@code-yeongyu/senpi 2026.8.30 → 2026.9.2

package/dist/modes/rpc/widget-line-renderer.js

@@ -0,0 +1,73 @@
+import { initTheme, theme } from "../interactive/theme/theme.js";
+export function createLiveComponentRenderer(options) {
+    let disposed = false;
+    let timer;
+    try {
+        // RPC hosts do not necessarily pass through the interactive theme setup.
+        try {
+            void theme.name;
+        }
+        catch {
+            initTheme("dark");
+        }
+        let component;
+        let lastLines;
+        const render = () => {
+            if (disposed)
+                return;
+            try {
+                const lines = component.render(options.getWidth());
+                if (lastLines &&
+                    lines.length === lastLines.length &&
+                    lines.every((line, i) => line === lastLines[i]))
+                    return;
+                lastLines = [...lines];
+                options.emit(lines);
+            }
+            catch (error) {
+                // Allow a recovered render to be emitted even when it matches the last
+                // successful frame; the fault means the client may have lost that frame.
+                lastLines = undefined;
+                options.onRenderFault?.(error);
+            }
+        };
+        const requestRender = () => {
+            if (disposed || timer !== undefined)
+                return;
+            timer = setTimeout(() => {
+                timer = undefined;
+                render();
+            }, 0);
+        };
+        const tui = new Proxy({ requestRender }, {
+            get(target, property) {
+                if (property in target)
+                    return target[property];
+                throw new Error(`RPC live component TUI member is unsupported: ${String(property)}`);
+            },
+        });
+        component = options.factory(tui, theme, ...(options.factoryArgs ?? []));
+        render();
+        return {
+            rerender: render,
+            dispose: () => {
+                if (disposed)
+                    return;
+                disposed = true;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                timer = undefined;
+                component.dispose?.();
+            },
+        };
+    }
+    catch (error) {
+        disposed = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+        timer = undefined;
+        options.onRenderFault?.(error);
+        return undefined;
+    }
+}
+//# sourceMappingURL=widget-line-renderer.js.map

package/dist/modes/rpc/widget-line-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-line-renderer.js","sourceRoot":"","sources":["../../../src/modes/rpc/widget-line-renderer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAc,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAO7E,MAAM,UAAU,2BAA2B,CAAC,OAO3C;IACA,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACJ,yEAAyE;QACzE,IAAI,CAAC;YACJ,KAAK,KAAK,CAAC,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACR,SAAS,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,SAA2C,CAAC;QAChD,IAAI,SAA+B,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,EAAE;YACnB,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnD,IACC,SAAS;oBACT,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;oBACjC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAY,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,KAAK,SAAU,CAAC,CAAC,CAAC,CAAC;oBAEhE,OAAO;gBACR,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,uEAAuE;gBACvE,yEAAyE;gBACzE,SAAS,GAAG,SAAS,CAAC;gBACtB,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACF,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,EAAE;YAC1B,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACvB,KAAK,GAAG,SAAS,CAAC;gBAClB,MAAM,EAAE,CAAC;YACV,CAAC,EAAE,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,aAAa,EAA6B,EAAE;YACnE,GAAG,CAAC,MAAM,EAAE,QAAyB;gBACpC,IAAI,QAAQ,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC,QAAkB,CAAC,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;SACD,CAAmB,CAAC;QACrB,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,CAAC;QACT,OAAO;YACN,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,EAAE;gBACb,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC7C,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACvB,CAAC;SACD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,GAAG,SAAS,CAAC;QAClB,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["import type { Component, TUI } from \"@earendil-works/pi-tui\";\nimport { initTheme, type Theme, theme } from \"../interactive/theme/theme.ts\";\n\nexport interface LiveComponentRenderer {\n\trerender(): void;\n\tdispose(): void;\n}\n\nexport function createLiveComponentRenderer(options: {\n\tfactory: (...args: [TUI, Theme, ...unknown[]]) => Component & { dispose?(): void };\n\t/** Additional arguments are used by footer factories; widgets retain the 2-arg path. */\n\tfactoryArgs?: readonly unknown[];\n\tgetWidth: () => number;\n\temit: (lines: string[]) => void;\n\tonRenderFault?: (error: unknown) => void;\n}): LiveComponentRenderer | undefined {\n\tlet disposed = false;\n\tlet timer: ReturnType<typeof setTimeout> | undefined;\n\ttry {\n\t\t// RPC hosts do not necessarily pass through the interactive theme setup.\n\t\ttry {\n\t\t\tvoid theme.name;\n\t\t} catch {\n\t\t\tinitTheme(\"dark\");\n\t\t}\n\t\tlet component: Component & { dispose?(): void };\n\t\tlet lastLines: string[] | undefined;\n\t\tconst render = () => {\n\t\t\tif (disposed) return;\n\t\t\ttry {\n\t\t\t\tconst lines = component.render(options.getWidth());\n\t\t\t\tif (\n\t\t\t\t\tlastLines &&\n\t\t\t\t\tlines.length === lastLines.length &&\n\t\t\t\t\tlines.every((line: string, i: number) => line === lastLines![i])\n\t\t\t\t)\n\t\t\t\t\treturn;\n\t\t\t\tlastLines = [...lines];\n\t\t\t\toptions.emit(lines);\n\t\t\t} catch (error) {\n\t\t\t\t// Allow a recovered render to be emitted even when it matches the last\n\t\t\t\t// successful frame; the fault means the client may have lost that frame.\n\t\t\t\tlastLines = undefined;\n\t\t\t\toptions.onRenderFault?.(error);\n\t\t\t}\n\t\t};\n\t\tconst requestRender = () => {\n\t\t\tif (disposed || timer !== undefined) return;\n\t\t\ttimer = setTimeout(() => {\n\t\t\t\ttimer = undefined;\n\t\t\t\trender();\n\t\t\t}, 0);\n\t\t};\n\t\tconst tui = new Proxy({ requestRender } as Record<string, unknown>, {\n\t\t\tget(target, property: string | symbol) {\n\t\t\t\tif (property in target) return target[property as string];\n\t\t\t\tthrow new Error(`RPC live component TUI member is unsupported: ${String(property)}`);\n\t\t\t},\n\t\t}) as unknown as TUI;\n\t\tcomponent = options.factory(tui, theme, ...(options.factoryArgs ?? []));\n\t\trender();\n\t\treturn {\n\t\t\trerender: render,\n\t\t\tdispose: () => {\n\t\t\t\tif (disposed) return;\n\t\t\t\tdisposed = true;\n\t\t\t\tif (timer !== undefined) clearTimeout(timer);\n\t\t\t\ttimer = undefined;\n\t\t\t\tcomponent.dispose?.();\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tdisposed = true;\n\t\tif (timer !== undefined) clearTimeout(timer);\n\t\ttimer = undefined;\n\t\toptions.onRenderFault?.(error);\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/utils/fs-watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-watch.d.ts","sourceRoot":"","sources":["../../src/utils/fs-watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAS,MAAM,SAAS,CAAC;AAEvF,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAUxE;AAED,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAC/B,OAAO,EAAE,MAAM,IAAI,EACnB,OAAO,CAAC,EAAE,YAAY,GACpB,SAAS,GAAG,IAAI,CASlB"}
+{"version":3,"file":"fs-watch.d.ts","sourceRoot":"","sources":["../../src/utils/fs-watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAgB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAS,MAAM,SAAS,CAAC;AAErG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAUxE;AAED,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAC/B,OAAO,EAAE,MAAM,IAAI,EACnB,OAAO,CAAC,EAAE,YAAY,GACpB,SAAS,GAAG,IAAI,CAiBlB"}

package/dist/utils/fs-watch.js

@@ -1,4 +1,4 @@
-import { watch } from "node:fs";
+import { realpathSync, watch } from "node:fs";
 export const FS_WATCH_RETRY_DELAY_MS = 5000;
 export function closeWatcher(watcher) {
     if (!watcher) {
@@ -13,7 +13,16 @@ export function closeWatcher(watcher) {
 }
 export function watchWithErrorHandler(path, listener, onError, options) {
     try {
-        const watcher = watch(path, { ...options, encoding: "utf8" }, listener);
+        let watchPath = path;
+        if (process.platform === "win32") {
+            try {
+                watchPath = realpathSync.native(path);
+            }
+            catch {
+                // Keep the raw path when it does not exist yet.
+            }
+        }
+        const watcher = watch(watchPath, { ...options, encoding: "utf8" }, listener);
         watcher.on("error", onError);
         return watcher;
     }

package/dist/utils/fs-watch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs-watch.js","sourceRoot":"","sources":["../../src/utils/fs-watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyD,KAAK,EAAE,MAAM,SAAS,CAAC;AAEvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,MAAM,UAAU,YAAY,CAAC,OAAqC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO;IACR,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,8BAA8B;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,QAA+B,EAC/B,OAAmB,EACnB,OAAsB;IAEtB,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["import { type FSWatcher, type WatchListener, type WatchOptions, watch } from \"node:fs\";\n\nexport const FS_WATCH_RETRY_DELAY_MS = 5000;\n\nexport function closeWatcher(watcher: FSWatcher | null | undefined): void {\n\tif (!watcher) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\twatcher.close();\n\t} catch {\n\t\t// Ignore watcher close errors\n\t}\n}\n\nexport function watchWithErrorHandler(\n\tpath: string,\n\tlistener: WatchListener<string>,\n\tonError: () => void,\n\toptions?: WatchOptions,\n): FSWatcher | null {\n\ttry {\n\t\tconst watcher = watch(path, { ...options, encoding: \"utf8\" }, listener);\n\t\twatcher.on(\"error\", onError);\n\t\treturn watcher;\n\t} catch {\n\t\tonError();\n\t\treturn null;\n\t}\n}\n"]}
+{"version":3,"file":"fs-watch.js","sourceRoot":"","sources":["../../src/utils/fs-watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,YAAY,EAAyC,KAAK,EAAE,MAAM,SAAS,CAAC;AAErG,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,MAAM,UAAU,YAAY,CAAC,OAAqC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO;IACR,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,8BAA8B;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,QAA+B,EAC/B,OAAmB,EACnB,OAAsB;IAEtB,IAAI,CAAC;QACJ,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACR,gDAAgD;YACjD,CAAC;QACF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["import { type FSWatcher, realpathSync, type WatchListener, type WatchOptions, watch } from \"node:fs\";\n\nexport const FS_WATCH_RETRY_DELAY_MS = 5000;\n\nexport function closeWatcher(watcher: FSWatcher | null | undefined): void {\n\tif (!watcher) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\twatcher.close();\n\t} catch {\n\t\t// Ignore watcher close errors\n\t}\n}\n\nexport function watchWithErrorHandler(\n\tpath: string,\n\tlistener: WatchListener<string>,\n\tonError: () => void,\n\toptions?: WatchOptions,\n): FSWatcher | null {\n\ttry {\n\t\tlet watchPath = path;\n\t\tif (process.platform === \"win32\") {\n\t\t\ttry {\n\t\t\t\twatchPath = realpathSync.native(path);\n\t\t\t} catch {\n\t\t\t\t// Keep the raw path when it does not exist yet.\n\t\t\t}\n\t\t}\n\t\tconst watcher = watch(watchPath, { ...options, encoding: \"utf8\" }, listener);\n\t\twatcher.on(\"error\", onError);\n\t\treturn watcher;\n\t} catch {\n\t\tonError();\n\t\treturn null;\n\t}\n}\n"]}

package/docs/app-server.md

@@ -537,8 +537,8 @@ timestamps, paths, and tokens, and preserves frame order, array order, and notif
 From `packages/coding-agent`, build the pinned Codex oracle once, then run the available handshake scenario:
 
 ```bash
-node scripts/qa-app-server/differential/build-oracle.mjs
-node scripts/qa-app-server/differential/run.mjs --scenario handshake
+bun scripts/qa-app-server/differential/build-oracle.mjs
+bun scripts/qa-app-server/differential/run.mjs --scenario handshake
 ```
 
 The build uses `/Users/yeongyu/local-workspaces/codex/codex-rs/Cargo.toml` and writes the binary under that checkout's

package/docs/containerization.md

@@ -26,7 +26,7 @@ Setup:
 ```bash
 cp -R packages/coding-agent/examples/extensions/gondolin ~/.senpi/agent/extensions/gondolin
 cd ~/.senpi/agent/extensions/gondolin
-npm install --ignore-scripts
+bun add --ignore-scripts
 ```
 
 Run from the project you want mounted:
@@ -54,7 +54,7 @@ FROM node:24-bookworm-slim
 RUN apt-get update \
   && apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
   && rm -rf /var/lib/apt/lists/*
-RUN npm install -g --ignore-scripts @code-yeongyu/senpi
+RUN bun add -g --ignore-scripts @code-yeongyu/senpi
 
 WORKDIR /workspace
 ENTRYPOINT ["senpi"]

package/docs/development.md

@@ -7,8 +7,8 @@ See [AGENTS.md](../../../AGENTS.md) at the monorepo root for fork-specific guide
 ```bash
 git clone https://github.com/code-yeongyu/senpi
 cd senpi
-npm install
-npm run build
+bun install
+bun run build
 ```
 
 Run from source:
@@ -36,7 +36,7 @@ Change `name`, `configDir`, and `bin` field for your fork. Affects CLI banner, c
 
 ## Path Resolution
 
-Three execution modes: npm install, standalone binary (`bun build --compile`), tsx from source.
+Three execution modes: bun install, standalone binary (`bun build --compile`), tsx from source.
 
 **Always use `src/config.ts`** for package assets:
 
@@ -55,17 +55,17 @@ Never use `__dirname` directly for package assets.
 ## Testing
 
 ```bash
-npm test            # Vitest across workspaces (skips live-API; default test runner)
+bun run test            # Vitest across workspaces (skips live-API; default test runner)
 ./pi-test.sh        # Launch the CLI from source via tsx for manual testing (--no-env unsets API keys)
-npm run check       # Biome + tsc + browser-smoke check (pre-commit equivalent)
+bun run check       # Biome + tsc + browser-smoke check (pre-commit equivalent)
 ```
 
-Live-API tests are env-gated vitest tests. Set `PI_ENABLE_LIVE_API_TESTS=1` (or a per-provider flag from `packages/ai/test/live-api-gates.ts`) plus the provider API keys, then run `npm test`.
+Live-API tests are env-gated vitest tests. Set `PI_ENABLE_LIVE_API_TESTS=1` (or a per-provider flag from `packages/ai/test/live-api-gates.ts`) plus the provider API keys, then run `bun run test`.
 
 Run a specific test:
 
 ```bash
-npm test --workspace @code-yeongyu/senpi -- test/specific.test.ts
+bun run test --workspace @code-yeongyu/senpi -- test/specific.test.ts
 ```
 
 ## Project Structure

package/docs/extensions.md

@@ -116,7 +116,7 @@ The bundled `model-fallback` extension registers `/fallback` to manage global pe
 Use the quick-set form in scripts or any non-TUI mode:
 
 ```text
-/fallback anthropic/claude-fable-5 ccapi/kimi-k3:max
+/fallback anthropic/claude-fable-5-1 ccapi/kimi-k3:max
 ```
 
 The first argument is the exact primary model selector; each later argument is an ordered fallback selector. Quick-set validates selectors before saving. At least one fallback is required:
@@ -184,9 +184,9 @@ To share extensions via npm or git as senpi packages, see [packages.md](packages
 | `@earendil-works/pi-ai` | AI utilities (`StringEnum` for Google-compatible enums) |
 | `@earendil-works/pi-tui` | TUI components for custom rendering |
 
-npm dependencies work too. Add a `package.json` next to your extension (or in a parent directory), run `npm install`, and imports from `node_modules/` are resolved automatically.
+npm dependencies work too. Add a `package.json` next to your extension (or in a parent directory), run `bun install`, and imports from `node_modules/` are resolved automatically.
 
-For distributed senpi packages installed with `senpi install` (npm or git), runtime deps must be in `dependencies`. Package installation uses production installs (`npm install --omit=dev`) by default, so `devDependencies` are not available at runtime; when `npmCommand` is configured, git packages use plain `install` for compatibility with wrappers.
+For distributed senpi packages installed with `senpi install` (npm or git), runtime deps must be in `dependencies`. Package installation uses production installs (`bun add --omit=dev`) by default, so `devDependencies` are not available at runtime; when `npmCommand` is configured, git packages use plain `install` for compatibility with wrappers.
 
 Node.js built-ins (`node:fs`, `node:path`, etc.) are also available.
 
@@ -288,7 +288,7 @@ Defer background resource startup until `session_start` or the command/tool/even
 └── my-extension/
     ├── package.json    # Declares dependencies and entry points
     ├── package-lock.json
-    ├── node_modules/   # After npm install
+    ├── node_modules/   # After bun install
     └── src/
         └── index.ts
 ```
@@ -307,7 +307,7 @@ Defer background resource startup until `session_start` or the command/tool/even
 }
 ```
 
-Run `npm install` in the extension directory, then imports from `node_modules/` work automatically.
+Run `bun install` in the extension directory, then imports from `node_modules/` work automatically.
 
 ## Events
 

package/docs/grok-neo.md

@@ -64,7 +64,7 @@ Senpi is a rebranded distribution, so its first-time setup is intentionally unav
 
 `--grok-neo` runs **in-process**: the chrome is a presentation strategy inside the ordinary interactive mode, in the same senpi process. There is no separate binary and no daemon — unlike the retired `--neo`, which launched a Go TUI binary talking to senpi over a JSONL RPC daemon.
 
-For the Bun-compiled binary (`npm run build:binary`) this means one process and one deployable directory. `bun build --compile` produces a single `dist/pi` executable, and its runtime assets ship alongside it in `dist/`: theme JSON files, image assets, the photon WASM module, and the pty native addon. Native `.node` addons are **not** embedded by `bun build --compile`; the pty addon is resolved as a sidecar relative to the executable (`dist/native/prebuilds/<platform-arch>/`). So the honest claim is "one process, one deployable directory" — not one file.
+For the Bun-compiled binary (`bun run build:binary`) this means one process and one deployable directory. `bun build --compile` produces a single `dist/pi` executable, and its runtime assets ship alongside it in `dist/`: theme JSON files, image assets, the photon WASM module, and the pty native addon. Native `.node` addons are **not** embedded by `bun build --compile`; the pty addon is resolved as a sidecar relative to the executable (`dist/native/prebuilds/<platform-arch>/`). So the honest claim is "one process, one deployable directory" — not one file.
 
 ## Experimental Status
 

package/docs/index.md

@@ -7,7 +7,7 @@ Senpi is a minimal terminal coding harness. It is designed to stay small at the
 Install with npm:
 
 ```bash
-npm install -g @code-yeongyu/senpi
+bun add -g @code-yeongyu/senpi
 ```
 
 To uninstall senpi itself, use the package manager that installed it:

package/docs/packages.md

@@ -90,7 +90,7 @@ ssh://git@github.com/user/repo@v1
 - Refs are pinned tags or commits. `pi update --extensions` and `pi update --all` do not move them to newer refs, but they do reconcile an existing clone to the configured ref.
 - Use `pi install git:host/user/repo@new-ref` to update settings and move an existing package to a new pinned ref.
 - Cloned to `~/.pi/agent/git/<host>/<path>` (global) or `.pi/git/<host>/<path>` (project).
-- When reconciliation changes the checkout, pi resets and cleans the clone, then runs `npm install` if `package.json` exists.
+- When reconciliation changes the checkout, pi resets and cleans the clone, then runs `bun install` if `package.json` exists.
 
 **SSH examples:**
 ```bash
@@ -166,7 +166,7 @@ If no `pi` manifest is present, pi auto-discovers resources from these directori
 
 ## Dependencies
 
-Third party runtime dependencies belong in `dependencies` in `package.json`. Dependencies that do not register extensions, skills, prompt templates, or themes also belong in `dependencies`. When pi installs a package from npm or git, it runs `npm install`, so those dependencies are installed automatically.
+Third party runtime dependencies belong in `dependencies` in `package.json`. Dependencies that do not register extensions, skills, prompt templates, or themes also belong in `dependencies`. When pi installs a package from npm or git, it runs `bun install`, so those dependencies are installed automatically.
 
 Pi bundles core packages for extensions and skills. If you import any of these, list them in `peerDependencies` with a `"*"` range and do not bundle them: `@earendil-works/pi-ai`, `@earendil-works/pi-agent-core`, `@earendil-works/pi-coding-agent`, `@earendil-works/pi-tui`, `typebox`.
 

package/docs/quickstart.md

@@ -10,7 +10,7 @@ procedure, see the [release and installation guide](release-guide.md).
 Senpi is distributed as an npm package:
 
 ```bash
-npm install -g @code-yeongyu/senpi
+bun add -g @code-yeongyu/senpi
 ```
 
 ### Uninstall
@@ -18,7 +18,7 @@ npm install -g @code-yeongyu/senpi
 Use the package manager that installed senpi:
 
 ```bash
-# npm install -g
+# bun add -g
 npm uninstall -g @code-yeongyu/senpi
 
 # pnpm
@@ -91,7 +91,7 @@ Senpi loads context files at startup. Add an `AGENTS.md` file to tell it how to
 ```markdown
 # Project Instructions
 
-- Run `npm run check` after code changes.
+- Run `bun run check` after code changes.
 - Do not run production migrations locally.
 - Keep responses concise.
 ```
@@ -123,7 +123,7 @@ Images or text can be pasted with Ctrl+V (Alt+V on Windows); images can also be
 In interactive mode:
 
 ```text
-!npm run lint
+!bun run lint
 ```
 
 The command output is sent to the model. Use `!!command` to run a command without adding its output to the model context.

package/docs/release-guide.md

@@ -216,7 +216,7 @@ change the supported Node/npm installation path or require a configuration migra
 `release:local` stages the publish manifest and bundled package tree inside the source checkout
 while packing. Run it from a clean, dedicated release checkout rather than a shared dirty
 worktree. After packing, verify `packages/coding-agent/package.json` still has only the five
-intentional internal bundle entries and run `npm install --ignore-scripts` before resuming
+intentional internal bundle entries and run `bun install --ignore-scripts` before resuming
 development so workspace dependency resolution is restored. Do not use destructive Git cleanup
 when other work is present.
 
@@ -225,25 +225,25 @@ when other work is present.
 Run from the repository root:
 
 ```bash
-npm run check
-npm run build
-CI=1 npm test
+bun run check
+bun run build
+CI=1 bun run test
 npm audit --omit=dev
 ```
 
 The release-script checks are:
 
 ```bash
-node scripts/generate-coding-agent-shrinkwrap.mjs --check
-node scripts/generate-coding-agent-install-lock.mjs --check
-node scripts/upstream-release-worthy.mjs
-npm run release -- --dry-run
-node scripts/release-notes.mjs extract \
+bun scripts/generate-coding-agent-shrinkwrap.mjs --check
+bun scripts/generate-coding-agent-install-lock.mjs --check
+bun scripts/upstream-release-worthy.mjs
+bun run release --dry-run
+bun scripts/release-notes.mjs extract \
   --version 2026.7.30-2 \
   --tag v2026.7.30-2
 ```
 
-`npm run release -- --dry-run` is safe for this workflow. Do not run the live release command:
+`bun run release --dry-run` is safe for this workflow. Do not run the live release command:
 the live path commits, tags, and pushes.
 
 ## Plugin verification
@@ -251,7 +251,7 @@ the live path commits, tags, and pushes.
 Run the focused extension suites:
 
 ```bash
-npm --prefix packages/coding-agent exec vitest -- \
+bunx --cwd packages/coding-agent vitest \
   --run \
   test/suite/builtin-extension-sync.test.ts \
   test/suite/vendored-builtins.test.ts \
@@ -304,7 +304,7 @@ Choose one durable output directory outside the repository:
 ```bash
 cd /Users/yeongyu/local-workspaces/senpi
 ARTIFACT_ROOT="$HOME/.local/share/senpi-releases/2026.7.30-2"
-npm run release:local -- --force --out "$ARTIFACT_ROOT"
+bun run release:local --force --out "$ARTIFACT_ROOT"
 ```
 
 The canonical npm tarball is:
@@ -341,7 +341,7 @@ Install the verified tarball through npm without lifecycle scripts, then refresh
 command cache:
 
 ```bash
-npm install -g --ignore-scripts "$TARBALL"
+bun add -g --ignore-scripts "$TARBALL"
 hash -r
 command -v senpi
 senpi --version
@@ -358,7 +358,7 @@ upgrade.
 Install the verified tarball:
 
 ```bash
-npm install -g --ignore-scripts "$TARBALL"
+bun add -g --ignore-scripts "$TARBALL"
 ```
 
 Create an isolated runtime home:
@@ -437,7 +437,7 @@ Install the transferred artifact:
 
 ```bash
 ssh mengmotaHost \
-  'npm install -g --ignore-scripts \
+  'bun add -g --ignore-scripts \
   /tmp/senpi-2026.7.30-2/code-yeongyu-senpi-2026.7.30-2.tgz'
 ```
 
@@ -516,10 +516,10 @@ counts must match exactly on each machine.
 Re-run version synchronization and lock generation:
 
 ```bash
-node scripts/sync-versions.js
-PI_ALLOW_LOCKFILE_CHANGE=1 npm install --package-lock-only --ignore-scripts
-node scripts/generate-coding-agent-shrinkwrap.mjs
-node scripts/generate-coding-agent-install-lock.mjs
+bun scripts/sync-versions.js
+PI_ALLOW_LOCKFILE_CHANGE=1 bun install --lockfile-only --ignore-scripts
+bun scripts/generate-coding-agent-shrinkwrap.mjs
+bun scripts/generate-coding-agent-install-lock.mjs
 ```
 
 Then rebuild before packaging.
@@ -567,7 +567,7 @@ configuration paths.
 Run the MCP suite directly:
 
 ```bash
-npm --prefix packages/coding-agent exec vitest -- --run test/mcp/
+bunx --cwd packages/coding-agent vitest --run test/mcp/
 ```
 
 Make only compatibility changes required by a reproduced failure. Do not add fallback logic
@@ -581,7 +581,7 @@ Rollback changes the executable package only. It does not remove or modify
 Reinstall the prior published version:
 
 ```bash
-npm install -g @code-yeongyu/senpi@2026.7.30
+bun add -g @code-yeongyu/senpi@2026.7.30
 ```
 
 Verify rollback from an isolated home:

package/docs/rpc.md

@@ -1,5 +1,7 @@
 # RPC Mode
 
+Shared-host clients may advertise the `rendered_components` capability to receive factory-rendered widget, header, and footer records. In a shared session, component rendering uses the minimum width reported by currently attached connections, defaulting to 80 when none report a width; disconnected connections no longer contribute.
+
 The shared Unix socket host uses `<agentDir>/rpc-host-daemon/host.pid` and `settings.json` as its ownership state. Clients attach to a compatible existing host regardless of which client surface started it; only incompatible unmanaged owners are refused.
 
 RPC mode enables headless operation of the coding agent via a JSON protocol over stdin/stdout. This is useful for embedding the agent in other applications, IDEs, or custom UIs.
@@ -8,6 +10,10 @@ RPC mode enables headless operation of the coding agent via a JSON protocol over
 
 ## Starting RPC Mode
 
+### RPC client lifecycle
+
+`RpcClient` accepts an `onDisconnect` callback for an established socket and rejects subsequent transport operations with the typed `RpcTransportGoneError` (also detectable with `isTransportGoneError`). Callers should use the callback to begin recovery and keep the error text out of user-facing output.
+
 ```bash
 senpi --mode rpc [options]
 ```
@@ -43,7 +49,7 @@ Multi-session mode lets one `senpi --mode rpc` process serve several independent
 # Shared JSONL over stdio (legacy multi-session host)
 senpi --mode rpc --multi-session [options]
 
-# One shared host over a Unix socket; each accepted connection has its own JSONL feed
+# One shared host over a local socket; each accepted connection has its own JSONL feed
 senpi --mode rpc --listen unix:///tmp/senpi-rpc.sock [options]
 senpi --mode rpc --listen /tmp/senpi-rpc.sock [options]
 ```
@@ -52,11 +58,27 @@ senpi --mode rpc --listen /tmp/senpi-rpc.sock [options]
 `unix://@name` where supported by the host platform. Socket mode accepts concurrent connections while retaining one
 process-global session registry.
 
+On Windows, listeners and clients deterministically map the logical socket path to
+`\\.\pipe\senpi-rpc-<sha256[:32]>`. Callers keep using the same `unix://` CLI value; the logical path remains the
+ownership and settings identity, and callers never construct the pipe name themselves.
+
 Socket event visibility is an all-sessions broadcast: every connected client receives lifecycle and agent events from
 every open session, each tagged with its routing `sessionId`. Correlated responses and extension UI requests are sent
 only to the connection that issued the command. This lets a non-owner observe a foreign turn without requiring a
 separate subscription protocol.
 
+### Client information and rendered components
+
+Clients may send `set_client_info` with `{ sessionId, width, capabilities? }`. Advertising `rendered_components` registers
+that connection to receive factory-rendered `setWidget`, `setHeader`, and `setFooter` records. Those records are filtered
+per connection; array/undefined widget records and dialog requests retain their existing delivery semantics. Width is
+shared per session using the minimum of attached clients, and a closed or dropped connection no longer contributes its
+width or capability registration. Snapshot replay preserves rendered-component provenance and applies the same capability
+filter to late joiners; a client that registers `rendered_components` while a snapshot is active receives its retained
+factory-rendered records. On a shared socket host, `rendered_components` is registration-only: it is never inherited from the host environment and must be sent in `set_client_info` for each client connection. Registration applies to the sessions attached by that connection; closing one session removes only that session's width and capability association, while socket disposal removes all associations. Clients must re-register `width` and `capabilities` after every reconnect. When the last
+capable connection leaves a still-attached binding, live component renderers and footer data providers are disposed but
+their factories are retained; a later capable connection recreates and re-renders them.
+
 ### Session auto-titling
 
 Auto-generated session titles are on by default only for interactive launches. RPC hosts opt in with
@@ -76,9 +98,23 @@ Startup: `senpi --mode rpc --multi-session` → NO default session is constructe
 
 Interactive launches use the shared RPC host by default when a persisted session is available. A cold start takes approximately 1.3 seconds on the first launch; warm attachment to an existing compatible host is fast. To use the local runtime directly for a launch, set `SENPI_DISABLE_SHARED_HOST=1`. This uses the same local fallback runtime and does not change RPC socket behavior for other clients.
 
+### Session replacement
+
+A replacement (`new_session`, `switch_session`, `fork`) responds as soon as the swap is committed; the derived-surface refresh that rebinds extensions continues afterwards. That refresh does not disturb work the client starts against the committed session: tool activation performed while extensions are still binding no longer cancels an in-flight compaction or invalidates its context. `loaded_surfaces_changed` is emitted only when the surface digest actually changes, so it is NOT a settle barrier clients can wait on.
+
+#### Replacement identity event
+
+When `new_session`, `switch_session`, or `fork` swaps the live session - including replacements an extension drives, which a client never issued - every attached connection receives:
+
+```json
+{ "type": "session_replaced", "durableSessionId": "…", "sessionFile": "…", "cwd": "…", "sessionName": "…" }
+```
+
+The command response reports only `{ cancelled }`, so this event is the only push channel carrying the new identity. The identity is `durableSessionId`, never `sessionId`: top-level `sessionId` is reserved for the per-connection routing handle that multi-session hosts tag every record with, and that tag is applied last, so reusing the key would overwrite the identity the event exists to deliver. Classic mode emits the event untagged.
+
 ### Shared host lifecycle (cold start + idle exit)
 
-The lifecycle supervisor is also available to bundled/rebranded runtimes through the hidden internal launch route `--internal-rpc-host-supervisor`. This route is wire-invisible and intended only for desktop launchers: it receives the public socket, ownership directory, and the runtime command/arguments to wrap, then runs the same `host-lifecycle.ts` implementation used by `ensureHost()`. Normal CLI modes do not use or advertise this route.
+The lifecycle supervisor is also available to bundled/rebranded runtimes through the hidden internal launch route `--internal-rpc-host-supervisor`. This route is wire-invisible and intended only for desktop launchers: it receives the public socket, ownership directory, and the runtime command/arguments to wrap, then runs the same `host-lifecycle.ts` implementation used by `ensureHost()`. Normal CLI modes do not use or advertise this route. Compiled standalone binaries also re-enter themselves through this route automatically: a bun executable always boots its embedded entrypoint, so the script-path re-entry used under a JS runtime would be parsed as CLI arguments (`Unknown option: --socket`) and the host could never start.
 
 Hosts started through `ensureHost()` are wrapped by a lifecycle supervisor that owns the public socket and spawns the
 real RPC host on a private internal hop. The policy lives in `<agentDir>/rpc-host-daemon/settings.json`:
@@ -108,12 +144,37 @@ internal directory. The supervisor also exports `SENPI_RPC_HOST_WATCH_PPID` as a
 set only by the supervisor: a host started any other way (plain `senpi --mode rpc --listen …`, embedders, hand-started
 hosts) sees neither variable and is unaffected. A host whose supervisor is alive is never touched by this binding.
 
+### Shared host occupancy (idle eviction, session cap, empty-host exit)
+
+Every open session owns a complete runtime (a lone idle session measures 340-510 MB RSS), so the host enforces three
+occupancy bounds itself, independent of the supervisor and of client cooperation:
+
+- **Idle eviction**: a session with no routed command and no session-owned work for
+  `SENPI_RPC_SESSION_IDLE_EVICTION_MS` (default 30 minutes) is closed through the exact `close_session` sequence
+  (abort → waitForIdle → dispose, all attachments drained, path reservation released) and every attached connection
+  receives that handle's `session_closed` broadcast plus a final `close_session` response record. "Session-owned
+  work" is the complete activity contract, not just a streaming turn: an agent run, a running bash command,
+  background terminal jobs and any other published wake source (terminal monitors, loop-guard holds), compaction,
+  and barrier-held session work all defer eviction, and the idle clock restarts when that work settles. An evicted
+  session resumes like any other: the next `open_session` with the same `sessionPath` reopens it.
+- **Session cap**: `open_session` beyond `SENPI_RPC_MAX_SESSIONS` concurrently opening/open sessions (default 8)
+  fails with `too_many_sessions`. Attaching to an already-hosted session (`attached: true`) adds no runtime and never
+  counts against the cap, so resume and second-surface flows keep working while at it.
+- **Empty-host exit**: when the registry holds zero sessions AND no client is connected, continuously for
+  `SENPI_RPC_HOST_EMPTY_EXIT_MS` (default 15 minutes), the host exits through its clean shutdown path (flush, socket
+  removal), for stdio and `--listen` hosts alike. A connected client counts as occupancy even with no session open,
+  so the host never drops a live socket under itself. Supervised hosts stay clean either way: a supervisor reads a
+  child exit of 0 without a signal as an intentional idle stop and exits 0 with the same cleanup, not as a crash.
+
+Values are positive integers; invalid values fall through to the defaults. These bounds run inside the host process,
+so they hold even for embedders and hand-started hosts that have no supervisor.
+
 ### D1 normative table (multi-session mode)
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |
 | `get_protocol_info` | - | `{ protocolVersion: 1, serverVersion: string, capabilities: string[], mode: "classic"\|"multi" }` | Answered in BOTH modes; side-effect-free; the capability probe. Multi-session hosts include `multi_session` plus the negotiated launch capabilities. |
-| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. |
+| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. Fails with `too_many_sessions` at the occupancy cap (see [Shared host occupancy](#shared-host-occupancy-idle-eviction-session-cap-empty-host-exit)); idle sessions past the eviction window are closed by the host itself. |
 | `close_session` | `sessionId` | `{}` | Aborts active work, awaits agent idle + settled persistence, flushes queued events, detaches subscriptions; its response is the LAST record tagged with that handle — no events after (test-pinned). |
 | `list_sessions` | - | `{ sessions: [{ sessionId, durableSessionId, sessionPath, cwd, name, status }] }` | Includes `opening`/`closing` entries with their status. |
 | every existing command | + `sessionId` (REQUIRED in multi mode) | unchanged | Routed to that session. |
@@ -132,6 +193,7 @@ In the response `error` field, machine-matchable:
 - `missing_session_id` (session-scoped command without `sessionId` in multi mode)
 - `multi_session_disabled` (`open_session` in classic mode)
 - `invalid_path` (relative `sessionPath`/`cwd`)
+- `too_many_sessions` (`open_session` while `SENPI_RPC_MAX_SESSIONS` sessions are already opening/open; attaching to a live session never fails this way)
 - `open_failed: <detail>`
 
 ### Tagging
@@ -1650,13 +1712,13 @@ Extensions can request user interaction via `ctx.ui.select()`, `ctx.ui.confirm()
 There are two categories of extension UI methods:
 
 - **Dialog methods** (`select`, `confirm`, `input`, `editor`): emit an `extension_ui_request` on stdout and block until the client sends back an `extension_ui_response` on stdin with the matching `id`.
-- **Fire-and-forget methods** (`notify`, `setStatus`, `setWidget`, `setTitle`, `set_editor_text`): emit an `extension_ui_request` on stdout but do not expect a response. The client can display the information or ignore it.
+- **Fire-and-forget methods** (`notify`, `setStatus`, `setWidget`, `setHeader`, `setFooter`, `setTitle`, `set_editor_text`): emit an `extension_ui_request` on stdout but do not expect a response. The client can display the information or ignore it.
 
 If a dialog method includes a `timeout` field, the agent-side will auto-resolve with a default value when the timeout expires. The client does not need to track timeouts.
 
 Some `ExtensionUIContext` methods are not supported or degraded in RPC mode because they require direct TUI access:
 - `custom()` returns `undefined`
-- `setWorkingMessage()`, `setWorkingIndicator()`, `setFooter()`, `setHeader()`, `setEditorComponent()`, `setToolsExpanded()` are no-ops
+- `setWorkingMessage()`, `setWorkingIndicator()`, `setEditorComponent()`, `setToolsExpanded()` are no-ops. `setFooter()` and `setHeader()` render factory components for clients advertising `rendered_components`.
 - `getEditorText()` returns `""`
 - `getToolsExpanded()` returns `false`
 - `pasteToEditor()` delegates to `setEditorText()` (no paste/collapse handling)
@@ -1783,7 +1845,22 @@ Set or clear a widget (block of text lines) displayed above or below the editor.
 }
 ```
 
-Send `widgetLines: undefined` (or omit it) to clear the widget. The `widgetPlacement` field is `"aboveEditor"` (default) or `"belowEditor"`. Only string arrays are supported in RPC mode; component factories are ignored.
+Send `widgetLines: undefined` (or omit it) to clear the widget. The `widgetPlacement` field is `"aboveEditor"` (default) or `"belowEditor"`. Component factories are rendered by the host using the attached client's terminal width.
+
+#### setHeader / setFooter
+
+Set or clear the extension header or footer using rendered text lines. Clients that do not understand these additive methods ignore them.
+
+```json
+{
+  "type": "extension_ui_request",
+  "id": "uuid-10",
+  "method": "setHeader",
+  "widgetLines": ["Header line"]
+}
+```
+
+Omit `widgetLines` to restore the built-in surface. Attached clients send `set_client_info` with their terminal width after attach and on resize; hosts default to width 80 when no width is supplied.
 
 #### setTitle
 

package/docs/sdk.md

@@ -36,7 +36,7 @@ await session.prompt("What files are in the current directory?");
 ## Installation
 
 ```bash
-npm install @earendil-works/pi-coding-agent
+bun add @earendil-works/pi-coding-agent
 ```
 
 The SDK is included in the main package. No separate installation needed.