@code-yeongyu/senpi-codemode 2026.10.10-10 → 2026.10.10-12

package/src/kernels/js/windows-tree-kill-host.ts

@@ -0,0 +1,117 @@
+import { execFile } from "node:child_process";
+
+// Host-side twin of windows-tree-kill.js (the worker imports that one; .ts files may not import .js). `taskkill /T`
+// adopts every process whose recorded ParentProcessId equals the root's pid, and Windows never rewrites that
+// field when a parent exits and reuses pids (senpi#2999). The tree is computed from one process listing instead: a process
+// belongs to it only when it started at or after the parent it names, and each pid is killed by name.
+
+const LISTING_TIMEOUT_MS = 5_000;
+const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+
+const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
+$created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
+"{0} {1} {2} {3}" -f $_.ProcessId, $_.ParentProcessId, $created, $_.Name }`;
+
+const PROTECTED_IMAGES = new Set([
+	"system",
+	"smss.exe",
+	"csrss.exe",
+	"wininit.exe",
+	"winlogon.exe",
+	"services.exe",
+	"lsass.exe",
+	"lsaiso.exe",
+	"svchost.exe",
+]);
+
+export interface WindowsProcessRow {
+	readonly pid: number;
+	readonly parentPid: number;
+	readonly createdAt: bigint;
+	readonly name: string;
+}
+
+export function parseWindowsRows(stdout: string): WindowsProcessRow[] {
+	const rows: WindowsProcessRow[] = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const [pidText, parentText, createdText, ...nameParts] = line.trim().split(/\s+/u);
+		const pid = Number(pidText);
+		const parentPid = Number(parentText);
+		if (!Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !/^\d+$/u.test(createdText ?? ""))
+			continue;
+		rows.push({ pid, parentPid, createdAt: BigInt(createdText ?? "0"), name: nameParts.join(" ") });
+	}
+	return rows;
+}
+
+/** The root and its genuine descendants; any protected image or ancestor of `selfPid` in it shrinks the kill to the root. */
+export function windowsTreeKillPids(rows: readonly WindowsProcessRow[], rootPid: number, selfPid: number): number[] {
+	const byPid = new Map(rows.map((row) => [row.pid, row]));
+	if (!byPid.has(rootPid)) return [];
+	const tree = new Set<number>([rootPid]);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const row of rows) {
+			if (tree.has(row.pid) || !tree.has(row.parentPid)) continue;
+			const parent = byPid.get(row.parentPid);
+			if (parent === undefined || row.createdAt < parent.createdAt) continue;
+			tree.add(row.pid);
+			grew = true;
+		}
+	}
+	const ancestors = new Set<number>([selfPid]);
+	for (let current = byPid.get(selfPid); current !== undefined; ) {
+		const parent = byPid.get(current.parentPid);
+		if (parent === undefined || ancestors.has(parent.pid) || parent.createdAt > current.createdAt) break;
+		ancestors.add(parent.pid);
+		current = parent;
+	}
+	const refused = [...tree].some(
+		(pid) => PROTECTED_IMAGES.has((byPid.get(pid)?.name ?? "").toLowerCase()) || ancestors.has(pid),
+	);
+	if (!refused) return [...tree];
+	const rootRefused = PROTECTED_IMAGES.has((byPid.get(rootPid)?.name ?? "").toLowerCase()) || ancestors.has(rootPid);
+	return rootRefused ? [] : [rootPid];
+}
+
+/** `taskkill` arguments: the checked tree pid by pid, or `/T` on the root when no listing could be read. */
+export function windowsTreeKillArgs(
+	rootPid: number,
+	rows: readonly WindowsProcessRow[] | undefined,
+	selfPid: number = process.pid,
+): string[] {
+	if (rows === undefined) return ["/F", "/T", "/PID", String(rootPid)];
+	const pids = windowsTreeKillPids(rows, rootPid, selfPid);
+	if (pids.length === 0) return [];
+	return ["/F", ...pids.flatMap((pid) => ["/PID", String(pid)])];
+}
+
+export function listWindowsRows(): Promise<WindowsProcessRow[] | undefined> {
+	return new Promise((resolve) => {
+		execFile(
+			"powershell.exe",
+			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
+			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
+			(error, stdout) => {
+				const rows = error ? [] : parseWindowsRows(String(stdout ?? ""));
+				resolve(rows.length > 0 ? rows : undefined);
+			},
+		);
+	});
+}
+
+/**
+ * Kills the checked process tree rooted at `pid`; resolves once taskkill has run (or nothing needed killing).
+ * A batch passes one shared `listing` so every tree is planned from the same snapshot.
+ */
+export async function killWindowsTree(
+	pid: number,
+	listing: Promise<readonly WindowsProcessRow[] | undefined> = listWindowsRows(),
+): Promise<void> {
+	const args = windowsTreeKillArgs(pid, await listing);
+	if (args.length === 0) return;
+	await new Promise<void>((resolve) => {
+		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+	});
+}

package/src/kernels/js/windows-tree-kill.d.ts

@@ -0,0 +1,19 @@
+export interface WindowsProcessRow {
+	readonly pid: number;
+	readonly parentPid: number;
+	readonly createdAt: bigint;
+	readonly name: string;
+}
+
+export function parseWindowsRows(stdout: string): WindowsProcessRow[];
+export function windowsTreeKillPids(rows: readonly WindowsProcessRow[], rootPid: number, selfPid: number): number[];
+export function windowsTreeKillArgs(
+	rootPid: number,
+	rows: readonly WindowsProcessRow[] | undefined,
+	selfPid?: number,
+): string[];
+export function listWindowsRows(): Promise<WindowsProcessRow[] | undefined>;
+export function killWindowsTree(
+	pid: number,
+	listing?: Promise<readonly WindowsProcessRow[] | undefined>,
+): Promise<void>;

package/src/kernels/js/windows-tree-kill.js

@@ -0,0 +1,100 @@
+import { execFile } from "node:child_process";
+
+// Plain JS (with windows-tree-kill.d.ts) because the worker runtime imports it. `taskkill /T`
+// adopts every process whose recorded ParentProcessId equals the root's pid, and Windows never rewrites that
+// field when a parent exits and reuses pids (senpi#2999). The tree is computed from one process listing instead: a process
+// belongs to it only when it started at or after the parent it names, and each pid is killed by name.
+
+const LISTING_TIMEOUT_MS = 5_000;
+const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+
+const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
+$created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
+"{0} {1} {2} {3}" -f $_.ProcessId, $_.ParentProcessId, $created, $_.Name }`;
+
+const PROTECTED_IMAGES = new Set([
+	"system",
+	"smss.exe",
+	"csrss.exe",
+	"wininit.exe",
+	"winlogon.exe",
+	"services.exe",
+	"lsass.exe",
+	"lsaiso.exe",
+	"svchost.exe",
+]);
+
+export function parseWindowsRows(stdout) {
+	const rows = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const [pidText, parentText, createdText, ...nameParts] = line.trim().split(/\s+/u);
+		const pid = Number(pidText);
+		const parentPid = Number(parentText);
+		if (!Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !/^\d+$/u.test(createdText ?? "")) continue;
+		rows.push({ pid, parentPid, createdAt: BigInt(createdText ?? "0"), name: nameParts.join(" ") });
+	}
+	return rows;
+}
+
+/** The root and its genuine descendants; any protected image or ancestor of `selfPid` in it shrinks the kill to the root. */
+export function windowsTreeKillPids(rows, rootPid, selfPid) {
+	const byPid = new Map(rows.map((row) => [row.pid, row]));
+	if (!byPid.has(rootPid)) return [];
+	const tree = new Set([rootPid]);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const row of rows) {
+			if (tree.has(row.pid) || !tree.has(row.parentPid)) continue;
+			const parent = byPid.get(row.parentPid);
+			if (parent === undefined || row.createdAt < parent.createdAt) continue;
+			tree.add(row.pid);
+			grew = true;
+		}
+	}
+	const ancestors = new Set([selfPid]);
+	for (let current = byPid.get(selfPid); current !== undefined; ) {
+		const parent = byPid.get(current.parentPid);
+		if (parent === undefined || ancestors.has(parent.pid) || parent.createdAt > current.createdAt) break;
+		ancestors.add(parent.pid);
+		current = parent;
+	}
+	const refused = [...tree].some((pid) => PROTECTED_IMAGES.has((byPid.get(pid)?.name ?? "").toLowerCase()) || ancestors.has(pid));
+	if (!refused) return [...tree];
+	const rootRefused = PROTECTED_IMAGES.has(byPid.get(rootPid).name.toLowerCase()) || ancestors.has(rootPid);
+	return rootRefused ? [] : [rootPid];
+}
+
+/** `taskkill` arguments: the checked tree pid by pid, or `/T` on the root when no listing could be read. */
+export function windowsTreeKillArgs(rootPid, rows, selfPid = process.pid) {
+	if (rows === undefined) return ["/F", "/T", "/PID", String(rootPid)];
+	const pids = windowsTreeKillPids(rows, rootPid, selfPid);
+	if (pids.length === 0) return [];
+	return ["/F", ...pids.flatMap((pid) => ["/PID", String(pid)])];
+}
+
+export function listWindowsRows() {
+	return new Promise((resolve) => {
+		execFile(
+			"powershell.exe",
+			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
+			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
+			(error, stdout) => {
+				const rows = error ? [] : parseWindowsRows(String(stdout ?? ""));
+				resolve(rows.length > 0 ? rows : undefined);
+			},
+		);
+	});
+}
+
+/**
+ * Kills the checked process tree rooted at `pid`; resolves once taskkill has run (or nothing needed killing).
+ * A batch passes one shared `listing` so every tree is planned from the same snapshot.
+ */
+export async function killWindowsTree(pid, listing = listWindowsRows()) {
+	const args = windowsTreeKillArgs(pid, await listing);
+	if (args.length === 0) return;
+	await new Promise((resolve) => {
+		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+	});
+}

package/src/kernels/js/worker-cwd.js

@@ -51,6 +51,7 @@ const FS_PATH_ARGS = {
 
 const CHILD_PROCESS_FILE_ARGS = ["spawn", "spawnSync", "execFile", "execFileSync", "fork"];
 const CHILD_PROCESS_COMMAND_ARGS = ["exec", "execSync"];
+const ASYNC_GROUP_SPAWNERS = new Set(["spawn", "fork"]);
 
 export function installSessionCwd(cwd, options) {
 	// A process-mode kernel child IS the main thread; the worker guard relaxes only for that entry.
@@ -95,7 +96,9 @@ function patchFs(fs, promises, at, root) {
 function patchChildProcess(childProcess, at, root) {
 	for (const name of CHILD_PROCESS_FILE_ARGS) {
 		replace(childProcess, name, (fn) => {
-			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root);
+			// Only asynchronous spawners start a new group: a synchronous call keeps the terminal (ssh/sudo/git prompts),
+			// and Bun ignores `detached` for execFile. Those calls get a notice instead (group-signal-notice.js).
+			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root, ASYNC_GROUP_SPAWNERS.has(name));
 			return name === "fork" ? resolvingArgs(withCwd, [0], at) : withCwd;
 		});
 	}
@@ -107,7 +110,7 @@ function patchBun(bun, at, root) {
 	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
-	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root));
+	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root, false));
 	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
 	const glob = bun.Glob?.prototype;
 	if (glob) {
@@ -149,32 +152,60 @@ function fileOptionsIndex(args) {
 	return Array.isArray(args[1]) || (args[1] == null && args.length > 2) ? 2 : 1;
 }
 
-function withOptionsCwd(fn, optionsIndex, root) {
+function withOptionsCwd(fn, optionsIndex, root, inOwnGroup = false) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function withSessionCwd(...args) {
 		const index = optionsIndex(args);
 		const options = args[index];
-		if (options === undefined || options === null) args[index] = { cwd: root };
-		else if (typeof options === "function") args.splice(index, 0, { cwd: root });
-		else if (typeof options === "object") args[index] = { ...options, cwd: cwdFrom(options.cwd, root) };
-		return fn.apply(this, args);
+		if (options === undefined || options === null) args[index] = group({ cwd: root });
+		else if (typeof options === "function") args.splice(index, 0, group({ cwd: root }));
+		else if (typeof options === "object") args[index] = group({ ...options, cwd: cwdFrom(options.cwd, root) });
+		if (!inOwnGroup || process.platform === "win32" || (isPlainOptions(options) && options.detached !== undefined)) {
+			return fn.apply(this, args);
+		}
+		// Bun's child_process spawns through Bun.spawn, whose child tracking skips `detached` children as ones the
+		// cell keeps on purpose. While this call runs, `detached` is ours, so the child is still retired with the cell.
+		const depth = globalThis[INJECTED_GROUP] ?? 0;
+		globalThis[INJECTED_GROUP] = depth + 1;
+		try {
+			return fn.apply(this, args);
+		} finally {
+			globalThis[INJECTED_GROUP] = depth;
+		}
 	};
 }
 
-function withBunSpawnCwd(fn, root) {
+function withBunSpawnCwd(fn, root, inOwnGroup = true) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function spawnInSessionCwd(...args) {
 		const [first, second] = args;
 		if (Array.isArray(first)) {
 			const options = second === undefined || second === null ? {} : second;
 			if (typeof options !== "object") return fn.apply(this, args);
-			return fn.call(this, first, { ...options, cwd: cwdFrom(options.cwd, root) }, ...args.slice(2));
+			return fn.call(this, first, group({ ...options, cwd: cwdFrom(options.cwd, root) }), ...args.slice(2));
 		}
 		if (first !== null && typeof first === "object") {
-			return fn.call(this, { ...first, cwd: cwdFrom(first.cwd, root) }, ...args.slice(1));
+			return fn.call(this, group({ ...first, cwd: cwdFrom(first.cwd, root) }), ...args.slice(1));
 		}
 		return fn.apply(this, args);
 	};
 }
 
+// senpi#2995: a JS kernel runs inside the agent process, so a child spawned from a cell would join the agent's
+// process group, and a cell that later signals that group (`kill -TERM -- -$PGID`) stops the agent itself. On
+// POSIX every cell child starts its own group instead; kernel teardown still retires it by pid and descendants.
+// A cell that sets `detached` itself keeps its choice. Windows is left alone: there `detached` opens a console.
+export const INJECTED_GROUP = Symbol.for("senpi.kernel.injectedProcessGroup");
+
+function isPlainOptions(value) {
+	return value !== null && typeof value === "object";
+}
+
+function ownGroup(options) {
+	if (process.platform === "win32" || options.detached !== undefined) return options;
+	return { ...options, detached: true };
+}
+
 function globScanOptions(options, root) {
 	if (options === undefined || options === null) return { cwd: root };
 	if (typeof options === "string") return cwdFrom(options, root);

package/src/kernels/js/worker-runtime.js

@@ -5,8 +5,9 @@ import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
 import { inspect } from "node:util";
 import { encodeDisplayImage, resolveDisplayOps } from "./display-image.js";
-import { terminateProcessTrees } from "./process-tree.js";
+import { terminateProcessGroups, terminateProcessTrees } from "./process-tree.js";
 import { awaitMaybePromise, indirectEval, wrapUserCode } from "./worker-indirect-eval.js";
+import { INJECTED_GROUP } from "./worker-cwd.js";
 import { installShellCapture } from "./worker-shell-capture.js";
 import { bindKernelBun } from "./worker-webview.js";
 import { createWorkpool } from "./workpool.js";
@@ -33,6 +34,9 @@ export class JsWorkerRuntime {
 	#hooks = null;
 	#pendingDisplays = [];
 	#children = new Set();
+	// Groups the worker created for cell children (senpi#2995). A group outlives its leader, so a grandchild re-parented
+	// to init is still found through it at retirement (senpi#3020).
+	#ownedGroups = new Map();
 	#childrenStopping;
 	#shellWaits = new Set();
 	#onChildEvent;
@@ -111,9 +115,14 @@ export class JsWorkerRuntime {
 	#trackChild(child, spawnOptions) {
 		if (child === null || typeof child !== "object" || typeof child.kill !== "function") return;
 		// `detached: true` is the cell saying it wants the process to outlive it.
-		if (isPlainObject(spawnOptions) && spawnOptions.detached === true) return;
+		const groupInjected = (globalThis[INJECTED_GROUP] ?? 0) > 0;
+		if (isPlainObject(spawnOptions) && spawnOptions.detached === true && !groupInjected) return;
 		this.#children.add(child);
 		const pid = Number.isInteger(child.pid) && child.pid > 0 ? child.pid : null;
+		// Bun.spawn children get their group from worker-cwd.js without the injection marker, so every tracked child is
+		// recorded; a child that is not a group leader names no group, and signalling it later finds nothing.
+		const ownGroupLeader = !(isPlainObject(spawnOptions) && spawnOptions.detached === false);
+		if (pid !== null && process.platform !== "win32" && ownGroupLeader) this.#ownedGroups.set(pid, child);
 		// The host keeps its own copy of live pids: if this worker is terminated
 		// while blocked, only the host can still retire them.
 		if (pid !== null) this.#onChildEvent?.({ pid, state: "spawned" });
@@ -127,10 +136,20 @@ export class JsWorkerRuntime {
 	#terminateChildren() {
 		const children = [...this.#children].filter(child => child.exitCode === null && child.signalCode === null);
 		this.#children.clear();
-		if (children.length === 0) return undefined;
+		// A leader that already exited leaves its group id reserved only while the group has members; if that pid now
+		// names a live process, it was reused by someone else and the group is not ours to signal (senpi#3020 review).
+		const groups = [...this.#ownedGroups].map(([pgid, child]) => ({
+			pgid,
+			leaderExited: child.exitCode !== null || child.signalCode !== null,
+		}));
+		this.#ownedGroups.clear();
+		if (children.length === 0 && groups.length === 0) return undefined;
 		const roots = children.map(child => child.pid).filter(pid => Number.isInteger(pid) && pid > 0);
 		const settled = Promise.allSettled(children.map(child => (child.exited instanceof Promise ? child.exited : Promise.resolve())));
-		return terminateProcessTrees(roots, { graceMs: CHILD_TERMINATION_GRACE_MS, settled });
+		return Promise.all([
+			roots.length > 0 ? terminateProcessTrees(roots, { graceMs: CHILD_TERMINATION_GRACE_MS, settled }) : undefined,
+			terminateProcessGroups(groups, { graceMs: CHILD_TERMINATION_GRACE_MS }),
+		]);
 	}
 
 	async #drainPendingDisplays() {

package/src/kernels/js/worker-shell-capture.js

@@ -1,4 +1,5 @@
 import { assertCellLive } from "./cell-run-context.js";
+import { groupSignalNotice, noticeChildProcessGroupSignals, shellCommandText, signalsProcessGroup } from "./group-signal-notice.js";
 
 const SHELL_CONFIG_METHODS = ["env", "cwd", "nothrow", "throws"];
 const SHELL_READ_METHODS = ["text", "json", "lines", "arrayBuffer", "bytes", "blob"];
@@ -28,7 +29,9 @@ export function installShellCapture(options) {
 	bun.$ = capturedShell(originalShell, options);
 	bun.spawn = capturedSpawn(originalSpawn, options, pinEnv);
 	if (originalSpawnSync !== null) bun.spawnSync = capturedSpawnSync(originalSpawnSync, pinEnv);
+	const restoreChildProcessNotice = noticeChildProcessGroupSignals(options.emitText, options.isActive);
 	return () => {
+		restoreChildProcessNotice();
 		bun.$ = originalShell;
 		bun.spawn = originalSpawn;
 		if (originalSpawnSync !== null) bun.spawnSync = originalSpawnSync;
@@ -43,6 +46,7 @@ function capturedShell(originalShell, options) {
 	const shell = (strings, ...expressions) => {
 		assertCellLive();
 		if (!options.isActive()) return originalShell(strings, ...expressions);
+		if (signalsProcessGroup(shellCommandText(strings, expressions))) options.emitText("stderr", groupSignalNotice("Bun.$"));
 		const promise = originalShell(isolateStdin(strings), ...expressions);
 		return captureShellPromise(promise, options);
 	};

package/src/kernels/js/worker-slot.ts

@@ -4,7 +4,6 @@ import type { WorkerLike } from "./inline-worker.ts";
 import { retireWorker, type WorkerRetirement } from "./interrupt-bounds.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
 import type { JavaScriptKernelOptions } from "./local-module-loader.ts";
-import type { JavaScriptProcessWorker } from "./process-worker.ts";
 import { KernelWebViewClients } from "./webview-host.ts";
 import { WorkerStartupCancelledError } from "./worker-host.ts";
 import { startWorkerWithInlineFallback } from "./worker-startup.ts";
@@ -38,7 +37,7 @@ export class WorkerSlot {
 
 	get processPid(): number | undefined {
 		const worker = this.#worker;
-		if (worker?.mode === "process") return (worker as JavaScriptProcessWorker).pid;
+		if (worker?.mode === "process") return worker.pid;
 		return this.#lastProcessPid;
 	}
 
@@ -113,7 +112,7 @@ export class WorkerSlot {
 	#publish(worker: WorkerLike, generation: number): void {
 		if (!this.#listeners.isOpen() || generation !== this.#generation) throw new WorkerStartupCancelledError();
 		this.#worker = worker;
-		if (worker.mode === "process") this.#lastProcessPid = (worker as JavaScriptProcessWorker).pid;
+		if (worker.mode === "process") this.#lastProcessPid = worker.pid;
 		const webViews = new KernelWebViewClients((message, transfer) => worker.postMessage(message, transfer));
 		this.#webViews = webViews;
 		worker.onMessage((message) => {

package/src/kernels/py/prelude.py

@@ -661,25 +661,6 @@ class ThreadRoutedStream(io.TextIOBase):
         )
         self.cell_target: io.StringIO | None = None
 
-    @contextlib.contextmanager
-    def capture(self, buffer: io.StringIO, *, cell: bool) -> Iterator[None]:
-        me = threading.get_ident()
-        previous = self._targets.get(me)
-        self._targets[me] = buffer
-        inherited = self._inherited.set(buffer)
-        if cell:
-            self.cell_target = buffer
-        try:
-            yield
-        finally:
-            self._inherited.reset(inherited)
-            if previous is None:
-                self._targets.pop(me, None)
-            else:
-                self._targets[me] = previous
-            if cell:
-                self.cell_target = None
-
     def write(self, text: str) -> int:
         target = self._targets.get(threading.get_ident()) or self._inherited.get() or self.cell_target
         if target is None:
@@ -694,6 +675,38 @@ class ThreadRoutedStream(io.TextIOBase):
         return None
 
 
+@contextlib.contextmanager
+def capture_streams(
+    streams: tuple[ThreadRoutedStream, ThreadRoutedStream],
+    buffers: tuple[io.StringIO, io.StringIO],
+    *,
+    cell: bool,
+) -> Iterator[None]:
+    stdout, stderr = streams
+    out, err = buffers
+    me = threading.get_ident()
+    previous_out, previous_err = stdout._targets.get(me), stderr._targets.get(me)
+    stdout._targets[me], stderr._targets[me] = out, err
+    inherited_out, inherited_err = stdout._inherited.set(out), stderr._inherited.set(err)
+    if cell:
+        stdout.cell_target, stderr.cell_target = out, err
+    try:
+        yield
+    finally:
+        stderr._inherited.reset(inherited_err)
+        stdout._inherited.reset(inherited_out)
+        if previous_err is None:
+            stderr._targets.pop(me, None)
+        else:
+            stderr._targets[me] = previous_err
+        if previous_out is None:
+            stdout._targets.pop(me, None)
+        else:
+            stdout._targets[me] = previous_out
+        if cell:
+            stdout.cell_target, stderr.cell_target = None, None
+
+
 @dataclass
 class _Entry:
     name: str
@@ -905,8 +918,7 @@ class KernelToolRunner:
                 if invocation.cancelled.is_set():
                     raise Cancelled(CANCELLED_BEFORE_START)
                 CURRENT.set(invocation)
-                stdout, stderr = self._streams
-                with stdout.capture(output, cell=False), stderr.capture(output, cell=False):
+                with capture_streams(self._streams, (output, output), cell=False):
                     value = self._call(invocation, entry.fn, args)
             finally:
                 CURRENT.set(None)
@@ -2218,8 +2230,7 @@ def run_cell(
     cell_scope = CURRENT_CELL_TOKEN.set(cell_token)
     try:
         KERNEL_TOOL_TOKEN.acquire()
-        cell_stdout, cell_stderr = KERNEL_TOOL_STREAMS
-        with cell_stdout.capture(stdout, cell=True), cell_stderr.capture(stderr, cell=True):
+        with capture_streams(KERNEL_TOOL_STREAMS, (stdout, stderr), cell=True):
             apply_preludes(preludes)
             leave_source_file = _enter_source_file(source_file)
             body, expression = compile_cell(code, source_file or "<cell>")
@@ -2373,7 +2384,7 @@ def _start_parent_watch() -> None:
         ).start()
 
 
-def _read_control(commands: queue.Queue[tuple[str, Any]]) -> None:
+def _read_control(commands: queue.SimpleQueue[tuple[str, Any]]) -> None:
     # Kernel-tool frames are served here, so a callback can be admitted while the main thread is inside a cell.
     for raw in sys.stdin:
         try:
@@ -2392,7 +2403,7 @@ def main() -> None:
     signal.signal(signal.SIGINT, signal.SIG_IGN)
     _start_parent_watch()
     sys.stdout, sys.stderr = KERNEL_TOOL_STREAMS
-    commands: queue.Queue[tuple[str, Any]] = queue.Queue()
+    commands: queue.SimpleQueue[tuple[str, Any]] = queue.SimpleQueue()
     threading.Thread(target=_read_control, args=(commands,), name="senpi-control-reader", daemon=True).start()
     host_closed = False
     while True:

package/src/kernels/py/transport.ts

@@ -244,6 +244,10 @@ export class PythonKernelTransport {
 		this.#child.stderr.on("data", onStderr);
 		this.#child.on("error", onError);
 		this.#child.on("exit", onExit);
+		// senpi#3016: a frame written while the interpreter is dying fails on the stdin stream (EPIPE), not on the child.
+		// #onError already ignores it once the child has exited or the transport is inactive, and the listener is never
+		// detached, so a late write failure is never unhandled.
+		this.#child.stdin.on("error", onError);
 		const { sessionId, connection, memory, kernelGeneration } = this.#options;
 		this.#write({
 			type: "init",

package/src/kernels/rb/runner.rb

@@ -9,6 +9,7 @@ $stdout.flush
 $__senpi_binding = TOPLEVEL_BINDING
 $__senpi_frame_mutex = Mutex.new
 $__senpi_current_cell = nil
+$__senpi_memory_cell = nil
 $__senpi_capture_cell = nil
 $__senpi_connection = nil
 $__senpi_frame_io = STDOUT.dup
@@ -123,8 +124,6 @@ rescue JSON::GeneratorError
   value.inspect
 end
 
-$__senpi_memory = nil
-
 SENPI_SIZER_SAMPLE = 1_000
 SENPI_SIZER_NODE_BUDGET = 5_000
 SENPI_SIZER_MAX_DEPTH = 64
@@ -239,19 +238,6 @@ rescue StandardError
   []
 end
 
-# The host reads the interpreter's footprint and decides on the notice; the runner only names its
-# largest globals. Nothing here spawns a process, so the user's `$?` is left alone.
-def __senpi_memory_report
-  return nil if $__senpi_memory.nil?
-  named = __senpi_largest_globals(5)
-  # The host replaces liveBytes with the interpreter footprint it reads itself; only globals is used.
-  report = { "liveBytes" => 0, "measure" => "footprint" }
-  report["globals"] = named unless named.empty?
-  report
-rescue StandardError
-  nil
-end
-
 SENPI_NON_DISPLAY_NODES = %i[
   LASGN IASGN GASGN CVASGN DASGN OP_ASGN OP_CDECL CDECL MASGN CASGN
   DEFN DEFS CLASS MODULE SCLASS ALIAS UNDEF
@@ -305,8 +291,6 @@ def __senpi_run_cell(message)
       "durationMs" => ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round,
     }
     frame["valueRepr"] = __senpi_value_repr(value) if !value.nil? && __senpi_should_display_result?(source)
-    memory = __senpi_memory_report
-    frame["memory"] = memory unless memory.nil?
     __senpi_emit(frame)
   rescue Exception => error
     __senpi_emit({
@@ -319,6 +303,7 @@ def __senpi_run_cell(message)
   ensure
     $__senpi_capture_cell = nil
     $__senpi_current_cell = nil
+    $__senpi_memory_cell = cell_id
   end
 end
 
@@ -332,10 +317,15 @@ $__senpi_protocol_stdin.each_line do |line|
   when "init"
     __senpi_emit({ "type" => "status", "event" => { "op" => "kernel-startup", "stage" => "host-init" } })
     $__senpi_connection = message["connection"]
-    $__senpi_memory = message["memory"]
-    __senpi_emit({ "type" => "ready" })
+    __senpi_emit({ "type" => "ready", "memoryGlobals" => true })
   when "run"
+    $__senpi_memory_cell = nil
     __senpi_run_cell(message)
+  when "memory-globals"
+    if message["cellId"] == $__senpi_memory_cell && $__senpi_current_cell.nil?
+      __senpi_emit({ "type" => "memory-globals-result", "cellId" => message["cellId"], "globals" => __senpi_largest_globals(5) })
+      $__senpi_memory_cell = nil
+    end
   when "close"
     __senpi_emit({ "type" => "closed" })
     exit 0

package/src/kernels/sandbox/vendor/pi-codemode/runtime/host.ts

@@ -115,7 +115,7 @@ class Execution {
 	private finished = false;
 	// senpi-change begin: output streaming
 	private readonly stream: StreamOptions | undefined;
-	private readonly credits: Int32Array | undefined;
+	private readonly credits: Int32Array<SharedArrayBuffer> | undefined;
 	private frameChain: Promise<void> = Promise.resolve();
 	private frames = 0;
 	private inFlightBytes = 0;
@@ -188,7 +188,7 @@ class Execution {
 			// senpi-change begin: output streaming and builtin policy
 			...(this.credits === undefined || this.stream === undefined
 				? {}
-				: { stream: { credits: this.credits.buffer as SharedArrayBuffer, frameBytes: this.stream.frameBytes } }),
+				: { stream: { credits: this.credits.buffer, frameBytes: this.stream.frameBytes } }),
 			storePolicy: options.storePolicy,
 			// senpi-change end
 		};