@code-yeongyu/senpi-codemode 2026.10.4 → 2026.10.5

package/CHANGELOG.md

@@ -12,6 +12,21 @@
 
 ### Removed
 
+## [2026.10.5] - 2026-10-03
+
+### Breaking Changes
+
+### Added
+
+- Eval kernels expose the session's `OMO_BROWSER_ENGINE` and clear a value inherited from the host process for a session that chose no engine ([#2611](https://github.com/code-yeongyu/senpi/issues/2611)).
+- A Python, Ruby, or Julia eval kernel whose interpreter dies is replaced once instead of failing every later cell: Ruby and Julia no longer stay closed after a crash, and a Python kernel whose stuck interpreter finally exits recovers instead of rejecting every cell. Cells queued behind the death keep their order and run on the replacement, whose first result says `[<language> kernel was restarted after <reason>; every global is lost]`; the cell that was running fails once and is never re-run, and a replacement that dies before finishing a cell fails the queued cells with `eval_kernel_unavailable` ([#2452](https://github.com/code-yeongyu/senpi/issues/2452))
+
+### Changed
+
+### Fixed
+
+### Removed
+
 ## [2026.10.4] - 2026-10-03
 
 ### Breaking Changes

package/README.md

@@ -339,6 +339,17 @@ bash tool for long-running commands you may want to stop. Native `Bun.$`
 cancellation is tracked in [Bun #11868](https://github.com/oven-sh/bun/issues/11868);
 the shell's interpretation and object redirects are not replaced.
 
+When a Python, Ruby, or Julia interpreter dies on its own (a crash, an OOM kill,
+`os.kill(os.getpid(), 9)`), the cell it was running fails once and is never run
+again: its side effects may already have happened. Cells queued behind it keep
+their order, callbacks, and deadlines and run on one fresh interpreter started
+for that death; the first result there carries
+`[<language> kernel was restarted after <reason>; every global is lost]`. If the
+fresh interpreter dies too before it finished a cell, the queued cells fail with
+`eval_kernel_unavailable` naming the reason, and the next cell you run starts
+another. An interpreter whose exit cannot be confirmed is reported, never
+replaced by a second one. The JavaScript worker keeps its own restart path.
+
 Commands a cell runs through `Bun.$` never read the host's terminal: the worker
 thread shares the TUI's stdin, so the shell wrapper hands every template an
 empty pipe (`true | ( … )`) while a cell is active. Output, exit codes, `cwd`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.4",
+	"version": "2026.10.5",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -32,14 +32,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.4",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.5",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.4"
+		"@code-yeongyu/senpi": "2026.10.5"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.4"
+		"@code-yeongyu/senpi": "2026.10.5"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/protocol.ts

@@ -90,6 +90,12 @@ const hostToKernelMessageSchema = Type.Union([
 	...kernelMemoryQueryHostToKernelSchemas,
 ]);
 
+/**
+ * Host-set: what a kernel death did to this cell's state. `lost`: the interpreter died while it ran;
+ * `restarted`: it ran on a kernel replaced after a death; `not-run`: it was failed without running.
+ */
+const kernelStateSchema = Type.Union([Type.Literal("lost"), Type.Literal("restarted"), Type.Literal("not-run")]);
+
 const kernelToHostMessageSchema = Type.Union([
 	Type.Object({ type: Type.Literal("ready") }),
 	Type.Object({ type: Type.Literal("init-failed"), error: bridgeErrorSchema }),
@@ -119,6 +125,9 @@ const kernelToHostMessageSchema = Type.Union([
 		valueRepr: Type.Optional(Type.String()),
 		durationMs: Type.Integer({ minimum: 0 }),
 		memory: Type.Optional(kernelMemoryReportSchema),
+		/** Host-set: the bracketed notice that this cell ran on a kernel restarted after its interpreter died. */
+		notice: Type.Optional(Type.String()),
+		kernelState: Type.Optional(kernelStateSchema),
 	}),
 	Type.Object({
 		type: Type.Literal("result"),
@@ -127,6 +136,8 @@ const kernelToHostMessageSchema = Type.Union([
 		error: bridgeErrorSchema,
 		durationMs: Type.Integer({ minimum: 0 }),
 		memory: Type.Optional(kernelMemoryReportSchema),
+		notice: Type.Optional(Type.String()),
+		kernelState: Type.Optional(kernelStateSchema),
 	}),
 	Type.Object({ type: Type.Literal("closed") }),
 	Type.Object({ type: Type.Literal("webview-connect"), requestId: Type.String({ minLength: 1 }) }),

