aiterm-mcp 0.61.3 → 0.61.5

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.5] - 2026-10-22
+
+### Fixed
+
+- In the opt-in POSIX native entry, an ordinary incoming send to a verified caller no longer invalidates that caller's outgoing send between paste and Enter. The incoming slot remains owned by its original request; unknown input, management operations, stops and generation changes remain blockers. Reciprocal sends do not wait on each other.
+- Agent paste/submit segments asynchronously acquire the existing metadata mutex before running their synchronous native gates. Routine graph-writer contention no longer poisons an already pasted input. Each effect still rechecks generations and stop state, and issuance is durable before input; no native command is replayed.
+- BellTeam's explicit promptless management `agent_launch` now uses the serving process/request identity after `pty_close`. Unreferenced prompt delivery, portable forks and automatic names remain refused.
+
+## [0.61.4] - 2026-10-22
+
+### 修正
+
+- POSIXのnative実行口で最初の`agent_launch`がtmuxソケット未作成時に`EXECUTION_UNSUPPORTED`で止まっていた。発行直前にも空状態を確かめ、最初の`new-session`自身が作ったserverのPID・開始識別子とsession IDを実receiptから照合して起動する。補助sessionや入力再送は作らず、読取不能・receipt不一致は未確認で止める。
+
 ## [0.61.3] - 2026-10-22
 
 ### Fixed
@@ -18,7 +32,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 修正
 
-- tmuxがまだ起動しておらず、対象ソケットが存在しない時、新規実行の登録が`EXECUTION_UNCONFIRMED`で止まっていた。実行世代の観測でもソケット未作成を空状態として扱い、初回の席を起動できるようにした。別ソケットや権限・接続の異常は引き続き不明として止める。
+- tmuxがまだ起動しておらず、対象ソケットが存在しない時、新規実行の登録が`EXECUTION_UNCONFIRMED`で止まっていた。実行世代の観測でもソケット未作成を空状態として扱う。別ソケットや権限・接続の異常は引き続き不明として止める。この版では、その次の初回席作成が既存serverを要求しており、冷間起動はまだ完了しなかった。
 
 ## [0.61.1] - 2026-10-22
 
@@ -2722,7 +2736,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...HEAD
+[0.61.5]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...v0.61.5
+[0.61.4]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...v0.61.4
 [0.61.3]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...v0.61.3
 [0.61.2]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.1...v0.61.2
 [0.61.1]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.0...v0.61.1

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.3** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.5** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -735,7 +735,10 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 ## 人が覗く
 
+POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。
+
 セッションは共有tmux socket（Windows nativeはpsmux namespace）上にある。`pty_open`／`agent_launch`の戻り値に表示されるattachコマンドで、人間がClaude／Codex／Grok／Cursor harnessの同じ端末へ入り、途中でキーボードを引き取れる。
+POSIXでは、tmuxのソケットがまだ無くても最初の`agent_launch`でserverを起動できる。Aitermは作成したsessionとserverを実際のreceiptから照合して受付を確定し、不明な結果を入力の再送で補わない。
 
 ## 要件
 

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.3** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.5** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -793,7 +793,10 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 ## A human can watch
 
+In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
+
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
+On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 
 ## Requirements
 

package/dist/core.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
 import { executionPointSchema } from "./execution-contract.js";
-import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget } from "./execution-effect.js";
+import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget, withExecutionNativeAdmission } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
 import { isCursorMcpClient } from "aiterm-steer-delivery";
@@ -5792,29 +5792,31 @@ async function dispatchAgentTurnInLock(name, text, o) {
     prepareSendText(dispatchText, { raw: o.raw });
     await o.before_send?.({ session_id: name, launch_id: meta.launch_id, vendor: meta.kind,
         harness: agentHarness(meta.kind), event_cursor: startOffset, operation_id: operationId });
-    captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
-            event_cursor: startOffset, operation_id: operationId, turn_id: null, steer_id: null
-        } });
-    recordInterimBoundary(meta, startOffset, operationId);
-    if (meta.kind === "claude") {
-        // durable／anonymousを分岐する前に同じsend preflightを通す。拒否されるpromptの
-        // receipt／active markerだけを残して、来ないStopを待つ状態を作らない。
-        prepareSendText(text, { raw: o.raw });
-        if (operationId) {
-            reserveClaudeOperation(meta, operationId);
+    await withExecutionNativeAdmission(name, () => {
+        captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
+                event_cursor: startOffset, operation_id: operationId, turn_id: null, steer_id: null
+            } });
+        recordInterimBoundary(meta, startOffset, operationId);
+        if (meta.kind === "claude") {
+            // durable／anonymousを分岐する前に同じsend preflightを通す。拒否されるpromptの
+            // receipt／active markerだけを残して、来ないStopを待つ状態を作らない。
+            prepareSendText(text, { raw: o.raw });
+            if (operationId) {
+                reserveClaudeOperation(meta, operationId);
+            }
+            else
+                reserveAnonymousClaudeTurn(meta);
         }
-        else
-            reserveAnonymousClaudeTurn(meta);
-    }
-    send(name, dispatchText, {
-        enter: false,
-        force: o.force,
-        raw: o.raw,
-        mark: false,
-        rtk: false,
-        preserveAgentOperation: meta.kind === "claude",
-        bracketedPaste: true,
-        typedPreface: prefaced.typedPreface,
+        send(name, dispatchText, {
+            enter: false,
+            force: o.force,
+            raw: o.raw,
+            mark: false,
+            rtk: false,
+            preserveAgentOperation: meta.kind === "claude",
+            bracketedPaste: true,
+            typedPreface: prefaced.typedPreface,
+        });
     });
     // Cursorの冷間起動ではbracketed pasteの反映が250msを超えることがある。本文がcomposerへ
     // 現れた実測をsubmit条件にし、未反映のままEnterだけを失う競合を作らない。
@@ -5829,7 +5831,7 @@ async function dispatchAgentTurnInLock(name, text, o) {
         // Codex TUI は literal text 投入直後の Enter を取り落とすことがある。agent 経路だけ submit を分離する。
         await sleep(AGENT_SUBMIT_DELAY_MS);
     }
-    sendKey(name, "Enter", { preserveAgentOperation: meta.kind === "claude" });
+    await withExecutionNativeAdmission(name, () => sendKey(name, "Enter", { preserveAgentOperation: meta.kind === "claude" }));
     let residue = await detectAgentSubmitResidue(name, meta.kind, dispatchText);
     // Cursorはcomposerへの貼付反映後でも最初のEnterを取り落とすことがある。本文残留を
     // 陽性観測した場合だけ同じEnterを一度再送し、再検査後も残る時は失敗として返す。
@@ -6029,7 +6031,7 @@ async function steerRunningTurn(name, meta, text, o) {
     };
     // Claudeのoperation相関は変えない。差し込みは実行中turnの一部であり、新しいturnを予約しない。
     const preserveAgentOperation = meta.kind === "claude";
-    send(name, text, {
+    await withExecutionNativeAdmission(name, () => send(name, text, {
         enter: false,
         force: true,
         raw: o.raw,
@@ -6038,7 +6040,7 @@ async function steerRunningTurn(name, meta, text, o) {
         preserveAgentOperation,
         bracketedPaste: true,
         typedPreface: prefaced.typedPreface,
-    });
+    }));
     if (meta.kind === "cursor") {
         const visible = await waitCursorPromptVisible(name, text);
         if (!visible.visible) {
@@ -6048,7 +6050,7 @@ async function steerRunningTurn(name, meta, text, o) {
     else {
         await sleep(AGENT_SUBMIT_DELAY_MS);
     }
-    sendKey(name, "Enter", { preserveAgentOperation });
+    await withExecutionNativeAdmission(name, () => sendKey(name, "Enter", { preserveAgentOperation }));
     // GrokとCursorは実行中の送信を待ち行列へ入れる。そのままだと現在turnの完了後に別turnとして動き、
     // 完了通知が差し込み前の回答で届いてしまう。待ち行列へ入ったことを確かめ、標準の「今すぐ送る」で現在turnへ移す。
     const queued = meta.kind === "grok" ? grokSteerQueued
@@ -6064,7 +6066,7 @@ async function steerRunningTurn(name, meta, text, o) {
                 `差し込む文が${label}の待ち行列へ入ったことを確認できません。子のturnが送る直前に終わっていた時は、` +
                 `文は新しいturnとして始まっており、その完了は通知されません。再送する前にpty_read(screen:true)で確かめてください。`, 2);
         }
-        sendKey(name, "Enter");
+        await withExecutionNativeAdmission(name, () => sendKey(name, "Enter"));
         if (!await waitSteerScreen(name, screen => !queued(screen), stillRunning)) {
             throw new AitermError(`STEER_STILL_QUEUED vendor=${meta.kind} session=${name}\n` +
                 `差し込む文が${label}の待ち行列に残っています。現在のturnが終わると別turnとして実行されます。`, 2);

