@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-10

package/src/environments/no-links.ts

@@ -0,0 +1,132 @@
+import { lstat, readdir, readFile, readlink, realpath, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { EnvironmentError } from "./py-installer.ts";
+
+/**
+ * Every managed-root write goes through here: each component of `path` strictly below `root` that exists must be a
+ * real file or directory, never a link, so a write can never land in what a planted link points at. `root` itself
+ * may be a link (a user may relocate their whole artifacts directory); nothing below it may.
+ */
+export async function assertNoLinksBelow(root: string, path: string): Promise<void> {
+	const below = relative(root, path);
+	if (below.startsWith("..") || isAbsolute(below)) {
+		throw new EnvironmentError("environment_install_failed", "refusing to write outside the managed environment");
+	}
+	let current = root;
+	for (const part of below.split(sep).filter((segment) => segment !== "")) {
+		current = join(current, part);
+		const stats = await lstat(current).catch(missing);
+		if (stats === undefined) return;
+		if (stats.isSymbolicLink()) {
+			throw new EnvironmentError(
+				"environment_install_failed",
+				`${relative(root, current)} is a link; refusing to write through it`,
+			);
+		}
+	}
+}
+
+/**
+ * The local directories a revision's `package.json` records as install sources, by package name, as realpaths: npm
+ * writes `file:<path relative to the revision>`, bun the absolute path. Only these may be link targets out of the
+ * revision, because installing from a directory links the package to it.
+ */
+export async function recordedInstallSources(revision: string): Promise<ReadonlyMap<string, string>> {
+	const sources = new Map<string, string>();
+	let manifest: unknown;
+	try {
+		manifest = JSON.parse(await readFile(join(revision, "package.json"), "utf8"));
+	} catch {
+		return sources;
+	}
+	if (typeof manifest !== "object" || manifest === null || !("dependencies" in manifest)) return sources;
+	const dependencies = manifest.dependencies;
+	if (typeof dependencies !== "object" || dependencies === null) return sources;
+	for (const [name, spec] of Object.entries(dependencies)) {
+		if (typeof spec !== "string") continue;
+		const path = spec.startsWith("file:") ? spec.slice("file:".length) : spec;
+		if (!isAbsolute(path) && !path.startsWith("./") && !path.startsWith("../")) continue;
+		const source = await realpath(resolve(revision, path)).catch(() => undefined);
+		if (source !== undefined && (await stat(source)).isDirectory()) sources.set(name, source);
+	}
+	return sources;
+}
+
+/**
+ * A copy filter. A link inside `tree` may point inside it (relatively: an absolute link would keep pointing at the
+ * previous revision from the copy), or out of it only to exactly the matching file of a recorded install source:
+ * the link at `node_modules/<name>/<rest>` may resolve to `<source of name>/<rest>` and to nothing else. Whether a
+ * target is inside is judged from the link's own text, without following further links.
+ */
+export async function assertLinkStaysInside(
+	path: string,
+	tree: string,
+	sources: ReadonlyMap<string, string>,
+): Promise<boolean> {
+	if (!(await lstat(path)).isSymbolicLink()) return true;
+	const target = await readlink(path);
+	const resolved = resolve(dirname(path), target);
+	const inside = relative(tree, resolved);
+	const where = relative(tree, path);
+	if (inside === "" || (!inside.startsWith("..") && !isAbsolute(inside))) {
+		if (!isAbsolute(target)) return true;
+		throw new EnvironmentError(
+			"environment_install_failed",
+			`${where} is an absolute link into its revision; refusing to build on it`,
+		);
+	}
+	if (await isRecordedSourceLink(where, resolved, sources)) return true;
+	throw new EnvironmentError(
+		"environment_install_failed",
+		`${where} links outside its revision; refusing to build on it`,
+	);
+}
+
+async function isRecordedSourceLink(
+	where: string,
+	resolved: string,
+	sources: ReadonlyMap<string, string>,
+): Promise<boolean> {
+	const parts = where.split(sep);
+	if (parts[0] !== "node_modules" || parts[1] === undefined) return false;
+	const scoped = parts[1].startsWith("@");
+	const name = scoped ? `${parts[1]}/${parts[2] ?? ""}` : parts[1];
+	const source = sources.get(name);
+	if (source === undefined) return false;
+	// `source` is a realpath; the expected target is that path plus the link's own path below the package, taken
+	// literally, so a file of the source that is itself a link out of it does not count as the source.
+	const expected = join(source, ...parts.slice(scoped ? 3 : 2));
+	const actual = await realpath(resolved).catch(() => undefined);
+	return actual !== undefined && actual === expected;
+}
+
+function missing(error: unknown): undefined {
+	if (error instanceof Error && "code" in error && error.code === "ENOENT") return undefined;
+	throw error;
+}
+
+/**
+ * Checks every link in a built revision as the next copy will, so an install that leaves a link the next install
+ * would refuse (an installer keeping links into a directory the manifest no longer records) is refused now, while
+ * the previous revision is still active.
+ */
+export async function assertBuiltRevisionLinks(revision: string): Promise<void> {
+	const sources = await recordedInstallSources(revision);
+	const walk = async (dir: string): Promise<void> => {
+		for (const entry of await readdir(dir, { withFileTypes: true })) {
+			const path = join(dir, entry.name);
+			if (entry.isSymbolicLink()) {
+				await assertLinkStaysInside(path, revision, sources).catch((error: unknown) => {
+					const where = relative(revision, path);
+					throw error instanceof EnvironmentError
+						? new EnvironmentError(
+								"environment_install_failed",
+								`the install left ${where} linked outside the revision, so nothing was published`,
+							)
+						: error;
+				});
+			} else if (entry.isDirectory()) await walk(path);
+		}
+	};
+	await walk(revision);
+}

package/src/environments/packages-install.ts

@@ -0,0 +1,98 @@
+import type { JsEnvironments, JsInstallReceipt } from "./js-environments.ts";
+import type { InstallReceipt } from "./py-environment.ts";
+import { EnvironmentError } from "./py-installer.ts";
+import type { PythonEnvironments } from "./python-environments.ts";
+
+export interface PackagesInstallEnvironments {
+	readonly python?: PythonEnvironments;
+	readonly js?: JsEnvironments;
+}
+
+export const PACKAGES_INSTALL_DEFAULT_TIMEOUT_SECONDS = 600;
+
+interface PackagesInstallRequest {
+	readonly manager: "pip" | "bun" | "npm";
+	readonly requirements: readonly string[];
+	readonly timeoutSeconds: number;
+}
+
+function invalid(message: string): EnvironmentError {
+	return new EnvironmentError("environment_install_failed", `packages.install(): ${message}`);
+}
+
+function parseRequest(args: unknown): PackagesInstallRequest {
+	if (typeof args !== "object" || args === null) throw invalid("expected (manager, requirements, {timeout?})");
+	const manager = "manager" in args ? args.manager : undefined;
+	if (manager !== "pip" && manager !== "bun" && manager !== "npm") {
+		throw invalid('manager must be "pip" (Python) or "bun" / "npm" (JavaScript)');
+	}
+	const raw = "requirements" in args ? args.requirements : undefined;
+	const list = typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw : undefined;
+	if (
+		list === undefined ||
+		list.length === 0 ||
+		!list.every((item) => typeof item === "string" && item.trim() !== "")
+	) {
+		throw invalid("requirements must be a non-empty string or a non-empty list of non-empty strings");
+	}
+	const timeout = "timeout" in args ? args.timeout : undefined;
+	if (timeout !== undefined && (typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0)) {
+		throw invalid("timeout must be a positive number of seconds");
+	}
+	return {
+		manager,
+		requirements: list.map((item: string) => item.trim()),
+		timeoutSeconds: timeout ?? PACKAGES_INSTALL_DEFAULT_TIMEOUT_SECONDS,
+	};
+}
+
+function jsArguments(requirements: readonly string[]): string {
+	for (const requirement of requirements) {
+		if (/\s/.test(requirement)) throw invalid(`a package spec cannot contain whitespace: ${requirement}`);
+	}
+	return requirements.join(" ");
+}
+
+/**
+ * `packages.install(manager, requirements, {timeout?})`: the in-cell form of `%pip install` / `%bun add` /
+ * `%npm add`. It drives the same session environment the magic cells use and returns its receipt; a stop of the
+ * owning cell cancels it (environment_install_cancelled), and the timeout fails it with environment_install_timeout.
+ * pip receives the requirement list as separate arguments, never re-split. The installer's output is not streamed
+ * into the cell: the receipt is the result, and a failure carries the installer's stderr tail.
+ */
+export async function runPackagesInstall(
+	args: unknown,
+	environments: PackagesInstallEnvironments,
+	signal: AbortSignal | undefined,
+): Promise<InstallReceipt | JsInstallReceipt> {
+	const request = parseRequest(args);
+	const { python, js } = environments;
+	const manager = request.manager;
+	let install: ((signal: AbortSignal) => Promise<InstallReceipt | JsInstallReceipt>) | undefined;
+	if (manager === "pip") {
+		if (python !== undefined) install = (signal) => python.install(request.requirements, signal);
+	} else if (js !== undefined) {
+		install = (signal) => js.install(jsArguments(request.requirements), signal, undefined, manager);
+	}
+	if (install === undefined) {
+		throw new EnvironmentError(
+			"environment_installer_unavailable",
+			manager === "pip"
+				? "pip installs need this session to have a Python interpreter"
+				: "bun/npm installs run only in a JavaScript cell",
+		);
+	}
+	const timeout = AbortSignal.timeout(request.timeoutSeconds * 1_000);
+	const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+	try {
+		return await install(combined);
+	} catch (error) {
+		if (timeout.aborted && !(signal?.aborted ?? false)) {
+			throw new EnvironmentError(
+				"environment_install_timeout",
+				`the install did not finish within ${request.timeoutSeconds}s and was stopped`,
+			);
+		}
+		throw error;
+	}
+}

package/src/environments/project-resolves.ts

@@ -0,0 +1,54 @@
+import { readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/**
+ * Whether a bare import of `name` from the session directory resolves in the project before a managed revision: the
+ * host-side twin of the kernel resolver (`kernels/js/worker-package-resolve.js` stays plain JavaScript, and a `.ts`
+ * module may not import it). Like the resolver it stops at the first `node_modules/<name>` directory up the chain,
+ * and that directory wins only when the resolver would take an entry from it.
+ */
+export function projectResolves(cwd: string, name: string): boolean {
+	for (let directory = cwd; ; directory = dirname(directory)) {
+		const packageDir = join(directory, "node_modules", name);
+		if (isDirectory(packageDir)) return hasRootEntry(packageDir);
+		if (dirname(directory) === directory) return false;
+	}
+}
+
+function hasRootEntry(packageDir: string): boolean {
+	let manifest: unknown;
+	try {
+		manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+	} catch {
+		return legacyFile(join(packageDir, "index.js"));
+	}
+	// The resolver throws on a null manifest and treats any other non-object as one without fields.
+	if (manifest === null) return true;
+	if (typeof manifest !== "object") return legacyFile(join(packageDir, "index.js"));
+	// With `exports` the resolver commits to this package: it imports the "." target or fails, never falling through.
+	if ("exports" in manifest && manifest.exports !== undefined && manifest.exports !== null) return true;
+	const moduleEntry =
+		"Bun" in globalThis && "module" in manifest && typeof manifest.module === "string" ? manifest.module : undefined;
+	const main = "main" in manifest && typeof manifest.main === "string" ? manifest.main : "index.js";
+	return legacyFile(join(packageDir, moduleEntry ?? main));
+}
+
+function legacyFile(path: string): boolean {
+	return [path, `${path}.js`, `${path}.mjs`, `${path}.cjs`, join(path, "index.js")].some(isFile);
+}
+
+function isFile(path: string): boolean {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+
+function isDirectory(path: string): boolean {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}

