@code-yeongyu/senpi-codemode 2026.10.10 → 2026.10.12

package/src/kernels/js/worker-runtime.js

@@ -1,10 +1,13 @@
 // allow: SIZE_OK — private runtime state and installed globals must stay in one worker module.
+import { pathToFileURL } from "node:url";
+import { createCellRequire, createRequire } from "./worker-require.js";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
 import { inspect } from "node:util";
 import { encodeDisplayImage, resolveDisplayOps } from "./display-image.js";
-import { terminateProcessTrees } from "./process-tree.js";
+import { terminateProcessGroups, terminateProcessTrees } from "./process-tree.js";
 import { awaitMaybePromise, indirectEval, wrapUserCode } from "./worker-indirect-eval.js";
+import { INJECTED_GROUP } from "./worker-cwd.js";
 import { installShellCapture } from "./worker-shell-capture.js";
 import { bindKernelBun } from "./worker-webview.js";
 import { createWorkpool } from "./workpool.js";
@@ -31,6 +34,10 @@ export class JsWorkerRuntime {
 	#hooks = null;
 	#pendingDisplays = [];
 	#children = new Set();
+	// Groups the worker created for cell children (senpi#2995). A group outlives its leader, so a grandchild re-parented
+	// to init is still found through it at retirement (senpi#3020).
+	#ownedGroups = new Map();
+	#childrenStopping;
 	#shellWaits = new Set();
 	#onChildEvent;
 	#onShellWaitChange;
@@ -47,6 +54,7 @@ export class JsWorkerRuntime {
 			generation: options.kernelGeneration ?? 1,
 			hostToolNames: options.hostToolNames ?? [],
 			foreignLanguageNames: options.foreignLanguageNames ?? [],
+			disabled: options.kernelToolsDisabled === true,
 		});
 		this.#installGlobals();
 	}
@@ -73,32 +81,48 @@ export class JsWorkerRuntime {
 				if (typeof prepared.sourceFile === "string") sourceName = prepared.sourceFile;
 			}
 			if (prelude) indirectEval(prelude, PRELUDE_SOURCE_URL);
-			const value = await awaitMaybePromise(indirectEval(bindKernelBun(wrapUserCode(cellCode)), sourceName));
+			const shadowed = [];
+			const source = bindKernelBun(wrapUserCode(cellCode, shadowed));
+			if (shadowed.length > 0) this.#emitText("stderr", shadowNote(shadowed));
+			const value = await awaitMaybePromise(indirectEval(source, sourceName));
 			await this.#drainPendingDisplays();
 			return value;
 		} finally {
-			this.#pendingDisplays = [];
-			// A child still running here has lost its only owner: the cell that
-			// spawned it is over, nothing will await it again, and it would be
-			// reparented to init. Retire it the way timeout and abort cleanup
-			// already do, unless the cell asked for a detached process.
-			await this.#terminateChildren();
-			this.#hooks = null;
+			// A released run finishing late must not clear the state of the cell running now.
+			if (this.#hooks === hooks) await this.release();
 		}
 	}
 
+	/** Ends the current run's ownership now: its displays, its hooks, and (unless detached) its child processes. */
+	async release() {
+		const hooks = this.#hooks;
+		this.#pendingDisplays = [];
+		// A child still running here has lost its only owner: the cell that
+		// spawned it is over, nothing will await it again, and it would be
+		// reparented to init. Retire it the way timeout and abort cleanup
+		// already do, unless the cell asked for a detached process.
+		await Promise.all([this.#childrenStopping, this.#terminateChildren()]);
+		this.#childrenStopping = undefined;
+		if (this.#hooks === hooks) this.#hooks = null;
+	}
+
 	interrupt() {
 		// The tree snapshot, SIGTERM, and SIGKILL escalation run on their own so
 		// the caller's interrupt latency stays that of the acknowledgement.
-		void this.#terminateChildren();
+		this.#childrenStopping = this.#terminateChildren();
 	}
 
