@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-10

package/src/extension/session-manager.ts

@@ -1,12 +1,15 @@
 import { join } from "node:path";
 import type { ExtensionContext } from "@code-yeongyu/senpi";
+import { readProcessFootprint } from "@code-yeongyu/senpi";
 import { type BridgeServerHandle, startBridgeServer } from "../bridge/http-server.ts";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
+import { resolveJsIsolation, resolveKernelToolsEnabled } from "../config/feature-settings.ts";
 import { resolveKernelMemoryThresholds } from "../config/memory-settings.ts";
 import { collectOrphanedChildren } from "../host-sdk.ts";
 import { JavaScriptKernel } from "../kernels/js/context-manager.ts";
 import type { KernelToolsCapability, KernelToolsDescribeResult } from "../kernels/js/kernel-tools-types.ts";
+import type { SessionEnvironment } from "../kernels/session-env.ts";
 import type { KernelLifecycle } from "../kernels/shared/kernel-death.ts";
 import type { EvalKernel, EvalLanguage } from "../tool/types.ts";
 import { type BridgeDispatchContext, dispatchBridgeCompletion } from "./bridge-dispatch.ts";
@@ -252,6 +255,8 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			this.#options.localRoots ??
 			(this.#options.artifactsDir ? { local: join(this.#options.artifactsDir, "local") } : undefined);
 		if (language === "js") {
+			const memoryThresholds = resolveKernelMemoryThresholds(this.#options.settings.memory);
+			const processIsolation = resolveJsIsolation(this.#options.settings) === "process";
 			const kernel = new JavaScriptKernel({
 				sessionId: this.#options.sessionId,
 				cwd: this.#options.cwd,
@@ -259,8 +264,13 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 				onMessage,
 				hostToolNames: () => this.#options.listTools?.().map((tool) => tool.name) ?? [],
 				foreignLanguageNames: () => this.#foreignKernelToolNames(),
-				memory: resolveKernelMemoryThresholds(this.#options.settings.memory),
+				memory: memoryThresholds,
 				collectOrphanedChildren,
+				...(processIsolation ? { isolation: "process" as const } : {}),
+				...(processIsolation && memoryThresholds !== undefined
+					? { processMemory: { thresholds: memoryThresholds, readFootprint: readProcessFootprint } }
+					: {}),
+				...(resolveKernelToolsEnabled(this.#options.settings) ? {} : { kernelToolsEnabled: false }),
 				...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
 				...(localRoots ? { localRoots: { ...localRoots } } : {}),
 				...(this.#options.artifactsDir ? { artifactsDir: this.#options.artifactsDir } : {}),
@@ -276,10 +286,14 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			...(localRoots ? { localRoots: { ...localRoots } } : {}),
 			...(this.#options.artifactsDir ? { artifactsDir: this.#options.artifactsDir } : {}),
 		};
+		// The Python prelude reads this when a cell defines an @tool; only a disabled setting adds it.
+		const sessionEnv: SessionEnvironment | undefined = resolveKernelToolsEnabled(this.#options.settings)
+			? this.#options.sessionEnv
+			: { ...this.#options.sessionEnv, SENPI_CODEMODE_KERNEL_TOOLS: "0" };
 		const shared = {
 			sessionId: this.#options.sessionId,
 			cwd: this.#options.cwd,
-			...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
+			...(sessionEnv ? { sessionEnv } : {}),
 			connection,
 			onMessage,
 			...lifecycle,

package/src/index.ts

@@ -10,7 +10,7 @@ import {
 	resolveMaxDetachedCells,
 	resolveRunBudgetSeconds,
 } from "./config/settings.ts";
-import { EvalNotifier } from "./extension/eval-notifier.ts";
+import { type EvalNotificationContent, EvalNotifier } from "./extension/eval-notifier.ts";
 import { EVAL_CELLS_STATUS_KEY } from "./extension/eval-status.ts";
 import { EvalStatusTicker } from "./extension/eval-status-ticker.ts";
 import { hostLine, modelIdFrom } from "./extension/host-facts.ts";
@@ -57,7 +57,7 @@ export interface CodemodeExtensionAPI {
 	getActiveTools(): string[];
 	getAllTools(): readonly EvalSchemaToolInfo[];
 	sendMessage(
-		message: { customType: string; content: string; display: boolean },
+		message: { customType: string; content: EvalNotificationContent; display: boolean },
 		options?: { triggerTurn?: boolean; deliverAs?: "steer" | "followUp" | "nextTurn" },
 	): void;
 	/** Optional host event bus; a host without one turns extension event emission into a harmless no-op. */
@@ -158,6 +158,7 @@ export default function senpiCodemode(pi: CodemodeExtensionAPI, options: SenpiCo
 					settings: runtime.settings,
 					artifactsDir: runtime.artifactsDir,
 					...(runtime.pythonEnvironments === undefined ? {} : { pythonEnvironments: runtime.pythonEnvironments }),
+					jsEnvironments: runtime.jsEnvironments,
 					cellManager,
 					handles,
 					executionTracker: manager,

package/src/interpreters/detect.ts

@@ -20,6 +20,8 @@ export interface InterpreterDetected {
 
 export interface InterpreterUnavailable {
 	readonly ok: false;
+	/** Why a configured interpreter could not be used; unset when detection simply found none. */
+	readonly reason?: string;
 }
 
 export type InterpreterDetection = InterpreterDetected | InterpreterUnavailable;
@@ -43,6 +45,8 @@ export interface CreateInterpreterDetectorOptions {
 
 export interface InterpreterDetector {
 	detect(language: CodemodeLanguage): Promise<InterpreterDetection>;
+	/** Probes exactly this executable (no PATH candidates, no splitting on spaces). */
+	detectExplicit(path: string): Promise<InterpreterDetection>;
 }
 
 export interface LanguageAvailability {
@@ -74,6 +78,9 @@ export function createInterpreterDetector(options: CreateInterpreterDetectorOpti
 			cache.set(language, pending);
 			return pending;
 		},
+		detectExplicit(path) {
+			return probeExplicit(path, probe);
+		},
 	};
 }
 
@@ -82,7 +89,7 @@ export async function getInterpreterAvailability(
 	detector: InterpreterDetector,
 ): Promise<InterpreterAvailability> {
 	return {
-		py: await availabilityFor("py", settings.languages.py, detector),
+		py: await pythonAvailability(settings, detector),
 		js: await availabilityFor("js", settings.languages.js, detector),
 		rb: await availabilityFor("rb", settings.languages.rb, detector),
 		jl: await availabilityFor("jl", settings.languages.jl, detector),
@@ -100,6 +107,32 @@ async function availabilityFor(
 	};
 }
 
+/** `languages.pyInterpreter`, when set, is the only interpreter Python uses; a path that does not answer makes Python unavailable. */
+async function pythonAvailability(
+	settings: CodemodeSettings,
+	detector: InterpreterDetector,
+): Promise<LanguageAvailability> {
+	const configured = settings.languages.pyInterpreter;
+	if (configured === undefined || !settings.languages.py)
+		return await availabilityFor("py", settings.languages.py, detector);
+	return { enabled: true, detected: await detector.detectExplicit(configured) };
+}
+
+async function probeExplicit(path: string, probe: ExecFileProbe): Promise<InterpreterDetection> {
+	const reason = (detail: string): InterpreterUnavailable => ({
+		ok: false,
+		reason: `languages.pyInterpreter "${path}" ${detail}; Python is unavailable in this session`,
+	});
+	try {
+		const result = await probe(path, ["--version"], { timeoutMs: probeTimeoutMs });
+		const version = parseVersion(`${result.stdout}\n${result.stderr}`);
+		if (version === null) return reason("did not report a Python version");
+		return { ok: true, path, version, resolvedPath: path };
+	} catch (error) {
+		return reason(`could not run (${error instanceof Error ? error.message.split("\n")[0] : String(error)})`);
+	}
+}
+
 async function detectUncached(
 	language: CodemodeLanguage,
 	hostPlatform: NodeJS.Platform,

package/src/kernels/AGENTS.md

@@ -16,6 +16,8 @@ runner/prelude assets).
 | Julia kernel | `jl/kernel.ts` + `jl/prelude.jl`, `jl/runner.jl` |
 | Shared subprocess layer | `shared/subprocess-kernel.ts`, `subprocess-{contract,process,queue,run}.ts`, `runtime-asset.ts` |
 | Session environment | `session-env.ts` (PI_* contract shared by all kernels; mirrors the core bash tool) |
+| JS process isolation | `js/process-worker.ts` (host side), `js/process-entry.js` (child entry), `js/kernel-memory.ts`, `js/control-frames.ts` |
+| Sandbox cells | `sandbox/sandbox-cell.ts` (host executor); `sandbox/vendor/pi-codemode/**` (vendored runtime, see its `VENDORED.md`) |
 
 ## CONVENTIONS
 

package/src/kernels/js/cell-dispatch.ts

@@ -0,0 +1,44 @@
+import type { HostToKernelMessage } from "../../bridge/protocol.ts";
+import type { HostCellExecutor } from "../../tool/types.ts";
+import { inputAtStart } from "../shared/cell-source-at-start.ts";
+import { refusedEntry } from "./host-entries.ts";
+import {
+	type JavaScriptKernelOptions,
+	type JavaScriptRunInput,
+	resolveKernelToolNameSource,
+} from "./kernel-contract.ts";
+import type { LocalModuleLoader } from "./local-module-loader.ts";
+
+export type CellDispatch =
+	| { readonly kind: "host"; readonly host: HostCellExecutor }
+	| { readonly kind: "worker"; readonly frames: readonly HostToKernelMessage[] };
+
+/**
+ * Decides at the cell's turn how it runs: as a host entry (an install, or a turn-time refusal such as an unreadable
+ * `%load` file) or in the worker, with the frames the worker needs (the current kernel-tool names, then the cell).
+ */
+export function dispatchCell(
+	queued: JavaScriptRunInput,
+	loader: LocalModuleLoader,
+	options: Pick<JavaScriptKernelOptions, "hostToolNames" | "foreignLanguageNames">,
+): CellDispatch {
+	const input = inputAtStart(queued);
+	if ("refused" in input) return { kind: "host", host: refusedEntry(input.refused) };
+	if (input.host !== undefined) return { kind: "host", host: input.host };
+	return {
+		kind: "worker",
+		frames: [
+			{
+				type: "kernel-tools-names",
+				hostToolNames: resolveKernelToolNameSource(options.hostToolNames),
+				foreignLanguageNames: resolveKernelToolNameSource(options.foreignLanguageNames),
+			},
+			{
+				type: "run",
+				cellId: input.cellId,
+				code: loader.prepareCell(input.code, input.kernelPreludes, input.sourceFile, input.packageRoot?.()),
+				timeoutMs: input.timeoutMs,
+			},
+		],
+	};
+}

package/src/kernels/js/cell-ownership.js

@@ -0,0 +1,268 @@
+import { currentCell, onReleaseOf, settleWithCell } from "./cell-run-context.js";
+
+// What a cell owns, and how each kind ends when the cell is stopped. Every patch is a no-op outside a cell, refuses
+// (or never starts) new work for a released cell, and registers what a live cell starts so release can end it.
+const RESOURCE_CLOSERS = ["terminate", "destroy", "stop", "close", "end"];
+
+// Some host bindings are read-only (Bun.fetch); those keep their own behaviour and are not owned by cells.
+function replace(owner, name, replacement, patched) {
+	const original = owner[name];
+	try {
+		owner[name] = replacement;
+	} catch {
+		return;
+	}
+	if (owner[name] !== replacement) return;
+	patched.push(() => {
+		owner[name] = original;
+	});
+}
+
+function builtin(name) {
+	return process.getBuiltinModule?.(name);
+}
+
+function closeResource(resource) {
+	for (const method of RESOURCE_CLOSERS) {
+		if (typeof resource?.[method] !== "function") continue;
+		if (method === "stop") resource.stop(true);
+		else resource[method]();
+		return;
+	}
+}
+
+function ownResultsOf(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const own = function (...args) {
+			const cell = currentCell();
+			if (cell === undefined) return original.apply(this, args);
+			if (cell.released) throw cell.interruption;
+			const result = original.apply(this, args);
+			const register = (resource) => {
+				onReleaseOf(cell, () => closeResource(resource));
+				return resource;
+			};
+			return result instanceof Promise ? result.then(register) : register(result);
+		};
+		Object.assign(own, original);
+		replace(owner, name, own, patched);
+	}
+}
+
+// `globals` is the global scope already patched: a module binding that is the same owned function is left alone.
+function patchTimers(scope, patched, globals = undefined) {
+	for (const [name, clearName] of [
+		["setTimeout", "clearTimeout"],
+		["setInterval", "clearInterval"],
+		["setImmediate", "clearImmediate"],
+	]) {
+		const original = scope?.[name];
+		const clear = scope?.[clearName];
+		if (typeof original !== "function" || typeof clear !== "function") continue;
+		if (globals !== undefined && original === globals[name]) continue;
+		const owned = function (callback, ...rest) {
+			const cell = currentCell();
+			if (cell === undefined || typeof callback !== "function") return original.call(this, callback, ...rest);
+			if (cell.released) {
+				const never = original.call(this, () => {}, ...rest);
+				clear.call(scope, never);
+				return never;
+			}
+			let forget = () => {};
+			const handle = original.call(
+				this,
+				function (...args) {
+					if (name !== "setInterval") forget();
+					return callback.apply(this, args);
+				},
+				...rest,
+			);
+			forget = onReleaseOf(cell, () => clear.call(scope, handle));
+			return handle;
+		};
+		Object.assign(owned, original);
+		replace(scope, name, owned, patched);
+	}
+}
+
+function patchPromiseApi(owner, name, patched) {
+	const original = owner?.[name];
+	if (typeof original !== "function") return;
+	const bound = function (...args) {
+		const cell = currentCell();
+		if (cell === undefined) return original.apply(this, args);
+		if (cell.released) return Promise.reject(cell.interruption);
+		return settleWithCell(cell, original.apply(this, args));
+	};
+	Object.assign(bound, original);
+	replace(owner, name, bound, patched);
+}
+
+function patchTimerPromises(patched) {
+	const timers = builtin("node:timers/promises");
+	if (timers === undefined) return;
+	patchPromiseApi(timers, "setTimeout", patched);
+	patchPromiseApi(timers, "setImmediate", patched);
+	const original = timers.setInterval;
+	if (typeof original !== "function") return;
+	const owned = function (...args) {
+		const cell = currentCell();
+		if (cell?.released) throw cell.interruption;
+		const iterator = original.apply(this, args);
+		if (cell === undefined) return iterator;
+		onReleaseOf(cell, () => void iterator.return?.());
+		return iterator;
+	};
+	replace(timers, "setInterval", owned, patched);
+}
+
+function patchFetch(scope, patched, name = "fetch") {
+	const original = scope[name];
+	if (typeof original !== "function") return;
+	const owned = function (input, init) {
+		const cell = currentCell();
+		if (cell === undefined) return original.call(this, input, init);
+		if (cell.released) return Promise.reject(cell.interruption);
+		const controller = new AbortController();
+		const own = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+		const signal = own === undefined ? controller.signal : AbortSignal.any([own, controller.signal]);
+		const forget = onReleaseOf(cell, () => controller.abort(cell.interruption));
+		return original.call(this, input, { ...init, signal }).finally(forget);
+	};
+	Object.assign(owned, original);
+	replace(scope, name, owned, patched);
+}
+
+// A released cell's code may still be resumed by a short I/O completion; refusing new I/O at that point makes such a
+// loop throw the interruption on its next operation instead of running on in the kept worker.
+function refuseWhenReleased(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const guarded = function (...args) {
+			const cell = currentCell();
+			if (cell?.released) throw cell.interruption;
+			const result = original.apply(this, args);
+			return cell === undefined ? result : settleWithCell(cell, result);
+		};
+		Object.assign(guarded, original);
+		replace(owner, name, guarded, patched);
+	}
+}
+
+// The callback form: a released cell's operation is never started, so its callback never runs, the same way a timer a
+// released cell sets never fires.
+function neverStartWhenReleased(owner, names, patched) {
+	for (const name of names) {
+		const original = owner?.[name];
+		if (typeof original !== "function") continue;
+		const guarded = function (...args) {
+			if (currentCell()?.released) return undefined;
+			return original.apply(this, args);
+		};
+		Object.assign(guarded, original);
+		replace(owner, name, guarded, patched);
+	}
+}
+
+const FS_OPERATIONS = ["readFile", "writeFile", "appendFile", "readdir", "stat", "lstat", "open", "access", "mkdir", "rm", "unlink", "rename", "copyFile"];
+
+// For ES classes only (Worker, WebSocket, MessageChannel): `instanceof` keeps accepting instances the runtime creates
+// internally from the original class. Node's function-style constructors are owned on activation instead.
+function patchClass(scope, name, close, patched) {
+	const Original = scope?.[name];
+	if (typeof Original !== "function") return;
+	const Owned = class extends Original {
+		constructor(...args) {
+			const cell = currentCell();
+			if (cell?.released) throw cell.interruption;
+			super(...args);
+			if (cell !== undefined) onReleaseOf(cell, () => close(this));
+		}
+		static [Symbol.hasInstance](value) {
+			return value instanceof Original;
+		}
+	};
+	Object.defineProperty(Owned, "name", { value: Original.name });
+	replace(scope, name, Owned, patched);
+}
+
+const NODE_RESOURCE_FACTORIES = {
+	"node:net": ["createConnection", "connect", "createServer"],
+	"node:tls": ["connect", "createServer"],
+	"node:http": ["request", "get", "createServer"],
+	"node:https": ["request", "get", "createServer"],
+	"node:dgram": ["createSocket"],
+	"node:fs": ["createReadStream", "createWriteStream", "watch"],
+	"node:readline": ["createInterface"],
+	"node:readline/promises": ["createInterface"],
+};
+
+// Node's socket and server types are function-style constructors that Node's own subclasses call with `.call(this)`
+// (http.Server calls net.Server), so they cannot be swapped for a class. A socket or server only does anything once it
+// connects, listens or binds, so that call is where a cell takes ownership of it; http, https and tls inherit these.
+const NODE_ACTIVATIONS = {
+	"node:net": { Socket: ["connect"], Server: ["listen"] },
+	"node:dgram": { Socket: ["bind"] },
+};
+
+function ownOnActivation(proto, names, patched) {
+	for (const name of names) {
+		const original = proto?.[name];
+		if (typeof original !== "function") continue;
+		const owned = new WeakSet();
+		const activate = function (...args) {
+			const cell = currentCell();
+			if (cell === undefined) return original.apply(this, args);
+			if (cell.released) throw cell.interruption;
+			if (!owned.has(this)) {
+				owned.add(this);
+				onReleaseOf(cell, () => closeResource(this));
+			}
+			return original.apply(this, args);
+		};
+		replace(proto, name, activate, patched);
+	}
+}
+
+export function installCellOwnership(scope = globalThis) {
+	const patched = [];
+	patchTimers(scope, patched);
+	patchTimers(builtin("node:timers"), patched, scope);
+	patchTimerPromises(patched);
+	patchFetch(scope, patched);
+	patchClass(scope, "WebSocket", (socket) => socket.close(), patched);
+	patchClass(scope, "Worker", (worker) => void worker.terminate(), patched);
+	refuseWhenReleased(builtin("node:fs/promises"), FS_OPERATIONS, patched);
+	neverStartWhenReleased(builtin("node:fs"), FS_OPERATIONS, patched);
+	patchClass(scope, "MessageChannel", (channel) => {
+		channel.port1.close();
+		channel.port2.close();
+	}, patched);
+	patchClass(scope, "BroadcastChannel", (channel) => channel.close(), patched);
+	const bun = scope.Bun;
+	if (bun !== undefined) {
+		patchPromiseApi(bun, "sleep", patched);
+		if (bun.fetch !== scope.fetch) patchFetch(bun, patched, "fetch");
+		refuseWhenReleased(bun, ["file", "write"], patched);
+		ownResultsOf(bun, ["connect", "listen", "serve", "udpSocket"], patched);
+	}
+	for (const [module, factories] of Object.entries(NODE_RESOURCE_FACTORIES)) ownResultsOf(builtin(module), factories, patched);
+	patchClass(builtin("node:worker_threads"), "Worker", (worker) => void worker.terminate(), patched);
+	for (const [module, types] of Object.entries(NODE_ACTIVATIONS)) {
+		for (const [name, methods] of Object.entries(types)) ownOnActivation(builtin(module)?.[name]?.prototype, methods, patched);
+	}
+	// Node hands `import("node:…")` its own ESM namespace; without this sync a cell importing the module gets the
+	// unowned originals.
+	syncBuiltinExports();
+	return () => {
+		for (const undo of patched.reverse()) undo();
+		syncBuiltinExports();
+	};
+}
+
+function syncBuiltinExports() {
+	builtin("node:module")?.syncBuiltinESMExports?.();
+}

package/src/kernels/js/cell-run-context.js

@@ -0,0 +1,89 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// Every continuation a cell creates (awaits, timers, I/O callbacks) runs inside its cell record. Stopping a cell
+// releases it: everything it owns is cleared, rejected or closed (`cell-ownership.js` decides what a cell owns), and
+// anything its code tries to start afterwards is refused, while the kernel and its variables stay.
+const cellRuns = new AsyncLocalStorage();
+const releasedInterruptions = new WeakMap();
+const MAX_CAUSE_DEPTH = 8;
+
+export function runInCell(cell, run) {
+	return cellRuns.run(cell, run);
+}
+
+export function currentCell() {
+	return cellRuns.getStore();
+}
+
+export function releasedCellError() {
+	const cell = cellRuns.getStore();
+	return cell?.released === true ? cell.interruption : undefined;
+}
+
+export function assertCellLive() {
+	const error = releasedCellError();
+	if (error !== undefined) throw error;
+}
+
+export function onCellRelease(close) {
+	const cell = cellRuns.getStore();
+	return cell === undefined ? () => {} : onReleaseOf(cell, close);
+}
+
+export function onReleaseOf(cell, close) {
+	cell.onRelease ??= new Set();
+	cell.onRelease.add(close);
+	return () => cell.onRelease.delete(close);
+}
+
+/**
+ * Releases the cell: every closer runs even when an earlier one throws, and the failures are returned so the caller
+ * can report them; a resource that would not close is a fact the user should see, not something to swallow.
+ */
+export function releaseCell(cell) {
+	cell.released = true;
+	releasedInterruptions.set(cell.interruption, cell);
+	const failures = [];
+	for (const close of cell.onRelease ?? []) {
+		try {
+			close();
+		} catch (error) {
+			failures.push(error);
+		}
+	}
+	cell.onRelease?.clear();
+	return failures;
+}
+
+/**
+ * The cell an unhandled rejection came from: a released cell whose interruption is the reason or sits in its `cause`
+ * chain, or the cell whose async context the rejection runs in (Node exposes it to the handler; Bun does not).
+ */
+export function cellOfRejection(reason) {
+	let current = reason;
+	for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof current === "object" && current !== null; depth++) {
+		const cell = releasedInterruptions.get(current);
+		if (cell !== undefined) return cell;
+		current = current.cause;
+	}
+	return cellRuns.getStore();
+}
+
+// An operation already in flight when its cell is released rejects with the interruption at once, so the stopped
+// cell's continuation never runs again; a non-promise result is returned as it is.
+export function settleWithCell(cell, result) {
+	if (result === null || typeof result !== "object" || typeof result.then !== "function") return result;
+	return new Promise((resolve, reject) => {
+		const forget = onReleaseOf(cell, () => reject(cell.interruption));
+		result.then(
+			(value) => {
+				forget();
+				resolve(value);
+			},
+			(error) => {
+				forget();
+				reject(error);
+			},
+		);
+	});
+}