@code-yeongyu/senpi-codemode 2026.10.6 → 2026.10.8

package/src/kernels/py/process.ts

@@ -22,6 +22,13 @@ export interface KernelSpawnOptions {
 
 export type KernelSpawnProcess = (options: KernelSpawnOptions) => KernelChild;
 
+/** Signals a kernel's whole process group (addressed by its leader pid); throws like `process.kill`. */
+export type KillProcessGroup = (pid: number, signal: NodeJS.Signals) => void;
+
+export const killProcessGroup: KillProcessGroup = (pid, signal) => {
+	process.kill(-pid, signal);
+};
+
 export class PythonKernelRetirementError extends Error {
 	constructor(pid: number | undefined) {
 		super(`Python kernel process${pid === undefined ? "" : ` ${pid}`} did not exit after SIGKILL`);
@@ -95,10 +102,10 @@ export async function waitForExit(child: KernelChild, timeoutMs: number): Promis
 // A cell's own subprocess is spawned into the detached kernel's process group. When the
 // leader exits gracefully on close, kill the group so a Popen the cell left running does
 // not outlive the kernel; the group is addressed by the leader pid (== pgid) while members live.
-export function sweepProcessGroup(child: KernelChild): void {
+export function sweepProcessGroup(child: KernelChild, killGroup: KillProcessGroup = killProcessGroup): void {
 	if (child.pid === undefined || process.platform === "win32") return;
 	try {
-		process.kill(-child.pid, "SIGKILL");
+		killGroup(child.pid, "SIGKILL");
 	} catch (error) {
 		// ESRCH means the group is already gone (the success case). Any other error
 		// (for example EPERM on a member we cannot signal) must not fail a graceful close.
@@ -106,7 +113,11 @@ export function sweepProcessGroup(child: KernelChild): void {
 	}
 }
 
-export async function hardKill(child: KernelChild, timeoutMs: number): Promise<void> {
+export async function hardKill(
+	child: KernelChild,
+	timeoutMs: number,
+	killGroup: KillProcessGroup = killProcessGroup,
+): Promise<void> {
 	await new Promise<void>((resolve, reject) => {
 		let timer: NodeJS.Timeout | undefined;
 		let settled = false;
@@ -123,7 +134,7 @@ export async function hardKill(child: KernelChild, timeoutMs: number): Promise<v
 		let signalDelivered = true;
 		if (child.pid !== undefined && process.platform !== "win32") {
 			try {
-				process.kill(-child.pid, "SIGKILL");
+				killGroup(child.pid, "SIGKILL");
 			} catch (error) {
 				if (!(error instanceof Error)) {
 					settle(new Error(String(error)));

package/src/kernels/py/startup.ts

@@ -1,10 +1,20 @@
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 
-// Fresh-cache Windows bootstrap: p99 5,220 ms across 30 samples in Actions run
-// 36882163342. Twice that observation, rounded up to a second, is a hang guard,
-// not a total startup budget: only an advancing kernel stage rearms it.
+/**
+ * How long a starting interpreter may stay completely still before startup fails: no new stage, no output
+ * line, and no CPU used. A cold, contended interpreter importing the stdlib emits nothing for seconds but
+ * keeps the CPU busy, so it never trips; only one that is silent AND idle does. Fresh-cache Windows
+ * bootstraps measured p99 5,220 ms of mostly import time (Actions run 36882163342), so 11 s of complete
+ * stillness is a stall, not a slow start.
+ */
 export const pythonStartupHangGuardMs = 11_000;
 
+/**
+ * Total startup budget, a backstop for an interpreter that keeps burning CPU without ever reaching
+ * `ready` (a livelock). Over twenty times the slowest measured cold start; never reached by a real one.
+ */
+export const pythonStartupCeilingMs = 120_000;
+
 const stages = ["interpreter-launch", "stdlib-imports", "runtime-init", "host-init"] as const;
 export type PythonStartupStage = (typeof stages)[number];
 
@@ -18,19 +28,30 @@ export class PythonKernelStartupError extends Error {
 	}
 }
 
-/** Owns the ready event and a per-stage inactivity watchdog, never a total deadline. */
+export interface PythonStartupOptions {
+	readonly noProgressMs: number;
+	readonly ceilingMs: number;
+	readonly failureDetail: () => string;
+	/** CPU used so far by the interpreter (any unit that only grows); `undefined` when unreadable. */
+	readonly readCpuTime: () => bigint | undefined;
+}
+
 export class PythonStartup {
-	readonly #timeoutMs: number;
-	readonly #failureDetail: () => string;
+	readonly #options: PythonStartupOptions;
 	readonly #ready = Promise.withResolvers<void>();
 	readonly ready = this.#ready.promise;
+	readonly #ceiling: NodeJS.Timeout;
 	#timer: NodeJS.Timeout | undefined;
 	#stageIndex = 0;
+	#lastCpu: bigint | undefined;
 	#settled = false;
 
-	constructor(timeoutMs: number, failureDetail: () => string) {
-		this.#timeoutMs = timeoutMs;
-		this.#failureDetail = failureDetail;
+	constructor(options: PythonStartupOptions) {
+		this.#options = options;
+		this.#ceiling = setTimeout(
+			() => this.#fail(`not ready after ${Math.round(options.ceilingMs / 1000)} s`),
+			options.ceilingMs,
+		);
 		this.#arm();
 	}
 
@@ -45,31 +66,48 @@ export class PythonStartup {
 		return stage;
 	}
 
+	activity(): void {
+		if (!this.#settled) this.#arm();
+	}
+
 	settle(error?: Error): boolean {
 		if (this.#settled) return false;
 		this.#settled = true;
 		clearTimeout(this.#timer);
+		clearTimeout(this.#ceiling);
 		if (error) {
-			const stage = stages[this.#stageIndex] ?? "interpreter-launch";
 			this.#ready.reject(
 				error instanceof PythonKernelStartupError
 					? error
-					: new PythonKernelStartupError(stage, error.message, error),
+					: new PythonKernelStartupError(this.#stage(), error.message, error),
 			);
 		} else this.#ready.resolve();
 		return true;
 	}
 
 	#arm(): void {
+		this.#lastCpu = this.#options.readCpuTime();
 		clearTimeout(this.#timer);
-		this.#timer = setTimeout(() => {
-			const detail = this.#failureDetail().trim();
-			this.settle(
-				new PythonKernelStartupError(
-					stages[this.#stageIndex] ?? "interpreter-launch",
-					`no progress for ${this.#timeoutMs}ms${detail ? `; ${detail}` : ""}`,
-				),
-			);
-		}, this.#timeoutMs);
+		this.#timer = setTimeout(() => this.#expire(), this.#options.noProgressMs);
+	}
+
+	#expire(): void {
+		if (this.#settled) return;
+		const cpu = this.#options.readCpuTime();
+		// Where CPU can't be read, stage and output are the only signs of life, as before.
+		if (cpu !== undefined && cpu !== this.#lastCpu) {
+			this.#arm();
+			return;
+		}
+		this.#fail(`no output, stage change or CPU use for ${this.#options.noProgressMs}ms`);
+	}
+
+	#fail(reason: string): void {
+		const detail = this.#options.failureDetail().trim();
+		this.settle(new PythonKernelStartupError(this.#stage(), `${reason}${detail ? `; ${detail}` : ""}`));
+	}
+
+	#stage(): PythonStartupStage {
+		return stages[this.#stageIndex] ?? "interpreter-launch";
 	}
 }

package/src/kernels/py/transport.ts

@@ -11,6 +11,7 @@ import {
 } from "../../bridge/protocol.ts";
 import { applySessionEnvironment, type SessionEnvironment } from "../session-env.ts";
 import type { KernelPreludePlan } from "../shared/kernel-prelude-plan.ts";
+import { readKernelCpuTime } from "../shared/process-cpu.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import {
 	defaultSpawn,
@@ -18,6 +19,7 @@ import {
 	type KernelChild,
 	type KernelSpawnOptions,
 	type KernelSpawnProcess,
+	type KillProcessGroup,
 	numberOrNull,
 	signalOrNull,
 	splitCommand,
@@ -44,8 +46,13 @@ export interface PythonTransportOptions {
 	/** Per-session PI_* values merged into the interpreter environment at spawn. */
 	readonly sessionEnv?: SessionEnvironment;
 	readonly startupTimeoutMs: number;
+	readonly startupCeilingMs: number;
+	readonly readCpuTime?: (pid: number | undefined) => bigint | undefined;
+	readonly killProcessGroup?: KillProcessGroup;
 	readonly onStartupProgress?: (stage: PythonStartupStage) => void;
 	readonly memory?: KernelMemoryThresholds;
+	/** Kernel-tool descriptors carry this; a restarted interpreter gets a new one, so old descriptors go stale. */
+	readonly kernelGeneration?: number;
 	readonly onMessage?: (message: KernelToHostMessage) => void;
 	readonly spawnProcess?: KernelSpawnProcess;
 	readonly isOwned: () => boolean;
@@ -140,6 +147,11 @@ export class PythonKernelTransport {
 		return transport;
 	}
 
+	/** Kernel-tool frames for the runner's control reader (served even while a cell runs). */
+	post(message: HostToKernelMessage): void {
+		if (this.#active && !this.#exited) this.#write(message);
+	}
+
 	run(input: PythonTransportRunInput): void {
 		const preludes = input.preludePlan && {
 			install: input.preludePlan.install.map(({ exports, python }) => ({ exports: [...exports], python })),
@@ -166,7 +178,7 @@ export class PythonKernelTransport {
 			return;
 		}
 		if (!this.#active) {
-			await hardKill(this.#child, hardKillWaitMs);
+			await hardKill(this.#child, hardKillWaitMs, this.#options.killProcessGroup);
 			return;
 		}
 		this.#active = false;
@@ -178,15 +190,15 @@ export class PythonKernelTransport {
 		}
 		// hardKill kills the whole group; a graceful leader exit does not, so sweep it
 		// to retire any subprocess the cell left running in the kernel's process group.
-		if (await exited) sweepProcessGroup(this.#child);
-		else await hardKill(this.#child, hardKillWaitMs);
+		if (await exited) sweepProcessGroup(this.#child, this.#options.killProcessGroup);
+		else await hardKill(this.#child, hardKillWaitMs, this.#options.killProcessGroup);
 	}
 
 	retire(): Promise<void> {
 		if (this.#exited || this.#isGone) return Promise.resolve();
 		if (this.#retirement) return this.#retirement;
 		this.#active = false;
-		const retirement = hardKill(this.#child, hardKillWaitMs).finally(() => {
+		const retirement = hardKill(this.#child, hardKillWaitMs, this.#options.killProcessGroup).finally(() => {
 			this.#detachListeners();
 			if (this.#retirement === retirement) this.#retirement = null;
 		});
@@ -195,7 +207,16 @@ export class PythonKernelTransport {
 	}
 
 	async #initialize(): Promise<void> {
-		const startup = new PythonStartup(this.#options.startupTimeoutMs, () => this.#stderrTail);
+		const pid = this.#child.pid;
+		const startup = new PythonStartup({
+			noProgressMs: this.#options.startupTimeoutMs,
+			ceilingMs: this.#options.startupCeilingMs,
+			failureDetail: () => this.#stderrTail,
+			readCpuTime: () => {
+				if (this.#options.readCpuTime) return this.#options.readCpuTime(pid);
+				return pid === undefined ? undefined : readKernelCpuTime(pid);
+			},
+		});
 		this.#startup = startup;
 		const onStdout = (chunk: unknown) => this.#onStdout(String(chunk));
 		const onStderr = (chunk: unknown) => this.#onStderr(String(chunk));
@@ -211,8 +232,14 @@ export class PythonKernelTransport {
 		this.#child.stderr.on("data", onStderr);
 		this.#child.on("error", onError);
 		this.#child.on("exit", onExit);
-		const { sessionId, connection, memory } = this.#options;
-		this.#write({ type: "init", sessionId, connection, ...(memory === undefined ? {} : { memory }) });
+		const { sessionId, connection, memory, kernelGeneration } = this.#options;
+		this.#write({
+			type: "init",
+			sessionId,
+			connection,
+			...(memory === undefined ? {} : { memory }),
+			...(kernelGeneration === undefined ? {} : { kernelGeneration }),
+		});
 		await startup.ready;
 	}
 
@@ -234,6 +261,7 @@ export class PythonKernelTransport {
 
 	#onStderr(chunk: string): void {
 		if (!this.#active) return;
+		this.#startup?.activity();
 		this.#stderrTail = `${this.#stderrTail}${chunk}`.slice(-4_000);
 		this.#options.onMessage?.({ type: "text", stream: "stderr", data: chunk });
 	}
@@ -251,6 +279,7 @@ export class PythonKernelTransport {
 			if (stage !== undefined) this.#options.onStartupProgress?.(stage);
 			return;
 		}
+		if (message.type === "text") this.#startup?.activity();
 		if (message.type === "ready") this.#settleStartup();
 		else if (message.type === "init-failed") this.#settleStartup(new Error(message.error.message));
 		else if (message.type === "result") this.#options.onResult(this, message);

package/src/kernels/rb/handles.rb

@@ -0,0 +1,97 @@
+# In-cell wait()/handle() over the host's handle capability. Mirrors src/bridge/reserved.ts.
+SENPI_RESERVED_WAIT_TOOL = "__wait__"
+SENPI_RESERVED_HANDLE_STATUS_TOOL = "__handle_status__"
+SENPI_RESERVED_HANDLE_OUTPUT_TOOL = "__handle_output__"
+SENPI_RESERVED_HANDLE_SEND_TOOL = "__handle_send__"
+SENPI_RESERVED_HANDLE_CANCEL_TOOL = "__handle_cancel__"
+SENPI_HANDLE_KINDS = ["agent", "completion", "workpool"].freeze
+SENPI_WAIT_MODES = ["all", "any", "settled"].freeze
+SENPI_WAIT_SOCKET_GRACE_SECONDS = 30
+SENPI_HANDLE_USAGE = "handle() expects an agent(..., handle: true) record, a workpool, a completion handle, or a saved {kind, id, run_epoch} reference"
+
+def __senpi_handle_ref(value)
+  return value.ref.dup if value.respond_to?(:ref) && value.respond_to?(:control)
+  return { "kind" => "workpool", "id" => value.pool_id, "run_epoch" => 0 } if value.is_a?(SenpiWorkpool)
+  raise TypeError, SENPI_HANDLE_USAGE unless value.is_a?(Hash)
+  record = value.transform_keys(&:to_s)
+  return { "kind" => "workpool", "id" => record["pool_id"], "run_epoch" => 0 } if record["pool_id"].is_a?(String)
+  kind = record["kind"]
+  unless SENPI_HANDLE_KINDS.include?(kind)
+    scheme = record["handle"].is_a?(String) ? record["handle"].split("://", 2).first : nil
+    kind = SENPI_HANDLE_KINDS.include?(scheme) ? scheme : nil
+  end
+  identity = record.fetch("id", record["task_id"])
+  raise TypeError, SENPI_HANDLE_USAGE if kind.nil? || !identity.is_a?(String) || identity.empty?
+  run_epoch = record.fetch("run_epoch", kind == "workpool" ? 0 : nil)
+  raise TypeError, "#{SENPI_HANDLE_USAGE}; run_epoch must be a non-negative integer" unless run_epoch.is_a?(Integer) && run_epoch >= 0
+  { "kind" => kind, "id" => identity, "run_epoch" => run_epoch }
+end
+
+# A long-lived request: ordinary calls keep their 60 s read timeout; this one is bounded by the explicit
+# timeout (plus grace for the host's reply) or else only by the cell's own end: SIGINT from the host (cancel,
+# the cell's hard limit) interrupts the read, which closes the socket and the host-side subscription.
+def __senpi_wait_post(args, timeout)
+  read_timeout = timeout.nil? ? nil : timeout.to_f + SENPI_WAIT_SOCKET_GRACE_SECONDS
+  payload = { "callId" => "rb-#{Process.pid}-#{rand(1_000_000)}", "toolName" => SENPI_RESERVED_WAIT_TOOL, "args" => args }
+  __senpi_bridge_request("/call", payload, read_timeout: read_timeout)
+end
+
+def __senpi_wait(handles, timeout: nil, mode: "all")
+  items = handles.nil? ? [] : handles.is_a?(Array) ? handles : [handles]
+  unless timeout.nil? || (timeout.is_a?(Numeric) && timeout.to_f.finite? && timeout >= 0)
+    raise ArgumentError, "wait() timeout must be a finite number of seconds >= 0"
+  end
+  raise ArgumentError, "wait() mode must be 'all', 'any' or 'settled'" unless SENPI_WAIT_MODES.include?(mode.to_s)
+  args = { "refs" => items.map { |item| __senpi_handle_ref(item) }, "mode" => mode.to_s }
+  args["timeout"] = timeout unless timeout.nil?
+  __senpi_wait_post(args, timeout)
+end
+
+class SenpiHandleControl
+  def initialize(ref)
+    @ref = ref.dup.freeze
+    freeze
+  end
+
+  def status
+    __senpi_call_tool(SENPI_RESERVED_HANDLE_STATUS_TOOL, { "ref" => @ref })
+  end
+
+  def output(format: "raw", offset: nil, limit: nil)
+    args = { "ref" => @ref, "format" => format }
+    args["offset"] = offset unless offset.nil?
+    args["limit"] = limit unless limit.nil?
+    __senpi_call_tool(SENPI_RESERVED_HANDLE_OUTPUT_TOOL, args)
+  end
+
+  def send_message(message)
+    __senpi_call_tool(SENPI_RESERVED_HANDLE_SEND_TOOL, { "ref" => @ref, "message" => message.to_s })
+  end
+  # Deliberately shadows Object#send so control.send(msg) matches the other languages; use __send__ for reflection.
+  alias send send_message
+
+  def cancel
+    __senpi_call_tool(SENPI_RESERVED_HANDLE_CANCEL_TOOL, { "ref" => @ref })
+  end
+
+  def wait(timeout: nil)
+    __senpi_wait([@ref], timeout: timeout, mode: "all")[0]
+  end
+
+  def inspect
+    "#<handle.control #{@ref["kind"]}://#{@ref["id"]}@#{@ref["run_epoch"]}>"
+  end
+end
+
+# The legacy record's fields as a Hash copy; `control` and `ref` are singleton methods, never keys.
+def __senpi_handle_view(value)
+  ref = __senpi_handle_ref(value)
+  view = value.is_a?(Hash) ? value.transform_keys(&:to_s).reject { |_key, item| item.respond_to?(:call) } : {}
+  view["id"] ||= ref["id"]
+  view["run_epoch"] ||= ref["run_epoch"]
+  view["handle"] ||= "#{ref["kind"]}://#{ref["id"]}"
+  control = SenpiHandleControl.new(ref)
+  view.define_singleton_method(:control) { control }
+  view.define_singleton_method(:ref) { ref.dup }
+  view
+end

package/src/kernels/rb/paths.rb

@@ -0,0 +1,37 @@
+# Path resolution (local:// roots) and display payload shaping for the Ruby prelude helpers.
+def __senpi_resolve_path(value)
+  raw = value.to_s
+  match = SENPI_INTERNAL_URL.match(raw)
+  return File.expand_path(raw) unless match
+
+  scheme = match[1].downcase
+  roots = $__senpi_connection.is_a?(Hash) ? $__senpi_connection["localRoots"] : nil
+  root = roots[scheme] if roots.is_a?(Hash)
+  raise "Protocol paths are not supported by this helper: #{raw}" unless root.is_a?(String) && !root.empty?
+
+  relative = URI::DEFAULT_PARSER.unescape(match[2].tr("\\", "/"))
+  root_path = File.expand_path(root)
+  return root_path if relative.empty?
+  if relative.start_with?("/") || relative.split("/").include?("..")
+    raise "Unsafe #{scheme}:// path (absolute or traversal): #{raw}"
+  end
+
+  resolved = File.expand_path(relative, root_path)
+  unless resolved == root_path || resolved.start_with?(root_path + File::SEPARATOR)
+    raise "#{scheme}:// path escapes its root: #{raw}"
+  end
+  resolved
+end
+
+def __senpi_display_payload(value)
+  if value.is_a?(Hash)
+    kind = value["type"] || value[:type]
+    text_value = value["text"] || value[:text]
+    return ["text/markdown", text_value.to_s] if kind == "markdown" && !text_value.nil?
+    return ["image/png", value["data"].to_s] if kind == "image" && value["mimeType"] == "image/png"
+    return ["image/jpeg", value["data"].to_s] if kind == "image" && value["mimeType"] == "image/jpeg"
+    return ["application/json", JSON.generate(value)]
+  end
+  return ["application/json", JSON.generate(value)] if value.is_a?(Array)
+  ["text/plain", value.to_s]
+end

package/src/kernels/rb/prelude.rb

@@ -19,42 +19,7 @@ def __senpi_emit_status(op, fields = {}, force: false)
   __senpi_emit({ "type" => "status", "event" => { "op" => op }.merge(fields.transform_keys(&:to_s)) })
 end
 
-def __senpi_resolve_path(value)
-  raw = value.to_s
-  match = SENPI_INTERNAL_URL.match(raw)
-  return File.expand_path(raw) unless match
-
-  scheme = match[1].downcase
-  roots = $__senpi_connection.is_a?(Hash) ? $__senpi_connection["localRoots"] : nil
-  root = roots[scheme] if roots.is_a?(Hash)
-  raise "Protocol paths are not supported by this helper: #{raw}" unless root.is_a?(String) && !root.empty?
-
-  relative = URI::DEFAULT_PARSER.unescape(match[2].tr("\\", "/"))
-  root_path = File.expand_path(root)
-  return root_path if relative.empty?
-  if relative.start_with?("/") || relative.split("/").include?("..")
-    raise "Unsafe #{scheme}:// path (absolute or traversal): #{raw}"
-  end
-
-  resolved = File.expand_path(relative, root_path)
-  unless resolved == root_path || resolved.start_with?(root_path + File::SEPARATOR)
-    raise "#{scheme}:// path escapes its root: #{raw}"
-  end
-  resolved
-end
-
-def __senpi_display_payload(value)
-  if value.is_a?(Hash)
-    kind = value["type"] || value[:type]
-    text_value = value["text"] || value[:text]
-    return ["text/markdown", text_value.to_s] if kind == "markdown" && !text_value.nil?
-    return ["image/png", value["data"].to_s] if kind == "image" && value["mimeType"] == "image/png"
-    return ["image/jpeg", value["data"].to_s] if kind == "image" && value["mimeType"] == "image/jpeg"
-    return ["application/json", JSON.generate(value)]
-  end
-  return ["application/json", JSON.generate(value)] if value.is_a?(Array)
-  ["text/plain", value.to_s]
-end
+require_relative "paths"
 
 def display(value)
   mime_type, payload = __senpi_display_payload(value)
@@ -118,7 +83,7 @@ def env(key = nil, value = nil)
   resolved
 end
 
-def __senpi_bridge_request(path, payload)
+def __senpi_bridge_request(path, payload, read_timeout: 60)
   connection = $__senpi_connection
   raise "Ruby tool bridge is not initialized" unless connection.is_a?(Hash)
   port = connection["port"]
@@ -132,7 +97,7 @@ def __senpi_bridge_request(path, payload)
   request.body = JSON.generate(payload)
   __senpi_emit_status("timeout-pause", force: true)
   begin
-    response = Net::HTTP.start(uri.hostname, uri.port, open_timeout: 10, read_timeout: 60) { |http| http.request(request) }
+    response = Net::HTTP.start(uri.hostname, uri.port, open_timeout: 10, read_timeout: read_timeout) { |http| http.request(request) }
   ensure
     __senpi_emit_status("timeout-resume", force: true)
   end
@@ -187,12 +152,24 @@ def tool
 end
 
 require_relative "workpool"
+require_relative "handles"
+
+# Block until the handles settle; never cancels work. See tool_schema("eval:wait").
+def wait(handles, timeout: nil, mode: "all")
+  __senpi_wait(handles, timeout: timeout, mode: mode)
+end
+
+# Rich view of an agent record, workpool, completion handle or saved reference; see tool_schema("eval:helpers").
+def handle(value)
+  __senpi_handle_view(value)
+end
 
 def completion(prompt, model: "default", system: nil, schema: nil, **kwargs)
   options = { "model" => model }.merge(kwargs.transform_keys(&:to_s))
   options["system"] = system unless system.nil?
   options["schema"] = schema unless schema.nil?
   result = __senpi_bridge_request("/completion", { "prompt" => prompt.to_s, "opts" => options })
+  return handle(result) if options["handle"] == true
   return result unless result.is_a?(Hash)
   return result["value"] if result.key?("value")
 

package/src/kernels/rb/runner.rb

@@ -165,27 +165,27 @@ class SenpiGlobalSizer
     return ObjectSpace.memsize_of(value) if Integer === value || Float === value
     return 0 if @seen.key?(value)
     @seen[value] = true
-    return SENPI_SIZER_OBJECT + SENPI_STRING_BYTESIZE.bind_call(value) if String === value
+    return SENPI_SIZER_OBJECT + SENPI_STRING_BYTESIZE.bind(value).call() if String === value
     if depth >= SENPI_SIZER_MAX_DEPTH || @nodes >= SENPI_SIZER_NODE_BUDGET
       @approximate = true
       return ObjectSpace.memsize_of(value)
     end
     if Array === value
-      length = SENPI_ARRAY_SIZE.bind_call(value)
-      SENPI_SIZER_OBJECT + length * SENPI_SIZER_POINTER + sampled(length, depth) { |index| SENPI_ARRAY_AT.bind_call(value, index) }
+      length = SENPI_ARRAY_SIZE.bind(value).call()
+      SENPI_SIZER_OBJECT + length * SENPI_SIZER_POINTER + sampled(length, depth) { |index| SENPI_ARRAY_AT.bind(value).call(index) }
     elsif Hash === value
       hash_size(value, depth)
     else
-      ivars = SENPI_IVARS.bind_call(value)
-      ObjectSpace.memsize_of(value) + sampled(ivars.length, depth) { |index| SENPI_IVAR_GET.bind_call(value, ivars[index]) }
+      ivars = SENPI_IVARS.bind(value).call()
+      ObjectSpace.memsize_of(value) + sampled(ivars.length, depth) { |index| SENPI_IVAR_GET.bind(value).call(ivars[index]) }
     end
   end
 
   def hash_size(hash, depth)
-    count = SENPI_HASH_SIZE.bind_call(hash)
+    count = SENPI_HASH_SIZE.bind(hash).call()
     taken = 0
     total = 0
-    SENPI_HASH_EACH.bind_call(hash) do |key, item|
+    SENPI_HASH_EACH.bind(hash).call() do |key, item|
       total += size(key, depth + 1) + size(item, depth + 1)
       taken += 1
       break if taken >= SENPI_SIZER_SAMPLE

package/src/kernels/sandbox/vendor/pi-codemode/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/kernels/sandbox/vendor/pi-codemode/VENDORED.md

@@ -0,0 +1,42 @@
+# Vendored: @earendil-works/pi-codemode 1.0.1
+
+- Upstream: https://github.com/earendil-works/pi, directory `packages/codemode/src`
+- Tag `v1.0.1`, commit `a7229ddc21810d6245105978033b7df645ecc2f7` (`packages/codemode/package.json` version 1.0.1)
+- License: MIT, upstream `LICENSE` copied unchanged beside this file.
+- Why vendored: the published package ships compiled `dist` only, and senpi needs three host changes that are not in any release (listed below once they land). Vendoring the source keeps them in this repository, so a registry consumer receives them.
+
+## Provenance
+
+Building `packages/codemode` at that commit with its pinned compiler (`typescript` 7.0.2, `tsc -p tsconfig.build.json`) reproduces all 40 files of the published npm `@earendil-works/pi-codemode@1.0.1` `dist` byte for byte, so this source is the released code.
+
+Each file below starts with a two-line attribution header. `wasm.ts` and `identifier.ts` are otherwise the upstream file unchanged. The other five carry the local changes listed below, and nothing else: outside the `senpi-change` blocks and the lines marked `// senpi-change`, every line is upstream's, in upstream's order. The SHA-256 is of the upstream file.
+
+| file | upstream SHA-256 |
+| --- | --- |
+| `runtime/host.ts` | `b81e1bb07f3cd7e612c5ed03b6d23929acf3738be764c0741b85306d8221c522` |
+| `runtime/worker.ts` | `f2e4854de6c9713390148a7d02b35e753065aca42c759ca14676f90f937f0a8a` |
+| `runtime/prelude-source.ts` | `bd544106d5bd36543be4e5fc21128c9cd46b26856fb0b17931250b955f93c24a` |
+| `runtime/protocol.ts` | `b5150df8e6c743f99a94f13cf6f4ae7515768bb9e6305e1a7e4dacd20e4dc6ff` |
+| `types.ts` | `a54fd8d97468bedd16cc1aae6d89648581da90bd55f65bb0b116c947893b5920` |
+| `wasm.ts` | `0785024745568c86611b00a82f2bc8f70fc1559eff7200e64a449ebbeeeebb94` |
+| `identifier.ts` | `c920a297e79186edc61348906950b639e8d67602122f165fb98012fd32be2f11` |
+
+Only these seven files are vendored: the closure of `runtime/host.ts` (the sandbox host). `index.ts`, `source.ts` and `declarations.ts` are not used.
+
+## Local changes
+
+Every change is marked, in one of two ways, so a sync can find each one:
+
+- a block between `// senpi-change begin: <topic>` and `// senpi-change end`, which adds code or replaces the upstream lines it stands in place of (for example `types.ts`'s `CodemodeResult`, and the end of `finish()` in `runtime/host.ts`);
+- a single upstream line edited in place, ending in `// senpi-change` (an extra import name, the `"output-frame"` message type in `isWorkerToHostMessage`, the prelude's `optionsJson` parameter and its stream-mode output-cap condition).
+
+A sync must re-apply both kinds: dropping a marked line (for example `"output-frame"` in the protocol guard) would make the host ignore every frame. Each one is an option whose default is upstream's behaviour: with the defaults, the ported upstream suite (`test/sandbox/vendor/upstream-sandbox.test.ts`, 47 cases, only its imports changed) passes unchanged.
+
+1. **Output streaming** (`output: "stream"`, `onOutputFrame`, `windowBytes`, `frameBytes`; `types.ts`, `runtime/protocol.ts`, `runtime/worker.ts`, `runtime/host.ts`, `runtime/prelude-source.ts`). Upstream keeps every output item until the script settles, which is why it caps output at 16 Mi characters. In stream mode:
+   - The host keeps nothing; `result.output` stays empty and `result.streamed` reports frames and the peak bytes in flight.
+   - The worker splits each item into frames of at most `frameBytes` (default 64 KiB), never splitting a surrogate pair, tagged with item id, sequence and a final flag.
+   - It sends a frame only after taking that many bytes from a shared credit counter (default window 256 KiB). It sleeps on the counter with `Atomics.wait` while the window is full, and re-checks the interrupt flag each time it wakes.
+   - The host hands frames to the consumer one at a time, in order, and returns their credit only once the consumer has finished. The output cap does not apply, because memory is bounded by the window.
+   - A normal finish settles only after every frame is consumed. An abort or timeout settles at once and drops frames still queued. The timer and the abort signal stay armed while a finished run's last frames drain, so a late abort, timeout or `close()` abandons them too (the run settles with that error): a consumer that never returns cannot keep a run alive.
+   - `frameBytes` and `windowBytes` must be at least 4, so a frame can always hold a whole surrogate pair.
+2. **Builtin store policy** (`builtins: { store: "collect" | "reject" }`; `types.ts`, `runtime/protocol.ts`, `runtime/worker.ts`, `runtime/host.ts`, `runtime/prelude-source.ts`). With `"reject"`, `load()` returns `undefined` and `store()` throws `CodemodeStoreDisabledError`. The names stay defined, so scripts written for upstream fail with a clear message instead of a ReferenceError.

package/src/kernels/sandbox/vendor/pi-codemode/identifier.ts

@@ -0,0 +1,14 @@
+// Vendored from https://github.com/earendil-works/pi (packages/codemode/src) at v1.0.1, commit a7229ddc21810d6245105978033b7df645ecc2f7.
+// MIT license; see LICENSE beside this file. Local changes are listed in VENDORED.md.
+/**
+ * The identifier a script uses for a tool: characters that are not valid in a JavaScript
+ * identifier become `_`. `mcp__docs__search` stays as is, `my-tool` becomes `my_tool`.
+ */
+export function toCodemodeIdentifier(name: string): string {
+	let identifier = "";
+	for (const char of name) {
+		const valid = identifier === "" ? /^[A-Za-z_$]$/.test(char) : /^[A-Za-z0-9_$]$/.test(char);
+		identifier += valid ? char : "_";
+	}
+	return identifier === "" ? "_" : identifier;
+}