aiterm-mcp 0.61.5 → 0.61.7

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.7] - 2026-10-23
+
+### Fixed
+
+- Native host `agent_auth` now admits automatic-name and explicit starts, authenticated no-op starts, session status/onboarding, absent-session receipts and cancellation through the existing v1 contract. Authentication PTYs retain their actual creation native/server identity and generation; only those proven PTYs accept ref-less host input/keys. The dispatcher uses the serving SDK RPC identity, without synthetic delivery references or read-only downgrade.
+- BellTeam model, effort and fast changes are admitted as native management RPCs bound to the existing session generation. Every native stage retains its normal stop/slot/generation checks, and partial failures retain possible effects. Fast-state metadata is revalidated before writing after asynchronous CLI observations.
+
+### Added
+
+- The opt-in native execution entry can explicitly reconcile a returned unknown, empty launch against its original native/server identity and current ready managed generation through `agent_execution/reconcile_launch`. It preserves the existing request and generation, issues no native input and permits a later ordinary send only through its usual admission. Issued RPCs and uncertain input or generations remain blocked; late callbacks cannot overwrite the reconciled stage.
+
+## [0.61.6] - 2026-10-22
+
+### Fixed
+
+- Agent startup waits asynchronously for the existing metadata mutex before checking pane ownership, restoring its terminal mode, or accepting startup-menu keys. A short concurrent writer after promptless native creation no longer turns an otherwise valid launch into `unknown`. Stops, uncertain slots, generation changes and the existing lock-acquisition deadline still refuse further effects; no launch or input is replayed.
+
 ## [0.61.5] - 2026-10-22
 
 ### Fixed
@@ -2736,7 +2753,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.7...HEAD
+[0.61.7]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.6...v0.61.7
+[0.61.6]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...v0.61.6
 [0.61.5]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...v0.61.5
 [0.61.4]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...v0.61.4
 [0.61.3]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.2...v0.61.3

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.5** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.7** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -559,6 +559,7 @@ MCPの本体を初めて使う時まで起こさない中継の後ろにAiterm
 
 `agent_launch({ harness, cwd, trust_project: true })`はpromptなしでも既知のworkspace・project hooks・MCP初期同意を
 進め、入力受付とharness生存を確認して`startup.status="ready"`を返す。指定なしのpromptなし起動は`not_checked`。
+起動準備は競合するmetadata保存が終わるのを待って続行する。端末回復と起動メニューの各キーでは世代・停止状態を再確認し、native起動が未確認になった場合は自動再実行せず診断用に保持する。
 Claude Code初回起動の文字表示テーマ選択では、画面で選択済みの項目を確定して起動を続ける。
 続いてログイン方式の選択が出た場合は`vendor_onboarding_required`を返す。公式の対話型Claude Code CLIで初回設定を完了する。
 入力受付の待ちは30秒。混んだ端末でagentの画面がまだ描かれていない間に切れた時だけ、起動から50秒まで待つ。
@@ -733,6 +734,13 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。 POSIXの明示native execution構成では、unknown sendになった対象1席も`pty_close`で閉じて再作成できる。元requestはunknownのまま保持し、再送しない。発行中の操作、管理close自体のunknown、native identityが不明な席は引き続き拒否する。
 
+BellTeamのmodel・effort・fast変更も、既存session世代に結合したnative管理要求で受け付ける。途中で世代・受付枠・停止状態が変われば、それ以降の打鍵を止める。途中まで変更した結果は作用不明のまま保持し、自動でやり直さない。
+
+POSIXの明示native入口でも、`agent_auth`の名前なし開始、認証済みで何も起こさない開始、既存v1の確認・初回案内・取消を受け付ける。認証PTYは実際の作成元nativeと世代へ結合する。BellTeamの参照なし入力・キーは、この証拠がある認証PTYにだけ許可し、通常agentの本文には配送参照を引き続き必要とする。作成証拠のない旧認証metadataを自動登録しない。
+
+この明示入口では `agent_execution` の `reconcile_launch` に元の `request` と正確な `target: {session_id, launch_id}` を渡し、結果不明の空起動を既存世代へ結合できる。保存したnative/serverと現在のmanaged世代、raw状態で初期promptなし、生存して入力待ちのharnessをmetadata受付内で照合し、該当するunknown launch枠だけを解放する。起動・打鍵・close・本文再送は行わない。issuedのRPC、入力状態不明、世代交代や世代未確認は拒否する。後続本文は元参照で通常のsend受付を通して一度だけ発行する。照合成功は失われた元RPC receiptの回収を意味しない。
+
+
 ## 人が覗く
 
 POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.5** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.7** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -600,6 +600,7 @@ Owner start times are checked through `/proc` on Linux; elsewhere an existing PI
 
 `agent_launch({ harness, cwd, trust_project: true })` completes known workspace, project-hook, and project-MCP startup
 consent even without a prompt, then verifies input readiness and harness liveness before returning `startup.status="ready"`.
+Startup checks wait for concurrent metadata writers before continuing. Each terminal recovery or startup-menu key still checks the current generation and stop state; an uncertain native launch remains available for status inspection without automatic replay.
 For Claude Code's first-run text-style menu, it confirms the item already selected on screen before continuing startup.
 If the CLI then requests an account login method, the launch reports `vendor_onboarding_required`; complete that choice in the official interactive Claude Code CLI.
 The input-readiness wait is 30 seconds. Only when it expires while the agent has not drawn anything yet (a busy host), the launch
@@ -795,9 +796,16 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
 
+An explicit `agent_execution` action `reconcile_launch` can bind an existing empty launch after a lost launch result in this opt-in entry. Supply the original `request` and exact `target: {session_id, launch_id}`. The server checks the original native/server identity, current managed generation, raw no-prompt state and a live ready harness under metadata admission, then releases only that unknown launch slot. It never launches, types, closes or resends. `issued` RPCs, unknown input and changed or unverified generations remain blocked. Any subsequent body uses the original reference through normal send admission once; a successful reconciliation does not prove the lost RPC receipt.
+
+
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
 On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 
+BellTeam model, effort and fast changes use a native management request bound to the existing session generation. Later stages stop if that generation, its admission slot or stop state changes. A partial change remains an uncertain effect and must not be blindly repeated.
+
+In the opt-in POSIX native entry, `agent_auth` also supports omitted session names, authenticated no-op starts and the normal v1 status/onboarding/cancel receipts. Authentication PTYs are bound to their actual native creator and generation. Ref-less BellTeam input or keys are allowed only for those proven authentication PTYs; ordinary agent messages still require their delivery reference. Legacy authentication metadata without creator proof is not automatically enrolled.
+
 ## Requirements
 
 - **Node.js >= 18**

package/dist/core.js

@@ -15,7 +15,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
-import { executionPointSchema } from "./execution-contract.js";
+import { executionLaunchSchema, executionPointSchema } from "./execution-contract.js";
 import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget, withExecutionNativeAdmission } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
@@ -209,7 +209,10 @@ function paneTtyOf(name) {
  * agent が tty 上に実在しない時は触らない（ready gate が入力受付不能として止める）。
  */
 export async function ensureAgentOwnsPaneInput(name, kind) {
-    assertExecutionContext(name);
+    // Startup resumes after native creation/readiness awaits. A short metadata
+    // writer is not a reason to abandon that already created launch. Wait for
+    // admission, then run the unchanged source/target/generation checks.
+    await withExecutionNativeAdmission(name, () => assertExecutionContext(name));
     if (isWin)
         return [];
     const tty = paneTtyOf(name);
@@ -225,9 +228,11 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
         return [];
     if (state.agentPresent && !state.agentForeground) {
         const wasStopped = state.agentStopped;
-        tmux("send-keys", "-t", name, "C-u");
-        tmux("send-keys", "-l", "-t", name, "fg");
-        tmux("send-keys", "-t", name, "Enter");
+        await withExecutionNativeAdmission(name, () => {
+            tmux("send-keys", "-t", name, "C-u");
+            tmux("send-keys", "-l", "-t", name, "fg");
+            tmux("send-keys", "-t", name, "Enter");
+        });
         const deadline = performance.now() + AGENT_FOREGROUND_RECOVERY_TIMEOUT_MS;
         for (;;) {
             await sleep(AGENT_FOREGROUND_RECOVERY_POLL_MS);
@@ -250,11 +255,13 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
             // stty is a native mutation outside tmux's command gate. Recheck the
             // captured device and the shared request generation/fence immediately
             // before dispatch; a replaced pane must not inherit the old tty repair.
-            beforeExecutionEffect(name, () => {
-                if (paneTtyOf(name) !== tty)
-                    throw new ExecutionError("EXECUTION_STALE_GENERATION");
+            const set = await withExecutionNativeAdmission(name, () => {
+                beforeExecutionEffect(name, () => {
+                    if (paneTtyOf(name) !== tty)
+                        throw new ExecutionError("EXECUTION_STALE_GENERATION");
+                });
+                return spawnSync("/bin/stty", [ttyFlag, tty, "raw", "-echo"], { encoding: "utf8", timeout: 5000, env: psEnv });
             });
-            const set = spawnSync("/bin/stty", [ttyFlag, tty, "raw", "-echo"], { encoding: "utf8", timeout: 5000, env: psEnv });
             if (set.status !== 0) {
                 throw new AitermError(`AGENT_TTY_COOKED session=${name}\n` +
                     `tty が icanon/echo のままで raw へ戻せません: ${(set.stderr ?? "").trim() || `code=${set.status}`}。送信していません。`, 2);
@@ -1671,17 +1678,59 @@ export function observeExecutionSessionGeneration(name) {
     const native = before.sessions.find(value => value.session_id === name);
     if (!native)
         return result(false, null);
-    const meta = tryLoadAgentMetadata(name), proof = meta?.execution_native;
+    const meta = tryLoadAgentMetadata(name) ?? readExecutionAuthMetadata(name), proof = meta?.execution_native;
     if (!meta || !proof || !before.server || proof.native_id !== native.native_id
         || !isDeepStrictEqual(proof.server, before.server))
         return result(true, null);
-    const after = observeExecutionNativeCreationScope(), last = tryLoadAgentMetadata(name);
+    const after = observeExecutionNativeCreationScope(), last = tryLoadAgentMetadata(name) ?? readExecutionAuthMetadata(name);
     if (after.state !== "known" || !isDeepStrictEqual(after.server, proof.server)
         || after.sessions.find(value => value.session_id === name)?.native_id !== proof.native_id
-        || last?.launch_id !== meta.launch_id || !isDeepStrictEqual(last.execution_native, proof))
+        || last?.launch_id !== meta.launch_id || !isDeepStrictEqual(last?.execution_native, proof))
         return result(true, null);
     return result(true, meta.launch_id);
 }
+/** Only native-stamped authentication PTYs qualify for host auth input. */
+export function observeExecutionAuthSessionGeneration(name) {
+    const current = observeExecutionSessionGeneration(name), meta = readExecutionAuthMetadata(name);
+    return { ...current, launch_id: current.launch_id && current.launch_id === meta?.launch_id && !tryLoadAgentMetadata(name)
+            ? current.launch_id : null };
+}
+/** Allocate only a terminal name. The serving RPC then reserves it and the
+ * actual native creation receipt supplies its identity; no existing seat is enrolled. */
+export function selectExecutionAuthSessionName() { return "auth-" + randomBytes(12).toString("hex"); }
+/** Read-only proof for reconciling a created, empty launch. Inspect raw prompt
+ * state: legacy/default normalization must never prove that input was absent. */
+export function observeExecutionCreatedLaunch(target) {
+    target = executionLaunchSchema.parse(target);
+    const unknown = () => { throw new ExecutionError("EXECUTION_UNCONFIRMED"); };
+    const generation = () => {
+        const value = observeExecutionSessionGeneration(target.session_id);
+        if (!value.exists || value.launch_id !== target.launch_id)
+            unknown();
+    };
+    const read = () => {
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(agentMetadataPath(target.session_id, target.launch_id), "utf8"));
+        }
+        catch {
+            return unknown();
+        }
+        const proof = executionNativeBindingSchema.safeParse(raw.execution_native);
+        if (raw.aiterm_session !== target.session_id || raw.launch_id !== target.launch_id
+            || raw.initial_prompt !== "none" || raw.initial_prompt_delivery != null || !proof.success)
+            return unknown();
+        return proof.data;
+    };
+    generation();
+    const native = read(), live = observeSession(target.session_id);
+    if (live.launch_id !== target.launch_id || live.harness_alive !== true || live.harness_process === null || live.state !== "idle")
+        unknown();
+    generation();
+    if (!isDeepStrictEqual(read(), native))
+        unknown();
+    return { target, native, initial_prompt: "none", initial_prompt_delivery: null, harness_alive: true, ready: true };
+}
 /** Private source-provenance snapshot. It deliberately omits screen, argv,
  * environment and cached vendor_session_id. No public tool is added. The
  * consumer proves its native serving MCP process descends from this unique
@@ -4230,7 +4279,7 @@ async function prepareAgentInput(name, meta, options) {
         handled.add(action.kind);
         const keys = action.selected ? action.keys.slice(0, -1) : action.keys;
         for (const key of keys) {
-            sendKey(name, key, { preserveAgentOperation: true });
+            await withExecutionNativeAdmission(name, () => sendKey(name, key, { preserveAgentOperation: true }));
             await sleep(AGENT_SUBMIT_DELAY_MS);
         }
         if (action.selected) {
@@ -4238,14 +4287,14 @@ async function prepareAgentInput(name, meta, options) {
             let moved = await waitStartupSelection(name, action.selected);
             if (!moved && keys.length > 0) {
                 for (const key of keys) {
-                    sendKey(name, key, { preserveAgentOperation: true });
+                    await withExecutionNativeAdmission(name, () => sendKey(name, key, { preserveAgentOperation: true }));
                     await sleep(AGENT_SUBMIT_DELAY_MS);
                 }
                 moved = await waitStartupSelection(name, action.selected);
             }
             if (!moved)
                 break;
-            sendKey(name, action.keys.at(-1), { preserveAgentOperation: true });
+            await withExecutionNativeAdmission(name, () => sendKey(name, action.keys.at(-1), { preserveAgentOperation: true }));
             await sleep(AGENT_SUBMIT_DELAY_MS);
         }
         ready = await waitAgentTuiReady(name, meta, options.ready_timeout ?? AGENT_TUI_READY_TIMEOUT_MS);
@@ -4515,6 +4564,19 @@ function loadAuthMetadata(name, kind) {
     }
     return value;
 }
+function readExecutionAuthMetadata(name) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(authMetadataPath(name), "utf8"));
+        if (!["claude", "codex", "grok", "cursor"].includes(raw?.kind))
+            return null;
+        const meta = loadAuthMetadata(name, raw.kind), launch = executionLaunchSchema.shape.launch_id.safeParse(meta?.launch_id);
+        const native = executionNativeBindingSchema.safeParse(meta?.execution_native);
+        return meta && launch.success && native.success ? { ...meta, launch_id: launch.data, execution_native: native.data } : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** 一覧の取得失敗を端末の消失へ丸めず、正規PTY一覧で存在を確認する。 */
 function authSessionExists(name) {
     return listSessionsResult().sessions.some(session => session.session_id === name);
@@ -4557,7 +4619,7 @@ export async function authenticateAgent(kind, options) {
         const meta = loadAuthMetadata(options.session_id, kind);
         if (!authSessionExists(options.session_id)) {
             if (meta)
-                fs.unlinkSync(authMetadataPath(options.session_id));
+                withExecutionPreparation(options.session_id, () => fs.unlinkSync(authMetadataPath(options.session_id)));
             return result("blocked", null, "認証sessionは既に終了または取消済みです。");
         }
         if (!meta)
@@ -4588,7 +4650,13 @@ export async function authenticateAgent(kind, options) {
             const kept = tmux("set-option", "-t", name, "remain-on-exit", "on");
             if (kept.code !== 0)
                 throw new AitermError("AGENT_AUTH_PANE_CONFIG_FAILED: 認証processの終了観測を設定できません。", 2);
-            writeJson0600(authMetadataPath(name), meta);
+            if (hasExecutionCreationScope()) {
+                meta.launch_id = randomBytes(16).toString("hex");
+                meta.execution_native = executionCreatedNativeBinding(name);
+            }
+            withExecutionPreparation(name, () => writeJson0600(authMetadataPath(name), meta));
+            if (meta.launch_id && hasExecutionCreationScope())
+                bindExecutionCreatedLaunch({ session_id: name, launch_id: meta.launch_id });
             launchAuthProcess(name, meta);
         }
         catch (error) {
@@ -4636,8 +4704,10 @@ export async function authenticateAgent(kind, options) {
                 return result("authenticated", session, null);
             if (meta.phase === "onboarding")
                 return result("blocked", session, "公式CLIの初回案内の完了を確認できません。");
-            meta.phase = "onboarding";
-            writeJson0600(authMetadataPath(session), meta);
+            withExecutionPreparation(session, () => {
+                meta.phase = "onboarding";
+                writeJson0600(authMetadataPath(session), meta);
+            });
             const restarted = tmux("respawn-pane", "-k", "-t", session, resolveWinPaneShell("bash"));
             if (restarted.code !== 0)
                 return result("failed", session, "公式CLIの初回案内を起動できません。");
@@ -5032,8 +5102,10 @@ const restoreCursorDefaults = (configPath) => (before) => {
         restoreJsonSetting(configPath, before, CURSOR_DEFAULT_MODEL_KEYS);
 };
 function recordAgentFast(meta, fast) {
-    meta.fast = fast;
-    writeAgentMetadata(meta);
+    withExecutionPreparation(meta.aiterm_session, () => {
+        meta.fast = fast;
+        writeAgentMetadata(meta);
+    });
 }
 /** 動いている席のfastを切り替える。返りは切り替えた後の状態。席は入力待ちである事（呼び手が確かめる）。 */
 async function switchAgentFast(name, meta, target, verified = false) {

package/dist/execution-dispatch.js

@@ -33,14 +33,14 @@ function routeFor(name, args) {
     if (!nativeTool.success)
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const target = launches.has(name) ? args.session_name : name === "pty_open" ? args.name : args.session_id;
-    // Automatic names are selected inside existing core today. Do not guess the
-    // future name or act before reserving it at the actual selection boundary.
+    // Generic automatic names remain unsupported. Auth start selects its name
+    // through the private allocator before this route reserves it.
     if (target === undefined || target === null)
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const session = executionLaunchSchema.shape.session_id.safeParse(target);
     if (!session.success)
         throw new ExecutionError("EXECUTION_INVALID");
-    return { tool: nativeTool.data, target: session.data, stage: launches.has(name) ? "launch" : "send" };
+    return { tool: nativeTool.data, target: session.data, stage: launches.has(name) || tool === "agent_auth.start" ? "launch" : "send" };
 }
 // The SDK signal belongs to this serving RPC, not to a whole CLI turn. Keep
 // an immediate local gate while the shared metadata lock may be awaiting I/O.
@@ -79,6 +79,19 @@ function requestCancellation(service, request, input) {
     };
 }
 export function createExecutionDispatcher(bindings) {
+    const selectAuthName = bindings.selectAuthSessionName, observeAuth = bindings.observeAuthSessionGeneration;
+    for (const fn of [selectAuthName, observeAuth])
+        if (fn !== undefined && typeof fn !== "function")
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const authGeneration = (session) => {
+        if (!observeAuth)
+            return null;
+        const value = observeAuth(session);
+        if (!value || value.schema !== "aiterm.pty-observe-result.v1" || value.session_id !== session || value.exists !== true)
+            return null;
+        const launch = executionLaunchSchema.safeParse({ session_id: session, launch_id: value.launch_id });
+        return launch.success ? { launch: launch.data, boundary: null } : null;
+    };
     const captureNativeParent = bindings.captureNativeParent;
     if (captureNativeParent !== undefined && typeof captureNativeParent !== "function")
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
@@ -129,6 +142,13 @@ export function createExecutionDispatcher(bindings) {
                         executionHostSourceFromMeta(fixedExtra._meta, bindings.initializedClientName());
                         return await body(args, fixedExtra);
                     }
+                    if (name === "agent_auth" && (args.action !== "status" || args.session_id !== undefined) && !observeAuth)
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    if (name === "agent_auth" && args.action === "start" && args.session_id === undefined) {
+                        if (!native || !selectAuthName)
+                            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                        args.session_id = executionLaunchSchema.shape.session_id.parse(selectAuthName());
+                    }
                     const route = routeFor(name, args);
                     if (!route)
                         return await body(args, fixedExtra);
@@ -145,7 +165,12 @@ export function createExecutionDispatcher(bindings) {
                     const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
                     const hostLaunch = client === "bellteam" && route.tool === "agent_launch" && !supplied
                         && args.prompt == null && args.throughline_source_session === undefined;
-                    const hostManagement = hostClose || hostLaunch;
+                    const hostConfigure = client === "bellteam" && route.tool === "agent_configure" && !supplied;
+                    const authOperation = name === "agent_auth";
+                    const authInput = (route.tool === "pty_send" || route.tool === "pty_key") && !supplied
+                        && client === "bellteam" ? authGeneration(route.target) : null;
+                    const hostAuth = client === "bellteam" && !supplied && authOperation;
+                    const hostManagement = hostClose || hostLaunch || hostConfigure || hostAuth || !!authInput;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
@@ -195,8 +220,16 @@ export function createExecutionDispatcher(bindings) {
                         if ((client === "bellteam" && !hostManagement) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
+                        if (authOperation && route.tool !== "agent_auth.start") {
+                            // A missing auth PTY returns the public v1 failed/already-cancelled
+                            // receipt. There is no native effect or replacement creation.
+                            if (!current.point)
+                                route.stage = "launch";
+                        }
                         if (route.stage === "send" && !current.point)
                             throw new ExecutionError("EXECUTION_STALE_GENERATION");
+                        if (authInput && !same(authInput, current.point))
+                            throw new ExecutionError("EXECUTION_STALE_GENERATION");
                         const request = directRequest;
                         cancellation?.assert();
                         await bindings.service.execute({ action: "register", source_session_id: source?.launch.session_id ?? directSeat,
@@ -230,7 +263,7 @@ export function createExecutionDispatcher(bindings) {
                         // must not turn a valid accepted action into permission to resend.
                         let target = null;
                         try {
-                            if (route.tool === "pty_close")
+                            if (route.tool === "pty_close" || route.tool === "agent_auth.cancel")
                                 target = expected ? { launch: expected, boundary: null } : null;
                             else {
                                 const current = await observe(route.target);

