@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9

package/docs/rpc.md

@@ -1286,7 +1286,7 @@ from them that the host itself went away (shutdown) or handed its endpoint to a
 | `event_queue_failed` | `true` | The socket's event queue failed; follows its `overflow` record when it has one | `overflow`, `stall` or `transport_error` |
 | `event_lease_refused` | `true` | An event cannot be leased; follows its `event_lease_refused` record | `lease_limit` or `storage_unavailable` |
 | `compact_endpoint_unsupported` | `false` | A compact mirror of a session served only on the legacy wire; follows its `compact_refused` record | none |
-| `host_shutdown` | `true` | The host is shutting down; follows its sessions' `session_closed` records (`reason: "host_shutdown"`) | none |
+| `host_shutdown` | `true` | The host is shutting down; follows its sessions' `session_closed` records (`reason: "host_shutdown"`), or `session_parked { reason: "host_shutdown" }` for a retained session on a socket host | none |
 | `host_handoff` | `true` | The host drains for a newer generation; follows its sessions' handoff park records | none |
 
 #### interactive_user
@@ -2514,7 +2514,8 @@ releases the caller's own attachment and closes the session only when no other c
 
 Retention limits (what `open`'s `retain_on_disconnect: true` does NOT survive): an explicit `close`, the host's own
 idle-eviction window (`SENPI_RPC_SESSION_IDLE_EVICTION_MS`, default 30 minutes, after which the session is parked -
-any `senpi host session` verb given its path or durable id resumes it), or the host process exiting. A session that has not
+any `senpi host session` verb given its path or durable id resumes it). The host process exiting does not end it: the next
+host on the same endpoint reopens it (see "Retained sessions across a host restart"). A session that has not
 received a message yet may have no JSONL file on disk even though `open` already reported a `sessionPath`.
 
 A minimal orchestration run:
@@ -2801,8 +2802,8 @@ viewer opened to the next one (senpi#5808). So every `open_session` on a delegat
 stays `open` with `attachments: 0` and attachable from any connection, exactly like a retained session (see "Retained
 sessions"). The host decides this when it reads the line, so a connection that ends while its open is still running
 leaves that session retained too. Like any retained session it is still closed by an explicit `close_session`, parked
-by the idle-eviction window, and recorded at park for the next host generation, which reopens it on startup, so a
-parked session survives into the next generation. `attach_session` never turns retention on: attaching over a delegated
+by the idle-eviction window, and recorded (at open, and again at park) for the next host on the endpoint, which reopens
+it on startup, so it survives into the next generation and across a host restart. `attach_session` never turns retention on: attaching over a delegated
 connection to a session that is not retained leaves it closing with its last attachment. One consequence to know: a
 delegated `open_session` by `sessionPath` (which needs `device_admin`) that lands on a session already live and opened by
 someone else joins it as an attach that asks for retention, so it turns retention on for that live session and every
@@ -3297,8 +3298,9 @@ What the host does enforce are lifecycle windows, and they only ever return memo
   command's `unknown_session`. A GENERATION HANDOFF also parks attached sessions, using the distinct activity
   predicate below, and emits `session_closed { sessionId, reason: "handoff_parked", sessionPath }`, so a client can tell "the host handed
   over, reopen by path" from "this session ended". An explicit `close_session` is `reason: "client_close"`; the host
-  process exiting is `reason: "host_shutdown"` (even for a retained session - the process is going away, so this is not
-  a park). `reason` is optional on the wire; a client that does not know a
+  process exiting is `reason: "host_shutdown"`, except for a retained session on a socket host, which PARKS instead
+  (`session_parked { reason: "host_shutdown" }`) because the next host on the endpoint reopens it (see "Retained sessions
+  across a host restart"). `reason` is optional on the wire; a client that does not know a
   value, or receives a record with no `reason` field, treats the record exactly as a reason-less one. "Session-owned
   work" is the complete activity contract, not just a streaming turn: an agent run, a running bash command,
   background terminal jobs and any other published wake source (terminal monitors, loop-guard holds), compaction,
@@ -3334,17 +3336,45 @@ What the host does enforce are lifecycle windows, and they only ever return memo
   in-flight turn to settlement, keeps its path reservation and worker slot, and stays in `list_sessions`. A later
