aiterm-mcp 0.61.7 → 0.61.9

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.9] - 2026-10-23
+
+### Fixed
+
+- Asynchronous agent launches wait for graph admission before their initial checks and their synchronous create/metadata/CLI input segment. CLI validation and readiness waits stay outside that mutex. A short competing writer cannot strand a managed shell between generation binding and CLI input; native effects are never retried.
+- Explicit native `pty_close` can recover a returned unknown launch only when the original native/server and managed generation still match, the raw initial prompt is absent, send remains unissued and the harness is confirmed exited. The close keeps the failed record and releases its slot only after native close and confirmed absence. Issued RPCs, live harnesses and uncertain input or identity remain blocked.
+
+### Added
+
+- The BellTeam native execution entry accepts explicit `agent_execution/close_launch` with the original request and exact target generation. It checks that expectation during admission and before close, uses the serving SDK management identity, and returns a versioned `_meta["aiterm/closed_launch"]` receipt only after close, confirmed absence and metadata commit. The original unknown record stays unchanged. Failed or uncertain closes return no closed receipt; later generations and historical receipts cannot authorize another close. The proof supports empty exited Claude Code and Codex launches.
+
+## [0.61.8] - 2026-10-23
+
+### Fixed
+
+- Repeating empty-launch reconciliation now rechecks the current managed generation, no-input readiness and competing session operations before returning an accepted launch with an unissued send. A historical accepted receipt cannot authorize clearing a newer generation's launch uncertainty. Rejection preserves the existing graph and issues no native input.
+
 ## [0.61.7] - 2026-10-23
 
 ### Fixed
@@ -2753,7 +2770,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.7...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.9...HEAD
+[0.61.9]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.8...v0.61.9
+[0.61.8]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.7...v0.61.8
 [0.61.7]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.6...v0.61.7
 [0.61.6]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.5...v0.61.6
 [0.61.5]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.4...v0.61.5

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.7** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.9** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -738,7 +738,13 @@ BellTeamのmodel・effort・fast変更も、既存session世代に結合したna
 
 POSIXの明示native入口でも、`agent_auth`の名前なし開始、認証済みで何も起こさない開始、既存v1の確認・初回案内・取消を受け付ける。認証PTYは実際の作成元nativeと世代へ結合する。BellTeamの参照なし入力・キーは、この証拠がある認証PTYにだけ許可し、通常agentの本文には配送参照を引き続き必要とする。作成証拠のない旧認証metadataを自動登録しない。
 
-この明示入口では `agent_execution` の `reconcile_launch` に元の `request` と正確な `target: {session_id, launch_id}` を渡し、結果不明の空起動を既存世代へ結合できる。保存したnative/serverと現在のmanaged世代、raw状態で初期promptなし、生存して入力待ちのharnessをmetadata受付内で照合し、該当するunknown launch枠だけを解放する。起動・打鍵・close・本文再送は行わない。issuedのRPC、入力状態不明、世代交代や世代未確認は拒否する。後続本文は元参照で通常のsend受付を通して一度だけ発行する。照合成功は失われた元RPC receiptの回収を意味しない。
+この明示入口では `agent_execution` の `reconcile_launch` に元の `request` と正確な `target: {session_id, launch_id}` を渡し、結果不明の空起動を既存世代へ結合できる。保存したnative/serverと現在のmanaged世代、raw状態で初期promptなし、生存して入力待ちのharnessをmetadata受付内で照合し、該当するunknown launch枠だけを解放する。受付済みでも本文未発行なら、照合を繰り返すたびに現在世代・入力待ち・競合操作なしを再確認する。保存した受付結果だけで後の世代を確認済みとしない。起動・打鍵・close・本文再送は行わない。issuedのRPC、入力状態不明、世代交代や世代未確認は拒否する。後続本文は元参照で通常のsend受付を通して一度だけ発行する。照合成功は失われた元RPC receiptの回収を意味しない。
+
+CLIが終了した結果不明の空起動には、BellTeam native入口の `agent_execution({action: "close_launch", request, target: {session_id, launch_id}})` を明示的に使う。元requestと期待世代を受付内とnative close直前で照合し、原native/server・managed世代一致、raw初期prompt `none`・初期配送なし・send未発行・現在CLI終了の正規probeがすべて必要になる。Claude CodeとCodexで同じ証明条件を使う。生存・issued・送信済み・欠測・世代交代は拒否し、sessionだけのcloseへの代用や自動再起動・再送はしない。旧版は新actionを拒否する。
+
+成功時の `structuredContent` は応答するSDKの別管理requestのExecutionRecordで、元unknown recordは変えない。`_meta["aiterm/closed_launch"]` に厳密なreceiptを返す。固定項目は `schema: "aiterm.closed-launch.v1"`、`version: 1`、`action: "close_launch"`、`outcome: "closed"`、元 `request`、正確な `target`、`management_ref`（応答SDKのMCP request、`tool: "pty_close"`）。`evidence` は原 `native` binding、`initial_prompt: "none"`、`initial_prompt_delivery: null`、`harness_alive: false`、`absence_confirmed: true`、`metadata_committed: true` を持つ。実close・不在確認・slot解放commitが揃った場合だけ返し、失敗や結果不明には返さない。本体が不明を解除する際は元pending操作と自身のstop/versionも照合する。過去receiptで後発の不明を解除しない。
+
+同じ明示入口で、返却済みunknown launchのCLIが終了している場合は、元native/server・managed世代とraw初期promptなし・本文未発行・harness終了を同期検証できた時だけ通常の`pty_close`で対象席を閉じられる。成功と不在を確認して該当枠だけを外し、元unknown requestを保持する。発行中RPC、生存harness、入力や世代の欠測は拒否する。旧requestを再実行せず、必要な後続は新しい通常要求として行う。
 
 
 ## 人が覗く

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.7** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.9** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -796,7 +796,13 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
 
-An explicit `agent_execution` action `reconcile_launch` can bind an existing empty launch after a lost launch result in this opt-in entry. Supply the original `request` and exact `target: {session_id, launch_id}`. The server checks the original native/server identity, current managed generation, raw no-prompt state and a live ready harness under metadata admission, then releases only that unknown launch slot. It never launches, types, closes or resends. `issued` RPCs, unknown input and changed or unverified generations remain blocked. Any subsequent body uses the original reference through normal send admission once; a successful reconciliation does not prove the lost RPC receipt.
+An explicit `agent_execution` action `reconcile_launch` can bind an existing empty launch after a lost launch result in this opt-in entry. Supply the original `request` and exact `target: {session_id, launch_id}`. The server checks the original native/server identity, current managed generation, raw no-prompt state and a live ready harness under metadata admission, then releases only that unknown launch slot. Repeating an accepted empty launch before its send also rechecks the current generation, readiness and absence of competing session operations; a saved acceptance alone cannot confirm a later generation. It never launches, types, closes or resends. `issued` RPCs, unknown input and changed or unverified generations remain blocked. Any subsequent body uses the original reference through normal send admission once; a successful reconciliation does not prove the lost RPC receipt.
+
+For an empty unknown launch whose harness has exited, the BellTeam native entry accepts `agent_execution({action: "close_launch", request, target: {session_id, launch_id}})`. The original request and generation are atomic expectations, checked within admission and immediately before the native close. Raw initial prompt must be `none`, initial delivery absent, send unissued, and the original native/server and managed identity must match. The private runtime proof covers Claude Code and Codex; live, issued, sent, missing or replaced targets remain refused. No session-only close fallback or automatic relaunch/send occurs. Older servers reject this action.
+
+Success retains the original unknown record and returns the serving SDK's distinct management execution record in `structuredContent`. `_meta["aiterm/closed_launch"]` is a strict receipt with `schema: "aiterm.closed-launch.v1"`, `version: 1`, `action: "close_launch"`, `outcome: "closed"`, the original `request`, exact `target`, and `management_ref` (the serving MCP request, `tool: "pty_close"`). Its `evidence` contains original `native` binding, `initial_prompt: "none"`, `initial_prompt_delivery: null`, `harness_alive: false`, `absence_confirmed: true`, and `metadata_committed: true`. Only confirmed close, absence and committed slot release produce this receipt. Errors or lost/uncertain results do not. Hosts must match the original pending operation and local stop/version state before clearing its uncertainty; historical receipts cannot clear later uncertainty.
+
+For a returned unknown launch whose harness has exited, the same native entry admits explicit `pty_close` only after synchronous proof of the original native/server and managed generation, raw no-initial-prompt state, an unissued body send and an exited harness. It releases the failed launch slot after successful close and confirmed absence, preserving the original unknown record. Issued RPCs, live harnesses and missing input or generation evidence remain blocked. The old request is never replayed; a later ordinary request may create a fresh generation.
 
 
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.

package/dist/core.js

@@ -1701,6 +1701,14 @@ export function selectExecutionAuthSessionName() { return "auth-" + randomBytes(
 /** Read-only proof for reconciling a created, empty launch. Inspect raw prompt
  * state: legacy/default normalization must never prove that input was absent. */
 export function observeExecutionCreatedLaunch(target) {
+    return observeEmptyCreatedLaunch(target, true);
+}
+/** Explicit management close only. No generation enrollment or acceptance of
+ * the failed launch; an unknown/missing harness proof remains a refusal. */
+export function observeExecutionExitedCreatedLaunch(target) {
+    return observeEmptyCreatedLaunch(target, false);
+}
+function observeEmptyCreatedLaunch(target, alive) {
     target = executionLaunchSchema.parse(target);
     const unknown = () => { throw new ExecutionError("EXECUTION_UNCONFIRMED"); };
     const generation = () => {
@@ -1724,12 +1732,14 @@ export function observeExecutionCreatedLaunch(target) {
     };
     generation();
     const native = read(), live = observeSession(target.session_id);
-    if (live.launch_id !== target.launch_id || live.harness_alive !== true || live.harness_process === null || live.state !== "idle")
+    if (live.launch_id !== target.launch_id || live.harness_alive !== alive
+        || (alive ? live.harness_process === null || live.state !== "idle"
+            : live.harness_process !== null || live.state !== "dead" || live.reason !== "harness_exited"))
         unknown();
     generation();
     if (!isDeepStrictEqual(read(), native))
         unknown();
-    return { target, native, initial_prompt: "none", initial_prompt_delivery: null, harness_alive: true, ready: true };
+    return { target, native, initial_prompt: "none", initial_prompt_delivery: null, harness_alive: alive, ready: alive };
 }
 /** Private source-provenance snapshot. It deliberately omits screen, argv,
  * environment and cached vendor_session_id. No public tool is added. The
@@ -5044,7 +5054,7 @@ async function launchKeepingUserDefaults(configPath, o, launch) {
     return withUserConfigLock(configPath, async () => {
         const before = readFileOrNull(configPath);
         const mustWrite = o.mustWrite(before);
-        const launched = launch();
+        const launched = await launch();
         const started = performance.now();
         const deadline = started + (mustWrite ? LAUNCH_DEFAULT_MUST_WRITE_WAIT_MS : LAUNCH_DEFAULT_WAIT_MS);
         let aliveCheckedAt = started;
@@ -6366,6 +6376,13 @@ function existingAgentLaunchResult(kind, sid, model, effort) {
 }
 export function openAgent(kind, opts = {}) {
     assertExecutionContext(opts.session_name);
+    return prepareAgentLaunch(kind, opts)();
+}
+/** Resolve and validate the CLI before taking native admission. Only the
+ * returned synchronous creation/metadata/CLI segment shares the graph mutex.
+ * Public synchronous openAgent retains its existing immediate refusal contract.
+ */
+function prepareAgentLaunch(kind, opts = {}) {
     const label = agentLabel(kind);
     // 前提検証は session を作る前に全部済ませる（失敗の残骸 session を作らない）。
     // model/effort → bin → cwd の順: model/effort 検証は CLI 不在の端末でも同じ結果になる（テスト可能性）。
@@ -6459,7 +6476,7 @@ export function openAgent(kind, opts = {}) {
         });
     if (launchOperationId !== null && sessionExists(opts.session_name)) {
         requireMatchingClaudeLaunch(opts.session_name, launchOperationId, launchRequestDigest);
-        return existingAgentLaunchResult("claude", opts.session_name, model, effort);
+        return () => existingAgentLaunchResult("claude", opts.session_name, model, effort);
     }
     if (kind === "claude")
         assertClaudeAuthenticationReady(bin);
@@ -6489,100 +6506,102 @@ export function openAgent(kind, opts = {}) {
     if (kind === "cursor" && model) {
         assertCursorModelAvailable(bin, cwd ?? process.cwd(), model, effort, cursorFast);
     }
-    let sid;
-    let hint;
-    // WindowsのCursorだけはPowerShell 7 paneから起動する（理由はcursorPwshLaunchLine）。
-    const paneShell = isWin && kind === "cursor" && agentDone ? "pwsh" : "bash";
-    try {
-        [sid, hint] = openSession(opts.session_name ?? null, paneShell, envVars);
-    }
-    catch (error) {
-        if (launchOperationId !== null && sessionExists(opts.session_name)) {
-            requireMatchingClaudeLaunch(opts.session_name, launchOperationId, launchRequestDigest);
-            return existingAgentLaunchResult("claude", opts.session_name, model, effort);
+    return () => {
+        let sid;
+        let hint;
+        // WindowsのCursorだけはPowerShell 7 paneから起動する（理由はcursorPwshLaunchLine）。
+        const paneShell = isWin && kind === "cursor" && agentDone ? "pwsh" : "bash";
+        try {
+            [sid, hint] = openSession(opts.session_name ?? null, paneShell, envVars);
         }
-        throw error;
-    }
-    let launchNote = "";
-    try {
-        const lineageContext = createAgentLineageContext(kind, sid, lineageSeed);
-        if (hasExecutionCreationScope())
-            beforeExecutionEffect(sid);
-        const meta = withExecutionPreparation(sid, () => {
-            const meta = agentDone
-                ? kind === "claude"
-                    ? createClaudeAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", launchOperationId, launchRequestDigest, lineageContext, model, effort)
-                    : kind === "codex"
-                        ? createCodexAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", { model, effort }, writeScope, lineageContext)
-                        : kind === "cursor"
-                            ? createCursorAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", writeScope, lineageContext)
-                            : createGrokAgentMetadata(kind, sid, cwd, opts.prompt ? "pending" : "none", grokAuthPath, writeScope, lineageContext)
-                : null;
-            if (meta) {
-                // Metadata constructors publish their internally generated launch ID.
-                // Stamp its exact native creator before binding and any later input.
-                if (hasExecutionCreationScope())
-                    meta.execution_native = executionCreatedNativeBinding(sid);
-                meta.agent_executable = bin;
-                // 席は通常の速度で始まる（Claude Code・Codexは起動の引数で明示する）。fast版のmodel IDで起こした時だけtrue。
-                meta.fast = opts.fast_state === true;
-                meta.model = opts.base_model !== undefined ? opts.base_model : model;
-                // The new physical shell is already pinned by its actual create receipt.
-                // Validate it before publishing metadata, then bind this internally
-                // generated managed launch. Model arguments cannot select this ID.
-                writeAgentMetadata(meta);
-                agentMetadataNegativeCache.delete(sid);
+        catch (error) {
+            if (launchOperationId !== null && sessionExists(opts.session_name)) {
+                requireMatchingClaudeLaunch(opts.session_name, launchOperationId, launchRequestDigest);
+                return existingAgentLaunchResult("claude", opts.session_name, model, effort);
             }
-            return meta;
-        });
-        if (meta && hasExecutionCreationScope())
-            bindExecutionCreatedLaunch({ session_id: sid, launch_id: meta.launch_id });
-        launchNote = buildAgentLaunchNote(kind, model, effort, meta);
-        let full;
-        if (paneShell === "pwsh" && meta) {
-            full = cursorPwshLaunchLine(cwd, cursorAgentEnvEntries(meta, sid, envVars), cursorPwshArgv(cursorAgentArgv(bin, model, effort, opts.prompt ?? null, meta, cursorFast), () => resolveWinPaneShell("bash")));
+            throw error;
         }
-        else {
-            const cmd = buildAgentCmd(kind, binForCmd, model, effort, opts.prompt ?? null, meta, cursorFast);
-            const envPrefix = agentEnvPrefix(meta, sid, envVars);
-            full = cwdForCmd ? `cd ${shq(cwdForCmd)} && ${envPrefix}${cmd}` : `${envPrefix}${cmd}`;
-        }
-        if (meta)
-            agentLaunchLines.set(sid, full);
-        // force:true はagent sessionへの手動介入を表す。起動コマンド自体はAitermが組み立てて素送信する。
-        send(sid, full, {
-            enter: true,
-            mark: false,
-            force: true,
-            rtk: false,
-            raw: true,
-            preserveAgentOperation: meta?.kind === "claude",
-        });
-    }
-    catch (e) {
-        const failure = e instanceof ExecutionError ? e : telemetryOwnedFailure("AITERM.VENDOR_LAUNCHER_FAILED", e);
-        // 起動コマンドを投入できなかった session は空のまま残る＝残骸を作らない。片付けてから元エラーを伝える。
+        let launchNote = "";
         try {
-            closeSessionInternal(sid, false);
-        }
-        catch {
-            /* 片付け失敗より元エラーの伝達を優先 */
+            const lineageContext = createAgentLineageContext(kind, sid, lineageSeed);
+            if (hasExecutionCreationScope())
+                beforeExecutionEffect(sid);
+            const meta = withExecutionPreparation(sid, () => {
+                const meta = agentDone
+                    ? kind === "claude"
+                        ? createClaudeAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", launchOperationId, launchRequestDigest, lineageContext, model, effort)
+                        : kind === "codex"
+                            ? createCodexAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", { model, effort }, writeScope, lineageContext)
+                            : kind === "cursor"
+                                ? createCursorAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", writeScope, lineageContext)
+                                : createGrokAgentMetadata(kind, sid, cwd, opts.prompt ? "pending" : "none", grokAuthPath, writeScope, lineageContext)
+                    : null;
+                if (meta) {
+                    // Metadata constructors publish their internally generated launch ID.
+                    // Stamp its exact native creator before binding and any later input.
+                    if (hasExecutionCreationScope())
+                        meta.execution_native = executionCreatedNativeBinding(sid);
+                    meta.agent_executable = bin;
+                    // 席は通常の速度で始まる（Claude Code・Codexは起動の引数で明示する）。fast版のmodel IDで起こした時だけtrue。
+                    meta.fast = opts.fast_state === true;
+                    meta.model = opts.base_model !== undefined ? opts.base_model : model;
+                    // The new physical shell is already pinned by its actual create receipt.
+                    // Validate it before publishing metadata, then bind this internally
+                    // generated managed launch. Model arguments cannot select this ID.
+                    writeAgentMetadata(meta);
+                    agentMetadataNegativeCache.delete(sid);
+                }
+                return meta;
+            });
+            if (meta && hasExecutionCreationScope())
+                bindExecutionCreatedLaunch({ session_id: sid, launch_id: meta.launch_id });
+            launchNote = buildAgentLaunchNote(kind, model, effort, meta);
+            let full;
+            if (paneShell === "pwsh" && meta) {
+                full = cursorPwshLaunchLine(cwd, cursorAgentEnvEntries(meta, sid, envVars), cursorPwshArgv(cursorAgentArgv(bin, model, effort, opts.prompt ?? null, meta, cursorFast), () => resolveWinPaneShell("bash")));
+            }
+            else {
+                const cmd = buildAgentCmd(kind, binForCmd, model, effort, opts.prompt ?? null, meta, cursorFast);
+                const envPrefix = agentEnvPrefix(meta, sid, envVars);
+                full = cwdForCmd ? `cd ${shq(cwdForCmd)} && ${envPrefix}${cmd}` : `${envPrefix}${cmd}`;
+            }
+            if (meta)
+                agentLaunchLines.set(sid, full);
+            // force:true はagent sessionへの手動介入を表す。起動コマンド自体はAitermが組み立てて素送信する。
+            send(sid, full, {
+                enter: true,
+                mark: false,
+                force: true,
+                rtk: false,
+                raw: true,
+                preserveAgentOperation: meta?.kind === "claude",
+            });
         }
-        throw failure;
-    }
-    const driveHint = agentDone
-        ? `TUI の描画には数秒かかる。少し置いてから pty_read(${sid}, screen:true) で画面を読み、` +
-            `turnはpty_send(${sid}, "...")で送る（自動で非ブロックdispatch。${autoDeliveryParent() ? `回答本文は${autoDeliveryParent()}親へ自動配送する` : "完了通知はaiterm-wait"}）。中断はpty_key(${sid}, "C-c")、` +
-            `Stopが来ない場合の解除はpty_close(${sid})を使う。`
-        : `TUI の描画には数秒かかる。少し置いてから pty_read(${sid}, screen:true) で画面を読み、` +
-            `pty_send(${sid}, "...") で入力・pty_key(${sid}, "Enter"/"Up"/"C-c" 等) で操作する（対話）。`;
-    return [
-        sid,
-        `${label} を session ${sid} で起動した。${launchNote}${agentDone ? "agent_done 待機が有効。" : ""}` +
-            `${agentDone ? " 通常のproject／user環境を共有し、aiterm所有の完了相関とsub-agent lineageだけを加算。" : ""}\n${hint}\n` +
-            driveHint +
-            `起動直後に増分 pty_read すると空/半描画になり得るので screen:true を使う。`,
-    ];
+        catch (e) {
+            const failure = e instanceof ExecutionError ? e : telemetryOwnedFailure("AITERM.VENDOR_LAUNCHER_FAILED", e);
+            // 起動コマンドを投入できなかった session は空のまま残る＝残骸を作らない。片付けてから元エラーを伝える。
+            try {
+                closeSessionInternal(sid, false);
+            }
+            catch {
+                /* 片付け失敗より元エラーの伝達を優先 */
+            }
+            throw failure;
+        }
+        const driveHint = agentDone
+            ? `TUI の描画には数秒かかる。少し置いてから pty_read(${sid}, screen:true) で画面を読み、` +
+                `turnはpty_send(${sid}, "...")で送る（自動で非ブロックdispatch。${autoDeliveryParent() ? `回答本文は${autoDeliveryParent()}親へ自動配送する` : "完了通知はaiterm-wait"}）。中断はpty_key(${sid}, "C-c")、` +
+                `Stopが来ない場合の解除はpty_close(${sid})を使う。`
+            : `TUI の描画には数秒かかる。少し置いてから pty_read(${sid}, screen:true) で画面を読み、` +
+                `pty_send(${sid}, "...") で入力・pty_key(${sid}, "Enter"/"Up"/"C-c" 等) で操作する（対話）。`;
+        return [
+            sid,
+            `${label} を session ${sid} で起動した。${launchNote}${agentDone ? "agent_done 待機が有効。" : ""}` +
+                `${agentDone ? " 通常のproject／user環境を共有し、aiterm所有の完了相関とsub-agent lineageだけを加算。" : ""}\n${hint}\n` +
+                driveHint +
+                `起動直後に増分 pty_read すると空/半描画になり得るので screen:true を使う。`,
+        ];
+    };
 }
 export class AgentLaunchPromptError extends AitermError {
     session_id;
@@ -6598,7 +6617,10 @@ export class AgentLaunchPromptError extends AitermError {
     }
 }
 export async function openAgentWithInitialPrompt(kind, opts = {}) {
-    assertExecutionContext(opts.session_name);
+    if (opts.session_name)
+        await withExecutionNativeAdmission(opts.session_name, () => assertExecutionContext(opts.session_name));
+    else
+        assertExecutionContext(opts.session_name);
     const mission = opts.prompt ?? null;
     const sourceSessionId = opts.throughline_source_session ?? null;
     const supplementFile = opts.throughline_supplement_file ?? null;
@@ -6646,12 +6668,16 @@ export async function openAgentWithInitialPrompt(kind, opts = {}) {
     };
     // GrokとCursorは、起動の --model の値を利用者の既定へ書く（Cursorは版による）。起動の前後で、直前の値へ戻す。
     const launch = () => {
+        const admitted = async () => {
+            const create = prepareAgentLaunch(kind, openOptions);
+            return opts.session_name ? withExecutionNativeAdmission(opts.session_name, create) : create();
+        };
         if (kind === "grok") {
             const configPath = grokUserConfigPath(realGrokHome());
             // Grokは起動完了の直後に書く（入力待ちと読める頃には書き終えている）。
             return launchKeepingUserDefaults(configPath, {
                 restore: restoreGrokDefaults(configPath), written: grokDefaultsWritten, mustWrite: () => false, ready: grokTuiReady,
-            }, () => openAgent(kind, openOptions));
+            }, admitted);
         }
         if (kind === "cursor" && openOptions.model) {
             const configPath = cursorUserConfigPath(realCursorHome());
@@ -6660,9 +6686,9 @@ export async function openAgentWithInitialPrompt(kind, opts = {}) {
                 restore: restoreCursorDefaults(configPath), written: cursorDefaultsWritten,
                 mustWrite: (before) => { const config = parseJsonObject(before); return config !== null && "selectedModel" in config; },
                 ready: cursorTuiReady,
-            }, () => openAgent(kind, openOptions));
+            }, admitted);
         }
-        return Promise.resolve().then(() => openAgent(kind, openOptions));
+        return admitted();
     };
     // 入力待ちになった席を、その席の中でfastへ切り替える（Claude Code・Codex）。出来なかった訳は返りへ入れ、起動は続ける。
     const switchAfterReady = async (name, meta) => {

package/dist/execution-close.js

@@ -1,12 +1,8 @@
 // Synchronous expected-generation close. The serving adapter must already own
 // the shared issued close slot; this helper does not replace admission/drain.
 import { executionLaunchSchema } from "./execution-contract.js";
+export { executionNativeBindingSchema } from "./execution-contract.js";
 import { ExecutionError } from "./execution-wire.js";
-import { z } from "zod";
-export const executionNativeBindingSchema = z.object({ schema: z.literal("aiterm.execution-native.v1"),
-    native_id: z.string().regex(/^\$\d+$/),
-    server: z.object({ pid: z.number().int().positive(), started_identity: z.string().min(1).max(256) }).strict(),
-}).strict();
 export function parseExecutionNativeSessions(text) {
     const sessions = [];
     for (const line of text.split(/\r?\n/).filter(Boolean)) {

package/dist/execution-contract.js

@@ -7,6 +7,10 @@ const referenceId = z.string().min(1).max(256);
 export const executionLaunchSchema = z.object({
     session_id: sessionId, launch_id: launchId,
 }).strict();
+export const executionNativeBindingSchema = z.object({ schema: z.literal("aiterm.execution-native.v1"),
+    native_id: z.string().regex(/^\$\d+$/),
+    server: z.object({ pid: z.number().int().positive(), started_identity: z.string().min(1).max(256) }).strict(),
+}).strict();
 // Existing references, normalized by the runtime adapter to an immutable run
 // boundary. A later native turn ID is an alias, not permission to rekey history.
 export const executionBoundarySchema = z.object({

package/dist/execution-dispatch.js

@@ -123,6 +123,13 @@ export function createExecutionDispatcher(bindings) {
                 throw new ExecutionError("EXECUTION_UNSUPPORTED");
             bindings.assertParticipant?.();
             return { sourceContext: extra => executionHostSourceFromMeta(extra._meta, bindings.initializedClientName()),
+                closeManagementRequest: (extra, session) => {
+                    if (!registeredControls || !native || bindings.initializedClientName() !== "bellteam")
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    return executionRequestSchema.options[4].parse({ kind: "mcp", process_pid: native.pid,
+                        process_started_identity: native.started_identity, request_id: extra.requestId,
+                        tool: "pty_close", target_session_id: session });
+                },
                 activate: () => { registeredControls = true; } };
         },
         async dispatch(name, input, extra, body) {

package/dist/execution-launch-recovery.js

@@ -7,3 +7,6 @@ export const createdLaunchObservationSchema = z.object({
     initial_prompt: z.literal("none"), initial_prompt_delivery: z.null(),
     harness_alive: z.literal(true), ready: z.literal(true),
 }).strict();
+export const exitedCreatedLaunchObservationSchema = createdLaunchObservationSchema.extend({
+    harness_alive: z.literal(false), ready: z.literal(false),
+});

package/dist/execution-native-server.js

@@ -38,6 +38,7 @@ export function createNativeExecutionServer(input) {
         selectAuthSessionName: core.selectExecutionAuthSessionName,
         observeAuthSessionGeneration: core.observeExecutionAuthSessionGeneration,
         observeCreatedLaunchSync: core.observeExecutionCreatedLaunch,
+        observeExitedCreatedLaunchSync: core.observeExecutionExitedCreatedLaunch,
         closeExpectedSession: core.closeExpectedAgentSession, // explicit management only, never stop fallback
         observeInterruptionSync: core.observeExpectedAgentRunInterruption,
         selectInterruptionSync: core.selectExpectedAgentRunInterruption,

package/dist/execution-parent-producer.js

@@ -1,7 +1,7 @@
 // Private same-scope MCP parent producer. No public/index/profile mount. Queue
 // aliases lacking current independent native proof remain unsupported.
 import path from "node:path";
-import { observeAgentDone, selectExecutionAuthSessionName, observeExecutionAuthSessionGeneration, observeExecutionNativeCreationScope, closeExpectedAgentSession, observeExecutionCreatedLaunch } from "./core.js";
+import { observeAgentDone, selectExecutionAuthSessionName, observeExecutionAuthSessionGeneration, observeExecutionNativeCreationScope, closeExpectedAgentSession, observeExecutionCreatedLaunch, observeExecutionExitedCreatedLaunch } from "./core.js";
 import { codexParentFromRequest } from "./codex-parent-receiver.js";
 import { claudeParentFromRequest } from "./claude-parent-receiver.js";
 import { cursorParentFromRequest } from "./cursor-parent-receiver.js";
@@ -33,15 +33,17 @@ const localProducerRuntime = {
     selectAuthSessionName: selectExecutionAuthSessionName,
     observeAuthSessionGeneration: observeExecutionAuthSessionGeneration,
     observeCreatedLaunchSync: observeExecutionCreatedLaunch,
+    observeExitedCreatedLaunchSync: observeExecutionExitedCreatedLaunch,
     closeExpectedSession: closeExpectedAgentSession,
 };
 export function createExecutionParentProducer(input) {
     const runtime = input.runtime ?? localProducerRuntime;
-    for (const name of ["selectAuthSessionName", "observeAuthSessionGeneration", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"])
+    for (const name of ["selectAuthSessionName", "observeAuthSessionGeneration", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync", "observeExitedCreatedLaunchSync"])
         if (runtime[name] !== undefined && typeof runtime[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const selectAuthName = runtime.selectAuthSessionName?.bind(runtime), observeAuth = runtime.observeAuthSessionGeneration?.bind(runtime);
     const createdLaunch = runtime.observeCreatedLaunchSync?.bind(runtime);
+    const exitedLaunch = runtime.observeExitedCreatedLaunchSync?.bind(runtime);
     const interruption = runtime.observeInterruptionSync?.bind(runtime);
     const selectInterruption = runtime.selectInterruptionSync?.bind(runtime), interruptKey = runtime.interruptKeySync?.bind(runtime);
     const observeActors = runtime.observeActors?.bind(runtime);
@@ -73,6 +75,14 @@ export function createExecutionParentProducer(input) {
             } } : {}),
         ...(interruptKey ? { interruptKeySync: (point) => { assertScope(); return interruptKey(point); } } : {}),
         observeSession: observe, observeSessionSync: observe,
+        ...(runtime.closeExpectedSession ? { closeCreatedLaunchSync: (target) => {
+                assertScope();
+                return runtime.closeExpectedSession(target);
+            } } : {}),
+        ...(exitedLaunch ? { observeExitedCreatedLaunchSync: (target) => {
+                assertScope();
+                return exitedLaunch(target);
+            } } : {}),
         ...(createdLaunch ? { observeCreatedLaunchSync: (target) => {
                 assertScope();
                 return createdLaunch(target);

package/dist/execution-participant.js

@@ -12,7 +12,7 @@ function snapshotRuntime(input) {
     for (const name of functions)
         if (typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
-    const optional = ["selectAuthSessionName", "observeAuthSessionGeneration", "observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync"];
+    const optional = ["selectAuthSessionName", "observeAuthSessionGeneration", "observeNativeSessions", "closeExpectedSession", "observeActors", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync", "observeOriginOwner", "observeCreatedLaunchSync", "observeExitedCreatedLaunchSync"];
     for (const name of optional)
         if (input[name] !== undefined && typeof input[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");

package/dist/execution-runtime.js

@@ -45,7 +45,7 @@ const waitSchema = z.object({
 });
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 export function createExecutionRuntime(bindings) {
-    for (const name of ["observeCreatedLaunchSync", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
+    for (const name of ["observeCreatedLaunchSync", "observeExitedCreatedLaunchSync", "closeCreatedLaunchSync", "observeInterruptionSync", "selectInterruptionSync", "interruptKeySync"])
         if (bindings[name] !== undefined && typeof bindings[name] !== "function")
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
     const interruption = bindings.observeInterruptionSync;
@@ -72,8 +72,10 @@ export function createExecutionRuntime(bindings) {
             return { state: "unknown" };
         }
     };
-    const created = bindings.observeCreatedLaunchSync;
+    const created = bindings.observeCreatedLaunchSync, exited = bindings.observeExitedCreatedLaunchSync;
     return {
+        ...(bindings.closeCreatedLaunchSync ? { closeCreatedLaunchSync: (target) => bindings.closeCreatedLaunchSync(executionLaunchSchema.parse(target)) } : {}),
+        ...(exited ? { observeExitedCreatedLaunchSync: (target) => exited(executionLaunchSchema.parse(target)) } : {}),
         ...(created ? { observeCreatedLaunchSync: (target) => created(executionLaunchSchema.parse(target)) } : {}),
         ...(interruption ? { interruptionSync: (point) => interruption(executionPointSchema.parse(point)) } : {}),
         ...(selectInterruption ? { selectInterruptionSync: (expected, candidates) => selectInterruption(executionLaunchSchema.parse(expected), z.array(executionPointSchema).parse(candidates ?? [])) } : {}),

package/dist/execution-service.js

@@ -1,15 +1,16 @@
 // Metadata/admission service with injected runtime. It never owns a payload or
 // retries a launch/send/close. The core/MCP adapter is a separate integration.
 import { z } from "zod";
-import { assessExecutionSource, planCascadeStop, unfinishedExecutionRelations, cascadeStopRequestSchema, cascadeStopResultSchema, cascadeInterruptRequestSchema, cascadeInterruptResultSchema, executionPointSchema, executionLaunchSchema } from "./execution-contract.js";
+import { assessExecutionSource, planCascadeStop, unfinishedExecutionRelations, cascadeStopRequestSchema, cascadeStopResultSchema, cascadeInterruptRequestSchema, cascadeInterruptResultSchema, executionPointSchema, executionLaunchSchema, executionRequestSchema } from "./execution-contract.js";
 import { executionActionSchema, executionRecordSchema, executionRefMetaSchema, executionRootsRequestSchema, executionRootsResultSchema, ExecutionError } from "./execution-wire.js";
-import { withExecutionEffectScope, withExecutionInterruptEffectScope } from "./execution-effect.js";
+import { withExecutionEffectScope, withExecutionInterruptEffectScope, withExecutionNativeAdmission, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { nativeInterruptionObservationSchema, interruptionIdentity, interruptionBlocksLaunch, interruptionBlocksRequest, interruptionSlots, assertInterruptionSource, sameInterruptionRowRun } from "./execution-interruption.js";
 import { interruptionKeyReference } from "./execution-interruption.js";
 import { isDeepStrictEqual } from "node:util";
 import { executionActorSchema } from "./execution-inventory.js";
-import { createdLaunchObservationSchema } from "./execution-launch-recovery.js";
+import { createdLaunchObservationSchema, exitedCreatedLaunchObservationSchema } from "./execution-launch-recovery.js";
 import { executionCheckpoint } from "./execution-checkpoint.js";
+import { executionCloseLaunchSchema, executionClosedLaunchSchema } from "./execution-wire.js";
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const key = (value) => JSON.stringify(value);
 const stopped = (state, launch) => !!launch && (state.stopping.some(value => same(value, launch)) || interruptionBlocksLaunch(state, launch));
@@ -43,29 +44,50 @@ function find(state, request) {
     return record;
 }
 const managementClose = (request) => request.kind === "mcp" && request.tool === "pty_close";
-/** Only a returned, unknown send may be displaced by an explicit close of
- * that exact launch. Issued work, management/parent slots and other generations
- * remain blockers. The record is never turned into accepted or not_sent.
+/** A returned unknown send, or an empty exited created launch with additional
+ * native proof, may be displaced by explicit close of that exact generation.
+ * Issued work and other generations remain blockers; failed records are kept.
  */
-function recoverableSends(state, request, session, expected) {
+function recoverableCloseSlots(state, request, session, expected) {
     if (!managementClose(request) || expected === null)
         return [];
     return state.slots.filter(slot => {
-        if (slot.session_id !== session || slot.expected_launch_id !== expected || slot.stage !== "send"
+        if (slot.session_id !== session || slot.expected_launch_id !== expected || !["send", "launch"].includes(slot.stage)
             || slot.state !== "unknown" || !slot.request || same(slot.request, request))
             return false;
+        const original = state.records.find(record => same(record.reservation.request, slot.request));
+        if (slot.stage === "launch")
+            return !!original && !!slot.created_native_id && !!slot.created_server
+                && (slot.request.kind !== "mcp" || slot.request.tool === "agent_launch")
+                && original.operations.launch === "unknown" && original.operations.send === "not_issued"
+                && original.relation.phase === "submitted_unknown" && original.relation.completion === "unknown"
+                && original.relation.lifecycle === "tracking" && !openParentEffect(state, slot.request)
+                && original.relation.target?.boundary === null
+                && same(original.relation.target.launch, { session_id: session, launch_id: expected });
         if (slot.request.kind === "mcp" && !["pty_send", "claude_turn.issue"].includes(slot.request.tool))
             return false;
-        const original = state.records.find(record => same(record.reservation.request, slot.request));
         return original?.operations.send === "unknown" && !["issued", "unknown"].includes(original.operations.launch)
             && original.relation.phase === "submitted_unknown" && original.relation.completion === "unknown"
             && same(original.relation.target?.launch, { session_id: session, launch_id: expected });
     });
 }
 function targetBlocked(state, request, session, expected) {
-    const recoverable = recoverableSends(state, request, session, expected);
+    const recoverable = recoverableCloseSlots(state, request, session, expected);
     return state.slots.some(slot => slot.session_id === session && !recoverable.includes(slot));
 }
+function assertCloseLaunchExpectation(state, expected, management) {
+    const original = find(state, expected.request), target = expected.target;
+    if (original.reservation.target.session_id !== target.session_id
+        || !same(original.relation.target?.launch, target))
+        throw new ExecutionError("EXECUTION_STALE_GENERATION");
+    if (original.operations.launch === "issued" || original.operations.send === "issued")
+        throw new ExecutionError("EXECUTION_BUSY");
+    const slots = state.slots.filter(slot => slot.session_id === target.session_id && !same(slot.request, management));
+    const candidates = recoverableCloseSlots(state, management, target.session_id, target.launch_id);
+    if (slots.length !== 1 || !same(slots[0].request, expected.request) || slots[0].stage !== "launch"
+        || !candidates.includes(slots[0]))
+        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+}
 function view(state, record) {
     return executionRecordSchema.parse({ ...record,
         stopping: record.stopping || stopped(state, record.relation.source?.launch) || stopped(state, record.relation.target?.launch)
@@ -444,16 +466,30 @@ export class ExecutionService {
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         return this.store.transactionSync(state => {
             const record = find(state, request), target = record.reservation.target;
-            if (!recoverableSends(state, request, target.session_id, target.expected_launch_id).length)
+            if (!recoverableCloseSlots(state, request, target.session_id, target.expected_launch_id).length)
                 return undefined;
             if (record.operations.send !== "preparing" || targetBlocked(state, request, target.session_id, target.expected_launch_id))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
             const native = this.runtime.nativeSessionSync?.(target.session_id);
             if (native?.state !== "present" || !native.server)
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
+            this.proveExitedLaunchClose(state, request, target.session_id, target.expected_launch_id, native);
             return native.native_id;
         }, { readOnly: true });
     }
+    proveExitedLaunchClose(state, request, session, expected, native) {
+        const launches = recoverableCloseSlots(state, request, session, expected).filter(slot => slot.stage === "launch");
+        if (!launches.length)
+            return;
+        if (!expected || !this.runtime.observeExitedCreatedLaunchSync)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const target = { session_id: session, launch_id: expected };
+        const proof = exitedCreatedLaunchObservationSchema.safeParse(this.runtime.observeExitedCreatedLaunchSync(target));
+        if (!proof.success || !same(proof.data.target, target) || proof.data.native.native_id !== native.native_id
+            || !same(proof.data.native.server, native.server) || launches.some(slot => slot.created_native_id !== native.native_id
+            || !same(slot.created_server, native.server)))
+            throw new ExecutionError("EXECUTION_UNCONFIRMED");
+    }
     verifyCreationServer(metaInput, expected) {
         const { request } = executionRefMetaSchema.parse(metaInput);
         if (!this.store.transactionSync)
@@ -547,8 +583,52 @@ export class ExecutionService {
             return this.store.transaction(state => view(state, find(state, args.request)), { readOnly: true });
         if (args.action === "reconcile_launch")
             return this.reconcileLaunch(args);
+        if (args.action === "close_launch")
+            throw new ExecutionError("EXECUTION_UNSUPPORTED"); // serving SDK identity required
         return this.finish(args);
     }
+    /** One explicit host RPC. The expectation is checked within registration,
+     * every effect admission and final commit; it never becomes a new source or
+     * rekeys the original failed request. No successful receipt survives a failed commit.
+     */
+    async closeLaunch(input, managementInput, context) {
+        const expected = executionCloseLaunchSchema.parse(input), management = executionRequestSchema.options[4].parse(managementInput);
+        if (management.tool !== "pty_close" || management.target_session_id !== expected.target.session_id
+            || same(management, expected.request) || !this.runtime.closeCreatedLaunchSync)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const source = context?.source ?? null;
+        await this.register({ action: "register", source_session_id: source?.launch.session_id ?? null,
+            reservation: { schema: "aiterm.execution-reservation.v1", request: management,
+                source: { launch: source?.launch ?? null, boundary: source?.boundary ?? null },
+                target: { session_id: expected.target.session_id, expected_launch_id: expected.target.launch_id } } }, context, expected);
+        const ref = { schema: "aiterm.execution-ref.v1", request: management };
+        const result = await this.invokeDeferred(ref, "send", (issue, prepare) => withExecutionEffectScope(expected.target.session_id, issue, async () => {
+            const native = await withExecutionNativeAdmission(expected.target.session_id, () => {
+                const id = this.managementCloseNative(ref);
+                if (!id)
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                const binding = this.store.transactionSync(state => {
+                    assertCloseLaunchExpectation(state, expected, management);
+                    const slot = state.slots.find(slot => same(slot.request, expected.request));
+                    return { schema: "aiterm.execution-native.v1", native_id: slot.created_native_id, server: slot.created_server };
+                }, { readOnly: true });
+                bindExecutionManagementCloseTarget(expected.target.session_id, id);
+                const closed = this.runtime.closeCreatedLaunchSync(expected.target);
+                if (closed && typeof closed.then === "function") {
+                    void Promise.resolve(closed).catch(() => undefined);
+                    throw new ExecutionError("EXECUTION_UNSUPPORTED", "possible");
+                }
+                return binding;
+            });
+            return { value: native, target: { launch: expected.target, boundary: null } };
+        }, undefined, prepare, body => this.admitNative(body)), expected.target.session_id, undefined, expected);
+        return { record: result.record, receipt: executionClosedLaunchSchema.parse({
+                schema: "aiterm.closed-launch.v1", version: 1, action: "close_launch", outcome: "closed",
+                request: expected.request, target: expected.target, management_ref: management,
+                evidence: { native: result.value, initial_prompt: "none", initial_prompt_delivery: null,
+                    harness_alive: false, absence_confirmed: true, metadata_committed: true },
+            }) };
+    }
     async admitNative(body) {
         if (!this.store.admitNative)
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
@@ -620,8 +700,10 @@ export class ExecutionService {
                 roots: selected, relation_coverage: !unresolved.length && coverage === "complete" ? "complete" : "incomplete", unresolved });
         }, { readOnly: true });
     }
-    async register(args, context) {
+    async register(args, context, closeExpectation) {
         return this.store.transaction(async (state) => {
+            if (closeExpectation)
+                assertCloseLaunchExpectation(state, closeExpectation, args.reservation.request);
             const previous = state.records.find(record => same(record.reservation.request, args.reservation.request));
             if (previous) {
                 if (!same(previous.reservation, args.reservation) || previous.source_session_id !== args.source_session_id)
@@ -678,16 +760,18 @@ export class ExecutionService {
      * issue() immediately before its first actual effect, on the same stack.
      * Synchronous metadata admission persists issuance before any native action.
      */
-    async invokeDeferred(metaInput, stage, body, targetSessionId, admission) {
-        return this.invokeInternal(metaInput, stage, body, targetSessionId, true, admission);
+    async invokeDeferred(metaInput, stage, body, targetSessionId, admission, closeExpectation) {
+        return this.invokeInternal(metaInput, stage, body, targetSessionId, true, admission, closeExpectation);
     }
-    async invokeInternal(metaInput, stage, body, targetSessionId, deferred, admission) {
+    async invokeInternal(metaInput, stage, body, targetSessionId, deferred, admission, closeExpectation) {
         const { request } = executionRefMetaSchema.parse(metaInput);
         let expectedCloseNative;
         if (deferred && (!this.store.transactionSync || !this.runtime.observeSync))
             throw new ExecutionError("EXECUTION_UNSUPPORTED");
         await this.store.transaction(async (state) => {
             admission?.();
+            if (closeExpectation)
+                assertCloseLaunchExpectation(state, closeExpectation, request);
             const record = find(state, request);
             const relation = record.relation;
             if (interruptionBlocksRequest(state, request))
@@ -704,13 +788,14 @@ export class ExecutionService {
                 throw new ExecutionError("EXECUTION_UNCONFIRMED");
             if (deferred) {
                 const target = record.reservation.target;
-                if (recoverableSends(state, request, target.session_id, target.expected_launch_id).length) {
+                if (recoverableCloseSlots(state, request, target.session_id, target.expected_launch_id).length) {
                     if (targetBlocked(state, request, target.session_id, target.expected_launch_id))
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
                     this.expectTarget(await this.runtime.observe(target.session_id), target.expected_launch_id, target.session_id);
                     const native = this.runtime.nativeSessionSync?.(target.session_id);
                     if (native?.state !== "present" || !native.server)
                         throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    this.proveExitedLaunchClose(state, request, target.session_id, target.expected_launch_id, native);
                     expectedCloseNative = { native_id: native.native_id, server: structuredClone(native.server) };
                 }
                 record.operations[stage] = "preparing";
@@ -762,6 +847,8 @@ export class ExecutionService {
                 // wait between them. Owning its slot is not permission to ignore a
                 // stop, uncertain slot or generation replacement after the first one.
                 return this.store.transactionSync(state => {
+                    if (closeExpectation)
+                        assertCloseLaunchExpectation(state, closeExpectation, request);
                     const record = find(state, request), relation = record.relation;
                     if (interruptionBlocksRequest(state, request))
                         throw new ExecutionError("EXECUTION_STOPPING");
@@ -785,6 +872,8 @@ export class ExecutionService {
                     }
                     const current = this.runtime.observeSync(slot.session_id);
                     checkCloseNative(slot.session_id);
+                    if (expectedCloseNative)
+                        this.proveExitedLaunchClose(state, request, slot.session_id, slot.expected_launch_id, expectedCloseNative);
                     if (current.state === "present" && stopped(state, current.launch))
                         throw new ExecutionError("EXECUTION_STOPPING");
                     if (slot.created_native_id) {
@@ -808,6 +897,8 @@ export class ExecutionService {
                 }, { readOnly: true });
             }
             const result = this.store.transactionSync(state => {
+                if (closeExpectation)
+                    assertCloseLaunchExpectation(state, closeExpectation, request);
                 const record = find(state, request), relation = record.relation;
                 if (interruptionBlocksRequest(state, request))
                     throw new ExecutionError("EXECUTION_STOPPING");
@@ -828,6 +919,8 @@ export class ExecutionService {
                 const current = this.runtime.observeSync(target.session_id);
                 this.expectTarget(current, expected, target.session_id);
                 checkCloseNative(target.session_id);
+                if (expectedCloseNative)
+                    this.proveExitedLaunchClose(state, request, target.session_id, expected, expectedCloseNative);
                 if (current.state === "present" && stopped(state, current.launch))
                     throw new ExecutionError("EXECUTION_STOPPING");
                 if ((stage === "launch" && current.state !== "absent") || (stage === "send" && current.state !== "present"))
@@ -906,6 +999,8 @@ export class ExecutionService {
         // Parsed above after issuance; null is supported only for an unissued noop.
         const targetPoint = outcome.target;
         const record = await this.store.transaction(async (state) => {
+            if (closeExpectation)
+                assertCloseLaunchExpectation(state, closeExpectation, request);
             const record = find(state, request);
             const slot = state.slots.find(value => same(value.request, request));
             if (!slot || slot.stage !== stage || record.operations[stage] !== "issued")
@@ -935,7 +1030,7 @@ export class ExecutionService {
                 // Actual management close plus confirmed absence releases only these
                 // failed send admissions. Old callbacks still fail their missing-slot
                 // guard, and their records remain unknown and cannot be invoked again.
-                const recovered = recoverableSends(state, request, slot.session_id, expected);
+                const recovered = recoverableCloseSlots(state, request, slot.session_id, expected);
                 state.slots = state.slots.filter(value => !recovered.includes(value));
                 this.interruptRelations(state, targetPoint.launch);
             }
@@ -967,8 +1062,24 @@ export class ExecutionService {
     async reconcileLaunch(args) {
         return this.store.transaction(state => {
             const record = find(state, args.request), relation = record.relation;
-            if (record.operations.launch === "accepted" && same(relation.target?.launch, args.target))
+            if (record.operations.launch === "accepted" && same(relation.target?.launch, args.target)) {
+                // A saved accepted receipt is historical. Before a caller can use an
+                // empty launch to resume input, prove that this generation is still
+                // present and no later operation owns the same session slot.
+                if (record.operations.send === "not_issued") {
+                    if (record.stopping || stopped(state, args.target) || stopped(state, relation.source?.launch)
+                        || interruptionBlocksRequest(state, args.request))
+                        throw new ExecutionError("EXECUTION_STOPPING");
+                    if (state.slots.some(slot => slot.session_id === args.target.session_id) || openParentEffect(state, args.request))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                    if (!this.runtime.observeCreatedLaunchSync)
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    const parsed = createdLaunchObservationSchema.safeParse(this.runtime.observeCreatedLaunchSync(args.target));
+                    if (!parsed.success || !same(parsed.data.target, args.target))
+                        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+                }
                 return view(state, record);
+            }
             if (record.operations.launch === "issued")
                 throw new ExecutionError("EXECUTION_BUSY");
             if (record.stopping || stopped(state, args.target) || stopped(state, relation.source?.launch)

package/dist/execution-tools.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { executionLaunchSchema, executionReservationSchema, executionRequestSchema, executionPointSchema, cascadeInterruptRequestSchema, cascadeInterruptResultObjectSchema } from "./execution-contract.js";
-import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY } from "./execution-wire.js";
+import { executionActionSchema, executionFinishSchema, executionRecordSchema, executionBindingSchema, executionRootsRequestSchema, executionRootsResultObjectSchema, executionRefFromMeta, executionErrorResult, ExecutionError, EXECUTION_BINDING_META_KEY, EXECUTION_ERROR_META_KEY, EXECUTION_SOURCE_META_KEY, EXECUTION_CLOSED_LAUNCH_META_KEY } from "./execution-wire.js";
 import { withExecutionEffectScope, bindExecutionManagementCloseTarget } from "./execution-effect.js";
 import { immediateStopInputSchema, immediateStopResultSchema } from "./execution-immediate-stop.js";
 export function executionBindingMeta(record) {
@@ -32,6 +32,14 @@ export function createExecutionToolHandlers(service, options = {}) {
                     throw new ExecutionError("EXECUTION_UNSUPPORTED");
                 // Capture and detach before entering the shared-store transaction.
                 const context = options.sourceContext?.(extra);
+                if (args.action === "close_launch") {
+                    if (!options.closeManagementRequest)
+                        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+                    const management = options.closeManagementRequest(extra, args.target.session_id);
+                    const closed = await service.closeLaunch(args, management, context === undefined ? undefined : structuredClone(context));
+                    return { content: [{ type: "text", text: JSON.stringify(closed.record) }], structuredContent: closed.record,
+                        _meta: { ...executionBindingMeta(closed.record), [EXECUTION_CLOSED_LAUNCH_META_KEY]: closed.receipt } };
+                }
                 const result = await service.execute(args, context === undefined ? undefined : structuredClone(context));
                 return { content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result,
                     _meta: executionBindingMeta(result) };
@@ -65,12 +73,12 @@ export function createExecutionToolHandlers(service, options = {}) {
 export function registerExecutionTools(server, service, options = {}) {
     const registration = controlRegistrars.get(server)?.(service);
     const handlers = createExecutionToolHandlers(service, { ...options,
-        ...(registration ? { sourceContext: registration.sourceContext } : {}) });
+        ...(registration ? { sourceContext: registration.sourceContext, closeManagementRequest: registration.closeManagementRequest } : {}) });
     server.registerTool("agent_execution", {
-        description: "既存の実配送/実行参照を登録・照会・終了証拠で更新し、結果不明の空起動を同世代へ照合する。本文や再送queueは保存しない。",
+        description: "既存の実配送/実行参照を登録・照会・終了証拠で更新する。結果不明の空起動は元requestと期待世代を指定して照合、または終了済みCLIだけcloseする。本文や再送queueは保存しない。",
         // MCP accepts a raw object shape; the handler enforces the stricter action
         // union, including required fields and forbidden fields for each action.
-        inputSchema: { action: z.enum(["register", "status", "finish", "reconcile_launch"]),
+        inputSchema: { action: z.enum(["register", "status", "finish", "reconcile_launch", "close_launch"]),
             reservation: executionReservationSchema.optional(), source_session_id: z.string().nullable().optional(),
             request: executionRequestSchema.optional(), target: executionLaunchSchema.optional(), evidence: executionFinishSchema.shape.evidence.optional(),
             remote: z.never().optional() },

package/dist/execution-wire.js

@@ -1,10 +1,11 @@
 // Versioned Bridge/MCP contract. No dependency on core, PTY or the tool server.
 import { z } from "zod";
-import { executionLaunchSchema, executionPointSchema, executionRequestSchema, executionReservationSchema, executionRelationSchema, executionPhaseSchema, cascadeStopRequestSchema, cascadeStopResultSchema } from "./execution-contract.js";
+import { executionLaunchSchema, executionPointSchema, executionRequestSchema, executionReservationSchema, executionRelationSchema, executionPhaseSchema, cascadeStopRequestSchema, cascadeStopResultSchema, executionNativeBindingSchema } from "./execution-contract.js";
 export const EXECUTION_REQUEST_META_KEY = "aiterm/execution";
 export const EXECUTION_BINDING_META_KEY = "aiterm/execution_binding";
 export const EXECUTION_ERROR_META_KEY = "aiterm/execution_error";
 export const EXECUTION_SOURCE_META_KEY = "aiterm/execution_source";
+export const EXECUTION_CLOSED_LAUNCH_META_KEY = "aiterm/closed_launch";
 export const executionTransportSourceSchema = z.object({
     schema: z.literal("aiterm.execution-source.v1"), source: executionPointSchema.nullable(),
 }).strict();
@@ -46,7 +47,22 @@ export const executionFinishSchema = z.object({
 export const executionReconcileLaunchSchema = z.object({
     action: z.literal("reconcile_launch"), request: executionRequestSchema, target: executionLaunchSchema,
 }).strict();
-export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema, executionReconcileLaunchSchema]);
+export const executionCloseLaunchSchema = z.object({
+    action: z.literal("close_launch"), request: executionRequestSchema, target: executionLaunchSchema,
+}).strict();
+export const executionClosedLaunchSchema = z.object({
+    schema: z.literal("aiterm.closed-launch.v1"), version: z.literal(1), action: z.literal("close_launch"),
+    outcome: z.literal("closed"), request: executionRequestSchema, target: executionLaunchSchema,
+    management_ref: executionRequestSchema.options[4],
+    evidence: z.object({ native: executionNativeBindingSchema, initial_prompt: z.literal("none"),
+        initial_prompt_delivery: z.null(), harness_alive: z.literal(false), absence_confirmed: z.literal(true),
+        metadata_committed: z.literal(true) }).strict(),
+}).strict().superRefine((value, ctx) => {
+    if (value.management_ref.tool !== "pty_close" || value.management_ref.target_session_id !== value.target.session_id
+        || (value.request.kind === "aiterm" ? value.request.launch.session_id : value.request.target_session_id) !== value.target.session_id)
+        ctx.addIssue({ code: "custom", message: "close receipt must bind the same original target and management request" });
+});
+export const executionActionSchema = z.union([executionRegisterSchema, executionStatusSchema, executionFinishSchema, executionReconcileLaunchSchema, executionCloseLaunchSchema]);
 export const executionRefMetaSchema = z.object({
     schema: z.literal("aiterm.execution-ref.v1"), request: executionRequestSchema,
 }).strict();

package/docs/DESIGN.md

@@ -453,11 +453,25 @@ unknown send枠を保持したまま既存core closeへ進み、native close成
 旧callbackは未知/消失した元slotで拒否され、同IDの新launchへnative作用を発行できない。
 issued、管理close自体のunknown、親作用のslot、世代/native/serverの不明・交代は対象外。
 既存の送信・待機lockの拒否も維持し、他席やissuerの停止を復旧条件へ追加しない。
+返却済みunknown launchも、元native/server・managed世代が一致し、raw initial_prompt:none・初期配送なし・
+send:not_issuedで、harnessの終了を現在の同期primitiveが証明できる場合だけ、同じ明示管理closeを許す（ADR 0131）。
+受付時とnative作用直前にこの証拠を検査し、closeと不在確認後に該当slotを外す。元unknown recordを保ち、
+旧requestのlaunch/sendは再実行しない。生存harnessはreconcile_launchの対象として維持する。
+本体からの明示復旧には既存agent_executionのclose_launch actionを使う（ADR 0132）。元requestと
+target(session_id,launch_id)を原子的な期待条件として受付と作用直前に照合し、応答SDK自身の管理refで
+既存close primitiveへ進む。呼出元がobserveしたsessionだけをcloseする手順で代用しない。
+close・不在確認・metadata commit後だけ_meta["aiterm/closed_launch"]のversion1 receiptを返す。
+structuredContentは別管理requestのrecord、元unknown recordは不変。結果不明や保存失敗にはclosed証明なし。
+本体は元pending操作・stop/versionを別途照合し、後発不明を過去receiptで解除しない。
+非同期launcherはCLIの検証をgraph mutex外で行い、実create→metadata公開→世代結合→CLI入力の同期区間を
+一度のnative admission内で通す。起動準備のawaitをmutex内に持ち込まず、待機後には通常の世代・停止・slot検査を行う。
 空起動の結果不明は明示 `agent_execution/reconcile_launch` で既存世代へ結合できる（ADR 0128）。
 対象は返却済みunknown launch、send:not_issued、元native/server stamp付きの単独slotだけ。
 同じmetadata transaction内のprivate同期primitiveで現在のnative/managed世代、生のinitial_prompt:none・初期配送なし、
 harness生存とidleを照合する。既存recordのlaunchをaccepted、targetを当該世代へ結合し、該当slotだけを外す。
 これは現在世代の明示採用で、失われたRPC receiptの復元ではない。本文・初期prompt・claim・nativeには作用しない。
+同じaccepted targetへの再照合もsend:not_issuedなら現在のmanaged世代・生の未入力状態・入力待ちを再確認し、
+同じsessionへの競合slotや親の未確定作用があれば拒否する。保存済みacceptedを後の世代の不明解除の証拠にしない。
 issued、入力済み・不明、停止、別slot、世代/native/serverの不一致は拒否。後続sendは元source世代を含め通常受付を通る。
 遅着した元callbackはまだ所有するissued stage/slotがある時だけunknownを書け、照合後や別stageを上書きしない。
 native handlerのisErrorは元の本文を保持し、`aiterm/execution_error`のcode/effectを併記する。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.7",
+  "version": "0.61.9",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [