aiterm-mcp 0.61.4 → 0.61.6

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.6] - 2026-10-22
+
+### Fixed
+
+- Agent startup waits asynchronously for the existing metadata mutex before checking pane ownership, restoring its terminal mode, or accepting startup-menu keys. A short concurrent writer after promptless native creation no longer turns an otherwise valid launch into `unknown`. Stops, uncertain slots, generation changes and the existing lock-acquisition deadline still refuse further effects; no launch or input is replayed.
+
+## [0.61.5] - 2026-10-22
+
+### Fixed
+
+- In the opt-in POSIX native entry, an ordinary incoming send to a verified caller no longer invalidates that caller's outgoing send between paste and Enter. The incoming slot remains owned by its original request; unknown input, management operations, stops and generation changes remain blockers. Reciprocal sends do not wait on each other.
+- Agent paste/submit segments asynchronously acquire the existing metadata mutex before running their synchronous native gates. Routine graph-writer contention no longer poisons an already pasted input. Each effect still rechecks generations and stop state, and issuance is durable before input; no native command is replayed.
+- BellTeam's explicit promptless management `agent_launch` now uses the serving process/request identity after `pty_close`. Unreferenced prompt delivery, portable forks and automatic names remain refused.
+
 ## [0.61.4] - 2026-10-22
 
 ### 修正
@@ -2728,7 +2742,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.6...HEAD
+[0.61.6]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...v0.61.6
+[0.61.5]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...v0.61.5
 [0.61.4]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...v0.61.4
 [0.61.3]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...v0.61.3
 [0.61.2]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.1...v0.61.2

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.4** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.6** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -559,6 +559,7 @@ MCPの本体を初めて使う時まで起こさない中継の後ろにAiterm
 
 `agent_launch({ harness, cwd, trust_project: true })`はpromptなしでも既知のworkspace・project hooks・MCP初期同意を
 進め、入力受付とharness生存を確認して`startup.status="ready"`を返す。指定なしのpromptなし起動は`not_checked`。
+起動準備は競合するmetadata保存が終わるのを待って続行する。端末回復と起動メニューの各キーでは世代・停止状態を再確認し、native起動が未確認になった場合は自動再実行せず診断用に保持する。
 Claude Code初回起動の文字表示テーマ選択では、画面で選択済みの項目を確定して起動を続ける。
 続いてログイン方式の選択が出た場合は`vendor_onboarding_required`を返す。公式の対話型Claude Code CLIで初回設定を完了する。
 入力受付の待ちは30秒。混んだ端末でagentの画面がまだ描かれていない間に切れた時だけ、起動から50秒まで待つ。
@@ -735,6 +736,8 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 ## 人が覗く
 
+POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。
+
 セッションは共有tmux socket（Windows nativeはpsmux namespace）上にある。`pty_open`／`agent_launch`の戻り値に表示されるattachコマンドで、人間がClaude／Codex／Grok／Cursor harnessの同じ端末へ入り、途中でキーボードを引き取れる。
 POSIXでは、tmuxのソケットがまだ無くても最初の`agent_launch`でserverを起動できる。Aitermは作成したsessionとserverを実際のreceiptから照合して受付を確定し、不明な結果を入力の再送で補わない。
 

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.4** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.6** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -600,6 +600,7 @@ Owner start times are checked through `/proc` on Linux; elsewhere an existing PI
 
 `agent_launch({ harness, cwd, trust_project: true })` completes known workspace, project-hook, and project-MCP startup
 consent even without a prompt, then verifies input readiness and harness liveness before returning `startup.status="ready"`.
+Startup checks wait for concurrent metadata writers before continuing. Each terminal recovery or startup-menu key still checks the current generation and stop state; an uncertain native launch remains available for status inspection without automatic replay.
 For Claude Code's first-run text-style menu, it confirms the item already selected on screen before continuing startup.
 If the CLI then requests an account login method, the launch reports `vendor_onboarding_required`; complete that choice in the official interactive Claude Code CLI.
 The input-readiness wait is 30 seconds. Only when it expires while the agent has not drawn anything yet (a busy host), the launch
@@ -793,6 +794,8 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 ## A human can watch
 
+In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
+
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
 On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 

package/dist/core.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
 import { executionPointSchema } from "./execution-contract.js";
-import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget } from "./execution-effect.js";
+import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget, withExecutionNativeAdmission } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
 import { isCursorMcpClient } from "aiterm-steer-delivery";
@@ -209,7 +209,10 @@ function paneTtyOf(name) {
  * agent が tty 上に実在しない時は触らない（ready gate が入力受付不能として止める）。
  */
 export async function ensureAgentOwnsPaneInput(name, kind) {
-    assertExecutionContext(name);
+    // Startup resumes after native creation/readiness awaits. A short metadata
+    // writer is not a reason to abandon that already created launch. Wait for
+    // admission, then run the unchanged source/target/generation checks.
+    await withExecutionNativeAdmission(name, () => assertExecutionContext(name));
     if (isWin)
         return [];
     const tty = paneTtyOf(name);
@@ -225,9 +228,11 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
         return [];
     if (state.agentPresent && !state.agentForeground) {
         const wasStopped = state.agentStopped;
-        tmux("send-keys", "-t", name, "C-u");
-        tmux("send-keys", "-l", "-t", name, "fg");
-        tmux("send-keys", "-t", name, "Enter");
+        await withExecutionNativeAdmission(name, () => {
+            tmux("send-keys", "-t", name, "C-u");
+            tmux("send-keys", "-l", "-t", name, "fg");
+            tmux("send-keys", "-t", name, "Enter");
+        });
         const deadline = performance.now() + AGENT_FOREGROUND_RECOVERY_TIMEOUT_MS;
         for (;;) {
             await sleep(AGENT_FOREGROUND_RECOVERY_POLL_MS);
@@ -250,11 +255,13 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
             // stty is a native mutation outside tmux's command gate. Recheck the
             // captured device and the shared request generation/fence immediately
             // before dispatch; a replaced pane must not inherit the old tty repair.
-            beforeExecutionEffect(name, () => {
-                if (paneTtyOf(name) !== tty)
-                    throw new ExecutionError("EXECUTION_STALE_GENERATION");
+            const set = await withExecutionNativeAdmission(name, () => {
+                beforeExecutionEffect(name, () => {
+                    if (paneTtyOf(name) !== tty)
+                        throw new ExecutionError("EXECUTION_STALE_GENERATION");
+                });
+                return spawnSync("/bin/stty", [ttyFlag, tty, "raw", "-echo"], { encoding: "utf8", timeout: 5000, env: psEnv });
             });
-            const set = spawnSync("/bin/stty", [ttyFlag, tty, "raw", "-echo"], { encoding: "utf8", timeout: 5000, env: psEnv });
             if (set.status !== 0) {
                 throw new AitermError(`AGENT_TTY_COOKED session=${name}\n` +
                     `tty が icanon/echo のままで raw へ戻せません: ${(set.stderr ?? "").trim() || `code=${set.status}`}。送信していません。`, 2);
@@ -4230,7 +4237,7 @@ async function prepareAgentInput(name, meta, options) {
         handled.add(action.kind);
         const keys = action.selected ? action.keys.slice(0, -1) : action.keys;
         for (const key of keys) {
-            sendKey(name, key, { preserveAgentOperation: true });
+            await withExecutionNativeAdmission(name, () => sendKey(name, key, { preserveAgentOperation: true }));
             await sleep(AGENT_SUBMIT_DELAY_MS);
         }
         if (action.selected) {
@@ -4238,14 +4245,14 @@ async function prepareAgentInput(name, meta, options) {
             let moved = await waitStartupSelection(name, action.selected);
             if (!moved && keys.length > 0) {
                 for (const key of keys) {
-                    sendKey(name, key, { preserveAgentOperation: true });
+                    await withExecutionNativeAdmission(name, () => sendKey(name, key, { preserveAgentOperation: true }));
                     await sleep(AGENT_SUBMIT_DELAY_MS);
                 }
                 moved = await waitStartupSelection(name, action.selected);
             }
             if (!moved)
                 break;
-            sendKey(name, action.keys.at(-1), { preserveAgentOperation: true });
+            await withExecutionNativeAdmission(name, () => sendKey(name, action.keys.at(-1), { preserveAgentOperation: true }));
             await sleep(AGENT_SUBMIT_DELAY_MS);
         }
         ready = await waitAgentTuiReady(name, meta, options.ready_timeout ?? AGENT_TUI_READY_TIMEOUT_MS);
@@ -5792,29 +5799,31 @@ async function dispatchAgentTurnInLock(name, text, o) {
     prepareSendText(dispatchText, { raw: o.raw });
     await o.before_send?.({ session_id: name, launch_id: meta.launch_id, vendor: meta.kind,
         harness: agentHarness(meta.kind), event_cursor: startOffset, operation_id: operationId });
-    captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
-            event_cursor: startOffset, operation_id: operationId, turn_id: null, steer_id: null
-        } });
-    recordInterimBoundary(meta, startOffset, operationId);
-    if (meta.kind === "claude") {
-        // durable／anonymousを分岐する前に同じsend preflightを通す。拒否されるpromptの
-        // receipt／active markerだけを残して、来ないStopを待つ状態を作らない。
-        prepareSendText(text, { raw: o.raw });
-        if (operationId) {
-            reserveClaudeOperation(meta, operationId);
+    await withExecutionNativeAdmission(name, () => {
+        captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
+                event_cursor: startOffset, operation_id: operationId, turn_id: null, steer_id: null
+            } });
+        recordInterimBoundary(meta, startOffset, operationId);
+        if (meta.kind === "claude") {
+            // durable／anonymousを分岐する前に同じsend preflightを通す。拒否されるpromptの
+            // receipt／active markerだけを残して、来ないStopを待つ状態を作らない。
+            prepareSendText(text, { raw: o.raw });
+            if (operationId) {
+                reserveClaudeOperation(meta, operationId);
+            }
+            else
+                reserveAnonymousClaudeTurn(meta);
         }
-        else
-            reserveAnonymousClaudeTurn(meta);
-    }
-    send(name, dispatchText, {
-        enter: false,
-        force: o.force,
-        raw: o.raw,
-        mark: false,
-        rtk: false,
-        preserveAgentOperation: meta.kind === "claude",
-        bracketedPaste: true,
-        typedPreface: prefaced.typedPreface,
+        send(name, dispatchText, {
+            enter: false,
+            force: o.force,
+            raw: o.raw,
+            mark: false,
+            rtk: false,
+            preserveAgentOperation: meta.kind === "claude",
+            bracketedPaste: true,
+            typedPreface: prefaced.typedPreface,
+        });
     });
     // Cursorの冷間起動ではbracketed pasteの反映が250msを超えることがある。本文がcomposerへ
     // 現れた実測をsubmit条件にし、未反映のままEnterだけを失う競合を作らない。
@@ -5829,7 +5838,7 @@ async function dispatchAgentTurnInLock(name, text, o) {
         // Codex TUI は literal text 投入直後の Enter を取り落とすことがある。agent 経路だけ submit を分離する。
         await sleep(AGENT_SUBMIT_DELAY_MS);
     }
-    sendKey(name, "Enter", { preserveAgentOperation: meta.kind === "claude" });
+    await withExecutionNativeAdmission(name, () => sendKey(name, "Enter", { preserveAgentOperation: meta.kind === "claude" }));
     let residue = await detectAgentSubmitResidue(name, meta.kind, dispatchText);
     // Cursorはcomposerへの貼付反映後でも最初のEnterを取り落とすことがある。本文残留を
     // 陽性観測した場合だけ同じEnterを一度再送し、再検査後も残る時は失敗として返す。
@@ -6029,7 +6038,7 @@ async function steerRunningTurn(name, meta, text, o) {
     };
     // Claudeのoperation相関は変えない。差し込みは実行中turnの一部であり、新しいturnを予約しない。
     const preserveAgentOperation = meta.kind === "claude";
-    send(name, text, {
+    await withExecutionNativeAdmission(name, () => send(name, text, {
         enter: false,
         force: true,
         raw: o.raw,
@@ -6038,7 +6047,7 @@ async function steerRunningTurn(name, meta, text, o) {
         preserveAgentOperation,
         bracketedPaste: true,
         typedPreface: prefaced.typedPreface,
-    });
+    }));
     if (meta.kind === "cursor") {
         const visible = await waitCursorPromptVisible(name, text);
         if (!visible.visible) {
@@ -6048,7 +6057,7 @@ async function steerRunningTurn(name, meta, text, o) {
     else {
         await sleep(AGENT_SUBMIT_DELAY_MS);
     }
-    sendKey(name, "Enter", { preserveAgentOperation });
+    await withExecutionNativeAdmission(name, () => sendKey(name, "Enter", { preserveAgentOperation }));
     // GrokとCursorは実行中の送信を待ち行列へ入れる。そのままだと現在turnの完了後に別turnとして動き、
     // 完了通知が差し込み前の回答で届いてしまう。待ち行列へ入ったことを確かめ、標準の「今すぐ送る」で現在turnへ移す。
     const queued = meta.kind === "grok" ? grokSteerQueued
@@ -6064,7 +6073,7 @@ async function steerRunningTurn(name, meta, text, o) {
                 `差し込む文が${label}の待ち行列へ入ったことを確認できません。子のturnが送る直前に終わっていた時は、` +
                 `文は新しいturnとして始まっており、その完了は通知されません。再送する前にpty_read(screen:true)で確かめてください。`, 2);
         }
-        sendKey(name, "Enter");
+        await withExecutionNativeAdmission(name, () => sendKey(name, "Enter"));
         if (!await waitSteerScreen(name, screen => !queued(screen), stillRunning)) {
             throw new AitermError(`STEER_STILL_QUEUED vendor=${meta.kind} session=${name}\n` +
                 `差し込む文が${label}の待ち行列に残っています。現在のturnが終わると別turnとして実行されます。`, 2);

package/dist/execution-dispatch.js

@@ -143,12 +143,15 @@ export function createExecutionDispatcher(bindings) {
                     // A host's explicit session close is a management RPC with its own
                     // existing process/request identity, not a delivery or resend.
                     const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
+                    const hostLaunch = client === "bellteam" && route.tool === "agent_launch" && !supplied
+                        && args.prompt == null && args.throughline_source_session === undefined;
+                    const hostManagement = hostClose || hostLaunch;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
                     let directRequest = null;
                     let frozenParent = null;
-                    if (!reference && (client !== "bellteam" || hostClose) && native) {
+                    if (!reference && (client !== "bellteam" || hostManagement) && native) {
                         directRequest = executionRequestSchema.options[4].parse({ kind: "mcp", process_pid: native.pid,
                             process_started_identity: native.started_identity, request_id: fixedExtra.requestId,
                             tool: route.tool, target_session_id: route.target });
@@ -189,7 +192,7 @@ export function createExecutionDispatcher(bindings) {
                     }
                     else {
                         // BellTeam must retain its existing delivery/room/call reference.
-                        if ((client === "bellteam" && !hostClose) || !directRequest)
+                        if ((client === "bellteam" && !hostManagement) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
                         if (route.stage === "send" && !current.point)

package/dist/execution-effect.js

@@ -106,15 +106,46 @@ function prepareInScope(scope, body) {
         throw scope.failure;
     }
 }
-export function withExecutionEffectScope(session, issue, body, creation, prepare) {
+export function withExecutionEffectScope(session, issue, body, creation, prepare, admitNative) {
     const enclosing = scopes.getStore();
     if (enclosing?.interrupt)
         refuse(enclosing, "EXECUTION_UNSUPPORTED");
     const target = executionLaunchSchema.shape.session_id.parse(session);
-    const scope = { session: target, issue, prepare, nativeTargets: new Set(), didIssue: false,
+    const scope = { session: target, issue, prepare, admitNative, nativeTargets: new Set(), didIssue: false,
         ...(creation ? { creation: { ...creation } } : {}) };
     return runEffectScope(scope, body);
 }
+/** Resume one synchronous native segment after asynchronous readiness/waits.
+ * Waits for the existing metadata mutex, never replays the native body. The
+ * normal gates inside body still check source/target/stop and persist issuance.
+ */
+export async function withExecutionNativeAdmission(session, body) {
+    const scope = scopes.getStore();
+    if (!scope) {
+        if (required)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return body();
+    }
+    if (scope.session !== session)
+        refuse(scope, "EXECUTION_CONFLICT");
+    if (scope.failure)
+        throw scope.failure;
+    if (!scope.admitNative)
+        return body(); // explicit legacy/fake frame
+    try {
+        return await scope.admitNative(() => {
+            if (scope.failure)
+                throw scope.failure;
+            assertExecutionContext(session);
+            return body();
+        });
+    }
+    catch (error) {
+        scope.failure ??= error instanceof ExecutionError ? new ExecutionError(error.code, scope.didIssue ? "possible" : error.effect)
+            : new ExecutionError("EXECUTION_UNCONFIRMED", scope.didIssue ? "possible" : "not_started");
+        throw scope.failure;
+    }
+}
 /** Private stop-owned synchronous frame over the existing native gate. It
  * creates no invocation/edge/request. The ordinary stop path supplies only
  * its target check, without a durable journal or completion/fence prerequisite.

package/dist/execution-service.js

@@ -70,11 +70,29 @@ function view(state, record) {
         stopping: record.stopping || stopped(state, record.relation.source?.launch) || stopped(state, record.relation.target?.launch)
             || interruptionBlocksRequest(state, record.reservation.request) });
 }
+/** An admitted ordinary input to the caller does not replace its generation
+ * or revoke its outstanding outgoing RPC. Blocking that input's issued slot
+ * would make reciprocal sends poison each other between paste and Enter.
+ * Unknown operations and management/creation slots are never exempted.
+ */
+function blocksSource(state, source, seatHint, own) {
+    return state.slots.some(slot => {
+        if (slot === own || slot.session_id !== (source?.session_id ?? seatHint))
+            return false;
+        if (!source || slot.stage !== "send" || slot.state !== "issued" || slot.expected_launch_id !== source.launch_id || !slot.request
+            || slot.request.kind === "mcp" && !["pty_send", "claude_turn.issue"].includes(slot.request.tool))
+            return true;
+        const incoming = state.records.find(value => same(value.reservation.request, slot.request));
+        return incoming?.operations.send !== "issued" || ["issued", "unknown"].includes(incoming.operations.launch)
+            || incoming.relation.phase !== "submitted_unknown" || incoming.relation.completion !== "open"
+            || incoming.relation.lifecycle !== "tracking" || !same(incoming.relation.target?.launch, source);
+    });
+}
 function sourceAdmission(state, point, seatHint) {
     assertInterruptionSource(state, point, seatHint);
     if (stopped(state, point?.launch))
         throw new ExecutionError("EXECUTION_STOPPING");
-    if (state.slots.some(slot => slot.session_id === (point?.launch.session_id ?? seatHint)))
+    if (blocksSource(state, point?.launch ?? null, seatHint))
         throw new ExecutionError("EXECUTION_UNCONFIRMED");
     if (!point && seatHint && state.stopping.some(value => value.session_id === seatHint))
         throw new ExecutionError("EXECUTION_UNCONFIRMED");
@@ -528,6 +546,11 @@ export class ExecutionService {
             return this.store.transaction(state => view(state, find(state, args.request)), { readOnly: true });
         return this.finish(args);
     }
+    async admitNative(body) {
+        if (!this.store.admitNative)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        return this.store.admitNative(body);
+    }
     /** Read-only root selection, not a stop or a reservation. Generations come
      * only from current observation or persisted unfinished relations/slots. A
      * completed/retired contact never becomes a root just because its name matches.
@@ -748,7 +771,7 @@ export class ExecutionService {
                         throw new ExecutionError("EXECUTION_STOPPING");
                     if (!relation.source && record.source_session_id && state.stopping.some(value => value.session_id === record.source_session_id))
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
-                    if (state.slots.some(value => value !== slot && value.session_id === (relation.source?.launch.session_id ?? record.source_session_id)))
+                    if (blocksSource(state, relation.source?.launch ?? null, record.source_session_id, slot))
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
                     if (relation.source) {
                         const source = this.runtime.observeSync(relation.source.launch.session_id);

package/dist/execution-store.js

@@ -81,6 +81,7 @@ export class FileExecutionStore {
     directory;
     lockTimeoutMs;
     lockActor;
+    nativeAdmission = false;
     constructor(directory, lockTimeoutMs = 2000, lockActor) {
         this.directory = directory;
         this.lockTimeoutMs = lockTimeoutMs;
@@ -151,7 +152,8 @@ export class FileExecutionStore {
         fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
         let lock;
         try {
-            lock = acquireExecutionLock(this.directory, this.lockActor);
+            if (!this.nativeAdmission)
+                lock = acquireExecutionLock(this.directory, this.lockActor);
         }
         catch (error) {
             if (error instanceof ExecutionError)
@@ -169,10 +171,51 @@ export class FileExecutionStore {
             return structuredClone(result);
         }
         finally {
+            if (lock)
+                releaseExecutionLock(lock);
+        }
+    }
+    async admitNative(body) {
+        // The marker exists only on a synchronous stack, never across an await.
+        // Re-entry shares the physical mutex but not a mutable state snapshot.
+        if (this.nativeAdmission)
+            return this.nativeBody(body);
+        fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+        const deadline = performance.now() + this.lockTimeoutMs;
+        let lock;
+        for (;;) {
+            try {
+                lock = acquireExecutionLock(this.directory, this.lockActor);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" && !(error instanceof ExecutionError && error.code === "EXECUTION_BUSY"))
+                    throw new ExecutionError("EXECUTION_STATE_UNAVAILABLE", "not_started");
+                if (performance.now() >= deadline)
+                    throw new ExecutionError("EXECUTION_BUSY", "not_started");
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        this.nativeAdmission = true;
+        try {
+            return this.nativeBody(body);
+        }
+        finally {
+            this.nativeAdmission = false;
             releaseExecutionLock(lock);
         }
     }
+    nativeBody(body) {
+        const result = body();
+        if (result && typeof result.then === "function") {
+            void Promise.resolve(result).catch(() => undefined);
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        }
+        return result;
+    }
     async transaction(body, options = {}) {
+        if (this.nativeAdmission)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
         fs.mkdirSync(this.directory, { recursive: true, mode: 0o700 });
         let lock;
         const deadline = performance.now() + this.lockTimeoutMs;

package/dist/execution-tools.js

@@ -134,7 +134,7 @@ async function runExecutionReceipt(service, meta, stage, body, targetSessionId,
                         return service.captureCreatedNative(ref, session, nativeId, expectedServer, serverPid);
                     },
                     launch: launch => service.bindCreatedLaunch(ref, launch),
-                } : undefined, prepare);
+                } : undefined, prepare, body => service.admitNative(body));
                 // A swallowed native refusal poisons the frame. Only a cleanly returned
                 // frame has a genuine successful action receipt to preserve on binding.
                 observed = action.value;

package/docs/DESIGN.md

@@ -28,6 +28,15 @@ native emit直前に照合したhook参照は既存deliveryへ保存する。Cod
 POSIXのraw tty回復もnative作用であり、tmux打鍵と同じ受付を通す。ttyは正確なsession selectorで読み、
 実stty直前にも同じdeviceを確認する。停止や世代/tty交代後に古いdeviceへ回復を発行しない。
 一つのRPCが複数のnative作用を発行するときも、各回に同じissued slotとsource/target世代・停止を再確認する。
+agentの貼付け・Enterの同期区間は、既存metadata mutexを非同期に取得してから実行する。
+native作成後に再開する起動準備も同じ非同期取得を通す。pane所有検査、fg/stty回復、
+起動メニューの各キーを短い同期区間で実行し、待機後の停止・世代・slot検査を省略しない。
+mutexをawait中へ持ち越さず、同じ同期stack内の各gateが発行記録を永続化してからnative作用へ進む。
+検証済みsourceと同世代への通常sendがissuedである間も、そのsourceの送信先が別ならoutgoing RPCは継続できる。
+incomingのslotを解放・書換・成功扱いせず、unknown・管理操作・世代不一致は従来どおり拒否する。
+incomingの完了待ちをoutgoingへ課して相互送信を循環待ちにしない（ADR 0127）。
+BellTeamのpromptなし明示管理launchは、管理close同様にserving process/request identityへ結合する。
+promptやThroughline読出しを含む未登録送信、auto-name、remoteはこの管理例外へ含めない。
 新launchは、既存POSIX serverのnative owner、またはserver未作成の完全な空観測を受付時と発行直前に確認する。
 冷間時は最初のnew-session自身でserverを作り、その実receiptのnative IDとserver PIDを、作成後の安定したnative一覧とprocess開始識別子で照合する。
 既存server時も冷間時も、作成したsessionのnative ID・server owner・core内部のlaunch世代を同じ要求slotへ段階結合する。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.4",
+  "version": "0.61.6",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [