@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/egress/wire.d.ts

@@ -0,0 +1,228 @@
+/**
+ * The brain-to-hand `model` lane of hosted model-key custody (row CK7; custody design 2.2, 4.3, 4.6, 15.14, 15.15).
+ *
+ * Message shapes only: the brain's device-proxy egress (CK9), the hand's provider-call executor (CK8), the hook and
+ * refresh channels (CK16, CK21) and the publisher (CK12d) speak these. Every request that makes the hand execute
+ * something carries a `SignedPlacementClaim`, checked by `verifyPlacementClaim` before anything runs.
+ */
+import type { DeviceId, ProviderId, WaitCondition } from "@earendil-works/pi-agent-core";
+import type { AssistantMessageEvent, SimpleStreamOptions, StopReason, TranscriptContext, Usage } from "@earendil-works/pi-ai";
+import type { OpenAiCompactBody } from "../extensions/builtin/compaction/openai-remote-schema.ts";
+import type { UrlSecretField } from "./endpoint.ts";
+import type { SignedPlacementClaim } from "./placement-claim.ts";
+import type { ServiceKeyEntry } from "./roster-entries.ts";
+/**
+ * The stream options a brain may send a hand: serializable request shaping only. Never secrets or headers, callbacks,
+ * signals or live objects, or the loop-only `commitStep` (4.3, 2.3 options hygiene). `env` stays hand-local because
+ * some adapters derive the dial target from it: the Cloudflare providers of `anthropic-messages` and `openai-responses`
+ * fill the account and gateway of the model `baseUrl` from it (`resolveCloudflareBaseUrl`), `azure-openai-responses`
+ * reads its base URL or resource name from it, and `bedrock-converse-stream` its HTTP proxy. A brain-supplied `env`
+ * could therefore redirect the hand's dial, with the hand's own credential, to a host of the brain's choosing. `cwd`
+ * stays hand-local because the start message's `cwd` is the one source the hand interprets.
+ */
+export declare const WIRE_STREAM_OPTION_KEYS: readonly ["abortServerSideFallback", "affinitySessionId", "cacheRetention", "deferred", "extraBody", "maxRetries", "maxRetryDelayMs", "maxTokens", "metadata", "reasoning", "refusalFallbacks", "samplingParams", "serviceTier", "sessionAffinityKey", "sessionId", "streamKind", "temperature", "thinkingBudgets", "thinkingSelection", "timeoutMs", "toolChoice", "transport", "websocketConnectTimeoutMs"];
+export type WireStreamOptions = Pick<SimpleStreamOptions, (typeof WIRE_STREAM_OPTION_KEYS)[number]>;
+export type HandLocalStreamOptionKey = Exclude<keyof SimpleStreamOptions, keyof WireStreamOptions>;
+export declare const PROVIDER_CALL_ERROR_CODES: readonly ["auth", "rate_limited", "unavailable", "aborted", "unknown_provider", "local_only_unsupported", "stale_epoch", "claim_expired", "claim_invalid", "registry_key_unknown", "registry_key_revoked", "definition_mismatch"];
+export type ProviderCallErrorCode = (typeof PROVIDER_CALL_ERROR_CODES)[number];
+export type SecretField = "apiKey" | `credential:${number}` | `header:${string}` | `modelHeader:${string}:${string}` | UrlSecretField;
+/** A JSON value, for payloads whose precise schema another row owns (see `HookModelRequestInput`, `WrapTable`). */
+export type WireJson = string | number | boolean | null | readonly WireJson[] | {
+    readonly [key: string]: WireJson;
+};
+/** The serializable projection of today's request-hook input; CK21 pins its golden shape. */
+export type HookModelRequestInput = WireJson;
+/** keyId -> recipientKeyId -> HPKE wrap, the wraps-document tables (2.2); CK3 owns the wrap encoding. */
+export type WrapTable = Readonly<Record<string, Readonly<Record<string, WireJson>>>>;
+export type ProviderCallKind = {
+    readonly kind: "step";
+    readonly stepId: string;
+    readonly attempt: number;
+} | {
+    readonly kind: "aux";
+    readonly auxId: string;
+    readonly streamKind: string;
+    readonly auxKind: "stream" | "warm" | "compact-endpoint";
+};
+/** Step, aux `stream` and aux `warm` carry the admitted request; `compact-endpoint` carries only the body (15.14). */
+export type ProviderCallRequest = {
+    readonly context: TranscriptContext;
+    readonly options: WireStreamOptions;
+} | {
+    readonly compactBody: OpenAiCompactBody;
+};
+export interface ProviderCallStart {
+    readonly t: "provider.call.start";
+    readonly callId: string;
+    readonly sessionId: string;
+    readonly call: ProviderCallKind;
+    readonly claim: SignedPlacementClaim;
+    readonly providerId: ProviderId;
+    readonly modelId: string;
+    readonly expectedSourceDigest?: string;
+    /** Always `"disabled"` for aux calls. */
+    readonly hooks: "enabled" | "disabled";
+    readonly cwd?: string;
+    readonly request: ProviderCallRequest;
+    readonly budget: {
+        readonly deadlineMs: number;
+        readonly maxOutputTokens?: number;
+    };
+}
+/** Sent once, before the dial, when the hand ran the session's request hooks; seq 0 is reserved for it. */
+export interface ProviderCallHooked {
+    readonly t: "provider.call.hooked";
+    readonly callId: string;
+    readonly seq: 0;
+    readonly request: ProviderCallRequest;
+}
+export interface ProviderCallEvent {
+    readonly t: "provider.call.event";
+    readonly callId: string;
+    readonly seq: number;
+    readonly event: AssistantMessageEvent;
+}
+export interface ProviderCallEnd {
+    readonly t: "provider.call.end";
+    readonly callId: string;
+    readonly seq: number;
+    readonly usage: Usage;
+    readonly stopReason: StopReason;
+}
+export interface ProviderCallError {
+    readonly t: "provider.call.error";
+    readonly callId: string;
+    readonly seq: number;
+    readonly code: ProviderCallErrorCode;
+    readonly until?: number;
+    readonly retryable: boolean;
+    readonly usage?: Usage;
+    readonly message: string;
+}
+export interface ProviderCallCancel {
+    readonly t: "provider.call.cancel";
+    readonly callId: string;
+    readonly reason: "user" | "superseded" | "budget" | "shutdown";
+}
+export interface ProviderCallAck {
+    readonly t: "provider.call.ack";
+    readonly callId: string;
+}
+export interface ProviderCallResultQuery {
+    readonly t: "provider.call.result";
+    readonly callId: string;
+    readonly claim: SignedPlacementClaim;
+}
+export type ProviderCallResultReply = {
+    readonly t: "provider.call.result.reply";
+    readonly callId: string;
+    readonly state: "unknown";
+} | {
+    readonly t: "provider.call.result.reply";
+    readonly callId: string;
+    readonly state: "running";
+    readonly lastSeq: number;
+    readonly hooked?: ProviderCallHooked;
+} | {
+    readonly t: "provider.call.result.reply";
+    readonly callId: string;
+    readonly state: "done";
+    readonly hooked?: ProviderCallHooked;
+    readonly events: readonly AssistantMessageEvent[];
+    readonly end: ProviderCallEnd | ProviderCallError;
+};
+export interface CustodyRefreshRequest {
+    readonly t: "custody.refresh.request";
+    readonly providerId: ProviderId;
+    readonly field: SecretField;
+    readonly version: number;
+    readonly claim: SignedPlacementClaim;
+}
+export interface CustodyRefreshAck {
+    readonly t: "custody.refresh.ack";
+    readonly providerId: ProviderId;
+    readonly field: SecretField;
+    readonly outcome: "changed" | "unchanged" | "unresolved";
+    readonly version?: number;
+}
+/** `recipient`: a device enrolled during a custody kill that needs K_cfg/K_proj wraps from a peer (6.6(d), 3.6). */
+export interface CustodyRewrapRequest {
+    readonly t: "custody.rewrap.request";
+    readonly dekIds: readonly string[];
+    readonly custodyEntry: ServiceKeyEntry;
+    readonly recipient?: DeviceId;
+}
+/** Device to device over the hand channel; never sent to the service. */
+export interface CustodyRewrapDeliver {
+    readonly t: "custody.rewrap.deliver";
+    readonly recipient: DeviceId;
+    readonly cfgWraps: WrapTable;
+    readonly projWraps: WrapTable;
+    readonly projCheck: Readonly<Record<string, string>>;
+    readonly sig: string;
+}
+export interface HookModelRequest {
+    readonly t: "hook.model_request";
+    readonly sessionId: string;
+    readonly stepId: string;
+    readonly claim: SignedPlacementClaim;
+    readonly input: HookModelRequestInput;
+}
+export interface HookModelRequestReply {
+    readonly t: "hook.model_request.reply";
+    readonly sessionId: string;
+    readonly stepId: string;
+    readonly output: HookModelRequestInput;
+}
+export interface HandSessionAdvertisement {
+    readonly t: "hand.session.advertise";
+    readonly sessionId: string;
+    readonly connectionId: string;
+    readonly cwd: string;
+    /** H(extension set hash, cwd, project-local hook set), per session (4.9). */
+    readonly advertHash: string;
+    readonly requestHooks: readonly ProviderId[] | "*";
+    readonly streamHooks: readonly ProviderId[] | "*";
+    readonly extensionProviders: readonly ProviderId[];
+    readonly handLocalProviders: readonly {
+        readonly id: ProviderId;
+        readonly models: readonly string[];
+    }[];
+    readonly handDefines: readonly ProviderId[];
+}
+export interface HandPresence {
+    readonly deviceId: DeviceId;
+    readonly online: boolean;
+    readonly capabilities: readonly string[];
+    /** sessionId -> advertHash for the sessions bound to this hand. */
+    readonly sessionAdverts?: Readonly<Record<string, string>>;
+    /** providerId -> this device's current live sourceDigest for the providers it defines; re-sent on file change. */
+    readonly liveDigests?: Readonly<Record<ProviderId, string>>;
+}
+export type StepNotice = {
+    readonly t: "step.waiting";
+    readonly sessionId: string;
+    readonly stepId: string;
+    readonly steer: string;
+    readonly waitFor: readonly WaitCondition[];
+} | {
+    readonly t: "step.resumed";
+    readonly sessionId: string;
+    readonly stepId: string;
+} | {
+    readonly t: "step.reset";
+    readonly sessionId: string;
+    readonly stepId: string;
+    readonly cause: "superseded" | "readmitted";
+};
+export interface ProviderCallChannel {
+    start(msg: ProviderCallStart): Promise<void>;
+    result(msg: ProviderCallResultQuery): Promise<ProviderCallResultReply>;
+    ack(msg: ProviderCallAck): Promise<void>;
+    cancel(msg: ProviderCallCancel): Promise<void>;
+    /** Resumes from any seq; `fromSeq: 0` includes `hooked`. */
+    events(callId: string, fromSeq: number): AsyncIterable<ProviderCallHooked | ProviderCallEvent | ProviderCallEnd | ProviderCallError>;
+    readonly presence: AsyncIterable<HandPresence>;
+    readonly hooks: AsyncIterable<HandSessionAdvertisement>;
+}
+//# sourceMappingURL=wire.d.ts.map

