@code-yeongyu/senpi 2026.9.17-2 → 2026.9.17-3

package/dist/modes/rpc/session-attribution.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Which session - and which of its tools - the host event loop is working for.
+ *
+ * Every in-process session shares one loop, so a stall observed by the loop-lag
+ * watchdog has to be attributed to the work that was running, not to the host at
+ * large. Attribution is carried in `AsyncLocalStorage` (so anything an attributed
+ * command starts can read it) and mirrored in a process-local activity registry the
+ * watchdog can sample from a timer callback, where the async context of the blocked
+ * work is long gone.
+ */
+export interface SessionAttribution {
+    /** Routing handle of the session this work belongs to. */
+    readonly sessionId?: string;
+    /** Tool currently executing for that session. */
+    readonly tool?: string;
+}
+/**
+ * Run `task` attributed to `attribution`: its async chain reads the attribution from
+ * `AsyncLocalStorage`, and the work stays blamable for as long as it is IN FLIGHT.
+ *
+ * The whole lifetime matters, not just the first synchronous segment: a routed command
+ * almost never blocks the loop before its first await - an extension request, a tool, a
+ * turn all block in a later continuation, by which time a synchronous-only registration
+ * has already been retired (observed on a live host: `no attributed session` for a
+ * 1.7 s stall caused by one session's extension request).
+ */
+export declare function runWithSessionAttribution<T>(attribution: SessionAttribution, task: () => T): T;
+/**
+ * Open-ended attribution for work that outlives its dispatch, i.e. a tool executing
+ * inside a turn. The span inherits the ambient session id when the caller does not
+ * name one, and stays blamable until the returned disposer runs.
+ */
+export declare function openSessionAttributionSpan(attribution: SessionAttribution): () => void;
+/** Current activity counter; the watchdog samples it once per tick. */
+export declare function sessionActivityMark(): number;
+/**
+ * The activity to blame for work that ran after `mark`. A synchronous body that
+ * finished inside the window wins (it is the code that just held the loop); otherwise
+ * the newest open span - a tool mid-execution - takes the blame. Neither means the
+ * stall belongs to the host itself, and the record is emitted without a session.
+ */
+export declare function sessionActivitySince(mark: number): SessionAttribution | undefined;
+/** Tool spans of one session, driven by the records its runtime emits. */
+export interface ToolAttributionSpans {
+    /** Inspect one session record; tool execution records open and close spans. */
+    observe(record: object): void;
+    /** Close every span of this session (turn settled, or the binding went away). */
+    closeAll(): void;
+}
+/**
+ * Track which tool a session is executing, from the record stream its runtime already
+ * produces. In-process sessions run their tools ON the host loop, so this is where a
+ * blocking tool becomes attributable; worker sessions block their own isolate and
+ * deliberately have no spans here.
+ */
+export declare function createToolAttributionSpans(sessionId: string): ToolAttributionSpans;
+//# sourceMappingURL=session-attribution.d.ts.map

package/dist/modes/rpc/session-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-attribution.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/session-attribution.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAeD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAoB9F;AAMD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAYtF;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAKjF;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACpC,+EAA+E;IAC/E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,IAAI,IAAI,CAAC;CACjB;AAWD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CA0BlF"}

package/dist/modes/rpc/session-attribution.js

@@ -0,0 +1,132 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const attributionStore = new AsyncLocalStorage();
+/**
+ * Monotonic activity counter. Ordering is all the watchdog needs - it samples the mark
+ * on every tick and asks what ran since - so the registry never reads a clock and stays
+ * deterministic under fake timers.
+ */
+let sequence = 0;
+/** Attributed work that is still running, keyed by its sequence number (ascending). */
+const openActivities = new Map();
+/** The most recent synchronous activity that has finished. */
+let lastFinished;
+/**
+ * Run `task` attributed to `attribution`: its async chain reads the attribution from
+ * `AsyncLocalStorage`, and the work stays blamable for as long as it is IN FLIGHT.
+ *
+ * The whole lifetime matters, not just the first synchronous segment: a routed command
+ * almost never blocks the loop before its first await - an extension request, a tool, a
+ * turn all block in a later continuation, by which time a synchronous-only registration
+ * has already been retired (observed on a live host: `no attributed session` for a
+ * 1.7 s stall caused by one session's extension request).
+ */
+export function runWithSessionAttribution(attribution, task) {
+    const mark = ++sequence;
+    openActivities.set(mark, attribution);
+    const finish = () => {
+        if (!openActivities.delete(mark))
+            return;
+        lastFinished = { sequence: ++sequence, attribution };
+    };
+    let awaited = false;
+    try {
+        const result = attributionStore.run(attribution, task);
+        if (isPromiseLike(result)) {
+            awaited = true;
+            // Settlement of a COPY: the caller still receives (and must handle) the
+            // original rejection - this branch only ends the attribution window.
+            void Promise.resolve(result).then(finish, finish);
+        }
+        return result;
+    }
+    finally {
+        if (!awaited)
+            finish();
+    }
+}
+function isPromiseLike(value) {
+    return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+/**
+ * Open-ended attribution for work that outlives its dispatch, i.e. a tool executing
+ * inside a turn. The span inherits the ambient session id when the caller does not
+ * name one, and stays blamable until the returned disposer runs.
+ */
+export function openSessionAttributionSpan(attribution) {
+    const ambient = attributionStore.getStore();
+    const merged = {
+        sessionId: attribution.sessionId ?? ambient?.sessionId,
+        tool: attribution.tool,
+    };
+    const mark = ++sequence;
+    openActivities.set(mark, merged);
+    return () => {
+        if (!openActivities.delete(mark))
+            return;
+        lastFinished = { sequence: ++sequence, attribution: merged };
+    };
+}
+/** Current activity counter; the watchdog samples it once per tick. */
+export function sessionActivityMark() {
+    return sequence;
+}
+/**
+ * The activity to blame for work that ran after `mark`. A synchronous body that
+ * finished inside the window wins (it is the code that just held the loop); otherwise
+ * the newest open span - a tool mid-execution - takes the blame. Neither means the
+ * stall belongs to the host itself, and the record is emitted without a session.
+ */
+export function sessionActivitySince(mark) {
+    if (lastFinished !== undefined && lastFinished.sequence > mark)
+        return lastFinished.attribution;
+    let newest;
+    for (const attribution of openActivities.values())
+        newest = attribution;
+    return newest;
+}
+function toolRecord(record) {
+    if (!("type" in record) || typeof record.type !== "string")
+        return undefined;
+    return {
+        type: record.type,
+        toolCallId: "toolCallId" in record && typeof record.toolCallId === "string" ? record.toolCallId : undefined,
+        toolName: "toolName" in record && typeof record.toolName === "string" ? record.toolName : undefined,
+    };
+}
+/**
+ * Track which tool a session is executing, from the record stream its runtime already
+ * produces. In-process sessions run their tools ON the host loop, so this is where a
+ * blocking tool becomes attributable; worker sessions block their own isolate and
+ * deliberately have no spans here.
+ */
+export function createToolAttributionSpans(sessionId) {
+    const spans = new Map();
+    const closeAll = () => {
+        for (const close of spans.values())
+            close();
+        spans.clear();
+    };
+    return {
+        closeAll,
+        observe: (record) => {
+            const parsed = toolRecord(record);
+            if (parsed === undefined)
+                return;
+            if (parsed.type === "tool_execution_start" && parsed.toolCallId !== undefined) {
+                spans.get(parsed.toolCallId)?.();
+                spans.set(parsed.toolCallId, openSessionAttributionSpan({ sessionId, tool: parsed.toolName }));
+                return;
+            }
+            if (parsed.type === "tool_execution_end" && parsed.toolCallId !== undefined) {
+                spans.get(parsed.toolCallId)?.();
+                spans.delete(parsed.toolCallId);
+                return;
+            }
+            // A settled turn cannot still be inside a tool: release whatever is left, so a
+            // tool whose end record never arrived cannot keep taking the blame forever.
+            if (parsed.type === "agent_settled" || parsed.type === "agent_idle")
+                closeAll();
+        },
+    };
+}
+//# sourceMappingURL=session-attribution.js.map

package/dist/modes/rpc/session-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-attribution.js","sourceRoot":"","sources":["../../../src/modes/rpc/session-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAmBrD,MAAM,gBAAgB,GAAG,IAAI,iBAAiB,EAAsB,CAAC;AAErE;;;;GAIG;AACH,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,uFAAuF;AACvF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC7D,8DAA8D;AAC9D,IAAI,YAAiG,CAAC;AAEtG;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAI,WAA+B,EAAE,IAAa;IAC1F,MAAM,IAAI,GAAG,EAAE,QAAQ,CAAC;IACxB,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,GAAS,EAAE;QACzB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,YAAY,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,IAAI,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,OAAO;YAAE,MAAM,EAAE,CAAC;IACxB,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AAC3G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAA+B;IACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAuB;QAClC,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,OAAO,EAAE,SAAS;QACtD,IAAI,EAAE,WAAW,CAAC,IAAI;KACtB,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,QAAQ,CAAC;IACxB,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACX,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,YAAY,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB;IAClC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAChD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,GAAG,IAAI;QAAE,OAAO,YAAY,CAAC,WAAW,CAAC;IAChG,IAAI,MAAsC,CAAC;IAC3C,KAAK,MAAM,WAAW,IAAI,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,GAAG,WAAW,CAAC;IACxE,OAAO,MAAM,CAAC;AACf,CAAC;AAUD,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,YAAY,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC3G,QAAQ,EAAE,UAAU,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACnG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,CAAC;QAC5C,KAAK,CAAC,KAAK,EAAE,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACN,QAAQ;QACR,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC/E,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/F,OAAO;YACR,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7E,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChC,OAAO;YACR,CAAC;YACD,+EAA+E;YAC/E,4EAA4E;YAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAAE,QAAQ,EAAE,CAAC;QACjF,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Which session - and which of its tools - the host event loop is working for.\n *\n * Every in-process session shares one loop, so a stall observed by the loop-lag\n * watchdog has to be attributed to the work that was running, not to the host at\n * large. Attribution is carried in `AsyncLocalStorage` (so anything an attributed\n * command starts can read it) and mirrored in a process-local activity registry the\n * watchdog can sample from a timer callback, where the async context of the blocked\n * work is long gone.\n */\nexport interface SessionAttribution {\n\t/** Routing handle of the session this work belongs to. */\n\treadonly sessionId?: string;\n\t/** Tool currently executing for that session. */\n\treadonly tool?: string;\n}\n\nconst attributionStore = new AsyncLocalStorage<SessionAttribution>();\n\n/**\n * Monotonic activity counter. Ordering is all the watchdog needs - it samples the mark\n * on every tick and asks what ran since - so the registry never reads a clock and stays\n * deterministic under fake timers.\n */\nlet sequence = 0;\n/** Attributed work that is still running, keyed by its sequence number (ascending). */\nconst openActivities = new Map<number, SessionAttribution>();\n/** The most recent synchronous activity that has finished. */\nlet lastFinished: { readonly sequence: number; readonly attribution: SessionAttribution } | undefined;\n\n/**\n * Run `task` attributed to `attribution`: its async chain reads the attribution from\n * `AsyncLocalStorage`, and the work stays blamable for as long as it is IN FLIGHT.\n *\n * The whole lifetime matters, not just the first synchronous segment: a routed command\n * almost never blocks the loop before its first await - an extension request, a tool, a\n * turn all block in a later continuation, by which time a synchronous-only registration\n * has already been retired (observed on a live host: `no attributed session` for a\n * 1.7 s stall caused by one session's extension request).\n */\nexport function runWithSessionAttribution<T>(attribution: SessionAttribution, task: () => T): T {\n\tconst mark = ++sequence;\n\topenActivities.set(mark, attribution);\n\tconst finish = (): void => {\n\t\tif (!openActivities.delete(mark)) return;\n\t\tlastFinished = { sequence: ++sequence, attribution };\n\t};\n\tlet awaited = false;\n\ttry {\n\t\tconst result = attributionStore.run(attribution, task);\n\t\tif (isPromiseLike(result)) {\n\t\t\tawaited = true;\n\t\t\t// Settlement of a COPY: the caller still receives (and must handle) the\n\t\t\t// original rejection - this branch only ends the attribution window.\n\t\t\tvoid Promise.resolve(result).then(finish, finish);\n\t\t}\n\t\treturn result;\n\t} finally {\n\t\tif (!awaited) finish();\n\t}\n}\n\nfunction isPromiseLike(value: unknown): value is PromiseLike<unknown> {\n\treturn typeof value === \"object\" && value !== null && \"then\" in value && typeof value.then === \"function\";\n}\n\n/**\n * Open-ended attribution for work that outlives its dispatch, i.e. a tool executing\n * inside a turn. The span inherits the ambient session id when the caller does not\n * name one, and stays blamable until the returned disposer runs.\n */\nexport function openSessionAttributionSpan(attribution: SessionAttribution): () => void {\n\tconst ambient = attributionStore.getStore();\n\tconst merged: SessionAttribution = {\n\t\tsessionId: attribution.sessionId ?? ambient?.sessionId,\n\t\ttool: attribution.tool,\n\t};\n\tconst mark = ++sequence;\n\topenActivities.set(mark, merged);\n\treturn () => {\n\t\tif (!openActivities.delete(mark)) return;\n\t\tlastFinished = { sequence: ++sequence, attribution: merged };\n\t};\n}\n\n/** Current activity counter; the watchdog samples it once per tick. */\nexport function sessionActivityMark(): number {\n\treturn sequence;\n}\n\n/**\n * The activity to blame for work that ran after `mark`. A synchronous body that\n * finished inside the window wins (it is the code that just held the loop); otherwise\n * the newest open span - a tool mid-execution - takes the blame. Neither means the\n * stall belongs to the host itself, and the record is emitted without a session.\n */\nexport function sessionActivitySince(mark: number): SessionAttribution | undefined {\n\tif (lastFinished !== undefined && lastFinished.sequence > mark) return lastFinished.attribution;\n\tlet newest: SessionAttribution | undefined;\n\tfor (const attribution of openActivities.values()) newest = attribution;\n\treturn newest;\n}\n\n/** Tool spans of one session, driven by the records its runtime emits. */\nexport interface ToolAttributionSpans {\n\t/** Inspect one session record; tool execution records open and close spans. */\n\tobserve(record: object): void;\n\t/** Close every span of this session (turn settled, or the binding went away). */\n\tcloseAll(): void;\n}\n\nfunction toolRecord(record: object): { type: string; toolCallId?: string; toolName?: string } | undefined {\n\tif (!(\"type\" in record) || typeof record.type !== \"string\") return undefined;\n\treturn {\n\t\ttype: record.type,\n\t\ttoolCallId: \"toolCallId\" in record && typeof record.toolCallId === \"string\" ? record.toolCallId : undefined,\n\t\ttoolName: \"toolName\" in record && typeof record.toolName === \"string\" ? record.toolName : undefined,\n\t};\n}\n\n/**\n * Track which tool a session is executing, from the record stream its runtime already\n * produces. In-process sessions run their tools ON the host loop, so this is where a\n * blocking tool becomes attributable; worker sessions block their own isolate and\n * deliberately have no spans here.\n */\nexport function createToolAttributionSpans(sessionId: string): ToolAttributionSpans {\n\tconst spans = new Map<string, () => void>();\n\tconst closeAll = (): void => {\n\t\tfor (const close of spans.values()) close();\n\t\tspans.clear();\n\t};\n\treturn {\n\t\tcloseAll,\n\t\tobserve: (record) => {\n\t\t\tconst parsed = toolRecord(record);\n\t\t\tif (parsed === undefined) return;\n\t\t\tif (parsed.type === \"tool_execution_start\" && parsed.toolCallId !== undefined) {\n\t\t\t\tspans.get(parsed.toolCallId)?.();\n\t\t\t\tspans.set(parsed.toolCallId, openSessionAttributionSpan({ sessionId, tool: parsed.toolName }));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (parsed.type === \"tool_execution_end\" && parsed.toolCallId !== undefined) {\n\t\t\t\tspans.get(parsed.toolCallId)?.();\n\t\t\t\tspans.delete(parsed.toolCallId);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// A settled turn cannot still be inside a tool: release whatever is left, so a\n\t\t\t// tool whose end record never arrived cannot keep taking the blame forever.\n\t\t\tif (parsed.type === \"agent_settled\" || parsed.type === \"agent_idle\") closeAll();\n\t\t},\n\t};\n}\n"]}

package/dist/modes/rpc/session-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-binding.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/session-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAGN,KAAK,oBAAoB,EAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gCAAgC,CAAC,IAAI,IAAI,CAAC;IAC1C,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAQD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,IAAI,EACxB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,aAAa,CAAM,GACtE,OAAO,CAAC,iBAAiB,CAAC,CAyC5B"}
+{"version":3,"file":"session-binding.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/session-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAGN,KAAK,oBAAoB,EAEzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gCAAgC,CAAC,IAAI,IAAI,CAAC;IAC1C,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,EAAE,MAAM,IAAI,EACxB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,aAAa,CAAM,GACtE,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/modes/rpc/session-binding.js

@@ -1,11 +1,6 @@
 import { bindToProviderScope, runWithProviderScope } from "@earendil-works/pi-ai/node/provider-scope";
 import { createRpcConnectionHandler, } from "./connection-handler.js";
-function enqueueRecords(writer, sessionId, chunk) {
-    for (const line of chunk.split("\n")) {
-        if (line)
-            writer.enqueue(sessionId, JSON.parse(line));
-    }
-}
+import { createToolAttributionSpans } from "./session-attribution.js";
 /**
  * Creates the extension UI bridge and subscriptions within the entry's provider
  * scope. The classic handler remains the single source of command semantics.
@@ -15,6 +10,19 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
         return entry.worker.bind(sessionId, writer, requestClose, options);
     if (!entry.runtime)
         throw new Error("Session runtime was not created");
+    // An in-process session executes its tools ON the host loop, so the tool this
+    // session is inside is what the loop-lag watchdog blames for a stall. The record
+    // stream already carries that transition; no extra subscription is needed.
+    const toolSpans = createToolAttributionSpans(sessionId);
+    const enqueueRecords = (chunk) => {
+        for (const line of chunk.split("\n")) {
+            if (!line)
+                continue;
+            const record = JSON.parse(line);
+            toolSpans.observe(record);
+            writer.enqueue(sessionId, record);
+        }
+    };
     // Attachments share one entry, so resolve the host from the live runtime. In
     // particular, switch_session must use the entry's replacement-aware method
     // instead of a runtime captured during open_session.