 	#trackChild(child, spawnOptions) {
 		if (child === null || typeof child !== "object" || typeof child.kill !== "function") return;
 		// `detached: true` is the cell saying it wants the process to outlive it.
-		if (isPlainObject(spawnOptions) && spawnOptions.detached === true) return;
+		const groupInjected = (globalThis[INJECTED_GROUP] ?? 0) > 0;
+		if (isPlainObject(spawnOptions) && spawnOptions.detached === true && !groupInjected) return;
 		this.#children.add(child);
 		const pid = Number.isInteger(child.pid) && child.pid > 0 ? child.pid : null;
+		// Bun.spawn children get their group from worker-cwd.js without the injection marker, so every tracked child is
+		// recorded; a child that is not a group leader names no group, and signalling it later finds nothing.
+		const ownGroupLeader = !(isPlainObject(spawnOptions) && spawnOptions.detached === false);
+		if (pid !== null && process.platform !== "win32" && ownGroupLeader) this.#ownedGroups.set(pid, child);
 		// The host keeps its own copy of live pids: if this worker is terminated
 		// while blocked, only the host can still retire them.
 		if (pid !== null) this.#onChildEvent?.({ pid, state: "spawned" });
@@ -112,10 +136,20 @@ export class JsWorkerRuntime {
 	#terminateChildren() {
 		const children = [...this.#children].filter(child => child.exitCode === null && child.signalCode === null);
 		this.#children.clear();
-		if (children.length === 0) return undefined;
+		// A leader that already exited leaves its group id reserved only while the group has members; if that pid now
+		// names a live process, it was reused by someone else and the group is not ours to signal (senpi#3020 review).
+		const groups = [...this.#ownedGroups].map(([pgid, child]) => ({
+			pgid,
+			leaderExited: child.exitCode !== null || child.signalCode !== null,
+		}));
+		this.#ownedGroups.clear();
+		if (children.length === 0 && groups.length === 0) return undefined;
 		const roots = children.map(child => child.pid).filter(pid => Number.isInteger(pid) && pid > 0);
 		const settled = Promise.allSettled(children.map(child => (child.exited instanceof Promise ? child.exited : Promise.resolve())));
-		return terminateProcessTrees(roots, { graceMs: CHILD_TERMINATION_GRACE_MS, settled });
+		return Promise.all([
+			roots.length > 0 ? terminateProcessTrees(roots, { graceMs: CHILD_TERMINATION_GRACE_MS, settled }) : undefined,
+			terminateProcessGroups(groups, { graceMs: CHILD_TERMINATION_GRACE_MS }),
+		]);
 	}
 
 	async #drainPendingDisplays() {
@@ -147,6 +181,17 @@ export class JsWorkerRuntime {
 			return isPlainObject(opts) && opts.handle === true ? handles.handle(value) : value;
 		};
 		globalThis.wait = async (list, options) => await handles.wait(list, options);
+		// The `%bun add` / `%npm add` installer as a call: same environment, receipt, cancellation and codes (senpi row 38).
+		globalThis.packages = Object.freeze({
+			install: async (manager, requirements, options = {}) => {
+				if (!isPlainObject(options)) throw new TypeError("packages.install(): options must be an object, e.g. { timeout: 120 }");
+				return await this.#callTool("__packages_install__", {
+					manager,
+					requirements,
+					...(options.timeout !== undefined ? { timeout: options.timeout } : {}),
+				});
+			},
+		});
 		globalThis.handle = value => handles.handle(value);
 		globalThis.tool = createToolNamespace(
 			(fn, metadata) => this.#tools.define(fn, metadata),
@@ -154,6 +199,8 @@ export class JsWorkerRuntime {
 			{ defined: () => this.#tools.defined(), undefine: (name) => this.#tools.undefine(name) },
 		);
 		globalThis.tools = globalThis.tool;
+		globalThis.require = createCellRequire(() => globalThis.__senpi_module_context__ ?? { cwdUrl: pathToFileURL(`${process.cwd()}/`).href });
+		globalThis.createRequire = createRequire;
 		const originalLog = console.log.bind(console);
 		const originalError = console.error.bind(console);
 		const originalStdoutWrite = process.stdout.write;
@@ -422,6 +469,12 @@ export class JsWorkerRuntime {
 	}
 }
 
+function shadowNote(names) {
+	const list = names.map((name) => `\`${name}\``).join(", ");
+	const restore = names.map((name) => `delete ${name}`).join("; ");
+	return `Note: ${list} ${names.length === 1 ? "shadows a kernel or platform global" : "shadow kernel or platform globals"} in your later cells; the kernel and imported libraries keep the original. \`${restore}\` restores ${names.length === 1 ? "it" : "them"}.\n`;
+}
+
 function isPlainObject(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/src/kernels/js/worker-shadow-guard.js

@@ -12,10 +12,6 @@ function protectedGlobals() {
 	return protectedGlobalNames;
 }
 
-export function findShadowedGlobalName(bindings) {
-	const names = protectedGlobals();
-	for (const name of bindings) {
-		if (names.has(name)) return name;
-	}
-	return undefined;
+export function isKernelGlobal(name) {
+	return protectedGlobals().has(name);
 }

package/src/kernels/js/worker-shell-capture.js

@@ -1,3 +1,6 @@
+import { assertCellLive } from "./cell-run-context.js";
+import { groupSignalNotice, noticeChildProcessGroupSignals, shellCommandText, signalsProcessGroup } from "./group-signal-notice.js";
+
 const SHELL_CONFIG_METHODS = ["env", "cwd", "nothrow", "throws"];
 const SHELL_READ_METHODS = ["text", "json", "lines", "arrayBuffer", "bytes", "blob"];
 // `true | ( … )` hands every command in the template an empty pipe as stdin. The worker thread shares
@@ -26,7 +29,9 @@ export function installShellCapture(options) {
 	bun.$ = capturedShell(originalShell, options);
 	bun.spawn = capturedSpawn(originalSpawn, options, pinEnv);
 	if (originalSpawnSync !== null) bun.spawnSync = capturedSpawnSync(originalSpawnSync, pinEnv);
+	const restoreChildProcessNotice = noticeChildProcessGroupSignals(options.emitText, options.isActive);
 	return () => {
+		restoreChildProcessNotice();
 		bun.$ = originalShell;
 		bun.spawn = originalSpawn;
 		if (originalSpawnSync !== null) bun.spawnSync = originalSpawnSync;
@@ -39,7 +44,9 @@ function isBunRuntime(bun) {
 
 function capturedShell(originalShell, options) {
 	const shell = (strings, ...expressions) => {
+		assertCellLive();
 		if (!options.isActive()) return originalShell(strings, ...expressions);
+		if (signalsProcessGroup(shellCommandText(strings, expressions))) options.emitText("stderr", groupSignalNotice("Bun.$"));
 		const promise = originalShell(isolateStdin(strings), ...expressions);
 		return captureShellPromise(promise, options);
 	};
@@ -132,6 +139,7 @@ function outputText(value) {
 // without an explicit env must get the worker's view pinned too (measured on Bun 1.4.0).
 function capturedSpawnSync(originalSpawnSync, pinEnv) {
 	return (...args) => {
+		assertCellLive();
 		if (!pinEnv) return originalSpawnSync(...args);
 		const [first, second] = args;
 		if (Array.isArray(first)) {
@@ -148,6 +156,7 @@ function capturedSpawnSync(originalSpawnSync, pinEnv) {
 
 function capturedSpawn(originalSpawn, options, pinEnv) {
 	return (...args) => {
+		assertCellLive();
 		if (!options.isActive()) return originalSpawn(...args);
 		const [first, second] = args;
 		let child;

package/src/kernels/js/worker-slot.ts

@@ -19,6 +19,7 @@ export class WorkerSlot {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #listeners: WorkerSlotListeners;
 	#worker: WorkerLike | null = null;
+	#lastProcessPid: number | undefined;
 	#webViews: KernelWebViewClients | null = null;
 	#mode: JavaScriptKernelMode = "worker";
 	#generation = 0;
@@ -34,6 +35,12 @@ export class WorkerSlot {
 		return this.#mode;
 	}
 
