@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-11

package/src/kernels/js/group-signal-notice.js

@@ -0,0 +1,117 @@
+// senpi#2995: Bun.$, node:child_process exec/execFile and the synchronous spawners leave their children in the
+// agent's process group (Bun.$ has no such option, Bun ignores `detached` for exec/execFile, and a synchronous call
+// keeps the terminal), so a group-wide signal from the same cell stops the agent. Such a command gets a notice; the
+// notice only warns and never fails the cell.
+
+// A command starts a (possibly indented) line, follows `;`, `|`, `&`, `(`, a backtick, `{`, `!`, a shell keyword
+// (`then`, `do`, `else`) or a runner (`nohup`, `time`, `xargs`, `env`, `exec`, `sudo` with flags), or opens a `-c '...'` script; a
+// `kill` word anywhere else (`git log --grep kill`, `echo kill ...`) is text.
+const COMMAND_POSITION = String.raw`(?:^\s*|[;|&(\x60]\s*|\b(?:then|do|else|nohup|time|xargs|env|exec)\s+|[{!]\s+|\bsudo(?:\s+-\S+)*\s+|\s-[A-Za-z]*c\s+['"]\s*)`;
+
+// A group target is a dash argument after the signal options: a number, `$var`, `${var}` or `$(...)`.
+const GROUP_TARGET = String.raw`-(?:\d+|\$\$|\$\{?\w+\}?|\$\()`;
+const SIGNAL_OPTION = String.raw`(?:-s\s+\w+|-n\s+\d+|-[A-Za-z]+\d*|-\d+)`;
+// The first dash argument is a signal, so a group is one after `--`, after a signal option, or after a plain pid:
+// `kill -- -<pgid>`, `kill -SIG -<pgid>`, `kill -TERM 1234 -5678`, `kill -- -$$`.
+const PID = String.raw`[^\s\-;|&][^\s;|&]*`;
+const KILL_GROUP = new RegExp(
+	String.raw`${COMMAND_POSITION}kill\b(?:` +
+		String.raw`\s+--\s+${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})+(?:\s+${PID})*\s+(?:--\s+)?${GROUP_TARGET}` +
+		String.raw`|(?:\s+${SIGNAL_OPTION})*(?:\s+${PID})+\s+${GROUP_TARGET})`,
+	"mu",
+);
+const PKILL_GROUP = new RegExp(String.raw`${COMMAND_POSITION}pkill\b[^\n;|&]*\s(?:-g\d*|--pgroup)\b`, "mu");
+// `killall` in command position (also after `sudo` or as a `-c` script) signals every process with that name, which
+// can include the agent's own (bun, node, senpi). Inside an `echo` string it is only text.
+const KILLALL = new RegExp(String.raw`${COMMAND_POSITION}killall\s`, "mu");
+
+export const GROUP_SIGNAL_NOTICE_TAG = "[senpi:group-signal]";
+
+export function signalsProcessGroup(commandText) {
+	return KILL_GROUP.test(commandText) || PKILL_GROUP.test(commandText) || KILLALL.test(commandText);
+}
+
+export function groupSignalNotice(api, readGroup = agentProcessGroup) {
+	const pgid = readGroup();
+	const group = pgid === undefined ? "the agent's process group" : `the agent's process group (${pgid})`;
+	return (
+		`${GROUP_SIGNAL_NOTICE_TAG} This command signals a process group. Children of ${api} share ${group}, so ` +
+		"signalling that group can stop this session. Start background jobs with Bun.spawn or child_process.spawn, " +
+		"which give them their own group, or signal them by pid.\n"
+	);
+}
+
+let cachedGroup;
+
+// A bounded `ps` lookup, kept once it succeeds; a missing `ps` or a failed run only drops the number from this notice.
+export function agentProcessGroup(spawnSync = globalThis.Bun?.spawnSync) {
+	if (cachedGroup !== undefined) return cachedGroup;
+	let text = "";
+	try {
+		const result = spawnSync?.(["ps", "-o", "pgid=", "-p", String(process.pid)], { timeout: 2_000 });
+		text = result?.success ? String(result.stdout).trim() : "";
+	} catch {
+		text = "";
+	}
+	if (!/^\d+$/u.test(text)) return undefined;
+	cachedGroup = text;
+	return cachedGroup;
+}
+
+export function shellCommandText(strings, expressions) {
+	if (!Array.isArray(strings)) return String(strings ?? "");
+	return strings.reduce((text, part, index) => text + part + (index < expressions.length ? String(expressions[index]) : ""), "");
+}
+
+const { promisify } = process.getBuiltinModule("node:util");
+const SCANNED_SPAWNERS = ["exec", "execFile", "execSync", "execFileSync", "spawnSync"];
+
+function commandTextOf(name, args) {
+	if (name === "exec" || name === "execSync") return String(args[0]);
+	return [args[0], ...(Array.isArray(args[1]) ? args[1] : [])].join(" ");
+}
+
+export function noticeChildProcessGroupSignals(emitText, isActive) {
+	const childProcess = process.getBuiltinModule("node:child_process");
+	const originals = new Map();
+	for (const name of SCANNED_SPAWNERS) {
+		const original = childProcess[name];
+		if (typeof original !== "function") continue;
+		originals.set(name, original);
+		const scan = (args) => {
+			try {
+				if (isActive() && signalsProcessGroup(commandTextOf(name, args))) {
+					emitText("stderr", groupSignalNotice(`child_process.${name}`));
+				}
+			} catch {
+				// The notice is advisory; the call itself always runs.
+			}
+		};
+		const scanned = function scannedSpawner(...args) {
+			scan(args);
+			return original.apply(this, args);
+		};
+		// Every own property, symbols included: `util.promisify.custom` is what makes promisify(exec) resolve to
+		// { stdout, stderr }. That custom function calls the original directly, so it is scanned too.
+		for (const key of Reflect.ownKeys(original)) {
+			if (key === "length" || key === "name" || key === "prototype" || key === promisify.custom) continue;
+			const descriptor = Object.getOwnPropertyDescriptor(original, key);
+			if (descriptor) Object.defineProperty(scanned, key, descriptor);
+		}
+		const customPromisify = original[promisify.custom];
+		if (typeof customPromisify === "function") {
+			Object.defineProperty(scanned, promisify.custom, {
+				configurable: true,
+				value: function scannedPromisified(...args) {
+					scan(args);
+					return customPromisify.apply(this, args);
+				},
+			});
+		}
+		childProcess[name] = scanned;
+	}
+	return () => {
+		for (const [name, original] of originals) childProcess[name] = original;
+	};
+}

package/src/kernels/js/host-entries.ts

@@ -0,0 +1,62 @@
+import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { HostCellExecutor } from "../../tool/types.ts";
+import { runHostCell } from "../shared/host-cell.ts";
+import type { ResultMessage } from "./kernel-contract.ts";
+
+export interface HostEntryKernel<Run> {
+	emit(run: Run, message: KernelToHostMessage): void;
+	settle(run: Run, result: ResultMessage): void;
+	durationMs(run: Run): number;
+}
+
+/** The host entries (installs) a JavaScript kernel is running: started per queue slot, stopped by interrupt and close. */
+export class HostEntries<Run extends { readonly input: { readonly cellId: string } }> {
+	readonly #aborts = new Map<Run, AbortController>();
+	readonly #done = new Map<Run, Promise<unknown>>();
+	readonly #kernel: HostEntryKernel<Run>;
+
+	constructor(kernel: HostEntryKernel<Run>) {
+		this.#kernel = kernel;
+	}
+
+	/** Runs `host` for `run`'s queue slot; it holds the slot like a cell but never reaches the worker. */
+	start(run: Run, host: HostCellExecutor): void {
+		const entry = runHostCell(run.input.cellId, host, {
+			emit: (message) => this.#kernel.emit(run, message),
+			settle: (result) => {
+				this.#aborts.delete(run);
+				this.#kernel.settle(run, result);
+			},
+			durationMs: () => this.#kernel.durationMs(run),
+			settleAfterAbort: true,
+		});
+		this.#aborts.set(run, entry.abort);
+		this.#done.set(run, entry.done);
+		void entry.done.finally(() => this.#done.delete(run));
+	}
+
+	/** Aborts `run`'s host entry; false when `run` is not one. */
+	abort(run: Run, reason: string): boolean {
+		const abort = this.#aborts.get(run);
+		if (abort === undefined) return false;
+		abort.abort(new Error(reason));
+		return true;
+	}
+
+	/** Aborts every running entry and waits for them to stop, at most `ms`: a closed kernel leaves no install running. */
+	async stopAll(reason: string, ms: number): Promise<void> {
+		const running = [...this.#done.values()];
+		for (const abort of this.#aborts.values()) abort.abort(new Error(reason));
+		let timer: ReturnType<typeof setTimeout> | undefined;
+		await Promise.race([
+			Promise.allSettled(running),
+			new Promise<void>((resolve) => (timer = setTimeout(resolve, ms))),
+		]);
+		if (timer !== undefined) clearTimeout(timer);
+	}
+}
+
+/** A turn-time refusal (an unreadable `%load` file, a refused magic) settles in queue order as a failed host entry. */
+export function refusedEntry(message: string): HostCellExecutor {
+	return async () => ({ ok: false, error: { message } });
+}

package/src/kernels/js/inline-worker.ts

@@ -19,6 +19,8 @@ export function resolveInlineWorkerEntryUrl(options: JavaScriptInlineWorkerEntry
 
 export interface WorkerLike {
 	readonly mode: JavaScriptKernelMode;
+	/** The child pid when `mode` is `"process"`; the slot reports it for orphan accounting after a crash. */
+	readonly pid?: number;
 	postMessage(message: HostToKernelMessage, transfer?: readonly MessagePort[]): void;
 	onMessage(handler: (message: KernelToHostMessage) => void): () => void;
 	onError(handler: (error: Error) => void): () => void;

package/src/kernels/js/kernel-contract.ts

@@ -7,7 +7,7 @@ import type { JavaScriptInterruptBounds } from "./interrupt-bounds.ts";
 export type ResultMessage = Extract<KernelToHostMessage, { type: "result" }>;
 export type ToolCallMessage = Extract<KernelToHostMessage, { type: "tool-call" }>;
 
-export type JavaScriptKernelMode = "worker" | "inline";
+export type JavaScriptKernelMode = "worker" | "inline" | "process";
 
 /** Snapshot or live provider consulted when the worker registry checks collisions. */
 export type KernelToolNameSource = readonly string[] | (() => readonly string[]);
@@ -30,8 +30,23 @@ export interface JavaScriptKernelOptions {
 	readonly workerEntryUrl?: URL;
 	/** Per-session PI_* values applied to the worker environment before the first cell runs. */
 	readonly sessionEnv?: SessionEnvironment;
+	/** Opt-in child-process kernel; absent keeps the worker-thread kernel. */
+	readonly isolation?: "process";
+	/** Resolution root for the process-mode runtime (bun, then node); `""` names a machine with none on PATH. */
+	readonly processCommandPath?: string;
+	/** The host's executable, which runs the child when it is bun or node; defaults to `process.execPath`. */
+	readonly processExecPath?: string;
+	/** How long a process-mode child gets to report ready; defaults to `PROCESS_STARTUP_DEADLINE_MS`. */
+	readonly processStartupDeadlineMs?: number;
+	/** Process-mode memory policy: the host reads the child's footprint instead of the in-heap worker reading. */
+	readonly processMemory?: {
+		readonly thresholds: KernelMemoryThresholds;
+		readonly readFootprint?: (pid: number) => { readonly bytes: number } | undefined;
+	};
 	/** Host tool names denied as JS kernel-tool identifiers (init protocol). */
 	readonly hostToolNames?: KernelToolNameSource;
+	/** `kernelTools.enabled`; false makes `tool(fn)` refuse with `tools_unavailable`. Unset keeps them on. */
+	readonly kernelToolsEnabled?: boolean;
 	/** Tool names registered in another kernel language, denied as JS kernel-tool identifiers. */
 	readonly foreignLanguageNames?: KernelToolNameSource;
 	/** Post-cell collection, notice, and ceiling thresholds; absent leaves the worker's memory unmanaged. */

package/src/kernels/js/kernel-memory-bridge.ts

@@ -6,7 +6,7 @@ import type { ResultMessage } from "./kernel-contract.ts";
 
 export interface JavaScriptMemoryReading {
 	readonly liveBytes: number;
-	readonly measure: "heap";
+	readonly measure: "heap" | "footprint";
 }
 
 /** A query waits at most this long: the worker answers between cells, never inside one. */

package/src/kernels/js/kernel-memory.ts

@@ -0,0 +1,79 @@
+import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
+import { restartNotice } from "../shared/kernel-death.ts";
+import type { ResultMessage } from "./kernel-contract.ts";
+import { type JavaScriptMemoryReading, KernelMemoryBridge } from "./kernel-memory-bridge.ts";
+import type { JavaScriptKernelOptions } from "./local-module-loader.ts";
+import { JavaScriptProcessMemoryHost } from "./process-memory-host.ts";
+
+/**
+ * The kernel's one view of memory: the worker's heap bridge, or in process mode the child process's footprint, plus
+ * the restart notice a crash leaves for the next result.
+ */
+export class JavaScriptKernelMemory {
+	readonly #bridge: KernelMemoryBridge;
+	readonly #process: JavaScriptProcessMemoryHost | null;
+	readonly #pid: () => number | undefined;
+	readonly #processMode: boolean;
+	#restartNotice: string | null = null;
+
+	constructor(options: JavaScriptKernelOptions, pid: () => number | undefined) {
+		const processMode = options.isolation === "process";
+		this.#bridge = new KernelMemoryBridge(processMode ? undefined : options.memory, options.onMemoryCollected);
+		this.#process =
+			processMode && options.processMemory !== undefined
+				? new JavaScriptProcessMemoryHost(options.processMemory.thresholds, options.processMemory.readFootprint)
+				: null;
+		this.#pid = pid;
+		this.#processMode = processMode;
+	}
+
+	get lastLiveBytes(): number | undefined {
+		return this.#process === null ? this.#bridge.lastLiveBytes : this.#process.lastLiveBytes(this.#pid);
+	}
+
+	/** A reading between cells. The worker is asked only through `post`, given when a worker is ready to answer. */
+	async query(
+		post: ((message: HostToKernelMessage) => void) | undefined,
+	): Promise<JavaScriptMemoryReading | undefined> {
+		if (this.#process !== null) return this.#process.query(this.#pid);
+		return post === undefined ? undefined : await this.#bridge.query(post);
+	}
+
+	consume(message: KernelToHostMessage): boolean {
+		return this.#bridge.consume(message);
+	}
+
+	settled(message: ResultMessage): ResultMessage {
+		if (this.#process !== null) return this.#process.settled(message, this.#pid);
+		const settled = this.#bridge.settled(message);
+		if (this.#restartNotice === null) return settled;
+		const notice = this.#restartNotice;
+		this.#restartNotice = null;
+		return { ...settled, notice, kernelState: "restarted" };
+	}
+
+	/** Whether the kernel should restart for memory now; only once nothing is running or queued (`idle`). */
+	claimRecycle(idle: boolean): boolean {
+		const worker = this.#bridge.claimRecycle(idle);
+		return this.#process?.claimRecycle(idle) === true || worker;
+	}
+
+	/** The worker was retired: pending readings fail. */
+	workerLost(error: Error): void {
+		this.#bridge.workerLost(error);
+	}
+
+	/**
+	 * The kernel crashed: pending readings fail. In process mode the next result also says the kernel restarted (a
+	 * crashed child loses every global); worker mode reports its crash as it always has, with no notice.
+	 */
+	crashed(error: Error): void {
+		this.#bridge.workerLost(error);
+		if (this.#process !== null) {
+			this.#process.workerLost();
+			this.#process.markRestarted(error);
+			return;
+		}
+		if (this.#processMode) this.#restartNotice = restartNotice("js", error.message);
+	}
+}

package/src/kernels/js/kernel-tools-registry.js

@@ -45,6 +45,7 @@ export function createKernelToolRegistry(options = {}) {
 			return generation;
 		},
 		define(fn, metadata) {
+			if (options.disabled === true) throw kernelToolError("tools_unavailable", "kernel tools are turned off for this project (kernelTools.enabled is false)");
 			assertJs();
 			const parsed = parseToolFunction(fn);
 			const resolved = resolveToolMetadata(metadata, parsed.params);

package/src/kernels/js/local-module-loader.ts

@@ -79,6 +79,14 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"  const specifier = String(source);",
 		"  const kernelBun = globalThis[Symbol.for('senpi.kernel.bun')];",
 		"  if (specifier === 'bun' && kernelBun) return { ...(await import('bun')), WebView: kernelBun.WebView, default: kernelBun };",
+		// Under Bun a cell's named import (`import { spawn } from 'node:child_process'`) binds the builtin's original
+		// export even after the worker patched the module object (worker-cwd.js), so the session cwd and the cell
+		// children's own process group (senpi#2995) were skipped. The patched module objects are served instead.
+		"  const patched = /^(?:node:)?(child_process|fs|fs\\/promises|path)$/.exec(specifier);",
+		"  if (patched && typeof process.getBuiltinModule === 'function') {",
+		"    const builtin = process.getBuiltinModule('node:' + patched[1]);",
+		"    if (builtin) return { ...builtin, default: builtin };",
+		"  }",
 		"  const match = /^([a-z][a-z0-9+.-]*):\\/\\/(.*)$/i.exec(specifier);",
 		"  let target = specifier;",
 		"  if (match) {",
@@ -98,7 +106,13 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"    const urlModule = await import('node:url');",
 		"    target = urlModule.pathToFileURL(specifier).href;",
 		"  }",
-		"  return options === undefined ? import(target) : import(target, options);",
+		"  const load = (resolved) => (options === undefined ? import(resolved) : import(resolved, options));",
+		"  const resolvePackage = globalThis[Symbol.for('senpi.kernel.resolvePackage')];",
+		"  if (target === specifier && typeof resolvePackage === 'function') {",
+		"    const resolved = resolvePackage(specifier, [context.cwdUrl, context.packageRootUrl]);",
+		"    if (resolved !== undefined) return await load(resolved);",
+		"  }",
+		"  return await load(target);",
 		"};",
 	].join("\n");
 }
@@ -115,18 +129,23 @@ function contributionPrelude(plan: KernelPreludePlan): string {
 
 export class LocalModuleLoader {
 	readonly #prelude: string;
+	readonly #cwdUrl: string;
 	readonly #contributions = new KernelPreludeTracker();
 
 	constructor(options: LocalModuleLoaderOptions) {
 		this.#prelude = loaderPrelude(runtimeContext(options));
+		this.#cwdUrl = directoryUrl(options.cwd);
 	}
 
-	prepareCell(code: string, contributions: readonly KernelPreludeContribution[] = [], sourceFile?: string): string {
+	prepareCell(
+		code: string,
+		contributions: readonly KernelPreludeContribution[] = [],
+		sourceFile?: string,
+		packageRoot?: string,
+	): string {
 		// A %load cell resolves its relative imports from its own file's directory for that cell only.
-		const base =
-			sourceFile === undefined
-				? ""
-				: `\nglobalThis.__senpi_module_context__ = { ...globalThis.__senpi_module_context__, cwdUrl: ${JSON.stringify(directoryUrl(dirname(sourceFile)))} };`;
+		const cwdUrl = sourceFile === undefined ? this.#cwdUrl : directoryUrl(dirname(sourceFile));
+		const base = `\nglobalThis.__senpi_module_context__ = { ...globalThis.__senpi_module_context__, cwdUrl: ${JSON.stringify(cwdUrl)}, packageRootUrl: ${JSON.stringify(packageRoot === undefined ? null : directoryUrl(packageRoot))} };`;
 		const prelude = `${this.#prelude}${base}\n${contributionPrelude(this.#contributions.plan(contributions))}`;
 		return `${PREPARED_CELL_PREFIX}${JSON.stringify({ prelude, code: rewriteImports(code), ...(sourceFile === undefined ? {} : { sourceFile }) })}`;
 	}

package/src/kernels/js/process-drain-scan.d.ts

@@ -0,0 +1,8 @@
+export type DrainPart = { readonly text: string } | { readonly key: string };
+
+export interface DrainScan {
+	readonly parts: DrainPart[];
+	readonly carry: string;
+}
+
+export function scanDrainText(carry: string, chunk: string, marker: string): DrainScan;

package/src/kernels/js/process-drain-scan.js

@@ -0,0 +1,28 @@
+/**
+ * Splits text read from the process kernel's fd 1 pipe into the output it carries and the result keys its drain
+ * markers name, in order. A read boundary can cut a marker, so a trailing prefix of one is handed back as `carry` for
+ * the next read rather than sent as output.
+ *
+ * Self-contained on purpose: its source also runs inside the pipe reader thread (process-entry.js `DRAINER`).
+ */
+export function scanDrainText(carry, chunk, marker) {
+	let text = carry + chunk;
+	const parts = [];
+	for (;;) {
+		const at = text.indexOf(marker);
+		if (at === -1) break;
+		const close = text.indexOf("\u0000", at + marker.length);
+		if (close === -1) break;
+		if (at > 0) parts.push({ text: text.slice(0, at) });
+		parts.push({ key: text.slice(at + marker.length, close) });
+		text = text.slice(close + 1);
+	}
+	let nextCarry = "";
+	const partial = text.lastIndexOf("\u0000");
+	if (partial !== -1 && marker.startsWith(text.slice(partial, partial + marker.length))) {
+		nextCarry = text.slice(partial);
+		text = text.slice(0, partial);
+	}
+	if (text.length > 0) parts.push({ text });
+	return { parts, carry: nextCarry };
+}