@@ -36,7 +44,7 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
     });
     const handler = await runWithProviderScope(entry.scope, async () => {
         const taggedSink = {
-            writeRaw: bindToProviderScope((chunk) => enqueueRecords(writer, sessionId, chunk)),
+            writeRaw: bindToProviderScope(enqueueRecords),
             waitForBackpressure: bindToProviderScope(async () => { }),
         };
         return createRpcConnectionHandler(runtimeHost, taggedSink, {
@@ -52,7 +60,10 @@ export async function createRpcSessionBinding(sessionId, entry, writer, requestC
         handle: (command) => runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command))),
         cancelPendingExtensionUiRequests: () => runWithProviderScope(entry.scope, () => handler.cancelPendingExtensionUiRequests()),
         rerenderComponents: () => runWithProviderScope(entry.scope, () => handler.rerenderComponents()),
-        dispose: () => runWithProviderScope(entry.scope, () => handler.dispose()),
+        dispose: () => {
+            toolSpans.closeAll();
+            return runWithProviderScope(entry.scope, () => handler.dispose());
+        },
     };
 }
 //# sourceMappingURL=session-binding.js.map

package/dist/modes/rpc/session-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-binding.js","sourceRoot":"","sources":["../../../src/modes/rpc/session-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEtG,OAAO,EACN,0BAA0B,GAI1B,MAAM,yBAAyB,CAAC;AAYjC,SAAS,cAAc,CAAC,MAA0B,EAAE,SAAiB,EAAE,KAAa;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC,CAAC;IACjE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,KAAsB,EACtB,MAA0B,EAC1B,YAAwB,EACxB,OAAO,GAA+D,EAAE;IAExE,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,6EAA6E;IAC7E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,EAAyB,EAAE;QACxD,GAAG,CAAC,OAAO,EAAE,QAAQ;YACpB,IAAI,QAAQ,KAAK,eAAe,IAAI,KAAK,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC,aAAa,CAAC;YACpF,IAAI,QAAQ,KAAK,kBAAkB;gBAClC,OAAO,CAAC,QAAiE,EAAE,EAAE;oBAC5E,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC;oBAC/B,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC3C,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,CAAC;KACD,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,UAAU,GAAsB;YACrC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC1F,mBAAmB,EAAE,mBAAmB,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;SACxD,CAAC;QACF,OAAO,0BAA0B,CAAC,WAAW,EAAE,UAAU,EAAE;YAC1D,SAAS;YACT,eAAe,EAAE,mBAAmB,CAAC,YAAY,CAAC;YAClD,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;YACvC,GAAG,OAAO;SACV,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,KAAK,CAAC;IACpB,OAAO;QACN,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9G,gCAAgC,EAAE,GAAG,EAAE,CACtC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,EAAE,CAAC;QACpF,kBAAkB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/F,OAAO,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;KACzE,CAAC;AACH,CAAC","sourcesContent":["import { bindToProviderScope, runWithProviderScope } from \"@earendil-works/pi-ai/node/provider-scope\";\nimport type { AgentSessionRuntime } from \"../../core/agent-session-runtime.ts\";\nimport {\n\tcreateRpcConnectionHandler,\n\ttype RpcConnectionHandler,\n\ttype RpcConnectionOptions,\n\ttype RpcConnectionSink,\n} from \"./connection-handler.ts\";\nimport type { SessionEventWriter } from \"./session-event-writer.ts\";\nimport type { RpcSessionEntry } from \"./session-registry.ts\";\n\n/** A session-owned adapter around the classic command and extension-UI wiring. */\nexport interface RpcSessionBinding {\n\thandle(command: object): Promise<void>;\n\tcancelPendingExtensionUiRequests?(): void;\n\trerenderComponents?(): void;\n\tdispose(): Promise<void>;\n}\n\nfunction enqueueRecords(writer: SessionEventWriter, sessionId: string, chunk: string): void {\n\tfor (const line of chunk.split(\"\\n\")) {\n\t\tif (line) writer.enqueue(sessionId, JSON.parse(line) as object);\n\t}\n}\n\n/**\n * Creates the extension UI bridge and subscriptions within the entry's provider\n * scope. The classic handler remains the single source of command semantics.\n */\nexport async function createRpcSessionBinding(\n\tsessionId: string,\n\tentry: RpcSessionEntry,\n\twriter: SessionEventWriter,\n\trequestClose: () => void,\n\toptions: Pick<RpcConnectionOptions, \"capabilities\" | \"sharedWidth\"> = {},\n): Promise<RpcSessionBinding> {\n\tif (entry.worker) return entry.worker.bind(sessionId, writer, requestClose, options);\n\tif (!entry.runtime) throw new Error(\"Session runtime was not created\");\n\t// Attachments share one entry, so resolve the host from the live runtime. In\n\t// particular, switch_session must use the entry's replacement-aware method\n\t// instead of a runtime captured during open_session.\n\tconst runtimeHost = new Proxy({} as AgentSessionRuntime, {\n\t\tget(_target, property) {\n\t\t\tif (property === \"switchSession\" && entry.switchSession) return entry.switchSession;\n\t\t\tif (property === \"setRebindSession\")\n\t\t\t\treturn (callback?: Parameters<AgentSessionRuntime[\"setRebindSession\"]>[0]) => {\n\t\t\t\t\tentry.rebindSession = callback;\n\t\t\t\t\tentry.runtime?.setRebindSession(callback);\n\t\t\t\t};\n\t\t\tconst runtime = entry.runtime;\n\t\t\tif (!runtime) throw new Error(\"Session runtime was not created\");\n\t\t\tconst value = Reflect.get(runtime, property, runtime);\n\t\t\treturn typeof value === \"function\" ? value.bind(runtime) : value;\n\t\t},\n\t});\n\tconst handler: RpcConnectionHandler = await runWithProviderScope(entry.scope, async () => {\n\t\tconst taggedSink: RpcConnectionSink = {\n\t\t\twriteRaw: bindToProviderScope((chunk: string) => enqueueRecords(writer, sessionId, chunk)),\n\t\t\twaitForBackpressure: bindToProviderScope(async () => {}),\n\t\t};\n\t\treturn createRpcConnectionHandler(runtimeHost, taggedSink, {\n\t\t\tsessionId,\n\t\t\tshutdownHandler: bindToProviderScope(requestClose),\n\t\t\tdisposeRuntime: false,\n\t\t\teventFlushScheduler: (flush) => flush(),\n\t\t\t...options,\n\t\t});\n\t});\n\tawait handler.ready;\n\treturn {\n\t\thandle: (command) => runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command))),\n\t\tcancelPendingExtensionUiRequests: () =>\n\t\t\trunWithProviderScope(entry.scope, () => handler.cancelPendingExtensionUiRequests()),\n\t\trerenderComponents: () => runWithProviderScope(entry.scope, () => handler.rerenderComponents()),\n\t\tdispose: () => runWithProviderScope(entry.scope, () => handler.dispose()),\n\t};\n}\n"]}
+{"version":3,"file":"session-binding.js","sourceRoot":"","sources":["../../../src/modes/rpc/session-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEtG,OAAO,EACN,0BAA0B,GAI1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAYtE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,KAAsB,EACtB,MAA0B,EAC1B,YAAwB,EACxB,OAAO,GAA+D,EAAE;IAExE,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,8EAA8E;IAC9E,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YAC1C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;IACF,CAAC,CAAC;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,EAAyB,EAAE;QACxD,GAAG,CAAC,OAAO,EAAE,QAAQ;YACpB,IAAI,QAAQ,KAAK,eAAe,IAAI,KAAK,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC,aAAa,CAAC;YACpF,IAAI,QAAQ,KAAK,kBAAkB;gBAClC,OAAO,CAAC,QAAiE,EAAE,EAAE;oBAC5E,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC;oBAC/B,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC3C,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,CAAC;KACD,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,UAAU,GAAsB;YACrC,QAAQ,EAAE,mBAAmB,CAAC,cAAc,CAAC;YAC7C,mBAAmB,EAAE,mBAAmB,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;SACxD,CAAC;QACF,OAAO,0BAA0B,CAAC,WAAW,EAAE,UAAU,EAAE;YAC1D,SAAS;YACT,eAAe,EAAE,mBAAmB,CAAC,YAAY,CAAC;YAClD,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;YACvC,GAAG,OAAO;SACV,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,KAAK,CAAC;IACpB,OAAO;QACN,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9G,gCAAgC,EAAE,GAAG,EAAE,CACtC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,EAAE,CAAC;QACpF,kBAAkB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/F,OAAO,EAAE,GAAG,EAAE;YACb,SAAS,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { bindToProviderScope, runWithProviderScope } from \"@earendil-works/pi-ai/node/provider-scope\";\nimport type { AgentSessionRuntime } from \"../../core/agent-session-runtime.ts\";\nimport {\n\tcreateRpcConnectionHandler,\n\ttype RpcConnectionHandler,\n\ttype RpcConnectionOptions,\n\ttype RpcConnectionSink,\n} from \"./connection-handler.ts\";\nimport { createToolAttributionSpans } from \"./session-attribution.ts\";\nimport type { SessionEventWriter } from \"./session-event-writer.ts\";\nimport type { RpcSessionEntry } from \"./session-registry.ts\";\n\n/** A session-owned adapter around the classic command and extension-UI wiring. */\nexport interface RpcSessionBinding {\n\thandle(command: object): Promise<void>;\n\tcancelPendingExtensionUiRequests?(): void;\n\trerenderComponents?(): void;\n\tdispose(): Promise<void>;\n}\n\n/**\n * Creates the extension UI bridge and subscriptions within the entry's provider\n * scope. The classic handler remains the single source of command semantics.\n */\nexport async function createRpcSessionBinding(\n\tsessionId: string,\n\tentry: RpcSessionEntry,\n\twriter: SessionEventWriter,\n\trequestClose: () => void,\n\toptions: Pick<RpcConnectionOptions, \"capabilities\" | \"sharedWidth\"> = {},\n): Promise<RpcSessionBinding> {\n\tif (entry.worker) return entry.worker.bind(sessionId, writer, requestClose, options);\n\tif (!entry.runtime) throw new Error(\"Session runtime was not created\");\n\t// An in-process session executes its tools ON the host loop, so the tool this\n\t// session is inside is what the loop-lag watchdog blames for a stall. The record\n\t// stream already carries that transition; no extra subscription is needed.\n\tconst toolSpans = createToolAttributionSpans(sessionId);\n\tconst enqueueRecords = (chunk: string): void => {\n\t\tfor (const line of chunk.split(\"\\n\")) {\n\t\t\tif (!line) continue;\n\t\t\tconst record = JSON.parse(line) as object;\n\t\t\ttoolSpans.observe(record);\n\t\t\twriter.enqueue(sessionId, record);\n\t\t}\n\t};\n\t// Attachments share one entry, so resolve the host from the live runtime. In\n\t// particular, switch_session must use the entry's replacement-aware method\n\t// instead of a runtime captured during open_session.\n\tconst runtimeHost = new Proxy({} as AgentSessionRuntime, {\n\t\tget(_target, property) {\n\t\t\tif (property === \"switchSession\" && entry.switchSession) return entry.switchSession;\n\t\t\tif (property === \"setRebindSession\")\n\t\t\t\treturn (callback?: Parameters<AgentSessionRuntime[\"setRebindSession\"]>[0]) => {\n\t\t\t\t\tentry.rebindSession = callback;\n\t\t\t\t\tentry.runtime?.setRebindSession(callback);\n\t\t\t\t};\n\t\t\tconst runtime = entry.runtime;\n\t\t\tif (!runtime) throw new Error(\"Session runtime was not created\");\n\t\t\tconst value = Reflect.get(runtime, property, runtime);\n\t\t\treturn typeof value === \"function\" ? value.bind(runtime) : value;\n\t\t},\n\t});\n\tconst handler: RpcConnectionHandler = await runWithProviderScope(entry.scope, async () => {\n\t\tconst taggedSink: RpcConnectionSink = {\n\t\t\twriteRaw: bindToProviderScope(enqueueRecords),\n\t\t\twaitForBackpressure: bindToProviderScope(async () => {}),\n\t\t};\n\t\treturn createRpcConnectionHandler(runtimeHost, taggedSink, {\n\t\t\tsessionId,\n\t\t\tshutdownHandler: bindToProviderScope(requestClose),\n\t\t\tdisposeRuntime: false,\n\t\t\teventFlushScheduler: (flush) => flush(),\n\t\t\t...options,\n\t\t});\n\t});\n\tawait handler.ready;\n\treturn {\n\t\thandle: (command) => runWithProviderScope(entry.scope, () => handler.handleInputLine(JSON.stringify(command))),\n\t\tcancelPendingExtensionUiRequests: () =>\n\t\t\trunWithProviderScope(entry.scope, () => handler.cancelPendingExtensionUiRequests()),\n\t\trerenderComponents: () => runWithProviderScope(entry.scope, () => handler.rerenderComponents()),\n\t\tdispose: () => {\n\t\t\ttoolSpans.closeAll();\n\t\t\treturn runWithProviderScope(entry.scope, () => handler.dispose());\n\t\t},\n\t};\n}\n"]}

package/dist/modes/rpc/session-command-router.d.ts

@@ -49,8 +49,24 @@ export declare class SessionCommandRouter {
     private readonly canExitWhenEmpty?;
     private sweepTimer;
     private emptySince;
+    /** Halves the idle window while the host reports memory pressure; never refuses work. */
+    private memoryPressure;
     constructor(registry: Pick<RpcSessionRegistry, "openSession" | "peek" | "getForCommand" | "beginClose" | "close" | "closeMarked" | "list" | "size">, writer: SessionEventWriter, defaults: Pick<RpcSessionLaunchProfile, "cwd" | "permissionPreset" | "creationModel" | "initialThinkingLevel">, createBinding?: typeof createRpcSessionBinding, connectionOptions?: Parameters<typeof createRpcSessionBinding>[4], idle?: RpcSessionIdlePolicy);
+    /** Live sessions the host holds, including ones opening or closing. */
+    get sessionCount(): number;
+    /**
+     * Raised by the host's memory sampler. Under pressure idle sessions are parked at
+     * HALF the configured window, which returns their memory to the process sooner.
+     * Deliberately the only lever: the host never refuses or kills a session for memory.
+     */
+    setMemoryPressure(pressure: boolean): void;
+    /**
+     * Every routed command runs inside its session's attribution scope, so a stall the
+     * loop-lag watchdog observes right after this dispatch can name the session that
+     * caused it - and anything the command starts inherits the attribution.
+     */
     handle(command: RpcCommand): Promise<RpcResponse | undefined>;
+    private dispatch;
     dispose(): Promise<void>;
     /**
      * One occupancy sweep. Evicts open sessions idle longer than idleEvictionMs,
@@ -58,9 +74,11 @@ export declare class SessionCommandRouter {
      * (`AgentSession.isSessionBusy`: agent run, bash, background terminal jobs and
      * other published wake sources, compaction, barrier-held session work) - busy
      * sessions restart their idle clock instead, so work that outlives a turn is
-     * never killed. Fires onEmptyExit once the registry has STAYED empty for
-     * emptyExitMs with the exit permitted; any live session or connected client
-     * resets that window. Runs on an unref'd interval and is safe to call directly.
+     * never killed. While the host reports memory pressure the window is HALVED, so an
+     * idle session's memory returns to the process sooner. Fires onEmptyExit once the
+     * registry has STAYED empty for emptyExitMs with the exit permitted; any live session
+     * or connected client resets that window. Runs on an unref'd interval and is safe to
+     * call directly.
      */
     sweepIdleSessions(): void;
     /**
@@ -68,6 +86,11 @@ export declare class SessionCommandRouter {
      * close_session, draining every attachment because eviction ends the shared
      * session, not one client's claim. Races with concurrent lifecycle paths are
      * tolerated the same way releaseOwnedSession tolerates them.
+     *
+     * Evicting a RETAINED session is a PARK, not a close: that session was opened to
+     * outlive its clients, so the terminal record names the file it reopens by
+     * (`session_parked`) instead of reporting a close nobody requested. The teardown
+     * itself is identical - retention never outlives the idle window.
      */
     private evictIdleSession;
     /** Drops per-connection records for a handle the host closed on its own. */

package/dist/modes/rpc/session-command-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-command-router.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/session-command-router.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAO9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,sBAAsB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAkB,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAKzG,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wGAAwG;IACxG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAaD,uFAAuF;AACvF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA0C;IAC/E,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyC;IAC3E,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGvB;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGvB;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgD;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsE;IACpG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAgB;IAClD,OAAO,CAAC,UAAU,CAA6C;IAC/D,OAAO,CAAC,UAAU,CAAqB;IAEvC,YACC,QAAQ,EAAE,IAAI,CACb,kBAAkB,EAClB,aAAa,GAAG,MAAM,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,CACnG,EACD,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,kBAAkB,GAAG,eAAe,GAAG,sBAAsB,CAAC,EAC9G,aAAa,GAAE,OAAO,uBAAiD,EACvE,iBAAiB,GAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAM,EACrE,IAAI,CAAC,EAAE,oBAAoB,EAkB3B;IAEK,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAqDlE;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAW7B;IAED;;;;;;;;;OASG;IACH,iBAAiB,IAAI,IAAI,CA0BxB;IAED;;;;;OAKG;YACW,gBAAgB;IAyB9B,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,eAAe;YAiBT,IAAI;IA6HlB;;;;OAIG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgE3D;IAED;;;;;;;;;;OAUG;YACW,mBAAmB;IAkBjC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAYlB,kFAAkF;IAClF,OAAO,CAAC,aAAa;YAQP,KAAK;IAoCnB,qGAAqG;IACrG,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;YACW,aAAa;IA6B3B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,IAAI;CAWZ"}
+{"version":3,"file":"session-command-router.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/session-command-router.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAW9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,sBAAsB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAkB,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAKzG,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wGAAwG;IACxG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAaD,uFAAuF;AACvF,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA0C;IAC/E,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyC;IAC3E,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGvB;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGvB;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgD;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsE;IACpG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAgB;IAClD,OAAO,CAAC,UAAU,CAA6C;IAC/D,OAAO,CAAC,UAAU,CAAqB;IACvC,yFAAyF;IACzF,OAAO,CAAC,cAAc,CAAS;IAE/B,YACC,QAAQ,EAAE,IAAI,CACb,kBAAkB,EAClB,aAAa,GAAG,MAAM,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,CACnG,EACD,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,kBAAkB,GAAG,eAAe,GAAG,sBAAsB,CAAC,EAC9G,aAAa,GAAE,OAAO,uBAAiD,EACvE,iBAAiB,GAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAM,EACrE,IAAI,CAAC,EAAE,oBAAoB,EAkB3B;IAED,uEAAuE;IACvE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAEzC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAG5D;YAEa,QAAQ;IAoEhB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAW7B;IAED;;;;;;;;;;;OAWG;IACH,iBAAiB,IAAI,IAAI,CA2BxB;IAED;;;;;;;;;;OAUG;YACW,gBAAgB;IAgC9B,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,eAAe;YAiBT,IAAI;IA4IlB;;;;OAIG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgE3D;IAED;;;;;;;;;;OAUG;YACW,mBAAmB;IAkBjC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAYlB,kFAAkF;IAClF,OAAO,CAAC,aAAa;YAQP,KAAK;IA4CnB,qGAAqG;IACrG,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;YACW,aAAa;IA6B3B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,IAAI;CAWZ"}

package/dist/modes/rpc/session-command-router.js

@@ -1,7 +1,9 @@
 import { VERSION } from "../../config.js";
 import { buildRpcSessionState } from "./connection-handler.js";
-import { AUTO_TITLE_SESSIONS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, } from "./custom-capability.js";
-import { RPC_ERROR_MISSING_SESSION_ID, RPC_ERROR_OPEN_FAILED, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_UNKNOWN_SESSION, } from "./rpc-types.js";
+import { AUTO_TITLE_PER_SESSION_CAPABILITY, AUTO_TITLE_SESSIONS_CAPABILITY, MEDIA_PLACEHOLDERS_CAPABILITY, RETAIN_ON_DISCONNECT_CAPABILITY, SESSION_CONTEXT_CAPABILITY, SESSION_KIND_CAPABILITY, } from "./custom-capability.js";
+import { sessionAutoTitleError, sessionContextError, sessionKindError } from "./rpc-input-validation.js";
+import { RPC_ERROR_INVALID_LAUNCH_PROFILE, RPC_ERROR_INVALID_SESSION_CONTEXT, RPC_ERROR_INVALID_SESSION_KIND, RPC_ERROR_MISSING_SESSION_ID, RPC_ERROR_OPEN_FAILED, RPC_ERROR_SESSION_CLOSING, RPC_ERROR_UNKNOWN_SESSION, } from "./rpc-types.js";
+import { runWithSessionAttribution } from "./session-attribution.js";
 import { createRpcSessionBinding } from "./session-binding.js";
 import { RpcSessionRegistryError } from "./session-registry.js";
 const controls = new Set(["get_protocol_info", "open_session", "close_session", "list_sessions"]);
@@ -21,6 +23,8 @@ export class SessionCommandRouter {
         this.widths = new Map();
         this.pendingCapabilities = new Map();
         this.finalizations = new Map();
+        /** Halves the idle window while the host reports memory pressure; never refuses work. */
+        this.memoryPressure = false;
         this.registry = registry;
         this.writer = writer;
         this.defaults = defaults;
@@ -38,15 +42,41 @@ export class SessionCommandRouter {
             this.sweepTimer.unref?.();
         }
     }
-    async handle(command) {
+    /** Live sessions the host holds, including ones opening or closing. */
+    get sessionCount() {
+        return this.registry.size;
+    }
+    /**
+     * Raised by the host's memory sampler. Under pressure idle sessions are parked at
+     * HALF the configured window, which returns their memory to the process sooner.
+     * Deliberately the only lever: the host never refuses or kills a session for memory.
+     */
+    setMemoryPressure(pressure) {
+        this.memoryPressure = pressure;
+    }
+    /**
+     * Every routed command runs inside its session's attribution scope, so a stall the
+     * loop-lag watchdog observes right after this dispatch can name the session that
+     * caused it - and anything the command starts inherits the attribution.
+     */
+    handle(command) {
+        const sessionId = "sessionId" in command ? command.sessionId : undefined;
+        return runWithSessionAttribution({ sessionId }, () => this.dispatch(command));
+    }
+    async dispatch(command) {
         if (command.type === "get_protocol_info") {
             const capabilities = new Set([
                 "multi_session",
                 AUTO_TITLE_SESSIONS_CAPABILITY,
                 MEDIA_PLACEHOLDERS_CAPABILITY,
-                // Host capability, not a client opt-in: only a multi-session host owns the
-                // attachment refcount `open_session.retain_on_disconnect` detaches from.
+                // Host capabilities, not client opt-ins: only a multi-session host owns the
+                // attachment refcount `open_session.retain_on_disconnect` detaches from, the
+                // per-session launch profile `context`/`auto_title` travel on, and the session
+                // listing `kind` filters.
                 RETAIN_ON_DISCONNECT_CAPABILITY,
+                SESSION_CONTEXT_CAPABILITY,
+                SESSION_KIND_CAPABILITY,
+                AUTO_TITLE_PER_SESSION_CAPABILITY,
                 ...(this.connectionOptions?.capabilities ?? []),
             ]);
             return {
@@ -62,14 +92,21 @@ export class SessionCommandRouter {
                 },
             };
         }
-        if (command.type === "list_sessions")
+        if (command.type === "list_sessions") {
+            // Worker sessions are machine-driven work: a client sees them only by asking, and
+            // the opaque context blob travels only on that listing, never to every connection.
+            const rows = this.registry.list();
+            const sessions = command.include_workers === true
+                ? rows
+                : rows.filter((row) => row.kind !== "worker").map(({ context: _context, ...row }) => row);
             return {
                 id: command.id,
                 type: "response",
                 command: "list_sessions",
                 success: true,
-                data: { sessions: this.registry.list() },
+                data: { sessions },
             };
+        }
         if (command.type === "open_session")
             return this.openWithBarrier(command);
         if (command.type === "close_session")
@@ -117,13 +154,16 @@ export class SessionCommandRouter {
      * (`AgentSession.isSessionBusy`: agent run, bash, background terminal jobs and
      * other published wake sources, compaction, barrier-held session work) - busy
      * sessions restart their idle clock instead, so work that outlives a turn is
-     * never killed. Fires onEmptyExit once the registry has STAYED empty for
-     * emptyExitMs with the exit permitted; any live session or connected client
-     * resets that window. Runs on an unref'd interval and is safe to call directly.
+     * never killed. While the host reports memory pressure the window is HALVED, so an
+     * idle session's memory returns to the process sooner. Fires onEmptyExit once the
+     * registry has STAYED empty for emptyExitMs with the exit permitted; any live session
+     * or connected client resets that window. Runs on an unref'd interval and is safe to
+     * call directly.
      */
     sweepIdleSessions() {
         const now = this.idleNow();
-        if (Number.isFinite(this.idleEvictionMs)) {
+        const idleEvictionMs = this.memoryPressure ? this.idleEvictionMs / 2 : this.idleEvictionMs;
+        if (Number.isFinite(idleEvictionMs)) {
             for (const { sessionId, status } of this.registry.list()) {
                 if (status !== "open")
                     continue;
@@ -135,7 +175,7 @@ export class SessionCommandRouter {
                     entry.lastCommandAt = now;
                     continue;
                 }
-                if (now - entry.lastCommandAt >= this.idleEvictionMs)
+                if (now - entry.lastCommandAt >= idleEvictionMs)
                     void this.evictIdleSession(sessionId);
             }
         }
@@ -158,8 +198,18 @@ export class SessionCommandRouter {
      * close_session, draining every attachment because eviction ends the shared
      * session, not one client's claim. Races with concurrent lifecycle paths are
      * tolerated the same way releaseOwnedSession tolerates them.
+     *
+     * Evicting a RETAINED session is a PARK, not a close: that session was opened to
+     * outlive its clients, so the terminal record names the file it reopens by
+     * (`session_parked`) instead of reporting a close nobody requested. The teardown
+     * itself is identical - retention never outlives the idle window.
      */
     async evictIdleSession(sessionId) {
+        // Read before the claim: the entry is gone once the teardown completes, and a park
+        // record without the session's path would not be actionable (so a retained session
+        // with no file to reopen by ends as an ordinary close).
+        const retained = this.registry.peek(sessionId);
+        const parkedPath = retained?.retainOnDisconnect === true ? retained.sessionPath : undefined;
         // A failed claim means an explicit close raced us and owns the entry now.
         const claim = this.tryClaimClose(sessionId, { drainAttachments: true });
         if (!claim)
@@ -168,12 +218,14 @@ export class SessionCommandRouter {
         binding?.cancelPendingExtensionUiRequests?.();
         this.forgetSessionOwnership(sessionId);
         if (claim.finalizer) {
-            await this.finalizeClose(sessionId, binding, () => this.writer.closeSession(sessionId, {
-                type: "response",
-                command: "close_session",
-                success: true,
-                data: {},
-            }));
+            await this.finalizeClose(sessionId, binding, () => parkedPath === undefined
+                ? this.writer.closeSession(sessionId, {
+                    type: "response",
+                    command: "close_session",
+                    success: true,
+                    data: {},
+                })
+                : this.writer.parkSession(sessionId, parkedPath));
         }
         else {
             await this.finalizations.get(sessionId)?.promise;
@@ -217,6 +269,18 @@ export class SessionCommandRouter {
         });
     }
     async open(command, owner) {
+        // The opaque per-session inputs are parsed HERE, at the wire boundary, so the
+        // registry, the runtime and the extensions downstream receive values already
+        // proven to satisfy every documented cap.
+        const kindError = sessionKindError(command.kind);
+        if (kindError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_SESSION_KIND}: ${kindError}`);
+        const contextError = sessionContextError(command.context);
+        if (contextError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_SESSION_CONTEXT}: ${contextError}`);
+        const autoTitleError = sessionAutoTitleError(command.auto_title);
+        if (autoTitleError)
+            return error(command.id, "open_session", `${RPC_ERROR_INVALID_LAUNCH_PROFILE}: ${autoTitleError}`);
         let opened;
         try {
             opened = await this.registry.openSession({
@@ -227,11 +291,15 @@ export class SessionCommandRouter {
                     ? { provider: command.provider, modelId: command.modelId }
                     : this.defaults.creationModel,
                 initialThinkingLevel: command.thinkingLevel ?? this.defaults.initialThinkingLevel,
+                sessionKind: command.kind,
+                sessionContext: command.context,
+                ...(typeof command.auto_title === "boolean" ? { autoTitle: command.auto_title } : {}),
             }, 
             // Host lifecycle policy, deliberately outside the immutable launch profile.
             { retainOnDisconnect: command.retain_on_disconnect === true });
             const openedSession = opened;
             const entry = this.registry.getForCommand(openedSession.sessionId, "open_session");
+            this.writer.setSessionKind(openedSession.sessionId, entry.kind);
             if (owner !== undefined) {
                 if (!this.writer.hasRegisteredConnectionCapabilities(owner))
                     this.writer.setConnectionCapabilities(owner, this.pendingCapabilities.get(owner) ?? this.connectionOptions?.capabilities ?? []);
@@ -461,6 +529,15 @@ export class SessionCommandRouter {
             success: true,
             data: {},
         };
+        // A close releases the CALLER's attachment, and routing handles are public on a
+        // shared host (`list_sessions` publishes every one of them), so ownership - not
+        // knowledge of the handle - authorizes it: a connection that never attached holds
+        // no attachment, and answering it would release another client's claim and could
+        // tear down a session it never opened. A host with no per-connection identity
+        // (stdio) has no ownership to check and keeps answering every close as before.
+        const owner = this.writer.currentConnection();
+        if (owner !== undefined && this.sessionsByConnection.get(owner)?.has(command.sessionId) !== true)
+            return error(command.id, "close_session", RPC_ERROR_UNKNOWN_SESSION);
         const reply = this.writer.reserveCloseResponse(command.sessionId, response);
         if (!reply)
             return undefined;
@@ -475,7 +552,6 @@ export class SessionCommandRouter {
             return error(command.id, "close_session", this.code(cause));
         }
         try {
-            const owner = this.writer.currentConnection();
             if (owner !== undefined)
                 this.releaseOwnerAttachment(owner, command.sessionId);
             if (claim.finalizer) {