@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/modes/rpc/method-classes-schema-delivery.d.ts

@@ -0,0 +1,32 @@
+/** The schema of `admit_external_message`, a relayed peer-agent message admitted as a delivery (senpi#6233). */
+import Type from "typebox";
+export declare const DELIVERY_RECORD_SCHEMAS: {
+    admit_external_message: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"admit_external_message">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly deliveryId: Type.TString;
+        readonly text: Type.TString;
+        readonly sender: Type.TOptional<Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"agent">;
+            session_id: Type.TString;
+            name: Type.TOptional<Type.TString>;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"command_line">;
+            user: Type.TOptional<Type.TString>;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"external">;
+            platform: Type.TString;
+            author: Type.TOptional<Type.TString>;
+        }>]>>;
+        readonly displayText: Type.TOptional<Type.TString>;
+        readonly deliverAs: Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>;
+        readonly expectedTurnId: Type.TOptional<Type.TString>;
+        readonly whenIdle: Type.TOptional<Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>>;
+        readonly chainCount: Type.TOptional<Type.TInteger>;
+    }>;
+};
+//# sourceMappingURL=method-classes-schema-delivery.d.ts.map

package/dist/modes/rpc/method-classes-schema-delivery.js

@@ -0,0 +1,22 @@
+/** The schema of `admit_external_message`, a relayed peer-agent message admitted as a delivery (senpi#6233). */
+import Type from "typebox";
+import { Id, literals, Opt, OptId, OptStr, Str, session } from "./method-classes-schema-fields.js";
+/** `SessionControlSender`: each kind's fields and no other, so nothing beyond the label rides along. */
+const DeliverySender = Type.Union([
+    Type.Object({ kind: Type.Literal("agent"), session_id: Id, name: OptId }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("command_line"), user: OptId }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("external"), platform: Id, author: OptId }, { additionalProperties: false }),
+]);
+export const DELIVERY_RECORD_SCHEMAS = {
+    admit_external_message: session("admit_external_message", {
+        deliveryId: Id,
+        text: Str,
+        sender: Opt(DeliverySender),
+        displayText: OptStr,
+        deliverAs: literals("steer", "followUp"),
+        expectedTurnId: OptId,
+        whenIdle: Opt(literals("start", "queue")),
+        chainCount: Opt(Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),
+    }),
+};
+//# sourceMappingURL=method-classes-schema-delivery.js.map

package/dist/modes/rpc/method-classes-schema-session.d.ts

@@ -1,6 +1,33 @@
 /** The schemas of the session-routed inbound records (senpi#4324). */
 import Type from "typebox";
 export declare const SESSION_RECORD_SCHEMAS: {
+    admit_external_message: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"admit_external_message">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly deliveryId: Type.TString;
+        readonly text: Type.TString;
+        readonly sender: Type.TOptional<Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"agent">;
+            session_id: Type.TString;
+            name: Type.TOptional<Type.TString>;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"command_line">;
+            user: Type.TOptional<Type.TString>;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"external">;
+            platform: Type.TString;
+            author: Type.TOptional<Type.TString>;
+        }>]>>;
+        readonly displayText: Type.TOptional<Type.TString>;
+        readonly deliverAs: Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>;
+        readonly expectedTurnId: Type.TOptional<Type.TString>;
+        readonly whenIdle: Type.TOptional<Type.TUnion<[Type.TLiteral<string>, ...Type.TLiteral<string>[]]>>;
+        readonly chainCount: Type.TOptional<Type.TInteger>;
+    }>;
     prompt: Type.TObject<{
         id: Type.TOptional<Type.TString>;
         admissionId: Type.TOptional<Type.TString>;
@@ -478,6 +505,15 @@ export declare const SESSION_RECORD_SCHEMAS: {
     } & {
         readonly enabled: Type.TBoolean;
     }>;
+    set_permission_preset: Type.TObject<{
+        id: Type.TOptional<Type.TString>;
+        admissionId: Type.TOptional<Type.TString>;
+        type: Type.TLiteral<"set_permission_preset">;
+    } & {
+        readonly sessionId: Type.TOptional<Type.TString>;
+    } & {
+        readonly permissionPreset: Type.TString;
+    }>;
     set_auto_retry: Type.TObject<{
         id: Type.TOptional<Type.TString>;
         admissionId: Type.TOptional<Type.TString>;

