@code-yeongyu/senpi 2026.11.6-3 → 2026.11.9

package/dist/core/extensions/builtin/terminal/tools/child-placement.js

@@ -25,6 +25,9 @@ function childGenerationOf(id) {
     const generation = CHILD_SESSION_ID.exec(id)?.[1];
     return generation === undefined ? undefined : Number(generation);
 }
+function optionalMinutes(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 1 ? Math.trunc(value) : undefined;
+}
 function parseBackgroundWake(value) {
     if (typeof value !== "object" || value === null)
         return undefined;
@@ -37,19 +40,46 @@ function parseBackgroundWake(value) {
         const startedAtMs = Reflect.get(value, "startedAtMs");
         if (typeof description !== "string" || typeof startedAtMs !== "number")
             return undefined;
-        return { event, id, description, startedAtMs };
+        const command = Reflect.get(value, "command");
+        const autoReapMinutes = optionalMinutes(Reflect.get(value, "autoReapMinutes"));
+        return {
+            event,
+            id,
+            description,
+            startedAtMs,
+            ...(typeof command === "string" ? { command } : {}),
+            ...(autoReapMinutes === undefined ? {} : { autoReapMinutes }),
+        };
+    }
+    if (event === "background_reap_failed") {
+        const autoReapMinutes = optionalMinutes(Reflect.get(value, "autoReapMinutes"));
+        const reason = Reflect.get(value, "reason");
+        if (autoReapMinutes === undefined || typeof reason !== "string")
+            return undefined;
+        return { event, id, autoReapMinutes, reason };
     }
     if (event === "background_exit") {
         const output = Reflect.get(value, "output");
         const exit = Reflect.get(value, "exit");
         if (typeof output !== "string" || (exit !== null && typeof exit !== "object"))
             return undefined;
-        return { event, id, exit: exit, output };
+        const autoReapedAfterMinutes = optionalMinutes(Reflect.get(value, "autoReapedAfterMinutes"));
+        return {
+            event,
+            id,
+            exit: exit,
+            output,
+            ...(autoReapedAfterMinutes === undefined ? {} : { autoReapedAfterMinutes }),
+        };
     }
     return undefined;
 }
-function exitView(exit, output) {
-    return { exitResult: exit, fullOutput: () => output };
+function exitView(exit, output, autoReapedAfterMinutes) {
+    return {
+        exitResult: exit,
+        fullOutput: () => output,
+        ...(autoReapedAfterMinutes === undefined ? {} : { autoReapedAfterMinutes }),
+    };
 }
 function bashIdOf(value) {
     if (typeof value !== "object" || value === null)
@@ -106,6 +136,9 @@ export function terminalChildJob(ctx, kind) {
                 defaultRows: ctx.defaultRows,
                 redactSecretsInOutput: ctx.redactSecretsInOutput === true,
                 ...(ctx.timeoutAction === undefined ? {} : { timeoutAction: ctx.timeoutAction }),
+                ...(ctx.backgroundAutoReapMinutes === undefined
+                    ? {}
+                    : { backgroundAutoReapMinutes: ctx.backgroundAutoReapMinutes }),
             };
         },
     };
@@ -124,11 +157,15 @@ function backgroundRelay(ctx) {
                 return;
             if (wake.event === "background_start") {
                 running.set(wake.id, generation);
-                ctx.onBackgroundStart?.(wake.id, wake.description, wake.startedAtMs);
+                ctx.onBackgroundStart?.(wake.id, wake.description, wake.startedAtMs, wake.command, wake.autoReapMinutes);
+                return;
+            }
+            if (wake.event === "background_reap_failed") {
+                ctx.onBackgroundReapFailed?.(wake.id, wake.autoReapMinutes, wake.reason);
                 return;
             }
             running.delete(wake.id);
-            ctx.onBackgroundExit?.(wake.id, exitView(wake.exit, wake.output));
+            ctx.onBackgroundExit?.(wake.id, exitView(wake.exit, wake.output, wake.autoReapedAfterMinutes));
         },
         childExited: (generation) => {
             for (const [id, startedOn] of running) {

package/dist/core/extensions/builtin/terminal/tools/context.d.ts

@@ -17,6 +17,8 @@ export interface TerminalToolContext {
     readonly timeoutAction?: TimeoutAction;
     /** Resolved `terminal.maxDurableMonitors`; omitted contexts admit any number of persistent monitors. */
     readonly maxDurableMonitors?: number | "unlimited";
+    /** Resolved `terminal.backgroundAutoReapMinutes`: background sessions are stopped at this age; unset means never. */
+    readonly backgroundAutoReapMinutes?: number | undefined;
     /** Resolve the environment for spawned sessions (mirrors core bash `getShellEnv`). */
     readonly getEnv: () => NodeJS.ProcessEnv;
     /**
@@ -24,12 +26,17 @@ export interface TerminalToolContext {
      * expose PI_* session metadata to spawned commands like the core bash tool does.
      */
     readonly getSessionContext?: () => import("../../../types.ts").ExtensionContext | undefined;
-    /** Registers a session when it transitions to background liveness; `command` is what it runs, when known. */
-    readonly onBackgroundStart?: (id: string, description: string, startedAtMs: number, command?: string) => void;
+    /**
+     * Registers a session when it transitions to background liveness; `command` is what it runs, when known, and
+     * `autoReapMinutes` the age at which the opt-in auto-reap stops it.
+     */
+    readonly onBackgroundStart?: (id: string, description: string, startedAtMs: number, command?: string, autoReapMinutes?: number) => void;
     /** A person or the model wrote to a session's stdin (`bash_input`): it is interactive from now on. */
     readonly onSessionInput?: (id: string) => void;
     /** Notified when a background session exits, so the notify layer can wake the agent. */
     readonly onBackgroundExit?: (id: string, runtime: TerminalExitView) => void;
+    /** The opt-in auto-reap's one stop at `autoReapMinutes` did not end the session, for `reason`; it keeps running. */
+    readonly onBackgroundReapFailed?: (id: string, autoReapMinutes: number, reason: string) => void;
     /** Session-scoped monitor state, sharing the terminal manager's bash-id namespace. */
     readonly monitorRegistry?: MonitorRegistry;
     /** Receives filtered monitor line and terminal-summary events. */
@@ -55,6 +62,8 @@ export interface TerminalToolContext {
 /** What a background exit notice reads: on the tool child it is a summary the child sent, not the live session. */
 export interface TerminalExitView {
     readonly exitResult: Pick<TerminalSessionExit, "exitCode" | "signal" | "cancelled" | "timedOut"> | null;
+    /** Set when the opt-in auto-reap stopped the session at this age (senpi#6201). */
+    readonly autoReapedAfterMinutes?: number;
     fullOutput(): string;
 }
 export interface TerminalLaunchBarrier {

package/dist/core/extensions/session-control-types.d.ts

@@ -45,6 +45,15 @@ export type SessionControlSender = {
     readonly platform: string;
     readonly author?: string;
 };
+/**
+ * The remote device a delivery's RPC connection speaks for, stamped by the engine from the connection it arrived on
+ * (senpi#6233). It is never taken from a caller's record or an extension's input, so it is the one provenance on a
+ * delivery that a remote caller cannot write.
+ */
+export interface SessionControlRemoteOrigin {
+    readonly deviceId: string;
+    readonly deviceName?: string;
+}
 export interface AdmitExternalMessageInput {
     readonly delivery_id: string;
     readonly text: string;
@@ -154,7 +163,13 @@ export interface SessionControlDeliveryDetails {
     readonly deliverAs: ExternalDeliverAs;
     readonly sender?: SessionControlSender;
     readonly display_text?: string;
+    /** Engine-stamped: the remote device the admitting connection speaks for. */
+    readonly remote_origin?: SessionControlRemoteOrigin;
+    /** Engine-stamped: the thread-chain hop count the delivery was admitted at. */
+    readonly chain_count?: number;
 }
+/** The engine-stamped remote device a delivery's `details` names, when it names a well-formed one. */
+export declare function sessionControlRemoteOriginOf(details: unknown): SessionControlRemoteOrigin | undefined;
 /** The sender a delivery's `details` names, when it names a well-formed one. */
 export declare function sessionControlSenderOf(details: unknown): SessionControlSender | undefined;
 /** Whether a custom-message `details` value proves it came through session-control admission. */

package/dist/core/extensions/session-control-types.js

@@ -11,6 +11,17 @@
 export { RELOCATION_TOOL_NAMES } from "../session-relocation.js";
 /** `customType` of the transcript entry an admitted delivery becomes. */
 export const SESSION_CONTROL_DELIVERY_TYPE = "session_control_delivery";
+/** The engine-stamped remote device a delivery's `details` names, when it names a well-formed one. */
+export function sessionControlRemoteOriginOf(details) {
+    if (!isSessionControlDeliveryDetails(details) || typeof details.remote_origin !== "object")
+        return undefined;
+    const origin = { ...details.remote_origin };
+    if (typeof origin.deviceId !== "string" || origin.deviceId === "")
+        return undefined;
+    return typeof origin.deviceName === "string" && origin.deviceName !== ""
+        ? { deviceId: origin.deviceId, deviceName: origin.deviceName }
+        : { deviceId: origin.deviceId };
+}
 /** The sender a delivery's `details` names, when it names a well-formed one. */
 export function sessionControlSenderOf(details) {
     if (!isSessionControlDeliveryDetails(details) || typeof details.sender !== "object" || details.sender === null)

package/dist/core/external-admission.d.ts

@@ -13,8 +13,10 @@
  * a file that still refuses writes.
  */
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
-import { type AdmissionHoldReason, type AdmitExternalMessageInput, type AdmittedDeliveries, type ExternalAdmissionResult, type ExternalDeliverAs, type SessionAdmissionGate, type SessionControlDeliveryDetails } from "./extensions/session-control-types.ts";
+import { type AdmissionHoldReason, type AdmitExternalMessageInput, type AdmittedDeliveries, type ExternalAdmissionResult, type ExternalDeliverAs, type SessionAdmissionGate, type SessionControlDeliveryDetails, type SessionControlRemoteOrigin } from "./extensions/session-control-types.ts";
 import type { CustomMessage } from "./messages.ts";
+import type { HistoryReducer } from "./session-history-reduce.ts";
+import { type InputTurnMark } from "./turn-origin.ts";
 export type SessionControlDeliveryMessage = CustomMessage<SessionControlDeliveryDetails>;
 export interface ExternalAdmissionPort {
     /** A run is active, or a prompt has claimed its start: new input queues behind it. */
@@ -28,6 +30,16 @@ export interface EditorHoldState {
     readonly hold_reason?: AdmissionHoldReason;
     readonly revision: number;
 }
+/**
+ * What the engine itself adds to a delivery an RPC connection admits (senpi#6233): the remote device that connection
+ * speaks for, the thread-chain hop it was admitted at, and the origin mark its turn takes. `pi.session` never passes
+ * one, so neither an extension nor a caller's record can write these.
+ */
+export interface DeliveryStamp {
+    readonly remoteOrigin?: SessionControlRemoteOrigin;
+    readonly chainCount?: number;
+    readonly turnMark?: InputTurnMark;
+}
 export declare class ExternalAdmission {
     private turnEpochValue;
     private readonly pending;
@@ -70,7 +82,7 @@ export declare class ExternalAdmission {
     /** Undoes `close` when the hand-over it was closed for did not happen. */
     reopen(): void;
     gate(): SessionAdmissionGate;
-    admit(input: AdmitExternalMessageInput): ExternalAdmissionResult;
+    admit(input: AdmitExternalMessageInput, stamp?: DeliveryStamp): ExternalAdmissionResult;
     list(): AdmittedDeliveries;
     /** A message's transcript entry was written: the file takes writes; a delivery's own entry makes it emitted. */
     observePersisted(message: AgentMessage): void;
@@ -96,5 +108,7 @@ export interface InputHold {
     /** The submission ended without being accepted (it threw, was cancelled, or never submitted). */
     end(): void;
 }
+/** Every delivery id the transcript holds an entry for: what answers for the process-lifetime ledger after a restart. */
+export declare const writtenDeliveryIds: HistoryReducer<Set<string>>;
 export declare function deliveryIdOf(message: AgentMessage): string | undefined;
 //# sourceMappingURL=external-admission.d.ts.map

