@code-yeongyu/senpi-codemode 2026.10.10 → 2026.10.12

package/src/bridges/eval-virtual-schemas.ts

@@ -1,3 +1,4 @@
+import { environmentsEntry, isolationEntry, type NamedEvalSchema } from "./eval-environment-schemas.ts";
 import type { EvalSchemaResult } from "./schema-bridge.ts";
 
 /**
@@ -22,7 +23,7 @@ const handleRefSchema = {
 	required: ["kind", "id", "run_epoch"],
 } as const;
 
-const waitEntry: EvalSchemaResult = {
+const waitEntry: NamedEvalSchema = {
 	name: "eval:wait",
 	description: [
 		"wait(handles, {timeout?, mode?}) blocks the cell until the given handles settle (js: await wait(...); py/rb: wait(...); jl: wait(handle(node)) or wait([handle(a), handle(b)])).",
@@ -44,7 +45,7 @@ const waitEntry: EvalSchemaResult = {
 	},
 };
 
-const helpersEntry: EvalSchemaResult = {
+const helpersEntry: NamedEvalSchema = {
 	name: "eval:helpers",
 	description: [
 		"Advanced cell helpers (all four languages; js helpers are awaited).",
@@ -70,7 +71,7 @@ const helpersEntry: EvalSchemaResult = {
 	},
 };
 
-const kernelToolsEntry: EvalSchemaResult = {
+const kernelToolsEntry: NamedEvalSchema = {
 	name: "eval:kernel-tools",
 	description: [
 		"Kernel tools: functions a cell defines that in-process children can call (js and py; rb/jl answer tools_unavailable).",
@@ -90,12 +91,18 @@ const kernelToolsEntry: EvalSchemaResult = {
 	},
 };
 
-const VIRTUAL_ENTRIES: ReadonlyMap<string, EvalSchemaResult> = new Map([
+const VIRTUAL_ENTRIES: ReadonlyMap<string, EvalSchemaResult> = new Map<string, EvalSchemaResult>([
 	[waitEntry.name, waitEntry],
 	[helpersEntry.name, helpersEntry],
 	[kernelToolsEntry.name, kernelToolsEntry],
+	[environmentsEntry.name, environmentsEntry],
+	[isolationEntry.name, isolationEntry],
 ]);
 
 export function virtualEvalSchema(name: string): EvalSchemaResult | undefined {
 	return VIRTUAL_ENTRIES.get(name);
 }
+
+export function virtualEvalSchemaNames(): readonly string[] {
+	return [...VIRTUAL_ENTRIES.keys()];
+}

package/src/bridges/reserved-dispatch.ts

@@ -1,5 +1,11 @@
 import type { AgentToolResult, EvalHandleHost } from "@code-yeongyu/senpi";
-import { RESERVED_AGENT_TOOL, RESERVED_OUTPUT_TOOL, RESERVED_SCHEMA_TOOL } from "../bridge/reserved.ts";
+import {
+	RESERVED_AGENT_TOOL,
+	RESERVED_OUTPUT_TOOL,
+	RESERVED_PACKAGES_INSTALL_TOOL,
+	RESERVED_SCHEMA_TOOL,
+} from "../bridge/reserved.ts";
+import { type PackagesInstallEnvironments, runPackagesInstall } from "../environments/packages-install.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
 import type { EvalStatusEvent, ExecuteTool } from "../tool/types.ts";
 import { type AgentExecuteTool, runEvalAgent } from "./agent-bridge.ts";
@@ -21,6 +27,8 @@ export interface ReservedDispatchContext {
 	readonly handles?: HandleRegistry;
 	/** `ctx.evalHandleHost` at dispatch time; agent/workpool refs need it, completion refs do not. */
 	readonly evalHandleHost?: EvalHandleHost;
+	/** The calling cell's session environments; `packages.install()` fails with environment_installer_unavailable without one. */
+	readonly environments?: PackagesInstallEnvironments;
 }
 