package/dist/execution-dispatch.js

@@ -143,12 +143,15 @@ export function createExecutionDispatcher(bindings) {
                     // A host's explicit session close is a management RPC with its own
                     // existing process/request identity, not a delivery or resend.
                     const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
+                    const hostLaunch = client === "bellteam" && route.tool === "agent_launch" && !supplied
+                        && args.prompt == null && args.throughline_source_session === undefined;
+                    const hostManagement = hostClose || hostLaunch;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
                     let directRequest = null;
                     let frozenParent = null;
-                    if (!reference && (client !== "bellteam" || hostClose) && native) {
+                    if (!reference && (client !== "bellteam" || hostManagement) && native) {
                         directRequest = executionRequestSchema.options[4].parse({ kind: "mcp", process_pid: native.pid,
                             process_started_identity: native.started_identity, request_id: fixedExtra.requestId,
                             tool: route.tool, target_session_id: route.target });
@@ -189,7 +192,7 @@ export function createExecutionDispatcher(bindings) {
                     }
                     else {
                         // BellTeam must retain its existing delivery/room/call reference.
-                        if ((client === "bellteam" && !hostClose) || !directRequest)
+                        if ((client === "bellteam" && !hostManagement) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
                         if (route.stage === "send" && !current.point)

package/dist/execution-effect.js

@@ -106,15 +106,46 @@ function prepareInScope(scope, body) {
         throw scope.failure;
     }
 }
-export function withExecutionEffectScope(session, issue, body, creation, prepare) {
+export function withExecutionEffectScope(session, issue, body, creation, prepare, admitNative) {
     const enclosing = scopes.getStore();
     if (enclosing?.interrupt)
         refuse(enclosing, "EXECUTION_UNSUPPORTED");
     const target = executionLaunchSchema.shape.session_id.parse(session);
-    const scope = { session: target, issue, prepare, nativeTargets: new Set(), didIssue: false,
+    const scope = { session: target, issue, prepare, admitNative, nativeTargets: new Set(), didIssue: false,
         ...(creation ? { creation: { ...creation } } : {}) };
     return runEffectScope(scope, body);
 }
+/** Resume one synchronous native segment after asynchronous readiness/waits.
+ * Waits for the existing metadata mutex, never replays the native body. The
+ * normal gates inside body still check source/target/stop and persist issuance.
+ */
+export async function withExecutionNativeAdmission(session, body) {
+    const scope = scopes.getStore();
+    if (!scope) {
+        if (required)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return body();
+    }
+    if (scope.session !== session)
+        refuse(scope, "EXECUTION_CONFLICT");
+    if (scope.failure)
+        throw scope.failure;
+    if (!scope.admitNative)
+        return body(); // explicit legacy/fake frame
+    try {
+        return await scope.admitNative(() => {
+            if (scope.failure)
+                throw scope.failure;
+            assertExecutionContext(session);
+            return body();
+        });
+    }
+    catch (error) {
+        scope.failure ??= error instanceof ExecutionError ? new ExecutionError(error.code, scope.didIssue ? "possible" : error.effect)
+            : new ExecutionError("EXECUTION_UNCONFIRMED", scope.didIssue ? "possible" : "not_started");
+        throw scope.failure;
+    }
+}
 /** Private stop-owned synchronous frame over the existing native gate. It
  * creates no invocation/edge/request. The ordinary stop path supplies only
  * its target check, without a durable journal or completion/fence prerequisite.
@@ -197,10 +228,13 @@ export function prepareExecutionCreation() {
         refuse(scope, "EXECUTION_UNSUPPORTED");
     try {
         const server = scope.creation.prepare();
-        if (!Number.isSafeInteger(server?.pid) || server.pid < 1 || typeof server.started_identity !== "string" || !server.started_identity)
+        if (server !== null && (!Number.isSafeInteger(server?.pid) || server.pid < 1
+            || typeof server.started_identity !== "string" || !server.started_identity))
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-        scope.creationServer = { ...server };
+        if (server)
+            scope.creationServer = { ...server };
         scope.creationPrepared = true;
+        return server === null;
     }
     catch (error) {
         scope.failure = new ExecutionError(error instanceof ExecutionError ? error.code : "EXECUTION_UNCONFIRMED", "not_started");
@@ -208,7 +242,7 @@ export function prepareExecutionCreation() {
     }
 }
 /** Private core metadata stamp, derived only from this frame's actual create
- * receipt and pre-existing native server proof. Not a tool input or lookup.
+ * receipt and verified native server proof. Not a tool input or name lookup.
  */
 export function executionCreatedNativeBinding(session) {
     const scope = scopes.getStore();
@@ -237,7 +271,14 @@ export function captureExecutionCreatedNative(receipt) {
     if (!parsed || parsed[2] !== scope.session || (scope.createdNative && scope.createdNative !== parsed[1]))
         refuse(scope, "EXECUTION_CONFLICT");
     try {
-        scope.creation.native(scope.session, parsed[1], Number(parsed[3]));
+        const server = scope.creation.native(scope.session, parsed[1], Number(parsed[3]));
+        if (server) {
+            if (!Number.isSafeInteger(server.pid) || server.pid < 1 || typeof server.started_identity !== "string" || !server.started_identity)
+                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+            scope.creationServer = { ...server };
+        }
+        if (!scope.creationServer)
+            throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
     }
     catch (error) {
         scope.failure = new ExecutionError(error instanceof ExecutionError ? error.code : "EXECUTION_UNCONFIRMED", "possible");

package/dist/execution-runtime.js

@@ -84,11 +84,13 @@ export function createExecutionRuntime(bindings) {
                             session_id: executionLaunchSchema.shape.session_id, native_id: z.string().regex(/^\$\d+$/),
                         }).strict()) }).strict().parse(bindings.observeNativeSessionsSync());
                     if (new Set(parsed.sessions.map(value => value.session_id)).size !== parsed.sessions.length
-                        || new Set(parsed.sessions.map(value => value.native_id)).size !== parsed.sessions.length)
+                        || new Set(parsed.sessions.map(value => value.native_id)).size !== parsed.sessions.length
+                        || (parsed.server === null && parsed.sessions.length > 0))
                         return { state: "unknown" };
+                    const server = parsed.server === null ? { server: null } : parsed.server ? { server: parsed.server } : {};
                     const target = parsed.sessions.find(value => value.session_id === session);
-                    return target ? { state: "present", native_id: target.native_id, ...(parsed.server ? { server: parsed.server } : {}) }
-                        : { state: "absent", ...(parsed.server ? { server: parsed.server } : {}) };
+                    return target ? { state: "present", native_id: target.native_id, ...server }
+                        : { state: "absent", ...server };
                 }
                 catch {
                     return { state: "unknown" };

package/dist/execution-service.js

@@ -70,11 +70,29 @@ function view(state, record) {
         stopping: record.stopping || stopped(state, record.relation.source?.launch) || stopped(state, record.relation.target?.launch)
             || interruptionBlocksRequest(state, record.reservation.request) });
 }
+/** An admitted ordinary input to the caller does not replace its generation
+ * or revoke its outstanding outgoing RPC. Blocking that input's issued slot
+ * would make reciprocal sends poison each other between paste and Enter.
+ * Unknown operations and management/creation slots are never exempted.
+ */
+function blocksSource(state, source, seatHint, own) {
+    return state.slots.some(slot => {
+        if (slot === own || slot.session_id !== (source?.session_id ?? seatHint))
+            return false;
+        if (!source || slot.stage !== "send" || slot.state !== "issued" || slot.expected_launch_id !== source.launch_id || !slot.request
+            || slot.request.kind === "mcp" && !["pty_send", "claude_turn.issue"].includes(slot.request.tool))
+            return true;
+        const incoming = state.records.find(value => same(value.reservation.request, slot.request));
+        return incoming?.operations.send !== "issued" || ["issued", "unknown"].includes(incoming.operations.launch)
+            || incoming.relation.phase !== "submitted_unknown" || incoming.relation.completion !== "open"
+            || incoming.relation.lifecycle !== "tracking" || !same(incoming.relation.target?.launch, source);
+    });
+}
 function sourceAdmission(state, point, seatHint) {
     assertInterruptionSource(state, point, seatHint);
     if (stopped(state, point?.launch))
         throw new ExecutionError("EXECUTION_STOPPING");
-    if (state.slots.some(slot => slot.session_id === (point?.launch.session_id ?? seatHint)))
+    if (blocksSource(state, point?.launch ?? null, seatHint))
         throw new ExecutionError("EXECUTION_UNCONFIRMED");
     if (!point && seatHint && state.stopping.some(value => value.session_id === seatHint))
         throw new ExecutionError("EXECUTION_UNCONFIRMED");
@@ -408,7 +426,7 @@ export class ExecutionService {
             if (record.operations.launch !== "preparing" || record.relation.lifecycle === "retired")
                 throw new ExecutionError("EXECUTION_CONFLICT");
             const native = this.runtime.nativeSessionSync(record.reservation.target.session_id);
-            if (native.state !== "absent" || !native.server)
+            if (native.state !== "absent" || native.server === undefined)
                 throw new ExecutionError("EXECUTION_UNSUPPORTED");
             return native.server;
         }, { readOnly: true });
@@ -441,7 +459,7 @@ export class ExecutionService {
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         this.store.transactionSync(state => {
             const record = find(state, request), native = this.runtime.nativeSessionSync?.(record.reservation.target.session_id);
-            if (!native?.server || !same(native.server, expected))
+            if (native?.state !== "absent" || !same(native.server, expected))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
         }, { readOnly: true });
     }
@@ -449,18 +467,23 @@ export class ExecutionService {
         const { request } = executionRefMetaSchema.parse(metaInput);
         if (!/^\$\d+$/.test(nativeId) || !this.store.transactionSync)
             throw new ExecutionError("EXECUTION_UNSUPPORTED", "possible");
-        this.store.transactionSync(state => {
+        return this.store.transactionSync(state => {
             const record = find(state, request), slot = state.slots.find(value => same(value.request, request) && value.stage === "launch");
+            // A cold first new-session creates the server itself. Prove its owner
+            // from the exact receipt and a stable native listing before stamping it.
+            const observed = expectedServer ? null : this.runtime.nativeSessionSync?.(session);
+            const server = expectedServer ?? (observed?.state === "present" && observed.native_id === nativeId ? observed.server : undefined);
             if (!slot || slot.state !== "issued" || record.operations.launch !== "issued" || slot.session_id !== session
                 || record.reservation.target.expected_launch_id !== null || record.relation.lifecycle === "retired"
-                || expectedServer.pid !== receiptPid
+                || !server || server.pid !== receiptPid
                 || (slot.created_native_id && slot.created_native_id !== nativeId)
-                || (slot.created_server && !same(slot.created_server, expectedServer)))
+                || (slot.created_server && !same(slot.created_server, server)))
                 throw new ExecutionError("EXECUTION_CONFLICT", "possible");
             // Preserve this genuine native receipt even if a stop is already fencing
             // its caller. Binding metadata does not authorize another native action.
             slot.created_native_id = nativeId;
-            slot.created_server = expectedServer;
+            slot.created_server = server;
+            return server;
         });
     }
     bindCreatedLaunch(metaInput, input) {
@@ -523,6 +546,11 @@ export class ExecutionService {
             return this.store.transaction(state => view(state, find(state, args.request)), { readOnly: true });
         return this.finish(args);
     }
+    async admitNative(body) {
+        if (!this.store.admitNative)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return this.store.admitNative(body);
+    }
     /** Read-only root selection, not a stop or a reservation. Generations come
      * only from current observation or persisted unfinished relations/slots. A
      * completed/retired contact never becomes a root just because its name matches.
@@ -743,7 +771,7 @@ export class ExecutionService {
                         throw new ExecutionError("EXECUTION_STOPPING");
                     if (!relation.source && record.source_session_id && state.stopping.some(value => value.session_id === record.source_session_id))
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
-                    if (state.slots.some(value => value !== slot && value.session_id === (relation.source?.launch.session_id ?? record.source_session_id)))
+                    if (blocksSource(state, relation.source?.launch ?? null, record.source_session_id, slot))
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
                     if (relation.source) {
                         const source = this.runtime.observeSync(relation.source.launch.session_id);

package/dist/execution-store.js

@@ -81,6 +81,7 @@ export class FileExecutionStore {
     directory;
     lockTimeoutMs;
     lockActor;
+    nativeAdmission = false;
     constructor(directory, lockTimeoutMs = 2000, lockActor) {
         this.directory = directory;
         this.lockTimeoutMs = lockTimeoutMs;
@@ -151,7 +152,8 @@ export class FileExecutionStore {
         fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
         let lock;
         try {
-            lock = acquireExecutionLock(this.directory, this.lockActor);
+            if (!this.nativeAdmission)
+                lock = acquireExecutionLock(this.directory, this.lockActor);
         }
         catch (error) {
             if (error instanceof ExecutionError)
@@ -169,10 +171,51 @@ export class FileExecutionStore {
             return structuredClone(result);
         }
         finally {
+            if (lock)
+                releaseExecutionLock(lock);
+        }
+    }
+    async admitNative(body) {
+        // The marker exists only on a synchronous stack, never across an await.
+        // Re-entry shares the physical mutex but not a mutable state snapshot.
+        if (this.nativeAdmission)
+            return this.nativeBody(body);
+        fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+        const deadline = performance.now() + this.lockTimeoutMs;
+        let lock;
+        for (;;) {
+            try {
+                lock = acquireExecutionLock(this.directory, this.lockActor);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" && !(error instanceof ExecutionError && error.code === "EXECUTION_BUSY"))
+                    throw new ExecutionError("EXECUTION_STATE_UNAVAILABLE", "not_started");
+                if (performance.now() >= deadline)
+                    throw new ExecutionError("EXECUTION_BUSY", "not_started");
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        this.nativeAdmission = true;
+        try {
+            return this.nativeBody(body);
+        }
+        finally {
+            this.nativeAdmission = false;
             releaseExecutionLock(lock);
         }
     }
+    nativeBody(body) {
+        const result = body();
+        if (result && typeof result.then === "function") {
+            void Promise.resolve(result).catch(() => undefined);
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        }
+        return result;
+    }
     async transaction(body, options = {}) {
+        if (this.nativeAdmission)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
         fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
         let lock;
         const deadline = performance.now() + this.lockTimeoutMs;

package/dist/execution-tools.js

@@ -126,15 +126,15 @@ async function runExecutionReceipt(service, meta, stage, body, targetSessionId,
                     return run();
                 }, stage === "launch" ? {
                     prepare: () => { expectedServer = service.prepareCreation(ref); return expectedServer; },
-                    verifyServer: () => { if (!expectedServer)
+                    verifyServer: () => { if (expectedServer === undefined)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED"); service.verifyCreationServer(ref, expectedServer); },
                     native: (session, nativeId, serverPid) => {
-                        if (!expectedServer)
+                        if (expectedServer === undefined)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-                        service.captureCreatedNative(ref, session, nativeId, expectedServer, serverPid);
+                        return service.captureCreatedNative(ref, session, nativeId, expectedServer, serverPid);
                     },
                     launch: launch => service.bindCreatedLaunch(ref, launch),
-                } : undefined, prepare);
+                } : undefined, prepare, body => service.admitNative(body));
                 // A swallowed native refusal poisons the frame. Only a cleanly returned
                 // frame has a genuine successful action receipt to preserve on binding.
                 observed = action.value;

package/dist/tmux-runtime.js

@@ -493,12 +493,12 @@ export function registeredSessionEnvironment(name) {
 export function tmuxNewSession(observe, name, launch, registered = []) {
     const guarded = hasExecutionCreationScope();
     // Windows per-session server creation needs a separate native-owner proof.
-    // The legacy public launcher is unchanged; guarded creation cannot assume
-    // POSIX's existing shared-server identity or bootstrap a missing server.
+    // The legacy public launcher is unchanged.
+    let cold = false;
     if (guarded) {
         if (isWin)
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-        prepareExecutionCreation();
+        cold = prepareExecutionCreation();
     }
     const printNative = guarded ? ["-P", "-F", "#{session_id}\t#{session_name}\t#{pid}"] : [];
     if (isWin) {
@@ -508,6 +508,15 @@ export function tmuxNewSession(observe, name, launch, registered = []) {
         return result;
     }
     const env = sessionCallerEnvironment();
+    if (cold) {
+        // With no server, there is no global environment to adjust. The first
+        // new-session inherits this caller's environment and prints its native ID
+        // and newly created server PID for the guarded receipt proof.
+        const r = runTmux(observe, undefined, ["new-session", "-d", "-s", name, ...printNative, ...launch.args, launch.shell], env);
+        if (r.code === 0 || r.stdout)
+            captureExecutionCreatedNative(r.stdout);
+        return r;
+    }
     const wildcard = tmuxHasSessionEnvironmentFlags();
     // tmux は起動時に PWD を共通環境へ足す。
     const others = new Set(["PWD"]);

package/docs/DESIGN.md

@@ -28,8 +28,17 @@ native emit直前に照合したhook参照は既存deliveryへ保存する。Cod
 POSIXのraw tty回復もnative作用であり、tmux打鍵と同じ受付を通す。ttyは正確なsession selectorで読み、
 実stty直前にも同じdeviceを確認する。停止や世代/tty交代後に古いdeviceへ回復を発行しない。
 一つのRPCが複数のnative作用を発行するときも、各回に同じissued slotとsource/target世代・停止を再確認する。
-新launchは、既存POSIX serverのnative owner、new-session自身のnative ID receipt、core内部で生成したlaunch世代を
-同じ要求slotへ段階結合する。物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。
+agentの貼付け・Enterの同期区間は、既存metadata mutexを非同期に取得してから実行する。
+mutexをawait中へ持ち越さず、同じ同期stack内の各gateが発行記録を永続化してからnative作用へ進む。
+検証済みsourceと同世代への通常sendがissuedである間も、そのsourceの送信先が別ならoutgoing RPCは継続できる。
+incomingのslotを解放・書換・成功扱いせず、unknown・管理操作・世代不一致は従来どおり拒否する。
+incomingの完了待ちをoutgoingへ課して相互送信を循環待ちにしない（ADR 0127）。
+BellTeamのpromptなし明示管理launchは、管理close同様にserving process/request identityへ結合する。
+promptやThroughline読出しを含む未登録送信、auto-name、remoteはこの管理例外へ含めない。
+新launchは、既存POSIX serverのnative owner、またはserver未作成の完全な空観測を受付時と発行直前に確認する。
+冷間時は最初のnew-session自身でserverを作り、その実receiptのnative IDとserver PIDを、作成後の安定したnative一覧とprocess開始識別子で照合する。
+既存server時も冷間時も、作成したsessionのnative ID・server owner・core内部のlaunch世代を同じ要求slotへ段階結合する。
+物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。冷間起動のための補助sessionや再送は作らない。
 作成時のnative ID/server ownerをmanaged metadataへ保存し、private runtimeの世代読取と期待closeでも再照合する。
 古いmetadataの欠測を現観測で補わず、既存席の自動登録は行わない。
 証拠の無い新server起動、Windows固有のserver作成、auto-name/通常PTY/auth等はまだunsupported。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.3",
+  "version": "0.61.5",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [