@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/retry-fallback/usage-limit.js

@@ -2,17 +2,25 @@ import { describeProviderFailureForUser, isQuotaExhaustionMessage } from "@earen
 import { rateLimitModelFamily } from "../credential-pool/model-scope.js";
 import { isBillingErrorMessage } from "./billing.js";
 export class AccountUsageLimitError extends Error {
-    constructor(provider, raw = "usage limit reached", resetsAt) {
-        super(describeProviderFailureForUser(raw, {
+    /**
+     * `families`: a no-family weekly limit confirmed on these families before it held the provider (senpi#5596).
+     * `accountsOut`: a pooled provider's accounts, each with why it cannot serve (senpi#5590).
+     */
+    constructor(provider, raw = "usage limit reached", resetsAt, families, accountsOut) {
+        const message = describeProviderFailureForUser(raw, {
             model: provider,
             usageLimit: "account",
             ...(resetsAt === undefined ? {} : { resetsAt: formatResetTime(resetsAt) }),
-        }));
+        });
+        const withFamilies = families === undefined || families.length === 0
+            ? message
+            : `${message} The limit named no model family; it was confirmed on ${families.join(" and ")}.`;
+        super(accountsOut === undefined ? withFamilies : `${withFamilies} No account can serve: ${accountsOut}.`);
         this.name = "AccountUsageLimitError";
     }
 }
 // The same reader-local time plus timezone the credential pool's blocked message uses.
-function formatResetTime(epochMs) {
+export function formatResetTime(epochMs) {
     return new Date(epochMs).toLocaleString("en-US", {
         month: "short",
         day: "numeric",

package/dist/core/sdk.d.ts

@@ -1,4 +1,4 @@
-import { type ThinkingLevel } from "@earendil-works/pi-agent-core";
+import { type AgentOptions, type ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ThinkingSelection } from "@earendil-works/pi-ai";
 import { type Model } from "@earendil-works/pi-ai/compat";
 import { AgentSession } from "./agent-session.ts";
@@ -17,6 +17,11 @@ import { createBashTool, createCodingTools, createEditTool, createFindTool, crea
 import type { ToolRuntimeKind } from "../cli/tool-runtime.ts";
 import { type ExecutionPipelineWitnessSink } from "./execution/pipeline-witness-sink.ts";
 export interface CreateAgentSessionOptions {
+    /**
+     * Makes each finished model step durable before the loop acts on it (hosted custody, C6 C.P3). Passed to the Agent
+     * this function builds; fused and split-local sessions leave it unset.
+     */
+    commitStep?: AgentOptions["commitStep"];
     /**
      * Where this session's execution-pipeline receipts go (S18b part 3): a sink outside the session, never a session entry.
      * Unset: the file `SENPI_EXECUTION_PIPELINE_WITNESS` names (one JSON line per call), else no receipts.

package/dist/core/sdk.js

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { bindPermissionDecision } from "./permission-mode.js";
 import { Agent, createInternalAgentChannel, setDefaultStreamFn, } from "@earendil-works/pi-agent-core";
 import { modelsAreEqual, streamSimple } from "@earendil-works/pi-ai/compat";
 import { getAgentDir } from "../config.js";
@@ -291,6 +292,7 @@ export async function createAgentSession(options = {}) {
     agent = new Agent({
         internalChannel,
         onExecutionPipeline: resolveWitnessSink(options.executionPipelineWitness),
+        ...(options.commitStep ? { commitStep: options.commitStep } : {}),
         initialState: {
             systemPrompt: "",
             model,
@@ -486,6 +488,7 @@ export async function createAgentSession(options = {}) {
         sessionManager.appendThinkingLevelChange(thinkingLevel, thinkingSelection, undefined, model);
     }
     sessionRef.current = session;
+    bindPermissionDecision(session);
     const extensionsResult = resourceLoader.getExtensions();
     return {
         session,

package/dist/core/session-log.js

@@ -7,7 +7,7 @@ const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
 const MAX_STRING_LENGTH = 200;
 const DEBUG_PREFIX = `[${APP_NAME}-session]`;
 const BLOCKED_KEY = /^(?:__proto__|constructor|prototype|headers?|env(?:ironment)?|authorization|credential(?:s)?|password|secret|token|api_?key|client_?secret)$/i;
-const ALLOWED_DATA_KEY = /^(?:action|attemptId|disposition|stage|error|mode|count|willRetry|deferAdmission|delivered|restored|cause|accepted|skipped|rejectionCause|reason|durationMs|kind|retryable|phase|op|bytes|generation|requestId|tokens|tokensBefore|tokensAfter|contextWindow|attempt|aborted|sessionId|role|provider|model|source|actor|from|to|duringTurn|persistDefault|extension|handlerEvent|queuedId|ageMs|seat|until|shared)$/;
+const ALLOWED_DATA_KEY = /^(?:action|attemptId|disposition|stage|error|mode|count|willRetry|deferAdmission|delivered|restored|cause|accepted|skipped|rejectionCause|reason|durationMs|kind|retryable|phase|op|bytes|generation|requestId|tokens|tokensBefore|tokensAfter|contextWindow|attempt|aborted|sessionId|role|provider|model|source|actor|from|to|duringTurn|persistDefault|extension|handlerEvent|queuedId|ageMs|seat|until|shared|toolCallId|parentToolCallId|toolName|thresholdMs|elapsedMs|queueDepth|queueHead)$/;
 const SENSITIVE_TEXT = /((?:authorization\s*[:=]\s*(?:bearer|basic)\s+)|(?:bearer\s+)|(?:[?&](?:api[_-]?key|token|secret|password|auth(?:orization)?)=))[^\s&,"'}\]]+/gi;
 export function createSessionLogger(agentDir, options = {}) {
     if (typeof agentDir !== "string" || agentDir.length === 0) {

package/dist/core/stall-warning.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Deadline-bounded warnings for waits that have no deadline of their own (senpi#6189).
+ *
+ * A wait that never settles leaves no trace: no timer fires, no result is written, and the
+ * session just idles. These helpers only observe such a wait. They log once when it outlives
+ * its threshold and never resolve, reject, abort or delay anything themselves.
+ */
+/** A wait still pending after this long is logged once. A bash spawn's own shorter timeout lowers it. */
+export declare const STALL_WARNING_MS = 30000;
+/** The warning threshold for a bash spawn whose own `timeout` (in seconds) may be shorter than {@link STALL_WARNING_MS}. */
+export declare function stallThresholdMs(timeoutSeconds: unknown): number;
+export declare function queueEntryLabel(event: {
+    readonly type: string;
+}): string;
+export interface StallWatch {
+    stop(): void;
+}
+/**
+ * Call `onStall` once if `stop` has not run within `thresholdMs`. The caller keeps its own `await`, so the
+ * watched wait's outcome and ordering are unchanged. The timer is unref'd: it never keeps the process alive.
+ */
+export declare function watchForStall(thresholdMs: number, onStall: (elapsedMs: number) => void): StallWatch;
+export interface PendingQueueSnapshot {
+    readonly queueDepth: number;
+    /** Label of the oldest unsettled entry: the one every later entry waits behind. */
+    readonly queueHead?: string;
+    readonly ageMs?: number;
+}
+/** The unsettled entries of a promise chain, oldest first, so a stalled wait on the chain can name what it waits behind. */
+export declare class PendingQueueLedger {
+    private nextId;
+    private readonly entries;
+    /**
+     * Record `run` as an entry from now until it settles, and return it wrapped for the chain. The wrapper returns
+     * exactly what `run` returns or throws, and releases the entry from that result. It never attaches a handler to
+     * the chain itself, so a rejection on the chain is exactly as visible (or unhandled) as before.
+     */
+    track<A extends unknown[], R>(label: string, run: (...args: A) => R): (...args: A) => R;
+    snapshot(): PendingQueueSnapshot;
+}
+//# sourceMappingURL=stall-warning.d.ts.map

