@code-yeongyu/senpi-codemode 2026.10.1-3 → 2026.10.2

package/CHANGELOG.md

@@ -12,6 +12,28 @@
 
 ### Removed
 
+## [2026.10.2] - 2026-10-02
+
+### Breaking Changes
+
+### Added
+
+- An eval regression gate records the full prompt and schema surfaces, helper witnesses across five required runtime legs, codemode-scoped eager imports, measured teardown resources (including global, named-import, promise and AbortSignal timers, named by creation site) and legacy contract results against a frozen baseline. CI provisions every interpreter and publishes the report; unrelated host imports and slow child startup cannot cause a regression failure. ([#2452](https://github.com/code-yeongyu/senpi/issues/2452))
+
+### Changed
+
+### Fixed
+
+- Fixed Mistral-hosted GLM 5.3 omitting required `eval` run fields when tool use is forced. ([#2444](https://github.com/code-yeongyu/senpi/pull/2444) by [@urbanbreach](https://github.com/urbanbreach))
+- Anthropic-compatible gateways that reject an `enum` inside a root `anyOf` branch (HTTP 400, code 11133) accept the `eval` schema again. ([#2569](https://github.com/code-yeongyu/senpi/issues/2569), reported and verified by [@DevNewbie1826](https://github.com/DevNewbie1826))
+- Reloading or replacing a session while a detached eval cell is running no longer kills the process from the footer's elapsed-time ticker. The ticker stops when its session's context is retired and starts again with the next session's cells; any other footer error still surfaces ([#2549](https://github.com/code-yeongyu/senpi/issues/2549) by [@rhyme227](https://github.com/rhyme227)).
+
+- JavaScript eval cells run in the session's project directory: a relative path in `Bun.file`, `Bun.write`, `node:fs`, `path.resolve`, `Bun.$`, spawned children, or `Bun.Glob` now resolves inside the project instead of the host process directory, which made `Bun.file("src/todo.ts")` fail with ENOENT in desktop threads and under `--cwd`. A missing or deleted session directory fails the cell with `CodemodeSessionCwdUnavailableError` instead of falling back to another directory. The bash tool's working directory is unchanged ([omo#9371](https://github.com/code-yeongyu/oh-my-openagent/issues/9371)).
+
+- Stop now explicitly reports when a running `Bun.$` wait forces the JavaScript kernel to restart and clears its variables, and recommends `Bun.spawn` or the bash tool for stoppable commands. Native shell semantics remain unchanged. Thanks to [@floweredao](https://github.com/floweredao) for the investigation ([#2475](https://github.com/code-yeongyu/senpi/pull/2475)); native cancellation remains tracked in [#2453](https://github.com/code-yeongyu/senpi/issues/2453).
+
+### Removed
+
 ## [2026.10.1-3] - 2026-10-01
 
 ### Breaking Changes

package/README.md

@@ -81,6 +81,20 @@ what a child spawned from the bash tool sees. The values snapshot at kernel star
 mid-session model switch updates the bash tool's next command but not already-running
 kernels; a new session starts fresh kernels with fresh values.
 
+### Working directory
+
+Every kernel runs in the session's working directory, the same directory the read,
+edit, and bash tools use. Python, Ruby, and Julia start their interpreter there. The
+JavaScript kernel is a worker thread, which cannot change directory, so it applies the
+session directory itself: `process.cwd()`, `path.resolve`, `node:fs` and
+`node:fs/promises`, `node:child_process`, `Bun.file`, `Bun.write`, `Bun.$`,
+`Bun.spawn`/`Bun.spawnSync`, `Bun.Glob` scans, and relative `import()` all resolve a
+relative path inside the session directory, never the host process directory. The host
+process and the bash tool keep their own directory. When the session directory is
+missing or deleted, the next cell fails with `CodemodeSessionCwdUnavailableError` naming
+the directory instead of running somewhere else. A new session (including a switch to
+another project) starts fresh kernels in its own directory.
+
 `PI_GOAL_STORE_FILE` is supplied by the host's optional `ExtensionContext.goalStoreFile`
 getter and may name a file that does not exist yet. It honors session-directory overrides
 and in-memory sessions; it cannot be derived reliably from `PI_SESSION_FILE`. If the host
@@ -246,10 +260,10 @@ user writes in: a progress update saying what the agent is doing and why, not
 a label for the code. The
 summary is shown in the TUI while the cell runs and in the finished result, so
 you can always tell what is running and why. It has no length limit; a
-collapsed block shows its first three lines. The schema marks all three
-optional only because the control actions (`peek`, `stop`, `list`) share it; a
-run request missing any of them fails with a teaching error that names what to
-add.
+collapsed block shows its first three lines. The schema requires all three
+for runs, including when `action` is omitted. Control actions (`peek`, `stop`,
+`list`) do not require run fields. Each action branch declares its own fields
+so providers can interpret it independently.
 
 ## Detached cells
 
@@ -319,6 +333,12 @@ restarted, or outcome unknown - never a per-language assumption; oversized
 buffered output is written under the session local root and referenced as
 `local://…`.
 
+When Stop restarts a kernel waiting on `Bun.$`, the result explicitly says that
+the kernel restarted and its variables were cleared. Use `Bun.spawn` or the
+bash tool for long-running commands you may want to stop. Native `Bun.$`
+cancellation is tracked in [Bun #11868](https://github.com/oven-sh/bun/issues/11868);
+the shell's interpretation and object redirects are not replaced.
+
 Commands a cell runs through `Bun.$` never read the host's terminal: the worker
 thread shares the TUI's stdin, so the shell wrapper hands every template an
 empty pipe (`true | ( … )`) while a cell is active. Output, exit codes, `cwd`,
@@ -360,6 +380,92 @@ namespace to prevent recursive execution.
 
 ## Validation
 
+The regression gate compares full prompt content (240 dialect/capability/runtime/host
+combinations), schemas, helper census, live helper witnesses and eager imports,
+and runs the legacy contracts. It requires Bun, Node, Python, Ruby and Julia; a missing
+interpreter fails rather than skipping a runtime. It does not gate wall-clock
+timing or absolute memory footprints; those belong to the paired benchmark.
+Ruby 3.4 and later also require the `base64` gem (`gem install base64 --version 0.3.0 --no-document`).
+
+The eager-import probe starts without third-party validation modules loaded.
+It validates observer records only after measurement, so a target sharing the
+harness dependency tree has the same cold census as a separate checkout.
+Module IDs are package-relative. The exact census covers codemode, its non-virtual
+dependency closure and Node builtins. The observer records parent edges and reads
+both loader `VIRTUAL_MODULES` tables: their backing packages and dependencies
+reachable only across virtual edges belong to the host and are excluded from
+set equality. Every observed edge and classification remains in the report.
+Workspace imports resolve through built `dist` entries. The gate build records
+the source file set, inherited build configs and content hashes after a successful
+build; preflight rejects missing, changed or deleted inputs. Unchanged content
+remains valid after timestamp refreshes. Each ignored `.senpi-gate-inputs.json`
+certificate sits beside its workspace manifest, outside the published `dist` tree.
+
+```bash
+bun packages/senpi-codemode/scripts/gate-build.ts
+bun run --cwd packages/senpi-codemode gate --baseline test/gate/baseline.json
+bun run --cwd packages/senpi-codemode test -- test/gate
+```
+
+The package test script already selects `test/`, so the last command intentionally
+runs the full package suite. For a focused gate-only run, invoke Vitest directly:
+
+```bash
+bun run --cwd packages/senpi-codemode vitest run test/gate
+```
+
+Install and build both the head checkout and a clean checkout of the PR merge
+base with `bun install --ignore-scripts --frozen-lockfile`. Build each target with
+the head harness, `bun packages/senpi-codemode/scripts/gate-build.ts <checkout>`.
+Record the baseline with the **head harness** against that freshly built base
+checkout, not by running an older harness:
+
+```bash
+bun run --cwd packages/senpi-codemode gate --target <base-checkout> \
+  --baseline test/gate/baseline.json --write-baseline
+```
+
+The report is gitignored `gate-report.json` by default (`--report <path>` overrides it).
+`test/gate/allowlist.json` contains reviewed additive changes keyed by plan node;
+it cannot authorize removal or modification of a legacy entry. The test-only
+`SENPI_CODEMODE_GATE_MUTATE=drop-phase` report mutation proves that helper removal
+is rejected. `SENPI_CODEMODE_GATE_MUTATE=leak-kernel` leaves the real kernel
+alive at the teardown witness, then closes it in `finally`; nonzero process,
+worker, socket, handle, subscription and active-resource listener counts fail
+by name. Constructors are observed because Bun's active-handle/report APIs
+return empty arrays even for live workers.
+Live timers are observed independently of the import census, including unref'd
+global timers, named and namespace imports from `node:timers`,
+`node:timers/promises` (including interval iterators and the scheduler), and
+self-rearming `AbortSignal.timeout` polls. Failures name the timer API and its
+creation site. The gate installs delegating wrappers before the kernel graph
+loads; on Bun its module-replacement API also updates builtin ESM bindings.
+These wrappers run only in gate processes and keep the native timer behavior.
+The only production-source additions are an inert gate observer at the existing
+worker, interpreter-process and bridge-server constructors. It is undefined in
+normal execution. This hook is necessary because Bun does not refresh named
+builtin exports when `syncBuiltinESMExports()` runs; patching their default
+exports alone otherwise reports zero resources even for a leaked real kernel.
+
+| Inert hook site | Measured resource | Verification |
+| --- | --- | --- |
+| `src/kernels/js/worker-host.ts` | Worker exit | Real Bun kernel close/leak tests |
+| `src/kernels/py/process.ts` | Python child close | Five-runtime gate and kernel-leak mutation |
+| `src/kernels/shared/subprocess-process.ts` | Ruby/Julia child close | Five-runtime gate and kernel-leak mutation |
+| `src/bridge/http-server.ts` | Server close and accepted sockets | Real Bun bridge close/leak tests |
+
+The gate-only `leak-bridge` mutation leaves the real bridge server open for the
+witness and closes it in `finally`; the real-runtime test must observe an open
+handle. Neither mutation is read by production code.
+
+Legacy scenario identities are compared exactly, so deleting or renaming a
+test cannot make the gate green. Platform-dependent skip outcomes remain
+visible in the report. Driver tests await child close events, with a generous
+hang watchdog; the infinite-loop timeout uses an injected clock after the
+worker announces execution. No deadline tests are excluded from the gate.
+The held-child probe advances the parent clock past all former startup
+deadlines three times before releasing the child's IPC barrier.
+
 ```bash
 cd packages/senpi-codemode
 bun run test

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.1-3",
+	"version": "2026.10.2",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -16,6 +16,7 @@
 		"LICENSE"
 	],
 	"scripts": {
+		"gate": "bun scripts/gate-eval.ts",
 		"test": "vitest run test/",
 		"clean": "node -e \"\"",
 		"build": "node -e \"\""
@@ -30,14 +31,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.1-3",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.1-3"
+		"@code-yeongyu/senpi": "2026.10.2"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.1-3"
+		"@code-yeongyu/senpi": "2026.10.2"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/http-server.ts

@@ -49,6 +49,7 @@ export async function startBridgeServer(options: BridgeServerOptions): Promise<B
 	const server = createServer((request, response) => {
 		void handleRequest(request, response, token, options);
 	});
+	globalThis.__senpiCodemodeGateObserveResource?.("handles", server, "close");
 	server.on("connection", (socket) => {
 		sockets.add(socket);
 		socket.on("close", () => sockets.delete(socket));

package/src/extension/eval-status-ticker.ts

@@ -1,5 +1,6 @@
 import type { EvalDetachedCellStatusEntry } from "../tool/detached-cell-manager.ts";
 import { formatEvalCellStatus } from "./eval-status.ts";
+import { isStaleExtensionContextError } from "./stale-context.ts";
 
 /** Footer live-elapsed refresh cadence while at least one detached cell is running. */
 export const EVAL_STATUS_TICK_INTERVAL_MS = 1000;
@@ -17,7 +18,8 @@ export interface EvalStatusTickerOptions {
  * Drives a once-per-second footer refresh while detached eval cells are running so
  * the "↗ py · … (Ns)" elapsed label advances live instead of freezing between
  * cell-set transitions. Same shape as the terminal builtin's MonitorStatusTicker:
- * the interval is unref'd, and ticks producing the already-rendered label are skipped.
+ * the interval is unref'd, ticks producing the already-rendered label are skipped, and a
+ * render that hits a retired extension context retires the ticker until the next sync.
  */
 export class EvalStatusTicker {
 	private readonly render: EvalStatusRender;
@@ -43,7 +45,7 @@ export class EvalStatusTicker {
 	sync(entries: readonly EvalDetachedCellStatusEntry[]): void {
 		this.entries = entries;
 		this.hasRendered = false;
-		this.tick();
+		if (!this.tick()) return;
 		if (entries.length === 0) {
 			this.stopInterval();
 			return;
@@ -69,11 +71,24 @@ export class EvalStatusTicker {
 		}
 	}
 
-	private tick(): void {
+	/** Returns false when the render hit a retired context and the ticker retired. */
+	private tick(): boolean {
 		const status = formatEvalCellStatus(this.entries, this.now());
-		if (this.hasRendered && status === this.lastRenderedStatus) return;
+		if (this.hasRendered && status === this.lastRenderedStatus) return true;
 		this.hasRendered = true;
 		this.lastRenderedStatus = status;
-		this.render(status);
+		try {
+			this.render(status);
+		} catch (error) {
+			// A context retired by session replacement or reload throws from inside the
+			// interval callback, where nothing catches it and the process exits. Retire
+			// instead; the next sync() (with a live context) re-arms the ticker.
+			if (isStaleExtensionContextError(error)) {
+				this.stop();
+				return false;
+			}
+			throw error;
+		}
+		return true;
 	}
 }

package/src/extension/session-cwd.ts

@@ -0,0 +1,35 @@
+import { stat } from "node:fs/promises";
+
+// Only these codes mean the directory is gone or was never one; anything else (EACCES, ELOOP,
+// EMFILE, EIO, ...) is a real failure that reopening the session would not fix, so it surfaces as is.
+const MISSING_DIRECTORY_CODES: ReadonlySet<string> = new Set(["ENOENT", "ENOTDIR"]);
+
+export class CodemodeSessionCwdUnavailableError extends Error {
+	readonly name = "CodemodeSessionCwdUnavailableError";
+	readonly cwd: string;
+
+	constructor(cwd: string, reason: string) {
+		super(
+			`The session working directory ${cwd} is unavailable (${reason}). Eval cells run in the session's project directory; reopen the session on an existing directory.`,
+		);
+		this.cwd = cwd;
+	}
+}
+
+export async function assertSessionCwdAvailable(cwd: string): Promise<void> {
+	let isDirectory: boolean;
+	try {
+		isDirectory = (await stat(cwd)).isDirectory();
+	} catch (error) {
+		if (
+			error instanceof Error &&
+			"code" in error &&
+			typeof error.code === "string" &&
+			MISSING_DIRECTORY_CODES.has(error.code)
+		) {
+			throw new CodemodeSessionCwdUnavailableError(cwd, error.code);
+		}
+		throw error;
+	}
+	if (!isDirectory) throw new CodemodeSessionCwdUnavailableError(cwd, "not a directory");
+}

package/src/extension/session-manager.ts

@@ -16,6 +16,7 @@ import { RubyKernel } from "../kernels/rb/kernel.ts";
 import type { SessionEnvironment } from "../kernels/session-env.ts";
 import { marshalToolResult } from "../tool/image.ts";
 import type { EvalKernel, EvalKernelManager, EvalLanguage, ExecuteTool } from "../tool/types.ts";
+import { assertSessionCwdAvailable } from "./session-cwd.ts";
 
 export interface CodemodeSessionManager extends EvalKernelManager {
 	dispose(): Promise<void>;
@@ -130,7 +131,10 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		// to the current cell, not the one that first created the kernel.
 		this.#onMessageRefs.set(language, onMessage);
 		const existing = this.#kernels.get(language);
-		if (existing) return existing;
+		if (existing) {
+			await assertSessionCwdAvailable(this.#options.cwd);
+			return existing;
+		}
 		const pending = this.#kernelCreations.get(language);
 		if (pending) return await pending;
 		// A bound method, never a closure in this frame: the dispatcher outlives every
@@ -204,12 +208,18 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		onMessage: (message: KernelToHostMessage) => void,
 		generation: number,
 	): Promise<EvalKernel> {
+		await assertSessionCwdAvailable(this.#options.cwd);
 		const kernel = await this.#createKernel(language, onMessage);
 		if (generation !== this.#generation) {
 			await kernel.close();
 			throw new CodemodeSessionDisposedError();
 		}
 		this.#kernels.set(language, kernel);
+		// The directory can vanish while the interpreter starts; every caller sharing this creation
+		// must see that, not only the next one. The kernel stays stored and dispose still closes it.
+		await assertSessionCwdAvailable(this.#options.cwd);
+		// A dispose that started during the check above already owns this stored kernel.
+		if (generation !== this.#generation) throw new CodemodeSessionDisposedError();
 		return kernel;
 	}
 

package/src/extension/stale-context.ts

@@ -0,0 +1,17 @@
+/**
+ * Detection for the error a retired host extension context throws once its session
+ * was replaced (new/fork/switch) or reloaded. Mirrors the host's
+ * `builtin/goal/stale-context.ts`, which stays internal to the host's builtins (the
+ * `@code-yeongyu/senpi` package does not export it). Older hosts also predate the reload
+ * message, so codemode carries both messages locally for compatibility.
+ */
+const STALE_EXTENSION_CONTEXT_ERROR_PREFIX = "This extension ctx is stale after session replacement or reload.";
+const STALE_EXTENSION_GENERATION_AFTER_RELOAD_MESSAGE = "stale extension generation after reload";
+
+export function isStaleExtensionContextError(error: unknown): error is Error {
+	return (
+		error instanceof Error &&
+		(error.message.startsWith(STALE_EXTENSION_CONTEXT_ERROR_PREFIX) ||
+			error.message === STALE_EXTENSION_GENERATION_AFTER_RELOAD_MESSAGE)
+	);
+}

package/src/kernels/AGENTS.md

@@ -36,6 +36,10 @@ runner/prelude assets).
   sees. The JS worker applies it at init (`worker-core.js`; shell capture pins
   the env view under Bun because `delete process.env.X` does not unsetenv),
   and py/rb/jl spawn with it merged into the interpreter environment.
+- Every kernel runs in the session cwd. py/rb/jl spawn there; the JS worker cannot
+  chdir, so `js/worker-cwd.js` applies the cwd to `process.cwd`, `path.resolve`,
+  `fs`, `child_process`, and `Bun.file`/`write`/`$`/`spawn`/`Glob` at init. The
+  session manager rejects a cell whose cwd is missing (`extension/session-cwd.ts`).
 
 ## ANTI-PATTERNS
 

package/src/kernels/js/context-manager.ts

@@ -3,10 +3,11 @@ import { CHILD_LIFECYCLE_OP, INTERRUPT_ACK_OP, MEMORY_COLLECTED_OP } from "../..
 import type { KernelInterruptHandle } from "../../tool/types.ts";
 import { KernelMemoryPolicy } from "../shared/kernel-memory.ts";
 import {
-	abandonedWorkerNote,
 	awaitCooperativeSettlement,
 	DEFAULT_INTERRUPT_BOUNDS,
 	type JavaScriptInterruptBounds,
+	restartedResult,
+	restartOutcome,
 	type WorkerRetirement,
 } from "./interrupt-bounds.ts";
 import {
@@ -27,7 +28,7 @@ import type {
 } from "./kernel-tools-types.ts";
 import { type JavaScriptKernelOptions, LocalModuleLoader } from "./local-module-loader.ts";
 import { terminateProcessTrees } from "./process-tree-host.ts";
-import { JavaScriptRunQueue, type PendingJavaScriptRun, stoppedResult } from "./run-queue.ts";
+import { JavaScriptRunQueue, type PendingJavaScriptRun } from "./run-queue.ts";
 import { bridgeError, WorkerStartupCancelledError } from "./worker-host.ts";
 import { WorkerSlot } from "./worker-slot.ts";
 
@@ -242,11 +243,9 @@ export class JavaScriptKernel {
 			}
 			if (!this.#runs.releaseActive(run)) return { retained: run.settledByWorker };
 			const retirement = await this.#terminate();
-			this.#runs.settle(run, run.interruptResult ?? stoppedResult(run.input.cellId, message));
+			this.#runs.settle(run, restartedResult(run, message));
 			void this.#recover(() => Promise.resolve());
-			return retirement === "abandoned"
-				? { retained: false, note: abandonedWorkerNote(this.#interruptBounds.terminateDeadlineMs) }
-				: { retained: false };
+			return restartOutcome(run, retirement, this.#interruptBounds);
 		} finally {
 			this.#clearToolCalls();
 		}
@@ -283,7 +282,7 @@ export class JavaScriptKernel {
 	#handleMessage(message: KernelToHostMessage): void {
 		if (this.#kernelTools.consume(message) && message.type !== "tool-call") return;
 		if (message.type === "status" && message.event.op === INTERRUPT_ACK_OP) {
-			this.#runs.active?.interruptAck?.resolve();
+			this.#runs.acknowledgeInterrupt(message.event);
 			return;
 		}
 		if (message.type === "status" && message.event.op === CHILD_LIFECYCLE_OP) {

package/src/kernels/js/interrupt-bounds.ts

@@ -1,5 +1,6 @@
+import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { WorkerLike } from "./inline-worker.ts";
-import type { PendingJavaScriptRun } from "./run-queue.ts";
+import { type PendingJavaScriptRun, stoppedResult } from "./run-queue.ts";
 
 /** How long the worker gets to acknowledge `interrupt`; silence means its event loop is blocked in synchronous code. */
 export const INTERRUPT_ACK_MS = 500;
@@ -53,6 +54,37 @@ export function abandonedWorkerNote(deadlineMs = WORKER_TERMINATE_DEADLINE_MS):
 	return `JavaScript worker did not stop within ${deadlineMs}ms: a synchronous call (for example Bun.spawnSync or child_process.spawnSync) is blocking it. A fresh worker replaced it; the blocked call keeps running until it returns.\n`;
 }
 
+const SHELL_RESTART_NOTICE =
+	"JavaScript kernel restarted while waiting on Bun.$; its variables were cleared.\nUse Bun.spawn or the bash tool for commands you may want to stop.";
+
+export function restartedResult(
+	run: PendingJavaScriptRun,
+	message: string,
+): Extract<KernelToHostMessage, { type: "result" }> {
+	const result = run.interruptResult ?? stoppedResult(run.input.cellId, message);
+	if (!run.shellWaitActive || result.ok) return result;
+	return {
+		...result,
+		error: {
+			...result.error,
+			code: "js_shell_interrupt_restart",
+			message: `${result.error.message}\n${SHELL_RESTART_NOTICE}`,
+		},
+	};
+}
+
+export function restartOutcome(
+	run: PendingJavaScriptRun,
+	retirement: WorkerRetirement,
+	bounds: JavaScriptInterruptBounds,
+): { readonly retained: false; readonly note?: string } {
+	const notes = [
+		...(run.shellWaitActive ? [SHELL_RESTART_NOTICE] : []),
+		...(retirement === "abandoned" ? [abandonedWorkerNote(bounds.terminateDeadlineMs)] : []),
+	];
+	return { retained: false, ...(notes.length === 0 ? {} : { note: notes.join("\n") }) };
+}
+
 async function raceDeadline<T extends string, Fallback extends string>(
 	operation: Promise<T>,
 	deadlineMs: number,

package/src/kernels/js/run-queue.ts

@@ -1,4 +1,4 @@
-import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { EvalStatusEvent, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { JavaScriptRunInput } from "./kernel-contract.ts";
 
 type ResultMessage = Extract<KernelToHostMessage, { type: "result" }>;
@@ -14,6 +14,7 @@ export interface PendingJavaScriptRun {
 	interruptResult: ResultMessage | null;
 	interruptAck: PromiseWithResolvers<void> | null;
 	settledByWorker: boolean;
+	shellWaitActive: boolean;
 }
 
 export class JavaScriptRunQueue {
@@ -40,6 +41,7 @@ export class JavaScriptRunQueue {
 			interruptResult: null,
 			interruptAck: null,
 			settledByWorker: false,
+			shellWaitActive: false,
 		});
 		return promise;
 	}
@@ -53,6 +55,13 @@ export class JavaScriptRunQueue {
 		return next;
 	}
 
+	acknowledgeInterrupt(event: EvalStatusEvent): void {
+		const active = this.#active;
+		if (!active || event.cellId !== active.input.cellId) return;
+		active.shellWaitActive = event.shellWaitActive === true;
+		active.interruptAck?.resolve();
+	}
+
 	remove(cellId: string, reason = "interrupted"): boolean {
 		const index = this.#queue.findIndex((run) => run.input.cellId === cellId);
 		if (index < 0) return false;

package/src/kernels/js/worker-core.js

@@ -2,6 +2,7 @@ import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 import { createKernelToolPump } from "./kernel-tools-pump.js";
 import { hostDeniedError, hostToolRefusal } from "./kernel-tools-scope.js";
+import { installSessionCwd } from "./worker-cwd.js";
 import { createWorkerMemory } from "./worker-memory.js";
 import { JsWorkerRuntime } from "./worker-runtime.js";
 import { installKernelWebView } from "./worker-webview.js";
@@ -91,7 +92,7 @@ export function createWorkerCore(transport, options) {
 
 	function interruptCell(reason) {
 		if (!activeCell || !runtime) return;
-		emit({ type: "status", event: { op: INTERRUPT_ACK_OP, cellId: activeCell.cellId } });
+		acknowledgeInterrupt();
 		const interruption = cellInterruptedError(reason);
 		activeCell.interruption = interruption;
 		for (const [callId, pending] of pendingTools) {
@@ -102,6 +103,11 @@ export function createWorkerCore(transport, options) {
 		runtime.interrupt();
 	}
 
+	function acknowledgeInterrupt() {
+		if (!activeCell || !runtime) return;
+		emit({ type: "status", event: { op: INTERRUPT_ACK_OP, cellId: activeCell.cellId, shellWaitActive: runtime.shellWaitActive } });
+	}
+
 	function onMessage(message) {
 		if (message.type === "run" || message.type === "interrupt" || message.type === "close") memory?.cancelIdle();
 		if (kernelTools.handle(message)) return;
@@ -118,6 +124,7 @@ export function createWorkerCore(transport, options) {
 		}
 		if (message.type === "init") {
 			applySessionEnvironment(message.sessionEnv);
+			installSessionCwd(options.cwd);
 			installKernelWebView(requestWebViewPort);
 			runtime = new JsWorkerRuntime({
 				cwd: options.cwd,
@@ -128,6 +135,9 @@ export function createWorkerCore(transport, options) {
 				hostToolNames: message.hostToolNames ?? [],
 				foreignLanguageNames: message.foreignLanguageNames ?? [],
 				onChildEvent: (event) => emit({ type: "status", event: { op: CHILD_LIFECYCLE_OP, ...event } }),
+				onShellWaitChange: () => {
+					if (activeCell?.interruption) acknowledgeInterrupt();
+				},
 			});
 			if (message.memory) {
 				memory = createWorkerMemory(message.memory, (report) => emit({ type: "status", event: { op: MEMORY_COLLECTED_OP, ...report } }));

package/src/kernels/js/worker-cwd.js

@@ -0,0 +1,185 @@
+import { Buffer } from "node:buffer";
+import { syncBuiltinESMExports } from "node:module";
+import { isAbsolute, resolve, sep } from "node:path";
+import { isMainThread } from "node:worker_threads";
+
+// A worker thread cannot chdir (process.chdir throws ERR_WORKER_UNSUPPORTED_OPERATION under Node
+// and Bun), so every relative path a cell used resolved against the host process directory: in a
+// shared RPC host that is the host's state dir, not the session's project (omo#9371). The worker
+// therefore applies the session directory to the path-taking APIs itself. Patches touch only this
+// worker's module instances and globals; the host thread and its bash tool keep their own cwd.
+
+// Indexes of the path arguments each fs function takes; `symlink`'s target stays relative to the link.
+const FS_PATH_ARGS = {
+	access: [0],
+	appendFile: [0],
+	chmod: [0],
+	chown: [0],
+	copyFile: [0, 1],
+	cp: [0, 1],
+	createReadStream: [0],
+	createWriteStream: [0],
+	exists: [0],
+	lchmod: [0],
+	lchown: [0],
+	link: [0, 1],
+	lstat: [0],
+	lutimes: [0],
+	mkdir: [0],
+	mkdtemp: [0],
+	open: [0],
+	openAsBlob: [0],
+	opendir: [0],
+	readdir: [0],
+	readFile: [0],
+	readlink: [0],
+	realpath: [0],
+	rename: [0, 1],
+	rm: [0],
+	rmdir: [0],
+	stat: [0],
+	statfs: [0],
+	symlink: [1],
+	truncate: [0],
+	unlink: [0],
+	unwatchFile: [0],
+	utimes: [0],
+	watch: [0],
+	watchFile: [0],
+	writeFile: [0],
+};
+
+const CHILD_PROCESS_FILE_ARGS = ["spawn", "spawnSync", "execFile", "execFileSync", "fork"];
+const CHILD_PROCESS_COMMAND_ARGS = ["exec", "execSync"];
+
+export function installSessionCwd(cwd) {
+	if (isMainThread) throw new Error("installSessionCwd must only run inside a kernel worker thread");
+	const root = resolve(cwd);
+	const rootBytes = Buffer.from(root.endsWith(sep) ? root : `${root}${sep}`);
+	// fs also takes Buffer/Uint8Array paths; a relative one gets the session root prepended as bytes,
+	// so non-UTF-8 names survive. A file: URL is always absolute, so URLs pass through unchanged.
+	const at = (path) => {
+		if (typeof path === "string") return isAbsolute(path) ? path : resolve(root, path);
+		if (path instanceof Uint8Array && !isAbsolute(Buffer.from(path).toString("latin1"))) {
+			return Buffer.concat([rootBytes, path]);
+		}
+		return path;
+	};
+	process.cwd = () => root;
+	const path = process.getBuiltinModule("node:path");
+	const resolveFromProcess = path.resolve;
+	path.resolve = (...segments) => resolveFromProcess(root, ...segments);
+	patchFs(process.getBuiltinModule("node:fs"), process.getBuiltinModule("node:fs/promises"), at, root);
+	patchChildProcess(process.getBuiltinModule("node:child_process"), at, root);
+	patchBun(globalThis.Bun, at, root);
+	syncBuiltinESMExports();
+}
+
+function patchFs(fs, promises, at, root) {
+	const promiseModules = [...new Set([fs.promises, promises])];
+	for (const [name, indexes] of Object.entries(FS_PATH_ARGS)) {
+		replace(fs, name, (fn) => resolvingArgs(fn, indexes, at));
+		replace(fs, `${name}Sync`, (fn) => resolvingArgs(fn, indexes, at));
+		for (const target of promiseModules) replace(target, name, (fn) => resolvingArgs(fn, indexes, at));
+	}
+	replace(fs.realpath, "native", (fn) => resolvingArgs(fn, [0], at));
+	replace(fs.realpathSync, "native", (fn) => resolvingArgs(fn, [0], at));
+	for (const target of [fs, ...promiseModules]) {
+		for (const name of ["glob", "globSync"]) replace(target, name, (fn) => withOptionsCwd(fn, () => 1, root));
+	}
+}
+
+function patchChildProcess(childProcess, at, root) {
+	for (const name of CHILD_PROCESS_FILE_ARGS) {
+		replace(childProcess, name, (fn) => {
+			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root);
+			return name === "fork" ? resolvingArgs(withCwd, [0], at) : withCwd;
+		});
+	}
+	for (const name of CHILD_PROCESS_COMMAND_ARGS) replace(childProcess, name, (fn) => withOptionsCwd(fn, () => 1, root));
+}
+
+function patchBun(bun, at, root) {
+	if (bun === null || typeof bun !== "object") return;
+	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
+	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
+	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
+	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root));
+	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
+	const glob = bun.Glob?.prototype;
+	if (glob) {
+		for (const name of ["scan", "scanSync"]) {
+			replace(glob, name, (fn) =>
+				function scan(options) {
+					return fn.call(this, globScanOptions(options, root));
+				},
+			);
+		}
+	}
+}
+
+function replace(target, name, wrap) {
+	const original = target?.[name];
+	if (typeof original !== "function") return;
+	target[name] = copyOwnProperties(original, wrap(original));
+}
+
+function copyOwnProperties(original, wrapped) {
+	for (const key of Reflect.ownKeys(original)) {
+		if (key === "length" || key === "name" || key === "prototype" || Object.hasOwn(wrapped, key)) continue;
+		const descriptor = Object.getOwnPropertyDescriptor(original, key);
+		if (descriptor) Object.defineProperty(wrapped, key, descriptor);
+	}
+	return wrapped;
+}
+
+function resolvingArgs(fn, indexes, at) {
+	return function resolvingPathArguments(...args) {
+		for (const index of indexes) if (index < args.length) args[index] = at(args[index]);
+		return fn.apply(this, args);
+	};
+}
+
+// spawn(file, args?, options?) and friends: options follow an args array, or an explicit
+// undefined args slot, otherwise they sit right after the file.
+function fileOptionsIndex(args) {
+	return Array.isArray(args[1]) || (args[1] == null && args.length > 2) ? 2 : 1;
+}
+
+function withOptionsCwd(fn, optionsIndex, root) {
+	return function withSessionCwd(...args) {
+		const index = optionsIndex(args);
+		const options = args[index];
+		if (options === undefined || options === null) args[index] = { cwd: root };
+		else if (typeof options === "function") args.splice(index, 0, { cwd: root });
+		else if (typeof options === "object") args[index] = { ...options, cwd: cwdFrom(options.cwd, root) };
+		return fn.apply(this, args);
+	};
+}
+
+function withBunSpawnCwd(fn, root) {
+	return function spawnInSessionCwd(...args) {
+		const [first, second] = args;
+		if (Array.isArray(first)) {
+			const options = second === undefined || second === null ? {} : second;
+			if (typeof options !== "object") return fn.apply(this, args);
+			return fn.call(this, first, { ...options, cwd: cwdFrom(options.cwd, root) }, ...args.slice(2));
+		}
+		if (first !== null && typeof first === "object") {
+			return fn.call(this, { ...first, cwd: cwdFrom(first.cwd, root) }, ...args.slice(1));
+		}
+		return fn.apply(this, args);
+	};
+}
+
+function globScanOptions(options, root) {
+	if (options === undefined || options === null) return { cwd: root };
+	if (typeof options === "string") return cwdFrom(options, root);
+	if (typeof options === "object") return { ...options, cwd: cwdFrom(options.cwd, root) };
+	return options;
+}
+
+function cwdFrom(cwd, root) {
+	if (cwd === undefined || cwd === null) return root;
+	return typeof cwd === "string" && !isAbsolute(cwd) ? resolve(root, cwd) : cwd;
+}

package/src/kernels/js/worker-host.ts

@@ -1,8 +1,16 @@
+import type { EventEmitter } from "node:events";
 import { Worker } from "node:worker_threads";
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { WorkerLike } from "./inline-worker.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
 
+declare global {
+	// Inert outside the gate. Bun does not refresh named builtin constructor exports.
+	var __senpiCodemodeGateObserveResource:
+		| ((kind: "processes" | "workers" | "handles", resource: EventEmitter, closeEvent: "exit" | "close") => void)
+		| undefined;
+}
+
 export class WorkerStartupCancelledError extends Error {
 	readonly name = "WorkerStartupCancelledError";
 
@@ -27,12 +35,9 @@ export function spawnNodeWorker(
 	parallelPoolWidth: number,
 	mode: JavaScriptKernelMode = "worker",
 ): WorkerLike {
-	return wrapNodeWorker(
-		new Worker(url, {
-			workerData: { cwd, parallelPoolWidth },
-		}),
-		mode,
-	);
+	const worker = new Worker(url, { workerData: { cwd, parallelPoolWidth } });
+	globalThis.__senpiCodemodeGateObserveResource?.("workers", worker, "exit");
+	return wrapNodeWorker(worker, mode);
 }
 
 export function waitForReady(worker: WorkerLike, signal: AbortSignal): Promise<void> {

package/src/kernels/js/worker-runtime.js

@@ -30,13 +30,16 @@ export class JsWorkerRuntime {
 	#hooks = null;
 	#pendingDisplays = [];
 	#children = new Set();
+	#shellWaits = new Set();
 	#onChildEvent;
+	#onShellWaitChange;
 	#tools;
 
 	constructor(options) {
 		this.#cwd = options.cwd;
 		this.#parallelPoolWidth = options.parallelPoolWidth;
 		this.#onChildEvent = typeof options.onChildEvent === "function" ? options.onChildEvent : null;
+		this.#onShellWaitChange = options.onShellWaitChange;
 		this.#localRoots = { ...(options.localRoots ?? {}) };
 		if (options.artifactsDir && !this.#localRoots.local) this.#localRoots.local = join(options.artifactsDir, "local");
 		this.#tools = createKernelToolRegistry({
@@ -51,7 +54,12 @@ export class JsWorkerRuntime {
 		return this.#tools;
 	}
 
+	get shellWaitActive() {
+		return this.#shellWaits.size > 0;
+	}
+
 	async run(code, cellId, hooks) {
+		this.#shellWaits.clear();
 		this.#hooks = hooks;
 		try {
 			let prelude = "";
@@ -158,6 +166,11 @@ export class JsWorkerRuntime {
 			isActive: () => this.#hooks !== null,
 			emitText: (stream, data) => this.#emitText(stream, data),
 			onChild: (child, spawnOptions) => this.#trackChild(child, spawnOptions),
+			onShellWait: (promise, waiting) => {
+				if (waiting) this.#shellWaits.add(promise);
+				else this.#shellWaits.delete(promise);
+				this.#onShellWaitChange?.();
+			},
 		});
 		globalThis.__senpi_restore_console__ = () => {
 			console.log = originalLog;

package/src/kernels/js/worker-shell-capture.d.ts

@@ -15,6 +15,8 @@ export interface ShellCaptureOptions {
 	readonly emitText: (stream: ShellCaptureStream, data: string) => void;
 	/** Receives every `Bun.spawn` child created while a cell is active so the runtime can kill it on interrupt. */
 	readonly onChild?: (child: ShellCaptureChild, spawnOptions?: unknown) => void;
+	/** Tracks native shell waits without starting an unawaited ShellPromise. */
+	readonly onShellWait?: (promise: object, waiting: boolean) => void;
 }
 
 export function installShellCapture(options: ShellCaptureOptions): ShellCaptureRestore;

package/src/kernels/js/worker-shell-capture.js

@@ -41,7 +41,7 @@ function capturedShell(originalShell, options) {
 	const shell = (strings, ...expressions) => {
 		if (!options.isActive()) return originalShell(strings, ...expressions);
 		const promise = originalShell(isolateStdin(strings), ...expressions);
-		return captureShellPromise(promise, options.emitText);
+		return captureShellPromise(promise, options);
 	};
 	for (const key of Object.keys(originalShell)) shell[key] = originalShell[key];
 	for (const method of SHELL_CONFIG_METHODS) {
@@ -65,13 +65,20 @@ function isolateStdin(strings) {
 	return Object.freeze(Object.assign(cooked, { raw: Object.freeze(raw) }));
 }
 
-function captureShellPromise(promise, emitText) {
+function captureShellPromise(promise, options) {
 	const prototype = Object.getPrototypeOf(promise);
+	let waiting = false;
+	let settled = false;
+	const finish = () => {
+		settled = true;
+		if (waiting) options.onShellWait?.(promise, false);
+		waiting = false;
+	};
 	let echo = true;
 	const echoOnce = (output) => {
 		if (!echo) return;
 		echo = false;
-		emitShellOutput(output, emitText);
+		emitShellOutput(output, options.emitText);
 	};
 	prototype.quiet.call(promise);
 	promise.quiet = function quiet() {
@@ -86,13 +93,19 @@ function captureShellPromise(promise, emitText) {
 		};
 	}
 	promise.then = function then(onFulfilled, onRejected) {
+		if (!waiting && !settled) {
+			waiting = true;
+			options.onShellWait?.(promise, true);
+		}
 		return prototype.then.call(
 			this,
 			(output) => {
+				finish();
 				echoOnce(output);
 				return onFulfilled ? onFulfilled(output) : output;
 			},
 			(error) => {
+				finish();
 				echoOnce(error);
 				if (onRejected) return onRejected(error);
 				throw error;

package/src/kernels/py/process.ts

@@ -34,13 +34,15 @@ export function defaultSpawn(options: KernelSpawnOptions): KernelChild {
 	// watch for a parent that is already gone by the time the interpreter boots.
 	const env =
 		process.platform === "win32" ? options.env : { ...options.env, SENPI_PY_KERNEL_PARENT_PID: String(process.pid) };
-	return spawn(options.command, [...options.args], {
+	const child = spawn(options.command, [...options.args], {
 		cwd: options.cwd,
 		env,
 		stdio: "pipe",
 		detached: process.platform !== "win32",
 		windowsHide: true,
 	});
+	globalThis.__senpiCodemodeGateObserveResource?.("processes", child, "close");
+	return child;
 }
 
 export function splitCommand(commandLine: string): { readonly command: string; readonly args: readonly string[] } {

package/src/kernels/shared/subprocess-process.ts

@@ -165,10 +165,12 @@ export class SubprocessProcess {
 
 export function spawnSubprocess(spawn: SubprocessSpawn | undefined, request: SubprocessSpawnRequest): SubprocessLike {
 	if (spawn) return spawn(request.command, request.args, { cwd: request.cwd, env: request.env });
-	return nodeSpawn(request.command, [...request.args], {
+	const child = nodeSpawn(request.command, [...request.args], {
 		cwd: request.cwd,
 		detached: true,
 		env: request.env,
 		stdio: ["pipe", "pipe", "pipe"],
 	});
+	globalThis.__senpiCodemodeGateObserveResource?.("processes", child, "close");
+	return child;
 }

package/src/tool/image.ts

@@ -30,6 +30,28 @@ const MAX_DISPLAY_IMAGES_PER_CELL = 8;
 const MAX_DISPLAY_IMAGE_BYTES_PER_CELL = 24 * 1024 * 1024;
 const MAX_JSON_OUTPUTS_PER_CELL = 64;
 
+// Base64 of the signatures of the formats providers accept inline (PNG, JPEG except JPEG-LS, GIF,
+// "RIFF....WEBP"). Signatures start at byte 0, so their encodings are prefixes.
+const IMAGE_SIGNATURES: ReadonlyArray<readonly [string, RegExp]> = [
+	["image/png", /^iVBORw0KGg/],
+	["image/jpeg", /^[/]9j[/](?!9)/],
+	["image/gif", /^R0lGOD[dl]h/],
+	["image/webp", /^UklG.{8}RUJQ/],
+];
+
+// Providers reject the whole request on a bad image, and a kept image block is resent on every later turn,
+// so invalid data is dropped with a reason instead. The detected type wins over the declared one.
+function validateDisplayImage(dataBase64: string): { data: string; mimeType: string } | { reason: string } {
+	const data = dataBase64.replace(/\s+/g, "");
+	if (data.length === 0 || data.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(data)) {
+		return { reason: "the image data is not valid base64 (truncated or corrupted?)" };
+	}
+	const head = data.slice(0, 16);
+	const signature = IMAGE_SIGNATURES.find(([, pattern]) => pattern.test(head));
+	if (signature === undefined) return { reason: "the image data is not a PNG, JPEG, GIF, or WebP image" };
+	return { data, mimeType: signature[0] };
+}
+
 export interface EvalOutputOptions {
 	readonly artifactPath?: string;
 	readonly headBytes: number;
@@ -98,6 +120,11 @@ export class EvalOutputCollector {
 
 	display(message: DisplayMessage): void {
 		if (message.mimeType.startsWith("image/")) {
+			const image = validateDisplayImage(message.dataBase64);
+			if ("reason" in image) {
+				this.#sink.push(`[display: image dropped \u2014 ${image.reason}]\n`);
+				return;
+			}
 			if (
 				this.#displayImages.length >= MAX_DISPLAY_IMAGES_PER_CELL ||
 				this.#displayImageBytes + message.dataBase64.length > MAX_DISPLAY_IMAGE_BYTES_PER_CELL
@@ -105,8 +132,8 @@ export class EvalOutputCollector {
 				this.#displayImagesElided++;
 				return;
 			}
-			this.#displayImages.push({ type: "image", mimeType: message.mimeType, data: message.dataBase64 });
-			this.#displayImageBytes += message.dataBase64.length;
+			this.#displayImages.push({ type: "image", mimeType: image.mimeType, data: image.data });
+			this.#displayImageBytes += image.data.length;
 			return;
 		}
 		const text = Buffer.from(message.dataBase64, "base64").toString("utf8");

package/src/tool/types.ts

@@ -66,8 +66,7 @@ export type EvalControlInput =
 
 export type EvalToolRequest = EvalToolInput | EvalControlInput;
 
-// Like `summary`, `language` and `code` stay optional in the wire schema because control
-// actions share it; the description teaches the requirement and parseEvalRequest enforces it.
+// Run fields are optional at the root for control calls, but required in the run branch.
 const LANGUAGE_FIELD_DESCRIPTION =
 	"REQUIRED for run. Kernel that runs the cell; each language keeps its own persistent state across eval calls.";
 const CODE_FIELD_DESCRIPTION = "REQUIRED for run. Cell body, verbatim.";
@@ -124,11 +123,20 @@ export function createEvalInputSchema(
 	const languages = enabledLanguageList(enabled);
 	if (languages.length === 0) throw new Error("eval requires at least one enabled language");
 	const languageSchema = evalLanguageUnion(languages);
+	const properties = evalInputProperties(languageSchema, deadlines);
 	return Type.Unsafe<EvalToolRequest>(
-		Type.Object(evalInputProperties(languageSchema, deadlines), {
+		Type.Object(properties, {
+			// Keep branches self-contained for Mistral-hosted GLM (#2240).
 			anyOf: [
-				{ properties: { action: { enum: ["run", "list"] } } },
-				{ properties: { action: { enum: ["peek", "stop"] } }, required: ["action", "cell_id"] },
+				Type.Object(
+					{ ...properties, action: Type.Optional(Type.Literal("run")) },
+					{ required: ["language", "code", "summary"] },
+				),
+				Type.Object({ action: Type.Literal("list") }),
+				Type.Object(
+					{ action: Type.Union([Type.Literal("peek"), Type.Literal("stop")]), cell_id: properties.cell_id },
+					{ required: ["action", "cell_id"] },
+				),
 			],
 		}),
 	) as EvalInputSchema;