@code-yeongyu/senpi-codemode 2026.10.10-10 → 2026.10.10-11

package/CHANGELOG.md

@@ -12,6 +12,38 @@
 
 ### Removed
 
+## [2026.10.10-11] - 2026-10-09
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+- Replaced the plan-authored type assertions the F2 audit listed, in this package's production code and tests, with real types: `EvalKernel` now declares the optional `describeKernelTools` / `invokeKernelTool` capabilities, the JS `WorkerLike` carries an optional `pid`, `bun:ffi` is read through one shared `isBunFfi` guard, the sandbox `credits` buffer is typed as `Int32Array<SharedArrayBuffer>`, the gate allowlist is validated by the existing typebox `allowlistSchema`, and test fakes use `satisfies`, typed factories and narrowing guards instead of casts. No behavior change, except that a malformed base allowlist is now refused by the same schema the head allowlist already required. ([#3005](https://github.com/code-yeongyu/senpi/issues/3005))
+- The bench judges `crash-queue-100` on Ruby and Julia by an absolute head budget instead of the head/base ratio: all 100 queued cells must run exactly once after one kernel replacement, with the head's median wall time under 820 ms (Ruby) or 2,700 ms (Julia). Their base never recovered from the crash, so the ratio compared a failure path with the real work. ([#3025](https://github.com/code-yeongyu/senpi/issues/3025))
+- A streaming, queued or running eval row now shows the cell's code in a fixed-height block that scrolls upward as lines arrive: the newest line always stays visible, older lines fold into an "N earlier code lines" row counted inside the block, and once output or status events arrive they share the block's rows instead of growing it, so the row never grows the transcript at any terminal width. The header stays one row, keeping the live spinner and render-clock elapsed time (a queued cell keeps its queued badge). Once a cell finishes, errs or is cancelled, the collapsed row is one line (icon, summary, status and duration), and expanding it shows the full code, output and status events. ([#2933](https://github.com/code-yeongyu/senpi/issues/2933))
+
+### Fixed
+
+- Python cells use a C-backed FIFO and one combined stdout/stderr routing scope, reducing per-cell bookkeeping while retaining interpreter ownership, parked-cell callbacks, invocation scope, cancellation, and stale-descriptor fencing ([#3034](https://github.com/code-yeongyu/senpi/issues/3034)).
+
+- Ruby and Julia cells below the host-read memory notice threshold and ceiling no longer walk all globals or serialize an unused memory payload. Above either threshold, successful and raised cells both collect the same bounded globals diagnostic, including when hysteresis suppresses the notice text. Stopping while a finished cell waits for that optional diagnostic now settles its completed result without globals and keeps kernel state. Current-footprint accounting and ceiling enforcement still run on every cell ([#3028](https://github.com/code-yeongyu/senpi/issues/3028)).
+
+- Warm eval cells now recheck the session working directory synchronously instead of awaiting a filesystem thread-pool round trip. Every cell still refuses a deleted or non-directory cwd with the same error, and other filesystem errors still surface; kernel startup retains its asynchronous pre/post checks ([#3033](https://github.com/code-yeongyu/senpi/issues/3033)).
+
+- When a Python, Ruby, Julia or process-isolated JavaScript kernel dies while a frame is being sent to it, the failed write (EPIPE) is reported as that kernel's error instead of surfacing as an unhandled error. Before, that unhandled error could end the host, or make a test run where every test passed exit 1 ([#3016](https://github.com/code-yeongyu/senpi/issues/3016)).
+
+- On macOS and Linux, when a JavaScript eval cell ends or is interrupted, a process its child started and left behind (re-parented to init after the child exited, as with `(sleep 30 &)`) is now stopped too: every process group the kernel gave a cell child is signalled at retirement. The agent's own group is never signalled, nor a group whose leader exited and whose pid was since reused, and children the cell started with `detached: true` are left running ([#3020](https://github.com/code-yeongyu/senpi/issues/3020)).
+
+- On Windows, ending a kernel's process tree (cell timeout, reset, shutdown) no longer uses `taskkill /T`: the tree is computed from creation times and each process is ended by pid, so an older, unrelated process holding a recycled parent pid is never killed ([#2999](https://github.com/code-yeongyu/senpi/issues/2999)).
+
+- `tool_schema("eval:environments")` now documents the `packages.install(manager, requirements, {timeout?})` cell helper that shipped in #2877: the signature (Python spells the option `timeout=`, default 600 s), the managers per language (`pip` for Python; `bun`/`npm` for JavaScript), the receipt fields, cancellation by `stop`, and the `environment_install_timeout` error code it raises. A two-way contract test now keeps every `environment_*`/`eval_isolate_*` code the source raises documented in its owning entry. ([#3003](https://github.com/code-yeongyu/senpi/issues/3003))
+
+- On macOS and Linux, a process started from a JavaScript eval cell with `node:child_process` or `Bun.spawn` now gets its own process group. A cell that later stops that job by its group (`kill -TERM -- -$PGID`) therefore no longer stops the agent itself. Named imports of `node:child_process`, `node:fs` and `node:path` in a cell now get the session cwd handling too. `Bun.$`, `exec`/`execFile` and the synchronous spawners (`spawnSync`, `execSync`, `execFileSync`, `Bun.spawnSync`, which keep the terminal) still share the agent's group, so a command there that signals a process group (including `pkill -g` and `killall`) prints a notice naming the agent's group. The notice is a warning only and never blocks the cell ([#2995](https://github.com/code-yeongyu/senpi/issues/2995)).
+
+### Removed
+
 ## [2026.10.10-10] - 2026-10-09
 
 ### Breaking Changes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.10-10",
+	"version": "2026.10.10-11",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -33,15 +33,15 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-10",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-11",
 		"quickjs-wasi": "3.6.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.10-10"
+		"@code-yeongyu/senpi": "2026.10.10-11"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.10-10"
+		"@code-yeongyu/senpi": "2026.10.10-11"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/memory-protocol.ts

@@ -24,7 +24,7 @@ export const kernelMemoryReportSchema = Type.Object({
 	approximate: Type.Optional(Type.Boolean()),
 	/** `liveBytes` was measured right after a full collection in this cell. */
 	gcRan: Type.Optional(Type.Boolean()),
-	/** Largest user globals, measured only when live memory after collection reached the notice threshold. */
+	/** Largest user globals, measured after collection or on demand when the host footprint reaches a threshold. */
 	globals: Type.Optional(Type.Array(kernelMemoryGlobalSchema, { maxItems: 8 })),
 	/** Host-set: live memory after collection reached the ceiling; the kernel restarts once its queue drains. */
 	overCeiling: Type.Optional(Type.Boolean()),
@@ -37,6 +37,8 @@ export const kernelMemoryReportSchema = Type.Object({
 /** On-demand heap reading between cells (JS kernels): no cell runs and no collection is forced. */
 export const kernelMemoryQueryHostToKernelSchemas = [
 	Type.Object({ type: Type.Literal("memory-query"), requestId: Type.String({ minLength: 1 }) }),
+	/** Ruby/Julia only: bounded, read-only globals sizing before the owning cell settles. */
+	Type.Object({ type: Type.Literal("memory-globals"), cellId: Type.String({ minLength: 1 }) }),
 ] as const;
 
 export const kernelMemoryQueryKernelToHostSchemas = [
@@ -46,6 +48,11 @@ export const kernelMemoryQueryKernelToHostSchemas = [
 		liveBytes: Type.Integer({ minimum: 0 }),
 		measure: Type.Literal("heap"),
 	}),
+	Type.Object({
+		type: Type.Literal("memory-globals-result"),
+		cellId: Type.String({ minLength: 1 }),
+		globals: Type.Array(kernelMemoryGlobalSchema, { maxItems: 8 }),
+	}),
 ] as const;
 
 export type KernelMemoryThresholds = Static<typeof kernelMemoryThresholdsSchema>;

package/src/bridge/protocol.ts

@@ -101,7 +101,7 @@ const hostToKernelMessageSchema = Type.Union([
 const kernelStateSchema = Type.Union([Type.Literal("lost"), Type.Literal("restarted"), Type.Literal("not-run")]);
 
 const kernelToHostMessageSchema = Type.Union([
-	Type.Object({ type: Type.Literal("ready") }),
+	Type.Object({ type: Type.Literal("ready"), memoryGlobals: Type.Optional(Type.Boolean()) }),
 	Type.Object({ type: Type.Literal("init-failed"), error: bridgeErrorSchema }),
 	Type.Object({
 		type: Type.Literal("text"),

package/src/bridges/eval-environment-schemas.ts

@@ -16,7 +16,8 @@ export const environmentsEntry: NamedEvalSchema = {
 		"py and js: %environment managed | project selects where installs go. managed (the default) uses per-session revisions under the session's artifacts directory (or environments.managedRoot) and never touches project files; project installs into the session directory (py: .senpi/python-packages; js: the project root).",
 		"py and js: %load <file> runs a local file as a cell, read when its turn comes in the queue, with the file's name in tracebacks; definitions persist like any cell. It accepts a path relative to the session directory, local:// or file://, reads files up to 8 MiB and never fetches remote URLs.",
 		"Installs pause the run budget like a bridge call, stream the installer's output into the cell, detach past the foreground window like any cell, and are stopped by stop.",
-		"Install failures are cell errors that start with their code: environment_install_failed (a bad argument or an installer failure, with the installer's stderr tail), environment_install_cancelled (stopped before or during the install), environment_installer_unavailable (no interpreter or no pip; no JavaScript package environment in this session; neither bun nor npm on PATH, or the chosen one missing; the installer failed to start; or installs turned off with environments.autoProvision: false), environment_resolution_conflict (py: pip reported a dependency conflict). A %load failure, and a magic refused because more code follows it, are plain cell errors without a code.",
+		'js and py: packages.install(manager, requirements, {timeout?}) runs the same install as a call instead of a magic: manager "pip" in a Python cell, "bun" or "npm" in a JavaScript cell; requirements is a non-empty string or a non-empty list of non-empty strings, and timeout is a positive number of seconds (default 600; py spells it packages.install("pip", [...], timeout=...)). pip receives the requirement list as separate arguments, never re-split; a js package spec cannot contain whitespace. It drives the same session environment the magic uses, returns that install\'s receipt (py: manager, mode, root, revision, requested, resolved, changed; js: installer, mode, revision, added, shadowed) and is cancelled by stop like a magic install. Unlike the magic, the installer\'s output is not streamed into the cell: the receipt is the result, and a failure carries the installer\'s stderr tail.',
+		"Install failures are cell errors that start with their code: environment_install_failed (an argument the host rejects: an unknown manager, an empty requirement list, a bun/npm requirement with whitespace or a non-positive timeout; or an installer failure, with the installer's stderr tail. A JS options value that is not an object, or a Python timeout that float() cannot convert, fails earlier in the cell with a plain TypeError or ValueError), environment_install_timeout (a packages.install() still running after its timeout, default 600 s, was stopped), environment_install_cancelled (stopped before or during the install), environment_installer_unavailable (no interpreter or no pip; no JavaScript package environment in this session; neither bun nor npm on PATH, or the chosen one missing; the installer failed to start; installs turned off with environments.autoProvision: false; or pip asked of a session with no Python interpreter, or bun/npm asked of a Python cell), environment_resolution_conflict (py: pip reported a dependency conflict). A %load failure, and a magic refused because more code follows it, are plain cell errors without a code.",
 	].join("\n"),
 	parameters: {
 		type: "object",
@@ -26,6 +27,9 @@ export const environmentsEntry: NamedEvalSchema = {
 			"%npm": { description: "js: %npm add <packages ...>" },
 			"%environment": { enum: ["managed", "project"] },
 			"%load": { description: "py and js: %load <path | local://... | file://...>" },
+			"packages.install": {
+				description: "js and py: packages.install(manager, requirements, {timeout?}) (py: timeout=...)",
+			},
 		},
 	},
 };

package/src/environments/editable-check.ts

@@ -60,7 +60,7 @@ async function refuseOutsideLinks(root: string, dir: string): Promise<void> {
 export async function assertInstalledInRevision(stdout: string, staging: string): Promise<void> {
 	const line = stdout.split("\n").find((entry) => entry.startsWith("Successfully installed "));
 	if (line === undefined) return;
-	const present = new Set((await readdir(staging).catch(() => [] as string[])).flatMap(installedName));
+	const present = new Set((await readdir(staging).catch((): string[] => [])).flatMap(installedName));
 	for (const token of line.slice("Successfully installed ".length).trim().split(/\s+/u)) {
 		const name = token.slice(0, token.lastIndexOf("-"));
 		if (!present.has(canonicalName(name))) {

package/src/extension/session-cwd.ts

@@ -1,3 +1,4 @@
+import { statSync } from "node:fs";
 import { stat } from "node:fs/promises";
 
 // Only these codes mean the directory is gone or was never one; anything else (EACCES, ELOOP,
@@ -21,15 +22,30 @@ export async function assertSessionCwdAvailable(cwd: string): Promise<void> {
 	try {
 		isDirectory = (await stat(cwd)).isDirectory();
 	} catch (error) {
-		if (
-			error instanceof Error &&
-			"code" in error &&
-			typeof error.code === "string" &&
-			MISSING_DIRECTORY_CODES.has(error.code)
-		) {
-			throw new CodemodeSessionCwdUnavailableError(cwd, error.code);
-		}
-		throw error;
+		throw sessionCwdStatError(cwd, error);
 	}
 	if (!isDirectory) throw new CodemodeSessionCwdUnavailableError(cwd, "not a directory");
 }
+
+/** Warm reuse checks every cell without a filesystem thread-pool round trip. */
+export function assertSessionCwdAvailableSync(cwd: string): void {
+	let isDirectory: boolean;
+	try {
+		isDirectory = statSync(cwd).isDirectory();
+	} catch (error) {
+		throw sessionCwdStatError(cwd, error);
+	}
+	if (!isDirectory) throw new CodemodeSessionCwdUnavailableError(cwd, "not a directory");
+}
+
+function sessionCwdStatError(cwd: string, error: unknown): unknown {
+	if (
+		error instanceof Error &&
+		"code" in error &&
+		typeof error.code === "string" &&
+		MISSING_DIRECTORY_CODES.has(error.code)
+	) {
+		return new CodemodeSessionCwdUnavailableError(cwd, error.code);
+	}
+	return error;
+}

package/src/extension/session-manager.ts

@@ -24,7 +24,7 @@ import {
 } from "./kernel-registration.ts";
 import type { RegisteredKernelSource } from "./kernel-registry.ts";
 import { ReplaceableKernel } from "./kernel-replacement.ts";
-import { assertSessionCwdAvailable } from "./session-cwd.ts";
+import { assertSessionCwdAvailable, assertSessionCwdAvailableSync } from "./session-cwd.ts";
 import type {
 	BridgeEndpoint,
 	CodemodeSessionManager,
@@ -114,7 +114,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		this.#onMessageRefs.set(language, onMessage);
 		const existing = this.#kernels.get(language);
 		if (existing) {
-			await assertSessionCwdAvailable(this.#options.cwd);
+			assertSessionCwdAvailableSync(this.#options.cwd);
 			return existing;
 		}
 		const pending = this.#kernelCreations.get(language);
@@ -311,8 +311,8 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 	/** Only an already running JavaScript kernel can define a colliding name; none is started for this. */
 	#javaScriptKernelToolsDescribe(names: readonly string[]): Promise<KernelToolsDescribeResult> | undefined {
 		const js = this.#kernels.get("js");
-		if (!js || !("describeKernelTools" in js) || typeof js.describeKernelTools !== "function") return undefined;
-		return (js.describeKernelTools as (names: readonly string[]) => Promise<KernelToolsDescribeResult>)(names);
+		if (!js || typeof js.describeKernelTools !== "function") return undefined;
+		return js.describeKernelTools(names);
 	}
 
 	#foreignKernelToolNames(): string[] {

package/src/kernels/jl/runner.jl

@@ -16,6 +16,7 @@ include("prelude.jl")
 const senpi_connection = Dict{String, Any}()
 const senpi_write_lock = ReentrantLock()
 global senpi_current_cell = nothing
+global senpi_memory_cell = nothing
 
 function senpi_escape(text::AbstractString)
     out = IOBuffer()
@@ -290,9 +291,7 @@ function senpi_set_connection(value)
     end
 end
 
-const senpi_memory = Ref{Any}(nothing)
-
-const SENPI_MEMORY_INTERNALS = Set([:senpi_current_cell, :senpi_memory, :senpi_connection, :senpi_frame_io, :senpi_stdout_capture, :senpi_stderr_capture, :senpi_protocol_stdin])
+const SENPI_MEMORY_INTERNALS = Set([:senpi_current_cell, :senpi_connection, :senpi_frame_io, :senpi_stdout_capture, :senpi_stderr_capture, :senpi_protocol_stdin])
 
 const SENPI_SIZER_SAMPLE = 1_000
 const SENPI_SIZER_NODE_BUDGET = 5_000
@@ -421,21 +420,6 @@ function senpi_largest_globals(limit::Int)
     end
 end
 
-function senpi_memory_report()
-    try
-        senpi_memory[] === nothing && return nothing
-        # The host reads the interpreter's current footprint and decides on the notice; the runner only
-        # names its largest globals, with a bounded walk, so a cell never pays for an unbounded scan.
-        named = senpi_largest_globals(5)
-        # The host replaces liveBytes with the interpreter footprint it reads itself; only globals is used.
-        report = Dict{String, Any}("liveBytes" => 0, "measure" => "footprint")
-        isempty(named) || (report["globals"] = named)
-        report
-    catch
-        nothing
-    end
-end
-
 function senpi_run_cell(message)
     cell_id = string(get(message, "cellId", ""))
     code = string(get(message, "code", ""))
@@ -452,13 +436,12 @@ function senpi_run_cell(message)
         yield()
         frame = Dict{String, Any}("type" => "result", "cellId" => cell_id, "ok" => true, "durationMs" => round(Int, (time() - started) * 1000))
         value !== nothing && senpi_should_display_result(parsed) && (frame["valueRepr"] = senpi_json(value))
-        memory = senpi_memory_report()
-        memory !== nothing && (frame["memory"] = memory)
         senpi_emit(frame)
     catch error
         senpi_emit(Dict("type" => "result", "cellId" => cell_id, "ok" => false, "error" => senpi_error(error), "durationMs" => round(Int, (time() - started) * 1000)))
     finally
         global senpi_current_cell = nothing
+        global senpi_memory_cell = cell_id
     end
 end
 
@@ -472,10 +455,16 @@ while !eof(SENPI_ORIGINAL_STDIN)
         if kind == "init"
             senpi_emit(Dict("type" => "status", "event" => Dict("op" => "kernel-startup", "stage" => "host-init")))
             senpi_set_connection(get(message, "connection", nothing))
-            senpi_memory[] = get(message, "memory", nothing)
-            senpi_emit(Dict("type" => "ready"))
+            senpi_emit(Dict("type" => "ready", "memoryGlobals" => true))
         elseif kind == "run"
+            global senpi_memory_cell = nothing
             senpi_run_cell(message)
+        elseif kind == "memory-globals"
+            cell_id = get(message, "cellId", nothing)
+            if cell_id == senpi_memory_cell && senpi_current_cell === nothing
+                senpi_emit(Dict("type" => "memory-globals-result", "cellId" => cell_id, "globals" => senpi_largest_globals(5)))
+                global senpi_memory_cell = nothing
+            end
         elseif kind == "close"
             senpi_emit(Dict("type" => "closed"))
             break

package/src/kernels/js/group-signal-notice.js

@@ -0,0 +1,117 @@
+// senpi#2995: Bun.$, node:child_process exec/execFile and the synchronous spawners leave their children in the
+// agent's process group (Bun.$ has no such option, Bun ignores `detached` for exec/execFile, and a synchronous call
+// keeps the terminal), so a group-wide signal from the same cell stops the agent. Such a command gets a notice; the
+// notice only warns and never fails the cell.
+
+// A command starts a (possibly indented) line, follows `;`, `|`, `&`, `(`, a backtick, `{`, `!`, a shell keyword
+// (`then`, `do`, `else`) or a runner (`nohup`, `time`, `xargs`, `env`, `exec`, `sudo` with flags), or opens a `-c '...'` script; a
+// `kill` word anywhere else (`git log --grep kill`, `echo kill ...`) is text.
+const COMMAND_POSITION = String.raw`(?:^\s*|[;|&(\x60]\s*|\b(?:then|do|else|nohup|time|xargs|env|exec)\s+|[{!]\s+|\bsudo(?:\s+-\S+)*\s+|\s-[A-Za-z]*c\s+['"]\s*)`;
+
+// A group target is a dash argument after the signal options: a number, `$var`, `${var}` or `$(...)`.
+const GROUP_TARGET = String.raw`-(?:\d+|\$\$|\$\{?\w+\}?|\$\()`;
+const SIGNAL_OPTION = String.raw`(?:-s\s+\w+|-n\s+\d+|-[A-Za-z]+\d*|-\d+)`;
+// The first dash argument is a signal, so a group is one after `--`, after a signal option, or after a plain pid:
+// `kill -- -<pgid>`, `kill -SIG -<pgid>`, `kill -TERM 1234 -5678`, `kill -- -$$`.
+const PID = String.raw`[^\s\-;|&][^\s;|&]*`;
+const KILL_GROUP = new RegExp(
+	String.raw`${COMMAND_POSITION}kill\b(?:` +
+		String.raw`\s+--\s+${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})+(?:\s+${PID})*\s+(?:--\s+)?${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})*(?:\s+${PID})+\s+${GROUP_TARGET})`,
+	"mu",
+);
+const PKILL_GROUP = new RegExp(String.raw`${COMMAND_POSITION}pkill\b[^\n;|&]*\s(?:-g\d*|--pgroup)\b`, "mu");
+// `killall` in command position (also after `sudo` or as a `-c` script) signals every process with that name, which
+// can include the agent's own (bun, node, senpi). Inside an `echo` string it is only text.
+const KILLALL = new RegExp(String.raw`${COMMAND_POSITION}killall\s`, "mu");
+
+export const GROUP_SIGNAL_NOTICE_TAG = "[senpi:group-signal]";
+
+export function signalsProcessGroup(commandText) {
+	return KILL_GROUP.test(commandText) || PKILL_GROUP.test(commandText) || KILLALL.test(commandText);
+}
+
+export function groupSignalNotice(api, readGroup = agentProcessGroup) {
+	const pgid = readGroup();
+	const group = pgid === undefined ? "the agent's process group" : `the agent's process group (${pgid})`;
+	return (
+		`${GROUP_SIGNAL_NOTICE_TAG} This command signals a process group. Children of ${api} share ${group}, so ` +
+		"signalling that group can stop this session. Start background jobs with Bun.spawn or child_process.spawn, " +
+		"which give them their own group, or signal them by pid.\n"
+	);
+}
+
+let cachedGroup;
+
+// A bounded `ps` lookup, kept once it succeeds; a missing `ps` or a failed run only drops the number from this notice.
+export function agentProcessGroup(spawnSync = globalThis.Bun?.spawnSync) {
+	if (cachedGroup !== undefined) return cachedGroup;
+	let text = "";
+	try {
+		const result = spawnSync?.(["ps", "-o", "pgid=", "-p", String(process.pid)], { timeout: 2_000 });
+		text = result?.success ? String(result.stdout).trim() : "";
+	} catch {
+		text = "";
+	}
+	if (!/^\d+$/u.test(text)) return undefined;
+	cachedGroup = text;
+	return cachedGroup;
+}
+
+export function shellCommandText(strings, expressions) {
+	if (!Array.isArray(strings)) return String(strings ?? "");
+	return strings.reduce((text, part, index) => text + part + (index < expressions.length ? String(expressions[index]) : ""), "");
+}
+
+const { promisify } = process.getBuiltinModule("node:util");
+const SCANNED_SPAWNERS = ["exec", "execFile", "execSync", "execFileSync", "spawnSync"];
+
+function commandTextOf(name, args) {
+	if (name === "exec" || name === "execSync") return String(args[0]);
+	return [args[0], ...(Array.isArray(args[1]) ? args[1] : [])].join(" ");
+}
+
+export function noticeChildProcessGroupSignals(emitText, isActive) {
+	const childProcess = process.getBuiltinModule("node:child_process");
+	const originals = new Map();
+	for (const name of SCANNED_SPAWNERS) {
+		const original = childProcess[name];
+		if (typeof original !== "function") continue;
+		originals.set(name, original);
+		const scan = (args) => {
+			try {
+				if (isActive() && signalsProcessGroup(commandTextOf(name, args))) {
+					emitText("stderr", groupSignalNotice(`child_process.${name}`));
+				}
+			} catch {
+				// The notice is advisory; the call itself always runs.
+			}
+		};
+		const scanned = function scannedSpawner(...args) {
+			scan(args);
+			return original.apply(this, args);
+		};
+		// Every own property, symbols included: `util.promisify.custom` is what makes promisify(exec) resolve to
+		// { stdout, stderr }. That custom function calls the original directly, so it is scanned too.
+		for (const key of Reflect.ownKeys(original)) {
+			if (key === "length" || key === "name" || key === "prototype" || key === promisify.custom) continue;
+			const descriptor = Object.getOwnPropertyDescriptor(original, key);
+			if (descriptor) Object.defineProperty(scanned, key, descriptor);
+		}
+		const customPromisify = original[promisify.custom];
+		if (typeof customPromisify === "function") {
+			Object.defineProperty(scanned, promisify.custom, {
+				configurable: true,
+				value: function scannedPromisified(...args) {
+					scan(args);
+					return customPromisify.apply(this, args);
+				},
+			});
+		}
+		childProcess[name] = scanned;
+	}
+	return () => {
+		for (const [name, original] of originals) childProcess[name] = original;
+	};
+}

package/src/kernels/js/inline-worker.ts

@@ -19,6 +19,8 @@ export function resolveInlineWorkerEntryUrl(options: JavaScriptInlineWorkerEntry
 
 export interface WorkerLike {
 	readonly mode: JavaScriptKernelMode;
+	/** The child pid when `mode` is `"process"`; the slot reports it for orphan accounting after a crash. */
+	readonly pid?: number;
 	postMessage(message: HostToKernelMessage, transfer?: readonly MessagePort[]): void;
 	onMessage(handler: (message: KernelToHostMessage) => void): () => void;
 	onError(handler: (error: Error) => void): () => void;

package/src/kernels/js/local-module-loader.ts

@@ -79,6 +79,14 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"  const specifier = String(source);",
 		"  const kernelBun = globalThis[Symbol.for('senpi.kernel.bun')];",
 		"  if (specifier === 'bun' && kernelBun) return { ...(await import('bun')), WebView: kernelBun.WebView, default: kernelBun };",
+		// Under Bun a cell's named import (`import { spawn } from 'node:child_process'`) binds the builtin's original
+		// export even after the worker patched the module object (worker-cwd.js), so the session cwd and the cell
+		// children's own process group (senpi#2995) were skipped. The patched module objects are served instead.
+		"  const patched = /^(?:node:)?(child_process|fs|fs\\/promises|path)$/.exec(specifier);",
+		"  if (patched && typeof process.getBuiltinModule === 'function') {",
+		"    const builtin = process.getBuiltinModule('node:' + patched[1]);",
+		"    if (builtin) return { ...builtin, default: builtin };",
+		"  }",
 		"  const match = /^([a-z][a-z0-9+.-]*):\\/\\/(.*)$/i.exec(specifier);",
 		"  let target = specifier;",
 		"  if (match) {",

package/src/kernels/js/process-tree-host.ts

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { killWindowsTree, listWindowsRows } from "./windows-tree-kill-host.ts";
 
 // Host-side twin of worker-runtime's `process-tree.js`. The worker file must stay plain
 // JavaScript (a Node worker thread spawned from a `.js` entry has no TypeScript loader), and
@@ -100,7 +101,7 @@ function sleep(ms: number): Promise<void> {
 /**
  * Retire whole process trees: snapshot the descendants first (a parent that dies before the
  * snapshot would reparent them to init), SIGTERM everything, wait `graceMs` for the pids to
- * disappear, then SIGKILL whatever is left. On Windows `taskkill /T /F` does the walk and the kill.
+ * disappear, then SIGKILL whatever is left. On Windows the checked tree is killed by pid (`windows-tree-kill.js`).
  */
 export async function terminateProcessTrees(
 	roots: readonly number[],
@@ -109,7 +110,8 @@ export async function terminateProcessTrees(
 	const liveRoots = roots.filter(isProcessAlive);
 	if (liveRoots.length === 0) return;
 	if (process.platform === "win32") {
-		for (const pid of liveRoots) await taskkillTree(pid);
+		const listing = listWindowsRows();
+		for (const pid of liveRoots) await killWindowsTree(pid, listing);
 		return;
 	}
 	const table = await readProcessTable();
@@ -150,9 +152,3 @@ async function withoutZombies(pids: number[]): Promise<number[]> {
 	}
 	return pids.filter((pid) => !zombies.has(pid));
 }
-
-function taskkillTree(pid: number): Promise<void> {
-	return new Promise((resolve) => {
-		execFile("taskkill", ["/T", "/F", "/PID", String(pid)], { windowsHide: true }, () => resolve());
-	});
-}

package/src/kernels/js/process-tree.d.ts

@@ -22,3 +22,14 @@ export function collectDescendants(table: ProcessTable, roots: readonly number[]
 export function ownedRoots(table: ProcessTable, parentPid: number, roots: readonly number[]): number[];
 
 export function terminateProcessTrees(roots: readonly number[], options: TerminateProcessTreesOptions): Promise<void>;
+export interface CellProcessGroup {
+	readonly pgid: number;
+	readonly leaderExited: boolean;
+}
+export interface TerminateProcessGroupsOptions {
+	readonly graceMs: number;
+}
+export function terminateProcessGroups(
+	groups: readonly CellProcessGroup[],
+	options: TerminateProcessGroupsOptions,
+): Promise<void>;

package/src/kernels/js/process-tree.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { killWindowsTree, listWindowsRows } from "./windows-tree-kill.js";
 
 // Plain JS (with process-tree.d.ts) because the worker runtime imports it and
 // worker files cannot import TypeScript; the host imports the same module so a
@@ -6,6 +7,8 @@ import { execFile } from "node:child_process";
 
 const PS_MAX_BUFFER = 16 * 1024 * 1024;
 const EXIT_POLL_MS = 25;
+// A hung `ps` must not hold a cell's retirement; empty output then means nothing is signalled.
+const PS_LOOKUP_TIMEOUT_MS = 2_000;
 const ZOMBIE_CHECK_INTERVAL_MS = 250;
 
 export function isProcessAlive(pid) {
@@ -30,7 +33,7 @@ export function signalProcess(pid, signal) {
 
 /**
  * Parent-to-children map of every process visible to `ps`. Windows has no
- * `ps`; callers there kill through `taskkill /T`, which walks the tree itself.
+ * `ps`; callers there kill the checked tree from `windows-tree-kill.js`.
  */
 export async function readProcessTable() {
 	if (process.platform === "win32") return new Map();
@@ -78,13 +81,14 @@ function sleep(ms) {
  * Retire whole process trees: snapshot the descendants first (a parent that
  * dies before the snapshot would reparent them to init), SIGTERM everything,
  * wait `graceMs` for `settled` (or for the pids to disappear), then SIGKILL
- * whatever is left. On Windows `taskkill /T /F` does the walk and the kill.
+ * whatever is left. On Windows the checked tree is killed by pid (`windows-tree-kill.js`).
  */
 export async function terminateProcessTrees(roots, options) {
 	const liveRoots = roots.filter(isProcessAlive);
 	if (liveRoots.length === 0) return;
 	if (process.platform === "win32") {
-		for (const pid of liveRoots) await taskkillTree(pid);
+		const listing = listWindowsRows();
+		for (const pid of liveRoots) await killWindowsTree(pid, listing);
 		return;
 	}
 	const table = await readProcessTable();
@@ -98,6 +102,52 @@ export async function terminateProcessTrees(roots, options) {
 	await waitForExit(survivors, options.killWaitMs ?? options.graceMs, options.settled);
 }
 
+/**
+ * Retire whole process groups the worker created (POSIX): SIGTERM each group that still has members, wait `graceMs`,
+ * then SIGKILL what is left. A group whose leader already exited is skipped while a live process holds the leader's
+ * pid, since that pid was reused. The agent's own group is never signalled.
+ */
+export async function terminateProcessGroups(groups, options) {
+	if (process.platform === "win32") return;
+	const ours = (group) => groupHasMembers(group.pgid) && !(group.leaderExited && isProcessAlive(group.pgid));
+	const candidates = groups.filter((group) => Number.isInteger(group.pgid) && group.pgid > 1 && ours(group));
+	if (candidates.length === 0) return;
+	// Without the agent's own group there is no way to rule it out, so nothing is signalled.
+	const ownGroup = await processGroupOf(process.pid);
+	if (ownGroup === undefined) return;
+	const live = candidates.filter((group) => group.pgid !== ownGroup && ours(group));
+	for (const group of live) signalGroup(group.pgid, "SIGTERM");
+	const deadline = Date.now() + options.graceMs;
+	let remaining = live;
+	while (remaining.length > 0 && Date.now() < deadline) {
+		await sleep(EXIT_POLL_MS);
+		remaining = remaining.filter(ours);
+	}
+	for (const group of remaining) signalGroup(group.pgid, "SIGKILL");
+}
+
+function groupHasMembers(pgid) {
+	try {
+		process.kill(-pgid, 0);
+		return true;
+	} catch (error) {
+		return isRecord(error) && error.code === "EPERM";
+	}
+}
+
+function signalGroup(pgid, signal) {
+	try {
+		process.kill(-pgid, signal);
+	} catch {
+		// The group emptied between the check and the signal.
+	}
+}
+
+async function processGroupOf(pid) {
+	const text = (await ps(["-o", "pgid=", "-p", String(pid)], { timeout: PS_LOOKUP_TIMEOUT_MS })).trim();
+	return /^\d+$/u.test(text) ? Number(text) : undefined;
+}
+
 // `kill(pid, 0)` still succeeds for a zombie, and a child whose owning worker is
 // blocked or gone is never reaped, so liveness also consults `ps` state.
 async function waitForExit(pids, graceMs, settled) {
@@ -132,19 +182,14 @@ async function withoutZombies(pids) {
 }
 
 // `ps -p` exits non-zero when any listed pid is gone but still prints the rest.
-function ps(args) {
+function ps(args, options = {}) {
 	return new Promise((resolve) => {
-		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true }, (_error, output) =>
+		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
 			resolve(typeof output === "string" ? output : String(output ?? "")),
 		);
 	});
 }
 
-function taskkillTree(pid) {
-	return new Promise((resolve) => {
-		execFile("taskkill", ["/T", "/F", "/PID", String(pid)], { windowsHide: true }, () => resolve());
-	});
-}
 
 function isRecord(value) {
 	return typeof value === "object" && value !== null;