@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10

package/src/kernels/js/worker-package-resolve.js

@@ -0,0 +1,153 @@
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isBuiltin } from "node:module";
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// A cell's bare import runs `import()` from this worker's own module, so the runtime resolves it from Senpi's install
+// tree, not the session's project or its managed package revision. This resolver walks `node_modules` from each root
+// the cell names, in order, and resolves the package entry the way ESM does (the `exports` field with import
+// conditions), so ESM-only packages load and the first root that has the package wins.
+const RESOLVE_PACKAGE = Symbol.for("senpi.kernel.resolvePackage");
+const CONDITIONS = typeof globalThis.Bun === "object" ? ["bun", "node", "import", "default"] : ["node", "import", "default"];
+
+function isFile(path) {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+
+function splitSpecifier(specifier) {
+	const parts = specifier.split("/");
+	const nameParts = specifier.startsWith("@") ? 2 : 1;
+	if (parts.length < nameParts || parts.slice(0, nameParts).some((part) => part === "" || part === "." || part === ".."))
+		return undefined;
+	const rest = parts.slice(nameParts).join("/");
+	return { name: parts.slice(0, nameParts).join("/"), subpath: rest === "" ? "." : `./${rest}` };
+}
+
+function conditionalTarget(target) {
+	if (typeof target === "string") return target;
+	if (Array.isArray(target)) {
+		for (const candidate of target) {
+			const resolved = conditionalTarget(candidate);
+			if (resolved !== undefined) return resolved;
+		}
+		return undefined;
+	}
+	if (target === null || typeof target !== "object") return undefined;
+	for (const [condition, value] of Object.entries(target)) {
+		if (condition !== "default" && !CONDITIONS.includes(condition)) continue;
+		const resolved = conditionalTarget(value);
+		if (resolved !== undefined) return resolved;
+	}
+	return undefined;
+}
+
+function exportsTarget(exportsField, subpath) {
+	const subpathKeyed =
+		exportsField !== null &&
+		typeof exportsField === "object" &&
+		!Array.isArray(exportsField) &&
+		Object.keys(exportsField).some((key) => key.startsWith("."));
+	if (!subpathKeyed) return subpath === "." ? conditionalTarget(exportsField) : undefined;
+	if (Object.hasOwn(exportsField, subpath)) return conditionalTarget(exportsField[subpath]);
+	let best;
+	for (const key of Object.keys(exportsField)) {
+		const star = key.indexOf("*");
+		if (star < 0 || key.includes("*", star + 1)) continue;
+		const prefix = key.slice(0, star);
+		const suffix = key.slice(star + 1);
+		if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix) || subpath.length < prefix.length + suffix.length)
+			continue;
+		if (best === undefined || prefix.length > best.prefix.length) {
+			best = { key, prefix, match: subpath.slice(prefix.length, subpath.length - suffix.length) };
+		}
+	}
+	if (best === undefined || hasInvalidSegment(best.match)) return undefined;
+	const target = conditionalTarget(exportsField[best.key]);
+	return target === undefined ? undefined : target.replaceAll("*", best.match);
+}
+
+// Node refuses a pattern match or target with "." / ".." / "node_modules" segments (ERR_INVALID_MODULE_SPECIFIER).
+function hasInvalidSegment(path) {
+	return path.split(/[\\/]/).some((segment) => segment === "." || segment === ".." || segment === "node_modules");
+}
+
+function legacyFile(path) {
+	for (const candidate of [path, `${path}.js`, `${path}.mjs`, `${path}.cjs`, join(path, "index.js")]) {
+		if (isFile(candidate)) return candidate;
+	}
+	return undefined;
+}
+
+function packageEntry(packageDir, subpath, specifier) {
+	let manifest;
+	try {
+		manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+	} catch {
+		return legacyFile(join(packageDir, subpath === "." ? "index.js" : subpath));
+	}
+	if (manifest.exports !== undefined && manifest.exports !== null) {
+		const target = exportsTarget(manifest.exports, subpath);
+		if (typeof target !== "string" || !target.startsWith("./") || hasInvalidSegment(target.slice(2))) {
+			const error = new Error(`Package subpath '${subpath}' is not exported for import by '${specifier}'`);
+			error.code = "ERR_PACKAGE_PATH_NOT_EXPORTED";
+			throw error;
+		}
+		return join(packageDir, target);
+	}
+	if (subpath !== ".") return legacyFile(join(packageDir, subpath));
+	const moduleEntry = typeof globalThis.Bun === "object" && typeof manifest.module === "string" ? manifest.module : undefined;
+	const main = moduleEntry ?? (typeof manifest.main === "string" ? manifest.main : "index.js");
+	return legacyFile(join(packageDir, main));
+}
+
+function findPackageDir(name, rootUrl) {
+	let directory = fileURLToPath(rootUrl);
+	for (;;) {
+		const candidate = join(directory, "node_modules", name);
+		if (isDirectory(candidate)) return candidate;
+		const parent = dirname(directory);
+		if (parent === directory) return undefined;
+		directory = parent;
+	}
+}
+
+/**
+ * The file URL the bare `specifier` resolves to from the first of `rootUrls` whose `node_modules` chain has its
+ * package, or undefined when it names a builtin or no root has the package (the caller then imports it natively).
+ */
+export function resolvePackage(specifier, rootUrls) {
+	if (specifier.includes(":") || isBuiltin(specifier)) return undefined;
+	const parts = splitSpecifier(specifier);
+	if (parts === undefined) return undefined;
+	for (const rootUrl of rootUrls) {
+		if (typeof rootUrl !== "string") continue;
+		const packageDir = findPackageDir(parts.name, rootUrl);
+		if (packageDir === undefined) continue;
+		const entry = packageEntry(packageDir, parts.subpath, specifier);
+		if (entry === undefined) continue;
+		let real = entry;
+		try {
+			real = realpathSync(entry);
+		} catch {
+			// A missing target fails in the import itself, with the runtime's own error.
+		}
+		return pathToFileURL(real.endsWith(sep) ? real.slice(0, -1) : real).href;
+	}
+	return undefined;
+}
+
+export function installPackageResolver() {
+	globalThis[RESOLVE_PACKAGE] = resolvePackage;
+}

package/src/kernels/py/host-cell.ts

@@ -1,42 +1,19 @@
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { HostCellExecutor } from "../../tool/types.ts";
-
-type HostCellOutcome = Awaited<ReturnType<HostCellExecutor>>;
-
+import { runHostCell as runSharedHostCell } from "../shared/host-cell.ts";
 import type { PendingRun, ResultMessage } from "./kernel-contract.ts";
-import { failedPythonResult } from "./transport.ts";
 
 export function runHostCell(
 	pending: PendingRun,
 	host: HostCellExecutor,
 	io: { readonly emit: (message: KernelToHostMessage) => void; readonly settle: (result: ResultMessage) => void },
 ): void {
-	const abort = new AbortController();
-	pending.hostAbort = abort;
-	const cellId = pending.input.cellId;
-	let finished = false;
-	// Output from an executor that was aborted, or after its outcome, belongs to no cell.
-	const emit = (message: KernelToHostMessage): void => {
-		if (!finished && !abort.signal.aborted) io.emit(message);
-	};
-	// Calling the executor inside a promise keeps a synchronous throw in this cell instead of failing the queue.
-	const done = new Promise<HostCellOutcome>((resolve) => resolve(host({ signal: abort.signal, emit }))).then(
-		(outcome): ResultMessage =>
-			outcome.ok
-				? {
-						type: "result",
-						cellId,
-						ok: true,
-						durationMs: 0,
-						...(outcome.valueRepr === undefined ? {} : { valueRepr: outcome.valueRepr }),
-					}
-				: { type: "result", cellId, ok: false, error: outcome.error, durationMs: 0 },
-		(error: unknown): ResultMessage =>
-			failedPythonResult(cellId, error instanceof Error ? error.message : String(error)),
-	);
-	pending.hostDone = done;
-	void done.then((result) => {
-		finished = true;
-		if (!abort.signal.aborted) io.settle(result);
+	const run = runSharedHostCell(pending.input.cellId, host, {
+		emit: io.emit,
+		settle: io.settle,
+		durationMs: () => 0,
+		settleAfterAbort: false,
 	});
+	pending.hostAbort = run.abort;
+	pending.hostDone = run.done;
 }

package/src/kernels/sandbox/sandbox-cell.ts

@@ -0,0 +1,116 @@
+import type { ResolvedSandbox } from "../../config/feature-settings.ts";
+import { marshalToolResult } from "../../tool/image.ts";
+import type { ExecuteTool, HostCellExecutor } from "../../tool/types.ts";
+import type { CodemodeSandbox } from "./vendor/pi-codemode/runtime/host.ts";
+import type { CodemodeError, CodemodeOutputFrame, CodemodeTool } from "./vendor/pi-codemode/types.ts";
+
+export interface SandboxCellOptions {
+	readonly sandbox: ResolvedSandbox;
+	readonly executeTool: ExecuteTool;
+	readonly toolNames: () => readonly string[];
+	readonly describeTool?: (name: string) => string | undefined;
+	/** Where the QuickJS wasm lives; by default the installed `quickjs-wasi` package's file. */
+	readonly wasmPath?: string;
+}
+
+// On the script's first line so reported line numbers still match the cell; globals, so a cell's own
+// `const print` shadows them instead of failing as a redeclaration.
+const OUTPUT_ALIASES =
+	'globalThis.print = (...values) => text(values.map((value) => (typeof value === "string" ? value : JSON.stringify(value))).join(" ")); globalThis.display = (value) => ((typeof value === "string" && value.startsWith("data:image/")) || (value !== null && typeof value === "object" && ("image_url" in value || value.type === "image")) ? image(value) : text(typeof value === "string" ? value : JSON.stringify(value))); globalThis.tool = tools; ';
+
+const ERROR_CODES: Partial<Record<CodemodeError["kind"], string>> = {
+	timeout: "eval_isolate_timeout",
+	aborted: "eval_isolate_aborted",
+	sandbox: "eval_isolate_unavailable",
+};
+
+function codeFor(error: CodemodeError): string | undefined {
+	if (error.kind === "script" && error.reason === "memory") return "eval_isolate_memory_limit";
+	if (error.kind === "script" && error.name === "CodemodeStoreDisabledError") return "eval_isolate_no_state";
+	if (error.kind === "script" && error.reason === "unresolved") return "eval_isolate_unresolved_promise";
+	return ERROR_CODES[error.kind];
+}
+
+/** The persistent kernel never sees an isolated cell; its tools go through executeTool so permission hooks still apply. */
+export function sandboxCellExecutor(code: string, options: SandboxCellOptions): HostCellExecutor {
+	return async ({ signal, emit }) => {
+		let sandbox: CodemodeSandbox;
+		try {
+			// Lazy: the vendored QuickJS runtime loads only when a session runs its first isolated cell. The wasm is loaded
+			// here, before any of the cell runs, so a missing runtime is reported as unavailable instead of failing inside
+			// the script.
+			const runtime = await import("./vendor/pi-codemode/runtime/host.ts");
+			const { loadQuickJSWasm } = await import("./vendor/pi-codemode/wasm.ts");
+			const wasm = await loadQuickJSWasm(options.wasmPath);
+			const items = new Map<number, string[]>();
+			const tools: CodemodeTool[] = options
+				.toolNames()
+				.filter((name) => name !== "eval")
+				.map((name) => ({
+					name,
+					description: options.describeTool?.(name) ?? "",
+					execute: async (args: unknown, context: { signal: AbortSignal }) =>
+						marshalToolResult(await options.executeTool(name, args, { signal: context.signal })),
+				}));
+			sandbox = new runtime.CodemodeSandbox({
+				wasm,
+				tools,
+				timeoutMs: options.sandbox.timeoutSeconds * 1_000,
+				memoryLimitBytes: options.sandbox.memoryMb * 1024 * 1024,
+				output: "stream",
+				builtins: { store: "reject" },
+				onOutputFrame: (frame: CodemodeOutputFrame) => {
+					const parts = items.get(frame.itemId) ?? [];
+					parts.push(frame.chunk);
+					if (!frame.final) {
+						items.set(frame.itemId, parts);
+						return;
+					}
+					items.delete(frame.itemId);
+					const payload = parts.join("");
+					if (frame.type === "image") {
+						emit({ type: "display", mimeType: frame.mimeType ?? "image/png", dataBase64: payload });
+					} else {
+						emit({ type: "text", stream: "stdout", data: payload.endsWith("\n") ? payload : `${payload}\n` });
+					}
+				},
+			});
+		} catch (error) {
+			// The full error, paths included, goes to the host's own log so a maintainer can diagnose it; the cell gets
+			// only what failed and the error's code. This covers every setup step: the runtime import, the tool list,
+			// the wasm load and the sandbox itself.
+			console.error("[senpi-codemode] isolated cell setup failed:", error);
+			const code =
+				error instanceof Error && "code" in error && typeof error.code === "string" ? ` (${error.code})` : "";
+			return {
+				ok: false,
+				error: {
+					name: "SandboxUnavailableError",
+					message: `eval_isolate_unavailable: the QuickJS runtime for isolated cells could not be loaded${code}; nothing in the cell ran`,
+				},
+			};
+		}
+		try {
+			const result = await sandbox.execute(OUTPUT_ALIASES + code, { signal });
+			if (result.ok) {
+				return result.value === undefined
+					? { ok: true }
+					: {
+							ok: true,
+							valueRepr: typeof result.value === "string" ? result.value : JSON.stringify(result.value),
+						};
+			}
+			const errorCode = codeFor(result.error);
+			return {
+				ok: false,
+				error: {
+					...(result.error.name === undefined ? {} : { name: result.error.name }),
+					message: errorCode === undefined ? result.error.message : `${errorCode}: ${result.error.message}`,
+					...(result.error.stack === undefined ? {} : { stack: result.error.stack }),
+				},
+			};
+		} finally {
+			await sandbox.close();
+		}
+	};
+}

package/src/kernels/sandbox/vendor/pi-codemode/VENDORED.md

@@ -40,3 +40,4 @@ A sync must re-apply both kinds: dropping a marked line (for example `"output-fr
    - A normal finish settles only after every frame is consumed. An abort or timeout settles at once and drops frames still queued. The timer and the abort signal stay armed while a finished run's last frames drain, so a late abort, timeout or `close()` abandons them too (the run settles with that error): a consumer that never returns cannot keep a run alive.
    - `frameBytes` and `windowBytes` must be at least 4, so a frame can always hold a whole surrogate pair.
 2. **Builtin store policy** (`builtins: { store: "collect" | "reject" }`; `types.ts`, `runtime/protocol.ts`, `runtime/worker.ts`, `runtime/host.ts`, `runtime/prelude-source.ts`). With `"reject"`, `load()` returns `undefined` and `store()` throws `CodemodeStoreDisabledError`. The names stay defined, so scripts written for upstream fail with a clear message instead of a ReferenceError.
+3. **Runtime-set error reasons** (`types.ts` `CodemodeError.reason`, `runtime/prelude-source.ts`, `runtime/worker.ts`). The prelude captures the engine's own `InternalError` before user code runs and tags a failure `reason: "memory"` only for an instance of it whose message is exactly "out of memory"; its stalled-promise failure is tagged `reason: "unresolved"`; the worker tags an engine out-of-memory from `evalCode` the same way; and `text()` rethrows the engine's own error instead of replacing it with a `TypeError`. The host maps the isolate error codes from `reason` only, never from message text. Upstream has no `reason`, so its behaviour is unchanged.

package/src/kernels/sandbox/vendor/pi-codemode/runtime/prelude-source.ts

@@ -46,6 +46,10 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 	const options = optionsJson === undefined ? {} : JSON.parse(optionsJson);
 	const streamOutput = options.streamOutput === true;
 	const rejectStore = options.store === "reject";
+	// The engine's own InternalError, captured before user code runs: a failure is tagged by identity, never by its
+	// text, so a cell's own error that merely mentions memory keeps its own code. A script can still construct this
+	// constructor itself and so label its own failure as the memory limit; that mislabels only its own cell.
+	const EngineInternalError = typeof InternalError === "function" ? InternalError : undefined;
 	// senpi-change end
 	"use strict";
 	const stringify = JSON.stringify;
@@ -94,7 +98,13 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 
 	function describeError(error) {
 		if (error instanceof ErrorCtor) {
-			return stringify({ name: error.name, message: error.message, stack: errorText(error) });
+			// senpi-change begin: the engine's out-of-memory error is reported by identity, not by matching its message
+			const reason =
+				EngineInternalError !== undefined && error instanceof EngineInternalError && error.message === "out of memory"
+					? "memory"
+					: undefined;
+			return stringify({ name: error.name, message: error.message, stack: errorText(error), reason });
+			// senpi-change end
 		}
 		return stringify({ message: format(error) });
 	}
@@ -285,6 +295,8 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 		try {
 			rendered = outputText(value);
 		} catch (error) {
+			// The engine's own out-of-memory error keeps its identity, so it is still reported as the memory limit.
+			if (EngineInternalError !== undefined && error instanceof EngineInternalError) throw error; // senpi-change
 			throw new TypeErrorCtor(error instanceof ErrorCtor ? error.message : String(error));
 		}
 		output("text", rendered);
@@ -423,6 +435,7 @@ export const PRELUDE_SOURCE: string = `(function (bridge, toolsJson, globalsJson
 					name: "Error",
 					message:
 						"The script is waiting on a promise that can never settle: no tool call is pending, and timers do not exist here.",
+					reason: "unresolved", // senpi-change: tagged by the runtime, so a script's own error text never matches it
 				}),
 			);
 			return true;

package/src/kernels/sandbox/vendor/pi-codemode/runtime/worker.ts

@@ -48,7 +48,10 @@ function discardOutput(memory: { readonly buffer: ArrayBufferLike }) {
 function describeException(error: JSException): string {
 	const head = error.message ? `${error.name}: ${error.message}` : error.name;
 	const stack = error.stack?.trimEnd();
-	return JSON.stringify({ name: error.name, message: error.message, stack: stack ? `${head}\n${stack}` : head });
+	// senpi-change begin: evalCode fails before any script runs, so an InternalError here is the engine's own
+	const reason = error.name === "InternalError" && error.message === "out of memory" ? "memory" : undefined;
+	return JSON.stringify({ name: error.name, message: error.message, stack: stack ? `${head}\n${stack}` : head, reason });
+	// senpi-change end
 }
 // senpi-change begin: output streaming
 /**

package/src/kernels/sandbox/vendor/pi-codemode/types.ts

@@ -71,6 +71,8 @@ export interface CodemodeError {
 	name?: string;
 	message: string;
 	stack?: string;
+	/** senpi-change: set by the runtime itself (never from script text) for its own memory-limit and stalled failures. */
+	reason?: "memory" | "unresolved";
 }
 
 /** Keys the script changed with `store()`. Only successful executions report writes. */

package/src/kernels/shared/host-cell.ts

@@ -0,0 +1,57 @@
+import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { HostCellExecutor } from "../../tool/types.ts";
+
+type HostCellOutcome = Awaited<ReturnType<HostCellExecutor>>;
+type HostResult = Extract<KernelToHostMessage, { type: "result" }>;
+
+export interface HostCellRun {
+	readonly cellId: string;
+	readonly abort: AbortController;
+	readonly done: Promise<HostResult>;
+}
+
+/**
+ * Runs a host entry (a cell the host executes, such as an install) for one queue slot: output after the outcome or after
+ * an abort belongs to no cell, a synchronous throw stays in this cell, and `settle` receives the cell's result.
+ * `settleAfterAbort` says whether an aborted entry still settles here or whoever aborted it settles the cell.
+ */
+export function runHostCell(
+	cellId: string,
+	host: HostCellExecutor,
+	io: {
+		readonly emit: (message: KernelToHostMessage) => void;
+		readonly settle: (result: HostResult) => void;
+		readonly durationMs: () => number;
+		readonly settleAfterAbort: boolean;
+	},
+): HostCellRun {
+	const abort = new AbortController();
+	let finished = false;
+	const emit = (message: KernelToHostMessage): void => {
+		if (!finished && !abort.signal.aborted) io.emit(message);
+	};
+	const done = new Promise<HostCellOutcome>((resolve) => resolve(host({ signal: abort.signal, emit }))).then(
+		(outcome): HostResult =>
+			outcome.ok
+				? {
+						type: "result",
+						cellId,
+						ok: true,
+						durationMs: io.durationMs(),
+						...(outcome.valueRepr === undefined ? {} : { valueRepr: outcome.valueRepr }),
+					}
+				: { type: "result", cellId, ok: false, error: outcome.error, durationMs: 0 },
+		(error: unknown): HostResult => ({
+			type: "result",
+			cellId,
+			ok: false,
+			error: { message: error instanceof Error ? error.message : String(error) },
+			durationMs: 0,
+		}),
+	);
+	void done.then((result) => {
+		finished = true;
+		if (io.settleAfterAbort || !abort.signal.aborted) io.settle(result);
+	});
+	return { cellId, abort, done };
+}

package/src/tool/cell-handler.ts

@@ -235,22 +235,20 @@ export class CellHandler {
 			this.#kernel.deliverToolReply({ type: "tool-reply", callId: message.callId, ok: true, value: reply.value });
 		} catch (error) {
 			if (!this.#state.active) return;
-			const text = appendSchemaHint(
-				error instanceof Error ? error.message : String(error),
-				message.toolName,
-				this.#toolParameters(message.toolName),
-			);
+			const code =
+				error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : undefined;
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			// A blocked call (a permission denial or another hook's veto) is not an argument problem.
+			const text =
+				code === "blocked"
+					? errorMessage
+					: appendSchemaHint(errorMessage, message.toolName, this.#toolParameters(message.toolName));
 			recordToolCall(this.#state.toolCalls, false, capture, undefined, text);
 			this.#kernel.deliverToolReply({
 				type: "tool-reply",
 				callId: message.callId,
 				ok: false,
-				error: {
-					message: text,
-					...(error instanceof Error && "code" in error && typeof error.code === "string"
-						? { code: error.code }
-						: {}),
-				},
+				error: { message: text, ...(code === undefined ? {} : { code }) },
 			});
 		}
 		this.#resultBuilder.emitUpdate(false);

package/src/tool/eval-request.ts

@@ -17,9 +17,19 @@ export function normalizeEvalSummary(value: unknown): string | undefined {
 	return normalized.length === 0 ? undefined : normalized;
 }
 
+export class EvalIsolateInvalidError extends TypeError {
+	readonly name = "EvalIsolateInvalidError";
+	readonly code = "eval_isolate_invalid";
+
+	constructor(reason: string) {
+		super(`eval_isolate_invalid: ${reason}`);
+	}
+}
+
 export function parseEvalRequest(
 	params: unknown,
 	enabledLanguages: readonly EvalLanguage[] = evalLanguageOrder,
+	options: { readonly sandbox?: boolean } = {},
 ): EvalToolRequest {
 	if (!isRecord(params)) throw new TypeError("eval parameters must be an object");
 	if (params.action === "list") return { action: "list" };
@@ -30,7 +40,9 @@ export function parseEvalRequest(
 	}
 	if (params.action !== undefined && params.action !== "run")
 		throw new TypeError(`Unknown eval action "${String(params.action)}"`);
-	if (!isEvalLanguage(params.language)) throw new TypeError(evalRunRequiresLanguageMessage(enabledLanguages));
+	if (params.language === undefined) throw new TypeError(evalRunRequiresLanguageMessage(enabledLanguages));
+	if (!isEvalLanguage(params.language))
+		throw new TypeError(`eval run language must be one of: ${enabledLanguages.join(", ")}`);
 	if (typeof params.code !== "string")
 		throw new TypeError("eval run requires code — the cell body to execute, verbatim");
 	const summary = normalizeEvalSummary(params.summary);
@@ -40,6 +52,15 @@ export function parseEvalRequest(
 		);
 	if (params.on_timeout !== undefined && params.on_timeout !== "detach" && params.on_timeout !== "error")
 		throw new TypeError(`Unknown eval on_timeout value "${String(params.on_timeout)}"`);
+	if (params.isolate !== undefined && params.isolate !== false) {
+		if (params.isolate !== true) throw new EvalIsolateInvalidError("isolate must be true or false");
+		if (options.sandbox !== true) {
+			throw new EvalIsolateInvalidError("sandbox cells are turned off (set sandbox.enabled in codemode settings)");
+		}
+		if (params.language !== "js")
+			throw new EvalIsolateInvalidError('sandbox cells run JavaScript only (language: "js")');
+		if (params.reset === true) throw new EvalIsolateInvalidError("a sandbox cell starts fresh; reset does not apply");
+	}
 	return {
 		language: params.language,
 		code: params.code,
@@ -48,6 +69,7 @@ export function parseEvalRequest(
 		...(typeof params.timeout === "number" ? { timeout: params.timeout } : {}),
 		...(params.on_timeout === "detach" || params.on_timeout === "error" ? { on_timeout: params.on_timeout } : {}),
 		...(typeof params.reset === "boolean" ? { reset: params.reset } : {}),
+		...(params.isolate === true ? { isolate: true } : {}),
 	};
 }
 

package/src/tool/eval-tool-options.ts

@@ -8,6 +8,7 @@ import type {
 import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
 import type { ResolvedCodemodeSettings } from "../config/settings.ts";
+import type { JsEnvironments } from "../environments/js-environments.ts";
 import type { PythonEnvironments } from "../environments/python-environments.ts";
 import type { EvalExecutionTracker } from "../extension/session-manager.ts";
 import type { HandleRegistry } from "../handles/handle-registry.ts";
@@ -72,6 +73,8 @@ export interface CreateEvalToolOptions {
 	readonly kernelPreludes?: () => readonly KernelPreludeContribution[];
 	/** The session's Python environments: `%pip` / `%environment` cells and the import root of every Python cell. */
 	readonly pythonEnvironments?: PythonEnvironments;
+	/** The session's managed JavaScript packages: `%bun add` / `%npm add` cells and the bare-import fallback root. */
+	readonly jsEnvironments?: JsEnvironments;
 	/** Contributions whose documentation lines the description lists; snapshot taken when the tool is (re)registered. */
 	readonly promptKernelPreludes?: readonly KernelPreludeContribution[];
 }

package/src/tool/eval-tool.ts

@@ -1,5 +1,6 @@
 import type { AgentToolResult, ToolDefinition } from "@code-yeongyu/senpi";
 import type { TUnsafe } from "typebox";
+import { resolveSandbox } from "../config/feature-settings.ts";
 import {
 	DEFAULT_FOREGROUND_WINDOW_SECONDS,
 	defaultCodemodeSettings,
@@ -8,7 +9,12 @@ import {
 import { buildEvalPrompt } from "../prompt/eval-prompt.ts";
 import { EvalDetachedCellManager } from "./detached-cell-manager.ts";
 import { executeEvalControl } from "./detached-eval-result.ts";
-import { isEvalControlRequest, normalizeEvalSummary, parseEvalRequest } from "./eval-request.ts";
+import {
+	EvalIsolateInvalidError,
+	isEvalControlRequest,
+	normalizeEvalSummary,
+	parseEvalRequest,
+} from "./eval-request.ts";
 import type { CreateEvalToolOptions } from "./eval-tool-options.ts";
 import { runEvalCell } from "./run-eval-cell.ts";
 import {
@@ -43,7 +49,8 @@ export function createEvalTool(options: CreateEvalToolOptions) {
 		foregroundWindowSeconds,
 		hardLimitSeconds: options.hardLimitSeconds ?? defaultEvalDeadlineSeconds.hardLimitSeconds,
 	};
-	const parameters = createEvalInputSchema(options.enabledLanguages, deadlines);
+	const sandbox = resolveSandbox(options.settings ?? defaultCodemodeSettings).enabled;
+	const parameters = createEvalInputSchema(options.enabledLanguages, deadlines, { sandbox });
 	const prompt = buildEvalPrompt(options.enabledLanguages, {
 		spawns: options.spawns ?? false,
 		monitor: options.monitor,
@@ -74,9 +81,14 @@ export function createEvalTool(options: CreateEvalToolOptions) {
 	async function execute(
 		...[toolCallId, params, signal, onUpdate, ctx]: EvalExecuteArgs<EvalToolRequest>
 	): Promise<AgentToolResult<EvalResultDetails>> {
-		const request = parseEvalRequest(params, languages);
+		const request = parseEvalRequest(params, languages, { sandbox });
 		if (isEvalControlRequest(request)) return await executeEvalControl(cellManager, request);
-		if (options.proxyExecutor) return await options.proxyExecutor(request, signal);
+		if (options.proxyExecutor) {
+			// A proxy runs cells elsewhere and knows nothing of sandbox cells: an isolated cell must never run unisolated.
+			if ("isolate" in request && request.isolate === true)
+				throw new EvalIsolateInvalidError("isolate: true is not available through this eval proxy");
+			return await options.proxyExecutor(request, signal);
+		}
 		if (!languages.includes(request.language))
 			throw new RangeError(
 				`Unsupported eval language "${request.language}". Enabled languages: ${languages.join(", ")}`,

package/src/tool/load-cell.ts

@@ -1,4 +1,4 @@
-import { closeSync, constants, fstatSync, openSync, readFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -50,6 +50,18 @@ function resolveTarget(target: string, options: LoadCellOptions): { path: string
  * Reads a `%load` target when its cell's turn comes in the kernel's queue, so a file the previous cell wrote is
  * there. Every failure is a refusal that names the target as the user wrote it, never an absolute path.
  */
+/** Reads from `fd` until EOF or `limit` bytes, whichever comes first; a file still growing cannot exceed it. */
+export function readAtMost(fd: number, limit: number): Buffer {
+	const buffer = Buffer.alloc(limit);
+	let filled = 0;
+	while (filled < limit) {
+		const read = readSync(fd, buffer, filled, limit - filled, null);
+		if (read === 0) break;
+		filled += read;
+	}
+	return buffer.subarray(0, filled);
+}
+
 export function loadCell(target: string, options: LoadCellOptions): LoadedCell {
 	const resolved = resolveTarget(target, options);
 	if ("message" in resolved) return { ok: false, message: resolved.message };
@@ -60,8 +72,11 @@ export function loadCell(target: string, options: LoadCellOptions): LoadedCell {
 		fd = openSync(resolved.path, constants.O_RDONLY | constants.O_NONBLOCK);
 		const info = fstatSync(fd);
 		if (!info.isFile()) return { ok: false, message: `not a file: ${target}` };
-		if (info.size > MAX_LOAD_BYTES) return { ok: false, message: `%load reads files up to 8 MiB: ${target}` };
-		return { ok: true, code: readFileSync(fd, "utf8"), sourceFile: resolved.path };
+		const tooLarge = { ok: false as const, message: `%load reads files up to 8 MiB: ${target}` };
+		if (info.size > MAX_LOAD_BYTES) return tooLarge;
+		const bytes = readAtMost(fd, MAX_LOAD_BYTES + 1);
+		if (bytes.length > MAX_LOAD_BYTES) return tooLarge;
+		return { ok: true, code: bytes.toString("utf8"), sourceFile: resolved.path };
 	} catch (error) {
 		const code = errorCode(error);
 		if (code === "ENOENT" || code === "ENOTDIR") return { ok: false, message: `file not found: ${target}` };