joined this turn's agent_end boundary leaves the turn un-aborted; the goal still pauses with it.
+            markStopPaused(pi, goal.id);
+            goal = await updateGoal(goalStoreRef(ctx), { status: "paused" }, "user");
+        }
         if (goal?.status === "active") {
             beginAgentGoalAccounting(goal);
         }
@@ -404,6 +423,33 @@ export default function goalExtension(pi) {
             return;
         syncContinuationGoal(ctx, continuedGoal);
     }
+    /** Close the accounting window at the Stop and pause an idle active goal; a running turn pauses at its `agent_end`. */
+    async function pauseGoalWithHeldSession(ctx) {
+        if (agentTurnInProgress || !stopHoldLive(ctx))
+            return false;
+        const goal = await readGoal(goalStoreRef(ctx));
+        if (goal?.status !== "active" || goal.continuationStoppedAt !== undefined)
+            return false;
+        const accounted = await accountCurrentAgentTurn(ctx, "active");
+        if (accounted?.status !== "active")
+            return false;
+        markStopPaused(pi, accounted.id);
+        const paused = await updateGoal(goalStoreRef(ctx), { status: "paused" }, "user");
+        clearAgentGoalAccounting();
+        refreshGoalUiBestEffort(ctx, paused);
+        return true;
+    }
+    async function resumeGoalWithReleasedSession(ctx) {
+        if (stopHoldLive(ctx))
+            return;
+        const goal = await readGoal(goalStoreRef(ctx));
+        if (goal?.status !== "paused" || !pausedByStop(ctx, goal.id))
+            return;
+        markStopResumed(pi, goal.id);
+        const resumed = await updateGoal(goalStoreRef(ctx), { status: "active" }, "user");
+        beginAgentGoalAccounting(resumed);
+        refreshGoalUiBestEffort(ctx, resumed);
+    }
     function beginAgentGoalAccounting(goal) {
         // Goal usage accrues only while its accounting window is open. A stale stop
         // excludes extension-driven turns, like other inactive goals, until input or resume.

package/dist/core/extensions/builtin/goal/stop-pause.d.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext } from "../../types.ts";
 export declare const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export declare const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
+/** A user Stop, or a parent's Stop inherited by this child, holds the session paused; an interrupted run does not. */
 export declare function stopHoldLive(ctx: ExtensionContext): boolean;
 /** The session reopened over a run that never finished: its process died mid-turn (senpi#4683, senpi#5755). */
 export declare function interruptedRunHeld(ctx: ExtensionContext): boolean;

package/dist/core/extensions/builtin/goal/stop-pause.js

@@ -1,8 +1,10 @@
 export const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
+/** A user Stop, or a parent's Stop inherited by this child, holds the session paused; an interrupted run does not. */
 export function stopHoldLive(ctx) {
-    return (ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold" && hold.key !== "interrupted-run") ===
-        true);
+    return (ctx
+        .getPauseState?.()
+        .holds.some((hold) => (hold.kind === "session_hold" && hold.key !== "interrupted-run") || hold.kind === "inherited_hold") === true);
 }
 /** The session reopened over a run that never finished: its process died mid-turn (senpi#4683, senpi#5755). */
 export function interruptedRunHeld(ctx) {

package/dist/core/extensions/builtin/permission-system/index.js

@@ -13,7 +13,7 @@ import { INTERNAL_PERMISSION_TOOLS } from "./internal-tools.js";
 import { handleNoUI } from "./non-interactive.js";
 import { createBuiltinParserRegistry, permissionRequestsFor, toolOwnedPermissionRequests, } from "./parsers.js";
 import { sharedPathIdentityResolver } from "./path-identity-host.js";
-import { registerPermissionPresetReader } from "./preset-registry.js";
+import { readDecisionPresetOverride, registerPermissionPresetReader } from "./preset-registry.js";
 import { showPermissionPrompt } from "./prompt.js";
 import { PermissionService } from "./service.js";
 import { loadPermissionSettings } from "./settings.js";
@@ -184,7 +184,7 @@ export default function permissionSystemExtension(pi) {
         activeSettingsManager = settingsManager;
         const permissionFlag = pi.getFlag("permission");
         loadedPermissionFlag = permissionFlag;
-        const permissionPresetFlag = pi.getFlag("permission-preset");
+        const permissionPresetFlag = decisionPresetFlag();
         loadedPresetFlag = { value: permissionPresetFlag };
         cliRuleset = typeof permissionFlag === "string" ? parsePermissionFlag(permissionFlag) : [];
         const cliPreset = typeof permissionPresetFlag === "string" ? parsePermissionPresetFlag(permissionPresetFlag) : undefined;
@@ -202,6 +202,13 @@ export default function permissionSystemExtension(pi) {
         if (cellSession)
             updateCellEnforcement(cellSession, staticRuleset, activePreset);
     };
+    // The core's delegated-default override wins over a valid or absent preset flag; an invalid one keeps refusing.
+    const decisionPresetFlag = () => {
+        const configured = pi.getFlag("permission-preset");
+        if (typeof configured === "string" && !parsePermissionPresetFlag(configured))
+            return configured;
+        return (cellSession === undefined ? undefined : readDecisionPresetOverride(cellSession)) ?? configured;
+    };
     const applyToolDenials = (onlyWhenNarrowed = false) => {
         const allTools = pi.getAllTools().map((tool) => tool.name);
         const disabledTools = disabled(allTools, staticRuleset);
@@ -215,8 +222,7 @@ export default function permissionSystemExtension(pi) {
     // the rules follow from the next tool call on, and a failed reload refuses calls like session_start.
     const followPresetFlag = (cwd, agentDir) => {
         if (loadedPresetFlag === undefined ||
-            (loadedPresetFlag.value === pi.getFlag("permission-preset") &&
-                loadedPermissionFlag === pi.getFlag("permission"))) {
+            (loadedPresetFlag.value === decisionPresetFlag() && loadedPermissionFlag === pi.getFlag("permission"))) {
             return;
         }
         const sessionApproved = service ? service.getSessionApproved() : [];

package/dist/core/extensions/builtin/permission-system/preset-registry.d.ts

@@ -8,5 +8,7 @@ type PresetReader = () => PermissionPresetName | undefined;
 export declare function registerPermissionPresetReader(session: object, read: PresetReader): () => void;
 /** `undefined` when no permission system runs for the session, or its setup failed. */
 export declare function readPermissionPreset(session: object): PermissionPresetName | undefined;
+export declare function registerDecisionPresetOverride(session: object, read: PresetReader): void;
+export declare function readDecisionPresetOverride(session: object): PermissionPresetName | undefined;
 export {};
 //# sourceMappingURL=preset-registry.d.ts.map

package/dist/core/extensions/builtin/permission-system/preset-registry.js

@@ -10,4 +10,15 @@ export function registerPermissionPresetReader(session, read) {
 export function readPermissionPreset(session) {
     return readers.get(session)?.();
 }
+/**
+ * The preset a gated decision must use instead of the configured one, read at EACH decision (the core's
+ * delegated-default rule: `ask` for delegated-origin work on a session no client named a mode for).
+ */
+const decisionOverrides = new WeakMap();
+export function registerDecisionPresetOverride(session, read) {
+    decisionOverrides.set(session, read);
+}
+export function readDecisionPresetOverride(session) {
+    return decisionOverrides.get(session)?.();
+}
 //# sourceMappingURL=preset-registry.js.map

package/dist/core/extensions/builtin/permission-system/settings.d.ts

@@ -17,4 +17,6 @@ export declare function loadPermissionSettings(settingsManager: SettingsManager,
     approved: Ruleset;
     preset: PermissionPresetName;
 };
+/** The preset `loadPermissionSettings` would enforce, without loading rules; throws on an invalid settings preset. */
+export declare function resolvePermissionPreset(settingsManager: SettingsManager, cliPresetOverride?: PermissionPresetName): PermissionPresetName;
 //# sourceMappingURL=settings.d.ts.map

package/dist/core/extensions/builtin/permission-system/settings.js

@@ -27,9 +27,18 @@ export function loadPermissionSettings(settingsManager, cliOverride, projectDir,
     const cliPresetRuleset = cliPresetOverride && cliPresetOverride !== DEFAULT_PERMISSION_PRESET ? rulesForPreset(cliPresetOverride) : [];
     const staticRuleset = merge(rulesForPreset(DEFAULT_PERMISSION_PRESET), globalPresetRuleset, globalRuleset, projectPresetRuleset, projectRuleset, cliPresetRuleset, cliOverride);
     const approved = agentDir === undefined ? [] : loadApproved(agentDir, projectDir);
-    const preset = cliPresetOverride ?? projectPreset ?? globalPreset ?? DEFAULT_PERMISSION_PRESET;
+    const preset = pickPermissionPreset(cliPresetOverride, projectPreset, globalPreset);
     return { staticRuleset, approved, preset };
 }
+function pickPermissionPreset(cliPreset, projectPreset, globalPreset) {
+    return cliPreset ?? projectPreset ?? globalPreset ?? DEFAULT_PERMISSION_PRESET;
+}
+/** The preset `loadPermissionSettings` would enforce, without loading rules; throws on an invalid settings preset. */
+export function resolvePermissionPreset(settingsManager, cliPresetOverride) {
+    const globalSettings = settingsManager.getGlobalSettings();
+    const projectSettings = settingsManager.getProjectSettings();
+    return pickPermissionPreset(cliPresetOverride, parseSettingsPreset(projectSettings.permissionPreset, "project"), parseSettingsPreset(globalSettings.permissionPreset, "global"));
+}
 function parseSettingsPreset(value, scope) {
     if (value === undefined) {
         return undefined;

package/dist/core/extensions/builtin/terminal/tools/bash.d.ts

@@ -53,7 +53,7 @@ export declare function createPtyBashTool(ctx: TerminalToolContext): {
         cols: Type.TOptional<Type.TNumber>;
         rows: Type.TOptional<Type.TNumber>;
     }>;
-    execute(_toolCallId: string, input: PtyBashInput, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback, execCtx?: SessionEnvSource): Promise<TerminalToolResult>;
+    execute(toolCallId: string, input: PtyBashInput, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback, execCtx?: SessionEnvSource): Promise<TerminalToolResult>;
 };
 export {};
 //# sourceMappingURL=bash.d.ts.map

package/dist/core/extensions/builtin/terminal/tools/bash.js

@@ -1,5 +1,8 @@
 import { Type } from "typebox";
+import { getAgentDir } from "../../../../../config.js";
 import { annotateShellTrust } from "../../../../../engine-trust/shell-trust.js";
+import { createSessionLogger } from "../../../../session-log.js";
+import { stallThresholdMs, watchForStall } from "../../../../stall-warning.js";
 import { formatTerminalToolOutput } from "../output-format.js";
 import { BACKGROUND_START_GRACE_MS, DEFAULT_COLS, DEFAULT_ROWS, FOREGROUND_ENV_OVERRIDES, KILLED_SESSION_EXIT_GRACE_MS, TERMINAL_BASH_TOOL, } from "../shared.js";
 import { errorResult, noticedResult, textResult, } from "./context.js";
@@ -76,6 +79,32 @@ export function createThrottledEmitter(emit, throttleMs = BASH_UPDATE_THROTTLE_M
         },
     };
 }
+let defaultSessionLogger;
+/**
+ * Spawn, logging once if the spawn outlives the call's own timeout (capped at the stall threshold). The call's
+ * kill timer and detach gate are armed only after spawn returns, so a spawn that never returns is otherwise
+ * silent (senpi#6189). The spawn itself is awaited exactly as before.
+ */
+async function spawnReportingStall(ctx, request, toolCallId, execCtx) {
+    const thresholdMs = stallThresholdMs(request.timeoutMs === undefined ? undefined : request.timeoutMs / 1000);
+    const watch = watchForStall(thresholdMs, (elapsedMs) => {
+        const logger = ctx.sessionLogger ?? (defaultSessionLogger ??= createSessionLogger(getAgentDir()));
+        const sessionId = (execCtx ?? ctx.getSessionContext?.())?.sessionManager?.getSessionId();
+        logger.warn("bash_spawn_stalled", {
+            toolCallId,
+            toolName: TERMINAL_BASH_TOOL,
+            ...(sessionId === undefined ? {} : { sessionId }),
+            thresholdMs,
+            elapsedMs,
+        });
+    });
+    try {
+        return await spawnCommandSession(sessionSpawnContext(ctx), request);
+    }
+    finally {
+        watch.stop();
+    }
+}
 function sessionSpawnContext(ctx) {
     return {
         ...ctx,
@@ -198,18 +227,18 @@ function scheduleDetachedSweep(ctx, id, runtime, timeoutMs, startedAt) {
             void ctx.manager.stop(id).catch(() => { });
     }, remainingMs);
 }
-async function runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, execCtx) {
+async function runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, toolCallId, execCtx) {
     if (signal?.aborted)
         return errorResult("Command aborted");
     const timeoutMs = input.timeout !== undefined ? Math.trunc(input.timeout * 1000) : undefined;
-    const { id, runtime } = await spawnCommandSession(sessionSpawnContext(ctx), {
+    const { id, runtime } = await spawnReportingStall(ctx, {
         command: input.command,
         cols,
         rows,
         timeoutMs,
         cwd,
         envOverrides: { ...sessionEnvOverrides(ctx, execCtx), ...FOREGROUND_ENV_OVERRIDES },
-    });
+    }, toolCallId, execCtx);
     const startedAt = Date.now();
     const activity = `running ${input.command.slice(0, 80)}`;
     const emitOutputUpdate = () => {
@@ -334,16 +363,16 @@ async function runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, exec
         },
     });
 }
-async function runBackground(ctx, input, cols, rows, cwd, execCtx) {
+async function runBackground(ctx, input, cols, rows, cwd, toolCallId, execCtx) {
     // Background sessions are NEVER killed by `timeout` (bash-timeout injects a default into
     // every bash call); they live until exit or kill_bash, so no timeoutMs is passed.
-    const { id, runtime } = await spawnCommandSession(sessionSpawnContext(ctx), {
+    const { id, runtime } = await spawnReportingStall(ctx, {
         command: input.command,
         cols,
         rows,
         cwd,
         envOverrides: sessionEnvOverrides(ctx, execCtx),
-    });
+    }, toolCallId, execCtx);
     ctx.onBackgroundStart?.(id, input.description ?? input.command, Date.now(), input.command);
     if (ctx.onBackgroundExit)
         runtime.session.onExit(() => ctx.onBackgroundExit?.(id, runtime));
@@ -368,13 +397,13 @@ export function createPtyBashTool(ctx) {
         promptGuidelines: ["PI_* env vars = current model + session details."],
         fullPromptGuidelines: ["You can inspect PI_* environment variables for current model and session details."],
         parameters: ptyBashSchema,
-        async execute(_toolCallId, input, signal, onUpdate, execCtx) {
+        async execute(toolCallId, input, signal, onUpdate, execCtx) {
             const cols = resolveDimension(input.cols, ctx.defaultCols || DEFAULT_COLS);
             const rows = resolveDimension(input.rows, ctx.defaultRows || DEFAULT_ROWS);
             const cwd = execCtx?.cwd;
             if (input.run_in_background)
-                return runBackground(ctx, input, cols, rows, cwd, execCtx);
-            return runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, execCtx);
+                return runBackground(ctx, input, cols, rows, cwd, toolCallId, execCtx);
+            return runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, toolCallId, execCtx);
         },
     };
 }

package/dist/core/extensions/builtin/terminal/tools/context.d.ts

@@ -2,6 +2,7 @@ import type { TextContent } from "@earendil-works/pi-ai";
 import type { TerminalSessionExit } from "@earendil-works/pi-pty";
 import type { TerminalManager } from "../manager.ts";
 import type { MonitorEvent, MonitorRegistry } from "../monitor-registry.ts";
+import type { SessionLogger } from "../../../../session-log.ts";
 import type { TimeoutAction } from "../settings.ts";
 /** Shared dependencies handed to every terminal tool factory. */
 export interface TerminalToolContext {
@@ -48,6 +49,8 @@ export interface TerminalToolContext {
      * the server and only then lets the command run. Absent on the in-process path, which spawns exactly as before.
      */
     readonly launchBarrier?: TerminalLaunchBarrier;
+    /** Where a stalled spawn is reported (senpi#6189); defaults to the agent directory's session log. */
+    readonly sessionLogger?: Pick<SessionLogger, "warn">;
 }
 /** What a background exit notice reads: on the tool child it is a summary the child sent, not the live session. */
 export interface TerminalExitView {

package/dist/core/extensions/bun-extension-importer.js

@@ -14,6 +14,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { parse } from "es-module-lexer/js";
 import { isCommonJsFile, isEsmByPackageType, parseImportClause, rewriteCommonJsImport, } from "./bun-extension-commonjs.js";
 import { ExtensionSourceError } from "./bun-extension-error.js";
+import { loadSynchronously } from "./bun-extension-load-turns.js";
 import { createPreparedSourceCache } from "./bun-extension-prepared-cache.js";
 import { ExtensionGenerationDisposedError, extensionNamespace, registerExtensionGraph, runtimeModulePath, } from "./bun-extension-registry.js";
 import { hasUseStrictDirective, strictDirectiveModuleSource } from "./bun-extension-strict-directive.js";
@@ -181,7 +182,7 @@ export function createBunExtensionImporter(virtualModules, builtinRedirects = {}
             const evaluating = commonJsModules.get(id);
             if (evaluating !== undefined)
                 return evaluating.exports;
-            const result = nativeRequire(id);
+            const result = loadSynchronously(() => nativeRequire(id));
             return commonJs.has(id) ? result.default : result;
         },
         evaluateCommonJs(filename, body) {
@@ -240,7 +241,7 @@ export function createBunExtensionImporter(virtualModules, builtinRedirects = {}
             // A package directory loads through its main or index file, as a native import does.
             const entry = statSync(absolute).isDirectory() ? realpathSync(Bun.resolveSync(absolute, absolute)) : absolute;
             const { id } = fileTarget(entry);
-            const module = await import(__rewriteRelativeImportExtension(id));
+            const module = await registration.holdDuring(import(__rewriteRelativeImportExtension(id)));
             const factory = module.default;
             if (typeof factory !== "function")
                 return factory;
@@ -255,7 +256,7 @@ export function createBunExtensionImporter(virtualModules, builtinRedirects = {}
         async importNamespace(path) {
             assertActive();
             const { id } = fileTarget(realpathSync(resolve(path)));
-            return import(__rewriteRelativeImportExtension(id));
+            return registration.holdDuring(import(__rewriteRelativeImportExtension(id)));
         },
         // Capture identity from the transpiler input, never from a later disk snapshot.
         compiledSources() {

package/dist/core/extensions/bun-extension-load-turns.d.ts

@@ -0,0 +1,4 @@
+export declare function loadInTurn<T>(load: () => T): T | Promise<T>;
+/** Runs `require` so every module it loads is served synchronously, as a CommonJS require needs. */
+export declare function loadSynchronously<T>(require: () => T): T;
+//# sourceMappingURL=bun-extension-load-turns.d.ts.map

package/dist/core/extensions/bun-extension-load-turns.js

@@ -0,0 +1,45 @@
+/**
+ * One extension module per event-loop turn (senpi#6199). Bun fetches the whole static graph of an `import()` inside
+ * one microtask drain, so a synchronous `onLoad` holds the loop for every module of the graph: a host compiling an
+ * extension (its boot load, a warm, an open) answered no socket until the last one. During an import each load waits
+ * for its own turn instead; a synchronous `require()` cannot take a promise, so its loads still run at once.
+ */
+const queued = [];
+let draining = false;
+let synchronousDepth = 0;
+function drainOne() {
+    queued.shift()?.();
+    if (queued.length > 0)
+        setImmediate(drainOne);
+    else
+        draining = false;
+}
+export function loadInTurn(load) {
+    if (synchronousDepth > 0)
+        return load();
+    return new Promise((resolve, reject) => {
+        queued.push(() => {
+            try {
+                resolve(load());
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        if (draining)
+            return;
+        draining = true;
+        setImmediate(drainOne);
+    });
+}
+/** Runs `require` so every module it loads is served synchronously, as a CommonJS require needs. */
+export function loadSynchronously(require) {
+    synchronousDepth++;
+    try {
+        return require();
+    }
+    finally {
+        synchronousDepth--;
+    }
+}
+//# sourceMappingURL=bun-extension-load-turns.js.map

package/dist/core/extensions/bun-extension-registry.d.ts

@@ -29,6 +29,7 @@ export declare class ExtensionGenerationDisposedError extends Error {
 }
 export declare function registerExtensionGraph(graph: ExtensionGraph, virtualModules: Readonly<Record<string, Readonly<Record<string, unknown>>>>): {
     generation: string;
+    holdDuring<T>(pending: Promise<T>): Promise<T>;
     dispose(): void;
 };
 /** Internal lifecycle diagnostics, shared by regression and compiled probes. */

