@code-yeongyu/senpi-codemode 2026.10.1 → 2026.10.2

package/CHANGELOG.md

@@ -12,6 +12,60 @@
 
 ### Removed
 
+## [2026.10.2] - 2026-10-02
+
+### Breaking Changes
+
+### Added
+
+- An eval regression gate records the full prompt and schema surfaces, helper witnesses across five required runtime legs, codemode-scoped eager imports, measured teardown resources (including global, named-import, promise and AbortSignal timers, named by creation site) and legacy contract results against a frozen baseline. CI provisions every interpreter and publishes the report; unrelated host imports and slow child startup cannot cause a regression failure. ([#2452](https://github.com/code-yeongyu/senpi/issues/2452))
+
+### Changed
+
+### Fixed
+
+- Fixed Mistral-hosted GLM 5.3 omitting required `eval` run fields when tool use is forced. ([#2444](https://github.com/code-yeongyu/senpi/pull/2444) by [@urbanbreach](https://github.com/urbanbreach))
+- Anthropic-compatible gateways that reject an `enum` inside a root `anyOf` branch (HTTP 400, code 11133) accept the `eval` schema again. ([#2569](https://github.com/code-yeongyu/senpi/issues/2569), reported and verified by [@DevNewbie1826](https://github.com/DevNewbie1826))
+- Reloading or replacing a session while a detached eval cell is running no longer kills the process from the footer's elapsed-time ticker. The ticker stops when its session's context is retired and starts again with the next session's cells; any other footer error still surfaces ([#2549](https://github.com/code-yeongyu/senpi/issues/2549) by [@rhyme227](https://github.com/rhyme227)).
+
+- JavaScript eval cells run in the session's project directory: a relative path in `Bun.file`, `Bun.write`, `node:fs`, `path.resolve`, `Bun.$`, spawned children, or `Bun.Glob` now resolves inside the project instead of the host process directory, which made `Bun.file("src/todo.ts")` fail with ENOENT in desktop threads and under `--cwd`. A missing or deleted session directory fails the cell with `CodemodeSessionCwdUnavailableError` instead of falling back to another directory. The bash tool's working directory is unchanged ([omo#9371](https://github.com/code-yeongyu/oh-my-openagent/issues/9371)).
+
+- Stop now explicitly reports when a running `Bun.$` wait forces the JavaScript kernel to restart and clears its variables, and recommends `Bun.spawn` or the bash tool for stoppable commands. Native shell semantics remain unchanged. Thanks to [@floweredao](https://github.com/floweredao) for the investigation ([#2475](https://github.com/code-yeongyu/senpi/pull/2475)); native cancellation remains tracked in [#2453](https://github.com/code-yeongyu/senpi/issues/2453).
+
+### Removed
+
+## [2026.10.1-3] - 2026-10-01
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+- The `eval` tool points at the bun-1-4 skill before a cell that installs a package, spawns a server or PTY, or starts a long run, instead of demanding it before the first JavaScript cell ([#2505](https://github.com/code-yeongyu/senpi/issues/2505)).
+
+### Fixed
+
+- Kernel-originated tool approvals now reach the RPC client that submitted the cell, including approvals requested after a cell detaches and its original turn ends. Reusing a kernel no longer sends permission dialogs to its creation context. ([#2512](https://github.com/code-yeongyu/senpi/issues/2512))
+
+- Python eval startup waits for kernel readiness with advancing stage events instead of a five-second total deadline. Cold Windows imports can complete normally; a hung start identifies its stalled stage. ([#2452](https://github.com/code-yeongyu/senpi/issues/2452))
+
+- Fixed the running eval spinner freezing between output updates. ([#2503](https://github.com/code-yeongyu/senpi/issues/2503))
+
+### Removed
+
+## [2026.10.1-2] - 2026-10-01
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
 ## [2026.10.1] - 2026-10-01
 
 ### Breaking Changes

package/README.md

@@ -18,6 +18,9 @@ task-tool names are known.
 	events, tool-call summaries, elapsed duration, and structured display state;
 	a terminal peek preserves the exact final result.
 - Loopback, bearer-authenticated kernel bridge with bounded JSONL frames.
+- Tool calls retain the submitting cell's host context, including its RPC approval
+  channel, even after detachment or kernel reuse. Headless sessions deny commands
+  that require approval rather than waiting for an absent UI.
 - Structured status events for file operations, environment access, phases,
   bridge activity, and delegated task progress.
 - One versioned `senpi.eval.execution` event at terminal cell settlement. The
@@ -56,6 +59,14 @@ task-tool names are known.
 A missing optional interpreter removes that language from the session's `eval`
 schema; it is not an installation failure.
 
+Python startup waits for the interpreter's `ready` event. It reports progress
+through `stdlib-imports`, `runtime-init`, and `host-init`; advancing to the next
+stage resets an inactivity guard rather than consuming a total startup budget.
+The default guard is 11 seconds per stage, derived from a measured 5.220-second
+Windows fresh-cache bootstrap p99 (30 samples). A stalled or failed start names
+the last stage and retains the interpreter's diagnostic error. The low-level
+`PythonKernel.start({ startupTimeoutMs })` override applies per stage.
+
 ### Session environment
 
 Every kernel starts with the active session's `PI_*` environment — `PI_SESSION_ID`,
@@ -70,6 +81,20 @@ what a child spawned from the bash tool sees. The values snapshot at kernel star
 mid-session model switch updates the bash tool's next command but not already-running
 kernels; a new session starts fresh kernels with fresh values.
 
+### Working directory
+
+Every kernel runs in the session's working directory, the same directory the read,
+edit, and bash tools use. Python, Ruby, and Julia start their interpreter there. The
+JavaScript kernel is a worker thread, which cannot change directory, so it applies the
+session directory itself: `process.cwd()`, `path.resolve`, `node:fs` and
+`node:fs/promises`, `node:child_process`, `Bun.file`, `Bun.write`, `Bun.$`,
+`Bun.spawn`/`Bun.spawnSync`, `Bun.Glob` scans, and relative `import()` all resolve a
+relative path inside the session directory, never the host process directory. The host
+process and the bash tool keep their own directory. When the session directory is
+missing or deleted, the next cell fails with `CodemodeSessionCwdUnavailableError` naming
+the directory instead of running somewhere else. A new session (including a switch to
+another project) starts fresh kernels in its own directory.
+
 `PI_GOAL_STORE_FILE` is supplied by the host's optional `ExtensionContext.goalStoreFile`
 getter and may name a file that does not exist yet. It honors session-directory overrides
 and in-memory sessions; it cannot be derived reliably from `PI_SESSION_FILE`. If the host
@@ -235,10 +260,10 @@ user writes in: a progress update saying what the agent is doing and why, not
 a label for the code. The
 summary is shown in the TUI while the cell runs and in the finished result, so
 you can always tell what is running and why. It has no length limit; a
-collapsed block shows its first three lines. The schema marks all three
-optional only because the control actions (`peek`, `stop`, `list`) share it; a
-run request missing any of them fails with a teaching error that names what to
-add.
+collapsed block shows its first three lines. The schema requires all three
+for runs, including when `action` is omitted. Control actions (`peek`, `stop`,
+`list`) do not require run fields. Each action branch declares its own fields
+so providers can interpret it independently.
 
 ## Detached cells
 
@@ -308,6 +333,12 @@ restarted, or outcome unknown - never a per-language assumption; oversized
 buffered output is written under the session local root and referenced as
 `local://…`.
 
+When Stop restarts a kernel waiting on `Bun.$`, the result explicitly says that
+the kernel restarted and its variables were cleared. Use `Bun.spawn` or the
+bash tool for long-running commands you may want to stop. Native `Bun.$`
+cancellation is tracked in [Bun #11868](https://github.com/oven-sh/bun/issues/11868);
+the shell's interpretation and object redirects are not replaced.
+
 Commands a cell runs through `Bun.$` never read the host's terminal: the worker
 thread shares the TUI's stdin, so the shell wrapper hands every template an
 empty pipe (`true | ( … )`) while a cell is active. Output, exit codes, `cwd`,
@@ -349,6 +380,92 @@ namespace to prevent recursive execution.
 
 ## Validation
 
+The regression gate compares full prompt content (240 dialect/capability/runtime/host
+combinations), schemas, helper census, live helper witnesses and eager imports,
+and runs the legacy contracts. It requires Bun, Node, Python, Ruby and Julia; a missing
+interpreter fails rather than skipping a runtime. It does not gate wall-clock
+timing or absolute memory footprints; those belong to the paired benchmark.
+Ruby 3.4 and later also require the `base64` gem (`gem install base64 --version 0.3.0 --no-document`).
+
+The eager-import probe starts without third-party validation modules loaded.
+It validates observer records only after measurement, so a target sharing the
+harness dependency tree has the same cold census as a separate checkout.
+Module IDs are package-relative. The exact census covers codemode, its non-virtual
+dependency closure and Node builtins. The observer records parent edges and reads
+both loader `VIRTUAL_MODULES` tables: their backing packages and dependencies
+reachable only across virtual edges belong to the host and are excluded from
+set equality. Every observed edge and classification remains in the report.
+Workspace imports resolve through built `dist` entries. The gate build records
+the source file set, inherited build configs and content hashes after a successful
+build; preflight rejects missing, changed or deleted inputs. Unchanged content
+remains valid after timestamp refreshes. Each ignored `.senpi-gate-inputs.json`
+certificate sits beside its workspace manifest, outside the published `dist` tree.
+
+```bash
+bun packages/senpi-codemode/scripts/gate-build.ts
+bun run --cwd packages/senpi-codemode gate --baseline test/gate/baseline.json
+bun run --cwd packages/senpi-codemode test -- test/gate
+```
+
+The package test script already selects `test/`, so the last command intentionally
+runs the full package suite. For a focused gate-only run, invoke Vitest directly:
+
+```bash
+bun run --cwd packages/senpi-codemode vitest run test/gate
+```
+
+Install and build both the head checkout and a clean checkout of the PR merge
+base with `bun install --ignore-scripts --frozen-lockfile`. Build each target with
+the head harness, `bun packages/senpi-codemode/scripts/gate-build.ts <checkout>`.
+Record the baseline with the **head harness** against that freshly built base
+checkout, not by running an older harness:
+
+```bash
+bun run --cwd packages/senpi-codemode gate --target <base-checkout> \
+  --baseline test/gate/baseline.json --write-baseline
+```
+
+The report is gitignored `gate-report.json` by default (`--report <path>` overrides it).
+`test/gate/allowlist.json` contains reviewed additive changes keyed by plan node;
+it cannot authorize removal or modification of a legacy entry. The test-only
+`SENPI_CODEMODE_GATE_MUTATE=drop-phase` report mutation proves that helper removal
+is rejected. `SENPI_CODEMODE_GATE_MUTATE=leak-kernel` leaves the real kernel
+alive at the teardown witness, then closes it in `finally`; nonzero process,
+worker, socket, handle, subscription and active-resource listener counts fail
+by name. Constructors are observed because Bun's active-handle/report APIs
+return empty arrays even for live workers.
+Live timers are observed independently of the import census, including unref'd
+global timers, named and namespace imports from `node:timers`,
+`node:timers/promises` (including interval iterators and the scheduler), and
+self-rearming `AbortSignal.timeout` polls. Failures name the timer API and its
+creation site. The gate installs delegating wrappers before the kernel graph
+loads; on Bun its module-replacement API also updates builtin ESM bindings.
+These wrappers run only in gate processes and keep the native timer behavior.
+The only production-source additions are an inert gate observer at the existing
+worker, interpreter-process and bridge-server constructors. It is undefined in
+normal execution. This hook is necessary because Bun does not refresh named
+builtin exports when `syncBuiltinESMExports()` runs; patching their default
+exports alone otherwise reports zero resources even for a leaked real kernel.
+
+| Inert hook site | Measured resource | Verification |
+| --- | --- | --- |
+| `src/kernels/js/worker-host.ts` | Worker exit | Real Bun kernel close/leak tests |
+| `src/kernels/py/process.ts` | Python child close | Five-runtime gate and kernel-leak mutation |
+| `src/kernels/shared/subprocess-process.ts` | Ruby/Julia child close | Five-runtime gate and kernel-leak mutation |
+| `src/bridge/http-server.ts` | Server close and accepted sockets | Real Bun bridge close/leak tests |
+
+The gate-only `leak-bridge` mutation leaves the real bridge server open for the
+witness and closes it in `finally`; the real-runtime test must observe an open
+handle. Neither mutation is read by production code.
+
+Legacy scenario identities are compared exactly, so deleting or renaming a
+test cannot make the gate green. Platform-dependent skip outcomes remain
+visible in the report. Driver tests await child close events, with a generous
+hang watchdog; the infinite-loop timeout uses an injected clock after the
+worker announces execution. No deadline tests are excluded from the gate.
+The held-child probe advances the parent clock past all former startup
+deadlines three times before releasing the child's IPC barrier.
+
 ```bash
 cd packages/senpi-codemode
 bun run test

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.1",
+	"version": "2026.10.2",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -16,6 +16,7 @@
 		"LICENSE"
 	],
 	"scripts": {
+		"gate": "bun scripts/gate-eval.ts",
 		"test": "vitest run test/",
 		"clean": "node -e \"\"",
 		"build": "node -e \"\""
@@ -30,14 +31,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.1",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.1"
+		"@code-yeongyu/senpi": "2026.10.2"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.1"
+		"@code-yeongyu/senpi": "2026.10.2"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/http-server.ts

@@ -49,6 +49,7 @@ export async function startBridgeServer(options: BridgeServerOptions): Promise<B
 	const server = createServer((request, response) => {
 		void handleRequest(request, response, token, options);
 	});
+	globalThis.__senpiCodemodeGateObserveResource?.("handles", server, "close");
 	server.on("connection", (socket) => {
 		sockets.add(socket);
 		socket.on("close", () => sockets.delete(socket));

package/src/extension/eval-status-ticker.ts

@@ -1,5 +1,6 @@
 import type { EvalDetachedCellStatusEntry } from "../tool/detached-cell-manager.ts";
 import { formatEvalCellStatus } from "./eval-status.ts";
+import { isStaleExtensionContextError } from "./stale-context.ts";
 
 /** Footer live-elapsed refresh cadence while at least one detached cell is running. */
 export const EVAL_STATUS_TICK_INTERVAL_MS = 1000;
@@ -17,7 +18,8 @@ export interface EvalStatusTickerOptions {
  * Drives a once-per-second footer refresh while detached eval cells are running so
  * the "↗ py · … (Ns)" elapsed label advances live instead of freezing between
  * cell-set transitions. Same shape as the terminal builtin's MonitorStatusTicker:
- * the interval is unref'd, and ticks producing the already-rendered label are skipped.
+ * the interval is unref'd, ticks producing the already-rendered label are skipped, and a
+ * render that hits a retired extension context retires the ticker until the next sync.
  */
 export class EvalStatusTicker {
 	private readonly render: EvalStatusRender;
@@ -43,7 +45,7 @@ export class EvalStatusTicker {
 	sync(entries: readonly EvalDetachedCellStatusEntry[]): void {
 		this.entries = entries;
 		this.hasRendered = false;
-		this.tick();
+		if (!this.tick()) return;
 		if (entries.length === 0) {
 			this.stopInterval();
 			return;
@@ -69,11 +71,24 @@ export class EvalStatusTicker {
 		}
 	}
 
-	private tick(): void {
+	/** Returns false when the render hit a retired context and the ticker retired. */
+	private tick(): boolean {
 		const status = formatEvalCellStatus(this.entries, this.now());
-		if (this.hasRendered && status === this.lastRenderedStatus) return;
+		if (this.hasRendered && status === this.lastRenderedStatus) return true;
 		this.hasRendered = true;
 		this.lastRenderedStatus = status;
-		this.render(status);
+		try {
+			this.render(status);
+		} catch (error) {
+			// A context retired by session replacement or reload throws from inside the
+			// interval callback, where nothing catches it and the process exits. Retire
+			// instead; the next sync() (with a live context) re-arms the ticker.
+			if (isStaleExtensionContextError(error)) {
+				this.stop();
+				return false;
+			}
+			throw error;
+		}
+		return true;
 	}
 }

package/src/extension/runtime-factory.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@code-yeongyu/senpi";
+import { type ExtensionContext, withBundledBunCommands } from "@code-yeongyu/senpi";
 import type { AgentExecuteTool } from "../bridges/agent-bridge.ts";
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
@@ -67,7 +67,7 @@ export async function createRuntime(
 	const executeTool = createExecuteTool(pi, activeTools);
 	const create = options.createSessionManager ?? createCodemodeSessionManager;
 	const sessionId = sessionIdFrom(event);
-	const sessionEnv = sessionEnvironmentFrom(ctx);
+	const sessionEnv = { ...sessionEnvironmentFrom(ctx), ...bundledBunPathEntry() };
 	const configuredPoolWidth = settings.parallelPoolWidth;
 	const parallelPoolWidth = Number.isFinite(configuredPoolWidth) ? Math.max(1, Math.trunc(configuredPoolWidth)) : 1;
 	const manager = await create({
@@ -105,6 +105,17 @@ export function createExecuteTool(pi: CodemodeRuntimeAPI, activeTools?: Readonly
 	});
 }
 
+// In a compiled executable, Bun Shell runs `bun` as this executable unless PATH has one, which booted
+// a second agent from `bun test` in a cell (omo#9362). Kernel children get the same bundled `bun`
+// directory the bash tool's PATH carries.
+function bundledBunPathEntry(): Record<string, string> {
+	const env = withBundledBunCommands(process.env);
+	if (env === process.env) return {};
+	const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path") ?? "PATH";
+	const value = env[pathKey];
+	return value === undefined ? {} : { [pathKey]: value };
+}
+
 function sessionIdFrom(event: unknown): string {
 	if (typeof event === "object" && event !== null && "sessionId" in event && typeof event.sessionId === "string") {
 		return event.sessionId;

package/src/extension/session-cwd.ts

@@ -0,0 +1,35 @@
+import { stat } from "node:fs/promises";
+
+// Only these codes mean the directory is gone or was never one; anything else (EACCES, ELOOP,
+// EMFILE, EIO, ...) is a real failure that reopening the session would not fix, so it surfaces as is.
+const MISSING_DIRECTORY_CODES: ReadonlySet<string> = new Set(["ENOENT", "ENOTDIR"]);
+
+export class CodemodeSessionCwdUnavailableError extends Error {
+	readonly name = "CodemodeSessionCwdUnavailableError";
+	readonly cwd: string;
+
+	constructor(cwd: string, reason: string) {
+		super(
+			`The session working directory ${cwd} is unavailable (${reason}). Eval cells run in the session's project directory; reopen the session on an existing directory.`,
+		);
+		this.cwd = cwd;
+	}
+}
+
+export async function assertSessionCwdAvailable(cwd: string): Promise<void> {
+	let isDirectory: boolean;
+	try {
+		isDirectory = (await stat(cwd)).isDirectory();
+	} catch (error) {
+		if (
+			error instanceof Error &&
