@code-yeongyu/senpi-codemode 2026.10.8 → 2026.10.10-10

package/src/environments/py-installer.ts

@@ -61,11 +61,75 @@ const SHORT_ALIASES: Readonly<Record<string, string>> = {
 const STDERR_TAIL_BYTES = 4_096;
 const PIP_TREE_GRACE_MS = 2_000;
 
+/**
+ * Splits a %pip argument line the way the platform's shell would for these inputs: single and double quotes
+ * group (`"pkg[extra]>=1.0"`) and `#` at the start of a word begins a comment. A backslash escapes the next
+ * character only in POSIX mode; on Windows it is a path separator and stays as written. An unclosed quote is
+ * refused rather than guessed.
+ */
+const DOUBLE_QUOTE_ESCAPES: ReadonlySet<string> = new Set(['"', "\\", "$", "`"]);
+
+export function splitShellWords(text: string, posix = process.platform !== "win32"): string[] {
+	const words: string[] = [];
+	let word = "";
+	let inWord = false;
+	let quote: "'" | '"' | undefined;
+	for (let index = 0; index < text.length; index++) {
+		const char = text[index] ?? "";
+		if (quote === "'") {
+			if (char === "'") quote = undefined;
+			else word += char;
+			continue;
+		}
+		if (posix && char === "\\" && index + 1 < text.length) {
+			const next = text[index + 1] ?? "";
+			// A backslash-newline is a line continuation in a shell, inside double quotes or not: both characters go.
+			if (next === "\n") {
+				index += 1;
+				continue;
+			}
+			// Inside double quotes a shell only escapes these; any other backslash stays as written.
+			if (quote === '"' && !DOUBLE_QUOTE_ESCAPES.has(next)) {
+				word += char;
+				continue;
+			}
+			index += 1;
+			word += next;
+			inWord = true;
+			continue;
+		}
+		if (quote === '"') {
+			if (char === '"') quote = undefined;
+			else word += char;
+			continue;
+		}
+		if (char === "'" || char === '"') {
+			quote = char;
+			inWord = true;
+			continue;
+		}
+		if (/\s/u.test(char)) {
+			if (inWord) words.push(word);
+			word = "";
+			inWord = false;
+			continue;
+		}
+		if (char === "#" && !inWord) break;
+		word += char;
+		inWord = true;
+	}
+	if (quote !== undefined)
+		throw new EnvironmentError("environment_install_failed", `unclosed ${quote} quote in %pip arguments`);
+	if (inWord) words.push(word);
+	return words;
+}
+
 export function parsePipRequirements(text: string): string[] {
-	const args = text
-		.trim()
-		.split(/\s+/)
-		.filter((arg) => arg !== "");
+	return normalizePipInstall(splitShellWords(text));
+}
+
+/** `%pip` words already split (`["install", ...]`): `packages.install()` passes its list as-is, so nothing is re-quoted. */
+export function normalizePipInstall(args: readonly string[]): string[] {
 	const command = args[0] === "install" ? args.slice(1) : undefined;
 	if (command === undefined) {
 		throw new EnvironmentError("environment_install_failed", "only `%pip install <requirements>` is supported");

package/src/environments/python-environments.ts

@@ -0,0 +1,85 @@
+import type { ResolvedCodemodeSettings } from "../config/settings.ts";
+import {
+	type EnvironmentMode,
+	type InstallReceipt,
+	installPythonPackages,
+	managedEnvironmentBase,
+	projectPythonBase,
+	pythonAbiTag,
+} from "./py-environment.ts";
+import { EnvironmentError } from "./py-installer.ts";
+import { readActiveRevisionSync } from "./revision-store.ts";
+
+export interface PythonEnvironmentsOptions {
+	readonly artifactsDir: string;
+	readonly cwd: string;
+	readonly interpreter: string;
+	readonly settings: Pick<ResolvedCodemodeSettings, "environments">;
+}
+
+export class PythonEnvironments {
+	readonly #options: PythonEnvironmentsOptions;
+	#mode: EnvironmentMode = "managed";
+	#currentBase: string | undefined;
+	#managedBase: Promise<string> | undefined;
+
+	constructor(options: PythonEnvironmentsOptions) {
+		this.#options = options;
+	}
+
+	get mode(): EnvironmentMode {
+		return this.#mode;
+	}
+
+	/**
+	 * The revision a Python cell imports from, read from the current mode's root each time a cell starts, so an
+	 * install by another session sharing the project root is seen. Undefined while nothing is installed there.
+	 */
+	get activeRoot(): string | undefined {
+		return this.#currentBase === undefined ? undefined : readActiveRevisionSync(this.#currentBase)?.dir;
+	}
+
+	async setMode(mode: EnvironmentMode): Promise<string> {
+		const base = await this.#base(mode);
+		this.#mode = mode;
+		this.#currentBase = base;
+		return base;
+	}
+
+	async install(
+		requirements: string | readonly string[],
+		signal: AbortSignal,
+		onOutput?: (stream: "stdout" | "stderr", data: string) => void,
+	): Promise<InstallReceipt> {
+		if (this.#options.settings.environments?.autoProvision === false) {
+			throw new EnvironmentError(
+				"environment_installer_unavailable",
+				"installs are turned off for this project (environments.autoProvision is false)",
+			);
+		}
+		const mode = this.#mode;
+		const base = await this.#base(mode);
+		const receipt = await installPythonPackages({
+			base,
+			mode,
+			interpreter: this.#options.interpreter,
+			requirements,
+			cwd: this.#options.cwd,
+			signal,
+			...(onOutput === undefined ? {} : { onOutput }),
+		});
+		if (this.#mode === mode) this.#currentBase = base;
+		return receipt;
+	}
+
+	#base(mode: EnvironmentMode): Promise<string> {
+		if (mode === "project") return Promise.resolve(projectPythonBase(this.#options.cwd));
+		const configured = this.#options.settings.environments?.managedRoot;
+		this.#managedBase ??= pythonAbiTag(this.#options.interpreter).then((abi) =>
+			configured === undefined
+				? managedEnvironmentBase(this.#options.artifactsDir, "py", abi)
+				: managedEnvironmentBase(configured, "py", abi),
+		);
+		return this.#managedBase;
+	}
+}

package/src/environments/revision-store.ts

@@ -1,7 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { chmod, cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { type LockWaitNotice, withRootLock } from "./install-lock.ts";
+import { assertLinkStaysInside, assertNoLinksBelow, recordedInstallSources } from "./no-links.ts";
 import { EnvironmentError } from "./py-installer.ts";
 
 const POINTER = "active";
@@ -12,11 +14,25 @@ export interface Revision {
 	readonly dir: string;
 }
 
+/** The same read, synchronous: the pointer is one short file, read when a Python cell starts running. */
+export function readActiveRevisionSync(base: string): Revision | undefined {
+	try {
+		return parsePointer(base, readFileSync(join(base, POINTER), "utf8"));
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return undefined;
+		throw error;
+	}
+}
+
+function parsePointer(base: string, text: string): Revision | undefined {
+	const name = text.trim();
+	const match = REVISION.exec(name);
+	return match?.[1] === undefined ? undefined : { number: Number(match[1]), dir: join(base, name) };
+}
+
 export async function readActiveRevision(base: string): Promise<Revision | undefined> {
 	try {
-		const name = (await readFile(join(base, POINTER), "utf8")).trim();
-		const match = REVISION.exec(name);
-		return match?.[1] === undefined ? undefined : { number: Number(match[1]), dir: join(base, name) };
+		return parsePointer(base, await readFile(join(base, POINTER), "utf8"));
 	} catch (error) {
 		if (error instanceof Error && "code" in error && error.code === "ENOENT") return undefined;
 		throw error;
@@ -35,7 +51,7 @@ export async function publishNextRevision(
 	signal?: AbortSignal,
 	onLockWait?: (notice: LockWaitNotice) => void,
 ): Promise<{ readonly revision: Revision; readonly previous: Revision | undefined }> {
-	await mkdir(base, { recursive: true });
+	await mkdirPrivate(base);
 	return withRootLock(
 		base,
 		async () => {
@@ -44,8 +60,18 @@ export async function publishNextRevision(
 			const staging = join(base, `.staging-rev-${number}-${process.pid}-${randomUUID()}`);
 			const dir = join(base, `rev-${number}`);
 			try {
-				if (previous === undefined) await mkdir(staging, { recursive: true });
-				else await cp(previous.dir, staging, { recursive: true, verbatimSymlinks: true });
+				if (previous === undefined) await mkdir(staging, { mode: 0o700 });
+				else {
+					await assertNoLinksBelow(base, previous.dir);
+					const sources = await recordedInstallSources(previous.dir);
+					await cp(previous.dir, staging, {
+						recursive: true,
+						verbatimSymlinks: true,
+						filter: async (source) => await assertLinkStaysInside(source, previous.dir, sources),
+					});
+				}
+				// Explicit, not left to the umask: a revision holds the user's installed packages and carried registry config.
+				await chmod(staging, 0o700);
 				await build(staging, previous);
 				signal?.throwIfAborted();
 				await renameRetrying(staging, dir);
@@ -93,3 +119,8 @@ async function highestRevision(base: string): Promise<number> {
 	}
 	return highest;
 }
+
+/** Creates `dir` and any missing parents private to the user (0700; the umask can only narrow it further). */
+export async function mkdirPrivate(dir: string): Promise<void> {
+	await mkdir(dir, { recursive: true, mode: 0o700 });
+}

package/src/extension/bridge-tool-call.ts

@@ -8,6 +8,8 @@ export interface BridgeToolCallRequest {
 	readonly toolName: string;
 	readonly args: unknown;
 	readonly callId: string;
+	/** The calling run's secret; absent for a call made outside any run (a plain thread), which gets no kernel tools. */
+	readonly cellToken?: string;
 	readonly signal: AbortSignal;
 }
 
@@ -17,7 +19,10 @@ export interface BridgeToolCallRequest {
 // and ordinary tool results are marshalled to { text, images, details, hasError } — the raw
 // { content } shape left python cells unable to reach tool.read image blocks.
 export async function routeBridgeToolCall(
-	options: Pick<CreateCodemodeSessionManagerOptions, "executeTool" | "listTools" | "settings" | "handles">,
+	options: Pick<
+		CreateCodemodeSessionManagerOptions,
+		"executeTool" | "listTools" | "settings" | "handles" | "environments"
+	>,
 	request: BridgeToolCallRequest,
 	evalHandleHost?: EvalHandleHost,
 ): Promise<unknown> {
@@ -37,5 +42,6 @@ export async function routeBridgeToolCall(
 		marshalToolResult,
 		...(options.handles === undefined ? {} : { handles: options.handles }),
 		...(evalHandleHost === undefined ? {} : { evalHandleHost }),
+		...(options.environments === undefined ? {} : { environments: options.environments }),
 	});
 }

package/src/extension/cell-kernel-tools.ts

@@ -0,0 +1,28 @@
+import { kernelToolsStorage } from "@code-yeongyu/senpi";
+import type { KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
+
+/**
+ * Kernel-tools capabilities of the subprocess-kernel cells running right now, keyed by a secret minted per run and
+ * sent only to the kernel running that cell. Those kernels (py/rb/jl) reach the host over the bridge, outside the
+ * submitting cell's async context, so a bridge call carries its run's secret and runs inside that run's capability:
+ * the same `kernelToolsStorage` scope the JS worker path enters per host call (#1754).
+ */
+export class CellKernelTools {
+	readonly #byToken = new Map<string, KernelToolsCapability>();
+
+	/** Makes `capability` the kernel tools of calls carrying `token` until the returned release runs. */
+	bind(token: string, capability: KernelToolsCapability): () => void {
+		this.#byToken.set(token, capability);
+		return () => {
+			if (this.#byToken.get(token) === capability) this.#byToken.delete(token);
+		};
+	}
+
+	/** Runs `call` with the capability bound to `token`; an absent, unknown or released token gets none. */
+	async run<T>(token: string | undefined, call: () => Promise<T>): Promise<T> {
+		const capability = token === undefined ? undefined : this.#byToken.get(token);
+		return capability === undefined
+			? await kernelToolsStorage.exit(call)
+			: await kernelToolsStorage.run(capability, call);
+	}
+}

package/src/extension/eval-notifier.ts

@@ -1,4 +1,9 @@
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import type { EvalImageContent } from "../tool/image-resize.ts";
+
+/** A notification's message content: plain text, or text and the cells' images in one message. */
+export type EvalNotificationContent = string | ({ readonly type: "text"; readonly text: string } | EvalImageContent)[];
+
 import type { EvalDetachedCellNotification, EvalDetachedCellNotifier } from "../tool/detached-cell-manager.ts";
 
 const NON_INTERACTIVE_MODES = new Set(["print", "json"]);
@@ -11,7 +16,7 @@ export type EvalNotifyMode = "wake" | "next-turn" | "off";
 export interface EvalNotifierDeps {
 	/** Deliver a model-visible notification without rendering synthetic user input. */
 	readonly sendMessage: (
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options: { triggerTurn: boolean; deliverAs: "steer" | "followUp" },
 	) => void;
 	readonly getContext: () => ExtensionContext | undefined;
@@ -43,10 +48,16 @@ export class EvalNotifier implements EvalDetachedCellNotifier {
 		this.#deps.sendMessage(
 			{
 				customType: EVAL_NOTIFICATION_CUSTOM_TYPE,
-				content: pending.map((cell) => cell.content).join("\n\n"),
+				content: notificationContent(pending),
 				display: false,
 			},
 			{ triggerTurn: true, deliverAs: mode === "wake" ? "steer" : "followUp" },
 		);
 	}
 }
+
+function notificationContent(cells: readonly EvalDetachedCellNotification[]): EvalNotificationContent {
+	const text = cells.map((cell) => cell.content).join("\n\n");
+	const images = cells.flatMap((cell) => cell.images ?? []);
+	return images.length === 0 ? text : [{ type: "text", text }, ...images];
+}

package/src/extension/kernel-registration.ts

@@ -63,11 +63,16 @@ export class SessionKernelRegistrations {
 }
 
 export function javaScriptKernelMemory(kernel: JavaScriptKernel): RegisteredKernelSource {
+	const measure = kernel.mode === "process" ? "footprint" : "heap";
 	return {
-		measure: "heap",
+		measure,
 		lastLiveBytes: () => kernel.lastLiveBytes,
 		busy: () => kernel.queueSnapshot().activeCellId !== null,
-		queryMemory: () => kernel.queryMemory(),
+		queryMemory: async () => {
+			const reading = await kernel.queryMemory();
+			return reading === undefined ? undefined : { liveBytes: reading.liveBytes, measure: reading.measure };
+		},
+		...(measure === "footprint" ? { pid: () => kernel.processPid } : {}),
 	};
 }
 

package/src/extension/kernel-replacement.ts

@@ -13,6 +13,7 @@ import type {
 	KernelInterruptHandle,
 	PendingCell,
 } from "../tool/types.ts";
+import { hasKernelTools, type KernelToolsMethods } from "./kernel-tools-probe.ts";
 
 export type StartKernel = (lifecycle: Required<KernelLifecycle>) => Promise<EvalKernel>;
 
@@ -50,10 +51,29 @@ export class ReplaceableKernel implements EvalKernel {
 	#closed = false;
 	#closeFailure: unknown;
 
+	// Present only when the instance has kernel tools, so a probe sees what it would see on the instance itself.
+	declare readonly describeKernelTools?: KernelToolsMethods["describeKernelTools"];
+	declare readonly invokeKernelTool?: KernelToolsMethods["invokeKernelTool"];
+
 	private constructor(language: EvalLanguage, start: StartKernel, first: EvalKernel) {
 		this.#language = language;
 		this.#start = start;
 		this.#kernel = first;
+		// Python is the one subprocess kernel with kernel tools; rb and jl only carry tools_unavailable stubs to hide.
+		if (language === "py" && hasKernelTools(first)) {
+			// Always the CURRENT instance: after a replacement the old definitions are gone with the old interpreter.
+			const tools: KernelToolsMethods = {
+				describeKernelTools: (names) => this.#currentTools().describeKernelTools(names),
+				invokeKernelTool: (request, options) => this.#currentTools().invokeKernelTool(request, options),
+			};
+			Object.assign(this, tools);
+		}
+	}
+
+	#currentTools(): KernelToolsMethods {
+		const current = this.#kernel;
+		if (!hasKernelTools(current)) throw new Error(`The ${this.#language} kernel has no kernel tools`);
+		return current;
 	}
 
 	/** Starts the first instance; one that cannot hand back its queue is returned as it is. */

package/src/extension/runtime-factory.ts

@@ -2,18 +2,23 @@ import { type ExtensionContext, withBundledBunCommands } from "@code-yeongyu/sen
 import type { AgentExecuteTool } from "../bridges/agent-bridge.ts";
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
+import { resolveJsIsolation } from "../config/feature-settings.ts";
+import { withoutUntrustedInterpreter } from "../config/project-trust.ts";
 import {
 	type CodemodeSettings,
 	loadCodemodeSettings,
 	type ResolvedCodemodeSettings,
 	resolveEnabledLanguages,
 } from "../config/settings.ts";
+import { JsEnvironments } from "../environments/js-environments.ts";
+import { PythonEnvironments } from "../environments/python-environments.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
 import {
 	createInterpreterDetector,
 	getInterpreterAvailability,
 	type InterpreterAvailability,
 } from "../interpreters/detect.ts";
+import { processRuntimeInfo } from "../kernels/js/process-worker.ts";
 import { sessionEnvironmentFrom } from "../kernels/session-env.ts";
 import { resolveSessionArtifactsDir } from "../output/streaming-output.ts";
 import type { EnabledEvalLanguages, EvalLanguage, EvalRuntimes } from "../tool/types.ts";
@@ -47,6 +52,8 @@ export type SessionRuntime = {
 	readonly artifactsDir: string;
 	readonly executeTool: AgentExecuteTool;
 	readonly spawns: boolean;
+	readonly pythonEnvironments?: PythonEnvironments;
+	readonly jsEnvironments: JsEnvironments;
 };
 
 export async function createRuntime(
@@ -58,12 +65,25 @@ export async function createRuntime(
 	handles?: HandleRegistry,
 ): Promise<SessionRuntime> {
 	const loaded = await loadCodemodeSettings({ cwd: ctx.cwd });
+	const trusted = withoutUntrustedInterpreter(
+		loaded.settings,
+		loaded.source,
+		ctx.cwd,
+		typeof ctx.isProjectTrusted === "function" ? () => ctx.isProjectTrusted() : undefined,
+	);
 	const settings: ResolvedCodemodeSettings = {
-		...loaded.settings,
-		languages: resolveEnabledLanguages(loaded.settings),
+		...trusted.settings,
+		languages: resolveEnabledLanguages(trusted.settings),
 	};
 	const availability = await getInterpreterAvailability(settings, createInterpreterDetector());
+	const pyReason = availability.py.detected.ok ? undefined : availability.py.detected.reason;
+	reportSettingsProblems(ctx, [
+		...loaded.warnings,
+		...(trusted.warning === undefined ? [] : [trusted.warning]),
+		...(pyReason === undefined ? [] : [pyReason]),
+	]);
 	const enabledLanguages = enabledLanguagesFrom(settings, availability);
+	const jsProcessIsolation = resolveJsIsolation(settings) === "process";
 	const artifacts = resolveSessionArtifactsDir(ctx.sessionManager.getSessionFile());
 	const activeTools = new Set(pi.getActiveTools());
 	const executeTool = createExecuteTool(pi, activeTools);
@@ -72,6 +92,15 @@ export async function createRuntime(
 	const sessionEnv = { ...sessionEnvironmentFrom(ctx), ...bundledBunPathEntry() };
 	const configuredPoolWidth = settings.parallelPoolWidth;
 	const parallelPoolWidth = Number.isFinite(configuredPoolWidth) ? Math.max(1, Math.trunc(configuredPoolWidth)) : 1;
+	const pythonEnvironments =
+		availability.py.detected.ok && enabledLanguages.py
+			? new PythonEnvironments({
+					artifactsDir: artifacts.dir,
+					cwd: ctx.cwd,
+					interpreter: availability.py.detected.path,
+					settings,
+				})
+			: undefined;
 	const manager = await create({
 		sessionId,
 		ownerSessionId: ctx.sessionManager.getSessionId(),
@@ -84,6 +113,7 @@ export async function createRuntime(
 		listTools: () => pi.getAllTools(),
 		complete,
 		...(handles === undefined ? {} : { handles }),
+		...(pythonEnvironments === undefined ? {} : { environments: { python: pythonEnvironments } }),
 	});
 	return {
 		sessionId,
@@ -91,14 +121,34 @@ export async function createRuntime(
 		parallelPoolWidth,
 		manager,
 		enabledLanguages,
-		runtimes: runtimesFromAvailability(availability, jsRuntimeInfo()),
+		runtimes: runtimesFromAvailability(
+			availability,
+			(jsProcessIsolation ? processRuntimeInfo(undefined) : undefined) ??
+				jsRuntimeInfo(process.versions, process.execPath, jsProcessIsolation),
+		),
 		settings,
 		artifactsDir: artifacts.dir,
 		executeTool,
 		spawns: activeTools.has(settings.taskTools.task),
+		jsEnvironments: new JsEnvironments({
+			artifactsDir: artifacts.dir,
+			cwd: ctx.cwd,
+			runtime: jsRuntimeInfo().name,
+			env: { ...process.env, ...sessionEnv },
+			settings,
+		}),
+		...(pythonEnvironments === undefined ? {} : { pythonEnvironments }),
 	};
 }
 
+/** Settings problems reach the user: a notice with a UI, otherwise stderr (print and RPC runs). */
+function reportSettingsProblems(ctx: ExtensionContext, problems: readonly string[]): void {
+	for (const problem of problems) {
+		if (ctx.hasUI) ctx.ui.notify(`[senpi-codemode] ${problem}`, "warning");
+		else console.error(`[senpi-codemode] ${problem}`);
+	}
+}
+
 export function createExecuteTool(pi: CodemodeRuntimeAPI, activeTools?: ReadonlySet<string>): AgentExecuteTool {
 	// A cell names tools directly and cannot run tool_search first, so eval opts in to
 	// lazy activation. Eligibility still belongs to the extension that registered the tool.

package/src/extension/runtime-info.ts

@@ -10,10 +10,14 @@ export interface JsRuntimeVersions {
 export function jsRuntimeInfo(
 	versions: JsRuntimeVersions = process.versions,
 	execPath: string = process.execPath,
+	processIsolation = false,
 ): EvalRuntimeInfo {
 	const bun = versions.bun;
-	if (bun !== undefined && bun.length > 0) return { name: "bun", version: bun, path: execPath };
-	return { name: "node", version: versions.node, path: execPath };
+	const base =
+		bun !== undefined && bun.length > 0
+			? { name: "bun", version: bun, path: execPath }
+			: { name: "node", version: versions.node, path: execPath };
+	return processIsolation ? { ...base, isolation: "process" } : base;
 }
 
 /** Short host-line segment, e.g. "node 26.7.0" or "bun 1.4.0". */

package/src/extension/session-manager-contract.ts

@@ -2,6 +2,7 @@ import type { ExtensionContext } from "@code-yeongyu/senpi";
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
 import type { CodemodeSettings } from "../config/settings.ts";
+import type { PackagesInstallEnvironments } from "../environments/packages-install.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
 import type { InterpreterAvailability } from "../interpreters/detect.ts";
 import type { SessionEnvironment } from "../kernels/session-env.ts";
@@ -42,4 +43,6 @@ export interface CreateCodemodeSessionManagerOptions {
 	readonly complete: (request: CompletionRequest, ctx: ExtensionContext) => Promise<CompletionResult>;
 	/** The session generation's handle registry; subprocess kernels reach `wait()`/`handle()` through the bridge. */
 	readonly handles?: HandleRegistry;
+	/** The Python environment `packages.install("pip", ...)` reaches from a Python cell over the bridge. */
+	readonly environments?: PackagesInstallEnvironments;
 }

package/src/extension/session-manager-proxy.ts

@@ -1,6 +1,7 @@
 import type { ExtensionContext } from "@code-yeongyu/senpi";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
+import type { KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
 import type { EvalKernel, EvalLanguage } from "../tool/types.ts";
 import {
 	CodemodeSessionDisposedError,
@@ -106,6 +107,11 @@ export class SessionManagerProxy implements CodemodeSessionManager, EvalExecutio
 		this.#current?.releaseKernelListener?.(language, onMessage);
 	}
 
+	bindCellKernelTools(token: string, capability: KernelToolsCapability): () => void {
+		// Bound to the generation that runs the cell: a later generation never serves that cell's host calls.
+		return this.#current?.bindCellKernelTools?.(token, capability) ?? (() => undefined);
+	}
+
 	async complete(request: CompletionRequest, ctx: ExtensionContext): Promise<CompletionResult> {
 		this.assertEvalExecutionAllowed();
 		const current = this.#current;

package/src/extension/session-manager.ts

@@ -1,16 +1,20 @@
 import { join } from "node:path";
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import { readProcessFootprint } from "@code-yeongyu/senpi";
 import { type BridgeServerHandle, startBridgeServer } from "../bridge/http-server.ts";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
+import { resolveJsIsolation, resolveKernelToolsEnabled } from "../config/feature-settings.ts";
 import { resolveKernelMemoryThresholds } from "../config/memory-settings.ts";
 import { collectOrphanedChildren } from "../host-sdk.ts";
 import { JavaScriptKernel } from "../kernels/js/context-manager.ts";
-import type { KernelToolsDescribeResult } from "../kernels/js/kernel-tools-types.ts";
+import type { KernelToolsCapability, KernelToolsDescribeResult } from "../kernels/js/kernel-tools-types.ts";
+import type { SessionEnvironment } from "../kernels/session-env.ts";
 import type { KernelLifecycle } from "../kernels/shared/kernel-death.ts";
 import type { EvalKernel, EvalLanguage } from "../tool/types.ts";
 import { type BridgeDispatchContext, dispatchBridgeCompletion } from "./bridge-dispatch.ts";
 import { type BridgeToolCallRequest, routeBridgeToolCall } from "./bridge-tool-call.ts";
+import { CellKernelTools } from "./cell-kernel-tools.ts";
 import { parkWhenIdle } from "./idle-parking-kernel.ts";
 import {
 	javaScriptKernelMemory,
@@ -65,6 +69,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 	readonly #registrations: SessionKernelRegistrations;
 	#kernelCreations = new Map<EvalLanguage, Promise<EvalKernel>>();
 	#onMessageRefs = new Map<EvalLanguage, (message: KernelToHostMessage) => void>();
+	readonly #cellKernelTools = new CellKernelTools();
 	#context: ExtensionContext | undefined;
 	#generation = 0;
 	#disposePromise: Promise<void> | undefined;
@@ -91,7 +96,13 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 	}
 
 	async #call(request: BridgeToolCallRequest): Promise<unknown> {
-		return await routeBridgeToolCall(this.#options, request, this.#context?.evalHandleHost);
+		return await this.#cellKernelTools.run(request.cellToken, () =>
+			routeBridgeToolCall(this.#options, request, this.#context?.evalHandleHost),
+		);
+	}
+
+	bindCellKernelTools(token: string, capability: KernelToolsCapability): () => void {
+		return this.#cellKernelTools.bind(token, capability);
 	}
 
 	async getKernel(language: EvalLanguage, onMessage: (message: KernelToHostMessage) => void): Promise<EvalKernel> {
@@ -244,6 +255,8 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			this.#options.localRoots ??
 			(this.#options.artifactsDir ? { local: join(this.#options.artifactsDir, "local") } : undefined);
 		if (language === "js") {
+			const memoryThresholds = resolveKernelMemoryThresholds(this.#options.settings.memory);
+			const processIsolation = resolveJsIsolation(this.#options.settings) === "process";
 			const kernel = new JavaScriptKernel({
 				sessionId: this.#options.sessionId,
 				cwd: this.#options.cwd,
@@ -251,8 +264,13 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 				onMessage,
 				hostToolNames: () => this.#options.listTools?.().map((tool) => tool.name) ?? [],
 				foreignLanguageNames: () => this.#foreignKernelToolNames(),
-				memory: resolveKernelMemoryThresholds(this.#options.settings.memory),
+				memory: memoryThresholds,
 				collectOrphanedChildren,
+				...(processIsolation ? { isolation: "process" as const } : {}),
+				...(processIsolation && memoryThresholds !== undefined
+					? { processMemory: { thresholds: memoryThresholds, readFootprint: readProcessFootprint } }
+					: {}),
+				...(resolveKernelToolsEnabled(this.#options.settings) ? {} : { kernelToolsEnabled: false }),
 				...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
 				...(localRoots ? { localRoots: { ...localRoots } } : {}),
 				...(this.#options.artifactsDir ? { artifactsDir: this.#options.artifactsDir } : {}),
@@ -268,10 +286,14 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			...(localRoots ? { localRoots: { ...localRoots } } : {}),
 			...(this.#options.artifactsDir ? { artifactsDir: this.#options.artifactsDir } : {}),
 		};
+		// The Python prelude reads this when a cell defines an @tool; only a disabled setting adds it.
+		const sessionEnv: SessionEnvironment | undefined = resolveKernelToolsEnabled(this.#options.settings)
+			? this.#options.sessionEnv
+			: { ...this.#options.sessionEnv, SENPI_CODEMODE_KERNEL_TOOLS: "0" };
 		const shared = {
 			sessionId: this.#options.sessionId,
 			cwd: this.#options.cwd,
-			...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
+			...(sessionEnv ? { sessionEnv } : {}),
 			connection,
 			onMessage,
 			...lifecycle,