@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/modes/rpc/connection-handler.js

@@ -1,6 +1,7 @@
 import { isHostOwnedToolRuntimeCapability, toolRuntimeCapabilities, } from "../../cli/tool-runtime.js";
 import { messagePathProjectRoot, resolveMessagePath } from "../../core/message-path-resolution.js";
 import { startOpenTimer } from "../../core/open-timing.js";
+import { admitExternalMessage } from "./admit-external-message-command.js";
 import { apiKeyLoginCredential } from "./api-key-login-credential.js";
 import { clientFacingIdentity } from "./client-admission-record.js";
 import { ExtensionOwnerLifetime } from "./extension-owner-lifetime.js";
@@ -51,12 +52,15 @@ import { ConnectionQuestionBridge, degradeQuestion, sessionQuestionBridges } fro
 import { remoteOriginDeclaration, remoteOriginField } from "./remote-origin.js";
 import { advertisedCompactCapabilities, sessionDeclaration } from "./compact-negotiation.js";
 import { commandAuthority } from "./command-authority.js";
+import { noteDelegatedRecord } from "./delegated-drive-origin.js";
 import { ConnectionRoles, DELEGATION_INCARNATION_STALE, roleConnection } from "./connection-roles.js";
 import { ACCOUNT_RESET_CAPABILITY, AUTH_KEY_VERIFY_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, buildCustomUnsupportedRequest, CONTINUE_FROM_LEAF_CAPABILITY, DEFAULT_CUSTOM_EXTENSION_LABEL, EVAL_CELLS_CAPABILITY, EXTENSION_EVENTS_CAPABILITY, ENTRIES_TAIL_CAPABILITY, INTERACTIVE_USER_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, PROVIDER_ACCOUNT_TEST_CAPABILITY, QUESTION_CAPABILITY, QUEUED_MESSAGE_REVISION_CAPABILITY, RESUME_SESSION_CAPABILITY, RETRY_FALLBACK_COMMAND_CAPABILITY, SESSION_HELD_CAPABILITY, TOOL_BARRIER_CAPABILITY, TASK_PARENT_CAPABILITY, } from "./custom-capability.js";
 import { runAbort, runGetEffectStatus, runQueuedInputChange, runSetThinkingLevel, } from "./effect-commands.js";
 import { EffectLedger } from "./effect-ledger.js";
 import { EFFECT_LEDGER_CAPABILITY } from "./effect-record.js";
 import { handleModelCommand } from "./handlers-model.js";
+import { SET_PERMISSION_PRESET_CAPABILITY } from "./host-capabilities.js";
+import { runSetPermissionPreset } from "./permission-preset-command.js";
 import { createRpcEventOutputBuffer } from "./event-output-buffer.js";
 import { extensionUiProgressReply, refusedExtensionUiResponse } from "./extension-ui-response.js";
 import { answerExtensionUiResponse } from "./handlers-answer.js";
@@ -86,11 +90,13 @@ import { answerHostResponse, isHostResponse, relocationChannel, } from "./sessio
 export { buildRpcSessionState } from "./rpc-session-state.js";
 /** The tool call a dialog is about, as wire fields (absent when the dialog is not a permission request). */
 function dialogCall(opts) {
+    const audience = opts?.audience === "session" ? { audience: "session" } : {};
     if (opts?.toolCallId === undefined)
-        return {};
+        return audience;
     return {
         toolCallId: opts.toolCallId,
         ...(opts.parentToolCallId === undefined ? {} : { parentToolCallId: opts.parentToolCallId }),
+        ...audience,
     };
 }
 function loadedExtensionName(path) {
@@ -201,6 +207,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     const connectionRoles = options.connectionRoles ?? new ConnectionRoles();
     const currentConnectionId = () => roleConnection(options.clientInfo?.connectionId());
     const hasRole = (role) => connectionRoles.has(currentConnectionId(), role);
+    const connectionOrigin = () => connectionRoles.isDelegated(currentConnectionId()) ? "delegated" : "local";
     const routingSessionId = options.sessionId;
     // True only while THIS connection's own command drives a replacement; the issuer
     // already learns the new identity from its command response.
@@ -449,7 +456,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             ? questions.ask(request, opts)
             : degradeQuestion(createExtensionUIContext(), request, opts),
         select: (title, options, opts) => createDialogPromise(opts, undefined, { method: "select", title, options, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
-        confirm: (title, message, opts) => createDialogPromise(opts, false, { method: "confirm", title, message, timeout: opts?.timeout }, (r) => "cancelled" in r && r.cancelled ? false : "confirmed" in r ? r.confirmed : false),
+        confirm: (title, message, opts) => createDialogPromise(opts, false, { method: "confirm", title, message, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? false : "confirmed" in r ? r.confirmed : false)),
         input: (title, placeholder, opts) => opts?.secret
             ? secretInputs.input(title, placeholder, opts)
             : createDialogPromise(opts, undefined, { method: "input", title, placeholder, timeout: opts?.timeout, ...dialogCall(opts) }, (r) => ("cancelled" in r && r.cancelled ? undefined : "value" in r ? r.value : undefined)),
@@ -564,7 +571,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // Host should track editor state locally if needed
             return "";
         },
-        async editor(title, prefill) {
+        async editor(title, prefill, opts) {
             const id = crypto.randomUUID();
             const frame = {
                 type: "extension_ui_request",
@@ -572,6 +579,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 method: "editor",
                 title,
                 prefill,
+                ...dialogCall(opts),
                 ...remoteOriginField(raiserOrigin()),
             };
             return new Promise((resolve, reject) => {
@@ -1000,6 +1008,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
     // Handle a single command
     const handleCommand = async (command, requestContext) => {
         const id = command.id;
+        noteDelegatedRecord(command, connectionOrigin(), session.sessionManager);
         switch (command.type) {
             case "get_protocol_info":
                 return {
@@ -1033,6 +1042,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                                 SESSION_MODEL_SCOPE_CAPABILITY,
                                 RESUME_SESSION_CAPABILITY,
                                 ENTRIES_TAIL_CAPABILITY,
+                                SET_PERMISSION_PRESET_CAPABILITY,
                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
                                 // Client flags cannot advertise a host guard this classic binding does not run, nor a tool runtime.
@@ -1055,7 +1065,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 if (holdAutomaticInput(session, command, hasRole(INTERACTIVE_USER_CAPABILITY)))
                     return success(id, "prompt", { disposition: "handled", heldAsNotice: true });
                 turnRequested = true;
-                const admission = handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY) });
+                const admission = handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY), connectionOrigin: connectionOrigin() });
                 promptCalls.add(admission);
                 void admission.finally(() => promptCalls.delete(admission));
                 return undefined;
@@ -1125,7 +1135,7 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 if (holdAutomaticInput(session, command, hasRole(INTERACTIVE_USER_CAPABILITY)))
                     return success(id, command.type, { disposition: "handled", heldAsNotice: true });
                 turnRequested = true;
-                await handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY) });
+                await handleClientInput(session, command, { output, promptCalls }, { interactiveUser: hasRole(INTERACTIVE_USER_CAPABILITY), connectionOrigin: connectionOrigin() });
                 return undefined;
             }
             case "abort":
@@ -1223,6 +1233,19 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
                 const result = (await sessionControl?.wake(deliveryIds)) ?? {};
                 return success(id, "wake", { admitted: result.admitted ?? [] });
             }
+            case "admit_external_message": {
+                const peer = {
+                    origin: connectionRoles.originOf(currentConnectionId()),
+                    connectionOrigin: connectionOrigin(),
+                };
+                const answer = admitExternalMessage(session, command, peer);
+                if (!answer.ok) {
+                    const { refusal } = answer;
+                    return error(id, command.type, refusal.message, refusal.errorCode, "errorData" in refusal ? refusal.errorData : undefined);
+                }
+                turnRequested = true;
+                return success(id, command.type, answer.data);
+            }
             case "new_session": {
                 const options = command.parentSession ? { parentSession: command.parentSession } : undefined;
                 const result = await runtimeHost.newSession(options);
@@ -1289,6 +1312,8 @@ export function createRpcConnectionHandler(runtimeHost, sink, options = {}) {
             // =================================================================
             case "set_thinking_level":
                 return runSetThinkingLevel(effectContext(), command);
+            case "set_permission_preset":
+                return runSetPermissionPreset(runtimeHost, command);
             case "cycle_thinking_level": {
                 const level = session.cycleThinkingLevel();
                 if (!level) {