package/src/extension/kernel-replacement.ts

@@ -0,0 +1,230 @@
+import type { HostToKernelMessage } from "../bridge/protocol.ts";
+import {
+	type KernelLifecycle,
+	KernelUnavailableError,
+	restartNotice,
+	unstartedResult,
+} from "../kernels/shared/kernel-death.ts";
+import type {
+	EvalKernel,
+	EvalKernelResult,
+	EvalKernelRunInput,
+	EvalLanguage,
+	KernelInterruptHandle,
+	PendingCell,
+} from "../tool/types.ts";
+
+export type StartKernel = (lifecycle: Required<KernelLifecycle>) => Promise<EvalKernel>;
+
+class ReplaceableKernelClosedError extends Error {
+	readonly name = "ReplaceableKernelClosedError";
+
+	constructor() {
+		super("Kernel closed");
+	}
+}
+
+/**
+ * The one kernel a session holds for a language whose instances can die (py, rb, jl). Every caller keeps
+ * this object for the life of a cell - its handler, its execution, its detached record - so a death never
+ * strands them: on the instance's own death event this evicts it, takes back the cells that never started,
+ * starts ONE replacement and runs them there in their original order, with their own callbacks. The first
+ * result of the replacement says the kernel was restarted. A replacement that dies before it finished a
+ * cell is not replaced again for the same cells: they fail with `eval_kernel_unavailable`, and the next
+ * cell submitted starts a fresh one. The cell that was running when the interpreter died is never re-run.
+ */
+export class ReplaceableKernel implements EvalKernel {
+	readonly #language: EvalLanguage;
+	readonly #start: StartKernel;
+	#kernel: EvalKernel;
+	#generation = 0;
+	#nextGeneration = 0;
+	#held: PendingCell[] = [];
+	#replacing: Promise<void> | null = null;
+	/** The death the current instance replaced, until that instance settled a cell of its own. */
+	#recovering: string | null = null;
+	/** A death whose cells were failed instead of replaced: the next cell's fresh instance announces it. */
+	#unannounced: string | null = null;
+	/** Carried by the first result the current replacement produces. */
+	#announce: string | null = null;
+	#closed = false;
+	#closeFailure: unknown;
+
+	private constructor(language: EvalLanguage, start: StartKernel, first: EvalKernel) {
+		this.#language = language;
+		this.#start = start;
+		this.#kernel = first;
+	}
+
+	/** Starts the first instance; one that cannot hand back its queue is returned as it is. */
+	static async create(language: EvalLanguage, start: StartKernel): Promise<EvalKernel> {
+		let owner: ReplaceableKernel | undefined;
+		const first = await start({
+			onDeath: (reason) => {
+				if (owner !== undefined) owner.#died(0, reason);
+			},
+		});
+		if (first.drainPending === undefined) return first;
+		owner = new ReplaceableKernel(language, start, first);
+		return owner;
+	}
+
+	run(input: EvalKernelRunInput): Promise<EvalKernelResult> {
+		if (this.#closed) return Promise.reject(new ReplaceableKernelClosedError());
+		if (this.#replacing === null && this.#kernel.isAlive?.() !== false) {
+			return this.#submit(this.#generation, this.#kernel, input);
+		}
+		return new Promise((settle) => {
+			this.#held.push({ input, settle });
+			this.#ensureReplacement();
+		});
+	}
+
+	cancelQueued(cellId: string, reason: string): boolean {
+		return this.#cancelHeld(cellId, reason) || this.#kernel.cancelQueued(cellId, reason);
+	}
+
+	async interrupt(reason = "interrupted", cellId?: string): Promise<KernelInterruptHandle> {
+		if (cellId !== undefined && this.#cancelHeld(cellId, reason)) return { stateRetained: Promise.resolve(true) };
+		if (cellId === undefined) this.#failHeld(reason === "Eval interrupted" ? reason : `Eval interrupted: ${reason}`);
+		return await this.#kernel.interrupt(reason, cellId);
+	}
+
+	queueSnapshot(): { activeCellId: string | null; queuedCellIds: readonly string[] } {
+		const current = this.#kernel.queueSnapshot();
+		return {
+			activeCellId: current.activeCellId,
+			queuedCellIds: [...current.queuedCellIds, ...this.#held.map((cell) => cell.input.cellId)],
+		};
+	}
+
+	deliverToolReply(message: Extract<HostToKernelMessage, { type: "tool-reply" }>): void {
+		this.#kernel.deliverToolReply(message);
+	}
+
+	async reset(): Promise<void> {
+		if (this.#replacing !== null) await this.#replacing;
+		if (this.#kernel.isAlive?.() === false) {
+			// A reset discards every global anyway, so the fresh instance announces nothing.
+			this.#unannounced = null;
+			const replacing = this.#replace(null);
+			this.#replacing = replacing;
+			await replacing;
+			if (this.#replacing === replacing) this.#replacing = null;
+			return;
+		}
+		await this.#kernel.reset();
+	}
+
+	async close(): Promise<void> {
+		this.#closed = true;
+		const held = this.#held.splice(0);
+		for (const cell of held)
+			cell.settle(unstartedResult(cell.input.cellId, new ReplaceableKernelClosedError().message));
+		if (this.#replacing !== null) await this.#replacing;
+		if (this.#closeFailure !== undefined) throw this.#closeFailure;
+		await this.#kernel.close();
+	}
+
+	listKernelToolNames(): readonly string[] {
+		return this.#kernel.listKernelToolNames?.() ?? [];
+	}
+
+	#submit(generation: number, kernel: EvalKernel, input: EvalKernelRunInput): Promise<EvalKernelResult> {
+		return kernel.run(input).then((result) => {
+			if (generation !== this.#generation) return result;
+			// The result the kernel settled for the cell its death interrupted proves nothing about the
+			// replacement; a result from a still-live current instance proves it works.
+			// A drained cell settles through this same promise already tagged; only the interrupted one is `lost`.
+			if (kernel.isAlive?.() === false)
+				return result.kernelState === undefined ? { ...result, kernelState: "lost" } : result;
+			this.#recovering = null;
+			const notice = this.#announce;
+			if (notice === null) return result;
+			this.#announce = null;
+			return { ...result, notice, kernelState: "restarted" };
+		});
+	}
+
+	#died(generation: number, reason: string): void {
+		if (generation !== this.#generation || this.#closed) return;
+		this.#held = [...(this.#kernel.drainPending?.() ?? []), ...this.#held];
+		if (this.#recovering !== null) {
+			this.#recovering = null;
+			this.#unannounced = reason;
+			const error = new KernelUnavailableError(this.#language, reason);
+			for (const cell of this.#held.splice(0)) cell.settle(unstartedResult(cell.input.cellId, error.message));
+			return;
+		}
+		this.#recovering = reason;
+		this.#ensureReplacement();
+	}
+
+	#ensureReplacement(): void {
+		if (this.#replacing !== null) return;
+		const reason = this.#recovering ?? this.#unannounced;
+		this.#recovering = reason;
+		this.#unannounced = null;
+		const replacing = this.#replace(reason).finally(() => {
+			if (this.#replacing === replacing) this.#replacing = null;
+		});
+		this.#replacing = replacing;
+	}
+
+	/** Never rejects: every failure settles the held cells with what went wrong. */
+	async #replace(reason: string | null): Promise<void> {
+		const dead = this.#kernel;
+		try {
+			await dead.close();
+		} catch (error) {
+			// The old interpreter may still be running: report that rather than start a second one.
+			this.#failUnavailable(reason, `its interpreter could not be retired: ${errorText(error)}`);
+			return;
+		}
+		if (this.#closed) return;
+		const generation = ++this.#nextGeneration;
+		let next: EvalKernel;
+		try {
+			next = await this.#start({ onDeath: (died) => this.#died(generation, died) });
+		} catch (error) {
+			this.#failUnavailable(reason, `its replacement did not start: ${errorText(error)}`);
+			return;
+		}
+		if (this.#closed) {
+			await next.close().catch((error: unknown) => {
+				this.#closeFailure = error;
+			});
+			return;
+		}
+		this.#kernel = next;
+		this.#generation = generation;
+		this.#announce = reason === null ? null : restartNotice(this.#language, reason);
+		for (const cell of this.#held.splice(0)) {
+			void this.#submit(generation, next, cell.input).then(cell.settle, (error: unknown) =>
+				cell.settle(unstartedResult(cell.input.cellId, errorText(error))),
+			);
+		}
+	}
+
+	#failUnavailable(reason: string | null, detail: string): void {
+		this.#recovering = null;
+		this.#unannounced = reason;
+		const error = new KernelUnavailableError(this.#language, reason === null ? detail : `${reason}; ${detail}`);
+		for (const cell of this.#held.splice(0)) cell.settle(unstartedResult(cell.input.cellId, error.message));
+	}
+
+	#cancelHeld(cellId: string, reason: string): boolean {
+		const index = this.#held.findIndex((cell) => cell.input.cellId === cellId);
+		const [cell] = index < 0 ? [] : this.#held.splice(index, 1);
+		cell?.settle(unstartedResult(cellId, reason));
+		return cell !== undefined;
+	}
+
+	#failHeld(message: string): void {
+		for (const cell of this.#held.splice(0)) cell.settle(unstartedResult(cell.input.cellId, message));
+	}
+}
+
+function errorText(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}

package/src/extension/session-manager.ts

@@ -8,6 +8,7 @@ import { resolveKernelMemoryThresholds } from "../config/memory-settings.ts";
 import { defaultCodemodeSettings } from "../config/settings.ts";
 import { collectOrphanedChildren } from "../host-sdk.ts";
 import { JavaScriptKernel } from "../kernels/js/context-manager.ts";
+import type { KernelLifecycle } from "../kernels/shared/kernel-death.ts";
 import { marshalToolResult } from "../tool/image.ts";
 import type { EvalKernel, EvalLanguage } from "../tool/types.ts";
 import {
@@ -16,7 +17,8 @@ import {
 	type StartedKernel,
 	startSubprocessKernel,
 } from "./kernel-registration.ts";
-import { kernelRegistry } from "./kernel-registry.ts";
+import { kernelRegistry, type RegisteredKernelSource } from "./kernel-registry.ts";
+import { ReplaceableKernel } from "./kernel-replacement.ts";
 import { assertSessionCwdAvailable } from "./session-cwd.ts";
 import type {
 	BridgeEndpoint,
@@ -192,27 +194,48 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		generation: number,
 	): Promise<EvalKernel> {
 		await assertSessionCwdAvailable(this.#options.cwd);
-		const { kernel, memory } = await this.#createKernel(language, onMessage);
+		// py/rb/jl instances can die; the session holds one replaceable kernel per language so every
+		// cell that kept a reference to it survives the death (JS heals its own worker).
+		let memory: RegisteredKernelSource | undefined;
+		const kernel =
+			language === "js"
+				? (() => {
+						return this.#createKernel(language, onMessage).then((created) => {
+							memory = created.memory;
+							return created.kernel;
+						});
+					})()
+				: ReplaceableKernel.create(language, async (lifecycle) => {
+						const created = await this.#createKernel(language, onMessage, lifecycle);
+						memory ??= created.memory;
+						return created.kernel;
+					});
+		const resolvedKernel = await kernel;
 		if (generation !== this.#generation) {
-			await kernel.close();
+			await resolvedKernel.close();
 			throw new CodemodeSessionDisposedError();
 		}
-		this.#kernels.set(language, kernel);
+		this.#kernels.set(language, resolvedKernel);
 		this.#registrations.set(
 			language,
-			registerKernel(this.#options.ownerSessionId ?? this.#options.sessionId, language, memory),
+			registerKernel(
+				this.#options.ownerSessionId ?? this.#options.sessionId,
+				language,
+				memory as RegisteredKernelSource,
+			),
 		);
 		// The directory can vanish while the interpreter starts; every caller sharing this creation
 		// must see that, not only the next one. The kernel stays stored and dispose still closes it.
 		await assertSessionCwdAvailable(this.#options.cwd);
 		// A dispose that started during the check above already owns this stored kernel.
 		if (generation !== this.#generation) throw new CodemodeSessionDisposedError();
-		return kernel;
+		return resolvedKernel;
 	}
 
 	async #createKernel(
 		language: EvalLanguage,
 		onMessage: (message: KernelToHostMessage) => void,
+		lifecycle: KernelLifecycle = {},
 	): Promise<StartedKernel> {
 		const bridge = this.#bridge;
 		if (!bridge) throw new Error("codemode bridge server is not running");
@@ -255,6 +278,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
 			connection,
 			onMessage,
+			...lifecycle,
 		};
 		const memory = resolveKernelMemoryThresholds(this.#options.settings.memory);
 		return await startSubprocessKernel({ language, interpreterPath: detected.path, memory, shared });

package/src/kernels/jl/kernel.ts

@@ -1,10 +1,11 @@
 import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { KernelLifecycle } from "../shared/kernel-death.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
-export interface JuliaKernelStartOptions {
+export interface JuliaKernelStartOptions extends KernelLifecycle {
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -52,6 +53,7 @@ export class JuliaKernel extends SubprocessKernel {
 			spawn: options.spawn,
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "jl", ...options.memory },
+			onDeath: options.onDeath,
 		});
 	}
 }

package/src/kernels/js/worker-core.js

@@ -24,6 +24,7 @@ const SESSION_ENVIRONMENT_KEYS = [
 	"PI_PROVIDER",
 	"PI_MODEL",
 	"PI_REASONING_LEVEL",
+	"OMO_BROWSER_ENGINE",
 ];
 
 export function createWorkerCore(transport, options) {

package/src/kernels/py/kernel-contract.ts

@@ -2,11 +2,12 @@ import type { KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { EvalKernelRunInput } from "../../tool/types.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { KernelLifecycle } from "../shared/kernel-death.ts";
 import type { KernelSpawnProcess } from "./process.ts";
 import type { PythonStartupStage } from "./startup.ts";
 import type { PythonTransportResult } from "./transport.ts";
 
-export interface PythonKernelStartOptions {
+export interface PythonKernelStartOptions extends KernelLifecycle {
 	readonly interpreterPath: string;
 	readonly sessionId: string;
 	readonly cwd: string;

package/src/kernels/py/kernel.ts

@@ -1,7 +1,8 @@
 // allow: SIZE_OK — one persistent Python lifecycle state machine owns queue, generation, and retirement.
-import type { KernelInterruptHandle } from "../../tool/types.ts";
+import type { KernelInterruptHandle, PendingCell } from "../../tool/types.ts";
 import type { KernelToolsInvokeOptions } from "../js/kernel-tools-types.ts";
 import { rejectKernelToolsUnavailable } from "../kernel-tools-unavailable.ts";
+import { describeExit } from "../shared/kernel-death.ts";
 import { KernelMemoryHost } from "../shared/kernel-memory-host.ts";
 import { KernelPreludeTracker } from "../shared/kernel-prelude-plan.ts";
 import type { PendingRun, PythonKernelRunOptions, PythonKernelStartOptions, ResultMessage } from "./kernel-contract.ts";
@@ -27,6 +28,7 @@ export class PythonKernel {
 	readonly #memory: KernelMemoryHost | null;
 	#generation = 0;
 	#closed = false;
+	#dead = false;
 
 	private constructor(options: PythonKernelStartOptions) {
 		this.#options = options;
@@ -43,6 +45,18 @@ export class PythonKernel {
 		return [];
 	}
 
+	isAlive(): boolean {
+		return !this.#dead;
+	}
+
+	drainPending(): readonly PendingCell[] {
+		return [...this.#queue].map((pending) => {
+			this.#pending.delete(pending.input.cellId);
+			this.#removePending(pending);
+			return { input: pending.input, settle: pending.resolve };
+		});
+	}
+
 	describeKernelTools(_names: readonly string[]): Promise<never> {
 		return rejectKernelToolsUnavailable();
 	}
@@ -54,6 +68,7 @@ export class PythonKernel {
 	run(input: PythonKernelRunOptions): Promise<ResultMessage> {
 		if (this.#failure) return Promise.reject(this.#failure);
 		if (this.#closed) return Promise.reject(new Error("Python kernel is closed"));
+		if (this.#dead) return Promise.reject(new Error("Python kernel died"));
 		return new Promise<ResultMessage>((resolve, reject) => {
 			const pending: PendingRun = { input, resolve, reject, startedAt: null, timeoutTimer: null };
 			this.#pending.set(input.cellId, pending);
@@ -156,6 +171,7 @@ export class PythonKernel {
 	#startNext(): void {
 		if (
 			this.#closed ||
+			this.#dead ||
 			this.#failure ||
 			this.#active ||
 			this.#starting ||
@@ -234,11 +250,11 @@ export class PythonKernel {
 			isOwned: () => !this.#closed && generation === this.#generation,
 			onRetirementFailure: (transport, error) => {
 				if (!this.#transport) this.#transport = transport;
-				this.#recordFailure(error);
+				this.#recoverWhenGone(transport, this.#recordFailure(error));
 			},
 			onResult: (transport, result) => this.#onResult(transport, result),
 			onError: (transport, error) => this.#onError(transport, error),
-			onExit: (transport, error) => this.#onExit(transport, error),
+			onExit: (transport, error, exit) => this.#onExit(transport, error, describeExit(exit.code, exit.signal)),
 		});
 	}
 
@@ -262,15 +278,37 @@ export class PythonKernel {
 		void this.reset().catch(() => undefined);
 	}
 
-	#onExit(transport: PythonKernelTransport, error: Error): void {
+	#onExit(transport: PythonKernelTransport, error: Error, reason: string): void {
 		if (this.#transport !== transport) return;
 		this.#transport = null;
+		// With an owner listening, a death is final for this instance: the cells that never started stay
+		// queued for `drainPending` and the owner replaces it. Without one it respawns lazily, as before.
+		const onDeath = this.#options.onDeath;
+		if (onDeath) this.#dead = true;
 		const active = this.#active;
 		if (active) {
 			if (active.resolveStateRetained) active.resolveStateRetained(false);
-			this.#settleRun(active, failedPythonResult(active.input.cellId, "Python kernel died", error.message));
+			const message = onDeath ? "Python kernel died; every global is lost" : "Python kernel died";
+			this.#settleRun(active, failedPythonResult(active.input.cellId, message, error.message));
 		}
-		this.#startNext();
+		if (onDeath) onDeath(reason);
+		else this.#startNext();
+	}
+
+	/**
+	 * A retirement that timed out is reported, and no second interpreter starts while the first may live.
+	 * Once that process is seen to exit after all, the failure is over: this instance is dead, not broken.
+	 */
+	#recoverWhenGone(transport: PythonKernelTransport, failure: Error): void {
+		const onDeath = this.#options.onDeath;
+		if (!onDeath) return;
+		void transport.whenGone().then(() => {
+			if (this.#closed || this.#failure !== failure) return;
+			this.#failure = null;
+			this.#dead = true;
+			if (this.#transport === transport) this.#transport = null;
+			onDeath("an interpreter that outlived its SIGKILL grace");
+		});
 	}
 
 	#onError(transport: PythonKernelTransport, error: Error): void {
@@ -349,8 +387,10 @@ export class PythonKernel {
 			try {
 				await transport.retire();
 			} catch (error) {
-				if (error instanceof Error) throw this.#recordFailure(error);
-				throw error;
+				if (!(error instanceof Error)) throw error;
+				const failure = this.#recordFailure(error);
+				this.#recoverWhenGone(transport, failure);
+				throw failure;
 			}
 			if (this.#transport === transport) this.#transport = null;
 		})();

package/src/kernels/py/transport.ts

@@ -52,7 +52,11 @@ export interface PythonTransportOptions {
 	readonly onRetirementFailure: (transport: PythonKernelTransport, error: Error) => void;
 	readonly onResult: (transport: PythonKernelTransport, result: PythonTransportResult) => void;
 	readonly onError: (transport: PythonKernelTransport, error: Error) => void;
-	readonly onExit: (transport: PythonKernelTransport, error: Error) => void;
+	readonly onExit: (
+		transport: PythonKernelTransport,
+		error: Error,
+		exit: { readonly code: number | null; readonly signal: string | null },
+	) => void;
 }
 
 const hardKillWaitMs = 500;
@@ -79,12 +83,29 @@ export class PythonKernelTransport {
 	#active = true;
 	#exited = false;
 	#retirement: Promise<void> | null = null;
+	#gone: Promise<void> | null = null;
+	#isGone = false;
 
 	private constructor(options: PythonTransportOptions, child: KernelChild) {
 		this.#options = options;
 		this.#child = child;
 	}
 
+	/**
+	 * A retirement that timed out is confirmed only by this: the process really exited after all. The
+	 * watch is attached on demand, so a transport nobody asks this of leaves no listener on its child.
+	 */
+	whenGone(): Promise<void> {
+		if (this.#exited || this.#isGone) return Promise.resolve();
+		this.#gone ??= new Promise<void>((resolve) => {
+			this.#child.once("exit", () => {
+				this.#isGone = true;
+				resolve();
+			});
+		});
+		return this.#gone;
+	}
+
 	static async start(options: PythonTransportOptions): Promise<PythonKernelTransport> {
 		const scriptPath = resolvePythonPreludePath();
 		const invocation = splitCommand(options.interpreterPath);
@@ -139,7 +160,7 @@ export class PythonKernelTransport {
 	}
 
 	async close(): Promise<void> {
-		if (this.#exited) return;
+		if (this.#exited || this.#isGone) return;
 		if (this.#retirement) {
 			await this.#retirement;
 			return;
@@ -162,7 +183,7 @@ export class PythonKernelTransport {
 	}
 
 	retire(): Promise<void> {
-		if (this.#exited) return Promise.resolve();
+		if (this.#exited || this.#isGone) return Promise.resolve();
 		if (this.#retirement) return this.#retirement;
 		this.#active = false;
 		const retirement = hardKill(this.#child, hardKillWaitMs).finally(() => {
@@ -244,7 +265,7 @@ export class PythonKernelTransport {
 		const error = new Error(this.#stderrTail.trim() || `Python kernel exited (${code ?? signal ?? "unknown"})`);
 		this.#detachListeners();
 		if (!active) return;
-		if (!this.#settleStartup(error)) this.#options.onExit(this, error);
+		if (!this.#settleStartup(error)) this.#options.onExit(this, error, { code, signal });
 	}
 
 	#onError(error: Error): void {

package/src/kernels/rb/kernel.ts

@@ -1,10 +1,11 @@
 import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { KernelLifecycle } from "../shared/kernel-death.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
-export interface RubyKernelStartOptions {
+export interface RubyKernelStartOptions extends KernelLifecycle {
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -41,6 +42,7 @@ export class RubyKernel extends SubprocessKernel {
 			spawn: options.spawn,
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "rb", ...options.memory },
+			onDeath: options.onDeath,
 		});
 	}
 }

package/src/kernels/session-env.ts

@@ -17,6 +17,7 @@ export const SESSION_ENVIRONMENT_KEYS = [
 	"PI_PROVIDER",
 	"PI_MODEL",
 	"PI_REASONING_LEVEL",
+	"OMO_BROWSER_ENGINE",
 ] as const;
 
 /** Resolved per-session values for {@link SESSION_ENVIRONMENT_KEYS}; absent keys stay unset. */
@@ -32,6 +33,7 @@ export interface SessionEnvironmentSource {
 	};
 	readonly model?: { readonly provider: string; readonly id: string } | undefined;
 	readonly thinkingLevel?: string | undefined;
+	readonly browserEngine?: string | undefined;
 }
 
 export function sessionEnvironmentFrom(source: SessionEnvironmentSource): SessionEnvironment {
@@ -47,6 +49,7 @@ export function sessionEnvironmentFrom(source: SessionEnvironmentSource): Sessio
 		env.PI_MODEL = model.id;
 	}
 	if (source.thinkingLevel) env.PI_REASONING_LEVEL = source.thinkingLevel;
+	if (source.browserEngine) env.OMO_BROWSER_ENGINE = source.browserEngine;
 	return env;
 }
 

package/src/kernels/shared/kernel-death.ts

@@ -0,0 +1,39 @@
+import { constants } from "node:os";
+import type { EvalKernelResult, EvalLanguage } from "../../tool/types.ts";
+
+/** How the session manager hears that a kernel's interpreter died. */
+export interface KernelLifecycle {
+	/** Called once when the interpreter died on its own; the kernel then keeps its unstarted cells for `drainPending`. */
+	readonly onDeath?: (reason: string) => void;
+}
+
+/** The wording a restart notice uses for an exit nobody asked for: "signal 9", "exit code 1". */
+export function describeExit(code: number | null, signal: string | null): string {
+	if (signal !== null) {
+		const number = Object.entries(constants.signals).find(([name]) => name === signal)?.[1];
+		return `signal ${number ?? signal}`;
+	}
+	return code === null ? "an exit with no status" : `exit code ${code}`;
+}
+
+export function restartNotice(language: EvalLanguage, reason: string): string {
+	return `[${language} kernel was restarted after ${reason}; every global is lost]`;
+}
+
+export const EVAL_KERNEL_UNAVAILABLE = "eval_kernel_unavailable";
+
+/** A queued cell that never ran: its kernel died again before the replacement finished one cell. */
+export class KernelUnavailableError extends Error {
+	readonly name = "KernelUnavailableError";
+	readonly code = EVAL_KERNEL_UNAVAILABLE;
+
+	constructor(language: EvalLanguage, reason: string) {
+		super(
+			`${EVAL_KERNEL_UNAVAILABLE}: the ${language} kernel died again (${reason}) before its replacement finished a cell; this cell never ran. Run it again to start a fresh kernel.`,
+		);
+	}
+}
+
+export function unstartedResult(cellId: string, message: string): EvalKernelResult {
+	return { type: "result", cellId, ok: false, error: { message }, durationMs: 0, kernelState: "not-run" };
+}

package/src/kernels/shared/subprocess-contract.ts

@@ -2,6 +2,7 @@ import type { KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { EvalKernelRunInput, EvalLanguage } from "../../tool/types.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { KernelLifecycle } from "./kernel-death.ts";
 import type { FootprintReader } from "./kernel-memory-host.ts";
 import type { SubprocessSpawn } from "./subprocess-process.ts";
 
@@ -16,7 +17,7 @@ export interface SubprocessKernelMemory {
 	readonly readFootprint: FootprintReader;
 }
 
-export interface SubprocessKernelOptions {
+export interface SubprocessKernelOptions extends KernelLifecycle {
 	readonly command: string;
 	readonly args: readonly string[];
 	readonly cwd?: string;

package/src/kernels/shared/subprocess-kernel.ts

@@ -1,9 +1,10 @@
 import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
 import { decodeBridgeFrame, encodeBridgeFrame, isKernelToHostMessage } from "../../bridge/protocol.ts";
-import type { KernelInterruptHandle } from "../../tool/types.ts";
+import type { KernelInterruptHandle, PendingCell } from "../../tool/types.ts";
 import type { KernelToolsInvokeOptions } from "../js/kernel-tools-types.ts";
 import { rejectKernelToolsUnavailable } from "../kernel-tools-unavailable.ts";
 import { applySessionEnvironment } from "../session-env.ts";
+import { describeExit } from "./kernel-death.ts";
 import { KernelMemoryHost } from "./kernel-memory-host.ts";
 import type { KernelResult, KernelRunInput, SubprocessKernelOptions, ToolCallMessage } from "./subprocess-contract.ts";
 import { type SubprocessLike, SubprocessProcess, type SubprocessSpawn, spawnSubprocess } from "./subprocess-process.ts";
@@ -19,6 +20,7 @@ import {
 	KernelRetirementError,
 	KernelStartupError,
 	type PendingRun,
+	settlePendingRun,
 	timeoutResult,
 } from "./subprocess-run.ts";
 
@@ -43,6 +45,7 @@ export class SubprocessKernel {
 	private retirementFailure: Error | null = null;
 	private failure: Error | null = null;
 	private closed = false;
+	private dead = false;
 
 	constructor(options: SubprocessKernelOptions) {
 		this.options = options;
@@ -52,6 +55,14 @@ export class SubprocessKernel {
 		this.spawnProcess();
 	}
 
+	isAlive(): boolean {
+		return !this.dead;
+	}
+
+	drainPending(): readonly PendingCell[] {
+		return this.runs.drain().map((run) => ({ input: run.input, settle: (result) => settlePendingRun(run, result) }));
+	}
+
 	run(input: KernelRunInput): Promise<KernelResult> {
 		if (this.closed) throw new KernelClosedError();
 		const run = this.runs.enqueue(input);
@@ -243,7 +254,27 @@ export class SubprocessKernel {
 		}
 		this.process = null;
 		this.processReady = false;
-		this.failClosed(new KernelExitedError(signal ?? code ?? "unknown"));
+		const error = new KernelExitedError(signal ?? code ?? "unknown");
+		if (this.options.onDeath) this.die(error, describeExit(code, signal), this.options.onDeath);
+		else this.failClosed(error);
+	}
+
+	/**
+	 * The interpreter exited on its own and is gone: the running cell fails once (its side effects may
+	 * already have happened), the cells that never started stay queued for `drainPending`, and the owner
+	 * replaces this instance. `run()` is never reached on it again.
+	 */
+	private die(error: Error, reason: string, onDeath: (reason: string) => void): void {
+		this.failure = error;
+		this.closed = true;
+		this.dead = true;
+		this.runs.clearToolCalls();
+		const active = this.runs.active;
+		if (active) {
+			this.runs.releaseActive(active);
+			this.runs.settle(active, failureResult(active, new Error(`${error.message}; every global is lost`)));
+		}
+		onDeath(reason);
 	}
 
 	private accepts(process: SubprocessProcess): boolean {

package/src/kernels/shared/subprocess-queue.ts

@@ -44,6 +44,11 @@ export class SubprocessRunQueue {
 		};
 	}
 
+	/** Removes every queued run that has not started, oldest first. */
+	drain(): PendingRun[] {
+		return this.#queue.splice(0);
+	}
+
 	releaseActive(run: PendingRun): boolean {
 		if (this.#active !== run) return false;
 		this.#active = null;

package/src/tool/cell-runtime.ts

@@ -5,7 +5,14 @@ import { formatModelTruncationNotice } from "../output/output-meta.ts";
 import { DEFAULT_MAX_BYTES, TailLineRing } from "../output/streaming-output.ts";
 import type { EvalToolCallMetric } from "./call-capture.ts";
 import { type EvalImageResizer, EvalOutputCollector, type EvalOutputResult } from "./image.ts";
-import type { EvalMemoryDetails, EvalRuntimeInfo, EvalStatusEvent, EvalToolDetails, EvalToolInput } from "./types.ts";
+import type {
+	EvalKernelState,
+	EvalMemoryDetails,
+	EvalRuntimeInfo,
+	EvalStatusEvent,
+	EvalToolDetails,
+	EvalToolInput,
+} from "./types.ts";
 
 const LIVE_UPDATE_LINES = 8;
 /** Same cadence as the core bash tool's streaming updates (BASH_UPDATE_THROTTLE_MS). */
@@ -48,6 +55,8 @@ export class CellResultBuilder {
 	readonly #output: EvalOutputCollector;
 	readonly #state: CellState;
 	#memory: KernelMemoryReport | undefined;
+	#restartNotice: string | undefined;
+	#kernelState: EvalKernelState | undefined;
 	readonly #liveLines = new TailLineRing({ maxBytes: DEFAULT_MAX_BYTES * 2, maxLines: LIVE_UPDATE_LINES });
 	#lastOutputUpdateAt = 0;
 	#outputUpdateTimer: ReturnType<typeof setTimeout> | undefined;
@@ -85,6 +94,8 @@ export class CellResultBuilder {
 	async finalize(result: KernelResult): Promise<AgentToolResult<EvalToolDetails>> {
 		this.#state.durationMs = result.durationMs;
 		this.#memory = result.memory;
+		this.#restartNotice = result.notice;
+		this.#kernelState = result.kernelState;
 		if (result.ok) {
 			if (result.valueRepr) this.#output.pushValue(`${result.valueRepr}\n`);
 			this.#state.status = "complete";
@@ -160,9 +171,10 @@ export class CellResultBuilder {
 				? `(displayed ${output.images.length} image${output.images.length === 1 ? "" : "s"}; no text output)`
 				: "(no output)");
 		const text = output.meta === undefined ? shown : `${shown}\n${formatModelTruncationNotice(output.meta)}`;
-		const notice = this.#memory?.notice;
-		const noticePart = notice === undefined ? [] : [{ type: "text" as const, text: notice }];
-		return { content: [{ type: "text", text }, ...noticePart, ...output.images], details };
+		const noticeParts = [this.#restartNotice, this.#memory?.notice].flatMap((notice) =>
+			notice === undefined ? [] : [{ type: "text" as const, text: notice }],
+		);
+		return { content: [{ type: "text", text }, ...noticeParts, ...output.images], details };
 	}
 
 	#details(output: EvalOutputResult | undefined, isError: boolean): EvalToolDetails {
@@ -202,6 +214,7 @@ export class CellResultBuilder {
 			...(output?.notice === undefined ? {} : { notice: output.notice }),
 			...(output?.meta === undefined ? {} : { meta: output.meta }),
 			...(output === undefined || this.#memory === undefined ? {} : { memory: memoryDetails(this.#memory) }),
+			...(this.#kernelState === undefined ? {} : { kernelState: this.#kernelState }),
 		};
 	}
 

package/src/tool/detached-cell-notification.ts

@@ -2,7 +2,7 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import type { EvalDetachedCellNotification, EvalDetachedCellSnapshot } from "./detached-cell-manager.ts";
 import { interruptionStateNote, unknownInterruptionStateNote } from "./interrupt-note.ts";
-import type { EvalMemoryDetails } from "./types.ts";
+import type { EvalKernelState, EvalMemoryDetails } from "./types.ts";
 
 const NOTIFICATION_TAIL_BYTES = 512;
 
@@ -78,11 +78,22 @@ function outcomeOf(cell: EvalDetachedCellSnapshot): string {
 }
 
 function stateNoteOf(cell: EvalDetachedCellSnapshot): string {
-	if (cell.state !== "cancelled") return memoryStateNote(cell.result.details?.memory);
+	if (cell.state !== "cancelled") {
+		const kernelState = cell.result.details?.kernelState;
+		return kernelState === undefined ? memoryStateNote(cell.result.details?.memory) : KERNEL_STATE_NOTES[kernelState];
+	}
 	const note = interruptionStateNote(cell.language, cell.stateRetained) ?? unknownInterruptionStateNote(cell.language);
 	return cell.interruptNote === undefined ? note : `${note} ${cell.interruptNote.trim()}`;
 }
 
+/** A kernel death decides what survived, whatever the memory report says. */
+const KERNEL_STATE_NOTES: Readonly<Record<EvalKernelState, string>> = {
+	lost: "The kernel died while this cell ran - every global is lost; the next eval cell runs on a fresh kernel.",
+	restarted:
+		"The kernel was restarted before this cell ran - globals from earlier cells are gone; this cell's variables are available to the next eval cell.",
+	"not-run": "This cell never ran and changed no kernel state.",
+};
+
 export function memoryStateNote(memory: EvalMemoryDetails | undefined): string {
 	if (memory?.overCeiling === true)
 		return "Kernel memory is over its ceiling - the kernel restarts before the next eval cell and every global is lost.";

package/src/tool/types.ts

@@ -161,6 +161,12 @@ export interface KernelInterruptHandle {
 	readonly note?: string;
 }
 
+/** An unstarted cell a dead kernel hands back, so its replacement runs it with the same input and callbacks. */
+export interface PendingCell {
+	readonly input: EvalKernelRunInput;
+	readonly settle: (result: EvalKernelResult) => void;
+}
+
 export interface EvalKernel {
 	run(input: EvalKernelRunInput): Promise<EvalKernelResult>;
 	cancelQueued(cellId: string, reason: string): boolean;
@@ -171,6 +177,10 @@ export interface EvalKernel {
 	close(): Promise<void>;
 	/** Names this kernel has registered; JS collides with other languages in the same session. */
 	listKernelToolNames?(): readonly string[];
+	/** False once the interpreter died on its own; the session manager then replaces the instance. */
+	isAlive?(): boolean;
+	/** Hands over, and forgets, every queued cell of a dead kernel that never started. */
+	drainPending?(): readonly PendingCell[];
 }
 
 export interface EvalKernelManager {
@@ -273,6 +283,10 @@ export interface EvalToolDetails {
 	readonly meta?: TruncationMeta;
 	/** Kernel memory after the cell; its notice text is delivered as its own content part. */
 	readonly memory?: EvalMemoryDetails;
+	/** What a kernel death did to this cell's state, when one did. */
+	readonly kernelState?: EvalKernelState;
 }
 
+export type EvalKernelState = NonNullable<EvalKernelResult["kernelState"]>;
+
 export type EvalMemoryDetails = Omit<KernelMemoryReport, "notice">;