aiterm-mcp 0.61.6 → 0.61.8

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.8] - 2026-10-23
+
+### Fixed
+
+- Repeating empty-launch reconciliation now rechecks the current managed generation, no-input readiness and competing session operations before returning an accepted launch with an unissued send. A historical accepted receipt cannot authorize clearing a newer generation's launch uncertainty. Rejection preserves the existing graph and issues no native input.
+
+## [0.61.7] - 2026-10-23
+
+### Fixed
+
+- Native host `agent_auth` now admits automatic-name and explicit starts, authenticated no-op starts, session status/onboarding, absent-session receipts and cancellation through the existing v1 contract. Authentication PTYs retain their actual creation native/server identity and generation; only those proven PTYs accept ref-less host input/keys. The dispatcher uses the serving SDK RPC identity, without synthetic delivery references or read-only downgrade.
+- BellTeam model, effort and fast changes are admitted as native management RPCs bound to the existing session generation. Every native stage retains its normal stop/slot/generation checks, and partial failures retain possible effects. Fast-state metadata is revalidated before writing after asynchronous CLI observations.
+
+### Added
+
+- The opt-in native execution entry can explicitly reconcile a returned unknown, empty launch against its original native/server identity and current ready managed generation through `agent_execution/reconcile_launch`. It preserves the existing request and generation, issues no native input and permits a later ordinary send only through its usual admission. Issued RPCs and uncertain input or generations remain blocked; late callbacks cannot overwrite the reconciled stage.
+
 ## [0.61.6] - 2026-10-22
 
 ### Fixed
@@ -2742,7 +2759,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.6...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.8...HEAD
+[0.61.8]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.7...v0.61.8
+[0.61.7]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.6...v0.61.7
 [0.61.6]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...v0.61.6
 [0.61.5]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...v0.61.5
 [0.61.4]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.3...v0.61.4

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.6** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.8** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -734,6 +734,13 @@ agent_launch({ "harness": "codex-cli", "remote": { "host": "rabbit" }, "cwd": "/
 
 1回の `pty_send` が受理する本文はUTF-8で最大64KiB。同一sessionへの送信はaiterm processをまたいで直列化し、chunk同士の混線を防ぐ。全OSで長いPTY入力の欠落を避けるためplatformのmultiplexerへUTF-8境界を壊さない256-byte単位でpasteし、chunk間に10msのdrain間隔を置く。POSIX shellまたはPowerShellが前面にいる時のsanitize済み複数行は、改行を含まない単一入力へ符号化する。POSIXは`eval`、PowerShellはUTF-8のBase64を復元したscriptblockのdot-sourceを使い、変数と作業場所を現在のshellに保つ。shellがscript全体を所有してから先頭行を実行するため、途中で起動したpager／REPLが後続行を対話キーとして奪わない。単一行、`raw:true`、非shell前面は従来どおり直接PTYへpasteする。agent dispatchは本文全体を`ESC[200~/201~`で1回だけ包み、包んだ全体を同じchunkで流す。agent TUIには1回の貼り付けに見えるので画像pathが貼り付けの間で切れず、chunk投入中のキー解釈による語中文字化け・submit取り落としも抑える。途中chunkが失敗した場合は部分送信済みであることを明示し、自動でEnterを押さない。送信processの異常終了でlockが残った場合は送信前にfail-closedする。`pty_list`で対象sessionを確認し、`pty_close`で閉じてから同じsession IDを作り直す。公開の一括停止toolは存在しない。 POSIXの明示native execution構成では、unknown sendになった対象1席も`pty_close`で閉じて再作成できる。元requestはunknownのまま保持し、再送しない。発行中の操作、管理close自体のunknown、native identityが不明な席は引き続き拒否する。
 
+BellTeamのmodel・effort・fast変更も、既存session世代に結合したnative管理要求で受け付ける。途中で世代・受付枠・停止状態が変われば、それ以降の打鍵を止める。途中まで変更した結果は作用不明のまま保持し、自動でやり直さない。
+
+POSIXの明示native入口でも、`agent_auth`の名前なし開始、認証済みで何も起こさない開始、既存v1の確認・初回案内・取消を受け付ける。認証PTYは実際の作成元nativeと世代へ結合する。BellTeamの参照なし入力・キーは、この証拠がある認証PTYにだけ許可し、通常agentの本文には配送参照を引き続き必要とする。作成証拠のない旧認証metadataを自動登録しない。
+
+この明示入口では `agent_execution` の `reconcile_launch` に元の `request` と正確な `target: {session_id, launch_id}` を渡し、結果不明の空起動を既存世代へ結合できる。保存したnative/serverと現在のmanaged世代、raw状態で初期promptなし、生存して入力待ちのharnessをmetadata受付内で照合し、該当するunknown launch枠だけを解放する。受付済みでも本文未発行なら、照合を繰り返すたびに現在世代・入力待ち・競合操作なしを再確認する。保存した受付結果だけで後の世代を確認済みとしない。起動・打鍵・close・本文再送は行わない。issuedのRPC、入力状態不明、世代交代や世代未確認は拒否する。後続本文は元参照で通常のsend受付を通して一度だけ発行する。照合成功は失われた元RPC receiptの回収を意味しない。
+
+
 ## 人が覗く
 
 POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.6** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.8** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -796,9 +796,16 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
 
+An explicit `agent_execution` action `reconcile_launch` can bind an existing empty launch after a lost launch result in this opt-in entry. Supply the original `request` and exact `target: {session_id, launch_id}`. The server checks the original native/server identity, current managed generation, raw no-prompt state and a live ready harness under metadata admission, then releases only that unknown launch slot. Repeating an accepted empty launch before its send also rechecks the current generation, readiness and absence of competing session operations; a saved acceptance alone cannot confirm a later generation. It never launches, types, closes or resends. `issued` RPCs, unknown input and changed or unverified generations remain blocked. Any subsequent body uses the original reference through normal send admission once; a successful reconciliation does not prove the lost RPC receipt.
+
+
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
 On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 
+BellTeam model, effort and fast changes use a native management request bound to the existing session generation. Later stages stop if that generation, its admission slot or stop state changes. A partial change remains an uncertain effect and must not be blindly repeated.
+
+In the opt-in POSIX native entry, `agent_auth` also supports omitted session names, authenticated no-op starts and the normal v1 status/onboarding/cancel receipts. Authentication PTYs are bound to their actual native creator and generation. Ref-less BellTeam input or keys are allowed only for those proven authentication PTYs; ordinary agent messages still require their delivery reference. Legacy authentication metadata without creator proof is not automatically enrolled.
+
 ## Requirements
 