   `open_session` with that `sessionPath` — from any connection — attaches to the same routing handle and returns
   `attached: true`. Retention never outranks an explicit teardown: a `close_session` from an attached connection still
-  reaches zero attachments and closes the session, host shutdown closes it, and the idle-eviction window above still
+  reaches zero attachments and closes the session, a socket host's shutdown parks it (see below), and the idle-eviction
+  window above still
   parks it (or the completed-detached-worker rule above parks it sooner) — announced as
   `session_parked { sessionId, sessionPath }`, after which the file reopens by path like any
   evicted session, and the parked session counts as gone for the empty-host exit below. The park is also recorded
   for the NEXT generation, which reopens it on startup; the host that parked it never reopens it on its own, so a
-  client reopening the session right after `session_parked` is the only open of that path (senpi#3485). It is also bounded by the empty-host exit
-  and the supervisor's idle-exit window below: retention survives a client, not the host. Any attach may turn retention
+  client reopening the session right after `session_parked` is the only open of that path (senpi#3485). Retention survives
+  the host process too (next item). Any attach may turn retention
   on for a live session; no attach turns it off for clients that already rely on it. Omitting the flag is byte-identical
   to the previous behavior — the session is closed with its last connection — except on a delegated connection
   (`declare_delegation`), where every `open_session` is retained (see "Delegated connections"; senpi#5808). Probe `retain_on_disconnect` in
   `get_protocol_info` capabilities before relying on it: an older host silently ignores the field.
+- **Retained sessions across a host restart**: every retained session with a session path is recorded in the
+  endpoint's daemon directory (`handover-parked/`, one entry per session path, the same record a handoff park writes)
+  as soon as its open succeeds; the entry follows the session's `set_session_context` patches and its park, and a
+  transcript switch (`new_session`, `switch_session`, a fork) moves it to the new file, so only the transcript the
+  session is on comes back. An explicit `close_session` or a reclaim removes every key the session was recorded
+  under. While the session is open the entry names the process that holds it; a park drops that, and a host never
+  reopens an entry whose holding process is still alive. So during a generation handoff the successor does not open
+  a session its draining predecessor still has loaded, idle and detached ones included: it reopens the predecessor's
+  park once the drain writes it (or the entry, if the predecessor dies without parking). A host
+  that starts on the same socket and agent dir - after a handoff, a clean stop, a crash, or a kill in the middle of a
+  turn - reopens, in the background right after it binds, every entry an earlier process wrote, replaying the
+  recorded launch profile as `open_session { sessionPath, durableSessionId, retain_on_disconnect: true, ... }`: the same
+  open-by-path a TUI resume runs on its session file. The session is `open` in `list_sessions` again with the same
+  `durableSessionId`, `sessionPath` and transcript, announced by a `session_opened` record, and no client has to
+  re-open it. A clean stop (SIGTERM, idle or empty exit) parks each retained session first: attached clients receive
+  `session_parked { sessionId, sessionPath, reason: "host_shutdown" }`, never `session_closed`, and a turn running at
+  the stop ends with `agent_end { aborted: true, abortSource: "system", abortCause: { kind: "host_shutdown" } }`, never
+  a user abort. A killed host sends nothing. Either way the turn the stopped process was running is not resumed: the
+  transcript holds what was persisted before the stop, as after a TUI crash. The routing handle (`sessionId`, `rpc-N`) is new, since handles are unique per process;
+  a client holding the old one gets `session_not_found` and re-resolves the session from `list_sessions` (or
+  `session_opened`) by `durableSessionId`. A relay that mirrors `list_sessions` (relayd keeps no session store of its
+  own) therefore sees the session again unchanged. Not reopened: an entry whose session file is gone (a session that
+  never received a message has none), an explicitly closed or reclaimed session (its entry is removed), and a session
+  whose context `task_status` is terminal (`completed`, `cancelled`, `error`, `failed`, `lost`, `interrupted`). There is
+  no separate resume-by-durable-id request: `open_session { sessionPath }` already resumes a known transcript, but a
+  remote client learns sessions only from `list_sessions`, so a session the restarted host did not list could not be
+  resumed by one at all.
 - **Empty-host exit**: when the registry holds zero sessions AND no client is connected, continuously for
   `SENPI_RPC_HOST_EMPTY_EXIT_MS` (default 15 minutes), the host exits through its clean shutdown path (flush, socket
   removal), for stdio and `--listen` hosts alike. A connected client counts as occupancy even with no session open,
@@ -4740,11 +4770,26 @@ Response:
     "autoCompactionEnabled": true,
     "messageCount": 5,
     "pendingMessageCount": 0,
-    "pendingDialogs": []
+    "pendingDialogs": [],
+    "permissionPreset": "ask",
+    "permissionPresetSource": "client",
+    "permissionPresetStatus": "applied",
+    "effectivePermissionPreset": "ask"
   }
 }
 ```
 
+`permissionPreset`, `permissionPresetSource`, `permissionPresetStatus` and `effectivePermissionPreset` report the approval mode the session enforces. `permissionPresetSource` is `client` when a client named a valid preset for this session (`open_session.permissionPreset`, an attach naming one, or `set_permission_preset`) and `host_default` when the host's own default applies (its `--permission-preset` flag, then project and global settings, then `full-access`). `permissionPresetStatus` is `invalid` when the named preset or the host's setting cannot be parsed: the open is still accepted, but every gated tool call is refused, and an invalid preset never counts as one the client set. `effectivePermissionPreset` is the preset the next permission decision uses, `null` while the status is `invalid`. A client confirms a mode it asked for only when `permissionPreset` equals it and `permissionPresetStatus` is `applied`. The `open_session` reply carries the first three fields in `data` as well as in `data.state`.
+
+A preset a client named is recorded in the session file as a `permission_mode` entry. The entry is a record only: a later open that names no preset still uses the host's own default, and the launch flag always wins.
+
+Each gated decision picks its preset in this order:
+
+1. A preset a client named for the session (`open_session.permissionPreset`, an attach naming one, or `set_permission_preset`) wins.
+2. Work a remote device started asks: a turn started by a `prompt`, `follow_up` or `steer` (`whenIdle: "start"`) from a delegated connection, and engine-started work (extension messages, goal and loop turns, `continue_from_leaf`, `wake`, restored input) on a session a remote device has driven. A session counts as remote-driven once a delegated connection sends it any record whose method class is `drive` or `device_admin`; the engine's method-class table decides, so every run starter is covered. That includes records that start no turn, such as `abort`, `set_session_name` or `clear_queue`, and the mark lasts for the session's lifetime on purpose: telling which drive records can shape later engine-started work would need a second hand-kept list beside the table, and a wrong guess there would run remote-influenced work without asking, so the engine errs toward asking. When the operator named no `--permission-preset`, it uses the preset a client recorded in the session file instead. An embedder's host-level preset is the host default, not a launch flag. This rule is decided before `spawnedBy`: a parent named in `open_session`, real or not, never takes a remote device's work off it.
+3. A child session (`spawnedBy`) follows its live parent's current mode, including later changes to it. A child whose parent is not live in this process asks, unless the operator named a preset for it with `--permission-preset`.
+4. Everything else uses the host's own default. A local connection's turn keeps the host default even on a session a remote device has driven, and a `steer` never changes the origin of the turn it joins.
+
 `currentTurnId` is the id of the running turn, present only while one runs; a steer or follow-up names it as `expectedTurnId` (on `prompt`, `steer` or `follow_up`).
 
 The `model` field is a full [Model](#model) object or `null`. `pendingModelSwitch` is always present: `null` means no held switch, while an object with `provider` and `id` identifies a switch that applies after the next compaction. The `sessionName` field is the display name set via `set_session_name`, or omitted if not set.
@@ -5198,6 +5243,21 @@ Response:
 {"type": "response", "command": "set_auto_compaction", "success": true}
 ```
 
+#### set_permission_preset
+
+Move this session to another approval mode. It works on a classic `--mode rpc` connection, which refuses `open_session`, and on a multi-session host with the `sessionId` envelope, so a client on another device can change a live session's mode without knowing its session file. It is classed `device_admin`: it changes what the agent may do without asking. Hosts that take it advertise `set_permission_preset_v1`.
+
+```json
+{"type": "set_permission_preset", "permissionPreset": "ask"}
+```
+
+Response:
+```json
+{"type": "response", "command": "set_permission_preset", "success": true, "data": {"permissionPreset": "ask", "permissionPresetSource": "client", "permissionPresetStatus": "applied"}}
+```
+
+The new preset applies from the next permission decision, and the session file records it like a preset named at open. An unknown preset is refused with `errorCode` `invalid_launch_profile` and changes nothing, so the session keeps the mode it had. Extensions hear a change on the `permission_preset_changed` event and read the enforced preset with `pi.getPermissionPreset()`.
+
 ### Retry
 
 #### set_auto_retry
@@ -5893,6 +5953,32 @@ Response:
 
 `kind` is the admission outcome (`started`, `queued`, `steered`, `already_admitted`, `held_draft`, `turn_conflict`); `admitted` is `[]` when no drain is registered.
 
+#### admit_external_message
+
+Admits a message another agent sent this session (a relayed peer delivery) exactly as `pi.session.admitExternalMessage` does in process (multi-session hosts: session-scoped). The engine writes its own `session_control_delivery` custom entry, with `details.sender` and `details.display_text` for human surfaces: never a `role: "user"` message, never the extension `input` event, and a `/`-led `text` is not dispatched as a command or expanded as a template. Method class `drive`.
+
+```json
+{"type": "admit_external_message", "sessionId": "rpc-1", "deliveryId": "d7", "text": "[from peer] build is green", "sender": {"kind": "agent", "session_id": "s-42", "name": "reviewer"}, "displayText": "build is green", "deliverAs": "followUp"}
+```
+
+Response:
+```json
+{
+  "type": "response",
+  "command": "admit_external_message",
+  "success": true,
+  "data": { "kind": "started", "turnId": "0" }
+}
+```
+
+- `deliveryId` (1-256 chars), `text` (non-empty) and `deliverAs` (`steer` | `followUp`) are required. `sender` is `{ kind: "agent", session_id, name? }`, `{ kind: "command_line", user? }` or `{ kind: "external", platform, author? }` with no other field.
+- `whenIdle`: `start` (default) starts a turn on an idle session; `queue` holds it for the next turn.
+- `expectedTurnId` is `get_state.currentTurnId` (a string). A steer whose `expectedTurnId` is not the current turn, or a mid-turn steer that names none, answers `kind: "turn_conflict"` and admits nothing. The reply's `turnId` is the session's turn at admission, in the same form.
+- `chainCount` is a thread call's hop count, checked against `threads.chainCountLimit` before anything is admitted (refused with `chain_count_limit` / `invalid_chain_count`, as on `prompt`/`steer`/`follow_up`); the admitted hop is written as `details.chain_count`.
+- `kind` is the same outcome `wake` reports (`held_draft`: retry; nothing was queued). The ledger keys a local connection's `deliveryId` as `rpc:local/<deliveryId>` and a remote device's as `device:<deviceId>/<deliveryId>`, so RPC ids never collide with in-process deliveries or with another device's. An id the runtime already holds, or that the transcript already holds an entry for (after a restart too), answers `already_admitted`.
+- On a connection that speaks for a remote device (a delegated connection, or one whose `set_client_info` declared `remoteOrigin`), the engine stamps that device as `details.remote_origin` and writes `text` unchanged, so the model reads exactly what a delivery on a local connection carries and no device (senpi#6250). It keeps `text` as `details.display_text` when no `displayText` is given, and refuses a `command_line` sender (`sender_not_allowed`). A delegated connection that names no remote device is refused (`delegated_origin_unknown`), never admitted as a local delivery. A record that names `remote_origin` is refused on every connection. The turn that consumes the delivery takes the connection's origin, so a remote device's follow-up runs under the delegated approval-mode rule even inside a local turn.
+- Once `release_session` has closed the session's admission, the record answers `success: false` with the release's message: the delivery stays with its sender.
+
 #### release_session
 
 Multi-session hosts only. Hands the session to a runtime outside the host; see "Handing a session over (`release_session`)".
@@ -6259,7 +6345,7 @@ When a multi-session host ends a routing handle it may name why:
 | `client_close` | An attached client sent `close_session` |
 | `idle_evicted` | The idle sweep ended a session that was not retained |
 | `session_dir_removed` | The session's transcript directory was deleted and nothing can reopen it: the idle sweep ended it because no client held it (whatever the idle window), or a generation handoff drain ended it instead of parking it. No `sessionPath` |
-| `host_shutdown` | The host process is exiting (SIGTERM, idle-exit, empty-host). A retained session is closed, not parked |
+| `host_shutdown` | The host process is exiting (SIGTERM, idle-exit, empty-host). A retained session on a socket host is parked instead (`session_parked { reason: "host_shutdown" }`) |
 | `replaced` | The routing handle ended because the live session behind it was replaced |
 | `handoff_parked` | A generation handoff drained this host; reopen with `open_session { sessionPath }` |
 | `released` | `release_session` handed the session to a runtime outside this host. Carries `sessionPath`, the file that runtime now writes: do NOT reopen it here |
@@ -6387,6 +6473,37 @@ capability:
 }
 ```
 
+#### Background session age
+
+The terminal builtin emits `terminal_background_age` on the same path, and on the in-process `pi.events`
+bus, when a background bash session is still running at 10 minutes and then every 30 minutes (10, 40,
+70, ...), and when the opt-in auto-reap (`terminal.backgroundAutoReapMinutes` or the `bash` parameter
+`auto_reap_minutes`) has stopped one, or once when its stop did not end the session. `data` has `kind`
+(`running`, `reaped`, or `reap_failed`), `id` (the `bash_id`), `description`, optional `command`,
+`startedAtMs`, `ageMs`, `ageMinutes`, `autoReapMinutes` (the age at which the session is stopped
+automatically, or `null` when nothing will stop it), `reason` (on `reap_failed` only: why the stop did not
+end it), and `stop`, the call that stops it. After `reap_failed` the session is still running, the
+`running` reports go on, and the auto-reap does not try again. Nothing is stopped by this event; a client that wants the session gone calls `kill_bash`
+with `stop.args`. A report that came due while the host slept arrives once, not once per missed interval.
+
+```json
+{
+  "type": "extension_event",
+  "name": "terminal_background_age",
+  "data": {
+    "kind": "running",
+    "id": "bash_3",
+    "description": "npm run dev",
+    "command": "npm run dev",
+    "startedAtMs": 1710000000000,
+    "ageMs": 600000,
+    "ageMinutes": 10,
+    "autoReapMinutes": null,
+    "stop": { "tool": "kill_bash", "args": { "bash_id": "bash_3" } }
+  }
+}
+```
+
 #### Job widgets
 
 The `job-widgets` builtin emits `job_widget_state` on the same path: live, display-ready widgets for the
@@ -6450,7 +6567,7 @@ cannot replace the ID on a queued start event. Older engines omit this additive
 
 ### agent_end
 
-Emitted when one low-level agent run completes. Contains all messages generated during this run. If `willRetry` is true, an automatic retry will follow. A run stopped because its session was replaced also carries `abortCause: { kind: "session_replaced", reason, targetSessionFile?, targetSessionId? }` (see `session_replaced`); extensions' own `agent_end` does not carry it, they learn of the replacement from `session_shutdown`.
+Emitted when one low-level agent run completes. Contains all messages generated during this run. If `willRetry` is true, an automatic retry will follow. A run stopped because its session was replaced also carries `abortCause: { kind: "session_replaced", reason, targetSessionFile?, targetSessionId? }` (see `session_replaced`); a run the host's own stop cut short ends with `aborted: true`, `abortSource: "system"` and `abortCause: { kind: "host_shutdown" }`, never `abortSource: "user"` (senpi#6190); extensions' own `agent_end` does not carry it, they learn of the replacement from `session_shutdown`.
 
 ```json
 {

package/docs/terminal-tools.md

@@ -21,6 +21,28 @@ Background sessions are NEVER killed by `timeout` (they live until they exit or
 call `kill_bash`), even though the bash-timeout extension injects a default `timeout`
 into every `bash` call. Foreground calls behave like the classic `bash` tool.
 
+### Long-running background sessions
+
+A background session that is still running (started with `run_in_background`, or a
+foreground command that auto-detached) is reported once it has run 10 minutes, then
+every 30 minutes after that (10, 40, 70, ... minutes). Each report names the session's
+`bash_id` and its command or label, says how long it has been running, and gives the
+call that stops it (`kill_bash({ bash_id })`). It reaches the agent like a completion
+notice (subject to `notify`), shows in the TUI, and goes to RPC clients as the
+`terminal_background_age` event ([RPC](rpc.md#background-session-age)). A report that came
+due while the machine slept is sent once, not once per missed interval.
+
+Nothing is stopped automatically by default. To stop long sessions at a set age, opt in
+with the `terminal.backgroundAutoReapMinutes` setting, or per call with the `bash`
+parameter `auto_reap_minutes` (which wins over the setting; `0` turns it off for that
+call). At that age the session is stopped the way `kill_bash` stops it (TERM to its
+process group, then KILL after a grace), its completion notice says it was stopped
+automatically, and a `terminal_background_age` event with `kind: "reaped"` is sent.
+It counts as reaped only once that stop has really ended the session. If the stop fails
+or the session survives it, one notice (and a `kind: "reap_failed"` event) says
+auto-reap failed and why; the session keeps running, its age reports go on, and the
+auto-reap does not retry.
+
 Background sessions and monitors also survive a session reload (`/reload`): existing
 `bash_N` ids stay addressable, watchers keep injecting events, and completion
 notifications keep arriving. Quitting or switching sessions still tears everything down.
@@ -214,7 +236,8 @@ Configure the suite under `terminal` in `settings.json` (global
     "scrollback": 10000,
     "maxSessions": 32,
     "timeoutAction": "background",
-    "notify": "wake"
+    "notify": "wake",
+    "backgroundAutoReapMinutes": 120
   }
 }
 ```
@@ -223,6 +246,7 @@ Configure the suite under `terminal` in `settings.json` (global
 - `scrollback` — xterm scrollback lines per session (default 10000).
 - `maxSessions` — concurrent sessions before least-recently-used exited sessions are pruned (default 32).
 - `timeoutAction` — fate of a foreground timeout (default `background`).
+- `backgroundAutoReapMinutes` — stop a background session once it has run this many minutes (default unset: never). A whole number of minutes of at least 1 turns it on; `0` or any other value leaves it off. The `bash` parameter `auto_reap_minutes` overrides it per call.
 - `notify` — async completion behavior: `wake` (wake an idle interactive agent once), `next-turn`, or `off` (default `wake`). Non-interactive `-p` / `--print` / `--mode json` runs never wake.
 - `killGuard` — `on` (default) or `off`, read from the global settings file only (a project value is ignored). While on, an agent command or eval cell that would signal every process (`kill -1`, a `pkill` pattern such as `a||b`, `.*` or one letter), a protected process (pid 1, the agent, its ancestors, the user's service manager) or a process group holding one is refused before it runs with a `[senpi:kill-guard]` message naming the rule and a narrow alternative. Narrow kills by pid, exact name (`pkill -x`) or anchored pattern run as before. Values only known when a command runs (`pkill -f "$P"`, `xargs kill`, a script's `kill $PID`) are judged then: on macOS and Linux every agent shell, monitor and eval kernel gets `kill`, `pkill` and `killall` shims first on `PATH` (in `<agent dir>/kill-guard/<version>/`) and a `BASH_ENV` that wraps bash's builtin `kill`, chaining any `BASH_ENV` you already set; an interactive bash the agent starts gets the same wrapper from a `PROMPT_COMMAND` hook before its first prompt, after your startup files, and your own `PROMPT_COMMAND` still runs after it; a refused command exits 126 with the same message. This also judges what the agent types into a running shell with `bash_input` (edited, recalled or history-expanded lines included), because the shell judges the line it actually runs. Builtin `kill` in dash or zsh, in `bash --posix -c` and in `bash -i -c`, in an interactive bash whose startup files replace `PROMPT_COMMAND`, and a `kill` named by absolute path, are judged only from the command text. A command you type yourself with `!` is never judged and gets no shims. `off` restores the unguarded behavior (no shims, no `BASH_ENV`, `PROMPT_COMMAND` left as you set it) and shows one notice per session.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi",
-	"version": "2026.11.6-2",
+	"version": "2026.11.9",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"piConfig": {
@@ -92,9 +92,9 @@
 	},
 	"dependencies": {
 		"@earendil-works/chord": "0.99.1",
-		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.11.6-2",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.11.6-2",
-		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.11.6-2",
+		"@earendil-works/pi-agent-core": "npm:@code-yeongyu/senpi-agent-core@2026.11.9",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.11.9",
+		"@earendil-works/pi-tui": "npm:@code-yeongyu/senpi-tui@2026.11.9",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"ajv": "8.20.0",
 		"chalk": "6.0.0",
@@ -115,8 +115,8 @@
 		"yaml": "2.9.1",
 		"@anthropic-ai/claude-agent-sdk": "0.3.306",
 		"@anthropic-ai/sdk": "0.127.0",
-		"@code-yeongyu/senpi-codemode": "2026.11.6-2",
-		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.11.6-2",
+		"@code-yeongyu/senpi-codemode": "2026.11.9",
+		"@earendil-works/pi-pty": "npm:@code-yeongyu/senpi-pty@2026.11.9",
 		"@modelcontextprotocol/sdk": "1.32.1",
 		"@mozilla/readability": "0.6.0",
 		"linkedom": "0.18.13",

package/dist/bundle/chunks/chunk-C7HEEBFH.js

@@ -1,2 +0,0 @@
-import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); { const __piWorkerThreads = require("node:worker_threads"); if (typeof __piWorkerThreads.markAsUncloneable !== "function") { __piWorkerThreads.markAsUncloneable = () => {}; } }
-import{rateLimitModelFamily}from"./chunk-6VWIMHMH.js";import{describeProviderFailureForUser,isQuotaExhaustionMessage}from"./chunk-OKMHSVCA.js";var BILLING_ERROR_PATTERN=new RegExp(["credit[- ]balance","insufficient[_ -]quota","\\bbilling\\b","purchase credits","credits[-_ ]required","credits are required","usage_limit_reached","usage_not_included","usage limit has been reached"].join("|"),"i"),STRONG_BILLING_ERROR_PATTERN=new RegExp(["credit[- ]balance","insufficient[_ -]quota","purchase credits","credits[-_ ]required","credits are required","usage_limit_reached","usage_not_included","usage limit has been reached"].join("|"),"i"),TRANSIENT_SERVER_SIGNAL_PATTERN=/(?:^|[^0-9])(?:500|502|503|504|520|522|524)(?:[^0-9]|$)|"type"\s*:\s*"server_error"/i;function isBillingErrorMessage(errorMessage){return errorMessage===void 0?!1:STRONG_BILLING_ERROR_PATTERN.test(errorMessage)?!0:BILLING_ERROR_PATTERN.test(errorMessage)?!TRANSIENT_SERVER_SIGNAL_PATTERN.test(errorMessage):!1}var AccountUsageLimitError=class extends Error{constructor(provider,raw="usage limit reached",resetsAt){super(describeProviderFailureForUser(raw,{model:provider,usageLimit:"account",...resetsAt===void 0?