package/dist/modes/rpc/method-classes-schema-session.js

@@ -1,6 +1,7 @@
 /** The schemas of the session-routed inbound records (senpi#4324). */
 import Type from "typebox";
 import { Bool, Id, Images, literals, ModelEntries, Num, Opt, OptBool, OptId, OptNum, OptPath, OptStr, PathStr, RetryFallback, RPC_INBOUND_LIMITS, Secret, Str, Strings, session, ThinkingLevel, } from "./method-classes-schema-fields.js";
+import { DELIVERY_RECORD_SCHEMAS } from "./method-classes-schema-delivery.js";
 /** A thread call's hop count: 1 for the first call of a chain, one more per hop. */
 const ChainCount = Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER });
 const steerOrFollowUp = (type) => session(type, {
@@ -131,6 +132,7 @@ const STATE_AND_MODEL_SCHEMAS = {
     set_follow_up_mode: session("set_follow_up_mode", { mode: literals("all", "one-at-a-time") }),
     compact: session("compact", { customInstructions: OptStr }),
     set_auto_compaction: session("set_auto_compaction", { enabled: Bool }),
+    set_permission_preset: session("set_permission_preset", { permissionPreset: Id }),
     set_auto_retry: session("set_auto_retry", { enabled: Bool }),
     abort_retry: session("abort_retry", {}),
     set_retry_fallback: session("set_retry_fallback", { retryFallback: RetryFallback }),
@@ -219,6 +221,7 @@ const SURFACE_AND_ACCOUNT_SCHEMAS = {
 };
 export const SESSION_RECORD_SCHEMAS = {
     ...PROMPTING_SCHEMAS,
+    ...DELIVERY_RECORD_SCHEMAS,
     ...STATE_AND_MODEL_SCHEMAS,
     ...BASH_AND_TREE_SCHEMAS,
     ...SURFACE_AND_ACCOUNT_SCHEMAS,

package/dist/modes/rpc/method-classes-schema.d.ts

@@ -29,6 +29,33 @@ export type RpcInboundSchemaDisagreements<Schemas extends RpcInboundSchemaTable>
     [K in RpcMethodType]: Agrees<RpcInboundRecordOf<K>, Static<Schemas[K]>> extends true ? never : K;
 }[RpcMethodType];
 export declare const RPC_INBOUND_SCHEMAS: {
+    readonly admit_external_message: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"admit_external_message">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    } & {
+        readonly deliveryId: import("typebox").TString;
+        readonly text: import("typebox").TString;
+        readonly sender: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TObject<{
+            kind: import("typebox").TLiteral<"agent">;
+            session_id: import("typebox").TString;
+            name: import("typebox").TOptional<import("typebox").TString>;
+        }>, import("typebox").TObject<{
+            kind: import("typebox").TLiteral<"command_line">;
+            user: import("typebox").TOptional<import("typebox").TString>;
+        }>, import("typebox").TObject<{
+            kind: import("typebox").TLiteral<"external">;
+            platform: import("typebox").TString;
+            author: import("typebox").TOptional<import("typebox").TString>;
+        }>]>>;
+        readonly displayText: import("typebox").TOptional<import("typebox").TString>;
+        readonly deliverAs: import("typebox").TUnion<[import("typebox").TLiteral<string>, ...import("typebox").TLiteral<string>[]]>;
+        readonly expectedTurnId: import("typebox").TOptional<import("typebox").TString>;
+        readonly whenIdle: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TLiteral<string>, ...import("typebox").TLiteral<string>[]]>>;
+        readonly chainCount: import("typebox").TOptional<import("typebox").TInteger>;
+    }>;
     readonly get_protocol_info: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
         admissionId: import("typebox").TOptional<import("typebox").TString>;
@@ -852,6 +879,15 @@ export declare const RPC_INBOUND_SCHEMAS: {
     } & {
         readonly enabled: import("typebox").TBoolean;
     }>;
+    readonly set_permission_preset: import("typebox").TObject<{
+        id: import("typebox").TOptional<import("typebox").TString>;
+        admissionId: import("typebox").TOptional<import("typebox").TString>;
+        type: import("typebox").TLiteral<"set_permission_preset">;
+    } & {
+        readonly sessionId: import("typebox").TOptional<import("typebox").TString>;
+    } & {
+        readonly permissionPreset: import("typebox").TString;
+    }>;
     readonly set_auto_retry: import("typebox").TObject<{
         id: import("typebox").TOptional<import("typebox").TString>;
         admissionId: import("typebox").TOptional<import("typebox").TString>;

package/dist/modes/rpc/method-classes.d.ts

@@ -140,10 +140,12 @@ export declare const RPC_METHOD_CLASS: {
         readonly version: 1;
     };
     readonly set_auto_compaction: "drive";
+    readonly set_permission_preset: "device_admin";
     readonly set_retry_fallback: "drive";
     readonly pause_for_run: "drive";
     readonly resume_for_run: "drive";
     readonly wake: "drive";
+    readonly admit_external_message: "drive";
     readonly release_tool_barrier: "drive";
     readonly request_self_settle: "drive";
     readonly "eval_cells.stop": "drive";

package/dist/modes/rpc/method-classes.js

@@ -187,10 +187,14 @@ export const RPC_METHOD_CLASS = {
     set_model: { classify: setModelClass, version: 1 },
     // a session override; set_steering_mode, set_follow_up_mode and set_auto_retry write global settings (device_admin)
     set_auto_compaction: "drive",
+    // like a preset-naming open_session: it changes what the agent may do without asking
+    set_permission_preset: "device_admin",
     set_retry_fallback: "drive",
     pause_for_run: "drive",
     resume_for_run: "drive",
     wake: "drive",
+    // the engine writes its own fixed delivery entry: no role=user, input event, command or template expansion (senpi#6233)
+    admit_external_message: "drive",
     release_tool_barrier: "drive",
     request_self_settle: "drive",
     "eval_cells.stop": "drive",

package/dist/modes/rpc/multi-session-host.js

@@ -13,6 +13,7 @@ import { answerDelegation, relayExecRefusal } from "./delegated-answer.js";
 import { parseClientCapabilities } from "./custom-capability.js";
 import { ClientOccupancy } from "./host-client-occupancy.js";
 import { HostCoreGate } from "./host-core-gate.js";
+import { bindRegisteredEndpoint } from "./host-bare-endpoint-registration.js";
 import { createHostDaemonPaths } from "./host-daemon-paths.js";
 import { ENDPOINT_OWNER_FENCE_CAPABILITY, GENERATION_HANDOFF_CAPABILITY } from "./host-decision.js";
 import { HandoffAnnouncement } from "./host-handoff-announcement.js";
@@ -549,7 +550,11 @@ async function runSocketHost(options, socketPath) {
     });
     // Everything the internal listener needs is initialized: the runtime milestone of a coordinated start (senpi#4602).
     reportStartupMilestone("host_runtime");
-    boundIdentity = await listen(server, socketPath, secret);
+    const bind = () => listen(server, socketPath, secret);
+    // A host binding its own public socket keeps its registry record; a supervised one's ensure keeps it.
+    boundIdentity = await (hostWatchdogBinding() === undefined
+        ? bindRegisteredEndpoint({ agentDir: options.agentDir, socket: socketPath, log: hostLog }, bind)
+        : bind());
     // A key record that cannot be published safely ends this host: held connections are refused, never served keyless.
     await transport.publish(() => shutdown(1));
     if (supervisorPublicOwnerFile) {

package/dist/modes/rpc/permission-preset-command.d.ts

@@ -0,0 +1,6 @@
+import type { AgentSessionRuntime } from "../../core/agent-session-runtime.ts";
+import { type RpcCommand, type RpcResponse } from "./rpc-types.ts";
+export declare function runSetPermissionPreset(runtime: Pick<AgentSessionRuntime, "session" | "setPermissionPreset">, command: Extract<RpcCommand, {
+    type: "set_permission_preset";
+}>): RpcResponse;
+//# sourceMappingURL=permission-preset-command.d.ts.map

package/dist/modes/rpc/permission-preset-command.js

@@ -0,0 +1,27 @@
+import { parsePermissionPresetName } from "../../core/extensions/builtin/permission-system/cli.js";
+import { permissionModeOf, permissionModeReply } from "../../core/permission-mode.js";
+import { RPC_ERROR_INVALID_LAUNCH_PROFILE } from "./rpc-types.js";
+// The live setter a classic `--mode rpc` session has no other way to receive (it refuses `open_session`), and the
+// path-free one for a session on another device. An unknown preset is refused before anything changes, so the
+// session keeps the mode it had; a valid one is applied through the runtime the way an attach naming it applies it.
+export function runSetPermissionPreset(runtime, command) {
+    if (parsePermissionPresetName(command.permissionPreset) === undefined) {
+        return {
+            id: command.id,
+            type: "response",
+            command: "set_permission_preset",
+            success: false,
+            error: `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: unknown permissionPreset "${command.permissionPreset}"`,
+            errorCode: RPC_ERROR_INVALID_LAUNCH_PROFILE,
+        };
+    }
+    runtime.setPermissionPreset(command.permissionPreset);
+    return {
+        id: command.id,
+        type: "response",
+        command: "set_permission_preset",
+        success: true,
+        data: permissionModeReply(permissionModeOf(runtime.session)),
+    };
+}
+//# sourceMappingURL=permission-preset-command.js.map

package/dist/modes/rpc/rpc-input-validation.js

@@ -1,6 +1,7 @@
 import { isBrowserEngine } from "../../core/browser-engine.js";
 import { clientMessageIdentitySchema } from "../../core/client-message-identity.js";
 import { MAX_TOOL_BARRIER_ID_LENGTH, toolBarrierSpecError } from "../../core/tool-barrier.js";
+import { admitExternalMessageFieldError } from "./admit-external-message-wire.js";
 import { validatePauseCommand } from "./pause-command-validation.js";
 export const MAX_RPC_MESSAGE_CHARACTERS = 1_000_000;
 /**
@@ -141,9 +142,9 @@ export function rpcCommandPayloadError(command) {
         !(typeof value.effectId === "string" && value.effectId.length > 0 && value.effectId.length <= 256)) {
         return "effectId must be a non-empty string of at most 256 characters.";
     }
-    const pauseFieldError = validatePauseCommand(value);
-    if (pauseFieldError !== undefined)
-        return pauseFieldError;
+    const fieldError = validatePauseCommand(value) ?? admitExternalMessageFieldError(value, MAX_RPC_MESSAGE_CHARACTERS);
+    if (fieldError !== undefined)
+        return fieldError;
     if (value.type === "get_pending_inputs" && value.knownClientMessageIds !== undefined) {
         const ids = value.knownClientMessageIds;
         if (!Array.isArray(ids) ||

package/dist/modes/rpc/rpc-mutation-response-types.d.ts

@@ -6,6 +6,7 @@ import type { ClientMessageIdentity } from "../../core/client-message-identity.t
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { ServiceTier } from "../../core/extensions/builtin/service-tier.ts";
 import type { SessionControlAdmission } from "../../core/extensions/types.ts";
+import type { PermissionModeReply } from "../../core/permission-mode.ts";
 import type { ApiKeyVerification } from "../../core/verify-api-key.ts";
 import type { ClientMessageAdmission } from "./client-admission-record.ts";
 import type { RpcProjectSettings, RpcProjectTrust } from "./project-workspace-commands.ts";
@@ -234,6 +235,12 @@ export type RpcMutationResponse = {
     type: "response";
     command: "set_auto_compaction";
     success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_permission_preset";
+    success: true;
+    data: PermissionModeReply;
 } | {
     id?: string;
     type: "response";

package/dist/modes/rpc/rpc-response-types.d.ts

@@ -1,3 +1,4 @@
+import type { RpcAdmitExternalMessageResponse } from "./admit-external-message-wire.ts";
 import type { RpcAttachmentResponse } from "./attachment-types.ts";
 import type { UnknownAdmissionResponse } from "./compact-admission-error.ts";
 import type { RpcHostCommandResponse } from "./rpc-host-response-types.ts";
@@ -12,5 +13,5 @@ export type RpcResponse = {
     data?: {
         capabilities: readonly string[];
     };
-} | UnknownAdmissionResponse | RpcAttachmentResponse | RpcHostCommandResponse | RpcReadResponse | RpcMutationResponse | RpcPauseResponse;
+} | UnknownAdmissionResponse | RpcAttachmentResponse | RpcHostCommandResponse | RpcReadResponse | RpcMutationResponse | RpcAdmitExternalMessageResponse | RpcPauseResponse;
 //# sourceMappingURL=rpc-response-types.d.ts.map

package/dist/modes/rpc/rpc-session-command-types.d.ts

@@ -5,6 +5,7 @@ import type { BashResult } from "../../core/bash-executor.ts";
 import type { ClientMessageIdentity } from "../../core/client-message-identity.ts";
 import type { SessionEntry } from "../../core/session-manager.ts";
 import type { ToolBarrierSpec } from "../../core/tool-barrier.ts";
+import type { RpcAdmitExternalMessageCommand } from "./admit-external-message-wire.ts";
 import type { RpcRecoveryCommand } from "./rpc-recovery-command-types.ts";
 import type { RpcRemoteOrigin } from "./remote-origin.ts";
 import type { RpcSessionModelEntry } from "./rpc-session-state-types.ts";
@@ -196,7 +197,7 @@ export type RpcSessionCommand = {
     id?: string;
     type: "wake";
     delivery_ids?: string[];
-} | {
+} | RpcAdmitExternalMessageCommand | {
     id?: string;
     type: "get_state";
 } | {
@@ -293,6 +294,10 @@ export type RpcSessionCommand = {
     id?: string;
     type: "set_auto_compaction";
     enabled: boolean;
+} | {
+    id?: string;
+    type: "set_permission_preset";
+    permissionPreset: string;
 } | {
     id?: string;
     type: "set_auto_retry";

package/dist/modes/rpc/rpc-session-event-types.d.ts

@@ -109,8 +109,11 @@ export type RpcSessionParkedEvent = {
     sessionId: string;
     /** Session file to reopen this session by. */
     sessionPath: string;
-    /** `idle`: the idle sweep parked it; `unloaded`: `unload_session` did. Absent from older hosts. */
-    reason?: "idle" | "unloaded";
+    /**
+     * `idle`: the idle sweep parked it; `unloaded`: `unload_session` did; `host_shutdown`: the host stopped with the session
+     * retained, and the next host on the endpoint reopens it. Absent from older hosts.
+     */
+    reason?: "idle" | "unloaded" | "host_shutdown";
 };
 /**
  * Sent only to the connections a headless engine's quiet takeover let go (senpi#5732): this connection no longer holds

package/dist/modes/rpc/rpc-session-state-types.d.ts

@@ -3,6 +3,7 @@ import type { Model, ProviderDiagnostic, ThinkingSelection } from "@earendil-wor
 import type { AgentAbortSource } from "../../core/agent-abort-provenance.ts";
 import type { QueuedInput } from "../../core/agent-session.ts";
 import type { HoldKind } from "../../core/engine-turn-hold.ts";
+import type { PermissionMode } from "../../core/permission-mode.ts";
 import type { ProviderOrigin } from "../../core/provider-origin.ts";
 import type { ServiceTier } from "../../core/extensions/builtin/service-tier.ts";
 import type { ContextUsage } from "../../core/extensions/types.ts";
@@ -105,7 +106,7 @@ export interface RpcSessionModelEntry {
     thinkingSelection?: ThinkingSelection;
     serviceTier?: ServiceTier;
 }
-export interface RpcSessionState {
+export interface RpcSessionState extends Partial<PermissionMode> {
     /** The running turn's id; absent when no turn is running. A steer or follow-up names it as `expectedTurnId` (senpi#5776). */
     currentTurnId?: string;
     /** Latest 64 UI-answer receipts in this session generation, oldest first. */

package/dist/modes/rpc/rpc-session-state.js

@@ -4,6 +4,7 @@
  */
 import { existsSync } from "node:fs";
 import { sanitizeProviderDiagnostic } from "@earendil-works/pi-ai";
+import { permissionModeOf } from "../../core/permission-mode.js";
 import { ProjectTrustStore } from "../../core/trust-manager.js";
 import { clientFacingIdentity } from "./client-admission-record.js";
 import { sessionQuestionBridges } from "./connection-question-bridge.js";
@@ -38,6 +39,7 @@ export function buildRpcSessionState(session, lastAbortSource) {
         lifecycle: observeLifecycle(session.lifecycle),
         pendingQuestions: sessionQuestionBridges.get(session)?.pendingQuestions(),
         pendingDialogs: sessionDialogRequests.get(session)?.snapshot() ?? [],
+        ...permissionModeOf(session),
         model: session.model,
         pendingModelSwitch: session.pendingModelSwitch
             ? {

package/dist/modes/rpc/session-attachment-commands.js

@@ -1,6 +1,6 @@
 import { takeOver } from "./attach-takeover.js";
 import { compactOpen } from "./compact-open-admission.js";
-import { clearHandoverParkedSession } from "./host-handover-parked.js";
+import { clearRetainedRecord } from "./session-router-residency.js";
 import { hostInstanceId } from "./protocol-identity.js";
 import { canonicalSessionPath } from "./session-path-key.js";
 import { recordAttachment, releaseDisconnectAttachment, releaseOwnerAttachment } from "./session-router-attachments.js";
@@ -116,8 +116,8 @@ export async function reclaimSession(host, command) {
     if (host.sessionsByConnection.get(owner)?.size === 0)
         host.sessionsByConnection.delete(owner);
     connectionLeft(host, row.sessionId, owner);
-    if (host.handoverParkedDir !== undefined && entry.sessionPath !== undefined)
-        await clearHandoverParkedSession(host.handoverParkedDir, entry.sessionPath).catch(() => { });
+    if (host.handoverParkedDir !== undefined)
+        await clearRetainedRecord(host, entry);
     if (claim.finalizer) {
         const binding = host.bindings.get(row.sessionId);
         binding?.cancelPendingExtensionUiRequests?.();

package/dist/modes/rpc/session-event-writer-connections.js

@@ -23,6 +23,7 @@ export class SessionEventWriterConnections extends SessionEventWriterLanes {
             record.type === "host_request" ||
             record.type === "relocation_due" ||
             (record.type === "extension_ui_request" &&
+                record.audience !== "session" &&
                 ["select", "confirm", "input", "editor"].includes(String(record.method))));
     }
     isSessionSealed(sessionId) {

package/dist/modes/rpc/session-event-writer.d.ts

@@ -51,7 +51,7 @@ export declare class SessionEventWriter extends SessionEventWriterDestinations {
      * session's reaches every connection. No client asked for this teardown, so there is
      * no close response to answer.
      */
-    parkSession(sessionId: string, sessionPath: string, reason: "idle" | "unloaded"): void;
+    parkSession(sessionId: string, sessionPath: string, reason: "idle" | "unloaded" | "host_shutdown"): void;
     /**
      * Seal a session `release_session` handed to a runtime outside this host and publish
      * `session_closed { reason: "released", sessionPath }`. Unlike a park the file must NOT be reopened

package/dist/modes/rpc/session-registry-attach.d.ts

@@ -1,12 +1,3 @@
-/**
- * Attach-on-open: a live session outlives individual client attachments, so a resume (or a second
- * surface) for an already-hosted path joins the existing runtime instead of failing. An entry
- * still opening holds the reservation, and an explicit open for that path waits on the entry's
- * openCompletion (bounded on the waiter only, default 45s) and attaches once it opens; on that
- * wait expiring, only the one waiting reopen fails with a retryable session_path_in_use
- * {reason: "open_in_progress", retry_after_ms} naming an attached current owner, and the in-flight
- * open keeps running untouched.
- */
 import type { SessionPathReservations } from "./host-reservations.ts";
 import { type OpenRpcSession, type RpcSessionEntry, type RpcSessionLaunchProfile, type RpcSessionOpenOptions } from "./session-registry-types.ts";
 export declare function attachToOpenSession(entries: ReadonlyMap<string, RpcSessionEntry>, sessionPath: string, profile: RpcSessionLaunchProfile, options: RpcSessionOpenOptions | undefined, pathReservations: SessionPathReservations | undefined, now: number): Promise<OpenRpcSession>;

package/dist/modes/rpc/session-registry-attach.js

@@ -1,3 +1,13 @@
+/**
+ * Attach-on-open: a live session outlives individual client attachments, so a resume (or a second
+ * surface) for an already-hosted path joins the existing runtime instead of failing. An entry
+ * still opening holds the reservation, and an explicit open for that path waits on the entry's
+ * openCompletion (bounded on the waiter only, default 45s) and attaches once it opens; on that
+ * wait expiring, only the one waiting reopen fails with a retryable session_path_in_use
+ * {reason: "open_in_progress", retry_after_ms} naming an attached current owner, and the in-flight
+ * open keeps running untouched.
+ */
+import { clientNamedPreset, withClientPreset } from "../../core/permission-mode.js";
 import { hostInstanceId } from "./protocol-identity.js";
 import { frozenProfile, RpcSessionRegistryError, } from "./session-registry-types.js";
 /** How long ONE explicit reopen waits on an in-flight open before giving up (the open keeps going). */
@@ -104,9 +114,12 @@ export async function attachToOpenSession(entries, sessionPath, profile, options
     }
     // The preset is applied even when the record already names it: the record is not the live session,
     // so a resent attach also repairs a session that drifted from it (senpi#2842).
-    if (profile.permissionPreset !== undefined) {
-        entry.profile = frozenProfile({ ...entry.profile, permissionPreset: profile.permissionPreset });
-        entry.runtime?.setPermissionPreset(profile.permissionPreset);
+    // Only a preset the client named moves the session: an embedder's host default folded into a preset-less attach is
+    // not a choice, and applying it would turn the host default into a client-named mode (remote approval-mode rule).
+    const namedPreset = clientNamedPreset(profile);
+    if (namedPreset !== undefined) {
+        entry.profile = frozenProfile(withClientPreset(entry.profile, namedPreset));
+        entry.runtime?.setPermissionPreset(namedPreset);
     }
     entry.lastCommandAt = now;
     if (wasParked) {

package/dist/modes/rpc/session-registry-types.d.ts

@@ -57,6 +57,8 @@ export interface RpcSessionEntry {
      * Requested per `open_session`; an attach may turn it on, never off.
      */
     retainOnDisconnect?: boolean;
+    /** The session path this host's handover-parked record entry is keyed by; it follows a transcript switch. */
+    recordedPath?: string;
     /** Timestamp of the last routed command / observed activity; drives idle eviction. */
     lastCommandAt: number;
     /**

package/dist/modes/rpc/session-registry.d.ts

@@ -14,6 +14,7 @@ export declare class RpcSessionRegistry {
     readonly closeGraceMs: number;
     /** Present only when the runtime factory can build a session's services alone (`host-warm.ts`). */
     readonly warm?: HostWarm;
+    private readonly warmsInFlight?;
     /** The agent directory this host keeps its sessions (and session-move folders) under. */
     get agentDir(): string;
     constructor(options: RpcSessionRegistryOptions);
@@ -22,6 +23,7 @@ export declare class RpcSessionRegistry {
     /** Daemon-family identities come from the endpoint's claims and generation registry. */
     holderPids(observedStarts?: ReadonlyMap<number, number | undefined>): Promise<readonly number[]>;
     openSession(requested: RpcSessionLaunchProfile, options?: RpcSessionOpenOptions): Promise<OpenRpcSession>;
+    private openNow;
     /**
      * Read-only lookup with no state transitions or attachment accounting.
      * Exists so lifecycle decisions (e.g. deferring a dropped connection's

package/dist/modes/rpc/session-registry.js

@@ -1,6 +1,6 @@
 import { isAbsolute } from "node:path";
 import { assertValidSessionId } from "../../core/session-manager.js";
-import { createRegistryWarm } from "./host-warm.js";
+import { createRegistryWarm, waitForWarms } from "./host-warm.js";
 import { refreshesSessionActivity } from "./session-command-activity.js";
 import { publishedSessionContext } from "./session-context-patch.js";
 import { attachLiveSession, markPathAttached } from "./session-live-attachment.js";
@@ -20,11 +20,14 @@ export class RpcSessionRegistry {
         this.reservations = new Set();
         this.pendingClaims = new Map();
         this.nextHandle = 0;
-        if (options.createRuntime.prepare)
-            this.warm = createRegistryWarm(options.createRuntime.prepare, {
+        if (options.createRuntime.prepare) {
+            const warming = createRegistryWarm(options.createRuntime.prepare, {
                 agentDir: options.agentDir,
                 ...(options.mcpRegistry !== undefined ? { mcpRegistry: options.mcpRegistry } : {}),
             });
+            this.warm = warming.warm;
+            this.warmsInFlight = warming.inFlight;
+        }
         this.options =
             options.mcpRegistry === undefined
                 ? options
@@ -70,6 +73,16 @@ export class RpcSessionRegistry {
         return this.options.pathReservations?.holderPids?.(observedStarts) ?? Promise.resolve([]);
     }
     openSession(requested, options) {
+        // A warm in flight (the boot load of senpi#6147 included) loads on this loop and yields it between modules
+        // (senpi#6199): an open builds its runtime after the warms of ITS cwd that are loading when it arrives, so
+        // its factories never run beside that load. Other cwds and later warms are not waited on, and the wait is
+        // bounded by `closeGraceMs` like the closing-reservation wait.
+        const warming = this.warmsInFlight?.(requested.cwd);
+        if (warming === undefined)
+            return this.openNow(requested, options);
+        return waitForWarms(warming, this.closeGraceMs, requested.cwd).then(() => this.openNow(requested, options));
+    }
+    openNow(requested, options) {
         return openRegistrySession({
             entries: this.entries,
             reservations: this.reservations,

package/dist/modes/rpc/session-router-close.js

@@ -1,8 +1,30 @@
-import { clearHandoverParkedSession } from "./host-handover-parked.js";
 import { RPC_ERROR_UNKNOWN_SESSION } from "./rpc-types.js";
 import { forgetSessionOwnership, releaseOwnerAttachment } from "./session-router-attachments.js";
 import { code, error } from "./session-router-errors.js";
 import { stopSweep } from "./session-router-occupancy.js";
+import { clearRetainedRecord, recordRetainedSession } from "./session-router-residency.js";
+/** How long a stop lets a cut turn settle before its teardown proceeds anyway: the default close grace. */
+const HOST_SHUTDOWN_ABORT_BOUND_MS = 10_000;
+/** Ends the running turn as a host shutdown (senpi#6190), bounded so a run its abort cannot release never holds the stop. */
+async function abortForHostShutdownWithin(sessionId, entry) {
+    // Async wrapper: a session that throws synchronously still only fails its own abort, never the whole stop.
+    const aborting = (async () => {
+        await entry?.runtime?.session.abortForHostShutdown();
+    })().catch((cause) => {
+        process.stderr.write(`senpi rpc host shutdown abort ${sessionId} failed: ${String(cause)}\n`);
+    });
+    let timer;
+    const bound = new Promise((resolve) => {
+        timer = setTimeout(resolve, HOST_SHUTDOWN_ABORT_BOUND_MS);
+        timer.unref?.();
+    });
+    try {
+        await Promise.race([aborting, bound]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Releases one attachment (or every attachment when draining) and reports
  * whether this caller became the finalizer. The join token is installed inside
@@ -66,10 +88,10 @@ export async function close(host, command) {
             releaseOwnerAttachment(host, owner, command.sessionId);
         if (claim.finalizer) {
             // An explicit close ends the session for good: drop any handover-parked record entry, or
-            // the session would come back on the next host start (MEDIUM-1, senpi#3282 review).
-            const entry = host.registry.peek(command.sessionId);
-            if (host.handoverParkedDir !== undefined && entry?.sessionPath !== undefined)
-                await clearHandoverParkedSession(host.handoverParkedDir, entry.sessionPath).catch(() => { });
+            // the session would come back on the next host start (MEDIUM-1, senpi#3282 review). Awaited only when a record
+            // exists, so a host without one starts the teardown in the same tick as the claim.
+            if (host.handoverParkedDir !== undefined)
+                await clearRetainedRecord(host, host.registry.peek(command.sessionId));
             await finalizeClose(host, command.sessionId, host.bindings.get(command.sessionId), () => reply.complete(true, "client_close"));
         }
         else {
@@ -189,11 +211,26 @@ export async function dispose(host) {
     if (host.admissions)
         await host.admissions.dispose();
     await Promise.all([...host.bindings.entries()].map(async ([sessionId, binding]) => {
+        const entry = host.registry.peek(sessionId);
+        // A retained session outlives this process: it parks under the transcript it is on now (its record stays
+        // for the next host on the endpoint, which reopens it) instead of closing, so attached clients do not read
+        // it as ended.
+        const parkedPath = host.handoverParkedDir !== undefined && entry?.retainOnDisconnect === true
+            ? (entry.runtime?.session.sessionFile ?? entry.sessionPath)
+            : undefined;
+        // Claimed before any await, like close(): the stop fences the session in the tick it starts.
         const claim = tryClaimClose(host, sessionId, { drainAttachments: true });
         if (!claim)
             return;
         if (claim.finalizer) {
-            await finalizeClose(host, sessionId, binding, () => host.writer.closeSession(sessionId, { type: "response", command: "close_session", success: true, data: {} }, "host_shutdown"));
+            await abortForHostShutdownWithin(sessionId, entry);
+            if (entry !== undefined && parkedPath !== undefined)
+                await recordRetainedSession(host, entry, parkedPath, false).catch((cause) => {
+                    process.stderr.write(`senpi rpc host shutdown park record ${sessionId} failed: ${String(cause)}\n`);
+                });
+            await finalizeClose(host, sessionId, binding, () => parkedPath !== undefined
+                ? host.writer.parkSession(sessionId, parkedPath, "host_shutdown")
+                : host.writer.closeSession(sessionId, { type: "response", command: "close_session", success: true, data: {} }, "host_shutdown"));
         }
         else
             await host.finalizations.get(sessionId)?.promise;