package/dist/execution-launch-recovery.js

@@ -0,0 +1,9 @@
+// Private read-only evidence from the serving native scope, never client claims.
+import { z } from "zod";
+import { executionLaunchSchema } from "./execution-contract.js";
+import { executionNativeBindingSchema } from "./execution-close.js";
+export const createdLaunchObservationSchema = z.object({
+    target: executionLaunchSchema, native: executionNativeBindingSchema,
+    initial_prompt: z.literal("none"), initial_prompt_delivery: z.null(),
+    harness_alive: z.literal(true), ready: z.literal(true),
+}).strict();

package/dist/execution-native-server.js

@@ -35,6 +35,9 @@ export function createNativeExecutionServer(input) {
             ?? provider.cursorParentFromRequest(profile, client, { hookRoot: path.join(expectedScope.state_root, "cursor-parent-hooks") }),
         observeDone: core.observeAgentDone,
         observeNativeSessions: core.observeExecutionNativeCreationScope,
+        selectAuthSessionName: core.selectExecutionAuthSessionName,
+        observeAuthSessionGeneration: core.observeExecutionAuthSessionGeneration,
+        observeCreatedLaunchSync: core.observeExecutionCreatedLaunch,
         closeExpectedSession: core.closeExpectedAgentSession, // explicit management only, never stop fallback
         observeInterruptionSync: core.observeExpectedAgentRunInterruption,
         selectInterruptionSync: core.selectExpectedAgentRunInterruption,

package/dist/execution-parent-producer.js

@@ -1,7 +1,7 @@
 // Private same-scope MCP parent producer. No public/index/profile mount. Queue
 // aliases lacking current independent native proof remain unsupported.
 import path from "node:path";
-import { observeAgentDone, observeExecutionNativeCreationScope, closeExpectedAgentSession } from "./core.js";
+import { observeAgentDone, selectExecutionAuthSessionName, observeExecutionAuthSessionGeneration, observeExecutionNativeCreationScope, closeExpectedAgentSession, observeExecutionCreatedLaunch } from "./core.js";
 import { codexParentFromRequest } from "./codex-parent-receiver.js";
 import { claudeParentFromRequest } from "./claude-parent-receiver.js";
 import { cursorParentFromRequest } from "./cursor-parent-receiver.js";
@@ -30,13 +30,18 @@ const localProducerRuntime = {
         ?? cursorParentFromRequest(client, { hookRoot: path.join(stateRoot(), "cursor-parent-hooks") }),
     observeDone: observeAgentDone,
     observeNativeSessions: observeExecutionNativeCreationScope,
+    selectAuthSessionName: selectExecutionAuthSessionName,
+    observeAuthSessionGeneration: observeExecutionAuthSessionGeneration,
+    observeCreatedLaunchSync: observeExecutionCreatedLaunch,
     closeExpectedSession: closeExpectedAgentSession,
 };
 export function createExecutionParentProducer(input) {
     const runtime = input.runtime ?? localProducerRuntime;
-    for (const name of ["observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner"])
+    for (const name of ["selectAuthSessionName", "observeAuthSessionGeneration", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"])
         if (runtime[name] !== undefined && typeof runtime[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const selectAuthName = runtime.selectAuthSessionName?.bind(runtime), observeAuth = runtime.observeAuthSessionGeneration?.bind(runtime);
+    const createdLaunch = runtime.observeCreatedLaunchSync?.bind(runtime);
     const interruption = runtime.observeInterruptionSync?.bind(runtime);
     const selectInterruption = runtime.selectInterruptionSync?.bind(runtime), interruptKey = runtime.interruptKeySync?.bind(runtime);
     const observeActors = runtime.observeActors?.bind(runtime);
@@ -68,6 +73,10 @@ export function createExecutionParentProducer(input) {
             } } : {}),
         ...(interruptKey ? { interruptKeySync: (point) => { assertScope(); return interruptKey(point); } } : {}),
         observeSession: observe, observeSessionSync: observe,
+        ...(createdLaunch ? { observeCreatedLaunchSync: (target) => {
+                assertScope();
+                return createdLaunch(target);
+            } } : {}),
         ...(typeof runtime.observeNativeSessions === "function" ? { observeNativeSessionsSync: () => {
                 assertScope();
                 return runtime.observeNativeSessions();
@@ -115,7 +124,10 @@ export function createExecutionParentProducer(input) {
     requireExecutionEffectScope(true);
     return { execution, parent, native, service, store, scope: structuredClone(scope), worker,
         inventory: () => store.inventory(typeof runtime.observeActors === "function" ? pids => { assertScope(); return runtime.observeActors(pids); } : undefined),
-        startup: Object.freeze({ actor: Object.freeze({ ...actor }), sourceEnvironment, assertScope, observeSessionGeneration: observe,
+        startup: Object.freeze({
+            ...(selectAuthName ? { selectAuthSessionName: () => { assertScope(); return selectAuthName(); } } : {}),
+            ...(observeAuth ? { observeAuthSessionGeneration: (session) => { assertScope(); return observeAuth(session); } } : {}),
+            actor: Object.freeze({ ...actor }), sourceEnvironment, assertScope, observeSessionGeneration: observe,
             captureNativeParent: () => {
                 assertScope();
                 const fixed = sourceEvidence.captureIngress();
@@ -124,6 +136,7 @@ export function createExecutionParentProducer(input) {
                 if (fixed?.proof.endpoint.vendor === "claude")
                     producerEndpoint.verifyIngress(fixed.endpoint, fixed.proof);
                 return fixed;
-            } }),
+            }
+        }),
         relation_coverage: "incomplete" };
 }

package/dist/execution-participant.js

@@ -12,7 +12,7 @@ function snapshotRuntime(input) {
     for (const name of functions)
         if (typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-    const optional = ["observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner"];
+    const optional = ["selectAuthSessionName", "observeAuthSessionGeneration", "observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"];
     for (const name of optional)
         if (input[name] !== undefined && typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
@@ -70,7 +70,9 @@ export function createExecutionParticipant(input) {
     const server = createAitermServer({ execution: server => {
             assertScope();
             dispatcher = createExecutionDispatcher({ service: producer.service, nativeIdentity: actor, sourceEnvironment,
-                initializedClientName: () => server.server.getClientVersion()?.name, observeSessionGeneration, assertParticipant: assertScope, captureNativeParent });
+                initializedClientName: () => server.server.getClientVersion()?.name, observeSessionGeneration, assertParticipant: assertScope, captureNativeParent,
+                ...(producer.startup.selectAuthSessionName ? { selectAuthSessionName: producer.startup.selectAuthSessionName } : {}),
+                ...(producer.startup.observeAuthSessionGeneration ? { observeAuthSessionGeneration: producer.startup.observeAuthSessionGeneration } : {}) });
             return { dispatcher, parentExecution: producer.execution, parentDependencies, parentStateRoot: producer.scope.state_root };
         } });
     producer.store.enroll(["mcp"]);

package/dist/execution-runtime.js

@@ -45,7 +45,7 @@ const waitSchema = z.object({
 });
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 export function createExecutionRuntime(bindings) {
-    for (const name of ["observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
+    for (const name of ["observeCreatedLaunchSync", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
         if (bindings[name] !== undefined && typeof bindings[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const interruption = bindings.observeInterruptionSync;
@@ -72,7 +72,9 @@ export function createExecutionRuntime(bindings) {
             return { state: "unknown" };
         }
     };
+    const created = bindings.observeCreatedLaunchSync;
     return {
+        ...(created ? { observeCreatedLaunchSync: (target) => created(executionLaunchSchema.parse(target)) } : {}),
         ...(interruption ? { interruptionSync: (point) => interruption(executionPointSchema.parse(point)) } : {}),
         ...(selectInterruption ? { selectInterruptionSync: (expected, candidates) => selectInterruption(executionLaunchSchema.parse(expected), z.array(executionPointSchema).parse(candidates ?? [])) } : {}),
         ...(interruptKey ? { interruptKeySync: (point) => interruptKey(executionPointSchema.parse(point)) } : {}),

package/dist/execution-service.js

@@ -8,6 +8,7 @@ import { nativeInterruptionObservationSchema, interruptionIdentity, interruption
 import { interruptionKeyReference } from "./execution-interruption.js";
 import { isDeepStrictEqual } from "node:util";
 import { executionActorSchema } from "./execution-inventory.js";
+import { createdLaunchObservationSchema } from "./execution-launch-recovery.js";
 import { executionCheckpoint } from "./execution-checkpoint.js";
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const key = (value) => JSON.stringify(value);
@@ -544,6 +545,8 @@ export class ExecutionService {
             return this.register(args, context);
         if (args.action === "status")
             return this.store.transaction(state => view(state, find(state, args.request)), { readOnly: true });
+        if (args.action === "reconcile_launch")
+            return this.reconcileLaunch(args);
         return this.finish(args);
     }
     async admitNative(body) {
@@ -878,6 +881,9 @@ export class ExecutionService {
             try {
                 await this.store.transaction(state => {
                     const record = find(state, request);
+                    const owned = state.slots.find(slot => same(slot.request, request));
+                    if (!owned || owned.stage !== stage || record.operations[stage] !== "issued")
+                        return;
                     record.operations[stage] = certain ? "not_sent" : "unknown";
                     if (certain) {
                         state.slots = state.slots.filter(slot => !same(slot.request, request));
@@ -909,7 +915,7 @@ export class ExecutionService {
                 || (expected !== null && targetPoint.launch.launch_id !== expected))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             const current = await this.runtime.observe(slot.session_id);
-            const closing = request.kind === "mcp" && request.tool === "pty_close";
+            const closing = request.kind === "mcp" && ["pty_close", "agent_auth.cancel"].includes(request.tool);
             if (closing ? current.state !== "absent" : current.state !== "present" || !same(current.launch, targetPoint.launch))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             record.operations[stage] = "accepted";
@@ -940,6 +946,9 @@ export class ExecutionService {
             try {
                 await this.store.transaction(state => {
                     const record = find(state, request);
+                    const owned = state.slots.find(slot => same(slot.request, request));
+                    if (!owned || owned.stage !== stage || record.operations[stage] !== "issued")
+                        return;
                     record.operations[stage] = "unknown";
                     record.relation.phase = "submitted_unknown";
                     record.relation.completion = "unknown";
@@ -953,6 +962,45 @@ export class ExecutionService {
         });
         return { value: outcome.value, record };
     }
+    /** Explicit present-generation reconciliation. It never replays the original
+     * launch or input, and does not claim to recover the lost RPC receipt. */
+    async reconcileLaunch(args) {
+        return this.store.transaction(state => {
+            const record = find(state, args.request), relation = record.relation;
+            if (record.operations.launch === "accepted" && same(relation.target?.launch, args.target))
+                return view(state, record);
+            if (record.operations.launch === "issued")
+                throw new ExecutionError("EXECUTION_BUSY");
+            if (record.stopping || stopped(state, args.target) || stopped(state, relation.source?.launch)
+                || interruptionBlocksRequest(state, args.request))
+                throw new ExecutionError("EXECUTION_STOPPING");
+            const slots = state.slots.filter(slot => slot.session_id === args.target.session_id);
+            const slot = slots[0];
+            if (record.operations.launch !== "unknown" || record.operations.send !== "not_issued"
+                || relation.phase !== "submitted_unknown" || relation.completion !== "unknown" || relation.lifecycle !== "tracking"
+                || record.reservation.target.session_id !== args.target.session_id
+                || relation.target?.boundary != null || (relation.target && !same(relation.target.launch, args.target))
+                || (record.reservation.target.expected_launch_id !== null && record.reservation.target.expected_launch_id !== args.target.launch_id)
+                || slots.length !== 1 || !slot || !same(slot.request, args.request) || slot.stage !== "launch" || slot.state !== "unknown"
+                || !slot.created_native_id || !slot.created_server
+                || (slot.expected_launch_id !== null && slot.expected_launch_id !== args.target.launch_id)
+                || openParentEffect(state, args.request))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            if (!this.runtime.observeCreatedLaunchSync)
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            const parsed = createdLaunchObservationSchema.safeParse(this.runtime.observeCreatedLaunchSync(args.target));
+            if (!parsed.success || !same(parsed.data.target, args.target)
+                || parsed.data.native.native_id !== slot.created_native_id
+                || !isDeepStrictEqual(parsed.data.native.server, slot.created_server))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            record.operations.launch = "accepted";
+            relation.target = { launch: args.target, boundary: null };
+            relation.phase = "invoked";
+            relation.completion = "open";
+            state.slots = state.slots.filter(value => value !== slot);
+            return view(state, record);
+        });
+    }
     async finish(args) {
         return this.store.transaction(async (state) => {
             const record = find(state, args.request);

package/dist/execution-tools.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
+import { executionLaunchSchema, executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
 import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY } from "./execution-wire.js";
 import { withExecutionEffectScope, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { immediateStopInputSchema, immediateStopResultSchema } from "./execution-immediate-stop.js";
@@ -67,12 +67,12 @@ export function registerExecutionTools(server, service, options = {}) {
     const handlers = createExecutionToolHandlers(service, { ...options,
         ...(registration ? { sourceContext: registration.sourceContext } : {}) });
     server.registerTool("agent_execution", {
-        description: "既存の実配送/実行参照を送信前に登録、照会、対応終了証拠で更新する。本文や再送queueは保存しない。",
+        description: "既存の実配送/実行参照を登録・照会・終了証拠で更新し、結果不明の空起動を同世代へ照合する。本文や再送queueは保存しない。",
         // MCP accepts a raw object shape; the handler enforces the stricter action
         // union, including required fields and forbidden fields for each action.
-        inputSchema: { action: z.enum(["register", "status", "finish"]),
+        inputSchema: { action: z.enum(["register", "status", "finish", "reconcile_launch"]),
             reservation: executionReservationSchema.optional(), source_session_id: z.string().nullable().optional(),
-            request: executionRequestSchema.optional(), evidence: executionFinishSchema.shape.evidence.optional(),
+            request: executionRequestSchema.optional(), target: executionLaunchSchema.optional(), evidence: executionFinishSchema.shape.evidence.optional(),
             remote: z.never().optional() },
         outputSchema: executionRecordSchema.shape,
     }, async (args, extra) => handlers.agent_execution(args, extra));

package/dist/execution-wire.js

@@ -43,7 +43,10 @@ export const executionFinishSchema = z.object({
         z.object({ kind: z.literal("interrupted"), target: executionLaunchSchema }).strict(),
     ]),
 }).strict();
-export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema]);
+export const executionReconcileLaunchSchema = z.object({
+    action: z.literal("reconcile_launch"), request: executionRequestSchema, target: executionLaunchSchema,
+}).strict();
+export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema, executionReconcileLaunchSchema]);
 export const executionRefMetaSchema = z.object({
     schema: z.literal("aiterm.execution-ref.v1"), request: executionRequestSchema,
 }).strict();

package/docs/DESIGN.md

@@ -29,19 +29,24 @@ POSIXのraw tty回復もnative作用であり、tmux打鍵と同じ受付を通
 実stty直前にも同じdeviceを確認する。停止や世代/tty交代後に古いdeviceへ回復を発行しない。
 一つのRPCが複数のnative作用を発行するときも、各回に同じissued slotとsource/target世代・停止を再確認する。
 agentの貼付け・Enterの同期区間は、既存metadata mutexを非同期に取得してから実行する。
+native作成後に再開する起動準備も同じ非同期取得を通す。pane所有検査、fg/stty回復、
+起動メニューの各キーを短い同期区間で実行し、待機後の停止・世代・slot検査を省略しない。
 mutexをawait中へ持ち越さず、同じ同期stack内の各gateが発行記録を永続化してからnative作用へ進む。
 検証済みsourceと同世代への通常sendがissuedである間も、そのsourceの送信先が別ならoutgoing RPCは継続できる。
 incomingのslotを解放・書換・成功扱いせず、unknown・管理操作・世代不一致は従来どおり拒否する。
 incomingの完了待ちをoutgoingへ課して相互送信を循環待ちにしない（ADR 0127）。
 BellTeamのpromptなし明示管理launchは、管理close同様にserving process/request identityへ結合する。
 promptやThroughline読出しを含む未登録送信、auto-name、remoteはこの管理例外へ含めない。
+BellTeamのrefなしagent_configureも同じnative process/request identityの管理RPCとして受ける。
+model/effort/fastの各stageは同じ既存世代・slot・source・停止のgateを通り、途中で変われば続きの打鍵を拒否する。
+発行後の途中失敗はpossible/unknownを保持する。CLI結果待ち後のfast metadata書込も同じ準備受付で再検査する（ADR 0129）。
 新launchは、既存POSIX serverのnative owner、またはserver未作成の完全な空観測を受付時と発行直前に確認する。
 冷間時は最初のnew-session自身でserverを作り、その実receiptのnative IDとserver PIDを、作成後の安定したnative一覧とprocess開始識別子で照合する。
 既存server時も冷間時も、作成したsessionのnative ID・server owner・core内部のlaunch世代を同じ要求slotへ段階結合する。
 物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。冷間起動のための補助sessionや再送は作らない。
 作成時のnative ID/server ownerをmanaged metadataへ保存し、private runtimeの世代読取と期待closeでも再照合する。
 古いmetadataの欠測を現観測で補わず、既存席の自動登録は行わない。
-証拠の無い新server起動、Windows固有のserver作成、auto-name/通常PTY/auth等はまだunsupported。
+証拠の無い新server起動、Windows固有のserver作成、一般のauto-name/通常PTY等はまだunsupported。認証専用PTYはADR 0130の限定経路で受け付ける。
 実18 toolsのhandlerを作るconstructorは、private dispatcher/親execution callbackを明示注入して隔離SDKで検証できる。
 通常のstdio mainは注入せず、全参加process/全core作用口・native fenceが揃うまで公開有効化しない。
 private participant factoryはproducer/service/dispatcher/同process用worker profileを同じscopeとnative actorで組む。
@@ -403,6 +408,14 @@ shell、接続先、各harnessの公式CLIが所有する。
 ## Model catalog
 
 `agent_auth`の共通進行はcore、公式command・status・認証画面の解釈は`src/harnesses/`が所有する。CLIの認証processを通常HOMEのPTYへ一度だけ起動し、`remain-on-exit`と`pane_dead_status`で終了を観測する。credentialを読み取る状態管理や独自OAuthは持たず、Aitermが保存するのは認証sessionのharness・実行file・cwd・phase・引き継いだenvの名前だけである。取消と通常のPTY closeでこの相関記録を削除する。
+native明示入口のauth startは、既存SDK RPCのprocess/start/request identityへ結合し、session省略時は一意なPTY名だけを選んで先に予約する。
+認証済みno-opはPTY/serverを作らず元のv1/session_id:nullを返す。作成時は実new-session receiptからauth metadataへ
+native/server stampと新しいauth世代を保存・結合する。通常agent metadataや本文delivery refを捏造しない。
+既存authのstatus/onboarding・取消は同じ世代を各作用前に再検査する。消失済みはnative作用なしで既存v1 receiptを返す。
+BellTeamのrefなしpty_send/pty_keyは、この作成proofを保持するauth PTYにだけ許可し、通常Botの未登録本文には広げない。
+初回案内のrespawnも同じsession世代を保ち、phase保存は準備受付を通す。旧auth metadataの欠測を現nativeから補わず、
+不明な入力・世代・未返却RPCのslotをstatusだけで解除しない。credentialの保存・操作は公式CLIが所有する。
+
 
 PTYが消失した場合は、相関記録の有無にかかわらず`status`が`failed`、`cancel`が既に終了・取消済みを示す`blocked`を返し、どちらも`session_id:null`となる。保存したsession IDを解除して`start`で再開始できる。生存中の通常PTYやharness不一致、記録の破損・読取り失敗はエラーを返す。
 
@@ -440,6 +453,13 @@ unknown send枠を保持したまま既存core closeへ進み、native close成
 旧callbackは未知/消失した元slotで拒否され、同IDの新launchへnative作用を発行できない。
 issued、管理close自体のunknown、親作用のslot、世代/native/serverの不明・交代は対象外。
 既存の送信・待機lockの拒否も維持し、他席やissuerの停止を復旧条件へ追加しない。
+空起動の結果不明は明示 `agent_execution/reconcile_launch` で既存世代へ結合できる（ADR 0128）。
+対象は返却済みunknown launch、send:not_issued、元native/server stamp付きの単独slotだけ。
+同じmetadata transaction内のprivate同期primitiveで現在のnative/managed世代、生のinitial_prompt:none・初期配送なし、
+harness生存とidleを照合する。既存recordのlaunchをaccepted、targetを当該世代へ結合し、該当slotだけを外す。
+これは現在世代の明示採用で、失われたRPC receiptの復元ではない。本文・初期prompt・claim・nativeには作用しない。
+issued、入力済み・不明、停止、別slot、世代/native/serverの不一致は拒否。後続sendは元source世代を含め通常受付を通る。
+遅着した元callbackはまだ所有するissued stage/slotがある時だけunknownを書け、照合後や別stageを上書きしない。
 native handlerのisErrorは元の本文を保持し、`aiterm/execution_error`のcode/effectを併記する。
 native作用後の不明はpossibleのままで、原因説明を再送可否や成功receiptへ変換しない。
 agent sessionへの送信1本を守る`<name>.agent-send.lock`は持つ時間が長いので、持ち主が終了した残骸を次の送信が片付ける。消す役を`<name>.agent-send.lock.reap`の排他作成で1つに絞り、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.5",
+  "version": "0.61.7",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [