@code-yeongyu/senpi-codemode 2026.9.16 → 2026.9.17-3

package/CHANGELOG.md

@@ -12,6 +12,74 @@
 
 ### Removed
 
+## [2026.9.17-3] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.9.17-2] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+- JS eval kernel: a cell whose top-level declaration (`const`/`let`/`var`, plain or destructured) names an existing platform or prelude global (for example `const fetch = ...`) is now rejected before execution with an error naming the identifier and the rename remedy, instead of silently replacing that global for every later cell and wedging the session until a kernel reset. Cell-created globals stay re-declarable across cells, and explicit `globalThis.<name> = ...` assignments remain untouched as the deliberate escape hatch. (#1784)
+
+### Removed
+
+## [2026.9.17] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+- `kernelTools.invoke(request, options?)` accepts a per-call execution scope for the nested host calls the invoked closure makes: `{ scope: { tools: { allow?: string[], deny?: string[] } } }`. While that invocation is active, a `tool.<name>()` outside the scope is refused inside the worker with `kernel_tool_host_denied` carrying `{ tool, call_id, reason: "allow" | "deny" }`: the closure sees a rejected promise, the refusal never reaches the host bridge, and the parent's own cells and queue keep the parent's full tool surface. `deny` wins over `allow`, an `allow` list refuses every host tool it does not name, a malformed list fails closed, and the scope lives only for that call — it is dropped when the call settles (including interrupt and reset) and is never persisted. The second argument still accepts a bare `AbortSignal`, and a call without a scope posts exactly the message it always did. Consumers detect the feature through `kernelTools.capabilities.invokeScope === true`; `KERNEL_TOOLS_CAPABILITIES`, `KernelToolsCapabilities`, `KernelToolsInvokeOptions`, `KernelToolsInvokeScope`, `KernelToolsHostScope`, `KernelToolHostDenial` and `KernelToolHostDenialReason` are exported ([#1731](https://github.com/code-yeongyu/senpi/issues/1731)).
+
+### Changed
+
+- Kernel-tools types bind to coding-agent's `ExtensionKernelTools` / `KernelToolInvokeOptions` / `KernelToolInvokeScope` (`KERNEL_TOOLS_CAPABILITIES satisfies ExtensionKernelTools["capabilities"]`) so the implementation cannot drift from the host declaration ([#1731](https://github.com/code-yeongyu/senpi/issues/1731)).
+
+### Fixed
+
+### Removed
+
+## [2026.9.16-3] - 2026-09-16
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.9.16-2] - 2026-09-16
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+- The JavaScript kernel-tool capability now reaches host tools called from inside a running eval cell. A cell that registers `tool(fn)` can hand those functions to its in-process children through `task`/`agent`/`workpool`, because `ExtensionContext.kernelTools` resolves for the duration of each host tool call the cell makes. It was undefined at the dispatch point — the worker's message loop ran outside the `kernelToolsStorage` scope that only covered the awaited run chain — so every grant was refused with `tools_unavailable` and the capability shipped in the previous release could not be used ([#1754](https://github.com/code-yeongyu/senpi/issues/1754)).
+
+### Removed
+
 ## [2026.9.16] - 2026-09-16
 
 ### Breaking Changes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.9.16",
+	"version": "2026.9.17-3",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -30,14 +30,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.16",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.17-3",
 		"typebox": "1.3.27"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.9.16"
+		"@code-yeongyu/senpi": "2026.9.17-3"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.9.16"
+		"@code-yeongyu/senpi": "2026.9.17-3"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/kernel-tools-protocol.ts

@@ -1,10 +1,28 @@
 import { type Static, Type } from "typebox";
 
+/** Payload of a `kernel_tool_host_denied` refusal: the host tool, the invoking call, the reason (#1731). */
+const kernelToolHostDenialSchema = Type.Object({
+	tool: Type.String({ minLength: 1 }),
+	call_id: Type.String({ minLength: 1 }),
+	reason: Type.Union([Type.Literal("allow"), Type.Literal("deny")]),
+});
+
 const kernelToolErrorSchema = Type.Object({
 	message: Type.String(),
 	name: Type.Optional(Type.String()),
 	stack: Type.Optional(Type.String()),
 	code: Type.Optional(Type.String()),
+	details: Type.Optional(kernelToolHostDenialSchema),
+});
+
+/** Per-call execution scope for the nested host calls the invoked closure makes (#1731). */
+export const kernelToolInvokeScopeSchema = Type.Object({
+	tools: Type.Optional(
+		Type.Object({
+			allow: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+			deny: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+		}),
+	),
 });
 
 export const kernelToolDescriptorSchema = Type.Object({
@@ -43,6 +61,7 @@ export const kernelToolHostToKernelSchemas = [
 		definition_revision: Type.Integer({ minimum: 1 }),
 		args: Type.Unknown(),
 		call_id: Type.String({ minLength: 1 }),
+		scope: Type.Optional(kernelToolInvokeScopeSchema),
 	}),
 	Type.Object({
 		type: Type.Literal("kernel-tool-cancel"),

package/src/index.ts

@@ -263,10 +263,17 @@ function modelIdFrom(event: unknown): string | undefined {
 }
 
 export {
+	KERNEL_TOOLS_CAPABILITIES,
 	KERNEL_TOOLS_UNSUPPORTED,
 	type KernelToolDescriptor,
+	type KernelToolHostDenial,
+	type KernelToolHostDenialReason,
+	type KernelToolsCapabilities,
 	type KernelToolsCapability,
 	type KernelToolsDescribeResult,
+	type KernelToolsHostScope,
+	type KernelToolsInvokeOptions,
 	type KernelToolsInvokeRequest,
+	type KernelToolsInvokeScope,
 } from "./kernels/js/kernel-tools-types.ts";
 export { enabledLanguagesFrom };

package/src/kernels/js/context-manager.ts

@@ -13,7 +13,11 @@ import {
 } from "./kernel-contract.ts";
 import { kernelToolError } from "./kernel-tools-errors.ts";
 import { KernelToolHostPump } from "./kernel-tools-host.ts";
-import type { KernelToolsDescribeResult, KernelToolsInvokeRequest } from "./kernel-tools-types.ts";
+import type {
+	KernelToolsDescribeResult,
+	KernelToolsInvokeOptions,
+	KernelToolsInvokeRequest,
+} from "./kernel-tools-types.ts";
 import { type JavaScriptKernelOptions, LocalModuleLoader } from "./local-module-loader.ts";
 import { terminateProcessTrees } from "./process-tree-host.ts";
 import { JavaScriptRunQueue, type PendingJavaScriptRun, stoppedResult } from "./run-queue.ts";
@@ -72,8 +76,11 @@ export class JavaScriptKernel {
 		return this.#kernelTools.describe(names);
 	}
 
-	invokeKernelTool(request: KernelToolsInvokeRequest, signal?: AbortSignal): Promise<unknown> {
-		return this.#kernelTools.invoke(request, signal);
+	invokeKernelTool(
+		request: KernelToolsInvokeRequest,
+		options?: AbortSignal | KernelToolsInvokeOptions,
+	): Promise<unknown> {
+		return this.#kernelTools.invoke(request, options);
 	}
 
 	async run(input: JavaScriptRunInput): Promise<ResultMessage> {

package/src/kernels/js/kernel-tools-context.d.ts

@@ -1,3 +1,5 @@
+import type { KernelToolsInvokeScope } from "./kernel-tools-types.ts";
+
 export const kernelToolCallContext: {
 	run<T>(store: KernelToolCallStore, fn: () => T): T;
 	getStore(): KernelToolCallStore | undefined;
@@ -8,6 +10,8 @@ export type KernelToolCallStore = {
 	readonly callId: string;
 	readonly generation: number;
 	readonly signal: AbortSignal;
+	/** Host tools this call's nested bridge calls may reach; absent means the parent's full surface. */
+	readonly scope?: KernelToolsInvokeScope;
 };
 
 export function inKernelToolInvoke(): boolean;

package/src/kernels/js/kernel-tools-errors.js

@@ -7,16 +7,19 @@ export const KERNEL_TOOL_ERROR_CODES = Object.freeze([
 	"kernel_tool_missing",
 	"kernel_tool_failed",
 	"kernel_tool_recursion",
+	"kernel_tool_host_denied",
 ]);
 
 export class KernelToolError extends Error {
-	constructor(code, message) {
+	constructor(code, message, details) {
 		super(message);
 		this.name = "KernelToolError";
 		this.code = code;
+		// Only `kernel_tool_host_denied` carries one today: { tool, call_id, reason }.
+		if (details !== undefined) this.details = details;
 	}
 }
 
-export function kernelToolError(code, message) {
-	return new KernelToolError(code, message);
+export function kernelToolError(code, message, details) {
+	return new KernelToolError(code, message, details);
 }

package/src/kernels/js/kernel-tools-errors.ts

@@ -7,20 +7,38 @@ export const KERNEL_TOOL_ERROR_CODES = [
 	"kernel_tool_missing",
 	"kernel_tool_failed",
 	"kernel_tool_recursion",
+	"kernel_tool_host_denied",
 ] as const;
 
 export type KernelToolErrorCode = (typeof KERNEL_TOOL_ERROR_CODES)[number];
 
+/** Why a nested host call was refused: it is outside the call's allow list, or named by its deny list. */
+export type KernelToolHostDenialReason = "allow" | "deny";
+
+/** Payload carried by `kernel_tool_host_denied`: the host tool, the invoking kernel-tool call, the reason. */
+export type KernelToolHostDenial = {
+	readonly tool: string;
+	readonly call_id: string;
+	readonly reason: KernelToolHostDenialReason;
+};
+
 export class KernelToolError extends Error {
 	readonly name = "KernelToolError";
 	readonly code: KernelToolErrorCode;
+	/** Structured payload for the codes that carry one; only `kernel_tool_host_denied` does today. */
+	readonly details?: KernelToolHostDenial;
 
-	constructor(code: KernelToolErrorCode, message: string) {
+	constructor(code: KernelToolErrorCode, message: string, details?: KernelToolHostDenial) {
 		super(message);
 		this.code = code;
+		if (details !== undefined) this.details = details;
 	}
 }
 
-export function kernelToolError(code: KernelToolErrorCode, message: string): KernelToolError {
-	return new KernelToolError(code, message);
+export function kernelToolError(
+	code: KernelToolErrorCode,
+	message: string,
+	details?: KernelToolHostDenial,
+): KernelToolError {
+	return new KernelToolError(code, message, details);
 }

package/src/kernels/js/kernel-tools-host.ts

@@ -2,7 +2,12 @@ import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/prot
 import { generateCorrelationId } from "../../bridge/protocol.ts";
 import { RESERVED_AGENT_TOOL } from "../../bridge/reserved.ts";
 import { kernelToolError } from "./kernel-tools-errors.ts";
-import type { KernelToolsDescribeResult, KernelToolsInvokeRequest } from "./kernel-tools-types.ts";
+import type {
+	KernelToolsDescribeResult,
+	KernelToolsInvokeOptions,
+	KernelToolsInvokeRequest,
+	KernelToolsInvokeScope,
+} from "./kernel-tools-types.ts";
 
 type KernelToolReply = Extract<
 	KernelToHostMessage,
@@ -59,7 +64,13 @@ export class KernelToolHostPump {
 		return { results: reply.results as KernelToolsDescribeResult["results"] };
 	}
 
-	async invoke(request: KernelToolsInvokeRequest, signal?: AbortSignal): Promise<unknown> {
+	/**
+	 * `options` is the caller's abort signal, or `{ signal?, scope? }` where `scope` bounds the host
+	 * tools the invoked closure may reach during this call only. A call without a scope posts exactly
+	 * the message it always did (#1731).
+	 */
+	async invoke(request: KernelToolsInvokeRequest, options?: AbortSignal | KernelToolsInvokeOptions): Promise<unknown> {
+		const { signal, scope } = normalizeInvokeOptions(options);
 		this.events.dispatchEvent(new Event("nestedInvoke"));
 		const reply = await this.#request(
 			{
@@ -70,13 +81,14 @@ export class KernelToolHostPump {
 				definition_revision: request.definition_revision,
 				args: request.args,
 				call_id: request.call_id,
+				...wireScope(scope),
 			},
 			signal,
 		);
 		if (reply.type !== "kernel-tool-invoke-reply") {
 			throw kernelToolError("kernel_tool_failed", "unexpected kernel-tool invoke reply");
 		}
-		if (!reply.ok) throw kernelToolError(codeOf(reply.error.code), reply.error.message);
+		if (!reply.ok) throw kernelToolError(codeOf(reply.error.code), reply.error.message, reply.error.details);
 		return reply.value;
 	}
 
@@ -112,6 +124,33 @@ export class KernelToolHostPump {
 	}
 }
 
+/**
+ * The scope as the protocol carries it: own copies of the caller's lists, and nothing at all when the
+ * caller named no host tools, so an unscoped call posts exactly the message it always did.
+ */
+function wireScope(scope?: KernelToolsInvokeScope): { scope?: { tools: { allow?: string[]; deny?: string[] } } } {
+	const tools = scope?.tools;
+	if (tools === undefined) return {};
+	if (tools.allow === undefined && tools.deny === undefined) return {};
+	return {
+		scope: {
+			tools: {
+				...(tools.allow === undefined ? {} : { allow: [...tools.allow] }),
+				...(tools.deny === undefined ? {} : { deny: [...tools.deny] }),
+			},
+		},
+	};
+}
+
+function normalizeInvokeOptions(options?: AbortSignal | KernelToolsInvokeOptions): KernelToolsInvokeOptions {
+	if (options === undefined) return {};
+	return isAbortSignal(options) ? { signal: options } : options;
+}
+
+function isAbortSignal(options: AbortSignal | KernelToolsInvokeOptions): options is AbortSignal {
+	return options instanceof AbortSignal || "aborted" in options;
+}
+
 function codeOf(
 	code: string | undefined,
 ):
@@ -119,12 +158,14 @@ function codeOf(
 	| "kernel_tool_stale"
 	| "kernel_tool_missing"
 	| "kernel_tool_recursion"
+	| "kernel_tool_host_denied"
 	| "tools_unavailable"
 	| "invalid_tool_definition" {
 	if (
 		code === "kernel_tool_stale" ||
 		code === "kernel_tool_missing" ||
 		code === "kernel_tool_recursion" ||
+		code === "kernel_tool_host_denied" ||
 		code === "tools_unavailable" ||
 		code === "invalid_tool_definition"
 	) {

package/src/kernels/js/kernel-tools-pump.js

@@ -21,7 +21,15 @@ export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
 			const runtime = getRuntime();
 			if (!runtime?.kernelTools) throw kernelToolError("tools_unavailable", "JS runtime not initialized");
 			const value = await kernelToolCallContext.run(
-				{ pendingTools, callId: message.call_id, generation: message.kernel_generation, signal: controller.signal },
+				// The scope lives only in this store: it is gone once the call settles, and it never
+				// reaches the top-level cell context or the next invocation (#1731).
+				{
+					pendingTools,
+					callId: message.call_id,
+					generation: message.kernel_generation,
+					signal: controller.signal,
+					scope: message.scope,
+				},
 				() =>
 					runtime.kernelTools.invoke(
 						{
@@ -91,15 +99,21 @@ function pumpError(error) {
 			message: error.message,
 			stack: error.stack,
 			...(typeof error.code === "string" ? { code: error.code } : {}),
+			...(isPlainRecord(error.details) ? { details: error.details } : {}),
 		};
 	}
 	return { message: String(error) };
 }
 
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 function errorFrom(error) {
 	const result = new Error(error.message);
 	if (error.name) result.name = error.name;
 	if (error.stack) result.stack = error.stack;
 	if (typeof error.code === "string") result.code = error.code;
+	if (isPlainRecord(error.details)) result.details = error.details;
 	return result;
 }

package/src/kernels/js/kernel-tools-scope.d.ts

@@ -0,0 +1,9 @@
+import type { KernelToolError, KernelToolHostDenialReason } from "./kernel-tools-errors.ts";
+import type { KernelToolsInvokeScope } from "./kernel-tools-types.ts";
+
+export function hostToolRefusal(
+	scope: KernelToolsInvokeScope | undefined,
+	toolName: string,
+): KernelToolHostDenialReason | null;
+
+export function hostDeniedError(toolName: string, callId: string, reason: KernelToolHostDenialReason): KernelToolError;

package/src/kernels/js/kernel-tools-scope.js

@@ -0,0 +1,34 @@
+import { kernelToolError } from "./kernel-tools-errors.js";
+
+/**
+ * Call-scoped host-tool policy for one kernel-tool invocation (#1731). A call without a tool scope
+ * refuses nothing (today's behavior); `deny` wins over `allow`; an `allow` list refuses every host
+ * tool it does not name; a malformed list fails closed instead of widening the call's reach.
+ */
+export function hostToolRefusal(scope, toolName) {
+	const tools = scope?.tools;
+	if (tools === null || typeof tools !== "object") return null;
+	if (tools.deny !== undefined) {
+		const deny = nameList(tools.deny);
+		if (deny === null || deny.includes(toolName)) return "deny";
+	}
+	if (tools.allow !== undefined) {
+		const allow = nameList(tools.allow);
+		if (allow === null || !allow.includes(toolName)) return "allow";
+	}
+	return null;
+}
+
+/** The typed refusal the closure sees and the invoking call reports. */
+export function hostDeniedError(toolName, callId, reason) {
+	return kernelToolError(
+		"kernel_tool_host_denied",
+		`Host tool is outside this kernel tool call's scope: ${toolName} (${reason})`,
+		{ tool: toolName, call_id: callId, reason },
+	);
+}
+
+function nameList(value) {
+	if (!Array.isArray(value)) return null;
+	return value.every((name) => typeof name === "string") ? value : null;
+}

package/src/kernels/js/kernel-tools-types.ts

@@ -1,6 +1,7 @@
-import type { KernelToolErrorCode } from "./kernel-tools-errors.ts";
+import type { ExtensionKernelTools, KernelToolInvokeOptions, KernelToolInvokeScope } from "@code-yeongyu/senpi";
+import type { KernelToolErrorCode, KernelToolHostDenial, KernelToolHostDenialReason } from "./kernel-tools-errors.ts";
 
-export type { KernelToolErrorCode };
+export type { KernelToolErrorCode, KernelToolHostDenial, KernelToolHostDenialReason };
 
 export type KernelToolDescriptor = {
 	readonly name: string;
@@ -31,9 +32,22 @@ export type KernelToolsDescribeResult = {
 	readonly results: readonly KernelToolsDescribeEntry[];
 };
 
+/** Host declaration (#1731); aliases so this package cannot drift from `@code-yeongyu/senpi`. */
+export type KernelToolsHostScope = NonNullable<KernelToolInvokeScope["tools"]>;
+export type KernelToolsInvokeScope = KernelToolInvokeScope;
+export type KernelToolsInvokeOptions = KernelToolInvokeOptions;
+
+/** Stable capability markers a consumer gates on before sending an option this runtime may not know. */
+export type KernelToolsCapabilities = ExtensionKernelTools["capabilities"];
+
+export const KERNEL_TOOLS_CAPABILITIES = Object.freeze({
+	invokeScope: true as const,
+}) satisfies ExtensionKernelTools["capabilities"];
+
 export type KernelToolsCapability = {
+	readonly capabilities: ExtensionKernelTools["capabilities"];
 	describe(names: readonly string[]): Promise<KernelToolsDescribeResult>;
-	invoke(request: KernelToolsInvokeRequest, signal?: AbortSignal): Promise<unknown>;
+	invoke: ExtensionKernelTools["invoke"];
 };
 
 export const KERNEL_TOOLS_UNSUPPORTED = {

package/src/kernels/js/worker-core.js

@@ -1,6 +1,7 @@
 import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 import { createKernelToolPump } from "./kernel-tools-pump.js";
+import { hostDeniedError, hostToolRefusal } from "./kernel-tools-scope.js";
 import { JsWorkerRuntime } from "./worker-runtime.js";
 
 // Mirrors INTERRUPT_ACK_OP and CHILD_LIFECYCLE_OP in src/bridge/reserved.ts (this worker file cannot import TypeScript).
@@ -59,6 +60,12 @@ export function createWorkerCore(transport, options) {
 		const nested = kernelToolCallContext.getStore();
 		if (!nested && activeCell?.interruption) throw activeCell.interruption;
 		if (nested?.signal.aborted) throw nested.signal.reason;
+		// A scoped kernel-tool call is refused here, before anything reaches the host bridge, so the
+		// closure sees a rejected promise and the parent's own cells keep their full tool surface (#1731).
+		if (nested) {
+			const refusal = hostToolRefusal(nested.scope, toolName);
+			if (refusal) throw hostDeniedError(toolName, nested.callId, refusal);
+		}
 		const bag = nested?.pendingTools ?? pendingTools;
 		const callId = `js-${crypto.randomUUID()}`;
 		const promise = new Promise((resolve, reject) => bag.set(callId, { resolve, reject }));

package/src/kernels/js/worker-indirect-eval.js

@@ -1,3 +1,5 @@
+import { findShadowedGlobalName } from "./worker-shadow-guard.js";
+
 export function indirectEval(source, filename) {
 	const withPragma = filename ? `${source}\n//# sourceURL=${filename}` : source;
 	const geval = globalThis.eval;
@@ -265,6 +267,12 @@ function rewriteDeclaration(code, declarationStart, start, end, keyword) {
 		const bindings = [];
 		collectPatternNames(pattern, bindings);
 		if (bindings.length === 0) return undefined;
+		const shadowed = findShadowedGlobalName(bindings);
+		if (shadowed !== undefined) {
+			throw new Error(
+				`eval cell declares top-level \`${shadowed}\`, but a global with that name already exists in the JS kernel. Persisting it would replace that global for every later cell. Rename the binding (for example \`${shadowed}Local\`), or assign globalThis.${shadowed} explicitly if replacing it is truly intended.`,
+			);
+		}
 		if (preserveDeclaration) {
 			for (const name of bindings) assignments.push(`globalThis[${JSON.stringify(name)}] = ${name};`);
 			continue;

package/src/kernels/js/worker-shadow-guard.js

@@ -0,0 +1,21 @@
+// Snapshot is lazy on purpose: the first guard call is the first cell's
+// transform, when prelude globals exist but no cell-created global does.
+// A module-level snapshot would miss prelude globals; re-snapshotting later
+// would wrongly protect cell-created names that must stay re-declarable.
+
+let protectedGlobalNames;
+
+function protectedGlobals() {
+	if (protectedGlobalNames === undefined) {
+		protectedGlobalNames = new Set(Object.getOwnPropertyNames(globalThis));
+	}
+	return protectedGlobalNames;
+}
+
+export function findShadowedGlobalName(bindings) {
+	const names = protectedGlobals();
+	for (const name of bindings) {
+		if (names.has(name)) return name;
+	}
+	return undefined;
+}

package/src/kernels/py/kernel.ts

@@ -1,4 +1,5 @@
 import type { KernelInterruptHandle } from "../../tool/types.ts";
+import type { KernelToolsInvokeOptions } from "../js/kernel-tools-types.ts";
 import { rejectKernelToolsUnavailable } from "../kernel-tools-unavailable.ts";
 import type { PendingRun, PythonKernelRunOptions, PythonKernelStartOptions, ResultMessage } from "./kernel-contract.ts";
 import { failedPythonResult, PythonKernelTransport } from "./transport.ts";
@@ -40,7 +41,7 @@ export class PythonKernel {
 		return rejectKernelToolsUnavailable();
 	}
 
-	invokeKernelTool(_request: unknown, _signal?: AbortSignal): Promise<never> {
+	invokeKernelTool(_request: unknown, _options?: AbortSignal | KernelToolsInvokeOptions): Promise<never> {
 		return rejectKernelToolsUnavailable();
 	}
 

package/src/kernels/shared/subprocess-kernel.ts

@@ -1,6 +1,7 @@
 import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
 import { decodeBridgeFrame, encodeBridgeFrame, isKernelToHostMessage } from "../../bridge/protocol.ts";
 import type { KernelInterruptHandle } from "../../tool/types.ts";
+import type { KernelToolsInvokeOptions } from "../js/kernel-tools-types.ts";
 import { rejectKernelToolsUnavailable } from "../kernel-tools-unavailable.ts";
 import { applySessionEnvironment } from "../session-env.ts";
 import type { KernelResult, KernelRunInput, SubprocessKernelOptions, ToolCallMessage } from "./subprocess-contract.ts";
@@ -78,7 +79,7 @@ export class SubprocessKernel {
 		return rejectKernelToolsUnavailable();
 	}
 
-	invokeKernelTool(_request: unknown, _signal?: AbortSignal): Promise<never> {
+	invokeKernelTool(_request: unknown, _options?: AbortSignal | KernelToolsInvokeOptions): Promise<never> {
 		return rejectKernelToolsUnavailable();
 	}
 

package/src/tool/cell-handler.ts

@@ -1,4 +1,9 @@
-import { type AgentToolResult, type ExtensionContext, sanitizeTerminalLabel } from "@code-yeongyu/senpi";
+import {
+	type AgentToolResult,
+	type ExtensionContext,
+	kernelToolsStorage,
+	sanitizeTerminalLabel,
+} from "@code-yeongyu/senpi";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
 import { RESERVED_SCHEMA_TOOL } from "../bridge/reserved.ts";
 import type { AgentExecuteTool } from "../bridges/agent-bridge.ts";
@@ -8,6 +13,7 @@ import { appendSchemaHint } from "../bridges/schema-hint.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
 import { handleCompletionToolCall } from "../completion/tool-bridge.ts";
 import type { ResolvedCodemodeSettings } from "../config/settings.ts";
+import type { KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
 import {
 	boundToolCallArgs,
 	capCodePoints,
@@ -39,6 +45,8 @@ export interface CellBridgeRuntime {
 	readonly ctx: ExtensionContext;
 	readonly artifactPath?: string;
 	readonly imageResizer?: EvalImageResizer;
+	/** This cell's live kernel-tool capability; only a JS kernel has one (#1754). */
+	readonly kernelTools?: KernelToolsCapability;
 }
 
 export class CellHandler {
@@ -81,7 +89,7 @@ export class CellHandler {
 				this.#resultBuilder.display(message);
 				return;
 			case "tool-call": {
-				const pending = this.#handleToolCall(message);
+				const pending = this.#dispatchToolCall(message);
 				this.#state.pendingBridgeCalls.push(pending);
 				await pending;
 				return;
@@ -114,6 +122,19 @@ export class CellHandler {
 		return this.#resultBuilder.liveResult();
 	}
 
+	/**
+	 * The worker's message loop fires outside the async context `run-eval-cell.ts` enters around the
+	 * awaited run chain, so the capability has to be entered here — around the whole dispatch, including
+	 * the reserved agent()/output() bridges where a host task tool resolves the parent's kernel tools —
+	 * for exactly the duration of each host tool call this cell makes (#1754). Without a capability
+	 * (py/rb/jl) the store stays empty and `ctx.kernelTools` remains undefined.
+	 */
+	async #dispatchToolCall(message: Extract<KernelToHostMessage, { type: "tool-call" }>): Promise<void> {
+		const kernelTools = this.#runtime.kernelTools;
+		if (kernelTools === undefined) return await this.#handleToolCall(message);
+		return await kernelToolsStorage.run(kernelTools, async () => await this.#handleToolCall(message));
+	}
+
 	async #handleToolCall(message: Extract<KernelToHostMessage, { type: "tool-call" }>): Promise<void> {
 		const startedAt = Date.now();
 		const metric = createToolCallMetric(message.toolName, startedAt);

package/src/tool/run-eval-cell.ts

@@ -1,8 +1,17 @@
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { type AgentToolResult, type ExtensionContext, kernelToolsStorage } from "@code-yeongyu/senpi";
+import {
+	type AgentToolResult,
+	type ExtensionContext,
+	type ExtensionKernelTools,
+	kernelToolsStorage,
+} from "@code-yeongyu/senpi";
 import { DEFAULT_FOREGROUND_WINDOW_SECONDS, defaultCodemodeSettings } from "../config/settings.ts";
-import type { KernelToolsCapability } from "../kernels/js/kernel-tools-types.ts";
+import {
+	KERNEL_TOOLS_CAPABILITIES,
+	type KernelToolsCapability,
+	type KernelToolsDescribeResult,
+} from "../kernels/js/kernel-tools-types.ts";
 import { TIMEOUT_PAUSE_OP, TIMEOUT_RESUME_OP } from "../timeouts/bridge-timeout.ts";
 import { abortError, CellExecution, defaultTimeoutFactory } from "./cell-execution.ts";
 import { CellHandler, type CellState } from "./cell-handler.ts";
@@ -167,6 +176,9 @@ async function executeCell(
 				void pending.catch((error: unknown) => execution.cancel(error));
 			}),
 		);
+		// Computed before the handler so the cell's capability can be entered per host tool call from the
+		// worker's message loop, which runs outside the `kernelToolsStorage.run` context below (#1754).
+		const kernelTools = jsKernelTools(kernel, invocation.input.language);
 		const runBound = async (): Promise<AgentToolResult<EvalToolDetails>> => {
 			execution.setKernel(kernel);
 			const activeHandler = new CellHandler(kernel, state, {
@@ -179,6 +191,7 @@ async function executeCell(
 					? {}
 					: { artifactPath: join(options.artifactsDir, `eval-${randomUUID()}.log`) }),
 				...(options.imageResizer === undefined ? {} : { imageResizer: options.imageResizer }),
+				...(kernelTools === undefined ? {} : { kernelTools }),
 			});
 			handler = activeHandler;
 			cellManager.markRunning(
@@ -198,7 +211,6 @@ async function executeCell(
 				await execution.wait(Promise.all(state.pendingBridgeCalls));
 			return await handler.finalize(result);
 		};
-		const kernelTools = jsKernelTools(kernel, invocation.input.language);
 		return kernelTools ? await kernelToolsStorage.run(kernelTools, runBound) : await runBound();
 	} catch (error) {
 		if (handler && error instanceof Error && error.name === "CodemodeSessionDisposedError")
@@ -217,11 +229,12 @@ function jsKernelTools(kernel: EvalKernel, language: string): KernelToolsCapabil
 	if (language !== "js") return undefined;
 	if (!("describeKernelTools" in kernel) || typeof kernel.describeKernelTools !== "function") return undefined;
 	const js = kernel as EvalKernel & {
-		describeKernelTools: KernelToolsCapability["describe"];
-		invokeKernelTool: KernelToolsCapability["invoke"];
+		describeKernelTools: (names: readonly string[]) => Promise<KernelToolsDescribeResult>;
+		invokeKernelTool: ExtensionKernelTools["invoke"];
 	};
 	return {
+		capabilities: KERNEL_TOOLS_CAPABILITIES,
 		describe: (names) => js.describeKernelTools(names),
-		invoke: (request, signal) => js.invokeKernelTool(request, signal),
-	};
+		invoke: (request, options) => js.invokeKernelTool(request, options),
+	} satisfies ExtensionKernelTools;
 }