@code-yeongyu/senpi 2026.11.6-2 → 2026.11.6-3

package/dist/core/stall-warning.js

@@ -0,0 +1,72 @@
+/**
+ * Deadline-bounded warnings for waits that have no deadline of their own (senpi#6189).
+ *
+ * A wait that never settles leaves no trace: no timer fires, no result is written, and the
+ * session just idles. These helpers only observe such a wait. They log once when it outlives
+ * its threshold and never resolve, reject, abort or delay anything themselves.
+ */
+/** A wait still pending after this long is logged once. A bash spawn's own shorter timeout lowers it. */
+export const STALL_WARNING_MS = 30_000;
+/** The warning threshold for a bash spawn whose own `timeout` (in seconds) may be shorter than {@link STALL_WARNING_MS}. */
+export function stallThresholdMs(timeoutSeconds) {
+    if (typeof timeoutSeconds !== "number" || !Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+        return STALL_WARNING_MS;
+    }
+    return Math.max(1, Math.min(STALL_WARNING_MS, Math.trunc(timeoutSeconds * 1000)));
+}
+export function queueEntryLabel(event) {
+    const toolCallId = event.toolCallId;
+    return typeof toolCallId === "string" ? `${event.type}:${toolCallId}` : event.type;
+}
+/**
+ * Call `onStall` once if `stop` has not run within `thresholdMs`. The caller keeps its own `await`, so the
+ * watched wait's outcome and ordering are unchanged. The timer is unref'd: it never keeps the process alive.
+ */
+export function watchForStall(thresholdMs, onStall) {
+    const startedAt = Date.now();
+    const timer = setTimeout(() => onStall(Date.now() - startedAt), thresholdMs);
+    timer.unref?.();
+    return { stop: () => clearTimeout(timer) };
+}
+/** The unsettled entries of a promise chain, oldest first, so a stalled wait on the chain can name what it waits behind. */
+export class PendingQueueLedger {
+    constructor() {
+        this.nextId = 0;
+        this.entries = new Map();
+    }
+    /**
+     * Record `run` as an entry from now until it settles, and return it wrapped for the chain. The wrapper returns
+     * exactly what `run` returns or throws, and releases the entry from that result. It never attaches a handler to
+     * the chain itself, so a rejection on the chain is exactly as visible (or unhandled) as before.
+     */
+    track(label, run) {
+        const id = this.nextId++;
+        this.entries.set(id, { label, enqueuedAt: Date.now() });
+        const release = () => {
+            this.entries.delete(id);
+        };
+        return (...args) => {
+            let result;
+            try {
+                result = run(...args);
+            }
+            catch (error) {
+                release();
+                throw error;
+            }
+            // The chain adopts `result`, which marks it handled anyway; this handler changes nobody's view of it.
+            if (result instanceof Promise)
+                void result.then(release, release);
+            else
+                release();
+            return result;
+        };
+    }
+    snapshot() {
+        const head = this.entries.values().next().value;
+        if (head === undefined)
+            return { queueDepth: 0 };
+        return { queueDepth: this.entries.size, queueHead: head.label, ageMs: Date.now() - head.enqueuedAt };
+    }
+}
+//# sourceMappingURL=stall-warning.js.map

package/dist/core/turn-origin.d.ts

@@ -0,0 +1,27 @@
+import type { SessionManager } from "./session-manager.ts";
+/**
+ * Who started a turn, for the delegated-default permission rule (remote approval-mode work):
+ * - `local`: a local connection's or the TUI's own input;
+ * - `delegated`: input that arrived on a delegated (remote device) connection;
+ * - `engine`: a turn no client record started (an extension's message, a goal or loop turn, restored input).
+ * A steer joins the running turn (`join`) and never changes its origin.
+ */
+export type TurnOrigin = "local" | "delegated" | "engine";
+export type InputTurnMark = TurnOrigin | "join";
+export type ConnectionOrigin = "local" | "delegated";
+type OriginSessionManager = Pick<SessionManager, "getEntries" | "appendCustomEntry">;
+/** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
+export declare function inputTurnMark(input: {
+    readonly mode?: "steer" | "followUp";
+    readonly connectionOrigin?: ConnectionOrigin;
+    readonly source?: string;
+}): InputTurnMark;
+export declare function markInputTurnOrigin(message: object, mark: InputTurnMark): void;
+/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+export declare function noteRunStart(sessionManager: object): void;
+export declare function noteUserMessageStart(sessionManager: object, message: object): void;
+export declare function recordDelegatedOrigin(sessionManager: OriginSessionManager): void;
+/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
+export declare function decidingTurnIsDelegated(sessionManager: Pick<SessionManager, "getEntries">): boolean;
+export {};
+//# sourceMappingURL=turn-origin.d.ts.map