 class SchemaUnavailableError extends Error {
@@ -36,6 +44,7 @@ export function isReservedToolName(toolName: string): boolean {
 		toolName === RESERVED_AGENT_TOOL ||
 		toolName === RESERVED_OUTPUT_TOOL ||
 		toolName === RESERVED_SCHEMA_TOOL ||
+		toolName === RESERVED_PACKAGES_INSTALL_TOOL ||
 		isHandleToolName(toolName)
 	);
 }
@@ -66,6 +75,9 @@ export async function runReservedTool(toolName: string, context: ReservedDispatc
 			marshalToolResult: context.marshalToolResult,
 		});
 	}
+	if (toolName === RESERVED_PACKAGES_INSTALL_TOOL) {
+		return await runPackagesInstall(context.args, context.environments ?? {}, context.signal);
+	}
 	if (toolName === RESERVED_SCHEMA_TOOL) {
 		const listTools = context.listTools;
 		if (listTools === undefined) throw new SchemaUnavailableError();

package/src/config/executable-settings.json

@@ -0,0 +1,5 @@
+{
+	"projectExecutableSettings": [
+		"languages.pyInterpreter"
+	]
+}

package/src/config/project-trust.ts

@@ -0,0 +1,51 @@
+import { join } from "node:path";
+import executableSettings from "./executable-settings.json" with { type: "json" };
+import type { CodemodeSettings } from "./settings.ts";
+
+/**
+ * Settings that name an executable run at session start (an interpreter's `--version` probe, then the kernel). The
+ * one list of them lives in `executable-settings.json`, which senpi's project-trust check also reads: a project
+ * codemode file that sets any of them asks for trust. Without trust they are dropped with a warning and never run.
+ * Trust is asked only when the project's own file sets one, so a host that cannot answer still starts sessions;
+ * such a host counts as not trusting the project.
+ */
+export const PROJECT_EXECUTABLE_SETTINGS: readonly string[] = executableSettings.projectExecutableSettings;
+
+export function withoutUntrustedInterpreter<Settings extends CodemodeSettings>(
+	settings: Settings,
+	source: string | null,
+	cwd: string,
+	isProjectTrusted: (() => boolean) | undefined,
+): { readonly settings: Settings; readonly warning?: string } {
+	const projectFile = join(cwd, ".senpi", "codemode.json");
+	if (source !== projectFile) return { settings };
+	const named = PROJECT_EXECUTABLE_SETTINGS.filter((path) => valueAt(settings, path) !== undefined);
+	if (named.length === 0 || isProjectTrusted?.() === true) return { settings };
+	let trimmed: Settings = settings;
+	for (const path of named) trimmed = withoutPath(trimmed, path);
+	const list = named.map((path) => `${path} "${String(valueAt(settings, path))}"`).join(", ");
+	return {
+		settings: trimmed,
+		warning: `${list} in ${projectFile} is ignored because this project is not trusted; it was not run`,
+	};
+}
+
+function valueAt(value: unknown, path: string): unknown {
+	let current: unknown = value;
+	for (const key of path.split(".")) {
+		if (typeof current !== "object" || current === null) return undefined;
+		current = Reflect.get(current, key);
+	}
+	return current;
+}
+
+function withoutPath<T>(value: T, path: string): T {
+	const copy = structuredClone(value);
+	const keys = path.split(".");
+	const last = keys.pop();
+	let parent: unknown = copy;
+	for (const key of keys)
+		parent = typeof parent === "object" && parent !== null ? Reflect.get(parent, key) : undefined;
+	if (last !== undefined && typeof parent === "object" && parent !== null) Reflect.deleteProperty(parent, last);
+	return copy;
+}

package/src/config/settings-overrides.ts

@@ -20,6 +20,8 @@ export function resolveEnabledLanguages(
 	env: Environment = process.env,
 ): CodemodeSettings["languages"] {
 	return {
+		// Keep the non-flag keys (languages.pyInterpreter); only the four enable flags take env overrides.
+		...settings.languages,
 		py: resolveLanguage(settings.languages.py, env[languageEnvironmentFlags.py]),
 		js: resolveLanguage(settings.languages.js, env[languageEnvironmentFlags.js]),
 		rb: resolveLanguage(settings.languages.rb, env[languageEnvironmentFlags.rb]),