{}:{resetsAt:formatResetTime(resetsAt)}})),this.name="AccountUsageLimitError"}};function formatResetTime(epochMs){return new Date(epochMs).toLocaleString("en-US",{month:"short",day:"numeric",hour:"numeric",minute:"2-digit",timeZoneName:"short"})}var SUBSCRIPTION_LIMIT_PATTERN=/\bhit\s+your\b[^.]*\blimit\b|\b(?:session|weekly|monthly|daily|hourly|\d+[- ]hour|usage)\s+limit\b|\bblocking_limit\b|\brapid_refill_breaker\b/i,PLAN_MODEL_LIMIT_PATTERN=/\breached\b[^.]*\b(?:free|plan|tier|model)\b[^.]*\blimit\b[\s\S]*\bswitch to (?:a |an )?(?:different|another) model\b/i,MODEL_SCOPE_PATTERN=/\bmodels?\b|\bpremium\b|\b(?:opus|sonnet|haiku|fable|mythos)\b/i;function usageLimitScope(failure){if(typeof failure=="object"&&failure.errorCause?.type==="usage_limit"){let scope=failure.errorCause.scope;if(scope==="account"||scope==="model")return scope}let errorMessage=typeof failure=="object"?failure.errorMessage:failure;if(errorMessage===void 0)return;if(rateLimitModelFamily(errorMessage)!==void 0)return"model";if(isQuotaExhaustionMessage(errorMessage)||isBillingErrorMessage(errorMessage)||SUBSCRIPTION_LIMIT_PATTERN.test(errorMessage)||PLAN_MODEL_LIMIT_PATTERN.test(errorMessage))return MODEL_SCOPE_PATTERN.test(errorMessage)?"model":"account"}function describeUsageLimitMessage(message){let scope=usageLimitScope(message);return!scope||message.errorCause?.type==="usage_limit"&&message.errorCause.scope===scope?message:{...message,errorCause:{type:"usage_limit",scope},...scope==="account"?{errorMessage:describeProviderFailureForUser(message.errorMessage,{model:`${message.provider}/${message.model}`,usageLimit:scope})}:{}}}function describeUsageLimitEntry(entry){if(entry.type!=="message"||entry.message.role!=="assistant")return entry;let message=describeUsageLimitMessage(entry.message);return message===entry.message?entry:{...entry,message}}function usageLimitCause(from,limit){if(limit==="model")return`${from} hit its usage limit`;if(limit==="account")return`the ${from.slice(0,Math.max(0,from.indexOf("/")))||from} account hit its usage limit, so its other models were skipped`}var SecretInputUnavailableError=class extends Error{constructor(reason){super("This client cannot collect a secret; use the TUI or the host's settings route."),this.code="secret_input_unavailable",this.name="SecretInputUnavailableError",this.reason=reason}};function resolveSecretInputTimeout(opts){let requested=opts?.timeout??18e5;if(!Number.isFinite(requested)||requested<=0)throw new Error("Invalid secret input timeout");let timeout=Math.ceil(requested);if(!Number.isSafeInteger(Date.now()+timeout))throw new Error("Invalid secret input timeout");return timeout}function armSecretInputDeadline(deadline,expire){let timer,check=()=>{let remaining=deadline-Date.now();remaining<=0?expire():timer=setTimeout(check,Math.min(remaining,2147483647))};return timer=setTimeout(check,Math.max(0,Math.min(deadline-Date.now(),2**31-1))),()=>clearTimeout(timer)}function isSecretInputValue(value){return!/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/u.test(value)}import{realpathSync,watch}from"node:fs";import{opendir}from"node:fs/promises";var FS_WATCH_RETRY_DELAY_MS=5e3;function closeWatcher(watcher){if(watcher)try{watcher.close()}catch{}}function canonicalWatchPath(path){if(process.platform!=="win32")return path;try{return realpathSync.native(path)}catch{return path}}async function probeDirectoryOpenable(directory){let handle=await opendir(directory);try{await handle.read()}finally{await handle.close()}}function watchWithErrorHandler(path,listener,onError,options){try{let watcher=watch(canonicalWatchPath(path),{...options,encoding:"utf8"},listener);return watcher.on("error",onError),watcher}catch{return onError(),null}}export{FS_WATCH_RETRY_DELAY_MS,closeWatcher,canonicalWatchPath,probeDirectoryOpenable,watchWithErrorHandler,isBillingErrorMessage,AccountUsageLimitError,usageLimitScope,describeUsageLimitMessage,describeUsageLimitEntry,usageLimitCause,SecretInputUnavailableError,resolveSecretInputTimeout,armSecretInputDeadline,isSecretInputValue};