package/dist/core/egress/wire.js

@@ -0,0 +1,49 @@
+/**
+ * The stream options a brain may send a hand: serializable request shaping only. Never secrets or headers, callbacks,
+ * signals or live objects, or the loop-only `commitStep` (4.3, 2.3 options hygiene). `env` stays hand-local because
+ * some adapters derive the dial target from it: the Cloudflare providers of `anthropic-messages` and `openai-responses`
+ * fill the account and gateway of the model `baseUrl` from it (`resolveCloudflareBaseUrl`), `azure-openai-responses`
+ * reads its base URL or resource name from it, and `bedrock-converse-stream` its HTTP proxy. A brain-supplied `env`
+ * could therefore redirect the hand's dial, with the hand's own credential, to a host of the brain's choosing. `cwd`
+ * stays hand-local because the start message's `cwd` is the one source the hand interprets.
+ */
+export const WIRE_STREAM_OPTION_KEYS = [
+    "abortServerSideFallback",
+    "affinitySessionId",
+    "cacheRetention",
+    "deferred",
+    "extraBody",
+    "maxRetries",
+    "maxRetryDelayMs",
+    "maxTokens",
+    "metadata",
+    "reasoning",
+    "refusalFallbacks",
+    "samplingParams",
+    "serviceTier",
+    "sessionAffinityKey",
+    "sessionId",
+    "streamKind",
+    "temperature",
+    "thinkingBudgets",
+    "thinkingSelection",
+    "timeoutMs",
+    "toolChoice",
+    "transport",
+    "websocketConnectTimeoutMs",
+];
+export const PROVIDER_CALL_ERROR_CODES = [
+    "auth",
+    "rate_limited",
+    "unavailable",
+    "aborted",
+    "unknown_provider",
+    "local_only_unsupported",
+    "stale_epoch",
+    "claim_expired",
+    "claim_invalid",
+    "registry_key_unknown",
+    "registry_key_revoked",
+    "definition_mismatch",
+];
+//# sourceMappingURL=wire.js.map