+	get processPid(): number | undefined {
+		const worker = this.#worker;
+		if (worker?.mode === "process") return worker.pid;
+		return this.#lastProcessPid;
+	}
+
 	get present(): boolean {
 		return this.#worker !== null;
 	}
@@ -105,6 +112,7 @@ export class WorkerSlot {
 	#publish(worker: WorkerLike, generation: number): void {
 		if (!this.#listeners.isOpen() || generation !== this.#generation) throw new WorkerStartupCancelledError();
 		this.#worker = worker;
+		if (worker.mode === "process") this.#lastProcessPid = worker.pid;
 		const webViews = new KernelWebViewClients((message, transfer) => worker.postMessage(message, transfer));
 		this.#webViews = webViews;
 		worker.onMessage((message) => {

package/src/kernels/js/worker-startup.ts

@@ -2,8 +2,10 @@ import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { createInlineWorker, type WorkerLike } from "./inline-worker.ts";
+import { retireWorker } from "./interrupt-bounds.ts";
 import { resolveKernelToolNameSource } from "./kernel-contract.ts";
 import { type JavaScriptKernelOptions, localBridgeConnection } from "./local-module-loader.ts";
+import { resolveJsProcessEntryUrl, spawnProcessWorker } from "./process-worker.ts";
 import { spawnNodeWorker, WorkerStartupCancelledError, waitForReady } from "./worker-host.ts";
 
 export interface JavaScriptWorkerEntryUrlOptions extends CodemodeRuntimeAssetEnvironment {
@@ -15,6 +17,21 @@ export function resolveJsWorkerEntryUrl(options: JavaScriptWorkerEntryUrlOptions
 	return pathToFileURL(requireCodemodeRuntimeAsset(localPath, join("kernels", "js", "worker-entry.js"), options));
 }
 
+/**
+ * How long a process-mode kernel child gets to report ready. A child that a starved host never schedules would
+ * otherwise hold every queued cell forever: no cell's own timeout is armed until the kernel is up.
+ */
+export const PROCESS_STARTUP_DEADLINE_MS = 30_000;
+
+export class ProcessKernelStartupTimeoutError extends Error {
+	constructor(deadlineMs: number) {
+		super(
+			`JavaScript kernel process did not become ready within ${deadlineMs / 1000}s; it was stopped, and the next cell starts a fresh one`,
+		);
+		this.name = "ProcessKernelStartupTimeoutError";
+	}
+}
+
 export interface WorkerStartupHooks {
 	readonly options: JavaScriptKernelOptions;
 	readonly kernelGeneration: number;
@@ -36,6 +53,13 @@ export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, s
 			await worker.terminate();
 			throw new WorkerStartupCancelledError();
 		}
+		// Process mode never falls back: the user asked for isolation, so a failed start stays visible. The child that
+		// failed to start is stopped (bounded), so a stuck one is not left behind.
+		if (worker.mode === "process") {
+			hooks.retire(worker);
+			await retireWorker(worker);
+			throw error;
+		}
 		if (worker.mode === "inline") throw error;
 		hooks.retire(worker);
 		await worker.terminate();
@@ -47,6 +71,15 @@ export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, s
 }
 
 function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
+	if (options.isolation === "process") {
+		const url = resolveJsProcessEntryUrl();
+		return spawnProcessWorker(url, {
+			cwd: options.cwd,
+			parallelPoolWidth: options.parallelPoolWidth,
+			...(options.processCommandPath === undefined ? {} : { searchPath: options.processCommandPath }),
+			...(options.processExecPath === undefined ? {} : { execPath: options.processExecPath }),
+		});
+	}
 	try {
 		const url = options.workerEntryUrl ?? resolveJsWorkerEntryUrl();
 		return spawnNodeWorker(url, options.cwd, options.parallelPoolWidth);
@@ -57,7 +90,10 @@ function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
 }
 
 async function initializeWorker(worker: WorkerLike, hooks: WorkerStartupHooks, signal: AbortSignal): Promise<void> {
-	const ready = waitForReady(worker, signal);
+	const ready =
+		worker.mode === "process"
+			? withStartupDeadline(waitForReady(worker, signal), hooks.options)
+			: waitForReady(worker, signal);
 	const options = hooks.options;
 	worker.postMessage({
 		type: "init",
@@ -68,6 +104,18 @@ async function initializeWorker(worker: WorkerLike, hooks: WorkerStartupHooks, s
 		foreignLanguageNames: resolveKernelToolNameSource(options.foreignLanguageNames),
 		...(options.sessionEnv === undefined ? {} : { sessionEnv: options.sessionEnv }),
 		...(options.memory === undefined ? {} : { memory: options.memory }),
+		...(options.kernelToolsEnabled === false ? { kernelToolsDisabled: true } : {}),
 	});
 	await ready;
 }
+
+function withStartupDeadline(ready: Promise<void>, options: JavaScriptKernelOptions): Promise<void> {
+	const deadlineMs = options.processStartupDeadlineMs ?? PROCESS_STARTUP_DEADLINE_MS;
+	let timer: NodeJS.Timeout | undefined;
+	const expired = new Promise<never>((_resolve, reject) => {
+		timer = setTimeout(() => reject(new ProcessKernelStartupTimeoutError(deadlineMs)), deadlineMs);
+	});
+	// When the deadline wins, the stopped child's readiness promise rejects later; that outcome is already reported.
+	ready.catch(() => {});
+	return Promise.race([ready, expired]).finally(() => clearTimeout(timer));
+}