package/dist/core/extensions/bun-extension-registry.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { dirname, isAbsolute } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { loadInTurn } from "./bun-extension-load-turns.js";
 import { publishRuntimeMetadata } from "./extension-runtime-module.js";
 // esbuild reads an import() only when its second argument is fully static, and these
 // attributes are whatever the extension wrote. The call stays dynamic either way, so
@@ -33,6 +34,10 @@ function splitModuleId(id) {
 }
 const graphs = new Map();
 const collected = new FinalizationRegistry((generation) => graphs.delete(generation));
+// Bun serves an import()'s modules one loop turn at a time (senpi#6199) and its loader keeps no reference to the graph
+// serving them: a graph whose importer was already dropped was collected between two loads and failed the import as
+// disposed (senpi#6208). A graph is held strongly while any import it serves is in flight.
+const importing = new Map();
 let nextGeneration = 0;
 let installed = false;
 let pluginRegistrations = 0;
@@ -129,7 +134,7 @@ function installRegistry(virtualModules) {
                     const parsed = splitModuleId(path);
                     if (parsed === undefined)
                         throw new ExtensionModuleIdError(path);
-                    return graphFor(parsed.generation).load(parsed.filename);
+                    return loadInTurn(() => graphFor(parsed.generation).load(parsed.filename));
                 });
                 installed = true;
             },
@@ -143,6 +148,19 @@ export function registerExtensionGraph(graph, virtualModules) {
     collected.register(graph, generation, graph);
     return {
         generation,
+        async holdDuring(pending) {
+            importing.set(graph, (importing.get(graph) ?? 0) + 1);
+            try {
+                return await pending;
+            }
+            finally {
+                const remaining = (importing.get(graph) ?? 1) - 1;
+                if (remaining === 0)
+                    importing.delete(graph);
+                else
+                    importing.set(graph, remaining);
+            }
+        },
         dispose() {
             graphs.delete(generation);
             collected.unregister(graph);

package/dist/core/extensions/loader.js

@@ -53,6 +53,7 @@ import { cachedExtensionFactory, extensionModuleImporter, rememberExtensionFacto
 import { kernelToolInvokerStorage } from "./kernel-tools-context.js";
 import { createLifecycleApi } from "./lifecycle-api.js";
 import { withProviderLoginStart } from "./provider-login-start.js";
+import { createSessionDialogApi } from "./session-dialog-api.js";
 import { StaleExtensionContextError } from "./stale-context-error.js";
 import { DEFAULT_EXTENSION_SESSION_PROFILE, EMPTY_SESSION_CONTEXT } from "./types.js";
 function sessionProfile(options) {
@@ -573,6 +574,10 @@ function createExtensionAPI(extension, runtime, cwd, eventBus, session) {
             }
             return readPermissionPreset(sessionManager);
         },
+        sessionDialog: createSessionDialogApi(() => {
+            assertActive();
+            return runtime.createContext().ui;
+        }),
         getSubscriptionLimits() {
             assertActive();
             return subscriptionLimits.snapshot();

package/dist/core/extensions/session-dialog-api.d.ts

@@ -0,0 +1,5 @@
+import type { ExtensionUIContext } from "./types.ts";
+/** Dialogs addressed to every client attached to the session (`pi.sessionDialog`). */
+export type SessionDialogApi = Pick<ExtensionUIContext, "select" | "confirm" | "input" | "editor">;
+export declare function createSessionDialogApi(currentUI: () => ExtensionUIContext): SessionDialogApi;
+//# sourceMappingURL=session-dialog-api.d.ts.map

package/dist/core/extensions/session-dialog-api.js

@@ -0,0 +1,13 @@
+const toSession = (opts) => ({
+    ...opts,
+    audience: "session",
+});
+export function createSessionDialogApi(currentUI) {
+    return {
+        select: (title, options, opts) => currentUI().select(title, options, toSession(opts)),
+        confirm: (title, message, opts) => currentUI().confirm(title, message, toSession(opts)),
+        input: (title, placeholder, opts) => currentUI().input(title, placeholder, toSession(opts)),
+        editor: (title, prefill, opts) => currentUI().editor(title, prefill, toSession(opts)),
+    };
+}
+//# sourceMappingURL=session-dialog-api.js.map

package/dist/core/extensions/types.d.ts

@@ -51,6 +51,7 @@ import type { PermissionPresetName } from "./builtin/permission-system/types.ts"
 import type { EvalHandleHost } from "./eval-handle-host.ts";
 import type { ExtensionKernelTools } from "./kernel-tools-context.ts";
 import type { SessionControlActions, SessionControlWakeEvent } from "./session-control-types.ts";
+import type { SessionDialogApi } from "./session-dialog-api.ts";
 import type { UserActivityKind } from "./user-activity.ts";
 export type { ExecOptions, ExecResult } from "../exec.ts";
 export type { AppKeybinding, KeybindingsManager } from "../keybindings.ts";
@@ -72,6 +73,11 @@ export interface ExtensionUIDialogOptions {
     toolCallId?: string;
     /** Set with `toolCallId` when another tool (for example a codemode script) issued that call. */
     parentToolCallId?: string;
+    /**
+     * `session`: address the dialog to every client attached to the session instead of the connection whose command
+     * is running, so a prompt raised after that command returned still reaches someone who can answer. RPC field.
+     */
+    audience?: "session";
 }
 /** A guarded private single-line input; callers on older hosts must check capabilities first. */
 export interface ExtensionUIInputOptions extends ExtensionUIDialogOptions {
@@ -247,7 +253,7 @@ export interface ExtensionUIContext {
     /** Get the current text from the core input editor. */
     getEditorText(): string;
     /** Show a multi-line editor for text editing. */
-    editor(title: string, prefill?: string): Promise<string | undefined>;
+    editor(title: string, prefill?: string, opts?: ExtensionUIDialogOptions): Promise<string | undefined>;
     /** Stack additional autocomplete behavior on top of the built-in provider. */
     addAutocompleteProvider(factory: AutocompleteProviderFactory): void;
     /**
@@ -2245,6 +2251,13 @@ export interface ExtensionAPI {
      * permission system is not running for the session, its setup failed, or the session is not bound yet.
      */
     getPermissionPreset(): PermissionPresetName | undefined;
+    /**
+     * Dialogs addressed to every client attached to this session, not only to the connection whose command is
+     * running: a prompt raised after that command returned (a background child's permission request a task runner
+     * forwards) still reaches someone who can answer. The first answer wins. Secret inputs stay with the raising
+     * connection. In the terminal UI they show like any dialog.
+     */
+    sessionDialog: SessionDialogApi;
     /**
      * Every subscription account's latest limit windows: the records `get_subscription_limits` serves, fed by
      * the engine's usage poll and by turns (senpi#3684). An account nothing has reported for is absent.

package/dist/core/permission-decision.d.ts

@@ -0,0 +1,22 @@
+import type { SessionManager } from "./session-manager.ts";
+type DecisionSessionManager = Pick<SessionManager, "getEntries" | "getHeader" | "getSessionId">;
+export interface DecisionSession {
+    readonly sessionManager: DecisionSessionManager;
+    readonly namedPreset: () => string | undefined;
+    readonly launchFlagNamed: () => boolean;
+    readonly recordedPreset: () => string | undefined;
+}
+/**
+ * Binds the remote approval-mode rule to one live session, evaluated at EACH gated decision:
+ * 1. a preset a client named for the session wins (no override);
+ * 2. delegated-origin work asks, or uses the mode a client recorded in the session file when the operator named none.
+ *    It is decided before any `spawnedBy` inheritance, because `spawnedBy` is a client-supplied claim: naming a
+ *    parent, real or made up, can never take a remote device's turn off this rule;
+ * 3. a child (`spawnedBy`) follows its live parent's mode for the parent's current turn; a child whose parent is not
+ *    live in this process asks, unless the operator named a preset for it with the launch flag;
+ * 4. anything else keeps the host's own default (no override).
+ */
+export declare function bindDecisionPreset(session: DecisionSession): void;
+export declare function releaseDecisionPreset(sessionManager: DecisionSessionManager): void;
+export {};
+//# sourceMappingURL=permission-decision.d.ts.map