package/dist/core/stall-warning.js

@@ -0,0 +1,72 @@
+/**
+ * Deadline-bounded warnings for waits that have no deadline of their own (senpi#6189).
+ *
+ * A wait that never settles leaves no trace: no timer fires, no result is written, and the
+ * session just idles. These helpers only observe such a wait. They log once when it outlives
+ * its threshold and never resolve, reject, abort or delay anything themselves.
+ */
+/** A wait still pending after this long is logged once. A bash spawn's own shorter timeout lowers it. */
+export const STALL_WARNING_MS = 30_000;
+/** The warning threshold for a bash spawn whose own `timeout` (in seconds) may be shorter than {@link STALL_WARNING_MS}. */
+export function stallThresholdMs(timeoutSeconds) {
+    if (typeof timeoutSeconds !== "number" || !Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
+        return STALL_WARNING_MS;
+    }
+    return Math.max(1, Math.min(STALL_WARNING_MS, Math.trunc(timeoutSeconds * 1000)));
+}
+export function queueEntryLabel(event) {
+    const toolCallId = event.toolCallId;
+    return typeof toolCallId === "string" ? `${event.type}:${toolCallId}` : event.type;
+}
+/**
+ * Call `onStall` once if `stop` has not run within `thresholdMs`. The caller keeps its own `await`, so the
+ * watched wait's outcome and ordering are unchanged. The timer is unref'd: it never keeps the process alive.
+ */
+export function watchForStall(thresholdMs, onStall) {
+    const startedAt = Date.now();
+    const timer = setTimeout(() => onStall(Date.now() - startedAt), thresholdMs);
+    timer.unref?.();
+    return { stop: () => clearTimeout(timer) };
+}
+/** The unsettled entries of a promise chain, oldest first, so a stalled wait on the chain can name what it waits behind. */
+export class PendingQueueLedger {
+    constructor() {
+        this.nextId = 0;
+        this.entries = new Map();
+    }
+    /**
+     * Record `run` as an entry from now until it settles, and return it wrapped for the chain. The wrapper returns
+     * exactly what `run` returns or throws, and releases the entry from that result. It never attaches a handler to
+     * the chain itself, so a rejection on the chain is exactly as visible (or unhandled) as before.
+     */
+    track(label, run) {
+        const id = this.nextId++;
+        this.entries.set(id, { label, enqueuedAt: Date.now() });
+        const release = () => {
+            this.entries.delete(id);
+        };
+        return (...args) => {
+            let result;
+            try {
+                result = run(...args);
+            }
+            catch (error) {
+                release();
+                throw error;
+            }
+            // The chain adopts `result`, which marks it handled anyway; this handler changes nobody's view of it.
+            if (result instanceof Promise)
+                void result.then(release, release);
+            else
+                release();
+            return result;
+        };
+    }
+    snapshot() {
+        const head = this.entries.values().next().value;
+        if (head === undefined)
+            return { queueDepth: 0 };
+        return { queueDepth: this.entries.size, queueHead: head.label, ageMs: Date.now() - head.enqueuedAt };
+    }
+}
+//# sourceMappingURL=stall-warning.js.map

package/dist/core/terminal-settings.d.ts

@@ -25,6 +25,7 @@ export interface TerminalSettings {
     monitorRunawayLinesPerMinute?: number;
     monitorRunawayMinutes?: number;
     maxDurableMonitors?: number | "unlimited";
+    backgroundAutoReapMinutes?: number;
     killGuard?: "on" | "off";
 }
 export interface BranchSummarySettings {

package/dist/core/turn-origin.d.ts

@@ -0,0 +1,31 @@
+import type { SessionManager } from "./session-manager.ts";
+/**
+ * Who started a turn, for the delegated-default permission rule (remote approval-mode work):
+ * - `local`: a local connection's or the TUI's own input;
+ * - `delegated`: input that arrived on a delegated (remote device) connection;
+ * - `engine`: a turn no client record started (an extension's message, a goal or loop turn, restored input).
+ * A steer joins the running turn (`join`) and never changes its origin.
+ */
+export type TurnOrigin = "local" | "delegated" | "engine";
+export type InputTurnMark = TurnOrigin | "join";
+export type ConnectionOrigin = "local" | "delegated";
+type OriginSessionManager = Pick<SessionManager, "getEntries" | "appendCustomEntry">;
+/** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
+export declare function inputTurnMark(input: {
+    readonly mode?: "steer" | "followUp";
+    readonly connectionOrigin?: ConnectionOrigin;
+    readonly source?: string;
+}): InputTurnMark;
+export declare function markInputTurnOrigin(message: object, mark: InputTurnMark): void;
+/** Carries `from`'s origin mark onto `to`, a copy of the same input: a copy without it would open or join a turn unmarked. */
+export declare function copyInputTurnMark(from: object, to: object): void;
+/** Whether a message carries an origin mark: a user message always opens a turn's origin, any other only when marked. */
+export declare function hasInputTurnMark(message: object): boolean;
+/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+export declare function noteRunStart(sessionManager: object): void;
+export declare function noteUserMessageStart(sessionManager: object, message: object): void;
+export declare function recordDelegatedOrigin(sessionManager: OriginSessionManager): void;
+/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
+export declare function decidingTurnIsDelegated(sessionManager: Pick<SessionManager, "getEntries">): boolean;
+export {};
+//# sourceMappingURL=turn-origin.d.ts.map

package/dist/core/turn-origin.js

@@ -0,0 +1,64 @@
+const DELEGATED_ORIGIN_ENTRY = "delegated_origin";
+const inputMarks = new WeakMap();
+const currentOrigins = new WeakMap();
+const delegatedSessions = new WeakSet();
+/** The mark an input gets where it is created: explicit for client records, `local` for the TUI, else `engine`. */
+export function inputTurnMark(input) {
+    if (input.mode === "steer")
+        return "join";
+    if (input.connectionOrigin !== undefined)
+        return input.connectionOrigin;
+    return input.source === undefined || input.source === "interactive" ? "local" : "engine";
+}
+export function markInputTurnOrigin(message, mark) {
+    inputMarks.set(message, mark);
+}
+/** Carries `from`'s origin mark onto `to`, a copy of the same input: a copy without it would open or join a turn unmarked. */
+export function copyInputTurnMark(from, to) {
+    const mark = inputMarks.get(from);
+    if (mark !== undefined)
+        inputMarks.set(to, mark);
+}
+/** Whether a message carries an origin mark: a user message always opens a turn's origin, any other only when marked. */
+export function hasInputTurnMark(message) {
+    return inputMarks.has(message);
+}
+/** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
+export function noteRunStart(sessionManager) {
+    currentOrigins.set(sessionManager, "engine");
+}
+export function noteUserMessageStart(sessionManager, message) {
+    const mark = inputMarks.get(message);
+    if (mark === "join")
+        return;
+    currentOrigins.set(sessionManager, mark ?? "engine");
+}
+export function recordDelegatedOrigin(sessionManager) {
+    if (delegatedOriginOf(sessionManager))
+        return;
+    delegatedSessions.add(sessionManager);
+    sessionManager.appendCustomEntry(DELEGATED_ORIGIN_ENTRY, { delegatedOrigin: true }, { startupBookkeeping: true });
+}
+// How many entries a session's scan has already found free of the marker: each gated decision reads only new entries.
+const scannedEntries = new WeakMap();
+function delegatedOriginOf(sessionManager) {
+    if (delegatedSessions.has(sessionManager))
+        return true;
+    const entries = sessionManager.getEntries();
+    const persisted = entries
+        .slice(scannedEntries.get(sessionManager) ?? 0)
+        .some((entry) => entry.type === "custom" && entry.customType === DELEGATED_ORIGIN_ENTRY);
+    if (persisted)
+        delegatedSessions.add(sessionManager);
+    else
+        scannedEntries.set(sessionManager, entries.length);
+    return persisted;
+}
+/** Whether the deciding turn counts as delegated-origin: a remote device started it, or nobody did on a remote-driven session. */
+export function decidingTurnIsDelegated(sessionManager) {
+    const origin = currentOrigins.get(sessionManager) ?? "engine";
+    if (origin === "delegated")
+        return true;
+    return origin === "engine" && delegatedOriginOf(sessionManager);
+}
+//# sourceMappingURL=turn-origin.js.map

package/dist/modes/interactive/components/remote-delivery-message.d.ts

@@ -3,7 +3,8 @@ import { type MessageRenderer, type SessionControlSender } from "../../../core/e
  * A message another session delivered renders as its own block - never as the user's own input, so
  * a reader always sees which text came from outside this terminal. A delivery that names its sender
  * shows one label line ("Sent by another agent · <name>") over the message as it was written; one
- * that does not keeps the generic heading over the text the model read.
+ * that does not keeps the generic heading over the text the model read. A delivery an RPC connection admitted for a
+ * remote device leads with the device the engine stamped, before the sender that device's caller claimed.
  */
 export declare const renderRemoteDelivery: MessageRenderer;
 export declare function senderLabel(sender: SessionControlSender): string;

package/dist/modes/interactive/components/remote-delivery-message.js

@@ -1,18 +1,23 @@
 import { Box, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
-import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, sessionControlSenderOf, } from "../../../core/extensions/types.js";
+import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, sessionControlRemoteOriginOf, sessionControlSenderOf, } from "../../../core/extensions/types.js";
 import { sharedMarkdownTheme } from "../theme/theme.js";
 /**
  * A message another session delivered renders as its own block - never as the user's own input, so
  * a reader always sees which text came from outside this terminal. A delivery that names its sender
  * shows one label line ("Sent by another agent · <name>") over the message as it was written; one
- * that does not keeps the generic heading over the text the model read.
+ * that does not keeps the generic heading over the text the model read. A delivery an RPC connection admitted for a
+ * remote device leads with the device the engine stamped, before the sender that device's caller claimed.
  */
 export const renderRemoteDelivery = (message, _options, theme) => {
     const box = new Box(1, 1, (text) => theme.bg("customMessageBg", text));
     const sender = sessionControlSenderOf(message.details);
-    const shown = sender === undefined ? undefined : displayTextOf(message.details);
-    if (sender !== undefined && shown !== undefined) {
-        box.addChild(new Text(theme.fg("dim", senderLabel(sender)), 0, 0));
+    const origin = sessionControlRemoteOriginOf(message.details);
+    const shown = sender === undefined && origin === undefined ? undefined : displayTextOf(message.details);
+    if (shown !== undefined) {
+        if (origin !== undefined)
+            box.addChild(new Text(theme.fg("dim", originLabel(origin)), 0, 0));
+        if (sender !== undefined)
+            box.addChild(new Text(theme.fg("dim", senderLabel(sender)), 0, 0));
         box.addChild(new Spacer(1));
         box.addChild(new Markdown(shown, 0, 0, sharedMarkdownTheme(), { color: (line) => theme.fg("customMessageText", line) }));
         return box;
@@ -43,6 +48,9 @@ export function senderLabel(sender) {
                 : `Sent from ${sender.platform} · ${sender.author}`;
     }
 }
+function originLabel(origin) {
+    return `Relayed from device ${origin.deviceName ?? origin.deviceId}`;
+}
 export function builtInMessageRenderer(customType) {
     return customType === SESSION_CONTROL_DELIVERY_TYPE ? renderRemoteDelivery : undefined;
 }

package/dist/modes/rpc/admit-external-message-command.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `admit_external_message` (senpi#6233): the session's own `ExternalAdmission.admit`, the call behind
+ * `pi.session.admitExternalMessage`. The engine writes its fixed `session_control_delivery` entry: never a user message,
+ * never the extension `input` event, never a slash command or prompt template, whatever the text says.
+ *
+ * What the engine adds comes from the connection the record arrived on (`DeliveryPeer`), never from the record (the
+ * security design gate's binding conditions): the device a remote connection speaks for is stamped into the entry's
+ * metadata (`details.remote_origin`) while the model reads exactly the text a same-machine delivery carries (senpi#6250:
+ * an agent need not know a message crossed devices), the ledger keys the delivery under that device, a `command_line` sender is refused
+ * from a remote device, the turn that consumes the delivery takes the connection's origin, the thread-chain guard
+ * runs first, and an id the transcript already holds is answered `already_admitted` after a restart too.
+ */
+import type { AgentSession } from "../../core/agent-session.ts";
+import type { ConnectionOrigin } from "../../core/turn-origin.ts";
+import type { RpcAdmitExternalMessageCommand, RpcAdmitExternalMessageReply } from "./admit-external-message-wire.ts";
+import { type ChainRefusal } from "./chain-admission.ts";
+import type { RpcRemoteOrigin } from "./remote-origin.ts";
+/** The connection a delivery arrived on, as the host knows it. */
+export interface DeliveryPeer {
+    /** The remote device the connection speaks for (`ConnectionRoles.originOf`); absent on a plain local connection. */
+    readonly origin: RpcRemoteOrigin | undefined;
+    readonly connectionOrigin: ConnectionOrigin;
+}
+export type AdmitExternalMessageAnswer = {
+    readonly ok: true;
+    readonly data: RpcAdmitExternalMessageReply;
+} | {
+    readonly ok: false;
+    readonly refusal: ChainRefusal | {
+        readonly message: string;
+        readonly errorCode: string;
+    };
+};
+type AdmittingSession = Pick<AgentSession, "externalAdmission" | "sessionManager" | "settingsManager">;
+export declare function admitExternalMessage(session: AdmittingSession, command: RpcAdmitExternalMessageCommand, peer: DeliveryPeer): AdmitExternalMessageAnswer;
+export {};
+//# sourceMappingURL=admit-external-message-command.d.ts.map

package/dist/modes/rpc/admit-external-message-command.js

@@ -0,0 +1,61 @@
+import { writtenDeliveryIds } from "../../core/external-admission.js";
+import { admitInputChain } from "./chain-admission.js";
+const SENDER_NOT_ALLOWED = "sender_not_allowed";
+const DELEGATED_ORIGIN_UNKNOWN = "delegated_origin_unknown";
+const CANONICAL_TURN_ID = /^(0|[1-9]\d{0,15})$/;
+/** The ledger key: a remote device's ids live under that device, a local connection's under its own prefix. */
+function ledgerId(deliveryId, origin) {
+    return origin === undefined
+        ? `rpc:local/${deliveryId}`
+        : `device:${encodeURIComponent(origin.deviceId)}/${deliveryId}`;
+}
+export function admitExternalMessage(session, command, peer) {
+    const chain = admitInputChain(command.chainCount, session.settingsManager);
+    if (chain.kind === "refused")
+        return { ok: false, refusal: chain.refusal };
+    const { origin } = peer;
+    // A delegated connection that names no device is never treated as this machine's own: it is refused (fail closed).
+    if (peer.connectionOrigin === "delegated" && origin === undefined)
+        return {
+            ok: false,
+            refusal: {
+                message: `${DELEGATED_ORIGIN_UNKNOWN}: a delegated connection that names no remote device cannot admit a delivery`,
+                errorCode: DELEGATED_ORIGIN_UNKNOWN,
+            },
+        };
+    if (origin !== undefined && command.sender?.kind === "command_line")
+        return {
+            ok: false,
+            refusal: {
+                message: `${SENDER_NOT_ALLOWED}: a remote device cannot send as this machine's command line`,
+                errorCode: SENDER_NOT_ALLOWED,
+            },
+        };
+    const admission = session.externalAdmission;
+    const answer = (kind, epoch) => ({
+        ok: true,
+        data: { kind, turnId: String(epoch) },
+    });
+    const id = ledgerId(command.deliveryId, origin);
+    if (session.sessionManager.reduceHistory(writtenDeliveryIds).has(id))
+        return answer("already_admitted", admission.turnEpoch);
+    const expected = command.expectedTurnId;
+    if (expected !== undefined && !CANONICAL_TURN_ID.test(expected))
+        return answer("turn_conflict", admission.turnEpoch);
+    const displayText = command.displayText ?? (origin === undefined ? undefined : command.text);
+    const result = admission.admit({
+        delivery_id: id,
+        text: command.text,
+        deliverAs: command.deliverAs,
+        ...(command.sender === undefined ? {} : { sender: command.sender }),
+        ...(displayText === undefined ? {} : { display_text: displayText }),
+        ...(expected === undefined ? {} : { expected_turn_id: Number(expected) }),
+        ...(command.whenIdle === undefined ? {} : { whenIdle: command.whenIdle }),
+    }, {
+        ...(origin === undefined ? {} : { remoteOrigin: origin }),
+        ...(chain.chainCount === undefined ? {} : { chainCount: chain.chainCount }),
+        turnMark: command.deliverAs === "steer" ? "join" : peer.connectionOrigin,
+    });
+    return answer(result.kind, result.turn_epoch);
+}
+//# sourceMappingURL=admit-external-message-command.js.map

package/dist/modes/rpc/admit-external-message-wire.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The wire of `admit_external_message` (senpi#6233): a message another agent sent this session, relayed over RPC and
+ * admitted the way `pi.session.admitExternalMessage` admits it in process. The fields mirror
+ * `AdmitExternalMessageInput` in the wire's camelCase, plus a thread call's `chainCount`; turn ids are strings, as
+ * `get_state.currentTurnId`. The field checks run on the local connection and inside `validateRpcInboundRecord`, so
+ * both paths refuse the same records.
+ */
+import type { ExternalAdmissionKind, ExternalDeliverAs, SessionControlSender } from "../../core/extensions/session-control-types.ts";
+export interface RpcAdmitExternalMessageCommand {
+    id?: string;
+    type: "admit_external_message";
+    /** The delivery's id: admitting an id this runtime already holds or wrote answers `already_admitted`. */
+    deliveryId: string;
+    /** What the model reads, provenance included. */
+    text: string;
+    /** Who the caller says sent it, for the surfaces a human reads; a claim, shown after the engine-stamped device. */
+    sender?: SessionControlSender;
+    /** The message as its sender wrote it, for human surfaces. */
+    displayText?: string;
+    deliverAs: ExternalDeliverAs;
+    /** The turn the sender observed (`get_state.currentTurnId`); a steer is admitted only while it is current. */
+    expectedTurnId?: string;
+    /** What an idle session does with it: `start` (the default) starts a turn, `queue` holds it for the next one. */
+    whenIdle?: "start" | "queue";
+    /** A thread call's hop count (1 for a chain's first hop), checked against the user's chain limit first (K8). */
+    chainCount?: number;
+}
+export interface RpcAdmitExternalMessageReply {
+    kind: ExternalAdmissionKind;
+    /** The session's turn when the delivery was admitted, in `get_state.currentTurnId`'s form. */
+    turnId: string;
+}
+export interface RpcAdmitExternalMessageResponse {
+    id?: string;
+    type: "response";
+    command: "admit_external_message";
+    success: true;
+    data: RpcAdmitExternalMessageReply;
+}
+/** Why an `admit_external_message` record is refused, prefixed with its type; `undefined` for any other record. */
+export declare function admitExternalMessageFieldError(value: Record<string, unknown>, maxTextCharacters: number): string | undefined;
+//# sourceMappingURL=admit-external-message-wire.d.ts.map

package/dist/modes/rpc/admit-external-message-wire.js

@@ -0,0 +1,55 @@
+/** The bound every id and label of the record stays inside, as the other local field checks bound theirs. */
+const MAX_ID_CHARACTERS = 256;
+const SENDER_FIELDS = {
+    agent: { required: ["session_id"], optional: ["name"] },
+    command_line: { required: [], optional: ["user"] },
+    external: { required: ["platform"], optional: ["author"] },
+};
+const SENDER_SHAPE = 'sender must be { kind: "agent", session_id, name? }, { kind: "command_line", user? } or { kind: "external", platform, author? }, each value a non-empty string of at most 256 characters.';
+function boundedId(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= MAX_ID_CHARACTERS;
+}
+/** A well-formed sender of a known kind with no other field, so nothing beyond the label can ride along. */
+function isDeliverySender(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const kind = Reflect.get(value, "kind");
+    if (typeof kind !== "string" || !Object.hasOwn(SENDER_FIELDS, kind))
+        return false;
+    const { required, optional } = SENDER_FIELDS[kind];
+    const allowed = new Set(["kind", ...required, ...optional]);
+    return (Object.keys(value).every((key) => allowed.has(key)) &&
+        required.every((key) => boundedId(Reflect.get(value, key))) &&
+        optional.every((key) => Reflect.get(value, key) === undefined || boundedId(Reflect.get(value, key))));
+}
+function fieldProblem(value, maxTextCharacters) {
+    if (!boundedId(value.deliveryId))
+        return "needs deliveryId, a non-empty string of at most 256 characters.";
+    if (typeof value.text !== "string" || value.text.trim() === "" || value.text.length > maxTextCharacters)
+        return `needs text, a non-empty string of at most ${maxTextCharacters} characters.`;
+    if (value.deliverAs !== "steer" && value.deliverAs !== "followUp")
+        return 'deliverAs must be "steer" or "followUp".';
+    if (value.displayText !== undefined &&
+        (typeof value.displayText !== "string" || value.displayText.length > maxTextCharacters))
+        return `displayText must be a string of at most ${maxTextCharacters} characters.`;
+    if (value.expectedTurnId !== undefined && !boundedId(value.expectedTurnId))
+        return "expectedTurnId must be a non-empty string of at most 256 characters; read it from get_state.currentTurnId.";
+    if (value.chainCount !== undefined && !(Number.isSafeInteger(value.chainCount) && value.chainCount >= 1))
+        return "chainCount must be a positive integer (1 for a chain's first hop).";
+    // The device is stamped by the engine from the connection; a record that names one is refused, never copied.
+    if (Object.hasOwn(value, "remote_origin") || Object.hasOwn(value, "remoteOrigin"))
+        return "must not name remote_origin: the engine stamps the device the connection speaks for.";
+    if (value.whenIdle !== undefined && value.whenIdle !== "start" && value.whenIdle !== "queue")
+        return 'whenIdle must be "start" or "queue"; omit it to start a turn on an idle session.';
+    if (value.sender !== undefined && !isDeliverySender(value.sender))
+        return SENDER_SHAPE;
+    return undefined;
+}
+/** Why an `admit_external_message` record is refused, prefixed with its type; `undefined` for any other record. */
+export function admitExternalMessageFieldError(value, maxTextCharacters) {
+    if (value.type !== "admit_external_message")
+        return undefined;
+    const problem = fieldProblem(value, maxTextCharacters);
+    return problem === undefined ? undefined : `admit_external_message ${problem}`;
+}
+//# sourceMappingURL=admit-external-message-wire.js.map

package/dist/modes/rpc/client-input-handler.d.ts

@@ -1,4 +1,5 @@
 import type { AgentSession } from "../../core/agent-session.ts";
+import type { ConnectionOrigin } from "../../core/turn-origin.ts";
 import { type RpcClientInput } from "./client-admission-record.ts";
 type InputOutput = {
     readonly output: (record: object) => void;
@@ -7,6 +8,7 @@ type InputOutput = {
 /** The sending connection's declared role; a connection that never declared `interactive_user` is an agent's. */
 type InputClient = {
     readonly interactiveUser: boolean;
+    readonly connectionOrigin?: ConnectionOrigin;
 };
 /** The same admission path serves classic stdio, shared sessions, and worker sessions. */
 export declare function handleClientInput(session: AgentSession, command: RpcClientInput, io: InputOutput, client?: InputClient): Promise<void>;

package/dist/modes/rpc/client-input-handler.js

@@ -72,6 +72,7 @@ export async function handleClientInput(session, command, io, client = { interac
                     ...options,
                     source: "rpc",
                     interactiveUser: client.interactiveUser,
+                    ...(client.connectionOrigin === undefined ? {} : { connectionOrigin: client.connectionOrigin }),
                     ...chain,
                     onQueuedInput: hooks.queued,
                     promptDisposition: (next) => {
@@ -136,6 +137,7 @@ export async function handleClientInput(session, command, io, client = { interac
                         expectedTurnId: command.expectedTurnId,
                         source: "rpc",
                         interactiveUser: client.interactiveUser,
+                        ...(client.connectionOrigin === undefined ? {} : { connectionOrigin: client.connectionOrigin }),
                         ...chain,
                         onQueuedInput: hooks.queued,
                     };