package/src/kernels/js/worker-webview.js

@@ -1,3 +1,4 @@
+import { onCellRelease } from "./cell-run-context.js";
 import { DELIVER_EVENT, WebViewPortClient, webViewError } from "./worker-webview-client.js";
 
 // Bun constructs "chrome"-backend WebViews only on the process main thread, and this kernel runs in
@@ -5,6 +6,7 @@ import { DELIVER_EVENT, WebViewPortClient, webViewError } from "./worker-webview
 // `Bun` parameter bound to a stand-in whose `WebView` forwards Chrome-backed views to the
 // main-thread service over a private port; every other `Bun.*` member is the real one.
 const KERNEL_BUN = Symbol.for("senpi.kernel.bun");
+const KERNEL_PROCESS_MODE = Symbol.for("senpi.kernel.processMode");
 
 export function bindKernelBun(source) {
 	if (!globalThis[KERNEL_BUN]) return source;
@@ -17,6 +19,10 @@ export function installKernelWebView(requestPort) {
 	globalThis[KERNEL_BUN] = shadowBun(bun, createKernelWebView(bun.WebView, requestPort));
 }
 
+export function markKernelProcessMode() {
+	globalThis[KERNEL_PROCESS_MODE] = true;
+}
+
 function shadowBun(real, WebView) {
 	return new Proxy(
 		{},
@@ -35,7 +41,10 @@ function shadowBun(real, WebView) {
 }
 
 // The macOS default (WebKit) stays a native worker view: its host process serves any thread.
+// A process-mode kernel already runs its cells on the child's main thread, so the native
+// WebView constructs there directly and no MessagePort proxy is ever needed.
 function needsMainThread(options) {
+	if (globalThis[KERNEL_PROCESS_MODE]) return false;
 	const backend = options?.backend;
 	if (backend === undefined) return process.platform !== "darwin";
 	return backend === "chrome" || (typeof backend === "object" && backend !== null && backend.type === "chrome");
@@ -82,13 +91,16 @@ function createKernelWebView(NativeWebView, requestPort) {
 		#console;
 		#ready;
 		#closed = false;
+		#forgetRelease;
 		onNavigated = null;
 		onNavigationFailed = null;
 
 		constructor(options = {}) {
 			if (!needsMainThread(options)) {
 				const view = new NativeWebView(options);
-				natives.add(new WeakRef(view));
+				const ref = new WeakRef(view);
+				natives.add(ref);
+				onCellRelease(() => ref.deref()?.close());
 				return view;
 			}
 			super();
@@ -96,6 +108,7 @@ function createKernelWebView(NativeWebView, requestPort) {
 			this.#console = capture;
 			proxied.add(this);
 			live.add(this);
+			this.#forgetRelease = onCellRelease(() => this.close());
 			const viewId = this.#viewId;
 			this.#ready = connect().then(async client => {
 				client.register(viewId, this);
@@ -149,6 +162,7 @@ function createKernelWebView(NativeWebView, requestPort) {
 		close() {
 			if (this.#closed) return;
 			this.#closed = true;
+			this.#forgetRelease?.();
 			live.delete(this);
 			const viewId = this.#viewId;
 			this.#ready.then(

package/src/kernels/py/prelude.py

@@ -61,6 +61,7 @@ RESERVED_HANDLE_STATUS_TOOL = "__handle_status__"
 RESERVED_HANDLE_OUTPUT_TOOL = "__handle_output__"
 RESERVED_HANDLE_SEND_TOOL = "__handle_send__"
 RESERVED_HANDLE_CANCEL_TOOL = "__handle_cancel__"
+RESERVED_PACKAGES_INSTALL_TOOL = "__packages_install__"
 TIMEOUT_PAUSE_OP = "timeout-pause"
 TIMEOUT_RESUME_OP = "timeout-resume"
 
