aiterm-mcp 0.61.2 → 0.61.4

package/CHANGELOG.md

@@ -7,11 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.4] - 2026-10-22
+
+### 修正
+
+- POSIXのnative実行口で最初の`agent_launch`がtmuxソケット未作成時に`EXECUTION_UNSUPPORTED`で止まっていた。発行直前にも空状態を確かめ、最初の`new-session`自身が作ったserverのPID・開始識別子とsession IDを実receiptから照合して起動する。補助sessionや入力再送は作らず、読取不能・receipt不一致は未確認で止める。
+
+## [0.61.3] - 2026-10-22
+
+### Fixed
+
+- An unknown send in the opt-in POSIX native execution entry no longer permanently blocks an explicit `pty_close` of that one session. The close is pinned to its expected launch/native identity; only confirmed close and absence release the failed-send admission. The original request remains unknown and is never replayed. Issued work, unknown management operations, and uncertain identities stay blocked.
+- Native handler errors retain their original explanation alongside the typed execution error. A failed recovery close preserves the old launch metadata and reports the native failure.
+
 ## [0.61.2] - 2026-10-22
 
 ### 修正
 
-- tmuxがまだ起動しておらず、対象ソケットが存在しない時、新規実行の登録が`EXECUTION_UNCONFIRMED`で止まっていた。実行世代の観測でもソケット未作成を空状態として扱い、初回の席を起動できるようにした。別ソケットや権限・接続の異常は引き続き不明として止める。
+- tmuxがまだ起動しておらず、対象ソケットが存在しない時、新規実行の登録が`EXECUTION_UNCONFIRMED`で止まっていた。実行世代の観測でもソケット未作成を空状態として扱う。別ソケットや権限・接続の異常は引き続き不明として止める。この版では、その次の初回席作成が既存serverを要求しており、冷間起動はまだ完了しなかった。
 
 ## [0.61.1] - 2026-10-22
 
@@ -2715,7 +2728,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...HEAD
+[0.61.4]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...v0.61.4
+[0.61.3]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...v0.61.3
 [0.61.2]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.1...v0.61.2
 [0.61.1]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.0...v0.61.1
 [0.61.0]: https://github.com/kitepon/aiterm-mcp/compare/v0.60.1...v0.61.0

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.2** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.4** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -731,11 +731,12 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 `pty_send` はコマンドやpromptの意味を判定せず、指定された本文を端末へ送る。既定ではESC・ブラケットペースト終端などをサニタイズし、`pty_read`も制御文字を無害化して返す（`raw: true`はそのまま扱う）。コマンドの許可・拒否はshell、接続先、起動したharnessが所有する。
 
-1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。
+1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。 POSIXの明示native execution構成では、unknown sendになった対象1席も`pty_close`で閉じて再作成できる。元requestはunknownのまま保持し、再送しない。発行中の操作、管理close自体のunknown、native identityが不明な席は引き続き拒否する。
 
 ## 人が覗く
 
 セッションは共有tmux socket（Windows nativeはpsmux namespace）上にある。`pty_open`／`agent_launch`の戻り値に表示されるattachコマンドで、人間がClaude／Codex／Grok／Cursor harnessの同じ端末へ入り、途中でキーボードを引き取れる。
+POSIXでは、tmuxのソケットがまだ無くても最初の`agent_launch`でserverを起動できる。Aitermは作成したsessionとserverを実際のreceiptから照合して受付を確定し、不明な結果を入力の再送で補わない。
 
 ## 要件
 

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.2** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.4** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -789,11 +789,12 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 `pty_send` does not interpret command or prompt meaning; it delivers the requested text to the terminal. By default it sanitizes ESC and bracketed-paste terminators, while `pty_read` neutralizes control characters in returned output (`raw: true` keeps them unchanged). The shell, remote endpoint, or launched harness owns command authorization.
 
-Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through its multiplexer in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell or PowerShell is in the foreground is encoded as one newline-free input (`eval` for POSIX shells; a dot-sourced, UTF-8 Base64-decoded scriptblock for PowerShell): the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally wrap the whole text once in `ESC[200~/201~` and stream the wrapped text in the same chunks, so the agent TUI sees one paste (an image path is never split across pastes), hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; use `pty_list` to confirm the affected session, close it with `pty_close`, then recreate the same session ID. There is no public kill-all tool.
+Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session are serialized across aiterm processes so chunks cannot interleave. Every OS pastes through its multiplexer in UTF-8-safe 256-byte chunks with a 10 ms drain interval; macOS, Linux, and WSL2 have all demonstrated silent middle/trailing loss when a long input is pushed without that boundary. Sanitized multiline text sent while a POSIX shell or PowerShell is in the foreground is encoded as one newline-free input (`eval` for POSIX shells; a dot-sourced, UTF-8 Base64-decoded scriptblock for PowerShell): the shell receives the complete script before it runs the first line, so a pager or REPL started mid-script cannot consume later lines as interactive keystrokes. Single-line input, `raw:true`, and non-shell frontends remain direct PTY pastes. Agent dispatches additionally wrap the whole text once in `ESC[200~/201~` and stream the wrapped text in the same chunks, so the agent TUI sees one paste (an image path is never split across pastes), hardening prompt injection against mid-word key-interpretation corruption and dropped submits. If a later chunk fails, aiterm reports the partial-send state and does not press Enter automatically. A lock left by a terminated sender fails closed before sending; use `pty_list` to confirm the affected session, close it with `pty_close`, then recreate the same session ID. There is no public kill-all tool. In the opt-in POSIX native execution entry, an unknown send can also be recovered by explicitly closing that one session with `pty_close`, then recreating it. The original request remains unknown and must not be replayed. Issued work, unknown management closes, and uncertain native identity remain blocked.
 
 ## A human can watch
 
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
+On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 
 ## Requirements
 

package/dist/core.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
 import { executionPointSchema } from "./execution-contract.js";
-import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary } from "./execution-effect.js";
+import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
 import { isCursorMcpClient } from "aiterm-steer-delivery";
@@ -1869,7 +1869,12 @@ function closeSessionInternal(name, observeDependency = true, o = {}) {
     assertSessionClosable(name);
     if (o.letHarnessExit)
         letClaudeExitBeforeClose(name);
-    (observeDependency ? tmux : tmuxCleanup)("kill-session", "-t", name);
+    const killed = (observeDependency ? tmux : tmuxCleanup)("kill-session", "-t", name);
+    if (executionManagementCloseTarget(name) && killed.code !== 0) {
+        // Recovery must not erase the old launch metadata or report closed when
+        // its one pinned native close failed. Keep the original send uncertainty.
+        throw new AitermError(`tmux sessionを閉じられませんでした: ${killed.stderr.trim() || `code=${killed.code}`}`, 2);
+    }
     for (const p of [logpath(name), offsetpath(name), lastcmdpath(name), markpath(name), sendLockPath(name)]) {
         try {
             fs.unlinkSync(p);

package/dist/execution-dispatch.js

@@ -140,12 +140,15 @@ export function createExecutionDispatcher(bindings) {
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
                     const context = { schema: "aiterm.execution-source.v1", source };
                     const supplied = executionRefFromMeta(fixedExtra._meta);
+                    // A host's explicit session close is a management RPC with its own
+                    // existing process/request identity, not a delivery or resend.
+                    const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
                     let directRequest = null;
                     let frozenParent = null;
-                    if (!reference && client !== "bellteam" && native) {
+                    if (!reference && (client !== "bellteam" || hostClose) && native) {
                         directRequest = executionRequestSchema.options[4].parse({ kind: "mcp", process_pid: native.pid,
                             process_started_identity: native.started_identity, request_id: fixedExtra.requestId,
                             tool: route.tool, target_session_id: route.target });
@@ -186,7 +189,7 @@ export function createExecutionDispatcher(bindings) {
                     }
                     else {
                         // BellTeam must retain its existing delivery/room/call reference.
-                        if (client === "bellteam" || !directRequest)
+                        if ((client === "bellteam" && !hostClose) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
                         if (route.stage === "send" && !current.point)
@@ -204,15 +207,21 @@ export function createExecutionDispatcher(bindings) {
                     const expected = status.relation.target?.launch ?? (status.reservation.target.expected_launch_id
                         ? { session_id: route.target, launch_id: status.reservation.target.expected_launch_id } : null);
                     const requestMeta = { ...fixedExtra._meta, [EXECUTION_REQUEST_META_KEY]: reference };
-                    return await runDeferredBoundExecution(bindings.service, requestMeta, route.stage, route.target, async () => {
+                    let handlerFailure;
+                    const bound = await runDeferredBoundExecution(bindings.service, requestMeta, route.stage, route.target, async () => {
                         const result = await withExecutionRequest(reference.request, () => body(args, { ...fixedExtra, _meta: requestMeta }), {
                             source: status.source.status === "verified" ? status.source.point : null,
                             client_name: client ?? null, native_identity: native,
                             metadata: fixedExtra._meta === undefined ? null : fixedExtra._meta,
                             ...(captureNativeParent ? { native_parent: frozenParent } : {}),
                         });
-                        if (result.isError)
+                        if (result.isError) {
+                            // Keep the original native/handler refusal for the caller. It is
+                            // still an error, never an accepted receipt or replay permission;
+                            // the service determines whether an effect crossed its gate.
+                            handlerFailure = result;
                             throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                        }
                         // Missing/invalid binding evidence is returned as null. The wrapper
                         // retains the genuine successful receipt if binding then fails; it
                         // must not turn a valid accepted action into permission to resend.
@@ -263,6 +272,8 @@ export function createExecutionDispatcher(bindings) {
                         }
                         return { result, target };
                     }, cancellation?.assert);
+                    return handlerFailure && bound.isError ? { ...handlerFailure,
+                        _meta: { ...handlerFailure._meta, ...bound._meta } } : bound;
                 }
                 catch (error) {
                     return executionErrorResult(error);
@@ -276,7 +287,7 @@ export function createExecutionDispatcher(bindings) {
                 const failure = executionErrorResult(new ExecutionError("EXECUTION_UNCONFIRMED", "possible"));
                 // Preserve a genuine accepted result even when cancellation recording
                 // failed. Status-only uncertainty must never become permission to resend.
-                return result.isError ? failure : { ...result, _meta: { ...result._meta,
+                return { ...result, _meta: { ...result._meta,
                         [EXECUTION_ERROR_META_KEY]: failure._meta[EXECUTION_ERROR_META_KEY] } };
             }
             return result;

package/dist/execution-effect.js

@@ -197,10 +197,13 @@ export function prepareExecutionCreation() {
         refuse(scope, "EXECUTION_UNSUPPORTED");
     try {
         const server = scope.creation.prepare();
-        if (!Number.isSafeInteger(server?.pid) || server.pid < 1 || typeof server.started_identity !== "string" || !server.started_identity)
+        if (server !== null && (!Number.isSafeInteger(server?.pid) || server.pid < 1
+            || typeof server.started_identity !== "string" || !server.started_identity))
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-        scope.creationServer = { ...server };
+        if (server)
+            scope.creationServer = { ...server };
         scope.creationPrepared = true;
+        return server === null;
     }
     catch (error) {
         scope.failure = new ExecutionError(error instanceof ExecutionError ? error.code : "EXECUTION_UNCONFIRMED", "not_started");
@@ -208,7 +211,7 @@ export function prepareExecutionCreation() {
     }
 }
 /** Private core metadata stamp, derived only from this frame's actual create
- * receipt and pre-existing native server proof. Not a tool input or lookup.
+ * receipt and verified native server proof. Not a tool input or name lookup.
  */
 export function executionCreatedNativeBinding(session) {
     const scope = scopes.getStore();
@@ -237,7 +240,14 @@ export function captureExecutionCreatedNative(receipt) {
     if (!parsed || parsed[2] !== scope.session || (scope.createdNative && scope.createdNative !== parsed[1]))
         refuse(scope, "EXECUTION_CONFLICT");
     try {
-        scope.creation.native(scope.session, parsed[1], Number(parsed[3]));
+        const server = scope.creation.native(scope.session, parsed[1], Number(parsed[3]));
+        if (server) {
+            if (!Number.isSafeInteger(server.pid) || server.pid < 1 || typeof server.started_identity !== "string" || !server.started_identity)
+                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+            scope.creationServer = { ...server };
+        }
+        if (!scope.creationServer)
+            throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
     }
     catch (error) {
         scope.failure = new ExecutionError(error instanceof ExecutionError ? error.code : "EXECUTION_UNCONFIRMED", "possible");
@@ -286,6 +296,21 @@ export function bindExecutionNativeTarget(session, nativeId) {
         refuse(scope, "EXECUTION_CONFLICT");
     scope.nativeTargets.add(nativeId);
 }
+/** Bound only by the management-close wrapper, never tool arguments. The
+ * ordinary core close/cleanup keeps using its session name; native commands
+ * are pinned to the independently captured native ID through the same gate.
+ */
+export function bindExecutionManagementCloseTarget(session, nativeId) {
+    const scope = scopes.getStore();
+    if (!scope || scope.session !== session || scope.didIssue || scope.creation || scope.interrupt || !/^\$\d+$/.test(nativeId))
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    scope.managementCloseTarget = nativeId;
+    scope.nativeTargets.add(nativeId);
+}
+export function executionManagementCloseTarget(session) {
+    const scope = scopes.getStore();
+    return scope?.session === session ? scope.managementCloseTarget : undefined;
+}
 export function beforeExecutionEffect(session, verify) {
     const scope = scopes.getStore();
     if (!scope) {
@@ -376,7 +401,7 @@ export function guardTmuxExecution(input) {
                 if (!parsed || parsed[1] !== scope.session)
                     refuse(scope, "EXECUTION_CONFLICT");
                 if (command !== "new-session")
-                    args[at + 1] = `${scope.createdNative ?? "=" + scope.session}${parsed[2] ?? ":"}`;
+                    args[at + 1] = `${scope.managementCloseTarget ?? scope.createdNative ?? "=" + scope.session}${parsed[2] ?? ":"}`;
             }
             effects = true;
         }

package/dist/execution-runtime.js

@@ -84,11 +84,13 @@ export function createExecutionRuntime(bindings) {
                             session_id: executionLaunchSchema.shape.session_id, native_id: z.string().regex(/^\$\d+$/),
                         }).strict()) }).strict().parse(bindings.observeNativeSessionsSync());
                     if (new Set(parsed.sessions.map(value => value.session_id)).size !== parsed.sessions.length
-                        || new Set(parsed.sessions.map(value => value.native_id)).size !== parsed.sessions.length)
+                        || new Set(parsed.sessions.map(value => value.native_id)).size !== parsed.sessions.length
+                        || (parsed.server === null && parsed.sessions.length > 0))
                         return { state: "unknown" };
+                    const server = parsed.server === null ? { server: null } : parsed.server ? { server: parsed.server } : {};
                     const target = parsed.sessions.find(value => value.session_id === session);
-                    return target ? { state: "present", native_id: target.native_id, ...(parsed.server ? { server: parsed.server } : {}) }
-                        : { state: "absent", ...(parsed.server ? { server: parsed.server } : {}) };
+                    return target ? { state: "present", native_id: target.native_id, ...server }
+                        : { state: "absent", ...server };
                 }
                 catch {
                     return { state: "unknown" };

package/dist/execution-service.js

@@ -41,6 +41,30 @@ function find(state, request) {
         throw new ExecutionError("EXECUTION_NOT_FOUND");
     return record;
 }
+const managementClose = (request) => request.kind === "mcp" && request.tool === "pty_close";
+/** Only a returned, unknown send may be displaced by an explicit close of
+ * that exact launch. Issued work, management/parent slots and other generations
+ * remain blockers. The record is never turned into accepted or not_sent.
+ */
+function recoverableSends(state, request, session, expected) {
+    if (!managementClose(request) || expected === null)
+        return [];
+    return state.slots.filter(slot => {
+        if (slot.session_id !== session || slot.expected_launch_id !== expected || slot.stage !== "send"
+            || slot.state !== "unknown" || !slot.request || same(slot.request, request))
+            return false;
+        if (slot.request.kind === "mcp" && !["pty_send", "claude_turn.issue"].includes(slot.request.tool))
+            return false;
+        const original = state.records.find(record => same(record.reservation.request, slot.request));
+        return original?.operations.send === "unknown" && !["issued", "unknown"].includes(original.operations.launch)
+            && original.relation.phase === "submitted_unknown" && original.relation.completion === "unknown"
+            && same(original.relation.target?.launch, { session_id: session, launch_id: expected });
+    });
+}
+function targetBlocked(state, request, session, expected) {
+    const recoverable = recoverableSends(state, request, session, expected);
+    return state.slots.some(slot => slot.session_id === session && !recoverable.includes(slot));
+}
 function view(state, record) {
     return executionRecordSchema.parse({ ...record,
         stopping: record.stopping || stopped(state, record.relation.source?.launch) || stopped(state, record.relation.target?.launch)
@@ -384,18 +408,40 @@ export class ExecutionService {
             if (record.operations.launch !== "preparing" || record.relation.lifecycle === "retired")
                 throw new ExecutionError("EXECUTION_CONFLICT");
             const native = this.runtime.nativeSessionSync(record.reservation.target.session_id);
-            if (native.state !== "absent" || !native.server)
+            if (native.state !== "absent" || native.server === undefined)
                 throw new ExecutionError("EXECUTION_UNSUPPORTED");
             return native.server;
         }, { readOnly: true });
     }
+    /** Private wrapper preparation for an explicit management close. No native
+     * effect or slot removal occurs here. The invoke gate independently rechecks
+     * this same identity immediately before every native command.
+     */
+    managementCloseNative(metaInput) {
+        const { request } = executionRefMetaSchema.parse(metaInput);
+        if (!managementClose(request))
+            return undefined;
+        if (!this.store.transactionSync)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return this.store.transactionSync(state => {
+            const record = find(state, request), target = record.reservation.target;
+            if (!recoverableSends(state, request, target.session_id, target.expected_launch_id).length)
+                return undefined;
+            if (record.operations.send !== "preparing" || targetBlocked(state, request, target.session_id, target.expected_launch_id))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            const native = this.runtime.nativeSessionSync?.(target.session_id);
+            if (native?.state !== "present" || !native.server)
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            return native.native_id;
+        }, { readOnly: true });
+    }
     verifyCreationServer(metaInput, expected) {
         const { request } = executionRefMetaSchema.parse(metaInput);
         if (!this.store.transactionSync)
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         this.store.transactionSync(state => {
             const record = find(state, request), native = this.runtime.nativeSessionSync?.(record.reservation.target.session_id);
-            if (!native?.server || !same(native.server, expected))
+            if (native?.state !== "absent" || !same(native.server, expected))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
         }, { readOnly: true });
     }
@@ -403,18 +449,23 @@ export class ExecutionService {
         const { request } = executionRefMetaSchema.parse(metaInput);
         if (!/^\$\d+$/.test(nativeId) || !this.store.transactionSync)
             throw new ExecutionError("EXECUTION_UNSUPPORTED", "possible");
-        this.store.transactionSync(state => {
+        return this.store.transactionSync(state => {
             const record = find(state, request), slot = state.slots.find(value => same(value.request, request) && value.stage === "launch");
+            // A cold first new-session creates the server itself. Prove its owner
+            // from the exact receipt and a stable native listing before stamping it.
+            const observed = expectedServer ? null : this.runtime.nativeSessionSync?.(session);
+            const server = expectedServer ?? (observed?.state === "present" && observed.native_id === nativeId ? observed.server : undefined);
             if (!slot || slot.state !== "issued" || record.operations.launch !== "issued" || slot.session_id !== session
                 || record.reservation.target.expected_launch_id !== null || record.relation.lifecycle === "retired"
-                || expectedServer.pid !== receiptPid
+                || !server || server.pid !== receiptPid
                 || (slot.created_native_id && slot.created_native_id !== nativeId)
-                || (slot.created_server && !same(slot.created_server, expectedServer)))
+                || (slot.created_server && !same(slot.created_server, server)))
                 throw new ExecutionError("EXECUTION_CONFLICT", "possible");
             // Preserve this genuine native receipt even if a stop is already fencing
             // its caller. Binding metadata does not authorize another native action.
             slot.created_native_id = nativeId;
-            slot.created_server = expectedServer;
+            slot.created_server = server;
+            return server;
         });
     }
     bindCreatedLaunch(metaInput, input) {
@@ -564,7 +615,7 @@ export class ExecutionService {
             }
             sourceAdmission(state, source.point, args.source_session_id);
             const target = args.reservation.target;
-            if (state.slots.some(slot => slot.session_id === target.session_id))
+            if (targetBlocked(state, args.reservation.request, target.session_id, target.expected_launch_id))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             const current = await this.runtime.observe(target.session_id);
             this.expectTarget(current, target.expected_launch_id, target.session_id);
@@ -606,6 +657,7 @@ export class ExecutionService {
     }
     async invokeInternal(metaInput, stage, body, targetSessionId, deferred, admission) {
         const { request } = executionRefMetaSchema.parse(metaInput);
+        let expectedCloseNative;
         if (deferred && (!this.store.transactionSync || !this.runtime.observeSync))
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         await this.store.transaction(async (state) => {
@@ -625,6 +677,16 @@ export class ExecutionService {
             if (record.reservation.source.launch && !relation.source)
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
             if (deferred) {
+                const target = record.reservation.target;
+                if (recoverableSends(state, request, target.session_id, target.expected_launch_id).length) {
+                    if (targetBlocked(state, request, target.session_id, target.expected_launch_id))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    this.expectTarget(await this.runtime.observe(target.session_id), target.expected_launch_id, target.session_id);
+                    const native = this.runtime.nativeSessionSync?.(target.session_id);
+                    if (native?.state !== "present" || !native.server)
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    expectedCloseNative = { native_id: native.native_id, server: structuredClone(native.server) };
+                }
                 record.operations[stage] = "preparing";
                 return; // no native effect or target slot yet; stop can cancel this
             }
@@ -654,6 +716,14 @@ export class ExecutionService {
             state.slots.push({ session_id: target.session_id, expected_launch_id: expected, stage, state: "issued", request });
         });
         let issued = !deferred, finished = false;
+        const checkCloseNative = (session) => {
+            if (!expectedCloseNative)
+                return;
+            const native = this.runtime.nativeSessionSync?.(session);
+            if (native?.state !== "present" || native.native_id !== expectedCloseNative.native_id
+                || !same(native.server, expectedCloseNative.server))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+        };
         const checkOrIssue = (commit, preparation) => {
             admission?.();
             const prepared = () => { admission?.(); return preparation(); };
@@ -688,6 +758,7 @@ export class ExecutionService {
                             throw new ExecutionError("EXECUTION_STALE_GENERATION");
                     }
                     const current = this.runtime.observeSync(slot.session_id);
+                    checkCloseNative(slot.session_id);
                     if (current.state === "present" && stopped(state, current.launch))
                         throw new ExecutionError("EXECUTION_STOPPING");
                     if (slot.created_native_id) {
@@ -725,11 +796,12 @@ export class ExecutionService {
                         throw new ExecutionError("EXECUTION_STALE_GENERATION");
                 }
                 const target = record.reservation.target;
-                if (state.slots.some(slot => slot.session_id === target.session_id))
+                if (targetBlocked(state, request, target.session_id, target.expected_launch_id))
                     throw new ExecutionError("EXECUTION_UNCONFIRMED");
                 const expected = relation.target?.launch.launch_id ?? target.expected_launch_id;
                 const current = this.runtime.observeSync(target.session_id);
                 this.expectTarget(current, expected, target.session_id);
+                checkCloseNative(target.session_id);
                 if (current.state === "present" && stopped(state, current.launch))
                     throw new ExecutionError("EXECUTION_STOPPING");
                 if ((stage === "launch" && current.state !== "absent") || (stage === "send" && current.state !== "present"))
@@ -830,8 +902,14 @@ export class ExecutionService {
             if (state.stopping.some(value => same(value, record.relation.source?.launch)) && !state.stopping.some(value => same(value, targetPoint.launch)))
                 state.stopping.push(targetPoint.launch);
             state.slots = state.slots.filter(value => !same(value.request, request));
-            if (closing)
+            if (closing) {
+                // Actual management close plus confirmed absence releases only these
+                // failed send admissions. Old callbacks still fail their missing-slot
+                // guard, and their records remain unknown and cannot be invoked again.
+                const recovered = recoverableSends(state, request, slot.session_id, expected);
+                state.slots = state.slots.filter(value => !recovered.includes(value));
                 this.interruptRelations(state, targetPoint.launch);
+            }
             return view(state, record);
         }).catch(async () => {
             // The side effect already returned, but its result could not be safely
@@ -1326,6 +1404,8 @@ export class ExecutionService {
     interruptRelations(state, launch) {
         for (const record of state.records)
             if (same(record.relation.target?.launch, launch)) {
+                if (record.operations.launch === "unknown" || record.operations.send === "unknown")
+                    continue;
                 record.relation.completion = "interrupted";
                 record.relation.target_fence = "closed";
             }

package/dist/execution-tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
 import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY } from "./execution-wire.js";
-import { withExecutionEffectScope } from "./execution-effect.js";
+import { withExecutionEffectScope, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { immediateStopInputSchema, immediateStopResultSchema } from "./execution-immediate-stop.js";
 export function executionBindingMeta(record) {
     return { [EXECUTION_BINDING_META_KEY]: executionBindingSchema.parse({
@@ -119,14 +119,19 @@ async function runExecutionReceipt(service, meta, stage, body, targetSessionId,
         const result = deferred
             ? await service.invokeDeferred(ref, stage, async (issue, prepare) => {
                 let expectedServer;
-                const action = await withExecutionEffectScope(targetSessionId, issue, run, stage === "launch" ? {
+                const action = await withExecutionEffectScope(targetSessionId, issue, () => {
+                    const native = service.managementCloseNative(ref);
+                    if (native)
+                        bindExecutionManagementCloseTarget(targetSessionId, native);
+                    return run();
+                }, stage === "launch" ? {
                     prepare: () => { expectedServer = service.prepareCreation(ref); return expectedServer; },
-                    verifyServer: () => { if (!expectedServer)
+                    verifyServer: () => { if (expectedServer === undefined)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED"); service.verifyCreationServer(ref, expectedServer); },
                     native: (session, nativeId, serverPid) => {
-                        if (!expectedServer)
+                        if (expectedServer === undefined)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-                        service.captureCreatedNative(ref, session, nativeId, expectedServer, serverPid);
+                        return service.captureCreatedNative(ref, session, nativeId, expectedServer, serverPid);
                     },
                     launch: launch => service.bindCreatedLaunch(ref, launch),
                 } : undefined, prepare);

package/dist/tmux-runtime.js

@@ -493,12 +493,12 @@ export function registeredSessionEnvironment(name) {
 export function tmuxNewSession(observe, name, launch, registered = []) {
     const guarded = hasExecutionCreationScope();
     // Windows per-session server creation needs a separate native-owner proof.
-    // The legacy public launcher is unchanged; guarded creation cannot assume
-    // POSIX's existing shared-server identity or bootstrap a missing server.
+    // The legacy public launcher is unchanged.
+    let cold = false;
     if (guarded) {
         if (isWin)
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-        prepareExecutionCreation();
+        cold = prepareExecutionCreation();
     }
     const printNative = guarded ? ["-P", "-F", "#{session_id}\t#{session_name}\t#{pid}"] : [];
     if (isWin) {
@@ -508,6 +508,15 @@ export function tmuxNewSession(observe, name, launch, registered = []) {
         return result;
     }
     const env = sessionCallerEnvironment();
+    if (cold) {
+        // With no server, there is no global environment to adjust. The first
+        // new-session inherits this caller's environment and prints its native ID
+        // and newly created server PID for the guarded receipt proof.
+        const r = runTmux(observe, undefined, ["new-session", "-d", "-s", name, ...printNative, ...launch.args, launch.shell], env);
+        if (r.code === 0 || r.stdout)
+            captureExecutionCreatedNative(r.stdout);
+        return r;
+    }
     const wildcard = tmuxHasSessionEnvironmentFlags();
     // tmux は起動時に PWD を共通環境へ足す。
     const others = new Set(["PWD"]);