package/dist/modes/rpc/connection-roles.d.ts

@@ -34,6 +34,8 @@ export declare class ConnectionRoles {
     private readonly origins;
     /** A worker isolate's first-seen delegation per connection (`retain`), kept for the worker's life. */
     private readonly retained;
+    /** A worker isolate's connections whose bind or command carried a delegation (a legacy one is never retained). */
+    private readonly carried;
     private source;
     /** The host reads each connection's live record from its writer's delegations. */
     useDelegations(source: (connectionId: string) => DelegatedConnectionView | undefined): void;
@@ -59,11 +61,15 @@ export declare class ConnectionRoles {
     declareOrigin(connectionId: string, origin: RpcRemoteOrigin): void;
     /** The remote device this connection speaks for: a delegated connection's principal, else its declared origin. */
     originOf(connectionId: string | undefined): RpcRemoteOrigin | undefined;
+    /** Whether the connection is delegated (a remote device's): on the host, retained by a worker, or carried to one. */
+    isDelegated(connectionId: string | undefined): boolean;
     has(connectionId: string | undefined, role: string): boolean;
     /** A logical detach: drops claims of earlier incarnations of a delegated socket, and everything of a local one. */
     release(connectionId: string): void;
     /** The socket is gone: nothing of it is kept. */
     forget(connectionId: string): void;
+    /** Worker isolate: a bind or command for `connectionId` carried a delegation, in either mode. */
+    noteCarriedDelegation(connectionId: string): void;
     /** Forgets every connection, for a worker isolate whose session ends. */
     clear(): void;
 }

package/dist/modes/rpc/connection-roles.js

@@ -35,6 +35,8 @@ export class ConnectionRoles {
         this.origins = new Map();
         /** A worker isolate's first-seen delegation per connection (`retain`), kept for the worker's life. */
         this.retained = new Map();
+        /** A worker isolate's connections whose bind or command carried a delegation (a legacy one is never retained). */
+        this.carried = new Set();
     }
     /** The host reads each connection's live record from its writer's delegations. */
     useDelegations(source) {
@@ -125,6 +127,11 @@ export class ConnectionRoles {
             ? { deviceId: principal.deviceId }
             : { deviceId: principal.deviceId, deviceName: principal.deviceName };
     }
+    /** Whether the connection is delegated (a remote device's): on the host, retained by a worker, or carried to one. */
+    isDelegated(connectionId) {
+        const key = roleConnection(connectionId);
+        return this.viewOf(key) !== undefined || this.carried.has(key);
+    }
     has(connectionId, role) {
         const key = roleConnection(connectionId);
         const store = commandAuthority.getStore();
@@ -155,12 +162,18 @@ export class ConnectionRoles {
         this.claims.delete(connectionId);
         this.origins.delete(connectionId);
         this.retained.delete(connectionId);
+        this.carried.delete(connectionId);
+    }
+    /** Worker isolate: a bind or command for `connectionId` carried a delegation, in either mode. */
+    noteCarriedDelegation(connectionId) {
+        this.carried.add(connectionId);
     }
     /** Forgets every connection, for a worker isolate whose session ends. */
     clear() {
         this.claims.clear();
         this.origins.clear();
         this.retained.clear();
+        this.carried.clear();
     }
 }
 //# sourceMappingURL=connection-roles.js.map

package/dist/modes/rpc/delegated-drive-origin.d.ts

@@ -0,0 +1,9 @@
+import type { SessionManager } from "../../core/session-manager.ts";
+import { type ConnectionOrigin } from "../../core/turn-origin.ts";
+/**
+ * Marks a session as remote-driven when a delegated connection sends it any record that can act on its work, decided
+ * by the engine's own method-class table (`drive`, and `device_admin`, which grants more), never by a hand-kept list of
+ * commands, so a new run starter (`continue_from_leaf`, `wake`, `resume_for_run`, ...) cannot slip past the rule.
+ */
+export declare function noteDelegatedRecord(command: object, origin: ConnectionOrigin, sessionManager: Pick<SessionManager, "getEntries" | "appendCustomEntry">): void;
+//# sourceMappingURL=delegated-drive-origin.d.ts.map

package/dist/modes/rpc/delegated-drive-origin.js

@@ -0,0 +1,16 @@
+import { recordDelegatedOrigin } from "../../core/turn-origin.js";
+import { classifyRpcMethod } from "./method-classes.js";
+const ACTING_CLASSES = new Set(["drive", "device_admin"]);
+/**
+ * Marks a session as remote-driven when a delegated connection sends it any record that can act on its work, decided
+ * by the engine's own method-class table (`drive`, and `device_admin`, which grants more), never by a hand-kept list of
+ * commands, so a new run starter (`continue_from_leaf`, `wake`, `resume_for_run`, ...) cannot slip past the rule.
+ */
+export function noteDelegatedRecord(command, origin, sessionManager) {
+    if (origin !== "delegated")
+        return;
+    const methodClass = classifyRpcMethod(command);
+    if (methodClass !== undefined && ACTING_CLASSES.has(methodClass))
+        recordDelegatedOrigin(sessionManager);
+}
+//# sourceMappingURL=delegated-drive-origin.js.map

package/dist/modes/rpc/effect-commands.d.ts

@@ -37,7 +37,7 @@ export declare function runAbort(ctx: EffectCommandContext, command: Command<"ab
  * or no longer exists.
  */
 export declare function runQueuedInputChange(ctx: EffectCommandContext, command: Command<"dequeue_message"> | Command<"edit_queued_message">): Promise<RpcResponse>;
-export declare function runSetThinkingLevel(ctx: EffectCommandContext, command: Command<"set_thinking_level">): Promise<import("./session-move-wire.ts").RpcMoveSessionResponse | import("./compact-admission-error.ts").UnknownAdmissionResponse | {
+export declare function runSetThinkingLevel(ctx: EffectCommandContext, command: Command<"set_thinking_level">): Promise<import("./admit-external-message-wire.ts").RpcAdmitExternalMessageResponse | import("./session-move-wire.ts").RpcMoveSessionResponse | import("./compact-admission-error.ts").UnknownAdmissionResponse | {
     readonly id?: string;
     readonly type: "response";
     readonly command: "attach_session";
@@ -430,6 +430,12 @@ export declare function runSetThinkingLevel(ctx: EffectCommandContext, command:
     type: "response";
     command: "set_auto_compaction";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_permission_preset";
+    success: true;
+    data: import("../../core/permission-mode.ts").PermissionModeReply;
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/host-bare-endpoint-registration.d.ts

@@ -0,0 +1,7 @@
+export interface BareEndpointRegistration {
+    readonly agentDir: string;
+    readonly socket: string;
+    readonly log: (message: string) => void;
+}
+export declare function bindRegisteredEndpoint<T>(registration: BareEndpointRegistration, bind: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=host-bare-endpoint-registration.d.ts.map

package/dist/modes/rpc/host-bare-endpoint-registration.js

@@ -0,0 +1,35 @@
+/**
+ * The registry record of a socket host that binds its own public socket (`--listen`, `--headless`). No
+ * `host ensure` runs for such a host, so nothing else writes its `endpoint.json`, and `host gc` removes the
+ * record with the rest of a dead endpoint's directory: after one outage the restarted host would serve
+ * while every registry reader (`host status --all`, a relay device service) finds nothing (senpi#6190).
+ *
+ * So the host writes the record itself before it serves, and binds inside the endpoint's ensure lock, the
+ * lock `host gc` judges and removes under: a gc that judged the socket dead has finished its removal
+ * before this write, and one that starts later finds the socket bound and keeps the endpoint. A supervised
+ * host never comes here - its ensure wrote the record and holds that lock while it starts the host.
+ */
+import { createDaemonDirectories, createHostDaemonPaths } from "./host-daemon-paths.js";
+import { acquireHostEnsureLock } from "./host-ensure-lock.js";
+/** Longer than a gc's hold of one endpoint (its 2 s lock wait, the evidence probes, the removal). */
+const REGISTRATION_LOCK_WAIT_MS = 10_000;
+export async function bindRegisteredEndpoint(registration, bind) {
+    // An abstract socket has no path, so it has no daemon directory either.
+    if (registration.socket.startsWith("\0"))
+        return bind();
+    const release = await acquireHostEnsureLock(registration.socket, REGISTRATION_LOCK_WAIT_MS).catch((cause) => {
+        registration.log(`endpoint ensure lock unavailable, registering without it: ${messageOf(cause)}`);
+        return undefined;
+    });
+    try {
+        await createDaemonDirectories(createHostDaemonPaths({ socket: registration.socket, agentDir: registration.agentDir })).catch((cause) => registration.log(`endpoint registry record not written: ${messageOf(cause)}`));
+        return await bind();
+    }
+    finally {
+        await release?.();
+    }
+}
+function messageOf(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+//# sourceMappingURL=host-bare-endpoint-registration.js.map

package/dist/modes/rpc/host-capabilities.d.ts

@@ -5,6 +5,8 @@ export declare const UNLOAD_SESSION_CAPABILITY = "unload_session";
 export declare const SUBSCRIPTION_LIMITS_CAPABILITY = "subscription_limits";
 /** `resolve_path`: which file a message's path means, the engine's one rule (senpi#3415). */
 export declare const RESOLVE_PATH_CAPABILITY = "resolve_path";
+/** `set_permission_preset`: a live session's approval mode can be set and is echoed back (classic and multi-session). */
+export declare const SET_PERMISSION_PRESET_CAPABILITY = "set_permission_preset_v1";
 /**
  * The capabilities a multi-session host advertises in `get_protocol_info`, in their wire order. `warm` is added only
  * when the runtime is in-process, `tool_runtime:<kind>` names where heavy tool work runs, and `negotiated` carries

package/dist/modes/rpc/host-capabilities.js

@@ -13,6 +13,8 @@ export const UNLOAD_SESSION_CAPABILITY = "unload_session";
 export const SUBSCRIPTION_LIMITS_CAPABILITY = "subscription_limits";
 /** `resolve_path`: which file a message's path means, the engine's one rule (senpi#3415). */
 export const RESOLVE_PATH_CAPABILITY = "resolve_path";
+/** `set_permission_preset`: a live session's approval mode can be set and is echoed back (classic and multi-session). */
+export const SET_PERMISSION_PRESET_CAPABILITY = "set_permission_preset_v1";
 /**
  * The capabilities a multi-session host advertises in `get_protocol_info`, in their wire order. `warm` is added only
  * when the runtime is in-process, `tool_runtime:<kind>` names where heavy tool work runs, and `negotiated` carries
@@ -56,6 +58,7 @@ export function multiSessionHostCapabilities(options) {
             // `get_state`/`get_entries` marked `observe` never attach, and history reads page backward too (senpi#4267).
             OBSERVE_READS_CAPABILITY,
             ENTRIES_TAIL_CAPABILITY,
+            SET_PERMISSION_PRESET_CAPABILITY,
             // Host capabilities, not client opt-ins: only a multi-session host owns the
             // attachment refcount `open_session.retain_on_disconnect` detaches from, the
             // per-session launch profile `context`/`auto_title` travel on, and the session

package/dist/modes/rpc/host-handover-parked.d.ts

@@ -4,6 +4,7 @@ import type { PromptSurface } from "../../core/dynamic-prompt/types.ts";
 import type { SessionContext, SessionKind } from "../../core/extensions/types.ts";
 import { type SessionEnv } from "./session-caller-env.ts";
 import { type SessionContextOverlay } from "./session-context-patch.ts";
+import { type ResidentWriter } from "./host-handover-resident-writer.ts";
 export interface HandoverParkedEntry {
     readonly sessionPath: string;
     readonly durableSessionId?: string;
@@ -41,9 +42,19 @@ export interface HandoverParkedEntry {
      * Absent on entries an older generation wrote, which every reader treats as a predecessor's park.
      */
     readonly parkedBy?: string;
+    /**
+     * Present while the session is open on its host (senpi#6190); a park drops it. A successor reopens a stamped
+     * entry only once that writer process is gone, so it never opens a session its live predecessor still holds.
+     */
+    readonly residentWriter?: ResidentWriter;
 }
 export declare function recordHandoverParkedSession(daemonDir: string, entry: HandoverParkedEntry): Promise<void>;
 export declare function readHandoverParkedSessions(daemonDir: string): Promise<readonly HandoverParkedEntry[]>;
 export declare function clearHandoverParkedSession(daemonDir: string, sessionPath: string): Promise<void>;
+/**
+ * Clears an inherited entry after its reopen, unless the reopen re-recorded it as resident on
+ * `holder` (a retained session is recorded by the host it is open on, so the next start reopens it).
+ */
+export declare function clearInheritedParkedSession(daemonDir: string, sessionPath: string, holder: string | undefined): Promise<void>;
 export declare function dropHandoverParkedSessionIfFileGone(daemonDir: string, sessionPath: string): Promise<void>;
 //# sourceMappingURL=host-handover-parked.d.ts.map

package/dist/modes/rpc/host-handover-parked.js

@@ -21,6 +21,7 @@ import { parsePermissionPresetName } from "../../core/extensions/builtin/permiss
 import { sessionAutoTitleError, sessionBrowserEngineError, sessionContextError, sessionKindError, sessionPromptSurfaceError, sessionRetryFallbackError, } from "./rpc-input-validation.js";
 import { sessionEnvShapeError } from "./session-caller-env.js";
 import { applyContextPatch } from "./session-context-patch.js";
+import { isResidentWriter } from "./host-handover-resident-writer.js";
 const recordDir = (daemonDir) => join(daemonDir, "handover-parked");
 const entryFile = (daemonDir, sessionPath) => join(recordDir(daemonDir), `${createHash("sha256").update(sessionPath, "utf8").digest("hex").slice(0, 16)}.json`);
 let mutationChain = Promise.resolve();
@@ -38,6 +39,7 @@ function isEntry(value) {
         (record.durableSessionId === undefined || typeof record.durableSessionId === "string") &&
         (record.cwd === undefined || typeof record.cwd === "string") &&
         (record.parkedBy === undefined || typeof record.parkedBy === "string") &&
+        (record.residentWriter === undefined || isResidentWriter(record.residentWriter)) &&
         (record.thinkingLevel === undefined || typeof record.thinkingLevel === "string") &&
         (record.permissionPreset === undefined ||
             (typeof record.permissionPreset === "string" &&
@@ -100,6 +102,21 @@ export async function readHandoverParkedSessions(daemonDir) {
 export function clearHandoverParkedSession(daemonDir, sessionPath) {
     return enqueueMutation(() => rm(entryFile(daemonDir, sessionPath), { force: true }));
 }
+/**
+ * Clears an inherited entry after its reopen, unless the reopen re-recorded it as resident on
+ * `holder` (a retained session is recorded by the host it is open on, so the next start reopens it).
+ */
+export function clearInheritedParkedSession(daemonDir, sessionPath, holder) {
+    return enqueueMutation(async () => {
+        const file = entryFile(daemonDir, sessionPath);
+        if (holder !== undefined) {
+            const recorded = await readFile(file, "utf8").then((text) => JSON.parse(text), () => undefined);
+            if (isEntry(recorded) && recorded.parkedBy === holder)
+                return;
+        }
+        await rm(file, { force: true });
+    });
+}
 export function dropHandoverParkedSessionIfFileGone(daemonDir, sessionPath) {
     if (existsSync(sessionPath))
         return Promise.resolve();

package/dist/modes/rpc/host-handover-reopen.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { createHostDaemonPaths } from "./host-daemon-paths.js";
-import { clearHandoverParkedSession, dropHandoverParkedSessionIfFileGone, readHandoverParkedSessions, } from "./host-handover-parked.js";
+import { clearHandoverParkedSession, clearInheritedParkedSession, dropHandoverParkedSessionIfFileGone, readHandoverParkedSessions, } from "./host-handover-parked.js";
+import { residentWriterProbe } from "./host-handover-resident-writer.js";
 import { RpcSessionRegistryError } from "./session-registry.js";
 // The watch budget must outlast a heavily loaded drain: a predecessor whose event loop is blocked
 // (parallel hosts, a busy turn settling) can take tens of seconds to write its park after this
@@ -37,6 +38,7 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
     const deadline = Date.now() + HANDOVER_PARKED_REOPEN_BUDGET_MS;
     const reopenAttempts = new Map();
     const heldPolls = new Map();
+    const writerAlive = residentWriterProbe();
     let emptyStreak = 0;
     let sawAnyPark = false;
     for (;;) {
@@ -46,12 +48,12 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
         // it by path with the same durable id.
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
-        const parked = await inheritedParks(daemonDir, holder);
+        const parked = await inheritedParks(daemonDir, holder, writerAlive);
         for (const entry of parked) {
             sawAnyPark = true;
             await reopenOne(daemonDir, open, entry, reopenAttempts, heldPolls, holder);
         }
-        const remaining = (await inheritedParks(daemonDir, holder)).length;
+        const remaining = (await inheritedParks(daemonDir, holder, writerAlive)).length;
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
         emptyStreak = remaining === 0 ? emptyStreak + 1 : 0;
@@ -67,9 +69,19 @@ export async function reopenHandoverParkedSessions(open, agentDir, socket, holde
  * parks retained sessions into the same record) is for its successor: reopening it here would put a
  * second open of the path in flight against the client reopening it (senpi#3485).
  */
-async function inheritedParks(daemonDir, holder) {
+async function inheritedParks(daemonDir, holder, writerAlive) {
     const parked = await readHandoverParkedSessions(daemonDir);
-    return parked.filter((entry) => entry.parkedBy === undefined || entry.parkedBy !== holder?.hostInstance);
+    const inherited = [];
+    for (const entry of parked) {
+        if (entry.parkedBy !== undefined && entry.parkedBy === holder?.hostInstance)
+            continue;
+        // A session still resident in its live writer (a handoff's draining predecessor) is that process's to park,
+        // and its unstamped park is what this host reopens; only a writer that is gone leaves it here to restore.
+        if (entry.residentWriter !== undefined && (await writerAlive(entry.residentWriter)))
+            continue;
+        inherited.push(entry);
+    }
+    return inherited;
 }
 async function reopenOne(daemonDir, open, entry, attempts, heldPolls, holder) {
     const taskStatus = entry.contextOverlay && Object.hasOwn(entry.contextOverlay, "task_status")
@@ -93,7 +105,7 @@ async function reopenOne(daemonDir, open, entry, attempts, heldPolls, holder) {
         // reopens it; clearing it here would lose the session when the drain closes it (senpi#3282).
         if (holder?.shouldReopen !== undefined && !holder.shouldReopen())
             return;
-        await clearHandoverParkedSession(daemonDir, entry.sessionPath);
+        await clearInheritedParkedSession(daemonDir, entry.sessionPath, holder?.hostInstance);
     }
     catch (cause) {
         // A `session_path_in_use` refusal means the predecessor still holds the path's cross-generation

package/dist/modes/rpc/host-handover-resident-writer.d.ts

@@ -0,0 +1,16 @@
+import { type WriterProbes } from "../../core/session-writer-claims.ts";
+export interface ResidentWriter {
+    readonly host: string;
+    readonly pid: number;
+    readonly bootAtMs: number;
+    readonly processStartedAtMs: number;
+}
+export declare function currentResidentWriter(probes?: WriterProbes): ResidentWriter;
+export declare function isResidentWriter(value: unknown): value is ResidentWriter;
+/**
+ * A liveness probe for one reopen watch, which polls: a writer found gone stays gone, and a live pid's start time
+ * (a process spawn on some platforms) is read once. A writer on another host cannot be probed from here, so it is
+ * never displaced.
+ */
+export declare function residentWriterProbe(probes?: WriterProbes): (writer: ResidentWriter) => Promise<boolean>;
+//# sourceMappingURL=host-handover-resident-writer.d.ts.map

package/dist/modes/rpc/host-handover-resident-writer.js

@@ -0,0 +1,57 @@
+/**
+ * The process that holds a retained session resident (senpi#6190). A host records each retained session it has
+ * open, stamped with this writer, so the next host on the endpoint can restore it after a crash; while that
+ * writer is still alive (a generation handoff's draining predecessor) the session is not its successor's to
+ * reopen - the predecessor parks it, and the unstamped park is what the successor consumes. Liveness follows the
+ * session writer claims: same host, same boot, live pid whose start time matches.
+ */
+import { BOOT_INSTANT_TOLERANCE_MS, sameBoot } from "../../core/extensions/builtin/terminal/process-identity.js";
+import { realWriterProbes } from "../../core/session-writer-claims.js";
+export function currentResidentWriter(probes = realWriterProbes) {
+    const self = probes.self();
+    return {
+        host: probes.host(),
+        pid: self.pid,
+        bootAtMs: probes.bootAtMs(),
+        processStartedAtMs: self.processStartedAtMs,
+    };
+}
+export function isResidentWriter(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    return (typeof record.host === "string" &&
+        Number.isInteger(record.pid) &&
+        typeof record.bootAtMs === "number" &&
+        typeof record.processStartedAtMs === "number");
+}
+/**
+ * A liveness probe for one reopen watch, which polls: a writer found gone stays gone, and a live pid's start time
+ * (a process spawn on some platforms) is read once. A writer on another host cannot be probed from here, so it is
+ * never displaced.
+ */
+export function residentWriterProbe(probes = realWriterProbes) {
+    const gone = new Set();
+    const verified = new Set();
+    return async (writer) => {
+        const key = `${writer.host}:${writer.pid}:${writer.processStartedAtMs}`;
+        if (gone.has(key))
+            return false;
+        if (writer.host !== probes.host())
+            return true;
+        if (!sameBoot(probes.bootAtMs(), writer.bootAtMs) || !probes.pidAlive(writer.pid)) {
+            gone.add(key);
+            return false;
+        }
+        if (verified.has(key))
+            return true;
+        const startedAtMs = await probes.readProcessStartMs(writer.pid);
+        if (startedAtMs !== undefined && Math.abs(startedAtMs - writer.processStartedAtMs) > BOOT_INSTANT_TOLERANCE_MS) {
+            gone.add(key);
+            return false;
+        }
+        verified.add(key);
+        return true;
+    };
+}
+//# sourceMappingURL=host-handover-resident-writer.js.map

package/dist/modes/rpc/host-idle-handover.js

@@ -15,6 +15,7 @@ const NEW_WORK_COMMANDS = new Set([
     "bash",
     "compact",
     "wake",
+    "admit_external_message",
     "edit_assistant_message",
     "edit_user_message",
 ]);

package/dist/modes/rpc/host-warm.d.ts

@@ -30,6 +30,11 @@ export declare class HostWarmer {
     private readonly load;
     constructor(load: (profile: HostWarmProfile) => Promise<void>);
     run(profile: HostWarmProfile): Promise<HostWarmState>;
+    /**
+     * Settles once every load of `cwd` in flight NOW has settled; `undefined` when none is. A snapshot: a warm
+     * that starts later, or one of another cwd, is not part of it.
+     */
+    inFlight(cwd: string): Promise<void> | undefined;
     private loadOnce;
 }
 /**
@@ -40,7 +45,17 @@ export declare class HostWarmer {
 export declare function createRegistryWarm(prepare: NonNullable<PreparableRuntimeFactory["prepare"]>, host: {
     agentDir: string;
     mcpRegistry?: HostMcpRegistry;
-}): HostWarm;
+}): {
+    readonly warm: HostWarm;
+    readonly inFlight: (cwd: string) => Promise<void> | undefined;
+};
+/** How an open's wait for the warms of its cwd ended. */
+export type WarmWaitOutcome = "settled" | "warm_wait_deadline";
+/**
+ * Waits for `warming` at most `boundMs`. A warm whose extension factory never settles (there is no factory
+ * timeout) must not stall an open, so past the bound the open proceeds and the reason is reported.
+ */
+export declare function waitForWarms(warming: Promise<void>, boundMs: number, cwd: string): Promise<WarmWaitOutcome>;
 type WarmCommand = Extract<RpcCommand, {
     type: "warm";
 }>;

package/dist/modes/rpc/host-warm.js

@@ -34,14 +34,24 @@ export class HostWarmer {
         const key = profileKey(profile);
         if (this.warm.has(key))
             return "already_warm";
-        let pending = this.loading.get(key);
-        if (pending === undefined) {
-            pending = this.loadOnce(key, profile);
-            this.loading.set(key, pending);
+        let load = this.loading.get(key);
+        if (load === undefined) {
+            load = { cwd: profile.cwd, pending: this.loadOnce(key, profile) };
+            this.loading.set(key, load);
         }
-        await pending;
+        await load.pending;
         return "warmed";
     }
+    /**
+     * Settles once every load of `cwd` in flight NOW has settled; `undefined` when none is. A snapshot: a warm
+     * that starts later, or one of another cwd, is not part of it.
+     */
+    inFlight(cwd) {
+        const pending = [...this.loading.values()].filter((load) => load.cwd === cwd).map((load) => load.pending);
+        if (pending.length === 0)
+            return undefined;
+        return Promise.allSettled(pending).then(() => undefined);
+    }
     async loadOnce(key, profile) {
         try {
             await this.load(profile);
@@ -85,7 +95,24 @@ export function createRegistryWarm(prepare, host) {
             scope.close();
         }
     });
-    return (profile) => warmer.run(profile);
+    return { warm: (profile) => warmer.run(profile), inFlight: (cwd) => warmer.inFlight(cwd) };
+}
+/**
+ * Waits for `warming` at most `boundMs`. A warm whose extension factory never settles (there is no factory
+ * timeout) must not stall an open, so past the bound the open proceeds and the reason is reported.
+ */
+export async function waitForWarms(warming, boundMs, cwd) {
+    let deadline;
+    const outcome = await Promise.race([
+        warming.then(() => "settled"),
+        new Promise((resolve) => {
+            deadline = setTimeout(() => resolve("warm_wait_deadline"), boundMs);
+        }),
+    ]);
+    clearTimeout(deadline);
+    if (outcome === "warm_wait_deadline")
+        process.stderr.write(`senpi rpc open: warm_wait_deadline: a warm of ${cwd} still loading after ${boundMs} ms; opening anyway\n`);
+    return outcome;
 }
 function refusal(command, code) {
     return { id: command.id, type: "response", command: "warm", success: false, error: code };