@@ -660,25 +661,6 @@ class ThreadRoutedStream(io.TextIOBase):
         )
         self.cell_target: io.StringIO | None = None
 
-    @contextlib.contextmanager
-    def capture(self, buffer: io.StringIO, *, cell: bool) -> Iterator[None]:
-        me = threading.get_ident()
-        previous = self._targets.get(me)
-        self._targets[me] = buffer
-        inherited = self._inherited.set(buffer)
-        if cell:
-            self.cell_target = buffer
-        try:
-            yield
-        finally:
-            self._inherited.reset(inherited)
-            if previous is None:
-                self._targets.pop(me, None)
-            else:
-                self._targets[me] = previous
-            if cell:
-                self.cell_target = None
-
     def write(self, text: str) -> int:
         target = self._targets.get(threading.get_ident()) or self._inherited.get() or self.cell_target
         if target is None:
@@ -693,6 +675,38 @@ class ThreadRoutedStream(io.TextIOBase):
         return None
 
 
+@contextlib.contextmanager
+def capture_streams(
+    streams: tuple[ThreadRoutedStream, ThreadRoutedStream],
+    buffers: tuple[io.StringIO, io.StringIO],
+    *,
+    cell: bool,
+) -> Iterator[None]:
+    stdout, stderr = streams
+    out, err = buffers
+    me = threading.get_ident()
+    previous_out, previous_err = stdout._targets.get(me), stderr._targets.get(me)
+    stdout._targets[me], stderr._targets[me] = out, err
+    inherited_out, inherited_err = stdout._inherited.set(out), stderr._inherited.set(err)
+    if cell:
+        stdout.cell_target, stderr.cell_target = out, err
+    try:
+        yield
+    finally:
+        stderr._inherited.reset(inherited_err)
+        stdout._inherited.reset(inherited_out)
+        if previous_err is None:
+            stderr._targets.pop(me, None)
+        else:
+            stderr._targets[me] = previous_err
+        if previous_out is None:
+            stdout._targets.pop(me, None)
+        else:
+            stdout._targets[me] = previous_out
+        if cell:
+            stdout.cell_target, stderr.cell_target = None, None
+
+
 @dataclass
 class _Entry:
     name: str
@@ -704,7 +718,8 @@ class _Entry:
 
 
 class Registry:
-    def __init__(self, on_change: Callable[[list[str]], None]) -> None:
+    def __init__(self, on_change: Callable[[list[str]], None], *, disabled: bool = False) -> None:
+        self._disabled = disabled
         self._lock = threading.Lock()
         self._entries: dict[str, _Entry] = {}
         # Revisions outlive undefine: a redefined name never reuses a revision an old descriptor carries.
@@ -713,6 +728,8 @@ class Registry:
         self.generation = 1
 
     def define(self, fn: Any, *, name: Any = None, description: Any = None, schema: Any = None) -> Any:
+        if self._disabled:
+            raise KernelToolError("tools_unavailable", "kernel tools are turned off for this project (kernelTools.enabled is false)")
         inferred = infer_tool(fn, name=name, description=description, schema=schema)
         key = tool_key(inferred["name"])
         with self._lock:
@@ -901,8 +918,7 @@ class KernelToolRunner:
                 if invocation.cancelled.is_set():
                     raise Cancelled(CANCELLED_BEFORE_START)
                 CURRENT.set(invocation)
-                stdout, stderr = self._streams
-                with stdout.capture(output, cell=False), stderr.capture(output, cell=False):
+                with capture_streams(self._streams, (output, output), cell=False):
                     value = self._call(invocation, entry.fn, args)
             finally:
                 CURRENT.set(None)
@@ -983,7 +999,12 @@ async def _awaited(awaitable: Any) -> Any:
 
 KERNEL_TOOL_TOKEN = OwnerToken()
 KERNEL_TOOL_STREAMS = (ThreadRoutedStream(stderr=False), ThreadRoutedStream(stderr=True))
-KERNEL_TOOL_REGISTRY = Registry(lambda names: emit({"type": "kernel-tools-defined", "names": names}))
+# kernelTools.enabled is read once, while the prelude loads and before any cell runs, then removed from the
+# environment: rewriting os.environ cannot turn kernel tools back on, and cell subprocesses never see the switch.
+KERNEL_TOOL_REGISTRY = Registry(
+    lambda names: emit({"type": "kernel-tools-defined", "names": names}),
+    disabled=os.environ.pop("SENPI_CODEMODE_KERNEL_TOOLS", None) == "0",
+)
 KERNEL_TOOL_RUNNER = KernelToolRunner(emit, KERNEL_TOOL_TOKEN, KERNEL_TOOL_REGISTRY, KERNEL_TOOL_STREAMS)
 
 
@@ -1154,6 +1175,27 @@ def tool_schema(name: str | None = None) -> Any:
     )
 
 
+class _Packages:
+    """packages.install(manager, requirements, *, timeout=600): the %pip installer as a call; returns its receipt."""
+
+    __slots__ = ()
+
+    def install(self, manager: str, requirements: Any, *, timeout: float | None = None) -> Any:
+        args: dict[str, Any] = {"manager": manager, "requirements": requirements}
+        if timeout is not None:
+            args["timeout"] = timeout
+        # A long install must not hit the 60 s socket cap; the host bounds it by the timeout (600 s by default).
+        socket_timeout = (600 if timeout is None else float(timeout)) + _WAIT_SOCKET_GRACE_SECONDS
+        return bridge_post(
+            "/call",
+            {"callId": f"py-{uuid.uuid4()}", "toolName": RESERVED_PACKAGES_INSTALL_TOOL, "args": args},
+            socket_timeout=socket_timeout,
+        )
+
+
+packages = _Packages()
+
+
 def output(
     *ids: str,
     format: str = "raw",
@@ -1781,6 +1823,7 @@ USER_NS.update(
         "workpool": workpool,
         "output": output,
         "tool_schema": tool_schema,
+        "packages": packages,
         "wait": wait,
         "handle": handle,
         "__senpi_magic": _magic,
@@ -2187,8 +2230,7 @@ def run_cell(
     cell_scope = CURRENT_CELL_TOKEN.set(cell_token)
     try:
         KERNEL_TOOL_TOKEN.acquire()
-        cell_stdout, cell_stderr = KERNEL_TOOL_STREAMS
-        with cell_stdout.capture(stdout, cell=True), cell_stderr.capture(stderr, cell=True):
+        with capture_streams(KERNEL_TOOL_STREAMS, (stdout, stderr), cell=True):
             apply_preludes(preludes)
             leave_source_file = _enter_source_file(source_file)
             body, expression = compile_cell(code, source_file or "<cell>")
@@ -2342,7 +2384,7 @@ def _start_parent_watch() -> None:
         ).start()
 
 
-def _read_control(commands: queue.Queue[tuple[str, Any]]) -> None:
+def _read_control(commands: queue.SimpleQueue[tuple[str, Any]]) -> None:
     # Kernel-tool frames are served here, so a callback can be admitted while the main thread is inside a cell.
     for raw in sys.stdin:
         try:
@@ -2361,7 +2403,7 @@ def main() -> None:
     signal.signal(signal.SIGINT, signal.SIG_IGN)
     _start_parent_watch()
     sys.stdout, sys.stderr = KERNEL_TOOL_STREAMS
-    commands: queue.Queue[tuple[str, Any]] = queue.Queue()
+    commands: queue.SimpleQueue[tuple[str, Any]] = queue.SimpleQueue()
     threading.Thread(target=_read_control, args=(commands,), name="senpi-control-reader", daemon=True).start()
     host_closed = False
     while True:

package/src/kernels/py/process.ts

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute } from "node:path";
 import type { Readable, Writable } from "node:stream";
 
 export interface KernelChild {
@@ -53,6 +55,8 @@ export function defaultSpawn(options: KernelSpawnOptions): KernelChild {
 }
 
 export function splitCommand(commandLine: string): { readonly command: string; readonly args: readonly string[] } {
+	// A configured interpreter path is one executable even when it contains spaces.
+	if (isAbsolute(commandLine) && existsSync(commandLine)) return { command: commandLine, args: [] };
 	const [command, ...args] = commandLine.split(" ").filter(Boolean);
 	if (!command) throw new Error("Python interpreter path is empty");
 	return { command, args };

package/src/kernels/py/transport.ts

@@ -244,6 +244,10 @@ export class PythonKernelTransport {
 		this.#child.stderr.on("data", onStderr);
 		this.#child.on("error", onError);
 		this.#child.on("exit", onExit);
+		// senpi#3016: a frame written while the interpreter is dying fails on the stdin stream (EPIPE), not on the child.
+		// #onError already ignores it once the child has exited or the transport is inactive, and the listener is never
+		// detached, so a late write failure is never unhandled.
+		this.#child.stdin.on("error", onError);
 		const { sessionId, connection, memory, kernelGeneration } = this.#options;
 		this.#write({
 			type: "init",

package/src/kernels/rb/runner.rb

@@ -9,6 +9,7 @@ $stdout.flush
 $__senpi_binding = TOPLEVEL_BINDING
 $__senpi_frame_mutex = Mutex.new
 $__senpi_current_cell = nil
+$__senpi_memory_cell = nil
 $__senpi_capture_cell = nil
 $__senpi_connection = nil
 $__senpi_frame_io = STDOUT.dup
@@ -123,8 +124,6 @@ rescue JSON::GeneratorError
   value.inspect
 end
 
-$__senpi_memory = nil
-
 SENPI_SIZER_SAMPLE = 1_000
 SENPI_SIZER_NODE_BUDGET = 5_000
 SENPI_SIZER_MAX_DEPTH = 64
@@ -239,19 +238,6 @@ rescue StandardError
   []
 end
 
-# The host reads the interpreter's footprint and decides on the notice; the runner only names its
-# largest globals. Nothing here spawns a process, so the user's `$?` is left alone.
-def __senpi_memory_report
-  return nil if $__senpi_memory.nil?
-  named = __senpi_largest_globals(5)
-  # The host replaces liveBytes with the interpreter footprint it reads itself; only globals is used.
-  report = { "liveBytes" => 0, "measure" => "footprint" }
-  report["globals"] = named unless named.empty?
-  report
-rescue StandardError
-  nil
-end
-
 SENPI_NON_DISPLAY_NODES = %i[
   LASGN IASGN GASGN CVASGN DASGN OP_ASGN OP_CDECL CDECL MASGN CASGN
   DEFN DEFS CLASS MODULE SCLASS ALIAS UNDEF
@@ -305,8 +291,6 @@ def __senpi_run_cell(message)
       "durationMs" => ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round,
     }
     frame["valueRepr"] = __senpi_value_repr(value) if !value.nil? && __senpi_should_display_result?(source)
-    memory = __senpi_memory_report
-    frame["memory"] = memory unless memory.nil?
     __senpi_emit(frame)
   rescue Exception => error
     __senpi_emit({
@@ -319,6 +303,7 @@ def __senpi_run_cell(message)
   ensure
     $__senpi_capture_cell = nil
     $__senpi_current_cell = nil
+    $__senpi_memory_cell = cell_id
   end
 end
 
@@ -332,10 +317,15 @@ $__senpi_protocol_stdin.each_line do |line|
   when "init"
     __senpi_emit({ "type" => "status", "event" => { "op" => "kernel-startup", "stage" => "host-init" } })
     $__senpi_connection = message["connection"]
-    $__senpi_memory = message["memory"]
-    __senpi_emit({ "type" => "ready" })
+    __senpi_emit({ "type" => "ready", "memoryGlobals" => true })
   when "run"
+    $__senpi_memory_cell = nil
     __senpi_run_cell(message)
+  when "memory-globals"
+    if message["cellId"] == $__senpi_memory_cell && $__senpi_current_cell.nil?
+      __senpi_emit({ "type" => "memory-globals-result", "cellId" => message["cellId"], "globals" => __senpi_largest_globals(5) })
+      $__senpi_memory_cell = nil
+    end
   when "close"
     __senpi_emit({ "type" => "closed" })
     exit 0