@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-11

package/src/tool/run-eval-cell.ts

@@ -7,12 +7,12 @@ import {
 	kernelToolsStorage,
 } from "@code-yeongyu/senpi";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
+import { resolveSandbox } from "../config/feature-settings.ts";
 import { DEFAULT_FOREGROUND_WINDOW_SECONDS, defaultCodemodeSettings } from "../config/settings.ts";
-import {
-	KERNEL_TOOLS_CAPABILITIES,
-	type KernelToolsCapability,
-	type KernelToolsDescribeResult,
-} from "../kernels/js/kernel-tools-types.ts";
+import type { JsEnvironments } from "../environments/js-environments.ts";
+import type { PackagesInstallEnvironments } from "../environments/packages-install.ts";
+import { KERNEL_TOOLS_CAPABILITIES, type KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
+import { sandboxCellExecutor, sandboxRuntimeInfo } from "../kernels/sandbox/sandbox-cell.ts";
 import { TIMEOUT_PAUSE_OP, TIMEOUT_RESUME_OP } from "../timeouts/bridge-timeout.ts";
 import { abortError, CellExecution, defaultTimeoutFactory } from "./cell-execution.ts";
 import { CellHandler, type CellState } from "./cell-handler.ts";
@@ -42,7 +42,8 @@ export async function runEvalCell(
 	const bridgeAbortController = new AbortController();
 	const cellSignal = AbortSignal.any([invocation.signal, bridgeAbortController.signal]);
 	const bridgeContext: ExtensionContext = { ...invocation.ctx, signal: cellSignal };
-	const runtime = options.runtimes?.[invocation.input.language];
+	const runtime =
+		invocation.input.isolate === true ? sandboxRuntimeInfo() : options.runtimes?.[invocation.input.language];
 	const state: CellState = {
 		input: invocation.input,
 		...(runtime === undefined ? {} : { runtime }),
@@ -238,6 +239,7 @@ async function executeCell(
 				...(kernelTools === undefined ? {} : { kernelTools }),
 				...(options.handles === undefined ? {} : { handles: options.handles }),
 				hardDeadlineMs: cell.startedAtMs + cell.hardLimitSeconds * 1_000,
+				...cellEnvironments(invocation.input.language, options),
 			});
 			handler = activeHandler;
 			cellManager.bindKernel(
@@ -261,25 +263,50 @@ async function executeCell(
 			}
 			if (invocation.input.reset) await execution.wait(kernel.reset());
 			execution.setKernel(kernel);
-			const magic = planMagicCell(invocation.input.language, invocation.input.code, options.pythonEnvironments);
+			const magic = planMagicCell(
+				invocation.input.language,
+				invocation.input.code,
+				options.pythonEnvironments,
+				options.jsEnvironments,
+			);
 			// Resolved when the cell's turn comes in the kernel's queue: a %load reads the file the cells ahead of it
 			// wrote, and a refusal settles in queue order like any cell.
 			const loadOptions = { cwd: invocation.ctx.cwd, artifactsDir: options.artifactsDir };
-			const resolveAtStart =
-				magic.kind === "load"
+			// An isolated cell never runs a file outside its sandbox: %load there is refused.
+			const isolatedLoad = invocation.input.isolate === true && magic.kind === "load";
+			const resolveAtStart = isolatedLoad
+				? () => ({
+						ok: false as const,
+						message:
+							"isolate: true cannot run a %load cell: an isolated cell sees no host files, and loading one would break that isolation. Run %load in a normal cell, or paste the code into the isolated cell.",
+					})
+				: magic.kind === "load"
 					? () => loadCell(magic.target, loadOptions)
 					: magic.kind === "refused"
 						? () => ({ ok: false as const, message: magic.message })
 						: undefined;
+			const isolated =
+				invocation.input.isolate === true && resolveAtStart === undefined
+					? sandboxCellExecutor(invocation.input.code, {
+							sandbox: resolveSandbox(options.settings ?? {}),
+							executeTool: options.executeTool,
+							toolNames: () => (options.listTools?.() ?? []).map((tool) => tool.name),
+							describeTool: (name) => options.listTools?.().find((tool) => tool.name === name)?.description,
+						})
+					: undefined;
 			const environments = invocation.input.language === "py" ? options.pythonEnvironments : undefined;
 			const envRoot = environments === undefined ? undefined : () => environments.activeRoot ?? "";
+			const jsEnvironments = invocation.input.language === "js" ? options.jsEnvironments : undefined;
+			const packageRoot = jsEnvironments === undefined ? undefined : () => jsEnvironments.packageRoot;
 			const result = await execution.wait(
 				kernel.run({
 					cellId: invocation.cellId,
 					code: invocation.input.code,
 					...(resolveAtStart === undefined ? {} : { resolveAtStart }),
 					...(magic.kind === "host" ? { host: magic.executor } : {}),
+					...(isolated === undefined ? {} : { host: isolated }),
 					...(envRoot === undefined ? {} : { envRoot }),
+					...(packageRoot === undefined ? {} : { packageRoot }),
 					...(bridgeCellToken === undefined ? {} : { bridgeCellToken }),
 					kernelPreludes: options.kernelPreludes?.(),
 					onMessage,
@@ -325,14 +352,24 @@ async function executeCell(
 }
 
 function kernelToolsFor(kernel: EvalKernel): KernelToolsCapability | undefined {
-	if (!("describeKernelTools" in kernel) || typeof kernel.describeKernelTools !== "function") return undefined;
-	const withTools = kernel as EvalKernel & {
-		describeKernelTools: (names: readonly string[]) => Promise<KernelToolsDescribeResult>;
-		invokeKernelTool: ExtensionKernelTools["invoke"];
-	};
+	if (typeof kernel.describeKernelTools !== "function" || typeof kernel.invokeKernelTool !== "function")
+		return undefined;
+	const describeKernelTools = kernel.describeKernelTools.bind(kernel);
+	const invokeKernelTool = kernel.invokeKernelTool.bind(kernel);
 	return {
 		capabilities: KERNEL_TOOLS_CAPABILITIES,
-		describe: (names) => withTools.describeKernelTools(names),
-		invoke: (request, options) => withTools.invokeKernelTool(request, options),
+		describe: describeKernelTools,
+		invoke: invokeKernelTool,
 	} satisfies ExtensionKernelTools;
 }
+
+// Only JS cells call tools in-process; a Python cell reaches packages.install() over the bridge, whose session manager
+// holds the same Python environment its magics use.
+function cellEnvironments(
+	language: string,
+	options: { readonly jsEnvironments?: JsEnvironments },
+): { readonly environments?: PackagesInstallEnvironments } {
+	if (language === "js" && options.jsEnvironments !== undefined)
+		return { environments: { js: options.jsEnvironments } };
+	return {};
+}

package/src/tool/runtime-label.ts

@@ -10,7 +10,8 @@ const ELLIPSIS = "\u2026";
  * runtime name because node and bun are otherwise indistinguishable.
  */
 export function formatRuntimeBadge(language: EvalLanguage, runtime: EvalRuntimeInfo, home: string = homedir()): string {
-	const label = language === "js" ? `${runtime.name} ${runtime.version}` : runtime.version;
+	const base = language === "js" ? `${runtime.name} ${runtime.version}` : runtime.version;
+	const label = runtime.isolation === undefined ? base : `${base}, ${runtime.isolation}`;
 	if (runtime.path === undefined || runtime.path.length === 0) return label;
 	return `${label}, ${minifyPath(runtime.path, home)}`;
 }

package/src/tool/types.ts

@@ -1,4 +1,9 @@
-import type { AgentToolResult, AgentToolUpdateCallback, KernelPreludeContribution } from "@code-yeongyu/senpi";
+import type {
+	AgentToolResult,
+	AgentToolUpdateCallback,
+	ExtensionKernelTools,
+	KernelPreludeContribution,
+} from "@code-yeongyu/senpi";
 import { type TSchema, type TUnsafe, Type } from "typebox";
 import type { KernelMemoryReport } from "../bridge/memory-protocol.ts";
 import type { HostToKernelMessage, KernelToHostMessage } from "../bridge/protocol.ts";
@@ -8,7 +13,7 @@ import {
 	DEFAULT_RUN_BUDGET_SECONDS,
 	defaultCodemodeSettings,
 } from "../config/settings.ts";
-import type { KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
+import type { KernelToolsCapability, KernelToolsDescribeResult } from "../kernels/js/kernel-tools-types.ts";
 import type { TruncationMeta } from "../output/output-meta.ts";
 
 export const evalLanguageOrder = ["js", "py", "rb", "jl"] as const;
@@ -52,6 +57,8 @@ export interface EvalToolInput {
 	readonly timeout?: number;
 	readonly on_timeout?: "detach" | "error";
 	readonly reset?: boolean;
+	/** Run in a fresh sandbox VM instead of the persistent kernel; accepted only while `sandbox.enabled` is on. */
+	readonly isolate?: boolean;
 }
 
 export interface EvalListInput {
@@ -117,14 +124,26 @@ const fullEvalInputSchema = Type.Object(
 /** Runtime accepts a discriminated run/control union. */
 export type EvalInputSchema = TUnsafe<EvalToolRequest> & Pick<typeof fullEvalInputSchema, "properties">;
 
+const ISOLATE_FIELD_DESCRIPTION =
+	"js only. Fresh sandbox per call: no persistence, no fs/net/process/timers; only tool.* plus print/display.";
+
 export function createEvalInputSchema(
 	enabled: EnabledEvalLanguages,
 	deadlines: EvalDeadlineSeconds = defaultEvalDeadlineSeconds,
+	options: { readonly sandbox?: boolean } = {},
 ): EvalInputSchema {
 	const languages = enabledLanguageList(enabled);
 	if (languages.length === 0) throw new Error("eval requires at least one enabled language");
 	const languageSchema = evalLanguageUnion(languages);
-	const properties = evalInputProperties(languageSchema, deadlines);
+	// The sandbox field exists in the schema only while sandbox cells are turned on, so the default schema
+	// (and the prompt built from it) stays exactly what it was.
+	const properties =
+		options.sandbox === true && languages.includes("js")
+			? {
+					...evalInputProperties(languageSchema, deadlines),
+					isolate: Type.Optional(Type.Boolean({ description: ISOLATE_FIELD_DESCRIPTION })),
+				}
+			: evalInputProperties(languageSchema, deadlines);
 	return Type.Unsafe<EvalToolRequest>(
 		Type.Object(properties, {
 			// Keep branches self-contained for Mistral-hosted GLM (#2240).
@@ -175,6 +194,12 @@ export interface EvalKernelRunInput {
 	readonly envRoot?: () => string;
 	/** The file a `%load` cell runs: tracebacks name it and its relative imports resolve from its directory. */
 	readonly sourceFile?: string;
+	/**
+	 * JavaScript only: the session's managed package revision; bare imports that do not resolve from cwd fall back to
+	 * it. Read when the cell starts running (not when it was queued), so a cell queued behind `%bun add` resolves the
+	 * revision that install published.
+	 */
+	readonly packageRoot?: () => string | undefined;
 	/**
 	 * Called when the cell's turn comes in the kernel's queue, never earlier: what to run instead of `code` (a `%load`
 	 * cell's file), or a refusal that settles the cell as failed in queue order.
@@ -218,6 +243,10 @@ export interface EvalKernel {
 	isAlive?(): boolean;
 	/** Hands over, and forgets, every queued cell of a dead kernel that never started. */
 	drainPending?(): readonly PendingCell[];
+	/** Describes this kernel's registered kernel tools; only an in-process JS kernel has them. */
+	describeKernelTools?(names: readonly string[]): Promise<KernelToolsDescribeResult>;
+	/** Invokes one of this kernel's kernel tools; present exactly when `describeKernelTools` is. */
+	invokeKernelTool?: ExtensionKernelTools["invoke"];
 }
 
 export interface EvalKernelManager {
@@ -259,6 +288,8 @@ export interface EvalRuntimeInfo {
 	readonly name: string;
 	readonly version: string;
 	readonly path?: string;
+	/** JS only: the kernel runs in a child process (`process`), or the cell ran in an isolated QuickJS VM (`sandbox`). */
+	readonly isolation?: "process" | "sandbox";
 }
 
 export type EvalRuntimes = Readonly<Partial<Record<EvalLanguage, EvalRuntimeInfo>>>;