@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-2

package/src/tool/run-eval-cell.ts

@@ -7,12 +7,14 @@ import {
 	kernelToolsStorage,
 } from "@code-yeongyu/senpi";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
+import { resolveSandbox } from "../config/feature-settings.ts";
 import { DEFAULT_FOREGROUND_WINDOW_SECONDS, defaultCodemodeSettings } from "../config/settings.ts";
 import {
 	KERNEL_TOOLS_CAPABILITIES,
 	type KernelToolsCapability,
 	type KernelToolsDescribeResult,
 } from "../kernels/js/kernel-tools-types.ts";
+import { sandboxCellExecutor } from "../kernels/sandbox/sandbox-cell.ts";
 import { TIMEOUT_PAUSE_OP, TIMEOUT_RESUME_OP } from "../timeouts/bridge-timeout.ts";
 import { abortError, CellExecution, defaultTimeoutFactory } from "./cell-execution.ts";
 import { CellHandler, type CellState } from "./cell-handler.ts";
@@ -261,25 +263,50 @@ async function executeCell(
 			}
 			if (invocation.input.reset) await execution.wait(kernel.reset());
 			execution.setKernel(kernel);
-			const magic = planMagicCell(invocation.input.language, invocation.input.code, options.pythonEnvironments);
+			const magic = planMagicCell(
+				invocation.input.language,
+				invocation.input.code,
+				options.pythonEnvironments,
+				options.jsEnvironments,
+			);
 			// Resolved when the cell's turn comes in the kernel's queue: a %load reads the file the cells ahead of it
 			// wrote, and a refusal settles in queue order like any cell.
 			const loadOptions = { cwd: invocation.ctx.cwd, artifactsDir: options.artifactsDir };
-			const resolveAtStart =
-				magic.kind === "load"
+			// An isolated cell never runs a file outside its sandbox: %load there is refused.
+			const isolatedLoad = invocation.input.isolate === true && magic.kind === "load";
+			const resolveAtStart = isolatedLoad
+				? () => ({
+						ok: false as const,
+						message:
+							"isolate: true cannot run a %load cell: an isolated cell sees no host files, and loading one would break that isolation. Run %load in a normal cell, or paste the code into the isolated cell.",
+					})
+				: magic.kind === "load"
 					? () => loadCell(magic.target, loadOptions)
 					: magic.kind === "refused"
 						? () => ({ ok: false as const, message: magic.message })
 						: undefined;
+			const isolated =
+				invocation.input.isolate === true && resolveAtStart === undefined
+					? sandboxCellExecutor(invocation.input.code, {
+							sandbox: resolveSandbox(options.settings ?? {}),
+							executeTool: options.executeTool,
+							toolNames: () => (options.listTools?.() ?? []).map((tool) => tool.name),
+							describeTool: (name) => options.listTools?.().find((tool) => tool.name === name)?.description,
+						})
+					: undefined;
 			const environments = invocation.input.language === "py" ? options.pythonEnvironments : undefined;
 			const envRoot = environments === undefined ? undefined : () => environments.activeRoot ?? "";
+			const jsEnvironments = invocation.input.language === "js" ? options.jsEnvironments : undefined;
+			const packageRoot = jsEnvironments === undefined ? undefined : () => jsEnvironments.packageRoot;
 			const result = await execution.wait(
 				kernel.run({
 					cellId: invocation.cellId,
 					code: invocation.input.code,
 					...(resolveAtStart === undefined ? {} : { resolveAtStart }),
 					...(magic.kind === "host" ? { host: magic.executor } : {}),
+					...(isolated === undefined ? {} : { host: isolated }),
 					...(envRoot === undefined ? {} : { envRoot }),
+					...(packageRoot === undefined ? {} : { packageRoot }),
 					...(bridgeCellToken === undefined ? {} : { bridgeCellToken }),
 					kernelPreludes: options.kernelPreludes?.(),
 					onMessage,

package/src/tool/types.ts

@@ -52,6 +52,8 @@ export interface EvalToolInput {
 	readonly timeout?: number;
 	readonly on_timeout?: "detach" | "error";
 	readonly reset?: boolean;
+	/** Run in a fresh sandbox VM instead of the persistent kernel; accepted only while `sandbox.enabled` is on. */
+	readonly isolate?: boolean;
 }
 
 export interface EvalListInput {
@@ -117,14 +119,26 @@ const fullEvalInputSchema = Type.Object(
 /** Runtime accepts a discriminated run/control union. */
 export type EvalInputSchema = TUnsafe<EvalToolRequest> & Pick<typeof fullEvalInputSchema, "properties">;
 
+const ISOLATE_FIELD_DESCRIPTION =
+	"js only. Fresh sandbox per call: no persistence, no fs/net/process/timers; only tool.* plus print/display.";
+
 export function createEvalInputSchema(
 	enabled: EnabledEvalLanguages,
 	deadlines: EvalDeadlineSeconds = defaultEvalDeadlineSeconds,
+	options: { readonly sandbox?: boolean } = {},
 ): EvalInputSchema {
 	const languages = enabledLanguageList(enabled);
 	if (languages.length === 0) throw new Error("eval requires at least one enabled language");
 	const languageSchema = evalLanguageUnion(languages);
-	const properties = evalInputProperties(languageSchema, deadlines);
+	// The sandbox field exists in the schema only while sandbox cells are turned on, so the default schema
+	// (and the prompt built from it) stays exactly what it was.
+	const properties =
+		options.sandbox === true && languages.includes("js")
+			? {
+					...evalInputProperties(languageSchema, deadlines),
+					isolate: Type.Optional(Type.Boolean({ description: ISOLATE_FIELD_DESCRIPTION })),
+				}
+			: evalInputProperties(languageSchema, deadlines);
 	return Type.Unsafe<EvalToolRequest>(
 		Type.Object(properties, {
 			// Keep branches self-contained for Mistral-hosted GLM (#2240).
@@ -175,6 +189,12 @@ export interface EvalKernelRunInput {
 	readonly envRoot?: () => string;
 	/** The file a `%load` cell runs: tracebacks name it and its relative imports resolve from its directory. */
 	readonly sourceFile?: string;
+	/**
+	 * JavaScript only: the session's managed package revision; bare imports that do not resolve from cwd fall back to
+	 * it. Read when the cell starts running (not when it was queued), so a cell queued behind `%bun add` resolves the
+	 * revision that install published.
+	 */
+	readonly packageRoot?: () => string | undefined;
 	/**
 	 * Called when the cell's turn comes in the kernel's queue, never earlier: what to run instead of `code` (a `%load`
 	 * cell's file), or a refusal that settles the cell as failed in queue order.