@code-yeongyu/senpi-codemode 2026.10.10-4 → 2026.10.10-6

package/CHANGELOG.md

@@ -6,10 +6,54 @@
 
 ### Added
 
+- `tool_schema("eval:environments")` and `tool_schema("eval:isolation")` document the package magics (`%pip`, `%bun`/`%npm`, `%environment`, `%load`) and isolated cells on demand, with the error codes each one raises. Nothing is added to the eval prompt or its input schema.
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.10.10-6] - 2026-10-07
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.10.10-5] - 2026-10-07
+
+### Breaking Changes
+
+### Added
+
 ### Changed
 
+- A running, queued or detached eval row now leads with the cell's summary (or its first code line), then the language, state and elapsed time, on one line; the code is shown on expand. A call still streaming its arguments shows that row instead of the raw `eval code="..."` fallback. Completed rows are unchanged ([#2802](https://github.com/code-yeongyu/senpi/issues/2802)).
+
+- A JavaScript cell may declare a name the kernel or platform already defines (`log`, `fetch`, `print`, `URL`, ...): the value persists for your later cells while the kernel and imported libraries keep the original, `delete <name>` restores it, and the cell notes the shadowing ([#2793](https://github.com/code-yeongyu/senpi/issues/2793)).
+
 ### Fixed
 
+- A live eval row whose cell has no summary skips a first code line that holds only escape or control characters and leads with the next line that has content, instead of showing only an ellipsis ([#2850](https://github.com/code-yeongyu/senpi/issues/2850)).
+
+- The `require` in a JavaScript cell carries `require.resolve`, `require.resolve.paths` and `require.cache` like Node's own `require`, and the call and `resolve` share one lookup, so they always name the same copy: builtins natively (including Bun's, such as `bun:sqlite`), then the project, then the managed package environment ([#2832](https://github.com/code-yeongyu/senpi/issues/2832)).
+
+- A live eval row whose cell has no summary sanitizes its first code line before measuring it, so escape and control characters in that line never reach the one-line row ([#2839](https://github.com/code-yeongyu/senpi/issues/2839)).
+
+- A live eval row stays one line in every terminal: its headline is measured and cut in screen cells, so a summary with wide characters (Korean, Chinese, Japanese, emoji) no longer wraps a narrow terminal, and a `peek`/`stop` call still streaming in renders `eval peek` instead of `eval peek undefined` ([#2831](https://github.com/code-yeongyu/senpi/issues/2831)).
+
+- Stopping or timing out a JavaScript cell that awaits something that never settles (a promise, a `fetch` whose server never answers, a polling loop on timers, `Bun.sleep` or `node:timers/promises`, a loop of short `Bun.spawn` children) now keeps the worker and every global instead of restarting it. Stop ends the cell and everything it started: its timers are cleared, pending sleeps and `fetch` requests reject, and the sockets, servers, WebSockets, WebViews, nested workers and child processes it opened are closed; the result arrives once its children are gone. A stopped cell's own `catch`/`finally` can no longer print, call tools, start processes, schedule timers or open connections. An unhandled promise rejection no longer crashes the JavaScript kernel: it is reported on the running or next cell, naming the cell it came from, with bursts folded into one line; an uncaught exception still restarts the worker. A cell stopped during a `Bun.$` command still restarts the worker, as before ([#2788](https://github.com/code-yeongyu/senpi/issues/2788)).
+
+- JavaScript cells can call `require(...)` and `createRequire(...)`: builtins, relative CommonJS and JSON files, and packages from the project or the managed package environment resolve as they do for `import` ([#2792](https://github.com/code-yeongyu/senpi/issues/2792)).
+
+- A detached eval cell's completion notification now carries the same output its result would have shown in the foreground (head, tail, elision marker and full-output notice) instead of a 512-byte tail, and images the cell displayed are delivered with the notification ([#2789](https://github.com/code-yeongyu/senpi/issues/2789)).
+
 ### Removed
 