package/docs/DESIGN.md

@@ -28,8 +28,10 @@ native emit直前に照合したhook参照は既存deliveryへ保存する。Cod
 POSIXのraw tty回復もnative作用であり、tmux打鍵と同じ受付を通す。ttyは正確なsession selectorで読み、
 実stty直前にも同じdeviceを確認する。停止や世代/tty交代後に古いdeviceへ回復を発行しない。
 一つのRPCが複数のnative作用を発行するときも、各回に同じissued slotとsource/target世代・停止を再確認する。
-新launchは、既存POSIX serverのnative owner、new-session自身のnative ID receipt、core内部で生成したlaunch世代を
-同じ要求slotへ段階結合する。物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。
+新launchは、既存POSIX serverのnative owner、またはserver未作成の完全な空観測を受付時と発行直前に確認する。
+冷間時は最初のnew-session自身でserverを作り、その実receiptのnative IDとserver PIDを、作成後の安定したnative一覧とprocess開始識別子で照合する。
+既存server時も冷間時も、作成したsessionのnative ID・server owner・core内部のlaunch世代を同じ要求slotへ段階結合する。
+物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。冷間起動のための補助sessionや再送は作らない。
 作成時のnative ID/server ownerをmanaged metadataへ保存し、private runtimeの世代読取と期待closeでも再照合する。
 古いmetadataの欠測を現観測で補わず、既存席の自動登録は行わない。
 証拠の無い新server起動、Windows固有のserver作成、auto-name/通常PTY/auth等はまだunsupported。
@@ -424,6 +426,15 @@ ADR 0074（repositoryの`docs/adr/0074-agent-model-catalog.md`）。
 境界失敗は明示errorにする。retry、別model、別harness、別backendへ自動fallbackしない。
 stale send lockは並行processとのABAを避けるため自動削除せず、公開APIでは対象sessionを`pty_close`して
 同じIDで再作成する。全session一括停止は公開しない。
+POSIXの明示native execution構成では、返却済みsendのunknown枠が対象席の管理closeまで
+永久に拒否しないよう、通常`pty_close`だけを同じ期待launch/native IDで受付できる。
+unknown send枠を保持したまま既存core closeへ進み、native close成功と席の不在を確認した後だけ
+該当send枠を解放する。元recordのphase/completion/sendはunknownのまま残し、再送や成功化をしない。
+旧callbackは未知/消失した元slotで拒否され、同IDの新launchへnative作用を発行できない。
+issued、管理close自体のunknown、親作用のslot、世代/native/serverの不明・交代は対象外。
+既存の送信・待機lockの拒否も維持し、他席やissuerの停止を復旧条件へ追加しない。
+native handlerのisErrorは元の本文を保持し、`aiterm/execution_error`のcode/effectを併記する。
+native作用後の不明はpossibleのままで、原因説明を再送可否や成功receiptへ変換しない。
 agent sessionへの送信1本を守る`<name>.agent-send.lock`は持つ時間が長いので、持ち主が終了した残骸を次の送信が片付ける。消す役を`<name>.agent-send.lock.reap`の排他作成で1つに絞り、
 その中でもう一度確かめてから消すので、確かめた後で別のlockに入れ替わらない。消す役の印そのものが残った時だけは自動で消さず、`pty_close`を案内する。
 終了した持ち主のpidを別のprocessが使い回すと、pidだけでは生きて見える。生きて見える持ち主は、processが始まってからの経過とlockを作ってからの時間を比べ、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.2",
+  "version": "0.61.4",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [