@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-11

package/src/kernels/py/prelude.py

@@ -61,6 +61,7 @@ RESERVED_HANDLE_STATUS_TOOL = "__handle_status__"
 RESERVED_HANDLE_OUTPUT_TOOL = "__handle_output__"
 RESERVED_HANDLE_SEND_TOOL = "__handle_send__"
 RESERVED_HANDLE_CANCEL_TOOL = "__handle_cancel__"
+RESERVED_PACKAGES_INSTALL_TOOL = "__packages_install__"
 TIMEOUT_PAUSE_OP = "timeout-pause"
 TIMEOUT_RESUME_OP = "timeout-resume"
 
@@ -660,25 +661,6 @@ class ThreadRoutedStream(io.TextIOBase):
         )
         self.cell_target: io.StringIO | None = None
 
-    @contextlib.contextmanager
-    def capture(self, buffer: io.StringIO, *, cell: bool) -> Iterator[None]:
-        me = threading.get_ident()
-        previous = self._targets.get(me)
-        self._targets[me] = buffer
-        inherited = self._inherited.set(buffer)
-        if cell:
-            self.cell_target = buffer
-        try:
-            yield
-        finally:
-            self._inherited.reset(inherited)
-            if previous is None:
-                self._targets.pop(me, None)
-            else:
-                self._targets[me] = previous
-            if cell:
-                self.cell_target = None
-
     def write(self, text: str) -> int:
         target = self._targets.get(threading.get_ident()) or self._inherited.get() or self.cell_target
         if target is None:
@@ -693,6 +675,38 @@ class ThreadRoutedStream(io.TextIOBase):
         return None
 
 
+@contextlib.contextmanager
+def capture_streams(
+    streams: tuple[ThreadRoutedStream, ThreadRoutedStream],
+    buffers: tuple[io.StringIO, io.StringIO],
+    *,
+    cell: bool,
+) -> Iterator[None]:
+    stdout, stderr = streams
+    out, err = buffers
+    me = threading.get_ident()
+    previous_out, previous_err = stdout._targets.get(me), stderr._targets.get(me)
+    stdout._targets[me], stderr._targets[me] = out, err
+    inherited_out, inherited_err = stdout._inherited.set(out), stderr._inherited.set(err)
+    if cell:
+        stdout.cell_target, stderr.cell_target = out, err
+    try:
+        yield
+    finally:
+        stderr._inherited.reset(inherited_err)
+        stdout._inherited.reset(inherited_out)
+        if previous_err is None:
+            stderr._targets.pop(me, None)
+        else:
+            stderr._targets[me] = previous_err
+        if previous_out is None:
+            stdout._targets.pop(me, None)
+        else:
+            stdout._targets[me] = previous_out
+        if cell:
+            stdout.cell_target, stderr.cell_target = None, None
+
+
 @dataclass
 class _Entry:
     name: str
@@ -704,7 +718,8 @@ class _Entry:
 
 
 class Registry:
-    def __init__(self, on_change: Callable[[list[str]], None]) -> None:
+    def __init__(self, on_change: Callable[[list[str]], None], *, disabled: bool = False) -> None:
+        self._disabled = disabled
         self._lock = threading.Lock()
         self._entries: dict[str, _Entry] = {}
         # Revisions outlive undefine: a redefined name never reuses a revision an old descriptor carries.
@@ -713,6 +728,8 @@ class Registry:
         self.generation = 1
 
     def define(self, fn: Any, *, name: Any = None, description: Any = None, schema: Any = None) -> Any:
+        if self._disabled:
+            raise KernelToolError("tools_unavailable", "kernel tools are turned off for this project (kernelTools.enabled is false)")
         inferred = infer_tool(fn, name=name, description=description, schema=schema)
         key = tool_key(inferred["name"])
         with self._lock:
@@ -901,8 +918,7 @@ class KernelToolRunner:
                 if invocation.cancelled.is_set():
                     raise Cancelled(CANCELLED_BEFORE_START)
                 CURRENT.set(invocation)
-                stdout, stderr = self._streams
-                with stdout.capture(output, cell=False), stderr.capture(output, cell=False):
+                with capture_streams(self._streams, (output, output), cell=False):
                     value = self._call(invocation, entry.fn, args)
             finally:
                 CURRENT.set(None)
@@ -983,7 +999,12 @@ async def _awaited(awaitable: Any) -> Any:
 