 ## [2026.10.10-4] - 2026-10-06

package/README.md

@@ -363,7 +363,8 @@ options object and asynchronous helpers are `await`-able.
 | `write(path, content)` | Creates parent directories and writes text. `local://` paths persist in the session artifact root. |
 | `env(key?, value?)` | Reads all kernel environment values, one value, or sets one value. Includes the session's `PI_*` values (see [Session environment](#session-environment)). |
 | `tool.<name>(args)` | Invokes an active Senpi tool through the normal `pi.executeTool` pipeline and returns `{ text, images?, details?, hasError? }` in every kernel; image blocks arrive as `images[i] = { mimeType, dataBase64 }`. |
-| `tool_schema(name?)` | Returns a tool's parameter schema without calling it; omit `name` to list tool names. |
+| `tool_schema(name?)` | Returns a tool's parameter schema without calling it; omit `name` to list tool names. Five virtual entries document codemode itself on demand and are never listed: `eval:wait`, `eval:helpers`, `eval:kernel-tools`, `eval:environments` (the `%pip`, `%bun`/`%npm`, `%environment` and `%load` magics, their results and error codes) and `eval:isolation` (`isolate: true` cells, their limits and error codes). |
+| `require(specifier)`, `createRequire(path)` (js) | CommonJS loading inside a cell, resolved like `import`: builtins (with or without `node:`), relative files and JSON from the cell's directory, bare packages from the session's project and then its managed package environment (`%bun add`/`%npm add`). A missing module raises the runtime's own `MODULE_NOT_FOUND` error. Like Node's `require`, it carries `require.resolve` (the same lookup the call uses, so both name the same copy; builtins resolve to the runtime's own id), `require.resolve.paths` and `require.cache` (the runtime's CommonJS cache). |
 | `tool(fn, metadata?)` (js) | Registers a named function as a kernel tool for in-process children. `metadata.name` registers it under that name instead of the function's; arguments are still passed in the function's parameter order. |
 | `tool.defined()` / `tool.undefine(name)` (js) | List the kernel tools this kernel defines (sorted), and remove one (`true` if it existed). A descriptor taken before `undefine` can no longer be invoked. Both names are reserved: a kernel tool can't be registered as `defined` or `undefine` (`reserved_tool_name`), and a host tool with either name is shadowed in the `tool` namespace, so it can't be called from a JavaScript cell. |
 | `@tool` / `@tool(name=, description=, schema=)` (py) | Registers a Python function as a kernel tool for in-process children; the schema is inferred from its type hints (`tool_schema("eval:kernel-tools")` lists the rules). Callbacks run while the kernel is idle or its cell is parked in a host call, never in the middle of a running computation. `tool.defined()` and `tool.undefine(name)` work as in JavaScript. Ruby and Julia kernels answer `tools_unavailable`. |
@@ -465,6 +466,10 @@ free; otherwise it settles `cancelled` with `eval_background_capacity_reached`,
 listing the live cells and a stop-or-wait remedy. Cells that complete inside the
 window return normally. Cancelling a queued cell never interrupts its predecessor.
 Do not re-run a detached or queued cell; each detached cell completes as one notification.
+The notification carries the same text the cell's result would have shown in the
+foreground (the output sink's configured head, its tail, the middle-elision marker and
+the full-output artifact notice), framed by the outcome line and the kernel-state note,
+plus any images the cell displayed.
 