package/dist/core/extensions/builtin/ask-user/escape-residue.d.ts

@@ -0,0 +1,50 @@
+import type { Question } from "./schema.ts";
+/**
+ * Escape residue in question text (oh-my-openagent#12797). Some models write non-ASCII tool-call text as
+ * `\uXXXX` escapes and then drop the backslash (`ub0b4 Tailscale 쓰기` for `내 Tailscale 쓰기`) or double it, so
+ * the decoded string still holds `\ub0b4`. The JSON is valid either way; only the text is wrong.
+ *
+ * Heuristic, applied to every header, question, option label and option description after quoted code is blanked
+ * out (fenced ``` or ~~~ blocks, then ``...`` spans, then `...` spans), since quoted code may name an escape on purpose:
+ * - A literal `\uXXXX` whose code point is non-ASCII is residue.
+ * - A bare run of `uXXXX` tokens is a candidate only when no ASCII letter, digit, `_` or `\` precedes it and
+ *   none follows it, so `menu1234`, `u1a2b3c4d` and other hex-like ids never match. A candidate is residue
+ *   when it decodes to non-ASCII text and either
+ *   - the run has two or more tokens (`ub0b4uc4f0`), each decoding to a letter, mark, number, punctuation or
+ *     symbol (a paired surrogate counts), or
+ *   - its single token decodes to a letter in a script the question set already uses outside ASCII, with
+ *     Hangul, Han, Hiragana, Katakana and Bopomofo counted as one family (a wrong high digit lands a Hangul
+ *     syllable in Han). `u1234` in English text, or beside Korean text, decodes to Ethiopic and stays.
+ * Known gap: a token glued to a preceding ASCII letter (`cafu00e9`) is not detected.
+ * Known limit: an escape named in plain prose outside code (\u00e9 with no backticks) is refused once like residue;
+ * its re-call opens as written.
+ */
+export type EscapeResidue = {
+    field: string;
+    token: string;
+};
+export declare function findEscapeResidue(questions: readonly Question[]): EscapeResidue[];
+/**
+ * The one-refusal bound, scoped to assistant turns. One assistant message's tool calls run in parallel inside one turn,
+ * and the model sees a refusal only after that turn ends. So every residue call in a turn with no open retry is refused,
+ * and every residue call in a later turn opens as written with a warning, whether or not its text changed. The retry
+ * stays open until a turn uses it, so no question set is refused twice in a row and a re-call can never loop.
+ */
+export type EscapeResidueRetry = {
+    refusedThisTurn: boolean;
+    retryOpen: boolean;
+    retriedThisTurn: boolean;
+};
+export declare function freshEscapeResidueRetry(): EscapeResidueRetry;
+/**
+ * Records any call; true means refuse it. A call made while the retry is open uses it up, clean or not, so a clean
+ * re-call closes the retry and a later residue set is refused once again. A residue call with no open retry is refused.
+ */
+export declare function refuseEscapeResidue(retry: EscapeResidueRetry, hasResidue: boolean): boolean;
+export declare function endEscapeResidueTurn(retry: EscapeResidueRetry): void;
+export declare class AskUserEscapeResidueError extends Error {
+    readonly residue: EscapeResidue[];
+    constructor(residue: EscapeResidue[]);
+}
+export declare function escapeResidueNote(residue: readonly EscapeResidue[]): string;
+//# sourceMappingURL=escape-residue.d.ts.map

package/dist/core/extensions/builtin/ask-user/escape-residue.js

@@ -0,0 +1,113 @@
+const BARE_RUN = /(?<![\\A-Za-z0-9_])((?:u[0-9a-fA-F]{4})+)(?![A-Za-z0-9_])/g;
+const LITERAL = /\\u([0-9a-fA-F]{4})/g;
+// Order matters: a fence holds backticks and newlines, and a double-backtick span may hold a single backtick.
+const QUOTED_CODE = [/(```|~~~)[\s\S]*?\1/g, /``[^\n]*?``/g, /`[^`\n]*`/g];
+const NON_ASCII_LETTER = /(?!\p{ASCII})\p{L}/gu;
+const PRINTABLE = /^[\p{L}\p{M}\p{N}\p{P}\p{S}]$/u;
+const CJK_FAMILY = "CJK";
+const SCRIPTS = [
+    [CJK_FAMILY, /[\p{Script=Hangul}\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Bopomofo}]/u],
+    ["Latin", /\p{Script=Latin}/u],
+    ["Cyrillic", /\p{Script=Cyrillic}/u],
+    ["Greek", /\p{Script=Greek}/u],
+    ["Arabic", /\p{Script=Arabic}/u],
+    ["Hebrew", /\p{Script=Hebrew}/u],
+    ["Thai", /\p{Script=Thai}/u],
+    ["Devanagari", /\p{Script=Devanagari}/u],
+];
+function scriptOf(char) {
+    return SCRIPTS.find(([, pattern]) => pattern.test(char))?.[0];
+}
+function decode(run) {
+    const units = [];
+    for (let index = 1; index < run.length; index += 5)
+        units.push(Number.parseInt(run.slice(index, index + 4), 16));
+    return String.fromCharCode(...units);
+}
+function isResidueRun(run, scripts) {
+    const decoded = decode(run);
+    const chars = Array.from(decoded);
+    if (chars.some((char) => (char.codePointAt(0) ?? 0) < 0x80))
+        return false;
+    if (run.length > 5)
+        return chars.every((char) => PRINTABLE.test(char));
+    const char = chars[0] ?? "";
+    if (!/\p{L}/u.test(char))
+        return false;
+    const script = scriptOf(char);
+    return script !== undefined && scripts.has(script);
+}
+function textFields(questions) {
+    const fields = [];
+    questions.forEach((question, index) => {
+        const at = `questions[${index}]`;
+        fields.push([`${at}.header`, question.header], [`${at}.question`, question.question]);
+        question.options.forEach((option, optionIndex) => {
+            fields.push([`${at}.options[${optionIndex}].label`, option.label]);
+            if (option.description !== undefined)
+                fields.push([`${at}.options[${optionIndex}].description`, option.description]);
+        });
+    });
+    return fields;
+}
+export function findEscapeResidue(questions) {
+    const fields = textFields(questions).map(([field, text]) => [
+        field,
+        QUOTED_CODE.reduce((masked, pattern) => masked.replace(pattern, (span) => " ".repeat(span.length)), text),
+    ]);
+    const scripts = new Set();
+    for (const [, text] of fields) {
+        for (const [char] of text.matchAll(NON_ASCII_LETTER)) {
+            const script = scriptOf(char);
+            if (script !== undefined)
+                scripts.add(script);
+        }
+    }
+    const residue = [];
+    for (const [field, text] of fields) {
+        for (const match of text.matchAll(LITERAL)) {
+            if (Number.parseInt(match[1] ?? "0", 16) >= 0x80)
+                residue.push({ field, token: match[0] });
+        }
+        for (const match of text.matchAll(BARE_RUN)) {
+            const run = match[1] ?? "";
+            if (isResidueRun(run, scripts))
+                residue.push({ field, token: run });
+        }
+    }
+    return residue;
+}
+export function freshEscapeResidueRetry() {
+    return { refusedThisTurn: false, retryOpen: false, retriedThisTurn: false };
+}
+/**
+ * Records any call; true means refuse it. A call made while the retry is open uses it up, clean or not, so a clean
+ * re-call closes the retry and a later residue set is refused once again. A residue call with no open retry is refused.
+ */
+export function refuseEscapeResidue(retry, hasResidue) {
+    if (retry.retryOpen) {
+        retry.retriedThisTurn = true;
+        return false;
+    }
+    if (hasResidue)
+        retry.refusedThisTurn = true;
+    return hasResidue;
+}
+export function endEscapeResidueTurn(retry) {
+    retry.retryOpen = retry.refusedThisTurn || (retry.retryOpen && !retry.retriedThisTurn);
+    retry.refusedThisTurn = false;
+    retry.retriedThisTurn = false;
+}
+export class AskUserEscapeResidueError extends Error {
+    constructor(residue) {
+        const found = residue.map(({ field, token }) => `${field} has "${token}"`).join("; ");
+        super(`Escape residue in the question text: ${found}. Non-ASCII text was written as a \\uXXXX escape that lost its backslash or kept a literal one, so the user would see the code instead of the character. Call this tool again with the same questions, writing every non-ASCII character directly as UTF-8 text, never as a \\uXXXX escape.`);
+        this.name = "AskUserEscapeResidueError";
+        this.residue = residue;
+    }
+}
+export function escapeResidueNote(residue) {
+    const tokens = [...new Set(residue.map(({ token }) => token))].join(", ");
+    return `This question may show undecoded character codes (${tokens}); it is shown as the model wrote it.`;
+}
+//# sourceMappingURL=escape-residue.js.map

package/dist/core/extensions/builtin/ask-user/extension.js

@@ -1,4 +1,5 @@
 import { APP_NAME } from "../../../../config.js";
+import { endEscapeResidueTurn, freshEscapeResidueRetry } from "./escape-residue.js";
 import { pickVariant, TOOL_NAMES } from "./family.js";
 import { deliverQueuedQuestionOutcomes, getPendingQuestions } from "./registry.js";
 import { resumeDanglingQuestion } from "./resume.js";
@@ -19,7 +20,7 @@ export default function askUserExtension(pi) {
             // In TUI mode interactive-mode's text dispatch handles /answer first.
         },
     });
-    const state = { timedOut: false, unavailable: false };
+    const state = { timedOut: false, unavailable: false, escapeResidue: freshEscapeResidueRetry() };
     let registered = false;
     const cancelPending = (ctx, origin, message, reportDetachedLoss = false) => {
         for (const entry of getPendingQuestions(ctx.sessionManager.getSessionId()))
@@ -42,6 +43,7 @@ export default function askUserExtension(pi) {
     pi.on("session_start", async (event, ctx) => {
         state.timedOut = false;
         state.unavailable = false;
+        state.escapeResidue = freshEscapeResidueRetry();
         const sessionId = ctx.sessionManager.getSessionId();
         for (const entry of getPendingQuestions(sessionId))
             entry.rebind(pi, ctx, state);
@@ -61,8 +63,12 @@ export default function askUserExtension(pi) {
     pi.on("model_select", async (event, ctx) => {
         sync(ctx, event.model);
     });
+    pi.on("turn_end", () => {
+        endEscapeResidueTurn(state.escapeResidue);
+    });
     pi.on("agent_end", async () => {
         state.timedOut = false;
+        state.escapeResidue = freshEscapeResidueRetry();
     });
     pi.on("session_shutdown", async (event, ctx) => {
         if (event.reason === "reload") {

package/dist/core/extensions/builtin/ask-user/resume.js

@@ -1,3 +1,4 @@
+import { freshEscapeResidueRetry } from "./escape-residue.js";
 import { TOOL_NAMES } from "./family.js";
 import { parseAskUserAnswerFrame } from "./format.js";
 import { ASK_USER_SETTLEMENT_ENTRY, emitAskUserClosed } from "./notify.js";
@@ -143,7 +144,7 @@ export async function resumeDanglingQuestion(pi, event, ctx) {
             continue;
         }
         // The runtime registration owns delivery, including after another reload.
-        void startQuestion(pi, ctx, request, ctx.signal, { timedOut: false, unavailable: false }, dangling.variant, {
+        void startQuestion(pi, ctx, request, ctx.signal, { timedOut: false, unavailable: false, escapeResidue: freshEscapeResidueRetry() }, dangling.variant, {
             resuming: true,
         });
     }

package/dist/core/extensions/builtin/ask-user/tool.d.ts

@@ -1,8 +1,11 @@
 import type { ExtensionAPI, ExtensionContext, ToolDefinition } from "../../types.ts";
+import { type EscapeResidueRetry } from "./escape-residue.ts";
 import { type AskUserVariant, type QuestionRequest, type QuestionResponse } from "./schema.ts";
 export interface AskUserState {
     timedOut: boolean;
     unavailable: boolean;
+    /** One refusal per turn of residue calls; the re-calls in a later turn open as written (oh-my-openagent#12797). */
+    escapeResidue: EscapeResidueRetry;
 }
 /**
  * Deliver a settled async answer as one framed user message. The extension owns

package/dist/core/extensions/builtin/ask-user/tool.js

@@ -1,5 +1,6 @@
 import { releaseQuestionInput } from "../../../question-input.js";
 import { WAKE_SOURCE_STATE_EVENT } from "../monitor-state-event.js";
+import { AskUserEscapeResidueError, escapeResidueNote, findEscapeResidue, refuseEscapeResidue, } from "./escape-residue.js";
 import { TOOL_NAMES } from "./family.js";
 import { formatGatedCancellation, formatModelAnswer, formatResultDetails, formatUserMessage, showsPartialAnswers, } from "./format.js";
 import { ASK_USER_ASKED_EVENT, ASK_USER_QUESTION_ENTRY, ASK_USER_SETTLEMENT_ENTRY, emitAskUserClosed, emitAskUserNotification, } from "./notify.js";
@@ -329,6 +330,13 @@ export function createAskUserTool(variant, pi, state) {
                 emitAskUserClosed(pi, request.requestId, unavailable);
                 return result(variant, unavailable, request);
             }
+            const residue = findEscapeResidue(request.questions);
+            if (refuseEscapeResidue(state.escapeResidue, residue.length > 0)) {
+                emitAskUserClosed(pi, request.requestId, unavailable);
+                throw new AskUserEscapeResidueError(residue);
+            }
+            if (residue.length > 0)
+                ctx.ui.notify(escapeResidueNote(residue), "warning");
             const completion = startQuestion(pi, ctx, request, signal, state, variant);
             if (!request.waitForAnswer)
                 return {

package/dist/core/extensions/builtin/goal/index.js

@@ -175,6 +175,13 @@ export default function goalExtension(pi) {
             clearAgentGoalAccounting();
         }
         refreshGoalUi(ctx, goal);
+        // A session reopened under a live Stop keeps its goal paused until the Stop is released.
+        if (await pauseGoalWithHeldSession(ctx))
+            return;
+        // A goal a live Stop paused (a crashed run included) resumes with the session once the Stop is released, so the
+        // resume prompt would only restart its counter under the hold.
+        if (goal?.status === "paused" && stopHoldLive(ctx) && pausedByStop(ctx, goal.id))
+            return;
         // Opening the session earns one reminder; renders and extension reloads do not.
         // Stale stops retain active status, unlike user-paused or blocking stops.
         if ((event.reason === "startup" || event.reason === "resume") &&
@@ -218,6 +225,13 @@ export default function goalExtension(pi) {
             }
         }
     });
+    // A Stop that lands while no turn runs emits no `session_abort`, so the goal pauses and resumes with the session here.
+    pi.on("session_hold_changed", async (event, ctx) => {
+        if (event.change === "paused")
+            await pauseGoalWithHeldSession(ctx);
+        else
+            await resumeGoalWithReleasedSession(ctx);
+    });
     pi.on("held_wakes_released", async (event, ctx) => {
         if (!event.sources.goal)
             return;
@@ -303,6 +317,11 @@ export default function goalExtension(pi) {
         if (event.aborted === true && event.abortSource === "user" && goal?.status === "active") {
             goal = await pauseOrBlockOnUserAbort(ctx, goal.id);
         }
+        else if (goal?.status === "active" && goal.continuationStoppedAt === undefined && stopHoldLive(ctx)) {
+            // A Stop that joined this turn's agent_end boundary leaves the turn un-aborted; the goal still pauses with it.
+            markStopPaused(pi, goal.id);
+            goal = await updateGoal(goalStoreRef(ctx), { status: "paused" }, "user");
+        }
         if (goal?.status === "active") {
             beginAgentGoalAccounting(goal);
         }
@@ -404,6 +423,33 @@ export default function goalExtension(pi) {
             return;
         syncContinuationGoal(ctx, continuedGoal);
     }
+    /** Close the accounting window at the Stop and pause an idle active goal; a running turn pauses at its `agent_end`. */
+    async function pauseGoalWithHeldSession(ctx) {
+        if (agentTurnInProgress || !stopHoldLive(ctx))
+            return false;
+        const goal = await readGoal(goalStoreRef(ctx));
+        if (goal?.status !== "active" || goal.continuationStoppedAt !== undefined)
+            return false;
+        const accounted = await accountCurrentAgentTurn(ctx, "active");
+        if (accounted?.status !== "active")
+            return false;
+        markStopPaused(pi, accounted.id);
+        const paused = await updateGoal(goalStoreRef(ctx), { status: "paused" }, "user");
+        clearAgentGoalAccounting();
+        refreshGoalUiBestEffort(ctx, paused);
+        return true;
+    }
+    async function resumeGoalWithReleasedSession(ctx) {
+        if (stopHoldLive(ctx))
+            return;
+        const goal = await readGoal(goalStoreRef(ctx));
+        if (goal?.status !== "paused" || !pausedByStop(ctx, goal.id))
+            return;
+        markStopResumed(pi, goal.id);
+        const resumed = await updateGoal(goalStoreRef(ctx), { status: "active" }, "user");
+        beginAgentGoalAccounting(resumed);
+        refreshGoalUiBestEffort(ctx, resumed);
+    }
     function beginAgentGoalAccounting(goal) {
         // Goal usage accrues only while its accounting window is open. A stale stop
         // excludes extension-driven turns, like other inactive goals, until input or resume.

package/dist/core/extensions/builtin/goal/stop-pause.d.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext } from "../../types.ts";
 export declare const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export declare const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
+/** A user Stop, or a parent's Stop inherited by this child, holds the session paused; an interrupted run does not. */
 export declare function stopHoldLive(ctx: ExtensionContext): boolean;
 /** The session reopened over a run that never finished: its process died mid-turn (senpi#4683, senpi#5755). */
 export declare function interruptedRunHeld(ctx: ExtensionContext): boolean;

package/dist/core/extensions/builtin/goal/stop-pause.js

@@ -1,8 +1,10 @@
 export const GOAL_STOP_PAUSED_ENTRY = "goal-stop-paused";
 export const GOAL_STOP_RESUMED_ENTRY = "goal-stop-resumed";
+/** A user Stop, or a parent's Stop inherited by this child, holds the session paused; an interrupted run does not. */
 export function stopHoldLive(ctx) {
-    return (ctx.getPauseState?.().holds.some((hold) => hold.kind === "session_hold" && hold.key !== "interrupted-run") ===
-        true);
+    return (ctx
+        .getPauseState?.()
+        .holds.some((hold) => (hold.kind === "session_hold" && hold.key !== "interrupted-run") || hold.kind === "inherited_hold") === true);
 }
 /** The session reopened over a run that never finished: its process died mid-turn (senpi#4683, senpi#5755). */
 export function interruptedRunHeld(ctx) {

package/dist/core/extensions/builtin/monitor-state-event.d.ts

@@ -5,6 +5,32 @@ export declare const CONTINUATION_HOLD_STATE_EVENT = "continuation_hold_state";
 /** Live widgets of a session's long background jobs; payload `JobWidgetState` (job-widgets/view-types.ts). */
 export declare const JOB_WIDGET_STATE_EVENT = "job_widget_state";
 export declare const MONITOR_NOTIFICATION_CUSTOM_TYPE = "senpi-monitor:notification";
+/** A background terminal session's age notice or auto-reap; payload `TerminalBackgroundAgeEvent` (senpi#6201). */
+export declare const TERMINAL_BACKGROUND_AGE_EVENT = "terminal_background_age";
+/**
+ * `running`: the session is still running at `ageMinutes` (first at 10 minutes, then every 30). `reaped`: the opt-in
+ * auto-reap stopped it at `autoReapMinutes`. `reap_failed`: the auto-reap's one stop at `autoReapMinutes` did not end
+ * it, for `reason`; it keeps running and keeps reporting. `stop` is the call that stops it; `autoReapMinutes` is null
+ * when nothing will stop it automatically.
+ */
+export interface TerminalBackgroundAgeEvent {
+    readonly kind: "running" | "reaped" | "reap_failed";
+    readonly id: string;
+    readonly description: string;
+    readonly command?: string;
+    readonly startedAtMs: number;
+    readonly ageMs: number;
+    readonly ageMinutes: number;
+    readonly autoReapMinutes: number | null;
+    /** Why the auto-reap failed; set on `reap_failed` only. */
+    readonly reason?: string;
+    readonly stop: {
+        readonly tool: "kill_bash";
+        readonly args: {
+            readonly bash_id: string;
+        };
+    };
+}
 /** Per-monitor entry in a monitor notification's `details.monitors`. */
 export interface MonitorNotificationDetail {
     readonly id: string;