package/dist/core/external-admission.js

@@ -1,4 +1,5 @@
 import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, } from "./extensions/session-control-types.js";
+import { markInputTurnOrigin } from "./turn-origin.js";
 export class ExternalAdmission {
     constructor(port) {
         this.turnEpochValue = 0;
@@ -81,7 +82,7 @@ export class ExternalAdmission {
             ? { can_admit: true, ...base }
             : { can_admit: false, hold_reason: editor.hold_reason, ...base };
     }
-    admit(input) {
+    admit(input, stamp = {}) {
         if (this.closedReason !== undefined)
             throw new Error(this.closedReason);
         const turn_epoch = this.turnEpochValue;
@@ -95,7 +96,7 @@ export class ExternalAdmission {
         if (input.expected_turn_id !== undefined && input.expected_turn_id !== turn_epoch) {
             return { kind: "turn_conflict", turn_epoch };
         }
-        const message = deliveryMessage(input);
+        const message = deliveryMessage(input, stamp);
         if (!this.isBusy() && input.whenIdle !== "queue") {
             this.pending.set(id, "start");
             // A start that settles without writing the entry left it queued for later (the runtime's
@@ -188,8 +189,8 @@ export class ExternalAdmission {
         return false;
     }
 }
-function deliveryMessage(input) {
-    return {
+function deliveryMessage(input, stamp) {
+    const message = {
         role: "custom",
         customType: SESSION_CONTROL_DELIVERY_TYPE,
         content: input.text,
@@ -200,10 +201,27 @@ function deliveryMessage(input) {
             deliverAs: input.deliverAs,
             ...(input.sender === undefined ? {} : { sender: input.sender }),
             ...(input.display_text === undefined ? {} : { display_text: input.display_text }),
+            ...(stamp.remoteOrigin === undefined ? {} : { remote_origin: stamp.remoteOrigin }),
+            ...(stamp.chainCount === undefined ? {} : { chain_count: stamp.chainCount }),
         },
         timestamp: Date.now(),
     };
+    // The mark rides the message into the run, where the turn that consumes it takes its origin (turn-origin.ts).
+    if (stamp.turnMark !== undefined)
+        markInputTurnOrigin(message, stamp.turnMark);
+    return message;
 }
+/** Every delivery id the transcript holds an entry for: what answers for the process-lifetime ledger after a restart. */
+export const writtenDeliveryIds = {
+    initial: () => new Set(),
+    add: (ids, entry) => {
+        if (entry.type === "custom_message" &&
+            entry.customType === SESSION_CONTROL_DELIVERY_TYPE &&
+            isSessionControlDeliveryDetails(entry.details))
+            ids.add(entry.details.delivery_id);
+        return ids;
+    },
+};
 export function deliveryIdOf(message) {
     if (message.role !== "custom" || message.customType !== SESSION_CONTROL_DELIVERY_TYPE)
         return undefined;

package/dist/core/retry-fallback/controller.d.ts

@@ -31,6 +31,7 @@ export declare class RetryFallbackController {
     accountError(provider: string): string | undefined;
     accountResetAt(provider: string): number | undefined;
     releaseGuessedAccountHold(provider: string): boolean;
+    releaseAccountHold(provider: string): boolean;
     resetTurn(): void;
     clear(): void;
     private canonicalChains;

package/dist/core/retry-fallback/controller.js

@@ -55,6 +55,9 @@ export class RetryFallbackController {
     releaseGuessedAccountHold(provider) {
         return this.unusable.releaseGuessedAccountHold(provider);
     }
+    releaseAccountHold(provider) {
+        return this.unusable.releaseAccountHold(provider);
+    }
     resetTurn() {
         this.triedSelectors.clear();
         this.refusedProviders.clear();

package/dist/core/retry-fallback/unusable.d.ts

@@ -42,6 +42,8 @@ export declare class UnusableEntries {
      * (senpi#5568). A hold with a reset the provider stated is kept. Returns whether a hold was dropped.
      */
     releaseGuessedAccountHold(provider: string): boolean;
+    /** Drops the provider's account hold, whatever its length; returns whether one was held (senpi#5590). */
+    releaseAccountHold(provider: string): boolean;
     isUnusable(model: Model<Api>): boolean;
     clear(model: Model<Api>): void;
     /** The provider's accounts changed (a login, an added or re-authorized account): every hold it earned is stale. */

package/dist/core/retry-fallback/unusable.js

@@ -97,7 +97,13 @@ export class UnusableEntries {
      * (senpi#5568). A hold with a reset the provider stated is kept. Returns whether a hold was dropped.
      */
     releaseGuessedAccountHold(provider) {
-        if (!this.isProviderSpent(provider) || this.accountResetAt(provider) !== undefined)
+        if (this.accountResetAt(provider) !== undefined)
+            return false;
+        return this.releaseAccountHold(provider);
+    }
+    /** Drops the provider's account hold, whatever its length; returns whether one was held (senpi#5590). */
+    releaseAccountHold(provider) {
+        if (!this.isProviderSpent(provider))
             return false;
         this.cooldowns.clear(accountKey(provider));
         this.accountErrors.delete(provider);

package/dist/core/retry-fallback/usage-limit.d.ts

@@ -10,8 +10,13 @@ import type { SessionEntry } from "../session-manager.ts";
  */
 export type UsageLimitScope = "model" | "account";
 export declare class AccountUsageLimitError extends Error {
-    constructor(provider: string, raw?: string, resetsAt?: number, families?: readonly string[]);
+    /**
+     * `families`: a no-family weekly limit confirmed on these families before it held the provider (senpi#5596).
+     * `accountsOut`: a pooled provider's accounts, each with why it cannot serve (senpi#5590).
+     */
+    constructor(provider: string, raw?: string, resetsAt?: number, families?: readonly string[], accountsOut?: string);
 }
+export declare function formatResetTime(epochMs: number): string;
 export declare function usageLimitScope(failure: string | undefined | Pick<AssistantMessage, "errorMessage" | "errorCause">): UsageLimitScope | undefined;
 /** Project advice without mutating the diagnostic-bearing engine message. */
 export declare function describeUsageLimitMessage(message: AssistantMessage): AssistantMessage;

package/dist/core/retry-fallback/usage-limit.js

@@ -2,20 +2,25 @@ import { describeProviderFailureForUser, isQuotaExhaustionMessage } from "@earen
 import { rateLimitModelFamily } from "../credential-pool/model-scope.js";
 import { isBillingErrorMessage } from "./billing.js";
 export class AccountUsageLimitError extends Error {
-    constructor(provider, raw = "usage limit reached", resetsAt, families) {
+    /**
+     * `families`: a no-family weekly limit confirmed on these families before it held the provider (senpi#5596).
+     * `accountsOut`: a pooled provider's accounts, each with why it cannot serve (senpi#5590).
+     */
+    constructor(provider, raw = "usage limit reached", resetsAt, families, accountsOut) {
         const message = describeProviderFailureForUser(raw, {
             model: provider,
             usageLimit: "account",
             ...(resetsAt === undefined ? {} : { resetsAt: formatResetTime(resetsAt) }),
         });
-        super(families === undefined || families.length === 0
+        const withFamilies = families === undefined || families.length === 0
             ? message
-            : `${message} The limit named no model family; it was confirmed on ${families.join(" and ")}.`);
+            : `${message} The limit named no model family; it was confirmed on ${families.join(" and ")}.`;
+        super(accountsOut === undefined ? withFamilies : `${withFamilies} No account can serve: ${accountsOut}.`);
         this.name = "AccountUsageLimitError";
     }
 }
 // The same reader-local time plus timezone the credential pool's blocked message uses.
-function formatResetTime(epochMs) {
+export function formatResetTime(epochMs) {
     return new Date(epochMs).toLocaleString("en-US", {
         month: "short",
         day: "numeric",

package/dist/core/sdk.d.ts

@@ -1,4 +1,4 @@
-import { type ThinkingLevel } from "@earendil-works/pi-agent-core";
+import { type AgentOptions, type ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ThinkingSelection } from "@earendil-works/pi-ai";
 import { type Model } from "@earendil-works/pi-ai/compat";
 import { AgentSession } from "./agent-session.ts";
@@ -17,6 +17,11 @@ import { createBashTool, createCodingTools, createEditTool, createFindTool, crea
 import type { ToolRuntimeKind } from "../cli/tool-runtime.ts";
 import { type ExecutionPipelineWitnessSink } from "./execution/pipeline-witness-sink.ts";
 export interface CreateAgentSessionOptions {
+    /**
+     * Makes each finished model step durable before the loop acts on it (hosted custody, C6 C.P3). Passed to the Agent
+     * this function builds; fused and split-local sessions leave it unset.
+     */
+    commitStep?: AgentOptions["commitStep"];
     /**
      * Where this session's execution-pipeline receipts go (S18b part 3): a sink outside the session, never a session entry.
      * Unset: the file `SENPI_EXECUTION_PIPELINE_WITNESS` names (one JSON line per call), else no receipts.

package/dist/core/sdk.js

@@ -292,6 +292,7 @@ export async function createAgentSession(options = {}) {
     agent = new Agent({
         internalChannel,
         onExecutionPipeline: resolveWitnessSink(options.executionPipelineWitness),
+        ...(options.commitStep ? { commitStep: options.commitStep } : {}),
         initialState: {
             systemPrompt: "",
             model,

package/dist/core/terminal-settings.d.ts

@@ -25,6 +25,7 @@ export interface TerminalSettings {
     monitorRunawayLinesPerMinute?: number;
     monitorRunawayMinutes?: number;
     maxDurableMonitors?: number | "unlimited";
+    backgroundAutoReapMinutes?: number;
     killGuard?: "on" | "off";
 }
 export interface BranchSummarySettings {

package/dist/core/turn-origin.d.ts

@@ -17,6 +17,10 @@ export declare function inputTurnMark(input: {
     readonly source?: string;
 }): InputTurnMark;
 export declare function markInputTurnOrigin(message: object, mark: InputTurnMark): void;
+/** Carries `from`'s origin mark onto `to`, a copy of the same input: a copy without it would open or join a turn unmarked. */
+export declare function copyInputTurnMark(from: object, to: object): void;
+/** Whether a message carries an origin mark: a user message always opens a turn's origin, any other only when marked. */
+export declare function hasInputTurnMark(message: object): boolean;
 /** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
 export declare function noteRunStart(sessionManager: object): void;
 export declare function noteUserMessageStart(sessionManager: object, message: object): void;

package/dist/core/turn-origin.js

@@ -13,6 +13,16 @@ export function inputTurnMark(input) {
 export function markInputTurnOrigin(message, mark) {
     inputMarks.set(message, mark);
 }
+/** Carries `from`'s origin mark onto `to`, a copy of the same input: a copy without it would open or join a turn unmarked. */
+export function copyInputTurnMark(from, to) {
+    const mark = inputMarks.get(from);
+    if (mark !== undefined)
+        inputMarks.set(to, mark);
+}
+/** Whether a message carries an origin mark: a user message always opens a turn's origin, any other only when marked. */
+export function hasInputTurnMark(message) {
+    return inputMarks.has(message);
+}
 /** A run starts as engine work; the user message that opens a turn sets its origin, a steer keeps it. */
 export function noteRunStart(sessionManager) {
     currentOrigins.set(sessionManager, "engine");

package/dist/modes/interactive/components/remote-delivery-message.d.ts

@@ -3,7 +3,8 @@ import { type MessageRenderer, type SessionControlSender } from "../../../core/e
  * A message another session delivered renders as its own block - never as the user's own input, so
  * a reader always sees which text came from outside this terminal. A delivery that names its sender
  * shows one label line ("Sent by another agent · <name>") over the message as it was written; one
- * that does not keeps the generic heading over the text the model read.
+ * that does not keeps the generic heading over the text the model read. A delivery an RPC connection admitted for a
+ * remote device leads with the device the engine stamped, before the sender that device's caller claimed.
  */
 export declare const renderRemoteDelivery: MessageRenderer;
 export declare function senderLabel(sender: SessionControlSender): string;

package/dist/modes/interactive/components/remote-delivery-message.js

@@ -1,18 +1,23 @@
 import { Box, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
-import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, sessionControlSenderOf, } from "../../../core/extensions/types.js";
+import { isSessionControlDeliveryDetails, SESSION_CONTROL_DELIVERY_TYPE, sessionControlRemoteOriginOf, sessionControlSenderOf, } from "../../../core/extensions/types.js";
 import { sharedMarkdownTheme } from "../theme/theme.js";
 /**
  * A message another session delivered renders as its own block - never as the user's own input, so
  * a reader always sees which text came from outside this terminal. A delivery that names its sender
  * shows one label line ("Sent by another agent · <name>") over the message as it was written; one
- * that does not keeps the generic heading over the text the model read.
+ * that does not keeps the generic heading over the text the model read. A delivery an RPC connection admitted for a
+ * remote device leads with the device the engine stamped, before the sender that device's caller claimed.
  */
 export const renderRemoteDelivery = (message, _options, theme) => {
     const box = new Box(1, 1, (text) => theme.bg("customMessageBg", text));
     const sender = sessionControlSenderOf(message.details);
-    const shown = sender === undefined ? undefined : displayTextOf(message.details);
-    if (sender !== undefined && shown !== undefined) {
-        box.addChild(new Text(theme.fg("dim", senderLabel(sender)), 0, 0));
+    const origin = sessionControlRemoteOriginOf(message.details);
+    const shown = sender === undefined && origin === undefined ? undefined : displayTextOf(message.details);
+    if (shown !== undefined) {
+        if (origin !== undefined)
+            box.addChild(new Text(theme.fg("dim", originLabel(origin)), 0, 0));
+        if (sender !== undefined)
+            box.addChild(new Text(theme.fg("dim", senderLabel(sender)), 0, 0));
         box.addChild(new Spacer(1));
         box.addChild(new Markdown(shown, 0, 0, sharedMarkdownTheme(), { color: (line) => theme.fg("customMessageText", line) }));
         return box;
@@ -43,6 +48,9 @@ export function senderLabel(sender) {
                 : `Sent from ${sender.platform} · ${sender.author}`;
     }
 }
+function originLabel(origin) {
+    return `Relayed from device ${origin.deviceName ?? origin.deviceId}`;
+}
 export function builtInMessageRenderer(customType) {
     return customType === SESSION_CONTROL_DELIVERY_TYPE ? renderRemoteDelivery : undefined;
 }

package/dist/modes/rpc/admit-external-message-command.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `admit_external_message` (senpi#6233): the session's own `ExternalAdmission.admit`, the call behind
+ * `pi.session.admitExternalMessage`. The engine writes its fixed `session_control_delivery` entry: never a user message,
+ * never the extension `input` event, never a slash command or prompt template, whatever the text says.
+ *
+ * What the engine adds comes from the connection the record arrived on (`DeliveryPeer`), never from the record (the
+ * security design gate's binding conditions): the device a remote connection speaks for is stamped into the entry's
+ * metadata (`details.remote_origin`) while the model reads exactly the text a same-machine delivery carries (senpi#6250:
+ * an agent need not know a message crossed devices), the ledger keys the delivery under that device, a `command_line` sender is refused
+ * from a remote device, the turn that consumes the delivery takes the connection's origin, the thread-chain guard
+ * runs first, and an id the transcript already holds is answered `already_admitted` after a restart too.
+ */
+import type { AgentSession } from "../../core/agent-session.ts";
+import type { ConnectionOrigin } from "../../core/turn-origin.ts";
+import type { RpcAdmitExternalMessageCommand, RpcAdmitExternalMessageReply } from "./admit-external-message-wire.ts";
+import { type ChainRefusal } from "./chain-admission.ts";
+import type { RpcRemoteOrigin } from "./remote-origin.ts";
+/** The connection a delivery arrived on, as the host knows it. */
+export interface DeliveryPeer {
+    /** The remote device the connection speaks for (`ConnectionRoles.originOf`); absent on a plain local connection. */
+    readonly origin: RpcRemoteOrigin | undefined;
+    readonly connectionOrigin: ConnectionOrigin;
+}
+export type AdmitExternalMessageAnswer = {
+    readonly ok: true;
+    readonly data: RpcAdmitExternalMessageReply;
+} | {
+    readonly ok: false;
+    readonly refusal: ChainRefusal | {
+        readonly message: string;
+        readonly errorCode: string;
+    };
+};
+type AdmittingSession = Pick<AgentSession, "externalAdmission" | "sessionManager" | "settingsManager">;
+export declare function admitExternalMessage(session: AdmittingSession, command: RpcAdmitExternalMessageCommand, peer: DeliveryPeer): AdmitExternalMessageAnswer;
+export {};
+//# sourceMappingURL=admit-external-message-command.d.ts.map

package/dist/modes/rpc/admit-external-message-command.js

@@ -0,0 +1,61 @@
+import { writtenDeliveryIds } from "../../core/external-admission.js";
+import { admitInputChain } from "./chain-admission.js";
+const SENDER_NOT_ALLOWED = "sender_not_allowed";
+const DELEGATED_ORIGIN_UNKNOWN = "delegated_origin_unknown";
+const CANONICAL_TURN_ID = /^(0|[1-9]\d{0,15})$/;
+/** The ledger key: a remote device's ids live under that device, a local connection's under its own prefix. */
+function ledgerId(deliveryId, origin) {
+    return origin === undefined
+        ? `rpc:local/${deliveryId}`
+        : `device:${encodeURIComponent(origin.deviceId)}/${deliveryId}`;
+}
+export function admitExternalMessage(session, command, peer) {
+    const chain = admitInputChain(command.chainCount, session.settingsManager);
+    if (chain.kind === "refused")
+        return { ok: false, refusal: chain.refusal };
+    const { origin } = peer;
+    // A delegated connection that names no device is never treated as this machine's own: it is refused (fail closed).
+    if (peer.connectionOrigin === "delegated" && origin === undefined)
+        return {
+            ok: false,
+            refusal: {
+                message: `${DELEGATED_ORIGIN_UNKNOWN}: a delegated connection that names no remote device cannot admit a delivery`,
+                errorCode: DELEGATED_ORIGIN_UNKNOWN,
+            },
+        };
+    if (origin !== undefined && command.sender?.kind === "command_line")
+        return {
+            ok: false,
+            refusal: {
+                message: `${SENDER_NOT_ALLOWED}: a remote device cannot send as this machine's command line`,
+                errorCode: SENDER_NOT_ALLOWED,
+            },
+        };
+    const admission = session.externalAdmission;
+    const answer = (kind, epoch) => ({
+        ok: true,
+        data: { kind, turnId: String(epoch) },
+    });
+    const id = ledgerId(command.deliveryId, origin);
+    if (session.sessionManager.reduceHistory(writtenDeliveryIds).has(id))
+        return answer("already_admitted", admission.turnEpoch);
+    const expected = command.expectedTurnId;
+    if (expected !== undefined && !CANONICAL_TURN_ID.test(expected))
+        return answer("turn_conflict", admission.turnEpoch);
+    const displayText = command.displayText ?? (origin === undefined ? undefined : command.text);
+    const result = admission.admit({
+        delivery_id: id,
+        text: command.text,
+        deliverAs: command.deliverAs,
+        ...(command.sender === undefined ? {} : { sender: command.sender }),
+        ...(displayText === undefined ? {} : { display_text: displayText }),
+        ...(expected === undefined ? {} : { expected_turn_id: Number(expected) }),
+        ...(command.whenIdle === undefined ? {} : { whenIdle: command.whenIdle }),
+    }, {
+        ...(origin === undefined ? {} : { remoteOrigin: origin }),
+        ...(chain.chainCount === undefined ? {} : { chainCount: chain.chainCount }),
+        turnMark: command.deliverAs === "steer" ? "join" : peer.connectionOrigin,
+    });
+    return answer(result.kind, result.turn_epoch);
+}
+//# sourceMappingURL=admit-external-message-command.js.map

package/dist/modes/rpc/admit-external-message-wire.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The wire of `admit_external_message` (senpi#6233): a message another agent sent this session, relayed over RPC and
+ * admitted the way `pi.session.admitExternalMessage` admits it in process. The fields mirror
+ * `AdmitExternalMessageInput` in the wire's camelCase, plus a thread call's `chainCount`; turn ids are strings, as
+ * `get_state.currentTurnId`. The field checks run on the local connection and inside `validateRpcInboundRecord`, so
+ * both paths refuse the same records.
+ */
+import type { ExternalAdmissionKind, ExternalDeliverAs, SessionControlSender } from "../../core/extensions/session-control-types.ts";
+export interface RpcAdmitExternalMessageCommand {
+    id?: string;
+    type: "admit_external_message";
+    /** The delivery's id: admitting an id this runtime already holds or wrote answers `already_admitted`. */
+    deliveryId: string;
+    /** What the model reads, provenance included. */
+    text: string;
+    /** Who the caller says sent it, for the surfaces a human reads; a claim, shown after the engine-stamped device. */
+    sender?: SessionControlSender;
+    /** The message as its sender wrote it, for human surfaces. */
+    displayText?: string;
+    deliverAs: ExternalDeliverAs;
+    /** The turn the sender observed (`get_state.currentTurnId`); a steer is admitted only while it is current. */
+    expectedTurnId?: string;
+    /** What an idle session does with it: `start` (the default) starts a turn, `queue` holds it for the next one. */
+    whenIdle?: "start" | "queue";
+    /** A thread call's hop count (1 for a chain's first hop), checked against the user's chain limit first (K8). */
+    chainCount?: number;
+}
+export interface RpcAdmitExternalMessageReply {
+    kind: ExternalAdmissionKind;
+    /** The session's turn when the delivery was admitted, in `get_state.currentTurnId`'s form. */
+    turnId: string;
+}
+export interface RpcAdmitExternalMessageResponse {
+    id?: string;
+    type: "response";
+    command: "admit_external_message";
+    success: true;
+    data: RpcAdmitExternalMessageReply;
+}
+/** Why an `admit_external_message` record is refused, prefixed with its type; `undefined` for any other record. */
+export declare function admitExternalMessageFieldError(value: Record<string, unknown>, maxTextCharacters: number): string | undefined;
+//# sourceMappingURL=admit-external-message-wire.d.ts.map