package/src/environments/py-environment.ts

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { assertInstalledInRevision, assertNoEditableInstalls } from "./editable-check.ts";
-import { parsePipRequirements, runPipInstall } from "./py-installer.ts";
+import { normalizePipInstall, parsePipRequirements, runPipInstall } from "./py-installer.ts";
 import { publishNextRevision, type Revision } from "./revision-store.ts";
 
 const execFileAsync = promisify(execFile);
@@ -40,12 +40,16 @@ export async function installPythonPackages(input: {
 	readonly base: string;
 	readonly mode: EnvironmentMode;
 	readonly interpreter: string;
-	readonly requirements: string;
+	/** `%pip` argument text, or the requirement list `packages.install()` passes without re-parsing. */
+	readonly requirements: string | readonly string[];
 	readonly cwd: string;
 	readonly signal: AbortSignal;
 	readonly onOutput?: (stream: "stdout" | "stderr", data: string) => void;
 }): Promise<InstallReceipt> {
-	const requested = parsePipRequirements(input.requirements);
+	const requested =
+		typeof input.requirements === "string"
+			? parsePipRequirements(input.requirements)
+			: normalizePipInstall(["install", ...input.requirements]);
 	let stdout = "";
 	const { revision } = await publishNextRevision(
 		input.base,

package/src/environments/py-installer.ts

@@ -125,7 +125,11 @@ export function splitShellWords(text: string, posix = process.platform !== "win3
 }
 
 export function parsePipRequirements(text: string): string[] {
-	const args = splitShellWords(text);
+	return normalizePipInstall(splitShellWords(text));
+}
+
+/** `%pip` words already split (`["install", ...]`): `packages.install()` passes its list as-is, so nothing is re-quoted. */
+export function normalizePipInstall(args: readonly string[]): string[] {
 	const command = args[0] === "install" ? args.slice(1) : undefined;
 	if (command === undefined) {
 		throw new EnvironmentError("environment_install_failed", "only `%pip install <requirements>` is supported");

package/src/environments/python-environments.ts

@@ -47,7 +47,7 @@ export class PythonEnvironments {
 	}
 
 	async install(
-		requirements: string,
+		requirements: string | readonly string[],
 		signal: AbortSignal,
 		onOutput?: (stream: "stdout" | "stderr", data: string) => void,
 	): Promise<InstallReceipt> {

package/src/environments/revision-store.ts

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { type LockWaitNotice, withRootLock } from "./install-lock.ts";
+import { assertLinkStaysInside, assertNoLinksBelow, recordedInstallSources } from "./no-links.ts";
 import { EnvironmentError } from "./py-installer.ts";
 
 const POINTER = "active";
@@ -50,7 +51,7 @@ export async function publishNextRevision(
 	signal?: AbortSignal,
 	onLockWait?: (notice: LockWaitNotice) => void,
 ): Promise<{ readonly revision: Revision; readonly previous: Revision | undefined }> {
-	await mkdir(base, { recursive: true });
+	await mkdirPrivate(base);
 	return withRootLock(
 		base,
 		async () => {
@@ -59,8 +60,18 @@ export async function publishNextRevision(
 			const staging = join(base, `.staging-rev-${number}-${process.pid}-${randomUUID()}`);
 			const dir = join(base, `rev-${number}`);
 			try {
-				if (previous === undefined) await mkdir(staging, { recursive: true });
-				else await cp(previous.dir, staging, { recursive: true, verbatimSymlinks: true });
+				if (previous === undefined) await mkdir(staging, { mode: 0o700 });
+				else {
+					await assertNoLinksBelow(base, previous.dir);
+					const sources = await recordedInstallSources(previous.dir);
+					await cp(previous.dir, staging, {
+						recursive: true,
+						verbatimSymlinks: true,
+						filter: async (source) => await assertLinkStaysInside(source, previous.dir, sources),
+					});
+				}
+				// Explicit, not left to the umask: a revision holds the user's installed packages and carried registry config.
+				await chmod(staging, 0o700);
 				await build(staging, previous);
 				signal?.throwIfAborted();
 				await renameRetrying(staging, dir);
@@ -108,3 +119,8 @@ async function highestRevision(base: string): Promise<number> {
 	}
 	return highest;
 }
+
+/** Creates `dir` and any missing parents private to the user (0700; the umask can only narrow it further). */
+export async function mkdirPrivate(dir: string): Promise<void> {
+	await mkdir(dir, { recursive: true, mode: 0o700 });
+}

package/src/extension/bridge-tool-call.ts

@@ -19,7 +19,10 @@ export interface BridgeToolCallRequest {
 // and ordinary tool results are marshalled to { text, images, details, hasError } — the raw
 // { content } shape left python cells unable to reach tool.read image blocks.
 export async function routeBridgeToolCall(
-	options: Pick<CreateCodemodeSessionManagerOptions, "executeTool" | "listTools" | "settings" | "handles">,
+	options: Pick<
+		CreateCodemodeSessionManagerOptions,
+		"executeTool" | "listTools" | "settings" | "handles" | "environments"
+	>,
 	request: BridgeToolCallRequest,
 	evalHandleHost?: EvalHandleHost,
 ): Promise<unknown> {
@@ -39,5 +42,6 @@ export async function routeBridgeToolCall(
 		marshalToolResult,
 		...(options.handles === undefined ? {} : { handles: options.handles }),
 		...(evalHandleHost === undefined ? {} : { evalHandleHost }),
+		...(options.environments === undefined ? {} : { environments: options.environments }),
 	});
 }

package/src/extension/eval-notifier.ts

@@ -1,4 +1,9 @@
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import type { EvalImageContent } from "../tool/image-resize.ts";
+
+/** A notification's message content: plain text, or text and the cells' images in one message. */
+export type EvalNotificationContent = string | ({ readonly type: "text"; readonly text: string } | EvalImageContent)[];
+
 import type { EvalDetachedCellNotification, EvalDetachedCellNotifier } from "../tool/detached-cell-manager.ts";
 
 const NON_INTERACTIVE_MODES = new Set(["print", "json"]);
@@ -11,7 +16,7 @@ export type EvalNotifyMode = "wake" | "next-turn" | "off";
 export interface EvalNotifierDeps {
 	/** Deliver a model-visible notification without rendering synthetic user input. */
 	readonly sendMessage: (
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options: { triggerTurn: boolean; deliverAs: "steer" | "followUp" },
 	) => void;
 	readonly getContext: () => ExtensionContext | undefined;
@@ -43,10 +48,16 @@ export class EvalNotifier implements EvalDetachedCellNotifier {
 		this.#deps.sendMessage(
 			{
 				customType: EVAL_NOTIFICATION_CUSTOM_TYPE,
-				content: pending.map((cell) => cell.content).join("\n\n"),
+				content: notificationContent(pending),
 				display: false,
 			},
 			{ triggerTurn: true, deliverAs: mode === "wake" ? "steer" : "followUp" },
 		);
 	}
 }
+
+function notificationContent(cells: readonly EvalDetachedCellNotification[]): EvalNotificationContent {
+	const text = cells.map((cell) => cell.content).join("\n\n");
+	const images = cells.flatMap((cell) => cell.images ?? []);
+	return images.length === 0 ? text : [{ type: "text", text }, ...images];
+}

package/src/extension/kernel-registration.ts

@@ -63,11 +63,16 @@ export class SessionKernelRegistrations {
 }
 
 export function javaScriptKernelMemory(kernel: JavaScriptKernel): RegisteredKernelSource {
+	const measure = kernel.mode === "process" ? "footprint" : "heap";
 	return {
-		measure: "heap",
+		measure,
 		lastLiveBytes: () => kernel.lastLiveBytes,
 		busy: () => kernel.queueSnapshot().activeCellId !== null,
-		queryMemory: () => kernel.queryMemory(),
+		queryMemory: async () => {
+			const reading = await kernel.queryMemory();
+			return reading === undefined ? undefined : { liveBytes: reading.liveBytes, measure: reading.measure };
+		},
+		...(measure === "footprint" ? { pid: () => kernel.processPid } : {}),
 	};
 }
 

package/src/extension/runtime-factory.ts

@@ -2,12 +2,15 @@ import { type ExtensionContext, withBundledBunCommands } from "@code-yeongyu/sen
 import type { AgentExecuteTool } from "../bridges/agent-bridge.ts";
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
+import { resolveJsIsolation } from "../config/feature-settings.ts";
+import { withoutUntrustedInterpreter } from "../config/project-trust.ts";
 import {
 	type CodemodeSettings,
 	loadCodemodeSettings,
 	type ResolvedCodemodeSettings,
 	resolveEnabledLanguages,
 } from "../config/settings.ts";
+import { JsEnvironments } from "../environments/js-environments.ts";
 import { PythonEnvironments } from "../environments/python-environments.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
 import {
@@ -15,6 +18,7 @@ import {
 	getInterpreterAvailability,
 	type InterpreterAvailability,
 } from "../interpreters/detect.ts";
+import { processRuntimeInfo } from "../kernels/js/process-worker.ts";
 import { sessionEnvironmentFrom } from "../kernels/session-env.ts";
 import { resolveSessionArtifactsDir } from "../output/streaming-output.ts";
 import type { EnabledEvalLanguages, EvalLanguage, EvalRuntimes } from "../tool/types.ts";
@@ -49,6 +53,7 @@ export type SessionRuntime = {
 	readonly executeTool: AgentExecuteTool;
 	readonly spawns: boolean;
 	readonly pythonEnvironments?: PythonEnvironments;
+	readonly jsEnvironments: JsEnvironments;
 };
 
 export async function createRuntime(
@@ -60,12 +65,25 @@ export async function createRuntime(
 	handles?: HandleRegistry,
 ): Promise<SessionRuntime> {
 	const loaded = await loadCodemodeSettings({ cwd: ctx.cwd });
+	const trusted = withoutUntrustedInterpreter(
+		loaded.settings,
+		loaded.source,
+		ctx.cwd,
+		typeof ctx.isProjectTrusted === "function" ? () => ctx.isProjectTrusted() : undefined,
+	);
 	const settings: ResolvedCodemodeSettings = {
-		...loaded.settings,
-		languages: resolveEnabledLanguages(loaded.settings),
+		...trusted.settings,
+		languages: resolveEnabledLanguages(trusted.settings),
 	};
 	const availability = await getInterpreterAvailability(settings, createInterpreterDetector());
+	const pyReason = availability.py.detected.ok ? undefined : availability.py.detected.reason;
+	reportSettingsProblems(ctx, [
+		...loaded.warnings,
+		...(trusted.warning === undefined ? [] : [trusted.warning]),
+		...(pyReason === undefined ? [] : [pyReason]),
+	]);
 	const enabledLanguages = enabledLanguagesFrom(settings, availability);
+	const jsProcessIsolation = resolveJsIsolation(settings) === "process";
 	const artifacts = resolveSessionArtifactsDir(ctx.sessionManager.getSessionFile());
 	const activeTools = new Set(pi.getActiveTools());
 	const executeTool = createExecuteTool(pi, activeTools);
@@ -74,6 +92,15 @@ export async function createRuntime(
 	const sessionEnv = { ...sessionEnvironmentFrom(ctx), ...bundledBunPathEntry() };
 	const configuredPoolWidth = settings.parallelPoolWidth;
 	const parallelPoolWidth = Number.isFinite(configuredPoolWidth) ? Math.max(1, Math.trunc(configuredPoolWidth)) : 1;
+	const pythonEnvironments =
+		availability.py.detected.ok && enabledLanguages.py
+			? new PythonEnvironments({
+					artifactsDir: artifacts.dir,
+					cwd: ctx.cwd,
+					interpreter: availability.py.detected.path,
+					settings,
+				})
+			: undefined;
 	const manager = await create({
 		sessionId,
 		ownerSessionId: ctx.sessionManager.getSessionId(),
@@ -86,6 +113,7 @@ export async function createRuntime(
 		listTools: () => pi.getAllTools(),
 		complete,
 		...(handles === undefined ? {} : { handles }),
+		...(pythonEnvironments === undefined ? {} : { environments: { python: pythonEnvironments } }),
 	});
 	return {
 		sessionId,
@@ -93,24 +121,34 @@ export async function createRuntime(
 		parallelPoolWidth,
 		manager,
 		enabledLanguages,
-		runtimes: runtimesFromAvailability(availability, jsRuntimeInfo()),
+		runtimes: runtimesFromAvailability(
+			availability,
+			(jsProcessIsolation ? processRuntimeInfo(undefined) : undefined) ??
+				jsRuntimeInfo(process.versions, process.execPath, jsProcessIsolation),
+		),
 		settings,
 		artifactsDir: artifacts.dir,
 		executeTool,
 		spawns: activeTools.has(settings.taskTools.task),
-		...(availability.py.detected.ok && enabledLanguages.py
-			? {
-					pythonEnvironments: new PythonEnvironments({
-						artifactsDir: artifacts.dir,
-						cwd: ctx.cwd,
-						interpreter: availability.py.detected.path,
-						settings,
-					}),
-				}
-			: {}),
+		jsEnvironments: new JsEnvironments({
+			artifactsDir: artifacts.dir,
+			cwd: ctx.cwd,
+			runtime: jsRuntimeInfo().name,
+			env: { ...process.env, ...sessionEnv },
+			settings,
+		}),
+		...(pythonEnvironments === undefined ? {} : { pythonEnvironments }),
 	};
 }
 
+/** Settings problems reach the user: a notice with a UI, otherwise stderr (print and RPC runs). */
+function reportSettingsProblems(ctx: ExtensionContext, problems: readonly string[]): void {
+	for (const problem of problems) {
+		if (ctx.hasUI) ctx.ui.notify(`[senpi-codemode] ${problem}`, "warning");
+		else console.error(`[senpi-codemode] ${problem}`);
+	}
+}
+
 export function createExecuteTool(pi: CodemodeRuntimeAPI, activeTools?: ReadonlySet<string>): AgentExecuteTool {
 	// A cell names tools directly and cannot run tool_search first, so eval opts in to
 	// lazy activation. Eligibility still belongs to the extension that registered the tool.

package/src/extension/runtime-info.ts

@@ -10,10 +10,14 @@ export interface JsRuntimeVersions {
 export function jsRuntimeInfo(
 	versions: JsRuntimeVersions = process.versions,
 	execPath: string = process.execPath,
+	processIsolation = false,
 ): EvalRuntimeInfo {
 	const bun = versions.bun;
-	if (bun !== undefined && bun.length > 0) return { name: "bun", version: bun, path: execPath };
-	return { name: "node", version: versions.node, path: execPath };
+	const base =
+		bun !== undefined && bun.length > 0
+			? { name: "bun", version: bun, path: execPath }
+			: { name: "node", version: versions.node, path: execPath };
+	return processIsolation ? { ...base, isolation: "process" } : base;
 }
 
 /** Short host-line segment, e.g. "node 26.7.0" or "bun 1.4.0". */

package/src/extension/session-manager-contract.ts

@@ -2,6 +2,7 @@ import type { ExtensionContext } from "@code-yeongyu/senpi";
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
 import type { CodemodeSettings } from "../config/settings.ts";
+import type { PackagesInstallEnvironments } from "../environments/packages-install.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
 import type { InterpreterAvailability } from "../interpreters/detect.ts";
 import type { SessionEnvironment } from "../kernels/session-env.ts";
@@ -42,4 +43,6 @@ export interface CreateCodemodeSessionManagerOptions {
 	readonly complete: (request: CompletionRequest, ctx: ExtensionContext) => Promise<CompletionResult>;
 	/** The session generation's handle registry; subprocess kernels reach `wait()`/`handle()` through the bridge. */
 	readonly handles?: HandleRegistry;
+	/** The Python environment `packages.install("pip", ...)` reaches from a Python cell over the bridge. */
+	readonly environments?: PackagesInstallEnvironments;
 }