 Queued steering also detaches an eligible interactive foreground call, including
 one paused in a host tool bridge, without cancelling its computation. If the
@@ -505,11 +510,29 @@ Use `eval({ action: "peek", cell_id })` for its state and buffered output, or
 `eval({ action: "stop", cell_id })` to cancel it. Stopping a queued cell removes it
 without interrupting the active cell; kernel state is retained. Python running-cell stop interrupts the
 existing kernel and preserves variables. JavaScript stop is cooperative first:
-the worker rejects the cell's pending bridge `tool.*` calls and kills the
-`Bun.spawn` children it started, and a cell that settles within the 2 s grace
-keeps the worker and every global. Only a cell that stays unsettled (a
-never-resolving promise, an un-abortable `fetch`, a `Bun.$` command) costs the
-worker VM. A worker blocked in a synchronous call (`Bun.spawnSync`,
+Stop ends the cell and everything it started, not the kernel's variables. The
+worker rejects the cell's pending bridge `tool.*` calls and releases the cell:
+its timers are cleared (the globals and the `node:timers` module alike), its
+pending `Bun.sleep`, `node:timers/promises` waits, `fetch` requests and file
+reads reject with the interruption, and the sockets, servers, file streams,
+`readline` interfaces, WebSockets, WebViews, nested workers and child processes
+it opened are closed or terminated, whether made with a factory or a
+constructor. A resource that will not close is reported on the cell output. The stop result arrives once those children are gone, and the
+worker and every global from earlier cells survive. If the stopped cell's own
+`catch`/`finally` still runs, it cannot print, call tools, start processes,
+schedule timers or open connections. One boundary remains: code that resumes
+because a later cell resolves a promise the stopped cell was awaiting runs
+until it reaches an operation a stopped cell may no longer start (output, tool
+calls, processes, timers, network, files, message channels, workers).
+
+An unhandled promise rejection never crashes the JavaScript kernel; its
+variables are kept, as in the Node REPL and Jupyter. The rejection is reported
+on the cell that is running, or on the next cell, naming the cell that started
+the work when it is known ("from cell <id>, after it was stopped"), with the
+error message and the top of its stack. A burst becomes one report plus
+"... and K more unhandled promise rejections". A fatal error (an uncaught
+exception) still restarts the worker, and the result says variables are lost. Only a cell stopped during a `Bun.$` command costs
+the worker VM. A worker blocked in a synchronous call (`Bun.spawnSync`,
 `child_process.spawnSync`) cannot be stopped at all; after a 3 s termination
 deadline a fresh worker replaces it, the cell output gains a stderr line naming
 the blocked synchronous call, and the blocked call keeps running until it

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.10-4",
+	"version": "2026.10.10-6",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -33,15 +33,15 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-4",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.10-6",
 		"quickjs-wasi": "3.6.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.10-4"
+		"@code-yeongyu/senpi": "2026.10.10-6"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.10-4"
+		"@code-yeongyu/senpi": "2026.10.10-6"
 	},
 	"keywords": [
 		"senpi",

package/src/bridges/eval-environment-schemas.ts

@@ -0,0 +1,48 @@
+import type { EvalSchemaResult } from "./schema-bridge.ts";
+
+export type NamedEvalSchema = Extract<EvalSchemaResult, { readonly name: string }>;
+
+/**
+ * The on-demand documentation for package environments and isolated cells (`tool_schema("eval:environments")` and
+ * `tool_schema("eval:isolation")`). Like the other virtual entries they are never listed, never run anything, and add
+ * nothing to the eval prompt or input schema. Every magic, code and message named here is the one the source emits.
+ */
+export const environmentsEntry: NamedEvalSchema = {
+	name: "eval:environments",
+	description: [
+		"Host magic cells: a cell whose first code line (blank and comment lines skipped) is one of these runs on the host, in the language kernel's queue, so it orders with ordinary cells and a queued one is removed by stop like any queued cell. A magic followed by more code is refused: put it on its own cell, then run the code that uses it in the next cell.",
+		"py: %pip install <requirements ...> installs into the session's environment (a trailing backslash continues the line). Result: installed <packages> into <mode> (revision <n>); already-imported modules stay cached until reset.",
+		"js: %bun add <packages ...> or %npm add <packages ...> (install is accepted as a synonym of add). Result: added <packages> with <installer> into <mode>[ (revision <n>)]; already-imported modules stay cached until reset. A package the project's own node_modules still shadows is named with environment_resolution_conflict in the result.",
+		"py and js: %environment managed | project selects where installs go. managed (the default) uses per-session revisions under the session's artifacts directory (or environments.managedRoot) and never touches project files; project installs into the session directory (py: .senpi/python-packages; js: the project root).",
+		"py and js: %load <file> runs a local file as a cell, read when its turn comes in the queue, with the file's name in tracebacks; definitions persist like any cell. It accepts a path relative to the session directory, local:// or file://, reads files up to 8 MiB and never fetches remote URLs.",
+		"Installs pause the run budget like a bridge call, stream the installer's output into the cell, detach past the foreground window like any cell, and are stopped by stop.",
+		"Install failures are cell errors that start with their code: environment_install_failed (a bad argument or an installer failure, with the installer's stderr tail), environment_install_cancelled (stopped before or during the install), environment_installer_unavailable (no interpreter or no pip; no JavaScript package environment in this session; neither bun nor npm on PATH, or the chosen one missing; the installer failed to start; or installs turned off with environments.autoProvision: false), environment_resolution_conflict (py: pip reported a dependency conflict). A %load failure, and a magic refused because more code follows it, are plain cell errors without a code.",
+	].join("\n"),
+	parameters: {
+		type: "object",
+		properties: {
+			"%pip": { description: "py: %pip install <requirements ...>" },
+			"%bun": { description: "js: %bun add <packages ...>" },
+			"%npm": { description: "js: %npm add <packages ...>" },
+			"%environment": { enum: ["managed", "project"] },
+			"%load": { description: "py and js: %load <path | local://... | file://...>" },
+		},
+	},
+};
+
+export const isolationEntry: NamedEvalSchema = {
+	name: "eval:isolation",
+	description: [
+		"isolate: true runs one JavaScript cell in a fresh QuickJS sandbox instead of the persistent kernel. It is available only when sandbox.enabled is on in the codemode settings; only then does the eval input schema carry the isolate field. An older senpi drops the field and would run the code as an ordinary cell, so check this entry before relying on it.",
+		'Requests are refused with eval_isolate_invalid when sandbox cells are turned off, when language is not "js", when isolate is not a boolean, with reset: true (a sandbox cell always starts fresh), or when eval runs through a proxy that cannot isolate a cell.',
+		"An isolated cell shares nothing with the kernel. Its globals are print, display, text, image, console, exit, tool.<name>(args) (also reachable as tools), ALL_TOOLS (the names and descriptions of the tools it may call), load and store. Its tool calls go through the host, so permission hooks still apply, and tool calls still pending when the script settles are aborted. The store is rejected: load returns nothing and store fails with eval_isolate_no_state.",
+		"Limits: sandbox.timeoutSeconds (default 300) and sandbox.memoryMb (default 64; SENPI_CODEMODE_SANDBOX_MEMORY_MB overrides it). The result's runtime names quickjs and its version, with isolation sandbox.",
+		"Failures start with their code: eval_isolate_timeout, eval_isolate_aborted, eval_isolate_memory_limit, eval_isolate_unresolved_promise (the script ended with a promise still pending), eval_isolate_no_state, eval_isolate_unavailable (the sandbox itself failed: it could not load, or its worker crashed, exited or lost its output; if that happened after the script started, tool calls the cell made may already have run, so check their effects before retrying).",
+	].join("\n"),
+	parameters: {
+		type: "object",
+		properties: {
+			isolate: { type: "boolean", description: 'true with language: "js" runs the cell in a fresh sandbox' },
+		},
+	},
+};

package/src/bridges/eval-virtual-schemas.ts

@@ -1,3 +1,4 @@
+import { environmentsEntry, isolationEntry, type NamedEvalSchema } from "./eval-environment-schemas.ts";
 import type { EvalSchemaResult } from "./schema-bridge.ts";
 
 /**
@@ -22,7 +23,7 @@ const handleRefSchema = {
 	required: ["kind", "id", "run_epoch"],
 } as const;
 
-const waitEntry: EvalSchemaResult = {
+const waitEntry: NamedEvalSchema = {
 	name: "eval:wait",
 	description: [
 		"wait(handles, {timeout?, mode?}) blocks the cell until the given handles settle (js: await wait(...); py/rb: wait(...); jl: wait(handle(node)) or wait([handle(a), handle(b)])).",
@@ -44,7 +45,7 @@ const waitEntry: EvalSchemaResult = {
 	},
 };
 
-const helpersEntry: EvalSchemaResult = {
+const helpersEntry: NamedEvalSchema = {
 	name: "eval:helpers",
 	description: [
 		"Advanced cell helpers (all four languages; js helpers are awaited).",
@@ -70,7 +71,7 @@ const helpersEntry: EvalSchemaResult = {
 	},
 };
 
-const kernelToolsEntry: EvalSchemaResult = {
+const kernelToolsEntry: NamedEvalSchema = {
 	name: "eval:kernel-tools",
 	description: [
 		"Kernel tools: functions a cell defines that in-process children can call (js and py; rb/jl answer tools_unavailable).",
@@ -90,12 +91,18 @@ const kernelToolsEntry: EvalSchemaResult = {
 	},
 };
 
-const VIRTUAL_ENTRIES: ReadonlyMap<string, EvalSchemaResult> = new Map([
+const VIRTUAL_ENTRIES: ReadonlyMap<string, EvalSchemaResult> = new Map<string, EvalSchemaResult>([
 	[waitEntry.name, waitEntry],
 	[helpersEntry.name, helpersEntry],
 	[kernelToolsEntry.name, kernelToolsEntry],
+	[environmentsEntry.name, environmentsEntry],
+	[isolationEntry.name, isolationEntry],
 ]);
 
 export function virtualEvalSchema(name: string): EvalSchemaResult | undefined {
 	return VIRTUAL_ENTRIES.get(name);
 }
+
+export function virtualEvalSchemaNames(): readonly string[] {
+	return [...VIRTUAL_ENTRIES.keys()];
+}

package/src/extension/eval-notifier.ts

@@ -1,4 +1,9 @@
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import type { EvalImageContent } from "../tool/image-resize.ts";
+
+/** A notification's message content: plain text, or text and the cells' images in one message. */
+export type EvalNotificationContent = string | ({ readonly type: "text"; readonly text: string } | EvalImageContent)[];
+
 import type { EvalDetachedCellNotification, EvalDetachedCellNotifier } from "../tool/detached-cell-manager.ts";
 
 const NON_INTERACTIVE_MODES = new Set(["print", "json"]);
@@ -11,7 +16,7 @@ export type EvalNotifyMode = "wake" | "next-turn" | "off";
 export interface EvalNotifierDeps {
 	/** Deliver a model-visible notification without rendering synthetic user input. */
 	readonly sendMessage: (
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options: { triggerTurn: boolean; deliverAs: "steer" | "followUp" },
 	) => void;
 	readonly getContext: () => ExtensionContext | undefined;
@@ -43,10 +48,16 @@ export class EvalNotifier implements EvalDetachedCellNotifier {
 		this.#deps.sendMessage(
 			{
 				customType: EVAL_NOTIFICATION_CUSTOM_TYPE,
-				content: pending.map((cell) => cell.content).join("\n\n"),
+				content: notificationContent(pending),
 				display: false,
 			},
 			{ triggerTurn: true, deliverAs: mode === "wake" ? "steer" : "followUp" },
 		);
 	}
 }
+
+function notificationContent(cells: readonly EvalDetachedCellNotification[]): EvalNotificationContent {
+	const text = cells.map((cell) => cell.content).join("\n\n");
+	const images = cells.flatMap((cell) => cell.images ?? []);
+	return images.length === 0 ? text : [{ type: "text", text }, ...images];
+}

package/src/index.ts

@@ -10,7 +10,7 @@ import {
 	resolveMaxDetachedCells,
 	resolveRunBudgetSeconds,
 } from "./config/settings.ts";
-import { EvalNotifier } from "./extension/eval-notifier.ts";
+import { type EvalNotificationContent, EvalNotifier } from "./extension/eval-notifier.ts";
 import { EVAL_CELLS_STATUS_KEY } from "./extension/eval-status.ts";
 import { EvalStatusTicker } from "./extension/eval-status-ticker.ts";
 import { hostLine, modelIdFrom } from "./extension/host-facts.ts";
@@ -57,7 +57,7 @@ export interface CodemodeExtensionAPI {
 	getActiveTools(): string[];
 	getAllTools(): readonly EvalSchemaToolInfo[];
 	sendMessage(
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options?: { triggerTurn?: boolean; deliverAs?: "steer" | "followUp" | "nextTurn" },
 	): void;
 	/** Optional host event bus; a host without one turns extension event emission into a harmless no-op. */

package/src/kernels/js/cell-ownership.js

@@ -0,0 +1,268 @@
+import { currentCell, onReleaseOf, settleWithCell } from "./cell-run-context.js";
+
+// What a cell owns, and how each kind ends when the cell is stopped. Every patch is a no-op outside a cell, refuses
+// (or never starts) new work for a released cell, and registers what a live cell starts so release can end it.
+const RESOURCE_CLOSERS = ["terminate", "destroy", "stop", "close", "end"];
+
+// Some host bindings are read-only (Bun.fetch); those keep their own behaviour and are not owned by cells.
+function replace(owner, name, replacement, patched) {
+	const original = owner[name];
+	try {
+		owner[name] = replacement;
+	} catch {
+		return;
+	}
+	if (owner[name] !== replacement) return;
+	patched.push(() => {
+		owner[name] = original;
+	});
+}
+
+function builtin(name) {
+	return process.getBuiltinModule?.(name);
+}
+
+function closeResource(resource) {
+	for (const method of RESOURCE_CLOSERS) {
+		if (typeof resource?.[method] !== "function") continue;
+		if (method === "stop") resource.stop(true);
+		else resource[method]();
+		return;
+	}
+}
+
+function ownResultsOf(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const own = function (...args) {
+			const cell = currentCell();
+			if (cell === undefined) return original.apply(this, args);
+			if (cell.released) throw cell.interruption;
+			const result = original.apply(this, args);
+			const register = (resource) => {
+				onReleaseOf(cell, () => closeResource(resource));
+				return resource;
+			};
+			return result instanceof Promise ? result.then(register) : register(result);
+		};
+		Object.assign(own, original);
+		replace(owner, name, own, patched);
+	}
+}
+
+// `globals` is the global scope already patched: a module binding that is the same owned function is left alone.
+function patchTimers(scope, patched, globals = undefined) {
+	for (const [name, clearName] of [
+		["setTimeout", "clearTimeout"],
+		["setInterval", "clearInterval"],
+		["setImmediate", "clearImmediate"],
+	]) {
+		const original = scope?.[name];
+		const clear = scope?.[clearName];
+		if (typeof original !== "function" || typeof clear !== "function") continue;
+		if (globals !== undefined && original === globals[name]) continue;
+		const owned = function (callback, ...rest) {
+			const cell = currentCell();
+			if (cell === undefined || typeof callback !== "function") return original.call(this, callback, ...rest);
+			if (cell.released) {
+				const never = original.call(this, () => {}, ...rest);
+				clear.call(scope, never);
+				return never;
+			}
+			let forget = () => {};
+			const handle = original.call(
+				this,
+				function (...args) {
+					if (name !== "setInterval") forget();
+					return callback.apply(this, args);
+				},
+				...rest,
+			);
+			forget = onReleaseOf(cell, () => clear.call(scope, handle));
+			return handle;
+		};
+		Object.assign(owned, original);
+		replace(scope, name, owned, patched);
+	}
+}
+
+function patchPromiseApi(owner, name, patched) {
+	const original = owner?.[name];
+	if (typeof original !== "function") return;
+	const bound = function (...args) {
+		const cell = currentCell();
+		if (cell === undefined) return original.apply(this, args);
+		if (cell.released) return Promise.reject(cell.interruption);
+		return settleWithCell(cell, original.apply(this, args));
+	};
+	Object.assign(bound, original);
+	replace(owner, name, bound, patched);
+}
+
+function patchTimerPromises(patched) {
+	const timers = builtin("node:timers/promises");
+	if (timers === undefined) return;
+	patchPromiseApi(timers, "setTimeout", patched);
+	patchPromiseApi(timers, "setImmediate", patched);
+	const original = timers.setInterval;
+	if (typeof original !== "function") return;
+	const owned = function (...args) {
+		const cell = currentCell();
+		if (cell?.released) throw cell.interruption;
+		const iterator = original.apply(this, args);
+		if (cell === undefined) return iterator;
+		onReleaseOf(cell, () => void iterator.return?.());
+		return iterator;
+	};
+	replace(timers, "setInterval", owned, patched);
+}
+
+function patchFetch(scope, patched, name = "fetch") {
+	const original = scope[name];
+	if (typeof original !== "function") return;
+	const owned = function (input, init) {
+		const cell = currentCell();
+		if (cell === undefined) return original.call(this, input, init);
+		if (cell.released) return Promise.reject(cell.interruption);
+		const controller = new AbortController();
+		const own = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+		const signal = own === undefined ? controller.signal : AbortSignal.any([own, controller.signal]);
+		const forget = onReleaseOf(cell, () => controller.abort(cell.interruption));
+		return original.call(this, input, { ...init, signal }).finally(forget);
+	};
+	Object.assign(owned, original);
+	replace(scope, name, owned, patched);
+}
+
+// A released cell's code may still be resumed by a short I/O completion; refusing new I/O at that point makes such a
+// loop throw the interruption on its next operation instead of running on in the kept worker.
+function refuseWhenReleased(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const guarded = function (...args) {
+			const cell = currentCell();
+			if (cell?.released) throw cell.interruption;
+			const result = original.apply(this, args);
+			return cell === undefined ? result : settleWithCell(cell, result);
+		};
+		Object.assign(guarded, original);
+		replace(owner, name, guarded, patched);
+	}
+}
+
+// The callback form: a released cell's operation is never started, so its callback never runs, the same way a timer a
+// released cell sets never fires.
+function neverStartWhenReleased(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const guarded = function (...args) {
+			if (currentCell()?.released) return undefined;
+			return original.apply(this, args);
+		};
+		Object.assign(guarded, original);
+		replace(owner, name, guarded, patched);
+	}
+}
+
+const FS_OPERATIONS = ["readFile", "writeFile", "appendFile", "readdir", "stat", "lstat", "open", "access", "mkdir", "rm", "unlink", "rename", "copyFile"];
+
+// For ES classes only (Worker, WebSocket, MessageChannel): `instanceof` keeps accepting instances the runtime creates
+// internally from the original class. Node's function-style constructors are owned on activation instead.
+function patchClass(scope, name, close, patched) {
+	const Original = scope?.[name];
+	if (typeof Original !== "function") return;
+	const Owned = class extends Original {
+		constructor(...args) {
+			const cell = currentCell();
+			if (cell?.released) throw cell.interruption;
+			super(...args);
+			if (cell !== undefined) onReleaseOf(cell, () => close(this));
+		}
+		static [Symbol.hasInstance](value) {
+			return value instanceof Original;
+		}
+	};
+	Object.defineProperty(Owned, "name", { value: Original.name });
+	replace(scope, name, Owned, patched);
+}
+
+const NODE_RESOURCE_FACTORIES = {
+	"node:net": ["createConnection", "connect", "createServer"],
+	"node:tls": ["connect", "createServer"],
+	"node:http": ["request", "get", "createServer"],
+	"node:https": ["request", "get", "createServer"],
+	"node:dgram": ["createSocket"],
+	"node:fs": ["createReadStream", "createWriteStream", "watch"],
+	"node:readline": ["createInterface"],
+	"node:readline/promises": ["createInterface"],
+};
+
+// Node's socket and server types are function-style constructors that Node's own subclasses call with `.call(this)`
+// (http.Server calls net.Server), so they cannot be swapped for a class. A socket or server only does anything once it
+// connects, listens or binds, so that call is where a cell takes ownership of it; http, https and tls inherit these.
+const NODE_ACTIVATIONS = {
+	"node:net": { Socket: ["connect"], Server: ["listen"] },
+	"node:dgram": { Socket: ["bind"] },
+};
+
+function ownOnActivation(proto, names, patched) {
+	for (const name of names) {
+		const original = proto?.[name];
+		if (typeof original !== "function") continue;
+		const owned = new WeakSet();
+		const activate = function (...args) {
+			const cell = currentCell();
+			if (cell === undefined) return original.apply(this, args);
+			if (cell.released) throw cell.interruption;
+			if (!owned.has(this)) {
+				owned.add(this);
+				onReleaseOf(cell, () => closeResource(this));
+			}
+			return original.apply(this, args);
+		};
+		replace(proto, name, activate, patched);
+	}
+}
+
+export function installCellOwnership(scope = globalThis) {
+	const patched = [];
+	patchTimers(scope, patched);
+	patchTimers(builtin("node:timers"), patched, scope);
+	patchTimerPromises(patched);
+	patchFetch(scope, patched);
+	patchClass(scope, "WebSocket", (socket) => socket.close(), patched);
+	patchClass(scope, "Worker", (worker) => void worker.terminate(), patched);
+	refuseWhenReleased(builtin("node:fs/promises"), FS_OPERATIONS, patched);
+	neverStartWhenReleased(builtin("node:fs"), FS_OPERATIONS, patched);
+	patchClass(scope, "MessageChannel", (channel) => {
+		channel.port1.close();
+		channel.port2.close();
+	}, patched);
+	patchClass(scope, "BroadcastChannel", (channel) => channel.close(), patched);
+	const bun = scope.Bun;
+	if (bun !== undefined) {
+		patchPromiseApi(bun, "sleep", patched);
+		if (bun.fetch !== scope.fetch) patchFetch(bun, patched, "fetch");
+		refuseWhenReleased(bun, ["file", "write"], patched);
+		ownResultsOf(bun, ["connect", "listen", "serve", "udpSocket"], patched);
+	}
+	for (const [module, factories] of Object.entries(NODE_RESOURCE_FACTORIES)) ownResultsOf(builtin(module), factories, patched);
+	patchClass(builtin("node:worker_threads"), "Worker", (worker) => void worker.terminate(), patched);
+	for (const [module, types] of Object.entries(NODE_ACTIVATIONS)) {
+		for (const [name, methods] of Object.entries(types)) ownOnActivation(builtin(module)?.[name]?.prototype, methods, patched);
+	}
+	// Node hands `import("node:…")` its own ESM namespace; without this sync a cell importing the module gets the
+	// unowned originals.
+	syncBuiltinExports();
+	return () => {
+		for (const undo of patched.reverse()) undo();
+		syncBuiltinExports();
+	};
+}
+
+function syncBuiltinExports() {
+	builtin("node:module")?.syncBuiltinESMExports?.();
+}

package/src/kernels/js/cell-run-context.js

@@ -0,0 +1,89 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// Every continuation a cell creates (awaits, timers, I/O callbacks) runs inside its cell record. Stopping a cell
+// releases it: everything it owns is cleared, rejected or closed (`cell-ownership.js` decides what a cell owns), and
+// anything its code tries to start afterwards is refused, while the kernel and its variables stay.
+const cellRuns = new AsyncLocalStorage();
+const releasedInterruptions = new WeakMap();
+const MAX_CAUSE_DEPTH = 8;
+
+export function runInCell(cell, run) {
+	return cellRuns.run(cell, run);
+}
+
+export function currentCell() {
+	return cellRuns.getStore();
+}
+
+export function releasedCellError() {
+	const cell = cellRuns.getStore();
+	return cell?.released === true ? cell.interruption : undefined;
+}
+
+export function assertCellLive() {
+	const error = releasedCellError();
+	if (error !== undefined) throw error;
+}
+
+export function onCellRelease(close) {
+	const cell = cellRuns.getStore();
+	return cell === undefined ? () => {} : onReleaseOf(cell, close);
+}
+
+export function onReleaseOf(cell, close) {
+	cell.onRelease ??= new Set();
+	cell.onRelease.add(close);
+	return () => cell.onRelease.delete(close);
+}
+
+/**
+ * Releases the cell: every closer runs even when an earlier one throws, and the failures are returned so the caller
+ * can report them; a resource that would not close is a fact the user should see, not something to swallow.
+ */
+export function releaseCell(cell) {
+	cell.released = true;
+	releasedInterruptions.set(cell.interruption, cell);
+	const failures = [];
+	for (const close of cell.onRelease ?? []) {
+		try {
+			close();
+		} catch (error) {
+			failures.push(error);
+		}
+	}
+	cell.onRelease?.clear();
+	return failures;
+}
+
+/**
+ * The cell an unhandled rejection came from: a released cell whose interruption is the reason or sits in its `cause`
+ * chain, or the cell whose async context the rejection runs in (Node exposes it to the handler; Bun does not).
+ */
+export function cellOfRejection(reason) {
+	let current = reason;
+	for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof current === "object" && current !== null; depth++) {
+		const cell = releasedInterruptions.get(current);
+		if (cell !== undefined) return cell;
+		current = current.cause;
+	}
+	return cellRuns.getStore();
+}
+
+// An operation already in flight when its cell is released rejects with the interruption at once, so the stopped
+// cell's continuation never runs again; a non-promise result is returned as it is.
+export function settleWithCell(cell, result) {
+	if (result === null || typeof result !== "object" || typeof result.then !== "function") return result;
+	return new Promise((resolve, reject) => {
+		const forget = onReleaseOf(cell, () => reject(cell.interruption));
+		result.then(
+			(value) => {
+				forget();
+				resolve(value);
+			},
+			(error) => {
+				forget();
+				reject(error);
+			},
+		);
+	});
+}