 KERNEL_TOOL_TOKEN = OwnerToken()
 KERNEL_TOOL_STREAMS = (ThreadRoutedStream(stderr=False), ThreadRoutedStream(stderr=True))
-KERNEL_TOOL_REGISTRY = Registry(lambda names: emit({"type": "kernel-tools-defined", "names": names}))
+# kernelTools.enabled is read once, while the prelude loads and before any cell runs, then removed from the
+# environment: rewriting os.environ cannot turn kernel tools back on, and cell subprocesses never see the switch.
+KERNEL_TOOL_REGISTRY = Registry(
+    lambda names: emit({"type": "kernel-tools-defined", "names": names}),
+    disabled=os.environ.pop("SENPI_CODEMODE_KERNEL_TOOLS", None) == "0",
+)
 KERNEL_TOOL_RUNNER = KernelToolRunner(emit, KERNEL_TOOL_TOKEN, KERNEL_TOOL_REGISTRY, KERNEL_TOOL_STREAMS)
 
 
@@ -1154,6 +1175,27 @@ def tool_schema(name: str | None = None) -> Any:
     )
 
 
+class _Packages:
+    """packages.install(manager, requirements, *, timeout=600): the %pip installer as a call; returns its receipt."""
+
+    __slots__ = ()
+
+    def install(self, manager: str, requirements: Any, *, timeout: float | None = None) -> Any:
+        args: dict[str, Any] = {"manager": manager, "requirements": requirements}
+        if timeout is not None:
+            args["timeout"] = timeout
+        # A long install must not hit the 60 s socket cap; the host bounds it by the timeout (600 s by default).
+        socket_timeout = (600 if timeout is None else float(timeout)) + _WAIT_SOCKET_GRACE_SECONDS
+        return bridge_post(
+            "/call",
+            {"callId": f"py-{uuid.uuid4()}", "toolName": RESERVED_PACKAGES_INSTALL_TOOL, "args": args},
+            socket_timeout=socket_timeout,
+        )
+
+
+packages = _Packages()
+
+
 def output(
     *ids: str,
     format: str = "raw",
@@ -1781,6 +1823,7 @@ USER_NS.update(
         "workpool": workpool,
         "output": output,
         "tool_schema": tool_schema,
+        "packages": packages,
         "wait": wait,
         "handle": handle,
         "__senpi_magic": _magic,
@@ -2187,8 +2230,7 @@ def run_cell(
     cell_scope = CURRENT_CELL_TOKEN.set(cell_token)
     try:
         KERNEL_TOOL_TOKEN.acquire()
-        cell_stdout, cell_stderr = KERNEL_TOOL_STREAMS
-        with cell_stdout.capture(stdout, cell=True), cell_stderr.capture(stderr, cell=True):
+        with capture_streams(KERNEL_TOOL_STREAMS, (stdout, stderr), cell=True):
             apply_preludes(preludes)
             leave_source_file = _enter_source_file(source_file)
             body, expression = compile_cell(code, source_file or "<cell>")
@@ -2342,7 +2384,7 @@ def _start_parent_watch() -> None:
         ).start()
 
 
-def _read_control(commands: queue.Queue[tuple[str, Any]]) -> None:
+def _read_control(commands: queue.SimpleQueue[tuple[str, Any]]) -> None:
     # Kernel-tool frames are served here, so a callback can be admitted while the main thread is inside a cell.
     for raw in sys.stdin:
         try:
@@ -2361,7 +2403,7 @@ def main() -> None:
     signal.signal(signal.SIGINT, signal.SIG_IGN)
     _start_parent_watch()
     sys.stdout, sys.stderr = KERNEL_TOOL_STREAMS
-    commands: queue.Queue[tuple[str, Any]] = queue.Queue()
+    commands: queue.SimpleQueue[tuple[str, Any]] = queue.SimpleQueue()
     threading.Thread(target=_read_control, args=(commands,), name="senpi-control-reader", daemon=True).start()
     host_closed = False
     while True:

package/src/kernels/py/process.ts

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute } from "node:path";
 import type { Readable, Writable } from "node:stream";
 
 export interface KernelChild {
@@ -53,6 +55,8 @@ export function defaultSpawn(options: KernelSpawnOptions): KernelChild {
 }
 
 export function splitCommand(commandLine: string): { readonly command: string; readonly args: readonly string[] } {
+	// A configured interpreter path is one executable even when it contains spaces.
+	if (isAbsolute(commandLine) && existsSync(commandLine)) return { command: commandLine, args: [] };
 	const [command, ...args] = commandLine.split(" ").filter(Boolean);
 	if (!command) throw new Error("Python interpreter path is empty");
 	return { command, args };

package/src/kernels/py/transport.ts

@@ -244,6 +244,10 @@ export class PythonKernelTransport {
 		this.#child.stderr.on("data", onStderr);
 		this.#child.on("error", onError);
 		this.#child.on("exit", onExit);
+		// senpi#3016: a frame written while the interpreter is dying fails on the stdin stream (EPIPE), not on the child.
+		// #onError already ignores it once the child has exited or the transport is inactive, and the listener is never
+		// detached, so a late write failure is never unhandled.
+		this.#child.stdin.on("error", onError);
 		const { sessionId, connection, memory, kernelGeneration } = this.#options;
 		this.#write({
 			type: "init",

package/src/kernels/rb/runner.rb

@@ -9,6 +9,7 @@ $stdout.flush
 $__senpi_binding = TOPLEVEL_BINDING
 $__senpi_frame_mutex = Mutex.new
 $__senpi_current_cell = nil
+$__senpi_memory_cell = nil
 $__senpi_capture_cell = nil
 $__senpi_connection = nil
 $__senpi_frame_io = STDOUT.dup
@@ -123,8 +124,6 @@ rescue JSON::GeneratorError
   value.inspect
 end
 
-$__senpi_memory = nil
-
 SENPI_SIZER_SAMPLE = 1_000
 SENPI_SIZER_NODE_BUDGET = 5_000
 SENPI_SIZER_MAX_DEPTH = 64
@@ -239,19 +238,6 @@ rescue StandardError
   []
 end
 
-# The host reads the interpreter's footprint and decides on the notice; the runner only names its
-# largest globals. Nothing here spawns a process, so the user's `$?` is left alone.
-def __senpi_memory_report
-  return nil if $__senpi_memory.nil?
-  named = __senpi_largest_globals(5)
-  # The host replaces liveBytes with the interpreter footprint it reads itself; only globals is used.
-  report = { "liveBytes" => 0, "measure" => "footprint" }
-  report["globals"] = named unless named.empty?
-  report
-rescue StandardError
-  nil
-end
-
 SENPI_NON_DISPLAY_NODES = %i[
   LASGN IASGN GASGN CVASGN DASGN OP_ASGN OP_CDECL CDECL MASGN CASGN
   DEFN DEFS CLASS MODULE SCLASS ALIAS UNDEF
@@ -305,8 +291,6 @@ def __senpi_run_cell(message)
       "durationMs" => ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round,
     }
     frame["valueRepr"] = __senpi_value_repr(value) if !value.nil? && __senpi_should_display_result?(source)
-    memory = __senpi_memory_report
-    frame["memory"] = memory unless memory.nil?
     __senpi_emit(frame)
   rescue Exception => error
     __senpi_emit({
@@ -319,6 +303,7 @@ def __senpi_run_cell(message)
   ensure
     $__senpi_capture_cell = nil
     $__senpi_current_cell = nil
+    $__senpi_memory_cell = cell_id
   end
 end
 
@@ -332,10 +317,15 @@ $__senpi_protocol_stdin.each_line do |line|
   when "init"
     __senpi_emit({ "type" => "status", "event" => { "op" => "kernel-startup", "stage" => "host-init" } })
     $__senpi_connection = message["connection"]
-    $__senpi_memory = message["memory"]
-    __senpi_emit({ "type" => "ready" })
+    __senpi_emit({ "type" => "ready", "memoryGlobals" => true })
   when "run"
+    $__senpi_memory_cell = nil
     __senpi_run_cell(message)
+  when "memory-globals"
+    if message["cellId"] == $__senpi_memory_cell && $__senpi_current_cell.nil?
+      __senpi_emit({ "type" => "memory-globals-result", "cellId" => message["cellId"], "globals" => __senpi_largest_globals(5) })
+      $__senpi_memory_cell = nil
+    end
   when "close"
     __senpi_emit({ "type" => "closed" })
     exit 0

package/src/kernels/sandbox/sandbox-cell.ts

@@ -0,0 +1,141 @@
+import type { ResolvedSandbox } from "../../config/feature-settings.ts";
+import { marshalToolResult } from "../../tool/image.ts";
+import type { EvalRuntimeInfo, ExecuteTool, HostCellExecutor } from "../../tool/types.ts";
+import type { CodemodeSandbox } from "./vendor/pi-codemode/runtime/host.ts";
+import type { CodemodeError, CodemodeOutputFrame, CodemodeTool } from "./vendor/pi-codemode/types.ts";
+
+export interface SandboxCellOptions {
+	readonly sandbox: ResolvedSandbox;
+	readonly executeTool: ExecuteTool;
+	readonly toolNames: () => readonly string[];
+	readonly describeTool?: (name: string) => string | undefined;
+	/** Where the QuickJS wasm lives; by default the installed `quickjs-wasi` package's file. */
+	readonly wasmPath?: string;
+}
+
+/**
+ * The runtime an isolated cell's result reports: the QuickJS build it runs on, never the persistent kernel's (senpi#2811).
+ * Read from the installed quickjs-wasi package the wasm loads from, only when an isolated cell runs; when that package
+ * cannot be resolved the cell itself fails with eval_isolate_unavailable, and the version says so.
+ */
+export function sandboxRuntimeInfo(): EvalRuntimeInfo {
+	let version = "unavailable";
+	try {
+		// getBuiltinModule, not a static import: node:module would otherwise load with the extension.
+		const manifest: unknown = process.getBuiltinModule("node:module").createRequire(import.meta.url)(
+			"quickjs-wasi/package.json",
+		);
+		if (
+			typeof manifest === "object" &&
+			manifest !== null &&
+			"version" in manifest &&
+			typeof manifest.version === "string"
+		)
+			version = manifest.version;
+	} catch {
+		// Reported as "unavailable": the same missing package makes the cell fail with eval_isolate_unavailable.
+	}
+	return { name: "quickjs", version, isolation: "sandbox" };
+}
+
+// On the script's first line so reported line numbers still match the cell; globals, so a cell's own
+// `const print` shadows them instead of failing as a redeclaration.
+const OUTPUT_ALIASES =
+	'globalThis.print = (...values) => text(values.map((value) => (typeof value === "string" ? value : JSON.stringify(value))).join(" ")); globalThis.display = (value) => ((typeof value === "string" && value.startsWith("data:image/")) || (value !== null && typeof value === "object" && ("image_url" in value || value.type === "image")) ? image(value) : text(typeof value === "string" ? value : JSON.stringify(value))); globalThis.tool = tools; ';
+
+const ERROR_CODES: Partial<Record<CodemodeError["kind"], string>> = {
+	timeout: "eval_isolate_timeout",
+	aborted: "eval_isolate_aborted",
+	sandbox: "eval_isolate_unavailable",
+};
+
+function codeFor(error: CodemodeError): string | undefined {
+	if (error.kind === "script" && error.reason === "memory") return "eval_isolate_memory_limit";
+	if (error.kind === "script" && error.name === "CodemodeStoreDisabledError") return "eval_isolate_no_state";
+	if (error.kind === "script" && error.reason === "unresolved") return "eval_isolate_unresolved_promise";
+	return ERROR_CODES[error.kind];
+}
+
+/** The persistent kernel never sees an isolated cell; its tools go through executeTool so permission hooks still apply. */
+export function sandboxCellExecutor(code: string, options: SandboxCellOptions): HostCellExecutor {
+	return async ({ signal, emit }) => {
+		let sandbox: CodemodeSandbox;
+		try {
+			// Lazy: the vendored QuickJS runtime loads only when a session runs its first isolated cell. The wasm is loaded
+			// here, before any of the cell runs, so a missing runtime is reported as unavailable instead of failing inside
+			// the script.
+			const runtime = await import("./vendor/pi-codemode/runtime/host.ts");
+			const { loadQuickJSWasm } = await import("./vendor/pi-codemode/wasm.ts");
+			const wasm = await loadQuickJSWasm(options.wasmPath);
+			const items = new Map<number, string[]>();
+			const tools: CodemodeTool[] = options
+				.toolNames()
+				.filter((name) => name !== "eval")
+				.map((name) => ({
+					name,
+					description: options.describeTool?.(name) ?? "",
+					execute: async (args: unknown, context: { signal: AbortSignal }) =>
+						marshalToolResult(await options.executeTool(name, args, { signal: context.signal })),
+				}));
+			sandbox = new runtime.CodemodeSandbox({
+				wasm,
+				tools,
+				timeoutMs: options.sandbox.timeoutSeconds * 1_000,
+				memoryLimitBytes: options.sandbox.memoryMb * 1024 * 1024,
+				output: "stream",
+				builtins: { store: "reject" },
+				onOutputFrame: (frame: CodemodeOutputFrame) => {
+					const parts = items.get(frame.itemId) ?? [];
+					parts.push(frame.chunk);
+					if (!frame.final) {
+						items.set(frame.itemId, parts);
+						return;
+					}
+					items.delete(frame.itemId);
+					const payload = parts.join("");
+					if (frame.type === "image") {
+						emit({ type: "display", mimeType: frame.mimeType ?? "image/png", dataBase64: payload });
+					} else {
+						emit({ type: "text", stream: "stdout", data: payload.endsWith("\n") ? payload : `${payload}\n` });
+					}
+				},
+			});
+		} catch (error) {
+			// The full error, paths included, goes to the host's own log so a maintainer can diagnose it; the cell gets
+			// only what failed and the error's code. This covers every setup step: the runtime import, the tool list,
+			// the wasm load and the sandbox itself.
+			console.error("[senpi-codemode] isolated cell setup failed:", error);
+			const code =
+				error instanceof Error && "code" in error && typeof error.code === "string" ? ` (${error.code})` : "";
+			return {
+				ok: false,
+				error: {
+					name: "SandboxUnavailableError",
+					message: `eval_isolate_unavailable: the QuickJS runtime for isolated cells could not be loaded${code}; nothing in the cell ran`,
+				},
+			};
+		}
+		try {
+			const result = await sandbox.execute(OUTPUT_ALIASES + code, { signal });
+			if (result.ok) {
+				return result.value === undefined
+					? { ok: true }
+					: {
+							ok: true,
+							valueRepr: typeof result.value === "string" ? result.value : JSON.stringify(result.value),
+						};
+			}
+			const errorCode = codeFor(result.error);
+			return {
+				ok: false,
+				error: {
+					...(result.error.name === undefined ? {} : { name: result.error.name }),
+					message: errorCode === undefined ? result.error.message : `${errorCode}: ${result.error.message}`,
+					...(result.error.stack === undefined ? {} : { stack: result.error.stack }),
+				},
+			};
+		} finally {
+			await sandbox.close();
+		}
+	};
+}

package/src/kernels/sandbox/vendor/pi-codemode/VENDORED.md

@@ -40,3 +40,4 @@ A sync must re-apply both kinds: dropping a marked line (for example `"output-fr
    - A normal finish settles only after every frame is consumed. An abort or timeout settles at once and drops frames still queued. The timer and the abort signal stay armed while a finished run's last frames drain, so a late abort, timeout or `close()` abandons them too (the run settles with that error): a consumer that never returns cannot keep a run alive.
    - `frameBytes` and `windowBytes` must be at least 4, so a frame can always hold a whole surrogate pair.
 2. **Builtin store policy** (`builtins: { store: "collect" | "reject" }`; `types.ts`, `runtime/protocol.ts`, `runtime/worker.ts`, `runtime/host.ts`, `runtime/prelude-source.ts`). With `"reject"`, `load()` returns `undefined` and `store()` throws `CodemodeStoreDisabledError`. The names stay defined, so scripts written for upstream fail with a clear message instead of a ReferenceError.
+3. **Runtime-set error reasons** (`types.ts` `CodemodeError.reason`, `runtime/prelude-source.ts`, `runtime/worker.ts`). The prelude captures the engine's own `InternalError` before user code runs and tags a failure `reason: "memory"` only for an instance of it whose message is exactly "out of memory"; its stalled-promise failure is tagged `reason: "unresolved"`; the worker tags an engine out-of-memory from `evalCode` the same way; and `text()` rethrows the engine's own error instead of replacing it with a `TypeError`. The host maps the isolate error codes from `reason` only, never from message text. Upstream has no `reason`, so its behaviour is unchanged.

package/src/kernels/sandbox/vendor/pi-codemode/runtime/host.ts

@@ -115,7 +115,7 @@ class Execution {
 	private finished = false;
 	// senpi-change begin: output streaming
 	private readonly stream: StreamOptions | undefined;
-	private readonly credits: Int32Array | undefined;
+	private readonly credits: Int32Array<SharedArrayBuffer> | undefined;
 	private frameChain: Promise<void> = Promise.resolve();
 	private frames = 0;
 	private inFlightBytes = 0;
@@ -188,7 +188,7 @@ class Execution {
 			// senpi-change begin: output streaming and builtin policy
 			...(this.credits === undefined || this.stream === undefined
 				? {}
-				: { stream: { credits: this.credits.buffer as SharedArrayBuffer, frameBytes: this.stream.frameBytes } }),
+				: { stream: { credits: this.credits.buffer, frameBytes: this.stream.frameBytes } }),
 			storePolicy: options.storePolicy,
 			// senpi-change end
 		};

package/src/kernels/sandbox/vendor/pi-codemode/runtime/prelude-source.ts

@@ -46,6 +46,10 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 	const options = optionsJson === undefined ? {} : JSON.parse(optionsJson);
 	const streamOutput = options.streamOutput === true;
 	const rejectStore = options.store === "reject";
+	// The engine's own InternalError, captured before user code runs: a failure is tagged by identity, never by its
+	// text, so a cell's own error that merely mentions memory keeps its own code. A script can still construct this
+	// constructor itself and so label its own failure as the memory limit; that mislabels only its own cell.
+	const EngineInternalError = typeof InternalError === "function" ? InternalError : undefined;
 	// senpi-change end
 	"use strict";
 	const stringify = JSON.stringify;
@@ -94,7 +98,13 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 
 	function describeError(error) {
 		if (error instanceof ErrorCtor) {
-			return stringify({ name: error.name, message: error.message, stack: errorText(error) });
+			// senpi-change begin: the engine's out-of-memory error is reported by identity, not by matching its message
+			const reason =
+				EngineInternalError !== undefined && error instanceof EngineInternalError && error.message === "out of memory"
+					? "memory"
+					: undefined;
+			return stringify({ name: error.name, message: error.message, stack: errorText(error), reason });
+			// senpi-change end
 		}
 		return stringify({ message: format(error) });
 	}
@@ -285,6 +295,8 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 		try {
 			rendered = outputText(value);
 		} catch (error) {
+			// The engine's own out-of-memory error keeps its identity, so it is still reported as the memory limit.
+			if (EngineInternalError !== undefined && error instanceof EngineInternalError) throw error; // senpi-change
 			throw new TypeErrorCtor(error instanceof ErrorCtor ? error.message : String(error));
 		}
 		output("text", rendered);
@@ -423,6 +435,7 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 					name: "Error",
 					message:
 						"The script is waiting on a promise that can never settle: no tool call is pending, and timers do not exist here.",
+					reason: "unresolved", // senpi-change: tagged by the runtime, so a script's own error text never matches it
 				}),
 			);
 			return true;

package/src/kernels/sandbox/vendor/pi-codemode/runtime/worker.ts

@@ -48,7 +48,10 @@ function discardOutput(memory: { readonly buffer: ArrayBufferLike }) {
 function describeException(error: JSException): string {
 	const head = error.message ? `${error.name}: ${error.message}` : error.name;
 	const stack = error.stack?.trimEnd();
-	return JSON.stringify({ name: error.name, message: error.message, stack: stack ? `${head}\n${stack}` : head });
+	// senpi-change begin: evalCode fails before any script runs, so an InternalError here is the engine's own
+	const reason = error.name === "InternalError" && error.message === "out of memory" ? "memory" : undefined;
+	return JSON.stringify({ name: error.name, message: error.message, stack: stack ? `${head}\n${stack}` : head, reason });
+	// senpi-change end
 }
 // senpi-change begin: output streaming
 /**

package/src/kernels/sandbox/vendor/pi-codemode/types.ts

@@ -71,6 +71,8 @@ export interface CodemodeError {
 	name?: string;
 	message: string;
 	stack?: string;
+	/** senpi-change: set by the runtime itself (never from script text) for its own memory-limit and stalled failures. */
+	reason?: "memory" | "unresolved";
 }
 
 /** Keys the script changed with `store()`. Only successful executions report writes. */

package/src/kernels/shared/bun-ffi.ts

@@ -0,0 +1,24 @@
+/**
+ * The one read of `bun:ffi` behind a guard: `process.getBuiltinModule` returns the module on Bun and
+ * `undefined` on Node, so this module loads on either runtime, and only a result carrying the callable
+ * surface the CPU readers bind is treated as FFI - the same boundary `display-js.ts` uses for `Bun`.
+ */
+export type BunFfi = {
+	readonly dlopen: <S>(path: string, definitions: Record<string, unknown>) => { readonly symbols: S };
+	readonly FFIType: Record<string, number>;
+	readonly ptr: (buffer: ArrayBufferView) => number;
+};
+
+/** True when `value` carries the `bun:ffi` surface the kernel CPU readers use (`dlopen`, `FFIType`, `ptr`). */
+export function isBunFfi(value: unknown): value is BunFfi {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("dlopen" in value) || typeof value.dlopen !== "function") return false;
+	if (!("ptr" in value) || typeof value.ptr !== "function") return false;
+	return "FFIType" in value && typeof value.FFIType === "object" && value.FFIType !== null;
+}
+
+/** The runtime's `bun:ffi` module, or `undefined` on Node and on any runtime whose builtin is not one. */
+export function loadBunFfi(): BunFfi | undefined {
+	const ffi: unknown = process.getBuiltinModule("bun:ffi");
+	return isBunFfi(ffi) ? ffi : undefined;
+}

package/src/kernels/shared/host-cell.ts

@@ -0,0 +1,57 @@
+import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { HostCellExecutor } from "../../tool/types.ts";
+
+type HostCellOutcome = Awaited<ReturnType<HostCellExecutor>>;
+type HostResult = Extract<KernelToHostMessage, { type: "result" }>;
+
+export interface HostCellRun {
+	readonly cellId: string;
+	readonly abort: AbortController;
+	readonly done: Promise<HostResult>;
+}
+
+/**
+ * Runs a host entry (a cell the host executes, such as an install) for one queue slot: output after the outcome or after
+ * an abort belongs to no cell, a synchronous throw stays in this cell, and `settle` receives the cell's result.
+ * `settleAfterAbort` says whether an aborted entry still settles here or whoever aborted it settles the cell.
+ */
+export function runHostCell(
+	cellId: string,
+	host: HostCellExecutor,
+	io: {
+		readonly emit: (message: KernelToHostMessage) => void;
+		readonly settle: (result: HostResult) => void;
+		readonly durationMs: () => number;
+		readonly settleAfterAbort: boolean;
+	},
+): HostCellRun {
+	const abort = new AbortController();
+	let finished = false;
+	const emit = (message: KernelToHostMessage): void => {
+		if (!finished && !abort.signal.aborted) io.emit(message);
+	};
+	const done = new Promise<HostCellOutcome>((resolve) => resolve(host({ signal: abort.signal, emit }))).then(
+		(outcome): HostResult =>
+			outcome.ok
+				? {
+						type: "result",
+						cellId,
+						ok: true,
+						durationMs: io.durationMs(),
+						...(outcome.valueRepr === undefined ? {} : { valueRepr: outcome.valueRepr }),
+					}
+				: { type: "result", cellId, ok: false, error: outcome.error, durationMs: 0 },
+		(error: unknown): HostResult => ({
+			type: "result",
+			cellId,
+			ok: false,
+			error: { message: error instanceof Error ? error.message : String(error) },
+			durationMs: 0,
+		}),
+	);
+	void done.then((result) => {
+		finished = true;
+		if (io.settleAfterAbort || !abort.signal.aborted) io.settle(result);
+	});
+	return { cellId, abort, done };
+}

package/src/kernels/shared/kernel-memory-host.ts

@@ -1,4 +1,4 @@
-import type { KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
+import type { KernelMemoryReport, KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { EvalLanguage } from "../../tool/types.ts";
 import { KernelMemoryPolicy } from "./kernel-memory.ts";
@@ -11,7 +11,7 @@ export type FootprintReader = (pid: number) => { readonly bytes: number } | unde
 export interface KernelMemoryHostOptions {
 	/**
 	 * Host-measured kernel (rb, jl): the host reads the interpreter's footprint after each result and
-	 * replaces the runner's live reading with it; the runner still names its largest globals, so the
+	 * replaces the runner's live reading with it; the runner names its largest globals on demand, so the
 	 * notice and the ceiling both apply, with every reading counting (no collection precedes it).
 	 */
 	readonly readFootprint?: FootprintReader;
@@ -36,12 +36,35 @@ export class KernelMemoryHost {
 	}
 
 	annotate(result: ResultMessage, pid?: number): ResultMessage {
+		return this.annotateReport(result, this.readReport(result, pid));
+	}
+
+	readReport(result: ResultMessage, pid?: number): KernelMemoryReport | undefined {
 		const runnerReport = result.memory;
-		const report =
-			this.#readFootprint === undefined
-				? runnerReport
-				: this.#footprintReport(this.#readFootprint, pid, runnerReport);
-		return report === undefined ? result : { ...result, memory: this.#policy.annotate(report) };
+		return this.#readFootprint === undefined
+			? runnerReport
+			: this.#footprintReport(this.#readFootprint, pid, runnerReport);
+	}
+
+	needsGlobals(report: KernelMemoryReport): boolean {
+		const { noticeBytes, ceilingBytes } = this.#policy.thresholds;
+		// Collect at or above the host-read notice threshold or ceiling, regardless of notice hysteresis;
+		// never collect below both thresholds. Zero disables a threshold, not the lazy diagnostic gate.
+		return (
+			(noticeBytes > 0 && report.liveBytes >= noticeBytes) || (ceilingBytes > 0 && report.liveBytes >= ceilingBytes)
+		);
+	}
+
+	annotateReport(result: ResultMessage, report: KernelMemoryReport | undefined): ResultMessage {
+		if (report === undefined) return result;
+		const memory = this.#policy.annotate(report);
+		// Safety accounting still observes every cell, but ordinary host-measured results carry no payload.
+		// A recycle announcement remains visible even when the replacement process is below threshold.
+		if (this.#readFootprint !== undefined && !this.needsGlobals(report) && memory.notice === undefined) {
+			const { memory: _memory, ...ordinary } = result;
+			return ordinary;
+		}
+		return { ...result, memory };
 	}
 
 	/**