package/src/environments/editable-check.ts

@@ -60,7 +60,7 @@ async function refuseOutsideLinks(root: string, dir: string): Promise<void> {
 export async function assertInstalledInRevision(stdout: string, staging: string): Promise<void> {
 	const line = stdout.split("\n").find((entry) => entry.startsWith("Successfully installed "));
 	if (line === undefined) return;
-	const present = new Set((await readdir(staging).catch(() => [] as string[])).flatMap(installedName));
+	const present = new Set((await readdir(staging).catch((): string[] => [])).flatMap(installedName));
 	for (const token of line.slice("Successfully installed ".length).trim().split(/\s+/u)) {
 		const name = token.slice(0, token.lastIndexOf("-"));
 		if (!present.has(canonicalName(name))) {

package/src/environments/packages-install.ts

@@ -0,0 +1,98 @@
+import type { JsEnvironments, JsInstallReceipt } from "./js-environments.ts";
+import type { InstallReceipt } from "./py-environment.ts";
+import { EnvironmentError } from "./py-installer.ts";
+import type { PythonEnvironments } from "./python-environments.ts";
+
+export interface PackagesInstallEnvironments {
+	readonly python?: PythonEnvironments;
+	readonly js?: JsEnvironments;
+}
+
+export const PACKAGES_INSTALL_DEFAULT_TIMEOUT_SECONDS = 600;
+
+interface PackagesInstallRequest {
+	readonly manager: "pip" | "bun" | "npm";
+	readonly requirements: readonly string[];
+	readonly timeoutSeconds: number;
+}
+
+function invalid(message: string): EnvironmentError {
+	return new EnvironmentError("environment_install_failed", `packages.install(): ${message}`);
+}
+
+function parseRequest(args: unknown): PackagesInstallRequest {
+	if (typeof args !== "object" || args === null) throw invalid("expected (manager, requirements, {timeout?})");
+	const manager = "manager" in args ? args.manager : undefined;
+	if (manager !== "pip" && manager !== "bun" && manager !== "npm") {
+		throw invalid('manager must be "pip" (Python) or "bun" / "npm" (JavaScript)');
+	}
+	const raw = "requirements" in args ? args.requirements : undefined;
+	const list = typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw : undefined;
+	if (
+		list === undefined ||
+		list.length === 0 ||
+		!list.every((item) => typeof item === "string" && item.trim() !== "")
+	) {
+		throw invalid("requirements must be a non-empty string or a non-empty list of non-empty strings");
+	}
+	const timeout = "timeout" in args ? args.timeout : undefined;
+	if (timeout !== undefined && (typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0)) {
+		throw invalid("timeout must be a positive number of seconds");
+	}
+	return {
+		manager,
+		requirements: list.map((item: string) => item.trim()),
+		timeoutSeconds: timeout ?? PACKAGES_INSTALL_DEFAULT_TIMEOUT_SECONDS,
+	};
+}
+
+function jsArguments(requirements: readonly string[]): string {
+	for (const requirement of requirements) {
+		if (/\s/.test(requirement)) throw invalid(`a package spec cannot contain whitespace: ${requirement}`);
+	}
+	return requirements.join(" ");
+}
+
+/**
+ * `packages.install(manager, requirements, {timeout?})`: the in-cell form of `%pip install` / `%bun add` /
+ * `%npm add`. It drives the same session environment the magic cells use and returns its receipt; a stop of the
+ * owning cell cancels it (environment_install_cancelled), and the timeout fails it with environment_install_timeout.
+ * pip receives the requirement list as separate arguments, never re-split. The installer's output is not streamed
+ * into the cell: the receipt is the result, and a failure carries the installer's stderr tail.
+ */
+export async function runPackagesInstall(
+	args: unknown,
+	environments: PackagesInstallEnvironments,
+	signal: AbortSignal | undefined,
+): Promise<InstallReceipt | JsInstallReceipt> {
+	const request = parseRequest(args);
+	const { python, js } = environments;
+	const manager = request.manager;
+	let install: ((signal: AbortSignal) => Promise<InstallReceipt | JsInstallReceipt>) | undefined;
+	if (manager === "pip") {
+		if (python !== undefined) install = (signal) => python.install(request.requirements, signal);
+	} else if (js !== undefined) {
+		install = (signal) => js.install(jsArguments(request.requirements), signal, undefined, manager);
+	}
+	if (install === undefined) {
+		throw new EnvironmentError(
+			"environment_installer_unavailable",
+			manager === "pip"
+				? "pip installs need this session to have a Python interpreter"
+				: "bun/npm installs run only in a JavaScript cell",
+		);
+	}
+	const timeout = AbortSignal.timeout(request.timeoutSeconds * 1_000);
+	const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+	try {
+		return await install(combined);
+	} catch (error) {
+		if (timeout.aborted && !(signal?.aborted ?? false)) {
+			throw new EnvironmentError(
+				"environment_install_timeout",
+				`the install did not finish within ${request.timeoutSeconds}s and was stopped`,
+			);
+		}
+		throw error;
+	}
+}

package/src/environments/py-environment.ts

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { assertInstalledInRevision, assertNoEditableInstalls } from "./editable-check.ts";
-import { parsePipRequirements, runPipInstall } from "./py-installer.ts";
+import { normalizePipInstall, parsePipRequirements, runPipInstall } from "./py-installer.ts";
 import { publishNextRevision, type Revision } from "./revision-store.ts";
 
 const execFileAsync = promisify(execFile);
@@ -40,12 +40,16 @@ export async function installPythonPackages(input: {
 	readonly base: string;
 	readonly mode: EnvironmentMode;
 	readonly interpreter: string;
-	readonly requirements: string;
+	/** `%pip` argument text, or the requirement list `packages.install()` passes without re-parsing. */
+	readonly requirements: string | readonly string[];
 	readonly cwd: string;
 	readonly signal: AbortSignal;
 	readonly onOutput?: (stream: "stdout" | "stderr", data: string) => void;
 }): Promise<InstallReceipt> {
-	const requested = parsePipRequirements(input.requirements);
+	const requested =
+		typeof input.requirements === "string"
+			? parsePipRequirements(input.requirements)
+			: normalizePipInstall(["install", ...input.requirements]);
 	let stdout = "";
 	const { revision } = await publishNextRevision(
 		input.base,

package/src/environments/py-installer.ts

@@ -1,5 +1,7 @@
 import { spawn } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
 import { devNull } from "node:os";
+import { join } from "node:path";
 import { terminateProcessTrees } from "../kernels/js/process-tree-host.ts";
 
 export type EnvironmentErrorCode =
@@ -125,7 +127,11 @@ export function splitShellWords(text: string, posix = process.platform !== "win3
 }
 
 export function parsePipRequirements(text: string): string[] {
-	const args = splitShellWords(text);
+	return normalizePipInstall(splitShellWords(text));
+}
+
+/** `%pip` words already split (`["install", ...]`): `packages.install()` passes its list as-is, so nothing is re-quoted. */
+export function normalizePipInstall(args: readonly string[]): string[] {
 	const command = args[0] === "install" ? args.slice(1) : undefined;
 	if (command === undefined) {
 		throw new EnvironmentError("environment_install_failed", "only `%pip install <requirements>` is supported");
@@ -176,7 +182,7 @@ export function isolatedPipEnv(): NodeJS.ProcessEnv {
 	return { ...env, PIP_CONFIG_FILE: process.platform === "win32" ? "nul" : devNull, PYTHONNOUSERSITE: "1" };
 }
 
-export function runPipInstall(input: {
+export async function runPipInstall(input: {
 	readonly interpreter: string;
 	readonly root: string;
 	readonly args: readonly string[];
@@ -196,52 +202,82 @@ export function runPipInstall(input: {
 		input.root,
 		...input.args,
 	];
-	return new Promise((resolve, reject) => {
-		if (input.signal.aborted) {
-			reject(new EnvironmentError("environment_install_cancelled", "the install was cancelled before it started"));
-			return;
-		}
-		const child = spawn(input.interpreter, argv, {
-			cwd: input.cwd,
-			stdio: ["ignore", "pipe", "pipe"],
-			env: isolatedPipEnv(),
-		});
-		let stderrTail = "";
-		child.stdout.setEncoding("utf8").on("data", (data: string) => input.onOutput?.("stdout", data));
-		child.stderr.setEncoding("utf8").on("data", (data: string) => {
-			stderrTail = (stderrTail + data).slice(-STDERR_TAIL_BYTES);
-			input.onOutput?.("stderr", data);
-		});
-		// pip's build backends run in their own subprocesses; stopping only pip would leave them writing.
-		const onAbort = () => {
-			const pid = child.pid;
-			if (pid === undefined) child.kill("SIGKILL");
-			else void terminateProcessTrees([pid], { graceMs: PIP_TREE_GRACE_MS }).catch(() => child.kill("SIGKILL"));
-		};
-		input.signal.addEventListener("abort", onAbort, { once: true });
-		child.once("error", (error) => {
-			input.signal.removeEventListener("abort", onAbort);
-			reject(
-				new EnvironmentError("environment_installer_unavailable", `${input.interpreter} -m pip: ${error.message}`),
-			);
-		});
-		child.once("close", (code, signal) => {
-			input.signal.removeEventListener("abort", onAbort);
+	if (input.signal.aborted) {
+		throw new EnvironmentError("environment_install_cancelled", "the install was cancelled before it started");
+	}
+	const scratch = await mkdtemp(join(input.root, ".pip-"));
+	try {
+		await new Promise<void>((resolve, reject) => {
 			if (input.signal.aborted) {
-				reject(new EnvironmentError("environment_install_cancelled", "the install was cancelled; pip was stopped"));
-			} else if (code === 0) resolve();
-			else if (/No module named pip/.test(stderrTail)) {
-				reject(new EnvironmentError("environment_installer_unavailable", `${input.interpreter} has no pip module`));
-			} else if (/ResolutionImpossible|conflicting dependencies/.test(stderrTail)) {
-				reject(new EnvironmentError("environment_resolution_conflict", stderrTail.trim()));
-			} else {
+				reject(
+					new EnvironmentError("environment_install_cancelled", "the install was cancelled before it started"),
+				);
+				return;
+			}
+			const child = spawn(input.interpreter, argv, {
+				cwd: input.cwd,
+				stdio: ["ignore", "pipe", "pipe"],
+				env: { ...isolatedPipEnv(), TMPDIR: scratch, TEMP: scratch, TMP: scratch },
+			});
+			let termination: Promise<void> | undefined;
+			let stderrTail = "";
+			child.stdout.setEncoding("utf8").on("data", (data: string) => input.onOutput?.("stdout", data));
+			child.stderr.setEncoding("utf8").on("data", (data: string) => {
+				stderrTail = (stderrTail + data).slice(-STDERR_TAIL_BYTES);
+				input.onOutput?.("stderr", data);
+			});
+			// pip's build backends run in their own subprocesses; stopping only pip would leave them writing.
+			const onAbort = () => {
+				const pid = child.pid;
+				if (pid === undefined) child.kill("SIGKILL");
+				else
+					termination = terminateProcessTrees([pid], { graceMs: PIP_TREE_GRACE_MS }).catch(() => {
+						child.kill("SIGKILL");
+					});
+			};
+			input.signal.addEventListener("abort", onAbort, { once: true });
+			child.once("error", (error) => {
+				input.signal.removeEventListener("abort", onAbort);
 				reject(
 					new EnvironmentError(
-						"environment_install_failed",
-						stderrTail.trim() || `pip exited with ${code ?? signal}`,
+						"environment_installer_unavailable",
+						`${input.interpreter} -m pip: ${error.message}`,
 					),
 				);
-			}
+			});
+			child.once("close", async (code, signal) => {
+				input.signal.removeEventListener("abort", onAbort);
+				await termination;
+				if (input.signal.aborted) {
+					reject(
+						new EnvironmentError("environment_install_cancelled", "the install was cancelled; pip was stopped"),
+					);
+				} else if (code === 0) resolve();
+				else if (/No module named pip/.test(stderrTail)) {
+					reject(
+						new EnvironmentError("environment_installer_unavailable", `${input.interpreter} has no pip module`),
+					);
+				} else if (/ResolutionImpossible|conflicting dependencies/.test(stderrTail)) {
+					reject(new EnvironmentError("environment_resolution_conflict", stderrTail.trim()));
+				} else {
+					reject(
+						new EnvironmentError(
+							"environment_install_failed",
+							stderrTail.trim() || `pip exited with ${code ?? signal}`,
+						),
+					);
+				}
+			});
 		});
-	});
+	} finally {
+		// A killed pip/build backend cannot clean Python's tempfile directories itself.
+		try {
+			await rm(scratch, { recursive: true, force: true, maxRetries: 3 });
+		} catch (cause) {
+			// Keep the install's success or typed failure; cleanup is a separate diagnostic.
+			process.emitWarning(`pip scratch cleanup failed: ${cause instanceof Error ? cause.message : String(cause)}`, {
+				code: "SENPI_PIP_SCRATCH_CLEANUP",
+			});
+		}
+	}
 }

package/src/environments/python-environments.ts

@@ -47,7 +47,7 @@ export class PythonEnvironments {
 	}
 
 	async install(
-		requirements: string,
+		requirements: string | readonly string[],
 		signal: AbortSignal,
 		onOutput?: (stream: "stdout" | "stderr", data: string) => void,
 	): Promise<InstallReceipt> {

package/src/extension/bridge-tool-call.ts

@@ -19,7 +19,10 @@ export interface BridgeToolCallRequest {
 // and ordinary tool results are marshalled to { text, images, details, hasError } — the raw
 // { content } shape left python cells unable to reach tool.read image blocks.
 export async function routeBridgeToolCall(
-	options: Pick<CreateCodemodeSessionManagerOptions, "executeTool" | "listTools" | "settings" | "handles">,
+	options: Pick<
+		CreateCodemodeSessionManagerOptions,
+		"executeTool" | "listTools" | "settings" | "handles" | "environments"
+	>,
 	request: BridgeToolCallRequest,
 	evalHandleHost?: EvalHandleHost,
 ): Promise<unknown> {
@@ -39,5 +42,6 @@ export async function routeBridgeToolCall(
 		marshalToolResult,
 		...(options.handles === undefined ? {} : { handles: options.handles }),
 		...(evalHandleHost === undefined ? {} : { evalHandleHost }),
+		...(options.environments === undefined ? {} : { environments: options.environments }),
 	});
 }

package/src/extension/eval-cells-rpc.ts

@@ -0,0 +1,62 @@
+import { EvalCellNotFoundError, type EvalDetachedCellManager } from "../tool/detached-cell-manager.ts";
+import { listEvalCells } from "../tool/detached-eval-result.ts";
+
+const DEFAULT_TAIL_BYTES = 8 * 1024;
+const MAX_TAIL_BYTES = 64 * 1024;
+
+class InvalidEvalCellRequestError extends Error {
+	readonly code = "invalid_eval_cell_request";
+
+	constructor(message: string) {
+		super(message);
+		this.name = "InvalidEvalCellRequestError";
+	}
+}
+
+/** Extension RPC handlers never invoke a model tool or write a session entry. */
+export function registerEvalCellsRpc(
+	rpc: { handle?(name: string, handler: (data: unknown) => unknown | Promise<unknown>): void } | undefined,
+	getCells: () => EvalDetachedCellManager | undefined,
+): void {
+	rpc?.handle?.("eval_cells.list", () => {
+		const cells = getCells();
+		return cells === undefined ? [] : listEvalCells(cells);
+	});
+	for (const action of ["peek", "stop"] as const) {
+		rpc?.handle?.(`eval_cells.${action}`, async (data) => {
+			if (
+				typeof data !== "object" ||
+				data === null ||
+				!("cellId" in data) ||
+				typeof data.cellId !== "string" ||
+				data.cellId.trim().length === 0
+			) {
+				throw new InvalidEvalCellRequestError("cellId must be a non-empty string");
+			}
+			const tailBytes = action === "peek" && "tailBytes" in data ? data.tailBytes : DEFAULT_TAIL_BYTES;
+			if (typeof tailBytes !== "number" || !Number.isSafeInteger(tailBytes) || tailBytes < 0) {
+				throw new InvalidEvalCellRequestError("tailBytes must be a non-negative safe integer");
+			}
+			const cells = getCells();
+			if (cells === undefined) throw new EvalCellNotFoundError(data.cellId);
+			const snapshot = action === "stop" ? await cells.stop(data.cellId) : cells.peek(data.cellId);
+			const bytes = Buffer.from(snapshot.outputTail, "utf8");
+			let start = Math.max(0, bytes.length - Math.min(tailBytes, MAX_TAIL_BYTES));
+			// Drop a partial leading UTF-8 character instead of expanding it into a replacement character.
+			while (start < bytes.length && (bytes[start] & 0xc0) === 0x80) start++;
+			return {
+				cellId: snapshot.cellId,
+				language: snapshot.language,
+				state: snapshot.state,
+				startedAtMs: snapshot.startedAtMs,
+				...(snapshot.result.details.summary ? { summary: snapshot.result.details.summary } : {}),
+				...(snapshot.queuedBehind === undefined ? {} : { queuedBehind: snapshot.queuedBehind }),
+				outputTail: bytes.subarray(start).toString("utf8"),
+				...(snapshot.stateRetained === undefined ? {} : { stateRetained: snapshot.stateRetained }),
+				...(snapshot.interruptNote === undefined ? {} : { interruptNote: snapshot.interruptNote }),
+				...(snapshot.hardLimitSeconds === undefined ? {} : { hardLimitSeconds: snapshot.hardLimitSeconds }),
+				...(snapshot.runBudgetSeconds === undefined ? {} : { runBudgetSeconds: snapshot.runBudgetSeconds }),
+			};
+		});
+	}
+}

package/src/extension/eval-notifier.ts

@@ -1,4 +1,9 @@
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import type { EvalImageContent } from "../tool/image-resize.ts";
+
+/** A notification's message content: plain text, or text and the cells' images in one message. */
+export type EvalNotificationContent = string | ({ readonly type: "text"; readonly text: string } | EvalImageContent)[];
+
 import type { EvalDetachedCellNotification, EvalDetachedCellNotifier } from "../tool/detached-cell-manager.ts";
 
 const NON_INTERACTIVE_MODES = new Set(["print", "json"]);
@@ -11,7 +16,7 @@ export type EvalNotifyMode = "wake" | "next-turn" | "off";
 export interface EvalNotifierDeps {
 	/** Deliver a model-visible notification without rendering synthetic user input. */
 	readonly sendMessage: (
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options: { triggerTurn: boolean; deliverAs: "steer" | "followUp" },
 	) => void;
 	readonly getContext: () => ExtensionContext | undefined;
@@ -43,10 +48,16 @@ export class EvalNotifier implements EvalDetachedCellNotifier {
 		this.#deps.sendMessage(
 			{
 				customType: EVAL_NOTIFICATION_CUSTOM_TYPE,
-				content: pending.map((cell) => cell.content).join("\n\n"),
+				content: notificationContent(pending),
 				display: false,
 			},
 			{ triggerTurn: true, deliverAs: mode === "wake" ? "steer" : "followUp" },
 		);
 	}
 }
+
+function notificationContent(cells: readonly EvalDetachedCellNotification[]): EvalNotificationContent {
+	const text = cells.map((cell) => cell.content).join("\n\n");
+	const images = cells.flatMap((cell) => cell.images ?? []);
+	return images.length === 0 ? text : [{ type: "text", text }, ...images];
+}

package/src/extension/kernel-registration.ts

@@ -63,11 +63,16 @@ export class SessionKernelRegistrations {
 }
 
 export function javaScriptKernelMemory(kernel: JavaScriptKernel): RegisteredKernelSource {
+	const measure = kernel.mode === "process" ? "footprint" : "heap";
 	return {
-		measure: "heap",
+		measure,
 		lastLiveBytes: () => kernel.lastLiveBytes,
 		busy: () => kernel.queueSnapshot().activeCellId !== null,
-		queryMemory: () => kernel.queryMemory(),
+		queryMemory: async () => {
+			const reading = await kernel.queryMemory();
+			return reading === undefined ? undefined : { liveBytes: reading.liveBytes, measure: reading.measure };
+		},
+		...(measure === "footprint" ? { pid: () => kernel.processPid } : {}),
 	};
 }