+			"code" in error &&
+			typeof error.code === "string" &&
+			MISSING_DIRECTORY_CODES.has(error.code)
+		) {
+			throw new CodemodeSessionCwdUnavailableError(cwd, error.code);
+		}
+		throw error;
+	}
+	if (!isDirectory) throw new CodemodeSessionCwdUnavailableError(cwd, "not a directory");
+}

package/src/extension/session-manager.ts

@@ -16,6 +16,7 @@ import { RubyKernel } from "../kernels/rb/kernel.ts";
 import type { SessionEnvironment } from "../kernels/session-env.ts";
 import { marshalToolResult } from "../tool/image.ts";
 import type { EvalKernel, EvalKernelManager, EvalLanguage, ExecuteTool } from "../tool/types.ts";
+import { assertSessionCwdAvailable } from "./session-cwd.ts";
 
 export interface CodemodeSessionManager extends EvalKernelManager {
 	dispose(): Promise<void>;
@@ -130,7 +131,10 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		// to the current cell, not the one that first created the kernel.
 		this.#onMessageRefs.set(language, onMessage);
 		const existing = this.#kernels.get(language);
-		if (existing) return existing;
+		if (existing) {
+			await assertSessionCwdAvailable(this.#options.cwd);
+			return existing;
+		}
 		const pending = this.#kernelCreations.get(language);
 		if (pending) return await pending;
 		// A bound method, never a closure in this frame: the dispatcher outlives every
@@ -204,12 +208,18 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		onMessage: (message: KernelToHostMessage) => void,
 		generation: number,
 	): Promise<EvalKernel> {
+		await assertSessionCwdAvailable(this.#options.cwd);
 		const kernel = await this.#createKernel(language, onMessage);
 		if (generation !== this.#generation) {
 			await kernel.close();
 			throw new CodemodeSessionDisposedError();
 		}
 		this.#kernels.set(language, kernel);
+		// The directory can vanish while the interpreter starts; every caller sharing this creation
+		// must see that, not only the next one. The kernel stays stored and dispose still closes it.
+		await assertSessionCwdAvailable(this.#options.cwd);
+		// A dispose that started during the check above already owns this stored kernel.
+		if (generation !== this.#generation) throw new CodemodeSessionDisposedError();
 		return kernel;
 	}
 

package/src/extension/stale-context.ts

@@ -0,0 +1,17 @@
+/**
+ * Detection for the error a retired host extension context throws once its session
+ * was replaced (new/fork/switch) or reloaded. Mirrors the host's
+ * `builtin/goal/stale-context.ts`, which stays internal to the host's builtins (the
+ * `@code-yeongyu/senpi` package does not export it). Older hosts also predate the reload
+ * message, so codemode carries both messages locally for compatibility.
+ */
+const STALE_EXTENSION_CONTEXT_ERROR_PREFIX = "This extension ctx is stale after session replacement or reload.";
+const STALE_EXTENSION_GENERATION_AFTER_RELOAD_MESSAGE = "stale extension generation after reload";
+
+export function isStaleExtensionContextError(error: unknown): error is Error {
+	return (
+		error instanceof Error &&
+		(error.message.startsWith(STALE_EXTENSION_CONTEXT_ERROR_PREFIX) ||
+			error.message === STALE_EXTENSION_GENERATION_AFTER_RELOAD_MESSAGE)
+	);
+}

package/src/kernels/AGENTS.md

@@ -36,6 +36,10 @@ runner/prelude assets).
   sees. The JS worker applies it at init (`worker-core.js`; shell capture pins
   the env view under Bun because `delete process.env.X` does not unsetenv),
   and py/rb/jl spawn with it merged into the interpreter environment.
+- Every kernel runs in the session cwd. py/rb/jl spawn there; the JS worker cannot
+  chdir, so `js/worker-cwd.js` applies the cwd to `process.cwd`, `path.resolve`,
+  `fs`, `child_process`, and `Bun.file`/`write`/`$`/`spawn`/`Glob` at init. The
+  session manager rejects a cell whose cwd is missing (`extension/session-cwd.ts`).
 
 ## ANTI-PATTERNS
 

package/src/kernels/js/context-manager.ts

@@ -3,10 +3,11 @@ import { CHILD_LIFECYCLE_OP, INTERRUPT_ACK_OP, MEMORY_COLLECTED_OP } from "../..
 import type { KernelInterruptHandle } from "../../tool/types.ts";
 import { KernelMemoryPolicy } from "../shared/kernel-memory.ts";
 import {
-	abandonedWorkerNote,
 	awaitCooperativeSettlement,
 	DEFAULT_INTERRUPT_BOUNDS,
 	type JavaScriptInterruptBounds,
+	restartedResult,
+	restartOutcome,
 	type WorkerRetirement,
 } from "./interrupt-bounds.ts";
 import {
@@ -27,7 +28,7 @@ import type {
 } from "./kernel-tools-types.ts";
 import { type JavaScriptKernelOptions, LocalModuleLoader } from "./local-module-loader.ts";
 import { terminateProcessTrees } from "./process-tree-host.ts";
-import { JavaScriptRunQueue, type PendingJavaScriptRun, stoppedResult } from "./run-queue.ts";
+import { JavaScriptRunQueue, type PendingJavaScriptRun } from "./run-queue.ts";
 import { bridgeError, WorkerStartupCancelledError } from "./worker-host.ts";
 import { WorkerSlot } from "./worker-slot.ts";
 
@@ -242,11 +243,9 @@ export class JavaScriptKernel {
 			}
 			if (!this.#runs.releaseActive(run)) return { retained: run.settledByWorker };
 			const retirement = await this.#terminate();
-			this.#runs.settle(run, run.interruptResult ?? stoppedResult(run.input.cellId, message));
+			this.#runs.settle(run, restartedResult(run, message));
 			void this.#recover(() => Promise.resolve());
-			return retirement === "abandoned"
-				? { retained: false, note: abandonedWorkerNote(this.#interruptBounds.terminateDeadlineMs) }
-				: { retained: false };
+			return restartOutcome(run, retirement, this.#interruptBounds);
 		} finally {
 			this.#clearToolCalls();
 		}
@@ -283,7 +282,7 @@ export class JavaScriptKernel {
 	#handleMessage(message: KernelToHostMessage): void {
 		if (this.#kernelTools.consume(message) && message.type !== "tool-call") return;
 		if (message.type === "status" && message.event.op === INTERRUPT_ACK_OP) {
-			this.#runs.active?.interruptAck?.resolve();
+			this.#runs.acknowledgeInterrupt(message.event);
 			return;
 		}
 		if (message.type === "status" && message.event.op === CHILD_LIFECYCLE_OP) {

package/src/kernels/js/interrupt-bounds.ts

@@ -1,5 +1,6 @@
+import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { WorkerLike } from "./inline-worker.ts";
-import type { PendingJavaScriptRun } from "./run-queue.ts";
+import { type PendingJavaScriptRun, stoppedResult } from "./run-queue.ts";
 
 /** How long the worker gets to acknowledge `interrupt`; silence means its event loop is blocked in synchronous code. */
 export const INTERRUPT_ACK_MS = 500;
@@ -53,6 +54,37 @@ export function abandonedWorkerNote(deadlineMs = WORKER_TERMINATE_DEADLINE_MS):
 	return `JavaScript worker did not stop within ${deadlineMs}ms: a synchronous call (for example Bun.spawnSync or child_process.spawnSync) is blocking it. A fresh worker replaced it; the blocked call keeps running until it returns.\n`;
 }
 
+const SHELL_RESTART_NOTICE =
+	"JavaScript kernel restarted while waiting on Bun.$; its variables were cleared.\nUse Bun.spawn or the bash tool for commands you may want to stop.";
+
+export function restartedResult(
+	run: PendingJavaScriptRun,
+	message: string,
+): Extract<KernelToHostMessage, { type: "result" }> {
+	const result = run.interruptResult ?? stoppedResult(run.input.cellId, message);
+	if (!run.shellWaitActive || result.ok) return result;
+	return {
+		...result,
+		error: {
+			...result.error,
+			code: "js_shell_interrupt_restart",
+			message: `${result.error.message}\n${SHELL_RESTART_NOTICE}`,
+		},
+	};
+}
+
+export function restartOutcome(
+	run: PendingJavaScriptRun,
+	retirement: WorkerRetirement,
+	bounds: JavaScriptInterruptBounds,
+): { readonly retained: false; readonly note?: string } {
+	const notes = [
+		...(run.shellWaitActive ? [SHELL_RESTART_NOTICE] : []),
+		...(retirement === "abandoned" ? [abandonedWorkerNote(bounds.terminateDeadlineMs)] : []),
+	];
+	return { retained: false, ...(notes.length === 0 ? {} : { note: notes.join("\n") }) };
+}
+
 async function raceDeadline<T extends string, Fallback extends string>(
 	operation: Promise<T>,
 	deadlineMs: number,

package/src/kernels/js/run-queue.ts

@@ -1,4 +1,4 @@
-import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { EvalStatusEvent, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { JavaScriptRunInput } from "./kernel-contract.ts";
 
 type ResultMessage = Extract<KernelToHostMessage, { type: "result" }>;
@@ -14,6 +14,7 @@ export interface PendingJavaScriptRun {
 	interruptResult: ResultMessage | null;
 	interruptAck: PromiseWithResolvers<void> | null;
 	settledByWorker: boolean;
+	shellWaitActive: boolean;
 }
 
 export class JavaScriptRunQueue {
@@ -40,6 +41,7 @@ export class JavaScriptRunQueue {
 			interruptResult: null,
 			interruptAck: null,
 			settledByWorker: false,
+			shellWaitActive: false,
 		});
 		return promise;
 	}
@@ -53,6 +55,13 @@ export class JavaScriptRunQueue {
 		return next;
 	}
 
+	acknowledgeInterrupt(event: EvalStatusEvent): void {
+		const active = this.#active;
+		if (!active || event.cellId !== active.input.cellId) return;
+		active.shellWaitActive = event.shellWaitActive === true;
+		active.interruptAck?.resolve();
+	}
+
 	remove(cellId: string, reason = "interrupted"): boolean {
 		const index = this.#queue.findIndex((run) => run.input.cellId === cellId);
 		if (index < 0) return false;

package/src/kernels/js/worker-core.js

@@ -2,6 +2,7 @@ import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 import { createKernelToolPump } from "./kernel-tools-pump.js";
 import { hostDeniedError, hostToolRefusal } from "./kernel-tools-scope.js";
+import { installSessionCwd } from "./worker-cwd.js";
 import { createWorkerMemory } from "./worker-memory.js";
 import { JsWorkerRuntime } from "./worker-runtime.js";
 import { installKernelWebView } from "./worker-webview.js";
@@ -91,7 +92,7 @@ export function createWorkerCore(transport, options) {
 
 	function interruptCell(reason) {
 		if (!activeCell || !runtime) return;
-		emit({ type: "status", event: { op: INTERRUPT_ACK_OP, cellId: activeCell.cellId } });
+		acknowledgeInterrupt();
 		const interruption = cellInterruptedError(reason);
 		activeCell.interruption = interruption;
 		for (const [callId, pending] of pendingTools) {
@@ -102,6 +103,11 @@ export function createWorkerCore(transport, options) {
 		runtime.interrupt();
 	}
 
+	function acknowledgeInterrupt() {
+		if (!activeCell || !runtime) return;
+		emit({ type: "status", event: { op: INTERRUPT_ACK_OP, cellId: activeCell.cellId, shellWaitActive: runtime.shellWaitActive } });
+	}
+
 	function onMessage(message) {
 		if (message.type === "run" || message.type === "interrupt" || message.type === "close") memory?.cancelIdle();
 		if (kernelTools.handle(message)) return;
@@ -118,6 +124,7 @@ export function createWorkerCore(transport, options) {
 		}
 		if (message.type === "init") {
 			applySessionEnvironment(message.sessionEnv);
+			installSessionCwd(options.cwd);
 			installKernelWebView(requestWebViewPort);
 			runtime = new JsWorkerRuntime({
 				cwd: options.cwd,
@@ -128,6 +135,9 @@ export function createWorkerCore(transport, options) {
 				hostToolNames: message.hostToolNames ?? [],
 				foreignLanguageNames: message.foreignLanguageNames ?? [],
 				onChildEvent: (event) => emit({ type: "status", event: { op: CHILD_LIFECYCLE_OP, ...event } }),
+				onShellWaitChange: () => {
+					if (activeCell?.interruption) acknowledgeInterrupt();
+				},
 			});
 			if (message.memory) {
 				memory = createWorkerMemory(message.memory, (report) => emit({ type: "status", event: { op: MEMORY_COLLECTED_OP, ...report } }));