package/dist/core/turn-origin.js

@@ -0,0 +1,54 @@
+const DELEGATED_ORIGIN_ENTRY = "delegated_origin";
+const inputMarks = new WeakMap();
+const currentOrigins = new WeakMap();
+const delegatedSessions = new WeakSet();
+/** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
+export function inputTurnMark(input) {
+    if (input.mode === "steer")
+        return "join";
+    if (input.connectionOrigin !== undefined)
+        return input.connectionOrigin;
+    return input.source === undefined || input.source === "interactive" ? "local" : "engine";
+}
+export function markInputTurnOrigin(message, mark) {
+    inputMarks.set(message, mark);
+}
+/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+export function noteRunStart(sessionManager) {
+    currentOrigins.set(sessionManager, "engine");
+}
+export function noteUserMessageStart(sessionManager, message) {
+    const mark = inputMarks.get(message);
+    if (mark === "join")
+        return;
+    currentOrigins.set(sessionManager, mark ?? "engine");
+}
+export function recordDelegatedOrigin(sessionManager) {
+    if (delegatedOriginOf(sessionManager))
+        return;
+    delegatedSessions.add(sessionManager);
+    sessionManager.appendCustomEntry(DELEGATED_ORIGIN_ENTRY, { delegatedOrigin: true }, { startupBookkeeping: true });
+}
+// How many entries a session's scan has already found free of the marker: each gated decision reads only new entries.
+const scannedEntries = new WeakMap();
+function delegatedOriginOf(sessionManager) {
+    if (delegatedSessions.has(sessionManager))
+        return true;
+    const entries = sessionManager.getEntries();
+    const persisted = entries
+        .slice(scannedEntries.get(sessionManager) ?? 0)
+        .some((entry) => entry.type === "custom" && entry.customType === DELEGATED_ORIGIN_ENTRY);
+    if (persisted)
+        delegatedSessions.add(sessionManager);
+    else
+        scannedEntries.set(sessionManager, entries.length);
+    return persisted;
+}
+/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
+export function decidingTurnIsDelegated(sessionManager) {
+    const origin = currentOrigins.get(sessionManager) ?? "engine";
+    if (origin === "delegated")
+        return true;
+    return origin === "engine" && delegatedOriginOf(sessionManager);
+}
+//# sourceMappingURL=turn-origin.js.map

package/dist/modes/rpc/client-input-handler.d.ts

@@ -1,4 +1,5 @@
 import type { AgentSession } from "../../core/agent-session.ts";
+import type { ConnectionOrigin } from "../../core/turn-origin.ts";
 import { type RpcClientInput } from "./client-admission-record.ts";
 type InputOutput = {
     readonly output: (record: object) => void;
@@ -7,6 +8,7 @@ type InputOutput = {
 /** The sending connection's declared role; a connection that never declared `interactive_user` is an agent's. */
 type InputClient = {
     readonly interactiveUser: boolean;
+    readonly connectionOrigin?: ConnectionOrigin;
 };
 /** The same admission path serves classic stdio, shared sessions, and worker sessions. */
 export declare function handleClientInput(session: AgentSession, command: RpcClientInput, io: InputOutput, client?: InputClient): Promise<void>;

package/dist/modes/rpc/client-input-handler.js

@@ -72,6 +72,7 @@ export async function handleClientInput(session, command, io, client = { interac
                     ...options,
                     source: "rpc",
                     interactiveUser: client.interactiveUser,
+                    ...(client.connectionOrigin === undefined ? {} : { connectionOrigin: client.connectionOrigin }),
                     ...chain,
                     onQueuedInput: hooks.queued,
                     promptDisposition: (next) => {
@@ -136,6 +137,7 @@ export async function handleClientInput(session, command, io, client = { interac
                         expectedTurnId: command.expectedTurnId,
                         source: "rpc",
                         interactiveUser: client.interactiveUser,
+                        ...(client.connectionOrigin === undefined ? {} : { connectionOrigin: client.connectionOrigin }),
                         ...chain,
                         onQueuedInput: hooks.queued,
                     };

package/dist/modes/rpc/connection-handler.js

@@ -51,12 +51,15 @@ import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } fro
 import { remoteOriginDeclaration, remoteOriginField } from "./remote-origin.js";
 import { advertisedCompactCapabilities, sessionDeclaration } from "./compact-negotiation.js";
 import { commandAuthority } from "./command-authority.js";
+import { noteDelegatedRecord } from "./delegated-drive-origin.js";
 import { ConnectionRoles, DELEGATION_INCARNATION_STALE, roleConnection } from "./connection-roles.js";
 import { ACCOUNT_RESET_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, ENTRIES_TAIL_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
 import { runAbort, runGetEffectStatus, runQueuedInputChange, runSetThinkingLevel, } from "./effect-commands.js";
 import { EffectLedger } from "./effect-ledger.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { handleModelCommand } from "./handlers-model.js";
+import { SET_PERMISSION_PRESET_CAPABILITY } from "./host-capabilities.js";
+import { runSetPermissionPreset } from "./permission-preset-command.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
 import { extensionUiProgressReply, refusedExtensionUiResponse } from "./extension-ui-response.js";
 import { answerExtensionUiResponse } from "./handlers-answer.js";
@@ -86,11 +89,13 @@ import { answerHostResponse, isHostResponse, relocationChannel, } from "./sessio
 export { buildRpcSessionState } from "./rpc-session-state.js";
 /** The tool call a dialog is about, as wire fields (absent when the dialog is not a permission request). */
 function dialogCall(opts) {
+    const audience = opts?.audience === "session" ? { audience: "session" } : {};
     if (opts?.toolCallId === undefined)
-        return {};
+        return audience;
     return {
         toolCallId: opts.toolCallId,
         ...(opts.parentToolCallId === undefined ? {} : { parentToolCallId: opts.parentToolCallId }),
+        ...audience,
     };
 }
 function loadedExtensionName(path) {
@@ -201,6 +206,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     const connectionRoles = options.connectionRoles ?? new ConnectionRoles();
     const currentConnectionId = () => roleConnection(options.clientInfo?.connectionId());
     const hasRole = (role) => connectionRoles.has(currentConnectionId(), role);
+    const connectionOrigin = () => connectionRoles.isDelegated(currentConnectionId()) ? "delegated" : "local";
     const routingSessionId = options.sessionId;
     // True only while THIS connection's own command drives a replacement; the issuer
     // already learns the new identity from its command response.
@@ -449,7 +455,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             ? questions.ask(request, opts)
             : degradeQuestion(createExtensionUIContext(), request, opts),
         select: (title, options, opts) => createDialogPromise(opts, undefined, { method: "select", title, options, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
-        confirm: (title, message, opts) => createDialogPromise(opts, false, { method: "confirm", title, message, timeout: opts?.timeout }, (r) => "cancelled" in r && r.cancelled ? false : "confirmed" in r ? r.confirmed : false),
+        confirm: (title, message, opts) => createDialogPromise(opts, false, { method: "confirm", title, message, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? false : "confirmed" in r ? r.confirmed : false)),
         input: (title, placeholder, opts) => opts?.secret
             ? secretInputs.input(title, placeholder, opts)
             : createDialogPromise(opts, undefined, { method: "input", title, placeholder, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
@@ -564,7 +570,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // Host should track editor state locally if needed
             return "";
         },
-        async editor(title, prefill) {
+        async editor(title, prefill, opts) {
             const id = crypto.randomUUID();
             const frame = {
                 type: "extension_ui_request",
@@ -572,6 +578,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 method: "editor",
                 title,
                 prefill,
+                ...dialogCall(opts),
                 ...remoteOriginField(raiserOrigin()),
             };
             return new Promise((resolve, reject) => {
@@ -1000,6 +1007,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     // Handle a single command
     const handleCommand = async (command, requestContext) => {
         const id = command.id;
+        noteDelegatedRecord(command, connectionOrigin(), session.sessionManager);
         switch (command.type) {
             case "get_protocol_info":
                 return {
@@ -1033,6 +1041,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 SESSION_MODEL_SCOPE_CAPABILITY,
                                 RESUME_SESSION_CAPABILITY,
                                 ENTRIES_TAIL_CAPABILITY,
+                                SET_PERMISSION_PRESET_CAPABILITY,
                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
                                 // Client flags cannot advertise a host guard this classic binding does not run, nor a tool runtime.
@@ -1055,7 +1064,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 if (holdAutomaticInput(session, command, hasRole(INTERACTIVE_USER_CAPABILITY)))
                     return success(id, "prompt", { disposition: "handled", heldAsNotice: true });
                 turnRequested = true;
-                const admission = handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY) });
+                const admission = handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY), connectionOrigin: connectionOrigin() });
                 promptCalls.add(admission);
                 void admission.finally(() => promptCalls.delete(admission));
                 return undefined;
@@ -1125,7 +1134,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 if (holdAutomaticInput(session, command, hasRole(INTERACTIVE_USER_CAPABILITY)))
                     return success(id, command.type, { disposition: "handled", heldAsNotice: true });
                 turnRequested = true;
-                await handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY) });
+                await handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY), connectionOrigin: connectionOrigin() });
                 return undefined;
             }
             case "abort":
@@ -1289,6 +1298,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // =================================================================
             case "set_thinking_level":
                 return runSetThinkingLevel(effectContext(), command);
+            case "set_permission_preset":
+                return runSetPermissionPreset(runtimeHost, command);
             case "cycle_thinking_level": {
                 const level = session.cycleThinkingLevel();
                 if (!level) {

package/dist/modes/rpc/connection-roles.d.ts

@@ -34,6 +34,8 @@ export declare class ConnectionRoles {
     private readonly origins;
     /** A worker isolate's first-seen delegation per connection (`retain`), kept for the worker's life. */
     private readonly retained;
+    /** A worker isolate's connections whose bind or command carried a delegation (a legacy one is never retained). */
+    private readonly carried;
     private source;
     /** The host reads each connection's live record from its writer's delegations. */
     useDelegations(source: (connectionId: string) => DelegatedConnectionView | undefined): void;
@@ -59,11 +61,15 @@ export declare class ConnectionRoles {
     declareOrigin(connectionId: string, origin: RpcRemoteOrigin): void;
     /** The remote device this connection speaks for: a delegated connection's principal, else its declared origin. */
     originOf(connectionId: string | undefined): RpcRemoteOrigin | undefined;
+    /** Whether the connection is delegated (a remote device's): on the host, retained by a worker, or carried to one. */
+    isDelegated(connectionId: string | undefined): boolean;
     has(connectionId: string | undefined, role: string): boolean;
     /** A logical detach: drops claims of earlier incarnations of a delegated socket, and everything of a local one. */
     release(connectionId: string): void;
     /** The socket is gone: nothing of it is kept. */
     forget(connectionId: string): void;
+    /** Worker isolate: a bind or command for `connectionId` carried a delegation, in either mode. */
+    noteCarriedDelegation(connectionId: string): void;
     /** Forgets every connection, for a worker isolate whose session ends. */
     clear(): void;
 }

package/dist/modes/rpc/connection-roles.js

@@ -35,6 +35,8 @@ export class ConnectionRoles {
         this.origins = new Map();
         /** A worker isolate's first-seen delegation per connection (`retain`), kept for the worker's life. */
         this.retained = new Map();
+        /** A worker isolate's connections whose bind or command carried a delegation (a legacy one is never retained). */
+        this.carried = new Set();
     }
     /** The host reads each connection's live record from its writer's delegations. */
     useDelegations(source) {
@@ -125,6 +127,11 @@ export class ConnectionRoles {
             ? { deviceId: principal.deviceId }
             : { deviceId: principal.deviceId, deviceName: principal.deviceName };
     }
+    /** Whether the connection is delegated (a remote device's): on the host, retained by a worker, or carried to one. */
+    isDelegated(connectionId) {
+        const key = roleConnection(connectionId);
+        return this.viewOf(key) !== undefined || this.carried.has(key);
+    }
     has(connectionId, role) {
         const key = roleConnection(connectionId);
         const store = commandAuthority.getStore();
@@ -155,12 +162,18 @@ export class ConnectionRoles {
         this.claims.delete(connectionId);
         this.origins.delete(connectionId);
         this.retained.delete(connectionId);
+        this.carried.delete(connectionId);
+    }
+    /** Worker isolate: a bind or command for `connectionId` carried a delegation, in either mode. */
+    noteCarriedDelegation(connectionId) {
+        this.carried.add(connectionId);
     }
     /** Forgets every connection, for a worker isolate whose session ends. */
     clear() {
         this.claims.clear();
         this.origins.clear();
         this.retained.clear();
+        this.carried.clear();
     }
 }
 //# sourceMappingURL=connection-roles.js.map

package/dist/modes/rpc/delegated-drive-origin.d.ts

@@ -0,0 +1,9 @@
+import type { SessionManager } from "../../core/session-manager.ts";
+import { type ConnectionOrigin } from "../../core/turn-origin.ts";
+/**
+ * Marks a session as remote-driven when a delegated connection sends it any record that can act on its work, decided
+ * by the engine's own method-class table (`drive`, and `device_admin`, which grants more), never by a hand-kept list of
+ * commands, so a new run starter (`continue_from_leaf`, `wake`, `resume_for_run`, ...) cannot slip past the rule.
+ */
+export declare function noteDelegatedRecord(command: object, origin: ConnectionOrigin, sessionManager: Pick<SessionManager, "getEntries" | "appendCustomEntry">): void;
+//# sourceMappingURL=delegated-drive-origin.d.ts.map

package/dist/modes/rpc/delegated-drive-origin.js

@@ -0,0 +1,16 @@
+import { recordDelegatedOrigin } from "../../core/turn-origin.js";
+import { classifyRpcMethod } from "./method-classes.js";
+const ACTING_CLASSES = new Set(["drive", "device_admin"]);
+/**
+ * Marks a session as remote-driven when a delegated connection sends it any record that can act on its work, decided
+ * by the engine's own method-class table (`drive`, and `device_admin`, which grants more), never by a hand-kept list of
+ * commands, so a new run starter (`continue_from_leaf`, `wake`, `resume_for_run`, ...) cannot slip past the rule.
+ */
+export function noteDelegatedRecord(command, origin, sessionManager) {
+    if (origin !== "delegated")
+        return;
+    const methodClass = classifyRpcMethod(command);
+    if (methodClass !== undefined && ACTING_CLASSES.has(methodClass))
+        recordDelegatedOrigin(sessionManager);
+}
+//# sourceMappingURL=delegated-drive-origin.js.map

package/dist/modes/rpc/effect-commands.d.ts

@@ -430,6 +430,12 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
     type: "response";
     command: "set_auto_compaction";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_permission_preset";
+    success: true;
+    data: import("../../core/permission-mode.ts").PermissionModeReply;
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/host-bare-endpoint-registration.d.ts

@@ -0,0 +1,7 @@
+export interface BareEndpointRegistration {
+    readonly agentDir: string;
+    readonly socket: string;
+    readonly log: (message: string) => void;
+}
+export declare function bindRegisteredEndpoint<T>(registration: BareEndpointRegistration, bind: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=host-bare-endpoint-registration.d.ts.map

package/dist/modes/rpc/host-bare-endpoint-registration.js

@@ -0,0 +1,35 @@
+/**
+ * The registry record of a socket host that binds its own public socket (`--listen`, `--headless`). No
+ * `host ensure` runs for such a host, so nothing else writes its `endpoint.json`, and `host gc` removes the
+ * record with the rest of a dead endpoint's directory: after one outage the restarted host would serve
+ * while every registry reader (`host status --all`, a relay device service) finds nothing (senpi#6190).
+ *
+ * So the host writes the record itself before it serves, and binds inside the endpoint's ensure lock, the
+ * lock `host gc` judges and removes under: a gc that judged the socket dead has finished its removal
+ * before this write, and one that starts later finds the socket bound and keeps the endpoint. A supervised
+ * host never comes here - its ensure wrote the record and holds that lock while it starts the host.
+ */
+import { createDaemonDirectories, createHostDaemonPaths } from "./host-daemon-paths.js";
+import { acquireHostEnsureLock } from "./host-ensure-lock.js";
+/** Longer than a gc's hold of one endpoint (its 2 s lock wait, the evidence probes, the removal). */
+const REGISTRATION_LOCK_WAIT_MS = 10_000;
+export async function bindRegisteredEndpoint(registration, bind) {
+    // An abstract socket has no path, so it has no daemon directory either.
+    if (registration.socket.startsWith("\0"))
+        return bind();
+    const release = await acquireHostEnsureLock(registration.socket, REGISTRATION_LOCK_WAIT_MS).catch((cause) => {
+        registration.log(`endpoint ensure lock unavailable, registering without it: ${messageOf(cause)}`);
+        return undefined;
+    });
+    try {
+        await createDaemonDirectories(createHostDaemonPaths({ socket: registration.socket, agentDir: registration.agentDir })).catch((cause) => registration.log(`endpoint registry record not written: ${messageOf(cause)}`));
+        return await bind();
+    }
+    finally {
+        await release?.();
+    }
+}
+function messageOf(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+//# sourceMappingURL=host-bare-endpoint-registration.js.map

package/dist/modes/rpc/host-capabilities.d.ts

@@ -5,6 +5,8 @@ export declare const UNLOAD_SESSION_CAPABILITY = "unload_session";
 export declare const SUBSCRIPTION_LIMITS_CAPABILITY = "subscription_limits";
 /** `resolve_path`: which file a message's path means, the engine's one rule (senpi#3415). */
 export declare const RESOLVE_PATH_CAPABILITY = "resolve_path";
+/** `set_permission_preset`: a live session's approval mode can be set and is echoed back (classic and multi-session). */
+export declare const SET_PERMISSION_PRESET_CAPABILITY = "set_permission_preset_v1";
 /**
  * The capabilities a multi-session host advertises in `get_protocol_info`, in their wire order. `warm` is added only
  * when the runtime is in-process, `tool_runtime:<kind>` names where heavy tool work runs, and `negotiated` carries

package/dist/modes/rpc/host-capabilities.js

@@ -13,6 +13,8 @@ export const UNLOAD_SESSION_CAPABILITY = "unload_session";
 export const SUBSCRIPTION_LIMITS_CAPABILITY = "subscription_limits";
 /** `resolve_path`: which file a message's path means, the engine's one rule (senpi#3415). */
 export const RESOLVE_PATH_CAPABILITY = "resolve_path";
+/** `set_permission_preset`: a live session's approval mode can be set and is echoed back (classic and multi-session). */
+export const SET_PERMISSION_PRESET_CAPABILITY = "set_permission_preset_v1";
 /**
  * The capabilities a multi-session host advertises in `get_protocol_info`, in their wire order. `warm` is added only
  * when the runtime is in-process, `tool_runtime:<kind>` names where heavy tool work runs, and `negotiated` carries
@@ -56,6 +58,7 @@ export function multiSessionHostCapabilities(options) {
             // `get_state`/`get_entries` marked `observe` never attach, and history reads page backward too (senpi#4267).
             OBSERVE_READS_CAPABILITY,
             ENTRIES_TAIL_CAPABILITY,
+            SET_PERMISSION_PRESET_CAPABILITY,
             // Host capabilities, not client opt-ins: only a multi-session host owns the
             // attachment refcount `open_session.retain_on_disconnect` detaches from, the
             // per-session launch profile `context`/`auto_title` travel on, and the session

package/dist/modes/rpc/host-handover-parked.d.ts

@@ -4,6 +4,7 @@ import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { SessionContext, SessionKind } from "../../core/extensions/types.ts";
 import { type SessionEnv } from "./session-caller-env.ts";
 import { type SessionContextOverlay } from "./session-context-patch.ts";
+import { type ResidentWriter } from "./host-handover-resident-writer.ts";
 export interface HandoverParkedEntry {
     readonly sessionPath: string;
     readonly durableSessionId?: string;
@@ -41,9 +42,19 @@ export interface HandoverParkedEntry {
      * Absent on entries an older generation wrote, which every reader treats as a predecessor's park.
      */
     readonly parkedBy?: string;
+    /**
+     * Present while the session is open on its host (senpi#6190); a park drops it. A successor reopens a stamped
+     * entry only once that writer process is gone, so it never opens a session its live predecessor still holds.
+     */
+    readonly residentWriter?: ResidentWriter;
 }
 export declare function recordHandoverParkedSession(daemonDir: string, entry: HandoverParkedEntry): Promise<void>;
 export declare function readHandoverParkedSessions(daemonDir: string): Promise<readonly HandoverParkedEntry[]>;
 export declare function clearHandoverParkedSession(daemonDir: string, sessionPath: string): Promise<void>;
+/**
+ * Clears an inherited entry after its reopen, unless the reopen re-recorded it as resident on
+ * `holder` (a retained session is recorded by the host it is open on, so the next start reopens it).
+ */
+export declare function clearInheritedParkedSession(daemonDir: string, sessionPath: string, holder: string | undefined): Promise<void>;
 export declare function dropHandoverParkedSessionIfFileGone(daemonDir: string, sessionPath: string): Promise<void>;
 //# sourceMappingURL=host-handover-parked.d.ts.map

package/dist/modes/rpc/host-handover-parked.js

@@ -21,6 +21,7 @@ import { parsePermissionPresetName } from "../../core/extensions/builtin/permiss
 import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { sessionEnvShapeError } from "./session-caller-env.js";
 import { applyContextPatch } from "./session-context-patch.js";
+import { isResidentWriter } from "./host-handover-resident-writer.js";
 const recordDir = (daemonDir) => join(daemonDir, "handover-parked");
 const entryFile = (daemonDir, sessionPath) => join(recordDir(daemonDir), `${createHash("sha256").update(sessionPath, "utf8").digest("hex").slice(0, 16)}.json`);
 let mutationChain = Promise.resolve();
@@ -38,6 +39,7 @@ function isEntry(value) {
         (record.durableSessionId === undefined || typeof record.durableSessionId === "string") &&
         (record.cwd === undefined || typeof record.cwd === "string") &&
         (record.parkedBy === undefined || typeof record.parkedBy === "string") &&
+        (record.residentWriter === undefined || isResidentWriter(record.residentWriter)) &&
         (record.thinkingLevel === undefined || typeof record.thinkingLevel === "string") &&
         (record.permissionPreset === undefined ||
             (typeof record.permissionPreset === "string" &&
@@ -100,6 +102,21 @@ export async function readHandoverParkedSessions(daemonDir) {
 export function clearHandoverParkedSession(daemonDir, sessionPath) {
     return enqueueMutation(() => rm(entryFile(daemonDir, sessionPath), { force: true }));
 }
+/**
+ * Clears an inherited entry after its reopen, unless the reopen re-recorded it as resident on
+ * `holder` (a retained session is recorded by the host it is open on, so the next start reopens it).
+ */
+export function clearInheritedParkedSession(daemonDir, sessionPath, holder) {
+    return enqueueMutation(async () => {
+        const file = entryFile(daemonDir, sessionPath);
+        if (holder !== undefined) {
+            const recorded = await readFile(file, "utf8").then((text) => JSON.parse(text), () => undefined);
+            if (isEntry(recorded) && recorded.parkedBy === holder)
+                return;
+        }
+        await rm(file, { force: true });
+    });
+}
 export function dropHandoverParkedSessionIfFileGone(daemonDir, sessionPath) {
     if (existsSync(sessionPath))
         return Promise.resolve();

package/dist/modes/rpc/host-handover-reopen.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { createHostDaemonPaths } from "./host-daemon-paths.js";
-import { clearHandoverParkedSession, dropHandoverParkedSessionIfFileGone, readHandoverParkedSessions, } from "./host-handover-parked.js";
+import { clearHandoverParkedSession, clearInheritedParkedSession, dropHandoverParkedSessionIfFileGone, readHandoverParkedSessions, } from "./host-handover-parked.js";
+import { residentWriterProbe } from "./host-handover-resident-writer.js";
 import { RpcSessionRegistryError } from "./session-registry.js";
 // The watch budget must outlast a heavily loaded drain: a predecessor whose event loop is blocked
 // (parallel hosts, a busy turn settling) can take tens of seconds to write its park after this
@@ -37,6 +38,7 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
     const deadline = Date.now() + HANDOVER_PARKED_REOPEN_BUDGET_MS;
     const reopenAttempts = new Map();
     const heldPolls = new Map();
+    const writerAlive = residentWriterProbe();
     let emptyStreak = 0;
     let sawAnyPark = false;
     for (;;) {
@@ -46,12 +48,12 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
         // it by path with the same durable id.
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
-        const parked = await inheritedParks(daemonDir, holder);
+        const parked = await inheritedParks(daemonDir, holder, writerAlive);
         for (const entry of parked) {
             sawAnyPark = true;
             await reopenOne(daemonDir, open, entry, reopenAttempts, heldPolls, holder);
         }
-        const remaining = (await inheritedParks(daemonDir, holder)).length;
+        const remaining = (await inheritedParks(daemonDir, holder, writerAlive)).length;
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
         emptyStreak = remaining === 0 ? emptyStreak + 1 : 0;
@@ -67,9 +69,19 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
  * parks retained sessions into the same record) is for its successor: reopening it here would put a
  * second open of the path in flight against the client reopening it (senpi#3485).
  */
-async function inheritedParks(daemonDir, holder) {
+async function inheritedParks(daemonDir, holder, writerAlive) {
     const parked = await readHandoverParkedSessions(daemonDir);
-    return parked.filter((entry) => entry.parkedBy === undefined || entry.parkedBy !== holder?.hostInstance);
+    const inherited = [];
+    for (const entry of parked) {
+        if (entry.parkedBy !== undefined && entry.parkedBy === holder?.hostInstance)
+            continue;
+        // A session still resident in its live writer (a handoff's draining predecessor) is that process's to park,
+        // and its unstamped park is what this host reopens; only a writer that is gone leaves it here to restore.
+        if (entry.residentWriter !== undefined && (await writerAlive(entry.residentWriter)))
+            continue;
+        inherited.push(entry);
+    }
+    return inherited;
 }
 async function reopenOne(daemonDir, open, entry, attempts, heldPolls, holder) {
     const taskStatus = entry.contextOverlay && Object.hasOwn(entry.contextOverlay, "task_status")
@@ -93,7 +105,7 @@ async function reopenOne(daemonDir, open, entry, attempts, heldPolls, holder) {
         // reopens it; clearing it here would lose the session when the drain closes it (senpi#3282).
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
-        await clearHandoverParkedSession(daemonDir, entry.sessionPath);
+        await clearInheritedParkedSession(daemonDir, entry.sessionPath, holder?.hostInstance);
     }
     catch (cause) {
         // A `session_path_in_use` refusal means the predecessor still holds the path's cross-generation

package/dist/modes/rpc/host-handover-resident-writer.d.ts

@@ -0,0 +1,16 @@
+import { type WriterProbes } from "../../core/session-writer-claims.ts";
+export interface ResidentWriter {
+    readonly host: string;
+    readonly pid: number;
+    readonly bootAtMs: number;
+    readonly processStartedAtMs: number;
+}
+export declare function currentResidentWriter(probes?: WriterProbes): ResidentWriter;
+export declare function isResidentWriter(value: unknown): value is ResidentWriter;
+/**
+ * A liveness probe for one reopen watch, which polls: a writer found gone stays gone, and a live pid's start time
+ * (a process spawn on some platforms) is read once. A writer on another host cannot be probed from here, so it is
+ * never displaced.
+ */
+export declare function residentWriterProbe(probes?: WriterProbes): (writer: ResidentWriter) => Promise<boolean>;
+//# sourceMappingURL=host-handover-resident-writer.d.ts.map