 - **Node.js >= 18**

package/dist/core.js

@@ -15,7 +15,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
 import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
-import { executionPointSchema } from "./execution-contract.js";
+import { executionLaunchSchema, executionPointSchema } from "./execution-contract.js";
 import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary, executionManagementCloseTarget, withExecutionNativeAdmission } from "./execution-effect.js";
 import { ExecutionError } from "./execution-wire.js";
 import { readExecutionParentProcess } from "./execution-parent-process.js";
@@ -1678,17 +1678,59 @@ export function observeExecutionSessionGeneration(name) {
     const native = before.sessions.find(value => value.session_id === name);
     if (!native)
         return result(false, null);
-    const meta = tryLoadAgentMetadata(name), proof = meta?.execution_native;
+    const meta = tryLoadAgentMetadata(name) ?? readExecutionAuthMetadata(name), proof = meta?.execution_native;
     if (!meta || !proof || !before.server || proof.native_id !== native.native_id
         || !isDeepStrictEqual(proof.server, before.server))
         return result(true, null);
-    const after = observeExecutionNativeCreationScope(), last = tryLoadAgentMetadata(name);
+    const after = observeExecutionNativeCreationScope(), last = tryLoadAgentMetadata(name) ?? readExecutionAuthMetadata(name);
     if (after.state !== "known" || !isDeepStrictEqual(after.server, proof.server)
         || after.sessions.find(value => value.session_id === name)?.native_id !== proof.native_id
-        || last?.launch_id !== meta.launch_id || !isDeepStrictEqual(last.execution_native, proof))
+        || last?.launch_id !== meta.launch_id || !isDeepStrictEqual(last?.execution_native, proof))
         return result(true, null);
     return result(true, meta.launch_id);
 }
+/** Only native-stamped authentication PTYs qualify for host auth input. */
+export function observeExecutionAuthSessionGeneration(name) {
+    const current = observeExecutionSessionGeneration(name), meta = readExecutionAuthMetadata(name);
+    return { ...current, launch_id: current.launch_id && current.launch_id === meta?.launch_id && !tryLoadAgentMetadata(name)
+            ? current.launch_id : null };
+}
+/** Allocate only a terminal name. The serving RPC then reserves it and the
+ * actual native creation receipt supplies its identity; no existing seat is enrolled. */
+export function selectExecutionAuthSessionName() { return "auth-" + randomBytes(12).toString("hex"); }
+/** Read-only proof for reconciling a created, empty launch. Inspect raw prompt
+ * state: legacy/default normalization must never prove that input was absent. */
+export function observeExecutionCreatedLaunch(target) {
+    target = executionLaunchSchema.parse(target);
+    const unknown = () => { throw new ExecutionError("EXECUTION_UNCONFIRMED"); };
+    const generation = () => {
+        const value = observeExecutionSessionGeneration(target.session_id);
+        if (!value.exists || value.launch_id !== target.launch_id)
+            unknown();
+    };
+    const read = () => {
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(agentMetadataPath(target.session_id, target.launch_id), "utf8"));
+        }
+        catch {
+            return unknown();
+        }
+        const proof = executionNativeBindingSchema.safeParse(raw.execution_native);
+        if (raw.aiterm_session !== target.session_id || raw.launch_id !== target.launch_id
+            || raw.initial_prompt !== "none" || raw.initial_prompt_delivery != null || !proof.success)
+            return unknown();
+        return proof.data;
+    };
+    generation();
+    const native = read(), live = observeSession(target.session_id);
+    if (live.launch_id !== target.launch_id || live.harness_alive !== true || live.harness_process === null || live.state !== "idle")
+        unknown();
+    generation();
+    if (!isDeepStrictEqual(read(), native))
+        unknown();
+    return { target, native, initial_prompt: "none", initial_prompt_delivery: null, harness_alive: true, ready: true };
+}
 /** Private source-provenance snapshot. It deliberately omits screen, argv,
  * environment and cached vendor_session_id. No public tool is added. The
  * consumer proves its native serving MCP process descends from this unique
@@ -4522,6 +4564,19 @@ function loadAuthMetadata(name, kind) {
     }
     return value;
 }
+function readExecutionAuthMetadata(name) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(authMetadataPath(name), "utf8"));
+        if (!["claude", "codex", "grok", "cursor"].includes(raw?.kind))
+            return null;
+        const meta = loadAuthMetadata(name, raw.kind), launch = executionLaunchSchema.shape.launch_id.safeParse(meta?.launch_id);
+        const native = executionNativeBindingSchema.safeParse(meta?.execution_native);
+        return meta && launch.success && native.success ? { ...meta, launch_id: launch.data, execution_native: native.data } : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** 一覧の取得失敗を端末の消失へ丸めず、正規PTY一覧で存在を確認する。 */
 function authSessionExists(name) {
     return listSessionsResult().sessions.some(session => session.session_id === name);
@@ -4564,7 +4619,7 @@ export async function authenticateAgent(kind, options) {
         const meta = loadAuthMetadata(options.session_id, kind);
         if (!authSessionExists(options.session_id)) {
             if (meta)
-                fs.unlinkSync(authMetadataPath(options.session_id));
+                withExecutionPreparation(options.session_id, () => fs.unlinkSync(authMetadataPath(options.session_id)));
             return result("blocked", null, "認証sessionは既に終了または取消済みです。");
         }
         if (!meta)
@@ -4595,7 +4650,13 @@ export async function authenticateAgent(kind, options) {
             const kept = tmux("set-option", "-t", name, "remain-on-exit", "on");
             if (kept.code !== 0)
                 throw new AitermError("AGENT_AUTH_PANE_CONFIG_FAILED: 認証processの終了観測を設定できません。", 2);
-            writeJson0600(authMetadataPath(name), meta);
+            if (hasExecutionCreationScope()) {
+                meta.launch_id = randomBytes(16).toString("hex");
+                meta.execution_native = executionCreatedNativeBinding(name);
+            }
+            withExecutionPreparation(name, () => writeJson0600(authMetadataPath(name), meta));
+            if (meta.launch_id && hasExecutionCreationScope())
+                bindExecutionCreatedLaunch({ session_id: name, launch_id: meta.launch_id });
             launchAuthProcess(name, meta);
         }
         catch (error) {
@@ -4643,8 +4704,10 @@ export async function authenticateAgent(kind, options) {
                 return result("authenticated", session, null);
             if (meta.phase === "onboarding")
                 return result("blocked", session, "公式CLIの初回案内の完了を確認できません。");
-            meta.phase = "onboarding";
-            writeJson0600(authMetadataPath(session), meta);
+            withExecutionPreparation(session, () => {
+                meta.phase = "onboarding";
+                writeJson0600(authMetadataPath(session), meta);
+            });
             const restarted = tmux("respawn-pane", "-k", "-t", session, resolveWinPaneShell("bash"));
             if (restarted.code !== 0)
                 return result("failed", session, "公式CLIの初回案内を起動できません。");
@@ -5039,8 +5102,10 @@ const restoreCursorDefaults = (configPath) => (before) => {
         restoreJsonSetting(configPath, before, CURSOR_DEFAULT_MODEL_KEYS);
 };
 function recordAgentFast(meta, fast) {
-    meta.fast = fast;
-    writeAgentMetadata(meta);
+    withExecutionPreparation(meta.aiterm_session, () => {
+        meta.fast = fast;
+        writeAgentMetadata(meta);
+    });
 }
 /** 動いている席のfastを切り替える。返りは切り替えた後の状態。席は入力待ちである事（呼び手が確かめる）。 */
 async function switchAgentFast(name, meta, target, verified = false) {

package/dist/execution-dispatch.js

@@ -33,14 +33,14 @@ function routeFor(name, args) {
     if (!nativeTool.success)
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const target = launches.has(name) ? args.session_name : name === "pty_open" ? args.name : args.session_id;
-    // Automatic names are selected inside existing core today. Do not guess the
-    // future name or act before reserving it at the actual selection boundary.
+    // Generic automatic names remain unsupported. Auth start selects its name
+    // through the private allocator before this route reserves it.
     if (target === undefined || target === null)
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const session = executionLaunchSchema.shape.session_id.safeParse(target);
     if (!session.success)
         throw new ExecutionError("EXECUTION_INVALID");
-    return { tool: nativeTool.data, target: session.data, stage: launches.has(name) ? "launch" : "send" };
+    return { tool: nativeTool.data, target: session.data, stage: launches.has(name) || tool === "agent_auth.start" ? "launch" : "send" };
 }
 // The SDK signal belongs to this serving RPC, not to a whole CLI turn. Keep
 // an immediate local gate while the shared metadata lock may be awaiting I/O.
@@ -79,6 +79,19 @@ function requestCancellation(service, request, input) {
     };
 }
 export function createExecutionDispatcher(bindings) {
+    const selectAuthName = bindings.selectAuthSessionName, observeAuth = bindings.observeAuthSessionGeneration;
+    for (const fn of [selectAuthName, observeAuth])
+        if (fn !== undefined && typeof fn !== "function")
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const authGeneration = (session) => {
+        if (!observeAuth)
+            return null;
+        const value = observeAuth(session);
+        if (!value || value.schema !== "aiterm.pty-observe-result.v1" || value.session_id !== session || value.exists !== true)
+            return null;
+        const launch = executionLaunchSchema.safeParse({ session_id: session, launch_id: value.launch_id });
+        return launch.success ? { launch: launch.data, boundary: null } : null;
+    };
     const captureNativeParent = bindings.captureNativeParent;
     if (captureNativeParent !== undefined && typeof captureNativeParent !== "function")
         throw new ExecutionError("EXECUTION_UNSUPPORTED");
@@ -129,6 +142,13 @@ export function createExecutionDispatcher(bindings) {
                         executionHostSourceFromMeta(fixedExtra._meta, bindings.initializedClientName());
                         return await body(args, fixedExtra);
                     }
+                    if (name === "agent_auth" && (args.action !== "status" || args.session_id !== undefined) && !observeAuth)
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    if (name === "agent_auth" && args.action === "start" && args.session_id === undefined) {
+                        if (!native || !selectAuthName)
+                            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                        args.session_id = executionLaunchSchema.shape.session_id.parse(selectAuthName());
+                    }
                     const route = routeFor(name, args);
                     if (!route)
                         return await body(args, fixedExtra);
@@ -145,7 +165,12 @@ export function createExecutionDispatcher(bindings) {
                     const hostClose = client === "bellteam" && route.tool === "pty_close" && !supplied;
                     const hostLaunch = client === "bellteam" && route.tool === "agent_launch" && !supplied
                         && args.prompt == null && args.throughline_source_session === undefined;
-                    const hostManagement = hostClose || hostLaunch;
+                    const hostConfigure = client === "bellteam" && route.tool === "agent_configure" && !supplied;
+                    const authOperation = name === "agent_auth";
+                    const authInput = (route.tool === "pty_send" || route.tool === "pty_key") && !supplied
+                        && client === "bellteam" ? authGeneration(route.target) : null;
+                    const hostAuth = client === "bellteam" && !supplied && authOperation;
+                    const hostManagement = hostClose || hostLaunch || hostConfigure || hostAuth || !!authInput;
                     if (args.remote !== undefined && args.remote !== null)
                         throw new ExecutionError("EXECUTION_UNSUPPORTED");
                     let reference = supplied;
@@ -195,8 +220,16 @@ export function createExecutionDispatcher(bindings) {
                         if ((client === "bellteam" && !hostManagement) || !directRequest)
                             throw new ExecutionError("EXECUTION_UNSUPPORTED");
                         const current = await observe(route.target);
+                        if (authOperation && route.tool !== "agent_auth.start") {
+                            // A missing auth PTY returns the public v1 failed/already-cancelled
+                            // receipt. There is no native effect or replacement creation.
+                            if (!current.point)
+                                route.stage = "launch";
+                        }
                         if (route.stage === "send" && !current.point)
                             throw new ExecutionError("EXECUTION_STALE_GENERATION");
+                        if (authInput && !same(authInput, current.point))
+                            throw new ExecutionError("EXECUTION_STALE_GENERATION");
                         const request = directRequest;
                         cancellation?.assert();
                         await bindings.service.execute({ action: "register", source_session_id: source?.launch.session_id ?? directSeat,
@@ -230,7 +263,7 @@ export function createExecutionDispatcher(bindings) {
                         // must not turn a valid accepted action into permission to resend.
                         let target = null;
                         try {
-                            if (route.tool === "pty_close")
+                            if (route.tool === "pty_close" || route.tool === "agent_auth.cancel")
                                 target = expected ? { launch: expected, boundary: null } : null;
                             else {
                                 const current = await observe(route.target);

package/dist/execution-launch-recovery.js

@@ -0,0 +1,9 @@
+// Private read-only evidence from the serving native scope, never client claims.
+import { z } from "zod";
+import { executionLaunchSchema } from "./execution-contract.js";
+import { executionNativeBindingSchema } from "./execution-close.js";
+export const createdLaunchObservationSchema = z.object({
+    target: executionLaunchSchema, native: executionNativeBindingSchema,
+    initial_prompt: z.literal("none"), initial_prompt_delivery: z.null(),
+    harness_alive: z.literal(true), ready: z.literal(true),
+}).strict();

package/dist/execution-native-server.js

@@ -35,6 +35,9 @@ export function createNativeExecutionServer(input) {
             ?? provider.cursorParentFromRequest(profile, client, { hookRoot: path.join(expectedScope.state_root, "cursor-parent-hooks") }),
         observeDone: core.observeAgentDone,
         observeNativeSessions: core.observeExecutionNativeCreationScope,
+        selectAuthSessionName: core.selectExecutionAuthSessionName,
+        observeAuthSessionGeneration: core.observeExecutionAuthSessionGeneration,
+        observeCreatedLaunchSync: core.observeExecutionCreatedLaunch,
         closeExpectedSession: core.closeExpectedAgentSession, // explicit management only, never stop fallback
         observeInterruptionSync: core.observeExpectedAgentRunInterruption,
         selectInterruptionSync: core.selectExpectedAgentRunInterruption,

package/dist/execution-parent-producer.js

@@ -1,7 +1,7 @@
 // Private same-scope MCP parent producer. No public/index/profile mount. Queue
 // aliases lacking current independent native proof remain unsupported.
 import path from "node:path";
-import { observeAgentDone, observeExecutionNativeCreationScope, closeExpectedAgentSession } from "./core.js";
+import { observeAgentDone, selectExecutionAuthSessionName, observeExecutionAuthSessionGeneration, observeExecutionNativeCreationScope, closeExpectedAgentSession, observeExecutionCreatedLaunch } from "./core.js";
 import { codexParentFromRequest } from "./codex-parent-receiver.js";
 import { claudeParentFromRequest } from "./claude-parent-receiver.js";
 import { cursorParentFromRequest } from "./cursor-parent-receiver.js";
@@ -30,13 +30,18 @@ const localProducerRuntime = {
         ?? cursorParentFromRequest(client, { hookRoot: path.join(stateRoot(), "cursor-parent-hooks") }),
     observeDone: observeAgentDone,
     observeNativeSessions: observeExecutionNativeCreationScope,
+    selectAuthSessionName: selectExecutionAuthSessionName,
+    observeAuthSessionGeneration: observeExecutionAuthSessionGeneration,
+    observeCreatedLaunchSync: observeExecutionCreatedLaunch,
     closeExpectedSession: closeExpectedAgentSession,
 };
 export function createExecutionParentProducer(input) {
     const runtime = input.runtime ?? localProducerRuntime;
-    for (const name of ["observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner"])
+    for (const name of ["selectAuthSessionName", "observeAuthSessionGeneration", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"])
         if (runtime[name] !== undefined && typeof runtime[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const selectAuthName = runtime.selectAuthSessionName?.bind(runtime), observeAuth = runtime.observeAuthSessionGeneration?.bind(runtime);
+    const createdLaunch = runtime.observeCreatedLaunchSync?.bind(runtime);
     const interruption = runtime.observeInterruptionSync?.bind(runtime);
     const selectInterruption = runtime.selectInterruptionSync?.bind(runtime), interruptKey = runtime.interruptKeySync?.bind(runtime);
     const observeActors = runtime.observeActors?.bind(runtime);
@@ -68,6 +73,10 @@ export function createExecutionParentProducer(input) {
             } } : {}),
         ...(interruptKey ? { interruptKeySync: (point) => { assertScope(); return interruptKey(point); } } : {}),
         observeSession: observe, observeSessionSync: observe,
+        ...(createdLaunch ? { observeCreatedLaunchSync: (target) => {
+                assertScope();
+                return createdLaunch(target);
+            } } : {}),
         ...(typeof runtime.observeNativeSessions === "function" ? { observeNativeSessionsSync: () => {
                 assertScope();
                 return runtime.observeNativeSessions();
@@ -115,7 +124,10 @@ export function createExecutionParentProducer(input) {
     requireExecutionEffectScope(true);
     return { execution, parent, native, service, store, scope: structuredClone(scope), worker,
         inventory: () => store.inventory(typeof runtime.observeActors === "function" ? pids => { assertScope(); return runtime.observeActors(pids); } : undefined),
-        startup: Object.freeze({ actor: Object.freeze({ ...actor }), sourceEnvironment, assertScope, observeSessionGeneration: observe,
+        startup: Object.freeze({
+            ...(selectAuthName ? { selectAuthSessionName: () => { assertScope(); return selectAuthName(); } } : {}),
+            ...(observeAuth ? { observeAuthSessionGeneration: (session) => { assertScope(); return observeAuth(session); } } : {}),
+            actor: Object.freeze({ ...actor }), sourceEnvironment, assertScope, observeSessionGeneration: observe,
             captureNativeParent: () => {
                 assertScope();
                 const fixed = sourceEvidence.captureIngress();
@@ -124,6 +136,7 @@ export function createExecutionParentProducer(input) {
                 if (fixed?.proof.endpoint.vendor === "claude")
                     producerEndpoint.verifyIngress(fixed.endpoint, fixed.proof);
                 return fixed;
-            } }),
+            }
+        }),
         relation_coverage: "incomplete" };
 }

package/dist/execution-participant.js

@@ -12,7 +12,7 @@ function snapshotRuntime(input) {
     for (const name of functions)
         if (typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-    const optional = ["observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner"];
+    const optional = ["selectAuthSessionName", "observeAuthSessionGeneration", "observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"];
     for (const name of optional)
         if (input[name] !== undefined && typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
@@ -70,7 +70,9 @@ export function createExecutionParticipant(input) {
     const server = createAitermServer({ execution: server => {
             assertScope();
             dispatcher = createExecutionDispatcher({ service: producer.service, nativeIdentity: actor, sourceEnvironment,
-                initializedClientName: () => server.server.getClientVersion()?.name, observeSessionGeneration, assertParticipant: assertScope, captureNativeParent });
+                initializedClientName: () => server.server.getClientVersion()?.name, observeSessionGeneration, assertParticipant: assertScope, captureNativeParent,
+                ...(producer.startup.selectAuthSessionName ? { selectAuthSessionName: producer.startup.selectAuthSessionName } : {}),
+                ...(producer.startup.observeAuthSessionGeneration ? { observeAuthSessionGeneration: producer.startup.observeAuthSessionGeneration } : {}) });
             return { dispatcher, parentExecution: producer.execution, parentDependencies, parentStateRoot: producer.scope.state_root };
         } });
     producer.store.enroll(["mcp"]);

package/dist/execution-runtime.js

@@ -45,7 +45,7 @@ const waitSchema = z.object({
 });
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 export function createExecutionRuntime(bindings) {
-    for (const name of ["observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
+    for (const name of ["observeCreatedLaunchSync", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
         if (bindings[name] !== undefined && typeof bindings[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const interruption = bindings.observeInterruptionSync;
@@ -72,7 +72,9 @@ export function createExecutionRuntime(bindings) {
             return { state: "unknown" };
         }
     };
+    const created = bindings.observeCreatedLaunchSync;
     return {
+        ...(created ? { observeCreatedLaunchSync: (target) => created(executionLaunchSchema.parse(target)) } : {}),
         ...(interruption ? { interruptionSync: (point) => interruption(executionPointSchema.parse(point)) } : {}),
         ...(selectInterruption ? { selectInterruptionSync: (expected, candidates) => selectInterruption(executionLaunchSchema.parse(expected), z.array(executionPointSchema).parse(candidates ?? [])) } : {}),
         ...(interruptKey ? { interruptKeySync: (point) => interruptKey(executionPointSchema.parse(point)) } : {}),

package/dist/execution-service.js

@@ -8,6 +8,7 @@ import { nativeInterruptionObservationSchema, interruptionIdentity, interruption
 import { interruptionKeyReference } from "./execution-interruption.js";
 import { isDeepStrictEqual } from "node:util";
 import { executionActorSchema } from "./execution-inventory.js";
+import { createdLaunchObservationSchema } from "./execution-launch-recovery.js";
 import { executionCheckpoint } from "./execution-checkpoint.js";
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const key = (value) => JSON.stringify(value);
@@ -544,6 +545,8 @@ export class ExecutionService {
             return this.register(args, context);
         if (args.action === "status")
             return this.store.transaction(state => view(state, find(state, args.request)), { readOnly: true });
+        if (args.action === "reconcile_launch")
+            return this.reconcileLaunch(args);
         return this.finish(args);
     }
     async admitNative(body) {
@@ -878,6 +881,9 @@ export class ExecutionService {
             try {
                 await this.store.transaction(state => {
                     const record = find(state, request);
+                    const owned = state.slots.find(slot => same(slot.request, request));
+                    if (!owned || owned.stage !== stage || record.operations[stage] !== "issued")
+                        return;
                     record.operations[stage] = certain ? "not_sent" : "unknown";
                     if (certain) {
                         state.slots = state.slots.filter(slot => !same(slot.request, request));
@@ -909,7 +915,7 @@ export class ExecutionService {
                 || (expected !== null && targetPoint.launch.launch_id !== expected))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             const current = await this.runtime.observe(slot.session_id);
-            const closing = request.kind === "mcp" && request.tool === "pty_close";
+            const closing = request.kind === "mcp" && ["pty_close", "agent_auth.cancel"].includes(request.tool);
             if (closing ? current.state !== "absent" : current.state !== "present" || !same(current.launch, targetPoint.launch))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
             record.operations[stage] = "accepted";
@@ -940,6 +946,9 @@ export class ExecutionService {
             try {
                 await this.store.transaction(state => {
                     const record = find(state, request);
+                    const owned = state.slots.find(slot => same(slot.request, request));
+                    if (!owned || owned.stage !== stage || record.operations[stage] !== "issued")
+                        return;
                     record.operations[stage] = "unknown";
                     record.relation.phase = "submitted_unknown";
                     record.relation.completion = "unknown";
@@ -953,6 +962,61 @@ export class ExecutionService {
         });
         return { value: outcome.value, record };
     }
+    /** Explicit present-generation reconciliation. It never replays the original
+     * launch or input, and does not claim to recover the lost RPC receipt. */
+    async reconcileLaunch(args) {
+        return this.store.transaction(state => {
+            const record = find(state, args.request), relation = record.relation;
+            if (record.operations.launch === "accepted" && same(relation.target?.launch, args.target)) {
+                // A saved accepted receipt is historical. Before a caller can use an
+                // empty launch to resume input, prove that this generation is still
+                // present and no later operation owns the same session slot.
+                if (record.operations.send === "not_issued") {
+                    if (record.stopping || stopped(state, args.target) || stopped(state, relation.source?.launch)
+                        || interruptionBlocksRequest(state, args.request))
+                        throw new ExecutionError("EXECUTION_STOPPING");
+                    if (state.slots.some(slot => slot.session_id === args.target.session_id) || openParentEffect(state, args.request))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    if (!this.runtime.observeCreatedLaunchSync)
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    const parsed = createdLaunchObservationSchema.safeParse(this.runtime.observeCreatedLaunchSync(args.target));
+                    if (!parsed.success || !same(parsed.data.target, args.target))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                }
+                return view(state, record);
+            }
+            if (record.operations.launch === "issued")
+                throw new ExecutionError("EXECUTION_BUSY");
+            if (record.stopping || stopped(state, args.target) || stopped(state, relation.source?.launch)
+                || interruptionBlocksRequest(state, args.request))
+                throw new ExecutionError("EXECUTION_STOPPING");
+            const slots = state.slots.filter(slot => slot.session_id === args.target.session_id);
+            const slot = slots[0];
+            if (record.operations.launch !== "unknown" || record.operations.send !== "not_issued"
+                || relation.phase !== "submitted_unknown" || relation.completion !== "unknown" || relation.lifecycle !== "tracking"
+                || record.reservation.target.session_id !== args.target.session_id
+                || relation.target?.boundary != null || (relation.target && !same(relation.target.launch, args.target))
+                || (record.reservation.target.expected_launch_id !== null && record.reservation.target.expected_launch_id !== args.target.launch_id)
+                || slots.length !== 1 || !slot || !same(slot.request, args.request) || slot.stage !== "launch" || slot.state !== "unknown"
+                || !slot.created_native_id || !slot.created_server
+                || (slot.expected_launch_id !== null && slot.expected_launch_id !== args.target.launch_id)
+                || openParentEffect(state, args.request))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            if (!this.runtime.observeCreatedLaunchSync)
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            const parsed = createdLaunchObservationSchema.safeParse(this.runtime.observeCreatedLaunchSync(args.target));
+            if (!parsed.success || !same(parsed.data.target, args.target)
+                || parsed.data.native.native_id !== slot.created_native_id
+                || !isDeepStrictEqual(parsed.data.native.server, slot.created_server))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            record.operations.launch = "accepted";
+            relation.target = { launch: args.target, boundary: null };
+            relation.phase = "invoked";
+            relation.completion = "open";
+            state.slots = state.slots.filter(value => value !== slot);
+            return view(state, record);
+        });
+    }
     async finish(args) {
         return this.store.transaction(async (state) => {
             const record = find(state, args.request);

package/dist/execution-tools.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
+import { executionLaunchSchema, executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
 import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY } from "./execution-wire.js";
 import { withExecutionEffectScope, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { immediateStopInputSchema, immediateStopResultSchema } from "./execution-immediate-stop.js";
@@ -67,12 +67,12 @@ export function registerExecutionTools(server, service, options = {}) {
     const handlers = createExecutionToolHandlers(service, { ...options,
         ...(registration ? { sourceContext: registration.sourceContext } : {}) });
     server.registerTool("agent_execution", {
-        description: "既存の実配送/実行参照を送信前に登録、照会、対応終了証拠で更新する。本文や再送queueは保存しない。",
+        description: "既存の実配送/実行参照を登録・照会・終了証拠で更新し、結果不明の空起動を同世代へ照合する。本文や再送queueは保存しない。",
         // MCP accepts a raw object shape; the handler enforces the stricter action
         // union, including required fields and forbidden fields for each action.
-        inputSchema: { action: z.enum(["register", "status", "finish"]),
+        inputSchema: { action: z.enum(["register", "status", "finish", "reconcile_launch"]),
             reservation: executionReservationSchema.optional(), source_session_id: z.string().nullable().optional(),
-            request: executionRequestSchema.optional(), evidence: executionFinishSchema.shape.evidence.optional(),
+            request: executionRequestSchema.optional(), target: executionLaunchSchema.optional(), evidence: executionFinishSchema.shape.evidence.optional(),
             remote: z.never().optional() },
         outputSchema: executionRecordSchema.shape,
     }, async (args, extra) => handlers.agent_execution(args, extra));

package/dist/execution-wire.js

@@ -43,7 +43,10 @@ export const executionFinishSchema = z.object({
         z.object({ kind: z.literal("interrupted"), target: executionLaunchSchema }).strict(),
     ]),
 }).strict();
-export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema]);
+export const executionReconcileLaunchSchema = z.object({
+    action: z.literal("reconcile_launch"), request: executionRequestSchema, target: executionLaunchSchema,
+}).strict();
+export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema, executionReconcileLaunchSchema]);
 export const executionRefMetaSchema = z.object({
     schema: z.literal("aiterm.execution-ref.v1"), request: executionRequestSchema,
 }).strict();

package/docs/DESIGN.md

@@ -37,13 +37,16 @@ incomingのslotを解放・書換・成功扱いせず、unknown・管理操作
 incomingの完了待ちをoutgoingへ課して相互送信を循環待ちにしない（ADR 0127）。
 BellTeamのpromptなし明示管理launchは、管理close同様にserving process/request identityへ結合する。
 promptやThroughline読出しを含む未登録送信、auto-name、remoteはこの管理例外へ含めない。
+BellTeamのrefなしagent_configureも同じnative process/request identityの管理RPCとして受ける。
+model/effort/fastの各stageは同じ既存世代・slot・source・停止のgateを通り、途中で変われば続きの打鍵を拒否する。
+発行後の途中失敗はpossible/unknownを保持する。CLI結果待ち後のfast metadata書込も同じ準備受付で再検査する（ADR 0129）。
 新launchは、既存POSIX serverのnative owner、またはserver未作成の完全な空観測を受付時と発行直前に確認する。
 冷間時は最初のnew-session自身でserverを作り、その実receiptのnative IDとserver PIDを、作成後の安定したnative一覧とprocess開始識別子で照合する。
 既存server時も冷間時も、作成したsessionのnative ID・server owner・core内部のlaunch世代を同じ要求slotへ段階結合する。
 物理shell準備はnative IDへ固定し、未結合の同名世代を採用しない。冷間起動のための補助sessionや再送は作らない。
 作成時のnative ID/server ownerをmanaged metadataへ保存し、private runtimeの世代読取と期待closeでも再照合する。
 古いmetadataの欠測を現観測で補わず、既存席の自動登録は行わない。
-証拠の無い新server起動、Windows固有のserver作成、auto-name/通常PTY/auth等はまだunsupported。
+証拠の無い新server起動、Windows固有のserver作成、一般のauto-name/通常PTY等はまだunsupported。認証専用PTYはADR 0130の限定経路で受け付ける。
 実18 toolsのhandlerを作るconstructorは、private dispatcher/親execution callbackを明示注入して隔離SDKで検証できる。
 通常のstdio mainは注入せず、全参加process/全core作用口・native fenceが揃うまで公開有効化しない。
 private participant factoryはproducer/service/dispatcher/同process用worker profileを同じscopeとnative actorで組む。
@@ -405,6 +408,14 @@ shell、接続先、各harnessの公式CLIが所有する。
 ## Model catalog
 
 `agent_auth`の共通進行はcore、公式command・status・認証画面の解釈は`src/harnesses/`が所有する。CLIの認証processを通常HOMEのPTYへ一度だけ起動し、`remain-on-exit`と`pane_dead_status`で終了を観測する。credentialを読み取る状態管理や独自OAuthは持たず、Aitermが保存するのは認証sessionのharness・実行file・cwd・phase・引き継いだenvの名前だけである。取消と通常のPTY closeでこの相関記録を削除する。
+native明示入口のauth startは、既存SDK RPCのprocess/start/request identityへ結合し、session省略時は一意なPTY名だけを選んで先に予約する。
+認証済みno-opはPTY/serverを作らず元のv1/session_id:nullを返す。作成時は実new-session receiptからauth metadataへ
+native/server stampと新しいauth世代を保存・結合する。通常agent metadataや本文delivery refを捏造しない。
+既存authのstatus/onboarding・取消は同じ世代を各作用前に再検査する。消失済みはnative作用なしで既存v1 receiptを返す。
+BellTeamのrefなしpty_send/pty_keyは、この作成proofを保持するauth PTYにだけ許可し、通常Botの未登録本文には広げない。
+初回案内のrespawnも同じsession世代を保ち、phase保存は準備受付を通す。旧auth metadataの欠測を現nativeから補わず、
+不明な入力・世代・未返却RPCのslotをstatusだけで解除しない。credentialの保存・操作は公式CLIが所有する。
+
 
 PTYが消失した場合は、相関記録の有無にかかわらず`status`が`failed`、`cancel`が既に終了・取消済みを示す`blocked`を返し、どちらも`session_id:null`となる。保存したsession IDを解除して`start`で再開始できる。生存中の通常PTYやharness不一致、記録の破損・読取り失敗はエラーを返す。
 
@@ -442,6 +453,15 @@ unknown send枠を保持したまま既存core closeへ進み、native close成
 旧callbackは未知/消失した元slotで拒否され、同IDの新launchへnative作用を発行できない。
 issued、管理close自体のunknown、親作用のslot、世代/native/serverの不明・交代は対象外。
 既存の送信・待機lockの拒否も維持し、他席やissuerの停止を復旧条件へ追加しない。
+空起動の結果不明は明示 `agent_execution/reconcile_launch` で既存世代へ結合できる（ADR 0128）。
+対象は返却済みunknown launch、send:not_issued、元native/server stamp付きの単独slotだけ。
+同じmetadata transaction内のprivate同期primitiveで現在のnative/managed世代、生のinitial_prompt:none・初期配送なし、
+harness生存とidleを照合する。既存recordのlaunchをaccepted、targetを当該世代へ結合し、該当slotだけを外す。
+これは現在世代の明示採用で、失われたRPC receiptの復元ではない。本文・初期prompt・claim・nativeには作用しない。
+同じaccepted targetへの再照合もsend:not_issuedなら現在のmanaged世代・生の未入力状態・入力待ちを再確認し、
+同じsessionへの競合slotや親の未確定作用があれば拒否する。保存済みacceptedを後の世代の不明解除の証拠にしない。
+issued、入力済み・不明、停止、別slot、世代/native/serverの不一致は拒否。後続sendは元source世代を含め通常受付を通る。
+遅着した元callbackはまだ所有するissued stage/slotがある時だけunknownを書け、照合後や別stageを上書きしない。
 native handlerのisErrorは元の本文を保持し、`aiterm/execution_error`のcode/effectを併記する。
 native作用後の不明はpossibleのままで、原因説明を再送可否や成功receiptへ変換しない。
 agent sessionへの送信1本を守る`<name>.agent-send.lock`は持つ時間が長いので、持ち主が終了した残骸を次の送信が片付ける。消す役を`<name>.agent-send.lock.reap`の排他作成で1つに絞り、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.6",
+  "version": "0.61.8",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [